- syslog-ng - lists.balabit.hu

Patch for open source syslog-ng-2.0.5
by Philip Bellino 19 Nov '07

19 Nov '07

The following attached patch is being submitted against the open source syslog-ng-2.0.5. * src/afsocket.c (afsocket_dd_format_stats_name): Using IPv6 for a destination of tcp6 or udp6: There was no case statement for AF_INET6 and as a result, "driver_name" was never filled in with either tcp6 or udp6. The subsequent routine (g_snprintf) that used "driver_name" caused a segmentation fault. This is now fixed. <<syslog-ng-Changelog.doc>> <<afsocket.diff>> Phil Bellino Software Engineer MRV Communications, Inc. 295 Foster Street Littleton, MA. 01460 Phone: 978-952-4807 Fax: 978-952-5444 Email: pbellino(a)mrv.com <http://www.mrv.com/>

2 1

about unix-dgram
by hi ro 19 Nov '07

19 Nov '07

Hi, Can I use "unix-dgram" as a destination config over RedHatLinux(RHEL ES version4 update5). I want to do following. 1. syslog-ng server receive syslog-message. 2. syslog-ng server write the message to a fifo pipe. (I want to config destination using unix-dgram.) 3. client-ap read the message from the fifo pipe. (I think client-ap can read messages one by one using unix-dgram.) Thanks hiro _________________________________________________________________ Hotmail限定　Windows Live x Lost Odysseyプレゼントキャンペーン　12月21日まで http://go.windowslive.jp/

2 3

Is there any problems when network config is changed?
by hi ro 16 Nov '07

16 Nov '07

Hi, Is there any problems when following occurs? [Precondition] Syslog-ng starts with a config about A-ADDRESS(IP ADDRESS). [Question] 1. Down NIC(A-ADDRESS) with ifdown. → Is there any problems? 2. Change IP-ADDRES from A to B. → Is there any problems? 3. UP NIC(B-ADDRESS) with ifup → Is there any problems? I know that syslog-ng can't start after 3. Thankshiro _________________________________________________________________ 今話題になってる出来事や有名人をランキングで毎週発表「MSN 気になる言葉」 http://keyword.jp.msn.com/default.aspx

2 3

Is there any problems when network config is changed?
by hi ro 16 Nov '07

16 Nov '07

Hi, Is there any problems when following occurs? [Precondition] Syslog-ng starts with a config about A-ADDRESS(IP ADDRESS). [Question] 1. Down NIC(A-ADDRESS) with ifdown. → Is there any problems? 2. Change IP-ADDRES from A to B. → Is there any problems? 3. UP NIC(B-ADDRESS) with ifup → Is there any problems? I know that syslog-ng can't start after 3. Thankshiro _________________________________________________________________ 【MSNビデオ】超貴重！驚きの大物対談が実現。作家村上龍が話題のあの人に迫る http://video.msn.co.jp/rvr/default.htm

1 0

Is there any problems when network config is changed?
by hi ro 16 Nov '07

16 Nov '07

Hi, Is there any problems when following occurs? [Precondition] Syslog-ng starts with a config about A-ADDRESS(IP ADDRESS). [Question] 1. Down NIC(A-ADDRESS) with ifdown. → Is there any problems? 2. Change IP-ADDRES from A to B. → Is there any problems? 3. UP NIC(B-ADDRESS) with ifup → Is there any problems? I know that syslog-ng can't start after 3. Thankshiro _________________________________________________________________ 広告表示なし！アカウント有効期限なし！Hotmail Plus のお申し込みはこちら http://get.live.com/mail/options

1 0

About lost of messages after syslog-ng stop
by Frank Abel Cancio Bello 14 Nov '07

