March 2000 - syslog-ng - lists.balabit.hu

new destination-file with group zzz
by Wolfgang Koessler 03 Nov '00

03 Nov '00

hello, I have some problems with the group of new destination-files of syslog-ng-1.3.13: my logrotate creats immediately after rotation the new log file: ~~~~~~~~~~~ /var/log/ns/f/newfile.log{ daily notifempty create 640 root zzz postrotate /usr/bin/killall -HUP syslog-ng endscript } ~~~~~~~~~~~ When syslog-ng writes in newfile.log, the group changes to "root". Can I specify in the sylog-ng.conf the group-affilation of the destination-file? Apart from this problem syslog-ng works fine! Thanks! wok ~~~ Wolfgang Kössler ZID Universität Innsbruck http://infoA.uibk.ac.at/c102/

2 1

syslog-ng under HP-UX 10.20
by Gero Krueger 28 Mar '00

28 Mar '00

Hello snort-users ! I tried to compile syslog-ng-1.4.2 under HP-UX 10.20 (using gcc 2.8). During the linker process, I realized that there is no snprintf (and vsnprintf) function in the libc. Does anyone know a solution for this ? -- < Gero Krueger | DeTeCSM > < Tel. : +49-541-333-2488 | IVS Osnabrueck > < Fax : +49-541-333-2940 | Hannoversche Str. 6-8 > < mailto: krueger(a)obk.telekom.de | 49084 Osnabrueck >

4 9

Re: syslog-ng
by Balazs Scheidler 25 Mar '00

25 Mar '00

> > Great program from what I have read so far. Just installed it. I was > curious if there were any plans to add an option to syslog-ng.conf > under DESTINATIONS: > > * mail <email address> - Emails specified logs to user. you can easily achieve this using the program() destination. Write a simple shell script: #!/bin/sh while read line; do echo $line | mail root(a)domain.com done -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog and syslog-ng together
by Gero Krueger 23 Mar '00

23 Mar '00

Hello snort-users ! I've got another interesting issue here: I set up syslog-ng on a solaris-2.6-box running together with the standard syslog. syslog-ng only forwards everything (/dev/log) to another loghost via tcp - this works fine. All messages are logged locally and on the remote loghost. Trying this under Linux 2.2.13, syslog and syslog-ng end up in some kind of race condition (messages are spread between them). Is there any way to get these two working at the same time like under solaris ? -- < Gero Krueger | DeTeCSM > < Tel. : +49-541-333-2488 | IVS Osnabrueck > < Fax : +49-541-333-2940 | Hannoversche Str. 6-8 > < mailto: krueger(a)obk.telekom.de | 49084 Osnabrueck >

1 0

syslog-ng 1.4.1
by Balazs Scheidler 20 Mar '00

20 Mar '00

Hi, I've released syslog-ng 1.4.1. This time I announce it to this list only, and if no bugs show up in two-three days, the announcement goes up to freshmeat. I've fixed a couple of bugs in this release: * fixed a filter evaluation bug (not in 'or' and 'and') * configuration file reading with syntax errors * pipe() cleanup This driver readds the requirement for GNU flex. I need a way to reinitialize lex buffers, and I know how to do that only with GNU flex (yyreinit(), patches to support other lex versions are welcome) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

3 2

syslog-ng on AIX 4.x
by Ohrberg, Mick 16 Mar '00

16 Mar '00

Dear syslog-ng users, Is there anyone out there who has successfully installed and used syslog-ng on an AIX machine? I use it in Solaris 2.6, and it works great! As a Solaris-user, I really don't know where to look for the syslog-equivalent in AIX. Syslog-ng compiles great under AIX, but using the logger doesn't give me the expected result... Anyone? Thanks in advance! -- Mick Öhrberg EMTS System Administrator, UMB (816)860-1064

1 0

sendmail with syslog-ng
by Simon Yang 15 Mar '00

15 Mar '00

Hi folks, I installed syslog-ng 1.3.14 under Solaris 2.6 and used the following config file source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination syslog { file("/var/tmp/syslog.trc"); program("/usr/lib/sendmail john(a)company.com"); }; log { source(local); destination(syslog); }; I expect that emails should only be sent to john(a)company.com when an error message occurs. With the current implementation of the syslog-ng, only one messages is sent out containing the whole syslog.trc that is defined in the config file when the syslog-ng is started. Obviously, something is wrong. Is this a feature or bug with syslog-ng or the config file was not configured correctly. Any help will be greatly appreciated.

1 0

Odd error
by Hamilton, Andrew Mr. 15 Mar '00

15 Mar '00

Hi, I'm relatively new to syslog-ng and have been working with it constantly over the last couple of weeks trying to get it to work with my systems. For the most part I have had no problems, or very few but now I am getting an odd error. I am running it on a Sun Solaris 5.6 and have run it on other systems identical to this system but I am getting this error: Error creating AF_INET socket (Error 0) Error initializing configuration, exiting. I've checked my config file and it doesn't appear to be messed up. Any ideas? Thanks Drew

2 1

RE: syslog-ng digest, Vol 1 (Cu)167 - 4 msgs
by Nick Hindley 10 Mar '00

10 Mar '00

This message has been automatically generated. I am out of the office from 6 March 2000 for approximately two weeks. To contact me before my return, please resend your message to nick.hindley(a)ukgateway.net

1 0

Small log entries are discarded in 1.4.0
by Jeffrey W. Baker 09 Mar '00

09 Mar '00

Hi there, I have found another serious bug in the 1.4.0 syslog-ng code. Actually the bug is in libol. The log is configured to read log entries from a named pipe, write them to a local file, and forward them to a remote machine which writes them to a file. The input testing program is writing log entries which are four bytes: three bytes of integers and a carraige return. The problem is that syslog-ng is throwing away most of these entries. It reads 1024 bytes from the input pipe. 1024 bytes is 256 log entries. It then takes 100 of these entries and puts them in the log queue. These 100 are logged properly, and then another 1024 bytes are read from the pipe. The remaining 156 log entries from the original read are simply overwritten. I believe the solution would be to write log entries into the queue until the input buffer is empty. Any other way will result in the loss of log entries. Perhaps I will have a patch for this later. Also, I found another small bug in src/sources.c. On line 128, memcpy is used to copy memory between overlapping regions. At least on Linux, memcpy should not be used to copy between overlapping regions. memmove() should be used instead. Cheers, Jeffrey

2 1