- syslog-ng - lists.balabit.hu

cvs tree
by Balazs Scheidler 09 Jun '99

09 Jun '99

Hi, I could not deal with a solaris bug I encountered, so I don't release any snapshots now. What I have done since last release, and what's available in cvs: 1999-06-08 Balazs Scheidler <bazsi(a)balabit.hu> * named pipes work now with the file driver (I may introduce a pipe driver later on, which could be an alias for "file") * fixed a bug in log_handler.destroy handling * changed -HUP handling, it reverts to the old config if the new cannot be initialized * changed afsocket_dest_reopen to be a general callback, capable of reinitializing any log_handler (and moved to destinations.c) * debian control file fixes (reported by Peter Gervai, grin(a)tolna.net) * internal source driver checks if used once * fixed a bug in syslog-ng.h, which used the config file in cwd even if debugging was turned off 1999-06-06 Balazs Scheidler <bazsi(a)balabit.hu> * added reference documentation to doc/syslog-ng.html * changed the parser, so IDENTIFIER's can always be quoted using quotation marks (") There have been some bugfixes, and the documentation was added to the tree. I have a quite major problem on solaris. As it seems the way syslog-ng exits the parent process when backgrounding itself conflicts with solaris thread libraries. The parent process waits until the configuration is initialized, so no log messages sent directly after syslog-ng backgrounds itself is not lost. This is accomplished via the TERM signal: parent: wait until term signal arrives child: initialize config send SIGTERM to parent The parent exits without problems, but the child gets a SIGABRT for some unknown reason. If I use the -d switch, which prevents syslog-ng to background itself, everything works fine. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

2 2

Re: syslog-ng 1.2.22 runtime problems
by Balazs Scheidler 09 Jun '99

09 Jun '99

Hi, cc-ing to the syslog-ng list. > Thank you for implementing compatibility with syslog_door. I've installed > syslog-ng files in /usr/local, but I have some problems with a few things. > > uname -a: > > SunOS logserver 5.7 Generic sun4m sparc SUNW,SPARCstation-5 > > I start /usr/local/bin/syslog-ng manually. When I do so I get this error > message: > > ld.so.1: /usr/local/bin/syslog-ng: fatal: libol.so.0: open failed: No such > file or directory > Killed > > I can get around this (sloppy) by: > > env LD_LIBRARY_PATH=/lib:/usr/lib:/usr/local/lib /usr/local/bin/syslog-ng Yes, you have to either add the /usr/local/lib directory to your /etc/ld.so.conf (at least this is the file under Linux), or set the above environment variable. > > Then an error with parsing the configuration file occurs. I removed the > > options { sync(10) }; > > line, and then syslog-ng executes without an error. That's strange. sync options _should_ work, and work on my box without problems. The file shipped with syslog-ng 1.1.22 is the same I test syslog-ng with. To check what might be wrong, please ./configure syslog-ng with the --with-debug switch, and send me the output of syslog-ng -y, which will display yacc debug output. > > However, it doesn't seem to be doing anything. > > I do a 'truss' (like strace) to see what it's doing, and it is sleeping. > It doesn't background itself like normal syslogd does. When I stop the > process (control-C) it core dumps... This may happen when configuration initialization blocks somewhere. syslog-ng first reads and parses configuration, if this is successful, tries to initialize it, and if this is successful too, it backgrounds itself. It most probably blocked in the initialization phase. The truss output should help. > > Now, from reading your web site I understand that "libol-config" is > important in running syslog-ng, but I cannot find out how to use it. libol-config is just a small script which makes it easy for syslog-ng to find libol header files and libraries. It is only meant for development (e.g. programs using libol) > > Perhaps you could begin a document on your web site which explains how to > get the daemon running. I have a minimal configuration file which is from > the src/ directory in your 1.2.22 distribution. It looks like this: > > options { sync(10); }; > source src { udp 0.0.0.0,1999; sun-door /etc/.syslog-door; internal; }; > destination everything { file /dev/tty10 sync(2); usertty root; }; > log { source src; destination everything; }; > > Unchanged, this configuration file is not parsed correctly by syslog-ng. I > deleted the first line and removed sync(2) from 'destination everything' > and that did not work, either. Then I deleted 'source src' altogether and > syslog-ng went into sleep mode. > > I do not know what I am supposed to be doing :) Can you help? First of all I think /dev/tty10 does not exist under Solaris. Under linux this means the 10th virtual terminal on the console. I don't have any other idea, so please send me the truss output, and the yacc debug messages I mentioned earlier. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

3 4

Experiences and question from a newbie
by Stefan Seufert 08 Jun '99

08 Jun '99

Hi, today i had some free minutes was able to play around with syslog-ng the first time. First some experiences I made while installing syslog-ng: I downloaded the latest releases of libol and syslog-ng nd tried to compile them on my test-box (2.0.35, a SuSE 5.3 system). The configuration, making ant the installation of libol succeded without any problems. But when I used configure in the syslog-ng it was unable to find libol-config although it had detected libol (It displayed the correct version number). After adding the source-path of libol to $path I was was able to compile syslog-ng without any further errors. If this is the normal behaviour it might be a good idea to add a hint to the documentation. From this point on everything worked as expected. Thanks for this great product. Now, some questions: - In the sample config file in the debian/ subdirectory there is a line wich states that support for special files is not fully implemented. I am currently using the "old" syslog-package on one of my hosts to log data into a FIFO from which the data is fetched by a perl script, analysed and put into a database. Syslog-ng seems currently not be able to handle fifos correctly. When can we expect this to be implemented? - Is there a howto or a detailed description for writing additional (destination) drivers for syslog-ng? I have serveral ideas how to enhance syslog-ng by some new drivers (keywords: mail, program, mysql, lpr) and will maybe able to contribute. Stefan

