- syslog-ng - lists.balabit.hu

specifying hostname for unix-stream sources
by william.batt＠abnamro.com 17 Jun '05

17 Jun '05

This may sound like a strange request, but I would like to override the default hostname for messages originating from unix-stream sources. The hostname (understandably) defaults to the server hostname. For "corporate" reasons I cannot change the hostname but need the syslog-ng messages to contain the hostname of a subinterface associated with my application. Also for "corporate" reasons I cannot completely replace syslog but need to run syslog-ng in parallel with it using separate sockets (e.g., /dev/log-ng). Is this possible? --------------------------------------------------------------------------- This message (including any attachments) is confidential and may be privileged. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorised use or dissemination of this message in whole or in part is strictly prohibited. Please note that e-mails are susceptible to change. ABN AMRO Bank N.V. (including its group companies) shall not be liable for the improper or incomplete transmission of the information contained in this communication nor for any delay in its receipt or damage to your system. ABN AMRO Bank N.V. (or its group companies) does not guarantee that the integrity of this communication has been maintained nor that this communication is free of viruses, interceptions or interference. ---------------------------------------------------------------------------

2 2

program filters
by Metal Gear 17 Jun '05

17 Jun '05

Hi, I m trying to log only specific type of program alerts in a mysql db at remote syslog-ng server. Till now i m able to get exactly the messages that i wanted but i m also getting some annoying messages in mysql db. I did researched the problem but was unable to find any satified answer. These messages are *host* *facility* *priority* *level* *tag* *date* *time* *program* *msg* * seq* abc kern warning warning 04 2005-06-16 08:58:35 On node 0 total On node 0 totalpages: 65088 3572 abc kern warning warning 04 2005-06-16 08:58:35 Processors Processors: 1 3573 abc kern warning warning 04 2005-06-16 08:58:35 ESR value after ESR value after enabling vector: 00000000 3574 abc kern info info 06 2005-06-16 08:59:29 parport0 parport0: PC-style at 0x378 (0x778) [PCSPP,TRISTATE] 3575 abc kern info info 06 2005-06-16 08:59:29 parport0 parport0: irq 7 detected 3576 I m also attaching my syslog-ng.conf file any help would be greatly appreciated. options { long_hostnames(off); sync(0); keep_hostname(yes); chain_hostnames(no); use_time_recvd(yes); }; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; source stunnel {tcp(ip("127.0.0.1 <http://127.0.0.1/>") port(514) keep-alive(yes));}; source netscreen {udp(ip("192.168.1.6 <http://192.168.1.6/>") port(514) );}; destination remoteclient {file("/var/log/HOSTS/$HOST/ $DAY.$MONTH.$YEAR.loggedmessages" create_dirs(yes));}; destination dest {file("/var/log/HOSTS/$HOST/$DAY.$MONTH.$YEAR.loggedmessages" create_dirs(yes));}; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; filter f_syslog {not match("STATS: dropped");}; filter f_auth { facility(auth) or program(".*ftp*.") or program(".*ssh*.") or program(".*pam*."); }; log {source(src); filter(f_syslog); filter(f_auth); destination(d_mysql);}; log {source(stunnel); filter(f_syslog); filter(f_auth); destination(d_mysql);}; log {source(netscreen); destination(d_mysql);}; log {source(src); filter(f_syslog); destination(dest);}; log {source(stunnel); filter(f_syslog); destination(remoteclient);}; log {source(netscreen); destination(remoteclient);};

2 3

syslog-n 1.6.8 crash and backtrace on FreeBSD 4.10
by Steve Shorter 16 Jun '05

16 Jun '05

Howdy! I want to setup syslog-ng on a large server farm and set up a test system on FreeBSD 4.10. The syslog-ng package from the ports collection would crash... so I got the latest sources of libio and syslog-ng and built it. It still crashes and dumps core. Here is a backtrace. Script started on Wed Jun 15 12:26:12 2005 bash-2.05b# gdb -c syslog-ng.core /usr/local/sbin/syslog-ng [cut out the GNU preamble] Core was generated by `syslog-ng'. Program terminated with signal 6, Abort trap. Reading symbols from /usr/lib/libc.so.4...done. Reading symbols from /usr/libexec/ld-elf.so.1...done. #0 0x480b2fc4 in kill () from /usr/lib/libc.so.4 (gdb) bt #0 0x480b2fc4 in kill () from /usr/lib/libc.so.4 #1 0x480f493e in abort () from /usr/lib/libc.so.4 #2 0x480d08d3 in __assert () from /usr/lib/libc.so.4 #3 0x80540be in io_iter (b=0x8062000) at io.c:283 #4 0x8049e5f in main_loop (backend=0x8062000) at main.c:256 #5 0x804a557 in main (argc=4, argv=0xbfbffc24) at main.c:549 (gdb) quit bash-2.05b# exit Script done on Wed Jun 15 12:26:40 2005 Looks like the libio call io_iter does an assert() in line 283 and it kills/abort's the process Any more info required? I can test patches if you like. Ideas? thanx - steve The config file is simple like this # # options # options { # gc_idle_threshold(); # gc_busy_threshold(); log_fifo_size(1000); long_hostnames(off); use_dns(yes); dns_cache(yes); dns_cache_size(1000); sync(0); }; # # sources # source src { unix-dgram("/var/run/log"); udp(ip(0.0.0.0.) port(515)); tcp(ip(10.1.3.4) port(515) max-connections(30)); internal(); # file("/dev/klog"); }; # # destinations # destination d_logfiles { file("/var/syslog-ng/$HOST/$FACILITY" template("$DATE <$FACILITY.$LEVEL>: $MSG\n") template_escape(no) remove_if_older(86400) create_dirs(yes) ); }; destination d_console { file("/dev/console"); }; destination d_root { usertty("root"); }; # # log facility filters # #filter f_user { facility(user); }; # # log level filters # filter f_emerg { level(emerg); }; # # program filters # #filter f_ppp { program("ppp"); }; log { source(src); destination(d_logfiles); }; log { source(src); filter(f_emerg); destination(d_root); };

