Difference: LibLogNorm (1 vs. 15)

Revision 152016-06-20 - ChampClark

Line: 1 to 1
 
META TOPICPARENT name="WebTopicList"

Line: 52 to 52
 $ cd liblognorm $ autoreconf -vfi $ ./configure --disable-docs
Changed:
<
<
$ make & sudo make install
>
>
$ make && sudo make install
 

Once you completed these steps, you can ./configure Sagan with liblognorm support. By re-running the Sagan ./configure, it'll detect that liblognorm is installed and use it.

Revision 142016-05-04 - ChampClark

Line: 1 to 1
 
META TOPICPARENT name="WebTopicList"

Line: 26 to 26
 

Compiling and installing liblognorm from the 'Github' tree.

Changed:
<
<
Liblognorm requires libjson-c be installed. More information about libjson-c can be found at: https://github.com/json-c/json-c

Operating System Command to install libjson-c
Gentoo emerge -av json-c
Ubuntu apt-get install libjson0 libjson0-dev
FreeBSD/OpenBSD Install from source
Fedora Core yum install json-c json-c-devel
CentOS Install from source
>
>
$ git clone https://github.com/rsyslog/libfastjson
$ cd libfastjson
$ ./autogen.sh
$ ./configure && make && sudo make install

[Note: Sagan & liblognorm no longer use libjson-c! liblognorm 1.1.3+ & Sagan 1.1.0+ use libfastjson]

  In order to install from the Github resource, open a terminal and enter these commands in this order:
Changed:
<
<
$ git clone https://github.com/rsyslog/libestr
$ cd libestr

Once in the "libestr" directory, do the following:


$ autoreconf -vfi
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install
>
>
$ git clone https://github.com/rsyslog/libestr
$ cd libestr
$ autoreconf -vfi
$ ./configure
$ make && sudo make install
  Once libestr is installed, continue with liblognorm.
Changed:
<
<
$ git clone https://github.com/rsyslog/liblognorm/
$ cd liblognorm

In the liblognorm directory, do the following:

$ autoreconf -vfi
$ ./configure --libdir=/usr/lib --includedir=/usr/include --disable-docs
$ make
$ sudo make install

>
>
$ git clone https://github.com/rsyslog/liblognorm/
$ cd liblognorm
$ autoreconf -vfi
$ ./configure --disable-docs
$ make & sudo make install

 

Once you completed these steps, you can ./configure Sagan with liblognorm support. By re-running the Sagan ./configure, it'll detect that liblognorm is installed and use it.

Deleted:
<
<
-- ChampClark - 2014-06-21
 \ No newline at end of file
Added:
>
>
-- ChampClark - 2016-05-04

Revision 132014-06-23 - ChampClark

Line: 1 to 1
 
META TOPICPARENT name="WebTopicList"

Line: 50 to 50
  In the liblognorm directory, do the following:
Changed:
<
<
$ autoreconf -vfi
$ ./configure --libdir=/usr/lib --includedir=/usr/include

>
>
$ autoreconf -vfi
$ ./configure --libdir=/usr/lib --includedir=/usr/include --disable-docs

 
$ make
$ sudo make install

Revision 122014-06-22 - ChampClark

Line: 1 to 1
 
META TOPICPARENT name="WebTopicList"

Line: 24 to 24
  You can certainly disable liblognorm at compile time, but it's advised against as liblognorm adds a lot of functionality to Sagan.
Changed:
<
<

Compiling and installing liblognorm from the 'git' tree.

>
>

Compiling and installing liblognorm from the 'Github' tree.

