- syslog-ng - lists.balabit.hu

SIGHUP res_init feature request
by Ted_Rule＠flextech.co.uk 04 Sep '02

04 Sep '02

Following on from some experience with DNS misbehaviour on an old syslogd instance, I was forced to add the ability to force a re-read of resolv.conf upon SIGHUP. This allowed me to change the DNS server that a given central syslog server interrogated without requiring a complete restart of the daemon - which would otherwise have potentially lost messages. Without this tweak, a given process effectively "caches forever" the contents of resolv.conf during the first call to gethostbyaddr(). In particular, if I needed to take out a given DNS server for maintenance/upgrade, I could swing DNS service elsewhere and avoid disrupting the natural behaviour of the syslog daemon. As far as I can tell syslog-ng doesn't have this feature. As far as I can tell, adding the feature merely requires 2 extra lines of code in main.c as per below. If it meets general approval, perhaps the feature could be added in the next patch release. Ted Within: /usr/src/syslog-ng/syslog-ng-1.5.20/src/main.c add the following: ........ #include <resolv.h> <<<extra line ........ if (sighuprecvd) { sighuprecvd = 0; if (!backend->super.reloading) { notice("SIGHUP received, restarting syslog-ng\n"); res_init(); <<< extra line if (!debug_flag) { set_error_stream(2, 0); set_internal_cfg(NULL); } backend->super.reloading = 1; reload_config = 1; r.backend = backend; r.state = -1; /* wait a second to flush buffers */ io_callout(&backend->super, 1, &r.super); } } ........ *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

2 1

Cutting Off.
by Jim Gifford 03 Sep '02

03 Sep '02

Version 1.5.20. The cut-off problem is back. Here is a sample. Here is a few samples. Sep 3 12:59:46 server SRC=63.171.79.154 DST=64.30.195.78 LEN=576 TOS=0x00 PREC=0x00 TTL=114 ID=44751 PROTO=TCP SPT=80 DPT=4959 SEQ=168963 ACK=2319997928 WINDOW=17373 RES=0x00 ACK URGP=0 ip_conntrack_tcp: INVALID: Out of window data; SEQ is over the upper bound (over the window of the receiver) It should be. Sep 3 12:59:46 server IPT: Reject_TCP_Packet: IN=eth0 OUT= MAC=00:50:ba:5c:16:53:00:10:67:00:51:f7:08:00 SRC=63.171.79.154 DST=64.30.195.78 LEN=576 TOS=0x00 PREC=0x00 TTL=114 ID=44750 PROTO=TCP SPT=80 DPT=4959 WINDOW=17373 RES=0x00 ACK URGP=0 ip_conntrack_tcp: INVALID: Out of window data; SEQ is over the upper bound (over the window of the receiver)

1 0

replacing plpgsql timestamp fn calls in 7.2
by colm ennis 02 Sep '02

02 Sep '02

hi, a plpgsql trigger i used in 7.1 made the following use of the timestamp function: insert into syslog_table values (timestamp(new.sdate, new.stime), hostid, ciscomsgid, new.smsg); ive had to upgrade to 7.2 and i read in the release notes that this function is gone in 7.2: The timestamp() function is no longer available. Use timestamp 'string' instead, or CAST. how do i get this insert to work? i have no idea of the syntax required. thanks for your help, colm ennis

1 0

Central Logging
by Lightfoot.Michael 02 Sep '02

02 Sep '02

I am setting up central logging for all my DMZ systems which are all Sun boxes running Solaris 2.6 or Solaris 8. What I want to achieve is to logg stuff locally as standard syslog did previously and in addition forward all syslog data to a central host to be stored identically in a subdirectory /var/log/$HOST/ - so I'll have files such as /var/log/foo/messages, /var/log/foo/syslog, /var/log/foo/authlog, etc. Has anyone done this in a way that doesn't demand a humungous config file on the central host with near identical settings for each remote host? Michael Lightfoot Unix Consultant ISG Host Systems Comcare +61 2 62750680 NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries.

