- syslog-ng - lists.balabit.hu

Re: [syslog-ng] configure error
by ictforever 10 Jun '07

10 Jun '07

> > Any advice and suggestion are appreciated.Thanks Did you export the environment variable? Check that # pkg-config eventlog --cflags returns anything at all. If it doesn't, investigate why (strace and friends could help here) here are envs: LD_LIBRARY_PATH=/usr/local/eventlog/lib PKG_CONFIG_PATH=/usr/local/eventlog/lib/pkgconfig/ [root@test syslog-ng-2.0.4]# pkg-config eventlog --cflags -I/usr/local/eventlog/include/eventlog but there is the same error: .............................. checking for GLIB... yes checking for EVTLOG... no configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? why? Thanks Regards.

2 1

configure error
by ictforever 08 Jun '07

08 Jun '07

Hi, when I wanted to install syslog-ng-2.0.4,I met some troubles.I installed eventlog-0.2.4 at /usr/local/eventlog,and setted the PKG_CONFIG_PATH=/usr/local/eventlog/lib/pkgconfig,but when I run ./configure,there were errors: ........................................ checking whether to enable TCP wrapper support... yes checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... Requested 'eventlog >= 0.2' but version of EventLog is no configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? Any advice and suggestion are appreciated.Thanks Regards

2 1

patch for syslog-ng-2.0.4 to handle missing files in "follow" mode
by Charles G Waldman 07 Jun '07

07 Jun '07

The new "follow_freq" feature is nice, because you no longer have to do things like "tail -f | logger" to get external logfiles into syslog-ng. However, one case is not handled gracefully, and this is the case when a log file is not present when syslog-ng starts up. In this case, an error is reported, and the file is dropped from the list of sources. It is possible that the file just hasn't been created yet, because syslog-ng is starting before some other server which creates the file. The attached patch modifies the startup behavior, so that if an input file is nonexistent and follow mode is enabled (i.e. follow_freq > 0), then the open is "deferred" - a log reader object is created with a file descriptor set to -1, and the existing logic is used to periodically check if the file comes into existence: conceptually, it looks basically like a file move, where the file is being moved from non-existence into existence :-) Patch attached... comments welcome.

1 0

Simple Doubt
by Luiz Cruz 06 Jun '07

06 Jun '07

Hi all, I have a doubt about a process that i have. Maybe the solution is in the side of syslog-ng, i am searching. My process is: Log -> Perl Script -> Fifo -> Syslog-ng -------------- > Syslog-ng -> perl -> rrd The problem is when the application write to many lines in the fifo file (through the perl script), my syslog-ng (Standard Configuration) can't process all lines quickly, and the load of cpu rises a lot. Is there any parameters that i can use to optimize the reading? Someone have a similar solution? Thanks a lot. Att., Luiz

3 7

2.0.4 compilation issues
by Douglas J Hunley 04 Jun '07

04 Jun '07

I'm trying to compile 2.0.4 using: ./configure --prefix=/usr --sysconfdir=/etc --enable-dynamic-linking and right away, it fails telling me that libnet-config isn't found. Which is correct, I don't have it installed. There wasn't anything in the tarball that told me I needed to. A 'grep -ri libnet *' shows a bunch of check in the configure and this ChangeLog entry: ChangeLog: * configure.in: added --with-libnet and --enable-spoof-source Is there a reason this dependency isn't documented inside the tarball, or am I missing some file/reference somewhere? Moving on, I went and downloaded the latest libnet, only to find out that the latest doesn't include libnet-config (it's deprecated). So now I have to downgrade my libnet. Moving on again, the compile fails: if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -DLIBNET_LIL_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O3 -march=k8 -mmmx -msse -msse2 -m3dnow -pipe -fomit-frame-pointer -Wall -g -MT cfg-grammar.o -MD -MP -MF ".deps/cfg-grammar.Tpo" \ -c -o cfg-grammar.o `test -f 'cfg-grammar.c' || echo './'`cfg-grammar.c; \ then mv -f ".deps/cfg-grammar.Tpo" ".deps/cfg-grammar.Po"; \ else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before 'libnet_t' afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to 'int' in declaration of 'AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y: In function 'yyparse': /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:590: error: syntax error before ')' token /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:623: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/home/doug/syslog-ng-2.0.4/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/doug/syslog-ng-2.0.4' make: *** [all] Error 2 And there I'm stuck. On a whim, I 'upgrade' my libnet and it suddenly compiles w/o issue.. I think the libnet dependency needs to be re-examined -- Douglas J Hunley (doug at hunley.homeip.net) - Linux User #174778 http://doug.hunley.homeip.net I think, therefore, I am ... not related to you.

