- syslog-ng - lists.balabit.hu

source definition with pipe / 1.4x or 1.5x
by D. Pille 07 Nov '02

07 Nov '02

Hello Balázs, I would like to migrate our servers from syslog to syslog-ng (we´re using SuSE 5.4 to 8.1, some clustered, mostly all Internet). Can you say about the next stable release or better: Should I use 1.4x now and then I can switch over to 1.5x - without greater reconfigurations? And another questions: source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; Is this source definition enough to leave klogd behind? Is it possible to use "pipe" in this manner for other logs - like them from proftpd? It´s for me not clear how to grep a log message in a logfile to a central log-server when the source isn´t at /proc or /dev. Will "pipe" as source driver look around the file and, if a new line appears, pipe this new lines? Regards, Detlef Pille NWN-Admin -- /"\ ASCII Ribbon Campaign \ / X No HTML in / \ email & news

2 1

Re: [syslog-ng]replacing Linux klogd by a chrooted syslog-ng running as a non root user
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

Balazs Scheidler wrote : > On Thu, Nov 07, 2002 at 02:25:44PM +0100, Guillaume LACHENAL wrote: > > from http://www.campin.net/syslog-ng/faq.html > > > > As /proc/kmsg and /dev/log are outside the jail, is there a way to do the > > same thing with a chrooted syslog-ng ? > > configuration initialization is performed prior to chroot-ing, so syslog-ng > first opens the necessary devices, and then chroots itself. OK. So if I understand when using syslog-ng '-C' options there is no need that $JAIL/etc contains syslog-ng.conf. It can stay in /etc > you cannot restart the daemon though, unless you do the following: OK I've seen it. You make me not to create a new thread on the list ;-) Is it for the same reasons that I have (almost) every time to send SIGTERM *twice* for syslog-ng to terminate ? > - mount /proc under the chroot jail as well (can be mounted multiple times) > - create a symlink in /dev/log to /chroot/dev/log > > then instead of using syslog-ng's own chroot feature, use the chroot Are you sure a chrooted process can follow symlinks outside the jail ? > command, so the config initialization is performed _inside_ the jail. These > have drawbacks as well: > > - you need libc and other libs in the jail (while when starting from > outside, these are mapped from the system at startup) libc is also needed when using the '-C' switch ! ldd syslog-ng libnsl.so.1 => /lib/libnsl.so.1 (0x00126000) libc.so.6 => /lib/libc.so.6 (0x0013d000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x00110000) and I've 'discover' during my jail creation that libresolv and libnss_* are also needed (remember the thread "chroot and hostname resolution problem [was : Re: [syslog-ng]centralized loghost]") I don't think we can say it's a drawback > - /proc might provide too much information inside the jail so you might as > well run syslog-ng outside the jail ;) Exactly opposite to the secure way we try to follow ;-) > The latter problem can be solved by restricting /proc access with a patch > like openwall, and I might provide a patch for the first, to chroot first, > and then initialize. I'll check it latter, when my platform will be 100% OK and have more spare time ;-) Thanks Regards Guillaume

2 1

logging from a chrooted process
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

I'm currently trying to chroot some services on a Linux box (ntpd) strace'ing it to find the missing libs, I've seen that the process can't log as /dev/log is outside the jail > 9135 connect(4, {sin_family=AF_UNIX, path=" /dev/log"}, 16) = -1 ENOENT (No such file or directory) How to make a /dev/log into the jail ? or send the log via network to a log collector ? Thanks Regards Guillaume

2 1

replacing Linux klogd by a chrooted syslog-ng running as a non root user
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

from http://www.campin.net/syslog-ng/faq.html > Q: I want to replace syslogd *and* klogd on my Linux box with syslog-ng. > > A: Use a source line like this in your conf file to read kernel messages, too. > source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; > > Note: do not run klogd and syslog-ng fetching local kernel messages at the > same time. It may cause syslog-ng to block which makes all logging local > daemons unusable. As /proc/kmsg and /dev/log are outside the jail, is there a way to do the same thing with a chrooted syslog-ng ? Thanks Regards, Guillaume

