April 2004 - syslog-ng - lists.balabit.hu

Where to get latest version og syslog-ng?
by me 17 May '04

17 May '04

Hi, I have problems compiling syslog-ng-1.9.1. As it looks like, the problem was/is known. My question is where to get the very latest version of syslog-ng? Thanks, /me old message of this mailinglist: -------------------------------- On Sun, Feb 16, 2003 at 08:54:17AM -0500, mclinden(a)informed.net wrote: > Greetings! > > The file src/fdread.h seems to be missing from the latest tarball of > syslog-ng-1.9.1 Please try the daily snapshots at http://www.balabit.com/downloads/syslog-ng/1.9/src-snapshot/ -- Bazsi -- "Sie haben neue Mails!" - Die GMX Toolbar informiert Sie beim Surfen! Jetzt aktivieren unter http://www.gmx.net/info

2 6

RE: [syslog-ng]libol license?
by atonns＠mail.ivillage.com 01 May '04

01 May '04

Bazsi, Thanks for your reply. It's interesting that you'd use the GPL instead of the LGPL for libol. GPL for libraries will "infect" any code that links to it, forcing it to be GPL as well. Any particular motivation for that? I'm also wondering if there's any documentation (english) for libol - I don't see any on your site. This site (http://www.usinglinux.org/devel/libol.html) is the 3rd link on Google when searching for "libol documentation". I'm trying to hunt down how signals are handled for childen of syslog-ng and it's a blurry line where syslog-ng ends and libol begins (this is related to the other thread about sec.pl). Any info you might have would be helpful. Thanks again, Tony -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: Friday, April 30, 2004 12:21 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]libol license? > > 2004-04-29, cs keltezéssel 20:40-kor atonns(a)mail.ivillage.com > ezt írta: > > No, it is under the GPL, not LGPL. > > I've comitted a COPYING file. The source file headers > reference the GPL > properly. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD > 804E C82C 8EB1 > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 1

RE: [syslog-ng]Not finding libol, please help
by Olivia Leonard 30 Apr '04

30 Apr '04

Hi Keith I think your version of libol is too old, you need to have at least version 0.3.13 installed. Olivia -----Original Message----- From: Keith Olmstead [mailto:kolmstea@centurytel.net] Sent: 30 April 2004 16:28 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Not finding libol, please help Hello, Trying to upgrade my syslog-ng install and during the config, it is not finding my libol. checking libol version >= 0.3.13... no configure: error: Required libol version not found but I have libol installed. libol-config --version 0.3.9 Just a default install of libol. Can anyone help me as to why it is not seeing libol. It is in my path and I can not find a reason why it is not finding it. This is on a RH9 box. Thanks, Keith -- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html The Information is this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any other action taken or any views, opinions or advice contained in this email are those of the sending individual and not necessarily those of the firm. It is possible for data transmitted by e-mail to be deliberately or accidentally corrupted or intercepted. For this reason where the communication is by email, J&E Davy does not accept any responsibility for any breach of confidence which may arise from the use of this medium. If you have received this e-mail in error please notify us immediately at mailto:helpdesk@davy.ie and delete this e-mail from your system.

2 1

libol license?
by atonns＠mail.ivillage.com 30 Apr '04

30 Apr '04

This isn't syslog-ng related directly but... I just downloaded libol-0.3.13.tar.gz from http://www.balabit.com/downloads/syslog-ng/libol/0.3/ It says on that page: Some of our download able products are free software, licensed under GNU General Public License, others have a more restrictive license. The exact license terms of those programs are available in a file named COPYING or LICENSE. However, there is no COPYING or LICENSE files in the libol-0.3.13.tar.gz tarball. This is an oversight, right? I assume it would be the LGPL, correct? -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 1

RE: [syslog-ng]Not finding libol, please help
by Edwards, Thomas 30 Apr '04

30 Apr '04

Get the new version of libol, it needs 0.3.13. You can get it here http://www.balabit.com/downloads/libol/0.3/libol-0.3.13.tar.gz Here is the main page. http://www.balabit.com/downloads/libol/0.3/ When I upgraded libol it went smoothly. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Keith Olmstead Sent: Friday, April 30, 2004 10:28 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Not finding libol, please help Hello, Trying to upgrade my syslog-ng install and during the config, it is not finding my libol. checking libol version >= 0.3.13... no configure: error: Required libol version not found but I have libol installed. libol-config --version 0.3.9 Just a default install of libol. Can anyone help me as to why it is not seeing libol. It is in my path and I can not find a reason why it is not finding it. This is on a RH9 box. Thanks, Keith -- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ******************************************** This message is intended only for the use of the Addressee and may contain information that is PRIVILEGED and CONFIDENTIAL. If you are not the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please erase all copies of the message and its attachments and notify us immediately. Thank you. ********************************************