1 0

Incomplete library checking when building 1.4.15 on Sol7/SPARC
by Adam Steffes 30 Aug '02

30 Aug '02

While trying to build syslog-ng v1.4.15 on a rather plain Solaris 7/SPARC machine, I found that the configure script doesn't look everywhere it should to find yywrap. My system had it in /usr/lib/libl.a while the configure script seemed to look only in /usr/lib/libfl.a. I basically hardcoded the configure script to look at libl.a in a hurried attempt to get it to compile. Is this something anyone has looked at before? I admit I am not a developer by any means, and certainly do not want to insult anyone. It seems a small bit of code could be added to the 'case' statement in the configure script to perform a more extensive search for yywrap. Here is how I found the location of yywrap on my machine: $ for lib in /usr/lib/*.a ; do echo $lib ; nm $lib | grep yywrap ; done <other libs snipped> /usr/lib/libintl.a /usr/lib/libkrb.a /usr/lib/libl.a /usr/lib/libl.a[yywrap.o]: [5] | 0| 8|FUNC |GLOB |0 |2 |yywrap [1] | 0| 0|FILE |LOCL |0 |ABS |yywrap.c /usr/lib/libldfeature.a /usr/lib/libm.a /usr/lib/libmail.a /usr/lib/libmalloc.a <the rest snipped> I hope this helps. -Adam

1 0

Priming the database.
by Scott A. McIntyre 30 Aug '02

30 Aug '02

Hi, I'm pondering moving towards mysql logging for syslog-ng, but was wondering if anyone has already got a tool/script laying around to take current logs and import into the database accurately and correctly. Thanks for any pointers, Scott

1 0

syslog over TCP
by BONIKOWSKE, SCOTT 28 Aug '02

28 Aug '02

--- Received from WPS.SBONIKOW (608) 226-2630 08-28-02 1021a Hello, I am new to syslog-ng, and I had a couple questions that I have not seen answered before in the archives (from what I saw), and I was wondering if anyone out there could help. I hope this is the right area for these questions. First, Does TCP increase the load on the CPU alot over UDP? the situation is, we are looking at using syslog-ng on a midsized company (overall about 6,000+ people). we would like to monitor all syslog activity from NT,2000, XP, HPUX, AIX, Cisco routers/switches/PIXs, linux. The windows machiens are mostly file/application servers, the linux boxes are file/web/application servers, the HPUX and AIX boxes are application servers also. There is a lot of logging that will need to be watched because of security reasons (including file access, logins, etc.), so we are expecting a lot of traffic. The end goal will be to have all of the logs filtered by machine (in some cases even more granular than that like cisco errors going into the main log, and a seperate error log for that machine, and an error log for all networking devices), and maybe even searchable if I have enough time. I am only going into high detail above becase I would like to know opinions about using TCP vs UDP for load on the CPU, and to see if anyone else has maybe done something like this themselves for a company close to the same size. Any help and comments would be welcome. Thanks Scott Bonikowske Open Systems Analyst WPS ---- 08-28-02 1021a ---- Sent to ------------------------------------ -> syslog-ng(a)lists.balabit.hu

1 0

syslog-ng documentation and some minor niggles
by Ted_Rule＠flextech.co.uk 28 Aug '02

28 Aug '02

Many thanks to Stephen Frost and Balazs for the useful information and suggestions regarding PIX syslogging. Having had a slightly deeper read of the latest src tree, I'd like to just make a few suggestions and comments. Several of the options available have Default Settings in their relevant subsection of the HTML tree within: /usr/src/syslog-ng/syslog-ng-1.5.19/doc/sgml/syslog-ng.html However, several options don't have defaults listed therein. Perhaps the next round of documentation updates could double check that all defaults are fully listed in the html pages. The Main HTML Doc Pages at http://www.balabit.hu/static/syslog-ng/reference/book1.html contain no reference to recent dns_cache options - even though this option appears to have been available for about 18 months. As I think several others have mentioned on the list, it would seem reasonable for a more up to date copy of the html pages to be glued up onto the website. The syslog-ng man pages explicitly state that destinations are closed and re-opened on SIGHUP, as per dear-old syslogd's behaviour. There have been references on the mailing list and the FAQs to the corresponding close / re-open of sources, but no explicit statement in the docs. Could I request that an explicit statement of source file descriptor open/close behaviour on SIGHUP be added to the docs/FAQ, please. Others on the list have noted that closing /dev/log on HUP causes certain programs grief - notably sendmail which requires a further HUP to itself to properly heal the broken syslog file descriptor. If syslog-ng does indeed close descriptors on HUP, can we please have an option to explicitly keep certain descriptors open on HUP. ( The docs suggest this may already be possible for TCP sockets, and Unix SOCK_STREAM sockets, but not Unix SOCK_DGRAM sockets ). See ensuing paragraphs for why I'd like the option to be available on Unix SOCK_DGRAM. In all the syslog-ng docs, Linux platforms are documented as having a default log listener socket of /dev/log SOCK_STREAM. However, the most recent RedHat sysklogd RPMs open /dev/log in SOCK_DGRAM mode. I believe this was done as part of a security patch to avoid a potential DoS attack against the stream socket. To the best of my recollection, this behaviour changed about a year ago. This seems to bring RedHat - at least - in line with other BSD variants. glibc openlog() call on RedHat opens SOCK_DGRAM first, falling back to SOCK_STREAM if that fails. Hence RedHat's glibc still supports either socket type, and hence syslog-ng's documented Linux defaults still work. Likewise, Perl's Syslog.pm module calls SOCK_DGRAM first falling back to SOCK_STREAM. Sometime during the change from kernel 2.0 to 2.2 I believe, the Unix DGRAM socket type behaviour was adjusted to blocking ( this assumption purely based on the perceived behaviour of sysklogd ). Thus it should be impossible to drop a message across a Unix DGRAM socket , as compared with the ease of such a message being dropped across an UDP DGRAM socket when the system is really busy. Hence the change from SOCK_STREAM to SOCK_DGRAM within sysklogd should not make the system more prone to dropping locally logged messages, as might have been the case with earlier kernels? Given all of the above, is it reasonable to change the preferred documented socket type from STREAM to DGRAM on /dev/log for syslog-ng on Linux? "logger-ng" - I believe others may also have asked for this - does such a thing exist? to allow one to create test messages and the like over TCP etc etc etc. Sys::Syslog-NG.pm ?? does such a thing exist to support Perl Syslogging over TCP and suchlike? Ted Rule, Flextech Television *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

