February 2000 - syslog-ng - lists.balabit.hu

new destination-file with group zzz
by Wolfgang Koessler 03 Nov '00

03 Nov '00

hello, I have some problems with the group of new destination-files of syslog-ng-1.3.13: my logrotate creats immediately after rotation the new log file: ~~~~~~~~~~~ /var/log/ns/f/newfile.log{ daily notifempty create 640 root zzz postrotate /usr/bin/killall -HUP syslog-ng endscript } ~~~~~~~~~~~ When syslog-ng writes in newfile.log, the group changes to "root". Can I specify in the sylog-ng.conf the group-affilation of the destination-file? Apart from this problem syslog-ng works fine! Thanks! wok ~~~ Wolfgang Kössler ZID Universität Innsbruck http://infoA.uibk.ac.at/c102/

2 1

Re: [syslog-ng] message numbers
by Terje Krogdahl 03 Mar '00

03 Mar '00

Balazs Scheidler <bazsi(a)balabit.hu> writes: > what is this message number? A serial number? Actually it is a sequence number. I see it when my Cisco routers log via syslog. The number is incremented by one every time a router sends a syslog message. Very useful to detect missing log entries, among other things. Here's a hex dump of a complete packet, in case this helps clear things up: 0: 0800 2083 600e 0000 0c76 bf10 0800 4500 .. .`....v....E. 16: 0094 0182 0000 fe11 1690 8243 4ffc 8243 ...........CO..C 32: 4fc4 1ac4 0202 0080 302f 3c31 3930 3e33 O.......0/<190>3 48: 3536 313a 2046 6562 2032 3620 3232 3a33 561: Feb 26 22:3 64: 393a 3138 2e32 3132 3a20 2553 4543 2d36 9:18.212: %SEC-6 80: 2d49 5041 4343 4553 534c 4f47 503a 206c -IPACCESSLOGP: l 96: 6973 7420 3132 3020 6465 6e69 6564 2074 ist 120 denied t 112: 6370 cp ... which produces the following syslog message. Note that I have removed the hostname and part of the message stating IP addresses. Feb 26 22:33:46 xxxxxxx.xx.telenor.net 3561: Feb 26 22:39:18.212: %SEC-6-IPACCESSLOGP: list 120 denied tcp... Syslog-ng is running under Solaris 2.6. -- Terje Krogdahl Nextra AS - I don't buy from spammers.

4 6

sun-stream problem with syslog-ng on Solaris
by Simon Yang 28 Feb '00

28 Feb '00

Hi folks, I compiled syslog-ng 1.4.0rc2 on Solaris 2.6. When I tried to start syslog-ng, I got the following error: # ./syslog-ng sun-streams support not compiled in (STREAM=/dev/log) Error initializing configuration, exiting. Terminated Did I miss some config parameter when I compiled syslog-ng? Attached is the content of the syslog-ng.conf: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination all { file("/var/log/messages"); }; log { source(local); destination(all); }; Any help will be greatly appreciated.

3 2

message numbers
by Terje Krogdahl 25 Feb '00

25 Feb '00

Hi! I'm in the progress of replacing Suns syslogd with syslog-ng 1.4.0rc2. I'm sure this is an FAQ, but how can I make it include message numbers? With Sun syslogd I get: Feb 23 13:17:58 hostname 1288115: the_message_itself but with syslog-ng I only get: Feb 23 13:17:58 hostname : the_message_itself The number "1288115" is missing, and I cannot figure out how to configure syslog-ng to include it. Unfortunately, I really need this number for post-processing of logs... Any suggestions? -- Terje Krogdahl Nextra AS - I don't buy from spammers.

