- syslog-ng - lists.balabit.hu

Shiming Yang/OCIO_CorpDataSecurity/Planning_Office/HQ_for_the_Americas/BTMNA is out of the office.
by Shiming Yang 11 Jul '05

11 Jul '05

I will be out of the office starting 07/11/2005 and will not return until 07/30/2005. I will respond to your message when I return. If there is problem about Proxy or IBM web hosting facility, please call my backup Will at 8380 or Rich Maer at 5744. ----------------------------------------- The information contained in this electronic mail message, and any and all accompanying documents, constitutes confidential information. If you are not the intended recipient of this information, any disclosure, copying, distribution, or the taking of any action in reliance on it is strictly prohibited. If you received this information in error, please notify the sender immediately and destroy this communication. Messages sent via this medium may be subject to delays and/or unauthorized alteration. Neither The Bank of Tokyo-Mitsubishi, Ltd. nor any of its affiliates shall be held liable for the contents of this message.

1 0

RE: [syslog-ng] HP-UX
by Stephen Tanner 11 Jul '05

11 Jul '05

Alessandro, I currently have version 1.6.6 running on multiple HP-UX 11i machines. I have not, however, attempted to upgrade to 1.6.8. Does it dump core during compilation or during execution once compiled? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alessandro Rocha Sent: Monday, July 11, 2005 9:14 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] HP-UX Hi All, I've tried to install the syslog-ng 1.6.8 on a HP-UX 11i server but it causes core dump during the initialization. Do you know if this version work with HP ? Thanks in advance. Alessandro. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

HP-UX
by Alessandro Rocha 11 Jul '05

11 Jul '05

Hi All, I've tried to install the syslog-ng 1.6.8 on a HP-UX 11i server but it causes core dump during the initialization. Do you know if this version work with HP ? Thanks in advance. Alessandro.

1 0

is connection broken logged?
by Richard Legault 11 Jul '05

11 Jul '05

We are using version 1.6.0rc4 As part of our regression testing we attempt to send a log message to a host that is non-existent (123.124.125.126) We expect to see in our log the error message Connection Broken, we are not seeing that. here is the parts of our conf file that are relevant destination tcsvlogfile { file("/var/log/svlogtc"); }; destination badsyslogsrvr { udp("123.124.125.126" port(514)); }; filter f_ic17 { match( "ic_17 test message" ); }; log { source(src); filter(f_ic17); destination(badsyslogsrvr); }; log { source(src); destination(tcsvlogfile); }; Now when I send the command logger "ic_17 test message" I see the corresponding "ic_17 test message" message in /var/log/svlogtc but I do not see the error that it could not send the message to badsyslogsrvr. i.e. Connection Broken ... Are error messages from syslog-ng not logged ( I could understand this as it could end up in a nasty recursion loop) Thanks. Richard Legault Senior Engineer 519-880-2400 ext 2722 www.sandvine.com

4 3

Hosts aren't logging to my log host
by Ryan McCain 07 Jul '05

07 Jul '05

I'm wanting all routers to log to their respective directories. I'm running this on SLES 9. Let me know if there is any debug output I need to provide. I'm new to syslog-ng, so I'm assuming, I'm missing something in the config file. Thanks, Ryan ---- #Options options { mark(600); sync(0); use_dns(yes); create_dirs(yes); }; # Source dirvers source src_int { internal(); }; source src { unix-stream("/dev/log"); }; source tcp { tcp(); }; # Destinations drivers; use macro expansion to make seperating logs easier destination d_facility { file("/var/log/syslog-ng/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" perm(0600)); }; destination d_program { file("/var/log/syslog-ng/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM" perm(0600)); }; # Finally, actually log everything to its appropriate place log { source("src"); destination("d_facility"); }; log { source("src"); destination("d_program"); }; log { source("tcp"); destination("d_facility"); }; # Log all internal() stuff to seperate log destination d_int { file("/var/log/syslog-ng/internal.log" perm(0600)); }; log { source("src_int"); destination("d_int"); }; # log everything remote/local to a console tty #destination d_tty { file("/dev/tty11"); }; #log { source("src"); source("src_int"); destination("d_tty"); };

1 0

SV: [syslog-ng] libol + syslog-ng
by kenneth.gullberg＠foreningssparbanken.se 07 Jul '05

07 Jul '05

Your libol is too old, it even says so in the error message :) // Kenneth -----Ursprungligt meddelande----- Från: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] För Chris Neitzert Skickat: den 7 juli 2005 12:11 Till: Syslog-ng users' and developers' mailing list Ämne: [syslog-ng] libol + syslog-ng heya I tried googling this up prior to sending but no luck I'm using a recently installed and yum-updated copy of fedora core 4, libol-0.3.9, and syslog-ng-1.6.8. ld sees libol but any variation of the syslog-ng ./configure --with-libol=/path/to/libol including to the source directory replies with: checking libol version >= 0.3.16... no configure: error: Required libol version not found, make sure that your libol version is in the 0.3.x branch even --without-libol returns the same. any clue what i'm doing wrong? chris _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3

libol + syslog-ng
by Chris Neitzert 07 Jul '05

07 Jul '05

heya I tried googling this up prior to sending but no luck I'm using a recently installed and yum-updated copy of fedora core 4, libol-0.3.9, and syslog-ng-1.6.8. ld sees libol but any variation of the syslog-ng ./configure --with-libol=/path/to/libol including to the source directory replies with: checking libol version >= 0.3.16... no configure: error: Required libol version not found, make sure that your libol version is in the 0.3.x branch even --without-libol returns the same. any clue what i'm doing wrong? chris

