December 2002 - syslog-ng - lists.balabit.hu

�ؼ��
by �� 24 Dec '02

24 Dec '02

深圳网络书店祝您圣诞快乐！点击进入深圳网络书店：　http://www.szbookshop.com ----------------------------------------------------------------------- 使用极星邮件群发，无须通过邮件服务器，直达对方邮箱，速度绝对一流！下载网址：http://love2net.51.net/，更多免费的超酷软件等你来下…… ---------------------------------------------------- INFORMATION This message has been sent using a trial-run version of the TSmtpRelayServer Delphi Component. ----------------------------------------------------

1 0

running swatch as a different user from syslog-ng
by Mika S. Marjamaki 23 Dec '02

23 Dec '02

Hi, I'm using syslog-ng 1.5.23 on RedHat 8.0. I'm running swatch 3.0.4 from syslog-ng with a destination configuration like this: - - - syslog-ng.conf destination d_swatch { program("/usr/bin/swatch --config-file=/etc/swatchrc.alerts --read-pipe=\"cat /dev/fd/0\" "); }; - - - However, I don't like running swatch as root. Central loghost Mini-HOWTO <http://www.campin.net/newlogcheck.html> suggests that I could run swatch as a different user with a configuration like this: - - - syslog-ng.conf destination swatch { program("su syslog -c '/usr/bin/swatch --config-file=/etc/swatchrc --read-pipe="cat /dev/fd/0"' "); }; - - - That kind of configuration does not work for me, though. I noticed that I had to put backslashes in front of "-signs around "cat /dev/fd/0". Ideas, anyone? Best Regards, Mika -- # Mika S. Marjamäki <ext-Mika.S.Marjamaki(a)nokia.com> +358-40-536-9514 # Unix System Specialist, NRC Unix Team

2 1

Error connecting to log server
by Richard E. Perlotto II 23 Dec '02

23 Dec '02

I have a set of Mandrake 9.0 boxes all running the latest version of syslog-ng (1.5.24). I have a centralized log server that is receiving logs from a variety of udp and tcp (syslog-ng) sources. All but one of the devices is able to log to the log server. The error that I get from that one server is: Error connecting to remote host AF_INET(10.1.1.1:5100), reattempting in 10 seconds Now I know that packet is getting there because I can look at an ACL from a router that sits between them: Dec 21 22:25:16 router1/router1 1553: Dec 21 22:28:09.816 pst: %SEC-6-IPACCESSLOGP: list 100 permitted tcp 10.1.1.1(32830) (FastEthernet1/0 0030.4841.12a4) -> 10.2.1.1(5100), 1 packet This same log server is also successfully receiving tcp logs from other syslog-ng servers without a problem and one of these is on the same subnet as the one that is having the problem connecting. The interesting thing is that even with using 514/udp the traffic does not seem to get to the log server. If I revert back to the standard syslog daemon, life is well again. Richard

3 4

change user:group of destination file
by Alex Howansky 23 Dec '02

23 Dec '02

libol 0.3.6 syslog-ng 1.5.24 According to the docs/faq, I should be able to do this: destination d_gb { file("/log/gb/$YEAR$MONTH$DAY" owner(log) group(log)); }; But when starting, I get: Starting syslog-ng: parse error at 51 Parse error reading configuration file, exiting. (line 51) What am I missing? P.S. The SSL cert on the mailman signup page for this list is expired. Thanks, -- Alex Howansky Wankwood Associates http://www.wankwood.com/

