- syslog-ng - lists.balabit.hu

Re: [syslog-ng]How to log into mysql database - help required
by Michael Earls 10 May '04

10 May '04

I would use if statement in cron to check to see if this is running if not running start it. ## Mysql insert run the check 0-55/1 * * * * root if [ -x /bin/bash ] && [ -r /etc/syslog-ng/mysql_pipe.sh ]; then /bin/bash /etc/syslog-ng/mysql_pipe.sh >> /var/log/syslog-ng/mysql_pipe.log 2>&1; fi Michael >>> gjg(a)sltnet.lk 5/10/2004 8:13:02 AM >>> I require to log syslogs into a mysql database. I used syslog-ng (downloaded the rpm for syslog-ng - ver 1.6 and libol from rpmseek.com and installed it) and used the information available in the site http://www.vermeer.org/display_doc.php?doc_id=1 for this purpose. As given in this website (1) First I made the pipe file using the following command # mkfifo /tmp/mysql.pipe (2) Then I used the following command to log into mysql (first tried with local logging) # mysql -u root --password=passwd syslog < /tmp/mysql.pipe This command gets stuck But when syslog-ng is stopped and started it logs and the contenets in /tmp/mysql.pipe gets loaded into the database table. The following commands were used to stop and start syslog-ng /etc/init.d/syslog-ng stop # Stop syslog-ng /etc/ini.d/syslog-ng start # Start syslog-ng (3) The site states about an initialization script like this one which needs to be started at start up. The script given is provided below. #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u theuserid --password=thepassword syslogdb < /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi Where should I put this script and how to start it up at initialization? Could you explain the working pricipal of this script?

1 0

Eventog to syslog
by Edwards, Thomas 10 May '04

10 May '04

Has anyone ever used the Eventlog to syslog program found here. https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys I was trying to decipher their input as to how to word the filters and am coming up short other than putting a direct match for the host name I am using. Any help would be greatly appreciated. Tom ******************************************** This message is intended only for the use of the Addressee and may contain information that is PRIVILEGED and CONFIDENTIAL. If you are not the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please erase all copies of the message and its attachments and notify us immediately. Thank you. ********************************************

4 3

RE: [syslog-ng]How to log into mysql database - help required
by Hamilton, Andrew 10 May '04

10 May '04

Try going here: <http://www.campin.net/syslog-ng/faq.html> http://www.campin.net/syslog-ng/faq.html Regards. -----Original Message----- From: Gayathri J. Gunawardena [mailto:gjg@sltnet.lk] Sent: Monday, May 10, 2004 8:13 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]How to log into mysql database - help required I require to log syslogs into a mysql database. I used syslog-ng (downloaded the rpm for syslog-ng - ver 1.6 and libol from rpmseek.com and installed it) and used the information available in the site http://www.vermeer.org/display_doc.php?doc_id=1 <http://www.vermeer.org/display_doc.php?doc_id=1> for this purpose. As given in this website (1) First I made the pipe file using the following command # mkfifo /tmp/mysql.pipe (2) Then I used the following command to log into mysql (first tried with local logging) # mysql -u root --password=passwd syslog < /tmp/mysql.pipe This command gets stuck But when syslog-ng is stopped and started it logs and the contenets in /tmp/mysql.pipe gets loaded into the database table. The following commands were used to stop and start syslog-ng /etc/init.d/syslog-ng stop # Stop syslog-ng /etc/ini.d/syslog-ng start # Start syslog-ng (3) The site states about an initialization script like this one which needs to be started at start up. The script given is provided below. #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u theuserid --password=thepassword syslogdb < /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi Where should I put this script and how to start it up at initialization? Could you explain the working pricipal of this script?

1 0

How to log into mysql database - help required
by Gayathri J. Gunawardena 10 May '04

10 May '04

I require to log syslogs into a mysql database. I used syslog-ng (downloaded the rpm for syslog-ng - ver 1.6 and libol from rpmseek.com and installed it) and used the information available in the site http://www.vermeer.org/display_doc.php?doc_id=1 for this purpose. As given in this website (1) First I made the pipe file using the following command # mkfifo /tmp/mysql.pipe (2) Then I used the following command to log into mysql (first tried with local logging) # mysql -u root --password=passwd syslog < /tmp/mysql.pipe This command gets stuck But when syslog-ng is stopped and started it logs and the contenets in /tmp/mysql.pipe gets loaded into the database table. The following commands were used to stop and start syslog-ng /etc/init.d/syslog-ng stop # Stop syslog-ng /etc/ini.d/syslog-ng start # Start syslog-ng (3) The site states about an initialization script like this one which needs to be started at start up. The script given is provided below. #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u theuserid --password=thepassword syslogdb < /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi Where should I put this script and how to start it up at initialization? Could you explain the working pricipal of this script?