2 2

Questions Again :)
by mrgenius 16 Jun '05

16 Jun '05

hi All! I am running syslog-ng logging in msyql database with phpsyslog-ng as front end. 1) Now i have 1 problem. The Devices which are sending logs don't have any hostnames associated with them nor i am running any DNS server. As a result the listing of hosts i am getting are in the form of IP addresses of hosts. Is it possible to show hostname against IP adresses?? Like x.x.x.x will be shown as ABC-ROUTER ?? if i define ABC-Router as x.x.x..x in /etc/hosts .. what configuration do i need to make in syslog-ng.conf?? 2) I want to Allow only specific hosts to send logs to loghost. But when i tried to put IP of hosts in configuration it gave me errors. Starting system logger: io.c: bind_inet_socket() bind failed 61.x.x.x:514 Cannot assign requested address I used following configuration source net { udp(ip(61.x.x.x) port(514) ); udp(ip(62.x.x.x) port(514) ); udp(ip(63.x.x.x) port(514) ); }; Do i have to allow this policy on firewall or syslog-ng also supports it?? bcause with only udp(); Every device on internet can start sending me logs and my server will be under attack. Regards, -Geni

2 1

syslog-ng 1.5.17 and tcp-keep-alive not working
by Olaf Hoyer 16 Jun '05

16 Jun '05

Hallo! I want to do a centralized sysloging, where some embedded devices, running a ppc version of linux 2.2.14, also running syslog-ng 1.5.17 shall log their data received bei some Interfaces to a central loghost. In a test scenario, with the loghost being syslog-ng 1.6.5, and running on a different port than the system syslog, everything is fine via udp and tcp with basic features. Some tests show, that when the syslog-ng on the loghost receives a -HUP, the connection is dropped, unless the option "keep-alive(yes)" is configured, like in the following example: source s_tcp { tcp(ip(0.0.0.0) port(8514) max-connections(100) keep-alive(yes)); }; with that config the loghost is working. So now I wanted to activate tcp keepalive on the client, in the hope, that whenever the syslog server closed the connection, that the client can reopen it upon new data arriving, what it is not doing in the basic config: working: destination syslog_server { tcp("10.0.0.1" port(8514)); } new line: destination syslog_server { tcp("10.0.0.1" port(8514) tcp-keep-alive(yes)); } But: [root@test /root]# syslog-ng parse error at 199 Parse error reading configuration file, exiting. (line 199) [root@test /root]# head -199 /etc/syslog-ng/syslog-ng.conf |tail -1 destination syslog_server { tcp("10.0.0.1" port(8514) tcp-keep-alive(yes)); }; Could someone enlighten me if a) syslog-ng 1.5 understands the "tcp-keep-alive" directive b) my thoughts are correct regarding the re-establishment of the tcp connection Thanks in advance Olaf -- Olaf Hoyer ohoyer(a)ohoyer.de Fuerchterliche Erlebniss geben zu raten, ob der, welcher sie erlebt, nicht etwas Fuerchterliches ist. (Nietzsche, Jenseits von Gut und Boese)

2 4

Reliability of Remote logging via TCP/Syslog-NG
by Alf 16 Jun '05

16 Jun '05

Hi Guys, (New to this list, searched the FAQ for this qn, didnt find it. So I apologize if this was repeated before on the list. It might be related to the topic on TCP timingout though as report @ https://lists.balabit.hu/pipermail/syslog-ng/2005-February/006974.html) I'm planning to deploy a syslog-ng setup. (Central logging server in Asia, and Clients will be in US/HK). The setup is actually as a backup/secure repository of log entries of the appliation we are running. Now the question is, (I know TCP is reliable vs UDP), how reliable will syslog-ng hand the log entries ? If it gets disconnected (due to timeout, reset, etc), will it hold the log entry in memory and queue it for resend ? Is there an option to set before it times out (And at least logs it in a local log that there was an error (as an internal msg i guess) I need to be certain that no messages get lost basically :P Thanks in advance. Elvin -

5 10

Hostnames on output!
by mrgenius 16 Jun '05

16 Jun '05

hi All! I am running syslog-ng logging in msyql database with phpsyslog-ng as front end. Now i have 1 problem. The Devices which are sending logs don't have any hostnames associated with them nor i am running any DNS server. As a result the listing of hosts i am getting are in the form of IP addresses of hosts. Is it possible to show hostname against IP adresses?? Like x.x.x.x will be shown as ABC-ROUTER ?? if i define ABC-Router as x.x.x..x in /etc/hosts .. what configuration do i need to make in syslog-ng.conf?? Regards, -Geni

1 0

Some Questions!
by mrgenius 16 Jun '05

16 Jun '05

Hi all! I belongs to a relatively huge orginization. And we are not going to impliment Centralized Logging. But I have Few considerations and Things in mind whihc i needs to be rectified. We are ISP having around 8-9 Cisco routers ranging from 2600 to 7200 series. around 30MaxTNT Access Servers and aroud 20 Cisco Switches. NOw i have Few Questions - What is Facility?? is it log message type ?? "DEBUG INFO NOTICE WARNING ERROR CRIT ALERT EMERG " . Because All Devices supports defining of facility from local0 to local 7. And Some devices like MaxTNT have options of definit facility as well as log level (having options of DEBUG INFO NOTICE WARNING ERROR CRIT ALERT EMERG) - Altough i know it depends on logs/time duration. But i would like to know what kind of machine is needed to runn syslog server (linux based) with stability? Will Dual XEON with 512k ram be enough?? And how about Harddisk size? Please if some one who has implimented syslog in such orgnization structure as i have.. suggest me answers of above said Question. Regards, -Geni Network Engineer

