May 2004 - syslog-ng - lists.balabit.hu

syslog-ng 1.7.0 on Darwin (Mac OSX Server 10.3 Panther)
by Cary, Kim 04 May '04

04 May '04

Hi all, Well, finally have this going and not crashing! Last night's 1.70 and the corresponding libol. Yay! However, I'm not grokking Darwin compared to Solaris/Linux and syslog-ng configs compared to vanilla syslog. I'm not finding much on searches that helps. The man pages for the O/S seem like they come from BSD but don't apply (see log sockets which don't exist ). I'm not a C programmer and am a bit lost trying to go to syslog.h . Little help here? IT RUNS 4.3 Berkeley Distribution June 6, 1993 4.3 Berkeley Distribution [mal-centurion:local/etc/syslog-ng] admin% sudo lsof | grep syslog tcsh 9840 admin cwd VDIR 14,21 512 200229 /usr/local/etc/syslog-ng syslog-ng 16625 root cwd VDIR 14,21 512 200229 /usr/local/etc/syslog-ng syslog-ng 16625 root 0u VCHR 3,2 0t0 20520196 /dev/null syslog-ng 16625 root 1u VCHR 3,2 0t0 20520196 /dev/null syslog-ng 16625 root 2u VCHR 3,2 0t0 20520196 /dev/null syslog-ng 16625 root 3r 0x013d5958 file struct, ty=0x3, op=0x30f300 syslog-ng 16625 root 4u IPv4 0x0142ef20 0t0 UDP *:syslog syslog-ng 16625 root 5r 0x013d3924 file struct, ty=0x3, op=0x30f300 syslog-ng 16625 root 6u IPv4 0x024554c8 0t0 TCP *:5140 (LISTEN) lsof 16894 root cwd VDIR 14,21 512 200229 /usr/local/etc/syslog-ng grep 16895 admin cwd VDIR 14,21 512 200229 /usr/local/etc/syslog-ng WHAT RUNS? I DONT KNOW THE RIGHT SOCKET/DEVICE OR PROTOCOL There is no /var/run/log or /dev/log. There is a /dev/klog but I get io.c: bind_unix_socket(): /dev/klog not a socket MY CONFIG IS FUBARED Below I place my regular config, then the syslog-ng config. VANILLA [mal-centurion:local/etc/syslog-ng] admin% more /etc/syslog.conf *.err;kern.*;auth.notice;authpriv,remoteauth,install.none;mail.crit /dev/console *.notice;local4,authpriv,remoteauth,ftp,install.none;kern.debug; mail.crit;mark.* /var/log/system.log # Send messages normally sent to the console also to the serial port. # To stop messages from being sent out the serial port, comment out this line. #*.err;kern.*;auth.notice;authpriv,remoteauth.none;mail.crit /dev/tty.serial # The authpriv log file should be restricted access; these # messages shouldn't go to terminals or publically-readable # files. authpriv.*;remoteauth.crit /var/log/secure.log lpr.info /var/log/lpr.log mail.* /var/log/mail.log ftp.* /var/log/ftp.log netinfo.err /var/log/netinfo.log install.* /var/log/install.log install.* @127.0.0.1:32376 *.emerg * local6.notice /private/var/log/mailaccess.log NEXT GENERATION ############################################################### # First, set some global options. options { # use_fqdn(yes); # use_dns(yes); # dns_cache(yes); keep_hostname(yes); long_hostnames(off); sync(1); log_fifo_size(1024); }; ############################################################### # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-stream("/dev/log"); internal(); }; source src { # don't read from /proc/kmsg and run klogd also (Linux) # pipe("/proc/kmsg"); # file("/proc/kmsg") log_prefix("kernel: "); # unix-stream("/dev/log"); # unix-stream("/chroot/named/dev/log"); internal(); udp(); # udp(ip("10.0.5.8") port(514)); tcp(port(5140) keep-alive(yes)); # tcp(ip("10.9.9.3") port(5140) keep-alive(yes)); }; ############################################################### # After that set destinations. # First some standard logfile # destination authlog { file("/var/ng-syslog/auth.log"); }; destination syslog { file("/var/ng-syslog/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/ng-syslog/daemon.log"); }; destination kern { file("/var/ng-syslog/kern.log"); }; destination lpr { file("/var/ng-syslog/lpr.log"); }; destination user { file("/var/ng-syslog/user.log"); }; destination uucp { file("/var/ng-syslog/uucp.log"); }; # This files are the log come from the mail subsystem. # #destination mail { file("/var/log/mail.log"); }; #destination maillog { file("/var/log/maillog"); }; #destination mailinfo { file("/var/log/mail.info"); }; #destination mailwarn { file("/var/log/mail.warn"); }; #destination mailerr { file("/var/log/mail.err"); }; # # Logging for INN news system # #destination newscrit { file("/var/log/news/news.crit"); }; #destination newserr { file("/var/log/news/news.err"); }; #destination newsnotice { file("/var/log/news/news.notice"); }; # Some `catch-all' logfiles. # destination debug { file("/var/ng-syslog/debug"); }; destination messages { file("/var/ng-syslog/messages"); }; # The root's console. # destination console { usertty("root"); }; The balance of that sample file is commented. The directory /var/ng-syslog exists, but none of the files. Do I have to touch those to get them going?

