September 2001 - syslog-ng - lists.balabit.hu

filter problem: level()
by Michael D. (Mick) Bauer 11 Oct '01

11 Oct '01

Hi, all. I've got a puzzling problem (to me ;-) with the level() function in my syslog-ng.conf file. I'm using a filter whose sole criterion is level(debug .. alert); as a sort of "catch-all" filter. But if I send syslog-ng eight messages, each with a different priority (i.e., one of each level), only the ones with levels "crit," "alert," and "emerg" get logged. But wait! Those "emerg" messages shouldn't be making it past the filter! What *on earth* is going on here? (Could it be some sort of weirdness between logger & syslog-ng?) Here's my config file, etc.: # begin syslog-ng.conf options { long_hostnames(off); sync(0); }; source src { unix-dgram("/dev/log"); internal(); }; destination d_local { file("/var/log/messages"); }; filter f_mick { level(debug .. alert); }; log { source(src); filter(f_mick); destination(d_local); }; # end syslog-ng.conf # begin bash-commands (logger) to test above config curious-george:/etc/init.d# for i in {debug,info,notice,warning,err,crit,alert, emerg} >do >logger -p auth.$i "Priority level $i" >echo "Priority level $i" >done Priority level debug Priority level info Priority level notice Priority level warning Priority level err Priority level crit Priority level alert Priority level emerg # end bash-commands & output # begin excerpt from /var/log/messages Sep 5 00:13:04 curious-george darthelm: Priority level crit Sep 5 00:13:04 curious-george darthelm: Priority level alert Sep 5 00:13:04 curious-george darthelm: Priority level emerg # end excerpt TIA, Mick /=============================\ | Michael D.(Mick) Bauer | | Network Security Consultant | | St. Paul, Minnesota (USA) | | mick<at>visi.com | \=============================/

