- syslog-ng - lists.balabit.hu

How to filter XDMCP messages ?
by Gerard Breiner 12 Jan '04

12 Jan '04

Hello, I wonder how to configure syslog-ng to filtering the messages emitted by gdm_xdmcp. this type of messages pollutes my files of logs. Here is messages i don't want : "gdm[3798]: gdm_xdmcp_handle_query: Opcode 1 from ". Best regards Gerard Gerard Breiner Institut d'Astrophysique Spatiale Orsay Campus France

4 5

1.5.26 vs 1.6.x and destination selection
by T. 12 Jan '04

12 Jan '04

I am trying to get the 1.6 branch of syslog-ng to create log files based on a naming convention that worked (sort of) in 1.5.26 but no longer does. Specifically, I have the following in my syslog-ng.conf: destination d_netfilt { file ("/var/logser/$HOST/$YEAR/$MONTH/$DAY/netfilt.log" owner(root) perm(0600) create_dirs(yes) ); }; destination d_messages { file ("/var/adm/messages.$YEAR.$MONTH" owner(root) perm(0644) ); }; filter f_netfilt { match(" netfilt\[0-9]+\]") or program("netfilt"); }; source s_udp { udp( port(514) ); }; log { source(s_udp); filter(f_netfilt); destination(d_netfilt); }; log { destination(d_messages); flags(fallback, catchall); }; With syslog-ng 1.5.26, this sends messages matching "netfilt" received on UDP port 514 into /var/logser (albeit it doesn't correctly expand $HOST into the source of the message - it fills this in as the hostname of the machine on which syslog-ng is running). With the 1.6 branch, however, running with the same config file and receiving messages from the same sources winds up dropping the logs down into the d_messages block. This happened both with the release candidates and with the recent 1.6.1 branch. I'm using libol 0.3.11 and running on Solaris 8 on Netra V120; both libol and syslog-ng were compiled using GCC 3.1 in 64-bit mode (-m64 -mcpu=ultrasparc -O3). Can anyone help point me in the right direction of getting 1.6.1 to correctly match the source of the message and, perhaps, also identify $HOST properly? Thanks in advance. T. E. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1

compiling syslog-ng (latest version) on solrais 9 - no error
by Markus Reger 11 Jan '04

11 Jan '04

This is the same problem on IRIX. You have to use the flex library like this: gcc ... -L(flex directory path) -lfl Gabor sorry to say but Gabor's advice didn't bring me any further. What I chose then was to set export LEXLIB="/opt/sfw/libfl.a" since this file holds yywrap. I made a make disclean ./configure make and everything went fine (at least there were no errors, warnings, notices or other complaints reported) and binaries were ceated. fyi we use: gcc 3.3 flex 2.5.4 libol 0.3.11 syslog-ng 1.6.0rc4 now the config will begin. kr

1 0

"last message repeated NN times"?
by Ed Ravin 11 Jan '04

11 Jan '04

I recall someone pointing out last year that syslogd has a feature where it can compress a burst of messages into a note like: Jan 10 17:01:06 loghost last message repeated 24 times While syslog-ng didn't have that. Is that still the case? I just ran into this with a mongo runaway program that logged several hundred messages a second, which filled up my log partition. If this feature still isn't in syslog-ng, is it one that we want? I could see it as a source option like "suppress-repeats", where it would spit out the original message followed by a tag, like this: Jan 10 17:25:39 loghost inetd[7729]: Connection from 10.24.1.168 [REPEATED 1024 TIMES] and maybe arguments to "suppress-repeats" like how many repeats should be printed before kicking in, or perhaps even a regex describing which parts of the log message to ignore before comparing it to the previous one. Thanks, -- Ed