Liblognorm requires libjson-c be installed. More information about libjson-c can be found at: https://github.com/json-c/json-c

 
Operating System Command to install libjson-c
Gentoo emerge -av json-c

Revision 112014-06-22 - ChampClark

Line: 1 to 1
 
META TOPICPARENT name="WebTopicList"

Line: 33 to 33
 
Fedora Core yum install json-c json-c-devel
CentOS Install from source
Changed:
<
<
In order to install from the 'git' resource, open a terminal and enter these commands in this order:
>
>
In order to install from the Github resource, open a terminal and enter these commands in this order:
 
Changed:
<
<
$ git clone https://github.com/rsyslog/libestr
>
>
$ git clone https://github.com/rsyslog/libestr
$ cd libestr
 
Changed:
<
<
Switch to the new folder libestr
$ autoreconf -vfi
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install
>
>
Once in the "libestr" directory, do the following:
 
Changed:
<
<
Once libestr is installed, conitnue with liblognorm.
>
>

$ autoreconf -vfi
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install
 
Changed:
<
<
$ git clone https://github.com/rsyslog/liblognorm/
>
>
Once libestr is installed, continue with liblognorm.

$ git clone https://github.com/rsyslog/liblognorm/
$ cd liblognorm
 
Changed:
<
<
Switch to the new folder liblognorm
>
>
In the liblognorm directory, do the following:
 
Changed:
<
<
$ autoreconf -vfi
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install

>
>
$ autoreconf -vfi
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install

 

Once you completed these steps, you can ./configure Sagan with liblognorm support. By re-running the Sagan ./configure, it'll detect that liblognorm is installed and use it.

Revision 102014-06-22 - ChampClark

Line: 1 to 1
 
META TOPICPARENT name="WebTopicList"

Line: 8 to 8
 

Intro to liblognorm

Deleted:
<
<
Note: Due to API changes in liblognorm, Sagan now requires liblognorm version 1.0.0 or higher. For more more information, please see http://www.liblognorm.com/news/liblognorm-1-0-0-released/
 "liblognorm" is a log normalization library. That is, you can feed liblognorm a "log message" (think syslog or event log) and it can extract useful information from the message. Liblognorm was created by Rainer Gerhards of "Rsyslog" fame in mid-2010. It uses a simple rule syntax to extract useful information from a log message. Actually, a better way to think about it is that it uses a "masking" approach to extract information. "liblognorm" is based of the Mitre Common Event Expression Language which has not been standardized yet. While testing with Sagan, we've found liblognorm to be extremely stable, but it should be noted that since CEE is not standardized yet and it's a fairly young project, liblognorm is expected to go through changes making it a "moving target".

For a simple example of how liblognorm works, let's examine the following log message:

Line: 26 to 24
  You can certainly disable liblognorm at compile time, but it's advised against as liblognorm adds a lot of functionality to Sagan.
Deleted:
<
<
You might also want to check your operating system distribution repository for the availability of "liblognorm". For example, I know Debian has liblognorm packages available.

Compiling and installing liblognorm from the tar ball.

First, you'll need to download three tar balls. They are:

libestr
libee
liblognorm

As of liblognorm version 1.0.0, libjson-c is now required. Most distributions have packages for libjson-c. You can also built it from source from https://github.com/json-c/json-c/wiki

Operating System Command to install libjson-c
Gentoo emerge -av json-c
Ubuntu apt-get install libjson0 libjson0-dev
FreeBSD/OpenBSD Install from source
Fedora Core yum install json-c json-c-devel
CentOS Install from source

Once libjson-c is installed, we can now move forward with installation of liblognorm. The order of compiling is important, as each library depends on another...

$ tar -zxvpf libestr-{version}.tar.gz
$ cd libestr-{version}
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install

Next, do libee .....

$ tar -zxvpf libee-{version}.tar.gz
$ cd libee-{version}
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install

Finally the main library, liblognorm.....

$ tar -zxvpf liblognorm-{version}.tar.gz
$ cd liblognorm-{version}
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install

Once you completed these steps, you can ./configure Sagan with liblognorm support. By re-running the Sagan ./configure, it'll detect that liblognorm is installed and use it.

 

Compiling and installing liblognorm from the 'git' tree.

Deleted:
<
<
Since liblognorm is based on CEE and can be considered a moving target, you might want to consider using the "git" source tree. The advantage to this is that you can take advantage of any new features and/or bug fixes. During our testing with Sagan and liblognorm, we've found it extremely stable. Using the 'git' resource has the advantage of keeping up with Rainer's latest liblognorm work.

