- syslog-ng - lists.balabit.hu

Feature Request
by David Douthitt 06 Jun '01

06 Jun '01

Let me say first that this is a fantastic piece of software - I'm starting to implement it in our UNIX environment. It's almost TOO powerful :-) But that is a Good Thing. I don't THINK this is in the current sources, but anyway.... I'd like to have some serious debugging available in the logs ... for example, right now we get: syslog-ng[99]: Syntax error reading config file, using old configuration ...and this is all you know. To actually find out the error, you have to run syslog-ng from the command line. Then testing gets complicated as you attempt to restart the active syslog-ng while finding out what the syntax errors are by running it at the command line. Wouldn't be better to do the following: syslog-ng[99]: Syntax error in configuration file /etc/syslog-ng.conf at line 45 syslog-ng[99]: Retaining old configuration Also, messages like these would be nice for debugging purposes: syslog-ng[99]: Message from source(src) received: level auth.info syslog-ng[99]: Log #1: filter not matched syslog-ng[99]: Log #2: filter not matched syslog-ng[99]: Log #3: filter not matched syslog-ng[99]: Log #4: filter f_authonly matched syslog-ng[99]: Log #4: log used syslog-ng[99]: Log #5: filter not matched syslog-ng[99]: Log #6: source not matched ...and so on. It would even be nice to be able to send a SIGINT or a SIGUSR1 or a SIGUSR2 to the running syslog to manipulate the debugging messages similar to BIND.

