- syslog-ng - lists.balabit.hu

about keyserver
by sncl-hz 05 Dec '02

05 Dec '02

Sir: Just now i want to run this command for pgp key: gpg --keyserver keyserver.pgp.com --recv-keys 9AF8D0A9 but it's timeout many times. i know before tar the tar.gz, i must run the command ,and make syslog-ng working. where is the wrong? Thanks. david

1 0

about syslog-ng please
by sncl-hz 05 Dec '02

05 Dec '02

Sir: Just now ,i install syslog-ng-1.5.0 in my redhat 7.2 professional .i completely follow the INSTALL documents, but i can not success. and the directory /etc/syslog-ng does not be created . below is the fact: -------------------------------------------------------------------------------- Making all in src make[1]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' make all-recursive make[2]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' Making all in . make[3]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.0/src -I. -O2 -Wall -D_GNU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33:18: list.h: No such file or directory main.c:29:20: format.h: No such file or directory main.c:30:20: werror.h: No such file or directory main.c:31:19: queue.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make: *** [all-recursive] Error 1 [root@ syslog-ng-1.5.0]# -------------------------------------------------------------------------- i don't know the reason ,just that time my syslog are working. what should i do to cover the question ? thanks best regard. david

1 0

2.4.20 & dgram
by Rain＠home.ro 05 Dec '02

05 Dec '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 i've been messing around with syslog-ng for some time and i've recently upgraded to the 2.4.20 kernel as soon as it appeared in fact... it ran without any problem on 2.4.18/2.4.19. on the new kernel however it bails out with an unrecognised socket error from io.c... i've managed to make it work though by changing from unix-dgram to unix-stream in syslog-ng.conf. in case somebody has the same problems and syslog-ng bails out with: io.c: sockaddr2info(): Unsupported address family 63472. or something similar on the 2.4.20, i suggest the above mentioned "workaround" (change to unix-stream("/dev/log"))... if this is wrong, or somebody can explain to me.. why unix-dgram doesn't work... i'd be pleased to know :) thanks -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE97niD/cQLO9Sg2gARAoMvAJ0Wo/jHsX2NEX2wXJ3MYT6Sfhj8EwCfXpy8 PhBOYzOU6ZOYx6HeifIaxd0= =qoU6 -----END PGP SIGNATURE-----

2 1

chown
by David Rohleder 04 Dec '02

04 Dec '02

Hello, is it necessary to change owner, group and file permissions on log files? Syslog-ng does this every time daemon is reloaded. Or can i control this behavior by some command? -- ------------------------------------------------------------------------- David Rohleder davro(a)ics.muni.cz Institute of Computer Science, Masaryk University Brno, Czech Republic -------------------------------------------------------------------------

1 0

RE: [syslog-ng]centralized syslog-server.
by Jon Hofstad 04 Dec '02

04 Dec '02

aha.. Thanks! It isn`t necessery to set up local logging, is it? I only wants everything to be sent out via UPD and nothing to be stored locally.. /Jon > -----Original Message----- > From: Nate Campi [mailto:nate@campin.net] > Sent: 4. desember 2002 16:40 > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]centralized syslog-server. > > > On Wed, Dec 04, 2002 at 04:04:08PM +0100, Jon Hofstad wrote: > > > > So my host-config only pushes out the syslog-messages that > spesifies that it > > wants to be sent to the remote host? > > > > Then my question is, how should I configure the host to send out all > > messages generated, to a remote syslog-server? > > # set up logging to loghost > destination loghost { > udp("10.0.0.1" port(514)); > }; > > # send everything to loghost, too > log { > source(src); > destination(loghost); > }; > > > -- > Nate Campi http://www.campin.net > > To sysadmin or not to sysadmin... that is the question, whether tis > nobler in the minde to suffer the slings and arrowes of outragious > fortune, or climb to the top of the building with a high-power rifle > and scope. > >

