- syslog-ng - lists.balabit.hu

Old log messages showing up followed by reboot
by Guillaume Fraysse 18 Oct '02

18 Oct '02

Hello everyone, First step, let me introduce myself, my name is Guillaume Fraysse and I'm a French software engineer in an IT compagny. I just subscribed to this list because I haven't found anything about a problem I encountered when googling and browsing the archives of the list. I, along with some fellow workers of mine, juste experienced a very strange behaviour. A linux (2.4.8, debian) server unexpectingly rebooted and while checking the logs we found out that at the time of the reboot nothing was to be found. Instead the last log messages (before the reboot) were from the day before. So the log file has old log messages right in the middle. Which gives something like that (I, of course, have blurred the logs) Oct 18 13:29:07 some_home_app some_message Oct 17 21:08:56 some_home_app some_old_message Oct 17 21:08:57 some_home_app some_old_message Oct 17 21:08:58 some_home_app some_old_message Oct 17 21:08:59 some_home_app some_old_message [...] OcOct 18 13:43:50 some_host syslog-ng[136]: syslog-ng version 1.4.16 starting (the OcOct isn't a typo, it's "as is") It didn't happen only to one log file but to several of them (the excerpt above is taken from /var/log/messages) : /var/log/debug /var/log/messages /var/log/syslog Coincidentally those files are all the ones logging the facility used by one of our applications (let's say it's local4). Here are the lines concerning /var/log/messages in the syslog-ng.conf file : options { long_hostnames(off); sync(0); }; source src { unix-dgram("/dev/log"); internal(); }; destination messages { file("/var/log/messages" owner("root") group("group") perm(0640)); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, local4); }; log { source(src); filter(f_messages); destination(messages); }; I assume it might not be a syslog-ng problem, more the way we use it, but does anyone have any idea about what could cause that behaviour ? Why do we see old messages like that ? And, even if they are old messages why aren't they logged with the current time ? Cheers, Guillaume

1 0

Search Agent
by EyaKoo 17 Oct '02

17 Oct '02

1 0

messages every 5 seconds
by Alex Finch 16 Oct '02

16 Oct '02

Following a recommendation in http://online.securityfocus.com/infocus/1633 I decided to try syslog-ng I installed it and it appears to run, but so far all I get is every 5 seconds: watcher[900]: Checking files... Is this normal - can I turn it off? -- Alex Finch, Research Fellow, Physics Department, Lancaster University.

2 1

problems: Error creating AF_INET socket (Success)
by Christian Hammers 16 Oct '02

