- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Writing to a named Pipe
by Pedro Rafael Alves Simoes 05 Feb '09

05 Feb '09

The patch worked. Is there any way to create the pipes on the fly? Date: Thu, 22 Jan 2009 19:39:48 +0100 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] Writing to a named Pipe To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1232649588.15998.177.camel(a)bzorp.balabit> Content-Type: text/plain On Thu, 2009-01-22 at 15:26 +0000, Pedro Rafael Alves Simoes wrote: > Hello, > > In my syslog-ng configuration I'm writing messages to named pipes > which name is given dynamically by the $PRI macro: > > destination d_test { > pipe("/tmp/$PRI.log"); > }; > > All the possible PRI.log pipes were created previously with mkfifo. > > With this configuration the messages aren't being written to the > pipes. It simply does nothing. Doing a strace on the syslog-ng > process, it shows an error : > > open("/tmp/$PRI.log", O_RDWR|O_NONBLOCK|O_NOCTTY|O_LARGEFILE) = -1 > ENOENT (No such file or directory) > > It seems that the PRI macro isn't being interpolated in the string. well, the pipe() driver does not support macros, thus it uses the string literally. More exactly the pipe driver explicitly disallows that. Since I don't remember exactly why I did this, here's a patch that removes the restriction. Please let me know how it works out for you, if it seems to work, I'm also willing to integrate it. Patch is against OSE 3.0, but is trivial to backport to 2.1 diff --git a/src/cfg-grammar.y b/src/cfg-grammar.y index 761bb56..fdfa18f 100644 --- a/src/cfg-grammar.y +++ b/src/cfg-grammar.y @@ -801,7 +801,7 @@ dest_afpipe dest_afpipe_params : string { - last_driver = affile_dd_new($1, AFFILE_NO_EXPAND | AFFILE_PIPE); + last_driver = affile_dd_new($1, AFFILE_PIPE); free($1); last_writer_options = &((AFFileDestDriver *) last_driver)->writer_options; last_writer_options->flush_lines = 0; -- Bazsi

3 3

Re: [syslog-ng] filter killing logging
by Len Conrad 03 Feb '09

03 Feb '09

>the log statement below works > >the #log statement logs nothing > >source src { unix-dgram("/var/run/log"); > unix-dgram("/var/run/logpriv" perm(0640)); > tcp(); > udp(); > internal(); > file("/dev/klog"); > }; > >### smtp postfix > >filter f_mail { facility(mail); }; > >filter f_postfix {match (" postfix"); }; > >destination d_postfix { file("/var/log/$HOST/maillog"); }; > >log { source (src) ; filter (f_mail); filter(f_m_info); destination (d_postfix); }; > >#log { source (src) ; filter (f_mail); filter(f_m_info); filter (f_postfix); destination (d_postfix); }; > >Thanks >Len Sorry about previous msg's null subject and missing version syslog-ng -V syslog-ng 2.0.9 (from FreeBSD pkg, not ver 3 yet) I enabled the postfix, imap3d, sasl, pop3d logging by trimming the trailing/leading spaces of " string " in the filter definitions. huh? Len

1 0

[Bug 31] New: sources are opened after dropping capabilities which prevents opening some
by bugzilla＠bugzilla.balabit.com 03 Feb '09

03 Feb '09

https://bugzilla.balabit.com/show_bug.cgi?id=31 Summary: sources are opened after dropping capabilities which prevents opening some Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: regression Estimated Hours: 0.0 mkdir /test/ mkfifo /test/fifo chmod 0 /test and use pipe('/test/fifo') as source. syslog-ng 3.0.1 will fail with permission denied because it can't access /test/fifo due to dropped capabilities. This is real example from Linux Vserver based system where /vservers has always 0 permission. The solution would be probably to not drop some caps until sources are opened. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

(no subject)
by Len Conrad 03 Feb '09

03 Feb '09

the log statement below works the #log statement logs nothing source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0640)); tcp(); udp(); internal(); file("/dev/klog"); }; ### smtp postfix filter f_mail { facility(mail); }; filter f_postfix {match (" postfix"); }; destination d_postfix { file("/var/log/$HOST/maillog"); }; log { source (src) ; filter (f_mail); filter(f_m_info); destination (d_postfix); }; #log { source (src) ; filter (f_mail); filter(f_m_info); filter (f_postfix); destination (d_postfix); }; Thanks Len

1 0

loggen
by nexact 03 Feb '09

03 Feb '09

Hello, I'm looking for 'loggen' utility to benchmark my current infrastructure, I can't find it in the website download section... Anyone could help me ? Thanks.