1 0

syslog-ng 1.9.5 released
by Balazs Scheidler 07 Jul '05

07 Jul '05

Hi, I'm pleased to announce syslog-ng 1.9.5 a new BETA release in the new syslog-ng 2.0 branch. Here is the NEWS entry: 1.9.5 Thu, 07 Jul 2005 11:35:25 +0200 * Documentation updates on new options. * Fixed some timezone related problems cleaned up template specific timezones. * Fixed destination file permission setting problems. * Fixed use_time_recvd() handling, added a note to the documentation that this option is deprecated. * Fixed a destination file fd/memory leak for macro expanded files. * Fixed regexp match references in macro expansion. (e.g. "/var/log/$1") * Added two new macros: STAMP which formats a timestamp according to the ts_format() option, and WEEK which refers to the current week number. * Linking fixes to support more platforms. * Changed local hostname detection to use the value of use_fqdn() and actually use a fully expanded hostname if that is true. * Fixed some configuration file parsing problems which caused user identifiers to be recognized as keywords if they had a common prefix. * Always add fractions of a second if it was received from the application. * Fixed a gcc4 compatibility problem. Please note that a daily snapshot is available from syslog-ng which might contain other, not-yet-released fixes. It is recommended to check these snapshots regularly if you are using syslog-ng 1.9.x. -- Bazsi

1 0

RE: [syslog-ng] Error parsing conf file?
by Balazs Scheidler 07 Jul '05

07 Jul '05

Hi, > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler > Sent: Tuesday, July 05, 2005 6:47 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: [syslog-ng] Error parsing conf file? > > > On Mon, 2005-07-04 at 15:56 -0600, Zb Indelak wrote: > > Any progress / clues on the multiple file-open bug? I'm using a > > multi-processor (2 CPUs) system, if that perhaps makes a difference. > > With the 20050704 snapshot I've seen a single file open over 20 times > > each. > > not yet, sorry, I was hunting down a bug for a customer, so did not have too much time lately. But I'm trying to look into this RSN. > > ps: I hate bugs that screw up the heap structure :( > I have now fixed this issue with the following patch: --- orig/src/logwriter.c +++ mod/src/logwriter.c @@ -327,7 +327,11 @@ log_writer_deinit(LogPipe *s, GlobalConf LogWriter *self = (LogWriter *) s; if (self->source) - g_source_destroy(self->source); + { + g_source_destroy(self->source); + g_source_unref(self->source); + self->source = NULL; + } return TRUE; } It will be included in tomorrow's snapshot. -- Bazsi

1 0

DB probs
by Edward Brookhouse 05 Jul '05

05 Jul '05

Hi all - I am upgrading from the syslog-ng 1.7 branch on one machine to another server using the 1.9.4 branch. Using this on the new server I am building, I can not get any data to write to a mysql database. Using mysql 4.1.11-2 and Syslogng 1.9.4 on RH Fedora Core 4 kernel 2.6.12-1 Using the syslog-ng config file and database setup from the older server that is still running does not work. So - I tried switching from using a mysql pipe file to using sqlsyslogd - same results - Log data flows in, gets written to a log file, but never gets inserted into the db - The db structure looks ok - the sqlsyslogd is running well - not much in the way of being able to debug that but ....gonna try to pass it through a debugger Here is the relevant portion of my conf destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -h localhost -u root -t logs syslog -p"); }; With the password specified in sqlsyslogd.conf (this is one word on a line by itself - is that right???) When a log entry comes in I do see an error about writing to FD 7 [root@io etc]# syslog-ng -F -e -v -d -f /etc/syslog-ng/syslog-ng.conf Starting destination program; cmdline='/usr/local/bin/syslog-mail' Starting destination program; cmdline='/usr/local/sbin/sqlsyslogd -h localhost -u root -t logs syslog -p' Starting destination program; cmdline='/usr/local/bin/syslog-mail-perl' syslog-ng starting up; version='1.9.4' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' Syslog connection accepted; to='AF_UNIX(/dev/log)', from='AF_UNIX(\xff\xff\xff\xff\x19)' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' Incoming log entry; line='<86>Jul 5 11:05:01 sshd[6703]: Accepted password for ebroo from ::ffff:172.17.17.193 port 33316 ssh2' Initializing destination file writer; filename='/var/log/syslog', template='/var/log/syslog' Initializing destination file writer; filename='/var/log/HOSTS/io/2005/07/05/05', template='/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$HOST_$YEAR_$ MONTH_$DAY' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' EOF occurred while reading; fd='7' Closing log reader fd; fd='7' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' Syslog connection accepted; to='AF_UNIX(/dev/log)', from='AF_UNIX(-)' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' Incoming log entry; line='<38>Jul 5 11:05:01 sshd(pam_unix)[6705]: session opened for user ebroo by (uid=0)' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' EOF occurred while reading; fd='7' Closing log reader fd; fd='7' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' Any thoughts appreciated!!!!!!!!!!!! Edward ebroo(a)healthydirections.com

1 1