2 2

Can't background syslog-ng
by Andrew Dixon 02 Oct '01

02 Oct '01

Hi All, I'm trying to get syslog-ng-1.5.10 up under a Linux system running on a powerpc. I can compile without errors and if I run: #syslog-ng -F syslog-ng version ` starting 7 so that syslog-ng doesn't background itself it works fine. When I try to back ground it though it fails: #syslog-ng -d io.c: Preparing fd 268600320 for io.c: Preparing fd 0 for reading syslog-ng version ` starting 7gc_mark: Marking object of class '8!' (1) !ÿøàSegmentation fault Has anyone else come across this? I straced syslog-ng and it complained about "Inappropriate ioctl for device" but I'm not sure which device it's trying to manipulate. Any help would be greatly appreciated and if anyone else is running syslog-ng on a PPC Linux system it'd be nice that it is possible. Thanks, Andy P.S. here's the strace: #strace ./syslog-ng execve("./syslog-ng", ["./syslog-ng"], [/* 23 vars */]) = 0 uname({sys="Linux", node="wolf", ...}) = 0 brk(0) = 0x100281f0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30015000 open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 4 SYS_197(0x4, 0x7fffedd8, 0x7fffedd8, 0x30027850, 0x7f7f7f7f) = 0 mmap(NULL, 24719, PROT_READ, MAP_PRIVATE, 4, 0) = 0x30016000 close(4) = 0 open("/lib/libnsl.so.1", O_RDONLY) = 4 read(4, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\0J0"..., 1024) = 1024 SYS_197(0x4, 0x7fffede0, 0x7fffede0, 0x30015280, 0x30027d50) = 0 mmap(0xffc9000, 157316, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0xffc9000 mprotect(0xffdb000, 83588, PROT_NONE) = 0 mmap(0xffe9000, 16384, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0x10000) = 0xffe9000 mmap(0xffed000, 9860, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffed000 close(4) = 0 open("/lib/libc.so.6", O_RDONLY) = 4 read(4, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\2\251"..., 1024) = 1024 SYS_197(0x4, 0x7fffedc0, 0x7fffedc0, 0x30015460, 0x30027d50) = 0 mmap(0xfe6b000, 1366404, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0xfe6b000 mprotect(0xff85000, 211332, PROT_NONE) = 0 mmap(0xff8b000, 167936, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0x110000) = 0xff8b000 mmap(0xffb4000, 18820, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffb4000 close(4) = 0 munmap(0x30016000, 24719) = 0 brk(0) = 0x100281f0 brk(0x10028240) = 0x10028240 brk(0x10029000) = 0x10029000 open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) = 4 brk(0x1002e000) = 0x1002e000 ioctl(4, TCGETS, 0x7ffff798) = -1 ENOTTY (Inappropriate ioctl for device) SYS_197(0x4, 0x7ffff288, 0x7ffff288, 0x100282e8, 0x10014904) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30016000 read(4, "#\n# Syslog-ng configuration file"..., 8192) = 5352 read(4, "", 4096) = 0 socket(PF_UNIX, SOCK_STREAM, 0) = 5 connect(5, {sin_family=AF_UNIX, path=" /var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory) close(5) = 0 open("/etc/nsswitch.conf", O_RDONLY) = 5 SYS_197(0x5, 0x7ffff238, 0x7ffff238, 0x1002cb88, 0x18) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 read(5, "# /etc/nsswitch.conf\n#\n# Example"..., 4096) = 465 read(5, "", 4096) = 0 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/ld.so.cache", O_RDONLY) = 5 SYS_197(0x5, 0x7fff3fb0, 0x7fff3fb0, 0x30027850, 0x7f7f7f7f) = 0 mmap(NULL, 24719, PROT_READ, MAP_PRIVATE, 5, 0) = 0x30017000 close(5) = 0 open("/lib/libnss_compat.so.2", O_RDONLY) = 5 read(5, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\0\35"..., 1024) = 1024 SYS_197(0x5, 0x7fff3fb8, 0x7fff3fb8, 0x1002cbc0, 0) = 0 mmap(0xfe3f000, 113332, PROT_READ|PROT_EXEC, MAP_PRIVATE, 5, 0) = 0xfe3f000 mprotect(0xfe4b000, 64180, PROT_NONE) = 0 mmap(0xfe4f000, 49152, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 5, 0) = 0xfe4f000 close(5) = 0 munmap(0x30017000, 24719) = 0 uname({sys="Linux", node="wolf", ...}) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 socket(PF_UNIX, SOCK_STREAM, 0) = 5 connect(5, {sin_family=AF_UNIX, path=" /var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory) close(5) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 brk(0x1002f000) = 0x1002f000 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 brk(0x10030000) = 0x10030000 brk(0x10031000) = 0x10031000 brk(0x10032000) = 0x10032000 read(4, "", 8192) = 0 ioctl(4, TCGETS, 0x7ffff258) = -1 ENOTTY (Inappropriate ioctl for device) close(4) = 0 munmap(0x30016000, 4096) = 0 pipe([4, 5]) = 0 fork() = 289 close(5) = 0 read(4, "\0", 1) = 1 exit(0) = ? -- Andrew Dixon Software Engineer Seranoa Networks 978.897.3434 x231

2 2

Unaligned trap errors on Alpha-Linux
by Jon Stearley 28 Sep '01

28 Sep '01

has a fix been found to the "unaligned trap" messages alpha users have been seeing? http://lists.balabit.hu/pipermail/syslog-ng/2000-May/000609.html http://lists.svlug.org/pipermail/svlug/2000-October/004209.html http://pusa.uv.es/~ulisses/kernelnewbies/kernelnewbies.25Jul00 i've got tons of them i'd like to eliminate from my alpha/linux-2.2.18/redhat6.2/syslog-ng-1.4.12/libol-0.2.23 clusters. it looks like an internal message, but it still occurs when i take internal() out of my source definition (?). thx for any pointers. -- +--------------------------------------------------------------+ | Jon Stearley (505) 845-7571 (FAX 844-2067) | | Compaq Federal LLC High Performance Solutions | | Sandia National Laboratories Scalable Systems Integration | +--------------------------------------------------------------+ here's one of my hosts, it keeps repeating: Sep 23 17:43:35 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005278: 00000001201249cc 2d 0 Sep 23 17:43:35 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 000000012000527c: 00000001201249f4 29 1 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 00000001200051d8: 00000001201249f4 2d 0 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005220: 00000001201249f4 29 16 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005278: 00000001201249cc 2d 0 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 000000012000527c: 00000001201249f4 29 1 Sep 23 17:44:12 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 00000001200051d8: 00000001201249f4 2d 0 Sep 23 17:44:12 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005220: 00000001201249f4 29 16