2 2

RE: [syslog-ng] undefined reference to `libnet_init'
by Tapas Mallick 04 Jun '07

04 Jun '07

Hello List, I am trying to install syslog-ng 2.0.4 on RHEL 4 (on top of VMWARE) and I am getting the same error message while "make" the software. ============================================= make all-recursive make[1]: Entering directory `/tmp/syslog-ng-2.0.4' Making all in src make[2]: Entering directory `/tmp/syslog-ng-2.0.4/src' gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -lglib-2.0 -L/usr/local/lib -levtlog -lwrap -Wl,-Bdynamic libsyslog-ng.a(afinet.o)(.text+0x776): In function `afinet_dd_init': /tmp/syslog-ng-2.0.4/src/afinet.c:338: undefined reference to `libnet_init' libsyslog-ng.a(afinet.o)(.text+0x895): In function `afinet_dd_queue': /tmp/syslog-ng-2.0.4/src/afinet.c:493: undefined reference to `libnet_write' libsyslog-ng.a(afinet.o)(.text+0x8d5):/tmp/syslog-ng-2.0.4/src/afinet.c:505: undefined reference to `libnet_geterror' libsyslog-ng.a(afinet.o)(.text+0x96f):/tmp/syslog-ng-2.0.4/src/afinet.c:364: undefined reference to `libnet_clear_packet' libsyslog-ng.a(afinet.o)(.text+0x9b3):/tmp/syslog-ng-2.0.4/src/afinet.c:366: undefined reference to `libnet_build_udp' libsyslog-ng.a(afinet.o)(.text+0x9ef):/tmp/syslog-ng-2.0.4/src/afinet.c:377: undefined reference to `libnet_build_ipv4' libsyslog-ng.a(afinet.o)(.text+0xa58):/tmp/syslog-ng-2.0.4/src/afinet.c:426: undefined reference to `libnet_clear_packet' libsyslog-ng.a(afinet.o)(.text+0xa98):/tmp/syslog-ng-2.0.4/src/afinet.c:428: undefined reference to `libnet_build_udp' libsyslog-ng.a(afinet.o)(.text+0xab5):/tmp/syslog-ng-2.0.4/src/afinet.c:442: undefined reference to `libnet_toggle_checksum' libsyslog-ng.a(afinet.o)(.text+0xaf6):/tmp/syslog-ng-2.0.4/src/afinet.c:444: undefined reference to `libnet_build_ipv6' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/tmp/syslog-ng-2.0.4/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/tmp/syslog-ng-2.0.4' make: *** [all] Error 2 ========================================= Attaching config.log too for your reference. Thanks And Regards, Tapas Mallick ____________________________________________________________________________________ Need a vacation? Get great deals to amazing places on Yahoo! Travel. http://travel.yahoo.com/

3 3

Logging loop
by bryanh＠giraffe-data.com 01 Jun '07

01 Jun '07

My syslog-ng got into an infinite loop when it didn't have permission to write to a file destination. It tried to log to that same destination the fact that it failed to log. Is there a recommended way to configure syslog-ng to avoid this? Maybe I could route messages from Syslog itself to some relatively reliable destination or just turn them off? If not, what would be a good enhancement to the program to avoid loops? I had the problem with syslog-ng 2.0.2. -- Bryan Henderson San Jose, California

4 5

Distributed syslog architecture
by Raghu (Lists) 30 May '07

30 May '07

Hi all, I am working on a project to build distributed syslog-ing system for a very lager enterprise with offices all across the globe. Below are the main objectives: 1. Support for primarily network devices, like ciscos, netscreens, junipers etc 2. Minimum or no loss of messages when network fails 3. Central storage of all syslog messages Could you please give me your ideas or point me to any documentation that deals with such designs? Thank you!