2 3

Getting rid of --
by Al Banard 10 Jan '04

10 Jan '04

How do I get rid of the two dashes between syslog-ng output and the actual message? I've tried this: template("$ISODATE $MESSAGE\n") but I still get "--" between the date and my message. current message output: 2004-01-10T09:18:52+0100 -- my_lovely_message desired message output: 2004-01-10T09:18:52+0100 my_lovely_message _________________________________________________________________ E-mail just got a whole lot better. New ninemsn Premium. Click here http://ninemsn.com.au/premium/landing.asp

1 0

RE: [syslog-ng]funny character is being inserted into each log line + perm(-1) n ot working
by Rule, Ted 09 Jan '04

09 Jan '04

The ^@ isn't really 'funny', per se; it's a representation of Ctrl-@ which in turn is actually the null character. Hence I suspect syslog-ng is safely mangling a null somewhere into a readable representation before writing it to the log file. Quite whose fault this is, is another matter. Ted. ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

2 1

Stable version?
by Andrew Culver 09 Jan '04

09 Jan '04

What is the current stable version of syslog-ng? The docs say 1.4 is the latest stable (so 1.5 would be development) but I also see 1.6 and 1.9. Just wondering if 1.6 is the latest stable since it hasn't been updated in about 8 months. TIA, Andrew

1 0

patch for log parsing bugs (log4j)
by Balazs Scheidler 09 Jan '04

09 Jan '04

hi, Attached you'll find a patch against syslog-ng 1.6.0rc4 which addresses some issues wrt log parsing. Please test if the patch fixes your problems. It might be part of a future release if it proves to interoperate with other platforms. People with not to frequent platforms (HP-UX comes to mind), please also test this patch as it might break there. Thanks. And finally the patch: Index: src/sources.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/sources.c,v retrieving revision 1.37 diff -u -r1.37 sources.c --- src/sources.c 8 Jan 2003 09:31:37 -0000 1.37 +++ src/sources.c 3 Oct 2003 14:22:32 -0000 @@ -107,23 +107,32 @@ } closure->pos += n; + /* UDP packets are complete log lines on their own */ + if (closure->dgram) { + do_handle_line(closure, closure->pos, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); + closure->pos = 0; + return ST_OK | ST_GOON; + } + eol = memchr(closure->buffer, '\0', closure->pos); - if (eol == NULL) - eol = memchr(closure->buffer, '\n', closure->pos); if (closure->pad_size && eol) { + + /* HP-UX sends chunks of pad_size in size, each containing a + * separate message, terminated by NUL */ do_handle_line(closure, eol - closure->buffer, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; } - if (!eol && (closure->dgram || closure->pos == closure->max_log_line)) { - /* we don't have a terminating nl nor \0, and our buffer is - full or we are a datagram receiver, when the message is in - its own packet. - */ + if (eol == NULL) + eol = memchr(closure->buffer, '\n', closure->pos); + if (!eol && closure->pos == closure->max_log_line) { + /* we don't have a terminating nl nor \0, and our buffer is full */ do_handle_line(closure, closure->pos, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; } + + /* iterate through lines */ start = closure->buffer; while (eol) { /* eol points at the newline character. end points at the -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 5

compiling syslog-ng (latest version) on solaris 9 - error
by Markus Reger 09 Jan '04

09 Jan '04

hello to everybody Made several attempts to compile syslog-ng. Compilation of libol went fine. Whenever I "make" syslog-ng I encounter the error: gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o getopt.o getopt1.o -lpthread -lnsl -lsocket -ldoor -lresolv /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Has anyone ever compiled on Solaris 9 - gcc 3.3. Thanks in advance for every hint. kr

2 1

Question regarding syslog-ng filter
by Aladdin 09 Jan '04

09 Jan '04

I'm using syslog-ng 1.6rc4 Can anyone tell me what is wrong with this filter: filter f_kern { facility(kern) and (not match("IPTABLES DROP") or not match("New not SYN:")); }; I still can see lines with IPTABLES DROP in my kernel log:-( Why these messages still come through this filter? Thanks. What am I missing?

1 0