2 1

OT: why does writes to /dev/log block?
by Jason Haar 15 Jun '05

15 Jun '05

Hi there I just reinstalled my Fedora workstation recently and hadn't moved over to syslog-ng like I normally do - so this is a question about syslog really. In the past two days I've come in to find my workstation fairly screwed up by the syslog daemon being hung/broken. It would be running, but not working any more. Anyway, as the socket file /dev/log exists, all apps that write to syslog were also hung! So I had my mail server screwed, cronjobs unable to finish, etc, etc. Simply stopping the syslog daemon caused my load average to jump to 40+ whilst all the pent-up processes started working again :-) I guess once the socket file disappeared under them, they just carried on nicely... So - am I right in saying /dev/log blocks, and is there some way at an application layer to limit how long a process attempts to write to syslog before giving up? I know an alarm around the syslog call should work - but is that the only way? Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 3

sqlsyslogd sometimes does not starts
by Metal Gear 14 Jun '05

14 Jun '05

Hi, i m using a script which logs certain alerts to mysql db. It mostly wotks fine but sometimes i see that i m not getting the alerts into mysql db i have to then manually start the service. I m using the following code for the above mentioned purpose which is being taken from http://www.vermeer.org/display_doc.php?doc_id=1#scripts. I m getting the logs in flat files but none in the mysql db. Thanks #!/bin/bash # # sqlsyslogd This is a daemon that takes syslog-ng input and pipe it into # a MySQL database. # # chkconfig: 2345 92 10 # description: sqlsyslogd bridges syslog-ng and mysql. # author: Josh Kuo Thu 2004/08/12 13:21:56 PDT . /etc/rc.d/init.d/functions case "$1" in start) if [ -x /tmp/mysql.pipe ]; then mkfifo /tmp/mysql.pipe else # if the service is already running, do not start another one PIDS=`pidofproc mysql` if [ "$PIDS" ]; then gprintf "sqlsyslogd is already running.\n" exit 1 fi mysql -u DBUSERNAME --password=PASSWORD DBNAME < /tmp/mysql.pipe & fi ;; stop ) killproc mysql ;; *) gprintf "Usage: sqlsyslogd {start|stop}\n" exit 1; esac exit 0;

2 1

Lines sorted into the wrong log files
by David Miller 14 Jun '05

14 Jun '05

I upgraded a pair of debian (sarge) boxen to syslog-ng 1.6.5. One is to be the central logging server, the other is a sample client. I changed the destinations of all the logs to just include tcp("ip_address"); On the server side I added tcp() to the source s_all {} statement. My problem is that I'm getting more logging done on the remote side than on the client side. For example, the client has: wiabweb2:/etc/syslog-ng# tail /var/log/cron.log 13 Jun 05:45:01 ntpdate[22494]: ntpdate 4.2.0a@1:4.2.0a+stable-2-r Sun Jan 9 16:13:28 CET 2005 (1) 13 Jun 05:45:03 ntpdate[22494]: step time server 192.168.120.13 offset 1.988834 sec but the remote server has: Jun 13 16:51:01 192.168.120.27 CRON[1779]: pam_ldap: could not open secret file /etc/ldap.secret (No such file or directory) Jun 13 16:51:01 192.168.120.27 /USR/SBIN/CRON[12192]: (root) CMD (/bin/date >> /tmp/date) Jun 13 16:52:01 192.168.120.27 CRON[18762]: pam_ldap: could not open secret file /etc/ldap.secret (No such file or directory) Jun 13 16:52:01 192.168.120.27 /USR/SBIN/CRON[172]: (root) CMD (/bin/date >> /tmp/date) These "extra" entries show up in syslog on both systems. Why would the remote system have the entries logged to more files than the client? ***************** Long set of config files follows ********************* Rather than add a thousand lines of almost all config, I'll just add what I think is relevent. On the server side, # sources # all known message sources source s_all { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); # use the above line if you want to receive remote UDP logging messages # (this is equivalent to the "-r" syslogd flag) # udp(); tcp(); }; [snip] ###### # destinations # some standard log files destination df_auth { file("/var/log/$HOST/auth.log"); }; destination df_syslog { file("/var/log/$HOST/syslog"); }; destination df_cron { file("/var/log/$HOST/cron.log"); }; [snip] ###### # filters # all messages from the auth and authpriv facilities filter f_auth { facility(auth, authpriv); }; # all messages except from the auth and authpriv facilities filter f_syslog { not facility(auth, authpriv); }; # respectively: messages from the cron, daemon, kern, lpr, mail, news, user, # and uucp facilities filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; [snip] # *.*;auth,authpriv.none -/var/log/syslog log { source(s_all); filter(f_syslog); destination(df_syslog); }; # this is commented out in the default syslog.conf # cron.* /var/log/cron.log log { source(s_all); filter(f_cron); destination(df_cron); }; ========= On the client side ============= ###### # sources # all known message sources source s_all { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); # use the above line if you want to receive remote UDP logging messages # (this is equivalent to the "-r" syslogd flag) # udp(); }; [snip] ###### # destinations # some standard log files destination df_auth { file("/var/log/auth.log"); tcp("192.168.120.49"); }; destination df_syslog { file("/var/log/syslog"); tcp("192.168.120.49"); }; destination df_cron { file("/var/log/cron.log"); tcp("192.168.120.49"); }; destination df_daemon { file("/var/log/daemon.log"); tcp("192.168.120.49"); }; destination df_kern { file("/var/log/kern.log"); tcp("192.168.120.49"); }; # destination df_lpr { file("/var/log/lpr.log"); tcp("192.168.120.49"); }; destination df_mail { file("/var/log/mail.log"); tcp("192.168.120.49"); }; ###### # filters # all messages from the auth and authpriv facilities filter f_auth { facility(auth, authpriv); }; # all messages except from the auth and authpriv facilities filter f_syslog { not facility(auth, authpriv); }; # respectively: messages from the cron, daemon, kern, lpr, mail, news, user, # and uucp facilities filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; # some filters to select messages of priority greater or equal to info, warn, # and err # (equivalents of syslogd's *.info, *.warn, and *.err) filter f_at_least_info { level(info..emerg); }; filter f_at_least_notice { level(notice..emerg); }; filter f_at_least_warn { level(warn..emerg); }; filter f_at_least_err { level(err..emerg); }; filter f_at_least_crit { level(crit..emerg); }; # all messages of priority debug not coming from the auth, authpriv, news, and # mail facilities filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; # all messages of info, notice, or warn priority not coming form the auth, # authpriv, cron, daemon, mail, and news facilities filter f_messages { level(info,notice,warn) and not facility(auth,authpriv,cron,daemon,mail,news); }; # messages with priority emerg filter f_emerg { level(emerg); }; # complex filter for messages usually sent to the xconsole filter f_xconsole { facility(daemon,mail) or level(debug,info,notice,warn) or (facility(news) and level(crit,err,notice)); }; # *.*;auth,authpriv.none -/var/log/syslog log { source(s_all); filter(f_syslog); destination(df_syslog); }; # this is commented out in the default syslog.conf ***** Why is ntpdate still logging into /var/log/cron ? # cron.* /var/log/cron.log # log { # source(s_all); # filter(f_cron); # destination(df_cron); #}; [snip]

