May 2000 - syslog-ng - lists.balabit.hu

new destination-file with group zzz
by Wolfgang Koessler 03 Nov '00

03 Nov '00

hello, I have some problems with the group of new destination-files of syslog-ng-1.3.13: my logrotate creats immediately after rotation the new log file: ~~~~~~~~~~~ /var/log/ns/f/newfile.log{ daily notifempty create 640 root zzz postrotate /usr/bin/killall -HUP syslog-ng endscript } ~~~~~~~~~~~ When syslog-ng writes in newfile.log, the group changes to "root". Can I specify in the sylog-ng.conf the group-affilation of the destination-file? Apart from this problem syslog-ng works fine! Thanks! wok ~~~ Wolfgang Kössler ZID Universität Innsbruck http://infoA.uibk.ac.at/c102/

2 1

Syslog-ng Dies - core dump
by John Wingenbach 07 Jun '00

07 Jun '00

I just installed and configured syslog-ng 1.4.3 on a Solaris 2.6 system. It cores out on startup. It apparently doesn't like part of my configuration. Debug output is: #> /opt/syslog-ng/sbin/syslog-ng -d -v binding fd 5, inetaddr: 0.0.0.0, port: 514 io.c: Preparing fd 5 for reading syslog-ng version 1.4.3 starting Segmentation Fault(coredump) My configuration is (Note below the comments regarding code which if removed allows it to live): source s_all { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; # Level Filters filter f_info { level(info .. emerg); }; filter f_warning { level(warning .. emerg); }; filter f_debug { level(debug .. emerg); }; filter f_crit { level(crit .. emerg); }; filter f_err { level(err .. emerg); }; filter f_emerg { level(emerg); }; # Facility Filters filter f_user { facility(user); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon); }; filter f_auth { facility(auth); }; filter f_lpr { facility(lpr); }; filter f_news { facility(news); }; filter f_kern { facility(kern); }; filter f_uucp { facility(uucp); }; filter f_cron { facility(cron); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # Complex Filters filter f_mailerror { filter (f_mail) and filter (f_err); }; filter f_axsyslog { filter (f_info) or filter(f_mailerror); }; ------ It would seem that the following filters used to build a summary syslog cause the problem. ------ filter f_errsanuser { filter (f_err) and not facility(user); }; filter f_kerndebug { filter (f_kern) and filter (f_debug); }; filter f_mailwarning { filter (f_mail) and filter (f_warning); }; filter f_summary { filter (f_errsanuser) or filter (f_kerndebug) or filter (f_daemon) or filter (f_mailwarning); }; destination d_all { file("/var/log/messages"); }; destination d_ttys { usertty("*"); }; destination d_console { file ("/dev/console"); }; destination d_kernfile { file ("/var/log/kern"); }; destination d_syslogfile { file ("/var/log/syslog"); }; destination d_userfile { file ("/var/log/user"); }; destination d_mailfile { file ("/var/log/mail"); }; destination d_mailcritfile { file ("/var/log/mail.crit"); }; destination d_mailwarnfile { file ("/var/log/mail.warning"); }; destination d_daemonfile { file ("/var/log/daemon"); }; destination d_daemonwarningfile { file ("/var/log/daemon.warning"); }; destination d_authfile { file ("/var/log/auth"); }; destination d_lprfile { file ("/var/log/lpr"); }; destination d_newsfile { file ("/var/log/news"); }; destination d_uucpfile { file ("/var/log/uucp"); }; destination d_cronfile { file ("/var/log/cron"); }; destination d_local0file { file ("/var/log/local0"); }; destination d_local1file { file ("/var/log/local1"); }; destination d_local2file { file ("/var/log/local2"); }; destination d_local3file { file ("/var/log/local3"); }; destination d_local4file { file ("/var/log/local4"); }; destination d_local5file { file ("/var/log/local5"); }; destination d_local6file { file ("/var/log/local6"); }; destination d_local7file { file ("/var/log/local7"); }; destination d_axentsyslog { file ("/axent/ita/system/falcon/syslog"); }; destination d_axentmail { file ("/axent/ita/system/falcon/syslog.mdbg"); }; log { source(s_all); filter (f_kern); filter (f_debug); destination (d_kernfile); }; log { source(s_all); filter (f_user); filter (f_debug); destination (d_userfile); }; log { source(s_all); filter (f_mail); filter (f_debug); destination (d_mailfile); }; log { source(s_all); filter (f_mail); filter (f_crit); destination (d_mailcritfile); }; log { source(s_all); filter (f_mail); filter (f_warning); destination (d_mailwarnfile); }; log { source(s_all); filter (f_daemon); filter (f_debug); destination (d_daemonfile); }; log { source(s_all); filter (f_daemon); filter (f_warning); destination (d_daemonwarningfile); }; log { source(s_all); filter (f_auth); filter (f_debug); destination (d_authfile); }; log { source(s_all); filter (f_lpr); filter (f_debug); destination (d_lprfile); }; log { source(s_all); filter (f_news); filter (f_debug); destination (d_newsfile); }; log { source(s_all); filter (f_uucp); filter (f_debug); destination (d_uucpfile); }; log { source(s_all); filter (f_cron); filter (f_debug); destination (d_cronfile); }; log { source(s_all); filter (f_local0); destination (d_local0file); }; log { source(s_all); filter (f_local1); filter (f_debug); destination (d_local1file); }; log { source(s_all); filter (f_local2); destination (d_local2file); }; log { source(s_all); filter (f_local3); destination (d_local3file); }; log { source(s_all); filter (f_local4); filter (f_debug); destination (d_local4file); }; log { source(s_all); filter (f_local5); filter (f_debug); destination (d_local5file); }; log { source(s_all); filter (f_local6); filter (f_debug); destination (d_local6file); }; log { source(s_all); filter (f_local7); filter (f_debug); destination (d_local7file); }; log { source(s_all); filter (f_axsyslog); destination (d_axentsyslog); }; log { source(s_all); filter (f_mail); filter (f_debug); destination (d_axentmail); }; log { source(s_all); filter (f_summary); destination (d_syslogfile); }; -- John C. Wingenbach Pliant Systems, Inc. Sr. Systems Administrator Work: (919) 405-4627 Fax: (919) 405-4544

