November 2002 - syslog-ng - lists.balabit.hu

Basic questions
by qian＠x85.com 11 Nov '02

11 Nov '02

I'm new to this mailing list. Here are some basic questions. Any help is appreciated. Q1. If I want to set a centralize log server, do i need to run your version of syslogd (syslog-ng) on log server only or all the clients need that version too? Q2. To save log from differnt host to its file, one needs to specify this: destination host ( file("/var/log/$HOST/....") ) on /etc/syslog.conf only on log server? Q3. If I use a rely server, so log generated from host1, relyed thru host2 to log server, is it recorded as host2 or host1 or host1/host2 depending on the option of keep_hostname/chain_hostname? What I want is to preserve the orinigal host (host1), how to do it? Yonglin Qian

2 1

(no subject)
by Danczi Jozef 11 Nov '02

11 Nov '02

______________________________________________________ Get Paid... With Your Free Email at http://www.zwallet.com/index.html?user=hermes1

1 0

res_init not found on Solaris 9
by joe781＠att.net 11 Nov '02

11 Nov '02

I am using Libol 0.3.5 and syslog-ng 1.5.23. Libol installed without a problem. The make for syslog-ng terminates as follows: gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor -lfl /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file res_init main.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /usr/local/src/syslog-ng-1.5.23/src The ./configure step finds it OK. Where would I find it? TIA. Joe Haggerty

3 2

Error: Changing permissions on special file?
by Joerg Sommer 10 Nov '02

10 Nov '02

Hi, why is the changing of the permissions on a special file an error? This could be an info message or an warning, but not an error. Joerg.

1 0

autoheader error building 1.5.23 under Mandrake 9.0
by Jay Levitt 10 Nov '02

10 Nov '02

On my Mandrake 9.0 box, I get the following error during make: cd /home/jay/syslog-ng-1.5.23 && autoheader /usr/bin/autoheader-2.13: Symbol `HAVE_RES_INIT' is not covered by /usr/share/autoconf/acconfig.h ./acconfig.h I have automake 1.4-p6 and autoconf/autoheader 2.13. I don't really understand the workings of the GNU automake/autoconf tools, but it definitely seems that HAVE_RES_INIT is in config.in but not acconfig.h. This symbol wasn't referenced in 1.5.22, so that builds fine.. Jay Levitt

2 1

RE: [syslog-ng]Information regarding interpreting Syslog messages
by Wrzesinski, Michael 08 Nov '02

08 Nov '02

Hello, maybe have a look at Tina Birds web site (http://www.shmoo.com/~tbird/) There are a few references. regards Michael Wrzesinski > -----Ursprüngliche Nachricht----- > Von: Deepu George [mailto:DEEPUG@mascotsystems.com] > Gesendet: Freitag, 8. November 2002 05:49 > An: syslog-ng(a)lists.balabit.hu > Betreff: [syslog-ng]Information regarding interpreting Syslog messages > > > Hi All, > > Is there any documentation available which can help to > interpret syslog > messages > > Best regards > Deepu

1 0

Information regarding interpreting Syslog messages
by Deepu George 08 Nov '02

08 Nov '02

Hi All, Is there any documentation available which can help to interpret syslog messages Best regards Deepu DISCLAIMER: Information contained and transmitted by this E-MAIL is proprietary to Mascot Systems Limited and is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If this is a forwarded message, the content of this E-MAIL may not have been sent with the authority of the Company. If you are not the intended recipient, an agent of the intended recipient or a person responsible for delivering the information to the named recipient, you are notified that any use, distribution, transmission, printing, copying or dissemination of this information in any way or in any manner is strictly prohibited. If you have received this communication in error, please delete this mail & notify us immediately at Mailadmin(a)mascotsystems.com Before opening attachments, please scan for viruses.

