- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Error encountered while building syslog-ng-2.1.3 on RHEL3
by Chanchal Verma 12 Jan '09

12 Jan '09

Hi Kostyantyn, I have checked that all required static libraries (.a) are available at /usr/lib location. I also created linked at /usr/local/lib for all requried libraries. It is giving same error messages. Following libraries are checked available at /usr/lib: libnsl.a librt.a libfl.a libevtlog.a (Created linked from /opt/soe/local/syslog-ng-2.1.3/eventlog/lib/libevtlog.a) libnet.a libwrap.a Here below is error messages: ----------------------------------------------------------- Here below is error messge: Compilation option: [champ@ankit-lin syslog-ng-2.1.3]# ./configure --enable-static-linking --prefix=/opt/soe/local/syslog-ng-2.1.3 Make works fine uptill (Pasted last few lines): .. .. if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/opt/soe/local/ syslog-ng-2.1.3/eventlog/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -D_GNU_SOUR CE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT globals.o -MD -MP -MF ".deps/globals.Tpo" \ -c -o globals.o `test -f 'globals.c' || echo './'`globals.c; \ then mv -f ".deps/globals.Tpo" ".deps/globals.Po"; \ else rm -f ".deps/globals.Tpo"; exit 1; \ fi rm -f libsyslog-ng.a ar cru libsyslog-ng.a misc.o utils.o messages.o syslog-names.o cfg.o cfg-lex.o cfg-grammar.o macros.o filter.o logmsg.o l ogpipe.o logsource.o driver.o sgroup.o dgroup.o center.o templates.o logreader.o logwriter.o affile.o afstreams.o afuser. o afprog.o afsocket.o afunix.o afinet.o afinter.o children.o stats.o gsockaddr.o fdwrite.o fdread.o memtrace.o dnscache.o apphook.o serialize.o logqueue.o afsql.o alarms.o globals.o ranlib libsyslog-ng.a if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/opt/soe/local/ syslog-ng-2.1.3/eventlog/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -D_GNU_SOUR CE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT main.o -MD -MP -MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo './'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi gcc -g -O2 -Wall -o syslog-ng main.o libsyslog-ng.a -static -lnsl -lrt -lfl -L/usr/local/lib -lglib-2.0 -L/opt/soe /local/syslog-ng-2.1.3/eventlog/lib -levtlog -lnet -lwrap make[2]: Leaving directory `/home/soetest1/syslog-ng-2.1.3/src' make[1]: Leaving directory `/home/soetest1/syslog-ng-2.1.3' Showing error message on standard output device: main.o(.text+0x5ec): In function `setup_creds': /home/soetest1/syslog-ng-2.1.3/src/main.c:324: Using 'initgroups' in statically linked applications requires at runtime t he shared libraries from the glibc version used for linking libsyslog-ng.a(misc.o)(.text+0x44d): In function `resolve_group': /home/soetest1/syslog-ng-2.1.3/src/misc.c:283: Using 'getgrnam' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/lib/gcc-lib/i386-redhat-linux/3.2.3/../../../libwrap.a(options.o)(.text+0x53c): In function `group_option': : Using 'endgrent' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(misc.o)(.text+0x3ed): In function `resolve_user': /home/soetest1/syslog-ng-2.1.3/src/misc.c:258: Using 'getpwnam' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0xbd8): In function `g_get_any_init_do': /home/soetest1/glib-2.16.0/glib/gutils.c:1646: Using 'getpwuid' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0xbc8):/home/soetest1/glib-2.16.0/glib/gutils.c:1645: Using 'setpwent' in st atically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0xbe3):/home/soetest1/glib-2.16.0/glib/gutils.c:1647: Using 'endpwent' in st atically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0x9d1):/home/soetest1/glib-2.16.0/glib/gutils.c:1589: Using 'getpwnam_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0xa10):/home/soetest1/glib-2.16.0/glib/gutils.c:1595: Using 'getpwuid_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(afinet.o)(.text+0x163): In function `afinet_resolve_name': /home/soetest1/syslog-ng-2.1.3/src/afinet.c:103: Using 'getaddrinfo' in statically linked applications requires at runtim e the shared libraries from the glibc version used for linking libsyslog-ng.a(misc.o)(.text+0x1d1): In function `resolve_hostname': /home/soetest1/syslog-ng-2.1.3/src/misc.c:166: Using 'gethostbyaddr' in statically linked applications requires at runtim e the shared libraries from the glibc version used for linking libsyslog-ng.a(misc.o)(.text+0xbd): In function `getlonghostname': /home/soetest1/syslog-ng-2.1.3/src/misc.c:71: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/lib/gcc-lib/i386-redhat-linux/3.2.3/../../../libnet.a(libnet_resolve.o)(.text+0x4dc): In function `libnet_name2addr6 ': : Using 'gethostbyname2' in statically linked applications requires at runtime the shared libraries from the glibc versio n used for linking libsyslog-ng.a(afinet.o)(.text+0xb2): In function `afinet_set_port': /home/soetest1/syslog-ng-2.1.3/src/afinet.c:58: Using 'getservbyname' in statically linked applications requires at runti me the shared libraries from the glibc version used for linking /usr/lib/gcc-lib/i386-redhat-linux/3.2.3/../../../libwrap.a(hosts_access.o)(.text+0x862): In function `host_match': : undefined reference to `yp_get_default_domain' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 ---------------------------------------------------- With Regards, Chanchal Verma Kostyantyn Gushtin <kgushtin(a)n-ix.com.ua> 01/09/2009 06:08 PM To Chanchal Verma/GIS/CSC@CSC cc Subject Re: [syslog-ng] Error encountered while building syslog-ng-2.1.3 on RHEL3 Chanchal Verma wrote: Hi Kostyantyn, Yes my compilation with --enable-dynamic-linking option works fine. I am facing problem while doing static compilation. I have followed the given steps but still getting error while doing 'make'. I am not sure how to use 'glib' option for compilation, I have libglib-2.0.a in '/usr/lib'. Now you really have problems with glibc :) . glib is just abstraction (on unix systems it use glibc). gcc -g -O2 -Wall -o syslog-ng main.o libsyslog-ng.a -static -lnsl -lrt -lfl -L/usr/local/lib -lglib-2.0 -L/opt/soe /local/syslog-ng-2.1.3/eventlog/lib -levtlog -lnet -lwrap make[2]: Leaving directory `/home/soetest1/syslog-ng-2.1.3/src' make[1]: Leaving directory `/home/soetest1/syslog-ng-2.1.3' >From this command line you can retrieve info which static libraries you need (some of them are glibc libraries, some not ). So you must have thous libraries : libnsl.a (I saw linker error message that it can't find this library), librt.a, libfl.a, libevtlog.a, libnet.a, libwrap.a . Maybe you need to install glibc-devel package and/or others that contains such libraries. -- Kostyantyn Gushtin Software engineer Solutions for Your success http://www.n-ix.com