2 1

RE: [syslog-ng]centralized syslog-server.
by Jon Hofstad 04 Dec '02

04 Dec '02

> > source s_send { udp(); internal(); }; ** This will only > pick up messages > from a udp source or internal. **Probably not too many since > you are not > actually sending any messages to this host. > > destination d_send { udp("192.168.80.94"); }; > > filter f_send { level(info); }; > > log { source(s_send); filter(f_send); destination(d_send); }; > ok.. So my host-config only pushes out the syslog-messages that spesifies that it wants to be sent to the remote host? Then my question is, how should I configure the host to send out all messages generated, to a remote syslog-server? -- I also spotted that i wrote the log-entry wrong in my previous mail: source crusher-1 { udp(); internal(); }; > > destination d_crusher-1 { file("/var/log/crusher-1"); }; > > filter f_crusher-1 { host("192.168.80.141"); } > > log { source(local); filter(f_filter2); destination(d_mesg); }; log { source(s_crusher-1); filter(f_crusher-1); destination(d_crusher-1); }; ## Is right :) /J

2 1

RE: [syslog-ng]centralized syslog-server.
by Hamilton, Andrew 04 Dec '02

04 Dec '02

Jon, ** comments in message. -----Original Message----- From: Jon Hofstad [mailto:Jon.Hofstad@ergo.no] Sent: Wednesday, December 04, 2002 9:25 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]centralized syslog-server. Hello. I`ve set up an syslog-ng server that will receive syslog-messages from different hosts. But I have some problems with my configuration. I was hoping some one could point out what I`m doing wrong.. ---------- This is the host`s configuration: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_send { udp(); internal(); }; ** This will only pick up messages from a udp source or internal. **Probably not too many since you are not actually sending any messages to this host. destination d_send { udp("192.168.80.94"); }; filter f_send { level(info); }; log { source(s_send); filter(f_send); destination(d_send); }; --------------------- AND here`s the server-config: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source crusher-1 { udp(); internal(); }; destination d_crusher-1 { file("/var/log/crusher-1"); }; filter f_crusher-1 { host("192.168.80.141"); } log { source(local); filter(f_filter2); destination(d_mesg); }; ----------- I`ve been snooping my interfaces and the host doesn`t seem to send out any messages via udp.. Hints are welcomed:) /Jon Hofstad _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Betr.: [syslog-ng]centralized syslog-server.
by EDL.Essed＠belastingdienst.nl 04 Dec '02

04 Dec '02

Hi, For the host you wrote: source s_send { udp(); internal(); }; This means you don't receive message from the local machine (something like unix_dgram("/dev/log"); is missing). So, are you sure you receive any messages on the host via UDP? I think internal doesn't generate any messages by default (I read here last month). Regards, Esteban. |---------+--------------------------------> | | "Jon Hofstad" | | | <Jon.Hofstad(a)ergo.no>| | | Verzonden door: | | | syslog-ng-admin@lists| | | .balabit.hu | | | | | | | | | 04-12-2002 15:24 | | | Antwoord a.u.b. aan | | | syslog-ng | | | | |---------+--------------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | Aan: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> | | cc: | |Onderwerp: [syslog-ng]centralized syslog-server. | >-------------------------------------------------------------------------------------------------------------------------------| Hello. I`ve set up an syslog-ng server that will receive syslog-messages from different hosts. But I have some problems with my configuration. I was hoping some one could point out what I`m doing wrong.. ---------- This is the host`s configuration: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_send { udp(); internal(); }; destination d_send { udp("192.168.80.94"); }; filter f_send { level(info); }; log { source(s_send); filter(f_send); destination(d_send); }; --------------------- AND here`s the server-config: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source crusher-1 { udp(); internal(); }; destination d_crusher-1 { file("/var/log/crusher-1"); }; filter f_crusher-1 { host("192.168.80.141"); } log { source(local); filter(f_filter2); destination(d_mesg); }; ----------- I`ve been snooping my interfaces and the host doesn`t seem to send out any messages via udp.. Hints are welcomed:) /Jon Hofstad _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