4 19

RE: [syslog-ng] Ignoring previously handled/filtered messages
by Ohrberg, Mick 02 Jun '00

02 Jun '00

IMHO, I WANT the messages to go to several logfiles. For instance, I want a message mail.fatal to go to the fatal logfile as well as the mail logfile. This way I can trigger on messages in the fatal logfile, look in the mail logfile and see if there were any messages in from mail that lead up to the fatal situation. However, when you do the same thing loggin to a remote host, this procedure results in four (!) messages being generated. A better way to handle 'double' messages would be very very nice. : -----Original Message----- : From: John Goggan [mailto:jgoggan@dcg.com] : Sent: Wednesday, May 24, 2000 4:46 PM : To: syslog-ng(a)venus.terrasoft.hu : Subject: Re: [syslog-ng] Ignoring previously handled/filtered messages : : : : ger wrote: : > try : > filter f_daemon { facility(daemon) and not program(name);}; : > : > where "name" is whatever program you're trying to filter out. : : Thanks to Ger and Ilya for their responses. While this does : work, it really : seems like a poor way to do it to me -- and, I believe, is : also quite a bit : different from the way standard syslog handles things. The : problem is that it : should just be easy to make it so that messages are handled : only ONCE and then : not sent to additional logs unless specifically desires. How : many people : really want the same syslog message sent to multiple logs : most of the time? : It just seems that the default (which does this) is the : opposite of what most : would want. : : Plus, what needs to be done to get around this just doesn't : make any sense. : This means that if I want separate logs for imapd, named, : telnetd, and ftpd : (to name just a few common daemons) -- and I want any other : daemons that pop : up to still go to a daemon.log, I have to do this in my : filter section: : : filter f_imapd { program("imapd"); }; : filter f_named { program("named"); }; : filter f_telnetd { program("telnetd"); }; : filter f_ftpd { program("ftpd"); }; : filter f_auth { facility(auth) : and not program("imapd") : and not program("named") : and not program("telnetd") : and not program("ftpd"); }; : filter f_daemon { facility(daemon) : and not program("imapd") : and not program("named") : and not program("telnetd") : and not program("ftpd"); }; : filter f_messages { level(info..warn) : and not facility(auth, authpriv, mail, news); : and not program("imapd") : and not program("named") : and not program("telnetd") : and not program("ftpd"); }; : : That just seems like a really bad design! I have to make : sure that I keep all : of the names updated in several different locations. If I : want to add a log : for just one more daemon, I have to add it to at least 3 : other filters besides : its own filter! : : Aren't other people experiencing such problems? Or is no one : out there using : syslog-ng to filter out specific daemons while still catching : the unlisted : daemons in a daemon.log file? : : There must be a better way... : : - John... : : _______________________________________________ : syslog-ng maillist - syslog-ng(a)lists.balabit.hu : http://lists.balabit.hu/mailman/listinfo/syslog-ng :

