- syslog-ng - lists.balabit.hu

question about logrotate (little offtopic ;)
by Buerger, Manfred 19 Sep '02

19 Sep '02

hello, my syslog-ng server is runnig fine, but a have little problem with logrotate. please take a look... syslog-ng writes the log files into "/var/log/syslog-ng/" in this directory for each host a subdirectory is created e.g.: /var/log/syslog-ng/10.10.10.2/ /var/log/syslog-ng/10.10.10.3/ usw... in /etc/logrotate.conf i made the following entry: /var/log/syslog-ng/* { rotate 5 daily size=500M postrotate /usr/bin/killall -HUP syslog-ng endscript compress } but this dont work! i have to specify the whole path to the log files: /var/log/syslog-ng/10.10.10.3/* ist there a way to rotate a directory with its subdirectory?? thanks in advance manfred

1 0

(no subject)
by Grenier, Scott 1 - San Mateo, CA 18 Sep '02

18 Sep '02

Hiya- I'm setting up new syslog servers using syslog-ng in a mostly Solaris environment. Regular syslog logs messages from hosts with the actual hostname, but syslog-ng is logging the host's IP address instead. Not all machines are in DNS. Here's what I have: options { chain_hostnames(no); use_time_recvd(yes); log_fifo_size(1000); }; source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; destination d_hostlogs { file("/logs1/HOSTS/$HOST/capturedmessages.$HOST.$YEAR$MONTH$DAY" owner(root) group(sys) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(src); destination(d_hostlogs); }; Syslog-ng creates the files and dirs nicely. I just can't get the actual hostname like I used to when running regular ol' out-o'-the-box syslogd. I checked out the FAQ on Nate's site already (Nice job on the site and FAQ, Nate. It's been a very useful resource for me.). Many thanks. -->scottg

2 1

Unwanted logging
by BENGT OLSSON 17 Sep '02

17 Sep '02

Hi I get some unwanted loggin from strange hosts.... The syslog-ng.conf-file looks like; options { use_fqdn(yes); keep_hostname(yes); use_dns(yes); long_hostnames(off); sync(0); log_fifo_size(1000); }; source all { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; destination hosts { file("/var/syslog/hosts/$HOST/$FACILITY_$YEAR-$MONTH-$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(all) ; destination(hosts) ; }; An example of unwanted "hosts"-directory in the /var/syslog/hosts-directory; 0x0.0x5da74da 0x0.0x5dc3cea 0x0.0x5dc3d5a 0x0.0x5dc4077 0x0.0x5dca334 0x0.0x5dcea7a 0x0.0x637fb77 0x0.0x642bad8 0x0.0x64c5ea8 An example of correct hosts -directory in the /var/syslog/hosts-directory looks like this; trillian.student.bth.se trumma.bth.se viking.student.bth.se viola.bth.se violin.bth.se vogonjeltz.student.bth.se voyager.student.bth.se vroomfondel.student.bth.se zaphod.student.bth.se Is there some internal logging or what is it comming from? A minor problem is that i have the "long_hostnames" to off and still it loging whit long hostnames....any guess? Best Regards -- Bengt Olsson Blekinge Tekniska Högskola Datorenheten Campus Gräsvik Vallhallavägen 1 371 79 Karlskrona Mail: bol(a)bth.se Tel: 0455-385152 Mobil: 0708-787 780

3 2

RE: [syslog-ng]Unwanted logging
by Hamilton, Andrew 17 Sep '02

17 Sep '02

I can help with the long_hostnames part. You have use_fqdn(yes) which turns on the full qualified domain name of the host. Regards, Drew -----Original Message----- From: BENGT OLSSON [mailto:bol@bth.se] Sent: Tuesday, September 17, 2002 8:32 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Unwanted logging Hi I get some unwanted loggin from strange hosts.... The syslog-ng.conf-file looks like; options { use_fqdn(yes); keep_hostname(yes); use_dns(yes); long_hostnames(off); sync(0); log_fifo_size(1000); }; source all { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; destination hosts { file("/var/syslog/hosts/$HOST/$FACILITY_$YEAR-$MONTH-$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(all) ; destination(hosts) ; }; An example of unwanted "hosts"-directory in the /var/syslog/hosts-directory; 0x0.0x5da74da 0x0.0x5dc3cea 0x0.0x5dc3d5a 0x0.0x5dc4077 0x0.0x5dca334 0x0.0x5dcea7a 0x0.0x637fb77 0x0.0x642bad8 0x0.0x64c5ea8 An example of correct hosts -directory in the /var/syslog/hosts-directory looks like this; trillian.student.bth.se trumma.bth.se viking.student.bth.se viola.bth.se violin.bth.se vogonjeltz.student.bth.se voyager.student.bth.se vroomfondel.student.bth.se zaphod.student.bth.se Is there some internal logging or what is it comming from? A minor problem is that i have the "long_hostnames" to off and still it loging whit long hostnames....any guess? Best Regards -- Bengt Olsson Blekinge Tekniska Högskola Datorenheten Campus Gräsvik Vallhallavägen 1 371 79 Karlskrona Mail: bol(a)bth.se Tel: 0455-385152 Mobil: 0708-787 780 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

localport binding...still not working.
by Robert D. Beal 17 Sep '02

17 Sep '02

>>I'm trying to get syslog-ng (1.5.20) to use 514 as its source port when >>using the udp destination driver as follows: >> >> <<Following taken from my syslog-ng.conf>> >> >> source s_sys { unix-stream("/dev/log"); internal(); }; >> destination d_syslog { udp("192.168.0.2" destport(514) >> localport(514)); }; >> log { source(s_src); destination(d_syslog); }; >> >>but it always seems to send the syslog udp datagrams using the next >>available non-privileged port as its source (>1024). I'm running as root >>(on RedHat 7.3) and syslogd is not running. Syslog-ng doesn't choke on the >>config, so I'm assuming its not a syntax problem, but I just can't seem to >>get it to use 514 as its source port?! Does anyone have any ideas what I >>may be doing wrong here? Or is it just silently ignoring my request to use >>port 514? > >As it seems the docs is buggy, Robert is right. The bug lies in libol, it >only binds the local socket if the local address is defined. So there are >two solutions: > >* supply localip as well as localport >* apply this patch to libol, and recompile > > >diff -u -r1.26 -r1.28 >--- io.c 11 Oct 2001 18:25:14 -0000 1.26 >+++ io.c 16 Sep 2002 08:23:22 -0000 1.28 >@@ -829,9 +834,9 @@ > memcpy(sa, &a->sa, sizeof(a->sa)); > return 1; > } >- if (a->ip && !tcp_addr(in, >- a->ip->length, a->ip->data, >- a->port)) >+ if (tcp_addr(in, >+ a ? a->ip->length : 7, a ? a->ip->data : "0.0.0.0", >+ a->port)) > return 0; > else > if (!a->ip && !tcp_addr(in, 0, NULL, a->port)) > > >-- >Bazsi >PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 I tried modifying my syslog-ng.conf as follows: source s_sys { unix-stream("/dev/log"); internal(); }; destination d_syslog { udp("192.168.0.2" destport(514) localip("192.168.0.10") localport(514)); }; log { source(s_src); destination(d_syslog); }; and I'm now getting a segmentation fault. 192.168.0.10 is the IP of the system I'm running on. I also tried 127.0.0.1 as the localip with the same result. Do I have the syntax incorrect? Syslog-ng didn't complain. I also tried the patch, but not being really strong in C/C++ I may have messed something up. I applied the patch, and now make errors out: make_class <io.c > io.c.xt /bin/sh: /home/src/syslog-ng/libol-0.3.3/utils/make_class: \: bad interpreter: No such file or directory make[1]: ***[io.c.x]: Error 126 make[1]: Leaving directory '/home/src/syslog-ng/libol-0.3.3/src` make{[1]: *** [all-recursive] Error 1 Any suggestions? I can live with syslog-ng binding to whatever source port, but I'd have to open up my router access lists a little more than I would like.

