- syslog-ng - lists.balabit.hu

rotating logs at 12:00 noon
by Navin Jathan 07 Mar '06

07 Mar '06

Hi, I am new to syslog-ng. I am not a programmer, but configuration of syslog-ng feels like I programming something!!! Wish I could get over this soon!! Apart from normal logging operation, I use syslog-ng to log PIX firewall logs from the network. Following is the configuration file: <..snip..> filter f_11 { facility(local0) and level(debug..emerg); }; destination d_8 { file("/var/log/pix/SyslogCatchAll-$DAY-$MONTH-$YEAR.log" create_dirs(yes)); }; log { source(local); filter(f_11); destination(d_8); }; <../snip..> This would typically rotate the logs at 12:00 at midnight daily. But I need to rotate the logs at 12:00 noon daily. Is it possible to configure syslog-ng in this manner? How do I do it? I had unsuccessfully tried to use logrotate with the native syslog utility in Linux. Do I have to use logrotate here again? Thanks in Advance, Regards, Navin Jathan. Disclaimer: Information transmitted by this e-mail is proprietary to Adventity and/ or its Customers, intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If you are not the intended recipient or it appears that this mail has been forwarded to you without proper authority, you are notified that any use or dissemination of this information in any manner is strictly prohibited. In such cases, please notify us immediately at postmaster(a)adventity.com and delete this mail from your records.

2 1

Checking for drops with netstat -s
by Cary, Kim 06 Mar '06

06 Mar '06

Syslog-ng 1.6.4 on Solaris 9: IPv4 udpInOverflows =640473547 UDP udpInDatagrams =409687632 udpInErrors = 0 udpOutDatagrams =466811 udpOutErrors = 0 Does the udpInOverflows indicate I'm losing packets?

2 1

filtering logs from a file?
by Steven Matkoski 06 Mar '06

06 Mar '06

Hi, I am using syslog-ng 1.6.5-2.2 on a Debian box in a chroot environment. I have a default configuration except for gathering log messages from a few routers, a pix, and vpn concentrator. I have the logs going into the files I want, but the logs are also going into files I don't want. I currently have all the routers logging into a routers/ directory and the pix and vpn logging into a security/ directory, but the pix and vpn are also logging into the router directory which I would like to stop. I have tried a bunch of different filters but nothing seems to work. Any help appreciated. My configuration: # router syslog source s_syslogd { udp(ip(0.0.0.0) port(514)); }; # router syslog destination d_router { file("/var/log/routers/$HOST"); }; destination d_security { file("/var/log/security/$HOST"); }; # router syslog filter f_router { not host(/<vpn ip>/) or not host(/<pix ip>/); }; filter f_security { host(<vpn ip>) or host(<pix ip>); }; # router.* #log { source(s_syslogd); filter(f_router); destination(d_router); }; log { source(s_syslogd); destination(d_router); }; # firewall, vpn concentrtor log { source(s_syslogd); filter(f_security); destination(d_security); }; thanks. -s.

1 0

how can I change the priority/facility of a log entry?
by Dave Augustus 02 Mar '06

02 Mar '06

Hello All, I have spent hours looking for this. Is there a way, using syslog-ng to re-write an incoming log entry's priority/facility. We have some windows boxen that we are logging but the log entries need a little massaging. Any ideas would be helpful. TIA -- Dave Augustus <davea(a)support.kcm.org>

2 1

Syslog-ng 1.6.9 just stops...
by Andreoli, Tony A. USNUNK NAVAIR B1490, R215 01 Mar '06

01 Mar '06

I'm using 1.6.9 (upgraded from 1.6.6 because I was seeing the same problem). I have it running on 8 different servers at different locations, some are SMP, some aren't. On these hosts, we have anywhere from 2 to 14 devices logging to the servers, some via 514/tcp, others via 514/udp. All of the loggers typically sit with a load average < 1 (usually not even registering), and a cpu idle of 99%. 7 of these remote loggers also log to our local machine, but only 5 lines every 2 minutes (for stats). What I've noticed (and I've seen this on all of them at one time or another), is that syslog-ng just stops. ps shows it running, but the log file (/logs/messages) never changes. If I tcpdump on the interface that it's listening on, I see traffic, and it seems that the act of tcpdumping causes the log file to start to grow again, then a little while later, it may stop again. It's sporadic though, on one of my systems, it hasn't done it in over 2 months, on another, it's done it 3 times today. I've pulled out my last hair and still haven't come any closer to a solution. I've recompiled the source, loaded 3 different versions, etc. The only thing common is that all of these systems are running RHEL3. Any help would be greatly appreciated. Thanks, Tony

