thanks scott, i saw the errors that was my fault for being tired and a little lazy that night made adjustments to file now i get no errors when doing the syslog-ng --syntax-only

but I am not getting any logging of the normal items like login attempt and failures and such

the only log i got was below looks like its just the stats and this was in messages and debug not the main log

Jun  1 11:48:05 mcm-001 syslog-ng[120]: syslog-ng starting up; version='3.0.8'
Jun  1 11:58:06 mcm-001 syslog-ng[120]: Log statistics; processed='destination(user)=0', processed='destination(mailwarn)=0', processed='destination(uucp)=0', processed='destination(lpr)=0', processed='destination(daemon)=0', processed='destination(debug)=1', processed='center(received)=0', processed='destination(mailerr)=0', processed='destination(d_syslog)=1', processed='destination(kern)=0', processed='source(src)=1', processed='destination(mailinfo)=0', processed='destination(newsnotice)=0', processed='destination(newserr)=0', processed='destination(messages)=1', processed='destination(authlog)=0', processed='destination(ppp)=0', processed='center(queued)=0', processed='destination(mail)=0', processed='destination(newscrit)=0', processed='destination(cron)=0', processed='src.internal(src#1)=1', stamp='src.internal(src#1)=1306943285', processed='destination(console)=0', processed='destination(console_all)=1'

here is the revised latest config

@version: 3.0
#
# Syslog-ng example configuration for for Debian GNU/Linux
#
# Copyright (c) 1999 anonymous
# Copyright (c) 1999 Balazs Scheidler
# $Id: syslog-ng.conf.sample,v 1.3 2003/05/20 08:57:27 asd Exp $
#
# Syslog-ng configuration file, compatible with default Debian syslogd
# installation.
#


# replaced with Line below fxs options { long_hostnames(off); sync(0); };
options { long_hostnames(off); flush_lines(0); };

source src { unix-stream("/var/run/syslog"); internal(); };
source net { udp(); };

destination authlog { file("/var/log/auth.log"); };
# replaced with Line below fxs destination syslog { file("/var/log/syslog"); };
destination d_syslog { file("/var/log/syslog.log"); };
#destination d_syslog { file("/var/log/system.log"); };
destination cron { file("/var/log/cron.log"); };
destination daemon { file("/var/log/daemon.log"); };
destination kern { file("/var/log/kern.log"); };
destination lpr { file("/var/log/lpr.log"); };
destination user { file("/var/log/user.log"); };
destination uucp { file("/var/log/uucp.log"); };
destination ppp { file("/var/log/ppp.log"); };
destination mail { file("/var/log/mail.log"); };

destination mailinfo { file("/var/log/mail.info"); };
destination mailwarn { file("/var/log/mail.warn"); };
destination mailerr { file("/var/log/mail.err"); };

destination newscrit { file("/var/log/news/news.crit"); };
destination newserr { file("/var/log/news/news.err"); };
destination newsnotice { file("/var/log/news/news.notice"); };

destination debug { file("/var/log/debug"); };
destination messages { file("/var/log/messages"); };
destination console { usertty("root"); };
#destination console_all { file("/dev/tty12"); };
destination console_all { file("/dev/console"); };
#destination loghost { udp("loghost" port(999)); };


destination xconsole { pipe("/dev/xconsole"); };

filter f_auth { facility(auth); };
filter f_authpriv { facility(auth, authpriv); };
#Changed it to make it filter the messages from the localO fxs  filter f_syslog { not facility(authpriv, mail); };
filter f_syslog { facility(local0); };
filter f_cron { facility(cron); };
filter f_daemon { facility(daemon); };
filter f_kern { facility(kern); };
filter f_lpr { facility(lpr); };
filter f_mail { facility(mail); };
filter f_user { facility(user); };
filter f_uucp { facility(cron); };
filter f_ppp { facility(local2); };
filter f_news { facility(news); };
filter f_debug { not facility(auth, authpriv, news, mail); };
filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); };
filter f_emergency { level(emerg); };

filter f_info { level(info); };
filter f_notice { level(notice); };
filter f_warn { level(warn); };
filter f_crit { level(crit); };
filter f_err { level(err); };

