[syslog-ng] YACC Stack Overflow

[Cauchi, Geoffrey, VF-MT]

Hi

Thanks for your suggestion to use macros.  This should do the job with the minimum changes to the server.  Furthermore it will allow me to reduce the config by a huge number of lines. :-)

I tried the following, but I'm doing something incorrect :(

source Cisco_Switch {
                        udp(ip(0.0.0.0) port(514));
                        };

destination d_files_per_ip {
      			file("/var/log/cisco/switches/$SOURCEIP/log.txt"
                        perm(0755) dir_perm(0755) create_dirs(yes)
                        ); };

log {
        source(Cisco_Switch);
        destination(d_files_per_ip);
};


With the original config (for a particular switch):

destination SS2A1_CAT1 { file("/var/log/cisco/switches/SS2A1_CAT1/log.txt" dir_perm(0755) perm(0755));};
filter f_filter67   { netmask(192.168.150.17);};
log { source(s_udp); filter(f_filter67); destination(SS2A1_CAT1); };

It works.  i.e. from the switch side config is fine

Can you please help?

Thanks again
Geoffrey

-----Original Message-----
From: syslog-ng-bounces at lists.balabit.hu [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Balazs Scheidler
Sent: 12 January 2009 15:01
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] YACC Stack Overflow

On Fri, 2009-01-09 at 01:49 +0100, Cauchi, Geoffrey, VF-MT wrote:
> Hi
> Thanks for replying.  The config file is actually big, due to the number of targets from 
> which we are receiving the log files - basically around 90 devices.  Each device is being 
> filtered on its IP Address, in order to create a separate log file for each device.

wouldn't it be possible to use macros for this purpose, e.g. something
like this:

destination d_files_per_ip { file("/var/log/$SOURCEIP/messages"); };

?


> 
> I was thinking of sending the log files to a MySQL database. Do you think that would help?

Probably, if you can describe the file naming using macros, you could
use either files or SQL as both of the supports creating files based on
macros dynamically.

> 
> Also, about your recommendation vis-à-vis using bison, how can I force syslog-ng to do that?  Do I need to re-compile syslog-ng?

You need to recompile syslog-ng, either if you want to increase yacc
limits or to switch to bison.

You can force a given implementation of yacc by setting the YACC
environment variable before running the configure script. But it is
probably enough to install bison as the configure script supposedly
prefers that over yacc.


-- 
Bazsi

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html

-------------------------------------------------------------------------------------
Vodafone Life is Now
-------------------------------------------------------------------------------------

This email is intended only for the use of individuals to whom it is addressed, as it may contain confidential or privileged information. If you are not a named addressee, intended recipient, or the person responsible for delivering the message to the named addressee, be advised that you have received this email in error and that you should not disseminate, distribute, print, copy this mail or otherwise divulge its contents. In such instances, please notify Vodafone Malta Limited on telephone number +356 99999247 and delete this email from your system. Since this transmission was affected via email, Vodafone Malta Limited cannot guarantee that it is secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Vodafone Malta Limited does not accept liability for any errors or omissions in the contents of this message which arise as a result of email transmission.

Save the environment for our children - Print e-mail only when necessary.