1 0

Not finding libol, please help
by Keith Olmstead 30 Apr '04

30 Apr '04

Hello, Trying to upgrade my syslog-ng install and during the config, it is not finding my libol. checking libol version >= 0.3.13... no configure: error: Required libol version not found but I have libol installed. libol-config --version 0.3.9 Just a default install of libol. Can anyone help me as to why it is not seeing libol. It is in my path and I can not find a reason why it is not finding it. This is on a RH9 box. Thanks, Keith --

1 0

RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 29 Apr '04

29 Apr '04

Aw crap. Forget all this. I looked at it again, and anyone would be able to DoS sec.pl using logger. ::sigh:: It looks like signal propagation from syslog-ng to sec.pl is the right way of doing this. -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com > -----Original Message----- > From: atonns(a)mail.ivillage.com [mailto:atonns@mail.ivillage.com] > Sent: Thursday, April 29, 2004 12:13 PM > To: syslog-ng(a)lists.balabit.hu > Subject: RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does > > After a night of sleeping on it, I came up with a alternate > solution - have > SEC detect restarts of syslog-ng. Below is the result. The > only fuzzy part > is in the sec-cleanup.pl script below - what to do if you > don't get a TERM > signal from sec.pl. I don't think using "logger" is the best > idea since > things are restarting, etc. etc. I _guess_ it could send email out. In > reality, it's all up to the end user. > > ### syslog-ng.conf ### > > source s_src { > sun-stream("/dev/log" door("/etc/.syslog_door")); > tcp(max-connections(1024)); > udp(); > internal(); > }; > > destination d_sec { > program("/usr/local/sbin/sec.pl -intevents -input=\"-\" > -conf=/usr/local/etc/sec.conf"); > }; > > log { > source(s_src); > destination(d_sec); > }; > > ### sec.conf ### > > type=Single > continue=TakeNext > ptype=RegExp > pattern=syslog-ng version .+ going down > desc=syslog-ng shutdown > action= shellcmd /usr/local/sbin/sec-cleanup.pl > > type=Single > continue=TakeNext > ptype=RegExp > pattern=SIGHUP received, restarting syslog-ng > desc=syslog-ng restart > action= shellcmd /usr/local/sbin/sec-cleanup.pl > > ### sec-cleanup.pl ### > > #!/usr/local/bin/perl -w > # > # sec-cleanup.pl > # > # ATonns Thu Apr 29 11:42:10 EDT 2004 > # > # $Id$ > # > > use strict; > my $PROGNAME="sec-cleanup.pl"; > my $waittime = 10; # in seconds > > ## CODE ## > > my $pid = $$; > my $ppid = getppid; > $SIG{'TERM'} = sub { > print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: got TERM > signal, exiting gracefully.\n"; > exit(0); > }; > print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: killing parent > $ppid\n"; > kill('TERM',$ppid); > sleep($waittime); > print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: not > good - timed out > waiting for TERM signal. Exiting.\n"; > exit(1); > > -- > "Computer science is as much about computers as > astronomy is about telescopes" -- Edsger Dijkstra > --------------------------------------------------------- > Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com > iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - > iVillage Inc. is a > leading women's media company that includes iVillage.com, Women.com, > gURL.com, Astrology.com, Promotions.com, iVillage Parenting > Network, The > Newborn Channel, Lamaze Publishing, Business Women's Network, > Diversity Best > Practices, Best Practices in Corporate Communications, and iVillage > Consulting. The information contained in this communication may be > confidential, is intended only for the use of the recipient > named above, and > may be construed under applicable law to be a commercial > email. If you have > received this communication in error, please delete this > message from your > computer system. If you are the recipient named above and do > not wish to > receive any future commercial emails, please reply to the > sender with a > message stating such preference. > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

