June 2002 - syslog-ng - lists.balabit.hu

Long messages truncated in 1.5.x branch on Solaris 8
by Andreas Schulze 03 Jul '02

03 Jul '02

Hello, we are observing a wondrous behavior on our central logservers. We have an local application, that logs to the destinations above. And all messages greater that approx. 975 Bytes are truncated. But the enigma is: If using the local Solaris 'logger' application, all messages greater than 509 Bytes are truncated. But they are truncated on different positions depends on the message size! (Say, if you log 600 Bytes, you get the first 509 and if you try to log 761, you get the first 26.) Hmm ?! We tried out the log_msg_size() feature, available since 1.5.1?. With no luck. Both logservers using Solaris 8, one running syslog-ng 1.5.7, the other 1.5.18. We are using file() and pipe() destinations capable of queueing via log_fifo_size() and capable of formating output via template(..$MSG..\n). Before writing to the destinations, we do a lot of filtering, too. We are using the excellent syslog-ng a long time, but now we stuck inactive. Has anybody a hint for us? Is this a bug in syslog-ng, in Solaris, in our mind? Thanks a lot for any note. -- Best regards --Andreas Schulze [phone: +49.5246.80.1275, fax: +49.5246.80.2275] | I believe, it was Dennis Ritchie who said something like: | "C is rarely the best language for a given task, | but it's often the second-best". | The implication being that: "[...]" | | sh# cat>$$.c<<EOT | main(l,a,n,d)char**a;{for(d=atoi(a[1])/10*80-atoi(a[2])/5-596;n="@NK\ | ACLCCGZAAQBEAADAFaISADJABBA^SNLGAQABDAXIMBAACTBATAHDBANZcEMMCCCCAAhE\ | IJFAEAAABAfHJETBdFLDAANEfDNBPHdBcBBBEA_AL H E L L O, W O R L D! " | [l++-3];)for(;n-->64;)putchar(!d+++33^l&1);} | EOT | gcc -o$$ $$.c;clear;./$$ 52 8;rm -f $$*

2 5

Solaris 2.6 + syslog-ng 1.5.18
by Sangbutsarakum, Patai 28 Jun '02

28 Jun '02

Dear lists, =1= I've tried to install 1.5.18 but without luck. My environment is Solaris 2.6 SPARC, I've success in 1.4.15 but I need TEMPLATE feature so I moved. To log to MySQL. Please suggest. =2= In case of tremendous of messages to log to MySQL via pipe method. Is that pipe tolerate for big load? Thanks in advances Pat. == Messages at Compile time == # ./configure creating cache ./config.cache checking for a BSD compatible install... ./install-sh -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... missing checking for working autoconf... missing checking for working automake... missing checking for working autoheader... missing checking for working makeinfo... missing checking whether build environment is sane... yes checking for gcc... gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for bison... bison -y checking how to run the C preprocessor... gcc -E checking for flex... flex checking for flex... (cached) flex checking for yywrap in -lfl... yes checking lex output file root... lex.yy checking whether yytext is a pointer... yes checking whether make sets ${MAKE}... (cached) yes checking for ANSI C header files... yes checking for malloc.h... yes checking for unistd.h... yes checking for door.h... yes checking for stropts.h... yes checking for sys/strlog.h... yes checking for stdarg.h... yes checking for sys/klog.h... no checking for working const... yes checking whether time.h and sys/time.h may both be included... yes checking for modern utmp... yes checking for hosts_access in -lwrap... no checking whether to compile klogctl... no checking size of short... 2 checking size of int... 4 checking size of long... 4 checking for I_CONSLOG... yes checking for O_LARGEFILE... yes checking for working alloca.h... yes checking for alloca... yes checking for vprintf... yes checking for door_create in -ldoor... yes checking for select... yes checking for snprintf... yes checking for vsnprintf... yes checking for strerror... yes checking for inet_aton... no checking for strncpy... yes checking for getutent... yes checking for getopt_long... no checking for strcasecmp... yes checking for strptime... yes checking for pthread.h... yes checking for pthread_create in -lpthread... yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking whether to enable TCP wrapper support... no checking libol version >= 0.3.3... ok updating cache ./config.cache creating ./config.status creating Makefile creating src/Makefile creating src/tests/Makefile creating doc/Makefile creating doc/sgml/Makefile creating contrib/Makefile creating utils/Makefile creating syslog-ng.spec creating src/config.h # make Making all in src cd /usr/local/src/syslog-ng-1.5.18 && /usr/local/src/syslog-ng-1.5.18/missing autoheader WARNING: `autoheader' is missing on your system. You should only need it if you modified `acconfig.h' or `configure.in'. You might want to install the `Autoconf' and `GNU m4' packages. Grab them from any GNU archive site. cd .. \ && CONFIG_FILES= CONFIG_HEADERS=src/config.h \ /bin/sh ./config.status creating src/config.h src/config.h is unchanged make all-recursive Making all in . gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c main.c main.c: In function `main': main.c:437: warning: passing arg 2 of `resolve_user_group' from incompatible pointer type main.c:437: warning: passing arg 3 of `resolve_user_group' from incompatible pointer type main.c:441: warning: passing arg 2 of `resolve_group' from incompatible pointer type gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c sources.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c center.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c filters.c filters.c: In function `make_filter_netmask': filters.c:314: warning: implicit declaration of function `inet_aton' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c destinations.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c log.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c cfgfile.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c cfg-grammar.c cfg-grammar.y: In function `yyerror': cfg-grammar.y:703: warning: implicit declaration of function `fprintf' cfg-grammar.y:703: `stderr' undeclared (first use in this function) cfg-grammar.y:703: (Each undeclared identifier is reported only once cfg-grammar.y:703: for each function it appears in.) *** Error code 1 make: Fatal error: Command failed for target `cfg-grammar.o' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive'

