- syslog-ng - lists.balabit.hu

route some messages to /dev/null
by Denis Kot 28 Feb '05

28 Feb '05

I want to route some messages to /dev/null. how to do it? -- Denis Kot denis?jabber.org.by ICQ: 13680126 Mobil: +375 29 6-1234-78

3 7

1.9.3 compatibility with glib 2.2
by Gilles Demarty 28 Feb '05

28 Feb '05

Hi all, on my way trying to compile syslog-ng 1.9.3 on a RedHat Entreprise Server 3.0 with glib 2.2, the only compiling error was the existence of g_queue_get_length() in afinter.c. g_queue_get_length() is a function introduced since glib 2.4. I wonder why you prefer using g_queue_get_length() instead of g_queue_is_empty() in that particular context, since you do a double neg of that value to get a gboolean. Therefore, I propose the following patch. This patch allow compatibility with glib 2.2, and is, i hope, more efficient (since a non empty test shoud be as efficient as an enumeration). # diff afinter.c ~/syslog-1.9.3-patched/src/afinter.c 35c35 < return !!g_queue_get_length(internal_msg_queue); --- > return !g_queue_is_empty(internal_msg_queue); 41c41 < return !!g_queue_get_length(internal_msg_queue); --- > return !g_queue_is_empty(internal_msg_queue); my €.02 -- Gilles DEMARTY ExaProtect Technology Tél: +33 (0) 4 26 23 25 25 Fax: +33 (0) 4 26 29 99 09 email(at)exaprotect.com www.exaprotect.com - "Be alert with your alerts"

2 1

syntax for escaped characters
by Mike Pepe 25 Feb '05

25 Feb '05

OK, I'm trying to figure out what the correct syntax for a match is. I'm trying to match crond(pam_unix) filter f_cron_pam { match("crond(pam_unix)"); }; Doesn't match. filter f_cron_pam { match("crond$pam_unix$"); }; Doesn't match. something about the parenthesis it doesn't like, because: filter f_cron_pam { match("crond") and match("pam_unix"); }; does match. It's just kind of an ugly way around it. Anyone know what the right way to do this is?

2 2

Syslog-ng on Fedora Core 1
by Phusion 24 Feb '05

24 Feb '05

Hi, I installed syslog-ng 1.6.6 from source on Fedora Core 1. I have it up and running but I can't seem to get kernel messages. I've included part of my syslog-ng.conf file for you to look at. source local { internal(); file("/proc/kmsg" log_prefix("kernel: ")); unix-stream("/dev/log"); }; Also, I don't have klogd running. When using the stock syslog that comes with Fedora, klogd also runs. I stopped that from running and started the syslog-ng service. I can't seem to get kernel log messages. Let me know what my problem is. Thanks.

