- syslog-ng - lists.balabit.hu

syslog-ng 1.6.1 released
by Balazs Scheidler 18 Jan '04

18 Jan '04

Hi, I have released syslog-ng 1.6.1 with the following NEWS entry: News for the 1.6.1 release Fri, 9 Jan 2004 10:27:38 +0100 * added a new macro named "PRI" which inserts the decimal value of the message priority (pri + level value combined) * fixed a problem in PIX timestamp parsing which inserted an unnecessary NUL character to the message Otherwise it is equivalent to 1.6.0rc4. I have also opened the 1.7.x development branch, even though I want to put this implementation of syslog-ng into maintenance mode. This means that the next stable release of syslog-ng will probably be based on my 1.9.x codebase. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

4 4

syslog-ng-1.6.1 make error.
by Andrews, Glenn J (Glenn) 18 Jan '04

18 Jan '04

I have install libol 0.3.12 and I am trying to install syslog-ng-1.6.1. The libol install ok. The syslog-ng "./configured" ok but when I try to make I get this error... cd /tmp/syslog-ng-1.6.1 && autoheader WARNING: Using auxiliary files such as `acconfig.h', `config.h.bot' WARNING: and `config.h.top', to define templates for `config.h.in' WARNING: is deprecated and discouraged. WARNING: Using the third argument of `AC_DEFINE' and WARNING: `AC_DEFINE_UNQUOTED' allows to define a template without WARNING: `acconfig.h': WARNING: AC_DEFINE([NEED_MAIN], 1, WARNING: [Define if a function `main' is needed.]) WARNING: More sophisticated templates can also be produced, see the WARNING: documentation. autom4te: need GNU m4 1.4 or later: /usr/ccs/bin/m4 autoheader: /usr/local/bin/autom4te failed with exit status: 1 *** Error code 1 make: Fatal error: Command failed for target `/tmp/syslog-ng-1.6.1/src/stamp-h.in' Current working directory /tmp/syslog-ng-1.6.1/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' I have m4 1.4 in my path. Is there something I am missing ? Glenn Andrews Data / Voice Networking Services 1 Robbins Road, Westford, MA 01886 gjandrews(a)lucent.com << mailto:gjandrews@lucent.com <mailto:gjandrews@lucent.com> >>

2 1

syslog-ng hanging
by david＠reno2.com 17 Jan '04

17 Jan '04

I have noticed that syslog-ng has been hanging on my 2.6.0 kernel gentoo host. I saw in a previous post that strace was requested, so here is some info: cindy etc # ps -ef |grep syslog-ng root 3381 1 0 15:36 ? 00:00:00 /usr/sbin/syslog-ng root 11416 9238 0 20:34 pts/1 00:00:00 grep syslog-ng cindy etc # cindy etc # strace -f -v -i -t -p 3381 Process 3381 attached - interrupt to quit 20:34:39 [4011e878] read(3, <unfinished ...> Process 3381 detached cindy etc # (The above unfinished part happens after I CTRL-C) Using following version of syslog-ng: [ebuild R ] app-admin/syslog-ng-1.6.0_rc3-r1 I will leave the system in this state until tomorrow morning (Mon, Dec 29, 7AM PST) in case any further diagnostic info is requested by then. I appreciate any help that you can give, Regards, David

2 1

syslog-ng unstable???
by Alexander von Hedenstroem 17 Jan '04

17 Jan '04

Hi, I like the concept of syslog-ng and so I decided to install it. I run a Debian stable (woody), and the version that comes with it is 1.5.15-1.1. I didn't change much on its configuration files, merely adding the udp logging source. That's all, honestly. And it worked pretty stable for a couple of weeks. Some day, I noticed that the server load was constantly around 80% because of rpc.statd and another process. I was wondering why, until I noticed that syslog-ng was not running! So I restarted it, and the load was gone. Why could it happen that syslog-ng terminates? Thanks, _ + mail: hedenstroem(a)pyromedia.de ( ) ASCII Ribbon Campaign + ICQ: #21622350 X - against HTML mail / \ - against MS attachments

