August 2002 - syslog-ng - lists.balabit.hu

1.5.19 and tcp
by CHENNES＠Nationwide.com 07 Aug '02

07 Aug '02

I am having difficulty keeping 1.5.19 running when receiving syslog messages via tcp. I have a central logging host that receives messages via tcp from collection hosts. The collection hosts are receiving messages from various hosts via udp and tcp. Essentially, the ng process immediately dies on the central logging host as soon as I start it. However, if I alter the configurations to use only udp, I have no problems. The central logging host and the collection hosts are all running Solaris 8 with 1.5.19. I have tested the same exact scenario using a previous version of ng (1.4.14) on the central logging host and it works just fine. I have included some configuration information below. **** output from command truss -fael syslog-ng -d syslog-ng version 1.5.19 starting 1548/1: write(2, " s y s l o g - n g v e".., 34) = 34 1548/1: sigaction(SIGPIPE, 0xFFBEFA18, 0xFFBEFB18) = 0 1548/1: sigaction(SIGHUP, 0xFFBEFA18, 0xFFBEFB18) = 0 1548/1: sigaction(SIGTERM, 0xFFBEFA18, 0xFFBEFB18) = 0 1548/1: sigaction(SIGCLD, 0xFFBEFA18, 0xFFBEFB18) = 0 1548/1: time() = 1028722452 1548/1: poll(0xFFBEFB38, 2, 100) = 0 1548/1: poll(0xFFBEFB38, 2, 60000) (sleeping...) 1548/2: signotifywait() (sleeping...) 1548/3: door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) 1548/4: lwp_cond_wait(0xFF0F5550, 0xFF0F5560, 0xFF0EEDB8) (sleeping...) 1548/5: door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) 1548/1: poll(0xFFBEFB38, 2, 60000) = 1 1548/1: accept(3, 0xFFBEF9C8, 0xFFBEF9C4, 1) = 7 1548/1: fcntl(7, F_GETFL, 0xFFFFFFFF) = 130 1548/1: fstat64(7, 0xFFBEF698) = 0 1548/1: getsockopt(7, 65535, 8192, 0xFFBEF798, 0xFFBEF790, 0) = 0 1548/1: fstat64(7, 0xFFBEF698) = 0 1548/1: getsockopt(7, 65535, 8192, 0xFFBEF798, 0xFFBEF794, 0) = 0 1548/1: setsockopt(7, 65535, 8192, 0xFFBEF798, 4, 0) = 0 1548/1: fcntl(7, F_SETFL, 0x00000082) = 0 1548/1: fcntl(7, F_SETFD, 0x00000001) = 0 AF_INET client connected from 10.1.1.1, port 38896 1548/1: write(2, " A F _ I N E T c l i e".., 55) = 55 io.c: Preparing fd 7 for reading 1548/1: write(2, " i o . c : P r e p a r".., 33) = 33 1548/1: time() = 1028722460 1548/1: poll(0xFFBEFB30, 3, 100) = 1 1548/1: read(7, " < 1 3 > A u g 7 0".., 2049) = 2049 1548/1: Incurred fault #6, FLTBOUNDS %pc = 0xFF141D00 1548/1: siginfo: SIGSEGV SEGV_MAPERR addr=0x3103F700 1548/1: Received signal #11, SIGSEGV [default] 1548/1: siginfo: SIGSEGV SEGV_MAPERR addr=0x3103F700 1548/1: *** process killed *** **** syslog-ng.conf from central logging host: options { sync(0); time_reopen(10); log_fifo_size(1000); keep_hostname(yes); use_dns(yes); use_fqdn(no); use_time_recvd(yes); gc_idle_threshold(1000); }; source ng_local { internal(); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); }; source remote { tcp(ip("10.1.1.10") port(5514)); }; destination ng_messages { file("/var/log/syslog-ng" owner(root) group(staff) perm(0440) create_dirs(yes) dir_perm(0755)); }; destination local_messages { file("/var/adm/messages" owner(root) group(staff) create_dirs(yes) dir_perm(0755)); }; destination remote_messages { file("/logfiles/$MONTH_$DAY_$YEAR/$HOST/messages" owner(root) group(corenet) perm(0440) create_dirs(yes) dir_perm(0755)); }; log { source(ng_local); destination(ng_messages); }; log { source(local); destination(local_messages); }; log { source(remote); destination(remote_messages); }; **** syslog-ng.conf from collection hosts: options { sync(0); time_reopen(10); log_fifo_size(2000); keep_hostname(yes); use_fqdn(no);}; source ng_local { internal(); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); }; source remote { udp(ip("10.1.1.1") port(514)); tcp(ip("10.1.1.1") port(5514)); }; destination ng_messages { file("/var/log/syslog-ng" owner(root) group(staff) create_dirs(yes) dir_perm(0755)); }; destination local_messages { file("/var/adm/messages" owner(root) group(staff) create_dirs(yes) dir_perm(0755)); }; destination remote_messages { tcp("10.1.1.10" port(5514)); }; log { source(ng_local); destination(ng_messages); }; log { source(local); destination(local_messages); }; log { source(remote); destination(remote_messages); };

