On Mon, 2012-06-11 at 13:27 +0800, Balla, Hithendra (EXT-Other - IN/Bangalore) wrote:

From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ext anju.raveendrannair@wipro.com Sent: Friday, June 08, 2012 5:16 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance.

Hi,

We are using syslog-ng-3.4.0alpha2 binary and trying to run the syslog-ng server configuration file, but its not starting the syslog ng server.

We are getting the following error incase of f__nonconsole_access filter when we ran the syslog-ng binary in debug mode.

Filter rule evaluation result; result='match', rule='f_nonconsole_access', location='/ne_data/conf/syslogng/syslog-ng_server.conf:58:29'

**

ERROR:logmsg.c:535:log_msg_set_value_indirect: assertion failed: (! log_msg_is_write_protected(self))

Abort (core dumped)

this is not the full, relevant configuration as it seems. Either one of your filter uses store-matches, or you are using db-parser() and the crash happens inside them. The configuration would be useful to reproduce the issue. A backtrace would be handy too.

PFA the debug.log

The server conf is having the following line for the above mentioned filter,

template ltemgr_msg_template { template("$S_ISODATE $HOST $FACILITY_NUM/$LEVEL_NUM $MSG\n"); };

#To strip of the msg_id introduced by syslogd

rewrite rw_msg{subst("\\[.*\\]", "", value("MESSAGE"));};

source s_LTEMGR_SYSLOG_CLIENTS{ tcp (ip (27.132.98.69) port(6515) max-connections(4)

tls(

key_file("/ne_data/conf/certificates/MOCM/MOCM_key.pem")

cert_file("/ne_data/conf/certificates/MOCM/MOCM_SB_server.pem")

ca_dir("/ne_data/conf/certificates/SYSLOGNG")

cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4 +RSA:+HIGH:+MEDIUM:!SSLv2")

peer_verify(optional-untrusted)

)

);

};

…….

destination d_ltemgr_nonconsoleaccess_log {file("/ne_data/syslog/ems" perm(0644) template(ltemgr_msg_template)); };

……

filter f_nonconsole_access { level(info..notice) and facility(auth) and ( match("Accepted password for" value("MESSAGE")) or match("Failed password for" value("MESSAGE")) ); };

…..

log { source(s_LTEMGR_SYSLOG_CLIENTS); filter(f_nonconsole_access); rewrite(rw_msg); destination(d_ltemgr_nonconsoleaccess_log); };

Without debug mode, we were able to run the server but central logging is not happening when tried with logger command.

Thanks,

Anju

Please do not print this email unless it is absolutely necessary.

The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments.

WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

www.wipro.com

plain text document attachment (ATT2422471.txt) ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

-- Bazsi