16 Oct '02

Hi Does someone know why it worked in 1.5.13 and not in 1.5.21? destination qdb2 { udp("qdb2.westend.com"); }; log { source(src); destination(qdb2); }; (optionally with port(514) but doesn't matter) # syslog-ng -F -v -d io.c: Preparing fd 3 for reading io.c: listening on fd 4 binding fd 5, unixaddr: /dev/log io.c: listening on fd 5 io.c: connecting using fd 6 Error creating AF_INET socket (Success) Error initializing configuration, exiting. The hostname is, according to "host"/"nslookup" correct. bye, -christian- P.S.: Please cc me when replying. thanks. strace: 24568 execve("/sbin/syslog-ng", ["syslog-ng", "-dddd", "-vvv"], [/* 22 vars */]) = 0 24568 uname({sys="Linux", node="proxy", ...}) = 0 24568 brk(0) = 0x805b7a4 24568 open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory) 24568 open("/etc/ld.so.cache", O_RDONLY) = 3 24568 fstat64(3, {st_mode=S_IFREG|0644, st_size=12877, ...}) = 0 24568 old_mmap(NULL, 12877, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40014000 24568 close(3) = 0 24568 open("/lib/libnsl.so.1", O_RDONLY) = 3 24568 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0 ;\0\000"..., 1024) = 1024 24568 fstat64(3, {st_mode=S_IFREG|0644, st_size=69472, ...}) = 0 24568 old_mmap(NULL, 80988, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x40018000 24568 mprotect(0x40029000, 11356, PROT_NONE) = 0 24568 old_mmap(0x40029000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x10000) = 0x40029000 24568 old_mmap(0x4002a000, 7260, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x4002a00 0 24568 close(3) = 0 24568 open("/lib/libc.so.6", O_RDONLY) = 3 24568 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\30\222"..., 1024) = 1024 24568 fstat64(3, {st_mode=S_IFREG|0755, st_size=1153784, ...}) = 0 24568 old_mmap(NULL, 1166560, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x4002c000 24568 mprotect(0x4013f000, 40160, PROT_NONE) = 0 24568 old_mmap(0x4013f000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x113000) = 0x4013f000 24568 old_mmap(0x40145000, 15584, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x401450 00 24568 close(3) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40149000 24568 munmap(0x40014000, 12877) = 0 24568 brk(0) = 0x805b7a4 24568 brk(0x805b7ec) = 0x805b7ec 24568 brk(0x805c000) = 0x805c000 24568 open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) = 3 24568 brk(0x8061000) = 0x8061000 24568 ioctl(3, SNDCTL_TMR_TIMEBASE, 0xbffff858) = -1 ENOTTY (Inappropriate ioctl for device) 24568 fstat64(3, {st_mode=S_IFREG|0644, st_size=4970, ...}) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40014000 24568 read(3, "#\n# Syslog-ng configuration file"..., 8192) = 4970 24568 read(3, "", 4096) = 0 24568 brk(0x8062000) = 0x8062000 24568 socket(PF_UNIX, SOCK_STREAM, 0) = 4 24568 connect(4, {sin_family=AF_UNIX, path="/var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directo ry) 24568 close(4) = 0 24568 open("/etc/nsswitch.conf", O_RDONLY) = 4 24568 fstat64(4, {st_mode=S_IFREG|0644, st_size=465, ...}) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40015000 24568 read(4, "# /etc/nsswitch.conf\n#\n# Example"..., 4096) = 465 24568 read(4, "", 4096) = 0 24568 close(4) = 0 24568 munmap(0x40015000, 4096) = 0 24568 open("/etc/ld.so.cache", O_RDONLY) = 4 24568 fstat64(4, {st_mode=S_IFREG|0644, st_size=12877, ...}) = 0 24568 old_mmap(NULL, 12877, PROT_READ, MAP_PRIVATE, 4, 0) = 0x4014a000 24568 close(4) = 0 24568 open("/lib/libnss_compat.so.2", O_RDONLY) = 4 24568 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\340\25"..., 1024) = 1024 24568 fstat64(4, {st_mode=S_IFREG|0644, st_size=40152, ...}) = 0 24568 old_mmap(NULL, 43256, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0x4014e000 24568 mprotect(0x40158000, 2296, PROT_NONE) = 0 24568 old_mmap(0x40158000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 4, 0x9000) = 0x40158000 24568 close(4) = 0 24568 munmap(0x4014a000, 12877) = 0 24568 uname({sys="Linux", node="proxy", ...}) = 0 24568 open("/etc/passwd", O_RDONLY) = 4 24568 fcntl64(4, F_GETFD) = 0 24568 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 24568 fstat64(4, {st_mode=S_IFREG|0644, st_size=3771, ...}) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40015000 24568 _llseek(4, 0, [0], SEEK_CUR) = 0 24568 read(4, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 3771 24568 close(4) = 0 24568 munmap(0x40015000, 4096) = 0 24568 brk(0x8063000) = 0x8063000 24568 socket(PF_UNIX, SOCK_STREAM, 0) = 4 24568 connect(4, {sin_family=AF_UNIX, path="/var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directo ry) 24568 close(4) = 0 24568 open("/etc/group", O_RDONLY) = 4 24568 fcntl64(4, F_GETFD) = 0 24568 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 24568 fstat64(4, {st_mode=S_IFREG|0644, st_size=539, ...}) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40015000 24568 _llseek(4, 0, [0], SEEK_CUR) = 0 24568 read(4, "root:x:0:\ndaemon:x:1:\nbin:x:2:\ns"..., 4096) = 539 24568 close(4) = 0 24568 munmap(0x40015000, 4096) = 0 24568 brk(0x8064000) = 0x8064000 24568 read(3, "", 8192) = 0 24568 ioctl(3, SNDCTL_TMR_TIMEBASE, 0xbffff328) = -1 ENOTTY (Inappropriate ioctl for device) 24568 close(3) = 0 24568 munmap(0x40014000, 4096) = 0 24568 brk(0x8068000) = 0x8068000 24568 socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) = 3 24568 fcntl64(3, F_GETFL) = 0x2 (flags O_RDWR) 24568 fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 24568 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 24568 fcntl64(3, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) 24568 fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 24568 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 24568 brk(0x8069000) = 0x8069000 24568 write(2, "io.c: Preparing fd 3 for reading"..., 33) = 33 24568 socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 4 24568 fcntl64(4, F_GETFL) = 0x2 (flags O_RDWR) 24568 fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 24568 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 24568 write(2, "io.c: listening on fd 4\n", 24) = 24 24568 listen(4, 256) = 0 24568 socket(PF_UNIX, SOCK_DGRAM, 0) = 5 24568 fcntl64(5, F_GETFL) = 0x2 (flags O_RDWR) 24568 fcntl64(5, F_SETFL, O_RDWR|O_NONBLOCK) = 0 24568 fcntl64(5, F_SETFD, FD_CLOEXEC) = 0 24568 write(2, "binding fd 5, unixaddr: /dev/log"..., 33) = 33 24568 stat64("/dev/log", {st_mode=S_IFSOCK|0666, st_size=0, ...