- syslog-ng - lists.balabit.hu

[Bug 29] New: syslog-ng segfault when HUP signal arrives
by bugzilla＠bugzilla.balabit.com 02 Feb '09

02 Feb '09

https://bugzilla.balabit.com/show_bug.cgi?id=29 Summary: syslog-ng segfault when HUP signal arrives Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 If there are two udp driver in the config file syslog-ng will segfault when a HUP signal arrive. Example config: source s_network_1 { udp(); }; source s_network { udp(); }; I know that this is not a valid config, but the segfault is not the humble way to tell me. :) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Errors compiling syslog-ng from source on Centos 5.2
by Ezra Taylor 02 Feb '09

02 Feb '09

All: I'm having problems installing syslog-ng-2.1.1 from source on Centos 5.2. I installed eventlog successfully. Eventlog is located at /usr/local/eventlog. My configure script is below. Note, make is failing. The output is below. ./configure EVTLOG_CFLAGS=/usr/local/eventlog/include EVTLOG_LIBS=/usr/local/eventlog/lib. syslog-ng Open Source Edition 2.1.1 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include /usr/local/eventlog/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -lnsl -lrt -lfl -L/lib64 -lglib-2.0 /usr/local/eventlog/lib -lwrap prefix : /usr/local Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : yes SQL support : no [etaylor@mytest syslog-ng-2.1.1]$ make make all-recursive make[1]: Entering directory `/home/etaylor/syslog-ng-2.1.1' Making all in src make[2]: Entering directory `/home/etaylor/syslog-ng-2.1.1/src' if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include /usr/local/eventlog/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT misc.o -MD -MP -MF ".deps/misc.Tpo" \ -c -o misc.o `test -f 'misc.c' || echo './'`misc.c; \ then mv -f ".deps/misc.Tpo" ".deps/misc.Po"; \ else rm -f ".deps/misc.Tpo"; exit 1; \ fi gcc: /usr/local/eventlog/include: linker input file unused because linking not done if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include /usr/local/eventlog/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT utils.o -MD -MP -MF ".deps/utils.Tpo" \ -c -o utils.o `test -f 'utils.c' || echo './'`utils.c; \ then mv -f ".deps/utils.Tpo" ".deps/utils.Po"; \ else rm -f ".deps/utils.Tpo"; exit 1; \ fi gcc: /usr/local/eventlog/include: linker input file unused because linking not done if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include /usr/local/eventlog/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT messages.o -MD -MP -MF ".deps/messages.Tpo" \ -c -o messages.o `test -f 'messages.c' || echo './'`messages.c; \ then mv -f ".deps/messages.Tpo" ".deps/messages.Po"; \ else rm -f ".deps/messages.Tpo"; exit 1; \ fi In file included from messages.c:24: messages.h:28:20: error: evtlog.h: No such file or directory In file included from messages.c:24: messages.h:54: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token messages.h:55: error: expected ')' before '*' token messages.c:41: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token messages.c: In function 'msg_send_internal_message': messages.c:47: error: 'EVT_PRI_WARNING' undeclared (first use in this function) messages.c:47: error: (Each undeclared identifier is reported only once messages.c:47: error: for each function it appears in.) messages.c: At top level: messages.c:63: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token messages.c:81: error: expected ')' before '*' token messages.c: In function 'msg_log_func': messages.c:99: error: 'EVT_PRI_INFO' undeclared (first use in this function) messages.c:102: error: 'EVT_PRI_DEBUG' undeclared (first use in this function) messages.c:104: error: 'EVT_PRI_WARNING' undeclared (first use in this function) messages.c:106: error: 'EVT_PRI_ERR' undeclared (first use in this function) messages.c:108: error: 'EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c: In function 'msg_init': messages.c:123: error: 'evt_context' undeclared (first use in this function) messages.c:123: warning: implicit declaration of function 'evt_ctx_init' messages.c:123: error: 'EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c: In function 'msg_deinit': messages.c:133: warning: implicit declaration of function 'evt_ctx_free' messages.c:133: error: 'evt_context' undeclared (first use in this function) make[2]: *** [messages.o] Error 1 make[2]: Leaving directory `/home/etaylor/syslog-ng-2.1.1/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/etaylor/syslog-ng-2.1.1' make: *** [all] Error 2 -- Ezra Taylor

2 2

syslog-ng Filter expression help
by cod3fr3ak 28 Jan '09

28 Jan '09

Is there anyway I can combine these filters into a single line per host? filter f_host-dns1 { host ("SVR006*") or host ("dns1*"); }; filter f_host-dns2 { host ("SVR015*") or host ("dns2*"); }; filter f_host-dns21 { host ("SVR138*") or host ("dns21*"); }; filter f_query-dns1 { filter (f_local0) and filter (f_host-dns1); }; filter f_query-dns2 { filter (f_local0) and filter (f_host-dns2); }; filter f_query-dns21 { filter (f_local0) and filter (f_host-dns21); }; I think I can but I am unsure of how syslog-ng handles ANDs and ORs

2 1

SSL compile errors even when configured without ssl support
by Chris Fabri 27 Jan '09