As of liblognorm version 1.0.0, libjson-c is now required. Most distributions have packages for libjson-c. You can also built it from source from https://github.com/json-c/json-c/wiki

 
Operating System Command to install libjson-c
Gentoo emerge -av json-c
Ubuntu apt-get install libjson0 libjson0-dev
Line: 87 to 35
  In order to install from the 'git' resource, open a terminal and enter these commands in this order:
Changed:
<
<
$ git clone git://git.adiscon.com/git/libestr.git

>
>
$ git clone https://github.com/rsyslog/libestr

 
Changed:
<
<
switch to the new folder libestr
>
>
Switch to the new folder libestr
 
$ autoreconf -vfi
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install
Changed:
<
<
leave that folder and repeat this step for libee
>
>
Once libestr is installed, conitnue with liblognorm.
 
Changed:
<
<
$ git clone git://git.adiscon.com/git/libee.git

>
>
$ git clone https://github.com/rsyslog/liblognorm/

 
Changed:
<
<
switch to the new folder libee
>
>
Switch to the new folder liblognorm
 
$ autoreconf -vfi
$ ./configure --libdir=/usr/lib --includedir=/usr/include

Line: 111 to 58
 $ sudo make install
Changed:
<
<
leave that folder and repeat this step again for liblognorm

$ git clone git://git.adiscon.com/git/liblognorm.git

switch to the new folder liblognorm

$ autoreconf -vfi
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install

This above was largely taken from http://www.liblognorm.com/help/first-steps-using-liblognorm/.

Once you completed these steps, you can ./configure Sagan with liblognorm support. By re-running the Sagan ./configure, it'll detect that liblognorm is installed and use it.

>
>
Once you completed these steps, you can ./configure Sagan with liblognorm support. By re-running the Sagan ./configure, it'll detect that liblognorm is installed and use it.
 
Changed:
<
<
-- ChampClark - 2014-01-27
>
>
-- ChampClark - 2014-06-21

Revision 92014-01-27 - ChampClark

Line: 1 to 1
 
META TOPICPARENT name="WebTopicList"

Line: 34 to 34
  libestr
libee
liblognorm
Changed:
<
<
Once downloaded, starting with libestr. The order of compiling is important, as each library depends on another....
>
>
As of liblognorm version 1.0.0, libjson-c is now required. Most distributions have packages for libjson-c. You can also built it from source from https://github.com/json-c/json-c/wiki

Operating System Command to install libjson-c
Gentoo emerge -av json-c
Ubuntu apt-get install libjson0 libjson0-dev
FreeBSD/OpenBSD Install from source
Fedora Core yum install json-c json-c-devel
CentOS Install from source

Once libjson-c is installed, we can now move forward with installation of liblognorm. The order of compiling is important, as each library depends on another...

 
$ tar -zxvpf libestr-{version}.tar.gz
$ cd libestr-{version}

Line: 65 to 74
 

Compiling and installing liblognorm from the 'git' tree.

Changed:
<
<
Since liblognorm is based on CEE and can be considered a moving target, you might want to consider using the "git" source tree. The advantage to this is that you can take advantage of any new features and/or bug fixes. During our testing with Sagan and liblognorm, we've found it extremely stable. However, using the 'git' resource has the advantage of keeping up with Rainer's latest liblognorm work.
>
>
Since liblognorm is based on CEE and can be considered a moving target, you might want to consider using the "git" source tree. The advantage to this is that you can take advantage of any new features and/or bug fixes. During our testing with Sagan and liblognorm, we've found it extremely stable. Using the 'git' resource has the advantage of keeping up with Rainer's latest liblognorm work.

