- syslog-ng - lists.balabit.hu

Syslog -> Oracle Database
by Shane Presley 08 Feb '05

08 Feb '05

So I am considering moving my syslog-ng entries into Oracle. I've found the scripts to do that, but still working with our DBAs on it. One question I had, do we need an Oracle client on the syslog-ng server? With MySQL you can connect to a remote SQL server using the script directly. The Oracle scripts also seem to reference an Oracle Server and port. But my Oracle DBA's seem to think they have to install the Oracle client. Anyone done this before to a remote Oracle server? Thanks Shane

2 3

new Fedora/Redhat init script
by Philip J. Hollenback 08 Feb '05

08 Feb '05

Attached is a new init script I wrote. It's based on the existing init.d.Redhat and init.d.Redhat-7.3 scripts. The main deficiency I wanted to correct was that the existing scripts do not properly implement 'reload' by sending a HUP to the running syslog-ng. Other than that I just tried to clean the init script up and make it consistent with other Redhat-style init scripts. I'm calling this script init.d.Fedora since there were already those existing scripts. However, I believe my script should work on any RedHat or Fedora system, so I would ask that you remove the existing scripts. Unless, of course, there's some functionality I'm missing in my script. Thanks, P. -- Philip J. Hollenback Telemetry Investments phollenback(a)telemetry-investments.com

7 11

Compilation problem with syslog-ng-1.9.3.
by Peter 08 Feb '05

08 Feb '05

Hello. I have a problem. I'm trying to compile syslog-ng-1.9.3. But after succesful configuration I have a linking error: i686-pc-linux-gnu-gcc -O2 -march=pentium4 -fomit-frame-pointer -pipe -mcpu=pentium4 -Wall -g -o syslog-ng main.o misc.o utils.o messages.o gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o driver.o sgroup.o dgroup.o center.o filter.o logsource.o logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o afstreams.o afuser.o afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o children.o -lnsl -Wl,-static -lfl -lglib-2.0 -levtlog -Wl,-call_shared /usr/lib/gcc-lib/i686-pc-linux-gnu/3.3.5/../../../../i686-pc-linux-gnu/bin/ld: cannot find -lglib-2.0 collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/var/tmp/portage/syslog-ng-1.9.3/work/syslog-ng-1.9.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/var/tmp/portage/syslog-ng-1.9.3/work/syslog-ng-1.9.3' make: *** [all] Error 2 Can anybody enlight me how I can avoid this error? I am sure I have this library: camobap ~ # ls -l /usr/lib/libglib-2.0.* -rwxr-xr-x 1 root root 805 Янв 30 22:01 /usr/lib/libglib-2.0.la lrwxrwxrwx 1 root root 22 Янв 30 22:01 /usr/lib/libglib-2.0.so -> libglib-2.0.so.0.400.8 lrwxrwxrwx 1 root root 22 Янв 30 22:01 /usr/lib/libglib-2.0.so.0 -> libglib-2.0.so.0.400.8 -rwxr-xr-x 1 root root 503304 Янв 30 22:01/usr/lib/libglib-2.0.so.0.400.8 Also I would like to note that many other applications that also depend on glib-2.0 compiled without problems. I can not find sollution by myself. Where should I look for sollution? Thank you in advance, _______ Peter.

2 1

1.6.6 release status
by Balazs Scheidler 05 Feb '05

05 Feb '05

Hi, Just a quick summary, how we are at: - there is one pending patch reporting truncated messages when log_msg_size() is exceeded, it can be in once Roberto confirms that my change is correct to his patch. Otherwise I've committed everything in, and made a manual snapshot with today's date which is being uploaded to our webserver right now. (takes a couple of minutes as there are over 10000 files to synchronize) Thanks Jose and Roberto for helping me preparing the release. -- Bazsi