1 0

RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 29 Apr '04

29 Apr '04

After a night of sleeping on it, I came up with a alternate solution - have SEC detect restarts of syslog-ng. Below is the result. The only fuzzy part is in the sec-cleanup.pl script below - what to do if you don't get a TERM signal from sec.pl. I don't think using "logger" is the best idea since things are restarting, etc. etc. I _guess_ it could send email out. In reality, it's all up to the end user. ### syslog-ng.conf ### source s_src { sun-stream("/dev/log" door("/etc/.syslog_door")); tcp(max-connections(1024)); udp(); internal(); }; destination d_sec { program("/usr/local/sbin/sec.pl -intevents -input=\"-\" -conf=/usr/local/etc/sec.conf"); }; log { source(s_src); destination(d_sec); }; ### sec.conf ### type=Single continue=TakeNext ptype=RegExp pattern=syslog-ng version .+ going down desc=syslog-ng shutdown action= shellcmd /usr/local/sbin/sec-cleanup.pl type=Single continue=TakeNext ptype=RegExp pattern=SIGHUP received, restarting syslog-ng desc=syslog-ng restart action= shellcmd /usr/local/sbin/sec-cleanup.pl ### sec-cleanup.pl ### #!/usr/local/bin/perl -w # # sec-cleanup.pl # # ATonns Thu Apr 29 11:42:10 EDT 2004 # # $Id$ # use strict; my $PROGNAME="sec-cleanup.pl"; my $waittime = 10; # in seconds ## CODE ## my $pid = $$; my $ppid = getppid; $SIG{'TERM'} = sub { print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: got TERM signal, exiting gracefully.\n"; exit(0); }; print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: killing parent $ppid\n"; kill('TERM',$ppid); sleep($waittime); print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: not good - timed out waiting for TERM signal. Exiting.\n"; exit(1); -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

1 0

Sylog-ng OpenBSD Problems
by Johannes Geier 29 Apr '04

29 Apr '04

Hello, I run syslog-ng-1.5.24 on OpenBSD 3.4 sparc64, i have some problems, its not working in the way i want it, my config looks in this way: options { long_hostnames(off); chain_hostnames(off); use_fqdn (yes); sync(0); }; source s_udp { udp(); }; destination test { file("/var/log/info"); }; log { source(s_udp); destination(test); }; no biggie at all tail -f /var/log/info shows: Apr 28 16:23:18 syslog/syslog 1552866: Apr 28 16:42:18: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1:14, changed state to down Apr 28 16:23:23 syslog/syslog 1552872: Apr 28 16:42:24: %LINK-3-UPDOWN: Interface Serial1/0:2, changed state to down There is no Router source IP, just syslog/syslog syslog is the name of the logging box # uname -a OpenBSD syslog.srv.test.com 3.4 GENERIC#85 sparc64 when i run that box with the normal syslogd the source ip, gets shown, and even when i erase all options in syslog-ng.conf : source s_udp { udp(); }; destination test { file("/var/log/info"); }; log { source(s_udp); destination(test); }; the source ip never comes in, i just want the sourceip no dns name nothing any ideas? Greets Johannes -- Die e-Mail-Boxes von Brennercom sind Virus-gesichert und Spam-gefiltert. Le caselle e-Mail di Brennercom sono protette da sistemi antivirus e antispam. http://www.brennercom.it

2 4

RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 29 Apr '04

29 Apr '04

Nate, I don't think it's perl, but syslog-ng. What version of syslog-ng are you running? I looked at the source for 'afprogram.c' in both 1.6.2 and the 1.7.0+20040428 where it forks the child to run the program. Using the code as follows, how could you do anything _but_ run /bin/sh -c ... if (pid == 0) { int fd = open("/dev/null", O_WRONLY); dup2(msgpipe[0], 0); dup2(fd, 1); dup2(fd, 2); close(fd); close(msgpipe[1]); execl("/bin/sh", "/bin/sh", "-c", self->progname->data, NULL); _exit(127); } I'm still reading through the code, but I don't think that syslog-ng passes along the necessary signals to it's children. When I HUP syslog-ng, it spawns another sec.pl as well, not SIGTERM'ing the first one. Am I not understanding the behavior of syslog-ng, doing something wrong, or is this some sort of bug in syslog-ng? FYI, sec.pl's behavior is documented as follows in the SEC man page: SIGTERM SEC will terminate gracefully (all SEC child processes will receive SIGTERM). Shouldn't syslog-ng do the same? Thanks, Tony -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com > -----Original Message----- > From: Nate Campi [mailto:nate@campin.net] > Sent: Wednesday, April 28, 2004 5:06 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]cannot get sec.pl to exit after syslog-ng does > > I read your message too fast the first time, it appears that you still > have it spawned by a shell with no shell redirection characters. > > 23330 ? S 2:11 /sbin/syslog-ng > 23331 ? S 0:00 \_ /usr/bin/perl /usr/bin/swatch > --script-dir=/root --read-pipe=cat /dev > 23346 ? S 0:31 | \_ perl /root/.swatch_script.23331 > 23370 ? S 0:02 | \_ cat /dev/fd/0 > 23334 ? S 3:24 \_ /usr/bin/perl -w > /usr/local/sbin/sec.pl -input=- -conf=/usr/local/etc > > I don't have a shell starting sec on linux. Maybe it's perl on solaris > doing this. I can't say. > -- > Nate > > "Guide to understanding a net.addict's day: Slow day: didn't have much > to do, so spent three hours on usenet. Busy day: managed to work in > three hours of usenet. Bad day: barely squeezed in three hours of > usenet." - Unknown > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 2