- syslog-ng - lists.balabit.hu

Can't install syslog-ng 2 on fedora 6
by Martin H 29 Dec '06

29 Dec '06

Hi, I am trying to install syslog-ng 2 on a Fedora Core 6 computer. I have the glib2-2.12.3-2.fc6 rpm package installed, but when I do a ./configure of syslog-ng, I get the following: checking pkg-config is at least version 0.9.0... yes checking for GLIB... configure: error: Package requirements (glib-2.0) were not met: No package 'glib-2.0' found I even tried installing glib2 from source, but I get the same thing. Specifically, I installed glib-2.12.0.tar.bz2 from source with default path (did not change prefix or any other install dir). I tried pointing the GLIB_LIBS variable to /usr/local/lib/ but I still get the same problem. Does anyone have any ideas why this is? Am I using the wrong path? Or did I install the wrong package? If I choose to do a ./configure --enable-dynamic-linking will syslog-ng start properly, or will I simply get a glib2 error when I try to start syslog-ng? Thanks for your help. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 3

Issues getting data into a MYSQL Database
by Chris Killian 27 Dec '06

27 Dec '06

All, I have without any issues setup syslog-ng with Mysql using the script that I found called syslog2mysql.sh which is shown below. #!/bin/bash if [ ! -e /var/log/mysql.pipe ] then mkfifo /var/log/mysql.pipe fi while [ -e /var/log/mysql.pipe ] do mysql -u syslogfeeder --password=ergosum syslog < /var/log/mysql.pipe >/dev/null done This works fine with most devices however I have added a new one and no messages are being recieved, this is what happens when I strace the process. viper:/home/chrisk# strace -p 13232 Process 13232 attached - interrupt to quit read(0, "INSERT INTO logs\n(host, facility"..., 4096) = 275 read(0, "INSERT INTO logs\n(host, facility"..., 4096) = 275 read(0, "INSERT INTO logs\n(host, facility"..., 4096) = 275 write(2, "ERROR", 5) = 5 write(2, " at line 13", 11) = 11 write(2, ": Unknown command \'\\\'\'.\n", 24) = 24 fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 read(3, 0x8060318, 16384) = -1 EAGAIN (Resource temporarily unavailable) fcntl64(3, F_SETFL, O_RDWR) = 0 write(3, "\1\0\0\0\1", 5) = 5 shutdown(3, 2 /* send and receive */) = 0 close(3) = 0 exit_group(1) = ? Process 13232 detached viper:/home/chrisk# The process dies and it restarted with nothing being put into the database. Anyone got any ideas at all?? Regards Chris K

1 0

Double hostname in log excerpt
by Steve Finkelstein 23 Dec '06

23 Dec '06

Hi all, I'm sending messages over a udp() stream to a centralized logging host using syslog-ng. The centralized server is displaying output like this: Dec 22 11:36:31 cc15-5 cc15-5 syslog-ng[4748]: syslog-ng version 1.6.8 starting Is there a global option to disable that second c15-5? I'm not sure why it's being displayed twice. Generally syslogd would only incorporate this once. I have the following global options set: options { stats(43200); chain_hostnames(off); sync(0); }; Thanks, Steve !DSPAM:3343,458c14af306121939910367!

2 1

Syntax error when using the tcp-keep-alive() option
by Jonathan Turner 22 Dec '06

22 Dec '06

Hi there, I'm working on using syslog-ng within our environment mainly due to the ability to use syslog with tcp. I will be traversing firewalls and therefore the tcp-keep-alive() option is vital for me. However when I try to turn this on in my tcp source it gives me a syntax error. I have pasted in the relevant part of the config below. I'm pretty sure I have it right. The strange thing is that when I search the source code for the option I can't find anything as if it has been removed from version 2.0 (the version I'm using). Does anyone know what may have happened to the tcp-keep-alive option in version 2.0 and, if I'm right and it isn't there, what are the options in syslog-ng that I could use to prevent the sessions timing out on firewalls? source testsrc { tcp( ip(0.0.0.0) port(5514) max-connections(300) keep-alive(yes) tcp-keep-alive(yes) ); }; Thanks.

