January 2004 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]funny character is being inserted into each log line + perm(-1) n ot working
by Rule, Ted 09 Jan '04

09 Jan '04

The ^@ isn't really 'funny', per se; it's a representation of Ctrl-@ which in turn is actually the null character. Hence I suspect syslog-ng is safely mangling a null somewhere into a readable representation before writing it to the log file. Quite whose fault this is, is another matter. Ted. ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

2 1

Stable version?
by Andrew Culver 09 Jan '04

09 Jan '04

What is the current stable version of syslog-ng? The docs say 1.4 is the latest stable (so 1.5 would be development) but I also see 1.6 and 1.9. Just wondering if 1.6 is the latest stable since it hasn't been updated in about 8 months. TIA, Andrew

1 0

patch for log parsing bugs (log4j)
by Balazs Scheidler 09 Jan '04

09 Jan '04

hi, Attached you'll find a patch against syslog-ng 1.6.0rc4 which addresses some issues wrt log parsing. Please test if the patch fixes your problems. It might be part of a future release if it proves to interoperate with other platforms. People with not to frequent platforms (HP-UX comes to mind), please also test this patch as it might break there. Thanks. And finally the patch: Index: src/sources.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/sources.c,v retrieving revision 1.37 diff -u -r1.37 sources.c --- src/sources.c 8 Jan 2003 09:31:37 -0000 1.37 +++ src/sources.c 3 Oct 2003 14:22:32 -0000 @@ -107,23 +107,32 @@ } closure->pos += n; + /* UDP packets are complete log lines on their own */ + if (closure->dgram) { + do_handle_line(closure, closure->pos, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); + closure->pos = 0; + return ST_OK | ST_GOON; + } + eol = memchr(closure->buffer, '\0', closure->pos); - if (eol == NULL) - eol = memchr(closure->buffer, '\n', closure->pos); if (closure->pad_size && eol) { + + /* HP-UX sends chunks of pad_size in size, each containing a + * separate message, terminated by NUL */ do_handle_line(closure, eol - closure->buffer, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; } - if (!eol && (closure->dgram || closure->pos == closure->max_log_line)) { - /* we don't have a terminating nl nor \0, and our buffer is - full or we are a datagram receiver, when the message is in - its own packet. - */ + if (eol == NULL) + eol = memchr(closure->buffer, '\n', closure->pos); + if (!eol && closure->pos == closure->max_log_line) { + /* we don't have a terminating nl nor \0, and our buffer is full */ do_handle_line(closure, closure->pos, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; } + + /* iterate through lines */ start = closure->buffer; while (eol) { /* eol points at the newline character. end points at the -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 5

compiling syslog-ng (latest version) on solaris 9 - error
by Markus Reger 09 Jan '04

09 Jan '04

hello to everybody Made several attempts to compile syslog-ng. Compilation of libol went fine. Whenever I "make" syslog-ng I encounter the error: gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o getopt.o getopt1.o -lpthread -lnsl -lsocket -ldoor -lresolv /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Has anyone ever compiled on Solaris 9 - gcc 3.3. Thanks in advance for every hint. kr

2 1

Question regarding syslog-ng filter
by Aladdin 09 Jan '04

09 Jan '04

I'm using syslog-ng 1.6rc4 Can anyone tell me what is wrong with this filter: filter f_kern { facility(kern) and (not match("IPTABLES DROP") or not match("New not SYN:")); }; I still can see lines with IPTABLES DROP in my kernel log:-( Why these messages still come through this filter? Thanks. What am I missing?

1 0

RE: [syslog-ng]Compile Error on Solaris 2.8
by Hamilton Andrew 08 Jan '04

08 Jan '04

Strange... Try this: In /tmp/syslog-ng/libol-0.3.9 do a 'make distclean', I don't remember if this works but if not you can do a 'make clean' and then delete config.cache and try to run the configure script again. If that doesn't work upgrade to the latest libol, which is 0.3.11, I think, and try it again, and if that still doesn't work repost and we'll try something else. Regards, Drew -----Original Message----- From: Chance Ellis [mailto:chance_ellis@yahoo.com] Sent: Wednesday, January 07, 2004 7:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Compile Error on Solaris 2.8 Trying to compile libol 0.3.9 on Solaris. Get this error on Make: Making all in utils make[1]: Entering directory `/tmp/syslog-ng/libol-0.3.9/utils' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/tmp/syslog-ng/libol-0.3.9/utils' Making all in src make[1]: Entering directory `/tmp/syslog-ng/libol-0.3.9/src' /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng/libol -0.3.9/src -I. -I/opt/gnome/include -I/usr/openwin/share/include/X11/extension s -I/usr/openwin/include -D_GNU_SOURCE -Wall -O2 -c format.c rm -f .libs/format.lo gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng/libol-0.3.9/src -I. -I/opt/gnome/includ e -I/usr/openwin/share/include/X11/extensions -I/usr/openwin/include -D_GNU_SOUR CE -Wall -O2 -c format.c -fPIC -DPIC -o .libs/format.lo In file included from objects.h:41, from format.h:27, from format.c:24: objtypes.h:36:3: #error No suitable type found to use for UINT32 objtypes.h:44:3: #error No suitable type found to use for UINT16 In my configure I noticed that when it checks the size of short, int and long they are returned Cached 0. Any ideas? Thanks! __________________________________ Do you Yahoo!? Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes http://hotjobs.sweepstakes.yahoo.com/signingbonus _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]funny character is being inserted into each log li ne + perm(-1) n ot working
by Clemson, Chris 08 Jan '04