2 1

Compile problem on Solaris (8)
by Gehring, Andrew x66132 06 Nov '02

06 Nov '02

Just downloaded 1.5.21 and libol 0.3.3. Libol compiles fine - installed into /usr/local/... I'm getting the following error with the syslog-ng compile... gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor -lfl /usr/local/lib/libol.a -lsocket -lnsl -lxnet main.o: In function `main_loop': /opt/source/syslog-ng/syslog-ng-1.5.21/src/main.c:225: undefined reference to `res_init' Anyone else seen this? Direction? TIA Andrew

2 1

Problem of recording
by Stefano Tanfoglio 06 Nov '02

06 Nov '02

I am Stefano Tanfoglio, I work from one bank in Italy. I use syslog-ng for archive the log of 176 computer. ( 2 router - 125 windows server - 51 linux server ). In Windows server i use ntsyslog service. protocol = udp destination server = ip syslog-ng server destination port = 514 Ntsyslog send all log In Linux server i use the syslog auth.* @syslog01.xxxx.it authpriv.* @syslog01.xxxx.it kernel.=err;kernel.=warn @syslog01.xxxx.it mail.=err;mail.=warn @syslog01.xxxx.it daemon.=err;daemon.=warn @syslog01.xxxx.it local7.=err;local7.=warn @syslog01.xxxx.it ... ... Configuratione syslong-ng.conf: Versione: syslog-ng-1.4.14-2mdk options { sync (0); time_reopen (10); log_fifo_size (3000); long_hostnames (on); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); }; source remote { udp(); }; destination linux { file("/var/log/HOSTS/LINUX/$HOST/$FACILITY" dir_perm(0755) perm(0655)); }; destination windows { file("/var/log/HOSTS/WINDOWS/$HOST/$FACILITY" dir_perm(0755) perm(0655)); }; destination router { file("/var/log/HOSTS/ROUTER/$HOST/$FACILITY" dir_perm(0755) perm(0655)); }; filter f_linux { host("name1.domain.tld|name2.domain.tld|name3.domain.tld|...........|51"); } ; filter f_windows { host("name1.domain.tld|name2.domain.tld|name3.domain.tld|...........|125"); }; filter f_router { host("name1.domain.tld|name2.domain.tld"); }; log { source(remote); filter(f_linux); destination(linux); }; log { source(remote); filter(f_windows); destination(windows); }; log { source(remote); filter(f_router); destination(router); }; Problem: 1) In the windows section I have 125 machine and only 80 recording. I try to move the last hostname in first position: filter f_windows { host("125|name1.domain.tld|name2.domain.tld|name3.domain.tld|...........|124 "); }; the test it ok, hostname logger and recording. 2)Every 10-15 minutes the syslog-ng system it down. 3) I try the new version but I have not obtained the positive information. 4) I have modified the syslog-ng.conf: .... .... destination tem { file("/var/log/HOSTS/ALL/$HOST" dir_perm(0755) perm(0655)); }; ... ... ... log { source(remote); destination(tem); }; .. .. The all machine recording and the server don' t crash with this solution. I don't try the DB recording. Thanks for the collaboration. Stefano Tanfoglio Assyrus Srl www.assyrus.it ICQ:146827274

3 2

Re: chroot and hostname resolution problem [was : Re: [syslog-ng]centralized
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