2 1

syslog-ng 3.0.1 has been released
by devel＠balabit.hu 12 Jan '09

12 Jan '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.1 SUMMARY : new stable release DATE : Jan 12, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new major version of syslog-ng Open Source Edition 3.0 has been released. The news and highlights of this version are summarized below. CHANGES: 3.0.1 Wed, 24 Dec 2008 12:16:08 +0100 NEWS: Communication: * Version 3.0 of syslog-ng supports the new syslog protocol standards developed by the Internet Engineering Task Force (IETF). The details of these protocols can be found at http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol-23.txt and http://www.ietf.org/internet-drafts/draft-ietf-syslog-transport-tls-11.txt. * The capability to encrypt log connections using TLS has been added. Configuration: * Log statements can be embedded into each other, making it possible to design complex log paths. That way for example the results of a filter can be sent to multiple destinations, or it can be sent to a destination unchanged, and partly rewritten for the other destination. Log files: * The encoding of source files can be set for proper character conversion (internally syslog-ng represents every message in UTF-8). Log messages: * The syslog-ng application assigns a unique message identification number to every log message, making it easy to detect if any messages are lost. * The syslog-ng application can read, process, and rewrite structured messages (e.g., Apache webserver logs) using templates and regular expressions. Both messages with fixed field sizes and fields separated with delimiters (e.g., comma-separated values) are supported. DOWNLOAD: This is a source code only release, no binary packages are available at this time. Those will be provided at a later date. The documentation of syslog-ng OSE 3.0, including the installation and user guides is available at: http://www.balabit.com/support/documentation/?product=syslog-ng Best Regards, BalaBit IT Security DOWNLOAD: You can download the latest source and binary packages of syslog-ng from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

