August 2002 - syslog-ng - lists.balabit.hu

Details
by PRINCE MARK ADE 24 Aug '02

24 Aug '02

FROM THE DESK OF: PRINCE MARK ADE ATTN: PRESIDENT / M. D/ C.E .O SIR, /MADAM REQUEST FOR URGENT BUSINESS RELATIONSHIP WE ARE MAKING THIS CONTACT WITH YOU AFTER SATISFACTORY INFORMATION WE GATHERED FROM THE FOREIGN TRADE OFFICE NIGERIA CHAMBER OF COMMERCE AND INDUSTRY HIGHLIGHTING YOUR COMPANYS PROFILE. WE ARE MEMBERS OF THE PROJECT CONSULTING ANDCONTRACT AWARDING COMMITTEE OF THE NIGERIAN NATIONAL PETROLEUM CORPORATION (NNPC). WE ARE AS CONVINCED AS TO BELIVE THAT YOU WILL PROVIDE US WITH A SOLUTION TO EFFECT A REMITTANCE OF FUND RESULTIN FROM OVER INVOICING OF JOB/ SERVICES DONE TO THE NIGERIAN NATIONAL PETROLEUM CORPORATION BY A FOREIGN CONTRACTOR, CONTRACT NO: NNPC/PED/AJO/1088/94. THIS PROJECT HAS BEEN FULLY EXECUTED AND COMMISSIONED. THE PRESENT GOVERNMENT IN NIGERIA HAS DUE TO THE BILATERAL AGREEMENT REACHED WITH THE WORLD BANK AND IMF, DIRECTED THAT ALL DEBTS OWENED BY FOREIGN CONTRACTORS BE PAID. WE ARE THEREFORE DESIROUS OF TRANSFERRING THE OVER INVOICE SUM OF TWENTY MILLION US DOLLAR (20,000,000,00) ONLY INTO YOUR COMPANYS OR PRIVATE ACCOUNT. NOTE, AS CIVIL SERVANTS, WE ARE NOT PERMITTED TO OWN FOREIGN ACCOUNT BY NIGERIAN CIVIL SERVICE LAW. THEREFORE, INORDER TO FACILITATE THE TRASFER OF THIS FUND INTO YOUR ACCOUNT, YOU ARE URGED. TO REPLY THROUGH THE ABOVE EMAIL ADDRESS FOR CONFIDENTIAL PURPOSE AND FOR THE URGENT NATURE OF THIS TRANSACTION. THE FOLLOWING ARE REQURED FROM YOU. (1) YOUR COMPANYS NAME AND ADDRESS (2) YOUR PERSONAL OR COMPANYS BANK NAME, ADDRESS ACCOUNT NUMBER AND TELEX NO. (3) YOUR PRIVATE AND OFFICIAL TELEPHONE AND FAX NUMBER THE FUND WILL BE SHARED, AS FOLLOWS 30% OF THE TOTAL VALUE SHOULD GO TO YOU AS THE OWNER OF THE ACCOUNT, WHILE 60% SHALL BE RELEASES TO US WHEN WE ARRIVE YOUR COUNTRY AFTER THE TRANSFER, THEN 10% WILL BE FOR EXPENSES INCURRED BY BOTH PARTIES IN THE COURSE OF THE TRANSFER INTO YOUR ACCOUNT. ON RECEIPT OF YOUR PAPERS, WE WILL TENDER AN APPLICATION FOR PAYMENT AT THE CENTRAL BANK OF NIGERIA, FEDERAL MINISTRY OF FINANCE AND ITS AFFILIATE MINISTRIES. FINALLY, THE CONFIDENCE AND TRUST RESPONDED ON YOU CANNOT BE OVER EMPHASISED; THEREFORE YOU ARE TO KEEP THIS TRANSACTION TO YOURSELF AND FOR CONFIDENTIAL REASONS. BEST REGARD. PRINCE MARK ADE (qus,jp,mon,gcon) (CHAIRMAN CONTRACT AWARD COMMITTEE (NNPC)

