September 2002 - syslog-ng - lists.balabit.hu

Re: [syslog-ng]source socket keepalive patch suggestion
by Ted_Rule＠flextech.co.uk 12 Sep '02

12 Sep '02

Ah.. perhaps the light begins to clear. I think I must have misinterpreted what the keep-alive option really does. I had thought it avoided re-opening a listener on the same socket on SIGHUP. From your reply, I'm now assme that all it does is ensure that 'ephemeral' connections accept()'ed from a listener are left open across a SIGHUP even if the listener is taken away. Is this nearer the truth? In which case , as you say, my patch is irrelevant to my real desire to avoid a re-open of any given listener ( of potentially any flavour ) across a SIGHUP, and the previous post about repairing the 'broken' glibc/syslog() call across a re-opened Unix DGRAM socket potentially provides an easier fix than a rewrite of syslog-ng. And/or avoiding use of Unix DGRAM sockets at all on glibc platforms until such a fix is in place. Ted *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

3 2

syslog-ng aborting
by BONIKOWSKE, SCOTT 12 Sep '02

12 Sep '02

--- Received from WPS.SBONIKOW (608) 226-2630 09-11-02 148p Hi, I am getting the following error shortly after syslog-ng is starting. io.c: sockaddr2info(): Unsupported address family 0. Aborted I have looked around and have not found anything that seems helpfull. There is nothing in the logs, and there is no core. The environment is SuSE 8.0 (64 bit) syslog-ng 1.5.20 It was a fresh compule, no changes to the source. A copy of the config is below. there has been very little change in the conf, just the locations for the files, and a new source. If there is any other info that I need to give, please let em know. Thanks Scott Bonikowske options { long_hostnames(off); sync(0); }; source src { unix-stream("/dev/log"); internal(); }; source net { udp(10.110.210.4) 514; }; destination authlog { file("/var/log/auth.log-ng"); }; destination syslog { file("/var/log/syslog-ng"); }; destination cron { file("/var/log/cron.log-ng"); }; destination daemon { file("/var/log/daemon.log-ng"); }; destination kern { file("/var/log/kern.log-ng"); }; destination lpr { file("/var/log/lpr.log-ng"); }; destination user { file("/var/log/user.log-ng"); }; destination uucp { file("/var/log/uucp.log-ng"); }; destination ppp { file("/var/log/ppp.log-ng"); }; destination mail { file("/var/log/mail.log-ng"); }; destination mailinfo { file("/var/log/mail.info-ng"); }; destination mailwarn { file("/var/log/mail.warn-ng"); }; destination mailerr { file("/var/log/mail.err-ng"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug-ng"); }; destination messages { file("/var/log/messages-ng"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; #destination loghost { udp("loghost" port(999)); }; destination xconsole { pipe("/dev/xconsole"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_ppp { facility(ppp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination (newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(f_ppp); destination(ppp); }; log { source(src); destination(console_all); }; ---- 09-11-02 148p ---- Sent to ------------------------------------ -> syslog-ng(a)lists.balabit.hu