3 2

Getting warnings while building syslog-ng-2.1.3 on HP-UX ITA64
by Chanchal Verma 03 Feb '09

03 Feb '09

Hi, I am trying to build syslog-ng-2.1.3 on HP-UX Itenium (64-bit) box. I am doing '--enable-dynamic-linking' and it is giving following warning messages while 'make'. ************************Warning messages during 'make' ******************* .. .. gcc -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -lcl -o loggen loggen.o -lnsl -lrt -ll -L/usr/local/lib/hpux32 -lglib-2.0 -lintl -liconv -L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib -levtlog -lwrap ld: (Warning) Unsatisfied symbol "yyleng" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylenguc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyinput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyunput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyolsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytext" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyoutput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextuc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyextra" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyfnd" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyprevious" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylex" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyout" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "deny_severity" in file /usr/lib/hpux32/libwrap.so ld: (Warning) Unsatisfied symbol "allow_severity" in file /usr/lib/hpux32/libwrap.so ld: (Warning) Unsatisfied symbol "yylstate" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextarr" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyback" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "rfc931_timeout" in file /usr/lib/hpux32/libwrap.so 20 warnings. ******************************************************************************* It is giving me similar error message while running syslog-nd daemon and fail. I have installed flex to get rid of libl.so but no success. # swlist |grep -i flex flex 2.5.4a flex # gcc -v Using built-in specs. Target: ia64-hp-hpux11.31 Configured with: ../gcc/configure Thread model: posix gcc version 4.2.3 Here is configure result: ================================ syslog-ng Open Source Edition 2.1.3 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -I/usr/local/include/glib-2.0 -I/usr/local/lib/hpux32/glib-2.0/include -I/opt/soe/local/syslog-ng-2.1.3/eventlog/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -lcl -lnsl -lrt -ll -L/usr/local/lib/hpux32 -lglib-2.0 -lintl -liconv -L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib -levtlog -lwrap prefix : /opt/soe/local/syslog-ng-2.1.3 Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : yes SQL support : no ================================ Any help will be highly appreciated. -- Chanchal

1 0

[Bug 29] New: syslog-ng segfault when HUP signal arrives
by bugzilla＠bugzilla.balabit.com 02 Feb '09

02 Feb '09

https://bugzilla.balabit.com/show_bug.cgi?id=29 Summary: syslog-ng segfault when HUP signal arrives Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 If there are two udp driver in the config file syslog-ng will segfault when a HUP signal arrive. Example config: source s_network_1 { udp(); }; source s_network { udp(); }; I know that this is not a valid config, but the segfault is not the humble way to tell me. :) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Errors compiling syslog-ng from source on Centos 5.2
by Ezra Taylor 02 Feb '09

