- syslog-ng - lists.balabit.hu

log_disk_fifo_size() option
by Lucky Y 07 Apr '08

07 Apr '08

Hi, In which version of syslog-ng is this feature implemented ? Regards, Lucky

2 1

syslog-ng 2.0 release preparations
by Balazs Scheidler 07 Apr '08

07 Apr '08

Hi, I've forward ported some bugfixes from syslog-ng OSE 2.1 to 2.0. I've tried to backport only the critical and less intrusive ones. The changes are below: Balazs Scheidler (10): backported apphook framework as it is needed for a Solaris specific change Fixed door initialization on Solaris fixed possible segfault for non-existing optional source files Added Solaris 10 specific svc manager files fixed solaris packaging. Binary statically linked on Solaris 8/9, dynamically on 10. ported to FreeBSD fixed compilation problem on AIX 5.2 fixed compilation issue on freebsd, include stat.h in misc.c Fixed svc method script permissions and added an export to LD_LIBRARY_PATH added LD_LIBRARY_PATH to the svc manager method script The most problematic change is the apphook backport to fix Solaris door initialization, and any possible problems that would result in the portability fixes. You can get the latest release via git (git.balabit.hu) or by fetching tomorrow's snapshot. -- Bazsi

1 0

Read logs from file and send them to another host
by Jaime Ventura 04 Apr '08

04 Apr '08

Hello. I need to read logs from file and send them to another host. Thats pretty easy with syslog-ng. On the target host, i need to save them on a specific file. That is done by using the filters. And here's the problem, which filter to use? I mean, how can I specify a priority (local7, for instance) on the source host, in order to filter it on the destination? Thanks Jaime

1 0

2.0.9 Solaris 10 x86 compilation error: loggen/yylex issue
by Marvin.Nipper＠Stream.com 04 Apr '08

04 Apr '08

I see in the archives that someone else, in a prior version, had encountered the problem of not being able to get a good compile on Solaris 10, but I never saw any resolution to that issue. I'm having the same problem now with 2.0.9. The last request (from bazsi, in the email of Wed Mar 12 11:08:36 CET 2008) was to check the cfg-lex.c file, to ensure that it was not zero length. I checked mine, and it is 56023 in size (slightly larger than the one used with my successful 2.0.5 compilation). In short, I guess I'm just looking for some input/guidance as to what may not be "quite right" in 2.0.9, that would make it no longer compile on my server (where 2.0.5 obviously did compile). Any and all help appreciated! Obviously, I'll gladly feed you any files or information that would assist in problem solving. Below, is the portion of the make output at the point where things fall apart. As further input, I'm using libnet (for source-spoofing) and obviously using the most current EventLog (that hasn't changed since my 2.0.5 compilation). I'm using the glib components delivered with Solaris 10 (again, as was done in 2.0.5). THANKS for your input and help! Portion of the make that failed....... gcc -g -O2 -Wall -o loggen loggen.o -lpthread -lresolv -lnsl -lrt -lsocket -ldoor -lfl -lglib-2.0 -L/usr/local/lib -levtlog -lsocket -lnsl -lnet Undefined first referenced symbol in file yylex /usr/sfw/lib/gcc/i386-pc-solaris2.10/3.4.3/../../../libfl.so ld: fatal: Symbol referencing errors. No output written to loggen collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `loggen' Current working directory /var/opt/packages/syslog-ng-2.0.9/tests/loggen *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='unit functional loggen'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /var/opt/packages/syslog-ng-2.0.9/tests *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src tests doc contrib solbuild tgzbuild'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /var/opt/packages/syslog-ng-2.0.9 *** Error code 1 make: Fatal error: Command failed for target `all' Marvin Nipper Director of Security Stream mailto:marvin.nipper@stream.com PGP Key ID: 0x8EE28551 (DSS/DH) 8C5D 403A D107 0A95 672B B637 BCF1 919A 8EE2 8551

1 0

io.c: bind_inet_socket() bind failed Address already in use
by Lucky Y 04 Apr '08

04 Apr '08

> >We use syslog-ng 1.6.12 in RHEL4. > >As part of our system testing we restart syslog-ng 150 times in a loop > >along with other services in the server. > > > >syslog-ng fails to come up 3/4 times with the error : > >"io.c: bind_inet_socket() bind failed 192.168.128.1:601 >> Address already in use". >How do you restart syslog-ng? It takes some time to close sources/ >destinations and there is a chance that the new syslog-ng instance >tries to bind to the same address the not-yet-stopped instance >still uses. SIGKILL will be sent to the process, and then syslog-ng will be started again. Some example messages seen in the syslog during the restart are: INFO Process PID = 7216 is killed, signal SIGKILL sent successfully, path = /opt/bin/syslog-ng -F -p /var/run/master-syslog-ng.pid -f /etc/syslog-ng.conf. io.c: do_write: write() failed (errno 32), Broken pipe syslog-ng[6242]: pkt_buffer::do_flush(): Error flushing data syslog-ng[6242]: Connection broken to AF_INET(Server:601), reopening in 5 seconds INFO Process, PID = 7216, is signaled, signal number = 9, path = /opt/bin/syslog-ng -F -p /var/run/master-syslog-ng.pid -f /etc/syslog-ng.conf INFO Send start process command, process name: /MasterSyslogDaemon INFO A process started, pid:30573, process:/opt/bin/syslog-ng -F -p /var/run/master-syslog-ng.pid -f /etc/syslog-ng.conf INFO Process, PID = 30573, exit abnormally, exit code = 2, path = /bin/syslog-ng -F -p /var/run/master-syslog-ng.pid -f /etc/syslog-ng.conf INFO Reporting termination of process /MasterSyslogDaemon INFO Termination of process MasterSyslogDaemon reported io.c: bind_inet_socket() bind failed 192.168.128.1:601 Address already in use

