- syslog-ng - lists.balabit.hu

If a destination{} fails ...
by Brian A. Seklecki 25 Oct '06

25 Oct '06

If a message is qualified for many destinations{} before finally hitting a cath-all fallback destination{} at the bottom of the config, will processing of that message stop at the failed facility {} ? ~BAS

2 2

flags(fallback)
by Brian A. Seklecki 25 Oct '06

25 Oct '06

"This flag makes a log statement 'fallback'. Being a fallback statement means that only messages not matching any 'non-fallback' log statements will be dispatched." Presumably this means "...messages not matching any 'non-fallback' log statements flagged as 'final' ...." Could it be possible to change the behavior, or have an alternate mode, that catches all message that haven't reached a "final" yet? ~BAS l8* -lava (Brian A. Seklecki - Pittsburgh, PA, USA) http://www.spiritual-machines.org/ "...from back in the heady days when "helpdesk" meant nothing, "diskquota" meant everything, and lives could be bought and sold for a couple of pages of laser printout - and frequently were."

2 2

Problem compiling syslog-ng 1.6.8 on HP-UX
by olivier "madmax"rolland 25 Oct '06

25 Oct '06

I Tried to compile syslog-ng 1.6.8 on HP-UX 11.11 and 11.23 but a lot of warning appeared: ./configure --enable-full-dynamic make gcc -g -O -Wall -I/usr/local/include/libol -D_GNU_SOURCE -fPIC -ldl - o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile. o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afus er.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o mac ros.o getopt.o getopt1.o -lnsl -ll /usr/local/lib/hpux32/libol.a -lnsl -lxnet ld: (Warning) Unsatisfied symbol "yylenguc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyinput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyunput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyolsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyoutput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextuc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyextra" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyfnd" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyprevious" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylstate" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextarr" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyback" in file /usr/lib/hpux32/libl.so 13 warnings. What can I do in order to resolve those warnings? ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Demandez à ceux qui savent sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

3 2

ignore src{}; contents at startup?
by Brian A. Seklecki 25 Oct '06

25 Oct '06

All: On FreeBSD, /dev/klog provides for output from the kernel (normally redirected to /dev/console before syslog starts). At startup, /etc/rc.d/dmesg copies the kernel boot hardware paramters to /var/run/dmesg.boot. If I have my src(); set to: source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; ...at starup, syslog-ng drains the contents of /dev/klog. By default it tsends to them to user.notice. I like to log{} these to an SMS pager (so I know if a RAID is failing or other hardware problem). However, I'd like to avoid duplication of the efforts of /etc/rc.d/dmesg on behalf of syslog-ng(8) ...especially since I route user.notice to my pager, and kernel boot dmesg(8) can grow over 50 lines. /dev/klog really isn't a socket. It's a special char device. Is there anyway to tell syslog-ng(8) to ignore it's contents at startup? If it was tail(1), i'd say "tail -0 -f /file". Perhaps clear out the contents of /dev/klog somehow? TIA, ~BAS

2 2

proper procedure for filing bug reports (fwd)
by Brian A. Seklecki 25 Oct '06

25 Oct '06

On Fri, 6 Oct 2006, Balazs Scheidler wrote: > On Tue, 2006-09-19 at 11:37 -0500, Matt Zagrabelny wrote: >> just curious what people do for bug reports with syslog-ng... > > send it to this mailing list. That's quite an interesting approach. Most projects, regardless of size, tending to maintain some sort of sf.net or collab.net project page where they can manage bug reports, patches, mailing lists, auto builds, docs, statistics, CVS/SVN, forums, mailing list archives, etc. If if the problem report load is low, it would be nice if dev/users had the full suite of F/OSS development tools available somewhere. ~BAS > > -- > Bazsi l8*

1 0

syslog-ng 2.0rc4 released
by Balazs Scheidler 24 Oct '06

24 Oct '06

Hi, I have released 2.0rc4 with the latest bugfixes. The NEWS entry is below. I'd appreciate feedback on the stability of this version, so that I can finally prepare a 2.0.0 final. 2.0rc4 Tue, 24 Oct 2006 13:33:55 +0200 Bugfixes: * Another leak fix in 2.0rc2 caused syslog-ng to crash when a destination TCP/unix-stream connection was broken. * Fixed EOF detection for destination connections. -- Bazsi