1 0

centralized syslog-server.
by Jon Hofstad 04 Dec '02

04 Dec '02

Hello. I`ve set up an syslog-ng server that will receive syslog-messages from different hosts. But I have some problems with my configuration. I was hoping some one could point out what I`m doing wrong.. ---------- This is the host`s configuration: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_send { udp(); internal(); }; destination d_send { udp("192.168.80.94"); }; filter f_send { level(info); }; log { source(s_send); filter(f_send); destination(d_send); }; --------------------- AND here`s the server-config: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source crusher-1 { udp(); internal(); }; destination d_crusher-1 { file("/var/log/crusher-1"); }; filter f_crusher-1 { host("192.168.80.141"); } log { source(local); filter(f_filter2); destination(d_mesg); }; ----------- I`ve been snooping my interfaces and the host doesn`t seem to send out any messages via udp.. Hints are welcomed:) /Jon Hofstad

1 0

��ӭ��
by �� 30 Nov '02

30 Nov '02

点击进入深圳网络书店：　http://www.szbookshop.com 送货上门，货到付款，还有打折哦使用极星邮件群发，无须通过邮件服务器，直达对方邮箱，速度绝对一流！下载网址：http://love2net.51.net/，更多免费的超酷软件等你来下…… ---------------------------------------------------- INFORMATION This message has been sent using a trial-run version of the TSmtpRelayServer Delphi Component. ----------------------------------------------------

1 0

Unsupported address family 63280
by Andreas Piesk 30 Nov '02

30 Nov '02

i'm trying to switch from syslogd to syslog-ng, but something goes wrong: # syslog-ng -d -F io.c: Preparing fd 3 for reading syslog-ng version 1.5.23 starting io.c: sockaddr2info(): Unsupported address family 63280. Aborted what causes it and how can i fix it? -ap -- Andreas Piesk <a.piesk(a)gmx.net> PGP-Fingerprint: 23CB A7E2 2E53 373C DBCD 8EFC 7777 61C1

2 1

Filters
by Sergio Alves de Lima Jr. 29 Nov '02

29 Nov '02

Hellow list, I am needing create filter for not log entries of connections of the pop3. Some a idea for resolution? Thanks a lot. []'s Sergio A Lima

2 2

Wrong timestamp on internal messages
by henriksa＠telia.com 29 Nov '02

29 Nov '02

These are the last two lines in the log after restarting syslog-ng: Nov 29 12:49:15 src@xxxx syslog-ng[5120]: syslog-ng version 1.5.23 going down Nov 29 12:49:16 src@xxxx syslog-ng[5133]: syslog-ng version 1.5.23 starting But 'date' gives the following: Fri Nov 29 13:49:23 MET 2002 'date -u' gives the same time as the internal message. So messages coming from other sources are timestamped with local time, internal() messages are stamped with GMT. Why is that?

3 2

Syslog-ng on Solaris 8
by Ja Wallaby 29 Nov '02

29 Nov '02

Hi, Are any of you running syslog-ng on solaris8? If so, what are the differences in the config file? I am trying to change my logging host from linux to solaris and am getting errors starting ng when using the same config file. J

3 3

Wish listt
by Peter_STRAKA＠tatrabanka.sk 28 Nov '02

28 Nov '02

Hello, With Regards Peter STRAKA TatraBanka a.s. Cernysevskeho 48 85005 Bratislava Slovak Republic Tel: +421-2-6866 3765 Email: straka(a)tatrabanka.sk ----- Forwarded by Peter STRAKA/TATRABANKA/SK on 11/28/2002 02:24 PM ----- |---------+---------------------------> | | Peter STRAKA | | | | | | 11/28/2002 01:57| | | PM | | | | |---------+---------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | | | To: syslog-ng(a)lists.balabit.huu | | cc: | | Subject: Wish listt | >-------------------------------------------------------------------------------------------------------------------------------| Hello, I use syslog-ng for longer time but I am new in this mailinglist. I didn't find any wish-list for syslog-ng on web page. I use it on linux platform and I in crontab I use chattr to change log files (imutable and appendable) I think it would be goot to have option attr() {like perm()} in config to do this. And for acl somethinf like acl option. And what about log-checking? I tried logcheck,logscanner,logsurger,logwatch,swatch, but every-one is only like better grep. I expect somethink on statistical base - somethink like http analyze. What are you thinking about? With Regards Peter STRAKA ____________________________________________________________________ Informacie obsiahnute v tomto dokumente su urcene vylucne pre potreby jeho adresata. Dokument moze obsahovat informacie chranene ako bankove alebo obchodne tajomstvo, pripadne informacie podliehajuce ochrane podla inych pravnych predpisov. Preto Vas v pripade, ak Vam bol mylne doruceny, vyzyvame, aby ste sa zdrzali jeho odtajnenia ci jeho pouzitia pre vlastne potreby. Zaroven si Vas dovolujeme poziadat, aby ste nas o takomto pripade bez zbytocneho odkladu informovali a dokument nasledne zlikvidovali. Information stated in this document is intended only for needs of proper addressees of this document. This document can contain information protected as a bank or business secret, or information protected by other legal regulations. Thus in case of receiving the document by error, we kindly ask you not to disclose, or use the document for your own needs. Likewise we kindly ask you to notify us immediately upon such a case by sending an email message to the sender's address, and subsequently delete the document. Tatra banka, a.s. Hodzovo namestie 3, 811 06 Bratislava 1 ICO: 00 686 930 Zapisana v obchodnom registri Okresneho sudu Bratislava I Oddiel: Sa, vlozka cislo: 71/B