The last missing lib was : 8677 open("/lib/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) Thanks to all who helped me. But as I'm just starting playing with syslog-ng, I think I'll be back quickly with some other questions ... ;-) Regards, Guillaume - - - Balazs Scheidler wrote : (snip) > those files are loaded dynamically by the libc ok I now understand better > do you have resolv.conf/host.conf ? You're right ! 8561 open("/etc/resolv.conf", O_RDONLY) = 5 8561 open("/etc/host.conf", O_RDONLY) = -1 ENOENT (No such file or directory) question : what's the difference, in name resolution process, between /etc/hosts.conf and /etc/nsswitch.conf my updated config : $JAIL/etc/resolv.conf is ok and working (tested outside the jail) $JAIL/etc/nsswitch.conf contain "hosts: dns" $JAIL/etc/hosts.conf contain "order bind" syslog-ng continue to resolve hostnames only if they are in $JAIL/etc/hosts

1 0

Re: chroot and hostname resolution problem [was : Re: [syslog-ng]centralized
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

Gregor Binder wrote : > Msg from Guillaume LACHENAL: > > Hi Guillaume, > > > and I suppose those libs are needed by the resolver ... > > most likely :) > > > Why 'ldd syslog-ng' does not reported this two files ? > > (nor ldd on the libs returned by the previous commands) > > You might find them if you continue to search recursively through the > results. This is what I've done ! : G> nor ldd on the libs returned by the previous command > > > How could I 'guessed' that I need to copy this files into the jail ? > > I've set up quite a few chroots for all kinds of services. Experience > says, that guessing (i.e. trying to figure out in advance) will usually > only save you the first few trace-sessions but almost never make the > chrooted service work 100% right away. Ok > > Althougt my $JAIL/etc/nsswitch.conf contains "hosts dns", > > hostnames are only resolved if they are in $JAIL/etc/hosts ! > > Amazing ... > > As you seem to start having fun with process tracing, try to find out > where resolving fails, or if it is attempted at all. I'm on this way ! > Regards, > Gregor.

2 1

Re: chroot and hostname resolution problem [was : Re: [syslog-ng]centralized
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

Balazs Scheidler wrote : (snip) > those files are loaded dynamically by the libc ok I now understand better > do you have resolv.conf/host.conf ? You're right ! 8561 open("/etc/resolv.conf", O_RDONLY) = 5 8561 open("/etc/host.conf", O_RDONLY) = -1 ENOENT (No such file or directory) question : what's the difference, in name resolution process, between /etc/hosts.conf and /etc/nsswitch.conf my updated config : $JAIL/etc/resolv.conf is ok and working (tested outside the jail) $JAIL/etc/nsswitch.conf contain "hosts: dns" $JAIL/etc/hosts.conf contain "order bind" syslog-ng continue to resolve hostnames only if they are in $JAIL/etc/hosts

1 0

Re: chroot and hostname resolution problem [was : Re: [syslog-ng]centralized
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

Gregor Binder wrote : > Hi, > > > > doing 'strace /etc/init.d/syslog-ng start', I can't find something > > > strange, > > I don't know about Linux/strace, but on most systems, you would have > to use an option to the tracing utility to trace calls of child -- man strace -- -f Trace child processes as they are created by currently traced processes as a result of the fork(2) system call. -- man strace -- > processes. Looks to me like you are tracing the shell process only. > > Try to run the syslog-ng BINARY from strace, and look for problems > like Ed suggested. 8254 open("/lib/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) 8254 open("/lib/libnss_dns.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) and I suppose those libs are needed by the resolver ... Why 'ldd syslog-ng' does not reported this two files ? (nor ldd on the libs returned by the previous commands) How could I 'guessed' that I need to copy this files into the jail ? > > > > Is there someone who is running a chrooted syslog-ng running under a > > > non root user as a log collector without any (hostname resolution) problem > > > ? > > I am - but I have "use_dns(no)" in my config. > > Same here. I don't see any technical reason why this wouldn't work, > unless you are missing resolv libraries (e.g. on Solaris) or > supplementary configuration files in the jail. > > Gregor. Now my syslog-ng is resolving almost as I want : Althougt my $JAIL/etc/nsswitch.conf contains "hosts dns", hostnames are only resolved if they are in $JAIL/etc/hosts ! Amazing ... I'll continue debugging, I progress ;-)