log { source(src); filter(f_authpriv); destination(authlog); };
# replaced with Line below fxs log { source(src); filter(f_syslog); destination(syslog); };
log { source(src); filter(f_syslog); destination(d_syslog); };
log { source(src); filter(f_cron); destination(cron); };
log { source(src); filter(f_daemon); destination(daemon); };
log { source(src); filter(f_kern); destination(kern); };
log { source(src); filter(f_lpr); destination(lpr); };
log { source(src); filter(f_mail); destination(mail); };
log { source(src); filter(f_user); destination(user); };
log { source(src); filter(f_uucp); destination(uucp); };
log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); };
log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); };
log { source(src); filter(f_mail); filter(f_err); destination(mailerr); };
log { source(src); filter(f_news); filter(f_crit); destination(newscrit); };
log { source(src); filter(f_news); filter(f_err); destination(newserr); };
log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); };
log { source(src); filter(f_debug); destination(debug); };
log { source(src); filter(f_messages); destination(messages); };
log { source(src); filter(f_emergency); destination(console); };
log { source(src); filter(f_ppp); destination(ppp); };
log { source(src); destination(console_all); };







On Wed, Jun 1, 2011 at 6:00 AM, <syslog-ng-request@lists.balabit.hu> wrote:
Send syslog-ng mailing list submissions to
       syslog-ng@lists.balabit.hu

To subscribe or unsubscribe via the World Wide Web, visit
       https://lists.balabit.hu/mailman/listinfo/syslog-ng
or, via email, send a message with subject or body 'help' to
       syslog-ng-request@lists.balabit.hu

You can reach the person managing the list at
       syslog-ng-owner@lists.balabit.hu

When replying, please edit your Subject line so it is more specific
than "Re: Contents of syslog-ng digest..."


Today's Topics:

  1. Re:  syslog-ng Digest, Vol 73, Issue 37 (Frank Scalzo)
  2.  [Bug 122] [3.2.4]: mixed linking broken for
     libsyslog-ng.so.* (bugzilla@bugzilla.balabit.com)
  3.  [Bug 122] [3.2.4]: mixed linking broken for
     libsyslog-ng.so.* (bugzilla@bugzilla.balabit.com)
  4. Re:  syslog-ng Digest, Vol 73, Issue 37 (Scott Rochford)
  5.  [Bug 122] [3.2.4]: mixed linking broken for
     libsyslog-ng.so.* (bugzilla@bugzilla.balabit.com)
  6.  [Bug 122] [3.2.4]: mixed linking broken for
     libsyslog-ng.so.* (bugzilla@bugzilla.balabit.com)


----------------------------------------------------------------------

Message: 1
Date: Tue, 31 May 2011 08:51:17 -0400
From: Frank Scalzo <fscalzo@gmail.com>
Subject: Re: [syslog-ng] syslog-ng Digest, Vol 73, Issue 37
To: syslog-ng@lists.balabit.hu
Message-ID: <BANLkTikpWETLmnTSzSDL_4Cx4p0=gPT+6w@mail.gmail.com>
Content-Type: text/plain; charset="windows-1252"

 Gergely,

sorry after fighting with this for hours i forgot to upload.

@version: 3.0
#
# Syslog-ng example configuration for for Debian GNU/Linux
#
# Copyright (c) 1999 anonymous
# Copyright (c) 1999 Balazs Scheidler
# $Id: syslog-ng.conf.sample,v 1.3 2003/05/20 08:57:27 asd Exp $
#
# Syslog-ng configuration file, compatible with default Debian syslogd
# installation.
#


# replaced with Line below fxs options { long_hostnames(off); sync(0); };
options { long_hostnames(off); flush_lines(0); };

source src { unix-stream("/var/run/syslog"); internal(); };
source net { udp(); };

destination authlog { file("/var/log/auth.log"); };
# replaced with Line below fxs destination syslog { file("/var/log/syslog");
};
destination d_syslog { file(?/var/log/system.log?); };
destination cron { file("/var/log/cron.log"); };
destination daemon { file("/var/log/daemon.log"); };
destination kern { file("/var/log/kern.log"); };
destination lpr { file("/var/log/lpr.log"); };
destination user { file("/var/log/user.log"); };
destination uucp { file("/var/log/uucp.log"); };
destination ppp { file("/var/log/ppp.log"); };
destination mail { file("/var/log/mail.log"); };

