August 2002 - syslog-ng - lists.balabit.hu

Updated Red Hat config file
by Frank Crawford 22 Aug '02

22 Aug '02

Folks, I've modified the contributed configuration file for Red Hat to update it to be more compatible with Red Hat 7.3. In particular, I've modified it to totally remove the requirement for running klogd (as described in the FAQ). In particular, I've added a template to include the program type "kernel:" for kernel messages. This is normally done by klogd, and is expected by such utilities as logwatch. The one question I have here is that I have two opens of "/var/log/messages" with different options, and I'm not sure if it is legal, although it does seem to work. Are there any possible problems with this? Thanks Frank Crawford -- ac3 Suite G16, Bay 7, Locomotive Workshop Phone: 02 9209 4600 Australian Technology Park Fax: 02 9209 4611 Eveleigh NSW 1430

2 4

compressed log
by Keven Belanger 22 Aug '02

22 Aug '02

Sorry I forgot to ask this one; can we compress log on the fly with gzip or something like that? So use a gz file as output Thanx again! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

2 1

Somebody help me !
by Le Nguyen Vu 22 Aug '02

22 Aug '02

Hi all, Sorry, my poor english... I install syslog-ng on my PC (flatform OS's Redhat Linux 7.3). But i can't get any log message form other machine (i.e Router, Server run on unix (linux) and windows 2000 server flatform). Some body know about it ? Please tell me how to config syslog-ng on redhat linux 7.3. Thanks, Please mail to me at misterde(a)wmail.saigonnet.vn. Thank again. Mister De misterde(a)wmail.saigonnet.vn

1 0

Re: OK
by Le Nguyen Vu 22 Aug '02

22 Aug '02

confirm 253008

1 0

Errors Compiling 1.5.19 with TCP_WRAPPERS
by Victor 22 Aug '02

22 Aug '02

I am trying to compile with tcp_wrappers, but I get this error: gcc -O2 -march=i686 -pipe -Wall -I/root/syslog-ng/work/src/libol-0.3.3/src -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o -lfl /root/syslog-ng/work/src/libol-0.3.3/src/.libs/libol.a -lnsl afinet.o: In function `do_open_afinet_connection': afinet.o(.text+0x3c3): undefined reference to `request_init' afinet.o(.text+0x3cf): undefined reference to `sock_host' afinet.o(.text+0x3d8): undefined reference to `hosts_access' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 Shouldn't it have something like -lwrap on the line above? Also, I heard on the mailing list that there is a patch for 1.5.19? Is there a link to it? What's the proper patch command to apply it? Thanks

1 0

RE: [syslog-ng]Supressing messages...
by Keven Belanger 21 Aug '02

21 Aug '02

If there is no way to exclude it, try to make a new destination to /dev/null ? Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717 -----Original Message----- From: bhartin(a)straus-frank.com [mailto:bhartin@straus-frank.com] Sent: Wednesday, August 21, 2002 15:25 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Supressing messages... I'm running syslog-ng-1.4.14-0. Long story short, I want to supress the logging of "VFS: Disk change detected..." messages that plague RH 7.1 installs using KDE w/autorun on CDs. Updating syslog-ng versions isn't happening anytime soon unless it is the only way to do so. What can I do to supress any and all logging of just this message, without affecting anything else in that group (kern.* or wherever it's at)? I'm sure newer versions have a working text based filter or such, but I'm pressed for time =(. Thanks for any help anyone can provide, -- Bradley Hartin - bhartin(a)straus-frank.com Communications and Network Administrator Straus-Frank Company _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3

