June 2005 - syslog-ng - lists.balabit.hu

RE: [syslog-ng] SQL add-on
by Michael Laccetti 09 Jun '05

09 Jun '05

Yeah, I checked that out, but the formatting was off, etc, etc. Rather then fiddle around with it, I just whipped off my own. Didn't mean to step on any toes. -----Original Message----- From: Benjamin Smee [mailto:ben@disciplina.net] Sent: June 9, 2005 15:37 To: syslog-ng(a)lists.balabit.hu Cc: Michael Laccetti [c] Subject: Re: [syslog-ng] SQL add-on heya, On Thursday 09 June 2005 20:33, Michael Laccetti wrote: > I know there are a few scripts out there that feed log information > into a DB, but they don't seem to be very well supported. So, I > created my own quick-and-dirty hack. > http://projects.codeogre.com/sqlsyslogd/ how about : http://www.frasunek.com/sources/security/sqlsyslogd/ There are a few around. A quick google would have pulled them up for you. In fact I have a few patches for that to make it a little more modern / robust if you are interested. -- Benjamin Smee http://blog.smee.id.au F4DF 0F78 708C 8A22 314A 5F5B 86FA FBF6 48FF 5BA1 -- ------------------------ [ SECURITY NOTICE ] ------------------------ To: ben(a)disciplina.net, syslog-ng(a)lists.balabit.hu. For your security, michael(a)s2g-limited.com digitally signed this message on 09 June 2005 at 19:44:15 UTC. Verify this digital signature at http://www.ciphire.com/verify. ------------------- [ CIPHIRE DIGITAL SIGNATURE ] ------------------- Q2lwaGlyZSBTaWcuAVdiZW5AZGlzY2lwbGluYS5uZXQsIHN5c2xvZy1uZ0BsaXN0cy5iY WxhYml0Lmh1AG1pY2hhZWxAczJnLWxpbWl0ZWQuY29tAGVtYWlsIGJvZHkAJgMAAHwAfA AAAAEAAAAPnKhCJgMAADsCAAIAAgACACCF2JwL8FSZ12JHjaqi4keWch0Su1tLYkwGHFe 6dbl/JgEAMU5HZi3bbCGzHuBROgacg8f7vXlTdFsqED3Fgplg8g8xofPb/f6PGsSvVMxp OSkVUQhnLRX4MdxGrYgrAvzDoS5lU2lnRW5k --------------------- [ END DIGITAL SIGNATURE ] ---------------------

1 0

SQL add-on
by Michael Laccetti 09 Jun '05

09 Jun '05

I know there are a few scripts out there that feed log information into a DB, but they don't seem to be very well supported. So, I created my own quick-and-dirty hack. http://projects.codeogre.com/sqlsyslogd/ It works, but it ain't horribly pretty, and it certainly isn't production level stuff. But it could be! If there are any comments, let me know. Mike -- ------------------------ [ SECURITY NOTICE ] ------------------------ To: syslog-ng(a)lists.balabit.hu. For your security, michael(a)s2g-limited.com digitally signed this message on 09 June 2005 at 19:33:48 UTC. Verify this digital signature at http://www.ciphire.com/verify. ------------------- [ CIPHIRE DIGITAL SIGNATURE ] ------------------- Q2lwaGlyZSBTaWcuAVdzeXNsb2ctbmdAbGlzdHMuYmFsYWJpdC5odQBtaWNoYWVsQHMyZ y1saW1pdGVkLmNvbQBlbWFpbCBib2R5ACoBAAB8AHwAAAABAAAAnJmoQioBAADHAgACAA IAAgAghdicC/BUmddiR42qouJHlnIdErtbS2JMBhxXunW5fyYBADFOR2Yt22whsx7gUTo GnIPH+715U3RbKhA9xYKZYPIPSH9j8LFRbh5sHpKtIt3KWUdeuw0WtbhXgNbjcjWfWEsv QonlU2lnRW5k --------------------- [ END DIGITAL SIGNATURE ] ---------------------