destination mailinfo { file("/var/log/mail.info"); };
destination mailwarn { file("/var/log/mail.warn"); };
destination mailerr { file("/var/log/mail.err"); };

destination newscrit { file("/var/log/news/news.crit"); };
destination newserr { file("/var/log/news/news.err"); };
destination newsnotice { file("/var/log/news/news.notice"); };

destination debug { file("/var/log/debug"); };
destination messages { file("/var/log/messages"); };
destination console { usertty("root"); };
#destination console_all { file("/dev/tty12"); };
destination console_all { file(?/dev/console?); };
#destination loghost { udp("loghost" port(999)); };


destination xconsole { pipe("/dev/xconsole"); };

filter f_auth { facility(auth); };
filter f_authpriv { facility(auth, authpriv); };
#Changed it to make it filter the messages from the localO fxs filter
f_syslog { not facility(authpriv, mail); };
filter f_syslog { facility(local0); };
filter f_cron { facility(cron); };
filter f_daemon { facility(daemon); };
filter f_kern { facility(kern); };
filter f_lpr { facility(lpr); };
filter f_mail { facility(mail); };
filter f_user { facility(user); };
filter f_uucp { facility(cron); };
filter f_ppp { facility(local2); };
filter f_news { facility(news); };
filter f_debug { not facility(auth, authpriv, news, mail); };
filter f_messages { level(info..warn)
   and not facility(auth, authpriv, mail, news); };
filter f_emergency { level(emerg); };

filter f_info { level(info); };
filter f_notice { level(notice); };
filter f_warn { level(warn); };
filter f_crit { level(crit); };
filter f_err { level(err); };

log { source(src); filter(f_authpriv); destination(authlog); };
# replaced with Line below fxs log { source(src); filter(f_syslog);
destination(syslog); };
log { source(src); filter(f_syslog); destination(d_syslog); };
log { source(src); filter(f_cron); destination(cron); };
log { source(src); filter(f_daemon); destination(daemon); };
log { source(src); filter(f_kern); destination(kern); };
log { source(src); filter(f_lpr); destination(lpr); };
log { source(src); filter(f_mail); destination(mail); };
log { source(src); filter(f_user); destination(user); };
log { source(src); filter(f_uucp); destination(uucp); };
log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); };
log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); };
log { source(src); filter(f_mail); filter(f_err); destination(mailerr); };
log { source(src); filter(f_news); filter(f_crit); destination(newscrit); };
log { source(src); filter(f_news); filter(f_err); destination(newserr); };
log { source(src); filter(f_news); filter(f_notice);
destination(newsnotice); };
log { source(src); filter(f_debug); destination(debug); };
log { source(src); filter(f_messages); destination(messages); };
log { source(src); filter(f_emergency); destination(console); };
log { source(src); filter(f_ppp); destination(ppp); };
log { source(src); destination(console_all); };
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110531/6b64dd89/attachment.html

------------------------------

Message: 2
Date: Tue, 31 May 2011 16:22:25 +0200 (CEST)
From: bugzilla@bugzilla.balabit.com
Subject: [syslog-ng] [Bug 122] [3.2.4]: mixed linking broken for
       libsyslog-ng.so.*
To: syslog-ng@lists.balabit.hu
Message-ID: <20110531142225.31EB311E053@lists.balabit.hu>
Content-Type: text/plain; charset="UTF-8"

https://bugzilla.balabit.com/show_bug.cgi?id=122





--- Comment #1 from Balazs Scheidler <bazsi@balabit.hu>  2011-05-31 16:22:24 ---
Can you show me your configure command line?

In dynamic mode it links against those libraries, in mixed mode it doesn't, as it fetches those symbols through the main program, which links these
dependencies statically.


--
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.


------------------------------

Message: 3
Date: Tue, 31 May 2011 18:01:32 +0200 (CEST)
From: bugzilla@bugzilla.balabit.com
Subject: [syslog-ng] [Bug 122] [3.2.4]: mixed linking broken for
       libsyslog-ng.so.*
To: syslog-ng@lists.balabit.hu
Message-ID: <20110531160132.F091739DA75@lists.balabit.hu>
Content-Type: text/plain; charset="UTF-8"

https://bugzilla.balabit.com/show_bug.cgi?id=122





--- Comment #2 from Arkadiusz Mi?kiewicz <arekm@maven.pl>  2011-05-31 18:01:33 ---
I always kept forgetting about these weird linking rules used in syslog-ng
(which break all the time with --as-needed or --no-copy-dt-needed-entries linker flags).