1 0

Please help fast...
by Keven Belanger 28 Aug '02

28 Aug '02

What is incorrect in this line ??? log { source(s_udp); destination(d_std); flags(fallback); }; Thanx... Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

2 1

2 more question...please help
by Keven Belanger 27 Aug '02

27 Aug '02

Okay! We have 2 problems; 1- The hostname of the syslog receiver is SECU-Rcv1 and SECU-Rcv2 So with a destinations like destination: d_std { file("/export/disk1/log/$HOST/$YEAR/$MONTH/messages.log"); }; We receive the log in /export/disk1/log/SECU-Rcv2 on the local host why not the ip like other host ?? 2- We have 2 syslog collector and a big config file with each host (customer) defined line by line and a rule with unknown, the problem is that each host log correctly to the respective directory but they also log to my unknown directory, I want to be able to say, if no filter match, log to unknown... Thanx a lot! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

1 0

some questions
by Joerg Sommer 27 Aug '02

27 Aug '02

Hi, * What's the difference between long_hostnames() and use_fqdn()? * How get I names instead of ips in the logs? With use_dns()? How dangerouse is use of use_dns()? * Can I write a hostname instead of a ip in tcp()? * I miss the default values of the options in the docu. What's default for use_dns(), stats(),...? * When will encryption and authentication come? Joerg.

