- syslog-ng - lists.balabit.hu

unable to use tcp/udp forward.
by User Un 17 Feb '00

17 Feb '00

Hello, I am evaluating syslog-ng as we want TCP ( reliable) syslog message, however, I am unable to comply due to strange "syntax error": destination all { # file( "/tmp/messages"); # ok # tcp( ip( 172.16.32.35) port( 1999)); # nok # udp( ip( 172.16.32.35) port( 514)); # nok udp( 172.16.32.35,514); # nok # usertty( un); # ok # program( "cat >/tmp/messges_cat"); # ok }; all "nok" failed with error like: /net/ts/opt/syslog-ng-1.3.14/sbin/syslog-ng -f /net/ts/opt/syslog-ng-1.3.14/etc/syslog-ng.conf -d -v parse error at 33 Parse error reading configuration file, exiting. I tryed with version 1.3.14 & 1.2.3. Thanks for any help. S.R.

3 2

Syslog stop fordward
by Victor Barahona 17 Feb '00

17 Feb '00

-----BEGIN PGP SIGNED MESSAGE----- Hi I loging a web server to a log-machine so I put the next configuration in the web server: ---------------- options { sync(0); time_reopen(10); log_fifo_size(100); }; source local { sun-stream("/dev/log" door("/etc/.syslog_door")); }; source syslog { internal(); }; source rincon { file("/www/logs/rincon-access.log"); }; destination brezo { tcp("150.244.9.2" port(514)); }; log { source(rincon); destination(brezo); }; ----------------------------------------------- The log-server has this config-file: ----------------------------------------------- options { sync(10); time_reopen(10); log_fifo_size(100); }; source local { internal(); }; source red { tcp(); }; destination rincon { file("/var/log/filer/rincon-access.log"); }; filter rincon { host(limonero) and match(HTTP/1); }; log { source(red); destination(rincon); }; ------------------------------------------------------ When I run with this configuration, te log-server stops to write lines in the file when fifo size is full (I think) so I increase the fifo size to 1000 first and to 150000 later. The destination file grown but seems no be sort by date as the source and finally stops the write lines (but the daemon is OK). Two things: 1)Everytime I run the syslog-ng in the web server, process all the file, instead only the appending lines. Who can I chage this? 2)Why the daemon stops writting in the log-server's file? It's a problem with big files? The origin file is about 8Mb and it grow to 11Mb due the header of the syslog-ng. There is some limit? Thanks -- "Making predictions is difficult, particularly about the future" Niels Bohr ------------------------------------------------------------------------ Victor Barahona..........................http://www.sdi.uam.es/~barahona Soporte Seguridad en red.................http://www.sdi.uam.es/utc/ss Unidad Tecnica de Comunicaciones Universidad Autonoma de Madrid Tlf.- 91 397 5525 PGP ID-0x8750AB79 ------------------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use MessageID: DwGwcnUdWLU9WfN4xS9DVnhJ0deLgA1M iQA/AwUBOKrOekoW8ByHUKt5EQICpgCfWBkBFnAR+/iGjZSTBX8vFqdBBRkAoIpq A9+ShW9YEy1RbygI+P8Yzfyb =6Ii6 -----END PGP SIGNATURE-----

2 1

use_fqdn()
by Graham Thomas 17 Feb '00

17 Feb '00

hi, Just putting together a config file for syslog-ng-1.2.3 on solaris and it doesn't appear to like the line: options { use_fqdn(yes); }; I've tried different options and all numerical ones are excepted ok. Options with accepted values described as 'yes' or 'no' in the documentation cause the deamon to fail on start-up. Have I got the syntax wrong? Do I need a newer version to enable this feature? If so, Is there a different option that will give me the full domain name in this version? thanks, graham

2 1

Syslog-ng fails with more than one program destination
by George Madden 15 Feb '00

