- syslog-ng - lists.balabit.hu

(no subject)
by Madhvi Gokool 21 Nov '02

21 Nov '02

Hello I have configured syslog on several routers and right now all the syslog messages are sent to one file. With syslog-ng, is it possible to have a log file for each router on the network. Regards madhvi

2 1

sylog-ng internal messages
by Guillaume LACHENAL 20 Nov '02

20 Nov '02

Where are syslog-ng internal() logged ? using destination d_hosts { file( "/var/log/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" ); }; i can't find anything relating to syslog-ng when grep'ing from /var/log/*/*/*/*/* thanks for help regards Guillaume

1 0

Syslog-ng 1.6
by Esteban Essed 20 Nov '02

20 Nov '02

Hi Balázs, Do you have any idea when you will be releasing 1.6? I mean a stable version of the 1.5 features. I know 1.5 is quite (very?) stable, but my employer only wants an official stable release. Regards, Esteban Essed. _________________________________________________________________ The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0

File size limit exceeded??
by Nathan 19 Nov '02

19 Nov '02

i keep getting this error every time i try and start syslog-ng the system is redhat linux 2.4.18. any clues on why i'm getting this? thanks. io.c: Preparing fd 3 for reading io.c: listening on fd 4 syslog-ng version 1.4.17 starting gc_mark: Marking object of class 'syslog_backend' (0) gc_mark: Marking object of class 'syslog_config' (1) gc_mark: Marking object of class 'resource_list' (2) gc_mark: Marking object of class 'log_source_group' (2) gc_mark: Marking object of class 'afunix_source' (3) gc_mark: Marking object of class 'listen_fd' (4) gc_mark: Marking object of class 'afsocket_accept_callback' (5) gc_mark: Marking object of class 'io_fd' (5) gc_mark: Marking object of class 'log_reader' (6) gc_mark: Marking object of class 'afsocket_source_connection' (7) gc_mark: Marking object of class 'afinet_source' (8) gc_mark: Marking object of class 'inet_address_info' (9) gc_mark: Marking object of class 'object_queue' (9) gc_mark: Marking object of class 'log_source_group' (9) gc_mark: Marking object of class 'log_center' (10) gc_mark: Marking object of class 'log_connection' (11) gc_mark: Marking object of class 'log_endpoint_info' (12) gc_mark: Marking object of class 'log_endpoint_info' (13) gc_mark: Marking object of class 'log_dest_group' (14) gc_mark: Marking object of class 'log_dest_group' (15)gc_mark: Marking object of class 'log_dest_group' (16) gc_mark: Marking object of class 'log_dest_group' (17) gc_mark: Marking object of class 'log_dest_group' (18) gc_mark: Marking object of class 'log_dest_group' (19) gc_mark: Marking object of class 'log_dest_group' (20) gc_mark: Marking object of class 'affile_dest' (21) gc_mark: Marking object of class 'affile_dest' (20) gc_mark: Marking object of class 'affile_dest' (19) gc_mark: Marking object of class 'affile_dest' (18) gc_mark: Marking object of class 'affile_dest' (17) gc_mark: Marking object of class 'affile_dest' (16) gc_mark: Marking object of class 'affile_dest' (15) gc_mark: Marking object of class 'log_connection' (12) gc_mark: Marking object of class 'log_endpoint_info' (13) gc_mark: Marking object of class 'log_endpoint_info' (14) gc_mark: Marking object of class 'log_filter' (15) gc_mark: Marking object of class 'filter_expr_op' (16) gc_mark: Marking object of class 'filter_expr_pri' (17) gc_mark: Marking object of class 'filter_expr_op' (17) gc_mark: Marking object of class 'filter_expr_pri' (18) gc_mark: Marking object of class 'filter_expr_pri' (18)gc_mark: Marking object of class 'log_filter' (16) gc_mark: Marking object of class 'filter_expr_pri' (17) gc_mark: Marking object of class 'log_filter' (17) gc_mark: Marking object of class 'filter_expr_pri' (18) gc_mark: Marking object of class 'log_filter' (18) gc_mark: Marking object of class 'filter_expr_pri' (19) gc_mark: Marking object of class 'log_filter' (19) gc_mark: Marking object of class 'filter_expr_op' (20) gc_mark: Marking object of class 'filter_expr_op' (21) gc_mark: Marking object of class 'filter_expr_pri' (22) gc_mark: Marking object of class 'filter_expr_pri' (22) gc_mark: Marking object of class 'filter_expr_pri' (21) gc_mark: Marking object of class 'log_filter' (20) gc_mark: Marking object of class 'filter_expr_pri' (21) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_connection' (13) gc_mark: Marking object of class 'log_endpoint_info' (14) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_dest_group' (17) gc_mark: Marking object of class 'afuser_dest' (18) gc_mark: Marking object of class 'log_dest_group' (17) gc_mark: Marking object of class 'afuser_dest' (18) gc_mark: Marking object of class 'log_connection' (14) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_connection' (15) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_connection' (16) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_connection' (17) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_endpoint_info' (20) gc_mark: Marking object of class 'afsocket_source_close_callback' (6) gc_mark: Marking object of class 'unix_address_info' (4) gc_mark: Marking object of class 'object_queue' (4) gc_mark: Marking object of class 'log_source_driver' (4) io.c: Preparing fd 5 for reading io.c: Preparing fd 6 for writing io.c: Preparing fd 7 for writing io.c: Preparing fd 8 for writing File size limit exceeded

