May 1999 - syslog-ng - lists.balabit.hu

UDP problems with 1.1.14
by Scott Dellinger 15 May '99

15 May '99

Having had success running syslog-ng 1.1.14 locally, I tried just now setting it up to receive messages via UDP, but I can't get it to work. Using the output of 'lsof' as a guide, I can see that the UDP port is opened, but once I send syslog-ng a message from a remote machine, the message "vanishes" and the UDP port is closed, though the program continues to run and accept local messages. -- Scott Dellinger Systems Administrator, JMU Technical Services dellinsd(a)jmu.edu

2 5

Source IP of UDP packets
by Asmodeus 13 May '99

13 May '99

Unless I'm really wrong (and my IP logger is more broken than I thought), doesn't: inet_ntoa(packet.ip.ip_src); give you the source IP (in a nice, readable string form)? Garnered from the Linux UDP header file. .Shawn

2 1

poll() system call emulation in libc (linux)
by Balazs Scheidler 11 May '99

11 May '99

Hi, It turned out recently that the Linux libc (2.0.7 or below) emulation of poll system call is buggy. If it passed -1 as timeout (infinite), it returns immediately. This may cause bad behaviour of syslog-ng or lsh, if compiled under these systems. Future versions of libol will have a workaround this bug. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

some questions
by Pavel Golubev 11 May '99

11 May '99

Hi all, I see that version 14 version does not support "sync" now ( -/var/log/xxx.log alternative in standard syslogd). As a rule a big logging may incredible slow down logstation without "-" mode. It's too bad for central logstation. Next. Standard syslogd writes "host" field correct - corresponding to client name, but remote client's messages in syslog-ng always looks like "srcname/syslog-ng_server_name". It's too hard for admin to separate logfiles visually. For last :) Can somebody give me _working_ example of log separating by remote hostname or IP address. It's not trivial for me :) PS: all _announced_ features works fine for me, including UDP remote logging with "program" and "match" filters. Thanks to autor. --- Pavel Golubev PG810-RIPE Global Ukraine Inc.

2 3

running environment
by Arek Jankowski 10 May '99

10 May '99

Hello, What environment do you people use for building and running syslog-ng? I use gcc 2.7.2.3 and linux 2.0.29 libc5 system and have only segfaults when try to run this program. Has it got any requirements concerning the system libraries? --- Arek J.

2 3

Re: [syslog-ng] syslog-ng 1.1.12 problem
by s 09 May '99

09 May '99

Hello, thank you for this tip. I could compile that code but i have got another problem now. ---- root@shell [/home/spy/syslog-ng-1.1.14]# syslog-ng **** syslog-ng: error in loading shared libraries: libol.so.0: cannot open shared object file: No such file or directory **** root@shell [/home/spy/syslog-ng-1.1.14]# id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) root@shell [/home/spy/syslog-ng-1.1.14]# ls -l src/syslog-ng -rwxr-xr-x 1 root root 51147 May 7 10:42 src/syslog-ng* root@shell [/home/spy/syslog-ng-1.1.14]# --------- checking for getopt_long... yes checking libol version == 0.1.10... ok updating cache ./config.cache ----------- root@shell [/home/spy/syslog-ng-1.1.14]# whereis libol.so.0 libol.so: /usr/local/lib/libol.so.0 /usr/local/lib/libol.so root@shell [/home/spy/syslog-ng-1.1.14]# ls -l /usr/local/lib/libol.so.0 lrwxrwxrwx 1 root root 14 May 7 10:41 /usr/local/lib/libol.so.0 -> libol.so.0.0.0* root@shell [/home/spy/syslog-ng-1.1.14]# ls -l /usr/local/lib/libol.so.0.0.0 -rwxr-xr-x 1 root root 40523 May 7 10:41 /usr/local/lib/libol.so.0.0.0* root@shell [/home/spy/syslog-ng-1.1.14]# ----------- Can someone help me please? thank you, Osman Taskin >Grab the latest version 1.1.14 (fixed compile error) you'll also need to >get updated libol as well. >--Jubal --- Jubal Kessler, Chief Systems Administrator, interQ Incorporated PGP Key Fingerprint: 5D32 BEB1 8E4B B454 6B9A FDCD 2D4C 19DD 9B47 7DC4 On Fri, 7 May 1999, s wrote: > > Hello there, > > i have got RH52 with 2.2.3-5 kernel and i always had problems with compiling > syslog. Can someone gimme a tip what to fix, so > i can compile it please?