1 0

RE: [syslog-ng]directory owner
by Keven Belanger 23 Aug '02

23 Aug '02

Sorry ;) I have re-read the mail ! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717 -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, August 23, 2002 11:31 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]directory owner On Fri, Aug 23, 2002 at 11:28:18AM -0400, Keven Belanger wrote: > Hi guys, we use syslog-ng 1.4.15 and I presently use the create_dirs (yes); option but the directory are always created with root:root > How can we change the directory owner and group ?? specify dir_owner() and dir_group() either globally, or locally. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]directory owner
by Keven Belanger 23 Aug '02

23 Aug '02

This is what I try but doesn't work, I use Solaris 8 Sparc ### # Common Options options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); dir_perm (0700); owner ("514"); group ("514"); keep_hostname (no); }; Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717 -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, August 23, 2002 11:31 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]directory owner On Fri, Aug 23, 2002 at 11:28:18AM -0400, Keven Belanger wrote: > Hi guys, we use syslog-ng 1.4.15 and I presently use the create_dirs (yes); option but the directory are always created with root:root > How can we change the directory owner and group ?? specify dir_owner() and dir_group() either globally, or locally. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

directory owner
by Keven Belanger 23 Aug '02

23 Aug '02

Hi guys, we use syslog-ng 1.4.15 and I presently use the create_dirs (yes); option but the directory are always created with root:root How can we change the directory owner and group ?? We need a fast answer please! Thanx! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

2 1

syslog-ng 1.5.20, unix-dgram source on BSD broken
by Balazs Scheidler 23 Aug '02

23 Aug '02

... and this patch fixes it: diff -u -r1.23 afunix.c --- afunix.c 21 Aug 2002 14:03:50 -0000 1.23 +++ afunix.c 23 Aug 2002 12:02:56 -0000 @@ -51,7 +51,7 @@ CAST(afsocket_source_connection, self, c); io_read(self->client, - make_log_reader(0, NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, c), + make_log_reader(!!(self->owner->flags & AFSOCKET_DGRAM), NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, c), make_afsocket_source_close_callback(self)); return ST_OK | ST_GOON; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

help please...
by Keven Belanger 23 Aug '02

23 Aug '02

I have 2 question: 1- I'm looking for a script (perl or other) to scan a file to find unique line (line that are duplicate will be remove) 2- Also want to know which log rotation people are using under Solaris ?? Answer soon! Thanx! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

3 2

RE: [syslog-ng]help please...
by Glenn Harrison 23 Aug '02

23 Aug '02

I can answer 2 fairly simply. Whilst using syslog-ng, I just set the logs to go into a dated directory or filename, that way they automatically get rotated each night without disrupting syslog at all. For example: destination messages { file("/var/log/syslog-dated/$HOST/$YEAR-$MONTH-$DAY/messages" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(sysadmin) perm(0640) dir_perm(0750) dir_owner(root) dir_group(sysadmin)); }; You could of course simplify this even more, and just have: destination messages { file("/var/adm/messages-$YEAR-$MONTH-$DAY" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(sysadmin) perm(0640) dir_perm(0750) dir_owner(root) dir_group(sysadmin)); }; Which would put dated messages files into your /var/adm directory, then run a find command each night to clean up the old logs once they're archived off to tape or whatever your policy is. I personally use these 2 cron entries to clean up my messages each night: 15 4 * * * /usr/bin/find /var/log/syslog-dated $ -name '*-*-*' $ -follow -mount -mtime +32 -type d -exec /usr/bin/rm -rf {} \; 30 4 * * * /usr/bin/find /var/log/syslog-dated $ -name '*.log' $ -follow -mount -mtime +2 -type f -exec /usr/bin/gzip {} \; This gzips the older logs, and deletes stuff over a month old. -----Original Message----- From: Keven Belanger [mailto:kbelanger@logicon.ca] Sent: Friday, 23 August 2002 5:23 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]help please... I have 2 question: 1- I'm looking for a script (perl or other) to scan a file to find unique line (line that are duplicate will be remove) 2- Also want to know which log rotation people are using under Solaris ?? Answer soon! Thanx! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717 Our Privacy statement AM Corporation manages Personal information as required by Privacy legislation. To provide the products and services you request and for related purposes, we collect information from you or from someone you have authorised. If your information is sensitive, such as health information, we will use it only for the purpose that you have requested. Sometimes, we must give your information to appropriate external service providers, such as our underwriter, administrators, your banking service provider and/or Financial Adviser. However, we will give your information only if you authorise us, or if we are legally required to, or if it is part of our normal procedures and necessary to provide what you have requested. This email is confidential > This email and any files transmitted with it are intended solely for the > use of the addressee(s) and may contain information which is confidential > or privileged. Any unauthorised use, in particular forwarding the > contents of this email and any files to third parties (other than is > expressly authorised) is prohibited. > > If you receive this email and you are not the addressee (or responsible > for the delivery of the email to the addressee) please notify us > immediately and delete the email and all copies. > > We do not guarantee that this email is virus or error free, and the > attached files are provided and may only be used on the basis that the > recipient assumes all responsibility for any loss, damage or consequence > resulting directly or indirectly from the use of the attached files, > whether caused by the negligence of the sender or not. > > The contents and opinions in non business emails are not necessarily those > of AM. >