1 0

sample syslog-ng.conf with swatch alerts
by Nilesh Naik 09 May '04

09 May '04

Hi any one having syslog-ng.conf file , for linux loghost, getting logs from the solaris and linux servers then please mail me the same for the reference , actually i am getting logs from all the servers but unfortunately , syslog-ng is not passing the same to swatch , (i guess) so if some one can send the same then would be very helpful to me in setting up a loghost in our datacenter regards Prashant __________________________________ Do you Yahoo!? Win a $20,000 Career Makeover at Yahoo! HotJobs http://hotjobs.sweepstakes.yahoo.com/careermakeover

1 0

help required !!!! bit urgent
by Nilesh Naik 09 May '04

09 May '04

Hello Sir i have sucessfully installed 1) syslog-ng version 1.4.17 2) swatch-3.1 on my redhat 7.2 linux server , which is our central loghost system , all other server are mix of solaris 7,8,9 & redhat linux 7.x, The problem i am facing is i am not able to generate real time alerts using swatch , Following are my configuration files , syslog-ng.conf options { sync (1); time_reopen (10); log_fifo_size (2048); long_hostnames (off); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); }; source net { udp(); }; destination swatch { program("/usr/bin/swatch --read-pipe=\"cat /dev/fd/0\""); }; log { source(net); destination(swatch); }; destination hosts { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(net); destination(hosts); }; here , i am getting lots under /var/log/HOSTS directory , but not getting logs of the loghost itself , my swatchrs is small and simple coz its not working at the moment , the same is bellow swatchrc watchfor /error Authentication/ echo exec echo $0 | mail /usr/bin/mail -s \"log 11alert\" user\(a)testdomain.com throttle 10:00 watchfor /error Authentication/ echo exec echo $0 | bash-mail-alert swap_space user(a)testdomain.com ~ nighter of this is generating any alerts , nor any files is getting created under /root/swatch directory , but when i start the syslog-ng , and then give ps -ef | grep swatch , i can see swatch process i guess swatch is not getting anything from syslog-ng , no clues why ? please help me and guide me where the problem is , would be really grateful to you sir regards Prashant __________________________________ Do you Yahoo!? Win a $20,000 Career Makeover at Yahoo! HotJobs http://hotjobs.sweepstakes.yahoo.com/careermakeover

1 0

permissions
by mark 08 May '04

08 May '04

Ok, success is on the horizon. I can start syslog-ng like this: syslog-ng -d -v -f /etc/syslog-ng/syslog-ng.conf -u log -g log where "log" is an unprivileged user (with /bin/false as a shell when it's all working, to prevent logins). The config file specifies that syslog-ng writes to: /var/log/syslog-ng/local/ But the debugging output is giving "permission denied" errors. The permissions on the directories are setup like this: # ls /var drwxr-x--- 9 root root 4096 May 8 05:11 log/ # ls /var/log drwx------ 3 log log 4096 May 8 05:13 syslog-ng/ # ls /var/log/syslog-ng drwx------ 2 log log 4096 May 8 05:13 local/ So surely the user "log" and therefore syslog-ng has permission to read and write in this directory? It doesn't appear to be the case as I can $ su log and get permission denied errors whilst trying to read, write, or even cd into the directory. The permissions on /var/log need to be set as they are, however I'm guessing that this is the root of the problem (no pun intended). Can anyone suggest a fix? mark www.darklogik.org

2 2

Greetings, and a syntax error...
by mark 08 May '04

08 May '04

Good evening. Greetings to all users on this list, I've just signed up. Primarily I wanted syslog-ng to do secure remote logging by piping it through stunnel or ssh, but now I've had some time with the config file, I much prefer the syntax. A problem. I have a syntax error in my config file somewhere, and I just can't see it. syslog-ng gives the incredibly helpful: syntax error in 3 Parse error reading configuration file, exiting. (line 3) I've tried every variation I can think of on this line. Anyway, here is the config file: options { sync(0); }; source src { unix-dgram("/dev/log"); internal(); owner("syslog-ng"); group("syslog-ng"); perm(0600); }; source s_tcp { tcp( port(1028) ip("127.0.0.1") max-connections(2)); }; destination authlog { file("/var/log/syslog-ng/$HOST/auth.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination syslog { file("/var/log/syslog-ng/$HOST/syslog.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination cron { file("/var/log/syslog-ng/$HOST/cron.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination daemon { file("/var/log/syslog-ng/$HOST/daemon.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination kern { file("/var/log/syslog-ng/$HOST/kern.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination lpr { file("/var/log/syslog-ng/$HOST/lpr.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination user { file("/var/log/syslog-ng/$HOST/user.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination mail { file("/var/log/syslog-ng/$HOST/mail.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination debug { file("/var/log/syslog-ng/$HOST/debug" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination messages { file("/var/log/syslog-ng/$HOST/messages" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination all { file("/var/log/syslog-ng/$HOST/all.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); destination(all); }; log { source(src); destination(console_all); }; As you can see I'm not intending to run syslog-ng as root. Any help would be appreciated. mark www.darklogik.org

2 2

Re: [syslog-ng]Greetings, and a syntax error...
by mark 08 May '04

08 May '04

I think I have it solved... :) (blindingly obvious error is swept under the carpet) mark www.darklogik.org