syslog-ng 1.4.7 crashing randomly
by Adam Steffes 21 Aug '02

21 Aug '02

I'm running syslog-ng 1.4.7 on a Solaris 7 machine which acts as a middleman for my production servers and main log repository server. It crashes without warning, without logging any problems beforehand, and often requires several attempts at restarts before staying up. Time between crashes seems random; it will go for a few days, die, require ten restarts in five minutes to keep it up, then run for another week before having any problems. 'gdb' says it's dying from a SIGKILL but I don't have anything running on the machine that would send it any such flags. Any ideas what is going on here? I found two messages in the archives from Oct. 2001 asking similar questions, but no resolutions: Nicholas Berry nberry(a)ragingwire.com Wed, 10 Oct 2001 09:10:13 -0700 a.. I too am having the same issue with crashing under Solaris 8 with syslog-ng 1.5.10, but my crashes happen several hours between each other. _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048 -----Original Message----- From: Andreas Schulze [mailto:Andreas.Schulze@mediaWays.NET] Sent: Wednesday, October 10, 2001 6:01 AM To: syslog-ng list Subject: [syslog-ng]Mystic crashes of 1.5.10 Hello Bazsi, thanks a lot for the stats() feature in the new version. But unfortunately 1.5.10 crashes a few minutes after starting. We are running your software on SUN Solaris 8 boxes. I read about a similiar problem with Linux boxes some weeks ago in this list. For your convenience the backtrace is attached. The calling deps between #17 and #1 can differ in each core. But it crashed _always_ in __sigprocmask () from /usr/lib/libthread.so.1 And it crashed _always_ by receiving SIGKILL. Seems a little bit mystic for me, because I don't know why and who's sending the SIGKILL. Coredumps by SIGSEGV are more familiar to me :) Thx. for a fast fix --Andreas

2 2

RE: [syslog-ng]Supressing messages...
by Keven Belanger 21 Aug '02

21 Aug '02

A filter like this should work, be aware this is case _SENSITIVE_ filter f_vfs {match("VFS: Disk change detected");}; Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717 -----Original Message----- From: bhartin(a)straus-frank.com [mailto:bhartin@straus-frank.com] Sent: Wednesday, August 21, 2002 15:58 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Supressing messages... On Wed, 21 Aug 2002, Keven Belanger wrote: > If there is no way to exclude it, try to make a new destination to /dev/null ? The problem is that I haven't found a way for a filter to catch it. The kernel version uses a printk for KERN_DEBUG. I've tried a filter against facility for debug, kern.debug, and *.debug--all of which show up as unknown facilities. I tried 'match("Disk change detected")' to no avail either. I may have to bite the bullet and move to a newer version, but.... -- Bradley Hartin - bhartin(a)straus-frank.com Communications and Network Administrator Straus-Frank Company _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Supressing messages...
by bhartin＠straus-frank.com 21 Aug '02

21 Aug '02

I'm running syslog-ng-1.4.14-0. Long story short, I want to supress the logging of "VFS: Disk change detected..." messages that plague RH 7.1 installs using KDE w/autorun on CDs. Updating syslog-ng versions isn't happening anytime soon unless it is the only way to do so. What can I do to supress any and all logging of just this message, without affecting anything else in that group (kern.* or wherever it's at)? I'm sure newer versions have a working text based filter or such, but I'm pressed for time =(. Thanks for any help anyone can provide, -- Bradley Hartin - bhartin(a)straus-frank.com Communications and Network Administrator Straus-Frank Company

1 0

RE: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x
by Dustin Trammell 21 Aug '02

21 Aug '02

Ok, that's strange... apparently the patch didn't apply correctly (according to the output of that tail command), even though the output from patch appeared that it did; It still had the old code in sources.c. I re-applied the patch, verified that the source was indeed patched this time, and recompiled. After a bit of testing, I don't seem to be getting the truncated entries any more, so I'm guessing it was just an error on my part during the patching and re-compiling process. Thanks for your help in debugging (: I hadn't even thought to actually look at the source for the original problem since it had appeared that the patch applied correctly. --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Stephen Frost [mailto:sfrost@snowman.net] Sent: Wednesday, August 21, 2002 13:40 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x Hmm, odd, I'm not having any problems here.. Can you go into the syslog-ng-1.5.19 directory and run: tail +113 src/sources.c | head -10 And send the output here? Stephen

2 1