November 2001 - syslog-ng - lists.balabit.hu

no logging after HUP (1.5.13)
by Arnold Pulleman 05 Jan '02

05 Jan '02

Because of the template feature I want to use syslog-ng 1.5 on a FreeBSD 4.2 and 4.3 platform. While testing 1.5.13 I found a problem when sending a hangup signal to syslog-ng. The restart message is shown but nothing follows until syslog-ng is stopped and started again. My question is how to solve this problem? The following output of the messages file appeared: Oct 30 11:06:49 humble syslog-ng[5018]: syslog-ng version 1.5.13 starting Oct 30 11:08:56 humble su: BAD SU user to root on /dev/ttyp7 Oct 30 11:09:28 humble su: user to root on /dev/ttyp7 Oct 30 11:16:49 humble syslog-ng[5018]: STATS: dropped 0 Oct 30 11:25:09 humble su: BAD SU user to root on /dev/ttyp7 Oct 30 11:26:05 humble su: user to root on /dev/ttyp3 Oct 30 11:26:49 humble syslog-ng[5018]: STATS: dropped 0 Oct 30 11:27:00 humble syslog-ng[5018]: SIGHUP received, restarting syslog-ng Oct 30 11:35:36 humble syslog-ng[5109]: syslog-ng version 1.5.13 starting Oct 30 11:35:49 humble syslog-ng[5109]: SIGHUP received, restarting syslog-ng

4 6

help
by Nocentino, Anthony 02 Jan '02

02 Jan '02

how do i config syslog-ng to start up automatically on boot

2 1

Daemons dies
by Chuck Kelly 30 Nov '01

30 Nov '01

I am running syslog-ng 1.4.14 on two different servers. One server has approx. 150 hosts logging to it. The other server has approx. 1500 hosts logging to it. The server with 1500 hosts has a problem with the daemon dying randomly, any where from 1-15 hours. I have adjusted to the log_fifo_size to 2000. Any other ideas? Since the dameon is running fine on the other server, I assume I am just running into a performance tweaking issue. -- Chuck

1 0

src/io.c patch for libol 0.2.23
by syslog-ng＠lists.thewrittenword.com 28 Nov '01

28 Nov '01

1. alloca patch below needed for HP-UX and AIX. 2. The following is not legal C89 code: struct fd_read r = { { STACK_HEADER, do_read, do_recv }, fd->fd }; You cannot assign a non-const value at initialization time. I think C99 allows this. The Sun and HP vendor compilers complain (though the Sun version allows it because they have started to incorporate C99 features). -- albert chin (china(a)thewrittenword.com) -- snip snip --- src/io.c.orig Tue Nov 27 13:04:16 2001 +++ src/io.c Tue Nov 27 13:42:26 2001 @@ -21,11 +21,28 @@ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ +#if defined _AIX && !defined __GNUC__ + #pragma alloca +#endif + #include "io.h" #include "werror.h" #include "xalloc.h" #include "format.h" +/* Make alloca work the best possible way. */ +#ifdef __GNUC__ +#define alloca __builtin_alloca +#else /* not __GNUC__ */ +#if HAVE_ALLOCA_H +#include <alloca.h> +#else /* not __GNUC__ or HAVE_ALLOCA_H */ +#ifndef _AIX /* Already did AIX, up at the top. */ +char *alloca (); +#endif /* not _AIX */ +#endif /* not HAVE_ALLOCA_H */ +#endif /* not __GNUC__ */ + #include <assert.h> #include <string.h> @@ -327,7 +344,6 @@ { debug("Read EOF on fd %i.\n", closure->fd); return A_EOF; - return 0; } if (res > 0) return res; @@ -400,7 +416,9 @@ int res; struct fd_read r = - { { STACK_HEADER, do_read, do_recv }, fd->fd }; + { { STACK_HEADER, do_read, do_recv }, 0 }; + + r.fd = fd->fd; /* The handler function may install a new handler */ res = READ_HANDLER(self->handler, @@ -482,7 +500,9 @@ int res; struct fd_write w = - { { STACK_HEADER, do_write }, fd->fd }; + { { STACK_HEADER, do_write }, 0 }; + + w.fd = fd->fd; assert(self->buffer); @@ -652,7 +672,9 @@ int blocking_read(int fd, struct read_handler *handler) { struct fd_read r = - { { STACK_HEADER, do_read }, fd }; + { { STACK_HEADER, do_read }, 0 }; + + r.fd = fd; for (;;) {

1 0

Flags?
by Jay Guerette 27 Nov '01

27 Nov '01

Is the 'flags' statement working in syslog-ng 1.4.14? It coughs on a flags(final)entry in my conf file: log { source(syslog); filter(p_ircd); destination(ircd); flags(final); }; It parses fine when the flags line is commented out... -- I hope that at this artificial inflation of a small species into the absolute measure of things one is still permitted to laugh?

