- syslog-ng - lists.balabit.hu

Logging Java stack traces with syslog-ng and log4j
by Vaibhav Goel 19 Apr '05

19 Apr '05

Hi all I am trying to get syslog-ng to log a java stack trace such as one shown below. PST:2005-03-15/10:46:49.657 [ExecuteThread: '23' for queue: 'weblogic.kernel.Default'] LOGERROR jwsm.com.cucbc.taglib.content.IncludeTagContent -- ServletExce ption on include tag javax.servlet.ServletException: Got error: 404 at com.cucbc.servlet.SimpleMDRequestDispatcher.handleError(SimpleMDRequestD ispatcher.java:72) at com.cucbc.servlet.AbstractMDRequestDispatcher.checkForError(AbstractMDRe questDispatcher.java:87) at com.cucbc.servlet.AbstractMDRequestDispatcher.include(AbstractMDRequestD ispatcher.java:71) at com.cucbc.taglib.content.IncludeTagContent.write(IncludeTag.java:137) at com.cucbc.taglib.content.ContentTagSupport.doEndTag(ContentTagSupport.ja va:52) at jsp_servlet._personal.__index._jspService(index.jsp:63) at weblogic.servlet.jsp.JspBase.service(JspBase.java:33) at weblogic.servlet.internal.ServletStubImpl$ServletInvocationAction.run(Se rvletStubImpl.java:996) etc... I have a filter match "LOGERROR" configured for syslog-ng. It matches fine and logs the line: PST:2005-03-15/10:46:49.657 [ExecuteThread: '23' for queue: 'weblogic.kernel.Default'] LOGERROR jwsm.com.cucbc.taglib.content.IncludeTagContent -- ServletExce ption on include tag However, the stack trace after that is ignored.... Any way to get that? I guess a regexp match on LOGERROR is out of the question... Thanks

2 1

Re: [syslog-ng]trouble configuring syslog-ng with libraries
by John Thrumston 15 Apr '05

15 Apr '05

I tried the ./configure --enable-dynamic-linking as it suggests, got the exact same results. Sunfreeware has a newer version of GLIB (SMCglib-2.6.2 out there. My questions are, if I add that package. 1) how will the server know which version to use? 2. Will this corrupt any other packages that may currently be using the SUNWGlib that was installed? Sorry to ask all these questions, I just don't know library functions very well and don't want to blow the box up so to speak. Thanks again for your help. Balazs Scheidler <bazsi(a)balabit.hu> wrote: On Thu, 2005-04-14 at 10:09 -0700, John Thrumston wrote: > thank you, that appears to have fixed that, but now I get the > following. > > checking for glib-2.0... yes > checking GLIB_CFLAGS... -I/usr/include/glib-2.0 > -I/usr/lib/sparcv9/glib-2.0/include > checking GLIB_LIBS... -L/usr/lib/sparcv9 -lglib-2.0 > checking for eventlog... yes > checking EVTLOG_CFLAGS... -I/usr/local/include/eventlog > checking EVTLOG_LIBS... -L/usr/local/lib -levtlog > checking for static GLib libraries... no > configure: error: static GLib libraries not found, either link GLib > dynamically using the --enable-dynamic-linking or install a static > GLib > > as you can see, it found glib but for some reason errors out. I have > added every directory if found thru find to the PKG_CONFIG_PATH > variable but that doesn't seem to help. What should I be looking for? Just do as the configure script says: either install a static glib (it is named libglib.a, not .la!) or if you don't mind linking to libraries in /usr (which could be NFS mounted for instance) then specify --enable-dynamic-linking to the configure script. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html --------------------------------- Do you Yahoo!? Make Yahoo! your home page

