- syslog-ng - lists.balabit.hu

RE: [syslog-ng]UDP syslog not being logged by syslog-ng
by Moxey, Joel, CND Tech Dev, VF UK 29 Jan '03

29 Jan '03

Drew, Thanks for you help. It was me being stupid! It's the Red Hat firewall stopping it working! Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 5:14 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Joel, I'm not sure this will really make a difference and it may just be a typo in the message, but in the filters you have authprov which should be authpriv, I believe. You could also try logging just source, destination and not use any filters to see what you are getting. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 12:02 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng They are in the local log files either. I tried changing the parameter to yes and still no success. Thanks for the ideas so far... Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 2:23 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Did you check the log file for the log server host? You have keep_hostname(no) so I think that the machine will log as from the local log server. Check to see if they are in the local host log file. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 9:08 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]UDP syslog not being logged by syslog-ng Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]UDP syslog not being logged by syslog-ng
by Hamilton, Andrew 29 Jan '03

29 Jan '03

Joel, I'm not sure this will really make a difference and it may just be a typo in the message, but in the filters you have authprov which should be authpriv, I believe. You could also try logging just source, destination and not use any filters to see what you are getting. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 12:02 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng They are in the local log files either. I tried changing the parameter to yes and still no success. Thanks for the ideas so far... Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 2:23 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Did you check the log file for the log server host? You have keep_hostname(no) so I think that the machine will log as from the local log server. Check to see if they are in the local host log file. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 9:08 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]UDP syslog not being logged by syslog-ng Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]UDP syslog not being logged by syslog-ng
by Moxey, Joel, CND Tech Dev, VF UK 29 Jan '03

29 Jan '03

They are in the local log files either. I tried changing the parameter to yes and still no success. Thanks for the ideas so far... Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 2:23 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Did you check the log file for the log server host? You have keep_hostname(no) so I think that the machine will log as from the local log server. Check to see if they are in the local host log file. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 9:08 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]UDP syslog not being logged by syslog-ng Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]UDP syslog not being logged by syslog-ng
by Hamilton, Andrew 29 Jan '03

29 Jan '03

Did you check the log file for the log server host? You have keep_hostname(no) so I think that the machine will log as from the local log server. Check to see if they are in the local host log file. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 9:08 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]UDP syslog not being logged by syslog-ng Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Problems with Regexp Matching
by Brian E. Seppanen 29 Jan '03

29 Jan '03

Hi Folks: I have a bunch of cisco routers that are all configured on the routers themselves to log at facility local0, and to send their logs to one host (well a couple of hosts simlarily configured, actually). I have the following filter for syslog filter f_syslog { not facility(auth, authpriv, local0, local1, mail) and level(debug..notice) and not match("nsca");}; I've likewise tried it as filter f_syslog { not facility(auth, authpriv, mail) and level(debug..notice) and not match("nsca");}; I then have a bunch of host filters that are supposed to filter router logs filter hostA { facility(local0) and host("192.168.0.1");}; unfortunately the logs are getting into syslog, I assume because they fall within the proper level, but why is the facility not preventing that? The same thing is happening with snmptraps which are received at local1. I'd appreciate any insights. syslog-ng 1.4.16 on redhat linux 7.2 and 7.3 Are there any general rules to follow when constructing filters??? thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

1 0

UDP syslog not being logged by syslog-ng
by Moxey, Joel, CND Tech Dev, VF UK 29 Jan '03

29 Jan '03

Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel

1 0

syslog-ng 1.5.25 released
by Balazs Scheidler 29 Jan '03

29 Jan '03

Hi, I have released syslog-ng 1.5.25, available at the usual places: http://www.balabit.hu/en/downloads/syslog-ng/ Here's the NEWS file entry: News for the 1.5.25 release Mon, 20 Jan 2003 16:34:03 +0100 * The previous kernel bug workaround in libol fixed the issue for the 2.4.20rc? kernels only, the current workaround should also work for 2.4.20 final as well. * Added bad_hostname() feature where the administrator can specify a regular expression to match bad hostnames, works around bad programs such as ctld which uses a space within its program name. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

5 19

RE: [syslog-ng]Ayuda....
by Hamilton, Andrew 28 Jan '03

28 Jan '03

You should probably post your configuration but I think you have a log statement that references a source called net that is not defined as a source. Regards, Drew -----Original Message----- From: rlobo [mailto:rlobo@ula.ve] Sent: Tuesday, January 28, 2003 2:02 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Ayuda.... Buenos dias y disculpen la molestia... necesito la ayuda de ustedes, estoy compilando el syslog -ng version 1.5.23 y el php-syslog-ng-1.2, ya tengo montado los requerimientos para este paquete... El problema es que cuando hago un start al syslog-ng me refleja este erro en el archivo de configuracion del syslog-ng.conf unresolved reference: net Error initializing configuration, exiting. Nota: Ya probe colocando la mi red donde dice net, tambien coloque la ip de la maquina en donde estoy compilando el paquete... Si no soy muy explicativo por favor me lo dicen.... Muchas Gracias.... _/ _/ _/ _/ Richard J. Lobo U. _/ _/ _/ _/ _/ T.S.U. en Informatica _/ _/ _/ _/_/_/ Tecnico de Red. _/_/_/ _/_/_/ _/ _/ Facultad de Ciencias y Rectorado Merida - Venezuela Telf: +58-274-2402437 *** RedULA *** rlobo(a)ula.ve Celular 0414 - 7485627 ------------------------------------------------------------------ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]logs getting stomped on
by Hamilton, Andrew 28 Jan '03

