February 2002 - syslog-ng - lists.balabit.hu

syslog-ng crash
by William D. Colburn (aka Schlake) 04 Feb '02

04 Feb '02

I induced my syslog-ng 1.4.14 to crash repeatably. I remember seeing some time ago that the author was in the hospital, and I see from the web page that not much has changed in quite a while, leading to beleive that he might still be indisposed. Normally I would disclose the crash to the list, but if no fix will be forthcoming I am afraid too let other people know how to down a server. Does anyone know if the author is still available, or if I should dig into the code to generate a patch on my own before releasing this information? -- William Colburn, "Sysprog" <wcolburn(a)nmt.edu> Computer Center, New Mexico Institute of Mining and Technology http://www.nmt.edu/tcc/ http://www.nmt.edu/~wcolburn

4 4

[PATCH] netmask-filter
by Gert Menke 04 Feb '02

04 Feb '02

Hi everybody, I have implemented a new filter for syslog-ng. You can now filter log messages based on their sender's IP address like this: # match a single host filter f_noc21 { netmask("134.130.3.73"); }; # match a whole subnet filter f_noc { netmask("134.130.3.0/255.255.255.0"); }; I'll attach patches for syslog-ng versions 1.4.14 and 1.5.13. I have also made a small patch that fixes the behaviour of the emulated inet_aton function in utils.c. (It would not work with "255.255.255.255".) On some architectures you need this patch for my netmask-filter to work properly! Have fun and tell me what you think about it! Greetings Gert

5 12

host() expression
by Chuck Kelly 04 Feb '02

04 Feb '02

I would like to be able to create a single filter for multiple hosts. Can someone help me with the syntax. i.e. filter f_sec1 { program(sudo) and host(host1 or host2 or host3) ; }; -- Chuck

2 1

Regular Expressions with Syslog-nt
by Leon Oosterwijk 04 Feb '02

04 Feb '02

All, I'm trying to use Regular Expressions for my hostname. I'm running into somewhat of a problem with finding out what I can match on. Here are my questions. I appears that the logging only matches on the host portion of the hostname unless you turn on use_fqdn(yes); in the options section. However, if I turn this on, it will start writing the entries to the log file as: > Jan 30 13:19:15 gw03-bna.isdn.net/gw03-bna.isdn.net I wish it to only write > Jan 30 13:19:15 gw03-bna/gw03-bna But still be able to match on FQDN. (BTW, what is the deal with the hostname/hostname. Can I make it just be "hostname" no slashes, and name duplication) The second issue is the RegEx Syntax. I'm trying this: filter f_rtr_bna { host("^.*rtr.nrep.bna.isdn.net$"); }; filter f_rtr_mem { host("^.*mem.isdn.net$"); }; Which is obviously not working. What do need to do here?

2 1

buffering during network outage between relays
by Martin, Sylvain R. (LNG) 04 Feb '02

04 Feb '02

We're logging the data to a central database from 2 relays. Is there a way for syslog-ng to buffer the data while the database server is rebooting or innaccessible? Here's our current setup. All machines forward the syslog msg to either a production or development relay which runs syslog-ng and then the messages are forwarded to a server running an oracle DB. You may wonder why we have 2 relays... well we have a few hundrer servers and workstations and we're just implementing the DB aspect of it. 15 Millions rows for 6months growing by 100K rows/day. on the DB server I have a custom written syslogd which buffers data in case the DB is down but the problem resides with syslog-ng interrupting the relay, for 60 seconds, of messages to the oracle DB server if the server dies or reboots. Is there someway for syslog-ng to relay missed messages? The only other way I can think of doing it is kinda messy... having syslog-ng dump to a FIFO pipe where a perl script could buffer the data in an array or file until the DB server comes alive again. We're using 1.4.14 -------------------- - Cloud of servers - -------------------- / \ / \ -------- ------- relays - prod - - dev - -------- ------- \ / \ / ------------- - oracle DB - ------------- Sylvain Martin

2 1

[PATCH] Bug in syslog-ng-1.5.13/src/affile.c/expand_macro
by Gert Menke 04 Feb '02

04 Feb '02

Hi! I think I have found a small bug/typo in affile.c. Here's the patch: diff -r -U3 syslog-ng-1.5.13-orig/src/affile.c syslog-ng-1.5.13-patched/src/affile.c --- syslog-ng-1.5.13-orig/src/affile.c Wed Oct 24 12:46:06 2001 +++ syslog-ng-1.5.13-patched/src/affile.c Tue Jan 29 14:21:25 2002 @@ -578,11 +578,11 @@ break; } break; + } case M_MESSAGE: { /* message */ length = append_string(dest, left, msg->msg->data, msg->msg->length, escape); break; - } } default: break; Greetings Gert

2 1

Re: first day of month bug?
by klaas.vangend＠philips.com 04 Feb '02

04 Feb '02

Alex Howansky <alex(a)wankwood.com> wrote: > Note that first file, stamped with 2001 instead of 2002. It actually contains > entries that should have gone into 20020201. The entries in 20010201 all occur > within the first hour of the day. It's as if the value of $YEAR is off by one > during the first hour of the first day of a month. If I look at the responsible code in affile.c: if (cfg->use_time_recvd) tm = localtime(&msg->recvd); else tm = localtime(&msg->stamp); switch (id) { case 'y': length = snprintf(*dest, *left, "%04d", tm->tm_year + 1900); break; I don't see any reason for this problem, so I expect your localtime() is buggy... (If you're familiar with C, you should be able to tell really quickly if you write some test code) Groetjes, Klaas van Gend

1 0

RE: [syslog-ng]sending message by email
by Ohrberg, Mick 01 Feb '02

01 Feb '02

Another method is to create a script called for instance syslog-ng-mail.sh, containing #!/bin/sh while read line; do echo $line | /usr/bin/mailx -s "$1" $2 done ...and then pipe all your matched messages to this script with two arguments of the subject and email address to send to. This makes it very generic. /Mick > -----Original Message----- > From: Stephen C Burns [mailto:sburns@farpointer.net] > Sent: Friday, February 01, 2002 10:31 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]sending message by email > > > > Assuming you have a comprehensive file with all of the messages in > /var/log/$HOST/messages, just set up a nightly cron job to cat > /var/log/$HOST/messages|mail your email > > At 09:47 AM 2/1/2002, you wrote: > >I have been trying, unsuccessfully, to setup email > notification of certain > >log messages. The filters I am using are working great, but my email > >notifications are empty. > >What I would like is to receive an email with a subject line > similar to > >"Log notification for hostname" where hostname is the system > the message > >was received from, with the body of the email containing the > log message. > >Is anyone else doing this? Can you provide an example of > your method, if so? > >Or, can anyone give me any pointers on making this work? > > > >--- > >David Monk CCNA, MCSE > ><mailto:david@purplebear.net>david(a)purplebear.net > > > >The more things change, the more they stay insane. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

4 5

sending message by email
by David Monk 01 Feb '02

01 Feb '02

I have been trying, unsuccessfully, to setup email notification of certain log messages. The filters I am using are working great, but my email notifications are empty. What I would like is to receive an email with a subject line similar to "Log notification for hostname" where hostname is the system the message was received from, with the body of the email containing the log message. Is anyone else doing this? Can you provide an example of your method, if so? Or, can anyone give me any pointers on making this work? --- David Monk CCNA, MCSE david(a)purplebear.net The more things change, the more they stay insane.

2 2