3 2

Re: chroot and hostname resolution problem [was : Re: [syslog-ng]centralized
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

Ed Ravin wrote : > Guillaume LACHENAL writes: >> >> can't find ktrace > > Ah, you must be using Linux. Should have said that up front. Yes. >> doing 'strace /etc/init.d/syslog-ng start', I can't find something >> strange, > > Look for "file not found" errors or anything else related to file > access. Can't find any error like this > Is there someone who is running a chrooted syslog-ng running under a > non root user as a log collector without any (hostname resolution) problem > ? > > I am - but I have "use_dns(no)" in my config. Could you try with "use_dns(yes)" ? > How about posting the log - make sure there is no private information > in it. If it's too huge put it up on the web somewhere and post the > URL to the list. See strace log attached (I'm running syslog-ng in debug mode with -d -v)

1 0

chroot and hostname resolution problem [was : Re: [syslog-ng]centralized loghost]
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

can't find ktrace doing 'strace /etc/init.d/syslog-ng start', I can't find something strange, but this kind of things if out of my knowledge. I can send the log if someone could help. Is there someone who is running a chrooted syslog-ng running under a non root user as a log collector without any (hostname resolution) problem ? The jail is correctly configured. I've checked the necessary libs w/ 'ldd syslog-ng' and build the cache with 'ldconfig' (chrooted of course) /etc/nsswitch.conf & /etc/resolv.conf are in the jail too I'm currently running 1.5.21 w/ libol-0.3.3 "Guillaume LACHENAL" <glachenal(a)on-x.com> Sent by: syslog-ng-admin(a)lists.balabit.hu 10/30/02 11:14 Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: Subject: Re: [syslog-ng]centralized loghost /etc/nsswitch.conf is available in the jail ktrace & truss are command not found on the box, i'll search for it when not chrooted, syslog-ng correctly resolve hostnames. "Ed Ravin" <eravin(a)panix.com> Sent by: syslog-ng-admin(a)lists.balabit.hu 10/28/02 17:31 Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: Subject: Re: [syslog-ng]centralized loghost Guillaume LACHENAL writes: > As syslog-ng run chrooted, I've copied /etc/resolv.conf & /etc/hosts > into the jail. > It does not fix the issue Does your system also require /etc/nsswitch.conf in the chroot? Do a ktrace/truss on the startup in the chroot and see if it finds all the files it needs to do DNS lookups. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

suggestion for keep_hostname() option
by Nam 05 Nov '02

05 Nov '02

Could keep_hostname() be implemented as an option usable locally to source drivers tcp and udp instead of just being a global option? The following example will illustrate what I'm getting at. The following excerted configs are used on the syslog-ng servers: options{ keep_hostname(no); use_dns(no); chain_hostname(no); }; source syslog { udp( port(514) ); }; source syslog-ng { tcp( port(514) ); }; When host A sends syslog message to syslog-ng server B, the message is written with the host A IP address. Then, syslog-ng server B relays this message to a central syslog-ng server C, the message is written with the syslog-ng server B IP address. It would be useful to write the message at the central server with the host A IP address as that is the IP address that originated the message. I could change the global option on the central syslog-ng server to be keep_hostname(yes) and the message will be written with host A IP address. However, that means that messages that are not being relayed (e.g. sent directly from a syslog host to the central syslog-ng server C) will have the keep_hostname(yes) applied when the desired option is keep_hostname(no) for those messages. The following example config shows the extension of keep_hostname() use that I'm suggesting. options{ use_dns(no); chain_hostname(no); }; source syslog { udp( port(514); keep_hostname(no); ); }; source syslog-ng { tcp( port(514); keep_hostname(yes); ); }; Possibly a patch Balazs? :-) A side note, with keep_hostname(no) and use_dns(no) the syslog-ng internally generated messages are written with the hostname. Possibly make it (or optionable) that when keep_hostname is no, those internal messages are written with the host IP address? Keeps the written log structures consistent especially when using macro expansions. Nam __________________________________________________________ Get your FREE personalized e-mail at http://www.canada.com

