January 2007 - syslog-ng - lists.balabit.hu

running as non-root doesn't get kernel log
by carlos＠fisica.ufpr.br 29 Jan '07

29 Jan '07

I'm trying to run syslog-ng 2.0.0 as a user that's not root via the -u option. The problem is that it doesn't get the kernel log. Tracking with strace shows that it doesn't open the kernel destination file. I made sure that events were being generated. Running as root strace shows the kernel destination being opened, and the events are recorded in the file. Any ideas?

4 8

syslog-ng 2.0.2 released
by Balazs Scheidler 29 Jan '07

29 Jan '07

Hi, I have released syslog-ng 2.0.2, which is available at the usual places. (http://www.balabit.com/products/syslog-ng/) The NEWS entry for this release can be found below. One additional bug was fixed which is not included in the NEWS entry, the usertty() destination can crash in some circumstances. (I could squeze in this fix, as I had a build failure in one of our build systems.) 2.0.2 Fri, 26 Jan 2007 08:45:59 +0100 Bugfixes: * Fixed compilation problems in dnscache on non-Linux systems, such as Solaris and BSDs * Fixed an incompatibility between 1.6.x and 2.0.x when parsing user/group information from the configuration file. * Remove trailing \0 and \n characters from a message before processing, removes an unnecessary trailing space from messages. * Fixed handling utmp entries in the usertty() driver, which contain a full path to the tty. Features: * Readded missing tcp-keep-alive() option with a new name consistent with the rest of the socket options (so_keepalive). -- Bazsi

1 0

HAVE_GETUTENT not defined
by bryanh＠giraffe-data.com 29 Jan '07

29 Jan '07

configure.in needs "getutent" added to its AC_CHECK_FUNCS(). Otherwise, HAVE_GETUTENT doesn't get defined in config.h and util.c uses its own implementation of getutent instead of the system's. That's a problem with modern GNU C Library because the utmp database format has changed. (There's a complicated backward compatibility facility that can maintain a shadow database in the old format, but I don't use it). BTW, I recommend not using a standard function name for a local function. E.g. in this case, the local version of getutent is called getutent. That misled me for a while, because I assumed syslog-ng was actually calling standard getutent. It would be better for it to call syslogng_getutent() and have that call the real getutent() if it's available. -- Bryan Henderson San Jose, California

2 1

crash with destination usertty
by bryanh＠giraffe-data.com 29 Jan '07

29 Jan '07

I am experiencing an assertion failure when I log to first a usertty destination, then a file destination. (In the reverse order, things seem to be OK. Logging to two files seems OK). I did some tracing, and while I got rather lost in the reference counting and acking logic, I did find out that a call to log_msg_ack() in afuser_dd_queue() is dropping 2 references to a message when there apparently aren't 2 to drop, resulting in an eventual attempt to unreference the message when its reference count is zero, which the code asserts is impossible. I then noticed that none of the other af*.c files call log_msg_ack() at all, and thought maybe that call doesn't belong there. The message that's triggering the problem is the "syslog-ng starting up" message. The reason log_msg_ack() drops two references is that there are two ack thingies attached to the message: one with a log_center_ack() callback and one with a log_source_msg_ack() callback. I can add more details, such as a config file, if necessary, or do some more tracing. -- Bryan Henderson San Jose, California

2 1

strangeness regarding hostname parsing
by Wolfram Schlich 28 Jan '07

28 Jan '07

[ Repost due to mistakenly included In-Reply-To: header in original mail :-) ] I am using syslog-ng 2.0.1. Running the command... $ logger -t "foo bar" baz ...results in syslog-ng using "foo" as the hostname and "bar: baz" as the message! This is a problem, for example with gconfd, which uses a tag like "gconfd (USERNAME-PID)". So, something seems to be wrong regarding the message parsing and whitespaces -> file src/logmsg.c, function log_msg_parse(). -- Regards, Wolfram Schlich <wschlich(a)gentoo.org> Gentoo Linux * http://dev.gentoo.org/~wschlich/

2 1

udp Error binding socket;
by news gonzo news gonzo 25 Jan '07

25 Jan '07

Hello, I have an error when I try to use a remote source I'm under RedHas AS3 Syslog2rc1. my config is : source s_remote_fw { udp(ip(192.168.7.2) port(514)); }; And the error is : Error binding socket; addr='AF_INET(192.168.7.2:514)', error='Cannot assign requested address (99)' Error initializing source driver; source='s_remote_fw' Thanks for your help ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com

