- syslog-ng - lists.balabit.hu

can't log to remote host -- error message in syslog
by Adam Tworkowski 30 Jul '02

30 Jul '02

Hi, I've been having issues logging to a remote server on another segment. I have no issue with logging from machines that are on the same segment as the logging server. I am getting the following error in the error log. Can someone interpret this for me. Thanks. src@hostname syslog-ng[12920]: Error connecting to remote host IF_INET(loghost:514), reattempting in 60 seconds

2 1

RE: [syslog-ng]Installing on a non-compiler system
by Nicholas Berry 30 Jul '02

30 Jul '02

You could build syslog-ng in a Solaris pkg format, but I'm not sure how much of a problem you would have installing the package on your Solaris 2.6 system (might not have a problem if you're up-to-date with the recommended patch cluster). Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. nberry(a)ragingwire.com -----Original Message----- From: Lightfoot.Michael [mailto:Lightfoot.Michael@comcare.gov.au] Sent: Monday, July 29, 2002 8:02 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Installing on a non-compiler system I have built syslog-ng on a development server (Solaris 9) and now wish to install it on another system which doesn't have development tools (it is a fairly standard Solaris 9 installation.) I will also be installing a Solaris 2.6 build on systems in our DMZ which have been hardened and have very little other than the OS. The problem I have struck is that after copying the built source to the target server, "make install" fails with the following error: # make install Making install in src Making install in . make: Fatal error: Don't know how to make target `/usr/local/src/syslog-ng-1.4.15/configure.in' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Any ideas on how I get around this easily? NFS is one option, but will not be for the DMZ systems (and is not used in production on any systems here.) I suppose I could install it on the development server using a filesystem diff before and after trick I have used in the past, but again there are problems doing this with the Solaris 2.6 build (which has to be done on a production server as I don't have a Solaris 2.6 dev machine any more.) Michael Lightfoot Unix Consultant ISG Host Systems Comcare +61 2 62750680 NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Installing on a non-compiler system
by Lightfoot.Michael 30 Jul '02

30 Jul '02

I have built syslog-ng on a development server (Solaris 9) and now wish to install it on another system which doesn't have development tools (it is a fairly standard Solaris 9 installation.) I will also be installing a Solaris 2.6 build on systems in our DMZ which have been hardened and have very little other than the OS. The problem I have struck is that after copying the built source to the target server, "make install" fails with the following error: # make install Making install in src Making install in . make: Fatal error: Don't know how to make target `/usr/local/src/syslog-ng-1.4.15/configure.in' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Any ideas on how I get around this easily? NFS is one option, but will not be for the DMZ systems (and is not used in production on any systems here.) I suppose I could install it on the development server using a filesystem diff before and after trick I have used in the past, but again there are problems doing this with the Solaris 2.6 build (which has to be done on a production server as I don't have a Solaris 2.6 dev machine any more.) Michael Lightfoot Unix Consultant ISG Host Systems Comcare +61 2 62750680 NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries.

1 0

Re: [syslog-ng]Re: problem with truncated kernel logs
by Ron Braley 29 Jul '02

29 Jul '02

No, it's still a problem. rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 07/29/02 11:32AM >>> On Mon, Jul 29, 2002 at 09:48:30AM -0500, Ron Braley wrote: > Bazsi > > Sorry - I forgot to change the subject line! > > No, klogd isn't running in addition to syslog-ng. Just to be sure, I > checked processes, which did show klogd -2 and then shut down the > syslog-ng service. I then checked processes and saw klogd was no longer > running. > > Thanks in advance for your expert advise! hmm. I don't really understand whether your problem is solved, or not? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: problem with truncated kernel logs
by Ron Braley 29 Jul '02