2 1

syslog-ng messages sent to outside prog
by Jay Guerette 27 Nov '01

27 Nov '01

A modified code snippet that will remove the leading <nn> facility/priority indicator when shlepping log lines to an external proggie: <code> #! /bin/bash # this line enables the extended globbing in bash to make this possible shopt -s extglob while read LOGLINE do echo ${LOGLINE/+([0-9<>])} | mail wakemeup(a)noon.ok done </code> -- I hope that at this artificial inflation of a small species into the absolute measure of things one is still permitted to laugh?

1 0

RE: [syslog-ng]syslog-ng loghost project documentation
by Ben Smee 25 Nov '01

25 Nov '01

heya, on which note just wanted to say thanks for the effort of writing that up. I had a quick look at it the other day and it helped clarify a couple of things, namely how you piped things straight into swatch (which is a nice trick). regards, -------------------- Benjamin Smee Technical Specialist Optus Business Operations (NAC) "YES" OPTUS ben.smee(a)optus.net.au Tel: +61-2-93420091 Fax: +61-2-93420998 Perilous to all of us are the devices of an art deeper than we possess ourselves. -- Gandalf the White > -----Original Message----- > From: Nate Campi [mailto:nate@campin.net] > Sent: Saturday, 24 November 2001 8:01 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]syslog-ng loghost project documentation > > > I've documented just about every part of my syslog-ng setup > at work, and place it at > http://www.campin.net/newlogcheck.html. It > covers the whole > deal, from reporting with custom log scanners, swatch, > archiving to files and to a database, and more. > > This may save others time when they are starting out on their > projects. This is a work in progress, but I'm sure it could > be useful now. > -- > Nate Campi http://www.campin.net GnuPG key: > 0xC17AEF79 > Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 > > Your mantra for today is: Don't let data from the network near a > shell. Bad things happen. -- Randall Schwartz > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/sysl> og-ng >

1 0

HI
by Olav Langeland 24 Nov '01

24 Nov '01

I am logging from a Cisco Pix to syslog-ng on a FreeBSD machine. --cut-from-syslog-ng-cfg-- destination pix { file("/usr/logs/pix/log"); }; filter f_pix { host(192.168.10.1); }; log { source(src); filter(f_pix); destination(pix); }; --cut-- This logs perfectly fine, but it still logs to /var/log/messages as well. How do I filter away this? Something I have missed, scanned through couple of months of mailinglist but didnt see anything particular. Any help appreciated, syslog-ng looks really nice. -- Olav Langeland - olav.langeland(a)nosp4m.activeisp.com

2 1

syslog-ng loghost project documentation
by Nate Campi 23 Nov '01

23 Nov '01

I've documented just about every part of my syslog-ng setup at work, and place it at http://www.campin.net/newlogcheck.html. It covers the whole deal, from reporting with custom log scanners, swatch, archiving to files and to a database, and more. This may save others time when they are starting out on their projects. This is a work in progress, but I'm sure it could be useful now. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 Your mantra for today is: Don't let data from the network near a shell. Bad things happen. -- Randall Schwartz

1 0

Feature Suggestion: Additional variable $PROGRAM_ESC for filename expansion
by Norbert Nemec 23 Nov '01

23 Nov '01

Hi there, I've been using syslog-ng for quite a while and I really like that program. There is just one feature I'm missing: In my current setup, I have all the logging data sorted into files within one directory, according the the name of the program sending the message. The documentation states correctly that this is a security problem, since the $PROGRAM variable might contain just about anything, including / and . making it possible for any user to write data to about any file in the filesystem. Even on my private system, where security is not a concern, this turns out to be nasty, since a small number of programs state their whole path as program name. my idea whould be to provide an alternative variable, e.g. $PROGRAM_ESC that is internally converted to a defined set of legal characters. This does not even have to be a high-quality, reversable conversion. A plain, well defined mangling should be absolutely enough. Ciao, Nobbi PS: Please CC me, I'm not subscribed. -- -- ______________________________________________________ -- JESUS CHRIST IS LORD! -- To Him, even that machine here has to obey... -- -- _________________________________Norbert "Nobbi" Nemec -- Hindenburgstr. 44 ... D-91054 Erlangen ... Germany -- eMail: <nobbi(a)cheerful.com> Tel: +49-(0)-9131-204180

1 0