- syslog-ng - lists.balabit.hu

RE: [syslog-ng]centralized loghost
by Hamilton, Andrew 24 Oct '02

24 Oct '02

You have use_dns(no). Therefore the value of $HOST is the IP address. If you want the hostname instead then you need to turn on the use_dns option. Regards, Drew -----Original Message----- From: Guillaume LACHENAL [mailto:glachenal@on-x.com] Sent: Thursday, October 24, 2002 11:19 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]centralized loghost I've just install syslog-ng 1.5.21 for centralizing all servers log's Here is the conf file : - - syslog-ng.conf - - options { use_dns(no); sync(0); }; source s_internal { internal(); }; source net { udp( ip(192.168.12.2) port(514) ); }; destination hosts { file( "/var/log/$HOST/$YEAR/$MONTH/$DAY/$FACILITY"\ create_dirs(yes) owner("root") group("root")\ perm(0600) dir_perm(0700) ); }; log { source(s_internal); source(net); destination(hosts); }; - - the problem is that logs go to /var/log/IP_of_$HOST/ ... Thanks for help G. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

centralized loghost
by Guillaume LACHENAL 24 Oct '02

24 Oct '02

I've just install syslog-ng 1.5.21 for centralizing all servers log's Here is the conf file : - - syslog-ng.conf - - options { use_dns(no); sync(0); }; source s_internal { internal(); }; source net { udp( ip(192.168.12.2) port(514) ); }; destination hosts { file( "/var/log/$HOST/$YEAR/$MONTH/$DAY/$FACILITY"\ create_dirs(yes) owner("root") group("root")\ perm(0600) dir_perm(0700) ); }; log { source(s_internal); source(net); destination(hosts); }; - - the problem is that logs go to /var/log/IP_of_$HOST/ ... Thanks for help G.

1 0

REPLY NEEDED_URGENT
by JAMES OGWU 24 Oct '02

24 Oct '02

DEAR SIR, STRICTLY CONFIDENTIAL WE ARE MEMBERS OF A SPECIAL COMMITTEE FOR BUDGET AND PLANNING OF THE NIGERIAN NATIONAL PETROLEUM CORPORATION (NNPC). THIS COMMITTEE IS PRINCIPALLY CONCERNED WITH CONTRACT AWARDS AND APPROVAL. WITH OUR POSITIONS, WE HAVE SUCCESSFULLY SECURED FOR OURSELVES THE SUM OF THIRTY ONE MILLION, FIVE HUNDRED THOUSAND UNITED STATES DOLLARS (US$31.5M). THIS AMOUNT WAS CAREFULLY MANIPULATED BY OVER-INVOICING OF AN OLD CONTRACT. BASED ON INFORMATION GATHERED ABOUT YOU, WE BELIEVE YOU WOULD BE IN A POSITION TO HELP US IN TRANSFERING THIS FUND (US$31.5M) INTO A SAFE ACCOUNT WHICH YOU HAVE ABSOLUTE CONTROL OVER. THIS IS VERY IMPORTANT. IT HAS BEEN AGREED THAT THE OWNER OF THE ACCOUNT WILL BE COMPENSATED WITH 30% OF THE REMITTED FUNDS, WHILE WE KEEP 60% AS THE INITIATORS AND 10% WILL BE SET ASIDE TO OFFSET EXPENSES AND PAY THE NECESSARY TAXES. WE INTEND TO USE PART OF OUR SHARE TO BUY AND IMPORT FROM YOUR COUNTRY, AGRICULTURAL AND CONSTRUCTION MACHINERY. WE SHALL ALSO NEED YOUR ASSISTANCE IN THIS REGARD ON A COMMISSION TO BE AGREED UPON WHEN WE COME OVER TO YOUR COUNTRY. IN ADDITION, WITH OUR EXPERIENCE AND CONNECTION IN THE OIL SECTOR OF MY COUNTRY, WE WOULD LIKE TO ESTABLISH A JOINT BUSINESS WITH YOU IN YOUR COUNTRY AFTER THIS TRANSACTION. THE PURPOSE BEING FOR YOU TO FRONT FOR US IN EXECUTING SOME GOVERNMENT CONTRACTS WHICH SHALL BE AWARDED THE FORMED COMPANY WITH OUR CONNECTIONS. ALL THESE WILL BE DISCUSS WHEN WE ARRIVE YOUR COUNTRY FOR THE DISBURSEMENT. ALL MODALITIES OF THIS TRANSACTION HAVE BEEN CAREFULLY WORKED OUT AND ONCE STARTED WILL NOT TAKE MORE THAN SEVEN (7) WORKING DAYS, WITH YOUR FULL SUPPORT. THIS TRANSACTION IS 100% RISK FREE. IF THIS PROPOSAL SATISFIES YOU, PLEASE REACH US BY EMAIL OR TELEPHONE; 234-80-23250079 FOR MORE INFORMATION. PLEASE, TREAT AS URGENT AND VERY IMPORTANT. YOURS FAITHFULLY, DR JAMES OGWU..

