- syslog-ng - lists.balabit.hu

REPLY NEEDED
by PATRICK KOFI 12 Dec '02

12 Dec '02

ASSISTANCE WE ARE MEMBERS OF A SPECIAL COMMITTEE FOR BUDGET AND PLANNING OF THE NIGERIA NATIONAL PETROLEUM CORPORATION (NNPC)IN WEST AFRICA. THIS COMMITTEE IS PRINCIPALLY CONCERNED WITH CONTRACT AWARDS AND APPROVAL. WITH OUR POSITIONS, WE HAVE SUCCESSFULLY SECURED FOR OURSELVES THE SUM OF THIRTHY ONE MILLION, FIVE HUNDRED THOUSAND UNITED STATES DOLLARS (US$31.5M). THIS AMOUNT WAS CAREFULLY MANIPULATED BY OVER-INVOICING OF AN OLD CONTRACT. BASED ON INFORMATION GATHERED ABOUT YOU, WE BELIEVE YOU WOULD BE IN A POSITION TO HELP US IN TRANSFERING THIS FUND (US$31.5M) INTO A SAFE ACCOUNT. IT HAS BEEN AGREED THAT THE OWNER OF THE ACCOUNT WILL BE COMPENSATED WITH 30% OF THE REMITTED FUNDS, WHILE WE KEEP 60% AS THE INITIATORS AND 10% WILL BE SET ASIDE TO OFFSET EXPENSES AND PAY THE NECESSARY TAXES.WE INTEND TO USE PART OF OUR OWN SHARE TO IMPORT FROM YOUR COUNTRY AGRICULTURAL AND CONSTRUCTION MACHINERY. THIS IS BECAUSE THE PRESENT GOVERNMENT OF MY COUNTRY IS EMPHASISING ON PROVIDING FOOD AND HOUSING FOR ALL ITS CITIZENS BEFORE THE NEXT ELECTION. HENCE, AGRICULTURAL AND CONSTRUCTION EQUIPMENT ARE IN HIGH DEMAND OVER HERE. WE SHALL ALSO NEED YOUR ASSISTANCE IN THIS REGARD ON A COMMISSION TO BE AGREED UPON WHEN WE FINALLY MEET. ALL MODALITIES OF THIS TRANSACTION HAVE BEEN CAREFULLY WORKED OUT AND ONCE STARTED WILL NOT TAKE MORE THAN SEVEN (7) WORKING DAYS, WITH YOUR FULL SUPPORT. THIS TRANSACTION IS 100% RISK FREE. MOREOVER, WE SHALL NEED THE FOLLOWING FROM YOU TO ENABLE US BEGIN THE TRANSACTION FORMALLY. THEY ARE; YOUR FULL NAME AND ADDRESS OR YOUR COMPANY NAME, ADDRESS AND TELEPHONE/FAX NUMBERS, YOUR BANKERS NAME AND ADDRESS, YOUR ACCOUNT NUMBER AND NAME. THIS INFORMATION WILL BE USED ALONGSIDE OTHER VITAL DOCUMENTS OVER HERE IN PREPARING THE NECESSARY APPLICATION FOR PAYMENT TO THE CONCERNED QUARTERS WHERE PAYMENT APPROVALS WOULD BE SECURED IN FAVOUR OF YOUR COMPANY FOR THE PAYMENT OF OUR FUND(US$31.5M) INTO YOUR NOMINATED ACCOUNT FOR US ALL. BY OUR APPLICATION, IT WILL BE ASSUMED THAT THIS SUM IS BEING REQUESTED AS PAYMENT, WHICH IS LONG-OUTSTANDING, FOR A CONTRACT, WE SHALL CLAIM WITH OUR POSITION, YOU OR YOUR COMPANY EXECUTED FOR (NNPC) SOMETIME IN 1997. HENCE, WE SHALL FOLLOW ALL THE LEGAL OFFICIAL PROTOCOLS USUALLY OBSERVED BY FOREIGN CONTRACTORS WHENEVER THEY ARE DEMANDING PAYMENT FOR CONTRACTS EXECUTED FOR THE GOVERNMENT OF MY COUNTRY. FURTHERMORE, IMMEDIATELY THE FINAL APPROVAL IS GRANTED, THE FUND WILL BE TRANSFERRED INTO YOUR ACCOUNT WITHIN 72 HOURS, BY WHICH TIME MY PARTNERS AND I WILL BE IN YOUR COUNTRY FOR THE FINAL DISBURSEMENT IN THE RATIO ALREADY SPELT OUT TO YOU. PLEASE, YOU SHOULD ENDEAVOUR TO GIVE US AN ACCOUNT WHICH YOU HAVE ABSOLUTE CONTROL OVER. THIS IS VERY IMPORTANT BECAUSE WE WOULD NOT WANT A SITUATION WHEN THE MONEY IS IN THE ACCOUNT, YOU NOW TELL US YOU WOULD NEED TO BE AUTHORISED BY ANOTHER PERSON BEFORE WE CAN HAVE OUR OWN SHARE. YOU WILL NOT BE REQUIRED TO TRAVEL OUT OF YOUR COUNTRY, ME AND MY PARTNERS, WE TRAVEL DOWN TO YOUR COUNTRY FOR THE DISBURSEMENT OF THE FUND, AFTER THE FINAL TRANSACTION. WE WILL ALSO DISCUSS ABOUT OIL BUSINEES IN MY COUNTRY WHEN WE COME DOWN OVER THERE. BECAUSE WE WOULD LIKE TO ESTABLISH A JOINT BUSINESS WITH YOU. THAT IS WE WILL USE YOUR NAME TO REGISTER AND INCORPORATE AN OIL COMPANY IN MY COUNTRY. BESIDES, ON THE COMPLETION OF THIS TRANSFER, ALL DOCUMENTS USED FOR THE PURPOSE WILL BE WITHDRAWN FROM THE QUARTERS THEY ARE SUBMITTED BY OUR CONTACTS IN THESE OFFICES AND DESTROYED, THEREAFTER. SO, THERE WILL NOT BE ANY PROBLEM ARISING FROM THIS TRANSACTION NOW OR IN THE FUTURE. IF THIS PROPOSAL SATISFIES YOU, PLEASE REACH US ONLY BY EMAIL FOR MORE INFORMATION. PLEASE, TREAT AS URGENT AND VERY IMPORTANT. YOURS FAITHFULLY, DR.PATRICK KOFI.

