November 2002 - syslog-ng - lists.balabit.hu

Urgent: Mangled messages in pipe() destinations in version 1.5.19
by Andreas Schulze 20 Mar '03

20 Mar '03

Hello Balazs, in version 1.5.19 (and in other versions between >1.5.7 and <=1.5.19, too) we observing obscure message mangling in pipe() destinations. Imagine the config below and the scenario: syslog-ng --write(2)--> pipe() --read(2)--> application All four log paths below, writes lines to the pipe '/tmp/pipe'. With 1.5.7 we read from the pipe exactly that, what syslog-ng (using the config below) writes to it. But with all newer versions (espec. 1.5.19) we read (with the same config): message_1 message_2 messagmessage_4 !!! ... message_n if we try to let syslog-ng write: message_1 message_2 message_3 message_4 ... message_n (The numbers and terms are only examples, because of the different sources and high message load.) Seems, that write(2) to fifo skips some message ends now. (espec. the terminating newline) > # example config: > # > source sys { sun-streams ("/dev/log" door("/var/run/syslog_door")); }; > source net { udp (ip(w.x.y.z) port(n)); }; > destination d_cisco { pipe("/tmp/pipe" template("@cisco: | $MSG\n")); }; > destination d_icmp { pipe("/tmp/pipe" template("@icmpd: | $MSG\n")); }; > log { source(net); filter(fa); destination(da); destination(d_cisco); }; > log { source(net); filter(fb); destination(db); destination(d_cisco); }; > log { source(sys); filter(f1); destination(d1); destination(d_icmp); }; > log { source(sys); filter(f2); destination(d2); destination(d_icmp); }; We are running a config similar to this above, with 1.5.7 since a lot of months very successfully in production ennvironment with very high message load. Since 1.5.1? the message mangling occurs. But now, some of your newer features becomes mission critical for us. Have you any idea, what happens? Versions <= 1.5.7 works well. Thanks a lot. -- Best regards --Andreas Schulze [phone: +49.5246.80.1275, fax: +49.5246.80.2275] | I believe, it was Dennis Ritchie who said something like: | "C is rarely the best language for a given task, | but it's often the second-best". | The implication being that: "[...]" | | sh# cat>$$.c<<EOT | main(l,a,n,d)char**a;{for(d=atoi(a[1])/10*80-atoi(a[2])/5-596;n="@NK\ | ACLCCGZAAQBEAADAFaISADJABBA^SNLGAQABDAXIMBAACTBATAHDBANZcEMMCCCCAAhE\ | IJFAEAAABAfHJETBdFLDAANEfDNBPHdBcBBBEA_AL H E L L O, W O R L D! " | [l++-3];)for(;n-->64;)putchar(!d+++33^l&1);} | EOT | gcc -o$$ $$.c;clear;./$$ 52 8;rm -f $$*

6 19

��ӭ��
by �� 30 Nov '02

30 Nov '02

点击进入深圳网络书店：　http://www.szbookshop.com 送货上门，货到付款，还有打折哦使用极星邮件群发，无须通过邮件服务器，直达对方邮箱，速度绝对一流！下载网址：http://love2net.51.net/，更多免费的超酷软件等你来下…… ---------------------------------------------------- INFORMATION This message has been sent using a trial-run version of the TSmtpRelayServer Delphi Component. ----------------------------------------------------

1 0

Unsupported address family 63280
by Andreas Piesk 30 Nov '02

30 Nov '02

i'm trying to switch from syslogd to syslog-ng, but something goes wrong: # syslog-ng -d -F io.c: Preparing fd 3 for reading syslog-ng version 1.5.23 starting io.c: sockaddr2info(): Unsupported address family 63280. Aborted what causes it and how can i fix it? -ap -- Andreas Piesk <a.piesk(a)gmx.net> PGP-Fingerprint: 23CB A7E2 2E53 373C DBCD 8EFC 7777 61C1

2 1

Filters
by Sergio Alves de Lima Jr. 29 Nov '02

29 Nov '02

Hellow list, I am needing create filter for not log entries of connections of the pop3. Some a idea for resolution? Thanks a lot. []'s Sergio A Lima

2 2

Wrong timestamp on internal messages
by henriksa＠telia.com 29 Nov '02

29 Nov '02

These are the last two lines in the log after restarting syslog-ng: Nov 29 12:49:15 src@xxxx syslog-ng[5120]: syslog-ng version 1.5.23 going down Nov 29 12:49:16 src@xxxx syslog-ng[5133]: syslog-ng version 1.5.23 starting But 'date' gives the following: Fri Nov 29 13:49:23 MET 2002 'date -u' gives the same time as the internal message. So messages coming from other sources are timestamped with local time, internal() messages are stamped with GMT. Why is that?

