October 2005 - syslog-ng - lists.balabit.hu

RE: [syslog-ng] Incompatibility beetween syslogNG 1.6.8(lattest stable)and libol 0.3.8 ?????
by William Bell 14 Oct '05

14 Oct '05

I can save you some trouble, grab one of the latest daily snapshots of the 1.6.8 verison, it configures libol in the process, it has never lead me astray. William -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of CIKALA Frederic ROSI/DOSI Sent: Friday, October 14, 2005 7:39 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Incompatibility beetween syslogNG 1.6.8(lattest stable)and libol 0.3.8 ????? Hello Before trying to install the 0.2.24 version of libol, i want to be sure that stable syslog NG version 1.6.8 is not compatible with the 0.3.8 version of libol. According to https://lists.balabit.hu/pipermail/syslog-ng/2001-December/002794.html, a stable version should be used with a 0.2 verison of libol, where as the stderr advises me to use a 0.3 version :-/ :-\ ... checking libol version >= 0.3.16... no configure: error: Required libol version not found, make sure that your libol version is in the 0.3.x branch [root@XXXX-Linux syslog-ng-1.6.8]# .... Thus, i'm totally confused and need Help thanks for those who will answer, there is no others clue on the web ;( *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. *********************************** _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Newbi with syslogNG & libol : Libol not recognize :(
by CIKALA Frederic ROSI/DOSI 14 Oct '05

14 Oct '05

Hello' I've found the server to install syslog-ng and i downloaded the stable version with the 0.3.8 version of the libol librairie. I found a document on the web which explain HowTo install it ... therefore i tried, but i got some problem during installation. First i've installed the libol libs (0.3.8) with the ./configure, make, make install - and it seems to be all right. Then, i tried the same sequence with syslogNG and i' got an error concerning libol, as following : [root@XXX-Linux syslog-ng-1.6.8]# ./configure checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes ... ... checking libol version >= 0.3.16... no configure: error: Required libol version not found, make sure that your libol version is in the 0.3.x branch [root@XXX-Linux syslog-ng-1.6.8]# Where as libol seems to be great installed : [root@XXX-Linux download]# libol-config --version 0.3.8 I saw a paper about this problem ( https://lists.balabit.hu/pipermail/syslog-ng/2004-April/006023.html ) but the answer is not goood for me cause' it tells that it is a version problem (like 0.3.9 is too old, and older than the 0.3.13 ... i cannot understand this :-/) so i'm quite Lost ... can anyone help please ? *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

1 0

RE: [syslog-ng] v1.6.8: usertty fails for usernames > 7 characters
by Patterson, Jay 14 Oct '05

14 Oct '05

I commented out some expressions on lines 103 and 108 of src/afuser.c src/afuser.c:103 ( /*self->username->length == strlen(ut->ut_user) &&*/ src/afuser.c:108 ( /*self->username->length == strlen(ut->ut_name) &&*/ These expressions appear to be optimizations that avoid doing a subsequent memcpy when the two strings obviously won't match, so I think commenting them out is harmless. From what I can tell, the strlen function will return a length much greater than the actual length for user names that go over 7 (or 31 for ut_user) characters, as there is no null-terminator in that case. I guess it eventually finds a zero somewhere beyond that point in memory. Experimentation with getutent more or less convinced me of that, as 8 character user names were returned with a bit of additional text, the null-string interpretation of ut_id. I had to touch afuser.c to set its modification date back to Jan 31 2003 after editing. Something in the build process breaks if the modification date on the file is too recent. This fixed the problem I was having with 8-character arguments to usertty Jay Patterson OpenView Consultant E-Mail: Jay.Patterson(a)T-Mobile.com Phone: 862-812-3436 -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] Sent: Thursday, October 13, 2005 2:12 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] v1.6.8: usertty fails for usernames > 7 characters syslog-ng-1.6.8 compiled with GCC 3.4.2 on Solaris 2.8 syslog-ng won't write to userttys for login names that are greater than 7 characters Equivalent functionality on syslogd works Never used getutent until today, but ... After using getutent a little, I've come to the conclusion that the utmp fields are not null-terminated. Coincidently, ut_name has a size of 8 ut_user has a size of 32 The code near source file "afuser.c", line 98, seems to treat the ut_name and ut_user fields as if they were null-terminated. Jay Patterson OpenView Consultant E-Mail: Jay.Patterson(a)T-Mobile.com Phone: 862-812-3436