As of liblognorm version 1.0.0, libjson-c is now required. Most distributions have packages for libjson-c. You can also built it from source from https://github.com/json-c/json-c/wiki

Operating System Command to install libjson-c
Gentoo emerge -av json-c
Ubuntu apt-get install libjson0 libjson0-dev
FreeBSD/OpenBSD Install from source
Fedora Core yum install json-c json-c-devel
CentOS Install from source
  In order to install from the 'git' resource, open a terminal and enter these commands in this order:
Line: 110 to 128
  Once you completed these steps, you can ./configure Sagan with liblognorm support. By re-running the Sagan ./configure, it'll detect that liblognorm is installed and use it.
Changed:
<
<
-- ChampClark - 2010-12-10
>
>
-- ChampClark - 2014-01-27

Revision 82013-12-09 - ChampClark

Line: 1 to 1
 
META TOPICPARENT name="WebTopicList"

Line: 8 to 8
 

Intro to liblognorm

Added:
>
>
Note: Due to API changes in liblognorm, Sagan now requires liblognorm version 1.0.0 or higher. For more more information, please see http://www.liblognorm.com/news/liblognorm-1-0-0-released/
 "liblognorm" is a log normalization library. That is, you can feed liblognorm a "log message" (think syslog or event log) and it can extract useful information from the message. Liblognorm was created by Rainer Gerhards of "Rsyslog" fame in mid-2010. It uses a simple rule syntax to extract useful information from a log message. Actually, a better way to think about it is that it uses a "masking" approach to extract information. "liblognorm" is based of the Mitre Common Event Expression Language which has not been standardized yet. While testing with Sagan, we've found liblognorm to be extremely stable, but it should be noted that since CEE is not standardized yet and it's a fairly young project, liblognorm is expected to go through changes making it a "moving target".

For a simple example of how liblognorm works, let's examine the following log message:

Revision 72013-12-06 - ChampClark

Line: 1 to 1
 
META TOPICPARENT name="WebTopicList"
Changed:
<
<

__Please Note: These instructions are for liblognorm previous to version 1.0.0. The newest version of liblognorm (1.0.0) will not work with Sagan yet. We are re-working the code to support liblognorm version 1.0.0 and should have that completed shortly. For more information, please see: http://www.liblognorm.com/news/liblognorm-1-0-0-released/__


>
>

  Installing / Configuring liblognorm.

Revision 62013-12-02 - ChampClark

Line: 1 to 1
 
META TOPICPARENT name="WebTopicList"
Added:
>
>

__Please Note: These instructions are for liblognorm previous to version 1.0.0. The newest version of liblognorm (1.0.0) will not work with Sagan yet. We are re-working the code to support liblognorm version 1.0.0 and should have that completed shortly. For more information, please see: http://www.liblognorm.com/news/liblognorm-1-0-0-released/__


 Installing / Configuring liblognorm.

Revision 52013-06-09 - ChampClark

Line: 1 to 1
 
META TOPICPARENT name="WebTopicList"
Installing / Configuring liblognorm.
Line: 6 to 6
 

Intro to liblognorm

Changed:
<
<
"liblognorm" is a log normalization library. That is, you can feed liblognorm a "log message" (think syslog or event log) and it can extract useful information from the message. liblognorm was created by Rainer Gerhards of "Rsyslog" fame in mid-2010. It uses a simple rule syntax to extract useful information from a log message. Actually, a better way to think about it is that it uses a "masking" approach to extract information. "liblognorm" is based of the Mitre Common Event Expression Language which has not been standardized yet. While testing with Sagan, we've found liblognorm to be extremely stable, but it should be noted that since CEE is not standardized yet and it's a fairly young project, liblognorm is expected to go through changes making it a "moving target".
>
>
"liblognorm" is a log normalization library. That is, you can feed liblognorm a "log message" (think syslog or event log) and it can extract useful information from the message. Liblognorm was created by Rainer Gerhards of "Rsyslog" fame in mid-2010. It uses a simple rule syntax to extract useful information from a log message. Actually, a better way to think about it is that it uses a "masking" approach to extract information. "liblognorm" is based of the Mitre Common Event Expression Language which has not been standardized yet. While testing with Sagan, we've found liblognorm to be extremely stable, but it should be noted that since CEE is not standardized yet and it's a fairly young project, liblognorm is expected to go through changes making it a "moving target".
  For a simple example of how liblognorm works, let's examine the following log message:
Line: 18 to 18
 
