November 2007 - syslog-ng - lists.balabit.hu

[PATCH] anonymizing filter
by Micah Anderson 06 Nov '08

06 Nov '08

Hello, A couple years ago this patch was submitted to the list for consideration for inclusion into syslog-ng. I am writing this email again to request that it be considered again. The patch provides a simple replace which enables you to strip out IP addresses from your logs before they are written to disk. The patch has been included in the Debian stable distribution, and currently is included in both Debian Sid and Lenny (unstable and testing). It has had a very wide testing base and is non-intrusive, it has existed since 2004 and has been adapted to work with the newer syslog-ng. The goal of this patch is to give an organization the means to implement site logging policies, by allowing for easy control over exactly what data is retained in the logfiles. When I first requested consideration for inclusion the reactions were some suggestions for improvement (which were done), some side discussions about the various states of data retention laws, and a general agreement that this patch is non-intrusive and had a valid use case (at least in the U.S., but also likely in other countries as well[0]). The side-discussions about data-retention laws were mostly around specific geographic localities that were considering laws that would make stripping of addresses illegal, or had already mandated such things. Although these were interesting discussions, as EU data retention laws would prohibit many people from making such configuration changes to their syslog-ng.conf, they were tangential to the point because this patch does not cause those to break such laws. On the other side of the pond, in the U.S., the EFF[1] has made it very clear that this mechanism of anonymizing logs is perfectly (a) legal in the U.S., and (b) advisable. There are many instances where it is preferable to keep less information on users than is collected by default on many systems. In the United States it is not currently required to retain data on users of a server, but you may be required to provide all data on a user which you have retained. OSPs can protect themselves from legal hassles and added work by choosing what data they wish to retain. The current climate in the U.S. makes this problem so much more important now than it was many years ago. Having the ability to implement a site-policy that enables an organization to decide if the trade-off between privacy and analysis is worthwhile. This patch allows organizations to have that choice if they feel that it is more important to avoid retaining sensitive data rather than having a full history of everything logged. Please accept this patch[2], Micah [0] EPIC International Data Retention Page http://www.epic.org/privacy/intl/data_retention.html [1] The EFF is the major civil liberties internet watchdog in the US, their "Best Practices for Online Service Providers" can be found here: http://www.eff.org/osp, they explicitly link to our patch as a recommendation [2] The latest patch can be found at https://code.autistici.org/trac/privacy/browser/trunk/syslog-ng

6 11

What packages need?
by hi ro 13 Apr '08

13 Apr '08

Hi, What packages does it need to compile syslog-ng? Is it the same package when to make RPM? (bison, flex, gcc-c++, pkgconfig, glib2-devel, libevtlog-devel) (It needs only libc to compile eventlog, doesn't it?) And if it's not necessary to connect database, does it need to install libdbi8? Thanks hiro _________________________________________________________________ 【MSNビデオ】超貴重！驚きの大物対談が実現。作家村上龍が話題のあの人に迫る http://video.msn.co.jp/rvr/default.htm

4 14

AIX startup
by Brian Loe 27 Mar '08

27 Mar '08

Okay, my syslog-ng instance died at some point last night and because I don't have it setup properly for respawning... Can anyone running syslog-ng on AIX 5.* give me some tips for this? I'm feeding pipes so i have to start instances of SEC as soon as I start syslog-ng - but the SEC scripts appear to "close" so if they're configured to respawn I'll have 2000 instances of them in an hour.