2 1

Problem compiling on FreeBSD
by Nicolai Strøm Gylling 16 Sep '02

16 Sep '02

Hi I'm trying to compile syslog-ng_1.5.20 on FreeBSD 4.6.2-RELEASE, but I get the error below. I'm using Libol 0.3.3. Anyone got some clues to what might be wrong? gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.5.20/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afremctrl.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.5.20/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c nscache.c In file included from nscache.c:55: /usr/include/netinet/in.h:233: syntax error before `in_addr_t' /usr/include/netinet/in.h:285: syntax error before `u_char' In file included from /usr/include/netinet/in.h:467, from nscache.c:55: /usr/include/netinet6/in6.h:122: syntax error before `u_int8_t' /usr/include/netinet6/in6.h:144: syntax error before `u_int8_t' /usr/include/netinet6/in6.h:149: syntax error before `u_int32_t' /usr/include/netinet6/in6.h:612: syntax error before `*' /usr/include/netinet6/in6.h:614: syntax error before `*' /usr/include/netinet6/in6.h:614: warning: data definition has no type or storage class /usr/include/netinet6/in6.h:615: syntax error before `u_int8_t' /usr/include/netinet6/in6.h:616: syntax error before `u_int8_t' /usr/include/netinet6/in6.h:631: syntax error before `u_int8_t' /usr/include/netinet6/in6.h:636: syntax error before `u_int8_t' /usr/include/netinet6/in6.h:638: syntax error before `u_int8_t' nscache.c: In function `nscache_new': nscache.c:112: structure has no member named `s_addr' nscache.c: In function `nscache_lookup': nscache.c:178: structure has no member named `s_addr' nscache.c:183: structure has no member named `s_addr' nscache.c:183: structure has no member named `s_addr' nscache.c:245: structure has no member named `s_addr' nscache.c:245: structure has no member named `s_addr' nscache.c:247: fixed or forbidden register 0 (ax) was spilled for class AREG. nscache.c:247: This may be due to a compiler bug or to impossible asm nscache.c:247: statements or clauses. nscache.c:247: This is the instruction: (insn 56 55 58 (parallel[ (set (reg:SI 2 %ecx) (udiv:SI (reg/v:SI 2 %ecx) (reg:SI 1 %edx))) (set (reg:SI 1 %edx) (umod:SI (reg/v:SI 2 %ecx) (reg:SI 1 %edx))) ] ) 243 {udivmodsi4} (insn_list 49 (insn_list 55 (nil))) (expr_list:REG_DEAD (reg/v:SI 2 %ecx) (expr_list:REG_DEAD (reg:SI 1 %edx) (expr_list:REG_UNUSED (reg:SI 2 %ecx) (nil))))) *** Error code 1 Stop in /tmp/syslog-ng-1.5.20/src. *** Error code 1 Best regards Nicolai Gylling

1 0

RE: [syslog-ng]Errors Compiling 1.5.19 with TCP_WRAPPERS
by Sangbutsarakum, Patai 16 Sep '02

16 Sep '02

I can't success also. I got suggestion to use other feature of syslog-ng that can do access-list like as TCP_WRAPPER. Hope this help Pat. -----Original Message----- From: Victor [mailto:victord@paid.com] Sent: Thursday, August 22, 2002 10:15 To: Syslog-ng Subject: [syslog-ng]Errors Compiling 1.5.19 with TCP_WRAPPERS I am trying to compile with tcp_wrappers, but I get this error: gcc -O2 -march=i686 -pipe -Wall -I/root/syslog-ng/work/src/libol-0.3.3/src -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o -lfl /root/syslog-ng/work/src/libol-0.3.3/src/.libs/libol.a -lnsl afinet.o: In function `do_open_afinet_connection': afinet.o(.text+0x3c3): undefined reference to `request_init' afinet.o(.text+0x3cf): undefined reference to `sock_host' afinet.o(.text+0x3d8): undefined reference to `hosts_access' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 Shouldn't it have something like -lwrap on the line above? Also, I heard on the mailing list that there is a patch for 1.5.19? Is there a link to it? What's the proper patch command to apply it? Thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

4 3

Memory not released in syslog-ng
by Rolf Böhme 13 Sep '02

13 Sep '02

Hello, according my notice about the memory problems with syslog-ng I have tested again with the actual stable version og syslog-ng. My Configuration is SuSE Linux 7.1 on Compaq Computer, 164MB RAM, 20GB Harddisk, syslog-ng 1.4.15, libol 0.2.23. Eight other Computers (Linux and WinNT 4.0/my modified ntsyslog) send their Information to the Log-Server. After about 23 to 32 hours running syslog-ng the Linux operating system kills the syslog-ng demon with a memory allocation error. The free memory is down to about 10MB. The memory used b syslog-ng was not released. I am using the following syslog-ng.conf: # Konfigurationsdatei fuer syslgd-ng # RB 020827 options { sync(0); keep_hostname(yes); long_hostnames(off); use_dns(yes); }; source s_default { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination d_messages { file("/logfiles/clients/$HOST/$YEAR-$MONTH-$DAY.$FACILITY.$PRIORITY" create_dirs(yes) ); }; log { source(s_default); destination(d_messages); }; What is wrong? Regards Rolf Böhme staatl. gepr. Informatikassistent CNA, Systemadministrator mailto:rolf.boehme@gno.de