14 Nov '07

Hi all! What can I do to avoid that when I stop my syslog-ng client and apache server still logging to its files not lost all those messages? I mean, in the time that the syslog-ng client was not running, the apache continue working and logging data, but when I start the syslog client it don't send to the syslog-ng server the messages that apache logging when it was stopped. Here is part of what I think relevant of my configuration file: # apache message source source s_apache { # Apache2 access log source. file("/var/log/apache2/access.log" log_prefix("apache_access: ") follow_freq(1) flags(no-parse) ); # Apache2 access log source. file("/var/log/apache2/error.log" log_prefix("apache_error: ") follow_freq(1) flags(no-parse) ); }; # central log server destination d_tcp { tcp("10.8.2.227" port(514)); }; # apache logs to central server. log { source(s_apache); destination(d_tcp); flags(flow-control); }; All work fine, just worry about the lost of messages in case that the communication with syslog-ng server fail. I know that Premium Edition have the log_disk_fifo_size(), but that is the only way of do this? Nobody have a workaround for this so necessary feature using the Open Source Edition? Salute Frank Abel __________________________________________ Participe en Universidad 2008. 11 al 15 de febrero del 2008. Palacio de las Convenciones, Ciudad de la Habana, Cuba http://www.universidad2008.cu

2 3

syslog-ng 2.0.3 is released
by Balazs Scheidler 14 Nov '07

14 Nov '07

Dear syslog-ng users, I've uploaded syslog-ng 2.0.3, the latest stable release in the syslog-ng 2.0 branch to our webserver. The list of changes is summarized below. The source is available at the usual places at http://www.balabit.com/products/syslog-ng/ 2.0.3 Mon, 26 Mar 2007 14:10:00 +0200 Bugfixes: * Fixed a possible segmentation fault in the usertty() destination driver when it was referenced on a log path with disabled flow-control. * Fixed various usertty() functionality problems. * Removed the 1024 byte limitation of internally generated messages. * Clarified the text of various internal messages, consistency updates for message severities. * Increased the minimum value for log_fifo_size to 1000 elements. * HP-UX portability fixes. * Some minor documentation fixes. Features: * Added spoof-source support for IPv4 & IPv6 to match 1.6.x functionality. * Added support for remembering the last posistion of file sources across restarts. * Added tcp-wrapper support. * Added support for more than 9 regexp matches. -- Bazsi

3 8

Re: [syslog-ng] Redirect syslog-ng to ttyS0
by kjell.danielsen＠hjemme.no 14 Nov '07

14 Nov '07

Hei. Her is a new trace. Regards Kjell time(NULL) = 1195026575 poll([{fd=13, events=0}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 100) = 0 poll([{fd=13, events=0}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 11, 3448000) = 1 recvfrom(3, "<165>Nov 14 07:49:40 AL[3581]: A"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\2\200\356E\1\200\0\371\1\200\320\21\2\200"}, [0]) = 187 time(NULL) = 1195026580 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026580 time(NULL) = 1195026580 poll([{fd=13, events=POLLOUT, revents=POLLOUT}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 100) = 3 write(13, "Nov 14 07:49:40 lim1 AL[3581]: A"..., 188) = 188 write(10, "Nov 14 07:49:40 lim1 AL[3581]: A"..., 188) = 188 write(4, "Nov 14 07:49:40 lim1 AL[3581]: A"..., 188) = 188 time(NULL) = 1195026580 poll([{fd=13, events=0}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 100) = 0 poll([{fd=13, events=0}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 11, 3443000) = 1 recvfrom(3, "<165>Nov 14 07:49:44 AL[3581]: A"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\2\200\356E\1\200\0\371\1\200\320\21\2\200"}, [0]) = 56 time(NULL) = 1195026584 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026584 time(NULL) = 1195026584 poll([{fd=13, events=POLLOUT, revents=POLLOUT}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 100) = 3 write(13, "Nov 14 07:49:44 lim1 AL[3581]: A"..., 57) = 57 write(10, "Nov 14 07:49:44 lim1 AL[3581]: A"..., 57) = 57 write(4, "Nov 14 07:49:44 lim1 AL[3581]: A"..., 57) = 57 time(NULL) = 1195026584 poll([{fd=13, events=0}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 100) = 0 poll([{fd=13, events=0, revents=POLLERR|POLLHUP}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 3439000) = 1 time(NULL) = 1195026596 close(13) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 3427000) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 155 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 156) = 156 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 156) = 156 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 165 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 3 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 166) = 166 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 166) = 166 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 51 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 52) = 52 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 52) = 52 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 61 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 3 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 62) = 62 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 62) = 62 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 126 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 127) = 127 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 127) = 127 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 136 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 3 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 137) = 137 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 137) = 137 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 51 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 52) = 52 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 52) = 52 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 61 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 3 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 62) = 62 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 62) = 62 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 148 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 149) = 149 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 149) = 149 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 158 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 159) = 159 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 159) = 159 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 3423000) = 1 recvfrom(3, "<165>Nov 14 07:50:05 AL[3581]: A"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 210 time(NULL) = 1195026605 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026605 time(NULL) = 1195026605 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:05 lim1 AL[3581]: A"..., 211) = 211 write(4, "Nov 14 07:50:05 lim1 AL[3581]: A"..., 211) = 211 time(NULL) = 1195026605 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 3418000) = 1 recvfrom(3, "<165>Nov 14 07:50:09 AL[3581]: A"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 56 time(NULL) = 1195026609 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026609 time(NULL) = 1195026609 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:09 lim1 AL[3581]: A"..., 57) = 57 write(4, "Nov 14 07:50:09 lim1 AL[3581]: A"..., 57) = 57 time(NULL) = 1195026609 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 0 poll( <unfinished ...>