08 Jan '04

> The ^@ isn't really 'funny', per se; it's a representation of Ctrl-@ > which in turn is actually the null character. ah, i see. i wondered what it was! > Hence I suspect syslog-ng is safely mangling a null somewhere > into a readable representation before writing it to the log file. hmm, strange. is there a way to turn this off? i dont mind that the date isn't displaying, and it's only affecting the firewall, so it's not a big deal really. it's just annoying to get alert emails that don't actually contain anything useful! > Quite whose fault this is, is another matter. :) thanks chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

Compile Error on Solaris 2.8
by Chance Ellis 08 Jan '04

08 Jan '04

Trying to compile libol 0.3.9 on Solaris. Get this error on Make: Making all in utils make[1]: Entering directory `/tmp/syslog-ng/libol-0.3.9/utils' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/tmp/syslog-ng/libol-0.3.9/utils' Making all in src make[1]: Entering directory `/tmp/syslog-ng/libol-0.3.9/src' /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng/libol -0.3.9/src -I. -I/opt/gnome/include -I/usr/openwin/share/include/X11/extension s -I/usr/openwin/include -D_GNU_SOURCE -Wall -O2 -c format.c rm -f .libs/format.lo gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng/libol-0.3.9/src -I. -I/opt/gnome/includ e -I/usr/openwin/share/include/X11/extensions -I/usr/openwin/include -D_GNU_SOUR CE -Wall -O2 -c format.c -fPIC -DPIC -o .libs/format.lo In file included from objects.h:41, from format.h:27, from format.c:24: objtypes.h:36:3: #error No suitable type found to use for UINT32 objtypes.h:44:3: #error No suitable type found to use for UINT16 In my configure I noticed that when it checks the size of short, int and long they are returned Cached 0. Any ideas? Thanks! __________________________________ Do you Yahoo!? Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes http://hotjobs.sweepstakes.yahoo.com/signingbonus

1 0

syslog-ng mysql syntax error
by Asif Iqbal 07 Jan '04

07 Jan '04

Hi All Since yesterday I am getting this syntax errors while pushing the log to the mysql database I followed the instruction exactly how it was said in http://vermeer.org/syslog/ and it was working fine until today it started complaining ERROR 1064 at line 841: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'level, tag, date, time, program, msg) VALUES ( '63.152.4.63', ' ERROR 1064 at line 1: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '/22/3 session 4612f4 Session End' ); INSERT INTO logs (host, fa ERROR 1064 at line 424: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '63.152.0.100', 'local4', 'err', 'err', 'a3', '2003-12-31', '17: Any suggestion/hint would be greatly appreciated -- Asif Iqbal http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x8B686E08 There's no place like 127.0.0.1

1 1

funny character is being inserted into each log line + perm(-1) n ot working
by Clemson, Chris 07 Jan '04

07 Jan '04

I am having a problem with logging from a Cisco PIX firewall to a syslog-ng file. For months it has been working fine, but something happened on 18th december: Dec 18 16:08:25 BPFpix-int Dec 18 2003 08:53:15: %PIX-3-313001: Denied ICMP type=8, code=0 from 217.81.176.93 on interface 0 Dec 18 09:46:50^@ BPFpix-int %PIX-3-313001: Denied ICMP type=8, code=0 from 217.79.97.90 on interface 0 all the lines logged since "Dec 18 09:46:50" have all had that ^@ code after it, and no date. i don't know why the times on the previous line are different, but the syslog server now has our "official" time, so i'm not that bothered. Around this time i was trying to sort out the permissions problems with /dev/ files i was having when syslog-ng restarted, so i guess this could be connected. This ^@ character is only in the PIX firewall log (which is saved to a different file than most of the other syslog messages). The pertinent config lines are as follows: destination null { file("/dev/null" perm(0666)); }; source BPFpix { udp(ip ("192.168.1.2") port(514)); }; filter f_bpfpixpingdrop { host ("BPFpix") and match("Denied ICMP"); }; # BPFpix messages # destination BPFpixlog { file ("/var/log/BPFpix"); }; log { source(BPFpix); destination(BPFpixlog); }; # drop ping attempts log { source(BPFpix); filter (f_bpfpixpingdrop); destination(null); flags(final);}; # log the rest log { source(BPFpix); destination(lanmon); }; the "lanmon" destination is a machine that emails certain syslog messages, and because the PIX messages have a ^@ in them, the messages are mainly blank! Can anyone tell me where this ^@ is coming from, and could it be permissions related? i am running syslog-ng 1.6.0rc4. also, i really want that first line to read: destination null { file("/dev/null" perm(-1)); }; so that no permissions are changed on that file, but syslog-ng complains about it when i start it up. What am i doing wrong? thank you! chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0