- syslog-ng - lists.balabit.hu

[patch] Fix build with --disable-ssl
by Joe Shaw 09 Feb '09

09 Feb '09

Hi, Here's a patch to fix building without SSL. Without it, tlstransport.h is included by tlstransport.c and things break because SSLisms are undefined. Thanks, Joe

3 8

Cannot compile loggen
by fredzy padzy 09 Feb '09

09 Feb '09

Hi everyone ! Ok, i'm quite ashamed to ask this ... but i'm not very good in compiling, and i'm sure it must be easy to solve But i do not succeed ! I discovered that php-syslog-ng provide loggen, written by bazsi. I need this tool since i must benchmark my syslog-ng server. The problem is that our customized version of this OS lacks a lot of librairies and i cannot compile loggen ( FI, i use a pkg of syslog-ng for solaris, since i couldn't compile it, because of too many librairies that where missing) i tried to compil loggen, but didn't succeed :( I tried a simple "gcc loggen.c -o loggen" and i was told : loggen.c:1:20 config.h:No such file or dorectory In which package should i find this config.h file ? because a lot of other tools (like perl) have one The make command give me another error like it doesn't find any "../../ configure.in" which is normal i think. How did you guys managed to compil it ? thanks in advance :)

1 0

Compile 3.0.1 on RHEL 5 with sql support
by Henk van Lingen 09 Feb '09

09 Feb '09

Hi, I'm new to syslog-ng and I'm trying to compile 3.0.1 on a RHEL 5.3 system. I want to use the log to PostgreSQL features so I'm trying to enable sql support. For this I've installed the libdbi packages: root@:~-# yum list '*libdbi*' Loaded plugins: rhnplugin, security Installed Packages libdbi.i386 0.8.1-2.1 installed libdbi.x86_64 0.8.1-2.1 installed libdbi-dbd-pgsql.x86_64 0.8.1a-1.2.2 installed libdbi-devel.i386 0.8.1-2.1 installed libdbi-devel.x86_64 0.8.1-2.1 installed libdbi-drivers.x86_64 0.8.1a-1.2.2 installed However, a configure gives: SQL support : no And a "./configure --enable-dynamic-linking --enable-sql" gives a /home/henk/syslog-ng-3.0.1/src/afsql.c:672: undefined reference to `dbi_initialize' in the make phase. Any ideas what or which lib I am missing? BTW: a configure without --enable-dynamic-linking gives a configure: error: static OpenSSL libraries not found (libssl.a and libcrypto.a) although I have those files both in /usr/lib and /usr/lib64 I have PKG_CONFIG_PATH=/usr/local/lib/pkgconfig, as is needed for eventlog. Regards, -- Henk van Lingen, (o- -+ Netwerk & Telefonie, ICT Service Center /\ | Jenalaan 18a, kamer 1.40 v_/_ http://henk.vanlingen.net/ http://www.tuxtown.net/netiquette/

3 3

Issue installing syslog-ng 3.0.1 on debian etch
by steven 06 Feb '09

06 Feb '09

Hi there I'm actually struggling. 'Configure' is doing fine, but 'make' always drops me at : if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT logmatcher.o -MD -MP -MF ".deps/logmatcher.Tpo" -c -o logmatcher.o logmatcher.c; \ then mv -f ".deps/logmatcher.Tpo" ".deps/logmatcher.Po"; else rm -f ".deps/logmatcher.Tpo"; exit 1; fi logmatcher.c: In function 'log_matcher_pcre_re_compile': logmatcher.c:509: error: 'PCRE_NEWLINE_ANYCRLF' undeclared (first use in this function) logmatcher.c:509: error: (Each undeclared identifier is reported only once logmatcher.c:509: error: for each function it appears in.) make[3]: *** [logmatcher.o] Error 1 make[3]: Leaving directory `/home/swn/syslog-ng-3.0.1/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/swn/syslog-ng-3.0.1' make[1]: *** [all] Error 2 make[1]: Leaving directory `/home/swn/syslog-ng-3.0.1' make: *** [build-stamp] Error 2 I tried on both i386 and amd64 architecture. If needed I can provide my config.log. Evtlog, libnet1 and libwrap* are installed. Oh yes, and of course this happens only when I --enable-pcre. Otherwise it compiles perfectly. Any ideas ? Thank you very much Steven

2 2

Re: [syslog-ng] [patch] log messages duplicated with syslog-ng version 3.0.1
by chris packham 06 Feb '09