28 Jan '03

I would have to agree with Bazsi. I've been running syslog-ng on Solaris 8 for a long while now and this never happened to me. It would pretty much have to be something on your system that is causing it. Regards, Drew -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, January 28, 2003 2:46 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]logs getting stomped on On Mon, Jan 27, 2003 at 11:10:48PM -0500, Brian Landers wrote: > > This happened to me when I had the files on a filesystem that > > had a 2GB file size limit and I hit the 2GB limit. > > Unfortunately, I'm reasonably sure this isn't the issue, unless > syslog-ng itself has problems with large files. This is on > Solaris 8, and the filesystem is mounted with the largefiles > option: > > /system on /dev/md/dsk/d50 > read/write/setuid/intr/largefiles/logging/onerror=panic/dev=1540032 on > Wed Aug 14 07:38:02 2002 > > Same thing happened again tonight, around the same time. At > about 22:30, the log mysteriously was truncated and restarted. > Arggh!!! I think it should be something outside syslog-ng as I have never heard syslog-ng doing something like this (and I was listening carefully ;) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng]logs getting stomped on
by Brian Landers 28 Jan '03

28 Jan '03

> This happened to me when I had the files on a filesystem that > had a 2GB file size limit and I hit the 2GB limit. Unfortunately, I'm reasonably sure this isn't the issue, unless syslog-ng itself has problems with large files. This is on Solaris 8, and the filesystem is mounted with the largefiles option: /system on /dev/md/dsk/d50 read/write/setuid/intr/largefiles/logging/onerror=panic/dev=1540032 on Wed Aug 14 07:38:02 2002 Same thing happened again tonight, around the same time. At about 22:30, the log mysteriously was truncated and restarted. Arggh!!! -- Brian Landers | packetslave(a)sapient.com Network System Exorcist | vox://404/439.4117 Sapient Information Technology | aim://Bluecoat93 CCNA, SCSA, EIEIO | yim://brian_landers "Trust your family to have a Bottomless Pit, Malfoy," said Harry darkly. "Other people have shrubbery in the garden. You have a Bottomless Pit."

2 1

Ayuda....
by rlobo 28 Jan '03

28 Jan '03

Buenos dias y disculpen la molestia... necesito la ayuda de ustedes, estoy compilando el syslog -ng version 1.5.23 y el php-syslog-ng-1.2, ya tengo montado los requerimientos para este paquete... El problema es que cuando hago un start al syslog-ng me refleja este erro en el archivo de configuracion del syslog-ng.conf unresolved reference: net Error initializing configuration, exiting. Nota: Ya probe colocando la mi red donde dice net, tambien coloque la ip de la maquina en donde estoy compilando el paquete... Si no soy muy explicativo por favor me lo dicen.... Muchas Gracias.... _/ _/ _/ _/ Richard J. Lobo U. _/ _/ _/ _/ _/ T.S.U. en Informatica _/ _/ _/ _/_/_/ Tecnico de Red. _/_/_/ _/_/_/ _/ _/ Facultad de Ciencias y Rectorado Merida - Venezuela Telf: +58-274-2402437 *** RedULA *** rlobo(a)ula.ve Celular 0414 - 7485627 ------------------------------------------------------------------

1 0

Re: syslog-ng misinterpreting messages from Enterasys Routers ( check_hostname )
by Ted_Rule＠flextech.co.uk 27 Jan '03

