- syslog-ng - lists.balabit.hu

Problems compiling syslog-ng 2.0.6 on Solaris 10
by Don Neufeld 26 Sep '08

26 Sep '08

Hi, I'm getting the following error while making syslog: [fhkfauaa@fhkfauaa ~/syslog-ng-2.0.6]$ make gmake all-recursive gmake[1]: Entering directory `/home/fhkfauaa/syslog-ng-2.0.6' Making all in src gmake[2]: Entering directory `/home/fhkfauaa/syslog-ng-2.0.6/src' gcc -g -O2 -Wall -o syslog-ng main.o libsyslog-ng.a -lpthread -lresolv -lnsl -lrt -lsocket -ldoor -Wl,-Bstatic -ll -Wl,-R/opt/local/lib -L/opt/local/lib -lglib-2.0 -lintl -liconv -L/usr/local/lib -levtlog -lwrap -Wl,-Bdynamic ld: fatal: library -ll: not found ld: fatal: File processing errors. No output written to syslog-ng collect2: ld returned 1 exit status gmake[2]: *** [syslog-ng] Error 1 gmake[2]: Leaving directory `/home/fhkfauaa/syslog-ng-2.0.6/src' gmake[1]: *** [all-recursive] Error 1 gmake[1]: Leaving directory `/home/fhkfauaa/syslog-ng-2.0.6' gmake: *** [all] Error 2 As far as I can see, it's not finding libl. Here are all the libl's on the system: [fhkfauaa@fhkfauaa ~/syslog-ng-2.0.6]$ find / -name libl.\* 2> /dev/null /usr/ccs/lib/amd64/libl.so /usr/ccs/lib/libl.so /usr/lib/amd64/libl.so /usr/lib/amd64/libl.so.1 /usr/lib/libl.so /usr/lib/libl.so.1 /usr/share/man/man3lib/libl.3lib Any ideas?

2 1

Re: [syslog-ng] Syslog relay tag
by Evan Rempel 24 Sep '08

24 Sep '08

I will need to see the rest of your config file. Specifically, the "template" that you are using on all of the systems. Gault Stephane wrote: > Well doesn't work for me here's the detail : > > BOX1: 192.168.5.80 : hostname= APP_80 > BOX2: 192.168.5.65 : hostname= APP_65 > Syslog server: 192.168.5.203 > > config file : > > BOX1: APP_80 > > options { > chain_hostnames(yes); > keep_hostname(no) > long_hostnames(off); > sync(0); > stats(43200); > perm(0640); > create_dirs(yes); > use_fqdn(yes); > }; > > destination syslog_server { tcp("192.168.5.65" port(514)); }; > > BOX2: APP_65 > > options { > chain_hostnames(yes); > keep_hostname(yes); > long_hostnames(off); > sync(0); > stats(43200); > perm(0640); > create_dirs(yes); > use_fqdn(yes); > }; > > destination syslog_server { tcp("192.168.5.203" port(514)); }; > > And My syslog server: 203: > > options { > chain_hostnames(yes); > keep_hostname(yes); > long_hostnames(off); > sync(0); > stats(43200); > perm(0640); > create_dirs(yes); > use_fqdn(yes); > }; > > And i get those king of logs when i generate some log on APP_880: > > > Sep 18 12:41:37 App_65 192.168.5.52 - - [18/Sep/2008:12:41:36 +0200] "GET /tutorial4/java/javaOO/lifecycle.html HTTP/1.1" 200 2620 > Sep 18 12:41:37 App_65 192.168.5.52 - - [18/Sep/2008:12:41:36 +0200] "GET /tutorial4/java/javaOO/objectcreation.html HTTP/1.1" 200 8047 > Sep 18 12:41:39 App_65 192.168.5.52 - - [18/Sep/2008:12:41:37 +0200] "GET /tutorial4/java/javaOO/usingobject.html HTTP/1.1" 200 10133 > > It see the hostname of the relay box and my IP as the generator of the logs, but doesn't indicate de real source of logs : APP_80 ou 192.168.5.80. > > Any clue of what an i doing wrong ? > > S.Gault > > ________________________________ > Discutez sur Messenger où que vous soyez ! Mettez Messenger sur votre mobile !<http://www.messengersurvotremobile.com/> > -- Evan Rempel erempel(a)uvic.ca Senior Programmer Analyst 250.721.7691 University Systems, University of Victoria