1 0

Segmantation fault
by Sergey N. Romanov 22 Oct '06

22 Oct '06

Hi there, I have syslog-ng 2.0rc3 on FreeBSD 5.4. >From time to time I have problems. Syslog-ng dies with core dump. This is output from gdb NU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"... Core was generated by `syslog-ng'. Program terminated with signal 11, Segmentation fault. #0 log_writer_broken (self=0x820e080, notify_code=3) at logpipe.h:77 77 logpipe.h: No such file or directory. in logpipe.h (gdb) where #0 log_writer_broken (self=0x820e080, notify_code=3) at logpipe.h:77 #1 0x08051199 in log_writer_fd_dispatch (source=0x81f0540, callback=0, user_data=0x0) at logwriter.c:361 #2 0x0805b7b1 in g_main_context_dispatch () #3 0x0805cb76 in g_main_context_iterate () #4 0x0805cf5b in g_main_context_iteration () #5 0x080483ac in main_loop_run (cfg=0x81f1300) at main.c:162 #6 0x08048a8c in main (argc=0, argv=0x0) at main.c:420 (gdb) In syslog-ng config I have some pipe sources. I have this problem after upgrade from 1.6 to 2.0rc3. Any ideas why I have this problem and how to fix this? -- Best regards, Sergey N. Romanov

3 4

lazy logger++
by Alexander Clouter 22 Oct '06

22 Oct '06

Hi, This is probably the last thing you care about during the release candidate phase but a single bit of extra functionality would be greatly useful for those using the multicast logging feature. What I am planning on doing is having something like the following in my syslog-ng.conf file which is fantastic as to add logging groups I just add extra udp() lines to s_multicastGeneric and nothing else is needed. At the moment I would need separate source/destination/log entries per multicast group address, which is upsetting and results in a hideous configuration file. ==================== source s_multicastGeneric { ## squid # access udp(ip(239.194.251.0) port(514)); # cache udp(ip(239.194.251.32) port(514)); }; destination df_multicastGeneric { file("/var/log/syslog-ng/mulitcastGeneric/$DESTIP/$R_YEAR$R_MONTH$R_DAY.log"); }; log { source(s_multicastGeneric); destination(df_multicastGeneric); flags(final); }; ==================== I have actually had a go at patching syslog-ng to do this, however my patching effort is getting out of control. My method is to add the IP_PKTINFO (or IP_RECVDSTADDR) socket option to the multicast receive section in afinet_setup_socket() but thats about as far as I have gotten. I'm still working on trying to produce a patch myself but I am hoping someone on this list might have a better idea on how to cleanly get the information needed for $DESTIP to function from macros.c without doing anything major to the sourcecode. Whilst I am in my 'moon-on-a-stick' request list, a $HOST_TO in addition to $DESTIP would be handy too. :) As I said, I'm working on a patch at my end and will post it here once done, but its unlikely to be pretty... :) Cheers Alex

2 3

Destination regex question
by James Whitt 18 Oct '06

18 Oct '06

My question is about using regex and breaking up the parts of a string to use in the destination. Here's the situation. We have all of our firewalls logging into one box that is running syslog-ng. We want to break them up into a directory structures such as: /logs/location1/firewall/host1/ /logs/location2/firewall/host1/ /logs/location2/firewall/host2/ Now the hostname contains all the information needed to do this. For example, a host name might be: firewallname.firewall.location1 anothername.firewall.location2 Up to this point, for each location I've had to do the following in syslog to map to the correct directory: destination location1_firewall { file("/logs/location1/firewall/$HOST/$R_YEAR-$R_MONTH-$R_DAY.log"); }; filter location1_firewall { host(.firewall.location1$); }; log { source(external); filter(location1_firewall); destination(location1_firewall); }; This works completely fine. The only issue is that we have over 80 different locations, so this would need to have these three lines modified and added for each location. We're also adding more over time, so each time another location is set up, we need to go through the configuration and update. I was hoping there woud be a way to just combine them all together. Something like: destination firewall { host(.firewall.(.+)$); file("/logs/$1/firewall/$HOST/$R_YEAR-$R_MONTH-$R_DAY.log"); }; filter firewall { host(.firewall.); }; log { source(external); filter(firewall); destination(firewall); }; I know the regex syntax might be different, but was curious if this kind of situation is possible.

2 1

Error accepting AF_UNIX connection, opened connections: 100, max: 100
by Hari Sekhon 18 Oct '06

18 Oct '06

I'm getting the following on a host that is sending logs to a remote central logserver: syslog-ng[2390]: Error accepting AF_UNIX connection, opened connections: 100, max: 100 Why is this happening? It isn't accepting logs, it's only sending them. And I also increased the remote logserver's max to 100 with the following line source s_tcp { tcp( port(<someport>) max-connections(1000)); }; For a start, I don't have 100 hosts logging to the remote logserver. Second, this host isn't the logserver so it shouldn't have this in it's /var/log/messages!!!! Can anyone explain this strange behavior? Thanks -h -- Hari Sekhon

2 3