2 1

RE: [syslog-ng]Match macro in filename?
by Vaibhav Goel 14 Apr '05

14 Apr '05

Thanks Nate. I am using (trying to) an alternate approach now...I am going to write a perl script that gets everything from STDIN and parses the log data, does some regexp matching and writes out the logs based on that....check this simple script (which does not wanna work): #!/usr/bin/perl -w my $input = <STDIN> ; if ($input =~ /xyz/) { $var = "xyz.log"; open(LOG, ">>/tmp/$var"); print LOG "$input"; close(LOG); } This does not seem to want to work using syslog-ng (it works fine from the commandline though),...any ideas anyone? -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Nate Campi Sent: April 14, 2005 2:12 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Match macro in filename? On Thu, Apr 14, 2005 at 07:55:24AM -0700, Vaibhav Goel wrote: > > Cool that it is 1.9.4. Is 1.9.4 production ready by any chance? I am > currently using 1.6.5. If not, is there any other way you can suggest > to solve this "problem"? I am not averse to writing some scripts etc.. Good news on the feature in the 1.9 branch! As for using 1.6.5, someone else just brought this up the other day, see this thread: https://lists.balabit.hu/pipermail/syslog-ng/2005-April/007260.html -- Nate "If you put a billion monkeys in front of a billion typewriters typing at random, they would reproduce the entire collected works of Usenet in about ... five minutes." -Anon. "Come to think of it, there are already a million monkeys on a million typewriters, and the Usenet is NOTHING like Shakespeare!" -Blair Houghton _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]Match macro in filename?
by Vaibhav Goel 14 Apr '05

14 Apr '05

Actually my bad...it does work...in fact writes 1 line of log entry but then no more. The script exits after that one entry (ie not running like my "cat" test in the background)... -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Vaibhav Goel Sent: April 14, 2005 2:23 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Match macro in filename? Thanks Nate. I am using (trying to) an alternate approach now...I am going to write a perl script that gets everything from STDIN and parses the log data, does some regexp matching and writes out the logs based on that....check this simple script (which does not wanna work): #!/usr/bin/perl -w my $input = <STDIN> ; if ($input =~ /xyz/) { $var = "xyz.log"; open(LOG, ">>/tmp/$var"); print LOG "$input"; close(LOG); } This does not seem to want to work using syslog-ng (it works fine from the commandline though),...any ideas anyone? -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Nate Campi Sent: April 14, 2005 2:12 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Match macro in filename? On Thu, Apr 14, 2005 at 07:55:24AM -0700, Vaibhav Goel wrote: > > Cool that it is 1.9.4. Is 1.9.4 production ready by any chance? I am > currently using 1.6.5. If not, is there any other way you can suggest > to solve this "problem"? I am not averse to writing some scripts etc.. Good news on the feature in the 1.9 branch! As for using 1.6.5, someone else just brought this up the other day, see this thread: https://lists.balabit.hu/pipermail/syslog-ng/2005-April/007260.html -- Nate "If you put a billion monkeys in front of a billion typewriters typing at random, they would reproduce the entire collected works of Usenet in about ... five minutes." -Anon. "Come to think of it, there are already a million monkeys on a million typewriters, and the Usenet is NOTHING like Shakespeare!" -Blair Houghton _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng/localhost/stunnel
by Dmitry 14 Apr '05

14 Apr '05

Nice Day. I am using syslog-ng with stunnel destination crypto2SS { tcp("127.0.0.1" port (514)); }; On central log host I have: source crypto { tcp(ip("127.0.0.1") port (514) keep-alive(yes)); }; destination r_facil {file(".../$HOST/$YEAR-$MONTH-$DAY/$FACILITY-$LEVEL.log"); }; and I have strange soft, that send to syslog throught 127.0.0.1:514 Problem: on my central host syslog-ng put logs into dir .../localhost (messages from this strange soft, other log put correct). I am trying to play with keep_hostname and chain_hostnames, but always got "localhost/localhost". Can anybody help me ? Thanx

2 1

RE: [syslog-ng]Match macro in filename?
by Vaibhav Goel 14 Apr '05

14 Apr '05

Cool that it is 1.9.4. Is 1.9.4 production ready by any chance? I am currently using 1.6.5. If not, is there any other way you can suggest to solve this "problem"? I am not averse to writing some scripts etc.. Thanks! -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: April 14, 2005 2:43 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Match macro in filename? On Wed, 2005-04-13 at 21:48 -0700, Nate Campi wrote: > On Wed, Apr 13, 2005 at 09:38:11AM -0700, Vaibhav Goel wrote: > > > > Is there any way to get a match filter in an output filename? > > > > For example: > > > > filter f_xyz { match("xyz"); }; > > > > should output to > > > > xyz.log > > There is no way to have syslog-ng remember the contents of a match and > use it later in another statement. In fact, this is possible in 1.9.4 (the future 2.0.x branch) where you can use regex's selection features in macro expansion. For example: filter f_xyz { match("(xyz)"); }; destination l_xyz { file("/var/log/$1"); }; However trusting the contents of the logs for something like filenames might not be the best solution. (although syslog-ng filters spurious filenames by checking '../' and '../' strings in filenames just before handing those over to open(). -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng]trouble configuring syslog-ng with libraries
by John Thrumston 14 Apr '05