5 10

Re: [syslog-ng] ipfw logging
by Ilya 02 Jun '00

02 Jun '00

ok i tried /dev/log - no result, same thing - ipfw is not being logged anywhere. i noiced that i am not the only one with this problem. the other person from japan seems to have similar issue. ---------- Original Message ---------------------------------- From: "Ilya" <maillist(a)krel.org> Reply-To: syslog-ng(a)venus.terrasoft.hu Date: Wed, 31 May 2000 01:36:19 -0400 >I am running on Freebsd 4.0 stable. >i just kept it the way documentation and examples have it and had no problem >except with ipfw

4 4

want kernal messages of FreeBSD
by Hideyuki Nishiyama 31 May '00

31 May '00

Hellow. I am H.Nishiyama in japanese. I want syslog-ng to send kernel messages of FreeBSD2.2.8 for ipfw. I tried to use unix-dgram("/de/klog") and file("/dev/klog"). But I didn't successed. Plese tell me how to send kernel messages of FreeBSD2.2.8 for ipfw!! Thank you to ream my letter. ------------------------------------------------------------ 新日本気象海洋株式会社 E-mail:hideyuki@yk.metocean.co.jp 情報システムグループ WWW :http://www.metocean.co.jp/ 西山英之 TEL :045-593-7616 FAX :045-593-7628