1 0

security patch for --chroot feature
by Scott Weikart 23 Oct '02

23 Oct '02

Here's a patch to make the --chroot feature more secure. 1) At least with the Linux kernel, root can break out of a chroot jail: http://www.linuxsecurity.com/feature_stories/feature_story-99.html [I verified this to be true with a 2.2 kernel.] I'm not sure whether this is true for other kernels, and I'm not sure whether other kernels require the process to be root before a chroot can succeed. So, my uid check may need to be ported. 2) With older Linux kernels, you could break out of a chroot jail if you didn't cd to the directory to which you will chroot. 3) I added checks to make sure that --user and/or --group work. The most important check is to make sure that setuid succeeds (if --chroot was specified). -scott p.s. I'm not (yet) subscribed to the list. ================================================================== --- main.c~ Wed Sep 4 07:52:25 2002 +++ main.c Sun Oct 13 15:37:46 2002 @@ -481,6 +481,15 @@ return 2; } if (chroot_dir) { + if (!uid) { + werror("-C can be defeated without -u, exitting.\n"); + return 3; + } + + if (chdir(chroot_dir) < 0) { + werror("Error chdiring, exiting.\n"); + return 3; + } if (chroot(chroot_dir) < 0) { werror("Error chrooting, exiting.\n"); return 3; @@ -488,9 +497,18 @@ } if (uid || gid) { - setgid(gid); - setgroups(0, NULL); - setuid(uid); + if (gid && setgid(gid) < 0) { + werror("Error setgiding, exiting.\n"); + return 4; + } + if (setgroups(0, NULL) < 0) { + werror("Error setgrouping, exiting.\n"); + return 4; + } + if (uid && setuid(uid) < 0) { + werror("Error setuiding, exiting.\n"); + return 4; + } } if (!debug_flag) {

3 2

Antwort: RE: [syslog-ng]syslog-ng and my console
by Franz.Bettag/SOFTWERK/DE%BIG＠big.de 22 Oct '02

22 Oct '02

options { long_hostnames(off); sync(0); }; source src { unix-stream("/dev/log"); internal(); file("/proc/kmsg" log_prefix("kernel: ")); }; destination authlog { file("/var/log/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/var/log/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/var/log/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/var/log/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/var/log/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/var/log/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/var/log/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/var/log/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/var/log/uucp.log" owner("root") group("adm") perm(0640)); }; destination mailinfo { file("/var/log/mail.info" owner("root") group("adm") perm(0640)); }; destination mailwarn { file("/var/log/mail.warn" owner("root") group("adm") perm(0640)); }; destination mailerr { file("/var/log/mail.err" owner("root") group("adm") perm(0640)); }; destination debug { file("/var/log/debug" owner("root") group("adm") perm(0640)); }; destination messages { file("/var/log/messages" owner("root") group("adm") perm(0640)); }; destination iptables { file("/var/log/firewall.log" owner("root") group("adm") perm(0640)); }; destination emergency { file("/var/log/emergency.log" owner("root") group("adm") perm(0640)); }; filter f_iptables { match("FW->*"); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(f_iptables); destination(iptables); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(emergency); }; log { source(src); filter(f_iptables); destination(iptables); }; Mit freundlichen Grüßen BIG-SPIELWARENFABRIK Dipl.-Ing. Ernst A. Bettag e. K. Franz Bettag http://www.BIG.de

1 0

RE: [syslog-ng]syslog-ng and my console
by Hamilton, Andrew 22 Oct '02

22 Oct '02

Franz, Could you post your configuration file? That would help track down your problem. Regards, Drew -----Original Message----- From: ?error?5.1.2?"553 percent hack not allowed." [mailto:?error?5.1.2?"553 percent hack not allowed."] Sent: Tuesday, October 22, 2002 5:27 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng and my console hi, syslog-ng is filling my console with my netfilter output stuff which i redirect via destination filter and stuff to /var/log/firewall.log. now i don't want all that stuff in my ttys. i've removed the destinations for console and console_all, now what can i do`? Mit freundlichen Grüßen BIG-SPIELWARENFABRIK Dipl.-Ing. Ernst A. Bettag e. K. Franz Bettag http://www.BIG.de

1 0

Can't get syslog-ng to compile under solaris 8
by Romildo Wildgrube 22 Oct '02

22 Oct '02

Hi, I'm trying to compile syslog-ng under solaris but have no success. I am doing a straight compile, make, make install and I keep getting the following error during make. Any help will be much appreciated. Thanks, Romi gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg- lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afpr ogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthre ad -ldoor -lfl /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file res_init main.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /apps/home/romildo/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /apps/home/romildo/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /apps/home/romildo/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive'

2 1

syslog-ng and my console
by Franz.Bettag/SOFTWERK/DE%BIG＠big.de 22 Oct '02

22 Oct '02

hi, syslog-ng is filling my console with my netfilter output stuff which i redirect via destination filter and stuff to /var/log/firewall.log. now i don't want all that stuff in my ttys. i've removed the destinations for console and console_all, now what can i do`? Mit freundlichen Grüßen BIG-SPIELWARENFABRIK Dipl.-Ing. Ernst A. Bettag e. K. Franz Bettag http://www.BIG.de

1 0

Syslog is spamming up my console
by Franz.Bettag/SOFTWERK/DE%BIG＠big.de 22 Oct '02

22 Oct '02

hi, i have syslog-ng running with filtering my iptables ouput correctly. no i don't like that it spams up my console (tty). i've already removed the console and console_all destination.. does anybody know a solution? Mit freundlichen Grüßen BIG-SPIELWARENFABRIK Dipl.-Ing. Ernst A. Bettag e. K. Franz Bettag http://www.BIG.de

