[syslog-ng] YACC Stack Overflow

[Cauchi, Geoffrey, VF-MT]

Hi
Thanks for replying.  The config file is actually big, due to the number of targets from which we are receiving the log files - basically around 90 devices.  Each device is being filtered on its IP Address, in order to create a separate log file for each device.

I was thinking of sending the log files to a MySQL database. Do you think that would help?

Also, about your recommendation vis-à-vis using bison, how can I force syslog-ng to do that?  Do I need to re-compile syslog-ng?

Thanks again
Gef

-----Original Message-----
From: syslog-ng-bounces at lists.balabit.hu [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Balazs Scheidler
Sent: 08 January 2009 21:32
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] YACC Stack Overflow

hi,

never seen anything like that. but you probably have a _huge_
configuration file.

can you tell me how large it is? also, can you tell me your experiences
regarding syslog-ng configuration file? if you have such a big file, I'd
be delighted if you could tell me what I could do to make it smaller.

Anyway, the problem seems to be that the yacc implementation that you
used has a hard-limit on the parser stack size. I develop syslog-ng with
bison, and that does not have such a limit (or it is much larger).

After I installer byacc (that you probably also use), I've figured this:

/* define the initial stack-sizes */
#ifdef YYSTACKSIZE
#undef YYMAXDEPTH
#define YYMAXDEPTH  YYSTACKSIZE
#else
#ifdef YYMAXDEPTH
#define YYSTACKSIZE YYMAXDEPTH
#else
#define YYSTACKSIZE 500
#define YYMAXDEPTH  500
#endif
#endif

e.g. the maximum depth is 500. you can increase this by passing
-DYYSTACKSIZE=1000 in CFLAGS, or by adding a 

"#define YYSTACKSIZE 1000" to the beginning of cfg-grammar.y and
recompile.

But I'd recommend to use bison as the parser generator.

On Tue, 2009-01-06 at 14:05 +0100, Cauchi, Geoffrey, VF-MT wrote:
> Hi
> 
> I am using syslog version 2.0.8 and all is running well.  I am using it
> to log a number of Cisco devices.  Recently I tried to add an additional
> number of devices that I would like to have their syslog sent to the
> Syslog-NG server.
> This is the syntax used in the config file:
> 
> destination CAT1 { file("/var/log/switches/CAT1/log.txt" dir_perm(0755)
> perm(0755));};
> 
> filter f_filter73   { netmask(192.168.150.25);};
> 
> log { source(s_udp); filter(f_filter73); destination(CAT1); };
> 
> 
> However, when I restart syslog-ng I get the following error:
> Stopping syslog-ng: [OK]
> Starting syslog-ng: yacc stack overflow at 314
> 
> YACC is complaining of a stack overflow.  Syslog-ng is running on Fedora
> Core 8.  Did anyone encounter this problem before?  Any help would be
> appreciated.
> Thanks
> Gef
> 
> -------------------------------------------------------------------------------------
> Vodafone Life is Now
> -------------------------------------------------------------------------------------
> 
> This email is intended only for the use of individuals to whom it is addressed, as it may contain confidential or privileged information. If you are not a named addressee, intended recipient, or the person responsible for delivering the message to the named addressee, be advised that you have received this email in error and that you should not disseminate, distribute, print, copy this mail or otherwise divulge its contents. In such instances, please notify Vodafone Malta Limited on telephone number +356 99999247 and delete this email from your system. Since this transmission was affected via email, Vodafone Malta Limited cannot guarantee that it is secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Vodafone Malta Limited does not accept liability for any errors or omissions in the contents of this message which arise as a result of email transmission.
> 
> Save the environment for our children - Print e-mail only when necessary.
> 
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
> 
> 
-- 
Bazsi


______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html

-------------------------------------------------------------------------------------
Vodafone Life is Now
-------------------------------------------------------------------------------------

This email is intended only for the use of individuals to whom it is addressed, as it may contain confidential or privileged information. If you are not a named addressee, intended recipient, or the person responsible for delivering the message to the named addressee, be advised that you have received this email in error and that you should not disseminate, distribute, print, copy this mail or otherwise divulge its contents. In such instances, please notify Vodafone Malta Limited on telephone number +356 99999247 and delete this email from your system. Since this transmission was affected via email, Vodafone Malta Limited cannot guarantee that it is secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Vodafone Malta Limited does not accept liability for any errors or omissions in the contents of this message which arise as a result of email transmission.

Save the environment for our children - Print e-mail only when necessary.