2 1

syslog-ng won't log to syslog server
by Azizul 18 Sep '08

18 Sep '08

Hi, I have install syslog-ng on my remote server. I need to centralized my pflog (firewall log) and snort alert to the syslog server. For your info i have successfully log all log except the pflog and snort alert. I have define the snort alert as local0.info and pflog as local1.info. Can you all give me the sample of configuration? I have tcpdump for and grep the local1.info and local0.info and its show on console. I'm confuse why the system not write to destination that i specify. Below is some configuration that i do on syslog-ng.conf (destination): destination local0 { file("/var/log/remote/local0.log"); }; destination local1 { file("/var/log/remote/local1.log"); }; TQ -- MUHAMMAD AZIZUL DARUS http://www.foodmalaysia.net http://www.myfelis.com http://yourubuntulinux.blogspot.com http://opensource-2u.blogspot.com http://photograph2u.blogspot.com http://malaysiataste.blogspot.com http://jomshopping.blogspot.com http://jahitan-manik.blogspot.com http://nissan-maniac.blogspot.com http://narutoslash.blogspot.com/

5 11

Problem with syslog-ng 1.6.8 and HUP - More information
by Tessier.Marc.2＠hydro.qc.ca 16 Sep '08

16 Sep '08

Hi, This is a Solaris 9 (SunOS spdmze21 5.9 Generic_122300-13 sun4u sparc SUNW,Sun-Fire-V240), running syslog-ng 1.6.8. After my previous posts to the list, I managed to get 2 truss outputs, once showing the signal being received and processed and one showing the signal being received and nothing happening at all. Here is what happens when the signal isn't processed : /1: Received signal #1, SIGHUP, in poll() [caught] /1: poll(0xFFBFEC78, 329, 100) Err#4 EINTR /1: sigprocmask(SIG_SETMASK, 0xFFBFE81C, 0x00000000) = 0 /1: sigaction(SIGHUP, 0xFFBFE5E0, 0xFFBFE700) = 0 /1: sigprocmask(SIG_SETMASK, 0xFF0AA094, 0xFFBFE5D0) = 0 /1: lwp_unpark(1, 1) = 0 /1: setcontext(0xFFBFE5E0) /1: so_socket(PF_INET, SOCK_DGRAM, IPPROTO_IP, "", 1) = 296 /1: ioctl(296, 0xC00C6982, 0xFFBFF6C4) = 0 /1: close(296) = 0 /1: sysinfo(SI_SRPC_DOMAIN, "", 256) = 1 /1: open("/etc/resolv.conf", O_RDONLY|O_LARGEFILE) = 296 /1: read(296, " ; - - - - - - - - - - -".., 1024) = 1024 /1: read(296, " a m e s e r v e r 1 2".., 1024) = 515 /1: read(296, 0x0013D638, 1024) = 0 /1: close(296) = 0 /1: write(2, " S I G H U P r e c e i".., 38) = 38 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1522 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1661 /1: write(210, " S e p 1 0 1 6 : 0 2".., 3091) = 3091 /1: write(209, " S e p 1 0 1 6 : 0 2".., 3091) = 3091 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(294, " < 2 2 > S e p 1 0 1".., 8192) = 3253 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: read(294, " < 2 3 > S e p 1 0 1".., 8192) = 3284 /1: write(16, " S e p 1 0 1 6 : 0 2".., 4096) = 4096 /1: write(16, " o u n d a r y = " = _ r".., 2121) = 2121 /1: write(15, " S e p 1 0 1 6 : 0 2".., 4096) = 4096 /1: write(15, " o u n d a r y = " = _ r".., 2121) = 2121 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 3045 /1: read(294, " < 2 3 > S e p 1 0 1".., 8192) = 552 /1: read(166, " < 1 6 6 > S e p 1 0 ".., 8192) = 312 /1: poll(0xFFBFEC78, 329, 100) = 5 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1584 /1: write(210, " S e p 1 0 1 6 : 0 2".., 4096) = 4096 /1: write(210, " 5 5 3 m a i l . i n f".., 421) = 421 /1: write(209, " S e p 1 0 1 6 : 0 2".., 4096) = 4096 /1: write(209, " 5 5 3 m a i l . i n f".., 421) = 421 /1: write(16, " S e p 1 0 1 6 : 0 2".., 528) = 528 /1: write(15, " S e p 1 0 1 6 : 0 2".., 528) = 528 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1533 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1489) = 1489 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1489) = 1489 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1484 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1444) = 1444 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1444) = 1444 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1526 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1498) = 1498 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1498) = 1498 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1799 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1771) = 1771 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1771) = 1771 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1643 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1569 /1: write(210, " S e p 1 0 1 