2 1

email.sh script for syslog-ng using qmail
by L. Jankok 21 Oct '02

21 Oct '02

Hi, I have a e-mail.sh script which used /usr/bin/mail to send "logging" mails from syslog-conf. I am looking for some similar e-mail.sh script using qmail for the e-mail.sh I am using right now doesn't work. this is my current e-mail.sh script #!/bin/sh while read line; do echo $line | /usr/bin/mail -s "log alert" admin(a)example.net done A "ps -ef | grep -i syslog | grep -v grep" gives me the following output. root 14191 1 0 19:36:45 ? 0:00 /usr/local/sbin/syslog-ng root 14193 14192 0 19:36:45 pts/2 0:00 /bin/sh /usr/local/sbin/syslog-mail.sh root 14192 14191 0 19:36:45 pts/2 0:00 /bin/sh -c /usr/local/sbin/syslog-mail.sh

1 1

Config ?
by Jack Sasportas 21 Oct '02

21 Oct '02

I used a much older version of syslog-ng previously, but the newer version is a little different, so I just want to confirm a couple of things. 1. If I install the RPM under redhat 7.2 what do I need to do to basically insure that the old syslog isn't going to kick in etc. 2. I want to split any pop activity from maillog into poplog, so I configured what I thought would work, and it does most of the time, but there are times when I pop the server, and there is no long entry. Here is my entire config. Any help appreciated.... THANKS -------- Config File ---------- # This file should be compatible with the out-of-the-box # /etc/syslog.conf on Red Hat Linux # global options # options { use_dns(yes); use_fqdn(no); use_time_recvd(no); chain_hostnames(no); mark(0); sync(0); }; source s_local { internal(); unix-stream("/dev/log" keep-alive(yes) max-connections(10)); file("/proc/kmsg"); }; # facility filters # # Jack filter f_authpriv { facility(authpriv); }; filter f_authpriv { facility(authpriv) and not program("popper"); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; filter f_kern { facility(kern); }; # Jack filter f_mail { facility(mail); }; filter f_mail { facility(mail) and not program("popper"); }; filter f_messages { priority(info..emerg) and not facility(mail, news, authpriv, cron, local1, local2, local3, local4, local5, local6); }; # Jack filter f_news { facility(news); }; # priority filters # filter f_crit { priority(crit..emerg); }; filter f_crit_only { priority(crit); }; filter f_emerg { priority(emerg); }; filter f_err { priority(err..emerg); }; filter f_err_only { priority(err); }; filter f_info { priority(info..emerg); }; filter f_notice { priority(notice..emerg); }; filter f_warn { priority(warning..emerg); }; # Jack filter f_pop { program(popper); }; destination d_all { usertty("*"); }; destination d_boot { file("/var/log/bootlog"); }; destination d_console { file("/dev/console"); }; destination d_cron { file("/var/log/cron"); }; destination d_mail { file("/var/log/maillog"); }; destination d_messages { file("/var/log/messages"); }; # Jack destination d_news_crit { file("/var/log/news/news.crit"); }; destination d_news_err { file("/var/log/news/news.err"); }; destination d_news_notice { file("/var/log/news/news.notice"); }; destination d_secure { file("/var/log/secure"); }; destination d_spooler { file("/var/log/spooler"); }; # Jack destination d_pop { file("/var/log/poplog"); }; # Everybody gets emergency messages log { source(s_local); filter(f_emerg); destination(d_all); }; # Log anything (except mail) of level info or higher. # Don't log private authentication messages! log { source(s_local); filter(f_messages); destination(d_messages); }; # The authpriv file has restricted access. log { source(s_local); filter(f_authpriv); destination(d_secure); }; # Jack Log all the pop mail messages. log { source(s_local); filter(f_pop); destination(d_pop); }; # Log all the mail messages in one place. log { source(s_local); filter(f_mail); destination(d_mail); }; # Log cron stuff log { source(s_local); filter(f_cron); destination(d_cron); }; # Save boot messages also to boot.log log { source(s_local); filter(f_boot); destination(d_boot); }; # # INN # log { source(s_local); filter(f_news); filter(f_crit_only); destination(d_news_crit); }; log { source(s_local); filter(f_news); filter(f_err_only); destination(d_news_err); }; log { source(s_local); filter(f_news); filter(f_notice); destination(d_news_notice); }; -------- Config File ---------- Thanks Jack

1 0

RE: [syslog-ng]separate logs from different sources
by Hamilton, Andrew 21 Oct '02

21 Oct '02

And of course you really don't need to have the filter statement in it at all if you use the $HOST macro. you could then just use: source net { tcp(); udp(); }; destination hostfile { file("/path/to/logs/$HOST"); }; log { source(net); destination(hostfile); }; Drew -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Monday, October 21, 2002 8:56 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]separate logs from different sources Olav, This should work for you. Of course you should substitute real names where I have placed the x's and the filter and destination names should be meaningful names. Whether you use TCP is up to you. You will need to use UDP because that is how Cisco routers send their logs. source net { tcp(); udp(); }; filter f_host { host("xxx.xxx.xxx.xxx"); }; destination hostfile { file("/path/to/logs/$HOST"); }; log { source(net); filter(f_host); destination(hostfile); }; Regards, Drew -----Original Message----- From: Olav Langeland [mailto:Olav.Langeland@activeisp.com] Sent: Monday, October 21, 2002 8:47 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]separate logs from different sources I want to send syslog from 3 different Cisco routers to a FreeBSD box and have syslog-ng separate them into different output files based on IP. Would appreciate if anyone could help me with configuration examples/ideas. thanks, olav. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]separate logs from different sources
by Hamilton, Andrew 21 Oct '02