1 0

perm 06400
by Carsten Thieswald1 27 Nov '02

27 Nov '02

I just joined the mailinglist. Therefor I copied my mailed my old mail into this one. umask sounds reasonable. But i don't have a clue how to influence it. - toutch test results in afile with 644 - umask is 022 in /etc/bashrc - I'm running RedHat 7.2 . Where can I change umask for syslog-ng? On Mon, Nov 25, 2002 at 06:23:56PM +0100, Carsten Thieswald1 wrote: > Hello, > > I try to use the option perm(0640) when creating a file. But it seems that > only the default permission is used (0600). Putiing it in the global > section doesn't change anything. I'm using version 1.4.15. I'm facing > similiar problems with dir_perm. umask ? -- Bazsi

3 2

Blocking on AIX
by Esteban Essed 27 Nov '02

27 Nov '02

Hi, I'm trying to log emergency messages to all users: destination d7 { usertty ("*"); }; The problem is this blocks on a 'bad' tty (/dev/pts/1). Using 'who' this tty shows a logged in user, but the user is not logged in anymore (since a week). In afuser.c in do_handle_afuser_log the function write_raw_with_poll() from io.c (of libol) is used and that uses poll (&pfd, 1, -1); The -1 indicates no timeout and syslog-ng blocks on this call. Is there a solution to this problem, other than not using usertty("*")? I am using syslog-ng 1.4.17 with libol 0.2.23 Thanks, Esteban Essed _________________________________________________________________ MSN 8 with e-mail virus protection service: 2 months FREE* http://join.msn.com/?page=features/virus

1 0

file source driver ???
by Salim A. Pathan 26 Nov '02

26 Nov '02

hi all, is it possible to use "/var/log/messages" file as a source driver to syslog-ng program?????? if yes then how???? can anyone tell me how to use "file("filename" [options])" ???????i got some idea from balabit.hu but not enough to start working with it. thanx in advance salim.

3 2

current directory of syslog-ng
by Ed Ravin 25 Nov '02

25 Nov '02

I'm invoking syslog-ng with these flags: /usr/local/sbin/syslog-ng -f /etc/central-syslog-ng.conf -p /logtree/tmp/syslog-ng.pid -C /logtree -u logs -g logs I see from lsof that the current working directory of syslog-ng, after it has chroot'd, is /logtree/log (the top level of all the file detinations, or "/log" in the chroot). The problem with this is that the /logtree/log directory is owned by root, and I think I'm unable to get core dumps of syslog-ng when it is run non-root and chroot'd because the file permissions of that directory don't permit syslog-ng to write a core file. What's the best way to solve this? I'm thinking a config file directive to set the current working directory would be nice. For my chroot'd environment, I had accidentally included features that don't work in a chroot, like usertty(user) which requires both root privs and access to /var/run/utmp, and I'd also specified the wrong place for the pidfile. Both of those caused aborts or segfaults when I looked at a ktrace, but no core files were ever written.