3 4

Details
by PRINCE MARK ADE 24 Aug '02

24 Aug '02

FROM THE DESK OF: PRINCE MARK ADE ATTN: PRESIDENT / M. D/ C.E .O SIR, /MADAM REQUEST FOR URGENT BUSINESS RELATIONSHIP WE ARE MAKING THIS CONTACT WITH YOU AFTER SATISFACTORY INFORMATION WE GATHERED FROM THE FOREIGN TRADE OFFICE NIGERIA CHAMBER OF COMMERCE AND INDUSTRY HIGHLIGHTING YOUR COMPANYS PROFILE. WE ARE MEMBERS OF THE PROJECT CONSULTING ANDCONTRACT AWARDING COMMITTEE OF THE NIGERIAN NATIONAL PETROLEUM CORPORATION (NNPC). WE ARE AS CONVINCED AS TO BELIVE THAT YOU WILL PROVIDE US WITH A SOLUTION TO EFFECT A REMITTANCE OF FUND RESULTIN FROM OVER INVOICING OF JOB/ SERVICES DONE TO THE NIGERIAN NATIONAL PETROLEUM CORPORATION BY A FOREIGN CONTRACTOR, CONTRACT NO: NNPC/PED/AJO/1088/94. THIS PROJECT HAS BEEN FULLY EXECUTED AND COMMISSIONED. THE PRESENT GOVERNMENT IN NIGERIA HAS DUE TO THE BILATERAL AGREEMENT REACHED WITH THE WORLD BANK AND IMF, DIRECTED THAT ALL DEBTS OWENED BY FOREIGN CONTRACTORS BE PAID. WE ARE THEREFORE DESIROUS OF TRANSFERRING THE OVER INVOICE SUM OF TWENTY MILLION US DOLLAR (20,000,000,00) ONLY INTO YOUR COMPANYS OR PRIVATE ACCOUNT. NOTE, AS CIVIL SERVANTS, WE ARE NOT PERMITTED TO OWN FOREIGN ACCOUNT BY NIGERIAN CIVIL SERVICE LAW. THEREFORE, INORDER TO FACILITATE THE TRASFER OF THIS FUND INTO YOUR ACCOUNT, YOU ARE URGED. TO REPLY THROUGH THE ABOVE EMAIL ADDRESS FOR CONFIDENTIAL PURPOSE AND FOR THE URGENT NATURE OF THIS TRANSACTION. THE FOLLOWING ARE REQURED FROM YOU. (1) YOUR COMPANYS NAME AND ADDRESS (2) YOUR PERSONAL OR COMPANYS BANK NAME, ADDRESS ACCOUNT NUMBER AND TELEX NO. (3) YOUR PRIVATE AND OFFICIAL TELEPHONE AND FAX NUMBER THE FUND WILL BE SHARED, AS FOLLOWS 30% OF THE TOTAL VALUE SHOULD GO TO YOU AS THE OWNER OF THE ACCOUNT, WHILE 60% SHALL BE RELEASES TO US WHEN WE ARRIVE YOUR COUNTRY AFTER THE TRANSFER, THEN 10% WILL BE FOR EXPENSES INCURRED BY BOTH PARTIES IN THE COURSE OF THE TRANSFER INTO YOUR ACCOUNT. ON RECEIPT OF YOUR PAPERS, WE WILL TENDER AN APPLICATION FOR PAYMENT AT THE CENTRAL BANK OF NIGERIA, FEDERAL MINISTRY OF FINANCE AND ITS AFFILIATE MINISTRIES. FINALLY, THE CONFIDENCE AND TRUST RESPONDED ON YOU CANNOT BE OVER EMPHASISED; THEREFORE YOU ARE TO KEEP THIS TRANSACTION TO YOURSELF AND FOR CONFIDENTIAL REASONS. BEST REGARD. PRINCE MARK ADE (qus,jp,mon,gcon) (CHAIRMAN CONTRACT AWARD COMMITTEE (NNPC)

1 0

RE: [syslog-ng]directory owner
by Keven Belanger 23 Aug '02

23 Aug '02

Sorry ;) I have re-read the mail ! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717 -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, August 23, 2002 11:31 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]directory owner On Fri, Aug 23, 2002 at 11:28:18AM -0400, Keven Belanger wrote: > Hi guys, we use syslog-ng 1.4.15 and I presently use the create_dirs (yes); option but the directory are always created with root:root > How can we change the directory owner and group ?? specify dir_owner() and dir_group() either globally, or locally. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]directory owner
by Keven Belanger 23 Aug '02

23 Aug '02

This is what I try but doesn't work, I use Solaris 8 Sparc ### # Common Options options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); dir_perm (0700); owner ("514"); group ("514"); keep_hostname (no); }; Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717 -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, August 23, 2002 11:31 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]directory owner On Fri, Aug 23, 2002 at 11:28:18AM -0400, Keven Belanger wrote: > Hi guys, we use syslog-ng 1.4.15 and I presently use the create_dirs (yes); option but the directory are always created with root:root > How can we change the directory owner and group ?? specify dir_owner() and dir_group() either globally, or locally. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

directory owner
by Keven Belanger 23 Aug '02

23 Aug '02

Hi guys, we use syslog-ng 1.4.15 and I presently use the create_dirs (yes); option but the directory are always created with root:root How can we change the directory owner and group ?? We need a fast answer please! Thanx! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

2 1

syslog-ng 1.5.20, unix-dgram source on BSD broken
by Balazs Scheidler 23 Aug '02

23 Aug '02

... and this patch fixes it: diff -u -r1.23 afunix.c --- afunix.c 21 Aug 2002 14:03:50 -0000 1.23 +++ afunix.c 23 Aug 2002 12:02:56 -0000 @@ -51,7 +51,7 @@ CAST(afsocket_source_connection, self, c); io_read(self->client, - make_log_reader(0, NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, c), + make_log_reader(!!(self->owner->flags & AFSOCKET_DGRAM), NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, c), make_afsocket_source_close_callback(self)); return ST_OK | ST_GOON; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

help please...
by Keven Belanger 23 Aug '02

23 Aug '02

I have 2 question: 1- I'm looking for a script (perl or other) to scan a file to find unique line (line that are duplicate will be remove) 2- Also want to know which log rotation people are using under Solaris ?? Answer soon! Thanx! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