1 0

Re: [syslog-ng]Installing on Mac OS X
by Ken Toney 12 Dec '02

12 Dec '02

>On Tue, Dec 10, 2002 at 09:42:27AM -0800, Nate Campi wrote: >> On Tue, Dec 10, 2002 at 12:32:56PM -0500, Ken Toney wrote: >> > syslog-ng directory, I ran "./configure --with -libol=path" with path >> ... >> >> You have to build libol, i.e. "./configure && make" in the libol dir >> but no "make install". Then run "./configure --with -libol=path" from >> the syslog-ng source dir. > >please note that --with-libol must be written with no spaces between 'with' >and '-libol' Thanks Nate and Balazs for your suggestions. However the space between 'with' and '-libol' was a mistake in my email only. I attempted to build libol, however, and now have an error when checking host system type. "checking host system type... configure: error: can not guess host type: you must specify one" Looking at the configure script, line 1249 is calling the config.guess script to determing the system type. But there is no entry in config.guess for Mac OS X, so the script does not recognize this system. I'm going to investigate ammending this script with an entry for OS X. I'll let the list know how it works out. Thanks. Ken Toney ktoney(a)tiff.org

2 1

encryption or hashing implemented?
by Blaise St-Laurent 12 Dec '02

12 Dec '02

I've noticed passing mention to this functionality, and i've not been able to see it implemented or documented anywhere else. A quick grep of the source reveals nothing of hashing, and a "not implmented yet" for encryption. This was in 1.4.17. is this functionality to be found in the 1.5 branch? If not, could someone point me towards the files i could modify to add hashing? Thanks. Thanks in advance, Blaise St-Laurent

2 3

Betr.: Re: [syslog-ng]pbs on syslog-ng 1.5.23 on freebsd 4.7 on / partition read-only !
by EDL.Essed＠belastingdienst.nl 11 Dec '02