3 3

syslog-ng 1.6.6 released
by Balazs Scheidler 04 Feb '05

04 Feb '05

Hi, I have released syslog-ng 1.6.6 with the user-visible changes file included at the end of this mail. It has been slightly been changed since the last snapshot to make the linking changes compatible with Solaris's linker. Otherwise the release is identical. Please note that I have changed GPG keys, this is signed with the new one. The fact that the release was signed with this key might attach some trust. My fingerprint is: pub 1024D/ADCF4138 2004-11-10 Balazs Scheidler <bazsi(a)balabit.hu> Key fingerprint = 8038 B76C B92A 661D E4EF 222D B613 44D0 ADCF 4138 sub 2048g/82B2CACD 2004-11-10 The release is available at the usual location at http://www.balabit.com/downloads/syslog-ng/ News for the 1.6.6 release Fri, 04 Feb 2005 13:06:22 +0100 * Fixed timezone handling problem on platforms which require an explicit tzset() call. * Fixed resolving the PRI macro which always expanded to an empty string. * Fixed possible hang during reload for one second. * Fixed syslog2ng script which sometimes generated three dots when generating priority ranges. (debug...emerg) * Added a notification about splitting message lines, if they are over the configured log_msg_size() limit. * Added a setsid() call to program destinations to avoid being in the same process group as the child, as some shells send signals to the whole process group they are in, effectively killing syslog-ng. (triggered on OpenBSD for example) * Added log_fifo_size option to TCP/UDP destinations. * Added relogger.pl to contrib/ which replays existing syslog files. * Updated documentation (manpages and SGML documentation) * Link to various libraries residing in /usr statically by default, also added an --enable-full-static configure option to make a fully static version. Happy logging, -- Bazsi

2 2

/dev/log on Linux is a datagram socket, not a stream socket
by Philip J. Hollenback 04 Feb '05

04 Feb '05

The syslog-ng reference manual (and the sample syslog-ng.conf for RedHat) indicate that /dev/log on linux is a stream socket. However, other utilities think that /dev/log is a datagram socket. To see this, configure syslog-ng to open /dev/log with unix_stream and then strace the logger command. logger tries to open /dev/log as a datagram socket first, fails, and then falls back to opening it as a stream socket: socket(PF_FILE, SOCK_DGRAM, 0) = 1 fcntl64(1, F_SETFD, FD_CLOEXEC) = 0 connect(1, {sa_family=AF_FILE, path="/dev/log"}, 16) = -1 EPROTOTYPE (Protocol wrong type for socket) close(1) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 1 fcntl64(1, F_SETFD, FD_CLOEXEC) = 0 connect(1, {sa_family=AF_FILE, path="/dev/log"}, 16) = 0 send(1, "<13>Feb 2 11:19:50 phil: test m"..., 39, 0) = 39 rt_sigaction(SIGPIPE, {SIG_DFL}, NULL, 8) = 0 close(1) = 0 If, however, you open /dev/log with unix_dgram and then run logger, it's happier: socket(PF_FILE, SOCK_DGRAM, 0) = 1 fcntl64(1, F_SETFD, FD_CLOEXEC) = 0 connect(1, {sa_family=AF_FILE, path="/dev/log"}, 16) = 0 send(1, "<13>Feb 2 11:21:28 phil: test m"..., 45, 0) = 45 rt_sigaction(SIGPIPE, {SIG_DFL}, NULL, 8) = 0 close(1) = 0 This indicates to me that the syslog-ng documentation and sample syslog-ng.conf files should be changed to show you should open /dev/log with unix_dgram on linux, not with unix_stream. This is with the 2.4.22 kernel, maybe this is something that changed at some point? Thanks, P. -- Philip J. Hollenback Telemetry Investments phollenback(a)telemetry-investments.com

2 3

$DAY not working in filenames macros in 1.6.x as it did in 1.5.x
by Andrew Fort 03 Feb '05