1 0

perm(0640)
by Carsten Thieswald1 25 Nov '02

25 Nov '02

Hello, I try to use the option perm(0640) when creating a file. But it seems that only the default permission is used (0600). Putiing it in the global section doesn't change anything. I'm using version 1.4.15. I'm facing similiar problems with dir_perm. Any idea Mit freundlichen Grüßen / Best regards Carsten Thieswald IBB .... an IBM Global Services Company Tel. : +49 (0) 40 6389 - 1750 mobil : +49 (0) 171 2281550

2 1

��ӭ��
by �� 25 Nov '02

25 Nov '02

点击进入深圳网络书店：　http://www.szbookshop.com 送货上门，货到付款，还有打折哦使用极星邮件群发，无须通过邮件服务器，直达对方邮箱，速度绝对一流！下载网址：http://love2net.51.net/，更多免费的超酷软件等你来下…… ---------------------------------------------------- INFORMATION This message has been sent using a trial-run version of the TSmtpRelayServer Delphi Component. ----------------------------------------------------

1 0

pgp signature problem on balabit file server
by Ed Ravin 23 Nov '02

23 Nov '02

While upgrading my syslog-ng, I also tried to upgrade lib-ol, but noticed that although there is a libol-3.3.5-tar.gz.asc file on the file server, it's a PGP encrypted message, not a PGP signature file.

2 1

crashbug fix in recent syslog-ng versions
by Balazs Scheidler 22 Nov '02

22 Nov '02

Hi, I have found two problems which are the possible cause of the crashes reported on this list. expect a new release soon if the fixes below prove to be effective. The first one is a misallocation, causing an off-by-one error: diff -u -r1.35 sources.c --- sources.c 21 Aug 2002 14:03:50 -0000 1.35 +++ sources.c 27 Oct 2002 07:35:23 -0000 @@ -163,10 +163,10 @@ self->dgram = dgram; self->next = next; self->prefix = prefix; - self->max_log_line = MAX(max_log_line, pad_size) + 1; + self->max_log_line = MAX(max_log_line, pad_size); self->pad_size = pad_size; self->msg_flags = msg_flags; - self->buffer = ol_space_alloc(max_log_line); + self->buffer = ol_space_alloc(self->max_log_line); return &self->super; } ---- end of patch The second one is triggered with much less probability, it is also an off-by-one (this one can be triggered when the byte _after_ the allocated buffer is either '\n' or '\r'). diff -u -r1.27 -r1.28 --- log.c 21 Aug 2002 14:03:50 -0000 1.27 +++ log.c 18 Oct 2002 12:31:08 -0000 1.28 @@ -44,11 +44,9 @@ static void parse_log_msg(struct log_info *lm, UINT32 length, UINT8 *data, UINT8 *prefix) { unsigned char *src; - int left; - int pri; + unsigned int left, pri, oldleft; time_t now = time(NULL); char *oldsrc; - int oldleft; src = data; left = length; @@ -241,7 +239,7 @@ lm->stamp = now; } - for (oldsrc = src, oldleft = left; oldleft >= 0; oldleft--, oldsrc++) { + for (oldsrc = src, oldleft = left; oldleft > 0; oldleft--, oldsrc++) { if (*oldsrc == '\n' || *oldsrc == '\r') *oldsrc = ' '; } lm->msg = c_format_cstring("%z%s", prefix ? prefix : (UINT8 *) "", left, src); -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

6 11

syslog-ng transform hostname
by vj23x＠netscape.net 21 Nov '02

21 Nov '02

Is there a way for syslog-ng to change the source hostname according to some regular expression before logging the message? We have some routers which have suffixes on their names we wish to strip off from the syslog messages. Example: rt001atl6-hssi6-0 -> rt001atl6 We'd like the name to get logged without everything after the '-' character. I'm stumped on how to do this with syslog-ng! It is such a powerful program, I believe it must be possible. __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

1 0

log_fifo_size() directive
by Luc Mazardo 21 Nov '02

21 Nov '02

Do you plan to use the directive log_fifo_size() as a destination option for udp() and tcp() destinations instead of use it global setting ? Thanks in advance for a futur response and for your work. -- Luc.Mazardo(a)cvf.fr

2 1