Build log (including configure options):

ftp://buildlogs.pld-linux.org/th/x86_64/FAIL/syslog-ng,9a44d5db-398c-4559-b35c-63d55e241838.bz2

BUT it is with a patch:

http://cvs.pld-linux.org/cgi-bin/cvsweb/packages/syslog-ng/syslog-ng-link.patch?rev=1.12

which fixes linking but links with these dynamicly (since libtool is used for that linking and thus -Bstatic is ignored)
thus breaking "mixed linking" idea.

So maybe the solution is to fail at configure time when --as-needed or --no-copy-dt-needed-entries linker flags are used?


--
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.

------------------------------

Message: 4
Date: Wed, 1 Jun 2011 10:09:06 +1100
From: Scott Rochford <scott.rochford@amadeus.com>
Subject: Re: [syslog-ng] syslog-ng Digest, Vol 73, Issue 37
To: Syslog-ng users' and developers' mailing list
       <syslog-ng@lists.balabit.hu>
Message-ID:
       <OF5ACCBA5A.7E8675AE-ONCA2578A1.007EBEF5-CA2578A1.007F2D1B@amadeus.com>

Content-Type: text/plain; charset="utf-8"

Hi Frank,

Someone must have used a so-called "smart" editor to edit this file, since
it seems to have used fancy quotes on the console line.

#destination console_all { file("/dev/tty12"); };
destination console_all { file(?/dev/console?); };
#destination loghost { udp("loghost" port(999)); };

Notice how they are different from those on the line above?  Word
processors often replace quotes with matching pairs like that
automatically; only plain text editors should be used to edit config files
like this.

Check for this kind of thing with a hex dumper or 'cat -vet':

$ cat frank
#destination console_all { file("/dev/tty12"); };
destination console_all { file("/dev/console"); };
#destination loghost { udp("loghost" port(999)); };

$ cat -vet frank
#destination console_all { file("/dev/tty12"); };$
destination console_all { file(M-bM-^@M-^\/dev/consoleM-bM-^@M-^]); };$
#destination loghost { udp("loghost" port(999)); };$

Scott




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110601/80342c8a/attachment-0001.htm

------------------------------

Message: 5
Date: Wed,  1 Jun 2011 08:19:29 +0200 (CEST)
From: bugzilla@bugzilla.balabit.com
Subject: [syslog-ng] [Bug 122] [3.2.4]: mixed linking broken for
       libsyslog-ng.so.*
To: syslog-ng@lists.balabit.hu
Message-ID: <20110601061929.CC96A39D7DE@lists.balabit.hu>
Content-Type: text/plain; charset="UTF-8"

https://bugzilla.balabit.com/show_bug.cgi?id=122





--- Comment #3 from Balazs Scheidler <bazsi@balabit.hu>  2011-06-01 08:19:29 ---
the patch is wrong since it produces _two_ copies of statically compiled libraries into the final executable.

one in the syslog-ng library, the other in the syslog-ng binary. the only reason it might work as the main
program does very little with glib directly.


--
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.


------------------------------

Message: 6
Date: Wed,  1 Jun 2011 08:24:30 +0200 (CEST)
From: bugzilla@bugzilla.balabit.com
Subject: [syslog-ng] [Bug 122] [3.2.4]: mixed linking broken for
       libsyslog-ng.so.*
To: syslog-ng@lists.balabit.hu
Message-ID: <20110601062431.0252E11E05F@lists.balabit.hu>
Content-Type: text/plain; charset="UTF-8"

https://bugzilla.balabit.com/show_bug.cgi?id=122





--- Comment #4 from Arkadiusz Mi?kiewicz <arekm@maven.pl>  2011-06-01 08:24:31 ---
That's why I wrote "thus breaking "mixed linking" idea.".


I ended up filtering out --as-needed and --no-copy-dt-needed-entries linker flags.


--
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.

------------------------------

_______________________________________________
syslog-ng maillist  -  syslog-ng@lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng


End of syslog-ng Digest, Vol 74, Issue 1
****************************************