2 2

UDP Socket Dying
by William Bell 22 Dec '06

22 Dec '06

We have recently switched to the latest version of syslog-ng/ eventlog and we are experiencing a problem where syslog-ng is losing its udp listener after about 20 minutes. We are receiving about 400 msgs/s to this port which can easily be handled by syslog-ng. Does anyone have any ideas as to the cause of this? We are experiencing it on multiple builds of linux.( 2 LFS Builds, 1 CentOS build). Load on the box never budges during this time period. I have not attached any debugging as of yet. Version: Snapshot 122106 of both eventlog and syslog-ng. William L. Bell II, CISSP, SSCP

2 1

remove_if_older()
by anthony lineham 21 Dec '06

21 Dec '06

>From the description in the reference manual I was expecting remove_if_older() to cause a destination file to be deleted once the file becomes older than the specified age, in seconds. However, this is not the behaviour I have observed. It seems that the age check is only made the first time the file is written too. I've had a quick look through the code and it looks like the age check is only made in affile_dw_init, which I assume is called when the file is first opened. This would be consistent with my observations. Is this the intended behaviour? Thanks Anthony

4 8

max-connections
by Hari Sekhon 20 Dec '06

20 Dec '06

I've got a central logserver on syslog-ng and am getting the following in my logs: syslog-ng[26180]: Error accepting AF_UNIX connection, opened connections: 100, max: 100 but I clearly have source s_tcp { tcp( port(50514) max-connections(1000)); }; source s_udp { udp(); }; in my syslog-ng.conf and the server was restarted since this change (it was made a while ago). Can anybody tell me why this is? Is it possible that it's the udp which is hitting the 100 limit (I thought since udp was connectionless this would unlikely)? -- Hari Sekhon

3 4

newbie question on dns_cache in syslog2.x
by jrhendri＠maine.rr.com 20 Dec '06

20 Dec '06

Apologies in advance for the the newbie question. I did search the archives, the FAQ and look at the source before posting. I am configuring a fedora core 5 system with syslog-ng-2.0rc4 and have not had any success with dns_cache(yes) actually doing anything. I setup tcpdump to watch the DNS traffic and am generating logs toward the box. No matter whether I have dns_cache enabled or not I see dns lookups for each inbound message. When I look at the source code, I find the resolve_hostname() function in misc.c and I don't see any caching code. What I do see is: /* FIXME: add nscache support here */ Am I missing something? How does dns_cache(yes) actually work? I do want to use hostnames in the logging directories, but I do not want each syslog message to trigger a DNS query. Should I just use nscd on the server and not worry about it :-) Thanks again! Jim

3 3

Use of sockaddr_storage in src/fdread.c
by Albert Chin 19 Dec '06

19 Dec '06

While building syslog-ng-2.0.0 on Solaris 7/SPARC: cc -DHAVE_CONFIG_H -I. -I. -I.. -DPATH_SYSCONFDIR=\"/etc/opt/TWWfsw/syslogng20\" -DPATH_LOCALSTATEDIR=\"/var/opt/TWWfsw/syslogng20\" -I/opt/TWWfsw/libglib26/include -I/opt/TWWfsw/libglib26/lib/include -I/opt/TWWfsw/gettext014/include -I/opt/TWWfsw/syslogng20/include/eventlog -D_GNU_SOURCE -mr -Qn -xstrconst -xO2 -xtarget=ultra2 -xarch=v8plusa -c fdread.c "fdread.c", line 45: incomplete struct/union/enum sockaddr_storage: sas This platform does not have struct sockaddr_storage, as used in src/fdread.c. Is syslog-ng _only_ for IPV6 systems? -- albert chin (china(a)thewrittenword.com)

2 1

src/afstreams.c needs prototype for g_fd_set_cloexec()
by Albert Chin 18 Dec '06

18 Dec '06

src/afstreams.c should #include misc.h for the prototype of g_fd_set_cloexec(). Patch attached. -- albert chin (china(a)thewrittenword.com)

2 1