April 1999 - syslog-ng - lists.balabit.hu

spam
by spy 19 Apr '99

19 Apr '99

------Transcript of session follows ------- syslog-ng(a)vekoll.saturnus.vein.hu 550 <spy(a)twilight.webbernet.net>... No spam please Subject: remote logging Date: Sat, 17 Apr 1999 08:43:33 +0200 From: s <spy(a)twilight.webbernet.net> To: syslog-ng(a)vekoll.saturnus.vein.hu References: 1 ello, what do you think about a new option in syslog-ng? I though "remote logging" could be very usefull. If someone hacks one system the first thing he will do is to clean the logs. Its very easy to clean the logs because they are in plain ascii format. If you could improve syslog-ng so that it can log remotly, intruders cannot clean the logs and its very easy to exemine the logs and trace him. What do u think about this improvement? spy(a)exploits.to Ì got these mail back, cuz of spam. Please configure your mailing-list better regards, spy

2 1

Re: [syslog-ng] main.c.x missing?
by Scott Dellinger 16 Apr '99

16 Apr '99

On Fri, 16 Apr 1999, Tommi Virtanen wrote: > > > After you install scsh, run make -C src main.c.x > > > - creating that is missing from the Makefiles. > > Umm... reread my last sentence. I can't compile scsh -- there are a > > number of compiler errors. The only RPM I can find is old and doesn't work > > right on my system. Could you just send the main.c.x file? It shouldn't > > be more than a few lines long; I think it only has one class definition in > > it. > Ouch. Misparsed "but it" as "but it [syslog-ng] still.." I figured that's what you had thought. > Here you go. [code snipped] *Much* better. :) Thanks; now it compiles happily. -- Scott Dellinger Systems Administrator, JMU Technical Services dellinsd(a)jmu.edu

1 0

main.c.x missing?
by Scott Dellinger 16 Apr '99

16 Apr '99

I am having problems compiling syslog-ng 1.1.7. Should main.c.x have been included in the distribution? Without it, 'make' tries to call 'make_class', which doesn't work since I don't have scsh. I actually tried installing scsh, but it doesn't compile cleanly on my RedHat 5.2 system. -- Scott Dellinger Systems Administrator, JMU Technical Services dellinsd(a)jmu.edu

2 2

syslog-ng 1.1.7 released
by Balazs Scheidler 15 Apr '99

15 Apr '99

Hi, I have released version 1.1.7 and libol 0.1.4. I added support for udp and tcp sources, and added a program filter, which filters messages based on program name. In addition it is now possible to restart syslog-ng by sending it a HUP signal. Except for sending messages over the network, all syslogd functionality is in place. I am thinking about builtin support for logfile rotation. One could specify rotation parameters in destination statements: destination d_messages { file /var/log/messages rotate(weekly, 9) compress }; What do you think? -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

4 5

Mailman upgrade
by Balazs Scheidler 12 Apr '99

12 Apr '99

Hi, Due to several bugs in our listprocessor mailman 1.0b6, I upgraded to mailman 1.0b11, which seems much more stable. Sadly enough mailman has binary config files, and for several reasons I couldn't simply copy the old configuration to the new one, thus I resubscribed everyone by hand. So you do not need to subscribe again, but any personal settings & passwords have been lost. If you want to modify your settings, simply go to the list preferences page at: http://vekoll.vein.hu/mailman/listinfo Choose the "Email my password" button, and as you have your password, set your preferences as you like it. If you have any problems, please send me them at: bazsi(a)balabit.hu -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

Mailman upgrade
by Balazs Scheidler 12 Apr '99

12 Apr '99

Hi, Due to several bugs in our listprocessor mailman 1.0b6, I upgraded to mailman 1.0b11, which seems much more stable. Sadly enough mailman has binary config files, and for several reasons I couldn't simply copy the old configuration to the new one, thus I resubscribed everyone by hand. So you do not need to subscribe again, but any personal settings & passwords have been lost. If you want to modify your settings, simply go to the list preferences page at: http://vekoll.vein.hu/mailman/listinfo Choose the "Email my password" button, and as you have your password, set your preferences as you like it. If you have any problems, please send me them at: bazsi(a)balabit.hu -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng 1.1.6 & libol 0.1.3
by Balazs Scheidler 11 Apr '99