2 2

Thanks.
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 28 Sep '01

28 Sep '01

All, Thanks for all your help and advice over the last couple of years. I have tried to give back some of the help I have gotten as well as some of the experience I have gained using the software. This has been an outstanding piece of software and has been very helpful to the organization for which I work. But my contract here is up and I am moving on to a straight programming job, (no more sysadmin work). Anyway, best of luck to all of you. Bazsi, thanks for the hard work and support. Andrew Hamilton

2 1

perm() bug in 1.4.13?
by Michael D. (Mick) Bauer 27 Sep '01

27 Sep '01

If I define a logfile with perms "-rw-r------" using the following in syslog.conf: destination d_micklog { file("/var/log/micklog" owner(mick) group(wheel) perm(0640)); }; a file is created that looks like this (ls -l output): -rw------- 1 mick wheel 57 Sep 27 10:03 /var/log/micklog Why aren't the "group" bits being set? At first I thought maybe I needed to "invert" the mode a là umode, but that isn't it. Ideas? TIA, Mick Bauer /=============================\ | Michael D.(Mick) Bauer | | Network Security Consultant | | St. Paul, Minnesota (USA) | | mick<at>visi.com | \=============================/

2 1

Losing events with syslog-ng and netfilter
by Jerome Poggi 27 Sep '01

27 Sep '01

Hi, I use syslog-ng 1.5.10 with Linux kernel 2.4.10 and netfilter 1.2.3 When Netfilter log 8 events, syslog-ng log only the half. Did you see this thinks before ? -- Jerome POGGI

1 0

RE: [syslog-ng]Does syslog-ng support remote logging?
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 27 Sep '01

27 Sep '01

You should have a source set up that receives UDP packets. Just include it in your source statement. Regards, Drew -----Original Message----- From: A. Dumas [mailto:a.dumas@snet.net] Sent: Thursday, September 27, 2001 4:15 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Does syslog-ng support remote logging? I've had syslog-ng on a Linux 7.1 box for a couple months and it's been running great. I'm attempting to setup remote logging on the various Cisco routers on my network and have them point to syslog-ng. I think the Cisco configurations are set up correctly since I have a sniffer on the network and I can see the packets going to the Linux box, but nothing shows up in syslog-ng that I can see. What should I be using in the syslog-ng configuration to isolate the relevant data? I've unsuccessfully tried several.

1 0

Does syslog-ng support remote logging?
by A. Dumas 27 Sep '01

27 Sep '01

Ive had syslog-ng on a Linux 7.1 box for a couple months and its been running great. Im attempting to setup remote logging on the various Cisco routers on my network and have them point to syslog-ng. I think the Cisco configurations are set up correctly since I have a sniffer on the network and I can see the packets going to the Linux box, but nothing shows up in syslog-ng that I can see. What should I be using in the syslog-ng configuration to isolate the relevant data? Ive unsuccessfully tried several.

1 0

[aaron@schrab.com: Bug#78445: syslog-ng: The included libol uses va_list incorrectly.]
by Balazs Scheidler 26 Sep '01