7 21

incorrect firewall logs with syslogng-2.0.0 [security error?]
by Jacek Kalinski 12 Mar '08

12 Mar '08

Hello, After upgradeing from syslogng-1.6.11 to 2.0.0 I've got a strange messages in /var/log/messages file: Nov 29 08:14:05 denise WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 11:10:19 denise PT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 16:42:16 denise W=0 RES=0x00 RST URGP=0 Nov 29 21:37:15 denise 116 ID=34901 DF PROTO=TCP SPT=3584 DPT=80 WINDOW=65535 RES=0x00 ACK FIN URGP=0 These are truncated iptables logs. Because in firewall.log file are simmilar entries to truncated one, I think full file should be: Nov 29 11:10:19 denise firewallp=INVALID:1 a=DROP IN=eth1 OUT= MAC=00:30:4f:36:2b:dc:00:04:9a:2c:7f:20:08:00 SRC=193.41.230.81 DST=xxx.xxx.xxx.x LEN=576 TOS=0x00 PREC=0x00 TTL=117 ID=3495 PROTO=TCP SPT=443 DPT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 (xxx.xxx.xxx.x is a real server IP address - one 'x' is one digit) Config file with interesting lines: options { dir_perm(0700); perm(0600); chain_hostnames(no); stats(1200); keep_hostname(yes); dir_owner(root); dir_group(root); owner(root); group(root); }; source local { unix-stream("/dev/log" max_connections(300)); file("/proc/kmsg"); # udp(ip(0.0.0.0) port(514)); internal(); }; # ..... # authpriv.none;cron.none;mail.none;news.none -/var/log/messages filter f_2 { not facility(news); }; filter f_3 { not facility(local5); }; filter f_4 { not facility(local6); }; filter f_5 { not facility(authpriv); }; filter f_6 { not facility(cron); }; filter f_7 { not facility(mail); }; filter f_notlocal7 { not facility(local7); }; filter f_notfirewall { not match("firewallp="); }; destination d_2 { file("/var/log/messages" create_dirs(yes)); }; log { source(local); filter(f_2); filter(f_4); filter(f_5); filter(f_6); filter(f_7); filter(f_notimapd); filter(f_notpopa3d); filter(f_notnamed); filter(f_notfirewall); destination(d_2); }; #..... # firewallp.* -/var/log/firewall.log filter f_16 { level(warning) and match("firewallp="); }; destination d_12 { file("/var/log/firewall.log" create_dirs(yes)); }; log { source(local); filter(f_16); destination(d_12); }; #..... Do you know where could be an error? It is a production server so I can't debug syslog-ng on this machine (sorry). NOTE: the only truncated lines I can find are iptables (AFAIR they are logged by /proc/kmesg) entries. All other lines are complete. And it is probably a critical error in security. PS: simple statistics line from syslog-ng: Nov 30 00:00:06 denise syslog-ng[32682]: Log statistics; dropped='pipe(/dev/tty12)=0', processed='center(queued)=758289', processed='center(received)=369020', processed='destination(d_maillogimapd)=4245', processed='destination(d_5)=1', processed='destination(d_4)=0', processed='destination(d_3)=14259', processed='destination(d_2)=14259', processed='destination(d_13)=0', processed='destination(d_1)=6000', processed='destination(d_12)=6000', processed='destination(d_11)=369020', processed='destination(d_10)=36', processed='destination(d_8)=0', processed='destination(d_maillogpopa3d)=103224', processed='destination(d_7)=241245', processed='destination(d_6)=0', processed='source(local)=369020' I think you see that it could be a little hard to debug (with so many messages parsed by syslog-ng) ;) Jacek

3 6

Can TAG field be terminated by space?
by Tsurusawa Takeshi 31 Dec '07

31 Dec '07

Hi, I'm using syslog-ng-2.0.5 and trying to store syslog messages into a DB table with a TAG field column. But when TAG fileld is terminated with space character(' ') in syslog message, syslog-ng parser returns as TAG field not only TAG field but also some extra strings end with a colon(':') in CONTENT field. For example, if MSG part is "program abc: message...", syslog-ng returns "program abc" as a TAG field. According to the section 4.1.3 of RFC3164, a space character can also terminate a TAG field. The TAG is a string of ABNF alphanumeric characters that MUST NOT exceed 32 characters. Any non-alphanumeric character will terminate the TAG field and will be assumed to be the starting character of the CONTENT field. Most commonly, the first character of the CONTENT field that signifies the conclusion of the TAG field has been seen to be the left square bracket character ("["), a colon character (":"), or a space character. Is it possible to change this behavior of syslog-ng? Thanks in advance. -- Tsurusawa Takeshi <tsuru(a)grid.nii.ac.jp>