6 : 0 2".., 3168) = 3168 /1: write(209, " S e p 1 0 1 6 : 0 2".., 3168) = 3168 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1814 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: read(294, " < 2 3 > S e p 1 0 1".., 8192) = 1481 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1794) = 1794 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1794) = 1794 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(16, " S e p 1 0 1 6 : 0 2".., 1438) = 1438 /1: write(15, " S e p 1 0 1 6 : 0 2".., 1299) = 1299 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1496 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1456) = 1456 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1456) = 1456 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1537 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1485) = 1485 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1485) = 1485 /1: read(166, " < 1 6 6 > S e p 1 0 ".., 8192) = 796 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(37, " S e p 1 0 1 6 : 0 2".., 1088) = 1088 /1: write(36, " S e p 1 0 1 6 : 0 2".., 1088) = 1088 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1618 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1598) = 1598 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1598) = 1598 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1720 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1795 /1: write(210, " S e p 1 0 1 6 : 0 2".., 3447) = 3447 /1: write(209, " S e p 1 0 1 6 : 0 2".., 3447) = 3447 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1580 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1532) = 1532 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1532) = 1532 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(294, " < 2 2 > S e p 1 0 1".., 8192) = 1155 /1: poll(0xFFBFEC78, 329, 100) = 4 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 2980 /1: write(50, " S e p 1 0 1 6 : 0 2".., 278) = 278 /1: write(16, " S e p 1 0 1 6 : 0 2".., 1128) = 1128 /1: write(15, " S e p 1 0 1 6 : 0 2".., 989) = 989 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 2900) = 2900 /1: write(209, " S e p 1 0 1 6 : 0 2".., 2900) = 2900 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(294, " < 2 2 > S e p 1 0 1".., 8192) = 1542 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(16, " S e p 1 0 1 6 : 0 2".., 1510) = 1510 /1: write(15, " S e p 1 0 1 6 : 0 2".., 1510) = 1510 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1263 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1223) = 1223 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1223) = 1223 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1508 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1460) = 1460 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1460) = 1460 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(51, " < 1 6 6 > S e p 1 0 ".., 8192) = 256 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(294, " < 2 3 > S e p 1 0 1".., 8192) = 1149 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(16, " S e p 1 0 1 6 : 0 2".., 1117) = 1117 /1: write(15, " S e p 1 0 1 6 : 0 2".., 1117) = 1117 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(294, " < 2 2 > S e p 1 0 1".., 8192) = 1541 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1496 /1: write(16, " S e p 1 0 1 6 : 0 2".., 1493) = 1493 /1: write(15, " S e p 1 0 1 6 : 0 2".., 1493) = 1493 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1452) = 1452 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1452) = 1452 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(294, " < 2 3 > S e p 1 0 1".., 8192) = 1488 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(16, " S e p 1 0 1 6 : 0 2".., 1436) = 1436 /1: write(15, " S e p 1 0 1 6 : 0 2".., 1436) = 1436 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(51, " < 1 6 6 > S e p 1 0 ".., 8192) = 504 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(57, " S e p 1 0 1 6 : 0 1".., 745) = 745 /1: write(56, " S e p 1 0 1 6 : 0 1".., 745) = 745 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1592 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1556) = 1556 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1556) = 1556 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(242, " < 2 2 > S e p 1 0 1".., 8192) = 125 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(294, " < 2 2 > S e p 1 0 1".., 8192) = 938 /1: poll(0xFFBFEC78, 329, 100) = 2 It continues