1 0

does remove_if_older still work?
by sawall 14 Jun '05

14 Jun '05

I have one line in my syslog-ng.conf file, as follows: destination netops { file("/var/log/HOSTS/$HOST" remove_if_older(604800) owner(root) group (root) perm(0644) dir_perm(0700)); }; I'm running version 1.6.7 on Fedora Core 2. I would like to have the files that hit this destination be deleted every 7 days. It does not appear to be working as the files keep growing. Maybe I misunderstood, but this should let the file grow for n seconds, then delete the file and start writing to a new file with the same name, right? I tried setting this to 60 and that made no difference. Any help would be appreciated. Thanks, Chris

4 7

Re: [syslog-ng] syslog-ng and windows
by mibry＠iinet.net.au 13 Jun '05

13 Jun '05

I hope this is able to help someone, I have been working on a solution to get eventlogs from a Windows box to a central syslog-ng server using open source products and have come up with a solution similar to using syslog-ng with stunnel. I have the solution setup in test environment at the moment and it seems to be working fine. I haven't quite finished the documentation at the moment but hope to have the documentation and files on my web site by Tuesday the 14th June. I hope that others will find the information useful. Here is the setup: Windows 2000 server running Eventlog to Syslog Utility available from https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys. Eventlog to Syslog sends Windows events to the loghost server. The loghost server is running debian sarge and syslog-ng 1.6.5. To make sure that the data from the Windows box is not intercepted during transmission I am using a tunneling program that is available for both *nix and Win32 boxs called Zebedee which is available from http://www.winton.org.uk/zebedee. Zebedee creates a secure tunnel for both TCP and UDP from the windows box to the loghost server. The default binaries under Linux do not spoof the correct ip address in the syslog logs so I have compiled a new set binaries which are available from the web site listed below. The only problem with the build that I have done is the program needs to be run as root. Any comments or feed back on the solution is welcome. http://members.iinet.net.au/~mibry/ Kind Regards Michael Bryant >Just curious.... >What would happen if TCP transmission was not terminated with an nl or >nul char? Would TCP receive buffers fill up and kill communication on >te server? >-----Original Message----- >From: syslog-ng-bounces at lists.balabit.hu >[mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Balazs >Scheidler Sent: Monday, May 30, 2005 6:24 AM To: tilaris at wanadoo.fr; Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] syslog-ng and windows On Mon, 2005-05-30 at 11:08 +0200, JF Suret wrote: > Hello, > > I'm using syslog-ng as a central log server, and I have both linux and windows clients. I know that there are some syslog windows clients ( NTsyslog, snare) but I can't find any open source syslog-ng clients. > > What I'm looking for is (at least if it does not exist) information on the TCP data format used by syslog-ng. > So I could write a little udp to tcp syslog translator that could be used on windows clients (and maybe modify NTsyslog if I have enought time...) It is basically the same as UDP, the only exception is that messages has to be translated by an NL or NUL characters as otherwise there's no way to recognize message boundary. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng at lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ----- End forwarded message -----