11 Dec '02

Hi, Really, as mentioned by Balazs, try using /var/run/log in your syslog-ng.conf file. On Freebsd 4.5: syslog.h:#define _PATH_LOG "/var/run/log" /dev/log is a symbolic link to /var/run/log, so you can not use it to create your socket. I guess it provides an interface for applications to log to /dev/log. Trying to start the bsd syslogd with /dev/log (syslogd -p /dev/log) will also fail. Regards, Esteban. ___________________________________________ wok, n.: Something to thwow at a wabbit. ___________________________________________ |---------+--------------------------------> | | "Balazs Scheidler" | | | <bazsi(a)balabit.hu> | | | Verzonden door: | | | syslog-ng-admin@lists| | | .balabit.hu | | | | | | | | | 11-12-2002 12:40 | | | Antwoord a.u.b. aan | | | syslog-ng | | | | |---------+--------------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | Aan: rmkml <rmkml(a)wanadoo.fr> | | cc: syslog-ng(a)lists.balabit.hu | |Onderwerp: Re: [syslog-ng]pbs on syslog-ng 1.5.23 on freebsd 4.7 on / partition read-only ! | >-------------------------------------------------------------------------------------------------------------------------------| On Wed, Dec 11, 2002 at 12:35:36PM +0100, rmkml wrote: > excuse me, > > but i not have /var/run/log file ! > > on partition / read-only, syslogd good start & job ! > > why syslog-ng fail with error msg ? > io.c: bind_unix_socket(): bind failed /dev/log (Address already in use) > > because not process "use" /dev/log ! I don't really understand you here. syslog-ng fails to open /dev/log as creating a socket is a write operation. Try ktrace-ing the original syslogd to see what it does to create its socket. Maybe it creates /var/run/log and /dev/log is a symlink to /var/run/log ? I'm Ccing you to the syslog-ng list, they might have an answer ready for you. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

4 3

RE: [syslog-ng]Re: no startup
by Hamilton, Andrew 11 Dec '02

11 Dec '02

The email that I replied to said you couldn't get it to start. This was the resolution I sent. I didn't respond to your email about filters because others did. However, filter no_pop { facility(mail) and not program(pop3); }; or something similar will do. Regards, Drew -----Original Message----- From: Sergio "Alves de Lima Jr. [mailto:sergioajr@ig.com.br] Sent: Tuesday, December 10, 2002 2:01 PM To: Andrew.Hamilton(a)afccc.af.mil Cc: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Re: no startup Good everning list and Mr. Hamilton, exactly after following these steps in syslog-ng configure file, the request of authentication they continue printed in logs files. Remember: my necessity consist in not log request of the pop sessions. My server pop runing pop3 over tcpd configured via inetd.conf. Thanks a lot. []'s P.S.: Please, sorry my bad english.:-> From: "Hamilton, Andrew" <Andrew.Hamilton(a)afccc.af.mil> To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]no startup Date: Mon, 9 Dec 2002 08:31:48 -0500 charset="iso-8859-1" Reply-To: syslog-ng(a)lists.balabit.hu filter f_filter7 has a stray ; there should be no semicolon before the = and. Regards, Drew _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng]pbs on syslog-ng 1.5.23 on freebsd 4.7 on / partition read-only !
by Balazs Scheidler 11 Dec '02

11 Dec '02

On Wed, Dec 11, 2002 at 12:35:36PM +0100, rmkml wrote: > excuse me, > > but i not have /var/run/log file ! > > on partition / read-only, syslogd good start & job ! > > why syslog-ng fail with error msg ? > io.c: bind_unix_socket(): bind failed /dev/log (Address already in use) > > because not process "use" /dev/log ! I don't really understand you here. syslog-ng fails to open /dev/log as creating a socket is a write operation. Try ktrace-ing the original syslogd to see what it does to create its socket. Maybe it creates /var/run/log and /dev/log is a symlink to /var/run/log ? I'm Ccing you to the syslog-ng list, they might have an answer ready for you. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Re: can't compile on Solaris9
by Balazs Scheidler 11 Dec '02

11 Dec '02

On Mon, Dec 02, 2002 at 04:23:47PM +0100, Longina Przybyszewska wrote: > hi, > I can not compile syslog-ng-1.5.21/23 versions on Solaris9(sparc). > I am getting the following error: add -lresolv to your LDFLAGS (in Makefile), this problem has been fixed in my CVS tree, but it has not yet been released. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 6

Installing on Mac OS X
by Ken Toney 11 Dec '02

11 Dec '02

I want to install syslog-ng on Mac OS X v. 10.2.2 but am getting stuck on the configure script. I did not want to install libol. So, from the syslog-ng directory, I ran "./configure --with -libol=path" with path being the path to the libol folder. The output seems to go fine until it reaches the step "checking libol version". It can't find the libol-config file. Does anybody have any suggestion, or has anybody compiled syslog-ng on Mac OS X. Thanks, Ken Toney ktoney(a)tiff.org