1 0

v1.6.8: usertty fails for usernames > 7 characters
by Patterson, Jay 13 Oct '05

13 Oct '05

syslog-ng-1.6.8 compiled with GCC 3.4.2 on Solaris 2.8 syslog-ng won't write to userttys for login names that are greater than 7 characters Equivalent functionality on syslogd works Never used getutent until today, but ... After using getutent a little, I've come to the conclusion that the utmp fields are not null-terminated. Coincidently, ut_name has a size of 8 ut_user has a size of 32 The code near source file "afuser.c", line 98, seems to treat the ut_name and ut_user fields as if they were null-terminated. Jay Patterson OpenView Consultant E-Mail: Jay.Patterson(a)T-Mobile.com Phone: 862-812-3436

1 0

bugreport for 1.9.5 on solaris
by Nate Campi 13 Oct '05

13 Oct '05

I built 1.9.5 and eventlog-0.2.3+20050116+1856 on Solaris 8. It wouldn't start with command line arguments like "--pidfile=/foo/syslog-ng.pid", I had to change it to "-p /foo/syslog-ng.pid". The usage message it spits out claims that the --long syntax is supported. The other thing is that "bad_hostname()" isn't implemented in 1.9.5, but I'm sure you already knew that. The 2.0 reference guide lists this as a supported option though. Just FYI. -- Nate NT is the only OS that has caused me to beat a piece of hardware to death with my bare hands.

8 16

ULP - Universal Logging Protocol
by Ken Garland 11 Oct '05

11 Oct '05

I'm not terribly familiar with ULP, just recently having heard of it. Though I was wondering if Syslog-NG plans, or currently is, implementing this protocol? Any links or information regarding this would be helpful. Thanks, Ken

1 0

2 questions
by CIKALA Frederic ROSI/DOSI 11 Oct '05

11 Oct '05

Hello everyone 1- I'm just wondering if the encryption support is now available for syslog NG. I've checked google, but did not find information about the encryption of the syslogNG flows. I've just found this paper, but it's out of date i think (it has been written five years ago) https://lists.balabit.hu/pipermail/syslog-ng/2000-December/001100.html I just want to securize the data that are send to the syslogNG central server ... I've got another question : 2- Do you know if there exist a syslogNG version for OS's like VMS or WMS ? thanks :) *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

1 0

phpsyslogng 2.8 trouble
by Robert Cole 10 Oct '05

10 Oct '05

When I try to login to php-syslog-ng I get "Username and password combination does not exist!". I can login as those users I try at a mysql -u prompt. Any ideas? Thanks, Robert

1 0

RE: [syslog-ng] Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin Nipper 10 Oct '05

