- syslog-ng - lists.balabit.hu

syslog-ng-2.1.3: 'Configure' failed on Solaris 8 using --enable-static-linking
by Chanchal Verma 19 Jan '09

19 Jan '09

Hi, I have successfully build syslog-ng-2.1.3 with --enable-dynamic-linking on Solaris 8. While trying to build using --enable-static-linking option, it is not allowing me to configure syslog-ng-2.1.3 version on my Solaris 8 box (sparc). It is not able to find glib-2.0.a (Static library), though it is available in /usr/local/lib path. -rw-r--r-- 1 root 2822036 Jan 15 06:21 /usr/local/lib/libglib-2.0.a Here is error message while doing compilation: ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- ./configure --enable-static-linking --prefix=/opt/syslog-ng-2.1.3 .... .... checking whether to enable TCP wrapper support... no checking whether to enable spoof source support... no checking whether to enable IPv6 support... yes checking whether to enable SQL support... no checking for pkg-config... (cached) /usr/local/bin/pkg-config checking pkg-config is at least version 0.14... yes checking for GLIB - version >= 2.4.0... yes (version 2.13.0) checking for static GLib libraries... no checking sanity checking Glib headers... yes configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- I have compiled glib-2.13.1 witn --enable-static option to get libglib-2.0.a library using gcc-3.4.6 compiler (same I am using for syslog-ng). Somehow syslog-ng is not able to find Static Glib during configure. Any help will be highly appreciated. Thanks, Chanchal Verma

4 9

Drops?
by Mike Rykowski 16 Jan '09

16 Jan '09

I configured syslog-ng to pass messages to SEC via named pipes. When I did I saw in the log statistics: Jan 13 09:10:00 syslog-ng[13736]: Log statistics; dropped='pipe(sec- pipe)=1607', dropped='unix-dgram(AF_UNIX(/dev/log))=0', processed='center(queued)=1794661', processed='center (received)=1718990', I then called SEC using the 'program' option instead of named pipes and I got: Jan 13 10:14:13 syslog-ng[14031]: Log statistics; dropped='program (/usr/local/bin/sec.pl -input="-" -conf=/usr/local/etc/my-sec.conf)=0', dropped='unix-dgram(AF_UNIX(/dev/log))=0', processed='center (queued)=2552863', processed='center(received)=2447130', The drops were zero but the queued and received were not equal. Does this mean messages are getting dropped? When I don't call SEC at all I get queued and received to be equal: Jan 14 09:26:44 syslog-ng[14119]: Log statistics; dropped='unix-dgram (AF_UNIX(/dev/log))=0', processed='center(queued)=70516726', processed='center(received)=70516726', -- Mike Rykowski NU-IT Telecommunications and Network Services

2 1

[Bug 26] New: 3.0.1: syslog facility is not recognized
by bugzilla＠bugzilla.balabit.com 16 Jan '09

16 Jan '09

https://bugzilla.balabit.com/show_bug.cgi?id=26 Summary: 3.0.1: syslog facility is not recognized Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: regression Estimated Hours: 0.0 Config contains: filter f_systlog { facility(syslog); }; and syslog-ng 3.0.1 yells: syntax error in /etc/syslog-ng/syslog-ng.conf at line 75. Replacing "facility(syslog)" with "facility(news)" and problem is gone which suggests problems with parsing "syslog" correctly. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

syslog-ng MIB table
by Riza Kamalie 16 Jan '09

16 Jan '09

Hi, Does syslog-ng have a MIB that can be quered using snmp? Regards Riza

2 1

Error resolving user error 3.0.1
by Riza Kamalie 16 Jan '09

16 Jan '09

Hi there, I have recently installed syslog-ng 3.0.1 OSE on fedora 9 running on a SUN X2100. I have an issue when using owner(username) and dir_owner(username) parameters and received the following error when starting up and the logs files don't have the desired ownership. [root@]# /usr/local/syslog-ng/sbin/syslog-ng -F -e -f /usr/local/syslog-ng/etc/syslog-ng.conf *Error resolving user; user='username' Error resolving user; user='username'* syslog-ng starting up; version='3.0.1' Any advise would be great. Excellent application + documentation. Regards Riza

4 6

[patch] Add follow_freq_ms option
by Joe Shaw 16 Jan '09

16 Jan '09

Hi, As I mentioned in the last thread, I've found myself wanting to have better than one second resolution for the follow_freq() option. Attached is a patch which adds a follow_freq_ms option, which takes its value in milliseconds rather than full seconds. follow_freq() continues to work as it did previously. Thanks, Joe

3 7

Too Many Open Files
by Zeek Anow 14 Jan '09

14 Jan '09

We are running Solaris 9, syslog-ng 2.0.5, We are getting: Error opening file for writing; filename='/logs/combo/combo.log.01', error='Too many open files (24)' I went into the startup script, /etc/init.d/syslog-ng and tried to up the limit by putting this in the startup section: ulimit -n 4096. When I stop and start syslog-ng and look at the ulimit settings, it still shows 256. core file size (blocks, -c) unlimited data seg size (kbytes, -d) unlimited file size (blocks, -f) unlimited open files (-n) 256 pipe size (512 bytes, -p) 10 stack size (kbytes, -s) 8192 cpu time (seconds, -t) unlimited max user processes (-u) 29995 virtual memory (kbytes, -v) unlimited Any ideas on how to set this? Thanks,