2 1

Re: syslog-ng bug?
by Balazs Scheidler 07 Aug '02

07 Aug '02

On Tue, Aug 06, 2002 at 03:03:51PM -0500, Dustin Trammell wrote: > Did you ever get a chance to take a look at this? I've looked into it. and it's not a bug, it's a feature :) so syslog-ng sets restrictive permissions of files by default which behaviour can be changed. use options { owner(logsystem); group(staff); }; if you want syslog-ng not to touch owner/group/permissions use the following: options { owner("-1") group("-1"); perm("-1"); }; the quotation marks are currently necessary as syslog-ng expects to find a string there (which is not a number) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Silly Scam #766 - 1 msg
by Christopher_Leonardos＠interliant.com 05 Aug '02

05 Aug '02

I hope everyone is aware, that this is a silly scam. Originally started by some people in Nigeria, this appears to be the "south african" version of the same old scam. Regards, Christopher Leonardos Security Engineer Interliant Inc. 12 Gill Street Woburn, MA 01801 781-756-3761 781-756-3737 FAX christopher_leonardos(a)interliant.com

1 0

information
by 4u2glamour＠justice.com 04 Aug '02

04 Aug '02

1 0

business offer
by khumalo maka 03 Aug '02

03 Aug '02

INVESTMENT REQUEST Compliment of the season! It is indeed my pleasure to write to you this letter, which i believe, will be a big surprise as we are both complete strangers. I work for the Ministry of Minerals and Energy in South Africa, and by this letter I am representing and also acting on behalf of two of my senior colleague (The Director General and The Group General Manager) whose mandate I have got to contact a trusted and reliable foreign based businessman, concerning the business matter of mutual benefit to all. By this mandate given to me, we are in dire need of a foreign partner to assist us in the transfer/investment of USD 15,00,000,00. (fifteen Million, United States Dollars). The key issues are the transfer and the subsequent investment of the said sum. We are ready to go into an agreement with you and also offer you a negotiable fee for putting together an investment portfolio. It does not matter whether or not you own a company or you have invested funds before. We shall guide you on what to do. The basis will be that a major company won a contract and subcontracted it to you. More often, big trading companies and firms of unrelated field win contracts and subcontracts to more specialized firms for execution. We shall follow strictly all the legal procedures entailed in our laws and international laws in transferring the funds to you. The source of the funds is legitimate and authoritative. Please, be informed that under the South Africa Government monetary policy, strategic positioned government officials are not allowed to operate or own bank account overseas, hence our need for a foreign partner to front for us. We pray that you take the essence of this letter in strict confidence, as the two officials involved would not like to be exposed on this. Kindly notify me via my e-mail, upon you acceptance to assist us. Further details will be made available to you as soon as you reply. We shall provide you with our confidential phone and fax number, once there is positive response from you. Thank you and God bless, as we wait for your urgent response Best Regards. ENGR. KHUMALO MAKA

1 0

syslog-ng 1.4.x troubles : 2nd post
by archi2k＠altern.org 01 Aug '02

01 Aug '02

Please CC me, I'm not subscribed to the list. Okay, to try to isolate the problem shown on my previous post, here is what I did : <snip /etc/init.d/syslog-ng> case "$1" in start) echo -n "Starting system logging: syslog-ng" #start-stop-daemon --start --quiet --exec /usr/local/sbin/syslog-ng strace -f syslog-ng > /var/log/syslog-ng.strace 2>&1 & echo -n " klogd" start-stop-daemon --start --quiet --exec /sbin/klogd -- $KLOGD echo "." ;; </snip> And guess what : when I run syslog-ng thru strace it works!! @#[|%!! Ie when I boot the box syslog-ng is not blocked any more. I finally found a way to make it actually work by not using start-stop-daemon : <snip> #start-stop-daemon --start --quiet --exec /usr/local/sbin/syslog-ng #strace -f syslog-ng > /var/log/syslog-ng.strace 2>&1 & /usr/local/sbin/syslog-ng </snip> simpler! But why?!? ciao

3 3

RE: [syslog-ng]Installing on a non-compiler system
by Lightfoot.Michael 01 Aug '02

01 Aug '02

Thanks for all the replies to my above query. I think that for a few systems, making a Solaris package has too much overhead, but the simple idea of setting DESTDIR and using tar seems fairly efficient (and will work!) > make DESTDIR=/tmp/syslog-ng-bin/ install > > it will install using /tmp/syslog-ng-bin/ as root. tar the > directory and > untar it on your production server relative to root. > > -- > Bazsi NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries.

1 0