3 2

Syslog-ng on Solaris 8
by Ja Wallaby 29 Nov '02

29 Nov '02

Hi, Are any of you running syslog-ng on solaris8? If so, what are the differences in the config file? I am trying to change my logging host from linux to solaris and am getting errors starting ng when using the same config file. J

3 3

Wish listt
by Peter_STRAKA＠tatrabanka.sk 28 Nov '02

28 Nov '02

Hello, With Regards Peter STRAKA TatraBanka a.s. Cernysevskeho 48 85005 Bratislava Slovak Republic Tel: +421-2-6866 3765 Email: straka(a)tatrabanka.sk ----- Forwarded by Peter STRAKA/TATRABANKA/SK on 11/28/2002 02:24 PM ----- |---------+---------------------------> | | Peter STRAKA | | | | | | 11/28/2002 01:57| | | PM | | | | |---------+---------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | | | To: syslog-ng(a)lists.balabit.huu | | cc: | | Subject: Wish listt | >-------------------------------------------------------------------------------------------------------------------------------| Hello, I use syslog-ng for longer time but I am new in this mailinglist. I didn't find any wish-list for syslog-ng on web page. I use it on linux platform and I in crontab I use chattr to change log files (imutable and appendable) I think it would be goot to have option attr() {like perm()} in config to do this. And for acl somethinf like acl option. And what about log-checking? I tried logcheck,logscanner,logsurger,logwatch,swatch, but every-one is only like better grep. I expect somethink on statistical base - somethink like http analyze. What are you thinking about? With Regards Peter STRAKA ____________________________________________________________________ Informacie obsiahnute v tomto dokumente su urcene vylucne pre potreby jeho adresata. Dokument moze obsahovat informacie chranene ako bankove alebo obchodne tajomstvo, pripadne informacie podliehajuce ochrane podla inych pravnych predpisov. Preto Vas v pripade, ak Vam bol mylne doruceny, vyzyvame, aby ste sa zdrzali jeho odtajnenia ci jeho pouzitia pre vlastne potreby. Zaroven si Vas dovolujeme poziadat, aby ste nas o takomto pripade bez zbytocneho odkladu informovali a dokument nasledne zlikvidovali. Information stated in this document is intended only for needs of proper addressees of this document. This document can contain information protected as a bank or business secret, or information protected by other legal regulations. Thus in case of receiving the document by error, we kindly ask you not to disclose, or use the document for your own needs. Likewise we kindly ask you to notify us immediately upon such a case by sending an email message to the sender's address, and subsequently delete the document. Tatra banka, a.s. Hodzovo namestie 3, 811 06 Bratislava 1 ICO: 00 686 930 Zapisana v obchodnom registri Okresneho sudu Bratislava I Oddiel: Sa, vlozka cislo: 71/B

1 0

perm 06400
by Carsten Thieswald1 27 Nov '02

27 Nov '02

I just joined the mailinglist. Therefor I copied my mailed my old mail into this one. umask sounds reasonable. But i don't have a clue how to influence it. - toutch test results in afile with 644 - umask is 022 in /etc/bashrc - I'm running RedHat 7.2 . Where can I change umask for syslog-ng? On Mon, Nov 25, 2002 at 06:23:56PM +0100, Carsten Thieswald1 wrote: > Hello, > > I try to use the option perm(0640) when creating a file. But it seems that > only the default permission is used (0600). Putiing it in the global > section doesn't change anything. I'm using version 1.4.15. I'm facing > similiar problems with dir_perm. umask ? -- Bazsi

3 2

Blocking on AIX
by Esteban Essed 27 Nov '02

27 Nov '02

Hi, I'm trying to log emergency messages to all users: destination d7 { usertty ("*"); }; The problem is this blocks on a 'bad' tty (/dev/pts/1). Using 'who' this tty shows a logged in user, but the user is not logged in anymore (since a week). In afuser.c in do_handle_afuser_log the function write_raw_with_poll() from io.c (of libol) is used and that uses poll (&pfd, 1, -1); The -1 indicates no timeout and syslog-ng blocks on this call. Is there a solution to this problem, other than not using usertty("*")? I am using syslog-ng 1.4.17 with libol 0.2.23 Thanks, Esteban Essed _________________________________________________________________ MSN 8 with e-mail virus protection service: 2 months FREE* http://join.msn.com/?page=features/virus

1 0

file source driver ???
by Salim A. Pathan 26 Nov '02

26 Nov '02

hi all, is it possible to use "/var/log/messages" file as a source driver to syslog-ng program?????? if yes then how???? can anyone tell me how to use "file("filename" [options])" ???????i got some idea from balabit.hu but not enough to start working with it. thanx in advance salim.

3 2