5 6

��Ϣ��
by zwb231 23 Dec '02

23 Dec '02

�𾴵��Ͽͻ�� ã��ǰ�ػݣ��վ��http://www.88dns.com/��ѡ��κ�һ��վ�ռ� �� 180 Ԫ ��˻��Ѻ��ϵ�¼һ�꣬ʹ��Ŀͻ��ܸ��ҵ�� Ϳռ��ػ��ڽ��ڹ��ӭ�� 1��200M��HTML�ռ䣩+ ��һ��150Ԫ/�� 2��60M�ռ�+60M��ҵ�ʾ� + ֧��ASP��CGI + ��һ��236Ԫ/�� 3��100MP�ռ�+100M��ҵ�ʾ� + ֧��ASP��CGI��ACCESS + ��һ��280Ԫ/�� 4��200MP�ռ�+200M��ҵ�ʾ� + ֧��ASP��CGI��ACCESS + ��һ��336Ԫ/�� Ͽռ��ں��ݣ� ��ռ��ϣ��ѡ��--��ǹ�˾��վ ��http://www.88dns.com/��˽��. ��١��ȶ�ѹ��һ�С��ȫ��ӯͨ�˵ķ��ּ��֣�س�ŵ�� 1��ӯͨ��ȫ��ԭװDell PowerApp��Ӧ�÷�� 2��ӯͨ��ȫ��װ��Turbolinux��Microsoft��ϵͳ�� 3��׼��SNMP��24x7x365 ϵͳ��⣻ 4��ӯͨ��ͻ�һ��ڿ��ȫ��˿��ʵ��˿ ��ҳ��Ҫ��ӭ��ϵ�� ϵE-mail:��zwb@logindns.com ��QQ��40327558�� 绰��0592-8667174��棺 0592--5580200 ֣��ϵ лл!�� ף��꼪�顢��С��˳��!!! �� ӯͨԶ��Ƽ�� --------------------------------------------------------------- �е�Ⱥ��ʼ�,��ר��(http://www.21cmm.com) ��CMM��У(http://www.21cmm.com)��Ŀ��ר��

1 0

Installing on Mac OS X
by Ken Toney 20 Dec '02

20 Dec '02

I am trying to install syslog-ng on Mac OS X. I am using version 1.5.24 of syslog-ng and libol 0.3.6 with autoconf 2.5. After installing libol, I configured syslog with no apparent difficulties. When I ran 'make' for syslog, I had errors. Anybody know what this means? Make output: Making all in src make username Making all in . gcc -DHAVE_CONFIG_H -I. -I/Users/username/syslog-ng-1.5.24/src -I. -g -O2 -Wall -I/Users/username/syslog-ng-1.5.24/libol-0.3.6/src - D_GNU_SOURCE -c main.c gcc -DHAVE_CONFIG_H -I. -I/Users/username/syslog-ng-1.5.24/src -I. -g -O2 -Wall -I/Users/username/syslog-ng-1.5.24/libol-0.3.6/src - D_GNU_SOURCE -c sources.c sources.c: In function `do_read_line': sources.c:95: warning: passing arg 5 of pointer to function from incompatible pointer type gcc -DHAVE_CONFIG_H -I. -I/Users/username/syslog-ng-1.5.24/src -I. -g -O2 -Wall -I/Users/username/syslog-ng-1.5.24/libol-0.3.6/src - D_GNU_SOURCE -c center.c center.c:157: illegal expression, found `}' cpp-precomp: warning: errors during smart preprocessing, retrying in basic mode center.c: In function `do_distribute_log': center.c:157: warning: deprecated use of label at end of compound statement gcc -DHAVE_CONFIG_H -I. -I/Users/username/syslog-ng-1.5.24/src -I. -g -O2 -Wall -I/Users/username/syslog-ng-1.5.24/libol-0.3.6/src - D_GNU_SOURCE -c filters.c filters.c:266: undefined type, found `uint32_t' filters.c:267: undefined type, found `uint32_t' filters.c:268: undefined type, found `uint32_t' cpp-precomp: warning: errors during smart preprocessing, retrying in basic mode filters.c: In function `do_filter_netmask': filters.c:266: `uint32_t' undeclared (first use in this function) filters.c:266: (Each undeclared identifier is reported only once filters.c:266: for each function it appears in.) filters.c:266: parse error before "host" filters.c:270: `host' undeclared (first use in this function) filters.c:271: `netw' undeclared (first use in this function) filters.c:272: `mask' undeclared (first use in this function) filters.c: In function `do_filter_call': filters.c:342: warning: implicit declaration of function `memcmp' make[3]: *** [filters.o] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive-am] Error 2 make: *** [all-recursive] Error 1 ---Ken Toney ktoney(a)tiff.org

