#3468 @ directive Fails with syslog-ng 3.0

[Steven Stringham]

The @ directive Fails with syslog-ng 3.0

From the syslog-ng 3.0 documentation: But, if I have this line (@version:3.0) at the top of my config file, then I cannot edit it in Webmin. I get "Bad directive @version: at 0" when open any of the configuration windows in Webmin.

I also had to change the paths for my installation (from an RPM) to the following: Can these be autodetected?
Path to Syslog-NG config file: /opt/syslog-ng/etc/syslog-ng.conf
Path to Syslog-NG program: /opt/syslog-ng/sbin/syslog-ng
Syslog-NG PID file: /opt/syslog-ng/var/run/syslog-ng.pid

Last but not least, it is possible to have a way to directly edit the config file in Webmin like some other modules do?

Thanks
Steven Stringham

Every syslog-ng configuration file must begin with a line containing the version information of syslog-ng. For syslog-ng version 3.0, this line looks like:

@version:3.0

If the configuration file does not contain the version information, syslog-ng assumes that the file is for syslog-ng version 2.x. In this case it interprets the configuration and sends warnings about the parts of the configuration that should be updated. Version 3.0 of syslog-ng will correctly operate with configuration files of version 2.x, but the default values of certain parameters are different in 3.0.

[Jamie Cameron]

How different is the syslog-ng 3.0 format from the older format?

This error is actually a good thing at the moment, as Webmin probably cannot yet handle the 3.0 format..

[KitchM]

I have found that Webmin fails to put a leading # on the first line (line 0). That is the simple souce of the problem. Perhaps the folks who program would check the editing portion of the program and see that the instruction set includes adding that for syslog-ng.conf.

Also, the version number is not copied exactly correctly. Perhaps it should have been 3.0.4, rather than 3.0. Without that, the detailed reference information is lost. When dealing with computers, there must be a focus on being detail oriented. These things make me worry about the quality of the rest of the work.

Thanks.

[Eurocomp]

Has this been resolved? I have installed syslog-ng module and still get this error. Have overcome the issue by copying the config, commenting out the @ line and setting the conf path in webmin to the edited copy. Means syslog-ng loads OK but I can still get to display the logfiles via Webmin - not elegant but it works :-)

[KitchM]

I have been working with the issue of logs in general. There is obviously a lot of confusion caused by ignorance that is still existing in the industry. It is clear that we are not sure how things should be within the one logging system of syslog-ng, let alone how it interacts with other existing methodologies, whether understood or not. Assumptions are a bad thing. We need to know exactly what should be expected and the simple details of how the program works. That has not been provided.

Without this knowledge, it is reasonable that Webmin programmers cannot determine how to go about finding a quick solution to something that should be very simple. I'm willing to let Webmin off the hook on this one.

Thanks.

[Jamie Cameron]

ecsssupport - could you attach your syslog-ng config file to this bug report?

Webmin should support the new format, but I may have made a mistake in my parsing code ..

[Eurocomp]

Hi Jamie,

Below is the syslog-ng.conf that is running the deamon, to use Webmin to read the file based logs I use the second copy with the @ commented out.

@version: 3.0

#Default configuration file for syslog-ng.
#
# For a description of syslog-ng configuration file directives, please read
# the syslog-ng Administrator's guide at:
#
# http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/bk01-toc.html
#

options {
};

######
# sources
source src {
# message generated by Syslog-NG
internal();
# standard Linux log source (this is the default place for the syslog()
# function to send logs to)
unix-stream("/dev/log");
# messages from the kernel
file("/proc/kmsg" program_override("kernel: "));

};

#
# Filter definitions
#

filter f_mailinfo { level(info) and facility(mail); };
filter f_mailwarn { level(warn) and facility(mail); };
filter f_mailerr { level(err, crit) and facility(mail); };
filter f_mail { facility(mail); };

######
# destinations
destination d_messages { file("/var/log/messages"); };

#
# Mail-messages in separate files:
#
destination mailinfo { file("/var/log/mail.info"); };
log { source(src); filter(f_mailinfo); destination(mailinfo); };

destination mailwarn { file("/var/log/mail.warn"); };
log { source(src); filter(f_mailwarn); destination(mailwarn); };

destination mailerr { file("/var/log/mail.err" fsync(yes)); };
log { source(src); filter(f_mailerr); destination(mailerr); };

#
# and also all in one file:
#
# destination mail { file("/var/log/mail"); };
#
# To database
# MySQL Destination

destination d_sql {
sql(type(mysql)
host("127.0.0.1") username("********") password("************")
database("syslog")
table("messages_${HOST}_${R_YEAR}${R_MONTH}${R_DAY}")
columns("datetime varchar(16)", "host varchar(32)", "program varchar(20)",
"pid varchar(8)", "message varchar(200)")
values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSGONLY")
indexes("datetime", "host", "program", "pid", "message"));
};

log { source(src); filter(f_mail); destination(d_sql); };

# All other logging

log {
source(src);
destination(d_messages);
};

[Jamie Cameron]

syslog-ng-lib.pl

[Jamie Cameron]

Ok, thanks .. i will fix this in the next Webmin release (1.520).

Or if you want a quick fix, replace the file syslog-ng/syslog-ng-lib.pl under the Webmin root directory with the file attached to this bug report..

[Eurocomp]

Hi Jamie,

That looks good. No errors and textfile based logs are accessible.

Cheers

Dave