2 1

Startup errors
by Hokhold, Mark 09 Jun '05

09 Jun '05

Syslog-ng experts, I would appreciate help from anyone familiar with this problem, thanks. I have the following on my server and client solaris 9 systems: Syslog-ng 1.6.8 Stunnel-4.10 Libol-0.3.16 Openssl-0.9.7g All compiled and installed successfully on both systems. Errors logged during and after startup of /etc/init.d/syslog-ng On the server (within the messages file): [ID xxxxxx daemon.notice] `port number` connected from `client IP address` [ID xxxxxx daemon.error] SSL accept: Peer suddenly disconnected On the client (within the syslog file): Syslog-ng[2782]: syslog-ng version 1.6.8 starting Syslog-ng[2782]: io.c do_write write() failed (errno 32), broken pipe Syslog-ng[2782]: pkt_buffer::do_flush(): Error flushing data Syslog-ng[2782]: Connection broken to AF_INET(127.0.0.1:514), reopening in 60 seconds On the client (within the messages file): Stunnel[2777]: [ID xxxxxx daemon.notice] stunnel 4.10 on sparc-sun-solaris2.9 UCONTEXT+POLL +IPv4 with OpenSSL 0.9.7g 11 Apr 2005 stunnel[2777]: [ID xxxxxx daemon.notice] 125 client allowed stunnel[2777]: `port number` connected from 127.0.0.1:33610 rsh[2824]: [ID xxxxxx daemon.notice] connection from localhost (127.0.0.1) - bad port Regards, Mark

1 0

RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel
by Stew Redfield 09 Jun '05

09 Jun '05

Since it starts cleanly from command line, run lsof against the pid and see if anything else is may be needed (random number generator, pipes or doors) that may be later in the boot stream. Or start a local syslog prior to initiating the tunnel (to capture the stunnel logs) just for error information. HTH, Stew -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stephen Tanner Sent: Thursday, June 09, 2005 11:14 AM To: Syslog-ng users' and developers' mailing list Subject: RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel >From everything that I can find, no it does not. It uses ssl to create a secure tcp connection based on port. Nothing that I have found indicates that it needs anything other than network connectivity and ssl in order to function. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield Sent: Thursday, June 09, 2005 11:05 AM To: Syslog-ng users' and developers' mailing list Subject: RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Does stunnel require a tty to function? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of JF Suret Sent: Thursday, June 09, 2005 11:00 AM To: Syslog-ng users' and developers' mailing list Subject: Re: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Maybe you could use SSH instead ? JF > Message du 09/06/05 16:38 > De : "Stephen Tanner" <stanner(a)leeclerk.org> > A : "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> > Copie à : > Objet : RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > I understand what you guys are saying, but the programs are called using > the fully qualified path to them. Both start and are running, but > syslog-ng seems unable to send logs through the tunnel to the loghost. > I don't know of any environmental variables that would even have > significance to either program. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield > Sent: Thursday, June 09, 2005 10:32 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Just like for cron called scripts, all environmental variables need to > be either within the script itself or sourced by the script. > > cron and init scripts have no knowledge of the environmental settings > that may be tied to your root (or any) shell. > > Also, it is best if you fully qualify program calls (/usr/local/bin/nawk > vs. nawk) within scripts if you don't set your path in environmental > settings. > > Bottom line, for the teams I've managed: if you need it for cron to > work, explicitly state it. > > Stew > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stephen Tanner > Sent: Thursday, June 09, 2005 9:51 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Exactly what do you mean by environment being the same? The startup > script works on this box if executed manually. The only thing that > could possibly change would be what is actually running at the time rc > starts stunnel and syslog-ng. I have place the startup script in rc2 > directly after inetd starts. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Hermann-Josef > Beckers > Sent: Thursday, June 09, 2005 9:47 AM > To: Syslog-ng users' and developers' mailing list > Subject: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > syslog-ng-bounces(a)lists.balabit.hu schrieb am 09.06.2005 15:32:38: > > > I have considered this. The only problem with this would be that I > can > > manually execute the script and everything starts up properly. It > only > > seems to barf when executed from rc on boot. > > > > --Stephen > > Did you check that the environment is exactly the same? > > Yours > hjb > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel
by Stephen Tanner 09 Jun '05