1 0

Syslog-NG security user permissions.
by Russo, Ben 27 Jun '02

27 Jun '02

With the recent brewhaha about SSH I can't help but wonder about other daemons running on my boxes that don't have privelage separation. Is it possible to give Syslog-ng a command line option (like named or ntpd)? So that after Syslog-ng binds to the network socket (with root privs) then it sets it's UID to something other than root? I realize that many of the options in syslog-ng might be more complex if this were done. I can think of many permissions and output file name and directory macros whose code would have to be modified if syslog-ng were to properly run as a regular user instead of ROOT and be able to properly handle error messages and such for permissions and directories and everything. However, it is inevitable with the facts that Syslog-NG is a network Daemon, that receives input and has macros based on that input to write to files, that a remote vulnerability in Syslog-NG will become known.... If Syslog-NG is running as a non-root UID then this is not a problem, (other than a big nuisance). -Ben.

2 1

Re: Thinking about linking
by Jay Goldberg 27 Jun '02

27 Jun '02

Hi Klaas Thanks very much for the reply and for thinking that this makes sense :) Symlinks are really portable - the symlink() and unlink() system calls are part of the Open Group's UNIX 98 definition (formerly X/Open and 'Spec 1170'), so any UNIX would be able to do this. Less sure about windows, BTW, although Cygwin and U/WIN definitely do support the calls. If I can find the time, I'll have a look at it myself, as I think it's really just a few lines of logic (plus error checking et al): add file options "symlink_cur" and "symlink_pre" at file close() time: if (symlink_cur is set) { unlink(symlink_cur) } if (symlink_pre is set) { symlink(real_file, symlink_pre) } at file open() time: if (symlink_cur is set) { symlink(real_file, symlink_cur) } ...that should about cover it. Never having touched lex & yacc, I've been hesitant to try to touch this code, but it shouldn't be that bad (famous last words :)) Kind regards Jay ===< Klaas van Gend wrote: >=== > From: klaas.vangend(a)philips.com > To: syslog-ng(a)lists.balabit.hu > Date: Wed, 26 Jun 2002 09:49:28 +0200 > Subject: [syslog-ng]Re: Thinking about linking > Reply-To: syslog-ng(a)lists.balabit.hu > > On 2002-06-26 06:25:05 AM syslog-ng-admin wrote: > > > > > Message: 4 > > Date: Tue, 25 Jun 2002 17:06:22 +0200 > > From: Jay Goldberg <jg(a)open.ch> > > To: syslog-ng(a)lists.balabit.hu > > Organization: Open Systems AG - http://www.open.ch > > Gecko/20020530 > > Subject: [syslog-ng]Thinking about linking > > Reply-To: syslog-ng(a)lists.balabit.hu > > > > Hi, syslog-ng'ers > > > > A quick question for all - I've been using syslog-ng, but instead of using > > the excellent built-in $YEAR $MONTH and $DAY macros for automatic logfile > > rotation, I've been using a different solution - > > > > I use the cronolog program (www.cronolog.org) as a destination for any files > > that I want to keep locally. It's not optimal, but it allows me to do one > > thing that keeps our complex management environment intact after the cutover > > from syslog to syslog-ng, and that's to maintain a symbolic link to the > > latest and previous logfiles in the place where folks/scripts would normally > > think to look for them. So for example: > > > > /reallybigdisk/logs/2002/06/messages.25 and > > /reallybigdisk/logs/2002/06/messages.24 > > > > would be today's and yesterdays 'messages' file. But with cronolog, I'm abl e > > to specify options so that /var/adm/messages is just a symlink to whatever f ile > > we're logging to now, and /var/adm/messages.0 is a symlink to whatever file > > we logged to last: > > > > host# ls -l /var/adm/messages* > > lrwxrwxrwx 1 root root 34 Jun 25 01:16 /var/adm/messages -> > > /reallybigdisk/logs/2002/06/messages.25 > > lrwxrwxrwx 1 root root 34 Jun 24 01:16 /var/adm/messages.0 -> > > /reallybigdisk/logs/2002/06/messages.24 > > > > I'm not sure if I missed this in the documentation for syslog-ng or perhaps > > I'm just insane for thinking that this is useful :) > > > > So I guess my questions after all this are: > > > > - did I miss this in the documentation? > > - am I insane for wanting such a feature? > > - would it be a lot of trouble to add this feature? > > > > ...I was thinking something along the lines of a 'maintain_symlink' option f or > > a file destination that takes the target of the symlink (e.g., > > /var/adm/messages) > > as an option. > > > As far as I know (and I've probably been the last person looking over that cod e), there is no such option currently available. > It wouldn't be too hard to write, if and only if creating symlinks is portable over all UNIX implementations. > Being a Linux&Windows programmer only, I don't know for sure. > Anyway, following the lines of my latest patch (the "remove_if_older" patch, s ubmitted Feb1 2002, included in 1.5.15), > it shouldn't be too difficult to implement. > > I currently don't have time for it, but I think your suggestion makes sense an d maybe I can persuade my boss to > give me some time to implement it. > > Groetjes, > > Klaas van Gend -- jay goldberg senior engineer open systems ag raeffelstrasse 29 ch-8045 zurich t: +41 1 455 74 00 f: +41 1 455 74 01 jg(a)open.ch http://www.open.ch

