November 1999 - syslog-ng - lists.balabit.hu

syslog-ng 1.2.2 & syslog-ng 1.3.5
by Balazs Scheidler 24 Nov '99

24 Nov '99

Hi, I have released syslog-ng 1.2.2 and syslog-ng 1.3.5. Changes in syslog-ng 1.2.2: * a small log parsing bug caused problems in Solaris STREAMS support Changes in syslog-ng 1.3.5: * A bug in UDP support caused segmentation fault immediately at startup I've removed the debian packaging files from the source distribution, because syslog-ng is now part of debian, and those files are maintained by a debian maintainer. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

RE: [syslog-ng] syslog-ng 1.3.3 on FreeBSD 3-STABLE
by Lowkrantz, Goran 23 Nov '99

23 Nov '99

Hi, Works just fine. Cheers, GLZ -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, November 23, 1999 8:36 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] syslog-ng 1.3.3 on FreeBSD 3-STABLE On Tue, Nov 23, 1999 at 08:25:26PM +0100, Lowkrantz, Goran wrote: > Hi, > > This is what I get when I run gdb on the core. It seems like the child dies, > the parent get a SIGCHLD but will continue to wait. > > GNU gdb 4.18 > Copyright 1998 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public License, and you are > welcome to change it and/or distribute copies of it under certain > conditions. > Type "show copying" to see the conditions. > There is absolutely no warranty for GDB. Type "show warranty" for details. > This GDB was configured as "i386-unknown-freebsd"... > Core was generated by `syslog-ng'. > Program terminated with signal 11, Segmentation fault. > Reading symbols from /usr/lib/libc.so.3...done. > Reading symbols from /usr/libexec/ld-elf.so.1...done. > #0 0x8050f50 in do_init_afinet_source_connection (c=0x8069188, > cfg=0x805f008, > persistent=0x0) at afinet.c:69 > 69 notice("AF_INET client connected from %S, port %i\n", > (gdb) bt oopss.. this is the problem. try to apply the following patch: --- afinet.c 1999/11/23 19:32:37 1.2 +++ afinet.c 1999/11/23 19:33:09 @@ -64,10 +64,12 @@ struct persistent_config *persistent) { CAST(afsocket_source_connection, self, c); - CAST(inet_address_info, inet, self->client_addr); - - notice("AF_INET client connected from %S, port %i\n", - inet->ip, inet->port); + if (self->client_addr) { + CAST(inet_address_info, inet, self->client_addr); + + notice("AF_INET client connected from %S, port %i\n", + inet->ip, inet->port); + } io_read(self->client, make_log_reader(1, c), make_afsocket_source_close_callback(self)); @@ -90,10 +92,13 @@ do_close_afinet_connection(struct afsocket_source_connection *c, int close_reason) { - CAST(inet_address_info, inet, c->client_addr); assert(c->owner); - notice("AF_INET client dropped connection from %S, port %i\n", - inet->ip, inet->port); + if (c->client_addr) { + CAST(inet_address_info, inet, c->client_addr); + + notice("AF_INET client dropped connection from %S, port %i\n", + inet->ip, inet->port); + } object_queue_remove(c->queue_node); c->owner->num_connections--; return ST_OK | ST_GOON; if you have no scsh installed touch afinet.c.x before trying to remake. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng] syslog-ng 1.3.3 on FreeBSD 3-STABLE
by Lowkrantz, Goran 23 Nov '99