27 Jan '03

Thanks for the tip, Bazsi.... A new niggling comments, I'm afraid... check_hostname has been available since July 2002, but the only reference to it in the tar.gz is in the Changelog. There's no corresponding reference in the documentation trees, nor the FAQ. The same is true of bad_hostname of course, but that only been available recently. The code loop which performs the check_hostname check seems to contain a redundant colon check... We have: while ( ..... && *src != ':' ... ) { if ( .... || *src == ':' || ... ) {{_hostname The if clause is never true since the while test precludes it.... In effect the check_hostname option is performing hostname matches /^[A-Za-z0-9-_@:/]+$/ I can see why the "/" is needed to guard against declaring a chained-hostname as bad, but I can't quite see the logic behind the '@' inclusion. Could someone explain, please? Since my initial configuration errored on my Enterasys routers, ( effectively because the "hostname" field terminated in a "," instead of ":" or "[" ) the check_hostname() option obviously defaults to "no". Given how few good hostnames don't match /^[A-Za-z0-9-_@:/]+$/, it might be worthwhile making check_hostname() default to 'yes', or at least heavily recommending enabling the check in the FAQ. I'm guessing the check_hostname() option is a global only.. Under really odd circs, I guess some people might want it as a per-source option as well? so that a global yes can be overridden on some sources. Given that 1.5.25 now has a bad_hostname() option, how's about future releases having a good_hostname() option so that check_hostname(yes) === good_hostname( "^[A-Za-z0-9-_@:/]+$"). A hostname match then only succeeds if it passes both the good_hostname() and bad_hostname() checks, and moving the character set match for check_hostname() out to the configuration file would allow for more accurate site-specific hostname checking. Ted ............ check_hostname code loop in src/log.c /* It's a regular ol' message. */ else { /* If we haven't already found the original hostname, look for it now. */ char hostname_buf[256]; int dst; oldsrc = src; oldleft = left; dst = 0; while (left && *src != ' ' && *src != ':' && *src != '[' && dst < sizeof(hostname_buf) - 1) { if (lm->flags & LF_CHECK_HOSTNAME && !((*src >= 'A' && *src <= 'Z') || (*src >= 'a' && *src <= 'z') || (*src >= '0' && *src <= '9') || *src == '-' || *src == '_' || *src == '.' || *src == ':' || *src == '@' || *src == '/')) { break; } hostname_buf[dst++] = *src; src++; left--; } ............... =================================================================== On Thu, Jan 23, 2003 at 11:21:24AM +0000, Ted_Rule(a)flextech.co.uk wrote: > > > Having finally bitten the bullet and installed syslog-ng ( libol-0.3.6 / > syslog-ng-1.5.24 ), > I've only come across one problem... syslog messages from our Enterasys Routers > are being > corrupted. All Unix and Cisco messages appear Ok. > [snip] > > I note the version 1.5.25 has a bad_hostname() option. Is it possible that this > may be used to alleviate this issue, or is some other workround > needed? I'm guessing "keep_hostname(no)" might fix it, but would that > potentially lead to other problems? Is there a summary of the algorithm > which syslog-ng uses to determine whether the message contains a hostname? There are two ways to overcome your problem: 1) check_hostname() is a global option that disallows '%' in hostnames, turn it on in your global options() section 2) use bad_hostname() -- ================================================================= ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Re: [syslog-ng]syslog-ng 1.5.25 released
by Ted_Rule＠flextech.co.uk 27 Jan '03

27 Jan '03

From "Stevens'" great Unix Network Programming bible .... "Traditionally , System V has returned the error EAGAIN for a non-blocking I/O operation that cannot be satisfied while Berkeley-derived implementations have returned the error EWOULDBLOCK. To confuse things even more, Posix.1 specifies that EAGAIN is used while Posix.1g specifes that EWOULDBLOCK is used. Fortunately, most current systems ( including SysV and 4.4BSD ) define these two error codes to be the same ( check <sys/errno.h ), so it doesn't matter which one we use. In this text we use EWOULDBLOCK, as specified by Posix.1g" Dontcha just lurrv so many standards.... Ted Balazs Scheidler <bazsi(a)balabit.hu> on 24/01/2003 09:03:25 Please respond to syslog-ng(a)lists.balabit.hu To: syslog-ng(a)lists.balabit.hu cc: (bcc: Ted Rule/160GPS/Flextech/UK) Subject: Re: [syslog-ng]syslog-ng 1.5.25 released On Thu, Jan 23, 2003 at 07:12:53PM +0100, Roberto Nibali wrote: > >>Would you care to explain to me this fix, please? As I read it, it only > >>kicks in in case write(2) returns with a 0. But this 0 doesn't mean 0 > >>bytes have been written, but something else. I'm a bit confused. Keep in > >>mind that I haven't read your code all too well yet ;). > > > >check fd_write in libol/src/io.c, which handles EINTR and EAGAIN and > >returns 0 > >instead of -1 for those reasons. > > I see, thanks for the pointer (I'm surprised EWOULDBLOCK is portable > enough). Syslog-ng has been running on a couple of Unixes and nobody complained about EWOULDBLOCK. I think it is defined as EAGAIN on most platforms. > > Additional question: Have you or anyone else done any tests with O_SYNC or > mounting the log partition with noatime? I'm asking because I'm trying to > isolate a performance issue on a central loghost. O_SYNC would certainly increase your load. noatime could help though. Checking the output of vmstat (disk i/o, swap i/o, system and user cpu time spent) usually helps locating performance issues. > > >thanks for the report. > > I should also like to ask you about the status of the template() patch [1] > done by one of my team mates. He's not working on this project anymore and > I've taken over. If I get around to fix your concerns mentioned in [2], > would you still consider it for inclusion into 1.6.0? yes. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Re: [syslog-ng]logs getting stomped on
by Michael Rogan 27 Jan '03