03 Feb '05

Hi guys, I am running syslog-ng 1.5.15 on some debian stable machines. All good, all happy. I have a source: source network-hosts { udp(ip(0.0.0.0) port(8514)); tcp(ip(0.0.0.0) port(8514) max-connections(200)); }; I use filename macro expansion to auto-rotate my logs. My destinations look exactly like: destination logfiles-host { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$YEAR$MONTH$DAY\_$HOST\_$PROGRAM" template("$ISODATE [$HOST] <$FACILITY> $MSG\n") template_escape(no) owner(root) group(logs) perm(0660) dir_perm(0770) create_dirs(yes)); }; the routing stanza goes: log { source(network-hosts); destination(logfiles-host); }; This works as I expect (even without escaping the _'s between $DAY, $HOST and $PROGRAM). My log paths look like: /var/log/HOSTS/mel1/2005/02/20050203_mel1_named /var/log/HOSTS/mel1/2005/02/20050203_mel1_sendmail Great. However, using 1.6.x (I've not tested 1.6.6, to be sure, only 1.6.4 and 1.6.5) on both Solaris and Linux, using the exact same config (i.e., when I upgraded, for example), using this destination: destination d_local { file("/var/log/LOCAL/$HOST/$YEAR/$MONTH/$YEAR$MONTH$DAY\_$HOST" template("$ISODATE [$HOST] <$FACILITY> $MSG\n") template_escape(no) perm(0660) dir_perm(0770) create_dirs(yes)); }; I get this: /var/log/LOCAL/mel1/2005/02/200502mel1 So $DAY is not expanding. Same thing occurs when I use file("/var/log/LOCAL/$HOST/$YEAR/$MONTH/$YEAR$MONTH$DAY_$HOST" Is this a problem with $DAY, the _, or something else? Let me know if I can provide further info to help debug this.. Anyone else run into this? I'd like to upgrade all my boxes to 1.6.{4,5,6} eventually but at the moment this is holding me back from moving to 1.6. Cheers, Andrew Fort

2 3

preparing syslog-ng 1.6.6
by Balazs Scheidler 03 Feb '05

03 Feb '05

Hi, As there are some changes since syslog-ng 1.6.5, I'd like to release a new version. Before doing so I'd like to ask you to test the latest snapshot a little bit. The most important and risky change seems to be this one: 2005-01-20 Balazs Scheidler <bazsi(a)bzorp.balabit> * src/main.c: fix possible log message losing during HUP as syslog-ng was not accepting messages for 1 second and these messages were dropped, processing changed so we still wait 1 second to flush buffers but also accept messages in this interval, so the window of losing messages becomes much smaller. (fixes: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=282771) Everything else is minor, and although they might cause build problems on some platforms, I doubt they'd cause real problems. The latest snapshot is here: http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot/ The summary of changes can be found in the file named ChangeLog within the tarball. If no show-stopper bugs are found, I'm going to release syslog-ng 1.6.6 this week. Thanks in advance. -- Bazsi

4 11

Bug in S_YEAR?
by janth＠moldung.no 03 Feb '05

03 Feb '05

Hi, I have a Solaris 8 host with syslog-ng ver 1.6.5 set up with the following syslog-ng.conf: options { use_time_recvd(no); # Use the time a message is received instead of the one specified in the message. sync(0); # The number of lines buffered before written to file. }; source src { udp(ip("0.0.0.0") port(514)); tcp(ip("0.0.0.0") port(514) max-connections(100)); sun-streams("/dev/log" door("/etc/.syslog_door")); # local solaris syslog internal(); # syslog-ng interne meldinger }; source s_syslog_ng { internal(); # syslog-ng interne meldinger }; destination dst_template { file("/syslog/$R_YEAR/$R_MONTH/$R_DAY/$HOST" template("$R_YEAR-$R_MONTH-$R_DAY $R_HOUR:$R_MIN:$R_SEC | $R_UNIXTIME | $S_YEAR-$S_MONTH-$S_DAY $S_HOUR:$S_MIN:$S_SEC | $S_UNIXTIME | $HOST | $HOST_FROM | $FULLHOST | $SOURCEIP | $FACILITY.$PRIORITY | $TAG | $PROGRAM | $MSG\n") ); }; destination d_syslog_ng { file("/syslog/syslog-ng.log" sync(0) log_fifo_size(10) perm(0644) ); }; log { source (s_syslog_ng); destination (d_syslog_ng); }; log { source(src); destination(dst_template); }; Then I have another host set up to use syslog-ng as loghost. This host has purposely wrong time (1973-01-02), as can be seen here: joe@testhost / $ logger "test. local time on `uname -n` is `date +'%Y-%m-%d %H:%m:%S'`" joe@loghost / $ tail -1 /syslog/2005/02/01/testhost 2005-02-01 11:24:47 | 1107253487 | 2005-01-02 21:04:39 | 1104696279 | testhost | testhost | testhost/testhost | 192.168.1.2 | user.notice | 0d | joe | joe: [ID 702911 user.notice] test. local time on testhost is 1973-01-02 21:01:39 It seems as S_YEAR is set to YEAR (or R_YEAR, I have not checked the source). I hope someone can fix this before syslog-ng 1.6.6... Regards Jan Thomas Moldung

