May 2004 - syslog-ng - lists.balabit.hu

Greetings, and a syntax error...
by mark 08 May '04

08 May '04

Good evening. Greetings to all users on this list, I've just signed up. Primarily I wanted syslog-ng to do secure remote logging by piping it through stunnel or ssh, but now I've had some time with the config file, I much prefer the syntax. A problem. I have a syntax error in my config file somewhere, and I just can't see it. syslog-ng gives the incredibly helpful: syntax error in 3 Parse error reading configuration file, exiting. (line 3) I've tried every variation I can think of on this line. Anyway, here is the config file: options { sync(0); }; source src { unix-dgram("/dev/log"); internal(); owner("syslog-ng"); group("syslog-ng"); perm(0600); }; source s_tcp { tcp( port(1028) ip("127.0.0.1") max-connections(2)); }; destination authlog { file("/var/log/syslog-ng/$HOST/auth.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination syslog { file("/var/log/syslog-ng/$HOST/syslog.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination cron { file("/var/log/syslog-ng/$HOST/cron.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination daemon { file("/var/log/syslog-ng/$HOST/daemon.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination kern { file("/var/log/syslog-ng/$HOST/kern.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination lpr { file("/var/log/syslog-ng/$HOST/lpr.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination user { file("/var/log/syslog-ng/$HOST/user.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination mail { file("/var/log/syslog-ng/$HOST/mail.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination debug { file("/var/log/syslog-ng/$HOST/debug" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination messages { file("/var/log/syslog-ng/$HOST/messages" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination all { file("/var/log/syslog-ng/$HOST/all.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); destination(all); }; log { source(src); destination(console_all); }; As you can see I'm not intending to run syslog-ng as root. Any help would be appreciated. mark www.darklogik.org

2 2

Re: [syslog-ng]Greetings, and a syntax error...
by mark 08 May '04

08 May '04

I think I have it solved... :) (blindingly obvious error is swept under the carpet) mark www.darklogik.org

1 0

libol.spec.in patch
by José Pedro Oliveira 07 May '04

07 May '04

Bazsi. The specfile included in libol no longer builds correctly (it is broken since Red Hat 9, or more correctly, since rpm 4.2). With the attached patch is builds correctly at least in RH73, RH9, and Fedora Core 1. The history of fedora.us libol SRPM can be found here: https://bugzilla.fedora.us/show_bug.cgi?id=1331 A scsh SRPM can be found here: https://bugzilla.fedora.us/show_bug.cgi?id=919 Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B * diff -ru libol-0.3.13+20040506-original/libol.spec.in libol-0.3.13+20040506-modified/libol.spec.in --- libol-0.3.13+20040506-original/libol.spec.in 2003-04-10 15:55:26.000000000 +0100 +++ libol-0.3.13+20040506-modified/libol.spec.in 2004-05-06 02:42:04.000000000 +0100 @@ -1,24 +1,39 @@ +# +# Before changing the macro below see the README file included in +# the syslog-ng package. +# +%define with_scheme_preprocessor 0 + Summary: Support library for syslog-ng Name: libol Version: @VERSION@ Release: 1 +Epoch: 0 License: GPL Group: System Environment/Libraries -Url: http://www.balabit.hu/products/syslog-ng/ -Source: http://www.balabit.hu/downloads/syslog-ng/libol/0.3/%{name}-%{version}.tar.… -Packager: Hollis Blanchard <hollis(a)penguinppc.org> -Buildroot: %{_tmppath}/%{name}-%{version}-buildroot +Url: http://www.balabit.com/products/syslog-ng/ +Source: http://www.balabit.com/downloads/syslog-ng/libol/0.3/%{name}-%{version}.tar… +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +Requires(post): /sbin/ldconfig +Requires(postun): /sbin/ldconfig +%if %{with_scheme_preprocessor} +BuildRequires: scsh +%endif %description Support library for syslog-ng. + %package devel -Summary: libol headers, libraries -Group: Development/Libraries -Requires: %name = %{version} +Summary: Support library for syslog-ng: headers and libraries +Group: Development/Libraries +Requires: %{name} = %{epoch}:%{version}-%{release} +%if %{with_scheme_preprocessor} +Requires: scsh +%endif %description devel -libol headers, libraries +Support library for syslog-ng: headers and libraries. %prep @@ -26,7 +41,7 @@ %build %configure -make +make %{?_smp_mflags} %install rm -rf ${RPM_BUILD_ROOT} @@ -42,21 +57,31 @@ %files -%defattr(-,root,root) -%doc ChangeLog -%{_bindir}/libol-config -%{_libdir}/libol.so +%defattr(-,root,root,-) +%doc ChangeLog COPYING %{_libdir}/libol.so.0 %{_libdir}/libol.so.0.0.0 %files devel -%defattr(-,root,root) -%{_includedir}/libol +%defattr(-,root,root,-) +%if %{with_scheme_preprocessor} +%{_bindir}/make_class +%else +%exclude %{_bindir}/make_class +%endif +%{_bindir}/libol-config %{_libdir}/libol.a %{_libdir}/libol.la +%{_libdir}/libol.so +%{_includedir}/libol %changelog +* Thu May 6 2004 Jose Pedro Oliveira <jpo(a)di.uminho.pt> - 0:0.3.13 +- update to version 0.3.13 +- macro %{with_scheme_preprocessor} +- merged several changes from the fedora.us libol specfile + * Thu Apr 10 2003 Jose Pedro Oliveira <jpo(a)di.uminho.pt> - specfile reformated - replaced hard coded values by RPM macros