2 4

syslog-ng-1.1.14
by s 08 May '99

08 May '99

Hello, i have installed s.1.1.4 and libol0.10 on my other RH5.2 (Kernel 2.0.36) box. its the same result; libol.so.0: cannot open shared object file: No such file or directory i tried that on 2 different boxes and kernels. Its the same. I wonder why noone reported that before. can someone else confirm that or do i make something wrong? regards, osman taskin

1 0

1.1.14 being bashful?
by Justin Wienckowski 08 May '99

08 May '99

Hey all, Recently downloaded, compiled, and installed syslog-ng 1.1.14 and libol. After a few mistarts with the config file, syslog-ng started up without any error messages. However, it doesn't appear that any messages are actually getting logged. None of the logfiles specified recieve data nor are they opened. The only files syslog-ng seems to open are two sockets, /dev/tty10, and /dev/tty9. Any ideas? My config file is attached. -Justin Wienckowski jwiencko(a)vt.edu ---syslog-ng.conf--- # # /etc/syslog-ng/syslog-ng.conf # # Last update: 1999 04 07 # # sources source src { udp 0.0.0.0,512; unix-stream /dev/log; internal; }; # destinations destination console { file /dev/console; }; destination kernel_log { file /var/log/kernel.log; }; destination secure_log { file /var/log/secure.log; }; destination ssh_log { file /var/log/ssh.log; }; destination mail_log { file /var/log/mail.log; }; destination ftp_log { file /var/log/ftp.log; }; destination msgs_log { file /var/log/messages.log; }; destination crit_log { file /var/log/crit.log; }; destination log_term { file /dev/tty10; }; destination secure_term { file /dev/tty9; }; # filters filter kernel { facility(kern) or program("kernel"); }; filter mail { facility(mail) or program("qmail"); }; filter ftp { program(".*ftpd"); }; filter ssh { match("ssh.*"); }; filter secure { ( facility(authpriv) or match("Overseer") ) and not match("ssh.*"); }; filter crit { priority(crit); }; filter other { not ( facility(kern) or facility(mail) or facility(authpriv) ) or match("Overseer"); }; # loging directives log { source src; filter other; destination msgs_log; destination log_term; }; log { source src; filter kernel; destination kernel_log; }; log { source src; filter mail; destination mail_log; }; log { source src; filter ftp; destination ftp_log; }; log { source src; filter ssh; destination ssh_log; }; log { source src; filter secure; destination secure_log; destination secure_term; }; log { source src; filter crit; destination console; destination crit_log; };

2 2

syslog-ng 1.1.14 and the promised host filter
by Balazs Scheidler 07 May '99

07 May '99

Hi, I have released syslog-ng 1.1.14 which implements two additional filters, which you can use to direct log messages: host(regexp) match against the source hostname (where the message came from) with this you can use syslog-ng as a central log host match(regexp) match against the content of the log message And the implementation of program() has been changed, so that it uses regexps too. I have found the hopefully last leak in syslog-ng, which caused it to eat some memory when HUP signals were sent to it. This version requires libol 0.1.10. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

2 1

host & match filter in cvs
by Balazs Scheidler 06 May '99

06 May '99

Hi, For those interested I added the following filters to syslog-ng: host(regexp) - filters based on the host part of a log message match(regexp) - filters based on message contents And changed the program filter to use regexps instead of simple strings. CVS instructions can be found on the web page. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0