1 0

Solaris 10 info
by Dave Johnson 11 Jun '05

11 Jun '05

After playing around with syslog-ng on Solaris 10 today, here are some notes: * As mentioned from Kenneth G, libol / syslog-ng should compile fine on Solaris 10, just make sure --enable-full-dynamic" in your configure for syslog-ng. * You may also need to update your LD_LIBRARY_PATH and PATH (/usr/sfw & /opt/sfw ? ) * Service Management Facility ("svcs" "svcadm" "svccfg" commands) You can choose to run syslog-ng via the traditional /etc/init.d method on solaris 10 and then wrap that start and stop script with the solaris 10's smf facility, or the other option is to do everything via the SMF facility. I've attached two files to do the later. The example files assume your syslog-ng.conf is ln /etc/syslog-ng/ -> /usr/local/etc/syslog-ng/ and the binary is /usr/local/sbin/syslog-ng: 1) Compile and install libol, syslog-ng. 2) mkdir /usr/local/etc/syslog-ng; ln -s /usr/local/etc/syslog-ng /etc/syslog-ng 3) copy your syslog-ng.conf to /etc/syslog-ng/ 4) cp svc.method.syslog-ng /lib/svc/method/syslog-ng 5) cp svc.manifest.syslog-ng.xml /var/svc/manifest/system/syslog-ng.xml 6) `svccfg import /var/svc/manifest/system/syslog-ng.xml` Then to switch from standard syslog to syslog-ng: 1) svcadm disable system-log 2) svcadm enable syslog-ng To revert back to solaris 10's default syslog, and have it running on reboot: 1) `svcadm disable syslog-ng` 2) `svccfg delete syslog-ng` 3) `svcadm enable system-log` ---------- Forwarded message ---------- From: kenneth.gullberg(a)foreningssparbanken.se < kenneth.gullberg(a)foreningssparbanken.se> Date: May 26, 2005 5:11 AM Subject: SV: [syslog-ng] syslog-ng 1.6.8 has been released To: syslog-ng(a)lists.balabit.hu Hi, Here is a small suggestion for the INSTALL file in the next release for unexperienced admin's: Solaris 10 ---------- For successful compilation on Solaris 10 you need to use --enable-full-dynamic when you run configure. // Kenneth

4 5

change localhost to actual hostname in log entries
by deet 10 Jun '05

10 Jun '05

Hello. I'm running the Suse supplied (SLES9) version of syslog-ng (version 1.6.5-10). I have a few hosts that are logging everything to a central log server. The syslog-ng process on the client hosts is listening on the loopback interface on port 514 for inbound syslog writes from applications that cannot use /dev/log. The problem is that the log entries get written as being from localhost (example below) Jun 10 11:35:04 localhost tomcat: INFO: 2005-06-10 11:35:04,103 [StoreLoader] - Find registry server-registry.xml at classpath resource Obviously this is not much of a problem when your looking at the logs on the client host that created the log entry. But on the central log server i'm sorting logs by $HOST and end up with all the logs from various clients which appear to be from "localhost" all get mixed together and written to one file which is confusing. So my question is 2 fold. On the client is it possible to change the hostname from "localhost" to the actual hostname via a syslog-ng configuration on the client before the logs get written to disk and sent the remote syslog server? If that is not possible are their any syslog-ng ways to accomplish the goal of changing "localhost" to the correct hostname either on the client or on the syslog server. TIA. Deet.

1 0

RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel
by Stephen Tanner 10 Jun '05

10 Jun '05

Gentlemen, I do believe that I have located my problem. It seems that the PRNG is not producing enough random bytes before stunnel starts so it never creates a stable tunnel and syslog-ng is unable to send outbound messages. I appreciate all your help in tracking this down. Stephen 2005.06.09 16:14:36 LOG5[1409:1]: stunnel 4.08 on hppa2.0w-hp-hpux11.11 PTHREAD+POLL+IPv4 with OpenSSL 0.9.7e 25 Oct 2004 2005.06.09 16:14:37 LOG4[1409:1]: PRNG may not have been seeded with enough random bytes 2005.06.09 16:14:37 LOG5[1409:1]: 27 clients allowed 2005.06.09 16:14:37 LOG5[1410:2]: 5140 connected from 127.0.0.1:49153 2005.06.09 16:14:37 LOG3[1410:2]: SSL_connect: Peer suddenly disconnected 2005.06.09 16:14:47 LOG5[1410:3]: 5140 connected from 127.0.0.1:49156 2005.06.09 16:14:47 LOG3[1410:3]: SSL_connect: Peer suddenly disconnected -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield Sent: Thursday, June 09, 2005 11:22 AM To: Syslog-ng users' and developers' mailing list Subject: RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Since it starts cleanly from command line, run lsof against the pid and see if anything else is may be needed (random number generator, pipes or doors) that may be later in the boot stream. Or start a local syslog prior to initiating the tunnel (to capture the stunnel logs) just for error information. HTH, Stew -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stephen Tanner Sent: Thursday, June 09, 2005 11:14 AM To: Syslog-ng users' and developers' mailing list Subject: RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel >From everything that I can find, no it does not. It uses ssl to create a secure tcp connection based on port. Nothing that I have found indicates that it needs anything other than network connectivity and ssl in order to function. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield Sent: Thursday, June 09, 2005 11:05 AM To: Syslog-ng users' and developers' mailing list Subject: RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Does stunnel require a tty to function? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of JF Suret Sent: Thursday, June 09, 2005 11:00 AM To: Syslog-ng users' and developers' mailing list Subject: Re: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Maybe you could use SSH instead ? JF > Message du 09/06/05 16:38 > De : "Stephen Tanner" <stanner(a)leeclerk.org> > A : "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> > Copie à : > Objet : RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > I understand what you guys are saying, but the programs are called using > the fully qualified path to them. Both start and are running, but > syslog-ng seems unable to send logs through the tunnel to the loghost. > I don't know of any environmental variables that would even have > significance to either program. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield > Sent: Thursday, June 09, 2005 10:32 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Just like for cron called scripts, all environmental variables need to > be either within the script itself or sourced by the script. > > cron and init scripts have no knowledge of the environmental settings > that may be tied to your root (or any) shell. > > Also, it is best if you fully qualify program calls (/usr/local/bin/nawk > vs. nawk) within scripts if you don't set your path in environmental > settings. > > Bottom line, for the teams I've managed: if you need it for cron to > work, explicitly state it. > > Stew > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stephen Tanner > Sent: Thursday, June 09, 2005 9:51 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Exactly what do you mean by environment being the same? The startup > script works on this box if executed manually. The only thing that > could possibly change would be what is actually running at the time rc > starts stunnel and syslog-ng. I have place the startup script in rc2 > directly after inetd starts. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Hermann-Josef > Beckers > Sent: Thursday, June 09, 2005 9:47 AM > To: Syslog-ng users' and developers' mailing list > Subject: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > syslog-ng-bounces(a)lists.balabit.hu schrieb am 09.06.2005 15:32:38: > > > I have considered this. The only problem with this would be that I > can > > manually execute the script and everything starts up properly. It > only > > seems to barf when executed from rc on boot. > > > > --Stephen > > Did you check that the environment is exactly the same? > > Yours > hjb > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] SQL add-on
by Michael Laccetti 09 Jun '05