02 Feb '09

All: I'm having problems installing syslog-ng-2.1.1 from source on Centos 5.2. I installed eventlog successfully. Eventlog is located at /usr/local/eventlog. My configure script is below. Note, make is failing. The output is below. ./configure EVTLOG_CFLAGS=/usr/local/eventlog/include EVTLOG_LIBS=/usr/local/eventlog/lib. syslog-ng Open Source Edition 2.1.1 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include /usr/local/eventlog/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -lnsl -lrt -lfl -L/lib64 -lglib-2.0 /usr/local/eventlog/lib -lwrap prefix : /usr/local Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : yes SQL support : no [etaylor@mytest syslog-ng-2.1.1]$ make make all-recursive make[1]: Entering directory `/home/etaylor/syslog-ng-2.1.1' Making all in src make[2]: Entering directory `/home/etaylor/syslog-ng-2.1.1/src' if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include /usr/local/eventlog/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT misc.o -MD -MP -MF ".deps/misc.Tpo" \ -c -o misc.o `test -f 'misc.c' || echo './'`misc.c; \ then mv -f ".deps/misc.Tpo" ".deps/misc.Po"; \ else rm -f ".deps/misc.Tpo"; exit 1; \ fi gcc: /usr/local/eventlog/include: linker input file unused because linking not done if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include /usr/local/eventlog/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT utils.o -MD -MP -MF ".deps/utils.Tpo" \ -c -o utils.o `test -f 'utils.c' || echo './'`utils.c; \ then mv -f ".deps/utils.Tpo" ".deps/utils.Po"; \ else rm -f ".deps/utils.Tpo"; exit 1; \ fi gcc: /usr/local/eventlog/include: linker input file unused because linking not done if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include /usr/local/eventlog/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT messages.o -MD -MP -MF ".deps/messages.Tpo" \ -c -o messages.o `test -f 'messages.c' || echo './'`messages.c; \ then mv -f ".deps/messages.Tpo" ".deps/messages.Po"; \ else rm -f ".deps/messages.Tpo"; exit 1; \ fi In file included from messages.c:24: messages.h:28:20: error: evtlog.h: No such file or directory In file included from messages.c:24: messages.h:54: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token messages.h:55: error: expected ')' before '*' token messages.c:41: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token messages.c: In function 'msg_send_internal_message': messages.c:47: error: 'EVT_PRI_WARNING' undeclared (first use in this function) messages.c:47: error: (Each undeclared identifier is reported only once messages.c:47: error: for each function it appears in.) messages.c: At top level: messages.c:63: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token messages.c:81: error: expected ')' before '*' token messages.c: In function 'msg_log_func': messages.c:99: error: 'EVT_PRI_INFO' undeclared (first use in this function) messages.c:102: error: 'EVT_PRI_DEBUG' undeclared (first use in this function) messages.c:104: error: 'EVT_PRI_WARNING' undeclared (first use in this function) messages.c:106: error: 'EVT_PRI_ERR' undeclared (first use in this function) messages.c:108: error: 'EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c: In function 'msg_init': messages.c:123: error: 'evt_context' undeclared (first use in this function) messages.c:123: warning: implicit declaration of function 'evt_ctx_init' messages.c:123: error: 'EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c: In function 'msg_deinit': messages.c:133: warning: implicit declaration of function 'evt_ctx_free' messages.c:133: error: 'evt_context' undeclared (first use in this function) make[2]: *** [messages.o] Error 1 make[2]: Leaving directory `/home/etaylor/syslog-ng-2.1.1/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/etaylor/syslog-ng-2.1.1' make: *** [all] Error 2 -- Ezra Taylor

2 2

syslog-ng Filter expression help
by cod3fr3ak 28 Jan '09

28 Jan '09

Is there anyway I can combine these filters into a single line per host? filter f_host-dns1 { host ("SVR006*") or host ("dns1*"); }; filter f_host-dns2 { host ("SVR015*") or host ("dns2*"); }; filter f_host-dns21 { host ("SVR138*") or host ("dns21*"); }; filter f_query-dns1 { filter (f_local0) and filter (f_host-dns1); }; filter f_query-dns2 { filter (f_local0) and filter (f_host-dns2); }; filter f_query-dns21 { filter (f_local0) and filter (f_host-dns21); }; I think I can but I am unsure of how syslog-ng handles ANDs and ORs

2 1

SSL compile errors even when configured without ssl support
by Chris Fabri 27 Jan '09

27 Jan '09

Greetings- I'm trying to compile syslog-ng 3.0.1 on RH 3 (yes, I know), and am unable to compile due to what appear to be openssl related errors: In file included from tlscontext.h:12, from tlscontext.c:1: /usr/include/openssl/ssl.h:909: syntax error before "KSSL_CTX" /usr/include/openssl/ssl.h:931: syntax error before '}' token Are the last set. However, I ran configure with "--disable-ssl." Reviewing some of the archives, it appears this was fixed in v3.0 back in Nov '08: https://lists.balabit.hu/pipermail/syslog-ng/2008-November/012234.html I've tried the 11202008 build just in case, and that didn't 'seem to resolve the problem. I really don't need SSL, so it would be much simpler to just skip the SSL part than try to get it working to get around this error. Various searches of the archives have mentioned that this was fixed a few other times, but I'm not having any luck. Help? :) chris

3 7