[syslog-ng] AW: [syslog-ng] Experiences and question from a newbie

[Stefan Seufert]

> > [...]
> > configure in the syslog-ng it was unable to find libol-config
> although it
> > had detected libol (It displayed the correct version number).
> After adding
> > the source-path of libol to $path I was was able to compile syslog-ng
> > without any further errors. If this is the normal behaviour it
> > [...]
>
> Hmm... libol-config is installed to $prefix/bin (which is by default
> /usr/local/bin), so you need to add that directory to the path. I
> don't know
> how the configure script could find the correct version number without
> libol-config. (it's determined by libol-config --version)

Ok, at least this explains the problems I experienced. /usr/local/bin is not
part of the path in a unmodified SuSE installation. Definitly not your
fault.

> > Now, some questions:
> >
> > - In the sample config file in the debian/ subdirectory there
> is a line wich
> > states that support for special files is not fully implemented. I am
> > currently using the "old" syslog-package on one of my hosts to
> log data into
> > a FIFO from which the data is fetched by a perl script, analysed and put
> > into a database. Syslog-ng seems currently not be able to handle fifos
> > correctly. When can we expect this to be implemented?
>
> You could use file /path/to/fifo; but when syslog-ng tries to open this
> file, it blocks as long as the other end opens the fifo as well.
> I'll try to
> fix this.

I have tried this but since it was described as "not implemented" I did not
add a detailed description to my last mail in order to keep the noise on
this list low. Now, since you mentioned some of the problems I think it is
the roght time to add some other things I have noticed. As you recommended I
used "file /my/fifio". As you said syslog-ng block until it can open the
file (i.e. a program has connected to the other side of the fifo) and only
starts up when it this has happened. When I send the syslog-ng process which
is configured to write to a fifo a HUP it coredumps. Last, if the reading
program dies syslog-ng will output an error msg. (in debug mode) and stop
writing to the fifo. If the reading program is restartet it will get no more
data out of the fifo. (I know that this is not a very good description but i
do not have access to my test box right now)

> > - Is there a howto or a detailed description for writing additional
> > (destination) drivers for syslog-ng? I have serveral ideas how
> > [...]
>
> not yet. though once you made yourself familiar with make_class, which
> preprocesses .c files, it's very simple. syslog-ng uses a
> slightly modified
> version of lsh's backend. lsh is a GPLd reimplementation of the SSH2
> protocols. make_class comes from lsh, and generates information for the
> garbage collector. You can find some information about make_class
> in the file
> HACKING in the lsh source tree.
>
> As an example destination driver check afuser.c, it's quite simple.

Thank you very much, I hope I'll be able to spend some time on this :)


Stefan