1 0

Problems with "nscache.c" on Solaris 7
by Stefano Pasquale 06 Jun '01

06 Jun '01

Hi, I tried to compile syslog-ng. I downloaded libol-0.2.22, configured, compiled, made and made-install, and then I downloaded syslog-ng-1.5.6, configured and compiled. An error occurred with "nscache.c". I used gcc 2.8.1: sp87286@shine->/tmp/syslog-ng-1.5.6 > gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.7/2.8.1/specs gcc version 2.8.1 Beware I didn't modify anything in any config/Make-files May someone help me? Thanks Here is the relevant output of what I did. root@shine:/ # cd /tmp/libol-0.2.22 root@shine:/tmp/libol-0.2.22 # make install Making install in utils /bin/sh /tmp/libol-0.2.22/mkinstalldirs /usr/local/bin .././install-sh -c make_class /usr/local/bin/make_class Making install in src /bin/sh /tmp/libol-0.2.22/mkinstalldirs /usr/local/lib /bin/sh ../libtool --mode=install .././install-sh -c libol.la /usr/local/lib/libol.la .././install-sh -c .libs/libol.so.0.0.0 /usr/local/lib/libol.so.0.0.0 (cd /usr/local/lib && rm -f libol.so.0 && ln -s libol.so.0.0.0 libol.so.0) (cd /usr/local/lib && rm -f libol.so && ln -s libol.so.0.0.0 libol.so) chmod +x /usr/local/lib/libol.so.0.0.0 .././install-sh -c .libs/libol.lai /usr/local/lib/libol.la .././install-sh -c .libs/libol.a /usr/local/lib/libol.a ranlib /usr/local/lib/libol.a chmod 644 /usr/local/lib/libol.a ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `LD_LIBRARY_PATH' environment variable during execution - use the `-RLIBDIR' linker flag See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- /bin/sh /tmp/libol-0.2.22/mkinstalldirs /usr/local/include/libol mkdir /usr/local/include/libol .././install-sh -c -m 644 abstract_io.h /usr/local/include/libol/abstract_io.h .././install-sh -c -m 644 alist.h /usr/local/include/libol/alist.h .././install-sh -c -m 644 format.h /usr/local/include/libol/format.h .././install-sh -c -m 644 gc.h /usr/local/include/libol/gc.h .././install-sh -c -m 644 io.h /usr/local/include/libol/io.h .././install-sh -c -m 644 jpoll.h /usr/local/include/libol/jpoll.h .././install-sh -c -m 644 list.h /usr/local/include/libol/list.h .././install-sh -c -m 644 objbase.h /usr/local/include/libol/objbase.h .././install-sh -c -m 644 objects.h /usr/local/include/libol/objects.h .././install-sh -c -m 644 objtypes.h /usr/local/include/libol/objtypes.h .././install-sh -c -m 644 pkt_buffer.h /usr/local/include/libol/pkt_buffer.h .././install-sh -c -m 644 queue.h /usr/local/include/libol/queue.h .././install-sh -c -m 644 read_line.h /usr/local/include/libol/read_line.h .././install-sh -c -m 644 resource.h /usr/local/include/libol/resource.h .././install-sh -c -m 644 stream_buffer.h /usr/local/include/libol/stream_buffer.h .././install-sh -c -m 644 werror.h /usr/local/include/libol/werror.h .././install-sh -c -m 644 xalloc.h /usr/local/include/libol/xalloc.h .././install-sh -c -m 644 command.h /usr/local/include/libol/command.h .././install-sh -c -m 644 io_commands.h /usr/local/include/libol/io_commands.h .././install-sh -c -m 644 abstract_io.h.x /usr/local/include/libol/abstract_io.h.x .././install-sh -c -m 644 alist.h.x /usr/local/include/libol/alist.h.x .././install-sh -c -m 644 io.h.x /usr/local/include/libol/io.h.x .././install-sh -c -m 644 list.h.x /usr/local/include/libol/list.h.x .././install-sh -c -m 644 read_line.h.x /usr/local/include/libol/read_line.h.x .././install-sh -c -m 644 resource.h.x /usr/local/include/libol/resource.h.x .././install-sh -c -m 644 io_commands.h.x /usr/local/include/libol/io_commands.h.x .././install-sh -c -m 644 command.h.x /usr/local/include/libol/command.h.x .././install-sh -c -m 644 queue.h.x /usr/local/include/libol/queue.h.x .././install-sh -c -m 644 olconfig.h /usr/local/include/libol/olconfig.h /bin/sh /tmp/libol-0.2.22/mkinstalldirs /usr/local/bin ./install-sh -c libol-config /usr/local/bin/libol-config root@shine:/tmp/libol-0.2.22 # root@shine:/tmp/libol-0.2.22 # root@shine:/tmp/libol-0.2.22 # sp87286@shine->/tmp/syslog-ng-1.5.6 > echo $LD_LIBRARY_PATH /usr/dt/lib:/usr/local/lib:/usr/dt/lib:/usr/local/lib: sp87286@shine->/tmp/syslog-ng-1.5.6 > ./configure loading cache ./config.cache checking for a BSD compatible install... ./install-sh -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... (cached) yes checking for working aclocal... missing checking for working autoconf... missing checking for working automake... missing checking for working autoheader... missing checking for working makeinfo... missing checking whether build environment is sane... yes checking for gcc... (cached) gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ANSI C... (cached) none needed checking for bison... (cached) bison -y checking how to run the C preprocessor... (cached) gcc -E checking for flex... (cached) flex checking for flex... (cached) flex checking for yywrap in -lfl... (cached) yes checking lex output file root... (cached) lex.yy checking whether yytext is a pointer... (cached) yes checking whether make sets ${MAKE}... (cached) yes checking for ANSI C header files... (cached) yes checking for malloc.h... (cached) yes checking for unistd.h... (cached) yes checking for door.h... (cached) yes checking for stropts.h... (cached) yes checking for sys/strlog.h... (cached) yes checking for stdarg.h... (cached) yes checking for sys/klog.h... (cached) no checking for working const... (cached) yes checking whether time.h and sys/time.h may both be included... (cached) yes checking for modern utmp... (cached) yes checking whether to compile klogctl... no checking size of short... (cached) 2 checking size of int... (cached) 4 checking size of long... (cached) 4 checking for I_CONSLOG... (cached) yes checking for working alloca.h... (cached) yes checking for alloca... (cached) yes checking for vprintf... (cached) yes checking for door_create in -ldoor... (cached) yes checking for select... (cached) yes checking for snprintf... (cached) yes checking for vsnprintf... (cached) yes checking for strerror... (cached) yes checking for inet_aton... (cached) no checking for strncpy... (cached) yes checking for getutent... (cached) yes checking for getopt_long... (cached) no checking for strcasecmp... (cached) yes checking for strptime... (cached) yes checking for pthread.h... (cached) yes checking for pthread_create in -lpthread... (cached) yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking libol version >= 0.2.22... ok creating ./config.status creating Makefile creating src/Makefile creating src/tests/Makefile creating doc/Makefile creating doc/sgml/Makefile creating contrib/Makefile creating utils/Makefile creating syslog-ng.spec creating src/config.h src/config.h is unchanged sp87286@shine->/tmp/syslog-ng-1.5.6 > sp87286@shine->/tmp/syslog-ng-1.5.6 > make Making all in src make all-recursive Making all in . gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.5.6/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c nscache.c nscache.c: In function `nscache_new': nscache.c:112: `INADDR_NONE' undeclared (first use in this function) nscache.c:112: (Each undeclared identifier is reported only once nscache.c:112: for each function it appears in.) *** Error code 1 make: Fatal error: Command failed for target `nscache.o' Current working directory /tmp/syslog-ng-1.5.6/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /tmp/syslog-ng-1.5.6/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /tmp/syslog-ng-1.5.6/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' sp87286@shine->/tmp/syslog-ng-1.5.6 > -- Stefano Pasquale

