...

[...] configure in the syslog-ng it was unable to find libol-config although it had detected libol (It displayed the correct version number). After adding the source-path of libol to $path I was was able to compile syslog-ng without any further errors. If this is the normal behaviour it [...]

Hmm... libol-config is installed to $prefix/bin (which is by default /usr/local/bin), so you need to add that directory to the path. I don't know how the configure script could find the correct version number without libol-config. (it's determined by libol-config --version)

Ok, at least this explains the problems I experienced. /usr/local/bin is not part of the path in a unmodified SuSE installation. Definitly not your fault.

...

Now, some questions:

- In the sample config file in the debian/ subdirectory there is a line wich states that support for special files is not fully implemented. I am currently using the "old" syslog-package on one of my hosts to log data into a FIFO from which the data is fetched by a perl script, analysed and put into a database. Syslog-ng seems currently not be able to handle fifos correctly. When can we expect this to be implemented?

You could use file /path/to/fifo; but when syslog-ng tries to open this file, it blocks as long as the other end opens the fifo as well. I'll try to fix this.

I have tried this but since it was described as "not implemented" I did not add a detailed description to my last mail in order to keep the noise on this list low. Now, since you mentioned some of the problems I think it is the roght time to add some other things I have noticed. As you recommended I used "file /my/fifio". As you said syslog-ng block until it can open the file (i.e. a program has connected to the other side of the fifo) and only starts up when it this has happened. When I send the syslog-ng process which is configured to write to a fifo a HUP it coredumps. Last, if the reading program dies syslog-ng will output an error msg. (in debug mode) and stop writing to the fifo. If the reading program is restartet it will get no more data out of the fifo. (I know that this is not a very good description but i do not have access to my test box right now)

...

- Is there a howto or a detailed description for writing additional (destination) drivers for syslog-ng? I have serveral ideas how [...]

not yet. though once you made yourself familiar with make_class, which preprocesses .c files, it's very simple. syslog-ng uses a slightly modified version of lsh's backend. lsh is a GPLd reimplementation of the SSH2 protocols. make_class comes from lsh, and generates information for the garbage collector. You can find some information about make_class in the file HACKING in the lsh source tree.

As an example destination driver check afuser.c, it's quite simple.

Thank you very much, I hope I'll be able to spend some time on this :) Stefan

With help I've finally gotten syslog-ng to work, up to a point. It loads the simple configuration file without a problem, and streams to all the right files; but after about a minute the program gives up and segfaults, leaving a core file.

I have saved a large (1250k) 'truss -f' output file; the tail end follows:

I think this could be a reentrancy problem. Sending output to log destinations is not reentrant, but is not protected by a mutex. (other input methods do not use threads, so reentrancy was not an targeted aim) I'll protect non-reentrant parts with a mutex, that should do the trick. I am going to hack in fifo support, and add this mutex and release 1.1.23. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi@balabit.hu