1 0

1.5.23 dies
by Jaakko Niemi 05 Nov '02

05 Nov '02

Hi, gc_mark: Marking object of class 'affile_dest_reaper' (1) io.c: sockaddr2info(): Unsupported address family 63828. Program received signal SIGABRT, Aborted. 0x40054781 in kill () from /lib/libc.so.6 (gdb) bt #0 0x40054781 in kill () from /lib/libc.so.6 #1 0x40054464 in raise () from /lib/libc.so.6 #2 0x40055be1 in abort () from /lib/libc.so.6 #3 0x080599ee in fatal ( format=0x8061000 "io.c: sockaddr2info(): Unsupported address family %i.\n") at werror.c:190 #4 0x08058e96 in sockaddr2address_info (addr_len=256, addr=0xbffff7a8) at io.c:1032 #5 0x0804aaf0 in do_handle_line (self=0x8070600, length=62, data=0x8070644 "<86>Nov 5 18:26:38 sshd[346]: connection from \"192.168.1.1\"", addr=0xbffff7a8, addrlen=256) at sources.c:70 #6 0x0804ad7a in do_read_line (h=0x80639a0, read=0xbffff90c) at sources.c:121 #7 0x08057c1f in read_callback (fd=0x8063958) at io.c:419 #8 0x0805780b in io_iter (b=0x80637f8) at io.c:263 #9 0x0804a07f in main_loop (backend=0x80637f8) at main.c:197 #10 0x0804a9d6 in main (argc=2, argv=0xbffffb74) at main.c:527 Seems to be happening when something gets logged from pam to authlog. 1.5.15 works with same configuration. In configuration I have: source src { unix-dgram("/dev/log"); internal(); file("/proc/kmsg"); }; Any more info I can give? --j

2 6

RE: [syslog-ng]Feedback about insertdb.pl
by _/CaT\_ 04 Nov '02

04 Nov '02

Sorry, is only a obsolete variable. Please comment or removed $ENV{'DBI_DSN'}='syslog'; $ENV{'DBI_USER'}='root'; $ENV{'DBI_PASS'}='mysqladmin'; #$ENV{'DBI_TABLE_SYSLOG'}='xxx'; $ENV{'DBI_PIPE_SYSLOG'}='/var/chroot/syslog-ng/dev/mysql.pipe'; $ENV{'ERR_MSG'}='/var/chroot/syslog-ng/var/log/err_DB_msg.log'; my $DB_SB='mysql'; my $DEBUG = 1; my $test_dsn = $ENV{'DBI_DSN'} || die "DSN not set\n"; my $test_user = $ENV{'DBI_USER'} || die "User not set\n"; my $test_password = $ENV{'DBI_PASS'} || die "Password not set\n"; #my $table = $ENV{'DBI_TABLE_SYSLOG'} || die "Table not set\n"; my $pipe = $ENV{'DBI_PIPE_SYSLOG'} || die "Pipe file not set\n"; my $errmsg = $ENV{'ERR_MSG'} || die "File ERR_MSG not set\n"; -----Original Message----- From: M.Ghalaie [mailto:mgh@mgn.net] Sent: Monday, November 04, 2002 8:00 PM To: cat_roger22(a)hotmail.com Subject: Re: [syslog-ng]Feedback about insertdb.pl Hello, I tested used your scripts "Perl". But I do not know to what "$ENV{'DBI_TABLE_SYSLOG'}='xxxxx'"... _/CaT\\_ wrote: > Hi *, > You've posted any feed-back about this post of mine: > http://lists.balabit.hu/pipermail/syslog-ng/2002-October/003905.html > With this solution I've resolved all my problem with insertions into > DB. > > Cheers > _/CaT\_ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > -- ---------------------------------------------- Mansour GHALAIE ---------------------------------------------- MGN De'partement Syste`me 8 Rue Grange Dame rose-78140 VELIZY (France) Tel : 01 34 49 06 37 Fax : 01 34 49 06 79 E.mail : mgh(a)mgn.net Site web : www.mgn.net ----------------------------------------------