}) = 0 24568 unlink("/dev/log") = 0 24568 bind(5, {sin_family=AF_UNIX, path="/dev/log"}, 11) = 0 24568 chown32(0x805fa60, 0, 0) = 0 24568 chmod("/dev/log", 0666) = 0 24568 fcntl64(5, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) 24568 fcntl64(5, F_SETFL, O_RDWR|O_NONBLOCK) = 0 24568 fcntl64(5, F_SETFD, FD_CLOEXEC) = 0 24568 write(2, "io.c: Preparing fd 5 for reading"..., 33) = 33 24568 socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) = 6 24568 fcntl64(6, F_GETFL) = 0x2 (flags O_RDWR) 24568 fcntl64(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0 24568 fcntl64(6, F_SETFD, FD_CLOEXEC) = 0 24568 write(2, "io.c: connecting using fd 6\n", 28) = 28 24568 gettimeofday({1034764213, 912762}, NULL) = 0 24568 getpid() = 24568 24568 open("/etc/resolv.conf", O_RDONLY) = 7 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=110, ...}) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40014000 24568 read(7, "domain westend.com\nsearch westen"..., 4096) = 110 24568 read(7, "", 4096) = 0 24568 close(7) = 0 24568 munmap(0x40014000, 4096) = 0 24568 socket(PF_UNIX, SOCK_STREAM, 0) = 7 24568 connect(7, {sin_family=AF_UNIX, path="/var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directo ry) 24568 close(7) = 0 24568 open("/etc/ld.so.cache", O_RDONLY) = 7 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=12877, ...}) = 0 24568 old_mmap(NULL, 12877, PROT_READ, MAP_PRIVATE, 7, 0) = 0x40014000 24568 close(7) = 0 24568 open("/lib/libnss_files.so.2", O_RDONLY) = 7 24568 read(7, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0@\35\0\000"..., 1024) = 1024 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=32668, ...}) = 0 24568 brk(0x806a000) = 0x806a000 24568 old_mmap(NULL, 36112, PROT_READ|PROT_EXEC, MAP_PRIVATE, 7, 0) = 0x40159000 24568 mprotect(0x40161000, 3344, PROT_NONE) = 0 24568 old_mmap(0x40161000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 7, 0x7000) = 0x40161000 24568 close(7) = 0 24568 munmap(0x40014000, 12877) = 0 24568 open("/etc/host.conf", O_RDONLY) = 7 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=26, ...}) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40014000 24568 read(7, "order hosts,bind\nmulti on\n", 4096) = 26 24568 read(7, "", 4096) = 0 24568 close(7) = 0 24568 munmap(0x40014000, 4096) = 0 24568 open("/etc/hosts", O_RDONLY) = 7 24568 fcntl64(7, F_GETFD) = 0 24568 fcntl64(7, F_SETFD, FD_CLOEXEC) = 0 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=269, ...}) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40014000 24568 read(7, "127.0.0.1\tlocalhost\n\n# The follo"..., 4096) = 269 24568 read(7, "", 4096) = 0 24568 close(7) = 0 24568 munmap(0x40014000, 4096) = 0 24568 open("/etc/ld.so.cache", O_RDONLY) = 7 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=12877, ...}) = 0 24568 old_mmap(NULL, 12877, PROT_READ, MAP_PRIVATE, 7, 0) = 0x40014000 24568 close(7) = 0 24568 open("/lib/libnss_dns.so.2", O_RDONLY) = 7 24568 read(7, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0`\r\0\000"..., 1024) = 1024 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=12176, ...}) = 0 24568 old_mmap(NULL, 15144, PROT_READ|PROT_EXEC, MAP_PRIVATE, 7, 0) = 0x4014a000 24568 mprotect(0x4014d000, 2856, PROT_NONE) = 0 24568 old_mmap(0x4014d000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 7, 0x2000) = 0x4014d000 24568 close(7) = 0 24568 open("/lib/libresolv.so.2", O_RDONLY) = 7 24568 read(7, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300\'\0"..., 1024) = 1024 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=56480, ...}) = 0 24568 old_mmap(NULL, 65312, PROT_READ|PROT_EXEC, MAP_PRIVATE, 7, 0) = 0x40162000 24568 mprotect(0x4016f000, 12064, PROT_NONE) = 0 24568 old_mmap(0x4016f000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 7, 0xd000) = 0x4016f000 24568 old_mmap(0x40170000, 7968, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x4017000 0 24568 close(7) = 0 24568 munmap(0x40014000, 12877) = 0 24568 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 7 24568 connect(7, {sin_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("212.117.68.10")}}, 28) = 0 24568 send(7, "\2158\1\0\0\1\0\0\0\0\0\0\4qdb2\7westend\3com\0\0\1"..., 34, 0) = 34 24568 gettimeofday({1034764213, 937072}, NULL) = 0 24568 poll([{fd=7, events=POLLIN, revents=POLLIN}], 1, 5000) = 1 24568 recvfrom(7, "\2158\201\200\0\1\0\1\0\2\0\2\4qdb2\7westend\3com\0\0\1"..., 1024, 0, {sin_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("212.117.68.10")}}, [16]) = 133 24568 close(7) = 0 24568 close(6) = 0 24568 write(2, "Error creating AF_INET socket (S"..., 40) = 40 24568 write(2, "Error initializing configuration"..., 43) = 43 24568 _exit(2) = ? -- Christian Hammers WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 ch(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Authorized Reseller