1 0

libol.spec.in patch
by José Pedro Oliveira 07 May '04

07 May '04

Bazsi. The specfile included in libol no longer builds correctly (it is broken since Red Hat 9, or more correctly, since rpm 4.2). With the attached patch is builds correctly at least in RH73, RH9, and Fedora Core 1. The history of fedora.us libol SRPM can be found here: https://bugzilla.fedora.us/show_bug.cgi?id=1331 A scsh SRPM can be found here: https://bugzilla.fedora.us/show_bug.cgi?id=919 Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B * diff -ru libol-0.3.13+20040506-original/libol.spec.in libol-0.3.13+20040506-modified/libol.spec.in --- libol-0.3.13+20040506-original/libol.spec.in 2003-04-10 15:55:26.000000000 +0100 +++ libol-0.3.13+20040506-modified/libol.spec.in 2004-05-06 02:42:04.000000000 +0100 @@ -1,24 +1,39 @@ +# +# Before changing the macro below see the README file included in +# the syslog-ng package. +# +%define with_scheme_preprocessor 0 + Summary: Support library for syslog-ng Name: libol Version: @VERSION@ Release: 1 +Epoch: 0 License: GPL Group: System Environment/Libraries -Url: http://www.balabit.hu/products/syslog-ng/ -Source: http://www.balabit.hu/downloads/syslog-ng/libol/0.3/%{name}-%{version}.tar.… -Packager: Hollis Blanchard <hollis(a)penguinppc.org> -Buildroot: %{_tmppath}/%{name}-%{version}-buildroot +Url: http://www.balabit.com/products/syslog-ng/ +Source: http://www.balabit.com/downloads/syslog-ng/libol/0.3/%{name}-%{version}.tar… +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +Requires(post): /sbin/ldconfig +Requires(postun): /sbin/ldconfig +%if %{with_scheme_preprocessor} +BuildRequires: scsh +%endif %description Support library for syslog-ng. + %package devel -Summary: libol headers, libraries -Group: Development/Libraries -Requires: %name = %{version} +Summary: Support library for syslog-ng: headers and libraries +Group: Development/Libraries +Requires: %{name} = %{epoch}:%{version}-%{release} +%if %{with_scheme_preprocessor} +Requires: scsh +%endif %description devel -libol headers, libraries +Support library for syslog-ng: headers and libraries. %prep @@ -26,7 +41,7 @@ %build %configure -make +make %{?_smp_mflags} %install rm -rf ${RPM_BUILD_ROOT} @@ -42,21 +57,31 @@ %files -%defattr(-,root,root) -%doc ChangeLog -%{_bindir}/libol-config -%{_libdir}/libol.so +%defattr(-,root,root,-) +%doc ChangeLog COPYING %{_libdir}/libol.so.0 %{_libdir}/libol.so.0.0.0 %files devel -%defattr(-,root,root) -%{_includedir}/libol +%defattr(-,root,root,-) +%if %{with_scheme_preprocessor} +%{_bindir}/make_class +%else +%exclude %{_bindir}/make_class +%endif +%{_bindir}/libol-config %{_libdir}/libol.a %{_libdir}/libol.la +%{_libdir}/libol.so +%{_includedir}/libol %changelog +* Thu May 6 2004 Jose Pedro Oliveira <jpo(a)di.uminho.pt> - 0:0.3.13 +- update to version 0.3.13 +- macro %{with_scheme_preprocessor} +- merged several changes from the fedora.us libol specfile + * Thu Apr 10 2003 Jose Pedro Oliveira <jpo(a)di.uminho.pt> - specfile reformated - replaced hard coded values by RPM macros

2 2

RE: [syslog-ng]Problem with "kill -HUP" on syslog-ng
by Wyner, Peter 06 May '04

06 May '04

I'm receiving thousands of syslogs per second, so the truss is not that useful - it's too difficule to isolate the interval. When failed HUP issue occurrs, no log entry is written to syslog, and the daemon continues running normally. When a successful HUP occurs, the appropriate message appears in syslog. I did not have this issue when I was testing, only when I put the server under extreme load, so that be a prerequisite for the issue to occur. Peter -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Balazs Scheidler Sent: Thursday, May 06, 2004 12:59 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Problem with "kill -HUP" on syslog-ng 2004-05-06, cs keltezéssel 18:39-kor Wyner, Peter ezt írta: > I have had similar issues HUPing 1.6.2 under Solaris 2.8. My resolution > is to kill have the script kill -9 the process and start a new one > instead of HUPing. The behavior is not consistant - sometimes it will > honor the SIGHUP and sometimes it won't. can you be more specific? it simply does nothing, it crashes or? syslog-ng should send this message to the system log when it receives a system log: notice("SIGHUP received, restarting syslog-ng\n") do you receive this message when it does not correctly restart? can you attach truss to the running syslog-ng process when you send a HUP signal to it? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Tuning for high-throughput
by Wyner, Peter 06 May '04

06 May '04

On another topic..... Anyone have any guidance on optimizing syslog-ng for high-volume systems? For example, what is a good range for sync(), and are there any other options that may assist in lowering CPU? We are not using any variables in the directory of filenames other than $HOST. Here's the current conf: options { log_fifo_size(1024); dns_cache(yes); use_dns(yes); chain_hostnames(no); keep_hostname(no); create_dirs(yes);}; source local { sun-streams("/dev/log"); internal(); }; source std_udp { udp( port(52001) ); }; destination all { file("/var/log/messages"); }; destination std { file("/syslog/std/current/$HOST" dir_perm(0755) perm(0644)); }; log { source(local); destination(all); }; log { source(std_udp); destination(std); }; TIA, Peter