27 Jan '03

Brian, This happened to me when I had the files on a filesystem that had a 2GB file size limit and I hit the 2GB limit. Michael -------------------------- Sent from my BlackBerry Wireless Handheld (www.BlackBerry.net) -----Original Message----- From: Brian Landers <packetslave(a)sapient.com> To: syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> Sent: Sun Jan 26 22:56:47 2003 Subject: [syslog-ng]logs getting stomped on I have 3 remote servers, logging to a central syslog-ng server over a reverse SSH tunnel, i.e the central server SSH's to the remote hosts, then opens a tunnel back. All servers are running 1.5.25 on Solaris 8. My problem is this, every night around 10 or 10:30pm, the log file gets overwritten, meaning it suddenly goes from starting at 00:00:01 to starting at 22:28:05 or whatever, and all the log entries prior to that are lost. There are no log rotation or other processes that would be causing this that I can find, syslog-ng appears to just mysteriously decide to start over at the begnning. Help! Relevant configs are below. --- central server --- options { time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); use_time_recvd(yes); }; source net { udp(); tcp( keep-alive(yes) ); }; destination inboundlog { file("/system/inbound_mail/logs/$YEAR-$MONTH-$DAY.log"); }; log { source(net); destination(inboundlog); }; --- remote server --- options { time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; destination loghost { tcp( "127.0.0.1" port(51400) ); }; log { source(local); destination(loghost); }; -- Brian Landers | packetslave(a)sapient.com Network System Exorcist | vox://404/439.4117 Sapient Information Technology | aim://Bluecoat93 CCNA, SCSA, EIEIO | yim://brian_landers "I know," said Harry. "We can all hang out. Go to the beach. Watch Malfoy not get tan." _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

logs getting stomped on
by Brian Landers 27 Jan '03

27 Jan '03

I have 3 remote servers, logging to a central syslog-ng server over a reverse SSH tunnel, i.e the central server SSH's to the remote hosts, then opens a tunnel back. All servers are running 1.5.25 on Solaris 8. My problem is this, every night around 10 or 10:30pm, the log file gets overwritten, meaning it suddenly goes from starting at 00:00:01 to starting at 22:28:05 or whatever, and all the log entries prior to that are lost. There are no log rotation or other processes that would be causing this that I can find, syslog-ng appears to just mysteriously decide to start over at the begnning. Help! Relevant configs are below. --- central server --- options { time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); use_time_recvd(yes); }; source net { udp(); tcp( keep-alive(yes) ); }; destination inboundlog { file("/system/inbound_mail/logs/$YEAR-$MONTH-$DAY.log"); }; log { source(net); destination(inboundlog); }; --- remote server --- options { time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; destination loghost { tcp( "127.0.0.1" port(51400) ); }; log { source(local); destination(loghost); }; -- Brian Landers | packetslave(a)sapient.com Network System Exorcist | vox://404/439.4117 Sapient Information Technology | aim://Bluecoat93 CCNA, SCSA, EIEIO | yim://brian_landers "I know," said Harry. "We can all hang out. Go to the beach. Watch Malfoy not get tan."

1 0

30��ַ100Ԫ��һ��
by tiffany＠ges.com.tw 26 Jan '03

26 Jan '03

��Ҫ��棬��㽫��Ҫ��Ĳ�Ʒ�Ͷ��ң��һ�Ϊ�㶨��Ҫ��ַ��۸�30��ַ100Ԫ��һ�ף�һ��ڽ��ҵ��usa123568(a)yaoweb.com >��ַ�Ա��ϵ��㲻��Ҫ��ҵĹ�棬�뷢�ʼ��û��usa123468 @ yaoweb.com��Ҫ�󳷳��ַ�� д�� >do you have products to sell in net ,please contact with me .i can find >300000 emailaddress for you only 10$ ,and i will sent it with a emailsendersoft to you,if you need please sent a mail to me ,my email: usa123568(a)yaoweb.com >if you want to remove your emailaddress pleses sent email to username:usa123468 its yaoweb.com and full in your emaiaddress on subject.then i will delete it

1 0

remove libol & syslog-ng after install
by Douglas, Stuart 24 Jan '03

24 Jan '03

Hello, I finally got a copy of the tarballs that would install (I did have to install flex to get syslog-ng to go). Of course I realized after doing ./configure, make, make install for both that I forgot to follow the rpm path instead by doing rpm -tb on both tarballs. I'd prefer to have the installation from the rpm packages, so how do I go about uninstalling my current setup? Should I even worry about it and just use what I've done? Thanks, Stuart

2 1

Program destination doesn't accept template. Bug?
by henriksa＠telia.com 24 Jan '03

24 Jan '03

Defining a template for a program destination causes a "Parse error reading configuration file". What's that all about? I'd like to send a short version of the log message to my mailscript that will fit nicely in the topic field. It would be a lot easier to be able to do this with syslog-ng that trying to regexp it in the script. I'm using version 1.5.23 of syslog-ng. /Henrik