Re: [syslog-ng] Host/IP Macros in relay chains
by Paul Robert Marino 10 Jan '09

10 Jan '09

I have one thing to add to this. I know this probably goes without saying but the reverse lookup should not be reliant on DNS. It should use the the systems native name resolution. I've often seen application programed to use only DNS for reverse resolution and in many of the secure environments I've worked in hosts files are used on loggers (also bastions, and firewalls) and DNS support is removed via the nsswhich.conf to make them impervious to DNS spoofing. DNS reliance is often a deal breaker on these hosts. -----Original Message----- From: Balazs Scheidler <bazsi(a)balabit.hu> Subj: Re: [syslog-ng] Host/IP Macros in relay chains Date: Fri Jan 9, 2009 1:09 pm Size: 1K To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> On Fri, 2009-01-09 at 10:46 +0000, Pennington, Philip wrote: > Sandor, > > > Thanks for your comments and useful suggestions. > > The requirement is somewhat complicated in that at a point along the > chain, I need to have the originating hostname for host filtering > purposes, whereas at the end of the chain, I need syslog-ng to present > the IP. That's why I began talking about reverse name resolution on the > last relay. well, with syslog-ng 3.0 and parse/rewrite you could probably encode all the needed information into the message payload and the change it back at the endpoints. see my blog about parse/rewrite capabilities: http://bazsi.blogs.balabit.com/2008/10/syslog-ng-message-parsing.html or the what's new document: http://www.balabit.com/dl/guides/syslog-ng-v3.0-guide-whatsnew-en.pdf the open source version of syslog-ng 3.0 is already released, although the official announcement is still due. -- Bazsi ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1

Host/IP Macros in relay chains
by Pennington, Philip 09 Jan '09

09 Jan '09

Question on Host/IP Macros in relay chains. Is there a way to present the original sender IP on a final relay in a chain of several relays ? With hostname, the FULLHOST and HOST macros are capable of doing this (with tuning of keep_hostname() and chain_hostnames() ) Their corresponding FULLHOST_FROM and HOST_FROM marcos exhibit the same behaviours as the SOURCEIP macro in the sense that they only provide the NAME/IP of the previous relay . I have read Michael Gehrmann's post " https://lists.balabit.hu/pipermail/syslog-ng/2004-November/006695.html " which discusses the compile time option "--enable-spoof-source" feature which spoofs the sourceip using UDP but this doesn't really help as I need to use tcp and retain the relay's source (firewalls in the chain). Presumably this setting would also be required on all members of the relay chain. I guess I am really looking for an alternative way to achieve similar effect to Michael's solution using the first (original) entry in the chain (rather than spoofing the last entry in the chain at all points through the chain) however to force an IP from the original sender's entry in the chain (Reverse/PTR DNS resolution perhaps ??). What HOST_FROM is-to HOST, SOURCEIP is-to what I want. Does anyone know whether this is currently possible (or pipeline development) ? Maybe in the premium version (although I can't see it documented there either)??? Thanks, Philip Excerpts from the syslog-ng-v2.0 admin guide (section 9.5 Macros) FULLHOST: The full FQDN of the host name chain (without trimming chained hosts), including the domain name. To use this macro, make sure that the keep_hostname() option is enabled. FULLHOST_FROM: FQDN of the host that sent the message to syslog-ng as resolved by syslogng using DNS. If the message traverses several hosts, this is the last host in the chain. To use this macro, make sure that the keep_hostname() option is enabled. HOST: The name of the source host where the message originates from. If the message traverses several hosts and the chain_hostnames() option is on, the first host in the chain is used. To use this macro, make sure that the keep_hostname() option is enabled. HOST_FROM: Name of the host that sent the message to syslog-ng, as resolved by syslogng using DNS. If the message traverses several hosts, this is the last host in the chain. To use this macro, make sure that the keep_hostname() option is enabled. SOURCEIP: IP address of the host that sent the message to syslog-ng. (I.e. the IP address of the host in the FULLHOST_FROM macro.) Please note that when a message traverses several relays, this macro contains the IP of the last relay. ============================================================================== Please access the attached hyperlink for an important electronic communications disclaimer: http://www.credit-suisse.com/legal/en/disclaimer_email_ib.html ==============================================================================