1 0

io.c: bind_inet_socket() bind failed Address already in use
by Lucky Y 04 Apr '08

04 Apr '08

Hi, We use syslog-ng 1.6.12 in RHEL4. As part of our system testing we restart syslog-ng 150 times in a loop along with other services in the server. syslog-ng fails to come up 3/4 times with the error : "io.c: bind_inet_socket() bind failed 192.168.128.1:601 Address already in use". Is this a known problem in syslog-ng 1.6.12 ? Or is it a configuration problem ? Part of the syslog-ng.conf : # Options ######################################################## options { log_fifo_size(15000); stats(86400); time_reopen(5); log_msg_size(65536); }; # Source definitions ############################################## source src { tcp(ip("Server") port(601) keep-alive(yes) max-connections(100)); udp(ip("Server") port(514)); unix-stream("/dev/master_log"); internal(); };

2 1

changing the location of the disk buffer for log_disk_fifo_size()
by Lucky Y 03 Apr '08

03 Apr '08

On Thu, 2008-04-03 at 12:16 +0300, Lucky Y wrote: > >Hi, > > > >Is there anyway to change the location of the disk buffer for > >log_disk_fifo_size() ? > > > >It buffers the messages in /var/lib/syslog-ng/ by default in Linux, > >but in our system this directory will not exist. >Not currently, however I plan to add functionality that will cause >syslog-ng to use the same directory as specified by the --persist-file >switch. >Would that be ok for you? It will be very useful if we can specify the directory to store the buffered messages itself. _Lucky

1 0

Unable to run several syslog-ng instances using file source driver file position persistence
by Andreas Kurz 01 Apr '08

01 Apr '08

Hello! I am using syslog-ng 2.0.8 (and tested 2.0.9 to see if it includes the feature...) and found out that there is still no cmdline option to define the path/name of the "syslog-ng.persist" file (like for the pid/conf file). So it is not possible to easy run several Instances of syslog-ng using the file source driver on the same machine and store the file positions beyond syslog-ng restarts ... e.g. in a cluster environment .... or did I miss a hidden config option? There was already a discussion about this some months ago. Is there a special reason, why this feature is not integrated in syslog-ng or is there only too less demand for such a feature? Regards, Andreas

2 3

Re: [syslog-ng] TAG-Macro
by JUNG, Christian 31 Mar '08

31 Mar '08

Hi, the signed CLA is on the way. And here's a summary of the patch in GNU ChangeLog format: ---8<--- 2008-03-27 Christian Jung <christian.jung(a)saarstahl.com> * macros.c: added support for BSD-style facility/priority tag. A BSD-style tag consists of a digit encoding the priority (0-7) and a letter (A-X) encoding the facility. The new macro is called 'BSDTAG'. * syslog-names.c: added struct sl_bsdtag_facilities. ---8<--- bye Chris > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of > Balazs Scheidler > Sent: Thursday, March 27, 2008 1:55 PM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] TAG-Macro > > > Thanks for your contribution. Could you please submit a signed > "Contributory License Agreement" via FAX to us, as described here: > > http://www.balabit.com/network-security/syslog-ng/opensource-l > ogging-system/contribution/ > > Thanks in advance, and sorry for the legal hassles. > > > On Thu, 2008-03-27 at 13:49 +0100, JUNG, Christian wrote: > > > -----Original Message----- > > > From: syslog-ng-bounces(a)lists.balabit.hu > > > [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of > > > Balazs Scheidler > > > Sent: Tuesday, March 18, 2008 12:46 PM > > > To: Syslog-ng users' and developers' mailing list > > > Subject: Re: [syslog-ng] TAG-Macro > > > > > > Something like BSDTAG? > > > > > > > Attached is a patch to the 2.0.9 source tree of syslog-ng > which implements the "BSDTAG" macro. > > > > > > bye > > Chris > > > ______________________________________________________________ > ________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > -- Bazsi ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1

AIX startup
by Brian Loe 27 Mar '08

27 Mar '08

Okay, my syslog-ng instance died at some point last night and because I don't have it setup properly for respawning... Can anyone running syslog-ng on AIX 5.* give me some tips for this? I'm feeding pipes so i have to start instances of SEC as soon as I start syslog-ng - but the SEC scripts appear to "close" so if they're configured to respawn I'll have 2000 instances of them in an hour.

7 21