2 2

RE: [syslog-ng]Problem with "kill -HUP" on syslog-ng
by Wyner, Peter 06 May '04

06 May '04

I'm receiving thousands of syslogs per second, so the truss is not that useful - it's too difficule to isolate the interval. When failed HUP issue occurrs, no log entry is written to syslog, and the daemon continues running normally. When a successful HUP occurs, the appropriate message appears in syslog. I did not have this issue when I was testing, only when I put the server under extreme load, so that be a prerequisite for the issue to occur. Peter -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Balazs Scheidler Sent: Thursday, May 06, 2004 12:59 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Problem with "kill -HUP" on syslog-ng 2004-05-06, cs keltezéssel 18:39-kor Wyner, Peter ezt írta: > I have had similar issues HUPing 1.6.2 under Solaris 2.8. My resolution > is to kill have the script kill -9 the process and start a new one > instead of HUPing. The behavior is not consistant - sometimes it will > honor the SIGHUP and sometimes it won't. can you be more specific? it simply does nothing, it crashes or? syslog-ng should send this message to the system log when it receives a system log: notice("SIGHUP received, restarting syslog-ng\n") do you receive this message when it does not correctly restart? can you attach truss to the running syslog-ng process when you send a HUP signal to it? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Tuning for high-throughput
by Wyner, Peter 06 May '04

06 May '04

On another topic..... Anyone have any guidance on optimizing syslog-ng for high-volume systems? For example, what is a good range for sync(), and are there any other options that may assist in lowering CPU? We are not using any variables in the directory of filenames other than $HOST. Here's the current conf: options { log_fifo_size(1024); dns_cache(yes); use_dns(yes); chain_hostnames(no); keep_hostname(no); create_dirs(yes);}; source local { sun-streams("/dev/log"); internal(); }; source std_udp { udp( port(52001) ); }; destination all { file("/var/log/messages"); }; destination std { file("/syslog/std/current/$HOST" dir_perm(0755) perm(0644)); }; log { source(local); destination(all); }; log { source(std_udp); destination(std); }; TIA, Peter

1 0

RE: [syslog-ng]Problem with "kill -HUP" on syslog-ng
by Wyner, Peter 06 May '04

06 May '04

I have had similar issues HUPing 1.6.2 under Solaris 2.8. My resolution is to kill have the script kill -9 the process and start a new one instead of HUPing. The behavior is not consistant - sometimes it will honor the SIGHUP and sometimes it won't. Peter -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Balazs Scheidler Sent: Thursday, May 06, 2004 12:01 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Problem with "kill -HUP" on syslog-ng 2004-05-06, cs keltezéssel 13:16-kor Stephane OMNES ezt írta: > Hi, > I need some help because I encountered a problem when trying to make some > automatic logrotate script with syslog-ng. > My "logrotate script" is the following : > /var/log/*.log { > sharedscripts > postrotate > /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || > true > endscript > } > > The syslog-ng daemon never restarts when you type "kill -HUP <syslog-ng.pid>" > I tried also "kill -SIGUP ..." same result (the daemon is stopped but never > restarts...). > Did someone ever encountered this problem ? > Is there any "proper" solution ? > > I'm currently workin under RedHat Enterprise v3.0 I don't know any problems wrt reload in syslog-ng 1.6.x, are you really sure you are HUPing the correct PID? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Problem with "kill -HUP" on syslog-ng
by Stephane OMNES 06 May '04