29 Jul '02

Bazsi Sorry - I forgot to change the subject line! No, klogd isn't running in addition to syslog-ng. Just to be sure, I checked processes, which did show klogd -2 and then shut down the syslog-ng service. I then checked processes and saw klogd was no longer running. Thanks in advance for your expert advise! rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 07/29/02 03:03AM >>> On Fri, Jul 26, 2002 at 03:11:10PM -0500, Ron Braley wrote: > Hi bazi. > > We're having a problem with syslog-ng 1.5. It appears to be truncating > our iptables firewall logs. > > The following shows good logs as viewed through dmesg, and actual log > entries as processed by syslog-ng: > > *** Good (dmesg): > IPTABLES TCP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:08:00:20:a7:53:e9:08:00 > SRC=134.129.212.23 DST=134.129.212.30 LEN=48 TOS=0x00 PREC=0x00 TTL=64 > ID=64525 DF > PROTO=TCP SPT=36788 DPT=53 WINDOW=24820 RES=0x00 SYN URGP=0 > > IPTABLES UDP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 > SRC=134.129.214.80 DST=134.129.212.30 LEN=239 TOS=0x00 PREC=0x00 > TTL=127 ID=21813 > PROTO=UDP SPT=138 DPT=138 LEN=219 > > *** Bad (syslog [/var/log/kern]): > Jul 25 16:16:12 smack IPTABLES TCP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:a0:c9:a9:b2:6c:08:00 > SRC=134.129.212.33 DST=134.129.212.30 LEN=60 TOS=0x00 > PREC=0x03NDOW=5840 > > Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:05:01:fECP1389 > > Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:05:01:fb3::0 > SRC=134.12920.134 DST=134.129.212.0 LEN=78 TOS=0x00 > PREC=0xTTL=1272ROTO=UDP SPT=137 DPT=137N=58 Please start a new thread if you send something unrelated to current threads. wrt your problem, are you sure you are not running klogd in addition to syslog-ng? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] 1.5.19 patch for hostname and hpux pipe
by Ron Braley 29 Jul '02

29 Jul '02

Hi bazi. We're having a problem with syslog-ng 1.5. It appears to be truncating our iptables firewall logs. The following shows good logs as viewed through dmesg, and actual log entries as processed by syslog-ng: *** Good (dmesg): IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:08:00:20:a7:53:e9:08:00 SRC=134.129.212.23 DST=134.129.212.30 LEN=48 TOS=0x00 PREC=0x00 TTL=64 ID=64525 DF PROTO=TCP SPT=36788 DPT=53 WINDOW=24820 RES=0x00 SYN URGP=0 IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.80 DST=134.129.212.30 LEN=239 TOS=0x00 PREC=0x00 TTL=127 ID=21813 PROTO=UDP SPT=138 DPT=138 LEN=219 *** Bad (syslog [/var/log/kern]): Jul 25 16:16:12 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:a0:c9:a9:b2:6c:08:00 SRC=134.129.212.33 DST=134.129.212.30 LEN=60 TOS=0x00 PREC=0x03NDOW=5840 Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fECP1389 Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb3::0 SRC=134.12920.134 DST=134.129.212.0 LEN=78 TOS=0x00 PREC=0xTTL=1272ROTO=UDP SPT=137 DPT=137N=58 Can you help, please? Thanks! rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax)

2 1

1.5.19 patch for hostname and hpux pipe
by Trapp, Michael 26 Jul '02

26 Jul '02

hi bazsi, i still see some problems with pipe support on hpux and the pad_size option. the message ist shorter but there is at least 1, sometimes a few additional lines in the log containing useless characters appended to the origin message. a few day's ago i've send you a patch regarding hostname options (check_hostname) would you integrate it into 1.5.20 ? i would appreciate it to find this feature in a future release ... thanx michael

2 1

Probs with RH7.3 and syslog-ng 1.4.15
by Torsten Schuchort 25 Jul '02

25 Jul '02

Hi all, i´ve probs with syslog-ng 1.4.15 and redhat 7.3 90% works well, but the facility kern not, so i have no kernellogging. Have anyone an idea? Greetings Torsten Schuchort