23 Nov '99

Hi, This is what I get when I run gdb on the core. It seems like the child dies, the parent get a SIGCHLD but will continue to wait. GNU gdb 4.18 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd"... Core was generated by `syslog-ng'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/lib/libc.so.3...done. Reading symbols from /usr/libexec/ld-elf.so.1...done. #0 0x8050f50 in do_init_afinet_source_connection (c=0x8069188, cfg=0x805f008, persistent=0x0) at afinet.c:69 69 notice("AF_INET client connected from %S, port %i\n", (gdb) bt #0 0x8050f50 in do_init_afinet_source_connection (c=0x8069188, cfg=0x805f008, persistent=0x0) at afinet.c:69 #1 0x805156e in do_init_afinet_source (c=0x805f108, cfg=0x805f008, persistent=0x0) at afinet.c:270 #2 0x804a390 in do_init_group (c=0x805d2c8, cfg=0x805f008, persistent=0x0) at sources.c:222 #3 0x804bd30 in do_init_config (self=0x805f008, p=0x0) at cfgfile.c:149 #4 0x8049c28 in main (argc=1, argv=0xbfbfdabc) at main.c:268 #5 0x8049555 in _start () I will check further. Cheers, GLZ -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, November 23, 1999 8:06 PM To: syslog-ng(a)venus.terrasoft.hu Subject: Re: [syslog-ng] syslog-ng 1.3.3 on FreeBSD 3-STABLE On Tue, Nov 23, 1999 at 07:56:38PM +0100, Lowkrantz, Goran wrote: > > There seems to be somthing wrong with the forking in the new version. It > never goes deamon. > > Here are the truss lists from 1.3.1 and 1.3.4 resp. I'm currently downloading FreeBSD, so I can test this. Under Linux it works o.k. > Any ideas or pointers where to look? syslog-ng goes to background the following way: parent: read configuration if config syntactically correct then fork(); wait for SIGTERM signal child: initialize configuration (open sockets etc.) if successful; close fds 0, 1, 2, become a session leader, send SIGTERM signal to parent You can find all of this in main.c -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