21 Oct '02

Olav, This should work for you. Of course you should substitute real names where I have placed the x's and the filter and destination names should be meaningful names. Whether you use TCP is up to you. You will need to use UDP because that is how Cisco routers send their logs. source net { tcp(); udp(); }; filter f_host { host("xxx.xxx.xxx.xxx"); }; destination hostfile { file("/path/to/logs/$HOST"); }; log { source(net); filter(f_host); destination(hostfile); }; Regards, Drew -----Original Message----- From: Olav Langeland [mailto:Olav.Langeland@activeisp.com] Sent: Monday, October 21, 2002 8:47 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]separate logs from different sources I want to send syslog from 3 different Cisco routers to a FreeBSD box and have syslog-ng separate them into different output files based on IP. Would appreciate if anyone could help me with configuration examples/ideas. thanks, olav. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

separate logs from different sources
by Olav Langeland 21 Oct '02

21 Oct '02

I want to send syslog from 3 different Cisco routers to a FreeBSD box and have syslog-ng separate them into different output files based on IP. Would appreciate if anyone could help me with configuration examples/ideas. thanks, olav.

1 0

Ca ne marche pas
by Laurent Mesuré 19 Oct '02

19 Oct '02

Hi, i've installed the 1.5.21 version of syslog-ng with postgresql 7.2.2 But if i try to log anything nothing happened, neither in files nor in database. i've made a test with the debug (-d) option and here is the resulting log in log.log file joined to this mail. I've joined also my syslog-ng.conf Laurent Mesuré #*********************************************************************** # Fichier de configuration pour syslog-ng # Voir syslog-ng(8) et syslog-ng.conf(5) pour plus d'informations # #*********************************************************************** # Versions Date Auteur # 1.0 25/09/2002 gb(a)sysfive.com # 2.0 24/04/2002 ben(a)pleasenospam.tnsi.com # 3.0 16/10/2002 Laurent Mesure <lmesure(a)nerim.net> #*********************************************************************** # Versions Description # 1.0 Original # 2.0 Modifie # 3.0 Francisation et adaptation #*********************************************************************** options { sync (0); time_reopen (10); log_fifo_size (100); long_hostnames (on); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); time_reap(12); gc_busy_threshold(768); }; #*********************************************************************** source s_sys { unix-stream ("/dev/log"); internal(); }; source s_udp { udp(); }; source s_tcp { tcp(); }; source s_local { internal(); }; #*********************************************************************** # destination d_files { file("/var/log/syslog-ng/$HOST/$FACILITY.$LEVEL" # template{"$ISODATE $HOST $FACILITY $PRIORITY $PROCESS $MSG\n")); # }; destination d_local { file("/var/log/syslog-ng.$MONTH"); }; destination d_msgs { file("/var/log/messages" template("$FULLDATE $HOST $FACILITY.PRIORITY $MSG\n")); }; destination d_mail { file("/var/log/maillog" template("$FULLDATE $HOST mail.$PRIORITY $MSG\n")); }; destination d_secure { file("/var/log/secure" template("$FULLDATE $HOST authpriv.$PRIORITY $MSG\n")); }; destination d_cron { file("/var/log/cron" template("$FULLDATE $HOST cron.$PRIORITY $MSG\n")); }; destination d_bootlog { file("/var/log/boot.log" template("$FULLDATE $HOST local7.$PRIORITY $MSG\n")); }; destination d_postgres { file("/mnt/disk2/spooldir/syslog2pgsql/fulllog.$YEAR.$MONTH.$DAY.$HOUR.$MIN.$SEC" template("INSERT INTO msg_table VALUES$ '$R_ISODATE', '$S_ISODATE', '$HOST', '$FACILITY', $PRIORITY', '$MSG'$\;\n") template_escape(yes) owner(postgres)); }; #*********************************************************************** #*********************************************************************** filter f_msgs { host("syslogdb") and level(warning,err,crit,alert,emerg) and not facility(mail,authpriv,cron); }; filter f_mail { host("syslogdb") and facility(mail); }; filter f_cron { host("syslogdb") and facility(cron); }; filter f_secure { host("syslogdb") and facility(authpriv); }; filter f_bootlog { host("syslogdb") and facility(local7); }; filter f_postgres { host("syslogdb"); }; #*********************************************************************** #*********************************************************************** # log { source(s_sys); source(s_udp); destination(d_files); }; log { source(s_sys); source(s_udp); filter(f_msgs); destination(d_msgs); }; log { source(s_sys); source(s_udp); filter(f_mail); destination(d_mail); }; log { source(s_sys); source(s_udp); filter(f_secure); destination(d_secure); }; log { source(s_sys); source(s_udp); filter(f_cron); destination(d_cron); }; log { source(s_sys); source(s_udp); filter(f_bootlog); destination(d_bootlog); }; log { source(s_sys); source(s_udp); source(s_tcp); filter(f_postgres); destination(d_postgres); }; log { source(s_local); destination(d_local); };

