- syslog-ng - lists.balabit.hu

syslog-ng 1.3.13 & libol 0.2.13 released
by Balazs Scheidler 17 Jan '00

17 Jan '00

Hi, I've released the latest development version of syslog-ng & libol. This release hopefully fixes some bugs, so if you had problems earlier, you should grab this release. I've also updated the documentation, though it's still not finished. http://www.balabit.hu/products/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

Re: [jkane@pobox.com: [syslog-ng] Solaris Streams support]
by Balazs Scheidler 13 Jan '00

13 Jan '00

On Thu, Jan 13, 2000 at 10:22:32AM -0700, John Arthur Kane wrote: > Hmm, the mailing list seems to be dead. > > Could you take a look at the message below. The 1.3.12 release solves > all of my problems in 1.3.5, EXCEPT now it cannot accept local syslog > entries on Solaris 2.6. > > Thanks it's not dead, I've been busy recently. STREAMS support is not gone, you should check out the config.log file. STREAMS support is enabled if you have sys/strlog.h and stropts.h, door support is added, if you have -ldoor available, and it contains a door_create() function. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Lost connections not reopened
by Andreas Zymny 13 Jan '00

13 Jan '00

I have the same problems as Gary Carroll on FreeBSD 3.x and 4.0-CURRENT with syslog-ng 1.3.12 and 1.2.8. I compiled an installed the latest stable from syslog-ng, while the 1.3.x doesn't run stable on my machines, but the 1.2.8 has the same problem. Lost connections are not automatically reopened, and all log entries are lost. Why are all log entries are lost? Is it possible to store all log entries in an file or an stream, so they can sent when the connection is reopened? Best regards, Andreas Zymny (Technik) [a.zymny(a)dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de

1 0

Solaris Streams support
by John Arthur Kane 11 Jan '00

11 Jan '00

[hmm, may be a duplicate, but I did not see it come through the list] Well, I have been gone for a month and I just grabbed 1.3.12 (upgrading from 1.3.5). However, when I try to run it, it complains: sun-streams support not compiled in (STREAM=/dev/log) Error initializing configuration, exiting. I can't find an option to turn on sun-streams, it appeared to be the default in 1.3.5. The lines in the conf file that cause this are: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; Thanks!

1 0

Solaris Streams support
by John Arthur Kane 11 Jan '00

11 Jan '00

Well, I have been gone for a month and I just grabbed 1.3.12 (upgrading from 1.3.5). However, when I try to run it, it complains: sun-streams support not compiled in (STREAM=/dev/log) Error initializing configuration, exiting. I can't find an option to turn on sun-streams, it appeared to be the default in 1.3.5. The lines in the conf file that cause this are: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; Thanks!

1 0

Error Message
by Andreas Zymny 10 Jan '00

10 Jan '00

This Error-Message I found in my syslog logfile: assertion "i < nfds" failed: file "io.c", line 172 There is an other problem in the "io.c" source. On my computer, the syslog-nd often dies with a message in the syslog logfile: Jan 6 11:09:10 syslog-ng[6929]: io.c: do_write: write() failed (errno 32), Broken pipe Jan 7 15:20:14 syslog-ng[11521]: io.c: do_write: write() failed (errno 32), Broken pipe Jan 7 16:46:57 syslog-ng[13775]: io.c: do_write: write() failed (errno 32), Broken pipe Jan 10 11:35:00 syslog-ng[19065]: io.c: do_write: write() failed (errno 32), Broken pipe Only an "kill -9" can kill the syslog-ng, and I can't reproduce this error. On both server (my machine an the log server) is FreeBSD installed (3.3 on my machine, 4.0 on the Server). Andreas Zymny (Technik) [a.zymny(a)dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de

1 0

Lost tcp connections not reopened
by Gary Carroll 06 Jan '00

06 Jan '00

Hi, this is a problem with syslog-ng.1.3.12 on Solaris.... System 1 forwards using tcp to System 2, both using syslog-ng. System 2 syslog-ng is hupped (kill -HUP `cat syslog-ng.pid`) and reinitializes as normal. System 1 loses tcp connection and writes internal message "Connection broken, reopening in 60 seconds". BUT the connection is not reopened and the forwarded data is lost until System 1 syslog-ng is hupped. Then everything is OK again. It would be really nice if the connection were reopened automatically. Thanks, Gary Carroll