2 1

RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 04 May '04

04 May '04

> From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: Tuesday, May 04, 2004 10:30 AM > To: syslog-ng(a)lists.balabit.hu > Subject: RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does > > I've tried to reproduce the problem you are describing, but without > success. I attached with strace to syslog-ng and its child > process (this > time it was /bin/cat), and here are the results: > [ results snipped ] > > So cat receives the TERM signal, maybe it is blocked for you > in some ways? > Another thing that should terminate your process is that > syslog-ng closes > the write side of its pipe e.g. your perl script should have > received an EOF > on its standard input, even if it does not receive the term signal. Well, it looks like the intervening "ignore SIGTERM" action is the /bin/sh spawned as the parent of all syslog-ng children (v1.6.2, line 112 of afprogram.c). Sorry I didn't think of using truss/strace sooner. I've included the truss output below. The command line used was "truss -d -f /usr/local/sbin/syslog-ng 2>&1 | tee debug1.txt", so each line has the pid and the offset-timestamp. You'll see that the /bin/sh ignores the SIGTERM and keeps waiting for it's children. It was only after I SIGTERM'd sec.pl did the /bin/sh exit. The processes were laid out as follows: 14340 /usr/local/sbin/syslog-ng 14342 /bin/sh -c /usr/local/sbin/sec.pl -intevents -input="-" -conf=/usr/local/etc/se 14344 /usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input=- -conf=/usr/lo I sent the first SIGTERM to syslog-ng at timestamp ~7.5 seconds, where it exited and /bin/sh didn't. I SIGTERM'd /bin/sh at timestamp ~17.4 seconds, with no result. It was only after SIGTERM'ing sec.pl at ~23.4 seconds did /bin/sh give up at ~26.4 seconds. I'm not sure what to do at this point about the /bin/sh - but I'm open to suggestions. I've checked syslog-ng 1.5.26 that Nate said he was using and it has the same /bin/sh line in afprogram.c. I've found this info from the 'sh' manpage: Signals The INTERRUPT and QUIT signals for an invoked command are ignored if the command is followed by &; otherwise signals have the values inherited by the shell from its parent, with the exception of signal 11 (but see also the trap command below). But I'm not sure what it would inherit from syslog-ng. > this is in main.c around line 77: Ah yes! ok! Once again, thanks for the help. -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com RELEVANT TRUSS OUTPUT: syslog-ng --------- 14340: 0.5666 poll(0xFFBEF908, 8, 100) = 0 14340: poll(0xFFBEF908, 8, 60000) (sleeping...) 