3 3

syslog-ng loses hostname information on some syslog logs sent via UDP
by D S, Manu (STSD) 09 Jan '09

09 Jan '09

Hi, I am running syslog-ng on a HP-UX server listening on UDP port 514. It is receiving logs from syslogd running on another server. For some messages syslog-ng does not log the hostname information found in the UDP packet. Rather, it mistakes some data in UDP as the hostname information. Here is the complete information. syslog-ng 2.0.9 on HP-UX. Syslogd on node01 sends logs to syslog-ng on node02. The logs in node02 are, Jan 9 11:55:11 node01 root: testing1 Jan 9 11:55:32 above message repeats 5 times Jan 9 11:55:32 node01 root: testing4 Notice that hostname is missing in the second message. tcpdump on UDP port 514 for the above logs 11:57:26.183996 00:30:6e:4b:26:37 (oui Unknown) > 00:30:6e:4a:32:44 (oui Unknown), ethertype IPv4 (0x0800), length 76: (tos 0x0, ttl 64, id 39220, offset 0, flags [DF], proto UDP (17), length 62) node01.xxx.com.57403 > node02.xxx.com.syslog: [udp sum ok] SYSLOG, length: 34 Facility user (1), Severity notice (5) Msg: Jan 9 11:55:11 root: testing1 0x0000: 3c31 333e 4a61 6e20 2039 2031 313a 3535 0x0010: 3a31 3120 726f 6f74 3a20 7465 7374 696e 0x0020: 6731 0x0000: 0030 6e4a 3244 0030 6e4b 2637 0800 4500 .0nJ2D.0nK&7..E. 0x0010: 003e 9934 4000 4011 3c2c 10b5 a1f0 10b5 .>.4@.@.<,...... 0x0020: a1f4 e03b 0202 002a a973 3c31 333e 4a61 ...;...*.s<13>Ja 0x0030: 6e20 2039 2031 313a 3535 3a31 3120 726f n..9.11:55:11.ro 0x0040: 6f74 3a20 7465 7374 696e 6731 ot:.testing1 11:57:26.185727 00:30:6e:4b:26:37 (oui Unknown) > 00:30:6e:4a:32:44 (oui Unknown), ethertype IPv4 (0x0800), length 92: (tos 0x0, ttl 64, id 39221, offset 0, flags [DF], proto UDP (17), length 78) node01.xxx.com.57403 > node02.xxx.com.syslog: [udp sum ok] SYSLOG, length: 50 Facility user (1), Severity notice (5) Msg: Jan 9 11:55:32 above message repeats 5 times 0x0000: 3c31 333e 4a61 6e20 2039 2031 313a 3535 0x0010: 3a33 3220 2061 626f 7665 206d 6573 7361 0x0020: 6765 2072 6570 6561 7473 2035 2074 696d 0x0030: 6573 0x0000: 0030 6e4a 3244 0030 6e4b 2637 0800 4500 .0nJ2D.0nK&7..E. 0x0010: 004e 9935 4000 4011 3c1b 10b5 a1f0 10b5 .N.5@.@.<....... 0x0020: a1f4 e03b 0202 003a b3b0 3c31 333e 4a61 ...;...:..<13>Ja 0x0030: 6e20 2039 2031 313a 3535 3a33 3220 2061 n..9.11:55:32..a 0x0040: 626f 7665 206d 6573 7361 6765 2072 6570 bove.message.rep 0x0050: 6561 7473 2035 2074 696d 6573 eats.5.times 11:57:26.186879 00:30:6e:4b:26:37 (oui Unknown) > 00:30:6e:4a:32:44 (oui Unknown), ethertype IPv4 (0x0800), length 76: (tos 0x0, ttl 64, id 39222, offset 0, flags [DF], proto UDP (17), length 62) node01.xxx.com.57403 > node02.xxx.com.syslog: [udp sum ok] SYSLOG, length: 34 Facility user (1), Severity notice (5) Msg: Jan 9 11:55:32 root: testing4 0x0000: 3c31 333e 4a61 6e20 2039 2031 313a 3535 0x0010: 3a33 3220 726f 6f74 3a20 7465 7374 696e 0x0020: 6734 0x0000: 0030 6e4a 3244 0030 6e4b 2637 0800 4500 .0nJ2D.0nK&7..E. 0x0010: 003e 9936 4000 4011 3c2a 10b5 a1f0 10b5 .>.6@.@.<*...... 0x0020: a1f4 e03b 0202 002a a86e 3c31 333e 4a61 ...;...