on and on with reads, writes and polls as if the signal was never received at all (though it did catch it). When it does work, you see that it opens its config file and starts to close FD (I cut it after a couple of closes, there are 3 dozens since this server is a central logging server) : /1: Received signal #1, SIGHUP, in poll() [caught] /1: poll(0xFFBFEC58, 333, 100) Err#4 EINTR /1: sigprocmask(SIG_SETMASK, 0xFFBFE7FC, 0x00000000) = 0 /1: sigaction(SIGHUP, 0xFFBFE5C0, 0xFFBFE6E0) = 0 /1: sigprocmask(SIG_SETMASK, 0xFF0AA094, 0xFFBFE5B0) = 0 /1: lwp_unpark(1, 1) = 0 /1: setcontext(0xFFBFE5C0) /1: so_socket(PF_INET, SOCK_DGRAM, IPPROTO_IP, "", 1) = 77 /1: ioctl(77, 0xC00C6982, 0xFFBFF6C4) = 0 /1: close(77) = 0 /1: sysinfo(SI_SRPC_DOMAIN, "", 256) = 1 /1: open("/etc/resolv.conf", O_RDONLY|O_LARGEFILE) = 77 /1: fcntl(77, F_DUPFD, 0x00000100) = 315 /1: close(77) = 0 /1: read(315, " ; - - - - - - - - - - -".., 1024) = 1024 /1: read(315, " a m e s e r v e r 1 2".., 1024) = 515 /1: read(315, 0x0009B5E0, 1024) = 0 /1: close(315) = 0 /1: write(2, " S I G H U P r e c e i".., 38) = 38 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(192, " < 1 6 6 > S e p 1 0 ".., 8192) = 243 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1761 /1: poll(0xFFBFEC58, 333, 100) = 4 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1481 /1: read(54, " < 1 6 6 > S e p 1 0 ".., 8192) = 1257 /1: write(55, " S e p 1 0 1 5 : 0 6".., 3142) = 3142 /1: write(53, " S e p 1 0 1 5 : 0 6".., 3142) = 3142 /1: poll(0xFFBFEC58, 333, 100) = 4 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1742 /1: read(264, " < 1 6 6 > S e p 1 0 ".., 8192) = 357 /1: write(143, " S e p 1 0 1 5 : 1 1".., 1568) = 1568 /1: write(142, " S e p 1 0 1 5 : 1 1".., 1568) = 1568 /1: poll(0xFFBFEC58, 333, 100) = 2 /1: write(55, " S e p 1 0 1 5 : 0 6".., 1694) = 1694 /1: write(53, " S e p 1 0 1 5 : 0 6".., 1694) = 1694 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(250, " < 2 3 > S e p 1 0 1".., 8192) = 88 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(264, " < 2 2 > S e p 1 0 1".., 8192) = 1463 /1: poll(0xFFBFEC58, 333, 100) = 3 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1574 /1: write(23, " S e p 1 0 1 5 : 0 6".., 1419) = 1419 /1: write(18, " S e p 1 0 1 5 : 0 6".., 1771) = 1771 /1: poll(0xFFBFEC58, 333, 100) = 2 /1: write(55, " S e p 1 0 1 5 : 0 6".., 1526) = 1526 /1: write(53, " S e p 1 0 1 5 : 0 6".., 1526) = 1526 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1809 /1: poll(0xFFBFEC58, 333, 100) = 2 /1: write(53, " S e p 1 0 1 5 : 0 6".., 1780) = 1780 /1: write(52, " S e p 1 0 1 5 : 0 6".., 1692) = 1692 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(192, " < 1 6 6 > S e p 1 0 ".., 8192) = 478 /1: poll(0xFFBFEC58, 333, 100) = 2 /1: write(71, " S e p 1 0 1 5 : 0 6".., 706) = 706 /1: write(69, " S e p 1 0 1 5 : 0 6".., 706) = 706 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1549 /1: poll(0xFFBFEC58, 333, 100) = 2 /1: write(55, " S e p 1 0 1 5 : 0 6".., 1589) = 1589 /1: write(53, " S e p 1 0 1 5 : 0 6".., 1501) = 1501 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(120, " < 1 6 6 > S e p 1 0 ".., 8192) = 325 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(250, " < 2 2 > S e p 1 0 1".., 8192) = 137 /1: open("/etc/syslog-ng.conf", O_RDONLY) = 77 /1: ioctl(77, TCGETA, 0xFFBFF53C) Err#25 ENOTTY /1: fstat64(77, 0xFFBFEF20) = 0 /1: fstat64(77, 0xFFBFEDC8) = 0 /1: ioctl(77, TCGETA, 0xFFBFEEAC) Err#25 ENOTTY /1: read(77, " # - - - - - - - - - - -".., 8192) = 7404 /1: read(77, 0x0006AB94, 8192) = 0 /1: door_info(6, 0xFFBFEC20) = 0 /1: door_call(6, 0xFFBFEC08) = 0 /1: door_info(6, 0xFFBFD020) = 0 /1: door_call(6, 0xFFBFD008) = 0 /1: door_info(6, 0xFFBFEC20) = 0 /1: door_call(6, 0xFFBFEC08) = 0 /1: door_info(6, 0xFFBFD020) = 0 /1: door_call(6, 0xFFBFD008) = 0 /1: ioctl(77, TCGETA, 0xFFBFEFA4) Err#25 ENOTTY /1: llseek(77, 0, SEEK_CUR) = 7404 /1: close(77) = 0 /1: poll(0xFFBFF6C8, 0, 0) = 0 /1: door_revoke(13) = 0 /1: close(13) Err#9 EBADF /1: close(59) = 0 /1: close(344) = 0 /1: close(316) = 0 I guess there's something in there that indicates what the problem is exactly, but I'm not qualified enough in system call tracing to say what it could be. Maybe one of you guys has an idea ? Thank you for any help! Marc Tessier Analyste Support Technique Support Technique des Infrastructures courriel : tessier.marc.2(a)hydro.qc.ca <mailto:tessier.marc.2@hydro.qc.ca> Tel: (514) 840-3000 Poste #6467