2 1

fyi: building SyslogNG snapshot on OSX 10.3.8
by OpenMacNews 23 Feb '05

23 Feb '05

hi all, i've seen a couple of recent questions onlist re: building on Mac, so i thought i'd post my latest notes; the following works great for me. HTH, but, as always, YMMV =) note: (a) i'm building from the latest src snapshots (b) i'm using some updated build tools (c) i'm linking against an EXTERNAL bind9 build's libs (currently bind-9.3.1rc1), rather than Apple's native -lresolv ... fwiw, my ENV: % gcc --version gcc (GCC) 3.3 20030304 (Apple Computer, Inc. build 1671) % glibtool --version ltmain.sh (GNU libtool) 1.5.14 (1.1220.2.195 2005/02/12 12:12:33) % automake --version automake (GNU automake) 1.9.4 % autoconf --version autoconf (GNU Autoconf) 2.59 setenv LIBOL_LOC "http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot" setenv SYSLOGNG_LOC "http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot" setenv LIBOL_VER "libol-0.3.15+20050216" setenv SYSLOGNG_VER "syslog-ng-1.6.6+20050216" cd /usr/ports/ wget $LIBOL_LOC/$LIBOL_VER.tar.gz wget $SYSLOGNG_LOC/$SYSLOGNG_VER.tar.gz gnutar zxvf $LIBOL_VER.tar.gz gnutar zxvf $SYSLOGNG_VER.tar.gz unsetenv CFLAGS CPPFLAGS CXX CXXFLAGS LDFLAGS LDDLFLAGS LD_PREBIND EXTRA_LDFLAGS EXTRA_LIBS LC_ALL LANG LINGUAS ################ ## LIBOL # cd /usr/ports/$LIBOL_VER glibtoolize --force --copy aclocal autoconf ./configure \ --prefix=/usr/local \ --enable-shared \ --enable-static make make install ################ ## SYSLOG-NG # cd /usr/ports/$SYSLOGNG_VER unsetenv CFLAGS CPPFLAGS CXX CXXFLAGS LDFLAGS LDDLFLAGS LD_PREBIND EXTRA_LDFLAGS EXTRA_LIBS LC_ALL LANG LINGUAS setenv LDFLAGS "-bind_at_load -L/usr/local/bind9/lib -llwres -lbind9" setenv CPPFLAGS "-I/usr/local/bind9/include" # make a couple of changes ... ================================================================ (EDITOR) /usr/ports/$SYSLOGNG_VER/configure.in @164 --- AC_CHECK_LIB(resolv, res_init) +++ dnl AC_CHECK_LIB(resolv, res_init) dnl on Linux res_init is a macro --- AC_CHECK_LIB(resolv, __res_init) +++ dnl AC_CHECK_LIB(resolv, __res_init) @336 --- LIBS="$LIBS $LIBOL_LIBS -Wl,-Bstatic $LEXLIB $LIBWRAP_LIBS $LIBNET_LIBS -Wl,-Bdynamic" +++ LIBS="$LIBS $LIBOL_LIBS -Wl,-dynamic $LEXLIB $LIBWRAP_LIBS $LIBNET_LIBS -Wl,-dynamic" ================================================================ glibtoolize --force --copy aclocal autoconf ./configure \ --prefix=/usr/local \ --enable-debug \ --enable-full-static=no \ --enable-tcp-wrapper make make install ################ ## StartupItems # mkdir -p /Library/StartupItems/SyslogNG ================================================== (EDITOR) /Library/StartupItems/SyslogNG/SyslogNG #!/bin/sh ## # SyslogNG StartupItem # . /etc/rc.common RunService () { case $1 in start ) StartService ;; stop ) StopService ;; restart) RestartService ;; * ) echo "$0: unknown argument: $1";; esac } ## # SyslogNG StartupItem Handlers ## StartService () { if [ "${SYSLOGNG:=-NO-}" = "-YES-" ]; then # if [ -f "/var/run/syslog" ] ; then ConsoleMessage "Stopping SYSLOGD server" sleep 2 killall syslogd # fi ConsoleMessage "Starting SYSLOG-NG Logging Server" /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf -p /var/run/syslog-ng.pid fi } StopService () { if [ -f "/var/run/syslog-ng.pid" ] ; then ConsoleMessage "Stopping SYSLOG-NG Logging Server" sleep 2 kill -9 `cat /var/run/syslog-ng.pid` fi } RestartService () { StopService StartService } RunService "$1" ================================================================= ================================================== (EDITOR) /Library/StartupItems/SyslogNG/StartupParameters.plist { Description = "SyslogNG"; Provides = ("SyslogNG"); Requires = ("Resolver","Network Time","Disks"); Uses = ("Network"); OrderPreference = "None"; Messages = { start = "Starting SyslogNG"; stop = "Stopping SyslogNG"; }; } ================================================== ================================================== (EDITOR) /etc/hostconfig +++ SYSLOGNG=-YES- ================================================== chown -R root:wheel /Library/StartupItems/SyslogNG chmod 755 /Library/StartupItems/SyslogNG chmod 755 /Library/StartupItems/SyslogNG/SyslogNG chmod 644 /Library/StartupItems/SyslogNG/StartupParameters.plist # now let's see what we've got ... % which syslog-ng /usr/local/sbin/syslog-ng % ls -al /usr/local/sbin/syslog-ng -rwxr-xr-x 1 root wheel 453968 Feb 23 11:17 /usr/local/sbin/syslog-ng % otool -L /usr/local/sbin/syslog-ng /usr/local/sbin/syslog-ng: /usr/local/bind9/lib/liblwres.1.dylib (compatibility version 4.0.0, current version 4.2.0) /usr/local/bind9/lib/libbind9.0.dylib (compatibility version 1.0.0, current version 1.5.0) /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 71.1.1) # start it up !!! % /Library/StartupItems/SyslogNG/SyslogNG start % ps -ax | grep syslog-ng 9649 ?? Ss 0:00.02 /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf -p /var/run/syslog-ng.pid smooth sailing from here ... happy trails! richard