3 6

[Bug 1] New: syslog-ng crashes when /etc/eventlog.conf exists
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=1 Summary: syslog-ng crashes when /etc/eventlog.conf exists Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bazsi(a)balabit.hu Estimated Hours: 0.0 Hi ! When /etc/eventlog.conf exists and contains "[hello]" (for example), syslog-ng segfaults at start. Here is the end of strace output: uname({sys="Linux", node="naruto", ...}) = 0 brk(0) = 0x8088000 brk(0x80a9000) = 0x80a9000 open("/etc/localtime", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f7c000 read(3, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\0\0\0\f\0"..., 4096) = 1082 close(3) = 0 munmap(0xb7f7c000, 4096) = 0 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0 rt_sigaction(SIGHUP, {0x804aae0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGTERM, {0x804aaf0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGINT, {0x804aaf0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGCHLD, {0x804ab00, [], 0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {0x804ab10, [], SA_ONESHOT}, NULL, 8) = 0 gettimeofday({1192688001, 803861}, NULL) = 0 open("/etc/eventlog.conf", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=8, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f7c000 read(3, "[hello]\n", 4096) = 8 --- SIGSEGV (Segmentation fault) @ 0 (0) --- kill(12421, SIGSEGV) = 0 sigreturn() = ? (mask now []) --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 12421 detached I did not find any documentation about /etc/eventlog.conf file. I have found this bug because such file was created by an unrelated application. -- System Information: Debian Release: lenny/sid APT prefers unstable APT policy: (500, 'unstable'), (500, 'stable'), (1, 'experimental') Architecture: i386 (i686) Kernel: Linux 2.6.22-2-686-bigmem (SMP w/2 CPU cores) Locale: LANG=fr_FR@euro, LC_CTYPE=fr_FR@euro (charmap=ISO-8859-15) Shell: /bin/sh linked to /bin/bash Versions of packages syslog-ng depends on: ii libc6 2.6.1-5 GNU C Library: Shared libraries Versions of packages syslog-ng recommends: ii logrotate 3.7.1-3 Log rotation utility -- no debconf information -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