2 1

TimeZone Macros Patch
by Robin * Slomkowski 13 Sep '02

13 Sep '02

I have created a patch based on syslog-ng-1.5.20 That adds two new macros. TZOFFSET The time-zone as hour offset from GMT. e.g. '-0700' TZ The time zone or name or abbreviation. e.g. 'PDT' usable like all other macros. $TZ and $TZOFFSET the affected source files are doc/sgml/syslog-ng.sgml documentation update src/affile.c The code change you also need to /bin/touch src/affile.c.x to get it to build correctly after you have applied the patch. and you need to explicitly rebuild the documentation if you want the documentation updates. I have the need for this as I have to coordinate syslog files with other application log files that are in multiple data centers. And since a standard syslog entry does not contain the timezone, I need the log file name to contain the GMT offset so I can correlate the data in a useful manner with the logs in other timezones, and daylight saving times. Hope this patch meets the code standards for this project and that others may find it useful. -- -R*S San Francisco, CA Robin * Slomkowski pretender(a)rslomkow.org

2 1

I NEED YOUR HELP
by monicaalfred monica 12 Sep '02

12 Sep '02

FROM :ABIDJAN-COTE D'IVOIRE E MAIL.monica.monicaalfred(a)caramail.com DEAR SIR IT IS MY PLEASURE TO WRITE TO YOU AFTER MYSEVEN DAYS FASTING AND PRAYERS, l AM MRS MONICA THE WIFE OF LATE MR ALFRED JACK FROM KWAZULU-NATAL IN REPUBLIC OF SOUTH AFRICA, MY HUSBAND OWNS A LIMITED LIABILITY COMPANY OF COCOA AND GOLD IN JOHANESBURG SOUTH AFRICA MY COUNTRY. AFTER HIS TRIP TO ABIDJAN COTE DIVIORE TO NEGOTIATEON A COCOA AND GOLD BUSINESS HE WANTED TO INVEST IN ABIDJAN .ONE WEEK HE CAME BACK FROM HIS TRIP TO ABIDJAN HE HAD A MOTOR ACCIDENT, WHICH MY DAUGHTER DIED INSTANTLY BUT MY HUSBAND DIED AFTER FIVE DAYS IN A PRIVATE HOSPITAL IN MY COUNTRY . IT WAS LIKE MY HUSBAND KNEW HE WAS GOING TO DIE (MAY HIS GENTLE SOUL REST IN PREFECT PEACE). HE DISCLOSED TO ME AND MY SON THAT HE DEPOSITED THE SUM OF ($9,500,000) INTO ONE OF THE BANK IN COTE DIVIORE THAT THE MONEY WAS MEANT FOR HIS COCOA AND GOLD BUSINESS HE WANTEDTO ESTABLISH IN ABIDJAN. MY HUSBAND HANDED ME THE DOCUMENTS COVERING THE LODGMENT AND INSTRUCTED ME AND MY SON TO SEEK FOR A RELIABLE AND TRUST WORTHY BUSINESS PARTNER FOR OUR LIFE TIME INVESTMENT THAT IS WHY I DECIDED TO CONTACT YOU , NOW I HAVE SUCCEEDED IN LOCATING THE BANK HERE IN ABIDJAN AND I HAVE CONCLUDED WITH THE BANK MODALITIES OF TRANSFERRING THE FUND INTO AN ACCOUNT ABROAD . NOW I AM SOLICITING FOR YOUR ASSISTANCE TO HELP ME PROVIDE AN ACCOUNT FACILITY WHERE I CAN TRANSFER THE MONEY INTO SO THAT WE CAN INVEST IT IN ANY LUCRATIVE BUSINESS IN YOUR COUNTRY BECAUSE THIS IS MY ONLY HOPE IN LIFE ,WE HAVE PROMISED TO GRATIFY YOU WITt 15% OF THE TOTAL SUM FOR YOUR KIND ASSISTANCE. I AM WAITING ANXIOUSLY TO HEAR FROM YOU SO THAT WE CAN DISCUSS THE MODALITIES OF THIS TRANSACTION YOU CAN CONTACT ME IMMEDIATELY FOR MORE DISCUSSION . NB: FOR PRIVATE AND CONFIDENTIAL CONTACT ME ON ABOVE E-MAIL. THANKS FOR YOUR KIND ASSISTANCE YOURS SINCERELY MRS.MONICA.ALFRED ______________________________________________________ Boîte aux lettres - Caramail - http://www.caramail.com

1 0

Re: [syslog-ng]source socket keepalive patch suggestion
by Ted_Rule＠flextech.co.uk 12 Sep '02

12 Sep '02

Ah.. perhaps the light begins to clear. I think I must have misinterpreted what the keep-alive option really does. I had thought it avoided re-opening a listener on the same socket on SIGHUP. From your reply, I'm now assme that all it does is ensure that 'ephemeral' connections accept()'ed from a listener are left open across a SIGHUP even if the listener is taken away. Is this nearer the truth? In which case , as you say, my patch is irrelevant to my real desire to avoid a re-open of any given listener ( of potentially any flavour ) across a SIGHUP, and the previous post about repairing the 'broken' glibc/syslog() call across a re-opened Unix DGRAM socket potentially provides an easier fix than a rewrite of syslog-ng. And/or avoiding use of Unix DGRAM sockets at all on glibc platforms until such a fix is in place. Ted *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

3 2

syslog-ng aborting
by BONIKOWSKE, SCOTT 12 Sep '02

12 Sep '02

--- Received from WPS.SBONIKOW (608) 226-2630 09-11-02 148p Hi, I am getting the following error shortly after syslog-ng is starting. io.c: sockaddr2info(): Unsupported address family 0. Aborted I have looked around and have not found anything that seems helpfull. There is nothing in the logs, and there is no core. The environment is SuSE 8.0 (64 bit) syslog-ng 1.5.20 It was a fresh compule, no changes to the source. A copy of the config is below. there has been very little change in the conf, just the locations for the files, and a new source. If there is any other info that I need to give, please let em know. Thanks Scott Bonikowske options { long_hostnames(off); sync(0); }; source src { unix-stream("/dev/log"); internal(); }; source net { udp(10.110.210.4) 514; }; destination authlog { file("/var/log/auth.log-ng"); }; destination syslog { file("/var/log/syslog-ng"); }; destination cron { file("/var/log/cron.log-ng"); }; destination daemon { file("/var/log/daemon.log-ng"); }; destination kern { file("/var/log/kern.log-ng"); }; destination lpr { file("/var/log/lpr.log-ng"); }; destination user { file("/var/log/user.log-ng"); }; destination uucp { file("/var/log/uucp.log-ng"); }; destination ppp { file("/var/log/ppp.log-ng"); }; destination mail { file("/var/log/mail.log-ng"); }; destination mailinfo { file("/var/log/mail.info-ng"); }; destination mailwarn { file("/var/log/mail.warn-ng"); }; destination mailerr { file("/var/log/mail.err-ng"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug-ng"); }; destination messages { file("/var/log/messages-ng"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; #destination loghost { udp("loghost" port(999)); }; destination xconsole { pipe("/dev/xconsole"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_ppp { facility(ppp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination (newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(f_ppp); destination(ppp); }; log { source(src); destination(console_all); }; ---- 09-11-02 148p ---- Sent to ------------------------------------ -> syslog-ng(a)lists.balabit.hu