09 Jun '05

Yeah, I checked that out, but the formatting was off, etc, etc. Rather then fiddle around with it, I just whipped off my own. Didn't mean to step on any toes. -----Original Message----- From: Benjamin Smee [mailto:ben@disciplina.net] Sent: June 9, 2005 15:37 To: syslog-ng(a)lists.balabit.hu Cc: Michael Laccetti [c] Subject: Re: [syslog-ng] SQL add-on heya, On Thursday 09 June 2005 20:33, Michael Laccetti wrote: > I know there are a few scripts out there that feed log information > into a DB, but they don't seem to be very well supported. So, I > created my own quick-and-dirty hack. > http://projects.codeogre.com/sqlsyslogd/ how about : http://www.frasunek.com/sources/security/sqlsyslogd/ There are a few around. A quick google would have pulled them up for you. In fact I have a few patches for that to make it a little more modern / robust if you are interested. -- Benjamin Smee http://blog.smee.id.au F4DF 0F78 708C 8A22 314A 5F5B 86FA FBF6 48FF 5BA1 -- ------------------------ [ SECURITY NOTICE ] ------------------------ To: ben(a)disciplina.net, syslog-ng(a)lists.balabit.hu. For your security, michael(a)s2g-limited.com digitally signed this message on 09 June 2005 at 19:44:15 UTC. Verify this digital signature at http://www.ciphire.com/verify. ------------------- [ CIPHIRE DIGITAL SIGNATURE ] ------------------- Q2lwaGlyZSBTaWcuAVdiZW5AZGlzY2lwbGluYS5uZXQsIHN5c2xvZy1uZ0BsaXN0cy5iY WxhYml0Lmh1AG1pY2hhZWxAczJnLWxpbWl0ZWQuY29tAGVtYWlsIGJvZHkAJgMAAHwAfA AAAAEAAAAPnKhCJgMAADsCAAIAAgACACCF2JwL8FSZ12JHjaqi4keWch0Su1tLYkwGHFe 6dbl/JgEAMU5HZi3bbCGzHuBROgacg8f7vXlTdFsqED3Fgplg8g8xofPb/f6PGsSvVMxp OSkVUQhnLRX4MdxGrYgrAvzDoS5lU2lnRW5k --------------------- [ END DIGITAL SIGNATURE ] ---------------------

1 0

SQL add-on
by Michael Laccetti 09 Jun '05

09 Jun '05

I know there are a few scripts out there that feed log information into a DB, but they don't seem to be very well supported. So, I created my own quick-and-dirty hack. http://projects.codeogre.com/sqlsyslogd/ It works, but it ain't horribly pretty, and it certainly isn't production level stuff. But it could be! If there are any comments, let me know. Mike -- ------------------------ [ SECURITY NOTICE ] ------------------------ To: syslog-ng(a)lists.balabit.hu. For your security, michael(a)s2g-limited.com digitally signed this message on 09 June 2005 at 19:33:48 UTC. Verify this digital signature at http://www.ciphire.com/verify. ------------------- [ CIPHIRE DIGITAL SIGNATURE ] ------------------- Q2lwaGlyZSBTaWcuAVdzeXNsb2ctbmdAbGlzdHMuYmFsYWJpdC5odQBtaWNoYWVsQHMyZ y1saW1pdGVkLmNvbQBlbWFpbCBib2R5ACoBAAB8AHwAAAABAAAAnJmoQioBAADHAgACAA IAAgAghdicC/BUmddiR42qouJHlnIdErtbS2JMBhxXunW5fyYBADFOR2Yt22whsx7gUTo GnIPH+715U3RbKhA9xYKZYPIPSH9j8LFRbh5sHpKtIt3KWUdeuw0WtbhXgNbjcjWfWEsv QonlU2lnRW5k --------------------- [ END DIGITAL SIGNATURE ] ---------------------

2 1

Startup errors
by Hokhold, Mark 09 Jun '05

09 Jun '05

Syslog-ng experts, I would appreciate help from anyone familiar with this problem, thanks. I have the following on my server and client solaris 9 systems: Syslog-ng 1.6.8 Stunnel-4.10 Libol-0.3.16 Openssl-0.9.7g All compiled and installed successfully on both systems. Errors logged during and after startup of /etc/init.d/syslog-ng On the server (within the messages file): [ID xxxxxx daemon.notice] `port number` connected from `client IP address` [ID xxxxxx daemon.error] SSL accept: Peer suddenly disconnected On the client (within the syslog file): Syslog-ng[2782]: syslog-ng version 1.6.8 starting Syslog-ng[2782]: io.c do_write write() failed (errno 32), broken pipe Syslog-ng[2782]: pkt_buffer::do_flush(): Error flushing data Syslog-ng[2782]: Connection broken to AF_INET(127.0.0.1:514), reopening in 60 seconds On the client (within the messages file): Stunnel[2777]: [ID xxxxxx daemon.notice] stunnel 4.10 on sparc-sun-solaris2.9 UCONTEXT+POLL +IPv4 with OpenSSL 0.9.7g 11 Apr 2005 stunnel[2777]: [ID xxxxxx daemon.notice] 125 client allowed stunnel[2777]: `port number` connected from 127.0.0.1:33610 rsh[2824]: [ID xxxxxx daemon.notice] connection from localhost (127.0.0.1) - bad port Regards, Mark