2 1

error "Cannot assign requested address"
by Matthew Bassili 17 Jan '04

17 Jan '04

List members, I am trying to setup syslog-ng (Red Hat9, syslog build 1.6.0rc4) with the following syslog-ng.conf file: ############################################################### # First, set some global options # options { keep_hostname(yes); long_hostnames(off); sync(0); log_fifo_size(1024); log_msg_size(8192); }; ############################################################### # # source local { unix-dgram("/dev/log"); internal(); pipe("/proc/kmsg" log_prefix("kernel: ")); }; #source nocpix # { udp(ip("172.31.30.2") port(514)); # }; source nocpix-out { udp(ip("147.76.127.44") port(514)); }; #source mb2-pix # { udp(ip("172.18.1.6") port(514)); # }; source other { udp(); }; # # ############################################################### # # destination local { file("/var/log/syslog-ng/local/local.$YEAR.$MONTH.$DAY"); }; destination other { file("/var/log/syslog-ng/other/other.$YEAR.$MONTH.$DAY"); }; destination nocpix { file("/var/log/syslog-ng/nocpix/nocpix.$YEAR.$MONTH.$DAY"); }; #destination mb2 { file("/var/log/syslog-ng/mb2/mb2.$YEAR.$MONTH.$DAY"); }; # # ############################################################### # # filter f_auth { facility(auth, authpriv); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { facility(daemon, kern, user); }; filter f_news { facility(news); }; filter f_spooler { facility(uucp,news) and level(crit); }; filter f_syslog { not facility(auth, authpriv) and not facility(mail); }; filter f_user { facility(user); }; # # ############################################################### # # log { source(local); destination(local);}; #log { source(nocpix); destination(nocpix);}; log { source(nocpix-out); destination(nocpix);}; #log { source(mb2-pix); destination(mb2);}; log { source(other); destination(other);}; & I get the following error message on startup: "Starting syslog-ng: io.c: bind_inet_socket() bind failed 147.76.127.44:514 Cannot assign requested address" When I comment out the line " source nocpix-out { udp(ip("147.76.127.44") port(514)); };" Everything works fine using udp();, but I really want to separate the sources so I can direct the log files to a different directory. Any help would be GREATLY appreciated. Matthew Bassili Senior Network Engineer NEC Business Solutions P/L 649 Springvale Rd Mulgarve, 3170 AUSTRALIA e-mail: matthew.bassili(a)nec.com.au

2 1

persistent link to current file
by Gainey, Joe (AT-Atlanta) 14 Jan '04

14 Jan '04

Is there any way to link the current version of a file to a standard location. If not would it be possible to add this functionality. Here is an example of what i have: destination d_default { file("/var/adm/messages.$YEAR.$MONTH.$DAY") ; } ; However, I have to recreate the symlink in cron every day: ln -s /var/adm/messages.2004.01.13 /var/adm/messages it would be nice if there was an option: destination d_default { file("/var/adm/messages.$YEAR.$MONTH.$DAY" soft_link("/var/adm/messages")) ; } ; if this or something like this has been implemented please let me know. Joe Gainey

4 5

RE: [syslog-ng]funny character is being inserted into each log li ne + perm(-1) n ot working
by Clemson, Chris 14 Jan '04

14 Jan '04

> On Wed, 2004-01-07 at 11:50, Rule, Ted wrote: > > The ^@ isn't really 'funny', per se; it's a representation of Ctrl-@ > > which in turn is actually the null character. > > Correct, this has been fixed by a patch posted to this list > earlier, and > in the last 1.6.1 syslog-ng release (which has the posted > patch merged) oh, thanks for the reply! i must have missed that, i'll check it out cheers, chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

Re: [syslog-ng]1.5.26 vs 1.6.x and destination selection
by T. 14 Jan '04

14 Jan '04

Interesting point. I tried with check_hostnames() set to either yes or no but with little success. I also tried use_fqdn() as well as taking out my bad_hostname() restrictions. I'll try to document some of the different use cases if I get a few moments free. --- On Mon 01/12, Balazs Scheidler < bazsi(a)balabit.hu > wrote: From: Balazs Scheidler [mailto: bazsi(a)balabit.hu] To: syslog-ng(a)lists.balabit.hu Date: Mon, 12 Jan 2004 21:41:11 +0100 Subject: Re: [syslog-ng]1.5.26 vs 1.6.x and destination selection On Mon, 2004-01-12 at 21:00, T. wrote: > Hi, Baszi. Thanks for writing back. Here's what I'm seeing: > > 0: 0003 ba10 8f5b 0001 81ff d8ad 0800 4500 .....[........E. > 16: 00a5 8018 0000 fc11 7b85 0a64 6303 0a40 .......{..dc..@ > 32: 4b03 042d 0202 0091 0736 3c31 3636 3e4a K..-.....6<166>J > 48: 616e 2031 3220 3230 3034 2031 393a 3336 an 12 2004 19:36 > 64: 3a35 313a 2025 4657 534d 2d36 2d33 3032 :51: %FWSM-6-302 > 80: 3030 363a 2054 6561 7264 6f77 6e20 5544 006: Teardown UD > 96: 5020 636f 6e6e 6563 7469 6f6e 2066 6f72 P connection for > 112: 2066 6164 6472 2031 302e 3130 302e 3832 faddr 10.100.82 > 128: 2e39 2f33 3738 3638 2067 6164 6472 2031 .9/37868 gaddr 1 > 144: 302e 3230 2e33 302e 3631 2f35 3320 6c61 0.20.30.61/53 la > 160: 6464 7220 3130 2e32 302e 3330 2e36 312f ddr 10.20.30.61/ > 176: 3533 0a 53. > > In this case, the filter that I expect to pick it up is: > > filter f_fwsm_misc { > match(" \%FWSM-") and > match(": (Teardown|Translation|Built)"); > }; > log { source(s_udp); filter(f_fwsm_misc); destination(d_netfilt); }; > log { destination(d_messages); flags(fallback, catchall); }; > > > This works OK in 1.5.26 (i.e. the message above gets written to d_netfilt) but not 1.6.0rc4 or 1.6.1 (it's written to d_messages). I wouldn't always expect program() to work well for remote hosts but the match() filter seems like it should. Also, I can't tell if $HOST is now being correctly interpreted in 1.6.1 because the message is being written to the wrong place :-) I can say that it does seem to work correctly for other syslog-ng hosts (which I have set up to use TCP), it's primarily the UDP transport that seems to be having problems. I don't understand how this might work differently than 1.5.26, though I think the problem is that you have to enable the check_hostname() option as '%FWSM-6-302' is taken as the hostname (if you enable check_hostname it will be interpreted as the part of the message as '%' is not a valid hostname. I can't remember any changes in this area though. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