14 Apr '05

thank you, that appears to have fixed that, but now I get the following. checking for glib-2.0... yes checking GLIB_CFLAGS... -I/usr/include/glib-2.0 -I/usr/lib/sparcv9/glib-2.0/include checking GLIB_LIBS... -L/usr/lib/sparcv9 -lglib-2.0 checking for eventlog... yes checking EVTLOG_CFLAGS... -I/usr/local/include/eventlog checking EVTLOG_LIBS... -L/usr/local/lib -levtlog checking for static GLib libraries... no configure: error: static GLib libraries not found, either link GLib dynamically using the --enable-dynamic-linking or install a static GLib as you can see, it found glib but for some reason errors out. I have added every directory if found thru find to the PKG_CONFIG_PATH variable but that doesn't seem to help. What should I be looking for? Thank you for the help earlier. Balazs Scheidler <bazsi(a)balabit.hu> wrote: On Thu, 2005-04-14 at 07:52 -0700, John Thrumston wrote: > I am trying to load syslog-ng for the first time. I am loading it on a > Solaris 9 box. I am using syslog-ng.1.9.4 downloaded from the host > site. > > I believe I have all the libraries needed. I am not really sure. when > I run > ./configure --enable-tcp_wrappers I get the following error at the end > of the configure. > > checking for eventlog... Package eventlog was not found in the > pkg-config search path. > Perhaps you should add the directory containing `eventlog.pc' > to the PKG_CONFIG_PATH environment variable > No package 'eventlog' found > configure: error: Library requirements (eventlog) not met; consider > adjusting the PKG_CONFIG_PATH environment va > riable if your libraries are in a nonstandard prefix so pkg-config can > find them. > > I have searched google and such for where I might find this eventlog > or the library variable event.pc put cannot locate it. I did a find on > the system and this event.pc doesn't exist. > > I am not sure what other questions you might have but I could use any > help that can be provided. eventlog is available from the same directory where you downloaded syslog-ng from. http://www.balabit.com/downloads/syslog-ng/1.9/src -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html --------------------------------- Do you Yahoo!? Yahoo! Small Business - Try our new resources site!

2 1

trouble configuring syslog-ng with libraries
by John Thrumston 14 Apr '05

14 Apr '05

I am trying to load syslog-ng for the first time. I am loading it on a Solaris 9 box. I am using syslog-ng.1.9.4 downloaded from the host site. I believe I have all the libraries needed. I am not really sure. when I run ./configure --enable-tcp_wrappers I get the following error at the end of the configure. checking for eventlog... Package eventlog was not found in the pkg-config search path. Perhaps you should add the directory containing `eventlog.pc' to the PKG_CONFIG_PATH environment variable No package 'eventlog' found configure: error: Library requirements (eventlog) not met; consider adjusting the PKG_CONFIG_PATH environment va riable if your libraries are in a nonstandard prefix so pkg-config can find them. I have searched google and such for where I might find this eventlog or the library variable event.pc put cannot locate it. I did a find on the system and this event.pc doesn't exist. I am not sure what other questions you might have but I could use any help that can be provided. Thanks --------------------------------- Do you Yahoo!? Yahoo! Small Business - Try our new resources site!

2 1

SQL Warnings (2)
by Metal Gear 14 Apr '05

14 Apr '05

Hi all, When i type http://localhost/syslog/index.php in my browser the following errors comes up Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /www/htdocs/web/index.php on line 35=20 Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /www/htdocs/web/index.php on line 53=20 All logs from syslog-ng are logged to mysql (database syslog and table logs) I have defined in db_fns.php $result =3D mysql_pconnect("", "", ""); becauz i have made a user mysql with no password and when i write mysql on shell in connects directly. Your help in this regard would highly be appreciated Thanks

1 0

Match macro in filename?
by Vaibhav Goel 14 Apr '05

14 Apr '05

Hi all Is there any way to get a match filter in an output filename? For example: filter f_xyz { match("xyz"); }; should output to xyz.log Thanks!

3 2