Hi Thanks for replying. The config file is actually big, due to the number of targets from which we are receiving the log files - basically around 90 devices. Each device is being filtered on its IP Address, in order to create a separate log file for each device. I was thinking of sending the log files to a MySQL database. Do you think that would help? Also, about your recommendation vis-à-vis using bison, how can I force syslog-ng to do that? Do I need to re-compile syslog-ng? Thanks again Gef -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: 08 January 2009 21:32 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] YACC Stack Overflow hi, never seen anything like that. but you probably have a _huge_ configuration file. can you tell me how large it is? also, can you tell me your experiences regarding syslog-ng configuration file? if you have such a big file, I'd be delighted if you could tell me what I could do to make it smaller. Anyway, the problem seems to be that the yacc implementation that you used has a hard-limit on the parser stack size. I develop syslog-ng with bison, and that does not have such a limit (or it is much larger). After I installer byacc (that you probably also use), I've figured this: /* define the initial stack-sizes */ #ifdef YYSTACKSIZE #undef YYMAXDEPTH #define YYMAXDEPTH YYSTACKSIZE #else #ifdef YYMAXDEPTH #define YYSTACKSIZE YYMAXDEPTH #else #define YYSTACKSIZE 500 #define YYMAXDEPTH 500 #endif #endif e.g. the maximum depth is 500. you can increase this by passing -DYYSTACKSIZE=1000 in CFLAGS, or by adding a "#define YYSTACKSIZE 1000" to the beginning of cfg-grammar.y and recompile. But I'd recommend to use bison as the parser generator. On Tue, 2009-01-06 at 14:05 +0100, Cauchi, Geoffrey, VF-MT wrote:

Hi

I am using syslog version 2.0.8 and all is running well. I am using it to log a number of Cisco devices. Recently I tried to add an additional number of devices that I would like to have their syslog sent to the Syslog-NG server. This is the syntax used in the config file:

destination CAT1 { file("/var/log/switches/CAT1/log.txt" dir_perm(0755) perm(0755));};

filter f_filter73 { netmask(192.168.150.25);};

log { source(s_udp); filter(f_filter73); destination(CAT1); };

However, when I restart syslog-ng I get the following error: Stopping syslog-ng: [OK] Starting syslog-ng: yacc stack overflow at 314

YACC is complaining of a stack overflow. Syslog-ng is running on Fedora Core 8. Did anyone encounter this problem before? Any help would be appreciated. Thanks Gef

------------------------------------------------------------------------------------- Vodafone Life is Now -------------------------------------------------------------------------------------

This email is intended only for the use of individuals to whom it is addressed, as it may contain confidential or privileged information. If you are not a named addressee, intended recipient, or the person responsible for delivering the message to the named addressee, be advised that you have received this email in error and that you should not disseminate, distribute, print, copy this mail or otherwise divulge its contents. In such instances, please notify Vodafone Malta Limited on telephone number +356 99999247 and delete this email from your system. Since this transmission was affected via email, Vodafone Malta Limited cannot guarantee that it is secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Vodafone Malta Limited does not accept liability for any errors or omissions in the contents of this message which arise as a result of email transmission.

Save the environment for our children - Print e-mail only when necessary.

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

-- Bazsi ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------------- Vodafone Life is Now ------------------------------------------------------------------------------------- This email is intended only for the use of individuals to whom it is addressed, as it may contain confidential or privileged information. If you are not a named addressee, intended recipient, or the person responsible for delivering the message to the named addressee, be advised that you have received this email in error and that you should not disseminate, distribute, print, copy this mail or otherwise divulge its contents. In such instances, please notify Vodafone Malta Limited on telephone number +356 99999247 and delete this email from your system. Since this transmission was affected via email, Vodafone Malta Limited cannot guarantee that it is secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Vodafone Malta Limited does not accept liability for any errors or omissions in the contents of this message which arise as a result of email transmission. Save the environment for our children - Print e-mail only when necessary.