3 2

Make throws link errors over glib2 when compiling syslog-ng 3.0.1
by Joost De Cock 14 Jan '09

14 Jan '09

Hello all, I know that the issue of rewriting syslog messages is a recurring debate here on the list :-) but I'm trying to get 3.0.1 up and running as we need to strip out some info to protect the privacy of our users (there, good cause flag set). I'm having a go under Cygwin and configure runs fine, but make dies on me in a flurry of messages (see below). I'm not much of a devhead, but these seem to be glib2 issue to me. Yet I'm a but stumped on how to beat some sense into it, and any pointer would be hugely appreciated. Thanks in advance, Joost tail of configure output: syslog-ng Open Source Edition 3.0.1 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -I/usr/include/glib-2.0 -I/usr/lib /glib-2.0/include -I/usr/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOU RCE -D_FILE_OFFSET_BITS=64 linker flags : prefix : /usr/local Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : no spoof-source support : no tcp-wrapper support : no SSL support : yes SQL support : no Linux capability support : no PCRE support : no Env wrapper support : no the part where make goes of the rails: gcc -g -O2 -Wall -o syslog-ng.exe main.o libsyslog-ng.a -Wl,-Bstatic -lfl -lglib-2.0 -lintl -liconv -levtlog -lssl -lcrypto -Wl,-Bdynamic -ld l /usr/lib/gcc/i686-pc-cygwin/3.4.4/../../../libcrypto.a(cryptlib.o):cryptlib.c:(. text+0x260): multiple definition of `_DllMain@12' /usr/lib/gcc/i686-pc-cygwin/3.4.4/../../../libglib-2.0.a(gutils.o):gutils.c:(.te xt+0x2c0): first defined here main.o: In function `main_loop_wakeup': /download/syslog-ng-3.0.1/src/main.c:119: undefined reference to `__imp__g_threa ds_got_initialized' /download/syslog-ng-3.0.1/src/main.c:119: undefined reference to `__imp__g_threa d_use_default_impl' /download/syslog-ng-3.0.1/src/main.c:119: undefined reference to `__imp__g_threa d_functions_for_glib_use' /download/syslog-ng-3.0.1/src/main.c:122: undefined reference to `__imp__g_threa ds_got_initialized' /download/syslog-ng-3.0.1/src/main.c:122: undefined reference to `__imp__g_threa d_use_default_impl' /download/syslog-ng-3.0.1/src/main.c:122: undefined reference to `__imp__g_threa d_functions_for_glib_use' main.o: In function `main_loop_run': /download/syslog-ng-3.0.1/src/main.c:195: undefined reference to `__imp__g_threa ds_got_initialized' /download/syslog-ng-3.0.1/src/main.c:195: undefined reference to `__imp__g_threa d_use_default_impl' /download/syslog-ng-3.0.1/src/main.c:195: undefined reference to `__imp__g_threa d_functions_for_glib_use' /download/syslog-ng-3.0.1/src/main.c:198: undefined reference to `__imp__g_threa ds_got_initialized' /download/syslog-ng-3.0.1/src/main.c:198: undefined reference to `__imp__g_threa d_use_default_impl' /download/syslog-ng-3.0.1/src/main.c:198: undefined reference to `__imp__g_threa d_functions_for_glib_use' libsyslog-ng.a(messages.o): In function `msg_event_create': /download/syslog-ng-3.0.1/src/messages.c:140: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/messages.c:140: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/messages.c:140: undefined reference to `__imp__g_t hread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/messages.c:149: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/messages.c:149: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/messages.c:149: undefined reference to `__imp__g_t hread_functions_for_glib_use' libsyslog-ng.a(messages.o): In function `msg_event_send': /download/syslog-ng-3.0.1/src/messages.c:167: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/messages.c:167: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/messages.c:167: undefined reference to `__imp__g_t hread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/messages.c:169: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/messages.c:169: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/messages.c:169: undefined reference to `__imp__g_t hread_functions_for_glib_use' libsyslog-ng.a(timeutils.o): In function `cached_mktime': /download/syslog-ng-3.0.1/src/timeutils.c:77: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:77: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:77: undefined reference to `__imp__g_t hread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:77: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:92: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:92: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:92: undefined reference to `__imp__g_t hread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:92: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:95: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:95: undefined reference to `__imp__g_t hread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:90: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:90: undefined reference to `__imp__g_t hread_functions_for_glib_use' libsyslog-ng.a(timeutils.o): In function `cached_localtime': /download/syslog-ng-3.0.1/src/timeutils.c:105: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:105: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:105: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:112: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:114: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:114: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:114: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:114: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:117: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:117: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:112: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:112: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:109: undefined reference to `__imp__g_ threads_got_initialized' libsyslog-ng.a(timeutils.o): In function `get_local_timezone_ofs': /download/syslog-ng-3.0.1/src/timeutils.c:134: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:134: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:134: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:134: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:144: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:144: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:165: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:165: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:165: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:165: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:169: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:169: undefined reference to `__imp__g_ thread_functions_for_glib_use' libsyslog-ng.a(timeutils.o): In function `clean_time_cache': /download/syslog-ng-3.0.1/src/timeutils.c:177: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:177: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:177: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:177: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:179: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:179: undefined reference to `__imp__g_ thread_functions_for_glib_use' libsyslog-ng.a(radix.o): In function `r_parser_string': /download/syslog-ng-3.0.1/src/radix.c:42: undefined reference to `__imp__g_ascii _table' libsyslog-ng.a(radix.o): In function `r_parser_ipv4': /download/syslog-ng-3.0.1/src/radix.c:108: undefined reference to `__imp__g_asci i_table' libsyslog-ng.a(radix.o): In function `r_parser_number': /download/syslog-ng-3.0.1/src/radix.c:135: undefined reference to `__imp__g_asci i_table' /download/syslog-ng-3.0.1/src/radix.c:135: undefined reference to `__imp__g_asci i_table' collect2: ld returned 1 exit status make[2]: *** [syslog-ng.exe] Error 1 make[2]: Leaving directory `/download/syslog-ng-3.0.1/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/download/syslog-ng-3.0.1' make: *** [all] Error 2