Invalid user %username:word% from %src-ip:ipv4% on port %src-port:number%
Changed:
<
<
Sagan uses liblognorm to extract information from log messages in order to better correlate the events. Sagan also has other methods of parsing, such as "parse_ip" or "parse_port", but liblognorm is by far the best at extracting useful information. Sagan rules ship with a standard rules and liblognorm "rulebase" files. These files end with the extension of .rulebase and are intended for liblognorm use. Sagan only uses liblognorm in certain cases, where rulebases or "masks" have been created from known log events to correlate information. That is, Sagan doesn't use liblognorm against every incoming log line because sometimes the log line might not contact information we need. In some dynamic log messages, it's better to use the "parse_ip" or "parse_port" flags within a rule.
>
>
Sagan uses liblognorm to extract information from log messages in order to better correlate the events. Sagan also has other methods of parsing, such as "parse_src_ip", "parse_dst_ip" or "parse_port", but liblognorm is by far the best at extracting useful information. Sagan rules ship with a standard rules and liblognorm "rulebase" files. These files end with the extension of .rulebase and are intended for liblognorm use. Sagan only uses liblognorm in certain cases, where rulebases or "masks" have been created from known log events to correlate information. That is, Sagan doesn't use liblognorm against every incoming log line because sometimes the log line might not contact information we need. In some dynamic log messages, it's better to use the "parse_ip" or "parse_port" flags within a rule.
  You can certainly disable liblognorm at compile time, but it's advised against as liblognorm adds a lot of functionality to Sagan.

Revision 42013-03-13 - ChampClark

Line: 1 to 1
 
META TOPICPARENT name="WebTopicList"
Changed:
<
<
Installing / Configuring liblognorm.
>
>
Installing / Configuring liblognorm.
 

Intro to liblognorm

Changed:
<
<
"liblognorm" is a log normalization library. That is, you can feed liblognorm a "log message" (think syslog or event log) and it can extract useful information from the message. liblognorm was created by Rainer Gerhards of "Rsyslog" fame in mid-2010. It uses a simple rule syntax to extract useful information from a log message. Actually, a better way to think about it is that it uses a "masking" approach to extract information. "liblognorm" is based of the Mitre Common Event Expression Language which has not been standardized yet. While testing with Sagan, we've found liblognorm to be extremely stable, but it should be noted that since CEE is not standardized yet and it's a fairly young project, liblognorm is expected to go through changes making it a "moving target".
>
>
"liblognorm" is a log normalization library. That is, you can feed liblognorm a "log message" (think syslog or event log) and it can extract useful information from the message. liblognorm was created by Rainer Gerhards of "Rsyslog" fame in mid-2010. It uses a simple rule syntax to extract useful information from a log message. Actually, a better way to think about it is that it uses a "masking" approach to extract information. "liblognorm" is based of the Mitre Common Event Expression Language which has not been standardized yet. While testing with Sagan, we've found liblognorm to be extremely stable, but it should be noted that since CEE is not standardized yet and it's a fairly young project, liblognorm is expected to go through changes making it a "moving target".
  For a simple example of how liblognorm works, let's examine the following log message:
Changed:
<
<
Invalid user bobuser from 192.168.0.1 on port 14121

>
>
Invalid user bobuser from 192.168.0.1 on port 14121

 

Even though this is a simple example, we can already see some information we might want to extract using liblognorm. The username, TCP/IP address and TCP port number in particular. To do this, we can create a simple "rule base" for liblognorm to use to extract this information. For example:

Changed:
<
<
Invalid user %username:word% from %src-ip:ipv4% on port %src-port:number%

>
>
Invalid user %username:word% from %src-ip:ipv4% on port %src-port:number%

 

Sagan uses liblognorm to extract information from log messages in order to better correlate the events. Sagan also has other methods of parsing, such as "parse_ip" or "parse_port", but liblognorm is by far the best at extracting useful information. Sagan rules ship with a standard rules and liblognorm "rulebase" files. These files end with the extension of .rulebase and are intended for liblognorm use. Sagan only uses liblognorm in certain cases, where rulebases or "masks" have been created from known log events to correlate information. That is, Sagan doesn't use liblognorm against every incoming log line because sometimes the log line might not contact information we need. In some dynamic log messages, it's better to use the "parse_ip" or "parse_port" flags within a rule.