2 4

syslog-ng-1.4.17 crashes
by Heinz Ekker 19 Nov '02

19 Nov '02

Hi! I am using syslog-ng 1.4.17 with libol 0.2.24 on a central log host running RedHat 7.3. It all worked fine so far, until the load on the logging servers got higher and higher, resulting in about 900MB Logs daily. Then, syslog-ng started to die randomly, apparently not connected to any particular load peaks (at least as far as I was able to check), just the normal inferno. After finding and eliminating that d*mn RedHat's 'ulimit -c 0' in the rc-script, I got several core dumps, which, when examined with gdb, all show the following backtrace: (gdb) bt #0 0x400530a1 in kill () from /lib/libc.so.6 #1 0x40052e99 in raise () from /lib/libc.so.6 #2 0x40054364 in abort () from /lib/libc.so.6 #3 0x080529e5 in fatal () #4 0x080530a7 in xalloc () #5 0x080531f7 in ol_string_alloc () #6 0x0805068f in c_format () #7 0x08053501 in do_flush () #8 0x0805162d in write_callback () #9 0x080511d7 in io_iter () #10 0x08049c45 in main_loop () #11 0x08049f81 in main () #12 0x400421c4 in __libc_start_main () from /lib/libc.so.6 As far as I know, malloc only returns NULL, if it was unable to allocate the requested memory. The machine has 1 GB physical RAM and another Gig of Swap space. I'm running the sar data collector, and at all times there were loads of free memory. Swap stays untouched, the machine is not doing much besides syslogging. At loss for any solution, I did a panic upgrade to 1.5.23 with libol 0.3.5 today, when syslog-ng died 3 times within 30 minutes. So far it runs stable, but I'll know more tomorrow. My questions: Is this a bug in the 1.4 series? Can I sleep well while running 1.5 (marked as 'development')? It is imperative for us that no messages, or at least as few as possible, are lost, for dealing with abuse requests and customer inquiries. TIA, -- Heinz Ekker, mailto:heinz.ekker@uta.at Do not meddle in the affairs | UTA Systems Engineering Unix of wizards, for they are | 1220 Wien, Ares Tower Zelle 619 subtle and quick to anger. | Phone: +43 1 9009 4625/Fax -3697