09 Jun '05

>From everything that I can find, no it does not. It uses ssl to create a secure tcp connection based on port. Nothing that I have found indicates that it needs anything other than network connectivity and ssl in order to function. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield Sent: Thursday, June 09, 2005 11:05 AM To: Syslog-ng users' and developers' mailing list Subject: RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Does stunnel require a tty to function? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of JF Suret Sent: Thursday, June 09, 2005 11:00 AM To: Syslog-ng users' and developers' mailing list Subject: Re: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Maybe you could use SSH instead ? JF > Message du 09/06/05 16:38 > De : "Stephen Tanner" <stanner(a)leeclerk.org> > A : "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> > Copie à : > Objet : RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > I understand what you guys are saying, but the programs are called using > the fully qualified path to them. Both start and are running, but > syslog-ng seems unable to send logs through the tunnel to the loghost. > I don't know of any environmental variables that would even have > significance to either program. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield > Sent: Thursday, June 09, 2005 10:32 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Just like for cron called scripts, all environmental variables need to > be either within the script itself or sourced by the script. > > cron and init scripts have no knowledge of the environmental settings > that may be tied to your root (or any) shell. > > Also, it is best if you fully qualify program calls (/usr/local/bin/nawk > vs. nawk) within scripts if you don't set your path in environmental > settings. > > Bottom line, for the teams I've managed: if you need it for cron to > work, explicitly state it. > > Stew > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stephen Tanner > Sent: Thursday, June 09, 2005 9:51 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Exactly what do you mean by environment being the same? The startup > script works on this box if executed manually. The only thing that > could possibly change would be what is actually running at the time rc > starts stunnel and syslog-ng. I have place the startup script in rc2 > directly after inetd starts. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Hermann-Josef > Beckers > Sent: Thursday, June 09, 2005 9:47 AM > To: Syslog-ng users' and developers' mailing list > Subject: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > syslog-ng-bounces(a)lists.balabit.hu schrieb am 09.06.2005 15:32:38: > > > I have considered this. The only problem with this would be that I > can > > manually execute the script and everything starts up properly. It > only > > seems to barf when executed from rc on boot. > > > > --Stephen > > Did you check that the environment is exactly the same? > > Yours > hjb > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel
by Stephen Tanner 09 Jun '05

09 Jun '05

I understand what you guys are saying, but the programs are called using the fully qualified path to them. Both start and are running, but syslog-ng seems unable to send logs through the tunnel to the loghost. I don't know of any environmental variables that would even have significance to either program. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield Sent: Thursday, June 09, 2005 10:32 AM To: Syslog-ng users' and developers' mailing list Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Just like for cron called scripts, all environmental variables need to be either within the script itself or sourced by the script. cron and init scripts have no knowledge of the environmental settings that may be tied to your root (or any) shell. Also, it is best if you fully qualify program calls (/usr/local/bin/nawk vs. nawk) within scripts if you don't set your path in environmental settings. Bottom line, for the teams I've managed: if you need it for cron to work, explicitly state it. Stew -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stephen Tanner Sent: Thursday, June 09, 2005 9:51 AM To: Syslog-ng users' and developers' mailing list Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Exactly what do you mean by environment being the same? The startup script works on this box if executed manually. The only thing that could possibly change would be what is actually running at the time rc starts stunnel and syslog-ng. I have place the startup script in rc2 directly after inetd starts. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Hermann-Josef Beckers Sent: Thursday, June 09, 2005 9:47 AM To: Syslog-ng users' and developers' mailing list Subject: Antwort: RE: [syslog-ng] Syslog-ng with stunnel syslog-ng-bounces(a)lists.balabit.hu schrieb am 09.06.2005 15:32:38: > I have considered this. The only problem with this would be that I can > manually execute the script and everything starts up properly. It only > seems to barf when executed from rc on boot. > > --Stephen Did you check that the environment is exactly the same? Yours hjb _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] Many errors when running make install
by Ryan McCain 09 Jun '05

09 Jun '05

Sorry for wasting your time with that question. I thought I had libol installed. I must of had a brain freeze. Thanks, Ryan >>>bazsi(a)balabit.hu 06/07/05 8:14 am >>> On Mon, 2005-06-06 at 10:54 -0500, Ryan McCain wrote: >This is on SLES 9. bison, flex and m4 are all installed. make and configure went smoothly. >Can someone interpret what this is telling me? The server has a minimal amount of packages >installed so this might be related to a missing package, but I didn't see any that I'm missing >that are called for in the INSTALL file.. Thanks!! the libol headers are missing, can you paste your exact configure command line (and libol and where it has been installed) -- Bazsi syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel
by Stew Redfield 09 Jun '05