1 0

RE: [syslog-ng]Problem with "kill -HUP" on syslog-ng
by Wyner, Peter 06 May '04

06 May '04

I have had similar issues HUPing 1.6.2 under Solaris 2.8. My resolution is to kill have the script kill -9 the process and start a new one instead of HUPing. The behavior is not consistant - sometimes it will honor the SIGHUP and sometimes it won't. Peter -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Balazs Scheidler Sent: Thursday, May 06, 2004 12:01 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Problem with "kill -HUP" on syslog-ng 2004-05-06, cs keltezéssel 13:16-kor Stephane OMNES ezt írta: > Hi, > I need some help because I encountered a problem when trying to make some > automatic logrotate script with syslog-ng. > My "logrotate script" is the following : > /var/log/*.log { > sharedscripts > postrotate > /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || > true > endscript > } > > The syslog-ng daemon never restarts when you type "kill -HUP <syslog-ng.pid>" > I tried also "kill -SIGUP ..." same result (the daemon is stopped but never > restarts...). > Did someone ever encountered this problem ? > Is there any "proper" solution ? > > I'm currently workin under RedHat Enterprise v3.0 I don't know any problems wrt reload in syslog-ng 1.6.x, are you really sure you are HUPing the correct PID? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Problem with "kill -HUP" on syslog-ng
by Stephane OMNES 06 May '04

06 May '04

Hi, I need some help because I encountered a problem when trying to make some automatic logrotate script with syslog-ng. My "logrotate script" is the following : /var/log/*.log { sharedscripts postrotate /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true endscript } The syslog-ng daemon never restarts when you type "kill -HUP <syslog-ng.pid>" I tried also "kill -SIGUP ..." same result (the daemon is stopped but never restarts...). Did someone ever encountered this problem ? Is there any "proper" solution ? I'm currently workin under RedHat Enterprise v3.0 Thanks in advance to answer my question. Regards. Stéphane OMNES Security Engineer ************************************************************ The contents of this email and any attachments are confidential. They are intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to anyone or make copies. * email scanned for viruses, vandals and malicious content * ************************************************************

2 1

syslog-ng 1.6.3 released
by Balazs Scheidler 06 May '04

06 May '04

Hi, I have released syslog-ng 1.6.3 with the following user-visible changes: News for the 1.6.3 release Thu, 06 May 2004 11:05:46 +0200 * fixed possible abort when several UNIX domain sources refer to the same socket * fixed afunix and afinet destination template handling, do not include the PRI value automatically, let the administrator do it explicitly in its template * fixed possible segfault when the value of 0 is represented as a string in port specications (e.g. remoteport, localport, port) * added MSGONLY macro which expands to the message only without the program name which sent the log message * added global sanitize_filenames() option which changes control characters in all filenames to '.', defaults to TRUE, this might avoid escape sequence attacks embedded in filenames (imagine an administrator doing an ls in a directory where filenames contain any control characters) * avoid using GNU extensions in strftime (more specificly the timezone expansion in $ISODATE used %z which is not portable for IRIX) * added address spoofing support (use the original IP address when resending messages, read the file README.spoof for more information) * couple of IRIX specific patches were integrated * updated documentation have fun! -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

syslog-ng.sgml patch
by José Pedro Oliveira 06 May '04

06 May '04

Bazsi, Thanks for having commited the libol configure.in patch. There is a problem in the caption of one of the tables in the documentation. Right now tables 3-1 and 3-2 have the same caption. List of tables as seen in the TXT file: ------ ... List of Tables 2-1. Communication method between syslogd and its clients 2-2. Available source drivers in syslog-ng 2-3. Available destination drivers in syslog-ng 2-4. Log statement flags 3-1. Available options for unix-stream & unix-dgram 3-2. Available options for unix-stream & unix-dgram ... ---------- The patch attached corrects this problem (in the SGML file). Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B * diff -ru syslog-ng-1.7.0+20040506-original/doc/sgml/syslog-ng.sgml syslog-ng-1.7.0+20040506-modified/doc/sgml/syslog-ng.sgml --- syslog-ng-1.7.0+20040506-original/doc/sgml/syslog-ng.sgml 2004-01-09 09:19:55.000000000 +0000 +++ syslog-ng-1.7.0+20040506-modified/doc/sgml/syslog-ng.sgml 2004-05-06 00:52:34.000000000 +0100 @@ -609,7 +609,7 @@ The following options are valid for udp() and tcp() </para> <table> - <title>Available options for unix-stream & unix-dgram</title> + <title>Available options for udp & tcp</title> <tgroup cols=4> <thead> <row> Only in syslog-ng-1.7.0+20040506-modified/doc/sgml: syslog-ng.sgml.orig