4 3

syslog-ng 1.4.0rc3
by Balazs Scheidler 25 Feb '00

25 Feb '00

Hi, You'll find rc3 at the usual place (http://www.balabit.hu/products/syslog-ng) Here's my changelog: 2000-02-25 Balazs Scheidler <bazsi(a)balabit.hu> * src/filters.c (do_filter_pri): split this to two functions, priorities are filtered by 8 bits, where the bit position denotes the value of the priority (0-7), at facilities bit position denotes an index to the sl_facilities array, (do_filter_lev): new function, (do_filter_fac) new function * src/cfg-grammar.y: changed the way valid masks are composed for facility/priority filters, display warnings when a priority/facility is unknown, added possibility to select a facility code by number. * src/log.c (parse_log_msg): don't remove programname from the whole message, set programname to "kernel" when a message comes from LOG_KERN facility (needed for SunOS) * src/cfg-lex.l: IDENTIFIER regex fix. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog-ng 1.4.0rc2
by Balazs Scheidler 25 Feb '00

25 Feb '00

Hi, I've released syslog-ng version 1.4.0rc2, fixing all known bugs in previous versions. I've also reorganized the downloads tree, each major version has a distinct directory, and libol was moved up in the directory hierarchy. My website in currently syncing, but as soon as this is completed you'll find 1.4.0rc2 here: http://www.balabit.hu/downloads/syslog-ng/1.4/syslog-ng-1.4.0rc2.tar.gz and libol: http://www.balabit.hu/downloads/libol/0.2/libol-0.2.16.tar.gz -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 3

Re: 1.4.0 rc2 bug
by Balazs Scheidler 23 Feb '00

23 Feb '00

> The .. (DOTDOT) range operator for priority filters seems to be broken with > this release. try this patch: Index: cfg-lex.l =================================================================== RCS file: /home/bazsi/cvs/syslog-ng/src/cfg-lex.l,v retrieving revision 1.8 diff -u -r1.8 cfg-lex.l --- cfg-lex.l 2000/02/22 17:50:29 1.8 +++ cfg-lex.l 2000/02/23 10:24:15 @@ -142,7 +142,7 @@ 0x{digit}+ { yylval.num = strtol(yytext, NULL, 16); return NUMBER; } 0{digit}+ { yylval.num = strtol(yytext, NULL, 8); return NUMBER; } {digit}+ { yylval.num = atoi(yytext); return NUMBER; } -({word}+(\.)?)* { return check_reserved_words(yytext); } +({word}+(\.)?)*{word}+ { return check_reserved_words(yytext); } \( { return '('; } \) { return ')'; } \; { return ';'; } -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Filter troubles
by Brad Arlt 22 Feb '00

22 Feb '00

I am having some difficulty understanding filters. (syslog-ng 1.3.17) I am trying to replicate Solaris's syslog.conf entry: *.err;kern.debug;daemon.notice;auth.err;news.none;user.none as far as I can tell this translates to: filter filname { priority(panic, alert, crit, error) and not facility(user, news); }; which is also the same as filter filname { priority(panic, alert, crit, error) and not facility(user) and not facility(news); }; kern doesn't seem to be logging at all... if I drop facility checking then kern logs.... Any thoughts? Also I noticed that there is a range operator (..) but the above priority(panic, alert, crit, error) does not seem to be the same as priority(panic..error). Am I right in thinking that (..) is broken or am misunderstanding what (..) does. ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_)

6 13

syslog-ng 1.3.17 a.k.a. 1.4.0rc1
by Balazs Scheidler 22 Feb '00

22 Feb '00

Hi, I've released release candidate 1 for 1.4.0 as 1.3.17. I've tried to fix all bugs encountered until now. If you find any showstopper bugs, please tell me about it. http://www.balabit.hu/products/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 3

syslog-ng 1.3.15 compile fails on FreeBSD 3.2R
by George Madden 18 Feb '00

18 Feb '00

I just tried compiling syslog-ng 1.3.15 with libol 0.2.14 on a FreeBSD 3.2R box and it fails with the following: affile.c: In function `do_open_file': affile.c:52: storage size of `st' isn't known affile.c:54: warning: implicit declaration of function `stat' affile.c:55: warning: implicit declaration of function `S_ISDIR' affile.c:61: warning: implicit declaration of function `mkdir' affile.c:52: warning: unused variable `st' *** Error code 1

2 4