- syslog-ng - lists.balabit.hu

Disk error handled properly?
by John Feeney 25 Jun '04

25 Jun '04

Hello, I am running syslog-ng (1.4.17) on Linux (2.4.21) and received an error when the disk partition became full. Looking at the code, it does not look as though the error was handled very well. After the error, syslog-ng started to take up 26% of my CPU time and was unresponsive to other logged messages to the file that was being written to when the error occurred (even though the room was made in the partition). The specifics are: Received this error - Jun 25 13:16:57 port1-1 syslog-ng[147]: io.c: do_write: write() failed (errno 28), No space left on device So, do_write() correctly identifies the error and puts out a nice message that the disk is full. int res = write(self->fd, data, length); if(res < 0) { switch(errno) { case EINTR: case EWOULDBLOCK: return 0; default: werror( "io.c: do_write: write() failed (errno %i), %z\n"); } ... return(res); } The only place I can see where do_write is called is write_callback() where I would have liked to have seen a "if(w < -1) do_something" but the value of w is just sent in as an argument to BUF_FLUSH(). static void write_callback(struct nonblocking_fd *fd) { CAST(io_fd, self, fd); int res; struct fd_write w = {{ STACK_HEADER, do_write), fd->fd, self->fsync }; assert(self->buffer); res = BUF_FLUSH(self->buffer, &w.super); So, if w is an error (-1), what is &w.super equal to? Something not good. Maybe I have this wrong. Maybe there is another place where do_write() is called. Regardless, the value of w is not being checked so what is the proper course of action if w is -1? Note: my syslog-ng is running on an embedded system that does not have much flash memory to store these logs. The system has a process that truncates the log files when they exceed specific limits, but the granularity of the file size checking can mean that one or more processes can exceed their limit(s) and cause the disk to be full before the checker process wakes up and does the cleanup, as happened in this case. Thanks. John Feeney -------------------------------------------------------- This email message and any files transmitted with it contain confidential information intended only for the person(s) to whom this email message is addressed. If you have received this email message in error, please notify the sender immediately by telephone or email and destroy the original message without making a copy. Thank you.

1 0

RE: [syslog-ng]losing messages during a HUP
by Rule, Ted 25 Jun '04

25 Jun '04

I know I've mentioned it before on the list, but I too would dearly like a separate signal for log rotation purposes to help with any potential data loss. Note that the signal doesn't actually have to close and open destinations - it only really has to close all of them, as the next bit of traffic routed to any given destination should presumably re-open it anyway. Avoiding the need to re-open should make the coding simpler. Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

losing messages during a HUP
by Nick Williams 25 Jun '04

25 Jun '04

Folks, I'd like to report a couple of bugs with syslog-ng whereby there is a window (albeit small) during which messages will just be lost. The problem occurs when a HUP signal is sent to the daemon in order to perform a logrotate. During this time, the daemon re-checks its config file. Before doing that, it closes the old incoming connections. After completing the re-read, it will reconnect up the inputs (typically to the same endpoints, since they hardly ever change, if at all). For the FIFO /dev/log, it not only closes it but it apparently unlinks it as well. Theoretically, life is fine because the clients detect the closed socket and the clients themselves issue retries. All to the good. However, that's not all. On linux (where we're seeing the problem, I don't know if it happens elsewhere), if there is no-one reading from the FIFO then the client gets the error ECONNREFUSED and the libc syslog implementation happily realises what's going on and just retries. But when /dev/log is unlinked and the clients try and connect, they get a different error back - EPROTOCOL. This causes the clients to assume that a FIFO can't be used and fallback to 'lesser' protocols like udp, etc, never to go back up the fallback list to a better protocol. That's an efficiency concern, but at least messages don't get lost. More importantly, messages can get lost between the last read from the FIFO, and between the close() of the FIFO. This may sound unlikely, but we are definitely seeing lost messages at this time (we're logging a very high volume of messages). I can see two possible solutions, maybe there are more: 1. provide an additional signal for logrotate use which only closes and re-opens the logfiles, but doesn't do anything with the configfile. 2. make the re-read of the configfile more clever and only close inputs if really neccessary. Nick.

1 1

Syslog to oracle
by Marc Brown 23 Jun '04

23 Jun '04

Hi , can we have syslog messages logged to oracle database . If so , please send me some info and references on that. - marc __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - Send 10MB messages! http://promotions.yahoo.com/new_mail

2 1

BalaBit exhibits at LinuxTag
by Balazs Scheidler 20 Jun '04

20 Jun '04

Hi, This a quick note to let you know that BalaBit is going to have a small booth at LinuxTag. This year LinuxTag takes place in Karlsruhe, Germany 23-26th June, e.g. it starts next Tuesday. Our booth will be part of GUUG's commercial booth at Stand A82. You can find me there personally, so feel free to drop in and have a chat about syslog-ng's future directions. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Michael J. Bock/NetServ/DST/US is out of the office.
by MJBock＠dstsystems.com 18 Jun '04

18 Jun '04

I will be out of the office starting 06/18/2004 and will not return until 06/28/2004. I will respond to your message when I return.

1 0

log format
by Paul Gamble - MWEB 18 Jun '04

18 Jun '04

I'm a syslog-ng newbie and so am hoping that this is not too much of a FAQ. A nod of thanks to the syslog-ng developers for syslog-ng btw! I need to write a unix-socket-based destination server that will accept data from syslog-ng. Hence, I'm trying to find a documented definition of syslog-ng's log records as my server would receive them. Can anyone provide a pointer or two as I cannot find this in the docs? I have a test server that receives records of the following form: <22><standard syslog log<22><another standard syslog record>, etc, etc What is the meaning of <22>? Can I rely on this as a record separator? Many thanks, Paul MWEB: S.A.'s most trusted and reliable Internet Service Provider. Just Like That. To join, go to: http://join.mweb.co.za or call 0860032000.

2 1

filter problem
by bugtraq 18 Jun '04

18 Jun '04

Hi all. I have some network devices witch syslog function from example 1. 192.168.0.1 2. 192.168.0.10 I create syslog config and define this filter's ---------------------------------------------------------------------------- ------------------------------------- source s_network { udp ( ip (0.0.0.0) port (514) ); }; filter cisco_1 { host ("192.168.0.1"); }; filter at-rpg6_1 { host ("192.168.0.10"); }; destination cisco_1 { file ( /usr/local/syslog-ng/log/cisco.log ); }; destination d_file_6 { file ( /usr/local/syslog-ng/log/at-rpg6.log ); }; log { source ( s_network ); filter ( cisco_1 ); destination ( cisco_1); }; log { source ( s_network ); filter ( at-rpg6_1 ); destination ( d_file_6 ); }; ---------------------------------------------------------------------------- --------------------------------------- In this config I have some mistake, messages send from 192.168.0.10 stored into /usr/local/syslog-ng/log/at-rpg6.log And it also stored /usr/local/syslog-ng/log/cisco.log What's wrong ? forgive me for bad english WBR swop.

2 2

ZyXEL IES-3000 Chassis - DSLAM
by Emil Valsson 16 Jun '04

16 Jun '04

Anyone know if I can log from this ZyXEL? He supports from Local1 thru 7 UNIX logging. If yes, how would the config file for syslog-ng look like? Thanks!

1 0

RE: [syslog-ng]php-syslog-ng Error
by Benjamin.Zoeller＠salt-solutions.de 14 Jun '04

14 Jun '04

Hello Ben, this is the wrong maillinglist. You´ll get help here. http://lists.sourceforge.net/lists/listinfo/php-syslog-ng-support <http://lists.sourceforge.net/lists/listinfo/php-syslog-ng-support> Solution: It is very easy you must edit your db_fns.php Look for this line and change the values -> mysql_pconnect("<servername>", "<username>", "<password>"); HTH Benjamin -----Original Message----- From: Ben Whittaker [mailto:ben_whittaker@yahoo.com] Sent: Samstag, 12. Juni 2004 21:42 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]php-syslog-ng Error I am getting a error when trying to view the syslog data with php-syslog-ng-2.5.1 Parse error: parse error in /srv/www/htdocs/includes/db_fns.php on line 5 Fatal error: Call to undefined function: db_connect_syslog() in /srv/www/htdocs/index.php on line 9 _____ Do you Yahoo!? Friends. Fun. Try the <http://messenger.yahoo.com/> all-new Yahoo! Messenger

1 0

php-syslog-ng Error
by Ben Whittaker 12 Jun '04

12 Jun '04

I am getting a error when trying to view the syslog data with php-syslog-ng-2.5.1 Parse error: parse error in /srv/www/htdocs/includes/db_fns.php on line 5 Fatal error: Call to undefined function: db_connect_syslog() in /srv/www/htdocs/index.php on line 9 --------------------------------- Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger

1 0

Cisco Pix configuration
by Ben Whittaker 12 Jun '04

12 Jun '04

How do I setup syslog-ng for cisco pix. I have added the following lines to my config # PIX source network { udp () ; tcp (); }; destination pixlog { file("/var/log/pix.log"); }; filter f_pix { facility(local4); }; but I am not getting any logging to this new syslog server. __________________________________ Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger. http://messenger.yahoo.com/

3 7

config option to make syslog-ng bind only to a certain IP address?
by Bill Moran 10 Jun '04

10 Jun '04

This is my first post to this list. Is there a config or command-line option to make syslog-ng only bind to a certain IP address? I have a machine with multiple IPs, and I'd like to have syslog-ng only listening on the primary IP. In the future, I may want multiple instances of syslog-ng listening on different IPs with different configs. -- Bill Moran Potential Technologies http://www.potentialtech.com

2 2

RE: [syslog-ng]Cisco Pix configuration
by "Pedroche, Raúl" 10 Jun '04

10 Jun '04

There is a catch with Cisco SecurePIX logging facility statement. The number you have to pass as a parameter is not the number of the "local" facility, but the low level facility number. local4 is 20, and is the default. Facility 4 is auth. See http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_refer ence_chapter09186a00801727a9.html#wp1028090 <http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_refe rence_chapter09186a00801727a9.html#wp1028090> -----Original Message----- From: Ben Whittaker [mailto:ben_whittaker@yahoo.com] Sent: Thursday, June 10, 2004 2:04 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Cisco Pix configuration Still do not have it worked out. Please help Pix logging on logging timestamp logging trap notifications logging facility 4 logging queue 1024 logging host inside 10.1.1.18 test:/etc/syslog-ng # more syslog-ng.conf # # /etc/syslog-ng/syslog-ng.conf # # Automatically generated by SuSEconfig on Wed Jun 9 19:16:34 EDT 2004. # # PLEASE DO NOT EDIT THIS FILE! # # you can modify /etc/syslog-ng/syslog-ng.conf.in instead # # # File format description can be found in syslog-ng.conf(5). # options { long_hostnames(off); sync(0); }; # # 'src' is our main source definition. you can add # more sources driver definitions to it, or define # your own sources, i.e.: # #source my_src { .... }; source src { # # include internal syslog-ng messages # note: the internal() soure is required! # internal(); # # the following line will be replaced by the # socket list generated by SuSEconfig using # variables from /etc/sysconfig/syslog: # unix-dgram("/dev/log"); # # uncomment to process log messages from network: # #udp(ip("0.0.0.0") port(514)); }; # # filter definitions # filter f_console { level(warn) and facility(kern) or level(err) and not facility(authpriv); }; filter f_newsnotice { level(notice) and facility(news); }; filter f_newscrit { level(crit) and facility(news); }; filter f_newserr { level(err) and facility(news); }; filter f_news { facility(news); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_warn { level(warn, err, crit); }; filter f_alert ; { level(alert); }; filter f_messages { not facility(news, mail); }; filter f_local { facility(local0, local1, local2, local3, local4, local5, local6, local7); }; filter f_iptables { facility(kern) and match("IN=") and match("OUT="); }; # # print most on tty10 and on the xconsole pipe # destination console { file("/dev/tty10"); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole"); }; log { source(src); filter(f_console); destination(xconsole); }; # enable this, if you want that root is informed # immediately, e.g. of logins #destination root { usertty("root"); }; #log { source(src); filter(f_alert); destination(root); }; # # these files are rotated and examined by "news.daily" # destination newscrit { file("/var/log/news/news.crit"); }; log { source(src); filter(f_newscrit); destination(newscrit); }; destination newserr { file("/var/log/news/news.err"); }; log { source(src); filter(f_newserr); destination(newserr); }; destination newsnotice { file("/var/log/news/news.notice"); }; log { source(src); filter(f_newsnotice); destination(newserr); }; # # enable this, if you want to keep all news messages # in one file #destination news { file("/var/log/news.all"); }; #log { source(src); filter(f_news); destination(news); }; # # all email-messages in one file # destination mail { file("/var/log/mail"); }; log { source(src); filter(f_mail); destination(mail); }; # # all cron-messages in one file # #destination cron { file("/var/log/cron"); }; #log { source(src); filter(f_cron); destination(cron); }; # # Some boot scripts require local7 # destination localmessages { file("/var/log/localmessages"); }; log { source(src); filter(f_local); destination(localmessages); }; # # all messages except the facilities news and mail # destination messages { file("/var/log/messages"); }; log { source(src); filter(f_messages); destination(messages); }; # # enable this, if you want all iptables messages # in one file # #destination firewall { file("/var/log/firewall"); }; #log { source(src); filter(f_iptables); destination(firewall); }; # # Warnings in one file # destination warn { file("/var/log/warn"); }; log { source(src); filter(f_warn); destination(warn); }; # # enable this, if you want to keep all messages in one file #destination allmessages { file("/var/log/allmessages"); }; #log { source(src); destination(allmessages); }; # PIX source network { udp () ; tcp (); }; log{source(network);filter(f_pix);destination(pixlog);}; destination pixlog { file("/var/log/pix.log"); }; filter f_pix { facility(local4); }; test:/etc/syslog-ng # Bill Nash <billn(a)billn.net> wrote: What about your log directives? log { source(network); destination(pixlog); flags(final); }; - billn On Wed, 9 Jun 2004, Ben Whittaker wrote: > Yes, Pix was logging to Kiwi > > Bill Nash wrote: > Stupid question, but: > Did you configure your PIX to export logs to your log server? > > If it behaves like IOS, it's something as simple as: > logging > > - billn > > On Wed, 9 Jun 2004, Ben Whittaker wrote: > > > How do I setup syslog-ng for cisco pix. > > > > I have added the following lines to my config > > > > # PIX > > source network { udp () ; tcp (); }; > > > > destination pixlog { file("/var/log/pix.log"); }; > > > > filter f_pix { facility(local4); }; > > > > > > > > but I am not getting any logging to this new syslog server. > > > > > > > > > > __________________________________ > > Do you Yahoo!? > > Friends. Fun. Try the all-new Yahoo! Messenger. > > http://messenger.yahoo.com/ > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > --------------------------------- > Do you Yahoo!? > Friends . Fun. Try the all-new Yahoo! Messenger _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _____ Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! <http://messenger.yahoo.com/> Messenger ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

2 1

RE: [syslog-ng]Cisco Pix configuration
by Madziarczyk, Jonathan 09 Jun '04

09 Jun '04

I believe you also need a log statement similar to below in your syslog-ng.conf: log{source(network);filter(f_pix);destination(pixlog);}; Also, your pix should have the following commands: logging on logging facility 4 logging trap {level...i.e. informational, debugging, etc} logging host inside {IP address of logging server} Hope this helps, Jon -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Ben Whittaker Sent: Wednesday, June 09, 2004 1:58 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Cisco Pix configuration How do I setup syslog-ng for cisco pix. I have added the following lines to my config # PIX source network { udp () ; tcp (); }; destination pixlog { file("/var/log/pix.log"); }; filter f_pix { facility(local4); }; but I am not getting any logging to this new syslog server. __________________________________ Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger. http://messenger.yahoo.com/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

relay host not reporting itself as IP
by Bill 08 Jun '04

08 Jun '04

Greetings, What options should I use in order to make a relay host report itself as it's IP and not hostname? I have a centralized server and various parsing scripts that expect ip addresses as a source, but for some reason, the actual remote syslog servers are logging it's information as its hostname, and not ip. What options, or websites should I check out to read more about the configuration options for ng? Thanks in advance,

3 2

RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 04 Jun '04

04 Jun '04

Hi, now I have it. RTFM :D I forgot to touch a new sources.c.x Many thx @all specially to Bazsi for coding. Does this fix stay in the new releases or do I have to apply the fix evertime I update my syslog-ng? regards, Benjamin michihito matsubara wrote: > Hi. > > i've been watching for this thread because of my old YAMAHA ISDN > router has same output as well as Benjamin's. > > On Fri, 4 Jun 2004 14:45:15 +0200 > Subject: RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line > Benjamin.Zoeller(a)salt-solutions.de wrote: > >> Sorry I can't compile this. Get the following error. > > Done againt syslog-ng-1.6.4+20040604 and gotya. > on Linux, gcc-3.3.2, glibc-2.3.1, libnet-1.1.1. > Now, there is no ^@ code at each end of lines. > Works very fine. > >>> Can you check if this patch works? (it fixed the problem for me) >>> >>> diff -u -r1.37.4.2 sources.c >>> --- src/sources.c 10 Mar 2004 18:43:28 -0000 1.37.4.2 >>> +++ src/sources.c 4 Jun 2004 12:28:26 -0000 >>> @@ -120,6 +120,13 @@ >>> full or we are a datagram receiver, when the >>> message is in its own packet. >>> */ >>> + if (closure->dgram) { >>> + /* strip one trailing LF or NUL character */ >>> + if (closure->pos > 0 && >>> + (closure->buffer[closure->pos - 1] == >>> '\n' || + closure->buffer[closure->pos - >>> 1] == '\0')) + closure->pos--; + >>> } do_handle_line(closure, closure->pos, >>> closure->buffer, salen ? (abstract_addr *) &sabuf : >>> NULL, salen); closure->pos = 0; return ST_OK | >>> ST_GOON; > > > Benjamin, > > looks like you missed something for the patch. > double check and try again. you can make it, too. > This patch is nothing but a clean and simple. > > regards, > mitch

2 1

Syslog Config and Cisco, Max Tnt
by Evan Himmel 04 Jun '04

04 Jun '04

I have all the hardware configured correctly. My problem is that I have separate filters setup for my MAX TNT and Cisco Gear to log into different directories. One...everything logs in both my Cisco and Modems directory and two I am no longer getting as much detail as I did with the Cisco Gear. below is my config for the Cisco Gear and TNT. #Logging for CISCO Devices destination d_cisco_devices { file("/var/log/cisco/$HOST.log"); }; # This is out destination file. Each host will get it's own log file # which is nice when you start using log checkers to email you about # things in your log file. filter f_cisco_info { level(info); }; filter f_cisco_notice { level(notice); }; filter f_cisco_warn { level(warn); }; filter f_cisco_crit { level(crit); }; filter f_cisco_err { level(err); }; filter f_cisco_debug { level(debug..emerg); }; # Sets up out filters. The thing to remember is Cisco's log at various # levels by default unlike a lot fo daemons. log { source(s_net); filter(f_cisco_info); destination(d_cisco_devices); }; log { source(s_net); filter(f_cisco_notice); destination(d_cisco_devices); }; log { source(s_net); filter(f_cisco_warn); destination(d_cisco_devices); }; log { source(s_net); filter(f_cisco_crit); destination(d_cisco_devices); }; log { source(s_net); filter(f_cisco_err); destination(d_cisco_devices); }; log { source(s_net); filter(f_cisco_debug); destination(d_cisco_devices); }; # Takes the logs our filters and passes them to our destination. Obviously # you can do some really interestng things with this, but I haven't # figured them out yet. #Logging for TNT MAX Devices destination d_modems_devices { file("/var/log/modems/$HOST.log"); }; # This is out destination file. Each host will get it's own log file # which is nice when you start using log checkers to email you about # things in your log file. filter f_modems_info { level(info); }; filter f_modems_notice { level(notice); }; filter f_modems_warn { level(warn); }; filter f_modems_crit { level(crit); }; filter f_modems_err { level(err); }; # Sets up out filters. log { source(s_net); filter(f_modems_info); destination(d_modems_devices); }; log { source(s_net); filter(f_modems_notice); destination(d_modems_devices); }; log { source(s_net); filter(f_modems_warn); destination(d_modems_devices); }; log { source(s_net); filter(f_modems_crit); destination(d_modems_devices); }; log { source(s_net); filter(f_modems_err); destination(d_modems_devices); }; # Takes the logs our filters and passes them to our destination. Obviously # you can do some really interestng things with this, but I haven't # figured them out yet. Evan Himmel Network Engineer PrimeLink, Inc. (518) 324-5465 http://www.primelink1.net

1 0

RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 04 Jun '04

04 Jun '04

Sorry I can't compile this. Get the following error. Making all in src make[1]: Entering directory `/usr/src/syslog-ng-1.6.4/src' make all-recursive make[2]: Entering directory `/usr/src/syslog-ng-1.6.4/src' Making all in . make[3]: Entering directory `/usr/src/syslog-ng-1.6.4/src' gcc -DHAVE_CONFIG_H -I. -I/usr/src/syslog-ng-1.6.4/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c main.c make_class <sources.c >sources.c.xT /bin/sh: /usr/local/bin/make_class: \: bad interpreter: No such file or directory make[3]: *** [sources.c.x] Error 126 make[3]: Leaving directory `/usr/src/syslog-ng-1.6.4/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/syslog-ng-1.6.4/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/src/syslog-ng-1.6.4/src' make: *** [all-recursive] Error 1 Balazs Scheidler wrote: > 2004-06-04, p keltezéssel 13:34-kor Benjamin.Zoeller(a)salt-solutions.de > ezt írta: >> Hi again, >> here is an tcpdump with parameter -s 255 thx to jozsef >> >> 13:24:30.357952 000.000.000.000.syslog-ng > >> 000.000.000.000.syslog-ng: udp 83 0x0000 4500 006f d16e 0000 3e11 >> 938c 0000 0000 E..o.n..>....... 0x0010 0000 0000 0202 0202 >> 005b 902c 3c31 3430 .........[.,<140 0x0020 3e41 4343 543a >> 204c 4f47 494e 2046 4149 >ACCT:.LOGIN.FAI 0x0030 4c45 4420 >> 6173 2079 6164 2066 726f 6d20 LED.as.yad.from. 0x0040 5445 >> 4c4e 4554 2031 302e 3139 392e 322e TELNET.10.199.2. 0x0050 >> 3635 2061 7420 4672 6920 4a75 6e20 2034 65.at.Fri.Jun..4 >> 0x0060 2031 323a 3234 3a32 3820 3230 3034 00 >> .12:24:28.2004. >> >> @John >> thx for your hint, but I think it`s to late now. >> I simply forgot to hide this in the hex part. >> >> @all >> Hope somebody can tell me why I get ^@ at each line. >> > > Can you check if this patch works? (it fixed the problem for me) > > diff -u -r1.37.4.2 sources.c > --- src/sources.c 10 Mar 2004 18:43:28 -0000 1.37.4.2 > +++ src/sources.c 4 Jun 2004 12:28:26 -0000 > @@ -120,6 +120,13 @@ > full or we are a datagram receiver, when the > message is in its own packet. > */ > + if (closure->dgram) { > + /* strip one trailing LF or NUL character */ > + if (closure->pos > 0 && > + (closure->buffer[closure->pos - 1] == > '\n' || + closure->buffer[closure->pos - > 1] == '\0')) + closure->pos--; > + } > do_handle_line(closure, closure->pos, > closure->buffer, salen ? (abstract_addr *) &sabuf : > NULL, salen); closure->pos = 0; return ST_OK | > ST_GOON;

2 1

RE: [syslog-ng]memory-based ringbuffer
by tc1＠mydot.org 04 Jun '04

04 Jun '04

> > I was just thinking if you have any plans to implement > > something along > > the lines of a memory-based ringbuffer into Syslog-NG. To > > me it sounds > > like a useful feature. > > ... > > interesting idea, though the feature is primarily meant for diskless > clients where no local storage exists. what is the point for > central log > servers? (where syslog-ng is primarily used) Well, the point being that you could use syslog-ng also for the diskless clients. That way all the fancy, less traditional, "non-standard" syslog-ng features can be used also client-side - such as forwarding over TCP (+ stunnel) and extensive support for filtering. Thoralf

1 0

RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 04 Jun '04

04 Jun '04

Hi again, here is an tcpdump with parameter -s 255 thx to jozsef 13:24:30.357952 000.000.000.000.syslog-ng > 000.000.000.000.syslog-ng: udp 83 0x0000 4500 006f d16e 0000 3e11 938c 0000 0000 E..o.n..>....... 0x0010 0000 0000 0202 0202 005b 902c 3c31 3430 .........[.,<140 0x0020 3e41 4343 543a 204c 4f47 494e 2046 4149 >ACCT:.LOGIN.FAI 0x0030 4c45 4420 6173 2079 6164 2066 726f 6d20 LED.as.yad.from. 0x0040 5445 4c4e 4554 2031 302e 3139 392e 322e TELNET.10.199.2. 0x0050 3635 2061 7420 4672 6920 4a75 6e20 2034 65.at.Fri.Jun..4 0x0060 2031 323a 3234 3a32 3820 3230 3034 00 .12:24:28.2004. @John thx for your hint, but I think it`s to late now. I simply forgot to hide this in the hex part. @all Hope somebody can tell me why I get ^@ at each line. Thx Benjamin John Kristoff wrote: > On Fri, 4 Jun 2004 10:52:11 +0200 > Benjamin.Zoeller(a)salt-solutions.de wrote: > >> 10:49:09.668790 .syslog-ng > .syslog-ng: udp 85 >> 0x0000 4500 0071 cfed 0000 3e11 950b 0ac6 00fd >> E..q....>....... 0x0010 0ac7 00fa 0202 0202 005d 1cd7 3c31 3430 >> .........]..<140 > > If you're going to go through the trouble of hiding IPs, you should > mask the hex portion as well. Though your use of 10/8 offers you > some privacy already I suppose. > > John

3 2

memory-based ringbuffer
by tc1＠mydot.org 04 Jun '04

04 Jun '04

Hi, I was just thinking if you have any plans to implement something along the lines of a memory-based ringbuffer into Syslog-NG. To me it sounds like a useful feature. Here the reference to the functionality in BSD: http://www.openbsd.org/cgi-bin/man.cgi?query=syslogc&sektion=8 One alternative possibility that I am aware of would be to use this kernel module: http://www.circlemud.org/~jelson/software/emlog/ But I still think that from a manageability point of view it might be easier to have this functionality in the syslog daemon. Having it there also reduces the number of copying around the same information. Thoralf

2 1

RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 04 Jun '04

04 Jun '04

Hi Balazs, it is very curios. The some tcpdumps gives me not all characters. Perhaps this is the problem??? Here some new ones: 10:49:09.668790 .syslog-ng > .syslog-ng: udp 85 0x0000 4500 0071 cfed 0000 3e11 950b 0ac6 00fd E..q....>....... 0x0010 0ac7 00fa 0202 0202 005d 1cd7 3c31 3430 .........]..<140 0x0020 3e41 4343 543a 204c 4f47 494e 2046 4149 >ACCT:.LOGIN.FAI 0x0030 4c45 4420 6173 2061 646d 696e 2066 726f LED.as.admin.fro 0x0040 6d20 5445 4c4e 4554 2031 302e 3139 392e m.TELNET.10.199. 0x0050 322e 2. 10:49:27.116598 .syslog-ng > .syslog-ng: udp 82 0x0000 4500 006e cff6 0000 3e11 9505 0ac6 00fd E..n....>....... 0x0010 0ac7 00fa 0202 0202 005a 0e93 3c31 3430 .........Z..<140 0x0020 3e41 4343 543a 204c 4f47 494e 2046 4149 >ACCT:.LOGIN.FAI 0x0030 4c45 4420 6173 2031 3220 6672 6f6d 2054 LED.as.12.from.T 0x0040 454c 4e45 5420 3130 2e31 3939 2e32 2e36 ELNET.10.199.2.6 0x0050 3520 5. 10:52:18.644121 .syslog-ng > .syslog-ng: udp 84 0x0000 4500 0070 d007 0000 3e11 94f2 0ac6 00fd E..p....>....... 0x0010 0ac7 00fa 0202 0202 005c 6ef8 3c31 3430 .........\n.<140 0x0020 3e41 4343 543a 204c 4f47 494e 2046 4149 >ACCT:.LOGIN.FAI 0x0030 4c45 4420 6173 2061 7364 6620 6672 6f6d LED.as.asdf.from 0x0040 2054 454c 4e45 5420 3130 2e31 3939 2e32 .TELNET.10.199.2 0x0050 2e36 .6 10:52:21.290085 .syslog-ng > .syslog-ng: udp 85 0x0000 4500 0071 d015 0000 3e11 94e3 0ac6 00fd E..q....>....... 0x0010 0ac7 00fa 0202 0202 005d 3f3a 3c31 3430 .........]?:<140 0x0020 3e41 4343 543a 204c 4f47 494e 2046 4149 >ACCT:.LOGIN.FAI 0x0030 4c45 4420 6173 2077 7433 3435 2066 726f LED.as.wt345.fro 0x0040 6d20 5445 4c4e 4554 2031 302e 3139 392e m.TELNET.10.199. 0x0050 322e 2. Balazs Scheidler wrote: > 2004-06-03, cs keltezéssel 15:57-kor > Benjamin.Zoeller(a)salt-solutions.de ezt írta: >> Loic Minier wrote: >>> Benjamin.Zoeller(a)salt-solutions.de - Thu, Jun 03, 2004: >>> >>>>> The problem is that I can't see the log line itself, thus I am >>>>> unable here my log: >>> >>> I think you should send the content of the network packets >>> (containing the log lines). This is achieved with tcpdump -X or >>> -XX under Linux, check man tcpdump if you're running something >>> else. >> >> ah, ok. >> Now I understand here an login attempt. >> >> 15:58:19.707437 XX.XXX.X.XXX.syslog-ng > XXX.XXX.XX.syslog-ng: udp 85 >> 0x0000 4500 0071 ca25 0000 3e11 9ad3 0ac6 00fd >> E..q.%..>....... 0x0010 0ac7 00fa 0202 0202 005d 04d1 3c31 3430 >> .........]..<140 0x0020 3e41 4343 543a 204c 4f47 494e 2046 4149 >> >ACCT:.LOGIN.FAI 0x0030 4c45 4420 6173 2061 646d 696e 2066 726f >> LED.as.admin.fro 0x0040 6d20 5445 4c4e 4554 2031 302e 3139 392e >> m.TELNET.10.199. 0x0050 322e >> 2. > > I'm afraid but this is not a complete packet. tcpdump says it is 85 > bytes long, but it is 82 only, and as it seems the line itself is not > complete either (the last IP address is terminated after the third > number) > > I sent the same message to my local syslog-ng process but there was no > NUL character appended.

3 2

syslog-ng kerdes
by SZOKOVACS Robert 04 Jun '04

04 Jun '04

Hello, hogyan lehet a syslog-ng-t ravenni, hogy a sok egymast koveto egyforma uzeneteket osszegroupolja es csak annyit mondjon, hogy 'repeated n times'? Tudja ezt egyaltalan? koszi Szo

3 4

RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 04 Jun '04

04 Jun '04

Loic Minier wrote: > Benjamin.Zoeller(a)salt-solutions.de - Thu, Jun 03, 2004: > >>> The problem is that I can't see the log line itself, thus I am >>> unable here my log: > > I think you should send the content of the network packets > (containing the log lines). This is achieved with tcpdump -X or -XX > under Linux, check man tcpdump if you're running something else. ah, ok. Now I understand here an login attempt. 15:58:19.707437 XX.XXX.X.XXX.syslog-ng > XXX.XXX.XX.syslog-ng: udp 85 0x0000 4500 0071 ca25 0000 3e11 9ad3 0ac6 00fd E..q.%..>....... 0x0010 0ac7 00fa 0202 0202 005d 04d1 3c31 3430 .........]..<140 0x0020 3e41 4343 543a 204c 4f47 494e 2046 4149 >ACCT:.LOGIN.FAI 0x0030 4c45 4420 6173 2061 646d 696e 2066 726f LED.as.admin.fro 0x0040 6d20 5445 4c4e 4554 2031 302e 3139 392e m.TELNET.10.199. 0x0050 322e 2.

2 1