1 0

RE: [syslog-ng]libol & syslog-ng tarballs error out
by Michael Breton 23 Jan '03

23 Jan '03

Try unpacking them this way: gunzip -c /path/to/libol-0.2.23.tar.gz | tar xvf - gunzip -c /path/to/syslog-ng-1.4.17.tar.gz | tar xvf - -----Original Message----- From: Douglas, Stuart [mailto:stuart.douglas@agt.com] Sent: Thursday, January 23, 2003 3:15 PM To: Syslog-Ng@Lists. Balabit. Hu (E-mail) Subject: [syslog-ng]libol & syslog-ng tarballs error out Hello, I'm running RH 7.3 and am not able to install from the tarballs. I've downloaded and attempted this several times, and the results are always the same. When I do a 'tar zxvf' on either file, they give the following: libol-0.2.23/ libol-0.2.23/src/ libol-0.2.23/src/gc.c libol-0.2.23/src/gc.h libol-0.2.23/src/io.c libol-0.2.23/src/io.h libol-0.2.23/src/list.h.x libol-0.2.23/src/xalloc.c libol-0.2.23/src/xalloc.h libol-0.2.23/src/jpoll.c libol-0.2.23/src/jpoll.h libol-0.2.23/src/read_line.c libol-0.2.23/src/read_line.h libol-0.2.23/src/resource.c libol-0.2.23/src/resource.h libol-0.2.23/src/werror.c tar: Skipping to next header tar: Archive contains obsolescent base-64 headers gzip: stdin: invalid compressed data--crc error gzip: stdin: invalid compressed data--length error tar: Child returned status 1 tar: Error exit delayed from previous errors ...and... syslog-ng-1.4.17/ syslog-ng-1.4.17/doc/ syslog-ng-1.4.17/doc/sgml/ syslog-ng-1.4.17/doc/sgml/syslog-ng.html.tar.gz syslog-ng-1.4.17/doc/sgml/syslog-ng.ps syslog-ng-1.4.17/doc/sgml/Makefile.am syslog-ng-1.4.17/doc/sgml/Makefile.in syslog-ng-1.4.17/doc/sgml/syslog-ng.dvi syslog-ng-1.4.17/doc/sgml/syslog-ng.txt syslog-ng-1.4.17/doc/sgml/syslog-ng.sgml syslog-ng-1.4.17/doc/syslog-ng.conf.sample syslog-ng-1.4.17/doc/syslog-ng.8 syslog-ng-1.4.17/doc/syslog-ng.conf.5 syslog-ng-1.4.17/doc/syslog-ng.old.txt syslog-ng-1.4.17/doc/syslog-ng.conf.solaris syslog-ng-1.4.17/doc/syslog-ng.conf.demo syslog-ng-1.4.17/doc/Makefile.am syslog-ng-1.4.17/doc/Makefile.in syslog-ng-1.4.17/doc/stresstest.sh syslog-ng-1.4.17/src/ syslog-ng-1.4.17/src/center.c syslog-ng-1.4.17/src/center.h syslog-ng-1.4.17/src/afunix.c syslog-ng-1.4.17/src/cfg-lex.c syslog-ng-1.4.17/src/cfg-lex.l syslog-ng-1.4.17/src/afuser.c syslog-ng-1.4.17/src/afuser.h syslog-ng-1.4.17/src/afprogram.c.x syslog-ng-1.4.17/src/afstreams.c.x syslog-ng-1.4.17/src/afinter.c syslog-ng-1.4.17/src/afinter.h syslog-ng-1.4.17/src/afsocket.c syslog-ng-1.4.17/src/afsocket.h syslog-ng-1.4.17/src/log.c syslog-ng-1.4.17/src/log.h syslog-ng-1.4.17/src/tests/ syslog-ng-1.4.17/src/tests/testall syslog-ng-1.4.17/src/tests/syslog-ng.conf.eval syslog-ng-1.4.17/src/tests/Makefile.am syslog-ng-1.4.17/src/tests/Makefile.in syslog-ng-1.4.17/src/tests/test.eval syslog-ng-1.4.17/src/syslog-ng.h syslog-ng-1.4.17/src/filters.c syslog-ng-1.4.17/src/filters.h syslog-ng-1.4.17/src/strcasecmp.c syslog-ng-1.4.17/src/filters.c.x syslog-ng-1.4.17/src/filters.h.x syslog-ng-1.4.17/src/afunix.c.x syslog-ng-1.4.17/src/afprogram.c syslog-ng-1.4.17/src/afprogram.h syslog-ng-1.4.17/src/log.h.x syslog-ng-1.4.17/src/cfg-grammar.c tar: Skipping to next header tar: Archive contains obsolescent base-64 headers gzip: stdin: invalid compressed data--crc error gzip: stdin: invalid compressed data--length error tar: Child returned status 1 tar: Error exit delayed from previous errors Are there any other sources for these than the balabit website? Anyone have any other ideas? Thanks, Stuart

