November 2007 - syslog-ng - lists.balabit.hu

Freshmeat page
by Andrej Ricnik-Bay 28 Nov '07

28 Nov '07

Hi, While the announcement on freshmeat says 2.06 the little download icon still points at 2.05. Cheers, Andrej -- Please don't top post, and don't use HTML e-Mail :} Make your quotes concise. http://www.american.edu/econ/notes/htmlmail.htm

3 3

Re: [syslog-ng] syslog-ng 2.0.6 has been released
by G.W. Haywood 28 Nov '07

28 Nov '07

Hi there, On Wed, 28 Nov 2007 BalaBit Development Team wrote: > ------------------------------------------------------------------------------ > PACKAGE : syslog-ng > VERSION : 2.0.6 > SUMMARY : new stable release > DATE : Nov 28, 2007 > ------------------------------------------------------------------------------ > > ... > > SOURCE DOWNLOAD: > > The latest versions of syslog-ng in source format can be found at: > > http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/ I don't see 2.0.6 there. -- 73, Ged.

1 0

Has Anyone Gotten Syslog-NG Running as Non-Root Working?
by Mathew Brown 28 Nov '07

28 Nov '07

Hi, I'm currently trying to get syslog-ng running as a non-privileged user. What I've done so far is as follows: * create a sysng user and group * stopped syslog from running * modified /etc/sysconfig/syslog-ng and set SYSLOGNG_OPTIONS to SYSLOGNG_OPTIONS="-p /var/run/syslogd.pid -u sysng -g sysng" * Added the following to my config file: owner(sysng); group(sysng); perm(0600); # default owner, group, and permissions for created directories # (defaults are 0, 0, 0700) dir_owner(sysng); dir_group(sysng); dir_perm(0700); * Fixed permissions under /var/log as follows: chgrp -R sysng /var/log chmod -R g+wx /var/log * However, my primary problem is reading from /proc/kmsg. It seems that when syslog-ng initially starts, it can open /proc/kmsg before it drops privileges to sysng. Strace shows that it did: 17692 open("/proc/kmsg", O_RDONLY|O_NOCTTY|O_NONBLOCK|O_LARGEFILE) = 3 However, I then find the following in my /var/log/messages file: Nov 28 10:42:37 localhost syslog-ng[18356]: I/O error occurred while reading; fd='3', error='Operation not permitted (1)' So it looks like it can't read from /proc/kmsg. Has anyone gotten this working? I found several related emails but without a resolution to this issue including: * https://lists.balabit.hu/pipermail/syslog-ng/2007-January/009684.html * https://lists.balabit.hu/pipermail/syslog-ng/2007-October/010804.html One possible solution that I'm currently thinking of is to use klogd instead of reading from /proc/kmsg. Any input? Thanks for your help. -- Mathew Brown mathewbrown(a)fastmail.fm -- http://www.fastmail.fm - One of many happy users: http://www.fastmail.fm/docs/quotes.html

1 0

[syslog-ng-announce] syslog-ng 2.0.6 has been released
by BalaBit Development Team 28 Nov '07

28 Nov '07

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.6 SUMMARY : new stable release DATE : Nov 28, 2007 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.6) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.6 Tue, 27 Nov 2007 10:35:27 +0100 IMPORTANT NOTES: * There are two possible Denial of Service fixes in this version of syslog-ng, therefore it is strongly recommended to upgrade to this version. Bugfixes: * HP-UX related build and runtime fixes, backported from the Premium Edition. * If unable to resolve the name of the target host, syslog-ng failed to initialize the TCP/UDP destination drivers. This behavior has been corrected. * Corrected program name parsing in incoming messages. * Fixed a problem in handling messages which lacked explicit timezone information, but the administrator specified a timezone for the messages. * Fixed some minor memory leaks in configuration reloads. * Fixed a segmentation fault which occurred when the timestamp of the incoming messages did not end with a space character (NULL pointer dereference). This is an easy Denial of Service possibility. * Fixed a segmentation fault which occurred when the PID macro was used and the message had a closing bracket (']') before an opening bracket ('['). * Fixed a possible segmentation fault for UDP6/TCP6 destinations. * Fixed IPv6 scope id resolution for link-local addresses. * Solaris related fixes. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/ _______________________________________________ syslog-ng-announce mailing list syslog-ng-announce(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng-announce