3 3

pbs on syslog-ng 1.5.23 on freebsd 4.7 on / partition read-only !
by rmkml 10 Dec '02

10 Dec '02

Hello, I have a pbs on use syslog-ng 1.5.23 on my freebsd 4.7 box (libol 0.3.5) can my partition / on read-only syslog-ng not start and this view msg : io.c: bind_unix_socket(): bind failed /dev/log (Address already in use) my conf is : options { sync(0); }; source src { unix-dgram("/dev/log"); file("/dev/klog"); internal(); }; destination messages { file("/var/log/messages"); }; log { source(src); destination(messages); }; when I delete : unix-dgram("/dev/log") syslog-ng start ! or use my conf on / read-write: syslog-ng start ! # ls -la /dev/log srw-rw-rw- 1 root wheel 0 Dec 10 18:34 /dev/log If I use syslogd (internal FreeBSDv47) on / read-only, syslogd start and GOOD jobs ! Can you help me ? Regards.

2 1

Re: no startup
by Sergio Alves de Lima Jr. 10 Dec '02

10 Dec '02

Good everning list and Mr. Hamilton, exactly after following these steps in syslog-ng configure file, the request of authentication they continue printed in logs files. Remember: my necessity consist in not log request of the pop sessions. My server pop runing pop3 over tcpd configured via inetd.conf. Thanks a lot. []'s P.S.: Please, sorry my bad english.:-> From: "Hamilton, Andrew" <Andrew.Hamilton(a)afccc.af.mil> To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]no startup Date: Mon, 9 Dec 2002 08:31:48 -0500 charset="iso-8859-1" Reply-To: syslog-ng(a)lists.balabit.hu filter f_filter7 has a stray ; there should be no semicolon before the = and. Regards, Drew

1 0

sshd2 logging needed
by wolverine 10 Dec '02

10 Dec '02

Hello, I have spent the last day hacking around with syslog-ng, and thinks is great. I have just one problem that I have not found an answer to in searching google. I am having difficulty getting it to pick up the entries from sshd2. I have sshd2 set up for SyslogFacility AUTH, and get authentication attempts logged in /var/log/secure using the standard logger, but cannot get them picked up by syslog-ng. I have tried some of the various filters that I have found, but still no information shows up. Anyone have this working? syslog-ng version 1.4.17 Mandrake 8.1, 8.2, 9.0, SSH 3.2.2 At this point, just getting it to log local is fine, as I have been able to get logs to be sent using stunnel, but pretty much gutted the configs down to get this working. Thanks go out to all for syslog-ng and for their support. -Wolverine

3 4

syslog-ng server
by Razham, Razak 10 Dec '02

10 Dec '02

Hi, I kinda new to this list and syslog-ng too. I need to build a syslog server. The syslog server will do the logging for 3 snort machine, 2 web server, 2 mail server and maybe another 2 squid. I am wondering what kind of server requirement, ie, processor, RAM, hdd space etc I am looking in. thanks. am

1 0

RE: [syslog-ng]no startup
by Hamilton, Andrew 09 Dec '02

09 Dec '02

filter f_filter7 has a stray ; there should be no semicolon before the and. Regards, Drew -----Original Message----- From: sergioajr(a)ig.com.br [mailto:sergioajr@ig.com.br] Sent: Saturday, December 07, 2002 2:09 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]no startup Hello all, I am nothing statup syslog-ng. This is program return error on runing script of start: Starting syslog-ng: parse error at 38 Parse error reading configuration file, exiting. My conf file content: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source stdlog { unix-stream("/dev/log"); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(mail); and not match("[pP]op3|[pP]op"); }; log { source(stdlog); filter(f_filter1); destination(d_cons); }; log { source(stdlog); filter(f_filter2); destination(d_mesg); }; log { source(stdlog); filter(f_filter3); destination(d_auth); }; log { source(stdlog); filter(f_filter4); destination(d_mail); }; log { source(stdlog); filter(f_filter5); destination(d_mlal); }; log { source(stdlog); filter(f_filter6); destination(d_spol); }; Please, how to resolving problem? Thanks a lot P.S.: sorry my bad english. []'s ========================================== Sergio A Lima Jr. Support Analist GNU/Linux-FreeBSD Sistemas ========================================== _________________________________________________________ Voce quer um iGMail protegido contra vírus e spams? Clique aqui: http://www.igmailseguro.ig.com.br _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Parse error on line 1 (no change after update)
by Wes Hall 08 Dec '02