11 Apr '99

Hi, I released $SUBJECT, which implements filtering syntax as suggested Richi Plana <richip(a)mozcom.com>, and fixes some of the build problems reported earlier. You can find them at the usual places. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

Question on semantics
by Richi Plana 11 Apr '99

11 Apr '99

Hi, Not to mean to be nitpicking, but the original syslog man pages state that priority is defined to be: priority ::= facility . level So shouldn't the config semantics be: filter f_messages { ( level(info) or level(notice) or level(warn) ) and not facility(auth) and not facility(authpriv) and not facility(cron) and not facility(daemon) and not facility(mail) and not facility(news); }; or better yet, filter f_messages { level(info,notice,warn..crit) and not facility(auth,authpriv,cron,daemon,mail,news); }; L L Richi Plana 8^) ,-,-. ,-,-. ,-,-. ,-,-. ,- LL LL Systems Administrator / / \ \ / / \ \ / / \ \ / / \ \ / / LLLLL Mosaic Communications, Inc. \ \ / / \ \ / / \ \ / / \ \ / / LLLLL mailto:richip@mozcom.com `-'-' `-'-' `-'-' `-'-' ------PGP key http://www2.mozcom.com/~richip/richip.asc ----------------

2 2

libol 0.1.1 compile problem and a suggestion
by Richi Plana 11 Apr '99

11 Apr '99

You wrote: |o| I have released $SUBJ, though did not announce them widely, only on |o| this list. I worked on parsing and evaluating filter statements. The new |o| syntax will be similar to function calls: I tried compiling libol-0.1.1 on a RH5.2 Linux system and came up with the ff. error: make[1]: Entering directory `/home/richip/src/libol-0.1.2/src' cd /home/richip/src/libol-0.1.2 && autoheader /usr/bin/autoheader: Symbol `HAVE_ATTRIBUTE' is not covered by /usr/lib/autoconf/acconfig.h ./acconfig.h I am not familiar with autoconf and I'm hoping someone on the list could tell me what to do. I did see the ff. line in the output of 'configure': checking for __attribute__... yes and thought it would be safe to add '#define HAVE_ATTRIBUTE 1' in ./acconfig.h . Was that bad? |o| The only issue left is how to deal with priorities. Original |o| syslogd accepts a message above or equal to the a specific |o| priority (and not only the specific priority). I may add an |o| optional parameter to priority() so that the relation could also |o| be specified: |o| |o| priority(info, GE) How about a level range specified using the '..' operator: priority(debug..notice,err,alert..) L L Richi Plana 8^) ,-,-. ,-,-. ,-,-. ,-,-. ,- LL LL Systems Administrator / / \ \ / / \ \ / / \ \ / / \ \ / / LLLLL Mosaic Communications, Inc. \ \ / / \ \ / / \ \ / / \ \ / / LLLLL mailto:richip@mozcom.com `-'-' `-'-' `-'-' `-'-' ------PGP key http://www2.mozcom.com/~richip/richip.asc ----------------

2 1

Link to new conf style on web page is wrong
by Richi Plana 11 Apr '99

11 Apr '99

Hi, On the syslog-ng web page, the link to the new conf style is: http://www.balabit.hu/products/syslog-ng.conf.sample-1.1 when it actually is: http://www.balabit.hu/products/syslog-ng.sample-1.1 L L Richi Plana 8^) ,-,-. ,-,-. ,-,-. ,-,-. ,- LL LL Systems Administrator / / \ \ / / \ \ / / \ \ / / \ \ / / LLLLL Mosaic Communications, Inc. \ \ / / \ \ / / \ \ / / \ \ / / LLLLL mailto:richip@mozcom.com `-'-' `-'-' `-'-' `-'-' ------PGP key http://www2.mozcom.com/~richip/richip.asc ----------------

1 0