1 0

Re: [syslog-ng]SIGXXX logrotate patch suggestion.
by Ted_Rule＠flextech.co.uk 04 Nov '02

04 Nov '02

Many many thanks, Balazs. Ted ************************************************************************************************ ************************************************************************************************ WATCH THE LATEST SERIES OF WILL AND GRACE EVERY WEDNESDAY AT 8PM, FROM NOVEMBER 13TH ONLY ON LIVING TV - RESPONSIBLE OWNERS OF WILL AND GRACE. ************************************************************************************************ ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

SIGXXX logrotate patch suggestion.
by Ted_Rule＠flextech.co.uk 04 Nov '02

04 Nov '02

This is allied to my previous request a few weeks ago that syslog-ng doesn't close and re-open listener sockets across a SIGHUP/reconfigure - all in a desire to drop as few messages as possible across the overnight log rotation. How's about another variation on the same theme, namely to provide a separate signal for rotating logs, in a similar manner to Squid which has separate signals for daemon reconfiguration and log rotation. The action of the new signal would merely be to close all existing output descriptors, and re-open them with the same parameters. This would allow overnight logrotate commands to rename logs before SIGXXX'ing syslog-ng and thus achieve log rotation without requiring listener's are closed/re-opened across the logrotate. Whether or not this is particulary easy given the current layout of the output file objects, I'm afraid I don't know, but it feels to me as though this might be easier to code than the reworking of SIGHUP to preserve listeners across a reconfigure. Any takers? Ted ************************************************************************************************ ************************************************************************************************ WATCH THE LATEST SERIES OF WILL AND GRACE EVERY WEDNESDAY AT 8PM, FROM NOVEMBER 13TH ONLY ON LIVING TV - RESPONSIBLE OWNERS OF WILL AND GRACE. ************************************************************************************************ ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

2 1

Re: [syslog-ng]compile problem HAVE_RES_INIT
by BONIKOWSKE, SCOTT 31 Oct '02

31 Oct '02

--- Received from WPS.SBONIKOW (608) 226-2630 10-31-02 953a If I remember correctly, doesn't libol installation still require an ldconfig after it is installed? Thanks Scott ****************************************************************************** From: xyf(a)nixnotes.org To: syslog-ng(a)lists.balabit.hu Date: Thu, 31 Oct 2002 08:47:15 -0600 Subject: Re: [syslog-ng]compile problem HAVE_RES_INIT On Thu, Oct 31, 2002 at 09:36:23AM -0500, Hamilton, Andrew wrote: > All these includes are part of the libol package. For some reason it is not > finding them. OK even though I installed libol-0.3.5 ./configure couldn't seem to find it so I ran "./configure --with-libol=/path/to/libol" and everything is happy:) Thanks so much for your help. kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ---- 10-31-02 953a ---- Sent to --------------------------------------- -> syslog-ng(a)lists.balabit.hu -> xyf(a)nixnotes.org

