November 2002 - syslog-ng - lists.balabit.hu

current directory of syslog-ng
by Ed Ravin 25 Nov '02

25 Nov '02

I'm invoking syslog-ng with these flags: /usr/local/sbin/syslog-ng -f /etc/central-syslog-ng.conf -p /logtree/tmp/syslog-ng.pid -C /logtree -u logs -g logs I see from lsof that the current working directory of syslog-ng, after it has chroot'd, is /logtree/log (the top level of all the file detinations, or "/log" in the chroot). The problem with this is that the /logtree/log directory is owned by root, and I think I'm unable to get core dumps of syslog-ng when it is run non-root and chroot'd because the file permissions of that directory don't permit syslog-ng to write a core file. What's the best way to solve this? I'm thinking a config file directive to set the current working directory would be nice. For my chroot'd environment, I had accidentally included features that don't work in a chroot, like usertty(user) which requires both root privs and access to /var/run/utmp, and I'd also specified the wrong place for the pidfile. Both of those caused aborts or segfaults when I looked at a ktrace, but no core files were ever written.

1 0

perm(0640)
by Carsten Thieswald1 25 Nov '02

25 Nov '02

Hello, I try to use the option perm(0640) when creating a file. But it seems that only the default permission is used (0600). Putiing it in the global section doesn't change anything. I'm using version 1.4.15. I'm facing similiar problems with dir_perm. Any idea Mit freundlichen Grüßen / Best regards Carsten Thieswald IBB .... an IBM Global Services Company Tel. : +49 (0) 40 6389 - 1750 mobil : +49 (0) 171 2281550

2 1

��ӭ��
by �� 25 Nov '02

25 Nov '02

点击进入深圳网络书店：　http://www.szbookshop.com 送货上门，货到付款，还有打折哦使用极星邮件群发，无须通过邮件服务器，直达对方邮箱，速度绝对一流！下载网址：http://love2net.51.net/，更多免费的超酷软件等你来下…… ---------------------------------------------------- INFORMATION This message has been sent using a trial-run version of the TSmtpRelayServer Delphi Component. ----------------------------------------------------

1 0

pgp signature problem on balabit file server
by Ed Ravin 23 Nov '02

23 Nov '02

While upgrading my syslog-ng, I also tried to upgrade lib-ol, but noticed that although there is a libol-3.3.5-tar.gz.asc file on the file server, it's a PGP encrypted message, not a PGP signature file.

2 1

crashbug fix in recent syslog-ng versions
by Balazs Scheidler 22 Nov '02

22 Nov '02

Hi, I have found two problems which are the possible cause of the crashes reported on this list. expect a new release soon if the fixes below prove to be effective. The first one is a misallocation, causing an off-by-one error: diff -u -r1.35 sources.c --- sources.c 21 Aug 2002 14:03:50 -0000 1.35 +++ sources.c 27 Oct 2002 07:35:23 -0000 @@ -163,10 +163,10 @@ self->dgram = dgram; self->next = next; self->prefix = prefix; - self->max_log_line = MAX(max_log_line, pad_size) + 1; + self->max_log_line = MAX(max_log_line, pad_size); self->pad_size = pad_size; self->msg_flags = msg_flags; - self->buffer = ol_space_alloc(max_log_line); + self->buffer = ol_space_alloc(self->max_log_line); return &self->super; } ---- end of patch The second one is triggered with much less probability, it is also an off-by-one (this one can be triggered when the byte _after_ the allocated buffer is either '\n' or '\r'). diff -u -r1.27 -r1.28 --- log.c 21 Aug 2002 14:03:50 -0000 1.27 +++ log.c 18 Oct 2002 12:31:08 -0000 1.28 @@ -44,11 +44,9 @@ static void parse_log_msg(struct log_info *lm, UINT32 length, UINT8 *data, UINT8 *prefix) { unsigned char *src; - int left; - int pri; + unsigned int left, pri, oldleft; time_t now = time(NULL); char *oldsrc; - int oldleft; src = data; left = length; @@ -241,7 +239,7 @@ lm->stamp = now; } - for (oldsrc = src, oldleft = left; oldleft >= 0; oldleft--, oldsrc++) { + for (oldsrc = src, oldleft = left; oldleft > 0; oldleft--, oldsrc++) { if (*oldsrc == '\n' || *oldsrc == '\r') *oldsrc = ' '; } lm->msg = c_format_cstring("%z%s", prefix ? prefix : (UINT8 *) "", left, src); -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

6 11

syslog-ng transform hostname
by vj23x＠netscape.net 21 Nov '02

21 Nov '02

Is there a way for syslog-ng to change the source hostname according to some regular expression before logging the message? We have some routers which have suffixes on their names we wish to strip off from the syslog messages. Example: rt001atl6-hssi6-0 -> rt001atl6 We'd like the name to get logged without everything after the '-' character. I'm stumped on how to do this with syslog-ng! It is such a powerful program, I believe it must be possible. __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

1 0

log_fifo_size() directive
by Luc Mazardo 21 Nov '02

21 Nov '02

Do you plan to use the directive log_fifo_size() as a destination option for udp() and tcp() destinations instead of use it global setting ? Thanks in advance for a futur response and for your work. -- Luc.Mazardo(a)cvf.fr

2 1

(no subject)
by Madhvi Gokool 21 Nov '02

21 Nov '02

Hello I have configured syslog on several routers and right now all the syslog messages are sent to one file. With syslog-ng, is it possible to have a log file for each router on the network. Regards madhvi

2 1

sylog-ng internal messages
by Guillaume LACHENAL 20 Nov '02

20 Nov '02

Where are syslog-ng internal() logged ? using destination d_hosts { file( "/var/log/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" ); }; i can't find anything relating to syslog-ng when grep'ing from /var/log/*/*/*/*/* thanks for help regards Guillaume

1 0

Syslog-ng 1.6
by Esteban Essed 20 Nov '02

20 Nov '02

Hi Balázs, Do you have any idea when you will be releasing 1.6? I mean a stable version of the 1.5 features. I know 1.5 is quite (very?) stable, but my employer only wants an official stable release. Regards, Esteban Essed. _________________________________________________________________ The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0