2 1

source socket keepalive patch suggestion
by Ted_Rule＠flextech.co.uk 12 Sep '02

12 Sep '02

I previously enquired whether it would be possible to allow for a keep-alive option on Unix DGRAM sockets to help avoid the situation on some platforms when daemons such as sendmail have the /dev/log socket 'whipped from under them' during syslog-ng/SIGHUP. It also occurred to me that avoiding closing/re-opening UDP sockets on HUP should help to avoid any loss of messages across HUP on a very busy central syslog server. I assumed - whether this is valid or not I don't know - that the current 1.5.20 source always rebuilds Unix DGRAM sockets on HUP. Likewise for UDP sockets. Having had a look at the YACC source, I think I may have come up with a patch to help with this - it certainly appears to compile and run but it's a bit difficult to test all the possible variations on the theme, and whether it actually fulfils my original requirements. The changes involved in the patch are as follows: Split parsing of Unix DGRAM and STREAM options apart a little more - previously it seems that the Yacc allowed for a max-connections options on a Unix DGRAM socket, even though I don't believe this is actually meaningful(?). The original source also seems to be at variance with the documentation here. Force default keepalive setting on TCP socket. The documentation suggests this is the default, but my reading of the Yacc suggests otherwise. Enable keepalive option on both flavours of DGRAM socket Disable max-connections option on Unix DGRAM socket. Force default keepalive setting on both flavours of DGRAM socket. Could you enlighten me further as to whether this patch actually helps to acheive my original intent. Thanks. diff, gzip of diff , and snippet of cfg-grammar.y before and after attached. Ted ========================================================== $ diff -u cfg-grammar.y.1.5.20.orig cfg-grammar.y.1.5.20.patched --- cfg-grammar.y.1.5.20.orig Wed Sep 11 09:33:53 2002 +++ cfg-grammar.y.1.5.20.patched Wed Sep 11 11:10:32 2002 @@ -120,6 +120,7 @@ %type <ptr> source_afunix_stream_params %type <ptr> source_afinet_udp_params %type <ptr> source_afinet_tcp_params +%type <ptr> source_afsocket_dgram_params %type <ptr> source_afsocket_stream_params %type <ptr> source_afstreams %type <ptr> source_afstreams_params @@ -248,10 +249,10 @@ { last_source_driver = make_afunix_source( &make_unix_address_c($1)->super, - AFSOCKET_DGRAM); + AFSOCKET_DGRAM | AFSOCKET_KEEP_ALIVE); free($1); } - source_afunix_options { $$ = last_source_driver; } + source_afunix_dgram_options { $$ = last_source_driver; } ; source_afunix_stream_params @@ -262,28 +263,41 @@ AFSOCKET_STREAM | AFSOCKET_KEEP_ALIVE); free($1); } - source_afunix_options { $$ = last_source_driver; } + source_afunix_stream_options { $$ = last_source_driver; } ; -/* options are common between dgram & stream */ -source_afunix_options - : source_afunix_option source_afunix_options +source_afunix_stream_options + : source_afunix_stream_option source_afunix_stream_options | ; +source_afunix_dgram_options + : source_afunix_dgram_option source_afunix_dgram_options + | + ; + +source_afunix_dgram_option + : source_afunix_option + | source_afsocket_dgram_params {} + ; + +source_afunix_stream_option + : source_afunix_option + | source_afsocket_stream_params {} + ; + source_afunix_option : KW_OWNER '(' string ')' { afunix_set_owner(last_source_driver, $3); free($3); } | KW_GROUP '(' string ')' { afunix_set_group(last_source_driver, $3); free($3); } | KW_PERM '(' NUMBER ')' { afunix_set_perm(last_source_driver, $3); } - | source_afsocket_stream_params {} - ; + ; source_afinet_udp_params : { last_source_driver = make_afinet_source( &make_inet_address_c("0.0.0.0", "514")->super, - AFSOCKET_DGRAM); + AFSOCKET_DGRAM | AFSOCKET_KEEP_ALIVE); } source_afinet_udp_options { $$ = last_source_driver; } ; @@ -297,6 +311,7 @@ : source_afinet_option | KW_LOCALPORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3 ,"udp"); free($3); } | KW_PORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "udp"); free($3); } + | source_afsocket_dgram_params {} ; source_afinet_option @@ -311,7 +326,7 @@ { last_source_driver = make_afinet_source( &make_inet_address_c("0.0.0.0", "514")->super, - AFSOCKET_STREAM); + AFSOCKET_STREAM | AFSOCKET_KEEP_ALIVE); } source_afinet_tcp_options { $$ = last_source_driver; } ; @@ -331,6 +346,10 @@ | source_afsocket_stream_params {} ; +source_afsocket_dgram_params + : KW_KEEP_ALIVE '(' yesno ')' { afsocket_src_set_keep_alive(last_source_driver, $3); } + ; + source_afsocket_stream_params : KW_KEEP_ALIVE '(' yesno ')' { afsocket_src_set_keep_alive(last_source_driver, $3); } | KW_MAX_CONNECTIONS '(' NUMBER ')' { afsocket_src_set_max_connections(last_source_driver, $3); } $ BEFORE: source_afsocket : KW_UNIX_DGRAM '(' source_afunix_dgram_params ')' { $$ = $3; } | KW_UNIX_STREAM '(' source_afunix_stream_params ')' { $$ = $3; } | KW_UDP '(' source_afinet_udp_params ')' { $$ = $3; } | KW_TCP '(' source_afinet_tcp_params ')' { $$ = $3; } ; source_afunix_dgram_params : string { last_source_driver = make_afunix_source( &make_unix_address_c($1)->super, AFSOCKET_DGRAM); free($1); } source_afunix_options { $$ = last_source_driver; } ; source_afunix_stream_params : string { last_source_driver = make_afunix_source( &make_unix_address_c($1)->super, AFSOCKET_STREAM | AFSOCKET_KEEP_ALIVE); free($1); } source_afunix_options { $$ = last_source_driver; } ; /* options are common between dgram & stream */ source_afunix_options : source_afunix_option source_afunix_options | ; source_afunix_option : KW_OWNER '(' string ')' { afunix_set_owner(last_source_driver, $3); free($3); } | KW_GROUP '(' string ')' { afunix_set_group(last_source_driver, $3); free($3); } | KW_PERM '(' NUMBER ')' { afunix_set_perm(last_source_driver, $3); } | source_afsocket_stream_params {} ; source_afinet_udp_params : { last_source_driver = make_afinet_source( &make_inet_address_c("0.0.0.0", "514")->super, AFSOCKET_DGRAM); } source_afinet_udp_options { $$ = last_source_driver; } ; source_afinet_udp_options : source_afinet_udp_option source_afinet_udp_options | ; source_afinet_udp_option : source_afinet_option | KW_LOCALPORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3 ,"udp"); free($3); } : | KW_PORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "udp"); free($3); } ; source_afinet_option : KW_LOCALIP '(' string ')' { afinet_src_set_localip(last_source_driver, $3); free($3); } | KW_LOCALPORT '(' NUMBER ')' { afinet_src_set_localport(last_source_driver, $3, NULL, NULL); } | KW_PORT '(' NUMBER ')' { afinet_src_set_localport(last_source_driver, $3, NULL, NULL); } | KW_IP '(' string ')' { afinet_src_set_localip(last_source_driver, $3); free($3); } ; source_afinet_tcp_params : { last_source_driver = make_afinet_source( &make_inet_address_c("0.0.0.0", "514")->super, AFSOCKET_STREAM); } source_afinet_tcp_options { $$ = last_source_driver; } ; source_afinet_tcp_options : source_afinet_tcp_option source_afinet_tcp_options | ; source_afinet_tcp_option : source_afinet_option | KW_LOCALPORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "tcp"); free($3); } | KW_PORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "tcp"); free($3); } | KW_AUTH '(' tripleoption ')' { afinet_src_set_auth(last_source_driver, $3); } | KW_MAC '(' tripleoption ')' { afinet_src_set_mac(last_source_driver, $3); } | KW_ENCRYPT '(' tripleoption ')' { afinet_src_set_encrypt(last_source_driver, $3); } | source_afsocket_stream_params {} ; source_afsocket_stream_params : KW_KEEP_ALIVE '(' yesno ')' { afsocket_src_set_keep_alive(last_source_driver, $3); } | KW_MAX_CONNECTIONS '(' NUMBER ')' { afsocket_src_set_max_connections(last_source_driver, $3); } ; ================================================================================================ AFTER: source_afsocket : KW_UNIX_DGRAM '(' source_afunix_dgram_params ')' { $$ = $3; } | KW_UNIX_STREAM '(' source_afunix_stream_params ')' { $$ = $3; } | KW_UDP '(' source_afinet_udp_params ')' { $$ = $3; } | KW_TCP '(' source_afinet_tcp_params ')' { $$ = $3; } ; source_afunix_dgram_params : string { last_source_driver = make_afunix_source( &make_unix_address_c($1)->super, AFSOCKET_DGRAM | AFSOCKET_KEEP_ALIVE); free($1); } source_afunix_dgram_options { $$ = last_source_driver; } ; source_afunix_stream_params : string { last_source_driver = make_afunix_source( &make_unix_address_c($1)->super, AFSOCKET_STREAM | AFSOCKET_KEEP_ALIVE); free($1); } source_afunix_stream_options { $$ = last_source_driver; } ; source_afunix_stream_options : source_afunix_stream_option source_afunix_stream_options | ; source_afunix_dgram_options : source_afunix_dgram_option source_afunix_dgram_options | ; source_afunix_dgram_option : source_afunix_option | source_afsocket_dgram_params {} ; source_afunix_stream_option : source_afunix_option | source_afsocket_stream_params {} ; source_afunix_option : KW_OWNER '(' string ')' { afunix_set_owner(last_source_driver, $3); free($3); } | KW_GROUP '(' string ')' { afunix_set_group(last_source_driver, $3); free($3); } | KW_PERM '(' NUMBER ')' { afunix_set_perm(last_source_driver, $3); } ; source_afinet_udp_params : { last_source_driver = make_afinet_source( &make_inet_address_c("0.0.0.0", "514")->super, AFSOCKET_DGRAM | AFSOCKET_KEEP_ALIVE); } source_afinet_udp_options { $$ = last_source_driver; } ; source_afinet_udp_options : source_afinet_udp_option source_afinet_udp_options | ; source_afinet_udp_option : source_afinet_option | KW_LOCALPORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3 ,"udp"); free($3); } | KW_PORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "udp"); free($3); } | source_afsocket_dgram_params {} ; source_afinet_option : KW_LOCALIP '(' string ')' { afinet_src_set_localip(last_source_driver, $3); free($3); } | KW_LOCALPORT '(' NUMBER ')' { afinet_src_set_localport(last_source_driver, $3, NULL, NULL); } | KW_PORT '(' NUMBER ')' { afinet_src_set_localport(last_source_driver, $3, NULL, NULL); } | KW_IP '(' string ')' { afinet_src_set_localip(last_source_driver, $3); free($3); } ; source_afinet_tcp_params : { last_source_driver = make_afinet_source( &make_inet_address_c("0.0.0.0", "514")->super, AFSOCKET_STREAM | AFSOCKET_KEEP_ALIVE); } source_afinet_tcp_options { $$ = last_source_driver; } ; source_afinet_tcp_options : source_afinet_tcp_option source_afinet_tcp_options | ; source_afinet_tcp_option : source_afinet_option | KW_LOCALPORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "tcp"); free($3); } | KW_PORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "tcp"); free($3); } | KW_AUTH '(' tripleoption ')' { afinet_src_set_auth(last_source_driver, $3); } | KW_MAC '(' tripleoption ')' { afinet_src_set_mac(last_source_driver, $3); } | KW_ENCRYPT '(' tripleoption ')' { afinet_src_set_encrypt(last_source_driver, $3); } | source_afsocket_stream_params {} ; source_afsocket_dgram_params : KW_KEEP_ALIVE '(' yesno ')' { afsocket_src_set_keep_alive(last_source_driver, $3); } ; source_afsocket_stream_params : KW_KEEP_ALIVE '(' yesno ')' { afsocket_src_set_keep_alive(last_source_driver, $3); } | KW_MAX_CONNECTIONS '(' NUMBER ')' { afsocket_src_set_max_connections(last_source_driver, $3); } ; (See attached file: cfg-grammar.y.1.5.20.diff.gz) *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

3 2

Re: [syslog-ng]source socket keepalive patch suggestion
by Ted_Rule＠flextech.co.uk 12 Sep '02