*.n<13>Ja 0x0030: 6e20 2039 2031 313a 3535 3a33 3220 726f n..9.11:55:32.ro 0x0040: 6f74 3a20 7465 7374 696e 6734 ot:.testing4 When I change keep_hostname(yes) to keep_hostname(no) and add the chain_hostnames(yes) option I get the following logged. Jan 9 11:55:22 node01/node01 root: testing3 Jan 9 11:57:13 above/node01 message repeats 6 times Jan 9 11:57:13 node01/node01 root: testing8 I would say, syslog-ng is confusing 'above' as the hostname before rewriting hostname. The tcpdump for these logs are 11:59:06.362374 00:30:6e:4b:26:37 (oui Unknown) > 00:30:6e:4a:32:44 (oui Unknown), ethertype IPv4 (0x0800), length 76: (tos 0x0, ttl 64, id 39223, offset 0, flags [DF], proto UDP (17), length 62) node01.xxx.com.57403 > node02.xxx.com.syslog: [udp sum ok] SYSLOG, length: 34 Facility user (1), Severity notice (5) Msg: Jan 9 11:55:22 root: testing3 0x0000: 3c31 333e 4a61 6e20 2039 2031 313a 3535 0x0010: 3a32 3220 726f 6f74 3a20 7465 7374 696e 0x0020: 6733 0x0000: 0030 6e4a 3244 0030 6e4b 2637 0800 4500 .0nJ2D.0nK&7..E. 0x0010: 003e 9937 4000 4011 3c29 10b5 a1f0 10b5 .>.7@.@.<)...... 0x0020: a1f4 e03b 0202 002a a870 3c31 333e 4a61 ...;...*.p<13>Ja 0x0030: 6e20 2039 2031 313a 3535 3a32 3220 726f n..9.11:55:22.ro 0x0040: 6f74 3a20 7465 7374 696e 6733 ot:.testing3 11:59:06.364052 00:30:6e:4b:26:37 (oui Unknown) > 00:30:6e:4a:32:44 (oui Unknown), ethertype IPv4 (0x0800), length 92: (tos 0x0, ttl 64, id 39224, offset 0, flags [DF], proto UDP (17), length 78) node01.xxx.com.57403 > node02.xxx.com.syslog: [udp sum ok] SYSLOG, length: 50 Facility user (1), Severity notice (5) Msg: Jan 9 11:57:13 above message repeats 6 times 0x0000: 3c31 333e 4a61 6e20 2039 2031 313a 3537 0x0010: 3a31 3320 2061 626f 7665 206d 6573 7361 0x0020: 6765 2072 6570 6561 7473 2036 2074 696d 0x0030: 6573 0x0000: 0030 6e4a 3244 0030 6e4b 2637 0800 4500 .0nJ2D.0nK&7..E. 0x0010: 004e 9938 4000 4011 3c18 10b5 a1f0 10b5 .N.8@.@.<....... 0x0020: a1f4 e03b 0202 003a b2af 3c31 333e 4a61 ...;...:..<13>Ja 0x0030: 6e20 2039 2031 313a 3537 3a31 3320 2061 n..9.11:57:13..a 0x0040: 626f 7665 206d 6573 7361 6765 2072 6570 bove.message.rep 0x0050: 6561 7473 2036 2074 696d 6573 eats.6.times 11:59:06.364302 00:30:6e:4b:26:37 (oui Unknown) > 00:30:6e:4a:32:44 (oui Unknown), ethertype IPv4 (0x0800), length 76: (tos 0x0, ttl 64, id 39225, offset 0, flags [DF], proto UDP (17), length 62) node01.xxx.com.57403 > node02.xxx.com.syslog: [udp sum ok] SYSLOG, length: 34 Facility user (1), Severity notice (5) Msg: Jan 9 11:57:13 root: testing8 0x0000: 3c31 333e 4a61 6e20 2039 2031 313a 3537 0x0010: 3a31 3320 726f 6f74 3a20 7465 7374 696e 0x0020: 6738 0x0000: 0030 6e4a 3244 0030 6e4b 2637 0800 4500 .0nJ2D.0nK&7..E. 0x0010: 003e 9939 4000 4011 3c27 10b5 a1f0 10b5 .>.9@.@.<'...... 0x0020: a1f4 e03b 0202 002a a76a 3c31 333e 4a61 ...;...*.j<13>Ja 0x0030: 6e20 2039 2031 313a 3537 3a31 3320 726f n..9.11:57:13.ro 0x0040: 6f74 3a20 7465 7374 696e 6738 ot:.testing8 Is this a bug on how syslogd sends the message or is it a syslog-ng logging problem? Thanks, Manu P.S: Apologies for the long mail