missing logs when SIGHUP
by Martin Ervius 05 Dec '07

05 Dec '07

Hi, It seems that sometimes when syslog-ng receives a SIGHUP (like for example after logrotating or config change) it loses track of the logs that has been received, but are not yet written to disk. Except for this problem, syslog-ng can receive ~35000 logs/sec on the same machine without any loss at all. I have been able to reproduce the situation in a test environment on both FreeBSD 6.1 (Opteron) with syslog-ng 2.0.3 and on Ubuntu Linux 7.10 (i386) with syslog-ng 2.0.5. On linux, it appears that the number of logs lost equals the size of the log_fetch_limit parameter, because the number of lost logs are in multiples of this value. To see what happens I used strace to follow syslog-ng and dump read and write calls while sending numbered logs at a rate of 1000/sec. Only one machine was sending logs and they were transferred from a different machine over tcp. During this time I sent a SIGHUP to the receiving syslog with two seconds apart (since it doesn't occur with every SIGHUP). log_fetch_limit is set to 100, log_fifo_size to 51200 and log_msg_size is 2048. Flow-control is not activated since it didn't appear to make any difference in this particular case. This is the output of 'strace -s 65536 -e write,read' with the irrelevant parts omitted (I captured a similar output on FreeBSD with ktrace, but is not included in this mail) ## read from tcp socket (only beginning and end to save space) read(5, "<135>Nov 27 18:36:34 tiger logger: hejsan 9388\n<135>Nov 27 18:36:34 tiger logger: hejsan 9389\n<135>Nov 27 18:36:34 tiger logger: hejsan 9390\n<135>Nov 27 18:36:34 tiger logger: hejsan 9391\n<135>Nov 27 18:36:34 tiger logger: hejsan 9392\n<135>Nov 27 18:36:34 tiger logger: hejsan 9393\n<135>Nov 27 18:36:34 tiger logger: hejsan 9394\n<135>Nov 27 18:36:34 tiger logger: hejsan 9395\n<135>Nov 27 18:36:34 tiger logger: hejsan 9396\n<135>Nov 27 18:36:34 tiger logger: hejsan 9397\n<135>Nov 27 18:36:34 tiger logger: hejsan 9398\n<135>Nov 27 18:36:34 tiger logger: hejsan 9399\n<135>Nov 27 18:36:34 tiger logger: hejsan 9400\n<135>Nov 27 18:36:34 tiger logger: hejsan 9401\n<135>Nov 27 18:36:34 tiger logger: hejsan 9402\n<135>Nov 27 18:36:34 tiger logger: hejsan 9403\n<135>Nov 27 18:36:34 tiger logger: hejsan 9404\n<135>Nov 27 18:36:34 tiger logger: hejsan 9405\n<135>Nov 27 18:36:34 tiger logger: hejsan 9406\n<135>Nov 27 18:36:34 tiger logger: hejsan 9407\n<135>Nov 27 18:36:34 tiger logger: hejsan 9408\n<135>Nov 27 18:36:34 tiger logger: hejsan 9409\n<135>Nov 27 18:36:34 tiger logger: hejsan 9410\n . . . <135>Nov 27 18:36:34 tiger logger: hejsan 9504\n<135>Nov 27 18:36:34 tiger logger: hejsan 9505\n<135>Nov 27 18:36:3 4 tiger logger: hejsan 9506\n<135>Nov 27 18:36:34 tiger logger: hejsan 9507\n<135>Nov 27 18:36:34 tiger logger: hej ", 8192) = 5678 ## then follows all the writes until a SIGHUP is received ... write(6, "Nov 27 18:36:34 tiger logger: hejsan 9401\n", 42) = 42 write(6, "Nov 27 18:36:34 tiger logger: hejsan 9402\n", 42) = 42 write(6, "Nov 27 18:36:34 tiger logger: hejsan 9403\n", 42) = 42 write(6, "Nov 27 18:36:34 tiger logger: hejsan 9404\n", 42) = 42 write(6, "Nov 27 18:36:34 tiger logger: hejsan 9405\n", 42) = 42 write(6, "Nov 27 18:36:34 tiger logger: hejsan 9406\n", 42) = 42 write(6, "Nov 27 18:36:34 tiger logger: hejsan 9407\n", 42) = 42 write(6, "Nov 27 18:36:34 tiger logger: hejsan 9408\n", 42) = 42 --- SIGHUP (Hangup) @ 0 (0) --- ## After the config file is re-read, syslog-ng continues to read new logs from the socket, with unwritten logs from 9409 to 9507 in the buffer (9508 is partly read before the SIGHUP) read(5, "san 9508\n<135>Nov 27 18:36:34 tiger logger: hejsan 9509\n<135>Nov 27 18:36:34 tiger logger: hejsan 9510\n<135>Nov 27 18:36:34 tiger logger: hejsan 9511\n<135>Nov 27 18:36:34 tiger logger: hejsan 9512\n<135>Nov 27 18:36:34 tiger logger: hejsan 9513\n<135>Nov 27 18:36:34 tiger logger: hejsan 9514\n<135>Nov 27 18:36:34 tiger logger: hejsan 9515\n.... ## And finally new writes are done, but starting at 9508. The logs ranging from 9409 to 9507 are now lost and are consequently missing in the destination file. write(4, "Nov 27 18:36:34 tiger logger: hejsan 9508\n", 42) = 42 write(4, "Nov 27 18:36:34 tiger logger: hejsan 9509\n", 42) = 42 write(4, "Nov 27 18:36:34 tiger logger: hejsan 9510\n", 42) = 42 write(4, "Nov 27 18:36:34 tiger logger: hejsan 9511\n", 42) = 42 ----------------------------------------------------------------------------------------- I have experimented with different parameter settings, but am still losing logs at SIGHUP. I hope this information is enough if someone is able to diagnose the issue. If not, I can send my particular config etc on request. Any input on this is appreciated, has anyone else noticed this behaviour or is it maybe a configuration issue with this setup? // Martin