2 1

change directory/file permissions
by Stefan M. Brandl 26 Jun '02

26 Jun '02

Hi, I have the following line in syslog-ng.conf: destination router { file("/opt/syslog-ng/var/$YEAR/$MONTH/$YEAR$MONTH$DAY-$HOST" create_dirs(yes) perm(0644)); }; This creates automaticaly the directorys and changes the file-permissions to 644. But it only changes the permissions of the file, not of the directories. What can I do, that also the directories get 644? Regards Stefan

2 4

Re: Thinking about linking
by klaas.vangend＠philips.com 26 Jun '02

26 Jun '02

On 2002-06-26 06:25:05 AM syslog-ng-admin wrote: > > Message: 4 > Date: Tue, 25 Jun 2002 17:06:22 +0200 > From: Jay Goldberg <jg(a)open.ch> > To: syslog-ng(a)lists.balabit.hu > Organization: Open Systems AG - http://www.open.ch > Gecko/20020530 > Subject: [syslog-ng]Thinking about linking > Reply-To: syslog-ng(a)lists.balabit.hu > > Hi, syslog-ng'ers > > A quick question for all - I've been using syslog-ng, but instead of using > the excellent built-in $YEAR $MONTH and $DAY macros for automatic logfile > rotation, I've been using a different solution - > > I use the cronolog program (www.cronolog.org) as a destination for any files > that I want to keep locally. It's not optimal, but it allows me to do one > thing that keeps our complex management environment intact after the cutover > from syslog to syslog-ng, and that's to maintain a symbolic link to the > latest and previous logfiles in the place where folks/scripts would normally > think to look for them. So for example: > > /reallybigdisk/logs/2002/06/messages.25 and > /reallybigdisk/logs/2002/06/messages.24 > > would be today's and yesterdays 'messages' file. But with cronolog, I'm able > to specify options so that /var/adm/messages is just a symlink to whatever file > we're logging to now, and /var/adm/messages.0 is a symlink to whatever file > we logged to last: > > host# ls -l /var/adm/messages* > lrwxrwxrwx 1 root root 34 Jun 25 01:16 /var/adm/messages -> > /reallybigdisk/logs/2002/06/messages.25 > lrwxrwxrwx 1 root root 34 Jun 24 01:16 /var/adm/messages.0 -> > /reallybigdisk/logs/2002/06/messages.24 > > I'm not sure if I missed this in the documentation for syslog-ng or perhaps > I'm just insane for thinking that this is useful :) > > So I guess my questions after all this are: > > - did I miss this in the documentation? > - am I insane for wanting such a feature? > - would it be a lot of trouble to add this feature? > > ...I was thinking something along the lines of a 'maintain_symlink' option for > a file destination that takes the target of the symlink (e.g., > /var/adm/messages) > as an option. As far as I know (and I've probably been the last person looking over that code), there is no such option currently available. It wouldn't be too hard to write, if and only if creating symlinks is portable over all UNIX implementations. Being a Linux&Windows programmer only, I don't know for sure. Anyway, following the lines of my latest patch (the "remove_if_older" patch, submitted Feb1 2002, included in 1.5.15), it shouldn't be too difficult to implement. I currently don't have time for it, but I think your suggestion makes sense and maybe I can persuade my boss to give me some time to implement it. Groetjes, Klaas van Gend