2 2

RE: [syslog-ng] ipfw logging
by Hamilton, Andrew Mr. 31 May '00

31 May '00

What are you running on? Your source in src looks a little strange. Most sources are something like /dev/log. What is coming in to /var/run/log? Do you have something putting log messages into a file? Drew > -----Original Message----- > From: maillist [SMTP:maillist@krel.org] > Sent: Tuesday, May 30, 2000 11:21 PM > To: syslog-ng(a)venus.terrasoft.hu > Subject: [syslog-ng] ipfw logging > > hi, ive been trying for two days to log ipfw messages to separate file and > with no success. as soon as i turn on old syslogd with > !ipfw > *.* /var/log/ipfw > it works > but syslog-ng with: > source src { unix-dgram("/var/run/log"); udp(); internal(); } > destination ipfw { file("/var/log/ipfw.log"); }; > filter f_ipfw { program("ipfw"); }; > log { source(src); filter("f_ipfw"); destination("ipfw"); }; > just doesnt catch anything, all the messages from ipfw appear on console, > but not in any file, even not in all.log! > > here is my full config: > # options > options { long_hostnames(off); sync(0); }; > > # sources > source src { unix-dgram("/var/run/log"); udp(); internal(); }; > source src2 { unix-dgram("/var/run/log2"); udp(ip(xxx.xxx.xxx.xxx) > port(514)); }; > > # destinations > destination messages { file("/var/log/messages"); }; > destination security { file("/var/log/security"); }; > destination maillog { file("/var/log/maillog"); }; > destination lpd-errs { file("/var/log/lpd-errs"); }; > destination cron { file("/var/log/cron"); }; > destination all { file("/var/log/all.log"); }; > destination newscrit { file("/var/log/news/news.crit"); }; > destination newserr { file("/var/log/news/news.err"); }; > destination newsnotice { file("/var/log/news/news.notice"); }; > destination slip { file("/var/log/slip.log"); }; > destination ppp { file("/var/log/ppp.log"); }; > destination console { file("/dev/console"); }; > destination root { usertty("root"); }; > destination allusers { usertty("*"); }; > destination rogue { file("/var/log/rogue"); }; > destination cobalt { file("/var/log/cobalt"); }; > destination cisco { file("/var/log/cisco"); }; > destination voyager { file("/var/log/voyager"); }; > destination lists { file("/var/log/lists"); }; > destination lists_m { file("/var/log/lists.sendmail"); }; > destination apollo { file("/var/log/apollo"); }; > destination samson { file("/var/log/samson"); }; > destination samson_d { file("/var/log/samson.bind"); }; > destination bugsy { file("/var/log/bugsy"); }; > #destination loghost { udp("loghost" port(514)); }; > destination goblin { file("/var/log/goblin"); }; > destination allsec { file("/var/log/allsec"); }; > destination samson.named { file("/var/log/named"); }; > destination ipfw { file("/var/log/ipfw.log"); }; > > # log facility filters > filter f_auth { facility(auth); }; > filter f_authpriv { facility(authpriv); }; > filter f_cron { facility(cron); }; > filter f_daemon { facility(daemon); }; > filter f_ftp { facility(ftp); }; > filter f_kern { facility(kern); }; > filter f_lpr { facility(lpr); }; > filter f_mail { facility(mail); }; > filter f_news { facility(news); }; > filter f_security { facility(security); }; > filter f_user { facility(user); }; > filter f_uucp { facility(uucp); }; > filter f_local0 { facility(local0); }; > filter f_local1 { facility(local1); }; > filter f_local2 { facility(local2); }; > filter f_local3 { facility(local3); }; > filter f_local4 { facility(local4); }; > filter f_local5 { facility(local5); }; > filter f_local6 { facility(local6); }; > filter f_local7 { facility(local7); }; > > # log host filters > filter h_rogue { host("rogue"); }; > filter h_cobalt { host("www"); }; > filter h_cisco { host("cisco"); }; > filter h_voyager { host("voyager"); }; > filter h_lists { host("lists"); }; > filter h_apollo { host("apollo"); }; > filter h_samson { host("samson"); }; > filter h_bugsy { host("bugsy"); }; > filter h_goblin { host("goblin"); }; > > # log level filters > filter f_emerg { level(emerg); }; > filter f_alert { level(alert..emerg); }; > filter f_crit { level(crit..emerg); }; > filter f_err { level(err..emerg); }; > filter f_warning { level(warning..emerg); }; > filter f_notice { level(notice..emerg); }; > filter f_info { level(info..emerg); }; > filter f_debug { level(debug..emerg); }; > > # program filters > filter f_ppp { program("ppp"); }; > filter f_slip { program("startslip"); }; > filter f_send { program("sendmail"); }; > filter nf_send { not program("sendmail"); }; > filter f_bind { program("named"); }; > filter nf_bind { not program("named"); }; > filter f_ipfw { program("ipfw"); }; > #filter nf_ipfw { not program("ipfw"); }; > > > > log { source(src2); filter("f_ipfw"); destination("ipfw"); }; > > # *.err;kern.debug;auth.notice;mail.crit /dev/console > log { source(src); filter(f_err); destination(console); }; > log { source(src); filter(f_kern); filter(f_debug); destination(console); > }; > log { source(src); filter(f_auth); filter(f_notice); destination(console); > }; > log { source(src); filter(f_mail); filter(f_crit); destination(console); > }; > > # *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages > log { source(src); filter(f_notice); destination(messages); }; > log { source(src); filter(f_kern); filter(f_debug); destination(messages); > }; > log { source(src); filter(f_lpr); filter(f_info); destination(messages); > }; > log { source(src); filter(f_mail); filter(f_crit); destination(messages); > }; > log { source(src); filter(f_news); filter(f_err); destination(messages); > }; > > # security.* /var/log/security > log { source(src); filter(f_security); destination(security); }; > > # mail.info /var/log/maillog > log { source(src); filter(f_mail); filter(f_info); destination(maillog); > }; > > # lpr.info /var/log/lpd-errs > log { source(src); filter(f_lpr); filter(f_info); destination(lpd-errs); > }; > > # cron.* /var/log/cron > log { source(src); filter(f_cron); destination(cron); }; > > # *.err root > log { source(src); filter(f_err); destination(root); }; > > # *.notice;news.err root > log { source(src); filter(f_notice); destination(root); }; > log { source(src); filter(f_news); filter(f_err); destination(root); }; > > # *.alert root > log { source(src); filter(f_alert); destination(root); }; > > # *.emerg * > log { source(src); filter(f_emerg); destination(allusers); }; > > # uncomment this to enable logging of all log messages to /var/log/all.log > # *.* /var/log/all.log > log { source(src); destination(all); }; > > # uncomment this to enable logging to a remote loghost named loghost > # *.* @loghost > #log { source(src); destination(loghost); }; > > # news.err > /var/log/news/news.err > # news.notice > /var/log/news/news.notice > # > #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); > }; > #log { source(src); filter(f_news); filter(f_err); destination(newserr); > }; > #log { source(src); filter(f_news); filter(f_notice); > destination(newsnotice); }; > > > log { source("src2"); filter("h_rogue"); destination("rogue"); }; > log { source("src2"); filter("h_cobalt"); destination("cobalt"); }; > log { source("src2"); filter("h_cisco"); destination("cisco"); }; > log { source("src2"); filter("h_voyager"); destination("voyager"); }; > log { source("src2"); filter("h_lists"); filter("f_send"); > destination("lists_m"); }; > log { source("src2"); filter("h_lists"); filter("nf_send"); > destination("lists"); }; > log { source("src2"); filter("h_apollo"); destination("apollo"); }; > log { source("src2"); filter("h_samson"); filter("f_bind"); > destination("samson_d"); }; > log { source("src2"); filter("h_samson"); filter("nf_bind"); > destination("samson"); }; > log { source("src2"); filter("h_bugsy"); destination("bugsy"); }; > log { source("src2"); filter("h_goblin"); destination("goblin"); }; > log { source("src2"); filter("f_security"); destination("allsec"); }; > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