1 0

RE: [syslog-ng]compile problem HAVE_RES_INIT
by Hamilton, Andrew 31 Oct '02

31 Oct '02

All these includes are part of the libol package. For some reason it is not finding them. -----Original Message----- From: ktb [mailto:xyf@nixnotes.org] Sent: Thursday, October 31, 2002 9:28 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]compile problem HAVE_RES_INIT On Thu, Oct 31, 2002 at 09:04:58AM -0500, Hamilton, Andrew wrote: > Try this: > > FWIW the following patch seems to have fixed it: > > --- syslog-ng-1.5.23/acconfig.h.orig Wed Apr 3 12:37:02 2002 > +++ syslog-ng-1.5.23/acconfig.h Tue Oct 29 17:00:12 2002 > @@ -40,4 +40,5 @@ > #undef PATH_SYSCONFDIR > > #undef ENABLE_TCP_WRAPPER > - > \ No newline at end of file > + > +#undef HAVE_RES_INIT > > Drew I'm not a programmer so wasn't completely sure how to implement this but assumed the "-" meant to take those lines out of acconfig.h and the "+" meant to add "#undef HAVE_RES_INIT" to the file in question. I ended up with the errors below - make[3]: Entering directory `/usr/local/src/syslog-ng-1.5.23/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.23/src -I. -g -O2 -Wall -D_G NU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33: list.h: No such file or directory main.c:29: format.h: No such file or directory main.c:30: werror.h: No such file or directory main.c:31: queue.h: No such file or directory main.c:32: pkt_buffer.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make: *** [all-recursive] Error 1 Thanks for the quick respons:) kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]compile problem HAVE_RES_INIT
by Hamilton, Andrew 31 Oct '02

31 Oct '02

Ok. Where is libol? Did you install it or tell it where it is? -----Original Message----- From: ktb [mailto:xyf@nixnotes.org] Sent: Thursday, October 31, 2002 9:35 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]compile problem HAVE_RES_INIT On Thu, Oct 31, 2002 at 09:33:38AM -0500, Hamilton, Andrew wrote: > After the patch did you rerun configure? > Ya, I did a "make clean && ./configure && make" kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]compile problem HAVE_RES_INIT
by Hamilton, Andrew 31 Oct '02

31 Oct '02

After the patch did you rerun configure? -----Original Message----- From: ktb [mailto:xyf@nixnotes.org] Sent: Thursday, October 31, 2002 9:28 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]compile problem HAVE_RES_INIT On Thu, Oct 31, 2002 at 09:04:58AM -0500, Hamilton, Andrew wrote: > Try this: > > FWIW the following patch seems to have fixed it: > > --- syslog-ng-1.5.23/acconfig.h.orig Wed Apr 3 12:37:02 2002 > +++ syslog-ng-1.5.23/acconfig.h Tue Oct 29 17:00:12 2002 > @@ -40,4 +40,5 @@ > #undef PATH_SYSCONFDIR > > #undef ENABLE_TCP_WRAPPER > - > \ No newline at end of file > + > +#undef HAVE_RES_INIT > > Drew I'm not a programmer so wasn't completely sure how to implement this but assumed the "-" meant to take those lines out of acconfig.h and the "+" meant to add "#undef HAVE_RES_INIT" to the file in question. I ended up with the errors below - make[3]: Entering directory `/usr/local/src/syslog-ng-1.5.23/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.23/src -I. -g -O2 -Wall -D_G NU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33: list.h: No such file or directory main.c:29: format.h: No such file or directory main.c:30: werror.h: No such file or directory main.c:31: queue.h: No such file or directory main.c:32: pkt_buffer.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make: *** [all-recursive] Error 1 Thanks for the quick respons:) kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]compile problem HAVE_RES_INIT
by Hamilton, Andrew 31 Oct '02

31 Oct '02

Try this: FWIW the following patch seems to have fixed it: --- syslog-ng-1.5.23/acconfig.h.orig Wed Apr 3 12:37:02 2002 +++ syslog-ng-1.5.23/acconfig.h Tue Oct 29 17:00:12 2002 @@ -40,4 +40,5 @@ #undef PATH_SYSCONFDIR #undef ENABLE_TCP_WRAPPER - \ No newline at end of file + +#undef HAVE_RES_INIT Drew -----Original Message----- From: ktb [mailto:xyf@nixnotes.org] Sent: Thursday, October 31, 2002 8:57 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]compile problem HAVE_RES_INIT I'm trying to compile syslog-ng-1.5.23 on a RedHat 6.0 machine. When I run "make" I get the following error - make[1]: Entering directory `/usr/local/src/syslog-ng-1.5.23/src' cd /usr/local/src/syslog-ng-1.5.23 && autoheader /usr/bin/autoheader: Symbol `HAVE_RES_INIT' is not covered by /usr/share/autoconf/acconfig.h ./acconfig.h make[1]: *** [/usr/local/src/syslog-ng-1.5.23/src/stamp-h.in] Error 1 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make: *** [all-recursive] Error 1 Anyone know how I can get around this error? Thanks, kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