1 0

Thinking about linking
by Jay Goldberg 25 Jun '02

25 Jun '02

Hi, syslog-ng'ers A quick question for all - I've been using syslog-ng, but instead of using the excellent built-in $YEAR $MONTH and $DAY macros for automatic logfile rotation, I've been using a different solution - I use the cronolog program (www.cronolog.org) as a destination for any files that I want to keep locally. It's not optimal, but it allows me to do one thing that keeps our complex management environment intact after the cutover from syslog to syslog-ng, and that's to maintain a symbolic link to the latest and previous logfiles in the place where folks/scripts would normally think to look for them. So for example: /reallybigdisk/logs/2002/06/messages.25 and /reallybigdisk/logs/2002/06/messages.24 would be today's and yesterdays 'messages' file. But with cronolog, I'm able to specify options so that /var/adm/messages is just a symlink to whatever file we're logging to now, and /var/adm/messages.0 is a symlink to whatever file we logged to last: host# ls -l /var/adm/messages* lrwxrwxrwx 1 root root 34 Jun 25 01:16 /var/adm/messages -> /reallybigdisk/logs/2002/06/messages.25 lrwxrwxrwx 1 root root 34 Jun 24 01:16 /var/adm/messages.0 -> /reallybigdisk/logs/2002/06/messages.24 I'm not sure if I missed this in the documentation for syslog-ng or perhaps I'm just insane for thinking that this is useful :) So I guess my questions after all this are: - did I miss this in the documentation? - am I insane for wanting such a feature? - would it be a lot of trouble to add this feature? ...I was thinking something along the lines of a 'maintain_symlink' option for a file destination that takes the target of the symlink (e.g., /var/adm/messages) as an option. I thought I'd ask first in case anyone's working on this already - it would save me from hacking at and most likely desecrating the code. I've had a look through, and it's a far tidier job than anything I've done in a long time. But then I haven't been a C programmer for the last 9 years :( Thanks! Jay -- jay goldberg senior engineer open systems ag raeffelstrasse 29 ch-8045 zurich t: +41 1 455 74 00 f: +41 1 455 74 01 jg(a)open.ch http://www.open.ch

1 0

syslog-ng on win
by Jas Amidzic 25 Jun '02

25 Jun '02

Syslog-ng is excellent tool, but to make it work for me I need to run it on at least one win200 box. Did anyone considered porting syslog-ng to the win environment? Thanks Jas ----------------------------------------------- ABS Web Site: www.abs.gov.au

3 2

RE: [syslog-ng]program() with template()..how or workaround?
by Michael Earls 24 Jun '02

24 Jun '02

You should look on http://www.campin.net/syslog-ng/faq.html there are some sites that list how to format syslog-ng to sql statements. michael -----Original Message----- From: thelittleprince(a)asteroid-b612.org Sent: Monday, June 24, 2002 2:40 PM To: <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng]program() with template()..how or workaround? i need to use template with program in order to send a specific format to a modified sqlsyslogd. I'm running the latest devel of syslog ng. can this be done? if not, is there some sort of workaround i can use with pipe to get the formatted data into sqlsyslogd? or maybe do something like.. program("/usr/local/bin/sqlsyslogd < echo $HOST $FACILITY"); i know that syntax wont work, but you get the gist. :) Thanx! Tony . ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. . Anthony J. Biacco Network Administrator/Engineer thelittleprince@asteroid b612.org http://www.asteroid b612.org "Strange, but it seems, there's a mutiny brewing inside of me" . ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. . _______________________________________________ syslog ng maillist syslog ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog ng Frequently asked questions at http://www.campin.net/syslog ng/faq.html

1 0

program() with template()..how or workaround?
by The Little Prince 24 Jun '02

24 Jun '02

i need to use template with program in order to send a specific format to a modified sqlsyslogd. I'm running the latest devel of syslog-ng. can this be done? if not, is there some sort of workaround i can use with pipe to get the formatted data into sqlsyslogd? or maybe do something like.. program("/usr/local/bin/sqlsyslogd < echo $HOST $FACILITY"); i know that syntax wont work, but you get the gist. :) Thanx! --Tony .-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-. Anthony J. Biacco Network Administrator/Engineer thelittleprince(a)asteroid-b612.org http://www.asteroid-b612.org "Strange, but it seems, there's a mutiny brewing inside of me" .-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-.

1 0