syslog-ng 1.3.3 on FreeBSD 3-STABLE
by Lowkrantz, Goran 23 Nov '99

23 Nov '99

There seems to be somthing wrong with the forking in the new version. It never goes deamon. Here are the truss lists from 1.3.1 and 1.3.4 resp. 1.3.1 ======================================= # truss /usr/local/sbin/syslog-ng syscall __sysctl(0xbfbfd9c8,0x2,0x2806518c,0xbfbfd9d0,0x0,0x0) returns 0 (0x0) syscall mmap(0x0,32768,0x3,0x1002,-1,0x0) returns 671506432 (0x28066000) syscall geteuid() returns 0 (0x0) syscall getuid() returns 0 (0x0) syscall getegid() returns 0 (0x0) syscall getgid() returns 0 (0x0) syscall open("/var/run/ld-elf.so.hints",0,05001446514) returns 3 (0x3) syscall read(0x3,0xbfbfd97c,0x80) returns 128 (0x80) syscall lseek(3,0x80,0) returns 128 (0x80) syscall read(0x3,0x2806a000,0x67) returns 103 (0x67) syscall close(3) returns 0 (0x0) syscall access("/usr/lib/libc.so.3",0) returns 0 (0x0) syscall open("/usr/lib/libc.so.3",0,05001446514) returns 3 (0x3) syscall read(0x3,0xbfbfc9f8,0x1000) returns 4096 (0x1000) syscall mmap(0x0,528384,0x5,0x2,3,0x0) returns 671539200 (0x2806e000) syscall mmap(0x280db000,20480,0x3,0x12,3,0x6c000) returns 671985664 (0x280db000) syscall mmap(0x280e0000,61440,0x3,0x1012,-1,0x0) returns 672006144 (0x280e0000) syscall close(3) returns 0 (0x0) syscall readlink("/etc/malloc.conf",0xbfbfd96c,63) errno 2 'No such file or directory' syscall mmap(0x0,4096,0x3,0x1002,-1,0x0) returns 672067584 (0x280ef000) syscall break(0x8059000) returns 0 (0x0) syscall break(0x805a000) returns 0 (0x0) syscall break(0x805b000) returns 0 (0x0) syscall open("/etc/syslog-ng/syslog-ng.conf",0,0666) returns 3 (0x3) syscall break(0x8060000) returns 0 (0x0) syscall ioctl(3,TIOCGETA,0xbfbfd484) errno 25 'Inappropriate ioctl for device' syscall fstat(3,0xbfbfd400) returns 0 (0x0) syscall break(0x8062000) returns 0 (0x0) syscall read(0x3,0x8060000,0x2000) returns 2523 (0x9db) syscall read(0x3,0x8060000,0x2000) returns 0 (0x0) syscall break(0x8063000) returns 0 (0x0) syscall break(0x8064000) returns 0 (0x0) syscall break(0x8065000) returns 0 (0x0) syscall break(0x8066000) returns 0 (0x0) syscall ioctl(3,TIOCGETA,0xbfbfd478) errno 25 'Inappropriate ioctl for device' syscall close(3) returns 0 (0x0) syscall fork() returns 498 (0x1f2) syscall sigaction(0xf,0xbfbfd9e8,0xbfbfd9dc) returns 0 (0x0) syscall sigprocmask(0x1,0x0) returns 0 (0x0) SIGNAL 15 SIGNAL 15 syscall sigaction(0xf,0xbfbfd948,0xbfbfd93c) returns 0 (0x0) syscall sigreturn(0xbfbfd980) returns 0 (0x0) ======================================= 1.3.4 ======================================= # truss src/syslog-ng syscall __sysctl(0xbfbfd9d4,0x2,0x2806618c,0xbfbfd9dc,0x0,0x0) returns 0 (0x0) syscall mmap(0x0,32768,0x3,0x1002,-1,0x0) returns 671510528 (0x28067000) syscall geteuid() returns 0 (0x0) syscall getuid() returns 0 (0x0) syscall getegid() returns 0 (0x0) syscall getgid() returns 0 (0x0) syscall open("/var/run/ld-elf.so.hints",0,05001456514) returns 3 (0x3) syscall read(0x3,0xbfbfd988,0x80) returns 128 (0x80) syscall lseek(3,0x80,0) returns 128 (0x80) syscall read(0x3,0x2806b000,0x67) returns 103 (0x67) syscall close(3) returns 0 (0x0) syscall access("/usr/lib/libc.so.3",0) returns 0 (0x0) syscall open("/usr/lib/libc.so.3",0,05001456514) returns 3 (0x3) syscall read(0x3,0xbfbfca04,0x1000) returns 4096 (0x1000) syscall mmap(0x0,528384,0x5,0x2,3,0x0) returns 671543296 (0x2806f000) syscall mmap(0x280dc000,20480,0x3,0x12,3,0x6c000) returns 671989760 (0x280dc000) syscall mmap(0x280e1000,61440,0x3,0x1012,-1,0x0) returns 672010240 (0x280e1000) syscall close(3) returns 0 (0x0) syscall readlink("/etc/malloc.conf",0xbfbfd974,63) errno 2 'No such file or directory' syscall mmap(0x0,4096,0x3,0x1002,-1,0x0) returns 672071680 (0x280f0000) syscall break(0x805a000) returns 0 (0x0) syscall break(0x805b000) returns 0 (0x0) syscall break(0x805c000) returns 0 (0x0) syscall break(0x805d000) returns 0 (0x0) syscall open("/etc/syslog-ng/syslog-ng.conf",0,0666) returns 3 (0x3) syscall break(0x8062000) returns 0 (0x0) syscall ioctl(3,TIOCGETA,0xbfbfd490) errno 25 'Inappropriate ioctl for device' syscall fstat(3,0xbfbfd40c) returns 0 (0x0) syscall break(0x8064000) returns 0 (0x0) syscall read(0x3,0x8062000,0x2000) returns 2523 (0x9db) syscall read(0x3,0x8062000,0x2000) returns 0 (0x0) syscall break(0x8065000) returns 0 (0x0) syscall break(0x8066000) returns 0 (0x0) syscall break(0x8067000) returns 0 (0x0) syscall break(0x8068000) returns 0 (0x0) syscall ioctl(3,TIOCGETA,0xbfbfd484) errno 25 'Inappropriate ioctl for device' syscall close(3) returns 0 (0x0) syscall fork() returns 808 (0x328) syscall sigaction(0xf,0xbfbfd9f4,0xbfbfd9e8) returns 0 (0x0) syscall sigprocmask(0x1,0x0) returns 0 (0x0) SIGNAL 20 ======================================= Any ideas or pointers where to look? Cheers, GLZ --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

2 1

syslog-ng 1.3.4
by Balazs Scheidler 23 Nov '99

23 Nov '99

Hi, I've released syslog-ng 1.3.4, fixing the missing afsocket.h.x bug, and adding support for a max-connections option for connection-oriented protocol drivers (e.g. unix-stream & unix-dgram) This is needed to fix the recently DoS attack against syslogd discussed on bugtraq. Default limit of connections: unix-stream: 100 tcp: 10 To change this, you'll need your change your source statement: source src { unix-stream("/dev/log" max-connections(10)); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 1