2 1

�ؼ��-298Ԫ��һ��ͼ��
by �� 19 Dec '02

19 Dec '02

为迎接圣诞、元旦，深圳网络书店特推出一批电子图书及特价新书。您只需花298元即可拥有一座3000册图书的家庭图书馆。会议、个人交往中的馈赠精品个人收藏的珍品、学习的工具书单位奖励员工的上佳奖品及纪念品关爱孩子成长的贴身礼物电子图书目录：家庭藏书集锦（10CD） 298元中华历史全集（11CD） 268元中外文学名著1000部（12CD） 268元中华传世藏书（5CD） 98元中华艳情文库（4CD） 98元中华历史文库（7CD） 168元中华经典文库（13CD） 328元中华珍稀小说文库（8CD） 228元中国小百科全书（1CD） 38元中国现代文学名著经典二（1CD） 38元中学生必读中外文学名著（1CD） 38元学生辞海辞源（2CD） 48元世界名人传记文学（1CD） 38元现在点击进入深圳网络书店：　http://www.szbookshop.com ----------------------------------------------------------------------- 使用极星邮件群发，无须通过邮件服务器，直达对方邮箱，速度绝对一流！下载网址：http://love2net.51.net/，更多免费的超酷软件等你来下…… ---------------------------------------------------- INFORMATION This message has been sent using a trial-run version of the TSmtpRelayServer Delphi Component. ----------------------------------------------------

1 0

Re: [syslog-ng]Problems getting tcp wrappers to work in Solaris
by Ted_Rule＠flextech.co.uk 19 Dec '02

19 Dec '02

This sounds similar to the problems with the configure script in ucd-snmp-4.2.3 finding tcp_wrappers on Linux/Solaris... there was a patch posted which I believe fixed 4.2.4 and above.... Maybe a compare of the way the ucd-snmp configure and syslog-ng configure finds tcp_wrappers might provide a clue? Ted Jason Buchanan <jsb(a)cmpnet.com> on 19/12/2002 17:03:58 Please respond to syslog-ng(a)lists.balabit.hu To: syslog-ng(a)lists.balabit.hu cc: (bcc: Ted Rule/160GPS/Flextech/UK) Subject: Re: [syslog-ng]Problems getting tcp wrappers to work in Solaris Balazs Scheidler wrote: >On Wed, Dec 18, 2002 at 11:11:38PM -0500, Ed Ravin wrote: > > >>Jason Buchanan writes: >> >> >>>Can someone pass along the format required for properly implementing tcp >>>wrappers for syslog-ng? >>> >>> >>I do this : >> >>in hosts.deny: >> >> syslog-ng: ALL EXCEPT 1.2.3.4 >> >>And I don't have a hosts.allow file. >> >>However, the example you posted looked OK - it's possible there's >>something else wrong. Have you tried strace/ktrace/truss as >>appropriate for your platform and see if syslog-ng is actually >>searching for / reading in /etc/hosts.allow and hosts.deny? >> >> > >Have you configured syslog-ng to actually use TCP wrappers? >Hint: check your './configure' output. > configure doesn't seem to work real well. I have tcpd.h in /usr/local/include but configure doesn't find it. I make a symlink so configure could find it in /usr/include but that didn't work either. So I copied libwrap.a to /usr/lib but it still wasn't finding hosts_access in the library, even though I rebuilt tcp wrappers from a freshly-extracted archive. Is there a different tcp wrappers distribution that I should use? This is for Solaris 8. Thanks! Sorry for the long quote - hopefully it will help anyone else who missed the first part of the thread. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Problems getting tcp wrappers to work in Solaris
by Jason Buchanan 19 Dec '02

19 Dec '02

hi, I am running out of ideas how to get syslog-ng to work properly with tcp wrappers. For hosts.deny: ALL: PARANOID ALL: ALL For hosts.allow: syslogng : 1.2.3.4 syslog-ng : 1.2.3.4 I have not been successful getting syslog-ng to refuse logging data from other hosts in my test lab. Can someone pass along the format required for properly implementing tcp wrappers for syslog-ng? Thanks, Jason

3 3

linux kern log entries
by Kai Wang 19 Dec '02

19 Dec '02

We implemented syslog-ng on our linux boxes. I found that syslog-ng handles facility "kern" as "user" on our machines. Is this a bug? How to fix it? Thanks Kai Wang University of Calgary

3 2