1 0

RE: [syslog-ng]help please...
by Nicholas Berry 22 Aug '02

22 Aug '02

We're using the macro abilities of syslog-ng to write out to a YYYY-MM format example: destination default { file ("/var/syslog-ng/$YEAR-$MONTH/$HOST_FROM/messages" ... ); } Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. nberry(a)ragingwire.com -----Original Message----- From: Keven Belanger [mailto:kbelanger@logicon.ca] Sent: Thursday, August 22, 2002 12:23 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]help please... I have 2 question: 1- I'm looking for a script (perl or other) to scan a file to find unique line (line that are duplicate will be remove) 2- Also want to know which log rotation people are using under Solaris ?? Answer soon! Thanx! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

1 0

syslog-ng 1.5.20
by Holtzl Peter 22 Aug '02

22 Aug '02

Hi, New development version of syslog-ng has been released: News for the 1.5.20 release Thu, 22 Aug 2002 16:03:45 +0200 * fixed a kernel message mangling problem * implemented check_hostname() which checks if a hostname is acceptable (contains characters [0-9a-zA-Z-_.], and if not, it is not parsed as hostname, this fixes problems with devices which send messages which seem to contain a hostname, but in reality they don't -- Höltzl Péter Ho:ltzl Pe'ter | Tel: +36 1 371-0540 | GnuPG Fingerprint: BalaBit IT Kft | Mobil: +36 20 366-9667 | DB30 5E5B 8777 C06F 5A1F holtzl.peter(a)balabit.hu | http://www.balabit.hu/ | 4586 CEAF 9678 4A89 CFD6

3 3

RE: [syslog-ng]Problems compiling libol / syslog-ng
by Camacho, Christian 22 Aug '02

22 Aug '02

That's a weird error, the time was a couple of minutes ahead, I changed it now, but that's not the problem.... Anyone has compiled it on Redhat 7.3 before?? Christian -----Mensaje original----- De: Dustin Trammell [mailto:DTrammell@PENSON.COM] Enviado el: Miércoles, 14 de Agosto de 2002 13:07 Para: 'syslog-ng(a)lists.balabit.hu' Asunto: RE: [syslog-ng]Problems compiling libol / syslog-ng Check the time on your system, it's probably wrong. Usually configure won't continue if it finds files that are newer than current date/time, or it creates a file that is older than current date/time. --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Camacho, Christian [mailto:CCamacho@golder.cl] Sent: Wednesday, August 14, 2002 11:04 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Problems compiling libol / syslog-ng I have Redhat 7.3 and can't configure libol (I have the same problem with syslog-ng). I don't have an alias for ls, I don't know Why I'm having such problem, I've compiled other tar balls before without this error... Any idea?? [root@agua libol-0.3.3]# ./configure creating cache ./config.cache checking for a BSD compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking whether build environment is sane... configure: error: ls -t appears to fail. Make sure there is not a broken alias in your environment configure: error: newly created file is older than distributed files! Check your system clock Thanks, Chris DISCLAIMER: This message may contain confidential information. If you are not the intended recipient please advise the sender and erase the message. Thank you. DISCLAIMER: This message may contain confidential information. If you are not the intended recipient please advise the sender and erase the message. Thank you.

4 7