12 Sep '02

This problem exist for me on all glibc incarnations as far as I'm aware. It also exists in Perl5 / Syslog:pm - but I wrote a local patch for myself for that. Admittedly, I probably could write a patch to glibc, but then I'd have to get it into the real glibc source so that it doesn't get overwritten by every new glibc RPM release. I just thought it would be easier all round to provide for as near 'non-stop' functionality across syslog-ng/SIGHUP as possible. Ted "Ed Ravin" <eravin(a)panix.com> on 11/09/2002 18:34:42 Please respond to syslog-ng(a)lists.balabit.hu To: syslog-ng(a)lists.balabit.hu cc: (bcc: Ted Rule/160GPS/Flextech/UK) Subject: Re: [syslog-ng]source socket keepalive patch suggestion Ted_Rule(a)flextech.co.uk writes: > > I previously enquired whether it would be possible to allow for a keep-alive > option > on Unix DGRAM sockets to help avoid the situation on some platforms when daemons > such as sendmail have the /dev/log socket 'whipped from under them' during > syslog-ng/SIGHUP. Why not fix the libc code on those platforms so it does basic sanity checking on the socket, and re-opens the socket when it discovers that its cached filehandle for /dev/log is invalid? I encountered this on NetBSD and it was an easy library fix (it's patched in all current releases (1.5.3 and 1.6 candidates) - what OS are you using? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

1 0

syslog memory problems
by Rolf Böhme 11 Sep '02

11 Sep '02

Hello, I have installed syslogd-ng version 1.4.9a on SuSE-Linux 7.1. Eight other Servers send their messages to the syslogd-ng-Server. After a few hours or about two days the Linux-System kills the syslogd-ng, because the allocation of memory from syslogd-ng failed. Any Hints or Tips and so on to correct the error? Regards Rolf Böhme staatl. gepr. Informatikassistent CNA, Systemadministrator mailto:rolf.boehme@gno.de

3 2

file buffer flushing
by Joerg Sommer 09 Sep '02

09 Sep '02

Hi, can syslog-ng delay the flush of a file buffer? I have noflushd running and if syslog-ng flushes his buffers, my disc spins up. But I will see new messages in the log files. Is it possible, that syslog writes the messages in the file, but don't call flush() on this file. Joerg.

3 3

Re: [syslog-ng]Remote Logging - config checker?
by Ted_Rule＠flextech.co.uk 09 Sep '02

09 Sep '02

As a sideline thought to this Gorm's minor config typo...... How easy would it be possible to provide an additional command line option to syslog-ng which merely perform a config file syntax and dir/file-permissions check? i.e much the same flavour of functionality as provided by bind9's named-checkconf on behalf of named. Apart from pure syntax checks on the configuration file, it would be nice/highly-desirable for the checker to confirm valid permissions on the various source/destinations ( where feasible ) , especially for the conditions wherein syslog-ng is either chrooted or chowned. Above all, the checker should attempt to ensure that no mistake exists that would cause syslog-ng to exit post SIGHUP or restart. Ted *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

1 0

Remote Logging
by Gorm Jensen 09 Sep '02

09 Sep '02

In the past, my log host received logs from one remote host, so syslog-ng.conf had separate destinations spelled out for the log host and the remote host. Now I am adding more remote hosts to the LAN, and I want to record the same information from the new hosts. I am trying to add the following lines to a syslog-ng.conf file that has worked in the past. I commented out the cron entry for the existing remote host. destination remote-logs.cron { file("/var/log/$HOST/cron.log"); }; log { source(s_tcp); filter(f_cron); destination(remote-logs.cron); } The first line works, but the second line causes a syntax error. What am I doing wrong?

2 2

Config Macro
by Gorm Jensen 08 Sep '02

08 Sep '02

For remote logging, can the $HOST macro refer to a directory rather than a file?

2 1

RE: [syslog-ng]test message
by Paul Mansmann 06 Sep '02

06 Sep '02

Bazsi, I haven't gotten any messages from the group since yesterday and was wondering if I was mistakenly removed, or if the group is down. Also, I've gotten three messages this morning from 'raodb' that appear to be addressed directly to me. ??? I'm not real sure what's going on here. Do you have any ideas? Thanks, Paul -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, September 05, 2002 10:54 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]test message I've unsubscribed the person repeating messages. Let's hope I did it right this time. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

test message
by Balazs Scheidler 05 Sep '02

05 Sep '02

I've unsubscribed the person repeating messages. Let's hope I did it right this time. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng](no subject)
by Keven Belanger 05 Sep '02

05 Sep '02

Should we unsubscribe to the list or the problem will be solve soon ? Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717 -----Original Message----- From: bazsi(a)balabit.hu [mailto:bazsi@balabit.hu] Sent: Thursday, September 05, 2002 9:33 AM To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com; syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 08:33:00 -0500 Subject: Re: [syslog-ng](no subject) From: bazsi(a)balabit.hu To: Brian.Ipsen(a)andebakken.dk Cc: raodb(a)21cn.com, syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 15:33:31 +0200 Subject: Re: [syslog-ng](no subject) On Thu, Sep 05, 2002 at 03:28:54PM +0200, Brian Ipsen wrote: > Hi! > Is it your mailserver, that is screwed up - or are these repeated messages > caused by the syslog-ng mailinglist server ?? I've put this address to the spamdb, and removed all pending messages from the mailqueue. It should solve the problem. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Cisco PIX TCP Syslogging via syslog-ng
by Ted_Rule＠flextech.co.uk 05 Sep '02