2 5

RE: [syslog-ng]syslog-ng on Redhat 7.1 server
by Hamilton, Andrew 19 Nov '02

19 Nov '02

The configuration files normally reside in this directory. With most of the distributions usually a sample config file ends up in there. 1.4.11 is kind of old though. But here is a sample config file attached you can use. It is only a sample and will need to be modified to suit your environment. Also by default syslog-ng looks for syslog-ng.conf in /etc/syslog-ng. I'm not sure where the rpm would put the contents of the doc directory. Regards, Drew -----Original Message----- From: Madhvi Gokool [mailto:madhvin@yahoo.com] Sent: Tuesday, November 19, 2002 6:31 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng on Redhat 7.1 server hello i have downloaded the rpm for syslog-ng (syslog-ng-1.4.11-1.i386.rpm) and libol(libol-0.2.21-1.i386.rpm). I installed them on my server by using the command rpm -i syslog-ng-1.4.11-1.i386.rpm rpm -i libol-0.2.21-1.i386.rpm the syslog-ng directory is created under the /etc directory. However, the syslog-ng directory does not contain any files. Grateful if someone could help Regards madhvi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng on Redhat 7.1 server
by Madhvi Gokool 19 Nov '02

19 Nov '02

hello i have downloaded the rpm for syslog-ng (syslog-ng-1.4.11-1.i386.rpm) and libol(libol-0.2.21-1.i386.rpm). I installed them on my server by using the command rpm -i syslog-ng-1.4.11-1.i386.rpm rpm -i libol-0.2.21-1.i386.rpm the syslog-ng directory is created under the /etc directory. However, the syslog-ng directory does not contain any files. Grateful if someone could help Regards madhvi

1 0

Locals in Syslog.
by Jon Hofstad 14 Nov '02

14 Nov '02

Hello. I`m working on a project where I need to set up a syslog-environment. I have about 140 servers that needs to send their syslog-info to a centralized syslog-ng server. My challenge is that I need to identify each server with their own local-value. Default, syslog has a limitation in how many locals you can define, isn`t it 8? Has anyone had experience with changing this value to whatever number; e.g 100? Regards Jon Hofstad

2 1

Upgrade problems??
by Abraham, Ajamu 14 Nov '02

14 Nov '02

I updated my freeBSD server running syslog-ng 1.4.12 to syslog-ng 1.5.23. I installed the new libol 0.3.5 prior to the upgrade. It seemed to have installed correctly with no errors. However when I try to start the program I revieve this message: absys# /usr/local/sbin/syslog-ng -v binding fd 3, inetaddr: 0.0.0.0, port: 514 binding fd 5, inetaddr: 0.0.0.0, port: 514 unresolved reference: DEFAULT Error initializing configuration, exiting. I thought this must be related to the options I have chosen in my configuration file. Here is the top section of my syslog-ng.conf file, where I define my options: absys# vi /usr/local/etc/syslog-ng/syslog-ng.conf #syslog-ng configuration. # # what the default options are for files that it writes # options { sync(0); time_reopen(10); log_fifo_size(100); }; ############################################################## # Sources: ############################################################### source src { tcp(); udp(); internal(); }; ### FILTERS ### Please help...thanks in advance! Ajamu Abraham Network Engineer About, Inc. 249 West 17th Street 2nd Floor New York, NY 10011 Direct: 212.204.1525 Cell #: 917.682.2246 "l'argent comptant règne tout autour de moi"

2 1

Re: syslog-ng 2.x
by Balazs Scheidler 13 Nov '02

13 Nov '02

On Wed, Nov 13, 2002 at 05:35:10PM +0100, "Lacruz Gimeno, José" wrote: > Balazs, > > we would like to use syslog-ng on HP-UX boxes, but we've been told it won't > do a good job till version 2, where message padding is handled correctly. We > would like to know if there is an estimated release date for this version. hmm... I've implemented input padding in the latest 1.5.x versions as well, and I had at least one success reports. please give it a try (the option might be undocumented), but it is used this way: source s_hpux { pipe("/dev/log" pad_size(2048)); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

syslog-n limits.
by Luc Mazardo 12 Nov '02

12 Nov '02

hello, I use syslog-ng (syslog-ng-1.4.17) and try to do some benchmarks with it. I've some problems for tuning it. The load average of syslog is more than 10.0 on a bi PIII 860 on a linux box decreasing to 2.0. My test is 50 clients simultaneously (using syslog() system call) with 500 logs per second during 5 minutes. Here is the option i use: options { use_dns(no); long_hostnames(off); sync(100); log_fifo_size(5000); gc_idle_threshold(50);gc_busy_threshold(5000); }; source src { unix-stream("/dev/log" max-connections(100)); internal(); udp(); }; Is there a different parameter to use for not increasing so much the load avg ? Thanks in advance. -- Luc.Mazardo(a)cvf.fr