ipfw logging
by maillist 30 May '00

30 May '00

hi, ive been trying for two days to log ipfw messages to separate file and with no success. as soon as i turn on old syslogd with !ipfw *.* /var/log/ipfw it works but syslog-ng with: source src { unix-dgram("/var/run/log"); udp(); internal(); } destination ipfw { file("/var/log/ipfw.log"); }; filter f_ipfw { program("ipfw"); }; log { source(src); filter("f_ipfw"); destination("ipfw"); }; just doesnt catch anything, all the messages from ipfw appear on console, but not in any file, even not in all.log! here is my full config: # options options { long_hostnames(off); sync(0); }; # sources source src { unix-dgram("/var/run/log"); udp(); internal(); }; source src2 { unix-dgram("/var/run/log2"); udp(ip(xxx.xxx.xxx.xxx) port(514)); }; # destinations destination messages { file("/var/log/messages"); }; destination security { file("/var/log/security"); }; destination maillog { file("/var/log/maillog"); }; destination lpd-errs { file("/var/log/lpd-errs"); }; destination cron { file("/var/log/cron"); }; destination all { file("/var/log/all.log"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination slip { file("/var/log/slip.log"); }; destination ppp { file("/var/log/ppp.log"); }; destination console { file("/dev/console"); }; destination root { usertty("root"); }; destination allusers { usertty("*"); }; destination rogue { file("/var/log/rogue"); }; destination cobalt { file("/var/log/cobalt"); }; destination cisco { file("/var/log/cisco"); }; destination voyager { file("/var/log/voyager"); }; destination lists { file("/var/log/lists"); }; destination lists_m { file("/var/log/lists.sendmail"); }; destination apollo { file("/var/log/apollo"); }; destination samson { file("/var/log/samson"); }; destination samson_d { file("/var/log/samson.bind"); }; destination bugsy { file("/var/log/bugsy"); }; #destination loghost { udp("loghost" port(514)); }; destination goblin { file("/var/log/goblin"); }; destination allsec { file("/var/log/allsec"); }; destination samson.named { file("/var/log/named"); }; destination ipfw { file("/var/log/ipfw.log"); }; # log facility filters filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # log host filters filter h_rogue { host("rogue"); }; filter h_cobalt { host("www"); }; filter h_cisco { host("cisco"); }; filter h_voyager { host("voyager"); }; filter h_lists { host("lists"); }; filter h_apollo { host("apollo"); }; filter h_samson { host("samson"); }; filter h_bugsy { host("bugsy"); }; filter h_goblin { host("goblin"); }; # log level filters filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info..emerg); }; filter f_debug { level(debug..emerg); }; # program filters filter f_ppp { program("ppp"); }; filter f_slip { program("startslip"); }; filter f_send { program("sendmail"); }; filter nf_send { not program("sendmail"); }; filter f_bind { program("named"); }; filter nf_bind { not program("named"); }; filter f_ipfw { program("ipfw"); }; #filter nf_ipfw { not program("ipfw"); }; log { source(src2); filter("f_ipfw"); destination("ipfw"); }; # *.err;kern.debug;auth.notice;mail.crit /dev/console log { source(src); filter(f_err); destination(console); }; log { source(src); filter(f_kern); filter(f_debug); destination(console); }; log { source(src); filter(f_auth); filter(f_notice); destination(console); }; log { source(src); filter(f_mail); filter(f_crit); destination(console); }; # *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages log { source(src); filter(f_notice); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_lpr); filter(f_info); destination(messages); }; log { source(src); filter(f_mail); filter(f_crit); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # security.* /var/log/security log { source(src); filter(f_security); destination(security); }; # mail.info /var/log/maillog log { source(src); filter(f_mail); filter(f_info); destination(maillog); }; # lpr.info /var/log/lpd-errs log { source(src); filter(f_lpr); filter(f_info); destination(lpd-errs); }; # cron.* /var/log/cron log { source(src); filter(f_cron); destination(cron); }; # *.err root log { source(src); filter(f_err); destination(root); }; # *.notice;news.err root log { source(src); filter(f_notice); destination(root); }; log { source(src); filter(f_news); filter(f_err); destination(root); }; # *.alert root log { source(src); filter(f_alert); destination(root); }; # *.emerg * log { source(src); filter(f_emerg); destination(allusers); }; # uncomment this to enable logging of all log messages to /var/log/all.log # *.* /var/log/all.log log { source(src); destination(all); }; # uncomment this to enable logging to a remote loghost named loghost # *.* @loghost #log { source(src); destination(loghost); }; # news.err /var/log/news/news.err # news.notice /var/log/news/news.notice # #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; #log { source(src); filter(f_news); filter(f_err); destination(newserr); }; #log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source("src2"); filter("h_rogue"); destination("rogue"); }; log { source("src2"); filter("h_cobalt"); destination("cobalt"); }; log { source("src2"); filter("h_cisco"); destination("cisco"); }; log { source("src2"); filter("h_voyager"); destination("voyager"); }; log { source("src2"); filter("h_lists"); filter("f_send"); destination("lists_m"); }; log { source("src2"); filter("h_lists"); filter("nf_send"); destination("lists"); }; log { source("src2"); filter("h_apollo"); destination("apollo"); }; log { source("src2"); filter("h_samson"); filter("f_bind"); destination("samson_d"); }; log { source("src2"); filter("h_samson"); filter("nf_bind"); destination("samson"); }; log { source("src2"); filter("h_bugsy"); destination("bugsy"); }; log { source("src2"); filter("h_goblin"); destination("goblin"); }; log { source("src2"); filter("f_security"); destination("allsec"); };