1 0

Old log messages showing up followed by reboot
by Guillaume Fraysse 18 Oct '02

18 Oct '02

Hello everyone, First step, let me introduce myself, my name is Guillaume Fraysse and I'm a French software engineer in an IT compagny. I just subscribed to this list because I haven't found anything about a problem I encountered when googling and browsing the archives of the list. I, along with some fellow workers of mine, juste experienced a very strange behaviour. A linux (2.4.8, debian) server unexpectingly rebooted and while checking the logs we found out that at the time of the reboot nothing was to be found. Instead the last log messages (before the reboot) were from the day before. So the log file has old log messages right in the middle. Which gives something like that (I, of course, have blurred the logs) Oct 18 13:29:07 some_home_app some_message Oct 17 21:08:56 some_home_app some_old_message Oct 17 21:08:57 some_home_app some_old_message Oct 17 21:08:58 some_home_app some_old_message Oct 17 21:08:59 some_home_app some_old_message [...] OcOct 18 13:43:50 some_host syslog-ng[136]: syslog-ng version 1.4.16 starting (the OcOct isn't a typo, it's "as is") It didn't happen only to one log file but to several of them (the excerpt above is taken from /var/log/messages) : /var/log/debug /var/log/messages /var/log/syslog Coincidentally those files are all the ones logging the facility used by one of our applications (let's say it's local4). Here are the lines concerning /var/log/messages in the syslog-ng.conf file : options { long_hostnames(off); sync(0); }; source src { unix-dgram("/dev/log"); internal(); }; destination messages { file("/var/log/messages" owner("root") group("group") perm(0640)); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, local4); }; log { source(src); filter(f_messages); destination(messages); }; I assume it might not be a syslog-ng problem, more the way we use it, but does anyone have any idea about what could cause that behaviour ? Why do we see old messages like that ? And, even if they are old messages why aren't they logged with the current time ? Cheers, Guillaume

1 0

Search Agent
by EyaKoo 17 Oct '02

17 Oct '02

1 0

messages every 5 seconds
by Alex Finch 16 Oct '02

16 Oct '02

Following a recommendation in http://online.securityfocus.com/infocus/1633 I decided to try syslog-ng I installed it and it appears to run, but so far all I get is every 5 seconds: watcher[900]: Checking files... Is this normal - can I turn it off? -- Alex Finch, Research Fellow, Physics Department, Lancaster University.

2 1

problems: Error creating AF_INET socket (Success)
by Christian Hammers 16 Oct '02