1 0

TCP Questions
by Jeff McReynolds 12 Nov '02

12 Nov '02

We are in need of a solution to move many different kinds of logs across our network. Traditionally our developers have pretty much just dumped log files where ever which of course is unmanagable after a while. We are currently using NG with Apache and are comfortable with the idea of loosing a log every now and then. What we cannot do is loose logs that our developer's applications are sending to the server. It appeared that a good way to accomplish this would be to use the TCP functionality built into NG. I have had some difficulty getting NG to accept the parameters listed on the docs page for the TCP connection. I even copied them verbatim at one point and still receive a parse error on the destination line in question. So, Two questions I guess: 1.) Can the TCP functionality be used as a fault tolerant solution for our developers logging needs? 2.) Does anyone have any suggestion as to why the following line would fail? destination d_joust { tcp("192.168.30.225" port(1999); localport(999)); }; <------------ Line 22 causing the parse error. filter f_tcp { (level(info) and facility (local7)); } log { source(s_sys); filter(f_tcp); destionation(d_joust); }; parse error at 22 Parse error reading configuration file, exiting. Thanks for any suggestions. -JMc

2 1

Re: syslog-ng and Solaris 8
by Balazs Scheidler 12 Nov '02

12 Nov '02

On Mon, Nov 11, 2002 at 12:45:18PM -0800, Rude Yak wrote: > Hello, Baszi. I'm having some stability issues on Solaris 8 and I'm not > quite sure how to best go about resolving them. Occasionally, I will notice > syslog-ng crashing, most often after receiving a UDP-based message. Running in > debug mode, I see the following: > > bash-2.05a# /apps/syslog-ng/current/sbin/syslog-ng -vdF -f > /apps/syslog-ng/etc/syslog-ng.conf > binding fd 3, inetaddr: 0.0.0.0, port: 514 > io.c: Preparing fd 3 for reading > io.c: connecting using fd 7 > connecting fd 7 to inetaddr 10.130.230.162, port 514 > io.c: connecting using fd 8 > connecting fd 8 to inetaddr 10.120.230.161, port 514 > syslog-ng version 1.5.17 starting > io.c: Preparing fd 8 for writing > io.c: Preparing fd 7 for writing > io.c: Preparing fd 9 for writing > io.c: sockaddr2info(): Unsupported address family 0. > Abort (core dumped) > > I'm building syslog-ng with gcc 3.1 on Solaris 8 with the following setup: > > syslog-ng 1.5.23 > libol 0.3.5 > CFLAGS -m64 -O3 > > > I'm attaching the core dump just in case. In this particular case, syslog-ng > crashes as soon as spamd (from the spamassassin package) connects. The lines > in spamd are something like: > > if ($log_facility ne 'stderr') { > eval { > setlogsock('unix'); > syslog('debug', 'spamd starting'); # required to actually open the socket > }; > > Is there something in my syslog-ng configuration that may be causing issues? no, as it seems solaris doesn't return a sensible address for unix domain socket peers. btw: solaris does not usually use unix domain sockets for log transport, what driver do you use for /dev/log? (usually it is a STREAMS device) this patch should fix it (touch io.c.x after applying): diff -u -r1.31 io.c --- io.c 14 Oct 2002 08:05:38 -0000 1.31 +++ io.c 12 Nov 2002 07:40:01 -0000 @@ -1024,13 +1024,17 @@ struct sockaddr_un *un = (struct sockaddr_un *) addr; return &make_unix_address(c_format("%z", un->sun_path))->super; } + case AF_UNSPEC: + break; #if 0 case AF_INETv6: break; #endif default: - fatal("io.c: sockaddr2info(): Unsupported address family %i.\n", addr->sa_family); + werror("io.c: sockaddr2info(): Unsupported address family %i (addrlen=%i).\n", addr->sa_family, addr_len); + break; } + return NULL; } #if 0 -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Basic questions
by qian＠x85.com 11 Nov '02