1 0

RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 04 May '04

04 May '04

"/bin/sh -c" is currently hardcoded into syslog-ng. -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.co > From: Loic Minier [mailto:lool+syslog@via.ecp.fr] > Sent: Tuesday, May 04, 2004 11:35 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]cannot get sec.pl to exit after syslog-ng does > > I don't wether it's worth it, but you can try with > /usr/xpg4/bin/sh, it > is a POSIX compatibility version of sh. I use it because it > suffers of > less bugs than /bin/sh. iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 1

syslog-ng 1.7.0 on Darwin (Mac OSX Server 10.3 Panther)
by Cary, Kim 04 May '04

04 May '04

Hi all, Well, finally have this going and not crashing! Last night's 1.70 and the corresponding libol. Yay! However, I'm not grokking Darwin compared to Solaris/Linux and syslog-ng configs compared to vanilla syslog. I'm not finding much on searches that helps. The man pages for the O/S seem like they come from BSD but don't apply (see log sockets which don't exist ). I'm not a C programmer and am a bit lost trying to go to syslog.h . Little help here? IT RUNS 4.3 Berkeley Distribution June 6, 1993 4.3 Berkeley Distribution [mal-centurion:local/etc/syslog-ng] admin% sudo lsof | grep syslog tcsh 9840 admin cwd VDIR 14,21 512 200229 /usr/local/etc/syslog-ng syslog-ng 16625 root cwd VDIR 14,21 512 200229 /usr/local/etc/syslog-ng syslog-ng 16625 root 0u VCHR 3,2 0t0 20520196 /dev/null syslog-ng 16625 root 1u VCHR 3,2 0t0 20520196 /dev/null syslog-ng 16625 root 2u VCHR 3,2 0t0 20520196 /dev/null syslog-ng 16625 root 3r 0x013d5958 file struct, ty=0x3, op=0x30f300 syslog-ng 16625 root 4u IPv4 0x0142ef20 0t0 UDP *:syslog syslog-ng 16625 root 5r 0x013d3924 file struct, ty=0x3, op=0x30f300 syslog-ng 16625 root 6u IPv4 0x024554c8 0t0 TCP *:5140 (LISTEN) lsof 16894 root cwd VDIR 14,21 512 200229 /usr/local/etc/syslog-ng grep 16895 admin cwd VDIR 14,21 512 200229 /usr/local/etc/syslog-ng WHAT RUNS? I DONT KNOW THE RIGHT SOCKET/DEVICE OR PROTOCOL There is no /var/run/log or /dev/log. There is a /dev/klog but I get io.c: bind_unix_socket(): /dev/klog not a socket MY CONFIG IS FUBARED Below I place my regular config, then the syslog-ng config. VANILLA [mal-centurion:local/etc/syslog-ng] admin% more /etc/syslog.conf *.err;kern.*;auth.notice;authpriv,remoteauth,install.none;mail.crit /dev/console *.notice;local4,authpriv,remoteauth,ftp,install.none;kern.debug; mail.crit;mark.* /var/log/system.log # Send messages normally sent to the console also to the serial port. # To stop messages from being sent out the serial port, comment out this line. #*.err;kern.*;auth.notice;authpriv,remoteauth.none;mail.crit /dev/tty.serial # The authpriv log file should be restricted access; these # messages shouldn't go to terminals or publically-readable # files. authpriv.*;remoteauth.crit /var/log/secure.log lpr.info /var/log/lpr.log mail.* /var/log/mail.log ftp.* /var/log/ftp.log netinfo.err /var/log/netinfo.log install.* /var/log/install.log install.* @127.0.0.1:32376 *.emerg * local6.notice /private/var/log/mailaccess.log NEXT GENERATION ############################################################### # First, set some global options. options { # use_fqdn(yes); # use_dns(yes); # dns_cache(yes); keep_hostname(yes); long_hostnames(off); sync(1); log_fifo_size(1024); }; ############################################################### # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-stream("/dev/log"); internal(); }; source src { # don't read from /proc/kmsg and run klogd also (Linux) # pipe("/proc/kmsg"); # file("/proc/kmsg") log_prefix("kernel: "); # unix-stream("/dev/log"); # unix-stream("/chroot/named/dev/log"); internal(); udp(); # udp(ip("10.0.5.8") port(514)); tcp(port(5140) keep-alive(yes)); # tcp(ip("10.9.9.3") port(5140) keep-alive(yes)); }; ############################################################### # After that set destinations. # First some standard logfile # destination authlog { file("/var/ng-syslog/auth.log"); }; destination syslog { file("/var/ng-syslog/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/ng-syslog/daemon.log"); }; destination kern { file("/var/ng-syslog/kern.log"); }; destination lpr { file("/var/ng-syslog/lpr.log"); }; destination user { file("/var/ng-syslog/user.log"); }; destination uucp { file("/var/ng-syslog/uucp.log"); }; # This files are the log come from the mail subsystem. # #destination mail { file("/var/log/mail.log"); }; #destination maillog { file("/var/log/maillog"); }; #destination mailinfo { file("/var/log/mail.info"); }; #destination mailwarn { file("/var/log/mail.warn"); }; #destination mailerr { file("/var/log/mail.err"); }; # # Logging for INN news system # #destination newscrit { file("/var/log/news/news.crit"); }; #destination newserr { file("/var/log/news/news.err"); }; #destination newsnotice { file("/var/log/news/news.notice"); }; # Some `catch-all' logfiles. # destination debug { file("/var/ng-syslog/debug"); }; destination messages { file("/var/ng-syslog/messages"); }; # The root's console. # destination console { usertty("root"); }; The balance of that sample file is commented. The directory /var/ng-syslog exists, but none of the files. Do I have to touch those to get them going?

