October 2003 - syslog-ng - lists.balabit.hu

Annie Chaiyakul/it/idecpharm/US is out of the office.
by Annie Chaiyakul 15 Oct '03

15 Oct '03

I will be out of the office starting 10/13/2003 and will not return until 10/20/2003. I will out of office until 10/13/03. For immediate issues, please contact the IT help desk and for urgent UNIX specific needs, please contact Emily Yau. Thank you.

1 0

1.6.0rc4 released
by Balazs Scheidler 09 Oct '03

09 Oct '03

Hi, I've released version 1.6.0rc4 with the following NEWS entry: News for the 1.6.0rc4 release Fri, 3 Oct 2003 16:00:47 +0200 * close stderr when going into background * set the fd for file sources into nonblocking mode to avoid blocking in the case both klogd and syslog-ng is reading /proc/kmsg * added support to parse PIX timestamps A couple of parsing errors reported earlier are _not_ fixed in this release as they would change the parsing code, and I don't want to get it wrong in the stable series. I'll post a patch instead which can be tested by interested parties. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 2

syslog-ng filename expansion - 1.6.0rc3
by James B. Davis 08 Oct '03

08 Oct '03

Hi, I've tried in vain to get underscores in the filename expansion but all I get is the last variable. For example: destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY-$YEAR-$MONTH-$DAY" owner(root) group(nms) perm(0640) dir_perm(0750) create_dirs(yes) ); }; Works but changing the "-" with "_" leaves me with files named "$DAY" rather than the whole string. Using "." works ok but it is real messy when you need fqdn. thx jbd -- James Davis Lead Systems Administrator Douglas County Government Information Technology Department 100 Third Street, Castle Rock CO 80104 USA cell 303.994.8881 fax 303.688.6908 direct 303.663.7654 http://www.douglas.co.us/ mailto:jdavis@douglas.co.us

1 0

bug report: interlaced messages
by Thomas Morin 03 Oct '03

03 Oct '03

Hi, I've just run into a problem I had already seen during my tests for the previous bug report I sent : I see pieces of logs that appear in the middle of other messages. Example: $ grep 'Sep 22 06:17:0' messages Sep 22 06:17:01 ker0009901 )<38>Sep 22 06:17:01 cron(pam_unix)[1173]: session closed for user mail We see, in the middle of a message, the beginning of a syslog header ( "<..>" ) and the message that follows does not belong to the 'messages' destination, and we see that it is actually missing from the 'auth.log' file : $ grep 'Sep 22 06:17:0' auth.log Sep 22 06:17:01 ker0009901 cron(pam_unix)[1173]: session opened for user mail by (uid=0) Sep 22 06:17:01 ker0009901 cron(pam_unix)[1174]: session opened for user root by (uid=0) Sep 22 06:17:02 ker0009901 cron(pam_unix)[1174]: session closed for user root (no "session closed" for user mail) This kind of problem might be a security issue if it can be triggered easily. I'm no expert here, but this looks a bit similar to the other bug I've just reported, since the same thing (interlaced messages) is happening when syslog-ng receives UDP syslog messages not NULL terminated of which size exceeds log_msg_size. Regards, -Thomas PS: this is syslog-ng 1.6.0, version 1.6.0rc1+20030310 (debian package), running on Linux 2.6.0-test5 -- == Thomas Morin == Ingénieur Consultant Atlantide - www.ago.fr - thomas.morin(a)ago.fr == PGP Id:8CEA233D Key FP:503BF6CFD3AE8719377B832A02FB94E08CEA233D --

2 3

syslog-ng writes two files
by Serge Torop 03 Oct '03

03 Oct '03

Hello! I'm using Linux RH 9.0, libol 0.3.9 and syslog-ng 1.6.0rc3. In my syslog-ng.conf: destination d_fetchmail { file("/var/log/fetchmail/fetchmaillog.$DAY.$MONTH.$YE$ Then syslog-ng operate the log it writes two files: 1. fetchmaillog.03.10.2003 2. fetchmaillog.31.12.2002 with different contents. Is writing fetchmaillog.31.12.2002 bug, then 3 Oct 2003 now? -- Serge P. Torop St.Petersburg, Russia

2 1