16 Oct '02

Hi Does someone know why it worked in 1.5.13 and not in 1.5.21? destination qdb2 { udp("qdb2.westend.com"); }; log { source(src); destination(qdb2); }; (optionally with port(514) but doesn't matter) # syslog-ng -F -v -d io.c: Preparing fd 3 for reading io.c: listening on fd 4 binding fd 5, unixaddr: /dev/log io.c: listening on fd 5 io.c: connecting using fd 6 Error creating AF_INET socket (Success) Error initializing configuration, exiting. The hostname is, according to "host"/"nslookup" correct. bye, -christian- P.S.: Please cc me when replying. thanks. strace: 24568 execve("/sbin/syslog-ng", ["syslog-ng", "-dddd", "-vvv"], [/* 22 vars */]) = 0 24568 uname({sys="Linux", node="proxy", ...}) = 0 24568 brk(0) = 0x805b7a4 24568 open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory) 24568 open("/etc/ld.so.cache", O_RDONLY) = 3 24568 fstat64(3, {st_mode=S_IFREG|0644, st_size=12877, ...}) = 0 24568 old_mmap(NULL, 12877, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40014000 24568 close(3) = 0 24568 open("/lib/libnsl.so.1", O_RDONLY) = 3 24568 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0 ;\0\000"..., 1024) = 1024 24568 fstat64(3, {st_mode=S_IFREG|0644, st_size=69472, ...}) = 0 24568 old_mmap(NULL, 80988, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x40018000 24568 mprotect(0x40029000, 11356, PROT_NONE) = 0 24568 old_mmap(0x40029000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x10000) = 0x40029000 24568 old_mmap(0x4002a000, 7260, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x4002a00 0 24568 close(3) = 0 24568 open("/lib/libc.so.6", O_RDONLY) = 3 24568 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\30\222"..., 1024) = 1024 24568 fstat64(3, {st_mode=S_IFREG|0755, st_size=1153784, ...}) = 0 24568 old_mmap(NULL, 1166560, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x4002c000 24568 mprotect(0x4013f000, 40160, PROT_NONE) = 0 24568 old_mmap(0x4013f000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x113000) = 0x4013f000 24568 old_mmap(0x40145000, 15584, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x401450 00 24568 close(3) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40149000 24568 munmap(0x40014000, 12877) = 0 24568 brk(0) = 0x805b7a4 24568 brk(0x805b7ec) = 0x805b7ec 24568 brk(0x805c000) = 0x805c000 24568 open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) = 3 24568 brk(0x8061000) = 0x8061000 24568 ioctl(3, SNDCTL_TMR_TIMEBASE, 0xbffff858) = -1 ENOTTY (Inappropriate ioctl for device) 24568 fstat64(3, {st_mode=S_IFREG|0644, st_size=4970, ...}) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40014000 24568 read(3, "#\n# Syslog-ng configuration file"..., 8192) = 4970 24568 read(3, "", 4096) = 0 24568 brk(0x8062000) = 0x8062000 24568 socket(PF_UNIX, SOCK_STREAM, 0) = 4 24568 connect(4, {sin_family=AF_UNIX, path="/var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directo ry) 24568 close(4) = 0 24568 open("/etc/nsswitch.conf", O_RDONLY) = 4 24568 fstat64(4, {st_mode=S_IFREG|0644, st_size=465, ...}) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40015000 24568 read(4, "# /etc/nsswitch.conf\n#\n# Example"..., 4096) = 465 24568 read(4, "", 4096) = 0 24568 close(4) = 0 24568 munmap(0x40015000, 4096) = 0 24568 open("/etc/ld.so.cache", O_RDONLY) = 4 24568 fstat64(4, {st_mode=S_IFREG|0644, st_size=12877, ...}) = 0 24568 old_mmap(NULL, 12877, PROT_READ, MAP_PRIVATE, 4, 0) = 0x4014a000 24568 close(4) = 0 24568 open("/lib/libnss_compat.so.2", O_RDONLY) = 4 24568 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\340\25"..., 1024) = 1024 24568 fstat64(4, {st_mode=S_IFREG|0644, st_size=40152, ...}) = 0 24568 old_mmap(NULL, 43256, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0x4014e000 24568 mprotect(0x40158000, 2296, PROT_NONE) = 0 24568 old_mmap(0x40158000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 4, 0x9000) = 0x40158000 24568 close(4) = 0 24568 munmap(0x4014a000, 12877) = 0 24568 uname({sys="Linux", node="proxy", ...}) = 0 24568 open("/etc/passwd", O_RDONLY) = 4 24568 fcntl64(4, F_GETFD) = 0 24568 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 24568 fstat64(4, {st_mode=S_IFREG|0644, st_size=3771, ...}) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40015000 24568 _llseek(4, 0, [0], SEEK_CUR) = 0 24568 read(4, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 3771 24568 close(4) = 0 24568 munmap(0x40015000, 4096) = 0 24568 brk(0x8063000) = 0x8063000 24568 socket(PF_UNIX, SOCK_STREAM, 0) = 4 24568 connect(4, {sin_family=AF_UNIX, path="/var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directo ry) 24568 close(4) = 0 24568 open("/etc/group", O_RDONLY) = 4 24568 fcntl64(4, F_GETFD) = 0 24568 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 24568 fstat64(4, {st_mode=S_IFREG|0644, st_size=539, ...}) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40015000 24568 _llseek(4, 0, [0], SEEK_CUR) = 0 24568 read(4, "root:x:0:\ndaemon:x:1:\nbin:x:2:\ns"..., 4096) = 539 24568 close(4) = 0 24568 munmap(0x40015000, 4096) = 0 24568 brk(0x8064000) = 0x8064000 24568 read(3, "", 8192) = 0 24568 ioctl(3, SNDCTL_TMR_TIMEBASE, 0xbffff328) = -1 ENOTTY (Inappropriate ioctl for device) 24568 close(3) = 0 24568 munmap(0x40014000, 4096) = 0 24568 brk(0x8068000) = 0x8068000 24568 socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) = 3 24568 fcntl64(3, F_GETFL) = 0x2 (flags O_RDWR) 24568 fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 24568 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 24568 fcntl64(3, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) 24568 fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 24568 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 24568 brk(0x8069000) = 0x8069000 24568 write(2, "io.c: Preparing fd 3 for reading"..., 33) = 33 24568 socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 4 24568 fcntl64(4, F_GETFL) = 0x2 (flags O_RDWR) 24568 fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 24568 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 24568 write(2, "io.c: listening on fd 4\n", 24) = 24 24568 listen(4, 256) = 0 24568 socket(PF_UNIX, SOCK_DGRAM, 0) = 5 24568 fcntl64(5, F_GETFL) = 0x2 (flags O_RDWR) 24568 fcntl64(5, F_SETFL, O_RDWR|O_NONBLOCK) = 0 24568 fcntl64(5, F_SETFD, FD_CLOEXEC) = 0 24568 write(2, "binding fd 5, unixaddr: /dev/log"..., 33) = 33 24568 stat64("/dev/log", {st_mode=S_IFSOCK|0666, st_size=0, ...}) = 0 24568 unlink("/dev/log") = 0 24568 bind(5, {sin_family=AF_UNIX, path="/dev/log"}, 11) = 0 24568 chown32(0x805fa60, 0, 0) = 0 24568 chmod("/dev/log", 0666) = 0 24568 fcntl64(5, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) 24568 fcntl64(5, F_SETFL, O_RDWR|O_NONBLOCK) = 0 24568 fcntl64(5, F_SETFD, FD_CLOEXEC) = 0 24568 write(2, "io.c: Preparing fd 5 for reading"..., 33) = 33 24568 socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) = 6 24568 fcntl64(6, F_GETFL) = 0x2 (flags O_RDWR) 24568 fcntl64(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0 24568 fcntl64(6, F_SETFD, FD_CLOEXEC) = 0 24568 write(2, "io.c: connecting using fd 6\n", 28) = 28 24568 gettimeofday({1034764213, 912762}, NULL) = 0 24568 getpid() = 24568 24568 open("/etc/resolv.conf", O_RDONLY) = 7 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=110, ...}) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40014000 24568 read(7, "domain westend.com\nsearch westen"..., 4096) = 110 24568 read(7, "", 4096) = 0 24568 close(7) = 0 24568 munmap(0x40014000, 4096) = 0 24568 socket(PF_UNIX, SOCK_STREAM, 0) = 7 24568 connect(7, {sin_family=AF_UNIX, path="/var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directo ry) 24568 close(7) = 0 24568 open("/etc/ld.so.cache", O_RDONLY) = 7 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=12877, ...}) = 0 24568 old_mmap(NULL, 12877, PROT_READ, MAP_PRIVATE, 7, 0) = 0x40014000 24568 close(7) = 0 24568 open("/lib/libnss_files.so.2", O_RDONLY) = 7 24568 read(7, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0@\35\0\000"..., 1024) = 1024 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=32668, ...}) = 0 24568 brk(0x806a000) = 0x806a000 24568 old_mmap(NULL, 36112, PROT_READ|PROT_EXEC, MAP_PRIVATE, 7, 0) = 0x40159000 24568 mprotect(0x40161000, 3344, PROT_NONE) = 0 24568 old_mmap(0x40161000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 7, 0x7000) = 0x40161000 24568 close(7) = 0 24568 munmap(0x40014000, 12877) = 0 24568 open("/etc/host.conf", O_RDONLY) = 7 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=26, ...}) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40014000 24568 read(7, "order hosts,bind\nmulti on\n", 4096) = 26 24568 read(7, "", 4096) = 0 24568 close(7) = 0 24568 munmap(0x40014000, 4096) = 0 24568 open("/etc/hosts", O_RDONLY) = 7 24568 fcntl64(7, F_GETFD) = 0 24568 fcntl64(7, F_SETFD, FD_CLOEXEC) = 0 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=269, ...}) = 0 24568 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40014000 24568 read(7, "127.0.0.1\tlocalhost\n\n# The follo"..., 4096) = 269 24568 read(7, "", 4096) = 0 24568 close(7) = 0 24568 munmap(0x40014000, 4096) = 0 24568 open("/etc/ld.so.cache", O_RDONLY) = 7 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=12877, ...}) = 0 24568 old_mmap(NULL, 12877, PROT_READ, MAP_PRIVATE, 7, 0) = 0x40014000 24568 close(7) = 0 24568 open("/lib/libnss_dns.so.2", O_RDONLY) = 7 24568 read(7, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0`\r\0\000"..., 1024) = 1024 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=12176, ...}) = 0 24568 old_mmap(NULL, 15144, PROT_READ|PROT_EXEC, MAP_PRIVATE, 7, 0) = 0x4014a000 24568 mprotect(0x4014d000, 2856, PROT_NONE) = 0 24568 old_mmap(0x4014d000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 7, 0x2000) = 0x4014d000 24568 close(7) = 0 24568 open("/lib/libresolv.so.2", O_RDONLY) = 7 24568 read(7, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300\'\0"..., 1024) = 1024 24568 fstat64(7, {st_mode=S_IFREG|0644, st_size=56480, ...}) = 0 24568 old_mmap(NULL, 65312, PROT_READ|PROT_EXEC, MAP_PRIVATE, 7, 0) = 0x40162000 24568 mprotect(0x4016f000, 12064, PROT_NONE) = 0 24568 old_mmap(0x4016f000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 7, 0xd000) = 0x4016f000 24568 old_mmap(0x40170000, 7968, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x4017000 0 24568 close(7) = 0 24568 munmap(0x40014000, 12877) = 0 24568 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 7 24568 connect(7, {sin_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("212.117.68.10")}}, 28) = 0 24568 send(7, "\2158\1\0\0\1\0\0\0\0\0\0\4qdb2\7westend\3com\0\0\1"..., 34, 0) = 34 24568 gettimeofday({1034764213, 937072}, NULL) = 0 24568 poll([{fd=7, events=POLLIN, revents=POLLIN}], 1, 5000) = 1 24568 recvfrom(7, "\2158\201\200\0\1\0\1\0\2\0\2\4qdb2\7westend\3com\0\0\1"..., 1024, 0, {sin_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("212.117.68.10")}}, [16]) = 133 24568 close(7) = 0 24568 close(6) = 0 24568 write(2, "Error creating AF_INET socket (S"..., 40) = 40 24568 write(2, "Error initializing configuration"..., 43) = 43 24568 _exit(2) = ? -- Christian Hammers WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 ch(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Authorized Reseller