3 2

Re : [syslog-ng] udp Error binding socket;
by news gonzo news gonzo 25 Jan '07

25 Jan '07

192.168.7.2 is remote If I don't need to enter the IP how can I send it to a specfic log ? thx ----- Message d'origine ---- De : Mike <mike(a)jeke.fdns.net> À : Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Envoyé le : Jeudi, 25 Janvier 2007, 17h55mn 09s Objet : Re: [syslog-ng] udp Error binding socket; is 192.168.7.2 an IP address on your syslog-ng machine? or is the IP address of the remote machine? the source {} config option tells syslog-ng which IP address to listen on, you do not need to enter the IP address of the remote host. Mike On Thu, 25 Jan 2007, news gonzo news gonzo wrote: > Hello, I have an error when I try to use a remote source I'm under RedHas AS3 Syslog2rc1. my config is : source s_remote_fw { udp(ip(192.168.7.2) port(514)); }; And the error is : Error binding socket; addr='AF_INET(192.168.7.2:514)', error='Cannot assign requested address (99)' Error initializing source driver; source='s_remote_fw' Thanks for your help ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

Re : [syslog-ng] udp Error binding socket;
by news gonzo news gonzo 25 Jan '07

25 Jan '07

Thx for your explanation very clear and relevant ;) ----- Message d'origine ---- De : Bill Nash <billn(a)billn.net> À : Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Envoyé le : Jeudi, 25 Janvier 2007, 18h19mn 10s Objet : Re: [syslog-ng] udp Error binding socket; I think you've implemented this incorrectly. A 'remote source' is a sender, and your host will be a destination. In relative terms, syslog-ng will need a listening socket to receive the information, so you'll configure a source using an address that actually belongs to the server running syslog-ng. For this to work, you need to declare your source to be your local device. Your server cannot bind 192.168.7.2 because it's the address of the remote machine, and it can't find a local interface with that address. Look for, or create, a source in your syslog-ng config with this setting: udp(ip(0.0.0.0) port(514)); This would create a local listening socket that will receive syslog from *all* remote hosts, such as your firewall. On your firewall, configure the logging options to send to the address of your syslog server. [ Firewall ] ----> udp/514 ----> [Your syslog host] 192.168.7.2 192.168.7.10 (I'm making up the 192.168.7.10 address just to fill in my examples below.) So, on my log collector, I would have a source like this: source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; The '0.0.0.0' address tells syslog-ng to use any network interface on your server, regardless of it's actual IP address. You can replace with the address of your network interface, if you prefer. For hosts sending to the log collector, for example, another syslog-ng device: destination loghost { udp("192.168.7.10" port(514)); }; Or a PIX firewall: logging host dmz1 192.168.7.10 Or a Cisco router: logging 192.168.7.10 Hope that helps, drop me a note if you need more info. - billn On Thu, 25 Jan 2007, news gonzo news gonzo wrote: > Hello, I have an error when I try to use a remote source I'm under RedHas AS3 Syslog2rc1. my config is : source s_remote_fw { udp(ip(192.168.7.2) port(514)); }; And the error is : Error binding socket; addr='AF_INET(192.168.7.2:514)', error='Cannot assign requested address (99)' Error initializing source driver; source='s_remote_fw' Thanks for your help ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

1 0

Is syslog-ng effected by the new Daylight Savings Time for 2007 ?
by KARAM Dean 25 Jan '07

25 Jan '07

Just wondering if syslog-ng needs to be patched before March 11th, or is syslog-ng dependent upon the operating system for its time/datestamp interpretation?

2 1

running a script with syslog-ng
by voorbeeld voorbeeld 25 Jan '07

25 Jan '07

Hello all, i wan't to filter my syslog messages, from a firewall, with a external script. So i was wondering if Syslog-ng has the ability to run a script like php when Syslog-ng receive a syslog message. Or does anyone know how to run a script (which uses the syslog data) when syslog-ng receive a message. greetings, Remco _________________________________________________________________ Windows Live Mail: Kies je eigen kleur, indeling en contacten! http://imagine-windowslive.com/mail/launch/default.aspx?Locale=nl-nl

2 1