July 1999 - syslog-ng - lists.balabit.hu

Re: syslog-ng parser bug?
by Balazs Scheidler 19 Jul '99

19 Jul '99

On Mon, Jul 19, 1999 at 07:11:55PM +0200, Rolf Offermanns wrote: > Hi Balazs! > I think I have found a bug in the config file parser in 1.2.27. > I will try to describe it as exactly as my english allows me to... Thanks for the report. The problem was that the first few bytes of those variable names were the same, so the same filter rule was applied to both log statement. Try this patch: --- syslog-ng-1.1.27/src/cfgfile.c Sat Jul 10 17:58:33 1999 +++ syslog-ng/src/cfgfile.c Mon Jul 19 23:38:44 1999 @@ -18,7 +18,7 @@ * * Inspired by nsyslog, originally written by Darren Reed. * - * $Id: cfgfile.c,v 1.17 1999/07/10 15:58:33 bazsi Exp $ + * $Id: cfgfile.c,v 1.18 1999/07/18 12:56:11 bazsi Exp $ * ***************************************************************************/ @@ -62,7 +62,8 @@ #define RESOLVE_VAR(s, first, next, i) \ for (s = first; s; s = s->next) { \ - if (strncmp(i->name->data, s->name->data, i->name->length) == 0) { \ + if (i->name->length == s->name->length && \ + strncmp(i->name->data, s->name->data, i->name->length) == 0) { \ i->ref = (struct ol_object *) s; \ break; \ } \ @@ -154,7 +155,7 @@ self->init = do_init_config; self->destroy = do_destroy_config; self->backend = backend; - self->sync_freq = 1; + self->sync_freq = 0; self->mark_freq = 1200; /* 20 minutes */ self->long_hostnames = 1; self->time_reopen = 60; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: bug?
by Balazs Scheidler 18 Jul '99

18 Jul '99

Hi, Thanks for reporting this. I am going to fix these as soon as I'll have some time. On Wed, Jul 14, 1999 at 10:15:06AM -0700, joeym(a)inficad.com wrote: > Sorry to bother you again, but I have noticed some strange behavior when > logging over TCP. > > Client Machine is BSDI 4.0 running syslog-ng. 'Server' machine is > FreeBSD 3.2-STABLE running syslog-ng and receiving UDP, TCP, and local > syslog msgs. When the client machine sends messages via UDP back to the > server machine, the server machine sees the tag as the correct hostname. > When the messages are sent from the client -> server via TCP, then the > server marks those messages as coming from its own hostname, and not the > client's hostname. > > Also, I noticed that sending SIGHUP to syslog-ng on the BSDI client > machine causes this message (in debug mode) to be sent : > new configuration initialized > io_iter(): no waiting fds and no callouts! exiting... > > and then it exits.. If i SIGHUP syslog-ng on the 'server' machine, it > reloads its config and moves happily on. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 1

Re: Small conf suggestion
by Balazs Scheidler 13 Jul '99

13 Jul '99

On Mon, Jul 12, 1999 at 09:01:21PM -0700, joey miller wrote: > I'm currently evaluating syslog-ng for use as a central syslog server in > our facilities, and have come across something that may cut down similar > setups (config file wise) like what I'm implementing by a large margin. > > I plan to have multiple hosts log back to a single syslog-ng server, and > am going to keep each machine/Cisco's logs seperated in a structure such > as: > /var/log/machine1.inficad.com/messages > /var/log/machine1.inficad.com/daemon.log > /var/log/routerX.inficad.com/messages > .. etc .. > > However, I've noticed it's going to require multiple (somewhat redundant) > destination {} entries to get this going the way I'd like. What I was > thinking was something along the lines of allowing a replacable string in > a file(); definition. For example, I could do: > > destination d_auth { file("/var/log/$HOST/auth.log"); }; > > This would allow me to have a single entry for the d_auth destination, > instead of requiring a seperate destination{} entry for each machine + log > level. > > If there is something like this available already, please let me know, as > I'm still exploring the syslog-ng package and haven't even begun to > exploit its full potential yet. It is not available yet, but as it has already been suggested by at least 3 people, I'll implement this in 1.3.x series. For now you have to stick to several destination fields. To make this problem easier to maintain, simply write a shell script or such to generate the config file. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: [syslog-ng] syslog-ng 1.1.27
by Ispanovits imre 11 Jul '99

11 Jul '99

Balazs Scheidler, SZO, 10 JÚL 1999-n írta: >>Hello, > >I have released version 1.1.27 aka 1.2.0rc1 of syslog-ng and the >corresponding libol versioned 0.2.0. I worked on this release a lot to >make it as bugfree as possible, and make installation flawless. T > >Syslog-ng is available at the usual places: > >http://www.balabit.hu/downloads/syslog-ng/source/ > >The official webpage is at: > >http://www.balabit.hu/products/syslog-ng/ >^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Hali! Biztos, hogy kint van? Miért nem látom? Imre ----------------------------------------------------------------- Cyrix 6x86 PR200MX/Amptron PM9900A/80MB/QFB EL5.1A/R6 6.0/2.2.9/KDE-1.1.1 -----------------------------------------------------------------

1 0

Archive test
by Balazs Scheidler 11 Jul '99

11 Jul '99

Archiver test, sorry for inconvinence

1 0

Archive test
by root 11 Jul '99

11 Jul '99

Archiver test, sorry for inconvinence

1 0