2 1

Configuration ?
by Jack Sasportas 16 Oct '02

16 Oct '02

I used a much older version of syslog-ng previously, but the newer version is a little different, so I just want to confirm a couple of things. 1. If I install the RPM under redhat 7.2 what do I need to do to basically insure that the old syslog isn't going to kick in etc. 2. I want to split any pop activity from maillog into poplog, so I configured what I thought would work, and it does most of the time, but there are times when I pop the server, and there is no long entry. Here is my entire config. Any help appreciated.... THANKS -------- Config File ---------- # This file should be compatible with the out-of-the-box # /etc/syslog.conf on Red Hat Linux # global options # options { use_dns(yes); use_fqdn(no); use_time_recvd(no); chain_hostnames(no); mark(0); sync(0); }; source s_local { internal(); unix-stream("/dev/log" keep-alive(yes) max-connections(10)); file("/proc/kmsg"); }; # facility filters # # Jack filter f_authpriv { facility(authpriv); }; filter f_authpriv { facility(authpriv) and not program("popper"); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; filter f_kern { facility(kern); }; # Jack filter f_mail { facility(mail); }; filter f_mail { facility(mail) and not program("popper"); }; filter f_messages { priority(info..emerg) and not facility(mail, news, authpriv, cron, local1, local2, local3, local4, local5, local6); }; # Jack filter f_news { facility(news); }; # priority filters # filter f_crit { priority(crit..emerg); }; filter f_crit_only { priority(crit); }; filter f_emerg { priority(emerg); }; filter f_err { priority(err..emerg); }; filter f_err_only { priority(err); }; filter f_info { priority(info..emerg); }; filter f_notice { priority(notice..emerg); }; filter f_warn { priority(warning..emerg); }; # Jack filter f_pop { program(popper); }; destination d_all { usertty("*"); }; destination d_boot { file("/var/log/bootlog"); }; destination d_console { file("/dev/console"); }; destination d_cron { file("/var/log/cron"); }; destination d_mail { file("/var/log/maillog"); }; destination d_messages { file("/var/log/messages"); }; # Jack destination d_news_crit { file("/var/log/news/news.crit"); }; destination d_news_err { file("/var/log/news/news.err"); }; destination d_news_notice { file("/var/log/news/news.notice"); }; destination d_secure { file("/var/log/secure"); }; destination d_spooler { file("/var/log/spooler"); }; # Jack destination d_pop { file("/var/log/poplog"); }; # Everybody gets emergency messages log { source(s_local); filter(f_emerg); destination(d_all); }; # Log anything (except mail) of level info or higher. # Don't log private authentication messages! log { source(s_local); filter(f_messages); destination(d_messages); }; # The authpriv file has restricted access. log { source(s_local); filter(f_authpriv); destination(d_secure); }; # Jack Log all the pop mail messages. log { source(s_local); filter(f_pop); destination(d_pop); }; # Log all the mail messages in one place. log { source(s_local); filter(f_mail); destination(d_mail); }; # Log cron stuff log { source(s_local); filter(f_cron); destination(d_cron); }; # Save boot messages also to boot.log log { source(s_local); filter(f_boot); destination(d_boot); }; # # INN # log { source(s_local); filter(f_news); filter(f_crit_only); destination(d_news_crit); }; log { source(s_local); filter(f_news); filter(f_err_only); destination(d_news_err); }; log { source(s_local); filter(f_news); filter(f_notice); destination(d_news_notice); }; -------- Config File ---------- Thanks Jack