Line: 32 to 28
  First, you'll need to download three tar balls. They are:
Changed:
<
<
libestr
libee
liblognorm
>
>
libestr
libee
liblognorm
  Once downloaded, starting with libestr. The order of compiling is important, as each library depends on another....
Changed:
<
<
$ tar -zxvpf libestr-{version}.tar.gz

>
>
$ tar -zxvpf libestr-{version}.tar.gz

 $ cd libestr-{version} $ ./configure --libdir=/usr/lib --includedir=/usr/include $ make
Line: 48 to 41
  Next, do libee .....
Changed:
<
<
$ tar -zxvpf libee-{version}.tar.gz

>
>
$ tar -zxvpf libee-{version}.tar.gz

 $ cd libee-{version} $ ./configure --libdir=/usr/lib --includedir=/usr/include $ make
Line: 58 to 50
  Finally the main library, liblognorm.....
Changed:
<
<
$ tar -zxvpf liblognorm-{version}.tar.gz

>
>
$ tar -zxvpf liblognorm-{version}.tar.gz

 $ cd liblognorm-{version} $ ./configure --libdir=/usr/lib --includedir=/usr/include $ make
Line: 74 to 65
  In order to install from the 'git' resource, open a terminal and enter these commands in this order:
Changed:
<
<
$ git clone git://git.adiscon.com/git/libestr.git

>
>
$ git clone git://git.adiscon.com/git/libestr.git

 

switch to the new folder libestr

Changed:
<
<
$ autoreconf -vfi

>
>
$ autoreconf -vfi

 $ ./configure --libdir=/usr/lib --includedir=/usr/include $ make $ sudo make install
Line: 89 to 78
  leave that folder and repeat this step for libee
Changed:
<
<
$ git clone git://git.adiscon.com/git/libee.git

>
>
$ git clone git://git.adiscon.com/git/libee.git

 

switch to the new folder libee

Changed:
<
<
$ autoreconf -vfi

>
>
$ autoreconf -vfi

 $ ./configure --libdir=/usr/lib --includedir=/usr/include $ make $ sudo make install
Line: 104 to 91
  leave that folder and repeat this step again for liblognorm
Changed:
<
<
$ git clone git://git.adiscon.com/git/liblognorm.git

>
>
$ git clone git://git.adiscon.com/git/liblognorm.git

 

switch to the new folder liblognorm

Changed:
<
<
$ autoreconf -vfi

>
>
$ autoreconf -vfi

 $ ./configure --libdir=/usr/lib --includedir=/usr/include $ make $ sudo make install

Revision 32011-03-16 - ChampClark

Line: 1 to 1
 
META TOPICPARENT name="WebTopicList"
Changed:
<
<
http://www.liblognorm.com/help/first-steps-using-liblognorm/
>
>
Installing / Configuring liblognorm.
 
Changed:
<
<
Coming soon!
>
>

Intro to liblognorm

"liblognorm" is a log normalization library. That is, you can feed liblognorm a "log message" (think syslog or event log) and it can extract useful information from the message. liblognorm was created by Rainer Gerhards of "Rsyslog" fame in mid-2010. It uses a simple rule syntax to extract useful information from a log message. Actually, a better way to think about it is that it uses a "masking" approach to extract information. "liblognorm" is based of the Mitre Common Event Expression Language which has not been standardized yet. While testing with Sagan, we've found liblognorm to be extremely stable, but it should be noted that since CEE is not standardized yet and it's a fairly young project, liblognorm is expected to go through changes making it a "moving target".

