November 2002 - syslog-ng - lists.balabit.hu

Re: chroot and hostname resolution problem [was : Re: [syslog-ng]centralized
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

Balazs Scheidler wrote : (snip) > those files are loaded dynamically by the libc ok I now understand better > do you have resolv.conf/host.conf ? You're right ! 8561 open("/etc/resolv.conf", O_RDONLY) = 5 8561 open("/etc/host.conf", O_RDONLY) = -1 ENOENT (No such file or directory) question : what's the difference, in name resolution process, between /etc/hosts.conf and /etc/nsswitch.conf my updated config : $JAIL/etc/resolv.conf is ok and working (tested outside the jail) $JAIL/etc/nsswitch.conf contain "hosts: dns" $JAIL/etc/hosts.conf contain "order bind" syslog-ng continue to resolve hostnames only if they are in $JAIL/etc/hosts

1 0

Re: chroot and hostname resolution problem [was : Re: [syslog-ng]centralized
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

Gregor Binder wrote : > Hi, > > > > doing 'strace /etc/init.d/syslog-ng start', I can't find something > > > strange, > > I don't know about Linux/strace, but on most systems, you would have > to use an option to the tracing utility to trace calls of child -- man strace -- -f Trace child processes as they are created by currently traced processes as a result of the fork(2) system call. -- man strace -- > processes. Looks to me like you are tracing the shell process only. > > Try to run the syslog-ng BINARY from strace, and look for problems > like Ed suggested. 8254 open("/lib/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) 8254 open("/lib/libnss_dns.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) and I suppose those libs are needed by the resolver ... Why 'ldd syslog-ng' does not reported this two files ? (nor ldd on the libs returned by the previous commands) How could I 'guessed' that I need to copy this files into the jail ? > > > > Is there someone who is running a chrooted syslog-ng running under a > > > non root user as a log collector without any (hostname resolution) problem > > > ? > > I am - but I have "use_dns(no)" in my config. > > Same here. I don't see any technical reason why this wouldn't work, > unless you are missing resolv libraries (e.g. on Solaris) or > supplementary configuration files in the jail. > > Gregor. Now my syslog-ng is resolving almost as I want : Althougt my $JAIL/etc/nsswitch.conf contains "hosts dns", hostnames are only resolved if they are in $JAIL/etc/hosts ! Amazing ... I'll continue debugging, I progress ;-)

3 2

Re: chroot and hostname resolution problem [was : Re: [syslog-ng]centralized
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

Ed Ravin wrote : > Guillaume LACHENAL writes: >> >> can't find ktrace > > Ah, you must be using Linux. Should have said that up front. Yes. >> doing 'strace /etc/init.d/syslog-ng start', I can't find something >> strange, > > Look for "file not found" errors or anything else related to file > access. Can't find any error like this > Is there someone who is running a chrooted syslog-ng running under a > non root user as a log collector without any (hostname resolution) problem > ? > > I am - but I have "use_dns(no)" in my config. Could you try with "use_dns(yes)" ? > How about posting the log - make sure there is no private information > in it. If it's too huge put it up on the web somewhere and post the > URL to the list. See strace log attached (I'm running syslog-ng in debug mode with -d -v)

1 0

chroot and hostname resolution problem [was : Re: [syslog-ng]centralized loghost]
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

can't find ktrace doing 'strace /etc/init.d/syslog-ng start', I can't find something strange, but this kind of things if out of my knowledge. I can send the log if someone could help. Is there someone who is running a chrooted syslog-ng running under a non root user as a log collector without any (hostname resolution) problem ? The jail is correctly configured. I've checked the necessary libs w/ 'ldd syslog-ng' and build the cache with 'ldconfig' (chrooted of course) /etc/nsswitch.conf & /etc/resolv.conf are in the jail too I'm currently running 1.5.21 w/ libol-0.3.3 "Guillaume LACHENAL" <glachenal(a)on-x.com> Sent by: syslog-ng-admin(a)lists.balabit.hu 10/30/02 11:14 Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: Subject: Re: [syslog-ng]centralized loghost /etc/nsswitch.conf is available in the jail ktrace & truss are command not found on the box, i'll search for it when not chrooted, syslog-ng correctly resolve hostnames. "Ed Ravin" <eravin(a)panix.com> Sent by: syslog-ng-admin(a)lists.balabit.hu 10/28/02 17:31 Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: Subject: Re: [syslog-ng]centralized loghost Guillaume LACHENAL writes: > As syslog-ng run chrooted, I've copied /etc/resolv.conf & /etc/hosts > into the jail. > It does not fix the issue Does your system also require /etc/nsswitch.conf in the chroot? Do a ktrace/truss on the startup in the chroot and see if it finds all the files it needs to do DNS lookups. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

suggestion for keep_hostname() option
by Nam 05 Nov '02

05 Nov '02

Could keep_hostname() be implemented as an option usable locally to source drivers tcp and udp instead of just being a global option? The following example will illustrate what I'm getting at. The following excerted configs are used on the syslog-ng servers: options{ keep_hostname(no); use_dns(no); chain_hostname(no); }; source syslog { udp( port(514) ); }; source syslog-ng { tcp( port(514) ); }; When host A sends syslog message to syslog-ng server B, the message is written with the host A IP address. Then, syslog-ng server B relays this message to a central syslog-ng server C, the message is written with the syslog-ng server B IP address. It would be useful to write the message at the central server with the host A IP address as that is the IP address that originated the message. I could change the global option on the central syslog-ng server to be keep_hostname(yes) and the message will be written with host A IP address. However, that means that messages that are not being relayed (e.g. sent directly from a syslog host to the central syslog-ng server C) will have the keep_hostname(yes) applied when the desired option is keep_hostname(no) for those messages. The following example config shows the extension of keep_hostname() use that I'm suggesting. options{ use_dns(no); chain_hostname(no); }; source syslog { udp( port(514); keep_hostname(no); ); }; source syslog-ng { tcp( port(514); keep_hostname(yes); ); }; Possibly a patch Balazs? :-) A side note, with keep_hostname(no) and use_dns(no) the syslog-ng internally generated messages are written with the hostname. Possibly make it (or optionable) that when keep_hostname is no, those internal messages are written with the host IP address? Keeps the written log structures consistent especially when using macro expansions. Nam __________________________________________________________ Get your FREE personalized e-mail at http://www.canada.com

1 0

1.5.23 dies
by Jaakko Niemi 05 Nov '02

05 Nov '02

Hi, gc_mark: Marking object of class 'affile_dest_reaper' (1) io.c: sockaddr2info(): Unsupported address family 63828. Program received signal SIGABRT, Aborted. 0x40054781 in kill () from /lib/libc.so.6 (gdb) bt #0 0x40054781 in kill () from /lib/libc.so.6 #1 0x40054464 in raise () from /lib/libc.so.6 #2 0x40055be1 in abort () from /lib/libc.so.6 #3 0x080599ee in fatal ( format=0x8061000 "io.c: sockaddr2info(): Unsupported address family %i.\n") at werror.c:190 #4 0x08058e96 in sockaddr2address_info (addr_len=256, addr=0xbffff7a8) at io.c:1032 #5 0x0804aaf0 in do_handle_line (self=0x8070600, length=62, data=0x8070644 "<86>Nov 5 18:26:38 sshd[346]: connection from \"192.168.1.1\"", addr=0xbffff7a8, addrlen=256) at sources.c:70 #6 0x0804ad7a in do_read_line (h=0x80639a0, read=0xbffff90c) at sources.c:121 #7 0x08057c1f in read_callback (fd=0x8063958) at io.c:419 #8 0x0805780b in io_iter (b=0x80637f8) at io.c:263 #9 0x0804a07f in main_loop (backend=0x80637f8) at main.c:197 #10 0x0804a9d6 in main (argc=2, argv=0xbffffb74) at main.c:527 Seems to be happening when something gets logged from pam to authlog. 1.5.15 works with same configuration. In configuration I have: source src { unix-dgram("/dev/log"); internal(); file("/proc/kmsg"); }; Any more info I can give? --j