15 Feb '00

I was testing with 1.3.13 and found it fails with a kill -HUP when more than one "program" destination is used. Syslog-ng never restarts and starts using all the cpu. I tested this on both Redhat 6.1 and FreeBSD 3.3. When I remove all but one program destination, it works fine. It also works fine under syslog-ng 1.2.3. I assume I can have more than one program destination but maybe not. Here is the debug output. It never closes the fd and the cpu goes to about 97% binding fd 3, inetaddr: 0.0.0.0, port: 514 io.c: Preparing fd 3 for reading io.c: listening on fd 4 io.c: Preparing fd 6 for writing io.c: Preparing fd 7 for writing io.c: Preparing fd 8 for writing syslog-ng version 1.3.13 starting io.c: Preparing fd 5 for writing Garbage collecting while idle... Objects alive: 68, garbage collected: 4 Garbage collecting while idle... Objects alive: 68, garbage collected: 14 Garbage collecting while idle... Objects alive: 68, garbage collected: 28 Garbage collecting while idle... Objects alive: 68, garbage collected: 37 SIGHUP received, restarting syslog-ng Marking fd 3 for closing. Marking fd 5 for closing. Marking fd 8 for closing. Here are the files from the Redhat system: syslog-ng.conf ## options { long_hostnames(off); sync(0); log_fifo_size(10); }; source src { unix-stream("/dev/log"); internal(); }; source net { udp(); }; # destination all { file ("/var/log/all" sync(0)); }; destination net { file ("/var/log/net" sync(100)); }; # destination authenfail {program ("/etc/scripts/authenfail.sh"); }; destination authendeny {program ("/etc/scripts/authendeny.sh"); }; destination poolmess {program ("/etc/scripts/poolmess.sh"); }; # filter f_authen { match ("PIX-6-10900"); }; filter f_authenfail { match ("PIX-6-109006"); }; filter f_authendeny { match ("PIX-6-109009"); }; filter f_poolfail { match ("laddr 10.10.01.254"); }; # log { source(src); destination(all); }; log { source(net); destination(net); }; # log { source(net); filter(f_authenfail); destination(authenfail); }; log { source(net); filter(f_authendeny); destination(authendeny); }; log { source(net); filter(f_poolfail); destination(poolmess); }; Here are the scripts: authendeny.sh #!/bin/sh while read LINE; do echo $LINE | mail -s "Athentication Denied" root done authenfail.sh #!/bin/sh while read LINE; do # use awk to get the second field with a ' as a delimiter NAME=`echo $LINE | awk -F\' '{print $2}'` echo $NAME echo $LINE | mail -s "Athentication Failed for $NAME" root done poolmess.sh #!/bin/sh while read LINE; do echo $LINE | mail -s "Possible pool overload" pixadmin done

2 6

syslog-ng 1.3.15 and libol 0.2.14
by Balazs Scheidler 13 Feb '00

13 Feb '00

I've released syslog-ng 1.3.15 with libol 0.2.14. News for the 1.3.15 release Added the possibility to create directories on the fly. You'll need to enable the create_dirs() option. Added a -V flag to display version number. Updated documentation, destination file() driver now fully documented. Fixed a few bugs. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

RE: [syslog-ng] syslog-ng 1.3.14
by Lowkrantz, Goran 06 Feb '00

06 Feb '00

Hi, FreeBSD 3.4-STABLE: libol-0.2.13/src/io.c:24->src/io.h:27->src/abstract_io.h:31 - sys/socket.h need sys/types.h for some typedefs. Cheers, GLZ -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, February 04, 2000 8:38 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng 1.3.14 I've released $subject with some bugfixes. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

syslog-ng 1.3.14
by Balazs Scheidler 04 Feb '00

04 Feb '00

I've released $subject with some bugfixes. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