4 3

RE: [syslog-ng] Syslog-ng 1.6.9 just stops...
by Andreoli, Tony A. USNUNK NAVAIR B1490, R215 01 Mar '06

01 Mar '06

Thanks for the reply. Yes, I do have it running, but the problem is more frequent than nightly. My logrotate script gets run every night at midnight, yet syslog-ng has stopped running 5 times today (in the last 6 hours) on one of my systems. Thanks, Tony _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of David Anderson Sent: Wednesday, March 01, 2006 12:19 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 1.6.9 just stops... R215, Wednesday, March 1, 2006, 3:01:47 PM, you wrote: > I'm using 1.6.9 (upgraded from 1.6.6 because I was seeing the same problem). I have it running on 8 different servers at different locations, some are SMP, some aren't. On these hosts, we have anywhere from 2 to 14 devices logging to the servers, some via 514/tcp, others via 514/udp. All of the loggers typically sit with a load average < 1 (usually not even registering), and a cpu idle of 99%. 7 of these remote loggers also log to our local machine, but only 5 lines every 2 minutes (for stats). What I've noticed (and I've seen this on all of them at one time or another), is that syslog-ng just stops. ps shows it running, but the log file (/logs/messages) never changes. If I tcpdump on the interface that it's listening on, I see traffic, and it seems that the act of tcpdumping causes the log file to start to grow again, then a little while later, it may stop again. It's sporadic though, on one of my systems, it hasn't done it in over 2 months, on another, it's done it 3 times today. I've pulled out my last hair and still haven't come any closer to a solution. I've recompiled the source, loaded 3 different versions, etc. The only thing common is that all of these systems are running RHEL3. Any help would be greatly appreciated. Thanks, Tony You haven't got Logrotate running, have you? I found that unless I restarted syslog-ng in the rotate scripts, then nothing further was logged. -- Best regards, David mailto:dma@pern.co.uk

1 0

Reverse DNS
by Jesper Markenstam 01 Mar '06

01 Mar '06

Hello, I am sure this topic has been beaten to death, but I cannot find answers anywhere. Apologies if I have missed something - here we go: I run syslog-ng 1.6.4 on Sol 9 Sparc (sunfreeware distribution). It works fine, except I want syslog-ng to resolve IP's to hostnames, and create directories using the resolved name rather than IP (long term, I will look at MySQL, but I would still have to get either DNS or keep_hostname to work). I installed bind 9.2.3 on the log server and setup a reverse zone authoritative for in-addr.arpa., but it still doesn't work. At this time, I prefer to use reverse DNS rather than hostname. I was not able to create_dirs based on keep_hostname(yes) either. dig works, and returns NOERROR when I run dig -x 1.2.3.4 @127.0.0.1 for example. The reverse zone is fully populated with all hosts that will be logging syslog-ng. nsswitch.conf: hosts: dns files ipnodes: dns files everything else is files only. resolv.conf: nameserver 127.0.0.1 syslog-ng.conf: # Options options { use_fqdn(no); use_dns(yes); dns_cache(yes); sync(5); keep_hostname(no); chain_hostnames(no); create_dirs(yes); # bad! perm(0644); dir_perm(0755); use_time_recvd(yes); }; # Sources source s_udp { udp(); }; # logging to console destination l_console { file ("/dev/console"); }; # logging of cisco's via udp to individual files and to one file destination r_cisco { file( "/remote/$HOST/$HOST-$YEAR$MONTH.LOG" ); file( "/r emote/all/alldevices.log" ); }; # Remote sources log { source (s_udp); destination (r_cisco); }; Kind regards Jesper Jesper Markenstam IS&T Systems Analyst REUTERS.KNOW.NOW. www.reuters.com <http://www.reuters.com/> To find out more about Reuters visit www.about.reuters.com Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Reuters Ltd.