2 1

Filtering "syslog-ng daemon" logs
by Eric Parusel 05 Jun '01

05 Jun '01

Hi, I'd like to filter out the syslog-ng logs that I get in my /var/log/messages file. Can I use a command-line flag to turn off these logs?: Jun 4 10:20:00 ldap1 syslog-ng[84369]: io.c: do_write: write() failed (errno 32), Broken pipe Jun 4 10:20:00 ldap1 syslog-ng[84369]: Connection broken, reopening in 60 seconds Jun 4 10:21:00 syslog1 syslog-ng[274]: AF_INET client connected from 127.0.0.1, port 1046 If not, can will the following filter work? filter f_nosyslog-ng { program("syslog-ng") and ( match("io\.c\:") or match("Connection\ broken\,\ reopening") or match("SIGHUP") or match("AF_INET_client") ); }; Did I use the brackets correctly? filter foo { program() and (match() or match() ); }; I'm no expert with regular expressions or syslog-ng filters, so bear with me :) As well, I'm using a tcp connection over stunnel, I would assume that it is normal to receive these messages occasionally? Thanks, Eric Parusel Systems Administrator Global Relay Communications

2 1

AIX and repeated message formats - fix?
by Jon Marks 04 Jun '01

04 Jun '01

Earlier I posted a message asking about whether syslog-ng had standard equipment for dealing with a couple of strange message types: 1) Messages forwarded by AIX syslogd which contain the string "Message forwarded from [hostname]: " ... and 2) Messages of the form: "last message repeated _n times" I haven't received any responses. I've read traffic in the mailing list archives (e.g. December 2000) regarding the topic, but I haven't found any solutions. If I've missed something vital, please help me and let me know about it.. I certainly apologize if I haven't been observant enough to skim the answers from the available resources. I've taken a stab at solving the problem myself, and I thought I'd share it with all of you. Those of you who are so much more familiar with the source than I, please comment about whether you find I might have broken other functionality or adversely affected performance. I'm glad for you suggestions, or if this can help somebody else. For my installation, being able to handle AIX messages is particularly important. My solution is just a simple and straightforward refactoring in log.c/parse_log_msg(). A patch against the 1.4.11 source distribution is attached to this message. I've tested it only on AIX, but I think it ought to work elsewhere since it only adds standard library stuff. (Basically, a couple of memcmp's). Some commented-out debugging output (to stderr) is there, too, if you'd want to enable it. I'll describe the intended effects of this patch: 1) Messages forwarded by AIX systems are recognized, and the source hostname is taken from the string appended by AIX syslogd. For example, MMM DD HH:MM:SS Message forwarded from <hostname>: ... will use <hostname> for the source address. "Message" isn't taken as the source host. 2) If the message is forwarded by AIX syslogd but originally of syslog-ng origin, it'll have the form MMM DD HH:MM:SS Message forwarded from <hostname>: source@hostname ... In this case, "source@hostname" will be used as the source hostname (so that syslog-ng's source info is preserved). 3) If the message doesn't contain a hostname because it's of the form MMM DD HH:MM:SS last message repeated *n* times then it won't try to extract one (so it won't improperly use 'last'). The hostname will just come later when in sources.c it's gotten from the message source socket or wherever. 4) If the message is a "last message repeated ..." which was *also* forwarded by an AIX syslogd, it'll get the hostname extracted from AIX's "Message forwarded from ..." message. I'm no expert in the syslog protocol/format, and I can see there is variablilty in implementation. So I'm certain there are plenty of cases that are left unaddressed. If you don't find this patch helpful in general, perhaps its useful for some common cases. One thing that's not addressed: When a "last message repeated ..." line is received, it's certainly helpful to know *which* was the last line-- the one that got repeated. If you're outputting to files by PROGRAM, then no program name is inherently available from this kind of message itself. And syslog-ng isn't keeping track of what PROGRAM logged last from a particular source host. So these "last message repeated ..." messages won't fall into the same logs as the lines for the PROGRAMs which produced the repeated messages. No simple solution is readily apparent to me... Also, please note that "keep_hostname(yes)" is important, otherwise the AIX sender of forwarded messages is used anyway-- despite that the real origin is available. If you use chain_hostnames(yes), then this info ought to be preserved anyway. Again, please comment and critique! Thanks very much. -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign

3 5

Log paths that DON'T stop matching....
by David Douthitt 04 Jun '01

04 Jun '01

It's hard to explain what I want, but here I'll try. A normal log path is thus: log { source(...); filter(...); destination(...); }; ...and when a match occurs (source and filter) then the message is sent to the destination and matching stops. To do what I'd like, with what I've seen so far, is to do something like this: log { source(a); filter(f_ba); destination(c); destination(d); }; log { source(a); filter(f_bb); destination(c); destination(e); }; log { source(a); filter(f_bc); destination(c); destination(f); }; log { source(a); filter(f_bd); destination(c); destination(g); }; log { source(a); filter(f_other); destination(c); }; What I'd like would be something closer to this - taking "passthru" to be an option to NOT stop filtering: log { source(a); filter(f_ba); destination(d); passthru; }; log { source(a); filter(f_bb); destination(e); passthru; }; log { source(a); filter(f_bc); destination(f); passthru; }; log { source(a); filter(f_bd); destination(g); passthru; }; log { source(a); filter(f_other); destination(c); }; This would be very much useful in situations like: log { source(internal); filter(f_crit); destination(pager); } log { source(internal); filter(DEFAULT); destination(mesg); } Or other similar...

2 2

Irix Support?
by Sean Brannon 02 Jun '01

02 Jun '01

I've grep'd thru the last 1.5 years of this mailing list and not come up with a definitive answer so I have to ask: Does syslog-ng compile and function properly on Irix 6.5.x? TIA....

1 0

syslog server for more 8 devices
by colette tostivint 01 Jun '01

01 Jun '01

Hi everybody, I setup a syslog server in order to monitoring routeurs and firewalls. I use this command : logging facility local0 ..................... logging facility local7 so I can only 8 devices and each device sends syslog messages to the same log file on my server. Only EIGHT devices? Thanks Colette

2 1

Re:
by colette tostivint 01 Jun '01

01 Jun '01

confirm 966360

1 0

Question
by colette tostivint 31 May '01

31 May '01

Hi How do you configure syslog-ng.conf for each device sends syslog messages to the different log file on my syslog server and it works like a old syslog.conf. Give me an example of configuration. Thanks Colette

1 0

Running Syslog-ng chrooted
by Kaladis 31 May '01

31 May '01

Dear Mailinglistpeoples, First of all I'd appreciate it if you could cc all replies to kaladis(a)gmx.de since I'm not a member of this mailing list. I am trying to run syslog-ng chrooted - to be accurate, from /usr/jail/syslog. I created /usr/sbin/syslog-ng, created all directories and so on, copied the needed libraries etc. Syslog-ng is starting quite fine within that chrooted environment as user syslog group syslog. However it is not logging anything. I guess that it must have to do with /dev/log since that isn't accesiable out of that environment anymore. Now I'm asking myself how I could have /dev/log under /usr/jail/syslog/dev/log or what else the problem could be. Thanks for your help - Kaladis --- www.maganation.com/~kaladix - Kaladix Linux - Your Secure Linux Choice

6 6