- syslog-ng - lists.balabit.hu

RE: [syslog-ng]Compile Error on Solaris 2.8
by Hamilton Andrew 08 Jan '04

08 Jan '04

Strange... Try this: In /tmp/syslog-ng/libol-0.3.9 do a 'make distclean', I don't remember if this works but if not you can do a 'make clean' and then delete config.cache and try to run the configure script again. If that doesn't work upgrade to the latest libol, which is 0.3.11, I think, and try it again, and if that still doesn't work repost and we'll try something else. Regards, Drew -----Original Message----- From: Chance Ellis [mailto:chance_ellis@yahoo.com] Sent: Wednesday, January 07, 2004 7:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Compile Error on Solaris 2.8 Trying to compile libol 0.3.9 on Solaris. Get this error on Make: Making all in utils make[1]: Entering directory `/tmp/syslog-ng/libol-0.3.9/utils' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/tmp/syslog-ng/libol-0.3.9/utils' Making all in src make[1]: Entering directory `/tmp/syslog-ng/libol-0.3.9/src' /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng/libol -0.3.9/src -I. -I/opt/gnome/include -I/usr/openwin/share/include/X11/extension s -I/usr/openwin/include -D_GNU_SOURCE -Wall -O2 -c format.c rm -f .libs/format.lo gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng/libol-0.3.9/src -I. -I/opt/gnome/includ e -I/usr/openwin/share/include/X11/extensions -I/usr/openwin/include -D_GNU_SOUR CE -Wall -O2 -c format.c -fPIC -DPIC -o .libs/format.lo In file included from objects.h:41, from format.h:27, from format.c:24: objtypes.h:36:3: #error No suitable type found to use for UINT32 objtypes.h:44:3: #error No suitable type found to use for UINT16 In my configure I noticed that when it checks the size of short, int and long they are returned Cached 0. Any ideas? Thanks! __________________________________ Do you Yahoo!? Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes http://hotjobs.sweepstakes.yahoo.com/signingbonus _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]funny character is being inserted into each log li ne + perm(-1) n ot working
by Clemson, Chris 08 Jan '04

08 Jan '04

> The ^@ isn't really 'funny', per se; it's a representation of Ctrl-@ > which in turn is actually the null character. ah, i see. i wondered what it was! > Hence I suspect syslog-ng is safely mangling a null somewhere > into a readable representation before writing it to the log file. hmm, strange. is there a way to turn this off? i dont mind that the date isn't displaying, and it's only affecting the firewall, so it's not a big deal really. it's just annoying to get alert emails that don't actually contain anything useful! > Quite whose fault this is, is another matter. :) thanks chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

Compile Error on Solaris 2.8
by Chance Ellis 08 Jan '04

08 Jan '04

Trying to compile libol 0.3.9 on Solaris. Get this error on Make: Making all in utils make[1]: Entering directory `/tmp/syslog-ng/libol-0.3.9/utils' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/tmp/syslog-ng/libol-0.3.9/utils' Making all in src make[1]: Entering directory `/tmp/syslog-ng/libol-0.3.9/src' /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng/libol -0.3.9/src -I. -I/opt/gnome/include -I/usr/openwin/share/include/X11/extension s -I/usr/openwin/include -D_GNU_SOURCE -Wall -O2 -c format.c rm -f .libs/format.lo gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng/libol-0.3.9/src -I. -I/opt/gnome/includ e -I/usr/openwin/share/include/X11/extensions -I/usr/openwin/include -D_GNU_SOUR CE -Wall -O2 -c format.c -fPIC -DPIC -o .libs/format.lo In file included from objects.h:41, from format.h:27, from format.c:24: objtypes.h:36:3: #error No suitable type found to use for UINT32 objtypes.h:44:3: #error No suitable type found to use for UINT16 In my configure I noticed that when it checks the size of short, int and long they are returned Cached 0. Any ideas? Thanks! __________________________________ Do you Yahoo!? Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes http://hotjobs.sweepstakes.yahoo.com/signingbonus

1 0

syslog-ng mysql syntax error
by Asif Iqbal 07 Jan '04

07 Jan '04

Hi All Since yesterday I am getting this syntax errors while pushing the log to the mysql database I followed the instruction exactly how it was said in http://vermeer.org/syslog/ and it was working fine until today it started complaining ERROR 1064 at line 841: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'level, tag, date, time, program, msg) VALUES ( '63.152.4.63', ' ERROR 1064 at line 1: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '/22/3 session 4612f4 Session End' ); INSERT INTO logs (host, fa ERROR 1064 at line 424: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '63.152.0.100', 'local4', 'err', 'err', 'a3', '2003-12-31', '17: Any suggestion/hint would be greatly appreciated -- Asif Iqbal http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x8B686E08 There's no place like 127.0.0.1