3 2

Re: [syslog-ng] importing old syslog-ng messages
by Daniel L. Spells Sr. 08 Jan '09

08 Jan '09

Joe, I tried catting the whole file to a named pipe, and echoing one line at a time. Both methods do the same thing. Daniel On Mon, January 5, 2009 04:18, Fegan, Joe wrote: > Then I would guess that whatever method you are using to send the old log > files to syslog-ng is stripping the newline characters, making it look > like one gigantic message. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Daniel L. Spells > Sr. > Sent: 29 December 2008 15:59 > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] importing old syslog-ng messages > > > I have pushed that number to 90K, and get the same message, except the > "log_msg_size=XXXX" changes to the what ever value the XXXX is set to in > the log, and nothing is written the the database. > > > On Mon, December 29, 2008 05:36, Balazs Scheidler wrote: > >> On Tue, 2008-12-16 at 11:44 -0600, Daniel L. Spells Sr. wrote: >> >> >>> I am getting: >>> >>> >>> >>> "syslog-ng[18859]: Message length overflow, line is split, >>> log_msg_size=4096" >>> >>> When I try to cat the log files to the named pipe. It repeats until >>> it completes the lines in the log file. >>> >>> This is on a base install on a Suse box. >>> >>> >>> >>> >> >> the message above says that you have messages over 4096 bytes in >> length. increase log_msg_size(). >> >> -- >> Bazsi >> >> >> >> _______________________________________________________________________ >> __ >> _____ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.campin.net/syslog-ng/faq.html >> >> >> >> > > > _________________________________________________________________________ > _____ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > > > _________________________________________________________________________ > _____ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > > >

2 1

Syslog-NG Openssh RHEL 4
by Christopher Bland 08 Jan '09

08 Jan '09

Hi guys, Having a bit of trouble logging sshd messages to my host. Sshd logs fine using syslog but I get nothing using Syslog-NG. I tried changing the SyslogFacility to DAEMON in sshd_config and still nothing. I have the following lines in my config which should have caught something: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_local { file ("/proc/kmsg" log_prefix("kernel: ")); unix-dgram("/dev/log"); # unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); internal(); }; destination secure { file("/var/log/secure"); }; destination messages { file("/var/log/messages"); }; filter f_daemon { facility(daemon); }; filter f_authpriv { facility(auth, authpriv); }; log { source(s_local); filter(f_authpriv); destination(secure); }; log { source(s_local); filter(f_daemon); destination(messages); }; log { source(s_local); destination(loghost); }; My sshd config looks like this: Protocol 2 SyslogFacility AUTHPRIV PasswordAuthentication yes ChallengeResponseAuthentication no GSSAPIAuthentication yes GSSAPICleanupCredentials yes UsePAM yes AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL Subsystem sftp /usr/libexec/openssh/sftp-server Any help is apprciated -Chris

2 1

Message length
by G. Rayot 08 Jan '09

08 Jan '09

Hi! Using logger command, I'm trying to send long messages to syslog-ng. I'm aware that messages cannot be too long (UDP limitation). The problem is that logger doesn't just cut my log, it also remove some part of the log replacing it with the syslog header. Needless to say, this information is crucial to me. Is there a way to change this or must I change my log generation creating shorter logs ? Thanks. G.

3 3

bug in http://www.balabit.com/downloads/files/syslog-ng/sources/3.0.1/source/syslog-ng_3.0.1.tar.gz
by Joseph Pietras 08 Jan '09

08 Jan '09

There is, as far as I know, only a 1 character bug! (and it is missing a "!") The file is src/misc.c $ diff -c misc.c misc.c.orig *** misc.c 2008-12-30 12:12:36.000000000 -0600 --- misc.c.orig 2008-12-30 12:24:00.000000000 -0600 *************** *** 274,280 **** struct passwd *pw; *uid = 0; ! if (!*user) return FALSE; pw = getpwnam(user); --- 274,280 ---- struct passwd *pw; *uid = 0; ! if (*user) return FALSE; pw = getpwnam(user); Hope this helps, hope it gets to someone who can fix it, thanks for syslog-ng. -joseph This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the originator of the message. This footer also confirms that this e-mail message has been scanned for the presence of computer viruses. Any views expressed in this message are those of the individual sender, except where the sender specifies and with authority, states them to be the views of Iowa Student Loan.