syslog-ng 1.3.3
by Balazs Scheidler 23 Nov '99

23 Nov '99

Hi, I've released syslog-ng 1.3.3, which completes the afsocket reorganization I introduced in 1.3.2. It should be quite stable now. This fixes a problem with some programs dropping messages (for instance sendmail). It was caused by the fact the syslog-ng dropped all af_unix connections when sent a HUP signal. A new option was added to unix-stream and tcp: keep-alive, which is on by default for unix-stream drivers. Another bug was fixed in the $DAY macro expansion. There was a discussion recently on bugtraq about a syslogd DoS attack. The problem is fixed in distributions by switching to unix-dgram sockets from unix-stream. syslog-ng supports this switch by using another driver, so you only need to change your configuration. An alternative solution will be provided to limit the number of simultaneous connections kept open. If this limit is reached, syslog-ng will be able to send a warning message, and messages will not be simply dropped. IMHO this solution is much better, than reverting to sock_dgram. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 2

RE: [syslog-ng] syslog-ng 1.3.3
by Lowkrantz, Goran 23 Nov '99

23 Nov '99

Ok, I installed scsh but still get make: don't know how to make afsocket.h.x. Stop *** Error code 1 Cheers, GLZ -----Original Message----- From: Chris Scheller [mailto:schelcj@networkone.net] Sent: Monday, November 22, 1999 11:26 PM To: 'syslog-ng(a)venus.terrasoft.hu' Subject: RE: [syslog-ng] syslog-ng 1.3.3 I had the same problem and was told to install scsh. i did so and compile worked great. scsh can be found at ftp-swiss.ai.mit.edu/pub/su/scsh/scsh.tar.gz Chris Scheller Network One Internet, inc. http://www.networkone.net/ System/Network Administration 1.888.GOT-NET1 On Mon, 22 Nov 1999, Lowkrantz, Goran wrote: > Hi, > > I downloaded 1.3.3 but the file src/afsocket.h.x seems to be missing, so it > won't build. > > Cheers, > GLZ > > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: Monday, November 22, 1999 10:11 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] syslog-ng 1.3.3 > > > Hi, > > I've released syslog-ng 1.3.3, which completes the afsocket reorganization I > introduced in 1.3.2. It should be quite stable now. > > This fixes a problem with some programs dropping messages (for instance > sendmail). It was caused by the fact the syslog-ng dropped all af_unix > connections when sent a HUP signal. A new option was added to unix-stream > and tcp: keep-alive, which is on by default for unix-stream drivers. > > Another bug was fixed in the $DAY macro expansion. > > There was a discussion recently on bugtraq about a syslogd DoS attack. The > problem is fixed in distributions by switching to unix-dgram sockets from > unix-stream. syslog-ng supports this switch by using another driver, so you > only need to change your configuration. > > An alternative solution will be provided to limit the number of simultaneous > connections kept open. If this limit is reached, syslog-ng will be able to > send a warning message, and messages will not be simply dropped. IMHO this > solution is much better, than reverting to sock_dgram. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Re: syslog-ng digest, Vol 1 #109 - 6 msgs
by Christopher James THOMPSON 23 Nov '99