2 1

syslog-ng 1.6.5: manpage patch
by Jose Pedro Oliveira 03 Feb '05

03 Feb '05

Balazs, This patch adds the missing command line options to the syslog-ng.8 manpage. The patch also applies to syslog-ng 1.9.x (he default syslog-ng.conf location still has to be corrected). Regards, jpo -- José Pedro Oliveira mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo diff -ruN syslog-ng-1.6.5-orig/doc/syslog-ng.8 syslog-ng-1.6.5/doc/syslog-ng.8 --- syslog-ng-1.6.5-orig/doc/syslog-ng.8 1999-07-10 16:58:32.000000000 +0100 +++ syslog-ng-1.6.5/doc/syslog-ng.8 2005-01-30 00:05:48.906523000 +0000 @@ -7,7 +7,7 @@ .B syslog-ng [ -.B \-dvV +.B \-dFsvV ] [ .B \-f <\fIconfig-filename\fP> @@ -17,6 +17,12 @@ ] [ .B \-C <\fIchroot-dir\fP> +] [ +.B \-u +<\fIuser\fP> +] [ +.B \-g +<\fIgroup\fP> ] .SH DESCRIPTION .PP @@ -64,38 +70,72 @@ \fBsyslog-ng\fP will also save all the current values as a "checkpoint". .SH OPTIONS .TP -.B \-d +.B \-C \0<directory>, \-\-chroot=<directory> +Chroot to directory. +.TP +.B \-d, \-\-debug Set "debug mode". Prints out various messages to aid in debugging and stops it from becoming a daemon. To activate debugging in the yacc parser, either use this option twice or combine with \fB-v\fP. .TP -.B \-f \0<filename> +.B \-F, \-\-foreground +Don't fork into background. +.TP +.B \-f \0<filename>, \-\-cfgfile=<filename> Instead of reading the normal \fB/etc/syslog-ng/syslog-ng.conf\fP file for configuration information, use the filename given instead. .TP -.B \-p \0<filename> +.B \-g \0<group>, \-\-group=<group> +Switch to group. +.TP +.B \-p \0<filename>, \-\-pidfile=<filename> Write the current PID information to the specified file. +Defaults to \fB/var/run/syslog-ng.pid\fP. +.TP +.B \-s, \-\-syntax\-only +Only read and parse the configuration file. See also the option \fB-f\fP. .TP -.B \-v +.B \-u \0<user>, \-\-group=<user> +Switch to user. +.TP +.B \-v, \-\-verbose Enable verbose mode. Process will not become a daemon. Prints out fewer messages, compared to \fB-d\fP. .TP -.B \-V +.B \-V, \-\-version Print the version number. .SH DIAGNOSTICS It is expected that \fBsyslog-ng\fP will run as root, however, if not running on a priviledged port of it it owned its own log directories, etc, it might run as a non-root user. .SH SEE ALSO -logger(1), syslog(3), services(5), syslog.conf(5), syslog-ng.conf(5) +.BR syslog-ng.conf (5), +.BR logger (1), +.BR syslog (2), +.BR syslog (3), +.BR services (5), +.BR syslog.conf (5), +.BR klogd (8), +.BR syslogd (8), +.BR sysklogd (8) .SH FILES -/etc/syslog-ng/syslog-ng.conf -/etc/syslog-ng/filename.sha1 -/etc/syslog-ng/filename.H0 -/etc/syslog-ng/filename.salt -.br -/var/run/syslog.pid -.br +.TP +.I /etc/syslog-ng/syslog-ng.conf +Configuration file for +.BR syslog\-ng . +See +.BR syslog\-ng.conf (5) +for more information. +.TP +.I /etc/syslog-ng/filename.sha1 +.TP +.I /etc/syslog-ng/filename.H0 +.TP +.I /etc/syslog-ng/filename.salt +.TP +.I /var/run/syslog-ng.pid +The file containing the process id of +.BR syslog-ng . .SH BUGS .PP If you find any, please send email to me at bazsi(a)balabit.hu

3 6