Hi Thanks for your suggestion to use macros. This should do the job with the minimum changes to the server. Furthermore it will allow me to reduce the config by a huge number of lines. :-) I tried the following, but I'm doing something incorrect :( source Cisco_Switch { udp(ip(0.0.0.0) port(514)); }; destination d_files_per_ip { file("/var/log/cisco/switches/$SOURCEIP/log.txt" perm(0755) dir_perm(0755) create_dirs(yes) ); }; log { source(Cisco_Switch); destination(d_files_per_ip); }; With the original config (for a particular switch): destination SS2A1_CAT1 { file("/var/log/cisco/switches/SS2A1_CAT1/log.txt" dir_perm(0755) perm(0755));}; filter f_filter67 { netmask(192.168.150.17);}; log { source(s_udp); filter(f_filter67); destination(SS2A1_CAT1); }; It works. i.e. from the switch side config is fine Can you please help? Thanks again Geoffrey -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: 12 January 2009 15:01 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] YACC Stack Overflow On Fri, 2009-01-09 at 01:49 +0100, Cauchi, Geoffrey, VF-MT wrote:

Hi Thanks for replying. The config file is actually big, due to the number of targets from which we are receiving the log files - basically around 90 devices. Each device is being filtered on its IP Address, in order to create a separate log file for each device.

wouldn't it be possible to use macros for this purpose, e.g. something like this: destination d_files_per_ip { file("/var/log/$SOURCEIP/messages"); }; ?

I was thinking of sending the log files to a MySQL database. Do you think that would help?

Probably, if you can describe the file naming using macros, you could use either files or SQL as both of the supports creating files based on macros dynamically.

Also, about your recommendation vis-à-vis using bison, how can I force syslog-ng to do that? Do I need to re-compile syslog-ng?

You need to recompile syslog-ng, either if you want to increase yacc limits or to switch to bison. You can force a given implementation of yacc by setting the YACC environment variable before running the configure script. But it is probably enough to install bison as the configure script supposedly prefers that over yacc. -- Bazsi ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------------- Vodafone Life is Now ------------------------------------------------------------------------------------- This email is intended only for the use of individuals to whom it is addressed, as it may contain confidential or privileged information. If you are not a named addressee, intended recipient, or the person responsible for delivering the message to the named addressee, be advised that you have received this email in error and that you should not disseminate, distribute, print, copy this mail or otherwise divulge its contents. In such instances, please notify Vodafone Malta Limited on telephone number +356 99999247 and delete this email from your system. Since this transmission was affected via email, Vodafone Malta Limited cannot guarantee that it is secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Vodafone Malta Limited does not accept liability for any errors or omissions in the contents of this message which arise as a result of email transmission. Save the environment for our children - Print e-mail only when necessary.

Well the problem is that with that config, the syslog message was not logged to the file :-( I was hoping there was some misconfig. I tried to debug the syslog, using -vd but there did not seem to be much info. Is there any other recommended way for debugging? Thanks Gef -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: 16 January 2009 14:49 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] YACC Stack Overflow On Fri, 2009-01-16 at 14:15 +0100, Cauchi, Geoffrey, VF-MT wrote:

Hi

Thanks for your suggestion to use macros. This should do the job with the minimum changes to the server. Furthermore it will allow me to reduce the config by a huge number of lines. :-)

I tried the following, but I'm doing something incorrect :(

source Cisco_Switch { udp(ip(0.0.0.0) port(514)); };

destination d_files_per_ip {

file("/var/log/cisco/switches/$SOURCEIP/log.txt"

perm(0755) dir_perm(0755) create_dirs(yes) ); };

log { source(Cisco_Switch); destination(d_files_per_ip); };

And what's the problem? the config seems to be just fine. -- Bazsi ________________________________________________________________________ ______ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------------- Vodafone Life is Now ------------------------------------------------------------------------------------- This email is intended only for the use of individuals to whom it is addressed, as it may contain confidential or privileged information. If you are not a named addressee, intended recipient, or the person responsible for delivering the message to the named addressee, be advised that you have received this email in error and that you should not disseminate, distribute, print, copy this mail or otherwise divulge its contents. In such instances, please notify Vodafone Malta Limited on telephone number +356 99999247 and delete this email from your system. Since this transmission was affected via email, Vodafone Malta Limited cannot guarantee that it is secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Vodafone Malta Limited does not accept liability for any errors or omissions in the contents of this message which arise as a result of email transmission. Save the environment for our children - Print e-mail only when necessary.