1 0

syslog-ng /php -syslog-ng
by n r 15 Sep '08

15 Sep '08

hi, I have syslog-ng on a server (debian Etch), and a client with syslog (ubuntu) my server configuration is : source s_local { internal(); unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); }; source s_tcpmessages { tcp(ip(x.x.x.Y)port(514) max-connections(100)); }; source s_udpmessages { udp(ip(x.x.x.Y)port(514)); }; destination d_hosts { file("/log1/HOSTS/$HOST/$YEAR.$MONTH.$DAY/$FACILITY.log"); }; destination d_mysql { program("/usr/bin/mysql -usyslogadmin -p3rda!mysql syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(s_local); destination(d_hosts); }; log { source(s_tcpmessages); destination(d_hosts); }; log { source(s_udpmessages); destination(d_hosts); }; log { source(s_local); destination(d_mysql); }; my client syslog is *.* @x.x.x.Y I don't understand : 1- why i see only (auth, mail, cron,syslog,kern.log) on destination d_hosts for the server? I need to have (user,dkpg.log ,..) 2- ON the server in destination d_hosts, i have (auth, mail, cron,syslog,kern.log) for my client, but why I can't see my client this on php-syslog-ng interface ? What'is wrong? nr _________________________________________________________________ Appelez vos amis de PC à PC -- C'EST GRATUIT http://get.live.com/messenger/overview