23 Nov '99

Hi syslog-ng Anyone had any luck getting scsh ??? I ran 'site idle 7200' and still get timeouts !!! > get scsh-0.5.1.tar.gz Receiving file: scsh-0.5.1.tar.gz 0 1468685 bytes. ETA: --:--Er ror: Error occurred during read! Reason: Connection timed out ** Aborting Transfer ** Transfer aborted. Data connection closed. 0% 0 > 1468685 bytes. ETA:769:55 scsh-0.5.1.tar.gz: 1448 bytes received in 45.61 seconds, 31.75 Bytes/s. ftp-swiss.ai.mit.edu /pub/su/scsh ftp-swiss> Kind Regards Chris Thompson syslog-ng-admin(a)venus.terrasoft.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the web, visit > http://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > You can reach the person managing the list at > syslog-ng-admin(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific than > "Re: Contents of syslog-ng digest..." > > Today's Topics: > > 1. syslog-ng 1.3.3 (Balazs Scheidler) > 2. RE: syslog-ng 1.3.3 (Lowkrantz, Goran) > 3. RE: syslog-ng 1.3.3 (Chris Scheller) > 4. RE: syslog-ng 1.3.3 (Lowkrantz, Goran) > 5. Re: syslog-ng 1.3.3 (Chris Scheller) > 6. Re: syslog-ng 1.3.3 (Chris Scheller) > > --__--__-- > > Message: 1 > Date: Mon, 22 Nov 1999 22:11:14 +0100 > From: Balazs Scheidler <bazsi(a)balabit.hu> > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] syslog-ng 1.3.3 > Reply-To: syslog-ng(a)lists.balabit.hu > > Hi, > > I've released syslog-ng 1.3.3, which completes the afsocket reorganization I > introduced in 1.3.2. It should be quite stable now. > > This fixes a problem with some programs dropping messages (for instance > sendmail). It was caused by the fact the syslog-ng dropped all af_unix > connections when sent a HUP signal. A new option was added to unix-stream > and tcp: keep-alive, which is on by default for unix-stream drivers. > > Another bug was fixed in the $DAY macro expansion. > > There was a discussion recently on bugtraq about a syslogd DoS attack. The > problem is fixed in distributions by switching to unix-dgram sockets from > unix-stream. syslog-ng supports this switch by using another driver, so you > only need to change your configuration. > > An alternative solution will be provided to limit the number of simultaneous > connections kept open. If this limit is reached, syslog-ng will be able to > send a warning message, and messages will not be simply dropped. IMHO this > solution is much better, than reverting to sock_dgram. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > --__--__-- > > Message: 2 > From: "Lowkrantz, Goran" <Goran.Lowkrantz(a)infologigruppen.se> > To: "'syslog-ng(a)venus.terrasoft.hu'" <syslog-ng(a)venus.terrasoft.hu> > Subject: RE: [syslog-ng] syslog-ng 1.3.3 > Date: Mon, 22 Nov 1999 22:48:14 +0100 > charset="windows-1252" > Reply-To: syslog-ng(a)lists.balabit.hu > > Hi, > > I downloaded 1.3.3 but the file src/afsocket.h.x seems to be missing, so it > won't build. > > Cheers, > GLZ > > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: Monday, November 22, 1999 10:11 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] syslog-ng 1.3.3 > > Hi, > > I've released syslog-ng 1.3.3, which completes the afsocket reorganization I > introduced in 1.3.2. It should be quite stable now. > > This fixes a problem with some programs dropping messages (for instance > sendmail). It was caused by the fact the syslog-ng dropped all af_unix > connections when sent a HUP signal. A new option was added to unix-stream > and tcp: keep-alive, which is on by default for unix-stream drivers. > > Another bug was fixed in the $DAY macro expansion. > > There was a discussion recently on bugtraq about a syslogd DoS attack. The > problem is fixed in distributions by switching to unix-dgram sockets from > unix-stream. syslog-ng supports this switch by using another driver, so you > only need to change your configuration. > > An alternative solution will be provided to limit the number of simultaneous > connections kept open. If this limit is reached, syslog-ng will be able to > send a warning message, and messages will not be simply dropped. IMHO this > solution is much better, than reverting to sock_dgram. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > --__--__-- > > Message: 3 > Date: Mon, 22 Nov 1999 14:26:27 -0800 (PST) > From: Chris Scheller <schelcj(a)networkone.net> > To: "'syslog-ng(a)venus.terrasoft.hu'" <syslog-ng(a)venus.terrasoft.hu> > Subject: RE: [syslog-ng] syslog-ng 1.3.3 > Reply-To: syslog-ng(a)lists.balabit.hu > > I had the same problem and was told to install scsh. i did so and compile > worked great. scsh can be found at > ftp-swiss.ai.mit.edu/pub/su/scsh/scsh.tar.gz > > Chris Scheller > Network One Internet, inc. > http://www.networkone.net/ > System/Network Administration > 1.888.GOT-NET1 > > On Mon, 22 Nov 1999, Lowkrantz, Goran wrote: > > > Hi, > > > > I downloaded 1.3.3 but the file src/afsocket.h.x seems to be missing, so it > > won't build. > > > > Cheers, > > GLZ > > > > -----Original Message----- > > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > > Sent: Monday, November 22, 1999 10:11 PM > > To: syslog-ng(a)lists.balabit.hu > > Subject: [syslog-ng] syslog-ng 1.3.3 > > > > > > Hi, > > > > I've released syslog-ng 1.3.3, which completes the afsocket reorganization I > > introduced in 1.3.2. It should be quite stable now. > > > > This fixes a problem with some programs dropping messages (for instance > > sendmail). It was caused by the fact the syslog-ng dropped all af_unix > > connections when sent a HUP signal. A new option was added to unix-stream > > and tcp: keep-alive, which is on by default for unix-stream drivers. > > > > Another bug was fixed in the $DAY macro expansion. > > > > There was a discussion recently on bugtraq about a syslogd DoS attack. The > > problem is fixed in distributions by switching to unix-dgram sockets from > > unix-stream. syslog-ng supports this switch by using another driver, so you > > only need to change your configuration. > > > > An alternative solution will be provided to limit the number of simultaneous > > connections kept open. If this limit is reached, syslog-ng will be able to > > send a warning message, and messages will not be simply dropped. IMHO this > > solution is much better, than reverting to sock_dgram. > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > > url: http://www.balabit.hu/pgpkey.txt > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > --__--__-- > > Message: 4 > From: "Lowkrantz, Goran" <Goran.Lowkrantz(a)infologigruppen.se> > To: "'syslog-ng(a)venus.terrasoft.hu'" <syslog-ng(a)venus.terrasoft.hu> > Subject: RE: [syslog-ng] syslog-ng 1.3.3 > Date: Tue, 23 Nov 1999 01:18:52 +0100 > charset="windows-1252" > Reply-To: syslog-ng(a)lists.balabit.hu > > Ok, I installed scsh but still get > > make: don't know how to make afsocket.h.x. Stop > *** Error code 1 > > Cheers, > GLZ > > -----Original Message----- > From: Chris Scheller [mailto:schelcj@networkone.net] > Sent: Monday, November 22, 1999 11:26 PM > To: 'syslog-ng(a)venus.terrasoft.hu' > Subject: RE: [syslog-ng] syslog-ng 1.3.3 > > I had the same problem and was told to install scsh. i did so and compile > worked great. scsh can be found at > ftp-swiss.ai.mit.edu/pub/su/scsh/scsh.tar.gz > > Chris Scheller > Network One Internet, inc. > http://www.networkone.net/ > System/Network Administration > 1.888.GOT-NET1 > > On Mon, 22 Nov 1999, Lowkrantz, Goran wrote: > > > Hi, > > > > I downloaded 1.3.3 but the file src/afsocket.h.x seems to be missing, so > it > > won't build. > > > > Cheers, > > GLZ > > > > -----Original Message----- > > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > > Sent: Monday, November 22, 1999 10:11 PM > > To: syslog-ng(a)lists.balabit.hu > > Subject: [syslog-ng] syslog-ng 1.3.3 > > > > > > Hi, > > > > I've released syslog-ng 1.3.3, which completes the afsocket reorganization > I > > introduced in 1.3.2. It should be quite stable now. > > > > This fixes a problem with some programs dropping messages (for instance > > sendmail). It was caused by the fact the syslog-ng dropped all af_unix > > connections when sent a HUP signal. A new option was added to unix-stream > > and tcp: keep-alive, which is on by default for unix-stream drivers. > > > > Another bug was fixed in the $DAY macro expansion. > > > > There was a discussion recently on bugtraq about a syslogd DoS attack. The > > problem is fixed in distributions by switching to unix-dgram sockets from > > unix-stream. syslog-ng supports this switch by using another driver, so > you > > only need to change your configuration. > > > > An alternative solution will be provided to limit the number of > simultaneous > > connections kept open. If this limit is reached, syslog-ng will be able to > > send a warning message, and messages will not be simply dropped. IMHO this > > solution is much better, than reverting to sock_dgram. > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > > url: http://www.balabit.hu/pgpkey.txt > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > --__--__-- > > Message: 5 > Date: Mon, 22 Nov 1999 16:44:54 -0800 (PST) > From: Chris Scheller <schelcj(a)networkone.net> > To: syslog-ng(a)venus.terrasoft.hu > cc: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng] syslog-ng 1.3.3 > Reply-To: syslog-ng(a)lists.balabit.hu > > Is it possible ( and i just missed it ) to do a destination like this > destination test { file("/var/log/syslog-ng/$YEAR/$MONTH/$HOST-$DAY"); }; > using the macros to create directories? > > Chris Scheller > Network One Internet, inc. > http://www.networkone.net/ > System/Network Administration > 1.888.GOT-NET1 > > On Mon, 22 Nov 1999, Balazs Scheidler wrote: > > > Hi, > > > > I've released syslog-ng 1.3.3, which completes the afsocket reorganization I > > introduced in 1.3.2. It should be quite stable now. > > > > This fixes a problem with some programs dropping messages (for instance > > sendmail). It was caused by the fact the syslog-ng dropped all af_unix > > connections when sent a HUP signal. A new option was added to unix-stream > > and tcp: keep-alive, which is on by default for unix-stream drivers. > > > > Another bug was fixed in the $DAY macro expansion. > > > > There was a discussion recently on bugtraq about a syslogd DoS attack. The > > problem is fixed in distributions by switching to unix-dgram sockets from > > unix-stream. syslog-ng supports this switch by using another driver, so you > > only need to change your configuration. > > > > An alternative solution will be provided to limit the number of simultaneous > > connections kept open. If this limit is reached, syslog-ng will be able to > > send a warning message, and messages will not be simply dropped. IMHO this > > solution is much better, than reverting to sock_dgram. > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > > url: http://www.balabit.hu/pgpkey.txt > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > --__--__-- > > Message: 6 > Date: Mon, 22 Nov 1999 16:44:54 -0800 (PST) > From: Chris Scheller <schelcj(a)networkone.net> > To: syslog-ng(a)venus.terrasoft.hu > cc: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng] syslog-ng 1.3.3 > Reply-To: syslog-ng(a)lists.balabit.hu > > Is it possible ( and i just missed it ) to do a destination like this > destination test { file("/var/log/syslog-ng/$YEAR/$MONTH/$HOST-$DAY"); }; > using the macros to create directories? > > Chris Scheller > Network One Internet, inc. > http://www.networkone.net/ > System/Network Administration > 1.888.GOT-NET1 > > On Mon, 22 Nov 1999, Balazs Scheidler wrote: > > > Hi, > > > > I've released syslog-ng 1.3.3, which completes the afsocket reorganization I > > introduced in 1.3.2. It should be quite stable now. > > > > This fixes a problem with some programs dropping messages (for instance > > sendmail). It was caused by the fact the syslog-ng dropped all af_unix > > connections when sent a HUP signal. A new option was added to unix-stream > > and tcp: keep-alive, which is on by default for unix-stream drivers. > > > > Another bug was fixed in the $DAY macro expansion. > > > > There was a discussion recently on bugtraq about a syslogd DoS attack. The > > problem is fixed in distributions by switching to unix-dgram sockets from > > unix-stream. syslog-ng supports this switch by using another driver, so you > > only need to change your configuration. > > > > An alternative solution will be provided to limit the number of simultaneous > > connections kept open. If this limit is reached, syslog-ng will be able to > > send a warning message, and messages will not be simply dropped. IMHO this > > solution is much better, than reverting to sock_dgram. > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > > url: http://www.balabit.hu/pgpkey.txt > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > --__--__-- > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > End of syslog-ng Digest