1 0

REAL ESTATE!!!!!!!!!!!!!!!!!!!!!!!
by DR.JOHNSON IGE. 08 Nov '02

08 Nov '02

ATTN:SIR. ASSISTANCE REQUIRED FOR ACQUISITION OF ESTATE I write to inform you of my desire to acquire estates or landed properties in your country.Considering your very strategic and influential position I know you will be in a better possition to help us, We would want the transaction to be strictly confidential as possible,hence our desire to have an overseas agent. I have therefore been directed to inquire if you would agree to act as our overseas agent in order to actualize this transaction.The deal,in brief,is that the funds with which we intend to carry out our proposed investments in your country is presently in a coded Escrow account of a Bank in Canada. However,I am,DR.JOHNSON IGE. a native of Warri in Niger Delta,Nigeria and I am the Executive Director with the Nigerian Export Processing Zone Authority of Nigeria (NEPZA).Please accept my apology for using this medium to reach you for a transaction/business of this magnitude,but this is due to the confidentiality and prompt access reposed on this medium.Be informed that a member of the Nigerian Export promotion Council(NEPC) who was the Government delegation to your country during a trade exhibition gave your enviable credentials/particulars to me.I have decided to seek your co-operation in the execution of the deal described hereunder for the benefit of all parties and hope you will keep it as a top secret because of the nature of this business. Within my Department NEPZA where I work as a Director and with the cooperation of Two other top Management officials.We have in our possession as overdue payment bills totalling to Thirty One Million,Five hundred Thousand US Dollars(US$3I,500.000.00) which was our commission for awarding a contract to Jullius Bergger of Germany A construction firm based in Germany.This amount(US$31.5M)represent the balance of the total contract value executed on behalf of my Department by this foreign contracting firm which we the officials over-invoiced deliberately.Though the actual cost have been paid to the original contractor leaving the balance in the tune of the said amount which we have in principle gotten approval to remit by Key Tested Telegraphic Transfer(K.T.T)to any foreign bank account you will provide by filing in an application through the Bank in Canada where the fund have been lodge for the transfer of rights and priviledge of the former contractor.Our arrangement with the construction company was to deposit our over-involce sum into a save account with the bank till we retire from active service to my Ministry for investment in your country.As you Know,we are civil servant and does not have the previledge to operate a foriegn account. We have made countless effort with the management of the bank in Canada to see that the fund is transfer to another country for the propose investment,the management of the bank turn the application down that legal documentation must be effected before the fund is been transfer to any bank account.As a civil servant to the Government,we can not obtain this documents without the help or assistance of an international acclaimed personality(Foriegn Body)to fixe in as the true contractor/beneficiary to the fund,these will enable us obtain all relevant documents in your favour with the assistance of the accredited Attorney with my Ministry. We are soliciting for your mutual understanding in lodging in application to the bank in Canada as soon as all the documents is processed in your name to release or transfer the contract fund to your account.We will truely compensate you for your candid effort in this deal and as well,you will be acting as our agent for the landed/housing property in your country.Once you have confirm your willingness to help us,the name and contact address of the bank,our account information with the bank and all the relevant details of the contract fund will be given to you for your perusal and for confirmation with the bank in Canada.The cost of processing the backup documents will be a collective responsibility from both parties so your sincerity and understanding will be highly appreciated to enable us achieve success. All we need from you now is your company name & address(if any),telephone & fax numbers,your banking details and your recent picture for identification when we come over to your country for the project.As soon as i hear from you,I will give you our website to visit. Thank you so much for your understanding and I await your urgent response to this mail. Yours Faithfully, DR.JOHNSON IGE. N.E.P.Z.A.

1 0

Re: [syslog-ng]replacing Linux klogd by a chrooted syslog-ng running as a non root user
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

Balazs Scheidler wrote : > On Thu, Nov 07, 2002 at 03:10:50PM +0100, Guillaume LACHENAL wrote: > > Is it for the same reasons that I have (almost) every time to send SIGTERM > > *twice* > > for syslog-ng to terminate ? > > it was a bug, and should have been fixed in latest 1.5.x release. OK. I'll upgrade when the best of syslog-ng will be configured quite fine on the box ;-) > > > then instead of using syslog-ng's own chroot feature, use the chroot > > > > Are you sure a chrooted process can follow symlinks outside the jail ? > > it's not the chrooted process which accesses the symlink, the programs > running outside are accessing a file _in_ the chroot. (symlink in /dev/log > pointing to /chroot/dev/log) Could you please explain. It works as you say with ntpd chrooted on my box. But, after 'chroot /chroot /sbin/ntpd' the running ntpd only see what's under '/chroot/'. How it works when ntpd attempt to log something ? (to /chroot/dev/log) > I remember, libc itself shouldn't be needed. ldd shows what syslog-ng is > linked to, but if it started outside, it will link to /lib/libc.so.6, and > _then_ chroot itself -> no need for libc in the jail itself. > > the others libresolv etc. are loaded after the chroot() call, so they must > be present in the jail as well. > > try rm-ing the libc inside the jail (and only libc the others might be > needed), and start syslog-ng, it _should_ work. Yes, it works

2 1

Re: [syslog-ng]logging from a chrooted process
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

Balazs Scheidler wrote: > On Thu, Nov 07, 2002 at 02:30:19PM +0100, Guillaume LACHENAL wrote: > > I'm currently trying to chroot some services on a Linux box (ntpd) > > > > strace'ing it to find the missing libs, I've seen that the process can't > > log as /dev/log is outside the jail > > > > > 9135 connect(4, {sin_family=AF_UNIX, path=" /dev/log"}, 16) = -1 > > ENOENT (No such file or directory) > > > > How to make a /dev/log into the jail ? or send the log via network to a > > log collector ? > > what about a unix-stream("/var/chroot/ntp/dev/log") source to syslog-ng? ... symlinked to /dev/log Yes, you indirectly reply me in https://lists.balabit.hu/pipermail/syslog-ng/2002-November/004096.html B> configuration initialization is performed prior to chroot-ing, so syslog-ng B> first opens the necessary devices, and then chroots itself. Instead of adjusting my conf file each time a chroot a service (OK, it's not every day ;-), it would be perfect if I can write a thing like : source s_chroot { unix-stream("/chroot/*/dev/log"); }; regards, Guillaume

3 2