11 Nov '02

I'm new to this mailing list. Here are some basic questions. Any help is appreciated. Q1. If I want to set a centralize log server, do i need to run your version of syslogd (syslog-ng) on log server only or all the clients need that version too? Q2. To save log from differnt host to its file, one needs to specify this: destination host ( file("/var/log/$HOST/....") ) on /etc/syslog.conf only on log server? Q3. If I use a rely server, so log generated from host1, relyed thru host2 to log server, is it recorded as host2 or host1 or host1/host2 depending on the option of keep_hostname/chain_hostname? What I want is to preserve the orinigal host (host1), how to do it? Yonglin Qian

2 1

(no subject)
by Danczi Jozef 11 Nov '02

11 Nov '02

______________________________________________________ Get Paid... With Your Free Email at http://www.zwallet.com/index.html?user=hermes1

1 0

res_init not found on Solaris 9
by joe781＠att.net 11 Nov '02

11 Nov '02

I am using Libol 0.3.5 and syslog-ng 1.5.23. Libol installed without a problem. The make for syslog-ng terminates as follows: gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor -lfl /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file res_init main.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /usr/local/src/syslog-ng-1.5.23/src The ./configure step finds it OK. Where would I find it? TIA. Joe Haggerty

3 2

Error: Changing permissions on special file?
by Joerg Sommer 10 Nov '02

10 Nov '02

Hi, why is the changing of the permissions on a special file an error? This could be an info message or an warning, but not an error. Joerg.

1 0

autoheader error building 1.5.23 under Mandrake 9.0
by Jay Levitt 10 Nov '02

10 Nov '02

On my Mandrake 9.0 box, I get the following error during make: cd /home/jay/syslog-ng-1.5.23 && autoheader /usr/bin/autoheader-2.13: Symbol `HAVE_RES_INIT' is not covered by /usr/share/autoconf/acconfig.h ./acconfig.h I have automake 1.4-p6 and autoconf/autoheader 2.13. I don't really understand the workings of the GNU automake/autoconf tools, but it definitely seems that HAVE_RES_INIT is in config.in but not acconfig.h. This symbol wasn't referenced in 1.5.22, so that builds fine.. Jay Levitt

2 1

RE: [syslog-ng]Information regarding interpreting Syslog messages
by Wrzesinski, Michael 08 Nov '02

08 Nov '02

Hello, maybe have a look at Tina Birds web site (http://www.shmoo.com/~tbird/) There are a few references. regards Michael Wrzesinski > -----Ursprüngliche Nachricht----- > Von: Deepu George [mailto:DEEPUG@mascotsystems.com] > Gesendet: Freitag, 8. November 2002 05:49 > An: syslog-ng(a)lists.balabit.hu > Betreff: [syslog-ng]Information regarding interpreting Syslog messages > > > Hi All, > > Is there any documentation available which can help to > interpret syslog > messages > > Best regards > Deepu

1 0

Information regarding interpreting Syslog messages
by Deepu George 08 Nov '02

08 Nov '02

Hi All, Is there any documentation available which can help to interpret syslog messages Best regards Deepu DISCLAIMER: Information contained and transmitted by this E-MAIL is proprietary to Mascot Systems Limited and is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If this is a forwarded message, the content of this E-MAIL may not have been sent with the authority of the Company. If you are not the intended recipient, an agent of the intended recipient or a person responsible for delivering the information to the named recipient, you are notified that any use, distribution, transmission, printing, copying or dissemination of this information in any way or in any manner is strictly prohibited. If you have received this communication in error, please delete this mail & notify us immediately at Mailadmin(a)mascotsystems.com Before opening attachments, please scan for viruses.