06 May '04

Hi, I need some help because I encountered a problem when trying to make some automatic logrotate script with syslog-ng. My "logrotate script" is the following : /var/log/*.log { sharedscripts postrotate /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true endscript } The syslog-ng daemon never restarts when you type "kill -HUP <syslog-ng.pid>" I tried also "kill -SIGUP ..." same result (the daemon is stopped but never restarts...). Did someone ever encountered this problem ? Is there any "proper" solution ? I'm currently workin under RedHat Enterprise v3.0 Thanks in advance to answer my question. Regards. Stéphane OMNES Security Engineer ************************************************************ The contents of this email and any attachments are confidential. They are intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to anyone or make copies. * email scanned for viruses, vandals and malicious content * ************************************************************

2 1

syslog-ng 1.6.3 released
by Balazs Scheidler 06 May '04

06 May '04

Hi, I have released syslog-ng 1.6.3 with the following user-visible changes: News for the 1.6.3 release Thu, 06 May 2004 11:05:46 +0200 * fixed possible abort when several UNIX domain sources refer to the same socket * fixed afunix and afinet destination template handling, do not include the PRI value automatically, let the administrator do it explicitly in its template * fixed possible segfault when the value of 0 is represented as a string in port specications (e.g. remoteport, localport, port) * added MSGONLY macro which expands to the message only without the program name which sent the log message * added global sanitize_filenames() option which changes control characters in all filenames to '.', defaults to TRUE, this might avoid escape sequence attacks embedded in filenames (imagine an administrator doing an ls in a directory where filenames contain any control characters) * avoid using GNU extensions in strftime (more specificly the timezone expansion in $ISODATE used %z which is not portable for IRIX) * added address spoofing support (use the original IP address when resending messages, read the file README.spoof for more information) * couple of IRIX specific patches were integrated * updated documentation have fun! -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

syslog-ng.sgml patch
by José Pedro Oliveira 06 May '04

06 May '04

Bazsi, Thanks for having commited the libol configure.in patch. There is a problem in the caption of one of the tables in the documentation. Right now tables 3-1 and 3-2 have the same caption. List of tables as seen in the TXT file: ------ ... List of Tables 2-1. Communication method between syslogd and its clients 2-2. Available source drivers in syslog-ng 2-3. Available destination drivers in syslog-ng 2-4. Log statement flags 3-1. Available options for unix-stream & unix-dgram 3-2. Available options for unix-stream & unix-dgram ... ---------- The patch attached corrects this problem (in the SGML file). Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B * diff -ru syslog-ng-1.7.0+20040506-original/doc/sgml/syslog-ng.sgml syslog-ng-1.7.0+20040506-modified/doc/sgml/syslog-ng.sgml --- syslog-ng-1.7.0+20040506-original/doc/sgml/syslog-ng.sgml 2004-01-09 09:19:55.000000000 +0000 +++ syslog-ng-1.7.0+20040506-modified/doc/sgml/syslog-ng.sgml 2004-05-06 00:52:34.000000000 +0100 @@ -609,7 +609,7 @@ The following options are valid for udp() and tcp() </para> <table> - <title>Available options for unix-stream & unix-dgram</title> + <title>Available options for udp & tcp</title> <tgroup cols=4> <thead> <row> Only in syslog-ng-1.7.0+20040506-modified/doc/sgml: syslog-ng.sgml.orig

1 0

RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 04 May '04

04 May '04

"/bin/sh -c" is currently hardcoded into syslog-ng. -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.co > From: Loic Minier [mailto:lool+syslog@via.ecp.fr] > Sent: Tuesday, May 04, 2004 11:35 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]cannot get sec.pl to exit after syslog-ng does > > I don't wether it's worth it, but you can try with > /usr/xpg4/bin/sh, it > is a POSIX compatibility version of sh. I use it because it > suffers of > less bugs than /bin/sh. iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 1