2 1

RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 04 May '04

04 May '04

> From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: Tuesday, May 04, 2004 10:30 AM > To: syslog-ng(a)lists.balabit.hu > Subject: RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does > > I've tried to reproduce the problem you are describing, but without > success. I attached with strace to syslog-ng and its child > process (this > time it was /bin/cat), and here are the results: > [ results snipped ] > > So cat receives the TERM signal, maybe it is blocked for you > in some ways? > Another thing that should terminate your process is that > syslog-ng closes > the write side of its pipe e.g. your perl script should have > received an EOF > on its standard input, even if it does not receive the term signal. Well, it looks like the intervening "ignore SIGTERM" action is the /bin/sh spawned as the parent of all syslog-ng children (v1.6.2, line 112 of afprogram.c). Sorry I didn't think of using truss/strace sooner. I've included the truss output below. The command line used was "truss -d -f /usr/local/sbin/syslog-ng 2>&1 | tee debug1.txt", so each line has the pid and the offset-timestamp. You'll see that the /bin/sh ignores the SIGTERM and keeps waiting for it's children. It was only after I SIGTERM'd sec.pl did the /bin/sh exit. The processes were laid out as follows: 14340 /usr/local/sbin/syslog-ng 14342 /bin/sh -c /usr/local/sbin/sec.pl -intevents -input="-" -conf=/usr/local/etc/se 14344 /usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input=- -conf=/usr/lo I sent the first SIGTERM to syslog-ng at timestamp ~7.5 seconds, where it exited and /bin/sh didn't. I SIGTERM'd /bin/sh at timestamp ~17.4 seconds, with no result. It was only after SIGTERM'ing sec.pl at ~23.4 seconds did /bin/sh give up at ~26.4 seconds. I'm not sure what to do at this point about the /bin/sh - but I'm open to suggestions. I've checked syslog-ng 1.5.26 that Nate said he was using and it has the same /bin/sh line in afprogram.c. I've found this info from the 'sh' manpage: Signals The INTERRUPT and QUIT signals for an invoked command are ignored if the command is followed by &; otherwise signals have the values inherited by the shell from its parent, with the exception of signal 11 (but see also the trap command below). But I'm not sure what it would inherit from syslog-ng. > this is in main.c around line 77: Ah yes! ok! Once again, thanks for the help. -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com RELEVANT TRUSS OUTPUT: syslog-ng --------- 14340: 0.5666 poll(0xFFBEF908, 8, 100) = 0 14340: poll(0xFFBEF908, 8, 60000) (sleeping...) 14340: signotifywait() (sleeping...) 14340: lwp_sema_wait(0xFEF0DE78) (sleeping...) 14340: door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) 14340: 7.5103 signotifywait() = 15 14340: 7.5107 Received signal #15, SIGTERM, in poll() [caught] 14340: siginfo: SIGTERM pid=13532 uid=0 14340: 7.5106 lwp_sigredirect(1, SIGTERM) = 0 14340: 7.5109 poll(0xFFBEF908, 8, 60000) Err#4 EINTR 14340: 7.5111 sigaction(SIGTERM, 0xFFBEF398, 0x00000000) = 0 14340: 7.5113 sysconfig(_CONFIG_SIGRT_MIN) = 38 14340: 7.5114 sigprocmask(SIG_SETMASK, 0xFF0DD9A8, 0x00000000) = 0 14340: 7.5116 sigaction(SIGTERM, 0xFFBEF228, 0xFFBEF328) = 0 14340: 7.5118 sigprocmask(SIG_SETMASK, 0xFF0E96D8, 0x00000000) = 0 14340: 7.5119 sysconfig(_CONFIG_SIGRT_MIN) = 38 14340: 7.5121 setcontext(0xFFBEF570) 14340: 7.5123 getpid() = 14340 [1] 14340: 7.5124 time() = 