1 0

REAL ESTATE!!!!!!!!!!!!!!!!!!!!!!!
by DR.JOHNSON IGE. 08 Nov '02

08 Nov '02

ATTN:SIR. ASSISTANCE REQUIRED FOR ACQUISITION OF ESTATE I write to inform you of my desire to acquire estates or landed properties in your country.Considering your very strategic and influential position I know you will be in a better possition to help us, We would want the transaction to be strictly confidential as possible,hence our desire to have an overseas agent. I have therefore been directed to inquire if you would agree to act as our overseas agent in order to actualize this transaction.The deal,in brief,is that the funds with which we intend to carry out our proposed investments in your country is presently in a coded Escrow account of a Bank in Canada. However,I am,DR.JOHNSON IGE. a native of Warri in Niger Delta,Nigeria and I am the Executive Director with the Nigerian Export Processing Zone Authority of Nigeria (NEPZA).Please accept my apology for using this medium to reach you for a transaction/business of this magnitude,but this is due to the confidentiality and prompt access reposed on this medium.Be informed that a member of the Nigerian Export promotion Council(NEPC) who was the Government delegation to your country during a trade exhibition gave your enviable credentials/particulars to me.I have decided to seek your co-operation in the execution of the deal described hereunder for the benefit of all parties and hope you will keep it as a top secret because of the nature of this business. Within my Department NEPZA where I work as a Director and with the cooperation of Two other top Management officials.We have in our possession as overdue payment bills totalling to Thirty One Million,Five hundred Thousand US Dollars(US$3I,500.000.00) which was our commission for awarding a contract to Jullius Bergger of Germany A construction firm based in Germany.This amount(US$31.5M)represent the balance of the total contract value executed on behalf of my Department by this foreign contracting firm which we the officials over-invoiced deliberately.Though the actual cost have been paid to the original contractor leaving the balance in the tune of the said amount which we have in principle gotten approval to remit by Key Tested Telegraphic Transfer(K.T.T)to any foreign bank account you will provide by filing in an application through the Bank in Canada where the fund have been lodge for the transfer of rights and priviledge of the former contractor.Our arrangement with the construction company was to deposit our over-involce sum into a save account with the bank till we retire from active service to my Ministry for investment in your country.As you Know,we are civil servant and does not have the previledge to operate a foriegn account. We have made countless effort with the management of the bank in Canada to see that the fund is transfer to another country for the propose investment,the management of the bank turn the application down that legal documentation must be effected before the fund is been transfer to any bank account.As a civil servant to the Government,we can not obtain this documents without the help or assistance of an international acclaimed personality(Foriegn Body)to fixe in as the true contractor/beneficiary to the fund,these will enable us obtain all relevant documents in your favour with the assistance of the accredited Attorney with my Ministry. We are soliciting for your mutual understanding in lodging in application to the bank in Canada as soon as all the documents is processed in your name to release or transfer the contract fund to your account.We will truely compensate you for your candid effort in this deal and as well,you will be acting as our agent for the landed/housing property in your country.Once you have confirm your willingness to help us,the name and contact address of the bank,our account information with the bank and all the relevant details of the contract fund will be given to you for your perusal and for confirmation with the bank in Canada.The cost of processing the backup documents will be a collective responsibility from both parties so your sincerity and understanding will be highly appreciated to enable us achieve success. All we need from you now is your company name & address(if any),telephone & fax numbers,your banking details and your recent picture for identification when we come over to your country for the project.As soon as i hear from you,I will give you our website to visit. Thank you so much for your understanding and I await your urgent response to this mail. Yours Faithfully, DR.JOHNSON IGE. N.E.P.Z.A.