2 1

source socket keepalive patch suggestion
by Ted_Rule＠flextech.co.uk 12 Sep '02

12 Sep '02

I previously enquired whether it would be possible to allow for a keep-alive option on Unix DGRAM sockets to help avoid the situation on some platforms when daemons such as sendmail have the /dev/log socket 'whipped from under them' during syslog-ng/SIGHUP. It also occurred to me that avoiding closing/re-opening UDP sockets on HUP should help to avoid any loss of messages across HUP on a very busy central syslog server. I assumed - whether this is valid or not I don't know - that the current 1.5.20 source always rebuilds Unix DGRAM sockets on HUP. Likewise for UDP sockets. Having had a look at the YACC source, I think I may have come up with a patch to help with this - it certainly appears to compile and run but it's a bit difficult to test all the possible variations on the theme, and whether it actually fulfils my original requirements. The changes involved in the patch are as follows: Split parsing of Unix DGRAM and STREAM options apart a little more - previously it seems that the Yacc allowed for a max-connections options on a Unix DGRAM socket, even though I don't believe this is actually meaningful(?). The original source also seems to be at variance with the documentation here. Force default keepalive setting on TCP socket. The documentation suggests this is the default, but my reading of the Yacc suggests otherwise. Enable keepalive option on both flavours of DGRAM socket Disable max-connections option on Unix DGRAM socket. Force default keepalive setting on both flavours of DGRAM socket. Could you enlighten me further as to whether this patch actually helps to acheive my original intent. Thanks. diff, gzip of diff , and snippet of cfg-grammar.y before and after attached. Ted ========================================================== $ diff -u cfg-grammar.y.1.5.20.orig cfg-grammar.y.1.5.20.patched --- cfg-grammar.y.1.5.20.orig Wed Sep 11 09:33:53 2002 +++ cfg-grammar.y.1.5.20.patched Wed Sep 11 11:10:32 2002 @@ -120,6 +120,7 @@ %type <ptr> source_afunix_stream_params %type <ptr> source_afinet_udp_params %type <ptr> source_afinet_tcp_params +%type <ptr> source_afsocket_dgram_params %type <ptr> source_afsocket_stream_params %type <ptr> source_afstreams %type <ptr> source_afstreams_params @@ -248,10 +249,10 @@ { last_source_driver = make_afunix_source( &make_unix_address_c($1)->super, - AFSOCKET_DGRAM); + AFSOCKET_DGRAM | AFSOCKET_KEEP_ALIVE); free($1); } - source_afunix_options { $$ = last_source_driver; } + source_afunix_dgram_options { $$ = last_source_driver; } ; source_afunix_stream_params @@ -262,28 +263,41 @@ AFSOCKET_STREAM | AFSOCKET_KEEP_ALIVE); free($1); } - source_afunix_options { $$ = last_source_driver; } + source_afunix_stream_options { $$ = last_source_driver; } ; -/* options are common between dgram & stream */ -source_afunix_options - : source_afunix_option source_afunix_options +source_afunix_stream_options + : source_afunix_stream_option source_afunix_stream_options | ; +source_afunix_dgram_options + : source_afunix_dgram_option source_afunix_dgram_options + | + ; + +source_afunix_dgram_option + : source_afunix_option + | source_afsocket_dgram_params {} + ; + +source_afunix_stream_option + : source_afunix_option + | source_afsocket_stream_params {} + ; + source_afunix_option : KW_OWNER '(' string ')' { afunix_set_owner(last_source_driver, $3); free($3); } | KW_GROUP '(' string ')' { afunix_set_group(last_source_driver, $3); free($3); } | KW_PERM '(' NUMBER ')' { afunix_set_perm(last_source_driver, $3); } - | source_afsocket_stream_params {} - ; + ; source_afinet_udp_params : { last_source_driver = make_afinet_source( &make_inet_address_c("0.0.0.0", "514")->super, - AFSOCKET_DGRAM); + AFSOCKET_DGRAM | AFSOCKET_KEEP_ALIVE); } source_afinet_udp_options { $$ = last_source_driver; } ; @@ -297,6 +311,7 @@ : source_afinet_option | KW_LOCALPORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3 ,"udp"); free($3); } | KW_PORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "udp"); free($3); } + | source_afsocket_dgram_params {} ; source_afinet_option @@ -311,7 +326,7 @@ { last_source_driver = make_afinet_source( &make_inet_address_c("0.0.0.0", "514")->super, - AFSOCKET_STREAM); + AFSOCKET_STREAM | AFSOCKET_KEEP_ALIVE); } source_afinet_tcp_options { $$ = last_source_driver; } ; @@ -331,6 +346,10 @@ | source_afsocket_stream_params {} ; +source_afsocket_dgram_params + : KW_KEEP_ALIVE '(' yesno ')' { afsocket_src_set_keep_alive(last_source_driver, $3); } + ; + source_afsocket_stream_params : KW_KEEP_ALIVE '(' yesno ')' { afsocket_src_set_keep_alive(last_source_driver, $3); } | KW_MAX_CONNECTIONS '(' NUMBER ')' { afsocket_src_set_max_connections(last_source_driver, $3); } $ BEFORE: source_afsocket : KW_UNIX_DGRAM '(' source_afunix_dgram_params ')' { $$ = $3; } | KW_UNIX_STREAM '(' source_afunix_stream_params ')' { $$ = $3; } | KW_UDP '(' source_afinet_udp_params ')' { $$ = $3; } | KW_TCP '(' source_afinet_tcp_params ')' { $$ = $3; } ; source_afunix_dgram_params : string { last_source_driver = make_afunix_source( &make_unix_address_c($1)->super, AFSOCKET_DGRAM); free($1); } source_afunix_options { $$ = last_source_driver; } ; source_afunix_stream_params : string { last_source_driver = make_afunix_source( &make_unix_address_c($1)->super, AFSOCKET_STREAM | AFSOCKET_KEEP_ALIVE); free($1); } source_afunix_options { $$ = last_source_driver; } ; /* options are common between dgram & stream */ source_afunix_options : source_afunix_option source_afunix_options | ; source_afunix_option : KW_OWNER '(' string ')' { afunix_set_owner(last_source_driver, $3); free($3); } | KW_GROUP '(' string ')' { afunix_set_group(last_source_driver, $3); free($3); } | KW_PERM '(' NUMBER ')' { afunix_set_perm(last_source_driver, $3); } | source_afsocket_stream_params {} ; source_afinet_udp_params : { last_source_driver = make_afinet_source( &make_inet_address_c("0.0.0.0", "514")->super, AFSOCKET_DGRAM); } source_afinet_udp_options { $$ = last_source_driver; } ; source_afinet_udp_options : source_afinet_udp_option source_afinet_udp_options | ; source_afinet_udp_option : source_afinet_option | KW_LOCALPORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3 ,"udp"); free($3); } : | KW_PORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "udp"); free($3); } ; source_afinet_option : KW_LOCALIP '(' string ')' { afinet_src_set_localip(last_source_driver, $3); free($3); } | KW_LOCALPORT '(' NUMBER ')' { afinet_src_set_localport(last_source_driver, $3, NULL, NULL); } | KW_PORT '(' NUMBER ')' { afinet_src_set_localport(last_source_driver, $3, NULL, NULL); } | KW_IP '(' string ')' { afinet_src_set_localip(last_source_driver, $3); free($3); } ; source_afinet_tcp_params : { last_source_driver = make_afinet_source( &make_inet_address_c("0.0.0.0", "514")->super, AFSOCKET_STREAM); } source_afinet_tcp_options { $$ = last_source_driver; } ; source_afinet_tcp_options : source_afinet_tcp_option source_afinet_tcp_options | ; source_afinet_tcp_option : source_afinet_option | KW_LOCALPORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "tcp"); free($3); } | KW_PORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "tcp"); free($3); } | KW_AUTH '(' tripleoption ')' { afinet_src_set_auth(last_source_driver, $3); } | KW_MAC '(' tripleoption ')' { afinet_src_set_mac(last_source_driver, $3); } | KW_ENCRYPT '(' tripleoption ')' { afinet_src_set_encrypt(last_source_driver, $3); } | source_afsocket_stream_params {} ; source_afsocket_stream_params : KW_KEEP_ALIVE '(' yesno ')' { afsocket_src_set_keep_alive(last_source_driver, $3); } | KW_MAX_CONNECTIONS '(' NUMBER ')' { afsocket_src_set_max_connections(last_source_driver, $3); } ; ================================================================================================ AFTER: source_afsocket : KW_UNIX_DGRAM '(' source_afunix_dgram_params ')' { $$ = $3; } | KW_UNIX_STREAM '(' source_afunix_stream_params ')' { $$ = $3; } | KW_UDP '(' source_afinet_udp_params ')' { $$ = $3; } | KW_TCP '(' source_afinet_tcp_params ')' { $$ = $3; } ; source_afunix_dgram_params : string { last_source_driver = make_afunix_source( &make_unix_address_c($1)->super, AFSOCKET_DGRAM | AFSOCKET_KEEP_ALIVE); free($1); } source_afunix_dgram_options { $$ = last_source_driver; } ; source_afunix_stream_params : string { last_source_driver = make_afunix_source( &make_unix_address_c($1)->super, AFSOCKET_STREAM | AFSOCKET_KEEP_ALIVE); free($1); } source_afunix_stream_options { $$ = last_source_driver; } ; source_afunix_stream_options : source_afunix_stream_option source_afunix_stream_options | ; source_afunix_dgram_options : source_afunix_dgram_option source_afunix_dgram_options | ; source_afunix_dgram_option : source_afunix_option | source_afsocket_dgram_params {} ; source_afunix_stream_option : source_afunix_option | source_afsocket_stream_params {} ; source_afunix_option : KW_OWNER '(' string ')' { afunix_set_owner(last_source_driver, $3); free($3); } | KW_GROUP '(' string ')' { afunix_set_group(last_source_driver, $3); free($3); } | KW_PERM '(' NUMBER ')' { afunix_set_perm(last_source_driver, $3); } ; source_afinet_udp_params : { last_source_driver = make_afinet_source( &make_inet_address_c("0.0.0.0", "514")->super, AFSOCKET_DGRAM | AFSOCKET_KEEP_ALIVE); } source_afinet_udp_options { $$ = last_source_driver; } ; source_afinet_udp_options : source_afinet_udp_option source_afinet_udp_options | ; source_afinet_udp_option : source_afinet_option | KW_LOCALPORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3 ,"udp"); free($3); } | KW_PORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "udp"); free($3); } | source_afsocket_dgram_params {} ; source_afinet_option : KW_LOCALIP '(' string ')' { afinet_src_set_localip(last_source_driver, $3); free($3); } | KW_LOCALPORT '(' NUMBER ')' { afinet_src_set_localport(last_source_driver, $3, NULL, NULL); } | KW_PORT '(' NUMBER ')' { afinet_src_set_localport(last_source_driver, $3, NULL, NULL); } | KW_IP '(' string ')' { afinet_src_set_localip(last_source_driver, $3); free($3); } ; source_afinet_tcp_params : { last_source_driver = make_afinet_source( &make_inet_address_c("0.0.0.0", "514")->super, AFSOCKET_STREAM | AFSOCKET_KEEP_ALIVE); } source_afinet_tcp_options { $$ = last_source_driver; } ; source_afinet_tcp_options : source_afinet_tcp_option source_afinet_tcp_options | ; source_afinet_tcp_option : source_afinet_option | KW_LOCALPORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "tcp"); free($3); } | KW_PORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "tcp"); free($3); } | KW_AUTH '(' tripleoption ')' { afinet_src_set_auth(last_source_driver, $3); } | KW_MAC '(' tripleoption ')' { afinet_src_set_mac(last_source_driver, $3); } | KW_ENCRYPT '(' tripleoption ')' { afinet_src_set_encrypt(last_source_driver, $3); } | source_afsocket_stream_params {} ; source_afsocket_dgram_params : KW_KEEP_ALIVE '(' yesno ')' { afsocket_src_set_keep_alive(last_source_driver, $3); } ; source_afsocket_stream_params : KW_KEEP_ALIVE '(' yesno ')' { afsocket_src_set_keep_alive(last_source_driver, $3); } | KW_MAX_CONNECTIONS '(' NUMBER ')' { afsocket_src_set_max_connections(last_source_driver, $3); } ; (See attached file: cfg-grammar.y.1.5.20.diff.gz) *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