2 2

Configure glitch in 3.0
by Corinna Vinschen 14 Jan '09

14 Jan '09

Hi, I think there's sort of a bug in the configury: if test "x$prefix" = "xNONE"; then prefix=$ac_default_prefix pidfiledir="/var/run" else pidfiledir="${prefix}/var/run" fi This evaluation of the pidfiledir does not take the defaults of autoconf into account. The pidfiledir should rather always default to pidfiledir="${localstatedir}" instead of fiddeling with the prefix itself. Does that make sense? Corinna -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

2 1

are nested quotes possible in parser
by Michael Hocke 14 Jan '09

14 Jan '09

Hi there, my Avocent console servers are sending console port output via syslog to my syslog server running syslog-ng 3.0.1. Console output looks like this: Jan 13 00:18:39 sysl@cyc2 Buffering: S39.gwa [Jan 13 00:14:04.379: % EARL_NETFLOW-SP-4-TCAM_THRLD: Netflow TCAM threshold exceeded, TCAM Utilization [97%]] Jan 13 00:18:53 sysl@cyc2 Buffering: S42.sw2f [2009 Jan 13 00:18:53 EST -05:00 %ETHC-5-PORTTOSTP:Port 3/27 joined bridge port 3/27] Jan 13 00:18:53 sysl@cyc2 Buffering: S42.sw2f [2009 Jan 13 00:18:53 EST -05:00 %DTP-7-PORTLINKDOWN:Port 3/27 Link down] Jan 13 00:18:53 sysl@cyc2 Buffering: S42.sw2f [2009 Jan 13 00:18:53 EST -05:00 %ETHC-5-PORTFROMSTP:Port 3/27 left bridge port 3/27] The goal is to store the console output within square brackets into separate files named after the server that created this output. The first line of the example above should go into the file "gwa" while the others go into "sw2f". This is what I have so far: > source s_udp { udp (); }; > > # --- parse console server output > # separate port description from message > parser p_console_output { > csv-parser (columns ("CONSOLE.SOURCE", "CONSOLE.MSG") > delimiters (" ") > quote-pairs ("[]") > template ("${MSGONLY}")); > }; > > # extract port label from port description > parser p_console_source { > csv-parser (columns ("CONSOLE.PORT", "CONSOLE.LABEL") > delimiters (".") > template ("${CONSOLE.SOURCE}")); > }; > > # --- destination of console output > destination d_console_output { > file ("/usr/local/var/log/remote/${HOST_FROM}/console/$ > {CONSOLE.LABEL}" > template ("${CONSOLE.MSG}\n")); > }; > > # --- filter console output > filter f_console_output { > facility (local7) and host ("^sysl(a)cyc.*"); > }; > > # --- log console output > log { > source (s_udp); > filter (f_console_output); > parser (p_console_output); > parser (p_console_source); > destination (d_console_output); > }; This works just fine with the last three lines of my example data above. The problem I am having is that if the console output (the text between square brackets) contains its own square brackets the message will cut off right after the first occurrence of the closing bracket. The first line of my example data will look like this: Jan 13 00:14:04.379: %EARL_NETFLOW-SP-4-TCAM_THRLD: Netflow TCAM threshold exceeded, TCAM Utilization [97% instead of Jan 13 00:14:04.379: %EARL_NETFLOW-SP-4-TCAM_THRLD: Netflow TCAM threshold exceeded, TCAM Utilization [97%] I could probably get around this by using a rewrite rule using PCRE but considering the amount of data that needs to be looked at this solution is going to be very expensive. Is there a way to make syslog-ng aware of nested quotes? If not, is there something in the pipeline to support this in future releases? If not, I will be willing to take a shot and implement this. Any pointers or suggestions are welcome. Thanks. - Michael

2 1