2 1

Error encountered while building syslog-ng-2.1.3 on RHEL3
by Chanchal Verma 08 Jan '09

08 Jan '09

Hi, I am facing problem while builing syslog-ng-2.1.3 on RHEL3 operating system. Configuration goes fine but it shows error while doing 'make'. Here is details of configuration option: champ@localhost syslog-ng-2.1.3]# ./configure --enable-static-linking --prefix=/opt/soe/local/syslog-ng-2.1.3 EVTLOG_CFLAGS="-I/opt/soe/local/syslog-ng-2.1.3/eventlog/include/eventlog" EVTLOG_LIBS="-L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib" checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes . . . checking for EVTLOG... yes checking for LIBNET... yes checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... yes checking whether to enable spoof source support... yes checking whether to enable IPv6 support... yes checking whether to enable SQL support... no checking for pkg-config... (cached) /usr/local/bin/pkg-config checking pkg-config is at least version 0.14... yes checking for GLIB - version >= 2.4.0... yes (version 2.16.0) checking for static GLib libraries... yes checking sanity checking Glib headers... yes configure: creating ./config.status config.status: creating dist.conf config.status: creating Makefile config.status: creating syslog-ng.spec.bb config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating doc/docvars.xml config.status: creating contrib/Makefile config.status: creating tests/Makefile config.status: creating solbuild/Makefile config.status: creating tgzbuild/Makefile config.status: creating tests/unit/Makefile config.status: creating tests/functional/Makefile config.status: creating tests/loggen/Makefile config.status: creating config.h config.status: config.h is unchanged config.status: executing depfiles commands . . **************************************************************** While doing 'make' following error encountered: champ@localhost syslog-ng-2.1.3]#make (I have pasted last few lines of error message) . . libsyslog-ng.a(afinet.o)(.text+0x78a):/home/soetest1/syslog-ng-2.1.3/src/afinet.c:342: undefined reference to `evt_tag_str' libsyslog-ng.a(afinet.o)(.text+0xae7): In function `afinet_dd_queue': /home/soetest1/syslog-ng-2.1.3/src/afinet.c:522: undefined reference to `evt_tag_str' libsyslog-ng.a(stats.o)(.text+0xd3): In function `stats_register_counter': /home/soetest1/syslog-ng-2.1.3/src/stats.c:97: undefined reference to `evt_tag_str' libsyslog-ng.a(stats.o)(.text+0x1aa):/home/soetest1/syslog-ng-2.1.3/src/stats.c:140: more undefined references to `evt_tag_str' follow libsyslog-ng.a(stats.o)(.text+0x3a8): In function `stats_generate_log': /home/soetest1/syslog-ng-2.1.3/src/stats.c:230: undefined reference to `evt_tag_printf' libsyslog-ng.a(stats.o)(.text+0x3b2):/home/soetest1/syslog-ng-2.1.3/src/stats.c:230: undefined reference to `evt_rec_add_tag' libsyslog-ng.a(fdwrite.o)(.text+0xad): In function `fd_write_write_method': /home/soetest1/syslog-ng-2.1.3/src/fdwrite.c:49: undefined reference to `evt_tag_int' libsyslog-ng.a(fdwrite.o)(.text+0xbe):/home/soetest1/syslog-ng-2.1.3/src/fdwrite.c:49: undefined reference to `evt_tag_int' libsyslog-ng.a(fdwrite.o)(.text+0x16e): In function `fd_write_free_method': /home/soetest1/syslog-ng-2.1.3/src/fdwrite.c:80: undefined reference to `evt_tag_int' libsyslog-ng.a(fdread.o)(.text+0x9d): In function `fd_do_read': /home/soetest1/syslog-ng-2.1.3/src/fdread.c:49: undefined reference