2 1

Configuration ?
by Jack Sasportas 16 Oct '02

16 Oct '02

I used a much older version of syslog-ng previously, but the newer version is a little different, so I just want to confirm a couple of things. 1. If I install the RPM under redhat 7.2 what do I need to do to basically insure that the old syslog isn't going to kick in etc. 2. I want to split any pop activity from maillog into poplog, so I configured what I thought would work, and it does most of the time, but there are times when I pop the server, and there is no long entry. Here is my entire config. Any help appreciated.... THANKS -------- Config File ---------- # This file should be compatible with the out-of-the-box # /etc/syslog.conf on Red Hat Linux # global options # options { use_dns(yes); use_fqdn(no); use_time_recvd(no); chain_hostnames(no); mark(0); sync(0); }; source s_local { internal(); unix-stream("/dev/log" keep-alive(yes) max-connections(10)); file("/proc/kmsg"); }; # facility filters # # Jack filter f_authpriv { facility(authpriv); }; filter f_authpriv { facility(authpriv) and not program("popper"); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; filter f_kern { facility(kern); }; # Jack filter f_mail { facility(mail); }; filter f_mail { facility(mail) and not program("popper"); }; filter f_messages { priority(info..emerg) and not facility(mail, news, authpriv, cron, local1, local2, local3, local4, local5, local6); }; # Jack filter f_news { facility(news); }; # priority filters # filter f_crit { priority(crit..emerg); }; filter f_crit_only { priority(crit); }; filter f_emerg { priority(emerg); }; filter f_err { priority(err..emerg); }; filter f_err_only { priority(err); }; filter f_info { priority(info..emerg); }; filter f_notice { priority(notice..emerg); }; filter f_warn { priority(warning..emerg); }; # Jack filter f_pop { program(popper); }; destination d_all { usertty("*"); }; destination d_boot { file("/var/log/bootlog"); }; destination d_console { file("/dev/console"); }; destination d_cron { file("/var/log/cron"); }; destination d_mail { file("/var/log/maillog"); }; destination d_messages { file("/var/log/messages"); }; # Jack destination d_news_crit { file("/var/log/news/news.crit"); }; destination d_news_err { file("/var/log/news/news.err"); }; destination d_news_notice { file("/var/log/news/news.notice"); }; destination d_secure { file("/var/log/secure"); }; destination d_spooler { file("/var/log/spooler"); }; # Jack destination d_pop { file("/var/log/poplog"); }; # Everybody gets emergency messages log { source(s_local); filter(f_emerg); destination(d_all); }; # Log anything (except mail) of level info or higher. # Don't log private authentication messages! log { source(s_local); filter(f_messages); destination(d_messages); }; # The authpriv file has restricted access. log { source(s_local); filter(f_authpriv); destination(d_secure); }; # Jack Log all the pop mail messages. log { source(s_local); filter(f_pop); destination(d_pop); }; # Log all the mail messages in one place. log { source(s_local); filter(f_mail); destination(d_mail); }; # Log cron stuff log { source(s_local); filter(f_cron); destination(d_cron); }; # Save boot messages also to boot.log log { source(s_local); filter(f_boot); destination(d_boot); }; # # INN # log { source(s_local); filter(f_news); filter(f_crit_only); destination(d_news_crit); }; log { source(s_local); filter(f_news); filter(f_err_only); destination(d_news_err); }; log { source(s_local); filter(f_news); filter(f_notice); destination(d_news_notice); }; -------- Config File ---------- Thanks Jack