06 Feb '09

OK thanks Bazsi. We'll pull down your changes. I must have missed the earlier message. >>> Balazs Scheidler <bazsi(a)balabit.hu> 02/05/09 11:11 PM >>> On Mon, 2009-02-02 at 11:18 +1300, chris packham wrote: > Hi, > > We were looking at migrating our system to use syslog-ng 3.0.1 and found that with our configuration we ended up with duplicated log messages. After some investigation this turned out to be a problem in the way templates were compiled. > > Attached is a patch that addresses this. you are right, but the same issue was reported the Peter Eckel. I've fixed this as a reply to his message, and also pushed a similar patch: commit 60aeab750e952b3a69714ea47e2aa31683c761fd Author: Balazs Scheidler <bazsi(a)balabit.hu> Date: Thu Feb 5 10:50:45 2009 +0100 fixed the references for non-inline templates this patch fixes template expansion for non-inline templates. The parser code caused these templates to be compiled as many times as they were referenced, which in turn concatenated the previously compiled value and the currently compiled value. -- Bazsi ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

1 0

1st post on some basic 101 setup
by lance raymond 05 Feb '09

05 Feb '09

Basic scenario is we have 5 web servers in a cluster which I wish to centrally log. I was pointed to syslog-ng and the linuxquestions guys 50+ readings and not 1 response so found this list and will give it a try. Basically all the webservers are running FC5, and rpm -qa shows the following version; syslog-ng-1.6.12-1.fc5 I see some newer versions, not sure if I should/have to, but really just want to log the different vhosts apache logs to a central server. I read a few diff things a few places, and so far have the following conf files. *Server.conf* options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination send_http_logs { file("/var/log/web.log"); }; filter send_http_logs { program("httpd.*"); }; log { source(s_sys); filter(send_http_logs); destination(send_http_logs); }; *Client.conf* options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; destination send_http_logs { udp("192.168.2.54" port(514)); }; filter send_http_logs { program("httpd.*"); }; log { source(s_sys); filter(send_http_logs); destination(send_http_logs); }; I restart the services and look for that web.log file and never see anything, so any help is appreciated.

2 2

syslog-ng +bash history
by Marcin Niskiewicz 05 Feb '09

05 Feb '09

Hello Everything that is written by users on console (my system is gentoo) is logged in 3 different files (debug , syslog, messages) ... I'd like to route all history logs to one file only... i made a filter and it works fine (it writes history to history.log) but still it writes it to those 3 files (debug , syslog, messages) as well ... so now everything I type is written to 4 files (debug , syslog, messages and history.log) ... is there possibility to configure syslog-ng to log history only to one file (for example history.log) and leave others files clean? best regards nichu My standard configuration (with my modifiication to route history to history.log) looks like this: # Copyright 2005 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo.hardened,v 1.5 2007/10/30 17:16:15 solar Exp $ # # Syslog-ng configuration file, compatible with default hardened installations. # options { chain_hostnames(off); sync(0); stats(43200); }; source src { unix-stream("/dev/log"); internal(); }; source kernsrc { file("/proc/kmsg"); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); file("/dev/tty12"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination mail { file("/var/log/mail/mail.log"); }; destination avc { file("/var/log/avc.log"); }; destination audit { file("/var/log/audit.log"); }; destination pax { file("/var/log/pax.log"); }; destination grsec { file("/var/log/grsec.log"); }; destination historia { file("/var/log/history.log"); }; destination mailinfo { file("/var/log/mail/mail.info"); }; destination mailwarn { file("/var/log/mail/mail.warn"); }; destination mailerr { file("/var/log/mail/mail.err"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; destination xconsole { pipe("/dev/xconsole"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_avc { match(".*avc: .*"); }; filter f_audit { match("^audit.*") and not match(".*avc: .*"); }; filter f_pax { match("^PAX:.*"); }; filter f_grsec { match("^grsec:.*"); }; filter f_history { match(".*HISTORY*"); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(kernsrc); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_history); destination(history); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); };

2 3

Postgres database questions
by Liam Kirsher 05 Feb '09

05 Feb '09

Hi -- I'm considering using syslog-ng to log to a postgres database, and just wanted to make sure I could do what I want to do before I spend a lot of time discovering that I can't. So, some of these questions probably have obvious answers. The client and loghost systems are running CentOS 5.2, which comes with syslog-ng v. 1.6. I believe I will need to upgrade to syslog-ng 3.0 (OSE) to use the database logging functionality. Correct? I noticed there was a recent message regarding difficulty compiling on CentOS 5.2 -- I hope this is not a problem. It looked like the suggested fix *should* have worked. I just don't want to end up in the syslog-ng Heartbreak Hotel! The only examples of database logging to Postgres I could find were to log the entire message, and/or were for older versions of syslog-ng. What I want to do is break the message up into columns and just log those columns. Reading the documentation, it seems like what I need to do is create a parser which will split the message up as desired. From there, I should be able to log to a database table with the desired fields. Right? Is this the correct approach, and are there any examples of how to do this, other than the cursory descriptions in the documentation? Thanks, Liam -- Liam Kirsher PGP: http://liam.numenet.com/pgp/