1 0

libol & syslog-ng tarballs error out
by Douglas, Stuart 23 Jan '03

23 Jan '03

Hello, I'm running RH 7.3 and am not able to install from the tarballs. I've downloaded and attempted this several times, and the results are always the same. When I do a 'tar zxvf' on either file, they give the following: libol-0.2.23/ libol-0.2.23/src/ libol-0.2.23/src/gc.c libol-0.2.23/src/gc.h libol-0.2.23/src/io.c libol-0.2.23/src/io.h libol-0.2.23/src/list.h.x libol-0.2.23/src/xalloc.c libol-0.2.23/src/xalloc.h libol-0.2.23/src/jpoll.c libol-0.2.23/src/jpoll.h libol-0.2.23/src/read_line.c libol-0.2.23/src/read_line.h libol-0.2.23/src/resource.c libol-0.2.23/src/resource.h libol-0.2.23/src/werror.c tar: Skipping to next header tar: Archive contains obsolescent base-64 headers gzip: stdin: invalid compressed data--crc error gzip: stdin: invalid compressed data--length error tar: Child returned status 1 tar: Error exit delayed from previous errors ...and... syslog-ng-1.4.17/ syslog-ng-1.4.17/doc/ syslog-ng-1.4.17/doc/sgml/ syslog-ng-1.4.17/doc/sgml/syslog-ng.html.tar.gz syslog-ng-1.4.17/doc/sgml/syslog-ng.ps syslog-ng-1.4.17/doc/sgml/Makefile.am syslog-ng-1.4.17/doc/sgml/Makefile.in syslog-ng-1.4.17/doc/sgml/syslog-ng.dvi syslog-ng-1.4.17/doc/sgml/syslog-ng.txt syslog-ng-1.4.17/doc/sgml/syslog-ng.sgml syslog-ng-1.4.17/doc/syslog-ng.conf.sample syslog-ng-1.4.17/doc/syslog-ng.8 syslog-ng-1.4.17/doc/syslog-ng.conf.5 syslog-ng-1.4.17/doc/syslog-ng.old.txt syslog-ng-1.4.17/doc/syslog-ng.conf.solaris syslog-ng-1.4.17/doc/syslog-ng.conf.demo syslog-ng-1.4.17/doc/Makefile.am syslog-ng-1.4.17/doc/Makefile.in syslog-ng-1.4.17/doc/stresstest.sh syslog-ng-1.4.17/src/ syslog-ng-1.4.17/src/center.c syslog-ng-1.4.17/src/center.h syslog-ng-1.4.17/src/afunix.c syslog-ng-1.4.17/src/cfg-lex.c syslog-ng-1.4.17/src/cfg-lex.l syslog-ng-1.4.17/src/afuser.c syslog-ng-1.4.17/src/afuser.h syslog-ng-1.4.17/src/afprogram.c.x syslog-ng-1.4.17/src/afstreams.c.x syslog-ng-1.4.17/src/afinter.c syslog-ng-1.4.17/src/afinter.h syslog-ng-1.4.17/src/afsocket.c syslog-ng-1.4.17/src/afsocket.h syslog-ng-1.4.17/src/log.c syslog-ng-1.4.17/src/log.h syslog-ng-1.4.17/src/tests/ syslog-ng-1.4.17/src/tests/testall syslog-ng-1.4.17/src/tests/syslog-ng.conf.eval syslog-ng-1.4.17/src/tests/Makefile.am syslog-ng-1.4.17/src/tests/Makefile.in syslog-ng-1.4.17/src/tests/test.eval syslog-ng-1.4.17/src/syslog-ng.h syslog-ng-1.4.17/src/filters.c syslog-ng-1.4.17/src/filters.h syslog-ng-1.4.17/src/strcasecmp.c syslog-ng-1.4.17/src/filters.c.x syslog-ng-1.4.17/src/filters.h.x syslog-ng-1.4.17/src/afunix.c.x syslog-ng-1.4.17/src/afprogram.c syslog-ng-1.4.17/src/afprogram.h syslog-ng-1.4.17/src/log.h.x syslog-ng-1.4.17/src/cfg-grammar.c tar: Skipping to next header tar: Archive contains obsolescent base-64 headers gzip: stdin: invalid compressed data--crc error gzip: stdin: invalid compressed data--length error tar: Child returned status 1 tar: Error exit delayed from previous errors Are there any other sources for these than the balabit website? Anyone have any other ideas? Thanks, Stuart

1 0

remote wtmp logging
by paul.reilly＠tcd.ie 23 Jan '03

23 Jan '03

Does syslog-ng support enable remote wtmp logging? If so, with pipe or file or how? Thanks Paul