2 1

RE: [syslog-ng] Make Error messages
by Stuart Boyle 28 Feb '06

28 Feb '06

Removed 1.9.8 and installed 1.9.9 and it went very smoothly. Many thanks for the assistance. Stuart -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Tuesday, February 28, 2006 2:59 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Make Error messages On Tue, 2006-02-28 at 14:06 -0500, Stuart Boyle wrote: > The file cfg-lex.c is empty !! Now, that's what I suspected. This is a problem. Try removing the file or restore it from the tarball and recompile. (please note that I've release 1.9.9 which should be better than 1.9.8 wsa) -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] Make Error messages
by Stuart Boyle 28 Feb '06

28 Feb '06

Output from ./configure :/usr/local/syslog-ng-1.9.8 # ./configure checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc option to accept ANSI C... none needed checking for bison... bison -y checking for flex... flex checking for yywrap in -lfl... yes checking lex output file root... lex.yy checking whether yytext is a pointer... yes checking whether make sets $(MAKE)... (cached) yes checking for ranlib... ranlib checking how to enable static linking for certain libraries... GNU or Solaris checking how to run the C preprocessor... gcc -E checking for egrep... grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dmalloc.h usability... no checking dmalloc.h presence... no checking for dmalloc.h... no checking for strings.h... (cached) yes checking openssl/ssl.h usability... no checking openssl/ssl.h presence... no checking for openssl/ssl.h... no checking getopt.h usability... yes checking getopt.h presence... yes checking for getopt.h... yes checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/strlog.h usability... no checking sys/strlog.h presence... no checking for sys/strlog.h... no checking door.h usability... no checking door.h presence... no checking for door.h... no checking whether struct tm is in sys/time.h or time.h... time.h checking for struct tm.tm_gmtoff... yes checking for I_CONSLOG... no checking for door_create in -ldoor... no checking for socket in -lsocket... no checking for gethostbyname in -lnsl... yes checking for regexec in -lregex... no checking for strdup... yes checking for strtol... yes checking for inet_aton... yes checking for inet_ntoa... yes checking for getopt_long... yes checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking for pkg-config... /usr/local/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB_CFLAGS... -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include checking for GLIB_LIBS... -L/usr/local/lib -lglib-2.0 checking for EVTLOG_CFLAGS... -I/usr/local/include/eventlog checking for EVTLOG_LIBS... -L/usr/local/lib -levtlog checking for static GLib libraries... yes configure: creating ./config.status config.status: creating dist.conf config.status: creating Makefile config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating doc/docvars.xml config.status: creating contrib/Makefile config.status: creating tests/Makefile config.status: creating tests/unit/Makefile config.status: creating tests/functional/Makefile config.status: creating config.h config.status: config.h is unchanged config.status: executing depfiles commands Output from MAKE :/usr/local/syslog-ng-1.9.8 # make make all-recursive make[1]: Entering directory `/usr/local/syslog-ng-1.9.8' Making all in src make[2]: Entering directory `/usr/local/syslog-ng-1.9.8/src' gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -Wl,-Bdynamic libsyslog-ng.a(cfg.o)(.text+0x5d6): In function `cfg_new': /usr/local/syslog-ng-1.9.8/src/cfg.c:247: undefined reference to `lex_init' libsyslog-ng.a(cfg-grammar.o)(.text+0x17): In function `yyerror': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:829: undefined reference to `linenum' libsyslog-ng.a(cfg-grammar.o)(.text+0x18ea): In function `yyparse': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.c:1689: undefined reference to `yylex' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/usr/local/syslog-ng-1.9.8/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/syslog-ng-1.9.8' make: *** [all] Error 2 The file cfg-lex.l contains the following: /usr/local/syslog-ng-1.9.8/src # more cfg-lex.l /*************************************************************************** * * Copyright (c) 1999 Balázs Scheidler * Copyright (c) 1999-2001 BalaBit IT Ltd. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. * * Inspired by nsyslog, originally written by Darren Reed. * * $Id: cfg-lex.l,v 1.8 2003/01/22 11:11:18 bazsi Exp $ * ***************************************************************************/ %{ #include "syslog-ng.h" #include "filter.h" #include "cfg-grammar.h" #include <string.h> #include <strings.h> struct keyword { char *kw_name; int kw_token; }; static struct keyword keywords[] = { /* statements */ { "source", KW_SOURCE }, { "destination", KW_DESTINATION }, { "log", KW_LOG }, { "options", KW_OPTIONS }, { "filter", KW_FILTER }, /* source or destination items */ { "file", KW_FILE }, { "fifo", KW_PIPE }, { "pipe", KW_PIPE }, { "internal", KW_INTERNAL }, { "unix_dgram", KW_UNIX_DGRAM }, { "unix_stream", KW_UNIX_STREAM }, { "udp", KW_UDP }, { "tcp", KW_TCP }, { "usertty", KW_USER }, { "door", KW_DOOR }, { "sun_stream", KW_SUN_STREAMS }, { "sun_streams", KW_SUN_STREAMS }, { "program", KW_PROGRAM }, /* option items */ { "flags", KW_FLAGS }, { "catchall", KW_CATCHALL }, { "fallback", KW_FALLBACK }, { "final", KW_FINAL }, { "flow_control", KW_FLOW_CONTROL }, { "no_parse", KW_NO_PARSE }, { "pad_size", KW_PAD_SIZE }, { "mark_freq", KW_MARK_FREQ }, { "stats_freq", KW_STATS_FREQ }, { "flush_lines", KW_FLUSH_LINES }, { "flush_timeout", KW_FLUSH_TIMEOUT }, /* obsolete */ { "sync_freq", KW_FLUSH_LINES }, { "sync", KW_FLUSH_LINES }, { "fsync", KW_FSYNC }, { "long_hostnames", KW_CHAIN_HOSTNAMES }, { "chain_hostnames", KW_CHAIN_HOSTNAMES }, { "keep_hostname", KW_KEEP_HOSTNAME }, { "keep_timestamp", KW_KEEP_TIMESTAMP }, { "ts_format", KW_TS_FORMAT }, { "time_zone", KW_TIME_ZONE }, { "recv_time_zone", KW_RECV_TIME_ZONE }, { "send_time_zone", KW_SEND_TIME_ZONE }, { "use_time_recvd", KW_USE_TIME_RECVD }, { "use_fqdn", KW_USE_FQDN }, { "use_dns", KW_USE_DNS }, { "gc_threshold", KW_GC_BUSY_THRESHOLD }, { "gc_busy_threshold", KW_GC_BUSY_THRESHOLD }, { "gc_idle_threshold", KW_GC_IDLE_THRESHOLD }, { "time_reopen", KW_TIME_REOPEN }, { "time_reap", KW_TIME_REAP }, { "follow_freq", KW_FOLLOW_FREQ }, { "file_template", KW_FILE_TEMPLATE }, { "proto_template", KW_PROTO_TEMPLATE }, { "log_fifo_size", KW_LOG_FIFO_SIZE }, { "log_fetch_limit", KW_LOG_FETCH_LIMIT }, { "log_iw_size", KW_LOG_IW_SIZE }, { "log_msg_size", KW_LOG_MSG_SIZE }, { "log_prefix", KW_LOG_PREFIX }, { "create_dirs", KW_CREATE_DIRS }, { "localip", KW_LOCALIP }, { "ip", KW_IP }, { "localport", KW_LOCALPORT }, { "port", KW_PORT }, { "destport", KW_DESTPORT }, { "owner", KW_OWNER }, { "group", KW_GROUP }, { "perm", KW_PERM }, { "dir_owner", KW_DIR_OWNER }, { "dir_group", KW_DIR_GROUP }, { "dir_perm", KW_DIR_PERM }, { "template", KW_TEMPLATE }, { "template_escape", KW_TEMPLATE_ESCAPE }, { "keep_alive", KW_KEEP_ALIVE }, { "max_connections", KW_MAX_CONNECTIONS }, { "mac", KW_MAC }, { "authentication", KW_AUTH }, { "encrypt", KW_ENCRYPT }, { "required", KW_REQUIRED }, { "allow", KW_ALLOW }, { "deny", KW_DENY }, { "compress", KW_COMPRESS }, { "dns_cache", KW_DNS_CACHE }, { "dns_cache_size", KW_DNS_CACHE_SIZE }, { "dns_cache_expire", KW_DNS_CACHE_EXPIRE }, { "dns_cache_expire_failed", KW_DNS_CACHE_EXPIRE_FAILED }, /* filter items */ { "or", KW_OR }, { "and", KW_AND }, { "not", KW_NOT }, { "level", KW_LEVEL }, { "priority", KW_LEVEL }, { "facility", KW_FACILITY }, { "program", KW_PROGRAM }, { "host", KW_HOST }, { "match", KW_MATCH }, /* on/off switches */ { "yes", KW_YES }, { "on", KW_YES }, { "no", KW_NO }, { "off", KW_NO } }; #define MAX_REGEXP_LEN 1024 int linenum = 1; int lex_filter_params = 0; char buf[MAX_REGEXP_LEN]; char *str; static int check_reserved_words(char *token); static void append_string(int length, char *str); static void append_char(char c); %} %option nounput white [ \t] digit [0-9] alpha [a-zA-Z] alphanum [a-zA-Z0-9] word [^ \#'"\{\}\\;\n\t,|\.] %x string %x qstring %% \#.*$ ; \n { linenum++; } {white}+ ; \.