05 Sep '02

More very sad news I'm afraid. I've been able to glue together a temporary copy of syslog-ng on my central syslog server listening to TCP/1468 for PIX syslogging. It is already apparent that things don't work properly - most of this appears to be entirely Cisco's fault. My original problem was that I'd reported UDP packet truncation for syslog messages > 255 characters. Cisco swore blind that my moving to TCP would fix this. tcpdump's of my test rig strongly suggests Cisco simply lied. Even the TCP stream seems to impose a 255 character limit prior to transmission. Worse still - as intimated from previous missives - the TCP stream doesn't contain EOM characters of any flavour between messages such that multiple syslog messages may appear in a single TCP packet. Moreover, sadly, syslog-ng appears to be unable to pick apart multiple messages correctly on some occasions, and hence one sees things like this: Sep 5 15:58:58 fttvgpsvpn1 %PIX-7-702301: lifetime expiring, (sa) sa_dest= 195. 188.171.5, sa_prot= 50, sa_spi= 0x6a3b8b02(1782287106), sa_trans= esp-3des esp-m d5-hmac , sa_conn_id= 8, (identity) local= 195.188.171.5, remote= 217.34.209.200 , local_proxy= 194.34.198.40/255.255.2<190>%PIX-6-602302: deleting SA, (sa) sa_d est= 195.188.171.5, sa_prot= 50, sa_spi= 0x6a3b8b02(1782287106), sa_trans= esp-3 des esp-md5-hmac , sa_conn_id= 8 where the 2 messages concatenated are actually contained in 2 separate TCP packets, as per the tcpdump below. The general logic I can deduce from the debugs so far is that the log daemon on the PIX assembles a message, truncates to 255 characters, stuffs it out the log stream ( be it UDP or TCP ). If the stream is TCP, I suspect Nagle Algorithm or similar determines when sufficient data within one or more messages have been accumulate sufficient to actually send a TCP packet. As a result, whilst any given log message is limited to 255 bytes, but any given TCP packet need not be. All in all, its a mess. I'm better off leaving the syslogging routing via UDP to ensure correct EOM determination on the syslog server. Needless to say, I'll raise a log with our Cisco resellers to try and get Cisco to fix their code. The minimum 2 requirements are: a) Raise log message size limit to 512 bytes for either UDP or TCP streams b) Terminate TCP messages with NUL or NL to allow sane logservers to unsplit the mess. I suspect there is very little Balazs can do to improve the decode of the PIX log stream without Cisco fixing their broken code. Ted 15:58:58.013327 192.168.82.15.1024 > 172.17.12.19.1468: P 878:1133(255) ack 1 win 4096 4500 0127 9d42 0000 fc06 55b2 c0a8 520f E..'.B....U...R. ac11 0c13 0400 05bc 02ff 1fde 3b30 7c08 ............;0|. 5018 1000 4360 0000 3c31 3931 3e25 5049 P...C`..<191>%PI 582d 372d 3730 3233 3031 3a20 6c69 6665 X-7-702301: life 7469 6d65 2065 7870 6972 696e 672c 2028 time expiring, ( 7361 2920 7361 5f64 6573 743d 2031 3935 sa) sa_dest= 195 2e31 3838 2e31 3731 2e35 2c20 7361 5f70 .188.171.5, sa_p 726f 743d 2035 302c 2073 615f 7370 693d rot= 50, sa_spi= 2030 7836 6133 6238 6230 3228 3137 3832 0x6a3b8b02(1782 3238 3731 3036 292c 2073 615f 7472 616e 287106), sa_tran 733d 2065 7370 2d33 6465 7320 6573 702d s= esp-3des esp- 6d64 352d 686d 6163 202c 2073 615f 636f md5-hmac , sa_co 6e6e 5f69 643d 2038 2c20 2869 6465 6e74 nn_id= 8, (ident 6974 7929 206c 6f63 616c 3d20 3139 352e ity) local= 195. 3138 382e 3137 312e 352c 2072 656d 6f74 188.171.5, remot 653d 2032 3137 2e33 342e 3230 392e 3230 e= 217.34.209.20 302c 206c 6f63 616c 5f70 726f 7879 3d20 0, local_proxy= 3139 342e 3334 2e31 3938 2e34 302f 3235 194.34.198.40/25 352e 3235 352e 32 5.255.2. 15:58:58.026581 172.17.12.19.1468 > 192.168.82.15.1024: . ack 1133 win 32120 (DF ) 4500 0028 6190 4000 4006 0e64 ac11 0c13 E..(a.@.@..d.... c0a8 520f 05bc 0400 3b30 7c08 02ff 20dd ..R.....;0|... . 5010 7d78 82af 0000 P.}x.... 15:58:58.027406 192.168.82.15.1024 > 172.17.12.19.1468: P 1133:1445(312) ack 1 w in 4096 4500 0160 9d43 0000 fc06 5578 c0a8 520f E..`.C....Ux..R. ac11 0c13 0400 05bc 02ff 20dd 3b30 7c08 .......... .;0|. 5018 1000 ca1d 0000 3c31 3930 3e25 5049 P.......<190>%PI 582d 362d 3630 3233 3032 3a20 6465 6c65 X-6-602302: dele 7469 6e67 2053 412c 2028 7361 2920 7361 ting SA, (sa) sa 5f64 6573 743d 2031 3935 2e31 3838 2e31 _dest= 195.188.1 3731 2e35 2c20 7361 5f70 726f 743d 2035 71.5, sa_prot= 5 302c 2073 615f 7370 693d 2030 7836 6133 0, sa_spi= 0x6a3 6238 6230 3228 3137 3832 3238 3731 3036 b8b02(1782287106 292c 2073 615f 7472 616e 733d 2065 7370 ), sa_trans= esp 2d33 6465 7320 6573 702d 6d64 352d 686d -3des esp-md5-hm 6163 202c 2073 615f 636f 6e6e 5f69 643d ac , sa_conn_id= 2038 0a0a 3c31 3930 3e25 5049 582d 362d 8..<190>%PIX-6- 3630 3233 3032 3a20 6465 6c65 7469 6e67 602302: deleting 2053 412c 2028 7361 2920 7361 5f64 6573 SA, (sa) sa_des 743d 2032 3137 2e33 342e 3230 392e 3230 t= 217.34.209.20 302c 2073 615f 7072 6f74 3d20 3530 2c20 0, sa_prot= 50, 7361 5f73 7069 3d20 3078 3137 6563 3539 sa_spi= 0x17ec59 3335 2834 3031 3336 3533 3031 292c 2073 35(401365301), s 615f 7472 616e 733d 2065 7370 2d33 6465 a_trans= esp-3de 7320 6573 702d 6d64 352d 686d 6163 202c s esp-md5-hmac , 2073 615f 636f 6e6e 5f69 643d 2037 0a0a sa_conn_id= 7.. *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