1 0

syslog-ng 1.9.1 released
by Balazs Scheidler 23 Jan '03

23 Jan '03

Hi, I have released syslog-ng 1.9.1 which is the first member of the 1.9.x branch. In this branch syslog-ng is reimplemented from scratch. Documentation is even more scarce than for syslog-ng 1.5.x so it is recommended to experienced users only. The program itself is in ALPHA state which means that it runs seems to work but almost certainly leaks memory. You can fetch this version by pointing your browser to http://www.balabit.hu/en/downloads/syslog-ng/downloads/ Backward compatibility was kept where possible, but some minor incompatibilies might be possible. Here is the NEWS entry for the never-released 1.9.0 and 1.9.1 which contains a summary of the new features present in this release. Feedback is appreciated. News for the 1.9.1 release Wed, 22 Jan 2003 12:13:44 +0100 This release is still not intended for production use. It has a good number of new features and a couple of them may not be stable enough. New features: * template declarations, the possibility to define a template once and refer to it * flow controlled log paths work, and they are also configurable * supports RFC3339 timestamps with second fractions and time zones, time zone conversion & source time zone specification * MARK messages are generated * keep alive for connections as well as listeners * the ability to follow log files as they are written to * the possibility to mark parts of a message using standard '(' and ')' regexp operators and refer to matches within templates (either filenames or content) This program is still ALPHA. News for the 1.9.0 release Thu, 9 May 2002 20:01:11 +0200 This release is the first release of the new reimplementation of syslog-ng. I moved to using glib instead of libol, as glib is more mature and provides several nice & easy to use features. Here's a bunch of nice things about 1.9.0: * supports flow controlled log paths (still not possible to configure it, but the code exists in the core) * better support for macros (macro support is moved out of affile, thus any other drivers may use it) * more robust detection of closed destination sockets (a closed channel is immediately detected, not at the first write) This avoids losing a log message when the connection is broken. * supports respawning destination programs (should be used with care to avoid DoS situations). This makes it easier to integrate third party extensions to syslog-ng. (SQL backends, on-line log analysis etc) * performance improvements, instead of using linear lookup in linked lists, I use hashtables everywhere. * the ability to define unparsed sources, makes it easier to integrate things like Apache logs * many internal reorganizations to make it easier to implement things like hashed log files, SSL protected TCP sessions and so on. Things still missing: * there are some new features with no configuration interface * internal messages always go to /dev/stderr * Sun's STREAMS is not yet supported 1.9.0 is currently in an ALPHA state, it's been tested only on my development computer, and not real-life traffic. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 3

doesn't write to file after logrotate
by Markus Schabel 23 Jan '03

23 Jan '03

Hello! I've configured some destinations (e.g. /var/log/syslog, /var/log/cron.log, /var/log/dhcp.log) - all the same. Then I've configured logrotate to rotate all these logs and automatically create a new one after rotating. The syslog-ng and logrotate-configurations for these files are exactly the same (just the filters are different), and it works fine for all except /var/log/dhcp.log. After it is rotated, syslog-ng doesn't write to it anymore, for the other log's it does. If I restart syslog-ng, it starts logging to /var/log/dhcp.log again. Always restarting syslog-ng after rotating dhcp.log isn't really a solution, are there any hints what I can do to solve this problem? regards Markus Schabel +--------------------------------------------+ | TGM - Die Schule der Technik, IT-Service | | A-1200 Wien, Wexstrasse 19-23 | | Tel.: +43(1)33126/316 Fax: +43(1)33126/154 | | eMail: markus.schabel(a)tgm.ac.at | | markus.schabel(a)member.fsf.org | | FSF Associate Member #597 | | Linux User #259595 (http://counter.li.org) | +--------------------------------------------+ Computers are like airconditioners: They stop working properly if you open windows.