2 6

RE: [syslog-ng]Feedback about insertdb.pl
by _/CaT\_ 04 Nov '02

04 Nov '02

Sorry, is only a obsolete variable. Please comment or removed $ENV{'DBI_DSN'}='syslog'; $ENV{'DBI_USER'}='root'; $ENV{'DBI_PASS'}='mysqladmin'; #$ENV{'DBI_TABLE_SYSLOG'}='xxx'; $ENV{'DBI_PIPE_SYSLOG'}='/var/chroot/syslog-ng/dev/mysql.pipe'; $ENV{'ERR_MSG'}='/var/chroot/syslog-ng/var/log/err_DB_msg.log'; my $DB_SB='mysql'; my $DEBUG = 1; my $test_dsn = $ENV{'DBI_DSN'} || die "DSN not set\n"; my $test_user = $ENV{'DBI_USER'} || die "User not set\n"; my $test_password = $ENV{'DBI_PASS'} || die "Password not set\n"; #my $table = $ENV{'DBI_TABLE_SYSLOG'} || die "Table not set\n"; my $pipe = $ENV{'DBI_PIPE_SYSLOG'} || die "Pipe file not set\n"; my $errmsg = $ENV{'ERR_MSG'} || die "File ERR_MSG not set\n"; -----Original Message----- From: M.Ghalaie [mailto:mgh@mgn.net] Sent: Monday, November 04, 2002 8:00 PM To: cat_roger22(a)hotmail.com Subject: Re: [syslog-ng]Feedback about insertdb.pl Hello, I tested used your scripts "Perl". But I do not know to what "$ENV{'DBI_TABLE_SYSLOG'}='xxxxx'"... _/CaT\\_ wrote: > Hi *, > You've posted any feed-back about this post of mine: > http://lists.balabit.hu/pipermail/syslog-ng/2002-October/003905.html > With this solution I've resolved all my problem with insertions into > DB. > > Cheers > _/CaT\_ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > -- ---------------------------------------------- Mansour GHALAIE ---------------------------------------------- MGN De'partement Syste`me 8 Rue Grange Dame rose-78140 VELIZY (France) Tel : 01 34 49 06 37 Fax : 01 34 49 06 79 E.mail : mgh(a)mgn.net Site web : www.mgn.net ----------------------------------------------

1 0

Re: [syslog-ng]SIGXXX logrotate patch suggestion.
by Ted_Rule＠flextech.co.uk 04 Nov '02

04 Nov '02

Many many thanks, Balazs. Ted ************************************************************************************************ ************************************************************************************************ WATCH THE LATEST SERIES OF WILL AND GRACE EVERY WEDNESDAY AT 8PM, FROM NOVEMBER 13TH ONLY ON LIVING TV - RESPONSIBLE OWNERS OF WILL AND GRACE. ************************************************************************************************ ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

SIGXXX logrotate patch suggestion.
by Ted_Rule＠flextech.co.uk 04 Nov '02

04 Nov '02

This is allied to my previous request a few weeks ago that syslog-ng doesn't close and re-open listener sockets across a SIGHUP/reconfigure - all in a desire to drop as few messages as possible across the overnight log rotation. How's about another variation on the same theme, namely to provide a separate signal for rotating logs, in a similar manner to Squid which has separate signals for daemon reconfiguration and log rotation. The action of the new signal would merely be to close all existing output descriptors, and re-open them with the same parameters. This would allow overnight logrotate commands to rename logs before SIGXXX'ing syslog-ng and thus achieve log rotation without requiring listener's are closed/re-opened across the logrotate. Whether or not this is particulary easy given the current layout of the output file objects, I'm afraid I don't know, but it feels to me as though this might be easier to code than the reworking of SIGHUP to preserve listeners across a reconfigure. Any takers? Ted ************************************************************************************************ ************************************************************************************************ WATCH THE LATEST SERIES OF WILL AND GRACE EVERY WEDNESDAY AT 8PM, FROM NOVEMBER 13TH ONLY ON LIVING TV - RESPONSIBLE OWNERS OF WILL AND GRACE. ************************************************************************************************ ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

2 1