2 1

syslog-ng vs. SEC problems after upgrading to 2.1.3
by Jyri Hovila 05 Feb '09

05 Feb '09

Hi everyone! I've been running syslog-ng and SEC (Simple Event Correlator, http://www.estpak.ee/~risto/sec/) on several Arch Linux (www.archlinux.org) servers for few years now. After upgrading to syslog-ng 2.1.3 things suddenly stopped working on all five servers with identical configuration. Here's what's going on: The syslog-ng part of the deal goes like this (from /etc/syslog- ng.conf): destination d_sec { program("/usr/bin/perl /usr/share/sec/sec.pl - input=\"-\" -conf=/usr/local/etc/sec.conf"); }; log { source(src); destination(d_sec); }; This setup has been working fine all these years; it's been sending all incoming syslog messages to SEC, which has been parsing the messages just fine. After upgrading to syslog-ng 2.1.3, SEC stopped receiving anything from syslog-ng. These messages are being logged to /var/log/everything every 10 minutes: Jan 28 13:36:14 2 syslog-ng[19411]: Log statistics; dropped='program(/ usr/bin/perl /usr/share/sec/sec.pl -input="-" -conf=/usr/local/etc/ sec.conf)=0', processed='center(queued)=255119', processed='center(received)=123603', processed='destination(d_sec)=123603', processed='destination(acpid)=0', processed='destination(console)=0', processed='destination(debug)=0', processed='destination(mail)=5485', processed='destination(user)=309', processed='destination(uucp)=0', processed='destination(messages)=1163', processed='destination(ppp)=0', processed='destination(news)=0', processed='destination(iptables)=92399', processed='destination(everything)=6778', processed='destination(lpr)=0', processed='destination(cron)=0', processed='destination(syslog)=123', processed='destination(authlog)=24426', processed='destination(errors)=5', processed='destination(kernel)=147', processed='destination(daemon)=681', processed='destination(console_all)=0', processed='source(src)=123603', suppressed='program(/usr/bin/perl /usr/ share/sec/sec.pl -input="-" -conf=/usr/local/etc/sec.conf)=0' ps aux tells me that SEC is running fine, but it seems syslog-ng doesn't want to speak to it properly. I have no idea where to go from here. Any tips, anyone? Thanks in advance! Yours, Jyri

2 1

Getting warnings while building syslog-ng-2.1.3 on HP-UX ITA64
by Chanchal Verma 05 Feb '09

05 Feb '09

Hi, I am trying to build syslog-ng-2.1.3 on HP-UX Itenium (64-bit) box. I am doing '--enable-dynamic-linking' and it is giving following warning messages while 'make'. ************************Warning messages during 'make' ******************* .. .. gcc -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -lcl -o loggen loggen.o -lnsl -lrt -ll -L/usr/local/lib/hpux32 -lglib-2.0 -lintl -liconv -L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib -levtlog -lwrap ld: (Warning) Unsatisfied symbol "yyleng" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylenguc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyinput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyunput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyolsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytext" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyoutput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextuc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyextra" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyfnd" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyprevious" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylex" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyout" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "deny_severity" in file /usr/lib/hpux32/libwrap.so ld: (Warning) Unsatisfied symbol "allow_severity" in file /usr/lib/hpux32/libwrap.so ld: (Warning) Unsatisfied symbol "yylstate" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextarr" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyback" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "rfc931_timeout" in file /usr/lib/hpux32/libwrap.so 20 warnings. ******************************************************************************* It is giving me similar error message while running syslog-nd daemon and fail. I have installed flex to get rid of libl.so but no success. # swlist |grep -i flex flex 2.5.4a flex # gcc -v Using built-in specs. Target: ia64-hp-hpux11.31 Configured with: ../gcc/configure Thread model: posix gcc version 4.2.3 Here is configure result: ================================ syslog-ng Open Source Edition 2.1.3 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -I/usr/local/include/glib-2.0 -I/usr/local/lib/hpux32/glib-2.0/include -I/opt/soe/local/syslog-ng-2.1.3/eventlog/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -lcl -lnsl -lrt -ll -L/usr/local/lib/hpux32 -lglib-2.0 -lintl -liconv -L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib -levtlog -lwrap prefix : /opt/soe/local/syslog-ng-2.1.3 Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : yes SQL support : no ================================ Any help will be highly appreciated. -- Chanchal

2 1