Re: [syslog-ng]1.5.26 vs 1.6.x and destination selection
by T. 12 Jan '04

12 Jan '04

Hi, Baszi. Thanks for writing back. Here's what I'm seeing: 0: 0003 ba10 8f5b 0001 81ff d8ad 0800 4500 .....[........E. 16: 00a5 8018 0000 fc11 7b85 0a64 6303 0a40 ......�.{..dc..@ 32: 4b03 042d 0202 0091 0736 3c31 3636 3e4a K..-.....6<166>J 48: 616e 2031 3220 3230 3034 2031 393a 3336 an 12 2004 19:36 64: 3a35 313a 2025 4657 534d 2d36 2d33 3032 :51: %FWSM-6-302 80: 3030 363a 2054 6561 7264 6f77 6e20 5544 006: Teardown UD 96: 5020 636f 6e6e 6563 7469 6f6e 2066 6f72 P connection for 112: 2066 6164 6472 2031 302e 3130 302e 3832 faddr 10.100.82 128: 2e39 2f33 3738 3638 2067 6164 6472 2031 .9/37868 gaddr 1 144: 302e 3230 2e33 302e 3631 2f35 3320 6c61 0.20.30.61/53 la 160: 6464 7220 3130 2e32 302e 3330 2e36 312f ddr 10.20.30.61/ 176: 3533 0a 53. In this case, the filter that I expect to pick it up is: filter f_fwsm_misc { match(" \%FWSM-") and match(": (Teardown|Translation|Built)"); }; log { source(s_udp); filter(f_fwsm_misc); destination(d_netfilt); }; log { destination(d_messages); flags(fallback, catchall); }; This works OK in 1.5.26 (i.e. the message above gets written to d_netfilt) but not 1.6.0rc4 or 1.6.1 (it's written to d_messages). I wouldn't always expect program() to work well for remote hosts but the match() filter seems like it should. Also, I can't tell if $HOST is now being correctly interpreted in 1.6.1 because the message is being written to the wrong place :-) I can say that it does seem to work correctly for other syslog-ng hosts (which I have set up to use TCP), it's primarily the UDP transport that seems to be having problems. Thanks again for any help you might be able to offer. --- On Mon 01/12, Balazs Scheidler < bazsi(a)balabit.hu > wrote: From: Balazs Scheidler [mailto: bazsi(a)balabit.hu] To: syslog-ng(a)lists.balabit.hu Date: Mon, 12 Jan 2004 13:54:10 +0100 Subject: Re: [syslog-ng]1.5.26 vs 1.6.x and destination selection Please try checking how those messages are formatted. syslog-ng might have problems identifying the program part in those messages. either a tcpdump or an strace with large strings (-s 512) might help to find the problem. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1

RE: [syslog-ng]Re: syslog-ng and log viewer
by Schernau, Ed 12 Jan '04

12 Jan '04

I second this, however I find that heavy DB usage causes NG to drop messages. However, I'm running MySQL on an old Sun Ultra 2, maybe this has something to do with it. -----Original Message----- From: Jérôme Fenal [mailto:jerome.fenal@logicacmg.com] Sent: Monday, January 12, 2004 10:49 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Re: syslog-ng and log viewer Gerard Breiner wrote: > Hello, > > I installed and configured syslog-ng. It works very fine ! Now, I'm > seeking a free application to visualize the logs files into a > navigator. An idea ? we use a home brew version of what can be found here : http://vermeer.org/syslog/ We log to mysql, then use a heavily modified of an early version of the php script found here : http://www.vermeer.org/projects/php-syslog-ng/ Cordialement, Jérôme -- Jérôme Fenal - Consultant Unix/SAN/Logiciel Libre Groupe Expert & Managed Services - LogicaCMG France http://www.logicacmg.com/fr/ - <mailto:jerome.fenal AT logicacmg.com> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html *****This information may be confidential and/or privileged. Use of this information by anyone other than the intended recipient is prohibited. If you received this in error, please inform the sender and remove any record of this message.*****

1 0