27 Jan '09

Greetings- I'm trying to compile syslog-ng 3.0.1 on RH 3 (yes, I know), and am unable to compile due to what appear to be openssl related errors: In file included from tlscontext.h:12, from tlscontext.c:1: /usr/include/openssl/ssl.h:909: syntax error before "KSSL_CTX" /usr/include/openssl/ssl.h:931: syntax error before '}' token Are the last set. However, I ran configure with "--disable-ssl." Reviewing some of the archives, it appears this was fixed in v3.0 back in Nov '08: https://lists.balabit.hu/pipermail/syslog-ng/2008-November/012234.html I've tried the 11202008 build just in case, and that didn't 'seem to resolve the problem. I really don't need SSL, so it would be much simpler to just skip the SSL part than try to get it working to get around this error. Various searches of the archives have mentioned that this was fixed a few other times, but I'm not having any luck. Help? :) chris

3 7

Cannot find init.d.AIX in contrib folder
by Chanchal Verma 23 Jan '09

23 Jan '09

Hi, I am building syslog-ng-2.1.3 on AIX 5.1. I compiled it successfully and tool is working fine. I am in process to automate the start script. I cannot find init.d.AIX script in <..>/syslog-ng-2.1.3/contrib folder. It is available for other OS (solaris, SunOS,HP-UX,RedHat..). The startup script which I have created is not 100% compliance with the AIX OS. Like syslog-ng is running on server and it is still showing status 'inoperative' as Subsystem status. I need startup script for AIX OS. Any help will be highly appreciated. With Regards, Chanchal Verma

3 5

Fixed number fd-limit doesn't scale
by Corinna Vinschen 23 Jan '09

23 Jan '09

Hi, in 3.0.1, in src/gprocess.c, line 112, the fd_limit_min is set to the fixed value 4096. This doesn't work well on systems which have a hard limit smaller than 4K. While there's a command line option --fd-limit (but unfortunately no equivalent config file option), the default on those systems is to get an error message at startup: syslog-ng: Error setting file number limit; limit='4096'; error='Too many open files' Wouldn't it be better to choose a system specifc default like OPEN_MAX instead or better, to call sysconf(_SC_OPEN_MAX) to fetch the system default and only use 4096 as fallback if none of the two is available or the values are larger than 4K? Corinna -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

2 9

New files for contrib/cygwin-packaging
by Corinna Vinschen 23 Jan '09

23 Jan '09

Hi, so far I didn't upgrade Cygwin's syslog-ng beyond 2.1.x. The changes in 3.0 require to change the Cygwin specific files in the contrib directory. Both files are attached. Could these both please applied to the syslog-ng repository? Thanks in advance, Corinna -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

2 3

Writing to a named Pipe
by Pedro Rafael Alves Simoes 22 Jan '09

22 Jan '09

Hello, In my syslog-ng configuration I'm writing messages to named pipes which name is given dynamically by the $PRI macro: destination d_test { pipe("/tmp/$PRI.log"); }; All the possible PRI.log pipes were created previously with mkfifo. With this configuration the messages aren't being written to the pipes. It simply does nothing. Doing a strace on the syslog-ng process, it shows an error : open("/tmp/$PRI.log", O_RDWR|O_NONBLOCK|O_NOCTTY|O_LARGEFILE) = -1 ENOENT (No such file or directory) It seems that the PRI macro isn't being interpolated in the string. Any help?

2 1

[Bug 27] New: 3.0.1: syntax check (-s) overwrites syslog-ng.pid
by bugzilla＠bugzilla.balabit.com 20 Jan '09

20 Jan '09

https://bugzilla.balabit.com/show_bug.cgi?id=27 Summary: 3.0.1: syntax check (-s) overwrites syslog-ng.pid Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: --- Estimated Hours: 0.0 syslog-ng -s overwrites syslog-ng.pid which makes no sense because we loose information about pid of running syslog-ng daemon. Then "stop" action in many init scripts is not able to find out pid of original syslog-ng this making "stop" no longer working. ps. version form in bugzilla missess 3.x.x versions -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

YACC Stack Overflow
by Cauchi, Geoffrey, VF-MT 19 Jan '09

19 Jan '09

Hi I am using syslog version 2.0.8 and all is running well. I am using it to log a number of Cisco devices. Recently I tried to add an additional number of devices that I would like to have their syslog sent to the Syslog-NG server. This is the syntax used in the config file: destination CAT1 { file("/var/log/switches/CAT1/log.txt" dir_perm(0755) perm(0755));}; filter f_filter73 { netmask(192.168.150.25);}; log { source(s_udp); filter(f_filter73); destination(CAT1); }; However, when I restart syslog-ng I get the following error: Stopping syslog-ng: [OK] Starting syslog-ng: yacc stack overflow at 314 YACC is complaining of a stack overflow. Syslog-ng is running on Fedora Core 8. Did anyone encounter this problem before? Any help would be appreciated. Thanks Gef ------------------------------------------------------------------------------------- Vodafone Life is Now ------------------------------------------------------------------------------------- This email is intended only for the use of individuals to whom it is addressed, as it may contain confidential or privileged information. If you are not a named addressee, intended recipient, or the person responsible for delivering the message to the named addressee, be advised that you have received this email in error and that you should not disseminate, distribute, print, copy this mail or otherwise divulge its contents. In such instances, please notify Vodafone Malta Limited on telephone number +356 99999247 and delete this email from your system. Since this transmission was affected via email, Vodafone Malta Limited cannot guarantee that it is secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Vodafone Malta Limited does not accept liability for any errors or omissions in the contents of this message which arise as a result of email transmission. Save the environment for our children - Print e-mail only when necessary.

2 7