1 0

Re: [syslog-ng] (syslog-ng): unaligned access: (SOLVED)
by Balazs Scheidler 27 May '00

27 May '00

> Looks like there's yet another, I'll dig into it again today and send some > more, unless you're still working on one of the two I already sent. I thought this fixed both, since this malloc debugger allocated memory chunks on a 4 bytes boundary (instead of 8), if memory was accessed later it could cause this at several places. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: [syslog-ng] (syslog-ng): unaligned access: (SOLVED)
by Balazs Scheidler 26 May '00

26 May '00

> pid 29068 (syslog-ng): unaligned access: va=0x14001645c pc=0x12001b2b0 > ra=0x12001b2b0 op=stt > pid 29068 (syslog-ng): unaligned access: va=0x14001644c pc=0x12001b018 > ra=0x12001b018 op=stq > pid 29068 (syslog-ng): unaligned access: va=0x140016454 pc=0x12001b028 > ra=0x12001b028 op=stt > pid 29068 (syslog-ng): unaligned access: va=0x140016454 pc=0x12001b030 > ra=0x12001b030 op=ldq > pid 29068 (syslog-ng): unaligned access: va=0x14001644c pc=0x12001b040 > ra=0x12001b040 op=ldq > 0x12000f3f0 288 conn->queue_node = I've got this one, it's caused by the optional malloc debugger which was errouneously included even in --with-debug was not given (it was not 64bit clean). The new libol version 0.2.17 should fix this. http://www.balabit.hu/downloads/libol/0.2/libol-0.2.17.tar.gz -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

syslog-ng 1.4.4 and libol 0.2.17
by Balazs Scheidler 26 May '00

26 May '00

Hi, I've released syslog-ng 1.4.4: NEWS for syslog-ng 1.4.4 * file permission specifiers readded for pipe() * fixed a configure.in bug on systems without snprintf() * updated documentation (New chapter: Finetuning, added some things about DEFAULT filter evaluation) NEWS for libol 0.2.17 * will not compile in the malloc debugger if --with-debug is specified, caused unaligned memory accesses on Alpha -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0