1 0

Re: [syslog-ng]replacing Linux klogd by a chrooted syslog-ng running as a non root user
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

Balazs Scheidler wrote : > On Thu, Nov 07, 2002 at 03:10:50PM +0100, Guillaume LACHENAL wrote: > > Is it for the same reasons that I have (almost) every time to send SIGTERM > > *twice* > > for syslog-ng to terminate ? > > it was a bug, and should have been fixed in latest 1.5.x release. OK. I'll upgrade when the best of syslog-ng will be configured quite fine on the box ;-) > > > then instead of using syslog-ng's own chroot feature, use the chroot > > > > Are you sure a chrooted process can follow symlinks outside the jail ? > > it's not the chrooted process which accesses the symlink, the programs > running outside are accessing a file _in_ the chroot. (symlink in /dev/log > pointing to /chroot/dev/log) Could you please explain. It works as you say with ntpd chrooted on my box. But, after 'chroot /chroot /sbin/ntpd' the running ntpd only see what's under '/chroot/'. How it works when ntpd attempt to log something ? (to /chroot/dev/log) > I remember, libc itself shouldn't be needed. ldd shows what syslog-ng is > linked to, but if it started outside, it will link to /lib/libc.so.6, and > _then_ chroot itself -> no need for libc in the jail itself. > > the others libresolv etc. are loaded after the chroot() call, so they must > be present in the jail as well. > > try rm-ing the libc inside the jail (and only libc the others might be > needed), and start syslog-ng, it _should_ work. Yes, it works

2 1

Re: [syslog-ng]logging from a chrooted process
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

Balazs Scheidler wrote: > On Thu, Nov 07, 2002 at 02:30:19PM +0100, Guillaume LACHENAL wrote: > > I'm currently trying to chroot some services on a Linux box (ntpd) > > > > strace'ing it to find the missing libs, I've seen that the process can't > > log as /dev/log is outside the jail > > > > > 9135 connect(4, {sin_family=AF_UNIX, path=" /dev/log"}, 16) = -1 > > ENOENT (No such file or directory) > > > > How to make a /dev/log into the jail ? or send the log via network to a > > log collector ? > > what about a unix-stream("/var/chroot/ntp/dev/log") source to syslog-ng? ... symlinked to /dev/log Yes, you indirectly reply me in https://lists.balabit.hu/pipermail/syslog-ng/2002-November/004096.html B> configuration initialization is performed prior to chroot-ing, so syslog-ng B> first opens the necessary devices, and then chroots itself. Instead of adjusting my conf file each time a chroot a service (OK, it's not every day ;-), it would be perfect if I can write a thing like : source s_chroot { unix-stream("/chroot/*/dev/log"); }; regards, Guillaume

3 2

Re: [syslog-ng]logging from a chrooted process
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

> > it would be perfect if I can write a thing like : > > > > source s_chroot { unix-stream("/chroot/*/dev/log"); }; > > I wouldn't like to implement this feature. You could write a script with the > same functionality instead that would generate you syslog-ng.conf. OK! Regards, Guillaume

1 0

internal()
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

To which facility go internal() messages ? Here is my box config : Debian Linux running provided syslogd/klogd syslog-ng 1.5.21 chrooted running as a log collector for all others box in the lan the debian provided syslogd also redirect all his messages to the log collector (this piggy conf will be cleaned soon. Only syslog-ng will stay) - - syslog-ng.conf - - options { use_dns(yes); chain_hostnames(no); sync(0); }; source s_internal { internal(); }; source s_net { udp( ip(192.168.12.2) port(514) ); }; source s_ntpd { unix-stream("/chroot/ntpd/dev/log"); }; destination d_hosts { file( "/var/log/$HOST/$YEAR/$MONTH/$DAY/$FACILITY"\ create_dirs(yes) owner("root") group("root")\ perm(0600) dir_perm(0700) ); }; log { source(s_internal); source(s_net); source(s_ntpd); destination(d_hosts); }; - - syslog-ng.conf - - when grepping syslog from /var/log/MyBox/*/*/*/* I attempted to find some messages about syslog-ng. But no the only syslog occurences found only refers to debian provided syslog Where can I find internal syslog-ng messages ? Thanks

1 0