1 0

Re: syslog-ng-1.5.21 on Solaris8
by Balazs Scheidler 15 Oct '02

15 Oct '02

On Tue, Oct 15, 2002 at 12:16:13PM +0200, Sean Boran wrote: > Hi, > > I'm a new comer to syslog-ng and wanted to try it out on Solaris. > I wish to use the 1.5 branch so I can perhaps divert to sql later.. > > Anyway, I run configure with no options and the make. > It compiles all modules but fails on linking: > > "gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o > syslog-ng main.o sources.o center.o filters.o destinations.o log.o > cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o > afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o > utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor > /usr/local/lib/libol.a -l > socket -lnsl -lxnet > Undefined first referenced > symbol in file > res_init main.o > yywrap cfg-lex.o > ld: fatal: Symbol referencing errors. No output written to syslog-ng > collect2: ld returned 1 exit status" > > - Then I though maybe I should install FLEX, so I installed flex-2.5.4a, > and redid the configure and make, the result is the same. > > - libol-0.3.3 compiled and installed just fine. > - I'm compiled on Solaris 8 sun4u, with pretty recent patches, if that > helps. > - I know litte about flex, so was unsure how to proceed with debugging.. > - I see one reference to res_init in main.c, but no explanation as what > is is or where it comes from.. > > Have you any tips for me? res_init can be solved by adding -lresolv to link flags. yywrap can be solved by linking against -lfl (part of flex) instead of simply -ll (part of lex as distributed with Solaris) res_init() seems to be platform dependant, so I added a configure test in 1.5.22 (which has been released, but not uploaded to our website) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

4 5

Fixed Solaris 5.7 x86 and thanks to Balázs Scheidler !!!!!
by Lancashire, Pete 15 Oct '02

15 Oct '02

My fault .. when I recreated the /dev/log sym link the shell's filename expansion got in the way. Thanks to Balázs Scheidler for the new Syslog !!!! -pete -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Monday, October 14, 2002 5:45 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Solaris 5.7 x86 Try this: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); }; regards, Drew -----Original Message----- From: Lancashire, Pete [mailto:PLancashire@columbia.com] Sent: Sunday, October 13, 2002 8:26 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Solaris 5.7 x86 Hi, What should the source local options be for Solaris 5.7 Intel ? source local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; Doesn't work for my system, I get the error message do_init_afstreams_source: Cannot open sun-stream /dev/log (Invalid argument) This is from a config file generated by the syslog2ng awk script. Thanks, -pete _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]logging with $HOST and no $HOST
by Hamilton, Andrew 15 Oct '02

15 Oct '02

You can always use the DEFAULT filter as your last log line. log { source(src); filter(DEFAULT); destination(junkfile); }; That will get all the logs any of your filters would miss. Regards, Drew -----Original Message----- From: JR Mayberry [mailto:mayberry0404@yahoo.com] Sent: Friday, October 11, 2002 1:56 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]logging with $HOST and no $HOST When I do an lsof on my syslog-ng server I will see entries like (i'm setup with : file(/log/$HOST/$MONTH-$DAY-$YEAR); ) "/log -- 13" (13 because its 1pm now) "/log -- 10-11-2002/13" So, I'm obviously losing logs, I need to know how I can fix this and get these logs (even if it's to a "dump all poorly malformed log packets to a single file" solution) syslog-ng 1.5.15 thanks. __________________________________________________ Do you Yahoo!? Faith Hill - Exclusive Performances, Videos & More http://faith.yahoo.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]Solaris 5.7 x86
by Hamilton, Andrew 15 Oct '02

15 Oct '02

Try this: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); }; regards, Drew -----Original Message----- From: Lancashire, Pete [mailto:PLancashire@columbia.com] Sent: Sunday, October 13, 2002 8:26 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Solaris 5.7 x86 Hi, What should the source local options be for Solaris 5.7 Intel ? source local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; Doesn't work for my system, I get the error message do_init_afstreams_source: Cannot open sun-stream /dev/log (Invalid argument) This is from a config file generated by the syslog2ng awk script. Thanks, -pete _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Solaris 5.7 x86
by Lancashire, Pete 14 Oct '02

14 Oct '02

Hi, What should the source local options be for Solaris 5.7 Intel ? source local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; Doesn't work for my system, I get the error message do_init_afstreams_source: Cannot open sun-stream /dev/log (Invalid argument) This is from a config file generated by the syslog2ng awk script. Thanks, -pete

1 0