\. { return DOTDOT; } 0x{digit}+ { yylval.num = strtol(yytext, NULL, 16); return NUMBER; } 0{digit}+ { yylval.num = strtol(yytext, NULL, 8); return NUMBER; } {digit}+ { yylval.num = atoi(yytext); return NUMBER; } ({word}+(\.)?)*{word}+ { return check_reserved_words(yytext); } $ { return '('; } $ { return ')'; } \; { return ';'; } \{ { return '{'; } \} { return '}'; } \| { return '|'; } \, ; \" { str = buf; /* yy_push_state(string);*/ BEGIN(string); } \' { str = buf; BEGIN(qstring); } <string>\\a { append_char(7); } <string>\\n { append_char(10); } <string>\\r { append_char(13); } <string>\\t { append_char(9); } <string>\\v { append_char(11); } <string>\\[^anrtv] { append_string(1, yytext + 1); } <string>\" { BEGIN(INITIAL); /* yy_pop_state();*/ yylval.cptr = strdup(buf); return STRING; } <string>[^"\\]+ { append_string(strlen(yytext), yytext); } <qstring>[^']+ { append_string(strlen(yytext), yytext); } <qstring>\' { BEGIN(INITIAL); yylval.cptr = strdup(buf); return STRING; } %% int lex_init(FILE *file) { yyrestart(file); linenum = 1; return 0; } int check_reserved_words(char *token) { int i, j; for (i = 0; i < (sizeof(keywords) / sizeof(struct keyword)); i++) { for (j = 0; token[j] && keywords[i].kw_name[j]; j++) { if (token[j] == '-' || token[j] == '_') { if (keywords[i].kw_name[j] != '_') break; } else if (token[j] != keywords[i].kw_name[j]) break; } if (token[j] == 0 && keywords[i].kw_name[j] == 0) return keywords[i].kw_token; } yylval.cptr = strdup(token); return IDENTIFIER; } static void append_string(int length, char *s) { int to_copy = MIN(MAX_REGEXP_LEN - (str - buf) - 1, length); memcpy(str, s, to_copy); str += to_copy; *str = 0; } static void append_char(char c) { *str = c; str++; *str = 0; } The file cfg-lex.c is empty !! -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Tuesday, February 28, 2006 1:52 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Make Error messages On Mon, 2006-02-27 at 16:08 -0500, Stuart Boyle wrote: > Im getting the following errors when I run make, ./configure runs > fine, no errors. > > I have bison and flex installed. > > cyblops2a:/usr/local/syslog-ng-1.9.8 # make make all-recursive > make[1]: Entering directory `/usr/local/syslog-ng-1.9.8' > Making all in src > make[2]: Entering directory `/usr/local/syslog-ng-1.9.8/src' > gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl > -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib > -levtlog -Wl,-Bdynamic > > libsyslog-ng.a(cfg.o)(.text+0x5d6): In function `cfg_new': > /usr/local/syslog-ng-1.9.8/src/cfg.c:247: undefined reference to > `lex_init' > libsyslog-ng.a(cfg-grammar.o)(.text+0x17): In function `yyerror': > /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:829: > undefined reference to `linenum' > libsyslog-ng.a(cfg-grammar.o)(.text+0x18ea): In function `yyparse': > /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.c:1689: > undefined reference to `yylex' > collect2: ld returned 1 exit status Now as I look at it again, it is not necessarily the flex version that is not correct, syslog-ng ships a generated cfg-lex.c file, and "linenum" variable is not something that -lfl exports but it is defined by cfg-lex.l (which is used to generate cfg-lex.c), as it seems you might have regenerated cfg-lex.c for some reason but it might be empty? Please try to include the make output that generated cfg-lex.c and the contents of your cfg-lex.c is also interesting. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Segfault under RHEL4U2
by Paul Krizak 28 Feb '06

28 Feb '06

I just downloaded 1.9.9 and I'm getting a segfault for the following syslog-ng.conf: source s_external_syslog { udp(port(514)); }; destination d_re_mce_aggregator { program( "/bin/true" ); }; log { source(s_external_syslog); destination(d_re_mce_aggregator); }; I think that the problem is when programs exit unexpectedly and/or don't wait for input. I haven't run many more test cases to see exactly what's going on. The segfault drops two cores, 1MB and 256KB. If they would be helpful, please let me know and I can send them somewhere. -- Paul Krizak 5900 E. Ben White Blvd. MS 625 Advanced Micro Devices Austin, TX 78741 Linux/Unix Systems Engineering Phone: (512) 602-8775 Microprocessor Solutions Sector Cell: (512) 791-0686

3 3