1083681719 14340: 7.5135 time() = 1083681719 14340: 7.5137 time() = 1083681719 14340: 7.5138 time() = 1083681719 14340: 7.5140 poll(0xFFBEF908, 8, 100) = 2 14340: 7.5142 write(4, " M a y 4 1 0 : 4 1".., 82) = 82 14340: 7.5145 write(9, " < 4 5 > M a y 4 1".., 86) = 86 14340: 7.5148 getpid() = 14340 [1] 14340: 7.5149 kill(14342, SIGTERM) = 0 14340: 7.5152 door_revoke(5) = 0 14340: 7.5153 close(5) Err#9 EBADF 14340: 7.5162 llseek(0, 0, SEEK_CUR) = 0 14340: 7.5164 _exit(0) /bin/sh ------- 14342: 0.2626 fork() = 14344 14342: waitid(P_PID, 14344, 0xFFBEF850, WEXITED|WTRAPPED|WNOWAIT) (sleeping...) 14342: 7.5170 Received signal #15, SIGTERM, in waitid() [caught] 14342: siginfo: SIGTERM pid=14340 uid=0 14342: 7.5178 waitid(P_PID, 14344, 0xFFBEF850, WEXITED|WTRAPPED|WNOWAIT) Err#4 EINTR 14342: 7.5180 setcontext(0xFFBEF538) 14342: waitid(P_PID, 14344, 0xFFBEF850, WEXITED|WTRAPPED|WNOWAIT) (sleeping...) 14342: 17.4322 Received signal #15, SIGTERM, in waitid() [caught] 14342: siginfo: SIGTERM pid=13532 uid=0 14342: 17.4324 waitid(P_PID, 14344, 0xFFBEF850, WEXITED|WTRAPPED|WNOWAIT) Err#4 EINTR 14342: 17.4326 setcontext(0xFFBEF538) 14342: waitid(P_PID, 14344, 0xFFBEF850, WEXITED|WTRAPPED|WNOWAIT) (sleeping...) 14342: 26.4310 waitid(P_PID, 14344, 0xFFBEF850, WEXITED|WTRAPPED|WNOWAIT) = 0 14342: 26.4318 ioctl(0, TIOCGPGRP, 0xFFBEF80C) Err#22 EINVAL 14342: 26.4319 getpgid(14344) = 14337 14342: 26.4321 ioctl(0, TIOCGPGRP, 0xFFBEF80C) Err#22 EINVAL 14342: 26.4322 waitid(P_PID, 14344, 0xFFBEF850, WEXITED|WTRAPPED) = 0 14342: 26.4326 llseek(0, 0, SEEK_CUR) Err#29 ESPIPE 14342: 26.4327 _exit(2000) sec.pl ------ 14344: 23.4165 Received signal #15, SIGTERM, in poll() [caught] 14344: siginfo: SIGTERM pid=13532 uid=0 14344: 23.4167 poll(0xFFBEF838, 0, 100) Err#91 ERESTART 14344: 23.4172 sigaction(SIGTERM, 0xFFBEF048, 0xFFBEF0C8) = 0 14344: 23.4175 setcontext(0xFFBEF520) 14344: 23.4179 time() = 1083681735 14344: 23.4181 waitid(P_ALL, 0, 0xFFBEF788, WEXITED|WTRAPPED|WNOHANG) Err#10 ECHILD 14344: 23.4183 ioctl(2, TCGETA, 0xFFBEF874) Err#6 ENXIO 14344: 23.4185 ioctl(2, TCGETA, 0xFFBEF874) Err#6 ENXIO 14344: 23.4187 time() = 1083681735 14344: 23.4189 ioctl(2, TCGETA, 0xFFBEF874) Err#6 ENXIO 14344: 23.4201 time() = 1083681735 14344: 23.4204 time() = 1083681735 14344: 23.4206 ioctl(2, TCGETA, 0xFFBEF874) Err#6 ENXIO 14344: 23.4208 time() = 1083681735 14344: 23.4211 time() = 1083681735 14344: 23.4213 ioctl(2, TCGETA, 0xFFBEF874) Err#6 ENXIO 14344: 23.4215 ioctl(2, TCGETA, 0xFFBEF874) Err#6 ENXIO 14344: 23.4217 time() = 1083681735 14344: 23.4219 alarm(0) = 0 14344: 23.4221 sigaction(SIGALRM, 0xFFBEF798, 0xFFBEF848) = 0 14344: 23.4222 sigfillset(0xFF23C4C4) = 0 14344: 23.4224 sigprocmask(SIG_BLOCK, 0xFFBEF838, 0xFFBEF828) = 0 14344: 23.4225 alarm(3) = 0 14344: sigsuspend(0xFFBEF818) (sleeping...) 14344: 26.4168 Received signal #14, SIGALRM, in sigsuspend() [caught] 14344: 26.4171 sigsuspend(0xFFBEF818) Err#4 EINTR 14344: 26.4173 setcontext(0xFFBEF500) 14344: 26.4174 alarm(0) = 0 14344: 26.4176 sigprocmask(SIG_UNBLOCK, 0xFFBEF838, 0x00000000) = 0 14344: 26.4178 sigaction(SIGALRM, 0xFFBEF798, 0x00000000) = 0 14344: 26.4179 time() = 1083681738 14344: 26.4181 getcontext(0xFFBEF5E8) 14344: 26.4183 setcontext(0xFFBEF5E8) 14344: 26.4212 getcontext(0xFFBEF4D0) 14344: 26.4219 getcontext(0xFFBEF370) 14344: 26.4221 getcontext(0xFFBEF370) 14344: 26.4244 llseek(0, 0, SEEK_CUR) Err#29 ESPIPE 14344: 26.4246 _exit(0) iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 1

RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 04 May '04

04 May '04

I am still unable to explain this. After Bazsi's explanation on the correlation between syslog-ng, C, scheme and lsh (it's not cryptic - my scheme is just a little rusty), I was able to walk through the source and see that the pid and kill handler are registered correctly in the resource list for the syslog-ng configuration. This means all children should get a SIGTERM when syslog-ng gets a SIGTERM - just before it exits the main loop. However, I am not observing this behavior. Also, I don't see CONFIG_DESTROY being called on the old configuration when the new configuration is reloaded, but I haven't walked through all that source. I'm still getting familiar with all of this so excuse me if I don't have everything straight. FYI, I'm using the libol 0.3.13 package from sunfreeware.com (SUNWlibol) and a custom complied syslog-ng 1.6.2 under Solaris 7. Any additional insights / explanations would be helpful. Thanks. Tony -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com > -----Original Message----- > From: Nate Campi [mailto:nate@campin.net] > Sent: Wednesday, April 28, 2004 10:06 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]cannot get sec.pl to exit after syslog-ng does > > On Wed, Apr 28, 2004 at 02:58:47PM -0700, Nate Campi wrote: > > > > Ok. I don't know why mine is a child of syslog-ng, and it properly > > terminates when syslog-ng does. We must not be on the same > version or > > something. 1.5.26 here. > > I just fired up sec on a solaris 9 box: > > 9130 /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf > 16508 /bin/sh -c /usr/local/sbin/sec.pl -input="-" > -conf=/usr/local/etc/sec.conf > 16509 /usr/bin/perl -w /usr/local/sbin/sec.pl -input=- > -conf=/usr/local/etc/sec.conf > > It isn't perl either, since starting a program with no arguments or > redirection also gets started by a shell on solaris: > > 9130 /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf > 16508 /bin/sh -c /usr/local/sbin/sec.pl -input="-" > -conf=/usr/local/etc/sec.conf > 16509 /usr/bin/perl -w /usr/local/sbin/sec.pl -input=- > -conf=/usr/local/etc/sec.conf > 16616 /bin/sh -c /usr/local/bin/splogger > 16617 /usr/local/bin/splogger > 16618 /bin/sh -c /usr/local/sbin/sec.pl -input="-" > -conf=/usr/local/etc/sec.conf > 16619 /usr/bin/perl -w /usr/local/sbin/sec.pl -input=- > -conf=/usr/local/etc/sec.conf > > Notice the two SEC's, I hupped syslog-ng when adding this: > > #--------------------------- > destination d_splogger { > program("/usr/local/bin/splogger"); > }; > > # send all logs to splogger > log { > source(src); > filter(f_not_brightmail); > destination(d_splogger); > }; > #--------------------------- > > So it's certainly different behavior on Linux and Solaris in > respect to > starting child processes (syslog-ng 1.5.24 on Solaris). > > Bazsi can you explain what's going on here? iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 1

libol: configure.in patch
by José Pedro Oliveira 04 May '04

04 May '04

Bazsi, Would it be possible to apply this patch against libol configure.in file? This patch allows the libol to be compiled with the same CFLAGS used in Linux distros (at least the RPM based ones). In a specfile the %configure macro automatically assigns CFLAGS with the cflags used to compile the distro. Note: The configure.in in the syslog-ng already does something similar. Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B * diff -ru libol-0.3.13+20040502-original/configure.in libol-0.3.13+20040502-modified/configure.in --- libol-0.3.13+20040502-original/configure.in 2004-01-19 13:20:38.000000000 +0000 +++ libol-0.3.13+20040502-modified/configure.in 2004-05-03 20:21:25.000000000 +0100 @@ -106,7 +106,7 @@ if test $enable_debug = "yes"; then CFLAGS="-Wall -g" else - CFLAGS="-Wall -O2" + CFLAGS="$CFLAGS -Wall" fi MAKE_CLASS="$srcdir/utils/make_class"

2 1

Unsecure remote logs
by George Edwards 03 May '04

03 May '04

I have set up syslog-ng to run locally. But I need to be able to receive logs from remote equipment that does not have the capability of sending the logs secure-such as routers. I have found a lot on how to set syslog-ng to receive remote logs securely but can anyone help me on how to receive unsecured remote logs. Thank you for all you help.

1 0

RE: [syslog-ng]libol license?
by _/CaT _ 02 May '04

02 May '04

1 0

RE: [syslog-ng]libol license?
by atonns＠mail.ivillage.com 01 May '04

01 May '04

Bazsi, Thanks for your reply. It's interesting that you'd use the GPL instead of the LGPL for libol. GPL for libraries will "infect" any code that links to it, forcing it to be GPL as well. Any particular motivation for that? I'm also wondering if there's any documentation (english) for libol - I don't see any on your site. This site (http://www.usinglinux.org/devel/libol.html) is the 3rd link on Google when searching for "libol documentation". I'm trying to hunt down how signals are handled for childen of syslog-ng and it's a blurry line where syslog-ng ends and libol begins (this is related to the other thread about sec.pl). Any info you might have would be helpful. Thanks again, Tony -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: Friday, April 30, 2004 12:21 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]libol license? > > 2004-04-29, cs keltezéssel 20:40-kor atonns(a)mail.ivillage.com > ezt írta: > > No, it is under the GPL, not LGPL. > > I've comitted a COPYING file. The source file headers > reference the GPL > properly. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD > 804E C82C 8EB1 > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 1

RE: [syslog-ng]Not finding libol, please help
by Olivia Leonard 30 Apr '04

30 Apr '04

Hi Keith I think your version of libol is too old, you need to have at least version 0.3.13 installed. Olivia -----Original Message----- From: Keith Olmstead [mailto:kolmstea@centurytel.net] Sent: 30 April 2004 16:28 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Not finding libol, please help Hello, Trying to upgrade my syslog-ng install and during the config, it is not finding my libol. checking libol version >= 0.3.13... no configure: error: Required libol version not found but I have libol installed. libol-config --version 0.3.9 Just a default install of libol. Can anyone help me as to why it is not seeing libol. It is in my path and I can not find a reason why it is not finding it. This is on a RH9 box. Thanks, Keith -- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html The Information is this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any other action taken or any views, opinions or advice contained in this email are those of the sending individual and not necessarily those of the firm. It is possible for data transmitted by e-mail to be deliberately or accidentally corrupted or intercepted. For this reason where the communication is by email, J&E Davy does not accept any responsibility for any breach of confidence which may arise from the use of this medium. If you have received this e-mail in error please notify us immediately at mailto:helpdesk@davy.ie and delete this e-mail from your system.

2 1