1 0

pull logs from remote hosts with syslog-ng?
by Jon Sabo 14 Nov '07

14 Nov '07

Is it possible to use syslog-ng to pull logs from a remote host? If you had a network where only inbound sessions were allowed but nothing was allowed to initiate a connection back, could you have a central syslog-ng server that went out and initiated connections/sessions to remote hosts and pulled back logs? Thanks, Jonathan

2 5

Syslog-ng-2.05 Segmentation Fault
by Daniel Szmandiuk 13 Nov '07

13 Nov '07

Syslog-ng experiences a segmentation fault whenever a message is processed: <stop syslogd first> # syslog-ng -d -d -v -F -e syslog-ng starting up; version='2.0.5' Incoming log entry; line='<28>Nov 9 10:11:24 xinetd[12285]: Exiting...' Filter rule evaluation begins; filter_rule='f_emerg' Filter node evaluation result; filter_result='not-match', filter_type='level' Filter rule evaluation result; filter_result='not-match', filter_rule='f_emerg' Filter rule evaluation begins; filter_rule='f_secure' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_secure' Filter rule evaluation begins; filter_rule='f_cron' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_cron' Filter rule evaluation begins; filter_rule='f_spooler' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter node evaluation result; filter_result='not-match', filter_type='AND' Filter rule evaluation result; filter_result='not-match', filter_rule='f_spooler' Filter rule evaluation begins; filter_rule='f_local7' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_local7' Filter rule evaluation begins; filter_rule='f_messages' Filter node evaluation result; filter_result='match', filter_type='level' Filter rule evaluation result; filter_result='match', filter_rule='f_messages' Initializing destination file writer; template='/var/log/messages', filename='/var/log/messages' Segmentation fault Platform is VMware Guest running RHEL5 x86_64. I used the following steps to build from source: Download eventlog-0.2.5 source ./configure --prefix=/usr --sysconfdir=/etc make make install export PKG_CONFIG_PATH="/usr/lib/pkgconfig" Download syslog-ng-2.0.5 source. ./configure --sysconfdir=/etc make make install I've basically used the supplied config file for Redhat in contrib folder. I'm uncommented the relevant lines in order to use syslog-ng in place of syslogd. Syslog-ng runs OK but as soon as it tries to process a syslog message, it dies with a segmentation fault. Any ideas anyone? Daniel This email and any attachments transmitted with it are confidential and may contain legally privileged information. If you are not the intended recipient you are prohibited from disclosing, copying or using the information contained in it. If you have received this email in error, please notify the sender immediately by return email and then delete all copies of this transmission together with any attachments. It is the addressee's/recipient's duty to virus scan and otherwise test the email before loading it onto any computer system. IMC Communications does not accept liability in connection with any computer virus, data corruption, delay, interruption, unauthorised access or unauthorised amendment in relation to this email. For information about our privacy policy, visit the IMC Communications website at www.imc.net.au This email has been checked by IMC's SMTP gateway. -&-

8 35