1 0

RE: [syslog-ng] syslog-ng 1.3.3
by Lowkrantz, Goran 22 Nov '99

22 Nov '99

Hi, I downloaded 1.3.3 but the file src/afsocket.h.x seems to be missing, so it won't build. Cheers, GLZ -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, November 22, 1999 10:11 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng 1.3.3 Hi, I've released syslog-ng 1.3.3, which completes the afsocket reorganization I introduced in 1.3.2. It should be quite stable now. This fixes a problem with some programs dropping messages (for instance sendmail). It was caused by the fact the syslog-ng dropped all af_unix connections when sent a HUP signal. A new option was added to unix-stream and tcp: keep-alive, which is on by default for unix-stream drivers. Another bug was fixed in the $DAY macro expansion. There was a discussion recently on bugtraq about a syslogd DoS attack. The problem is fixed in distributions by switching to unix-dgram sockets from unix-stream. syslog-ng supports this switch by using another driver, so you only need to change your configuration. An alternative solution will be provided to limit the number of simultaneous connections kept open. If this limit is reached, syslog-ng will be able to send a warning message, and messages will not be simply dropped. IMHO this solution is much better, than reverting to sock_dgram. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

预定春节火车票
by hello 21 Nov '99

21 Nov '99

预定春节火车票，请电26368636咨询

1 0