26 Sep '01

----- Forwarded message from Aaron Schrab <aaron(a)schrab.com> ----- From: Aaron Schrab <aaron(a)schrab.com> To: 78445(a)bugs.debian.org Cc: control(a)bugs.debian.org Reply-To: Aaron Schrab <aaron(a)schrab.com>, 78445(a)bugs.debian.org Subject: Bug#78445: syslog-ng: The included libol uses va_list incorrectly. Date: Sat, 22 Sep 2001 10:47:33 -0500 tags 78445 patch thanks The msg_vformat function from libol passes the same va_list to two different functions, expecting that the first won't affect the second. This assumption isn't true on powerpc, so when the second function gets it, there aren't any arguments left to read. The included patch fixes this by making a copy of the va_list before passing it for the first time. I checked for other occurences of this problem, but this seems to be the only one. My patched copy has been handling my logging for a few hours now and it seems to work fine. The unpatched one died immediately. *** /tmp/syslog-ng.diff diff -Pur syslog-ng-1.5.9/debian/libol.patch syslog-ng-1.5.9.ats/debian/libol.patch --- syslog-ng-1.5.9/debian/libol.patch Wed Dec 31 18:00:00 1969 +++ syslog-ng-1.5.9.ats/debian/libol.patch Sat Sep 22 06:06:43 2001 @@ -0,0 +1,37 @@ +diff -ur libol-0.2.24.orig/src/format.h libol-0.2.24/src/format.h +--- libol-0.2.24.orig/src/format.h Sat Jul 10 08:23:09 1999 ++++ libol-0.2.24/src/format.h Sat Sep 22 05:56:59 2001 +@@ -28,6 +28,12 @@ + + #include <stdarg.h> + ++#ifndef va_copy ++# ifdef __va_copy ++# define va_copy __va_copy ++# endif ++#endif ++ + struct ol_string *c_format(const char *format, ...); + UINT32 c_format_length(const char *format, ...); + UINT32 c_format_write(const char *format, UINT32 length, UINT8 *buffer, ...); +diff -ur -x configure libol-0.2.24.orig/src/werror.c libol-0.2.24/src/werror.c +--- libol-0.2.24.orig/src/werror.c Fri Feb 4 13:02:04 2000 ++++ libol-0.2.24/src/werror.c Sat Sep 22 05:58:41 2001 +@@ -117,9 +117,16 @@ + { + UINT8 errorbuf[BUF_SIZE]; + int length; +- ++#ifdef va_copy ++ va_list args_copy; ++ va_copy (args_copy, args); ++#endif ++ + length = c_vformat_length(f, args); + if (length <= BUF_SIZE) { ++#ifdef va_copy ++ va_copy (args, args_copy); ++#endif + c_vformat_write(f, sizeof(errorbuf), errorbuf, args); + MSG_WRITE(level, length, errorbuf); + } diff -Pur syslog-ng-1.5.9/debian/rules syslog-ng-1.5.9.ats/debian/rules --- syslog-ng-1.5.9/debian/rules Sat Sep 22 06:08:56 2001 +++ syslog-ng-1.5.9.ats/debian/rules Sat Sep 22 06:09:13 2001 @@ -17,7 +17,7 @@ rm $(LIBOLDIR)/ltmain.sh $(LIBOLDIR)/config.sub $(LIBOLDIR)/config.guess \ $(LIBOLDIR)/aclocal.m4 $(LIBOLDIR)/missing \ $(LIBOLDIR)/ltconfig $(LIBOLDIR)/mkinstalldirs - (cd $(LIBOLDIR); ./autogen.sh; ./configure --prefix=/usr/lib; $(MAKE) ) + (cd $(LIBOLDIR); patch -p1 < ../debian/libol.patch; ./autogen.sh; ./configure --prefix=/usr/lib; $(MAKE) ) echo "libol: Done" # mv -f ltmain.sh ltmain.sh.save # mv -f config.sub config.sub.save -- System Information Debian Release: testing/unstable Architecture: powerpc Kernel: Linux frell 2.4.10-pre10-ben0 #1 Thu Sep 20 00:45:23 CDT 2001 ppc Locale: LANG=C, LC_CTYPE=en_US Versions of packages syslog-ng depends on: ii libc6 2.2.4-1 GNU C Library: Shared libraries an ----- End forwarded message ----- -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

1.4.13 HUP issues
by Nathan Wertman 26 Sep '01

26 Sep '01

While trying to parse my logs for some pppd information about connect times and such I noticed a really wierd problem. When software uses an openlog to open a 'channel' to the log, and when syslog-ng is HUP'ed (during my logrotate script) the process that was writing to the log no longer puts any information into the log. This bug has been fixed in the unstable tree but I would rather not use the unstable tree on my server, especially for something as important as system logging. Has anyone else seen this? Is there a patch for it? I have just begun hacking on syslog-ng so this patch is a little out of my league until I figure out how the code works, but I would like to get syslog-ng up and running as soon as possible. If you need more information please let me know and I will be happy to provide you with it. Nathan Wertman "Those who will not reason, are bigots, those who cannot, are fools, and those who dare not are slaves." - George Gordon Noel Byron (1788 - 1824) (Lord Byron)

2 1