14340: signotifywait() (sleeping...) 14340: lwp_sema_wait(0xFEF0DE78) (sleeping...) 14340: door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) 14340: 7.5103 signotifywait() = 15 14340: 7.5107 Received signal #15, SIGTERM, in poll() [caught] 14340: siginfo: SIGTERM pid=13532 uid=0 14340: 7.5106 lwp_sigredirect(1, SIGTERM) = 0 14340: 7.5109 poll(0xFFBEF908, 8, 60000) Err#4 EINTR 14340: 7.5111 sigaction(SIGTERM, 0xFFBEF398, 0x00000000) = 0 14340: 7.5113 sysconfig(_CONFIG_SIGRT_MIN) = 38 14340: 7.5114 sigprocmask(SIG_SETMASK, 0xFF0DD9A8, 0x00000000) = 0 14340: 7.5116 sigaction(SIGTERM, 0xFFBEF228, 0xFFBEF328) = 0 14340: 7.5118 sigprocmask(SIG_SETMASK, 0xFF0E96D8, 0x00000000) = 0 14340: 7.5119 sysconfig(_CONFIG_SIGRT_MIN) = 38 14340: 7.5121 setcontext(0xFFBEF570) 14340: 7.5123 getpid() = 14340 [1] 14340: 7.5124 time() = 1083681719 14340: 7.5135 time() = 1083681719 14340: 7.5137 time() = 1083681719 14340: 7.5138 time() = 1083681719 14340: 7.5140 poll(0xFFBEF908, 8, 100) = 2 14340: 7.5142 write(4, " M a y 4 1 0 : 4 1".., 82) = 82 14340: 7.5145 write(9, " < 4 5 > M a y 4 1".., 86) = 86 14340: 7.5148 getpid() = 14340 [1] 14340: 7.5149 kill(14342, SIGTERM) = 0 14340: 7.5152 door_revoke(5) = 0 14340: 7.5153 close(5) Err#9 EBADF 14340: 7.5162 llseek(0, 0, SEEK_CUR) = 0 14340: 7.5164 _exit(0) /bin/sh ------- 14342: 0.2626 fork() = 14344 14342: waitid(P_PID, 14344, 0xFFBEF850, WEXITED|WTRAPPED|WNOWAIT) (sleeping...) 14342: 7.5170 Received signal #15, SIGTERM, in waitid() [caught] 14342: siginfo: SIGTERM pid=14340 uid=0 14342: 7.5178 waitid(P_PID, 14344, 0xFFBEF850, WEXITED|WTRAPPED|WNOWAIT) Err#4 EINTR 14342: 7.5180 setcontext(0xFFBEF538) 14342: waitid(P_PID, 14344, 0xFFBEF850, WEXITED|WTRAPPED|WNOWAIT) (sleeping...) 14342: 17.4322 Received signal #15, SIGTERM, in waitid() [caught] 14342: siginfo: SIGTERM pid=13532 uid=0 14342: 17.4324 waitid(P_PID, 14344, 0xFFBEF850, WEXITED|WTRAPPED|WNOWAIT) Err#4 EINTR 14342: 17.4326 setcontext(0xFFBEF538) 14342: waitid(P_PID, 14344, 0xFFBEF850, WEXITED|WTRAPPED|WNOWAIT) (sleeping...) 