1 0

Help understanding syslog-ng open-source code
by emanuel 28 Nov '07

28 Nov '07

Hey guys, im trying to implement a few features for the open-source version of syslog-ng. I am going to build my own device driver to better fit my needs. My problem with this task is, that the source code lacks proper commenting and you can easily get lost. Now I wanted to know if theres some special forum or source code documentation and if not, is there someone who is able and willing to answer some questions about the syslog-ng code? This would give my work a huge boost. Thanks for your responses in advance, Emanuel

3 5

[Bug 2] New: program() enhancements
by bugzilla＠bugzilla.balabit.com 27 Nov '07

27 Nov '07

https://bugzilla.balabit.com/show_bug.cgi?id=2 Summary: program() enhancements Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bazsi(a)balabit.hu Type of the Report: enhancement Estimated Hours: 0.0 1) make it possible to specify the shell to be used to invoke the program destination 2) instead of restarting the process make it possible to send a signal to it using SIGHUP 3) make it possible to read the output of such programs and interpret it as log messages -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

spams
by Balazs Scheidler 27 Nov '07

27 Nov '07

Hi, We've had a minor spam issue, but I supposedly fixed it, so no more spam messages should be posted here. -- Bazsi

1 0

Confirm bre1tling 0rder 2980038
by Priscilla Shipman 27 Nov '07

27 Nov '07

Hello, We have brand new model of r0lex yachtmaster II from 2008 for only $229. 15% off only in November. V1sit us n0w at: http://www.spokkilee.com/

1 0

syslog-ng's enigmatic logging behavior ?
by Eiji Inatsu 27 Nov '07

27 Nov '07

Hello, I encoutered a problem about message filtering or macro or ???. I want to fix this problem. please help me. [env] # uname -a SunOS hogehoge 5.10 Generic_125100-07 sun4u sparc SUNW,Sun-Fire-V245 # syslog-ng -V syslog-ng 2.0.2 [conf] # cat syslog-ng options {create_dirs(yes); use_fqdn(yes); dir_owner(syslog-ng); dir_perm(0750); owner(syslog-ng); perm(0740); sync(0);}; ... source s_net { udp(ip(2.2.2.2) port(514)); }; ... log { source(s_net); filter(f_fw_1); destination(d_fw_1); flags(final); }; ... filter f_fw_all { host("DC_"); }; filter f_fw_1 { filter(f_fw_all) and host("ifw1"); }; ... destination d_fw_1 { file("/opt/syslog/log/DC_fw/$HOST/$HOST.log.$YEAR$MONTH$DAY-$HOUR" dir_group(fw-log) group(fw-log)); }; ... ... destination d_debug_all { file("/opt/syslog/log/debug/$HOST/$HOST.log.$YEAR$MONTH$DAY-$HOUR" dir_group(all-log) group(all-log)); }; ... log { source(s_net); destination(d_debug_all); flags(final);}; # grep -v ^# syslog-ng.conf | wc -l 532 # grep DC_fw /etc/inet/hosts 1.1.1.1 DC_ifw1 [problem] A message is loged to d_fw_1 and a message is loged to d_debug_all. The filename of a message loged to d_fw_1 is DC_ifw120071127-12 and the filename of a message loged d_debug_all is 1.1.1.1. I think all messages should only be loged to d_fw_1, but doesn't. I want to know what should I do to fix to my problem. thanks. --- // mailto: le.petit.planet(a)gmail.com

1 0

November 70% OFF
by Arlene＠Viagra.com 26 Nov '07

26 Nov '07

1 0