4 5

compiling syslog-ng 2.0.4
by Folkert van Heusden 30 May '07

30 May '07

Hi, I'm trying to compile syslog-ng 2.0.4 but fail to. It gives the following errors: if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -DLIBNET_LIL_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -march=pentium4 -fprefetch-loop-arrays -Wall -g -MT cfg-grammar.o -MD -MP -MF ".deps/cfg-grammar.Tpo" \ -c -o cfg-grammar.o `test -f 'cfg-grammar.c' || echo './'`cfg-grammar.c; \ then mv -f ".deps/cfg-grammar.Tpo" ".deps/cfg-grammar.Po"; \ else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:590: error: syntax error before ')' token /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:623: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/usr/src/syslog-ng-2.0.4/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/src/syslog-ng-2.0.4' make: *** [all] Error 2 What could be the cause? And how do I fix this? Folkert van Heusden -- MultiTail is a versatile tool for watching logfiles and output of commands. Filtering, coloring, merging, diff-view, etc. http://www.vanheusden.com/multitail/ ---------------------------------------------------------------------- Phone: +31-6-41278122, PGP-key: 1F28D8AE, www.vanheusden.com

3 5

[PATCH] Added SElinux module for running syslog-ng on RHEL5.
by Jan-Frode Myklebust 26 May '07

26 May '07

Here's a small patch adding a small SElinux module that makes it possible to run syslog-ng on RHEL5 with SElinux in default enforcing mode. --- contrib/rhel-packaging/syslog_ng.te | 20 ++++++++++++++++++++ contrib/rhel-packaging/syslog_ng.te.README | 14 ++++++++++++++ 2 files changed, 34 insertions(+), 0 deletions(-) create mode 100644 contrib/rhel-packaging/syslog_ng.te create mode 100644 contrib/rhel-packaging/syslog_ng.te.README diff --git a/contrib/rhel-packaging/syslog_ng.te b/contrib/rhel-packaging/syslog_ng.te new file mode 100644 index 0000000..449756c --- /dev/null +++ b/contrib/rhel-packaging/syslog_ng.te @@ -0,0 +1,20 @@ +module syslog_ng 1.0; + +require { + class sock_file { getattr unlink }; + class tcp_socket { create bind setopt name_bind node_bind listen }; + class dir { write add_name }; + class file { create write getattr read }; + type device_t; + type syslogd_t; + type rsh_port_t; + type inaddr_any_node_t; + type var_t; +}; + +allow syslogd_t device_t:sock_file { getattr unlink }; +allow syslogd_t rsh_port_t:tcp_socket name_bind; +allow syslogd_t inaddr_any_node_t:tcp_socket node_bind; +allow syslogd_t self:tcp_socket { create listen bind setopt }; +allow syslogd_t var_t:dir { write add_name }; +allow syslogd_t var_t:file { create write getattr read }; diff --git a/contrib/rhel-packaging/syslog_ng.te.README b/contrib/rhel-packaging/syslog_ng.te.README new file mode 100644 index 0000000..df316a1 --- /dev/null +++ b/contrib/rhel-packaging/syslog_ng.te.README @@ -0,0 +1,14 @@ +"syslog_ng.te" is the necessary selinux module to allow syslog-ng +running on RHEL5 (with selinux in default enforcing mode). It's +necessary for up for letting the syslogd_t domain access /proc/kmsg, +listen on 514/tcp and write /var/syslog-ng.persist. + +To build and load it, execute: + + checkmodule -M -m -o syslog_ng.mod syslog_ng.te + semodule_package -o syslog_ng.pp -m syslog_ng.mod + semodule -i ./syslog_ng.pp + +The module can be removed from the system by executing: + + semodule --remove=syslog_ng -- 1.5.1

2 5