1 0

Cisco PIX TCP Syslogging via syslog-ng
by Ted_Rule＠flextech.co.uk 05 Sep '02

05 Sep '02

From: Ted_Rule(a)flextech.co.uk To: syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 16:28:53 +0100 Subject: [syslog-ng]Cisco PIX TCP Syslogging via syslog-ng More very sad news I'm afraid. I've been able to glue together a temporary copy of syslog-ng on my central syslog server listening to TCP/1468 for PIX syslogging. It is already apparent that things don't work properly - most of this appears to be entirely Cisco's fault. My original problem was that I'd reported UDP packet truncation for syslog messages > 255 characters. Cisco swore blind that my moving to TCP would fix this. tcpdump's of my test rig strongly suggests Cisco simply lied. Even the TCP stream seems to impose a 255 character limit prior to transmission. Worse still - as intimated from previous missives - the TCP stream doesn't contain EOM characters of any flavour between messages such that multiple syslog messages may appear in a single TCP packet. Moreover, sadly, syslog-ng appears to be unable to pick apart multiple messages correctly on some occasions, and hence one sees things like this: Sep 5 15:58:58 fttvgpsvpn1 %PIX-7-702301: lifetime expiring, (sa) sa_dest= 195. 188.171.5, sa_prot= 50, sa_spi= 0x6a3b8b02(1782287106), sa_trans= esp-3des esp-m d5-hmac , sa_conn_id= 8, (identity) local= 195.188.171.5, remote= 217.34.209.200 , local_proxy= 194.34.198.40/255.255.2<190>%PIX-6-602302: deleting SA, (sa) sa_d est= 195.188.171.5, sa_prot= 50, sa_spi= 0x6a3b8b02(1782287106), sa_trans= esp-3 des esp-md5-hmac , sa_conn_id= 8 where the 2 messages concatenated are actually contained in 2 separate TCP packets, as per the tcpdump below. The general logic I can deduce from the debugs so far is that the log daemon on the PIX assembles a message, truncates to 255 characters, stuffs it out the log stream ( be it UDP or TCP ). If the stream is TCP, I suspect Nagle Algorithm or similar determines when sufficient data within one or more messages have been accumulate sufficient to actually send a TCP packet. As a result, whilst any given log message is limited to 255 bytes, but any given TCP packet need not be. All in all, its a mess. I'm better off leaving the syslogging routing via UDP to ensure correct EOM determination on the syslog server. Needless to say, I'll raise a log with our Cisco resellers to try and get Cisco to fix their code. The minimum 2 requirements are: a) Raise log message size limit to 512 bytes for either UDP or TCP streams b) Terminate TCP messages with NUL or NL to allow sane logservers to unsplit the mess. I suspect there is very little Balazs can do to improve the decode of the PIX log stream without Cisco fixing their broken code. Ted 15:58:58.013327 192.168.82.15.1024 > 172.17.12.19.1468: P 878:1133(255) ack 1 win 4096 4500 0127 9d42 0000 fc06 55b2 c0a8 520f E..'.B....U...R. ac11 0c13 0400 05bc 02ff 1fde 3b30 7c08 ............;0|. 5018 1000 4360 0000 3c31 3931 3e25 5049 P...C`..<191>%PI 582d 372d 3730 3233 3031 3a20 6c69 6665 X-7-702301: life 7469 6d65 2065 7870 6972 696e 672c 2028 time expiring, ( 7361 2920 7361 5f64 6573 743d 2031 3935 sa) sa_dest= 195 2e31 3838 2e31 3731 2e35 2c20 7361 5f70 .188.171.5, sa_p 726f 743d 2035 302c 2073 615f 7370 693d rot= 50, sa_spi= 2030 7836 6133 6238 6230 3228 3137 3832 0x6a3b8b02(1782 3238 3731 3036 292c 2073 615f 7472 616e 287106), sa_tran 733d 2065 7370 2d33 6465 7320 6573 702d s= esp-3des esp- 6d64 352d 686d 6163 202c 2073 615f 636f md5-hmac , sa_co 6e6e 5f69 643d 2038 2c20 2869 6465 6e74 nn_id= 8, (ident 6974 7929 206c 6f63 616c 3d20 3139 352e ity) local= 195. 3138 382e 3137 312e 352c 2072 656d 6f74 188.171.5, remot 653d 2032 3137 2e33 342e 3230 392e 3230 e= 217.34.209.20 302c 206c 6f63 616c 5f70 726f 7879 3d20 0, local_proxy= 3139 342e 3334 2e31 3938 2e34 302f 3235 194.34.198.40/25 352e 3235 352e 32 5.255.2. 15:58:58.026581 172.17.12.19.1468 > 192.168.82.15.1024: . ack 1133 win 32120 (DF 4500 0028 6190 4000 4006 0e64 ac11 0c13 E..(a.@.@..d.... c0a8 520f 05bc 0400 3b30 7c08 02ff 20dd ..R.....;0|... . 5010 7d78 82af 0000 P.}x.... 15:58:58.027406 192.168.82.15.1024 > 172.17.12.19.1468: P 1133:1445(312) ack 1 w in 4096 4500 0160 9d43 0000 fc06 5578 c0a8 520f E..`.C....Ux..R. ac11 0c13 0400 05bc 02ff 20dd 3b30 7c08 .......... .;0|. 5018 1000 ca1d 0000 3c31 3930 3e25 5049 P.......<190>%PI 582d 362d 3630 3233 3032 3a20 6465 6c65 X-6-602302: dele 7469 6e67 2053 412c 2028 7361 2920 7361 ting SA, (sa) sa 5f64 6573 743d 2031 3935 2e31 3838 2e31 _dest= 195.188.1 3731 2e35 2c20 7361 5f70 726f 743d 2035 71.5, sa_prot= 5 302c 2073 615f 7370 693d 2030 7836 6133 0, sa_spi= 0x6a3 6238 6230 3228 3137 3832 3238 3731 3036 b8b02(1782287106 292c 2073 615f 7472 616e 733d 2065 7370 ), sa_trans= esp 2d33 6465 7320 6573 702d 6d64 352d 686d -3des esp-md5-hm 6163 202c 2073 615f 636f 6e6e 5f69 643d ac , sa_conn_id= 2038 0a0a 3c31 3930 3e25 5049 582d 362d 8..<190>%PIX-6- 3630 3233 3032 3a20 6465 6c65 7469 6e67 602302: deleting 2053 412c 2028 7361 2920 7361 5f64 6573 SA, (sa) sa_des 743d 2032 3137 2e33 342e 3230 392e 3230 t= 217.34.209.20 302c 2073 615f 7072 6f74 3d20 3530 2c20 0, sa_prot= 50, 7361 5f73 7069 3d20 3078 3137 6563 3539 sa_spi= 0x17ec59 3335 2834 3031 3336 3533 3031 292c 2073 35(401365301), s 615f 7472 616e 733d 2065 7370 2d33 6465 a_trans= esp-3de 7320 6573 702d 6d64 352d 686d 6163 202c s esp-md5-hmac , 2073 615f 636f 6e6e 5f69 643d 2037 0a0a sa_conn_id= 7.. *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. *************************************************************************************************** _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]errors
by Mateer, Mike T. 05 Sep '02

05 Sep '02

hey I have at least 100+ messages from you...with the same information...what is going on... -----Original Message----- From: bhartin(a)straus-frank.com [mailto:bhartin@straus-frank.com] Sent: Thursday, September 05, 2002 9:41 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]errors From: bhartin(a)straus-frank.com To: syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 09:41:00 -0500 Subject: Re: [syslog-ng]errors From: bhartin(a)straus-frank.com To: syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 09:41:00 -0500 Subject: Re: [syslog-ng]errors From: bhartin(a)straus-frank.com To: syslog-ng(a)lists.balabit.hu Date: Thu, 5 Sep 2002 09:41:30 -0500 Subject: Re: [syslog-ng]errors On 5 Sep 2002, seth vidal wrote: > Maybe someone has subscribed the list to itself and its looping somehow? My guess is someone has two email addresses forwarded to each other, then mailed the list from one address while CCing the other. Instant loop. Just need to blacklist the other address now. -- Bradley Hartin - bhartin(a)straus-frank.com Communications and Network Administrator Straus-Frank Company _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0