1 1

funny character is being inserted into each log line + perm(-1) n ot working
by Clemson, Chris 07 Jan '04

07 Jan '04

I am having a problem with logging from a Cisco PIX firewall to a syslog-ng file. For months it has been working fine, but something happened on 18th december: Dec 18 16:08:25 BPFpix-int Dec 18 2003 08:53:15: %PIX-3-313001: Denied ICMP type=8, code=0 from 217.81.176.93 on interface 0 Dec 18 09:46:50^@ BPFpix-int %PIX-3-313001: Denied ICMP type=8, code=0 from 217.79.97.90 on interface 0 all the lines logged since "Dec 18 09:46:50" have all had that ^@ code after it, and no date. i don't know why the times on the previous line are different, but the syslog server now has our "official" time, so i'm not that bothered. Around this time i was trying to sort out the permissions problems with /dev/ files i was having when syslog-ng restarted, so i guess this could be connected. This ^@ character is only in the PIX firewall log (which is saved to a different file than most of the other syslog messages). The pertinent config lines are as follows: destination null { file("/dev/null" perm(0666)); }; source BPFpix { udp(ip ("192.168.1.2") port(514)); }; filter f_bpfpixpingdrop { host ("BPFpix") and match("Denied ICMP"); }; # BPFpix messages # destination BPFpixlog { file ("/var/log/BPFpix"); }; log { source(BPFpix); destination(BPFpixlog); }; # drop ping attempts log { source(BPFpix); filter (f_bpfpixpingdrop); destination(null); flags(final);}; # log the rest log { source(BPFpix); destination(lanmon); }; the "lanmon" destination is a machine that emails certain syslog messages, and because the PIX messages have a ^@ in them, the messages are mainly blank! Can anyone tell me where this ^@ is coming from, and could it be permissions related? i am running syslog-ng 1.6.0rc4. also, i really want that first line to read: destination null { file("/dev/null" perm(-1)); }; so that no permissions are changed on that file, but syslog-ng complains about it when i start it up. What am i doing wrong? thank you! chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

Syslog-ng and Oracle
by Coward, Robert (Contractor) 05 Jan '04

05 Jan '04

Hey all, I just got syslog-ng installed and cofigured properly, and I was wondering is there any way to get oracle to log to it? I know that by default Oracle logs to its alert.log in $ORACLE_HOME, but I am unsure as to whether this behaivour can be overridden to use the syslog protocol. Any help would be greatly appreciated. Roberto

1 0

syslog-ng hast no more facilities than old syslog?
by Ekkard Gerlach 04 Jan '04

04 Jan '04

Is it right that syslog-ng hat no more facilities than sylog-old? I hoped that I could take any name: root@rex2:~>logger -p 'hello.err' hello logger: unknown facility name: hallo. thx ekkard

3 3

syslog-ng spec file
by Aladdin 01 Jan '04

01 Jan '04

Hello , I want to make RPM file for my RedHat system from spec file which is included in source tarball. Syslog-ng is 1.6.0rc4 version. I stucked with the following part: Source2: syslog-ng.init Source3: mysql-syslog.pipe Source4: mysql-syslog.buffer Source5: syslog-ng.sysconfig So my question is - where can I get the following files mentioned as sources. I was unable to find them anywhere in the tarball:( Thanks. -- Best regards, Aladdin mailto:aladdin@antakalnis.lt

1 0

central syslog server
by Asif Iqbal 31 Dec '03

31 Dec '03

Hi All I am trying to setup a central syslog server. Server A will push all its data to Server B (central syslog server, ip 1.2.3.4) Server A: ********* options { dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname(yes); }; source src { sun-streams("/dev/log"); udp(); internal(); }; destination d_server_B { udp("1.2.3.4" port(514)); }; log { source(src); destination(d_server_B); }; Server B: ********** options { dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname(yes); }; source local { sun-streams("/dev/log"); udp(); internal(); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(local); destination(d_mysql); }; But It does not seem to fully working. I get lots of logs in Server A from the routers. However only logs that Server B (central syslog server) gets from Server A are internal logs, nothing about the routers Am I missing something ? Thanks -- Asif Iqbal http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x8B686E08 There's no place like 127.0.0.1

1 2

Old Syslog Data
by Asif Iqbal 23 Dec '03

23 Dec '03

Hi All I am using syslog-ng which pipes the log to mysql database in this format host, facility, priority, level, tag, date, time, program, msg I installed the php plugin and now I can browse through the web real fast. Is there a way I can push all the previous logs in the database in the same format ? That way users can also look at the previous datam Thanks -- Asif Iqbal http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x8B686E08 There's no place like 127.0.0.1

3 3