problems after upgrading to v.2.3 linux kernel
by Brian Johnson 03 Feb '00

03 Feb '00

I've been running syslog-ng on linux 2.2.14 for awhile, and it's been working fine, I just upgraded to 2.3.40 and not syslog-ng dies shortly after starting. I'm running syslog-ng 1.3.13 (I was running 1.3.12 and that had the same problem). when I run syslog-ng -d -v I get this: io.c: listening on fd 3 io.c: Preparing fd 4 for reading syslog-ng version 1.3.13 starting io.c: Preparing fd 5 for writing io.c: Preparing fd 6 for writing io.c: Preparing fd 7 for writing Garbage collecting while idle... Objects alive: 126, garbage collected: 0 io.c: Preparing fd 8 for reading io.c: sockaddr2info(): Unsupported address family 18154. Aborted in my syslog-ng.conf file I have: options { long_hostnames(on); sync(0); }; source src { unix-stream("/dev/log"); file("/proc/kmsg"); internal(); }; and my destinations are all just various normal files... is this a bug, or something I'm doing wrong? this exact configuration did work fine with the linux 2.2.14 kernel...

2 1

Solaris and Syslog-ng
by Victor Barahona 02 Feb '00

02 Feb '00

-----BEGIN PGP SIGNED MESSAGE----- Hi After read the hole archive from 1999-february to nowadays (big job) I have no clear if the stable brunch have or not Solaris support. Let's go with the problem. I'm using sparc-solaris7 and syslog-ng 1.2.3 When I run syslog-ng I have: bash-2.02# syslog-ng parse error at 11 Parse error reading configuration file, exiting. The 11 line refers to the source line. Here is my config file: # options { sync(0); time_reopen(10); log_fifo_size(100); }; source local { sun-door("/etc/.syslog_door"); internal(); }; #################### Destinos de brezo: destination piolin { tcp("piolin" port(514)); }; destination todo { file("/var/adm/toto"); }; #################### Filtros filter xferlog { match(xferlog); }; #######################Logs locales log { source(local); filter(xferlog); destination(piolin); }; log { source(local); destination(todo); }; ------------------------- Something is wrong with doors in this case. Any ideas? -- ------------------------------------------------------------------------ Victor Barahona..........................http://www.sdi.uam.es/~barahona Soporte Seguridad en red.................http://www.sdi.uam.es/utc/ss Unidad Tecnica de Comunicaciones Universidad Autonoma de Madrid Spain Tlf.- 91 397 5525 PGP ID-0x8750AB79 ------------------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use MessageID: uAR2CWNoCZXvbiqWdA6lZ5yPp19i6bZt iQA/AwUBOJgl50oW8ByHUKt5EQIBFgCfWjgP6h3chD2FYrgyA7uOSrnSbFkAoL7Y b92Xc6mnnxyFGSFwCxkAc7LP =rdre -----END PGP SIGNATURE-----

3 4

syslog-ng 1.3.13 doesn't compile on alpha systems
by Arnaud Launay 02 Feb '00

02 Feb '00

Hi, Compiling 1.3.13 on alpha fails there: gcc -DHAVE_CONFIG_H -I. -I/usr/src/syslog-ng-1.3.13/src -I. -O2 -Wall -I/usr/include/libol -D_GNU_SOURCE -c affile.c affile.c: In function `expand_macro': affile.c:332: warning: cast to pointer from integer of different size affile.c:345: warning: cast to pointer from integer of different size affile.c:363: warning: cast to pointer from integer of different size affile.c: In function `expand_macros': affile.c:444: conversion to non-scalar type requested affile.c:446: conversion to non-scalar type requested make[1]: *** [affile.o] Error 1 make[1]: Leaving directory `/usr/src/syslog-ng-1.3.13/src' make: *** [all-recursive] Error 1 Seems to me like 64-bits pb. -- Arnaud Launay - Directeur technique EdenJob Tél: 01 41 92 91 50 Email: launay(a)edenjob.com Visitez notre site emploi: http://www.apr-job.com Fax: 01 41 92 91 54

2 1