08 Dec '02

I think that was it. I set list in vi and cleaned out some characters but that didn't fix the problem. There must be something else hiding in there. Anyway I started typing the file in from scratch, It's probably quicker that way. I orginally thought my syntax was wrong. Thanks for your help everyone. wes

1 0

no startup
by sergioajr＠ig.com.br 07 Dec '02

07 Dec '02

Hello all, I am nothing statup syslog-ng. This is program return error on runing script of start: Starting syslog-ng: parse error at 38 Parse error reading configuration file, exiting. My conf file content: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source stdlog { unix-stream("/dev/log"); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(mail); and not match("[pP]op3|[pP]op"); }; log { source(stdlog); filter(f_filter1); destination(d_cons); }; log { source(stdlog); filter(f_filter2); destination(d_mesg); }; log { source(stdlog); filter(f_filter3); destination(d_auth); }; log { source(stdlog); filter(f_filter4); destination(d_mail); }; log { source(stdlog); filter(f_filter5); destination(d_mlal); }; log { source(stdlog); filter(f_filter6); destination(d_spol); }; Please, how to resolving problem? Thanks a lot P.S.: sorry my bad english. []'s ========================================== Sergio A Lima Jr. Support Analist GNU/Linux-FreeBSD Sistemas ========================================== _________________________________________________________ Voce quer um iGMail protegido contra vírus e spams? Clique aqui: http://www.igmailseguro.ig.com.br

1 0

config question
by Jackson, Aaron D. (OCTO) 07 Dec '02

07 Dec '02

I have syslog-ng installed on several Solaris 8 machines and it is working fine. The other day an application (Cisco Secure) blew up and started generating millions of the following log messages in a very short period: Dec 4 15:34:31 acs CiscoSecure: [ID 310893 local0.error] ERROR - error on accept # cat local0.log | grep 'ERROR - error on' | wc -l 13578934 The log file is 1GB in size and is too big to really browse through it. This situation happened once before when I was using the Solaris syslog server, however instead of logging all the messages Cisco Secure generated, it had log entries something like: Dec 4 15:34:31 acs CiscoSecure: [ID 310893 local0.error] ERROR - error on accept Last message repeated 100,000 times. Is there a way to get syslog-ng to do this? I looked through the docs, but didn't see a way. Thanks. Aaron

2 1

Parse error on line 1 (no change after update)
by wes 06 Dec '02

06 Dec '02

Well it must be something on my system that is odd. See new attempt after install of 1.5.23 below. Any ideas? Is there any debug info I can use to track down the parse error? Wes [root@EARTH syslog-ng]# cat syslog-ng.conf #options { sync(0); }; source src { udp(); internal(); }; destination misc{file("/var/log/misc");}; log{source(src); destination (misc);}; [root@EARTH syslog-ng]# /usr/local/sbin/syslog-ng -v -d -f /etc/syslog-ng/syslog -ng.conf parse error at 2 Parse error reading configuration file, exiting. (line 2)

2 1

Parse error on line 1
by wes 06 Dec '02

06 Dec '02

Yep looks like the right file. If I edit it I can move the parse error. I'll rebuild syslog-ng from scratch and see if that works. Wes Version:1.4.17 OS: Mandrake 2.4.8-34.1mdk Screen dump of 2nd try: [root@EARTH syslog-ng]# cat syslog-ng.conf options { sync(0); }; source src { udp(); internal(); }; destination misc{file("/var/log/misc");}; log{source(src); destination (misc);}; [root@EARTH syslog-ng]# whereis syslog-ng syslog-ng: /etc/syslog-ng /usr/local/sbin/syslog-ng [root@EARTH syslog-ng]# /usr/local/sbin/syslog-ng -v -d -f /etc/syslog-ng/syslog-ng.conf parse error at 1 Parse error reading configuration file, exiting. [root@EARTH syslog-ng]# cat syslog syslog-ng.conf syslog-ng.conf.old [root@EARTH syslog-ng]# cat syslog-ng.conf options { sync(0); }; source src { udp(); internal(); }; destination misc{file("/var/log/misc");}; log{source(src); destination (misc);}; [root@EARTH syslog-ng]# vi sy syslog-ng.conf syslog-ng.conf.old [root@EARTH syslog-ng]# vi syslog-ng.conf [root@EARTH syslog-ng]# /usr/local/sbin/syslog-ng -v -d -f /etc/syslog-ng/syslog -ng.conf parse error at 2 Parse error reading configuration file, exiting. [root@EARTH syslog-ng]# cat syslog-ng.conf #options { sync(0); }; source src { udp(); internal(); }; destination misc{file("/var/log/misc");}; log{source(src); destination (misc);}; [root@EARTH syslog-ng]#