09 Jun '05

Does stunnel require a tty to function? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of JF Suret Sent: Thursday, June 09, 2005 11:00 AM To: Syslog-ng users' and developers' mailing list Subject: Re: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Maybe you could use SSH instead ? JF > Message du 09/06/05 16:38 > De : "Stephen Tanner" <stanner(a)leeclerk.org> > A : "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> > Copie à : > Objet : RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > I understand what you guys are saying, but the programs are called using > the fully qualified path to them. Both start and are running, but > syslog-ng seems unable to send logs through the tunnel to the loghost. > I don't know of any environmental variables that would even have > significance to either program. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield > Sent: Thursday, June 09, 2005 10:32 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Just like for cron called scripts, all environmental variables need to > be either within the script itself or sourced by the script. > > cron and init scripts have no knowledge of the environmental settings > that may be tied to your root (or any) shell. > > Also, it is best if you fully qualify program calls (/usr/local/bin/nawk > vs. nawk) within scripts if you don't set your path in environmental > settings. > > Bottom line, for the teams I've managed: if you need it for cron to > work, explicitly state it. > > Stew > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stephen Tanner > Sent: Thursday, June 09, 2005 9:51 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Exactly what do you mean by environment being the same? The startup > script works on this box if executed manually. The only thing that > could possibly change would be what is actually running at the time rc > starts stunnel and syslog-ng. I have place the startup script in rc2 > directly after inetd starts. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Hermann-Josef > Beckers > Sent: Thursday, June 09, 2005 9:47 AM > To: Syslog-ng users' and developers' mailing list > Subject: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > syslog-ng-bounces(a)lists.balabit.hu schrieb am 09.06.2005 15:32:38: > > > I have considered this. The only problem with this would be that I > can > > manually execute the script and everything starts up properly. It > only > > seems to barf when executed from rc on boot. > > > > --Stephen > > Did you check that the environment is exactly the same? > > Yours > hjb > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel
by JF Suret 09 Jun '05

09 Jun '05

Maybe you could use SSH instead ? JF > Message du 09/06/05 16:38 > De : "Stephen Tanner" <stanner(a)leeclerk.org> > A : "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> > Copie à : > Objet : RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > I understand what you guys are saying, but the programs are called using > the fully qualified path to them. Both start and are running, but > syslog-ng seems unable to send logs through the tunnel to the loghost. > I don't know of any environmental variables that would even have > significance to either program. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield > Sent: Thursday, June 09, 2005 10:32 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Just like for cron called scripts, all environmental variables need to > be either within the script itself or sourced by the script. > > cron and init scripts have no knowledge of the environmental settings > that may be tied to your root (or any) shell. > > Also, it is best if you fully qualify program calls (/usr/local/bin/nawk > vs. nawk) within scripts if you don't set your path in environmental > settings. > > Bottom line, for the teams I've managed: if you need it for cron to > work, explicitly state it. > > Stew > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stephen Tanner > Sent: Thursday, June 09, 2005 9:51 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Exactly what do you mean by environment being the same? The startup > script works on this box if executed manually. The only thing that > could possibly change would be what is actually running at the time rc > starts stunnel and syslog-ng. I have place the startup script in rc2 > directly after inetd starts. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Hermann-Josef > Beckers > Sent: Thursday, June 09, 2005 9:47 AM > To: Syslog-ng users' and developers' mailing list > Subject: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > syslog-ng-bounces(a)lists.balabit.hu schrieb am 09.06.2005 15:32:38: > > > I have considered this. The only problem with this would be that I > can > > manually execute the script and everything starts up properly. It > only > > seems to barf when executed from rc on boot. > > > > --Stephen > > Did you check that the environment is exactly the same? > > Yours > hjb > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > >

1 0

duplicate lines
by Peter Straka 09 Jun '05

09 Jun '05

Hello, I would ask you if it is posible to write filter which remove every duplicate lines from one source usage as: log ( source; filter(duplicate); destination) parameters: number of lines which can be betwen the same line (this is becouse some messages are repeated in a block of lines) time period which will defined when the counter must be reset (before that counter will be send) and next line will be again the first one counter - to count number of droped lines and show this value every time period - like solaris syslog do duplicate line means : 1 line: aaaaa bbbbbb 2 line: cccccc 3 line: aaaaa bbbbbb 4 line: cccccc ... line: aaaaa bbbbbb ... line: cccccc 9 line: ddddd lines 1,2,9 will pass to destination lines 3-8 will be removed (droped) in the past it was a filter - DEFAULT which did this job in a "some" way and I thing now it is nothing which can be usable any idea? with regards Peter STRAKA

2 1