August 2004 - syslog-ng - lists.balabit.hu

Michael J. Bock/NetServ/DST/US is out of the office.
by MJBock＠dstsystems.com 23 Aug '04

23 Aug '04

I will be out of the office starting 08/20/2004 and will not return until 08/30/2004. I will respond to your message when I return.

1 0

dhcp3-server logging problem
by natxete＠xs4all.nl 23 Aug '04

23 Aug '04

Hallo everybody, This is my first message to this list. I have a problem with the way syslog-ng 1.5.15 (stock debian woody) is logging the dhcp3-server messages. I have searched in the mailing-list archives and through google but could not find the answer to my problem. Which is: In the conf file for dhcp3-server, one can specify the facility where the log messages should go. The specific lines are: # Use this to send dhcp log messages to a different log file (you also # have to hack syslog.conf to complete the redirection). log-facility local7; So I created some new entries in /etc/syslog-nl/syslog-ng.conf, which are: # dest file where i want the dhcpd stuff: destination dhcpd { file("/var/log/dhcpd.log" owner("root") group("adm") perm(0640)); }; # this is all in one line, obviously. filter f_local7 { facility(local7); }; log { source(src); filter(f_local7); destination(dhcpd); }; So I restarted both services in order to reload their config files, and yes, now I get all the dhcp logging in /var/log/dhcpd.log, *but* I also get it in /var/log/syslog, which is driving me nuts, because I also have logcheck installed and every hour I get all the dhcpd messages in the logcheck emails. Is there a way I have overlooked to prevent this? TIA, N.Asenjo

2 1

RE: [syslog-ng]check_hostname(yes) - parse error
by Smith, Krista 16 Aug '04

16 Aug '04

Yes, I finally figured that out. :) As other options are added though, it might be handy to know which ones are available with which versions, maybe on the online manual options page? I didn't download syslog-ng very long ago and at the time it was the most recent one listed on the download page. So I didn't realize so many others had come out in the meantime and thought that if it was listed on the options page with all the rest, it must be a standard one available to me. I stand corrected. :) Thanks, Krista -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, August 16, 2004 11:54 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]check_hostname(yes) - parse error On Wed, 2004-08-11 at 23:36, Smith, Krista wrote: > Hello, > > I've got syslog-ng (1.4.17) working on a Solaris 9 central logserver, > except for one small thing. I'm trying to use the option > "check_hostname(yes)" but I get a parse error when I add it to my > options. My options line looks like this: > > options { create_dirs(yes); keep_hostname(yes); check_hostname(yes); > }; > > If I remove that portion of the line, it gives no error. I've checked > for invisible characters, searched Google and the syslog-ng archives, > but cannot find anything suggesting what the problem might be. If > anyone can point me in the right direction I'd be grateful. try it with syslog-ng 1.6.4, you'll be surprised :) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]chroot/syslog-ng/Solaris8
by Roy G Davis 16 Aug '04

16 Aug '04

yes, thank you i have syslog-ng accepting normal things using streams/doors. but it is not picking up anything generated from whithin the chroot jail. i actually get the same behavior w sun's syslog too. that is: i have sftp-logging patch applied to openssh code. it works for a non-chroot user - you see them login, change directory, upload/download file, log out etc. but all i see is initial login for a chroot user. THX -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Monday, August 16, 2004 12:58 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]chroot/syslog-ng/Solaris8 On Sat, 2004-08-14 at 20:00, Roy G Davis wrote: > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu on behalf of Nate Campi > Sent: Fri 8/13/2004 7:30 PM > To: syslog-ng(a)lists.balabit.hu > Cc: > Subject: Re: [syslog-ng]chroot/syslog-ng/Solaris8 > On Fri, Aug 13, 2004 at 01:26:54PM -0500, Roy G Davis wrote: > > does anyone have experience using syslog-ng with chroot-ed > applications > > on Solaris 8? > > specifically, i am running ssh/sftp chroot-ed (with sftp logging > patch) > > and i get no logging. > > i know it is something about /dev/log etc in the chroot environment > but > > cant find exact info. > > Try this, you might not have found it since it might seem postfix > specific, but it applies to anything chrooted: > > http://www.campin.net/syslog-ng/faq.html#postfix maybe the link is linux specific, you need to use sun-streams combined with the door option on Solaris. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]chroot/syslog-ng/Solaris8
by Roy G Davis 16 Aug '04