10 Oct '05

> I've added a simple configure check on tm_gmtoff and if it does not > exist I fall back to the global "timezone" variable. > > It should be available in the yesterday's snapshot. > > -- > Bazsi I downloaded the latest snapshot and gave this a try on my Solaris 8 system. I see the check being made in the configure script, but it still errored off when trying to compile misc.c. It looks like there may also be a reference (in the code) to another non-existent variable (tm_isdst). Anyway, that execution stream follows. Let me know if there's something that I can send you that would help you to figure this out. I'm glad to do so. THANKS for your help! ./configure checking for a BSD-compatible install... ./install-sh -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... no checking for nawk... nawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc option to accept ANSI C... none needed checking for bison... no checking for byacc... no checking for flex... no checking for lex... lex checking for yywrap in -lfl... no checking for yywrap in -ll... yes checking lex output file root... lex.yy checking whether yytext is a pointer... no checking whether make sets $(MAKE)... (cached) yes checking for ranlib... ranlib checking how to enable static linking for certain libraries... GNU or Solaris checking how to run the C preprocessor... gcc -E checking for egrep... egrep checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... no checking for unistd.h... yes checking dmalloc.h usability... no checking dmalloc.h presence... no checking for dmalloc.h... no checking for strings.h... (cached) yes checking openssl/ssl.h usability... no checking openssl/ssl.h presence... no checking for openssl/ssl.h... no checking getopt.h usability... no checking getopt.h presence... no checking for getopt.h... no checking whether struct tm is in sys/time.h or time.h... time.h checking for struct tm.tm_gmtoff... no checking for door_create in -ldoor... yes checking for socket in -lsocket... yes checking for gethostbyname in -lnsl... yes checking for regexec in -lregex... no checking for strdup... yes checking for strtol... yes checking for inet_aton... no checking for inet_ntoa... yes checking for getopt_long... no checking for global timezone variable... yes checking for pkg-config... /usr/local/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB_CFLAGS... -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include checking for GLIB_LIBS... -L/usr/local/lib -lglib-2.0 -liconv checking for EVTLOG_CFLAGS... -I/usr/local/include/eventlog checking for EVTLOG_LIBS... -L/usr/local/lib -levtlog checking for static GLib libraries... yes configure: creating ./config.status config.status: creating dist.conf config.status: creating Makefile config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating doc/docvars.xml config.status: creating contrib/Makefile config.status: creating tests/Makefile config.status: creating tests/unit/Makefile config.status: creating tests/functional/Makefile config.status: creating config.h config.status: executing depfiles commands secdevrsn01 # make make all-recursive Making all in src if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT misc.o -MD -MP -MF ".deps/misc.Tpo" \ -c -o misc.o `test -f 'misc.c' || echo './'`misc.c; \ then mv -f ".deps/misc.Tpo" ".deps/misc.Po"; \ else rm -f ".deps/misc.Tpo"; exit 1; \ fi misc.c: In function `get_local_timezone_ofs': misc.c:86: error: request for member `tm_isdst' in something not a structure or union *** Error code 1 make: Fatal error: Command failed for target `misc.o' Current working directory /var/opt/packages/syslog-ng-1.9.5+20051010/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /var/opt/packages/syslog-ng-1.9.5+20051010 *** Error code 1 make: Fatal error: Command failed for target `all'

1 0

Re: syslog-ng Digest, Vol 6, Issue 10
by Jason Pepas 09 Oct '05

09 Oct '05

On Thu, Oct 06, 2005 at 09:10:41PM +0200, syslog-ng-request(a)lists.balabit.hu wrote: > >+ if (left && *src >= '0' && *src <= '9') { > > Consider isdigit(3) This was done to remain consistent with the existing code. Do you want me to enlarge the scope of the patch to change the existing instances of this as well? > >+ while (left && *src >= '0' && *src <= '9') { > > Consider isdigit(3) or parse up to *src == ']' I avoided parsing up to ']' to avoid the unlikely situation where someone sends us a mal formatted log entry. If for some reason I get a message like "foo[135xyz]", I don't want the xyz part, even though the 135 part is probably garbage anyway. > > self->msg = c_format_cstring("syslog-ng[%i]: %s", getpid(), >length, > data); > > self->program = c_format_cstring("syslog-ng"); > >+ self->pid = c_format_cstring("%i", getpid()); > > This is wrong! You most certainly don't want to add the pid of the > receiving syslog-ng process. seen out of context, that part of the patch is deceptive and misleading at first glance, but I am pretty certain it is correct. This is part of the make_internal_message() function. Notice the existing call to getpid() a few lines up where self->msg is being constructed. > Whitespace/tab damage. oops! I probably have broken .vimrc settings. Also, is macros.gperf an automatically generated file? I wasn't sure if I needed to patch that part. -jason pepas

3 6