2 7

destination socket solaris 10 binding failure
by chris cobucci 03 Dec '07

03 Dec '07

Dear users: my first post, so please let me know if I commit some fo-paw. can you let me know if I am mis-configuring something here -- it's my first attempt at using destination sockets: system: sun solaris 10 (sparc) software: syslog-ng.2.0.5 syslog-ng.2.0.6 (no extra-ordinary compile options) /usr/local/etc/syslog-ng.conf (pertinent lines only) destination poe { unix-dgram("/tmp/poeunixsocket"); }; log { source(s_sys); destination(poe); }; socket file is srwxr-xr-w root root 0 poeunixsocket I figured with no listener, ng would just buffer. starting ng (as root) I get: Error binding socket; addr='AF_UNIX(anonymous)', error='Is a directory (21)' Initiating connection failed, reconnecting; time_reopen='10' I've tried unix-stream as well to no avail. Any assistance would be greatly appreciated. Thanks, Chris _________________________________________________________________ Your smile counts. The more smiles you share, the more we donate. Join in. www.windowslive.com/smile?ocid=TXT_TAGLM_Wave2_oprsmilewlhmtagline

2 4

File source and flow-control question
by Behal, Pavel 01 Dec '07

01 Dec '07

Dear List Members, I have found syslog-ng really valuable part of operating system, thanks to all. I would like to ask a flow-control related question: I have tried to use it (2.0.5) also as a collector of events from some log text-files using the file source with follow-freq set. It is working fine. But I have realized, that in case of network problem, the syslog-ng process never stops reading the data. (Yes, this is normal.) It continuously follows the incremented data and everything above volume the of internal line buffer get lost. I hoped, this can be changed using the flow-control flag, but I think the flow-control flag does not affect the file source and it never blocks reading. Is there any way, how to setup the syslog-ng to stop reading the followed source file when destination is unavailable and continue from last event send after reconnect? Thank you. Best Regards, Pavel

2 1

Re: [syslog-ng] Redirect syslog-ng to ttyS0
by kjell.danielsen＠hjemme.no 29 Nov '07