1 0

syslog-ng config file include feature...
by Rick Coloccia 11 Sep '08

11 Sep '08

I found in list archives that back in March 2002 there was conversation about modifying syslog-ng so that the syslog-ng.conf file could be split apart. Mine is large and unwieldy - I'd like to break it into files for each file, or for each set of files, that syslog-ng creates. In my dhcpd.conf, I have include statements after my global definitions, allowing me to split the config apart, guaranteeing changes only in the places where I mean them to be. I'd like to do something like that here. Is there some behavior like this in syslog-ng somewhere? A quick google search and a read of the syslog-ng.conf man page doesn't indicate that there is... I am running 2.1.1 with the patch that came over the list on 9/2/08 on CentOS 5.2. Thanks in advance! -Rick -- Rick Coloccia, Jr. Network Manager State University of NY College at Geneseo 1 College Circle, 119 South Hall Geneseo, NY 14454 V: 585-245-5577 F: 585-245-5579

2 1

ISODATE without TZOFFSET
by Del Riesgo, Christopher D 10 Sep '08

10 Sep '08

I was going to use ISODATE in my template, but cannot have the time zone offset appended due to outside factors. This is syslog-ng v2.0.9 on vanilla CentOS v5.2. I initially thought of just making the date up from needed variables, but that raises a question about the template string. I needed this isodate output: YYYY-MM-DDThh:mm:ss So, I was trying to use this template: template t_myformat { template("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC $HOST $MSG\n"); template_escape(no); }; My issue is with the need to have the capital 't' (T) in between the $DAY and $HOUR without any spaces that ISO specifies. If I put the "T" directly after the $DAY, it will of course fail to find the variable $DAYT. I tried many variations of escaping the characters and only one worked, "\a" (bell). I ended up with this string that produces the correct output: template("$YEAR-$MONTH-$DAY\aT$HOUR:$MIN:$SEC $HOST $MSG\n"); Is this supposed to work? Is there a better or more correct method of defining the end of the $DAY variable and getting that "T" directly after the day and before the hour? Also, Is the TZOFFSET required on the ISODATE? And, Is there an easier method to change the ISODATE string, either in conf file or source code? I searched but did not see an applicable place in the code to change the ISODATE string parameters. I search the list archives and after countless other google searches, I haven't seen this issue come up before. Thanks

2 1

Syslog relay : keep facility and level
by Thibaud Desodt 10 Sep '08

10 Sep '08

Hi, I am trying to setup a syslog-ng architecture with a relay. Here is an example : Linux Host1 logs messages to syslog with facility user.info on Host1, syslog-ng is set up to forward these messages (with a filter based on the facility) to Host2 via UDP Linux Host2(log collector)'s syslog-ng is configured to listen for incoming udp packets, and forward them to a Windows Host3 after changing the message's format thanks to a template (add the Source IP at the beginning of the message) Windows Host3 processes the incoming udp messages. I have managed to make it work, that is, messages generated on Host1 with the logger command are successfully received on Host3. Nevertheless, it looks like all the messages reaching my Host3 have the facility/priority User.notice, instead of the original one. Here are some parts of my configuration : -------on Host1: #filter for user facility - for tests filter f_user {facility(user); }; destination host2 {udp("IP.Address.of.Host2");}; log{ source(src); filter(f_user);destination( host2 ); }; ------on Host2 # syslog full redirection to Thibaud's machine destination host3 { udp("IP.ADDRESSE:OF:HOST" template("$SOURCEIP $MSG\n")); }; source s_udp {udp();}; log { source(s_udp); destination ( host3 ); }; I generate messages on host1 with the command logger -p user.warning "message warning test" Is there anything I am doing wrong? Could changing the template make the message lose information about Facility and Level? Thanks in advance