1 0

RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel
by Stew Redfield 09 Jun '05

09 Jun '05

Since it starts cleanly from command line, run lsof against the pid and see if anything else is may be needed (random number generator, pipes or doors) that may be later in the boot stream. Or start a local syslog prior to initiating the tunnel (to capture the stunnel logs) just for error information. HTH, Stew -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stephen Tanner Sent: Thursday, June 09, 2005 11:14 AM To: Syslog-ng users' and developers' mailing list Subject: RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel >From everything that I can find, no it does not. It uses ssl to create a secure tcp connection based on port. Nothing that I have found indicates that it needs anything other than network connectivity and ssl in order to function. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield Sent: Thursday, June 09, 2005 11:05 AM To: Syslog-ng users' and developers' mailing list Subject: RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Does stunnel require a tty to function? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of JF Suret Sent: Thursday, June 09, 2005 11:00 AM To: Syslog-ng users' and developers' mailing list Subject: Re: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Maybe you could use SSH instead ? JF > Message du 09/06/05 16:38 > De : "Stephen Tanner" <stanner(a)leeclerk.org> > A : "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> > Copie à : > Objet : RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > I understand what you guys are saying, but the programs are called using > the fully qualified path to them. Both start and are running, but > syslog-ng seems unable to send logs through the tunnel to the loghost. > I don't know of any environmental variables that would even have > significance to either program. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield > Sent: Thursday, June 09, 2005 10:32 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Just like for cron called scripts, all environmental variables need to > be either within the script itself or sourced by the script. > > cron and init scripts have no knowledge of the environmental settings > that may be tied to your root (or any) shell. > > Also, it is best if you fully qualify program calls (/usr/local/bin/nawk > vs. nawk) within scripts if you don't set your path in environmental > settings. > > Bottom line, for the teams I've managed: if you need it for cron to > work, explicitly state it. > > Stew > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stephen Tanner > Sent: Thursday, June 09, 2005 9:51 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Exactly what do you mean by environment being the same? The startup > script works on this box if executed manually. The only thing that > could possibly change would be what is actually running at the time rc > starts stunnel and syslog-ng. I have place the startup script in rc2 > directly after inetd starts. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Hermann-Josef > Beckers > Sent: Thursday, June 09, 2005 9:47 AM > To: Syslog-ng users' and developers' mailing list > Subject: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > syslog-ng-bounces(a)lists.balabit.hu schrieb am 09.06.2005 15:32:38: > > > I have considered this. The only problem with this would be that I > can > > manually execute the script and everything starts up properly. It > only > > seems to barf when executed from rc on boot. > > > > --Stephen > > Did you check that the environment is exactly the same? > > Yours > hjb > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel
by Stephen Tanner 09 Jun '05

09 Jun '05

>From everything that I can find, no it does not. It uses ssl to create a secure tcp connection based on port. Nothing that I have found indicates that it needs anything other than network connectivity and ssl in order to function. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield Sent: Thursday, June 09, 2005 11:05 AM To: Syslog-ng users' and developers' mailing list Subject: RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Does stunnel require a tty to function? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of JF Suret Sent: Thursday, June 09, 2005 11:00 AM To: Syslog-ng users' and developers' mailing list Subject: Re: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Maybe you could use SSH instead ? JF > Message du 09/06/05 16:38 > De : "Stephen Tanner" <stanner(a)leeclerk.org> > A : "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> > Copie à : > Objet : RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > I understand what you guys are saying, but the programs are called using > the fully qualified path to them. Both start and are running, but > syslog-ng seems unable to send logs through the tunnel to the loghost. > I don't know of any environmental variables that would even have > significance to either program. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield > Sent: Thursday, June 09, 2005 10:32 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Just like for cron called scripts, all environmental variables need to > be either within the script itself or sourced by the script. > > cron and init scripts have no knowledge of the environmental settings > that may be tied to your root (or any) shell. > > Also, it is best if you fully qualify program calls (/usr/local/bin/nawk > vs. nawk) within scripts if you don't set your path in environmental > settings. > > Bottom line, for the teams I've managed: if you need it for cron to > work, explicitly state it. > > Stew > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stephen Tanner > Sent: Thursday, June 09, 2005 9:51 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Exactly what do you mean by environment being the same? The startup > script works on this box if executed manually. The only thing that > could possibly change would be what is actually running at the time rc > starts stunnel and syslog-ng. I have place the startup script in rc2 > directly after inetd starts. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Hermann-Josef > Beckers > Sent: Thursday, June 09, 2005 9:47 AM > To: Syslog-ng users' and developers' mailing list > Subject: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > syslog-ng-bounces(a)lists.balabit.hu schrieb am 09.06.2005 15:32:38: > > > I have considered this. The only problem with this would be that I > can > > manually execute the script and everything starts up properly. It > only > > seems to barf when executed from rc on boot. > > > > --Stephen > > Did you check that the environment is exactly the same? > > Yours > hjb > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel
by Stephen Tanner 09 Jun '05

09 Jun '05

I understand what you guys are saying, but the programs are called using the fully qualified path to them. Both start and are running, but syslog-ng seems unable to send logs through the tunnel to the loghost. I don't know of any environmental variables that would even have significance to either program. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield Sent: Thursday, June 09, 2005 10:32 AM To: Syslog-ng users' and developers' mailing list Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Just like for cron called scripts, all environmental variables need to be either within the script itself or sourced by the script. cron and init scripts have no knowledge of the environmental settings that may be tied to your root (or any) shell. Also, it is best if you fully qualify program calls (/usr/local/bin/nawk vs. nawk) within scripts if you don't set your path in environmental settings. Bottom line, for the teams I've managed: if you need it for cron to work, explicitly state it. Stew -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stephen Tanner Sent: Thursday, June 09, 2005 9:51 AM To: Syslog-ng users' and developers' mailing list Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Exactly what do you mean by environment being the same? The startup script works on this box if executed manually. The only thing that could possibly change would be what is actually running at the time rc starts stunnel and syslog-ng. I have place the startup script in rc2 directly after inetd starts. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Hermann-Josef Beckers Sent: Thursday, June 09, 2005 9:47 AM To: Syslog-ng users' and developers' mailing list Subject: Antwort: RE: [syslog-ng] Syslog-ng with stunnel syslog-ng-bounces(a)lists.balabit.hu schrieb am 09.06.2005 15:32:38: > I have considered this. The only problem with this would be that I can > manually execute the script and everything starts up properly. It only > seems to barf when executed from rc on boot. > > --Stephen Did you check that the environment is exactly the same? Yours hjb _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] Many errors when running make install
by Ryan McCain 09 Jun '05

09 Jun '05

Sorry for wasting your time with that question. I thought I had libol installed. I must of had a brain freeze. Thanks, Ryan >>>bazsi(a)balabit.hu 06/07/05 8:14 am >>> On Mon, 2005-06-06 at 10:54 -0500, Ryan McCain wrote: >This is on SLES 9. bison, flex and m4 are all installed. make and configure went smoothly. >Can someone interpret what this is telling me? The server has a minimal amount of packages >installed so this might be related to a missing package, but I didn't see any that I'm missing >that are called for in the INSTALL file.. Thanks!! the libol headers are missing, can you paste your exact configure command line (and libol and where it has been installed) -- Bazsi syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel
by Stew Redfield 09 Jun '05

09 Jun '05

Does stunnel require a tty to function? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of JF Suret Sent: Thursday, June 09, 2005 11:00 AM To: Syslog-ng users' and developers' mailing list Subject: Re: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Maybe you could use SSH instead ? JF > Message du 09/06/05 16:38 > De : "Stephen Tanner" <stanner(a)leeclerk.org> > A : "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> > Copie à : > Objet : RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > I understand what you guys are saying, but the programs are called using > the fully qualified path to them. Both start and are running, but > syslog-ng seems unable to send logs through the tunnel to the loghost. > I don't know of any environmental variables that would even have > significance to either program. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield > Sent: Thursday, June 09, 2005 10:32 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Just like for cron called scripts, all environmental variables need to > be either within the script itself or sourced by the script. > > cron and init scripts have no knowledge of the environmental settings > that may be tied to your root (or any) shell. > > Also, it is best if you fully qualify program calls (/usr/local/bin/nawk > vs. nawk) within scripts if you don't set your path in environmental > settings. > > Bottom line, for the teams I've managed: if you need it for cron to > work, explicitly state it. > > Stew > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stephen Tanner > Sent: Thursday, June 09, 2005 9:51 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Exactly what do you mean by environment being the same? The startup > script works on this box if executed manually. The only thing that > could possibly change would be what is actually running at the time rc > starts stunnel and syslog-ng. I have place the startup script in rc2 > directly after inetd starts. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Hermann-Josef > Beckers > Sent: Thursday, June 09, 2005 9:47 AM > To: Syslog-ng users' and developers' mailing list > Subject: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > syslog-ng-bounces(a)lists.balabit.hu schrieb am 09.06.2005 15:32:38: > > > I have considered this. The only problem with this would be that I > can > > manually execute the script and everything starts up properly. It > only > > seems to barf when executed from rc on boot. > > > > --Stephen > > Did you check that the environment is exactly the same? > > Yours > hjb > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel
by JF Suret 09 Jun '05

09 Jun '05

Maybe you could use SSH instead ? JF > Message du 09/06/05 16:38 > De : "Stephen Tanner" <stanner(a)leeclerk.org> > A : "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> > Copie à : > Objet : RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > I understand what you guys are saying, but the programs are called using > the fully qualified path to them. Both start and are running, but > syslog-ng seems unable to send logs through the tunnel to the loghost. > I don't know of any environmental variables that would even have > significance to either program. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stew Redfield > Sent: Thursday, June 09, 2005 10:32 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Just like for cron called scripts, all environmental variables need to > be either within the script itself or sourced by the script. > > cron and init scripts have no knowledge of the environmental settings > that may be tied to your root (or any) shell. > > Also, it is best if you fully qualify program calls (/usr/local/bin/nawk > vs. nawk) within scripts if you don't set your path in environmental > settings. > > Bottom line, for the teams I've managed: if you need it for cron to > work, explicitly state it. > > Stew > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stephen Tanner > Sent: Thursday, June 09, 2005 9:51 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > Exactly what do you mean by environment being the same? The startup > script works on this box if executed manually. The only thing that > could possibly change would be what is actually running at the time rc > starts stunnel and syslog-ng. I have place the startup script in rc2 > directly after inetd starts. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Hermann-Josef > Beckers > Sent: Thursday, June 09, 2005 9:47 AM > To: Syslog-ng users' and developers' mailing list > Subject: Antwort: RE: [syslog-ng] Syslog-ng with stunnel > > syslog-ng-bounces(a)lists.balabit.hu schrieb am 09.06.2005 15:32:38: > > > I have considered this. The only problem with this would be that I > can > > manually execute the script and everything starts up properly. It > only > > seems to barf when executed from rc on boot. > > > > --Stephen > > Did you check that the environment is exactly the same? > > Yours > hjb > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > >

1 0