1 0

REPLY NEEDEDS_URGENT
by PATRICK KOFI 23 Jan '03

23 Jan '03

ASSISTANCE WE ARE MEMBERS OF A SPECIAL COMMITTEE FOR BUDGET AND PLANNING OF THE NIGERIA NATIONAL PETROLEUM CORPORATION (NNPC)IN WEST AFRICA. THIS COMMITTEE IS PRINCIPALLY CONCERNED WITH CONTRACT AWARDS AND APPROVAL. WITH OUR POSITIONS, WE HAVE SUCCESSFULLY SECURED FOR OURSELVES THE SUM OF THIRTHY ONE MILLION, FIVE HUNDRED THOUSAND UNITED STATES DOLLARS (US$31.5M). THIS AMOUNT WAS CAREFULLY MANIPULATED BY OVER-INVOICING OF AN OLD CONTRACT. BASED ON INFORMATION GATHERED ABOUT YOU, WE BELIEVE YOU WOULD BE IN A POSITION TO HELP US IN TRANSFERING THIS FUND (US$31.5M) INTO A SAFE ACCOUNT. IT HAS BEEN AGREED THAT THE OWNER OF THE ACCOUNT WILL BE COMPENSATED WITH 30% OF THE REMITTED FUNDS, WHILE WE KEEP 60% AS THE INITIATORS AND 10% WILL BE SET ASIDE TO OFFSET EXPENSES AND PAY THE NECESSARY TAXES.WE INTEND TO USE PART OF OUR OWN SHARE TO IMPORT FROM YOUR COUNTRY AGRICULTURAL AND CONSTRUCTION MACHINERY. THIS IS BECAUSE THE PRESENT GOVERNMENT OF MY COUNTRY IS EMPHASISING ON PROVIDING FOOD AND HOUSING FOR ALL ITS CITIZENS BEFORE THE NEXT ELECTION. HENCE, AGRICULTURAL AND CONSTRUCTION EQUIPMENT ARE IN HIGH DEMAND OVER HERE. WE SHALL ALSO NEED YOUR ASSISTANCE IN THIS REGARD ON A COMMISSION TO BE AGREED UPON WHEN WE FINALLY MEET. ALL MODALITIES OF THIS TRANSACTION HAVE BEEN CAREFULLY WORKED OUT AND ONCE STARTED WILL NOT TAKE MORE THAN SEVEN (7) WORKING DAYS, WITH YOUR FULL SUPPORT. THIS TRANSACTION IS 100% RISK FREE. MOREOVER, WE SHALL NEED THE FOLLOWING FROM YOU TO ENABLE US BEGIN THE TRANSACTION FORMALLY. THEY ARE; YOUR FULL NAME AND ADDRESS OR YOUR COMPANY NAME, ADDRESS AND TELEPHONE/FAX NUMBERS, YOUR BANKERS NAME AND ADDRESS, YOUR ACCOUNT NUMBER AND NAME. THIS INFORMATION WILL BE USED ALONGSIDE OTHER VITAL DOCUMENTS OVER HERE IN PREPARING THE NECESSARY APPLICATION FOR PAYMENT TO THE CONCERNED QUARTERS WHERE PAYMENT APPROVALS WOULD BE SECURED IN FAVOUR OF YOUR COMPANY FOR THE PAYMENT OF OUR FUND(US$31.5M) INTO YOUR NOMINATED ACCOUNT FOR US ALL. BY OUR APPLICATION, IT WILL BE ASSUMED THAT THIS SUM IS BEING REQUESTED AS PAYMENT, WHICH IS LONG-OUTSTANDING, FOR A CONTRACT, WE SHALL CLAIM WITH OUR POSITION, YOU OR YOUR COMPANY EXECUTED FOR (NNPC) SOMETIME IN 1997. HENCE, WE SHALL FOLLOW ALL THE LEGAL OFFICIAL PROTOCOLS USUALLY OBSERVED BY FOREIGN CONTRACTORS WHENEVER THEY ARE DEMANDING PAYMENT FOR CONTRACTS EXECUTED FOR THE GOVERNMENT OF MY COUNTRY. FURTHERMORE, IMMEDIATELY THE FINAL APPROVAL IS GRANTED, THE FUND WILL BE TRANSFERRED INTO YOUR ACCOUNT WITHIN 72 HOURS, BY WHICH TIME MY PARTNERS AND I WILL BE IN YOUR COUNTRY FOR THE FINAL DISBURSEMENT IN THE RATIO ALREADY SPELT OUT TO YOU. PLEASE, YOU SHOULD ENDEAVOUR TO GIVE US AN ACCOUNT WHICH YOU HAVE ABSOLUTE CONTROL OVER. THIS IS VERY IMPORTANT BECAUSE WE WOULD NOT WANT A SITUATION WHEN THE MONEY IS IN THE ACCOUNT, YOU NOW TELL US YOU WOULD NEED TO BE AUTHORISED BY ANOTHER PERSON BEFORE WE CAN HAVE OUR OWN SHARE. YOU WILL NOT BE REQUIRED TO TRAVEL OUT OF YOUR COUNTRY, ME AND MY PARTNERS, WE TRAVEL DOWN TO YOUR COUNTRY FOR THE DISBURSEMENT OF THE FUND, AFTER THE FINAL TRANSACTION. WE WILL ALSO DISCUSS ABOUT OIL BUSINEES IN MY COUNTRY WHEN WE COME DOWN OVER THERE. BECAUSE WE WOULD LIKE TO ESTABLISH A JOINT BUSINESS WITH YOU. THAT IS WE WILL USE YOUR NAME TO REGISTER AND INCORPORATE AN OIL COMPANY IN MY COUNTRY. BESIDES, ON THE COMPLETION OF THIS TRANSFER, ALL DOCUMENTS USED FOR THE PURPOSE WILL BE WITHDRAWN FROM THE QUARTERS THEY ARE SUBMITTED BY OUR CONTACTS IN THESE OFFICES AND DESTROYED, THEREAFTER. SO, THERE WILL NOT BE ANY PROBLEM ARISING FROM THIS TRANSACTION NOW OR IN THE FUTURE. IF THIS PROPOSAL SATISFIES YOU, PLEASE REACH US ONLY BY EMAIL FOR MORE INFORMATION. PLEASE, TREAT AS URGENT AND VERY IMPORTANT. YOURS FAITHFULLY, DR.PATRICK KOFI.

1 0

RE: [syslog-ng]does syslog-ng conflict with syslogd? how avoid
by Hamilton, Andrew 22 Jan '03

22 Jan '03

Yes it will do that transparently. There is a lot of help here: http://www.campin.net/syslog-ng/faq.html Regards, Drew -----Original Message----- From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] Sent: Wednesday, January 22, 2003 3:10 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]does syslog-ng conflict with syslogd? how avoid I just installed syslog-ng. If I kill syslogd and start the syslog-ng daemon will it capture messages from apps trying to talk to syslogd transparently??? So to avoid conflicts and compatibility problems I just have to kill syslogd and swap in the new daemon??? That would be great if so.... then if I could get syslog-ng.conf done right I'm in business!! Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2363 49590 Lassing Road, Room A339 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-7940 Fax: (619) 553-1269 Email: seberino(a)spawar.navy.mil _______________________________________ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0