1 0

Re: syslog-ng digest, Vol 1 #132 - 2 msgs
by Andreas Zymny 05 Jan '00

05 Jan '00

On Wed, 5 Jan 2000 syslog-ng-admin(a)venus.terrasoft.hu wrote: > When replying, please edit your Subject line so it is more specific than > "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Filter operator "not" does not work (Andreas Zymny) > 2. Re: Filter operator "not" does not work (Balazs Scheidler) > > --__--__-- > > Message: 1 > Date: Tue, 4 Jan 2000 17:56:59 +0000 (GMT) > From: Andreas Zymny <anzy(a)du.gtn.com> > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Filter operator "not" does not work > Reply-To: syslog-ng(a)lists.balabit.hu > > Hi, > > I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" > operator for the filters doesn't work in the 1.3.11 version. > > bash-2.03# /usr/sbin/syslogd > parse error at 13 > Parse error reading configuration file, exiting. > > Andreas Zymny (Technik) > [a.zymny(a)dpn.de] > -- > DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 > Bismarckstr. 120 fax: +49 203 3093 112 > D-47057 Duisburg http://www.dpn.de > > > --__--__-- > > Message: 2 > Date: Tue, 4 Jan 2000 18:10:52 +0100 > From: Balazs Scheidler <bazsi(a)balabit.hu> > To: syslog-ng(a)venus.terrasoft.hu > Subject: Re: [syslog-ng] Filter operator "not" does not work > Reply-To: syslog-ng(a)lists.balabit.hu > > On Tue, Jan 04, 2000 at 05:56:59PM +0000, Andreas Zymny wrote: > > Hi, > > > > I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" > > operator for the filters doesn't work in the 1.3.11 version. > > > > bash-2.03# /usr/sbin/syslogd > > parse error at 13 > > Parse error reading configuration file, exiting. > > Version 1.3.11 had a major problem in the parser, which I have fixed in the > just released 1.3.12. Please test this release too. I think, there is still a problem in the parser, while this line doesn't work: filter f_all { host("install1") not match("sshd"); }; When the "not" is exchanged with by "and" or "or", all works fine. Andreas Zymny (Technik) [a.zymny(a)dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de

2 1

Re: syslog-ng digest, Vol 1 #132 - 2 msgs
by Andreas Zymny 05 Jan '00

05 Jan '00

On Wed, 5 Jan 2000 syslog-ng-admin(a)venus.terrasoft.hu wrote: > When replying, please edit your Subject line so it is more specific than > "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Filter operator "not" does not work (Andreas Zymny) > 2. Re: Filter operator "not" does not work (Balazs Scheidler) > > --__--__-- > > Message: 1 > Date: Tue, 4 Jan 2000 17:56:59 +0000 (GMT) > From: Andreas Zymny <anzy(a)du.gtn.com> > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Filter operator "not" does not work > Reply-To: syslog-ng(a)lists.balabit.hu > > Hi, > > I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" > operator for the filters doesn't work in the 1.3.11 version. > > bash-2.03# /usr/sbin/syslogd > parse error at 13 > Parse error reading configuration file, exiting. > > Andreas Zymny (Technik) > [a.zymny(a)dpn.de] > -- > DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 > Bismarckstr. 120 fax: +49 203 3093 112 > D-47057 Duisburg http://www.dpn.de > > > --__--__-- > > Message: 2 > Date: Tue, 4 Jan 2000 18:10:52 +0100 > From: Balazs Scheidler <bazsi(a)balabit.hu> > To: syslog-ng(a)venus.terrasoft.hu > Subject: Re: [syslog-ng] Filter operator "not" does not work > Reply-To: syslog-ng(a)lists.balabit.hu > > On Tue, Jan 04, 2000 at 05:56:59PM +0000, Andreas Zymny wrote: > > Hi, > > > > I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" > > operator for the filters doesn't work in the 1.3.11 version. > > > > bash-2.03# /usr/sbin/syslogd > > parse error at 13 > > Parse error reading configuration file, exiting. > > Version 1.3.11 had a major problem in the parser, which I have fixed in the > just released 1.3.12. Please test this release too. Fine, I will get the new version, and test it. Yesterday, I send your syslog-ng a "kill -HUP" to initiate the reload of the configuration file (with the "not" operator). The syslog-ng doesn't shutdown the process, and doesn't told me, that there is an configuration error. He was still using the older - and correct - configuration file. Andreas Zymny (Technik) [a.zymny(a)dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de

1 0

Filter operator "not" does not work
by Andreas Zymny 04 Jan '00

04 Jan '00

Hi, I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" operator for the filters doesn't work in the 1.3.11 version. bash-2.03# /usr/sbin/syslogd parse error at 13 Parse error reading configuration file, exiting. Andreas Zymny (Technik) [a.zymny(a)dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de

2 1