16 Aug '04

yes, thanks, i have seen that link. i tried that, but may not have done it exactly right. there is still something i am missing here. thx again -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu on behalf of Nate Campi Sent: Fri 8/13/2004 7:30 PM To: syslog-ng(a)lists.balabit.hu Cc: Subject: Re: [syslog-ng]chroot/syslog-ng/Solaris8 On Fri, Aug 13, 2004 at 01:26:54PM -0500, Roy G Davis wrote: > does anyone have experience using syslog-ng with chroot-ed applications > on Solaris 8? > specifically, i am running ssh/sftp chroot-ed (with sftp logging patch) > and i get no logging. > i know it is something about /dev/log etc in the chroot environment but > cant find exact info. Try this, you might not have found it since it might seem postfix specific, but it applies to anything chrooted: http://www.campin.net/syslog-ng/faq.html#postfix -- Nate To sysadmin or not to sysadmin... that is the question, whether tis nobler in the minde to suffer the slings and arrowes of outragious fortune, or climb to the top of the building with a high-power rifle and scope. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

two syslog-ngs?
by markzero＠logik.ath.cx 16 Aug '04

16 Aug '04

Hmm, having got stunnel mostly working, I'm left with a little more confusion. I'm about to attempt to build the loghost, the only problem is that I'll need to chroot syslog-ng. /chroot/syslogng Surely, this is going to cause problems as the chrooted syslog will need to do the logging for the local machine as well, and as such will need access to /dev/log. It can't be as simple as: ln -s /dev/log /chroot/syslogng/dev/log ...can it? Other than this, the only solution I can think of is to run two copies of syslogng, one chrooted for accepting network connections and one un-chrooted (that is an annoyingly awkward word in conversation) for doing local logging for the machine itself. Anyone come up with a better way?

2 1

check_hostname(yes) - parse error
by Smith, Krista 16 Aug '04

16 Aug '04

Hello, I've got syslog-ng (1.4.17) working on a Solaris 9 central logserver, except for one small thing. I'm trying to use the option "check_hostname(yes)" but I get a parse error when I add it to my options. My options line looks like this: options { create_dirs(yes); keep_hostname(yes); check_hostname(yes); }; If I remove that portion of the line, it gives no error. I've checked for invisible characters, searched Google and the syslog-ng archives, but cannot find anything suggesting what the problem might be. If anyone can point me in the right direction I'd be grateful. Thanks, Krista -- Krista Smith Unix Analyst EnCana Corporation desk: (403) 645-3121 cell: (403) 830-2334 krista.smith(a)encana.com www.encana.com <www.encana.com>

2 1

RE: [syslog-ng](no subject)
by Andrews, Glenn J (Glenn) 16 Aug '04

16 Aug '04

Great. Now virus via syslog ;-) "Antigen for Exchange removed new__price.zip->price.exe since it was found to be infected with VIRUS= Win32/Unknown.Trojan (CA(InoculateIT)) virus." -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Bazsi Sent: Monday, August 09, 2004 3:04 PM To: Syslog-ng Subject: [syslog-ng](no subject) price

2 1

Reply-To: syslog-ng@lists.balabit.hu
by G. C. 16 Aug '04

16 Aug '04

I modified the file afinet.c inserting the line as suggested and gave the following commands: ./configure --enable-spoof-source --> ok make --> ERROR The error is the following: make_class <afinet.c >afinet.c.xT /bin/sh: /usr/local/bin/make_class: \: bad interpreter: No such file or directory make[3]: *** [afinet.c.x] Error 126 make[3]: Leaving directory `/usr/src/syslog-ng-1.6.4/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/syslog-ng-1.6.4/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/src/syslog-ng-1.6.4/src' make: *** [all-recursive] Error 1 Sorry but not being a developer I might have mistaken something... P. _____________________________________________________ > >Hmm.. I possible forgot to free something in that path. I'll check it out >for you. Can you check if this one works for you? Index: src/afinet.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/afinet.c,v retrieving revision 1.25.4.6 diff -u -r1.25.4.6 afinet.c --- src/afinet.c 5 Aug 2004 11:35:12 -0000 1.25.4.6 +++ src/afinet.c 6 Aug 2004 18:15:32 -0000 @@ -653,6 +653,7 @@ if (libnet_write(self->lnet_ctx) < 0) { werror("Error sending raw frame, error: %z", libnet_geterror(self->lnet_ctx)); } + ol_string_free(msg_line); } else { fallback_socket: _________________________________________________________________ Protect your PC - get McAfee.com VirusScan Online http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

2 1

syslog-ng : concurrent readling & writing tasks ?
by Loic SPINDLER 16 Aug '04

16 Aug '04

Hello, I noticed that both reading input process and writing to output are not running concurrent in the syslog-ng. Is it planned for a future release ?

2 1