1 0

Re: syslog-ng-1.5.21 on Solaris8
by Balazs Scheidler 15 Oct '02

15 Oct '02

On Tue, Oct 15, 2002 at 12:16:13PM +0200, Sean Boran wrote: > Hi, > > I'm a new comer to syslog-ng and wanted to try it out on Solaris. > I wish to use the 1.5 branch so I can perhaps divert to sql later.. > > Anyway, I run configure with no options and the make. > It compiles all modules but fails on linking: > > "gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o > syslog-ng main.o sources.o center.o filters.o destinations.o log.o > cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o > afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o > utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor > /usr/local/lib/libol.a -l > socket -lnsl -lxnet > Undefined first referenced > symbol in file > res_init main.o > yywrap cfg-lex.o > ld: fatal: Symbol referencing errors. No output written to syslog-ng > collect2: ld returned 1 exit status" > > - Then I though maybe I should install FLEX, so I installed flex-2.5.4a, > and redid the configure and make, the result is the same. > > - libol-0.3.3 compiled and installed just fine. > - I'm compiled on Solaris 8 sun4u, with pretty recent patches, if that > helps. > - I know litte about flex, so was unsure how to proceed with debugging.. > - I see one reference to res_init in main.c, but no explanation as what > is is or where it comes from.. > > Have you any tips for me? res_init can be solved by adding -lresolv to link flags. yywrap can be solved by linking against -lfl (part of flex) instead of simply -ll (part of lex as distributed with Solaris) res_init() seems to be platform dependant, so I added a configure test in 1.5.22 (which has been released, but not uploaded to our website) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

4 5

Fixed Solaris 5.7 x86 and thanks to Balázs Scheidler !!!!!
by Lancashire, Pete 15 Oct '02

15 Oct '02

My fault .. when I recreated the /dev/log sym link the shell's filename expansion got in the way. Thanks to Balázs Scheidler for the new Syslog !!!! -pete -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Monday, October 14, 2002 5:45 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Solaris 5.7 x86 Try this: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); }; regards, Drew -----Original Message----- From: Lancashire, Pete [mailto:PLancashire@columbia.com] Sent: Sunday, October 13, 2002 8:26 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Solaris 5.7 x86 Hi, What should the source local options be for Solaris 5.7 Intel ? source local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; Doesn't work for my system, I get the error message do_init_afstreams_source: Cannot open sun-stream /dev/log (Invalid argument) This is from a config file generated by the syslog2ng awk script. Thanks, -pete _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]logging with $HOST and no $HOST
by Hamilton, Andrew 15 Oct '02

15 Oct '02

You can always use the DEFAULT filter as your last log line. log { source(src); filter(DEFAULT); destination(junkfile); }; That will get all the logs any of your filters would miss. Regards, Drew -----Original Message----- From: JR Mayberry [mailto:mayberry0404@yahoo.com] Sent: Friday, October 11, 2002 1:56 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]logging with $HOST and no $HOST When I do an lsof on my syslog-ng server I will see entries like (i'm setup with : file(/log/$HOST/$MONTH-$DAY-$YEAR); ) "/log -- 13" (13 because its 1pm now) "/log -- 10-11-2002/13" So, I'm obviously losing logs, I need to know how I can fix this and get these logs (even if it's to a "dump all poorly malformed log packets to a single file" solution) syslog-ng 1.5.15 thanks. __________________________________________________ Do you Yahoo!? Faith Hill - Exclusive Performances, Videos & More http://faith.yahoo.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]Solaris 5.7 x86
by Hamilton, Andrew 15 Oct '02

15 Oct '02

Try this: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); }; regards, Drew -----Original Message----- From: Lancashire, Pete [mailto:PLancashire@columbia.com] Sent: Sunday, October 13, 2002 8:26 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Solaris 5.7 x86 Hi, What should the source local options be for Solaris 5.7 Intel ? source local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; Doesn't work for my system, I get the error message do_init_afstreams_source: Cannot open sun-stream /dev/log (Invalid argument) This is from a config file generated by the syslog2ng awk script. Thanks, -pete _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Solaris 5.7 x86
by Lancashire, Pete 14 Oct '02

14 Oct '02

Hi, What should the source local options be for Solaris 5.7 Intel ? source local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; Doesn't work for my system, I get the error message do_init_afstreams_source: Cannot open sun-stream /dev/log (Invalid argument) This is from a config file generated by the syslog2ng awk script. Thanks, -pete

1 0