4 4

Fwd: Syslog-ng doesn't parse certain log messages
by Michael Renner 25 Jul '02

25 Jul '02

>Date: Wed, 17 Jul 2002 15:52:32 +0200 >To: syslog-ng(a)lists.balabit.hu >From: Michael Renner <m.renner(a)inode.at> >Subject: Syslog-ng doesn't parse certain log messages > >Hi! > >It seems that our syslog-ng (1.5.18, upgraded from 1.5.14 today) stopped >logging messages from some routers. It seems to be a syslog-ng problem >because the routers don't have anything in common (except that all of them >are ciscos, but completely different hardware/ios versions). Just wanted to let you know that this was caused by UDP-Packets with wrong UDP Checksums, caused by a buggy IOS in one of the routers. "tcpdump -vvv -s0 -X" made this easily visible =) mfg/best regards -- Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at/ Michael Renner - Junior System Engineer m.renner(a)inode.at, Tel.: +43 59999 0 Fax.: +43 59999 6599 Buero Wien - Millennium Tower Handelskai 94-96/43 - A-1200 Wien Buero Graz - Schmiedlstrasse 1 - A-8042 Graz Buero Sbg - Schillerstrasse 30 - A-5020 Salzburg Buero Ibk - Eduard Bodem Gasse 5-7 - A-6020 Innsbruck

1 0

UNSTABLE syslog-ng 1.4.15 + redhat-7.3
by Cataldi Roger 25 Jul '02

25 Jul '02

After Core's dump problem I've got another with FREE-BSD 4.6, I'm still waiting for an helping hand ;). I tried to install syslog-ng 1.4.15 on a redhat-7.3 system but it's Unstable without CORE Dump File. The attachment is the debug's backtrace with installed packets and configuration files... Another question, the last, what is the most STABLE version of REDHAT or FreeBDS I'd use?? Thnks. _/CaT\_ PS: If I succeed in my syslog-server Mission when you'll come to Rome (Caput Mundi), I 'll offer you the real pizza with a real red wine to "ZOZZONE's" --- gcc version 2.96 20000731 (Red Hat Linux 7.3 2.96-110) flex version 2.5.4 (rpm flex-2.5.4a-23) bison (GNU Bison) 1.35 (rpm bison-1.35-1) yacc 1.9 (rpm byacc-1.9-19) scsh-0.6.2 libol-0.2.23 syslog-ng-1.4.15 --- GNU gdb Red Hat Linux (5.2-2) Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux"... (gdb) run -v Starting program: /usr/local/sbin/syslog-ng -v binding fd 5, inetaddr: 0.0.0.0, port: 514 Program received signal SIGTERM, Terminated. 0x420b4ae7 in pause () from /lib/i686/libc.so.6 (gdb) bt #0 0x420b4ae7 in pause () from /lib/i686/libc.so.6 #1 0x08049d0d in go_background () #2 0x08049e93 in main () #3 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6 ---- ########################################################################## options { long_hostnames(off); keep_hostname(no); sync(0); use_dns(no); log_fifo_size(1000); gc_idle_threshold(100); gc_busy_threshold(3000); }; ########################################################################## source src { internal(); udp(ip(0.0.0.0) port(514)); }; ########################################################################### ###Destination #Sorting degl'hosts # destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(mspns) perm(0644) dir_perm(0700) create_dirs(yes)); }; # destination all { file("/var/log/all.log" owner(root) group(mspns) perm(0644)); }; # destination send_trap_prova { program("/usr/local/script/syslogtrapper_test"); }; # ############################################################################ ####Filtering # filter f_prova { host ("10.11.5.37") and not match ("message repeated"); }; # ############################################################################ # ###Logging # log { source(src); destination(hosts); }; # log { source(src); destination(all); }; # log { source(src); filter(f_prova); destination(send_trap_prova); }; # ############################################################################ # # /usr/local/script/syslogtrapper_test # #!/bin/bash while read line do snmptrap -c xxxxxx! 10.11.8.14 .1.3.6.1.4.1.2620.1.1.0 10.11.5.48 6 2 '' .1.3.6.1.4.1.2620.1.1.6 s "prova invio trap V1: $line" done exit

1 0