August 1999 - syslog-ng - lists.balabit.hu

Got 1.1.31 running on FreeBSD3
by Lowkrantz, Goran 14 Aug '99

14 Aug '99

Hi, I got the 1.1.31 version up and running on FreeBSD 3.1R and 3.2S with two small glitches. 1: src/config.h: #define HAVE_MODERN_UTMP 0 2: When compiling util.c I get the following messages. gcc -DHAVE_CONFIG_H -I. -I/usr/home/glz/work.d/syslog-ng-1.1.31/src -I. -O2 -Wall -I/usr/local/include/libol -c utils.c In file included from utils.c:32: /usr/include/arpa/inet.h:89: warning: parameter has incomplete type /usr/include/arpa/inet.h:92: warning: parameter has incomplete type /usr/include/arpa/inet.h:96: warning: parameter has incomplete type I will track them down later today if no-one have a quick answer. The tests I have made so far work OK. Cheers, Goran L --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

1 0

Re: Re: Syslog-ng: [wishlitst ;)] make it color. :)
by Siddall 12 Aug '99

12 Aug '99

>On Sat, Jul 31, 1999 at 11:24:11PM +0200, Dawid Kuroczko wrote: >> Hello! >> >> I have a suggestion, a feature I'd really like to see in a syslog >> daemon, but I haven't found do far. Please make it use ANSI color >> escapes ("\033[31;41;1m") while presenting messages to console, >> for example to make important messages red, standard grey and >> network green. I think it should be configurable, but I don't >> know where. :) Maybe a special color foo { ... } section, or >> maybe special additions in destination bar { ... } ? I think >> you're the best person to decide. I'm sorry I cannot send you >> a patch, but I'm to weak at C, unfortunately. :) > >Hi, > >I think this will be possible with the rewrite rules to be introduced in the >1.3.x series, but you'll have to wait for that a bit. > >-- >Bazsi >PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD >804E C82C 8EB1 > url: http://www.balabit.hu/pgpkey.txt I am new to this program, and new to the Linux world in general (6 days old) however I have this to offer: I would like to propose a small amendment to that idea. Simply allow user definable message PREFIX (msgpfx) and SUFIXs (msgsfx) that would automatically be appended onto the alert. Allow this to be done in the destination field so that you have the most control. Then the config file might look something like this. destination tty1 { msgpfx("\[\033[34m\]**ALERT!!!**"); msgsfx("**ALERT!!!**\[\033[0m\]); pipe("/dev/tty1"); usertty("administrator"); }; -Corbin B. Siddall, MCSE, CCNA

1 0

syslog-ng 1.1.31 && Solaris 2.6 SPARC
by Erik M. Beebe 12 Aug '99

12 Aug '99

Hello; I have recently installed syslog-ng 1.1.31 && libol-0.2.3 on a machine running SPARC Solaris 2.6; If I connect to port 514/UDP using NetCat, syslog-ng logs it just fine. If I try to use "logger" locally, it does not. Here are my source lines: source stdlog { sun-streams("/dev/log" door("/etc/.syslog_door")); }; source src { internal(); udp(ip(0.0.0.0) port(514)); }; I don't believe it's any problems with the destination/filter/log lines causing this problem -- it looks like syslog-ng just isn't getting what is sent to /dev/log. Anyone have any idea what could be causing this? Thanks much in advance, Erik -- Erik M. Beebe Infinet System Administrator Phone: (757) 664-2227 Email: ebeebe(a)infi.net http://www.infi.net

1 0

Re: [syslog-ng] Compile Error for syslog-ng-1.1.30
by Balazs Scheidler 11 Aug '99

11 Aug '99

On Fri, Aug 06, 1999 at 02:28:19PM +0900, bazsi wrote: > > > < static utmp ut; > > > --- > > > > static struct utmp ut; > > > > getutent() emulation for systems which not have one is still broken in at > > least one way. getutent() should return NULL when the EOF is reached. > > Though I don't understand C language very well... > > If read() read EOF then return (ssize_t)NULL. It's right. > But, Can I hope stored NULL to &ut by read() at the time? No. I have fixed it now. But Solaris should support getutent() calls, so you don't need those routines. This is the correct getutent() call for those interested: struct utmp *getutent(void) { static struct utmp ut; if (utent_fd == -1) { utent_fd = open(_PATH_UTMP, O_RDONLY | O_NOCTTY); } if (utent_fd == -1) return NULL; rc = read(utent_fd, &ut, sizeof(ut)); if (rc <= 0) { close(utent_fd); utent_fd = -1; return NULL; } else { return &ut; } } > > Could you provide some messages before the first door_return call? Maybe in > > a private message. > > OK. The following is what I Executed commands. > > # cp /dev/null /var/log/test.log > # ls -l /var/log/test.log > -rw-r--r-- 1 root other 0 Aug 6 13:41 /var/log/test.log > # /usr/local/sbin/syslog-ng > Terminated > # su - > # su - > # ps -ef | grep syslog-ng > root 21724 1 0 13:43:29 ? 0:00 /usr/local/sbin/syslog-ng > # cat /var/log/test.log > Aug 6 13:43:29 src@sun1 syslog-ng[21724]: syslog-ng version 1.1.30 starting I'd need a bit different truss outputs. 1) Launch syslog-ng using the truss -o syslog-ng.truss ./syslog-ng -dv Using -dv will prevent forking. 2) While the previous truss is running, on a different terminal (or VT session): truss -o logger.truss logger "This is a message" The files syslog-ng.truss and logger.truss is what I need. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