2 2

Problem with syslog-ng 1.6.8 and HUP
by Tessier.Marc.2＠hydro.qc.ca 10 Sep '08

10 Sep '08

Hi, I have been working on an issue for the last few days with one of our main centralized syslog servers which is a SPARC Solaris 9 box. It is running syslog-ng 1.6.8. Our log rotation script moves, compresses and then touches a new file depending on size. Then script then sends an HUP to syslog-ng in the following way : /usr/bin/pkill -HUP syslog-ng > /dev/null 2>&1 I have added some debugging to the script to make sure it grabs the proper PID, and logs it independantly : Sep 10 07:58:01 machine01 syslogmgr[8304]: info: signaling Syslog/Syslog-ng (HUP) at PID 4362. And it is : root@spdmze21# ps -ef | grep syslog-ng root 4362 1 2 Sep 07 ? 160:38 /usr/sbin/syslog-ng Now in the log files, it seems syslog-ng isn't always reacting to the kill. This is what I get as far as syslog-ng noticing the signal in the last 2 days : root@machine01# grep syslog-ng complete.log | grep restarting Sep 9 09:58:06 machine01 syslog-ng[4362]: SIGHUP received, restarting syslog-ng Sep 9 15:58:03 machine01 syslog-ng[4362]: SIGHUP received, restarting syslog-ng Sep 9 19:58:07 machine01 syslog-ng[4362]: SIGHUP received, restarting syslog-ng Sep 10 01:58:04 machine01 syslog-ng[4362]: SIGHUP received, restarting syslog-ng Sep 10 03:58:05 machine01 syslog-ng[4362]: SIGHUP received, restarting syslog-ng However, it was signaled everyhour : Sep 10 00:58:02 machine01 syslogmgr[20532]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Sep 10 01:58:04 machine01 syslogmgr[26686]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Sep 10 02:58:02 machine01 syslogmgr[3702]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Sep 10 03:58:05 machine01 syslogmgr[9935]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Sep 10 04:58:04 machine01 syslogmgr[17262]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Sep 10 05:58:02 machine01 syslogmgr[24178]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Sep 10 06:58:02 machine01 syslogmgr[1748]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Sep 10 07:58:01 machine01 syslogmgr[8304]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Now the problem this creates for me is that it leaves a bunch of open file descriptors which don't point to a file anymore : root@machine01# lsof -p 4362 -s | grep d80 syslog-ng 4362 root 7w VREG 85,80 9699746 40 /var/adm/log (/dev/md/dsk/d80) syslog-ng 4362 root 17w VREG 85,80 3223056 500412 /var/adm/log (/dev/md/dsk/d80) syslog-ng 4362 root 18w VREG 85,80 11604669 612873 /var/adm/log (/dev/md/dsk/d80) syslog-ng 4362 root 20w VREG 85,80 8617243 90 /var/adm/log (/dev/md/dsk/d80) syslog-ng 4362 root 23w VREG 85,80 11698446 612889 /var/adm/log (/dev/md/dsk/d80) ... This causes our rotation to mess up and thus the filesystem to eventually become filled. If I fire pkill manually, it works : root@machine01# /usr/bin/pkill -HUP syslog-ng > /dev/null 2>&1 root@machine01# lsof -p 4362 -s | grep d80 root@machine01# The script itself is called every hour from root's crontab. At this point, I am completely stumped. Even looking at the changelog from 1.6.8 to 1.6.12 (latest 1.6 tree version) I don't see anything that addresses this issue. Now since I have not been able to reproduce a non-working HUP, I don't have a truss output of when it happens. Thank you for any help! Marc Tessier Analyste Support Technique Support Technique des Infrastructures courriel : tessier.marc.2(a)hydro.qc.ca <mailto:tessier.marc.2@hydro.qc.ca> Tel: (514) 840-3000 Poste #6467

2 2

Re: [syslog-ng] Syslog-ng - UDP templates
by Thibaud Desodt 10 Sep '08

10 Sep '08

Hi, thanks for your replies. Actually, this morning, restarting syslog-ng doesn't throw an error anymore. I guess my configuration file was incorrect and I must have corrected it without noticing... I may have forgotten a semi-colon somewhere, and the error message was not very clear about the details. UDP-forwarding with a template now works as expected. Regards, Thibaud

1 0