2 1

Re: [syslog-ng]Chrooted syslog-ng and DNS in Solaris 8
by Guillaume LACHENAL 06 Dec '02

06 Dec '02

assuming solaris lib names are almost the same as my linux box, you need : aludra:/chroot/syslog-ng/lib# ls -l total 252 -rwxr-xr-x 1 root root 85654 Aug 14 13:37 ld-2.1.3.so lrwxrwxrwx 1 root root 11 Aug 14 13:38 ld-linux.so.2 -> ld-2.1.3.so -rw-r--r-- 1 root root 76032 Oct 30 12:01 libnsl-2.1.3.so lrwxrwxrwx 1 root root 15 Aug 14 13:36 libnsl.so.1 -> libnsl-2.1.3.so -rw-r--r-- 1 root root 11452 Nov 6 12:01 libnss_dns-2.1.3.so lrwxrwxrwx 1 root root 19 Nov 6 12:02 libnss_dns.so.2 -> libnss_dns-2.1.3.so -rw-r--r-- 1 root root 31084 Nov 6 12:01 libnss_files-2.1.3.so lrwxrwxrwx 1 root root 21 Nov 6 12:02 libnss_files.so.2 -> libnss_files-2.1.3.so -rw-r--r-- 1 root root 46624 Nov 6 15:23 libresolv-2.1.3.so lrwxrwxrwx 1 root root 18 Nov 6 15:23 libresolv.so.2 -> libresolv-2.1.3.so aludra:/chroot/syslog-ng/lib# libnss_dns / libnssfiles depends on your $CHROOT/etc/host.conf / $CHROOT/etc/nsswitch.conf regards, Guillaume henriksa(a)telia.com Sent by: syslog-ng-admin(a)lists.balabit.hu 12/06/02 14:45 Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: Subject: [syslog-ng]Chrooted syslog-ng and DNS in Solaris 8 I saw there was a discussion about this last month but that was a bit messy so I was wondering if someone could explain this a little better to me. What files do I need to copy to the chroot jail in Solaris 8 so that syslog-ng can resolve hostnames when use_dns(yes) is used? /Henrik _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Chrooted syslog-ng and DNS in Solaris 8
by henriksa＠telia.com 06 Dec '02

06 Dec '02

I saw there was a discussion about this last month but that was a bit messy so I was wondering if someone could explain this a little better to me. What files do I need to copy to the chroot jail in Solaris 8 so that syslog-ng can resolve hostnames when use_dns(yes) is used? /Henrik

1 0

Parse error on line 1
by Wes Hall 06 Dec '02

06 Dec '02

It has to be something very simple, anyone have an idea why I'm receiving this error? Thanks wes ------------------ [root@EARTH syslog-ng]# /usr/local/sbin/syslog-ng -v parse error at 1 Parse error reading configuration file, exiting. [root@EARTH syslog-ng]# ------------------- syslog-ng.conf: [root@EARTH syslog-ng]# cat syslog-ng.conf options { sync(0); }; source src { udp(); internal(); }; destination misc{file("/var/log/misc");}; log{source(src); destination (misc);}; [root@EARTH syslog-ng]#

2 1

SEGV when parsing localip - version 1.5.23
by Nigel Metheringham 05 Dec '02

05 Dec '02

I'm getting the same SEGV when a localip is specified as was described at the bottom of this message:- http://lists.balabit.hu/pipermail/syslog-ng/2002-September/003853.html Having looked at it further, looks like this function in afinet.c is the culprit void inet_address_setip(struct address_info **a, const char *ip) { CAST(inet_address_info, addr, *a); if (addr) { *a = &make_inet_address_c(ip, NULL)->super; } else { ol_string_free(addr->ip); addr->ip = c_format("%z", ip); } } The if (addr) tests if addr is NULL, and if it *is* it is then addr->ip is dereferenced causing a SEGV. Looks to me as though the if and else parts are swapped over. I'm going to experiment with that as a fix. Nigel. -- [ Nigel Metheringham Nigel.Metheringham(a)InTechnology.co.uk ] [ - Comments in this message are my own and not ITO opinion/policy - ]