compile problem HAVE_RES_INIT
by ktb 31 Oct '02

31 Oct '02

I'm trying to compile syslog-ng-1.5.23 on a RedHat 6.0 machine. When I run "make" I get the following error - make[1]: Entering directory `/usr/local/src/syslog-ng-1.5.23/src' cd /usr/local/src/syslog-ng-1.5.23 && autoheader /usr/bin/autoheader: Symbol `HAVE_RES_INIT' is not covered by /usr/share/autoconf/acconfig.h ./acconfig.h make[1]: *** [/usr/local/src/syslog-ng-1.5.23/src/stamp-h.in] Error 1 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make: *** [all-recursive] Error 1 Anyone know how I can get around this error? Thanks, kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation)

1 0

Re: [syslog-ng]Syslog forwarding - PIXos...
by Ted_Rule＠flextech.co.uk 31 Oct '02

31 Oct '02

If you're playing with PIXies... please beware all my previous findings on this mailing list regarding the current stupidity of PIXos syslog implementation... Namely a 256 byte message limit, a total lack of properly defined message boundaries on PIX syslog over TCP, and Cisco's complete unwillingness to fix such glaring oversights. Ted *********************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. *************************************************************************************************

1 0

RE: [syslog-ng]Syslog forwarding
by Hamilton, Andrew 31 Oct '02

31 Oct '02

Fernando, I did the very same thing you are doing for several years. syslog-ng is perfect for that in that it will allow you to configure both ways. It will spoof the name or it will leave the name. By setting various options you can get a combination of the two even. Look at keep_hostname(yes) this tells syslog-ng to keep the hostname it got from the message, use_fqdn(yes), fqdn is important if you have multiple domains with the same hostname in different domains such as ns1. Also chain_hostnames(no), syslog-ng will chain the hostnames together if you don't turn this off. For CiscoWorks you want to turn this off. Realize also that if you have a central loghost that is different from the CiscoWorks machine you must also run syslog-ng on that host as well. Regards, Drew -----Original Message----- From: Fernando Cardoso [mailto:fernando.cardoso@whatevernet.com] Sent: Wednesday, October 30, 2002 3:32 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Syslog forwarding Hi all I'm designing a solution where I need to forward syslog messages to 2 different servers (Cisco Works and a log correlation system). The messages will be sent from Cisco routers and PIXes to a box running syslog-ng that will forward the messages to the servers according to the facility and levels defined on filters. My question regards the origin of the messages as they will be seen by the end servers. Since both Cisco Works and the log correlation engine rely on the source IP to acknowledge and trigger alarms, will they see the syslog-ng box IP or the original IP address of the routers and PIXes? In other words will syslog-ng spoof the source IP addresses when forwarding the messages? Thanks in advance Fernando _____________________________________________________________________ INTERNET MAIL FOOTER A presente mensagem pode conter informação considerada confidencial. Se o receptor desta mensagem não for o destinatário indicado, fica expressamente proibido de copiar ou endereçar a mensagem a terceiros. Em tal situação, o receptor deverá destruir a presente mensagem e por gentileza informar o emissor de tal facto. --------------------------------------------------------------------- Privileged or confidential information may be contained in this message. If you are not the addressee indicated in this message, you may not copy or deliver this message to anyone. In such case, you should destroy this message and kindly notify the sender by reply email. --------------------------------------------------------------------- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1