syslog-ng 1.1.31
by Balazs Scheidler 07 Aug '99

07 Aug '99

Hi, To fix the encountered build bugs in 1.1.30, I release 1.1.31. I tried to track the memory leak someone has mentioned, but it simply doesn't leak for me. I sent syslog-ng 100 simoultenious connections, 1000 messages each connection, from both local programs, and from network connections. It doesn't grow. Maybe who reported this, doesn't run the latest version? I've also released a new version of libol, though not much is changed there. A few error messages have been changed to be only verbose messages. Here's the changelog: 1999-08-07 Balazs Scheidler <bazsi(a)balabit.hu> * afuser.c: works on old utmp structures too (NetBSD) * configure.in: added test for modern utmp structure, bumped version number, changed required libol version to 0.2.3 * utils.c: fixed a bug in getutent() implementation * main.c: fixed a bug in SIGTERM handling, exit message is now displayed I've also updated the .deb packages, they are exact copies of what I am using on my computer. You can find this at the usual places: http://www.balabit.hu/products/syslog-ng and http://www.balabit.hu/downloads/syslog-ng Have fun! PS: I am going to a canoe tour next week, so I won't be able to respond to my mail. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Compile Error for syslog-ng-1.1.30
by georg.funke＠netcologne.de 06 Aug '99

06 Aug '99

Hi, when i try to syslog-ng-1.1.30, i get the following error: utils.c: In function `getutent': utils.c:70: syntax error before `ut' utils.c:77: `ut' undeclared (first use in this function) utils.c:77: (Each undeclared identifier is reported only once utils.c:77: for each function it appears in.) utils.c:79: warning: control reaches end of non-void function My System is Redhat 6.0 with kernel 2.2.10 and the compiler is gcc-2.95. Can you help me why i get this error? Thanks Georg -- Georg Funke Crowns & Flames SDC Cologne, Germany; http://www.geocities.com/Colosseum/4893 "Friendship is Square Dancing's greatest Reward"

3 4

syslog-ng 1.1.30
by Balazs Scheidler 04 Aug '99

04 Aug '99

Hi, I have released syslog-ng 1.1.30 and the corresponding libol version 0.2.2. Changes include: * Sun-Streams support cleaned up, it does compile (and it is really compiled in), and should work, but it's now completely untested. Please report success/failure you may had. * NetBSD didn't have getutent() calls, so I implemented them in utils.c. Again this is untested, I have no *BSD machines lieing around. Nothing has changed in libol, only a new symbol has been made public. You can find these at the usual place: http://www.balabit.hu/products/syslog-ng And the tarballs & pgp signatures at: http://www.balabit.hu/downloads/syslog-ng/source -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

Re: syslog-ng memory usage
by Balazs Scheidler 04 Aug '99

04 Aug '99

On Tue, Aug 03, 1999 at 09:05:04AM -0400, mr(a)noc.1st.net wrote: > Here's what it looked like today: > > root 13410 0.3 54.2 70452 69716 ? S Aug02 5:00 syslog-ng > > I've attached the conf file. What kind of system do you have? I mean is it Linux or something else? I tried to track down that memory leak, but syslog-ng was not growing at all for any of the stresstests I used. (I tried both the file and the udp source driver, and file destination driver) I see the following possibilities: 1) your malloc() implementation in the libc doesn't like fragmentation. syslog-ng allocates lots of memory blocks, but frees them as well, maybe your malloc() implementation may have problems with fragmented memory. You may have a look at GNU Malloc, which is AFAIR available separate from libc, and can be compiled to a standalone shared lib. 2) The output queues of syslog-ng begin to fill up, because it is unable to handle the load. This should not be a problem though, since by default the output queues are 100 entries long for each file. (using 200 bytes as an estimated length of a message we get 20*100*200 = 400000 Bytes for twenty file destinations) 3) The libc itself leaks somewhere. I use GNU libc 2.1.1, GNU/Linux Debian, potato distribution. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

.. beginner question src Sol 7 (intel)
by Werner Dundler 04 Aug '99

04 Aug '99

hello after trying to get a usefull logging with the standart solaris syslog i removed that damn program and install the newest version of syslog-ng. i compiled it (straight) using gcc and took a basic configuration and changed it. but i ran into one trouble.... my syslog-ng deamon runs fine and when i send a -HUP to it i get a nice message that syslog-ng initiolized a new configuration. but i can´t get it to log system messages. i used: source src { unix-stream("/dev/log"); internal(); }; and source src { unix-stream("/etc/.syslog_door"); internal(); }; i tested both configurations with # logger -t auth.debug "bla" .. but never got a response into my logfile. system is a solaris 7 intel machine. filter and log for auth.* should be up and running .... does anybody know what i did wrong ? ciao and thx werner

2 1

Syslog ng 1.1.29 under Solaris 7
by Rob See 04 Aug '99

04 Aug '99

I've been attempting to get syslog-ng to run under solaris 7, and have been running into the same problems that were mentioned in a previous message. The config script seems to only be checking for stropts.h and not strlog.h, so the sun-stream support isn't getting compiled in no matter what. When I change afstream.c so that it will compile that support in, it has problems with tmp not being defined. the line "char tmp[MAX_LINE + 1]" around line 70 is commented out. When I uncomment it, it compiles, but segfaults any time a message is sent to it in _vformat_length. Does anyone have any ideas that could help ? -Rob See

1 0