14342: 26.4310 waitid(P_PID, 14344, 0xFFBEF850, WEXITED|WTRAPPED|WNOWAIT) = 0 14342: 26.4318 ioctl(0, TIOCGPGRP, 0xFFBEF80C) Err#22 EINVAL 14342: 26.4319 getpgid(14344) = 14337 14342: 26.4321 ioctl(0, TIOCGPGRP, 0xFFBEF80C) Err#22 EINVAL 14342: 26.4322 waitid(P_PID, 14344, 0xFFBEF850, WEXITED|WTRAPPED) = 0 14342: 26.4326 llseek(0, 0, SEEK_CUR) Err#29 ESPIPE 14342: 26.4327 _exit(2000) sec.pl ------ 14344: 23.4165 Received signal #15, SIGTERM, in poll() [caught] 14344: siginfo: SIGTERM pid=13532 uid=0 14344: 23.4167 poll(0xFFBEF838, 0, 100) Err#91 ERESTART 14344: 23.4172 sigaction(SIGTERM, 0xFFBEF048, 0xFFBEF0C8) = 0 14344: 23.4175 setcontext(0xFFBEF520) 14344: 23.4179 time() = 1083681735 14344: 23.4181 waitid(P_ALL, 0, 0xFFBEF788, WEXITED|WTRAPPED|WNOHANG) Err#10 ECHILD 14344: 23.4183 ioctl(2, TCGETA, 0xFFBEF874) Err#6 ENXIO 14344: 23.4185 ioctl(2, TCGETA, 0xFFBEF874) Err#6 ENXIO 14344: 23.4187 time() = 1083681735 14344: 23.4189 ioctl(2, TCGETA, 0xFFBEF874) Err#6 ENXIO 14344: 23.4201 time() = 1083681735 14344: 23.4204 time() = 1083681735 14344: 23.4206 ioctl(2, TCGETA, 0xFFBEF874) Err#6 ENXIO 14344: 23.4208 time() = 1083681735 14344: 23.4211 time() = 1083681735 14344: 23.4213 ioctl(2, TCGETA, 0xFFBEF874) Err#6 ENXIO 14344: 23.4215 ioctl(2, TCGETA, 0xFFBEF874) Err#6 ENXIO 14344: 23.4217 time() = 1083681735 14344: 23.4219 alarm(0) = 0 14344: 23.4221 sigaction(SIGALRM, 0xFFBEF798, 0xFFBEF848) = 0 14344: 23.4222 sigfillset(0xFF23C4C4) = 0 14344: 23.4224 sigprocmask(SIG_BLOCK, 0xFFBEF838, 0xFFBEF828) = 0 14344: 23.4225 alarm(3) = 0 14344: sigsuspend(0xFFBEF818) (sleeping...) 14344: 26.4168 Received signal #14, SIGALRM, in sigsuspend() [caught] 14344: 26.4171 sigsuspend(0xFFBEF818) Err#4 EINTR 14344: 26.4173 setcontext(0xFFBEF500) 14344: 26.4174 alarm(0) = 0 14344: 26.4176 sigprocmask(SIG_UNBLOCK, 0xFFBEF838, 0x00000000) = 0 14344: 26.4178 sigaction(SIGALRM, 0xFFBEF798, 0x00000000) = 0 14344: 26.4179 time() = 1083681738 14344: 26.4181 getcontext(0xFFBEF5E8) 14344: 26.4183 setcontext(0xFFBEF5E8) 14344: 26.4212 getcontext(0xFFBEF4D0) 14344: 26.4219 getcontext(0xFFBEF370) 14344: 26.4221 getcontext(0xFFBEF370) 14344: 26.4244 llseek(0, 0, SEEK_CUR) Err#29 ESPIPE 14344: 26.4246 _exit(0) iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 1

RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 04 May '04

04 May '04

I am still unable to explain this. After Bazsi's explanation on the correlation between syslog-ng, C, scheme and lsh (it's not cryptic - my scheme is just a little rusty), I was able to walk through the source and see that the pid and kill handler are registered correctly in the resource list for the syslog-ng configuration. This means all children should get a SIGTERM when syslog-ng gets a SIGTERM - just before it exits the main loop. However, I am not observing this behavior. Also, I don't see CONFIG_DESTROY being called on the old configuration when the new configuration is reloaded, but I haven't walked through all that source. I'm still getting familiar with all of this so excuse me if I don't have everything straight. FYI, I'm using the libol 0.3.13 package from sunfreeware.com (SUNWlibol) and a custom complied syslog-ng 1.6.2 under Solaris 7. Any additional insights / explanations would be helpful. Thanks. Tony -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com > -----Original Message----- > From: Nate Campi [mailto:nate@campin.net] > Sent: Wednesday, April 28, 2004 10:06 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]cannot get sec.pl to exit after syslog-ng does > > On Wed, Apr 28, 2004 at 02:58:47PM -0700, Nate Campi wrote: > > > > Ok. I don't know why mine is a child of syslog-ng, and it properly > > terminates when syslog-ng does. We must not be on the same > version or > > something. 1.5.26 here. > > I just fired up sec on a solaris 9 box: > > 9130 /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf > 16508 /bin/sh -c /usr/local/sbin/sec.pl -input="-" > -conf=/usr/local/etc/sec.conf > 16509 /usr/bin/perl -w /usr/local/sbin/sec.pl -input=- > -conf=/usr/local/etc/sec.conf > > It isn't perl either, since starting a program with no arguments or > redirection also gets started by a shell on solaris: > > 9130 /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf > 16508 /bin/sh -c /usr/local/sbin/sec.pl -input="-" > -conf=/usr/local/etc/sec.conf > 16509 /usr/bin/perl -w /usr/local/sbin/sec.pl -input=- > -conf=/usr/local/etc/sec.conf > 16616 /bin/sh -c /usr/local/bin/splogger > 16617 /usr/local/bin/splogger > 16618 /bin/sh -c /usr/local/sbin/sec.pl -input="-" > -conf=/usr/local/etc/sec.conf > 16619 /usr/bin/perl -w /usr/local/sbin/sec.pl -input=- > -conf=/usr/local/etc/sec.conf > > Notice the two SEC's, I hupped syslog-ng when adding this: > > #--------------------------- > destination d_splogger { > program("/usr/local/bin/splogger"); > }; > > # send all logs to splogger > log { > source(src); > filter(f_not_brightmail); > destination(d_splogger); > }; > #--------------------------- > > So it's certainly different behavior on Linux and Solaris in > respect to > starting child processes (syslog-ng 1.5.24 on Solaris). > > Bazsi can you explain what's going on here? iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 1

libol: configure.in patch
by José Pedro Oliveira 04 May '04

04 May '04

Bazsi, Would it be possible to apply this patch against libol configure.in file? This patch allows the libol to be compiled with the same CFLAGS used in Linux distros (at least the RPM based ones). In a specfile the %configure macro automatically assigns CFLAGS with the cflags used to compile the distro. Note: The configure.in in the syslog-ng already does something similar. Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B * diff -ru libol-0.3.13+20040502-original/configure.in libol-0.3.13+20040502-modified/configure.in --- libol-0.3.13+20040502-original/configure.in 2004-01-19 13:20:38.000000000 +0000 +++ libol-0.3.13+20040502-modified/configure.in 2004-05-03 20:21:25.000000000 +0100 @@ -106,7 +106,7 @@ if test $enable_debug = "yes"; then CFLAGS="-Wall -g" else - CFLAGS="-Wall -O2" + CFLAGS="$CFLAGS -Wall" fi MAKE_CLASS="$srcdir/utils/make_class"

2 1

Unsecure remote logs
by George Edwards 03 May '04

03 May '04

I have set up syslog-ng to run locally. But I need to be able to receive logs from remote equipment that does not have the capability of sending the logs secure-such as routers. I have found a lot on how to set syslog-ng to receive remote logs securely but can anyone help me on how to receive unsecured remote logs. Thank you for all you help.

1 0

RE: [syslog-ng]libol license?
by _/CaT _ 02 May '04

02 May '04

1 0

RE: [syslog-ng]libol license?
by atonns＠mail.ivillage.com 01 May '04

01 May '04

Bazsi, Thanks for your reply. It's interesting that you'd use the GPL instead of the LGPL for libol. GPL for libraries will "infect" any code that links to it, forcing it to be GPL as well. Any particular motivation for that? I'm also wondering if there's any documentation (english) for libol - I don't see any on your site. This site (http://www.usinglinux.org/devel/libol.html) is the 3rd link on Google when searching for "libol documentation". I'm trying to hunt down how signals are handled for childen of syslog-ng and it's a blurry line where syslog-ng ends and libol begins (this is related to the other thread about sec.pl). Any info you might have would be helpful. Thanks again, Tony -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: Friday, April 30, 2004 12:21 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]libol license? > > 2004-04-29, cs keltezéssel 20:40-kor atonns(a)mail.ivillage.com > ezt írta: > > No, it is under the GPL, not LGPL. > > I've comitted a COPYING file. The source file headers > reference the GPL > properly. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD > 804E C82C 8EB1 > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 1