1 0

RE: [syslog-ng]about syslog-ng please
by Hamilton, Andrew 05 Dec '02

05 Dec '02

That should be libol-0.3.x Drew -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Thursday, December 05, 2002 10:28 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]about syslog-ng please You also need libol-3.x. You don't have to install it but you do have to download and build it. If you don't install it in a place in your path you must tell configure when you build syslog-ng where to find libol. Regards, Drew -----Original Message----- From: sncl-hz [mailto:sncl-hz@sohu.com] Sent: Thursday, December 05, 2002 8:09 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]about syslog-ng please Sir: Just now ,i install syslog-ng-1.5.0 in my redhat 7.2 professional .i completely follow the INSTALL documents, but i can not success. and the directory /etc/syslog-ng does not be created . below is the fact: ---------------------------------------------------------------------------- ---- Making all in src make[1]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' make all-recursive make[2]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' Making all in . make[3]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.0/src -I. -O2 -Wall -D_GNU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33:18: list.h: No such file or directory main.c:29:20: format.h: No such file or directory main.c:30:20: werror.h: No such file or directory main.c:31:19: queue.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make: *** [all-recursive] Error 1 [root@ syslog-ng-1.5.0]# -------------------------------------------------------------------------- i don't know the reason ,just that time my syslog are working. what should i do to cover the question ? thanks best regard. david ?%?��?-?%?��+-��i��m��?�X��ڕ��?-�w��̬��'�Zު秶\��G��?'�� a��0q��y޷?�Z ?�j�m _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]about syslog-ng please
by Hamilton, Andrew 05 Dec '02

05 Dec '02

You also need libol-3.x. You don't have to install it but you do have to download and build it. If you don't install it in a place in your path you must tell configure when you build syslog-ng where to find libol. Regards, Drew -----Original Message----- From: sncl-hz [mailto:sncl-hz@sohu.com] Sent: Thursday, December 05, 2002 8:09 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]about syslog-ng please Sir: Just now ,i install syslog-ng-1.5.0 in my redhat 7.2 professional .i completely follow the INSTALL documents, but i can not success. and the directory /etc/syslog-ng does not be created . below is the fact: ---------------------------------------------------------------------------- ---- Making all in src make[1]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' make all-recursive make[2]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' Making all in . make[3]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.0/src -I. -O2 -Wall -D_GNU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33:18: list.h: No such file or directory main.c:29:20: format.h: No such file or directory main.c:30:20: werror.h: No such file or directory main.c:31:19: queue.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make: *** [all-recursive] Error 1 [root@ syslog-ng-1.5.0]# -------------------------------------------------------------------------- i don't know the reason ,just that time my syslog are working. what should i do to cover the question ? thanks best regard. david ?%?��?-?%?��+-��i��m��?�X��ڕ��?-�w��̬��'�Zު秶\��G��?'�� a��0q��y޷?�Z ?�j�m

1 0

syslog-ng fails to start if attempting to forward to unrouteable ip
by Nigel Metheringham 05 Dec '02

05 Dec '02

I have a box I am testing syslog-ng v1.5.23 on - its basically a stripped Red Hat 7.3 box with a 2.4.20 kernel. This box talks to other stuff via an IPSec (FreeS/WAN) link. At boot up time, when the interfaces are originally bought up, the box has almost no routes at all - it definitely has no default route. Following the syslog-ng startup the ipsec startup script runs and brings up the tunnels incidentally providing a default route. The syslog-ng config includes remote logging of some of the information to a central server - seen over the IPSec links. The destination part of this is set as udp("1.2.3.4"); However the syslog-ng startup fails with an error - from memory it is:- Error creating AF_INET socket - Network is unreachable I'm not sure if a failing destination - especially where its a network/udp one - should kill the complete daemon startup. Also can people suggest a route round this? So far the best that comes to mind is to make the remote logging run via a program which buffers anything it receives and tries repeatedly to send it until it manages to successfully sent it - but thats quite a hack. Nigel. -- [ Nigel Metheringham Nigel.Metheringham(a)InTechnology.co.uk ] [ - Comments in this message are my own and not ITO opinion/policy - ]

1 0