3 4

Switching libol away from scsh
by Tommi Virtanen 07 Jun '99

07 Jun '99

Hi. Currently, scsh's license is non-free. The author has promised to fix this, but seems to be incredibly busy with other issues, or just disinterested. Meanwhile, I'd like syslog-ng to be as free as possible; that includes not needing scsh to work. I recently made minor modifications to lsh to make it work without scsh (Ray Dassen will be integrating my changes in the lsh distribution shortly; I will provide the patch by email if requested), and as syslog-ng and libol share the same backend, those modifications were quite easy to port to libol. What follows is a diff file that modifies libol to use Guile instead of scsh. Hopefully you will integrate this into your distribution. Thank You. -- Havoc Consulting | unix, linux, perl, mail, www, internet, security consulting +358 50 5486010 | software development, unix administration, training

3 2

Documentation for syslog-ng
by Balazs Scheidler 06 Jun '99

06 Jun '99

Hi, I have released some reference documentation for syslog-ng. It is available at: http://www.balabit.hu/products/syslog-ng Please note that I have moved the webpage of syslog-ng to the above url instead of the old one, so please update your bookmarks. (The old one still works with a Redirect) -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng 1.1.22
by Balazs Scheidler 05 Jun '99

05 Jun '99

Hi, I have released syslog-ng 1.1.22, which adds the following new features. * a new destination, usertty, which writes messages to the given users' terminal * a new source, called sun-door, which implements the native log protocol of Solaris 2.5 and above. This is highly experimental, could someone with root access to a solaris box test this out? * documentation updates (someone with experienced man page creation skills, could help me out with this) No bugs have been fixed, since none were reported. (which either means that there are no bugs, or that nobody uses syslog-ng :) I hope that the first version is true. I don't plan to announce this version to a wider audience as long as the previously mentioned features are tested a bit. Please note that I have changed pgp keys. This doesn't mean that my old key has been compromised. It only means that I thought 768 bits is not secure enough. You can get my new 2048bit key either by fingering me, or downloading from the web site. The new key is signed with the old one, so you can trust the new one as much as you trusted the previous one. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

switching away from scsh
by Tommi Virtanen 03 Jun '99

03 Jun '99

One more correction: The scsh-compability libraries required by the current patch are still non-free; but now that the make_class and friends are ported to Guile, it will be easier to port them away from scsh features. I will provide more patches later. -- Havoc Consulting | unix, linux, perl, mail, www, internet, security consulting +358 50 5486010 | software development, unix administration, training

2 1

Re: [syslog-ng] syslog-ng 1.1.20 and libol version 0.1.18 released
by Balazs Scheidler 29 May '99

29 May '99

> > I have fixed several bugs and build errors in both syslog-ng and libol. It > > compiles cleanly and works for me (tm). It has also been debianized, so it's > > available in a debian package as well. > > > now it compiles OK but every next attempt reread configfile by HUP cause > Segfault: > > > # syslog-ng -d > syslog-ng version 1.1.20 starting > SIGHUP received restarting syslog-ng > new configuration initialized > SIGHUP received restarting syslog-ng > Segmentation fault (core dumped) fixed in version 1.1.21. The problem was that gc deallocated my configuration structure while I was still using it... tarball and .deb package available at http://www.balabit.hu/downloads/syslog-ng -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng 1.1.20 and libol version 0.1.18 released
by Balazs Scheidler 28 May '99

28 May '99

Hi, I have fixed several bugs and build errors in both syslog-ng and libol. It compiles cleanly and works for me (tm). It has also been debianized, so it's available in a debian package as well. Some of the changes: * It is now linked statically against libol, so a dynamic version is not required for running syslog-ng * Fixed a few bugs (the emitted loglines contained embedded \0 characters, and \n was not always interpreted correctly) * Added debian control files, and readded .deb packages to the site. I have personally switched to this release from the standard syslogd on my computer. So as you can see it's quite stable now. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

[pg@gu.net: Re: [syslog-ng] syslog-ng v16 compilation problem]
by Balazs Scheidler 28 May '99

28 May '99

As it seems 1.1.18 fixed the problems you may have encountered. ----- Forwarded message from Pavel Golubev <pg(a)gu.net> ----- Date: Fri, 28 May 1999 02:57:51 +0300 (EEST) From: Pavel Golubev <pg(a)gu.net> To: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] syslog-ng v16 compilation problem On Wed, 26 May 1999, Balazs Scheidler wrote: 1.1.18 compiles OK now :) --- Pavel Golubev PG810-RIPE Global Ukraine Inc. ----- End forwarded message ----- -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0