to `evt_tag_int' libsyslog-ng.a(fdread.o)(.text+0xae):/home/soetest1/syslog-ng-2.1.3/src/fdread.c:49: undefined reference to `evt_tag_int' libsyslog-ng.a(fdread.o)(.text+0x1be):/home/soetest1/syslog-ng-2.1.3/src/fdread.c:103: more undefined references to `evt_tag_int' follow libsyslog-ng.a(dnscache.o)(.text+0x2db): In function `dns_cache_check_hosts': /home/soetest1/syslog-ng-2.1.3/src/dnscache.c:221: undefined reference to `evt_tag_errno' libsyslog-ng.a(dnscache.o)(.text+0x2f0):/home/soetest1/syslog-ng-2.1.3/src/dnscache.c:221: undefined reference to `evt_tag_str' libsyslog-ng.a(apphook.o)(.text+0x47): In function `register_application_hook': /home/soetest1/syslog-ng-2.1.3/src/apphook.c:38: undefined reference to `evt_tag_int' libsyslog-ng.a(apphook.o)(.text+0x5c):/home/soetest1/syslog-ng-2.1.3/src/apphook.c:38: undefined reference to `evt_tag_int' libsyslog-ng.a(apphook.o)(.text+0x114): In function `run_application_hook': /home/soetest1/syslog-ng-2.1.3/src/apphook.c:56: undefined reference to `evt_tag_int' libsyslog-ng.a(serialize.o)(.text+0x43): In function `serialize_archive_read_bytes': /home/soetest1/syslog-ng-2.1.3/src/serialize.c:33: undefined reference to `evt_tag_str' libsyslog-ng.a(serialize.o)(.text+0xcb): In function `serialize_archive_write_bytes': /home/soetest1/syslog-ng-2.1.3/src/serialize.c:49: undefined reference to `evt_tag_str' libsyslog-ng.a(logreader.o)(.text+0xce): In function `log_reader_fd_check': /home/soetest1/syslog-ng-2.1.3/src/logreader.c:104: undefined reference to `evt_tag_errno' libsyslog-ng.a(logreader.o)(.text+0x19a):/home/soetest1/syslog-ng-2.1.3/src/logreader.c:112: undefined reference to `evt_tag_errno' libsyslog-ng.a(logreader.o)(.text+0x30d): In function `log_reader_handle_line': /home/soetest1/syslog-ng-2.1.3/src/logreader.c:195: undefined reference to `evt_tag_printf' libsyslog-ng.a(logreader.o)(.text+0x6cf): In function `log_reader_fetch_log': /home/soetest1/syslog-ng-2.1.3/src/logreader.c:450: undefined reference to `evt_tag_int' libsyslog-ng.a(logreader.o)(.text+0x6e6):/home/soetest1/syslog-ng-2.1.3/src/logreader.c:450: undefined reference to `evt_tag_int' libsyslog-ng.a(logreader.o)(.text+0x6f7):/home/soetest1/syslog-ng-2.1.3/src/logreader.c:450: undefined reference to `evt_tag_int' libsyslog-ng.a(logreader.o)(.text+0x774):/home/soetest1/syslog-ng-2.1.3/src/logreader.c:440: undefined reference to `evt_tag_int' libsyslog-ng.a(logreader.o)(.text+0x7c2):/home/soetest1/syslog-ng-2.1.3/src/logreader.c:425: undefined reference to `evt_tag_errno' libsyslog-ng.a(logreader.o)(.text+0x7d3):/home/soetest1/syslog-ng-2.1.3/src/logreader.c:425: undefined reference to `evt_tag_int' libsyslog-ng.a(logreader.o)(.text+0x8a5): In function `log_reader_init': /home/soetest1/syslog-ng-2.1.3/src/logreader.c:479: undefined reference to `evt_tag_int' libsyslog-ng.a(logreader.o)(.text+0x8ba):/home/soetest1/syslog-ng-2.1.3/src/logreader.c:479: undefined reference to `evt_tag_int' /usr/lib/gcc-lib/i386-redhat-linux/3.2.3/../../../libwrap.a(hosts_access.o)(.text+0x862): In function `host_match': : undefined reference to `yp_get_default_domain' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/home/soetest1/syslog-ng-2.1.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/soetest1/syslog-ng-2.1.3' make: *** [all] Error 2 I am building it on - RHEL 3.0 - Operating system. Any help will be highly appreciated. With Regards, Chanchal Verma

2 1