1 0

anyone know where these are coming from?
by Mike Pepe 23 Feb '05

23 Feb '05

Hi all, My system is running fedora core 3. My /var/log/messages gets full of these: Feb 20 00:10:03 quadzilla crond(pam_unix)[29549]: session closed for user root for every cron job that runs. However these aren't cron messages, because anything from cron goes into a separate log. I'm wondering if anyone knows a way to filter these without using a match rule, or how it's possible to determine what program is sending these messages? thanks -Mike

2 3

Help on Centralized log host
by Anup Philip 22 Feb '05

22 Feb '05

Hi all, Can anyone give the steps to configure a host to send all logs to a central syslog-ng server in a Solaris environment? It will be really great if anyone can send the sample syslog-ng.conf file for centralized syslog server and client. Thanks a lot in advance. Rgds Anup

2 1

what´s wrong?
by Denis Kot 21 Feb '05

21 Feb '05

Hello to All I want to messages from smbd and nmbd to redirect to another logfile I have: source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; destination d_smbd { file("/var/log/smbd"); }; filter f_smbd { program(smbd.*) or match(smbd); }; filter f_nmbd { program(nmbd.*) or match(nmbd); }; log { source(src); filter(f_smbd); destination(d_smbd); }; log { source(src); filter(f_nmbd); destination(d_smbd); }; log { source(src); destination(messages); }; but messages like: Feb 18 15:02:57 gate smbd[1089]: [2005/02/18 15:02:57, 0] lib/util_sock.c:get_peer_addr(1000) Feb 18 15:02:57 gate smbd[1089]: getpeername failed. Error was Transport endpoint is not connected or Feb 18 15:04:14 gate nmbd[15845]: [2005/02/18 15:04:14, 0] nmbd/nmbd_incomingdgrams.c:process_get_backup_list_request(693) Feb 18 15:04:14 gate nmbd[15845]: process_get_backup_list_request: domain list requested for workgroup MASSNET and I am not a local master browser. still going to /var/log/messages... what´s wrong? -- Denis Kot denis?jabber.org.by ICQ: 13680126 Mobil: +375 29 6-1234-78

4 5

Re:
by Bazsi 20 Feb '05

20 Feb '05

1 0

The right way for kmsg: file or pipe and where is /proc/kmsg if proc is deprecated in 2.6?
by Peter 20 Feb '05

20 Feb '05

Hello. I would like to ask two questions. 1. There is some strange difference between examples and documentation. In reference there is written that /proc/kmsg is file, but in all examples I found it is pipe. What is it pipe or a file in Linux (2.6)? 2. Proc is deprecated in linux kernel 2.6. What is the substitution for /proc/kmsg from the point of kernel logging? BTW. There is a small bug in reference manual. Example 3-9. Using the tcp() is broken and is not working. I think it should look like: destination d_tcp { tcp("10.1.2.3" port(1999) localport(999)); }; instead of: destination d_tcp { tcp("10.1.2.3" port(1999); localport(999)); }; A least this works for me. And on pages of reference manual link on "Note" picture is broken. :) Thank you for your attention, Peter.

1 0