29 Nov '07

Hei. I have included the strace log ( when I log in n ttyS0). Can anyone help me analyzing it. Kjell execve("/sbin/syslog-ng", ["syslog-ng"], [/* 69 vars */]) = 0 brk(0) = 0x80021000 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f79000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=82152, ...}) = 0 mmap2(NULL, 82152, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7f64000 close(3) = 0 open("/lib/libnsl.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0`5\0\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=87850, ...}) = 0 mmap2(NULL, 83712, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f4f000 madvise(0xb7f4f000, 83712, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f60000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x10) = 0xb7f60000 mmap2(0xb7f62000, 5888, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f62000 close(3) = 0 open("/lib/libresolv.so.2", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0P&\0\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=74278, ...}) = 0 mmap2(NULL, 76052, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f3c000 madvise(0xb7f3c000, 76052, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f4b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xe) = 0xb7f4b000 mmap2(0xb7f4d000, 6420, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f4d000 close(3) = 0 open("/lib/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300Y\1"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1408371, ...}) = 0 mmap2(NULL, 1181084, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7e1b000 madvise(0xb7e1b000, 1181084, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f35000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x119) = 0xb7f35000 mmap2(0xb7f39000, 9628, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f39000 close(3) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7e1a000 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7e1a8c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 mprotect(0xb7f35000, 8192, PROT_READ) = 0 munmap(0xb7f64000, 82152) = 0 brk(0) = 0x80021000 brk(0x80042000) = 0x80042000 open("/etc/localtime", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f78000 read(3, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0"..., 4096) = 56 close(3) = 0 munmap(0xb7f78000, 4096) = 0 open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) = 3 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfec3f78) = -1 ENOTTY (Inappropriate ioctl for device) fstat64(3, {st_mode=S_IFREG|0644, st_size=5785, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f78000 read(3, "#\n# /etc/syslog-ng/syslog-ng.con"..., 8192) = 5785 read(3, "", 4096) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 4 fcntl64(4, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 connect(4, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) close(4) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 4 fcntl64(4, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 connect(4, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) close(4) = 0 open("/etc/nsswitch.conf", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0644, st_size=1185, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f77000 read(4, "#\n# /etc/nsswitch.conf\n#\n# An ex"..., 4096) = 1185 read(4, "", 4096) = 0 close(4) = 0 munmap(0xb7f77000, 4096) = 0 open("/etc/ld.so.cache", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0644, st_size=82152, ...}) = 0 mmap2(NULL, 82152, PROT_READ, MAP_PRIVATE, 4, 0) = 0xb7e05000 close(4) = 0 open("/lib/libnss_compat.so.2", O_RDONLY) = 4 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0@\21\0\000"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=31943, ...}) = 0 mmap2(NULL, 29296, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb7f70000 madvise(0xb7f70000, 29296, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f76000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x5) = 0xb7f76000 close(4) = 0 munmap(0xb7e05000, 82152) = 0 open("/etc/ld.so.cache", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0644, st_size=82152, ...}) = 0 mmap2(NULL, 82152, PROT_READ, MAP_PRIVATE, 4, 0) = 0xb7e05000 close(4) = 0 open("/lib/libnss_nis.so.2", O_RDONLY) = 4 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\260\34"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=41986, ...}) = 0 mmap2(NULL, 37424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb7f66000 madvise(0xb7f66000, 37424, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f6e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x7) = 0xb7f6e000 close(4) = 0 open("/lib/libnss_files.so.2", O_RDONLY) = 4 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\360\33"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=42109, ...}) = 0 mmap2(NULL, 37528, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb7dfb000 madvise(0xb7dfb000, 37528, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7e03000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x7) = 0xb7e03000 close(4) = 0 munmap(0xb7e05000, 82152) = 0 open("/etc/group", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=831, ...}) = 0 mmap2(NULL, 831, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 831, [831], SEEK_SET) = 0 munmap(0xb7e19000, 831) = 0 close(4) = 0 open("/etc/group", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=831, ...}) = 0 mmap2(NULL, 831, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 831, [831], SEEK_SET) = 0 munmap(0xb7e19000, 831) = 0 close(4) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 4 fcntl64(4, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 connect(4, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) close(4) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 4 fcntl64(4, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 connect(4, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) close(4) = 0 open("/etc/passwd", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=1654, ...}) = 0 mmap2(NULL, 1654, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 1654, [1654], SEEK_SET) = 0 munmap(0xb7e19000, 1654) = 0 close(4) = 0 open("/etc/group", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=831, ...}) = 0 mmap2(NULL, 831, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 831, [831], SEEK_SET) = 0 munmap(0xb7e19000, 831) = 0 close(4) = 0 open("/etc/passwd", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=1654, ...}) = 0 mmap2(NULL, 1654, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 1654, [1654], SEEK_SET) = 0 munmap(0xb7e19000, 1654) = 0 close(4) = 0 open("/etc/group", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=831, ...}) = 0 mmap2(NULL, 831, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 831, [831], SEEK_SET) = 0 munmap(0xb7e19000, 831) = 0 close(4) = 0 open("/etc/passwd", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=1654, ...}) = 0 mmap2(NULL, 1654, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 1654, [1654], SEEK_SET) = 0 munmap(0xb7e19000, 1654) = 0 close(4) = 0 open("/etc/group", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=831, ...}) = 0 mmap2(NULL, 831, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 831, [831], SEEK_SET) = 0 munmap(0xb7e19000, 831) = 0 close(4) = 0 read(3, "", 8192) = 0 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfec39f8) = -1 ENOTTY (Inappropriate ioctl for device) close(3) = 0 munmap(0xb7f78000, 4096) = 0 pipe([3, 4]) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7e1a908) = 5189 close(4) = 0 read(3, "\0", 1) = 1 exit_group(0) = ?

5 8