3 2

Re: [syslog-ng]source socket keepalive patch suggestion
by Ted_Rule＠flextech.co.uk 12 Sep '02

12 Sep '02

This problem exist for me on all glibc incarnations as far as I'm aware. It also exists in Perl5 / Syslog:pm - but I wrote a local patch for myself for that. Admittedly, I probably could write a patch to glibc, but then I'd have to get it into the real glibc source so that it doesn't get overwritten by every new glibc RPM release. I just thought it would be easier all round to provide for as near 'non-stop' functionality across syslog-ng/SIGHUP as possible. Ted "Ed Ravin" <eravin(a)panix.com> on 11/09/2002 18:34:42 Please respond to syslog-ng(a)lists.balabit.hu To: syslog-ng(a)lists.balabit.hu cc: (bcc: Ted Rule/160GPS/Flextech/UK) Subject: Re: [syslog-ng]source socket keepalive patch suggestion Ted_Rule(a)flextech.co.uk writes: > > I previously enquired whether it would be possible to allow for a keep-alive > option > on Unix DGRAM sockets to help avoid the situation on some platforms when daemons > such as sendmail have the /dev/log socket 'whipped from under them' during > syslog-ng/SIGHUP. Why not fix the libc code on those platforms so it does basic sanity checking on the socket, and re-opens the socket when it discovers that its cached filehandle for /dev/log is invalid? I encountered this on NetBSD and it was an easy library fix (it's patched in all current releases (1.5.3 and 1.6 candidates) - what OS are you using? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

1 0

syslog memory problems
by Rolf Böhme 11 Sep '02

11 Sep '02

Hello, I have installed syslogd-ng version 1.4.9a on SuSE-Linux 7.1. Eight other Servers send their messages to the syslogd-ng-Server. After a few hours or about two days the Linux-System kills the syslogd-ng, because the allocation of memory from syslogd-ng failed. Any Hints or Tips and so on to correct the error? Regards Rolf Böhme staatl. gepr. Informatikassistent CNA, Systemadministrator mailto:rolf.boehme@gno.de

3 2

file buffer flushing
by Joerg Sommer 09 Sep '02

09 Sep '02

Hi, can syslog-ng delay the flush of a file buffer? I have noflushd running and if syslog-ng flushes his buffers, my disc spins up. But I will see new messages in the log files. Is it possible, that syslog writes the messages in the file, but don't call flush() on this file. Joerg.

3 3

Re: [syslog-ng]Remote Logging - config checker?
by Ted_Rule＠flextech.co.uk 09 Sep '02

09 Sep '02

As a sideline thought to this Gorm's minor config typo...... How easy would it be possible to provide an additional command line option to syslog-ng which merely perform a config file syntax and dir/file-permissions check? i.e much the same flavour of functionality as provided by bind9's named-checkconf on behalf of named. Apart from pure syntax checks on the configuration file, it would be nice/highly-desirable for the checker to confirm valid permissions on the various source/destinations ( where feasible ) , especially for the conditions wherein syslog-ng is either chrooted or chowned. Above all, the checker should attempt to ensure that no mistake exists that would cause syslog-ng to exit post SIGHUP or restart. Ted *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

1 0

Remote Logging
by Gorm Jensen 09 Sep '02

09 Sep '02

In the past, my log host received logs from one remote host, so syslog-ng.conf had separate destinations spelled out for the log host and the remote host. Now I am adding more remote hosts to the LAN, and I want to record the same information from the new hosts. I am trying to add the following lines to a syslog-ng.conf file that has worked in the past. I commented out the cron entry for the existing remote host. destination remote-logs.cron { file("/var/log/$HOST/cron.log"); }; log { source(s_tcp); filter(f_cron); destination(remote-logs.cron); } The first line works, but the second line causes a syntax error. What am I doing wrong?

2 2

Config Macro
by Gorm Jensen 08 Sep '02

08 Sep '02

For remote logging, can the $HOST macro refer to a directory rather than a file?

2 1

RE: [syslog-ng]test message
by Paul Mansmann 06 Sep '02

06 Sep '02

Bazsi, I haven't gotten any messages from the group since yesterday and was wondering if I was mistakenly removed, or if the group is down. Also, I've gotten three messages this morning from 'raodb' that appear to be addressed directly to me. ??? I'm not real sure what's going on here. Do you have any ideas? Thanks, Paul -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, September 05, 2002 10:54 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]test message I've unsubscribed the person repeating messages. Let's hope I did it right this time. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1