For a simple example of how liblognorm works, let's examine the following log message:

Invalid user bobuser from 192.168.0.1 on port 14121

Even though this is a simple example, we can already see some information we might want to extract using liblognorm. The username, TCP/IP address and TCP port number in particular. To do this, we can create a simple "rule base" for liblognorm to use to extract this information. For example:

Invalid user %username:word% from %src-ip:ipv4% on port %src-port:number%

Sagan uses liblognorm to extract information from log messages in order to better correlate the events. Sagan also has other methods of parsing, such as "parse_ip" or "parse_port", but liblognorm is by far the best at extracting useful information. Sagan rules ship with a standard rules and liblognorm "rulebase" files. These files end with the extension of .rulebase and are intended for liblognorm use. Sagan only uses liblognorm in certain cases, where rulebases or "masks" have been created from known log events to correlate information. That is, Sagan doesn't use liblognorm against every incoming log line because sometimes the log line might not contact information we need. In some dynamic log messages, it's better to use the "parse_ip" or "parse_port" flags within a rule.

You can certainly disable liblognorm at compile time, but it's advised against as liblognorm adds a lot of functionality to Sagan.

You might also want to check your operating system distribution repository for the availability of "liblognorm". For example, I know Debian has liblognorm packages available.

Compiling and installing liblognorm from the tar ball.

First, you'll need to download three tar balls. They are:

libestr
libee
liblognorm

Once downloaded, starting with libestr. The order of compiling is important, as each library depends on another....

$ tar -zxvpf libestr-{version}.tar.gz
$ cd libestr-{version}
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install

Next, do libee .....

$ tar -zxvpf libee-{version}.tar.gz
$ cd libee-{version}
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install

Finally the main library, liblognorm.....

$ tar -zxvpf liblognorm-{version}.tar.gz
$ cd liblognorm-{version}
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install

Once you completed these steps, you can ./configure Sagan with liblognorm support. By re-running the Sagan ./configure, it'll detect that liblognorm is installed and use it.

Compiling and installing liblognorm from the 'git' tree.

Since liblognorm is based on CEE and can be considered a moving target, you might want to consider using the "git" source tree. The advantage to this is that you can take advantage of any new features and/or bug fixes. During our testing with Sagan and liblognorm, we've found it extremely stable. However, using the 'git' resource has the advantage of keeping up with Rainer's latest liblognorm work.

In order to install from the 'git' resource, open a terminal and enter these commands in this order:

$ git clone git://git.adiscon.com/git/libestr.git

switch to the new folder libestr

$ autoreconf -vfi
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install

leave that folder and repeat this step for libee

$ git clone git://git.adiscon.com/git/libee.git

switch to the new folder libee

$ autoreconf -vfi
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install

leave that folder and repeat this step again for liblognorm

$ git clone git://git.adiscon.com/git/liblognorm.git

switch to the new folder liblognorm

$ autoreconf -vfi
$ ./configure --libdir=/usr/lib --includedir=/usr/include
$ make
$ sudo make install

This above was largely taken from http://www.liblognorm.com/help/first-steps-using-liblognorm/.

Once you completed these steps, you can ./configure Sagan with liblognorm support. By re-running the Sagan ./configure, it'll detect that liblognorm is installed and use it.

  -- ChampClark - 2010-12-10 \ No newline at end of file

Revision 22011-03-16 - ChampClark

Line: 1 to 1
 
META TOPICPARENT name="WebTopicList"
Added:
>
>
http://www.liblognorm.com/help/first-steps-using-liblognorm/
 Coming soon!

-- ChampClark - 2010-12-10 \ No newline at end of file

Revision 12010-12-10 - ChampClark

Line: 1 to 1
Added:
>
>
META TOPICPARENT name="WebTopicList"
Coming soon!

-- ChampClark - 2010-12-10

 
This site is powered by the TWiki collaboration platform Powered by PerlCopyright © 2008-2021 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback