- syslog-ng - lists.balabit.hu

$TEMPLATE available with unix-stream
by Loic SPINDLER 09 Aug '04

09 Aug '04

Unix stream users : I'd need to have syslog messages catched by the syslog-ng and forwarded to local daemon using unix-stream. Moreover, as I collect different facilities and level I'd like to ask syslog-ng to add to each line forwarded the $FACILITY to the beginning of the line. Is this now possible ? loic

2 1

program driver only works once
by David Schwendinger 06 Aug '04

06 Aug '04

All, I have a program driver setup in the syslog-ng.conf file to execute a perl script which sends an email with fixed content based on a syslog message. This first time I run syslog-ng with the program driver, syslog-ng and the script appear in a "ps -ef" listing as mentioned in the syslog-ng docs.: "NOTE: the program is executed once at startup, and kept running until SIGHUP or exit. The reason is to prevent starting up a large number of programs for messages, which would imply an easy DoS." The first time the conditions are met to send the email it works but the script which was listed with syslog-ng in a "ps-ef" no longer appears in a "ps -ef" and I can not seem to get it to start again. "service syslog-ng restart" or "stop" then "start" does not work. Reboot does not work. How can I get this script ready to send another alert after it has been triggered? The following are pertinent lines from the syslog-ng.conf file. source s_sys { unix-stream("/dev/log"); internal(); }; destination d_mail-me { program("/etc/syslog-ng/test-mail.script"); }; filter f_filter9 { match("for user"); }; log { source(s_sys); filter(f_filter9); destination(d_mail-me); }; thanks, David

1 0

leak in spoof_source support
by Balazs Scheidler 06 Aug '04

06 Aug '04

>Researching the problem we found out that it seems to be related to >the >"address spoofing" options. Enabling this option, under heavy traffic (which >means always, in our case) we experience this memory leak problem. >Disabling the address spoofing option, everything runs smoothly with only >about 720k memory occupation. > >The problem is "we need this option"... And this is getting critical, can >anyone hep? >Thanks, Hmm.. I possible forgot to free something in that path. I'll check it out for you. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 1

possibly missed mail
by Balazs Scheidler 06 Aug '04

06 Aug '04

hi, sorry, I haven't noticed our list manager put me to nomail mode. I quickly grepped through the last couple of mails in the archive, but if you think I missed something, please resend. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Newbie Filter question (Solaris)
by Kenneth Gullberg 06 Aug '04

06 Aug '04

Hi, Im new to syslogng and want to replace the normal syslogd in solaris with -ng because of the filters. I run postfix on 2 loadbalanced machines and i want to get rid of the healthchecks log entries. I setup a conf file that looks like this: options { long_hostnames(off); # doesn't actually help on Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(1); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(2048); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); }; ############################################################### source src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; ############################################################### destination alteon { file("/var/log/alteon"); }; destination notalteon { file("/var/log/notalteon"); }; destination ipf { file("/var/log/ipf.log"); }; ############################################################### filter f_mail { facility(mail); }; filter f_not_mail { not facility(mail); }; filter f_ipf { facility(local0); }; filter f_alteon { match("10.155.68.2") or match("10.155.68.3"); }; filter f_notalteon { not match("10.155.68.2") or not match("10.155.68.3"); }; ############################################################### log { source(src); filter(f_alteon); destination(alteon); }; log { source(src); filter(f_notalteon); destination(notalteon); }; log { source(src); filter(f_ipf); destination(ipf); }; According to this i should log everything that contains 10.155.68.2 or .3 to /var/log/alteon and if it doesnt contain .2 or .3 to /var/log/notalteon and it will also send the ip filter logs to its own log (which works). It seems that f_alteon och f_ipf works. But f_notalteon logs both stuff that does contain .2 and .3 and stuff that doesnt contain .2 and .3 What have i missed? // Kenneth

2 1

Problems compiling
by Nathaniel Hall 06 Aug '04

06 Aug '04

I am trying to install Syslog-NG on RH AS 3 Update 2. I have downloaded the syslog-ng gzips along with libol v 0.3.13. I ran configure, make, and install alright, but when I go to configure Syslog-ng, I get the following error. configure: error: Required libol version not found, make sure that your libol version is in the 0.3.x branch Any ideas? ~~~~~~~~~~~~~~~~~~~~~~~~~~ Nathaniel Hall Intrusion Detection and Firewall Technician Ozarks Technical Community College -- Office of Computer Networking halln(a)otc.edu 417-799-0552

2 2

Missing Log Entries under Load
by Tim Burress 06 Aug '04

06 Aug '04

Hello! Apparently this is sort of a FAQ, but despite wading through many Google searches, I haven't really found a good explanation or set of suggestions, so I thought I would post the question and then duck. We're running: syslog-ng 1.6.4 iptables v1.2.11-20040621 Linux 2.4.26 with iptables rules set up to log incoming connections. What we see is that, when we do a very fast port scan, the logs are very incomplete. For instance, in a scan of 440 ports, only about 210 entries appear in the logs. We also get a small number of corrupted log entries in our default messages file, where leading characters of the message appear to have been lost. We have our log sources set up as: source src { internal(); file("/proc/kmsg"); unix-stream ("/dev/log" max-connections(200)); unix-stream ("/var/log/snort/dev/log" max-connections(30)); }; Could someone explain, or point me to an explanation of, why these problems occur? It seems likely that the message corruption problem is due to wrap-around of the kernel message ring buffer. I suppose the missing messages could also be caused by that, however doubling the size of the buffer and rebuilding the kernel didn't seem to have any effect. And then, are there any suggestions for ways to tune the system so that a greater proportion of messages can be logged? We've tried tweaking the syslog-ng FIFO size and garbage collection parameters, but these, too, seemed to have little effect, at least in isolation. Any suggestions greatly appreciated! Thanks! Tim __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - 100MB free storage! http://promotions.yahoo.com/new_mail

1 0

Normalizing syslogs from FreeBSD and Solaris machines
by Ken McKittrick 05 Aug '04

05 Aug '04

Hello I can't seem to get syslog outputs from Postfix running on Solaris and FreeBSD servers to look the same. FreeBSD - Aug 5 11:14:43 69.67.254.17 postfix/smtp[80999]: 9FAA9EB760: to=<adams4(a)usadatanet.net>, relay=127.0.0.1[127.0.0.1], delay=1, status=sent (250 2.6.0 Ok, id=81995-01, from MTA: 250 Ok: queued as E16ECEB7CD) This corresponds to $DATE $HOST $MESSAGE, yes the postfix/smtp[80999] which would be $PROGRAM is actually part of the $MESSAGE. Solaris - Aug 5 11:16:06 69.67.254.10 postfix/smtp[10111]: [ID 197553 mail.info] B3391B26D: to=<taptoes(a)usadatanet.net>, relay=127.0.0.1[127.0.0.1], delay=2, status=sent (250 2.6.0 Ok, id=11585-10, from MTA: 250 Ok: queued as 9190DAE91) This corresponds to $DATE $PROGRAM $MESSAGE. Which is closer to what I would expect. My main problem is that Solaris stuffs the ID and facility.priority into the message itself. I've tried logging with defined message formats and that doesn't seem to help. So how can I gracefully removed the [ID xxxxxx Facility.Priority] from the message in the Solaris log lines? Thanks Ken McKittrick ISP Engineer USADatanet

2 3

syslog-ng 1.6.5 and libol 0.3.14
by Balazs Scheidler 05 Aug '04

05 Aug '04

hi, I have prepared a new syslog-ng release, found at the usual locations, http://www.balabit.hu/downloads/syslog-ng/ The summary of user-visible changes: News for the 1.6.5 release Thu, 05 Aug 2004 13:50:11 +0200 * cleaned up libol and syslog-ng compilation warnings and made configure.in/Makefile.am files autoconf2.50 compliant * fixed a BSD specific compilation problem * check if the UDP datagram ends in a NL or NUL character and strip that away if present -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

MORE: Syslog-ng unusual memory occupation
by G. C. 04 Aug '04

04 Aug '04

Researching the problem we found out that it seems to be related to the "address spoofing" options. Enabling this option, under heavy traffic (which means always, in our case) we experience this memory leak problem. Disabling the address spoofing option, everything runs smoothly with only about 720k memory occupation. The problem is "we need this option"... And this is getting critical, can anyone hep? Thanks, P. __________________________________ Hi, I'm using syslog-ng (1.6.4) on a RedHat Linux AS 3.0 and I'm experiencing a heavy memory occupation. Untill yesterday syslog-ng was using 1GB RAM, today I added 1 GB more and now it is using it too plus some swap (total 2.8 GB used. And it is growing...). I use this server for collecting logs from several hundreds network devices. The traffic collected is around 1GB/day and I save it to a text log file which is created and rotated daily. I cannot understand the reason, I tried to play with the garbage collection and fifo options but accomplished nothing. Any experience of such a behavior? Thanks in advance for your help, Peter. _________________________________________________________________ Add photos to your messages with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

1 0

Syslog-ng unusual memory occupation
by G. C. 02 Aug '04

02 Aug '04

Hi, I'm using syslog-ng (1.6.4) on a RedHat Linux AS 3.0 and I'm experiencing a heavy memory occupation. Untill yesterday syslog-ng was using 1GB RAM, today I added 1 GB more and now it is using it too plus some swap (total 2.8 GB used. And it is growing...). I use this server for collecting logs from several hundreds network devices. The traffic collected is around 1GB/day and I save it to a text log file which is created and rotated daily. I cannot understand the reason, I tried to play with the garbage collection and fifo options but accomplished nothing. Any experience of such a behavior? Thanks in advance for your help, Peter. _________________________________________________________________ The new MSN 8: smart spam protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0

RE: [syslog-ng]Sudden dead
by "Pedroche, Raúl" 02 Aug '04

02 Aug '04

Check whether you have a source that includes internal() and where is that source logged to. -----Original Message----- From: Francisco Javier Martinez Martinez [mailto:fjmartinez@csi.uned.es] Sent: Friday, July 30, 2004 11:38 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Sudden dead Hello world. I had installed syslog-ng 1.4.15 & libil 0.2.23 sometime ago in a red hat 7.2 box, it works fine as central logger for varius serevers some time, but suddenly it dead. When the daemon is started it show the literal Ok, but the truth is that there is no process running, if I run /etc/rc.d/initd/syslog-ng status it told me that is stopped but that there is a PID file, I didn`t know where syslog-ng log its own activity to be able to see what is wrong, any idea? thanks in advance. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

1 0

OpenBSD 3.5 not logging.. anything
by markzero＠logik.ath.cx 30 Jul '04

30 Jul '04

I have sandboxed Syslog-ng on OpenBSD 3.5. It doesn't appear to be logging anything other than itself. # ls -al /dev/log sr-Sr-S--- 1 _syslogng _syslogng 0 Jul 30 22:50 /dev/log # ls -al /var/log/ total 156 drwx------ 2 _syslogng _syslogng 512 Jul 30 22:36 . drwxr-xr-x 20 root wheel 512 Jul 28 11:21 .. -rw-r----- 1 _syslogng _syslogng 566 Jul 30 22:50 all.log -rw-r----- 1 _syslogng _syslogng 586 Jul 28 11:20 authlog -rw-r----- 1 _syslogng _syslogng 45 Jul 28 11:15 daemon -rw-r----- 1 _syslogng _syslogng 22685 Jul 30 22:50 debug -rw------- 1 _syslogng _syslogng 304 Jul 28 13:30 failedlogin -rw-r----- 1 _syslogng _syslogng 0 Mar 29 19:47 ftpd -rw-r----- 1 _syslogng _syslogng 268536 Jul 30 22:36 lastlog -rw-r----- 1 _syslogng _syslogng 0 Mar 29 19:47 lpd-errs -rw------- 1 _syslogng _syslogng 415 Jul 28 11:30 maillog -rw-r----- 1 _syslogng _syslogng 33733 Jul 30 22:50 messages -rw------- 1 _syslogng _syslogng 0 Mar 29 19:47 secure -rw-r----- 1 _syslogng _syslogng 22685 Jul 30 22:50 syslog -rw-r----- 1 _syslogng _syslogng 9600 Jul 30 22:46 wtmp -rw-r--r-- 1 _syslogng _syslogng 147 Jul 28 11:49 wtmp.0.gz -rw-r----- 1 _syslogng _syslogng 0 Mar 29 19:47 xferlog and my config file: # $Xanthus: syslog-ng.conf,v 1.1 2004/07/27 02:56:44 markzero Exp $ # syslog-ng config # options { long_hostnames(off); owner(_syslogng); group(_syslogng); perm(0640); dir_owner(_syslogng); dir_group(_syslogng); dir_perm(0640); sync(0); }; source src { unix-stream("/dev/log" owner("_syslogng") group("_syslogng") perm(06440)); internal(); }; destination all { file("/var/log/all.log"); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination mail { file("/var/log/mail.log"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; #destination loghost { udp("loghost" port(999)); }; filter test { level(debug..emerg); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(test); destination(all); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); destination(console_all); }; -although this config is theoretical, it's not one I plan on using in production (hence the (all) destination). The contents of the log files in /var/log include: STATS: dropped 0 syslog-ng version 1.5.24 going down syslog-ng version 1.5.24 starting ..and not a lot else. I've tried generating alerts with the 'logger' command, as well as deliberately typing in the wrong password to su, attempting to login as root over ssh and sending lots of mail to nonexistant users on my system. No logs of any kind are generated. I don't get any errors, where do I go from here? mark

1 0

RE: [syslog-ng]Problem with syslog-ng on OpenBSD 3.5 Sparc64
by Coward, Robert (Contractor) 30 Jul '04

30 Jul '04

Here is a copy of my conf file. I also noted today that if I start the daemon by hand the error did not show up. The connection is mad to a port on localhost which is then forwarded to the main log server via stunnel. This same config works with OpenBSD 3.4 Sparc 64. options { keep_hostname(yes); sync(0); log_fifo_size(1024); stats(36000); }; source localhost { unix-dgram("/dev/log"); internal(); }; destination localhost@chrome { file("/var/log/syslog-ng.all"); }; destination loghost@phantom { tcp("localhost" port(5141)); }; filter f_no_stats { not match("STATS: dropped 0"); }; # (src + dst [+ filters] = logging) log { source(localhost); filter(f_no_stats); destination(localhost@chrome); source(localhost); filter(f_no_stats); destination(loghost@phantom); }; Its very simple no bells and whistles. --- 30 July 2004 "I fought the Dharma, and the Dharma won." (Allen Ginsberg) --- Robert V. Coward UNIX System Administrator Computer Science Corporation

1 0

Problem with syslog-ng on OpenBSD 3.5 Sparc64
by Coward, Robert (Contractor) 30 Jul '04

30 Jul '04

I recently upgraded to OpenBSD version 3.5 Sparc64. I installed syslog-ng version 1.5.24 from the OpenBSD ports tree. The install went fine and there were no errors. I substituted the line in /etc/rc that normally starts syslogd for /usr/local/sbin/syslog-ng. On boot up it starts fine. However after the system comes up all entries to the log are proceeded with the following entry: syslog-ng[18782]: io.c: sockaddr2info(): Unsupported address family 110 (addrlen=256). I did some googling and the only refernces i can find about this, concerns a kernel error in a much earlier release in OpenBSD. I've been playing with it to see if I can determine why the error comes up to no avail. Has anyone seen anything like this? --- 30 July 2004 "Theology, by diverting the attention of men from this life to another, and by endeavoring to coerce all men into one religion, constantly preaching that this world is full of misery, but the next world would be beautiful -- or not, as the case may be -- has forced on men the thought of fear where otherwise there might have been the happy abandon of nature." (Elbert Hubbard, 1856-1915) --- Robert V. Coward UNIX System Administrator Computer Science Corporation

2 1

Sudden dead
by Francisco Javier Martinez Martinez 30 Jul '04

30 Jul '04

Hello world. I had installed syslog-ng 1.4.15 & libil 0.2.23 sometime ago in a red hat 7.2 box, it works fine as central logger for varius serevers some time, but suddenly it dead. When the daemon is started it show the literal Ok, but the truth is that there is no process running, if I run /etc/rc.d/initd/syslog-ng status it told me that is stopped but that there is a PID file, I didn`t know where syslog-ng log its own activity to be able to see what is wrong, any idea? thanks in advance.

1 0

can't determine log directory with ISO-8859-1 chars
by Kerese Peter 29 Jul '04

29 Jul '04

Hello ! I got a debian sarge server logging all boxes around here using syslog-ng 1.5.15-1.1 via tcp sockets. Logfiles are determinated this way: "$HOST-$MONTH-$DAY.log". Everything works fine except one server which have LC_ALL="hu_HU" (no way to change it). This one sends su session opening events with national letters like ju'l,ma'j,etc. Logfiles are determinated this way: "$HOST-$MONTH-$DAY.log" As it seems syslog-ng can't handle it - it pushes these entries into a false logfile usually int $HOST-12-31.log. I have read the documentation,FAQ, googled (:>) it but can't find anything. Any idea,please? Regards, -- Peter dove(a)koli.rulez.org

1 0

Re: success: syslog-ng on OSX 10.3.4
by Ken Toney 27 Jul '04

27 Jul '04

On Jul 26, 2004, at 3:03 PM, OpenMacNews wrote: > you've not set your path to INCLUDE "/usr/local/bin" > > from your config.log: > > PATH: /sw/bin > PATH: /sw/sbin > PATH: /bin > PATH: /sbin > PATH: /usr/bin > PATH: /usr/sbin > > you'll need to set your ENV vars to properly reflect your dev env. > > richard Okay, so I set my ENV variables and it configured successfully. Then when I run make I error out again. This is the output. Trying to understand the output, I verified that libol is installed in /usr/local/include. Sorry for so many questions but I'm new to this. Thanks for all of you help. Ken ******************************** Making all in src make all-recursive Making all in . gcc -DHAVE_CONFIG_H -I. -I/Users/xxx/Desktop/syslog-ng-1.6.4/src -I. -W -Wno-unused -g -DYYDEBUG -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c macros.c macros.c: In function `append_string': macros.c:84: warning: comparison between signed and unsigned macros.c:84: warning: signed and unsigned type in conditional expression macros.c: In function `format_tzofs': macros.c:118: error: `tm' undeclared (first use in this function) macros.c:118: error: (Each undeclared identifier is reported only once macros.c:118: error: for each function it appears in.) macros.c: In function `expand_macro': macros.c:385: warning: comparison between signed and unsigned In file included from macros.c:527: macros-gperf.c: In function `find_macro': macros-gperf.c:119: warning: missing initializer macros-gperf.c:119: warning: (near initialization for `wordlist[0].id') macros-gperf.c:119: warning: missing initializer macros-gperf.c:119: warning: (near initialization for `wordlist[1].id') macros-gperf.c:120: warning: missing initializer macros-gperf.c:120: warning: (near initialization for `wordlist[2].len') macros-gperf.c:121: warning: missing initializer macros-gperf.c:121: warning: (near initialization for `wordlist[3].id') macros-gperf.c:122: warning: missing initializer macros-gperf.c:122: warning: (near initialization for `wordlist[4].len') macros-gperf.c:123: warning: missing initializer macros-gperf.c:123: warning: (near initialization for `wordlist[5].id') macros-gperf.c:123: warning: missing initializer macros-gperf.c:123: warning: (near initialization for `wordlist[6].id') macros-gperf.c:123: warning: missing initializer macros-gperf.c:123: warning: (near initialization for `wordlist[7].id') macros-gperf.c:124: warning: missing initializer macros-gperf.c:124: warning: (near initialization for `wordlist[8].len') macros-gperf.c:125: warning: missing initializer macros-gperf.c:125: warning: (near initialization for `wordlist[9].len') macros-gperf.c:126: warning: missing initializer macros-gperf.c:126: warning: (near initialization for `wordlist[10].len') macros-gperf.c:127: warning: missing initializer macros-gperf.c:127: warning: (near initialization for `wordlist[11].id') macros-gperf.c:128: warning: missing initializer macros-gperf.c:128: warning: (near initialization for `wordlist[12].len') macros-gperf.c:129: warning: missing initializer macros-gperf.c:129: warning: (near initialization for `wordlist[13].id') macros-gperf.c:130: warning: missing initializer macros-gperf.c:130: warning: (near initialization for `wordlist[14].len') macros-gperf.c:131: warning: missing initializer macros-gperf.c:131: warning: (near initialization for `wordlist[15].len') macros-gperf.c:132: warning: missing initializer macros-gperf.c:132: warning: (near initialization for `wordlist[16].id') macros-gperf.c:133: warning: missing initializer macros-gperf.c:133: warning: (near initialization for `wordlist[17].len') macros-gperf.c:134: warning: missing initializer macros-gperf.c:134: warning: (near initialization for `wordlist[18].id') macros-gperf.c:135: warning: missing initializer macros-gperf.c:135: warning: (near initialization for `wordlist[19].len') macros-gperf.c:136: warning: missing initializer macros-gperf.c:136: warning: (near initialization for `wordlist[20].len') macros-gperf.c:137: warning: missing initializer macros-gperf.c:137: warning: (near initialization for `wordlist[21].len') macros-gperf.c:138: warning: missing initializer macros-gperf.c:138: warning: (near initialization for `wordlist[22].len') macros-gperf.c:139: warning: missing initializer macros-gperf.c:139: warning: (near initialization for `wordlist[23].len') macros-gperf.c:140: warning: missing initializer macros-gperf.c:140: warning: (near initialization for `wordlist[24].len') macros-gperf.c:141: warning: missing initializer macros-gperf.c:141: warning: (near initialization for `wordlist[25].len') macros-gperf.c:142: warning: missing initializer macros-gperf.c:142: warning: (near initialization for `wordlist[26].len') macros-gperf.c:143: warning: missing initializer macros-gperf.c:143: warning: (near initialization for `wordlist[27].id') macros-gperf.c:144: warning: missing initializer macros-gperf.c:144: warning: (near initialization for `wordlist[28].len') macros-gperf.c:145: warning: missing initializer macros-gperf.c:145: warning: (near initialization for `wordlist[29].len') macros-gperf.c:146: warning: missing initializer macros-gperf.c:146: warning: (near initialization for `wordlist[30].len') macros-gperf.c:147: warning: missing initializer macros-gperf.c:147: warning: (near initialization for `wordlist[31].len') macros-gperf.c:148: warning: missing initializer macros-gperf.c:148: warning: (near initialization for `wordlist[32].id') macros-gperf.c:149: warning: missing initializer macros-gperf.c:149: warning: (near initialization for `wordlist[33].len') macros-gperf.c:150: warning: missing initializer macros-gperf.c:150: warning: (near initialization for `wordlist[34].len') macros-gperf.c:151: warning: missing initializer macros-gperf.c:151: warning: (near initialization for `wordlist[35].len') macros-gperf.c:152: warning: missing initializer macros-gperf.c:152: warning: (near initialization for `wordlist[36].len') macros-gperf.c:153: warning: missing initializer macros-gperf.c:153: warning: (near initialization for `wordlist[37].id') macros-gperf.c:154: warning: missing initializer macros-gperf.c:154: warning: (near initialization for `wordlist[38].len') macros-gperf.c:155: warning: missing initializer macros-gperf.c:155: warning: (near initialization for `wordlist[39].len') macros-gperf.c:156: warning: missing initializer macros-gperf.c:156: warning: (near initialization for `wordlist[40].len') macros-gperf.c:157: warning: missing initializer macros-gperf.c:157: warning: (near initialization for `wordlist[41].id') macros-gperf.c:158: warning: missing initializer macros-gperf.c:158: warning: (near initialization for `wordlist[42].len') macros-gperf.c:159: warning: missing initializer macros-gperf.c:159: warning: (near initialization for `wordlist[43].len') macros-gperf.c:160: warning: missing initializer macros-gperf.c:160: warning: (near initialization for `wordlist[44].len') macros-gperf.c:161: warning: missing initializer macros-gperf.c:161: warning: (near initialization for `wordlist[45].len') macros-gperf.c:162: warning: missing initializer macros-gperf.c:162: warning: (near initialization for `wordlist[46].id') macros-gperf.c:163: warning: missing initializer macros-gperf.c:163: warning: (near initialization for `wordlist[47].len') macros-gperf.c:164: warning: missing initializer macros-gperf.c:164: warning: (near initialization for `wordlist[48].id') macros-gperf.c:165: warning: missing initializer macros-gperf.c:165: warning: (near initialization for `wordlist[49].len') macros-gperf.c:166: warning: missing initializer macros-gperf.c:166: warning: (near initialization for `wordlist[50].len') macros-gperf.c:167: warning: missing initializer macros-gperf.c:167: warning: (near initialization for `wordlist[51].id') macros-gperf.c:168: warning: missing initializer macros-gperf.c:168: warning: (near initialization for `wordlist[52].len') macros-gperf.c:169: warning: missing initializer macros-gperf.c:169: warning: (near initialization for `wordlist[53].len') macros-gperf.c:170: warning: missing initializer macros-gperf.c:170: warning: (near initialization for `wordlist[54].id') macros-gperf.c:170: warning: missing initializer macros-gperf.c:170: warning: (near initialization for `wordlist[55].id') macros-gperf.c:170: warning: missing initializer macros-gperf.c:170: warning: (near initialization for `wordlist[56].id') macros-gperf.c:171: warning: missing initializer macros-gperf.c:171: warning: (near initialization for `wordlist[57].len') macros-gperf.c:172: warning: missing initializer macros-gperf.c:172: warning: (near initialization for `wordlist[58].len') macros-gperf.c:173: warning: missing initializer macros-gperf.c:173: warning: (near initialization for `wordlist[59].id') macros-gperf.c:173: warning: missing initializer macros-gperf.c:173: warning: (near initialization for `wordlist[60].id') macros-gperf.c:173: warning: missing initializer macros-gperf.c:173: warning: (near initialization for `wordlist[61].id') macros-gperf.c:173: warning: missing initializer macros-gperf.c:173: warning: (near initialization for `wordlist[62].id') macros-gperf.c:174: warning: missing initializer macros-gperf.c:174: warning: (near initialization for `wordlist[63].len') macros-gperf.c:175: warning: missing initializer macros-gperf.c:175: warning: (near initialization for `wordlist[64].len') macros-gperf.c:176: warning: missing initializer macros-gperf.c:176: warning: (near initialization for `wordlist[65].len') macros-gperf.c:177: warning: missing initializer macros-gperf.c:177: warning: (near initialization for `wordlist[66].len') macros-gperf.c:178: warning: missing initializer macros-gperf.c:178: warning: (near initialization for `wordlist[67].id') macros-gperf.c:179: warning: missing initializer macros-gperf.c:179: warning: (near initialization for `wordlist[68].len') macros-gperf.c:180: warning: missing initializer macros-gperf.c:180: warning: (near initialization for `wordlist[69].id') macros-gperf.c:181: warning: missing initializer macros-gperf.c:181: warning: (near initialization for `wordlist[70].len') macros-gperf.c:182: warning: missing initializer macros-gperf.c:182: warning: (near initialization for `wordlist[71].len') macros-gperf.c:183: warning: missing initializer macros-gperf.c:183: warning: (near initialization for `wordlist[72].id') macros-gperf.c:184: warning: missing initializer macros-gperf.c:184: warning: (near initialization for `wordlist[73].len') macros-gperf.c:185: warning: missing initializer macros-gperf.c:185: warning: (near initialization for `wordlist[74].id') macros-gperf.c:186: warning: missing initializer macros-gperf.c:186: warning: (near initialization for `wordlist[75].len') macros-gperf.c:187: warning: missing initializer macros-gperf.c:187: warning: (near initialization for `wordlist[76].id') macros-gperf.c:187: warning: missing initializer macros-gperf.c:187: warning: (near initialization for `wordlist[77].id') macros-gperf.c:188: warning: missing initializer macros-gperf.c:188: warning: (near initialization for `wordlist[78].len') macros-gperf.c:189: warning: missing initializer macros-gperf.c:189: warning: (near initialization for `wordlist[79].id') macros-gperf.c:190: warning: missing initializer macros-gperf.c:190: warning: (near initialization for `wordlist[80].len') macros-gperf.c:191: warning: missing initializer macros-gperf.c:191: warning: (near initialization for `wordlist[81].id') macros-gperf.c:191: warning: missing initializer macros-gperf.c:191: warning: (near initialization for `wordlist[82].id') macros-gperf.c:191: warning: missing initializer macros-gperf.c:191: warning: (near initialization for `wordlist[83].id') macros-gperf.c:191: warning: missing initializer macros-gperf.c:191: warning: (near initialization for `wordlist[84].id') macros-gperf.c:192: warning: missing initializer macros-gperf.c:192: warning: (near initialization for `wordlist[85].len') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[86].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[87].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[88].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[89].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[90].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[91].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[92].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[93].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[94].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[95].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[96].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[97].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[98].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[99].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[100].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[101].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[102].id') macros-gperf.c:195: warning: missing initializer macros-gperf.c:195: warning: (near initialization for `wordlist[103].len') make[3]: *** [macros.o] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive-am] Error 2 make: *** [all-recursive] Error 1

2 1

RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers
by Amaral, Angelo 27 Jul '04

27 Jul '04

Ted I look in my configuration: $ strings /usr/lib/libwrap.a | grep twist twist twist %s to %s twist_option: dup: %m twist_option: /bin/sh: %m twist option in resident process twist_option But in my Linux Redhat 3.1AS, tcpwrappers don´t work. Please dou you help me. Thanks, Angelo Amaral -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Rule, Ted Sent: terça-feira, 27 de julho de 2004 10:00 To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers An odd thing showed up on some of my Solaris boxes the other day, which might be pertinent. Does the libwrap library definitely support :deny in the allow file? This is dependent on the library's compile time options, but may be checked with strings libwrap.so | grep twist For :deny support to exist in the library, there must be references to twist in the library. e.g.: $ strings /usr/lib/libwrap.a | grep twist twist twist option in resident process twist %s to %s twist_option: dup: %m twist_option: /bin/sh: %m twist_option $ If there are no twist references, :deny cant be used in /etc/hosts.allow, but it's much worse than that. If :deny appears in the allow file on a twistless library, the library interprets /etc/hosts.allow as if you'd said :allow. Ouch. It all boils down to use of -DPROCESS_OPTIONS at library compile time. Ted > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Amaral, Angelo > Sent: Tuesday July 27 2004 13:49 > To: syslog-ng(a)lists.balabit.hu > Subject: RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers > > Thanks, Musashino-shi. > > But, I don´t make syslog-ng works with tcpwrappers. > > > ************************************************************** > ******************************************* > I show how I compile my syslog-ng: > > 1- Intall libnet (libnet-1.1.2.1-2.fc2.i386.rpm) in my linux > RedHat 3.1AS. > > 2- Compile syslog-ng: > # ./configure --enable-tcp-wrapper --enable-sp > oof-source > loading cache ./config.cache > checking for a BSD compatible install... (cached) /usr/bin/install -c > checking whether build environment is sane... yes > checking whether make sets ${MAKE}... (cached) yes > checking for working aclocal-1.4... found > checking for working autoconf... found > checking for working automake-1.4... found > checking for working autoheader... found > checking for working makeinfo... found > checking whether build environment is sane... yes > checking for gcc... (cached) gcc > checking whether the C compiler (gcc ) works... yes > checking whether the C compiler (gcc ) is a cross-compiler... no > checking whether we are using GNU C... (cached) yes > checking whether gcc accepts -g... (cached) yes > checking for gcc option to accept ANSI C... (cached) none needed > checking for bison... (cached) bison -y > checking how to run the C preprocessor... (cached) gcc -E > checking for flex... (cached) flex > checking for flex... (cached) flex > checking for yywrap in -lfl... (cached) yes > checking lex output file root... (cached) lex.yy > checking whether yytext is a pointer... (cached) yes > checking whether make sets ${MAKE}... (cached) yes > checking for ANSI C header files... (cached) yes > checking for malloc.h... (cached) yes > checking for unistd.h... (cached) yes > checking for door.h... (cached) no > checking for stropts.h... (cached) yes > checking for sys/strlog.h... (cached) no > checking for stdarg.h... (cached) yes > checking for sys/klog.h... (cached) yes > checking for arpa/nameser.h... (cached) yes > checking for tcpd.h... (cached) yes > checking for working const... (cached) yes > checking whether time.h and sys/time.h may both be > included... (cached) yes > checking for modern utmp... (cached) yes > checking for global timezone variable... (cached) yes > checking size of short... (cached) 2 > checking size of int... (cached) 4 > checking size of long... (cached) 4 > checking for I_CONSLOG... (cached) no > checking for O_LARGEFILE... (cached) yes > checking for res_init in <resolv.h>... (cached) yes > checking for working alloca.h... (cached) yes > checking for alloca... (cached) yes > checking for vprintf... (cached) yes > checking for res_init in -lresolv... (cached) no > checking for __res_init in -lresolv... (cached) yes > checking for door_create in -ldoor... (cached) no > checking for socket in -lsocket... (cached) no > checking for gethostbyname in -lnsl... (cached) yes > checking for select... (cached) yes > checking for snprintf... (cached) yes > checking for vsnprintf... (cached) yes > checking for strerror... (cached) yes > checking for inet_aton... (cached) yes > checking for strncpy... (cached) yes > checking for getutent... (cached) yes > checking for getopt_long... (cached) yes > checking for strcasecmp... (cached) yes > checking for strptime... (cached) yes > checking for TCP wrapper library... (cached) -lwrap > checking whether to enable Sun STREAMS support... no > checking whether to enable Sun door support... no > checking whether to enable TCP wrapper support... yes > checking whether to enable spoof_source support... yes > checking libol version >= 0.3.13... ok > creating ./config.status > creating Makefile > creating src/Makefile > creating src/tests/Makefile > creating doc/Makefile > creating doc/sgml/Makefile > creating contrib/Makefile > creating syslog-ng.spec > creating src/config.h > src/config.h is unchanged > > 3- Look ldd: > # ldd /usr/local/sbin/syslog-ng > libnsl.so.1 => /lib/libnsl.so.1 (0xb75c7000) > libresolv.so.2 => /lib/libresolv.so.2 (0xb75b5000) > libwrap.so.0 => /usr/lib/libwrap.so.0 (0xb75ac000) > libc.so.6 => /lib/tls/libc.so.6 (0xb7475000) > /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0xb75eb000) > > ************************************************************** > ******************************************* > > And the configuration continue not working. > May you help me, please. > > Thanks. > > Angelo Amaral > > > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of michihito > matsubara > Sent: sábado, 24 de julho de 2004 00:01 > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers > > > Angelo > > On Thu, 22 Jul 2004 11:10:40 -0300 > Subject: RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers > "Amaral, Angelo" <angelo.amaral(a)hp.com> wrote: > > Another senario. > Have you ever run ldd against syslog-ng itself? > This will show how syslog-ng linked against libwrap library or not. > > On my Linux box, > > $ ldd /sbin/syslog-ng > libnsl.so.1 => /lib/libnsl.so.1 (0x40020000) > libresolv.so.2 => /lib/libresolv.so.2 (0x40034000) > libwrap.so.0 => /usr/lib/libwrap.so.0 (0x40044000) > libnet.so.2 => /usr/lib/libnet1/libnet.so.2 (0x4004c000) > libc.so.6 => /lib/libc.so.6 (0x4005e000) > /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) > > And, on my FreeBSD box, > > % ldd /usr/local/sbin/syslog-ng > /usr/local/sbin/syslog-ng: > libwrap.so.3 => /usr/lib/libwrap.so.3 (0x2807c000) > libc.so.4 => /usr/lib/libc.so.4 (0x28084000) > > > HTH > mitch > > > > Andrew, > > > > I put in my system, the hosts.allow below: > > > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > ++++++++++++++++ > > > > # hosts.allow This file describes the names of the hosts which are > > # allowed to use the local INET services, as decided > > # by the '/usr/sbin/tcpd' server. > > # > > > > in.tftpd: ALL :allow > > sshd: ALL :allow > > ALL: ALL :deny > > > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > ++++++++++++++++ > > > > And the configuration continue not working. > > May you help me, please. > > > > Thanks. > > -- > Musashino-shi, Tokyo, Japan > K12LTSP in Japanese ; http://open-mitch.dyndns.org/k12ltsp/ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers
by Rule, Ted 27 Jul '04

27 Jul '04

An odd thing showed up on some of my Solaris boxes the other day, which might be pertinent. Does the libwrap library definitely support :deny in the allow file? This is dependent on the library's compile time options, but may be checked with strings libwrap.so | grep twist For :deny support to exist in the library, there must be references to twist in the library. e.g.: $ strings /usr/lib/libwrap.a | grep twist twist twist option in resident process twist %s to %s twist_option: dup: %m twist_option: /bin/sh: %m twist_option $ If there are no twist references, :deny cant be used in /etc/hosts.allow, but it's much worse than that. If :deny appears in the allow file on a twistless library, the library interprets /etc/hosts.allow as if you'd said :allow. Ouch. It all boils down to use of -DPROCESS_OPTIONS at library compile time. Ted > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Amaral, Angelo > Sent: Tuesday July 27 2004 13:49 > To: syslog-ng(a)lists.balabit.hu > Subject: RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers > > Thanks, Musashino-shi. > > But, I don´t make syslog-ng works with tcpwrappers. > > > ************************************************************** > ******************************************* > I show how I compile my syslog-ng: > > 1- Intall libnet (libnet-1.1.2.1-2.fc2.i386.rpm) in my linux > RedHat 3.1AS. > > 2- Compile syslog-ng: > # ./configure --enable-tcp-wrapper --enable-sp > oof-source > loading cache ./config.cache > checking for a BSD compatible install... (cached) /usr/bin/install -c > checking whether build environment is sane... yes > checking whether make sets ${MAKE}... (cached) yes > checking for working aclocal-1.4... found > checking for working autoconf... found > checking for working automake-1.4... found > checking for working autoheader... found > checking for working makeinfo... found > checking whether build environment is sane... yes > checking for gcc... (cached) gcc > checking whether the C compiler (gcc ) works... yes > checking whether the C compiler (gcc ) is a cross-compiler... no > checking whether we are using GNU C... (cached) yes > checking whether gcc accepts -g... (cached) yes > checking for gcc option to accept ANSI C... (cached) none needed > checking for bison... (cached) bison -y > checking how to run the C preprocessor... (cached) gcc -E > checking for flex... (cached) flex > checking for flex... (cached) flex > checking for yywrap in -lfl... (cached) yes > checking lex output file root... (cached) lex.yy > checking whether yytext is a pointer... (cached) yes > checking whether make sets ${MAKE}... (cached) yes > checking for ANSI C header files... (cached) yes > checking for malloc.h... (cached) yes > checking for unistd.h... (cached) yes > checking for door.h... (cached) no > checking for stropts.h... (cached) yes > checking for sys/strlog.h... (cached) no > checking for stdarg.h... (cached) yes > checking for sys/klog.h... (cached) yes > checking for arpa/nameser.h... (cached) yes > checking for tcpd.h... (cached) yes > checking for working const... (cached) yes > checking whether time.h and sys/time.h may both be > included... (cached) yes > checking for modern utmp... (cached) yes > checking for global timezone variable... (cached) yes > checking size of short... (cached) 2 > checking size of int... (cached) 4 > checking size of long... (cached) 4 > checking for I_CONSLOG... (cached) no > checking for O_LARGEFILE... (cached) yes > checking for res_init in <resolv.h>... (cached) yes > checking for working alloca.h... (cached) yes > checking for alloca... (cached) yes > checking for vprintf... (cached) yes > checking for res_init in -lresolv... (cached) no > checking for __res_init in -lresolv... (cached) yes > checking for door_create in -ldoor... (cached) no > checking for socket in -lsocket... (cached) no > checking for gethostbyname in -lnsl... (cached) yes > checking for select... (cached) yes > checking for snprintf... (cached) yes > checking for vsnprintf... (cached) yes > checking for strerror... (cached) yes > checking for inet_aton... (cached) yes > checking for strncpy... (cached) yes > checking for getutent... (cached) yes > checking for getopt_long... (cached) yes > checking for strcasecmp... (cached) yes > checking for strptime... (cached) yes > checking for TCP wrapper library... (cached) -lwrap > checking whether to enable Sun STREAMS support... no > checking whether to enable Sun door support... no > checking whether to enable TCP wrapper support... yes > checking whether to enable spoof_source support... yes > checking libol version >= 0.3.13... ok > creating ./config.status > creating Makefile > creating src/Makefile > creating src/tests/Makefile > creating doc/Makefile > creating doc/sgml/Makefile > creating contrib/Makefile > creating syslog-ng.spec > creating src/config.h > src/config.h is unchanged > > 3- Look ldd: > # ldd /usr/local/sbin/syslog-ng > libnsl.so.1 => /lib/libnsl.so.1 (0xb75c7000) > libresolv.so.2 => /lib/libresolv.so.2 (0xb75b5000) > libwrap.so.0 => /usr/lib/libwrap.so.0 (0xb75ac000) > libc.so.6 => /lib/tls/libc.so.6 (0xb7475000) > /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0xb75eb000) > > ************************************************************** > ******************************************* > > And the configuration continue not working. > May you help me, please. > > Thanks. > > Angelo Amaral > > > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of michihito > matsubara > Sent: sábado, 24 de julho de 2004 00:01 > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers > > > Angelo > > On Thu, 22 Jul 2004 11:10:40 -0300 > Subject: RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers > "Amaral, Angelo" <angelo.amaral(a)hp.com> wrote: > > Another senario. > Have you ever run ldd against syslog-ng itself? > This will show how syslog-ng linked against libwrap library or not. > > On my Linux box, > > $ ldd /sbin/syslog-ng > libnsl.so.1 => /lib/libnsl.so.1 (0x40020000) > libresolv.so.2 => /lib/libresolv.so.2 (0x40034000) > libwrap.so.0 => /usr/lib/libwrap.so.0 (0x40044000) > libnet.so.2 => /usr/lib/libnet1/libnet.so.2 (0x4004c000) > libc.so.6 => /lib/libc.so.6 (0x4005e000) > /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) > > And, on my FreeBSD box, > > % ldd /usr/local/sbin/syslog-ng > /usr/local/sbin/syslog-ng: > libwrap.so.3 => /usr/lib/libwrap.so.3 (0x2807c000) > libc.so.4 => /usr/lib/libc.so.4 (0x28084000) > > > HTH > mitch > > > > Andrew, > > > > I put in my system, the hosts.allow below: > > > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > ++++++++++++++++ > > > > # hosts.allow This file describes the names of the hosts which are > > # allowed to use the local INET services, as decided > > # by the '/usr/sbin/tcpd' server. > > # > > > > in.tftpd: ALL :allow > > sshd: ALL :allow > > ALL: ALL :deny > > > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > ++++++++++++++++ > > > > And the configuration continue not working. > > May you help me, please. > > > > Thanks. > > -- > Musashino-shi, Tokyo, Japan > K12LTSP in Japanese ; http://open-mitch.dyndns.org/k12ltsp/ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers
by Amaral, Angelo 27 Jul '04

27 Jul '04

Thanks, Musashino-shi. But, I don´t make syslog-ng works with tcpwrappers. ********************************************************************************************************* I show how I compile my syslog-ng: 1- Intall libnet (libnet-1.1.2.1-2.fc2.i386.rpm) in my linux RedHat 3.1AS. 2- Compile syslog-ng: # ./configure --enable-tcp-wrapper --enable-sp oof-source loading cache ./config.cache checking for a BSD compatible install... (cached) /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... (cached) yes checking for working aclocal-1.4... found checking for working autoconf... found checking for working automake-1.4... found checking for working autoheader... found checking for working makeinfo... found checking whether build environment is sane... yes checking for gcc... (cached) gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ANSI C... (cached) none needed checking for bison... (cached) bison -y checking how to run the C preprocessor... (cached) gcc -E checking for flex... (cached) flex checking for flex... (cached) flex checking for yywrap in -lfl... (cached) yes checking lex output file root... (cached) lex.yy checking whether yytext is a pointer... (cached) yes checking whether make sets ${MAKE}... (cached) yes checking for ANSI C header files... (cached) yes checking for malloc.h... (cached) yes checking for unistd.h... (cached) yes checking for door.h... (cached) no checking for stropts.h... (cached) yes checking for sys/strlog.h... (cached) no checking for stdarg.h... (cached) yes checking for sys/klog.h... (cached) yes checking for arpa/nameser.h... (cached) yes checking for tcpd.h... (cached) yes checking for working const... (cached) yes checking whether time.h and sys/time.h may both be included... (cached) yes checking for modern utmp... (cached) yes checking for global timezone variable... (cached) yes checking size of short... (cached) 2 checking size of int... (cached) 4 checking size of long... (cached) 4 checking for I_CONSLOG... (cached) no checking for O_LARGEFILE... (cached) yes checking for res_init in <resolv.h>... (cached) yes checking for working alloca.h... (cached) yes checking for alloca... (cached) yes checking for vprintf... (cached) yes checking for res_init in -lresolv... (cached) no checking for __res_init in -lresolv... (cached) yes checking for door_create in -ldoor... (cached) no checking for socket in -lsocket... (cached) no checking for gethostbyname in -lnsl... (cached) yes checking for select... (cached) yes checking for snprintf... (cached) yes checking for vsnprintf... (cached) yes checking for strerror... (cached) yes checking for inet_aton... (cached) yes checking for strncpy... (cached) yes checking for getutent... (cached) yes checking for getopt_long... (cached) yes checking for strcasecmp... (cached) yes checking for strptime... (cached) yes checking for TCP wrapper library... (cached) -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... yes checking whether to enable spoof_source support... yes checking libol version >= 0.3.13... ok creating ./config.status creating Makefile creating src/Makefile creating src/tests/Makefile creating doc/Makefile creating doc/sgml/Makefile creating contrib/Makefile creating syslog-ng.spec creating src/config.h src/config.h is unchanged 3- Look ldd: # ldd /usr/local/sbin/syslog-ng libnsl.so.1 => /lib/libnsl.so.1 (0xb75c7000) libresolv.so.2 => /lib/libresolv.so.2 (0xb75b5000) libwrap.so.0 => /usr/lib/libwrap.so.0 (0xb75ac000) libc.so.6 => /lib/tls/libc.so.6 (0xb7475000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0xb75eb000) ********************************************************************************************************* And the configuration continue not working. May you help me, please. Thanks. Angelo Amaral -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of michihito matsubara Sent: sábado, 24 de julho de 2004 00:01 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers Angelo On Thu, 22 Jul 2004 11:10:40 -0300 Subject: RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers "Amaral, Angelo" <angelo.amaral(a)hp.com> wrote: Another senario. Have you ever run ldd against syslog-ng itself? This will show how syslog-ng linked against libwrap library or not. On my Linux box, $ ldd /sbin/syslog-ng libnsl.so.1 => /lib/libnsl.so.1 (0x40020000) libresolv.so.2 => /lib/libresolv.so.2 (0x40034000) libwrap.so.0 => /usr/lib/libwrap.so.0 (0x40044000) libnet.so.2 => /usr/lib/libnet1/libnet.so.2 (0x4004c000) libc.so.6 => /lib/libc.so.6 (0x4005e000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) And, on my FreeBSD box, % ldd /usr/local/sbin/syslog-ng /usr/local/sbin/syslog-ng: libwrap.so.3 => /usr/lib/libwrap.so.3 (0x2807c000) libc.so.4 => /usr/lib/libc.so.4 (0x28084000) HTH mitch > Andrew, > > I put in my system, the hosts.allow below: > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > > # hosts.allow This file describes the names of the hosts which are > # allowed to use the local INET services, as decided > # by the '/usr/sbin/tcpd' server. > # > > in.tftpd: ALL :allow > sshd: ALL :allow > ALL: ALL :deny > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > > And the configuration continue not working. > May you help me, please. > > Thanks. -- Musashino-shi, Tokyo, Japan K12LTSP in Japanese ; http://open-mitch.dyndns.org/k12ltsp/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

?? Connection broken to AF_INET(127.0.0.1:514), reopening in 60 seconds
by seberino＠spawar.navy.mil 27 Jul '04

27 Jul '04

I don't know what is the trouble with my remote syslog-ng/stunnel setup since I turned off packet filtering. Any guidance would be greatly appreciated. Here is error message in log: Jul 26 11:06:47 seberino3 syslog-ng[3245]: Connection broken to AF_INET(127.0.0.1:514), reopening in 60 seconds Here is my syslog-ng.conf: options {long_hostnames(no); keep_hostname(yes); chain_hostnames(no);}; source client_sources {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination local_dest {file("/var/log/messages");}; destination remote_dest {tcp("127.0.0.1" port(514));}; log {source(client_sources); destination(local_dest);}; log {source(client_sources); destination(remote_dest);}; Chris

3 4

logging messages from Netscreen to syslog-ng - need to pipe to MySQL db now
by Brandon Rodak 26 Jul '04

26 Jul '04

This might be a basic question but I am missing something. I believe I am successfully sending the Netscreen firewall messages to a remote syslog server (running syslog-ng) as I have them stored in an appropriate log file. What I want to do now is pipe this file to a MySQL database so that I can retrieve the data later for analysis and to post to a web interface. I have even tried the simple syslong-ng.conf example below (unrelated to my Netscreen logs) in an attempt to pipe data. destination database { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY','$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; Nothing ever appears in the mysql.pipe file. Also I need advice on what fields I should be extrapolating out of the log for use in the Database; I realize the fields above are not the ones I would need from my Netscreen log but any information or leads on how to use the Netscreen logs correctly with a database would be awesome. Thanks for any and all help! It is greatly appreciated! Brandon -- Brandon Rodak Web Services Computer Marketing Corporation http://www.cmcflex.com

1 0

Re: syslog-ng on OSX 10.3.4
by Ken Toney 26 Jul '04

26 Jul '04

Richard, I haven't gotten syslog-ng installed on OS X 10.3.4 yet, but can share with you some resources I have for information. You might try reading <http://sial.org/howto/logging/> <http://www.campin.net/newlogcheck.html> I'd be happy to share my conf file with you once I get syslog-ng running, but I am one step behind you. I am trying to install syslog-ng 1.6.4 on OS X 10.3.4 and can't. Did you run into any problems installing syslog-ng? Thanks, Ken On Jul 14, 2004, at 3:53 AM, syslog-ng-request(a)lists.balabit.hu wrote: > Message: 4 > Date: Fri, 09 Jul 2004 12:26:26 -0700 > From: OpenMacNews <syslog-ng.20.openmacnews(a)spamgourmet.com> > To: syslog-ng <syslog-ng(a)lists.balabit.hu> > Subject: [syslog-ng]syslog-ng on OSX 10.3.4 > Reply-To: syslog-ng(a)lists.balabit.hu > > hi all, > > i'm new to syslog-ng. > > i've installed 1.7x on OSX 10.3.4; now, starting to deal with the > config file. > > i dl'd and searched thru the list archives for pointers, etc. and > found the last relevant, post by Kim Cary, but nothing further. > > i contacted Kim -- not yet finished/successful. > > soooooo, to ask: has anyone here got syslog-ng up/running on OSX, and > would you be willing to share your conf file? > > thx! > > richard

2 3

Jailing syslog-ng on OpenBSD 3.5
by markzero＠logik.ath.cx 26 Jul '04

26 Jul '04

Hello. I'm having difficulty jailing syslog-ng under OpenBSD 3.5. My exact steps so far (after having added group _syslogng and user _syslogng): # mkdir -p /jail/sysng # mkdir -p /jail/sysng/usr/local/sbin # mkdir -p /jail/sysng/usr/lib # mkdir -p /jail/sysng/usr/libexec # mkdir -p /jail/sysng/dev # mkdir -p /jail/sysng/var/log # mkdir -p /jail/sysng/etc/syslog-ng # cp /usr/local/sbin/syslog-ng /jail/sysng/usr/local/sbin # cp /usr/lib/libc.so.30.3 /jail/sysng/usr/lib # cp /usr/libexec/ld.so /jail/sysng/usr/libexec # cp /etc/syslog-ng/syslog-ng.conf /jail/sysng/etc/syslog-ng/ # chown -R _syslogng._syslogng /jail/sysng # ln /dev/log /jail/sysng/dev/log I should explain that I installed syslog-ng from a package, as I have no access to a compiler on this machine (and my other machine is currently in pieces being repaired) - therefore I just moved the binaries into the jail. Running the command: # chroot -g _syslogng -u _syslogng /jail/sysng /usr/local/sbin/syslog-ng Does not give any errors, and log files are indeed created in /jail/var/log (as per the configuration file) - HOWEVER, nothing on the system is actually logged. Syslog-ng logs its own 'birth and death' but does not, for example, log mail or even the reboot command. Is there some glaring error here? The debugging output from syslog-ng gives no errors either, I'm lost as to where to go next to track down the problem. mark ps: I excluded my config as it's pretty much the stock sample config with uccp and ppp removed. If this is relevant, I will attach it to my next email.

1 1