3 2

RE: [syslog-ng]help please...
by Glenn Harrison 23 Aug '02

23 Aug '02

I can answer 2 fairly simply. Whilst using syslog-ng, I just set the logs to go into a dated directory or filename, that way they automatically get rotated each night without disrupting syslog at all. For example: destination messages { file("/var/log/syslog-dated/$HOST/$YEAR-$MONTH-$DAY/messages" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(sysadmin) perm(0640) dir_perm(0750) dir_owner(root) dir_group(sysadmin)); }; You could of course simplify this even more, and just have: destination messages { file("/var/adm/messages-$YEAR-$MONTH-$DAY" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(sysadmin) perm(0640) dir_perm(0750) dir_owner(root) dir_group(sysadmin)); }; Which would put dated messages files into your /var/adm directory, then run a find command each night to clean up the old logs once they're archived off to tape or whatever your policy is. I personally use these 2 cron entries to clean up my messages each night: 15 4 * * * /usr/bin/find /var/log/syslog-dated $ -name '*-*-*' $ -follow -mount -mtime +32 -type d -exec /usr/bin/rm -rf {} \; 30 4 * * * /usr/bin/find /var/log/syslog-dated $ -name '*.log' $ -follow -mount -mtime +2 -type f -exec /usr/bin/gzip {} \; This gzips the older logs, and deletes stuff over a month old. -----Original Message----- From: Keven Belanger [mailto:kbelanger@logicon.ca] Sent: Friday, 23 August 2002 5:23 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]help please... I have 2 question: 1- I'm looking for a script (perl or other) to scan a file to find unique line (line that are duplicate will be remove) 2- Also want to know which log rotation people are using under Solaris ?? Answer soon! Thanx! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717 Our Privacy statement AM Corporation manages Personal information as required by Privacy legislation. To provide the products and services you request and for related purposes, we collect information from you or from someone you have authorised. If your information is sensitive, such as health information, we will use it only for the purpose that you have requested. Sometimes, we must give your information to appropriate external service providers, such as our underwriter, administrators, your banking service provider and/or Financial Adviser. However, we will give your information only if you authorise us, or if we are legally required to, or if it is part of our normal procedures and necessary to provide what you have requested. This email is confidential > This email and any files transmitted with it are intended solely for the > use of the addressee(s) and may contain information which is confidential > or privileged. Any unauthorised use, in particular forwarding the > contents of this email and any files to third parties (other than is > expressly authorised) is prohibited. > > If you receive this email and you are not the addressee (or responsible > for the delivery of the email to the addressee) please notify us > immediately and delete the email and all copies. > > We do not guarantee that this email is virus or error free, and the > attached files are provided and may only be used on the basis that the > recipient assumes all responsibility for any loss, damage or consequence > resulting directly or indirectly from the use of the attached files, > whether caused by the negligence of the sender or not. > > The contents and opinions in non business emails are not necessarily those > of AM. >

1 0

RE: [syslog-ng]help please...
by Nicholas Berry 22 Aug '02

22 Aug '02

We're using the macro abilities of syslog-ng to write out to a YYYY-MM format example: destination default { file ("/var/syslog-ng/$YEAR-$MONTH/$HOST_FROM/messages" ... ); } Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. nberry(a)ragingwire.com -----Original Message----- From: Keven Belanger [mailto:kbelanger@logicon.ca] Sent: Thursday, August 22, 2002 12:23 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]help please... I have 2 question: 1- I'm looking for a script (perl or other) to scan a file to find unique line (line that are duplicate will be remove) 2- Also want to know which log rotation people are using under Solaris ?? Answer soon! Thanx! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

1 0

syslog-ng 1.5.20
by Holtzl Peter 22 Aug '02

22 Aug '02

Hi, New development version of syslog-ng has been released: News for the 1.5.20 release Thu, 22 Aug 2002 16:03:45 +0200 * fixed a kernel message mangling problem * implemented check_hostname() which checks if a hostname is acceptable (contains characters [0-9a-zA-Z-_.], and if not, it is not parsed as hostname, this fixes problems with devices which send messages which seem to contain a hostname, but in reality they don't -- Höltzl Péter Ho:ltzl Pe'ter | Tel: +36 1 371-0540 | GnuPG Fingerprint: BalaBit IT Kft | Mobil: +36 20 366-9667 | DB30 5E5B 8777 C06F 5A1F holtzl.peter(a)balabit.hu | http://www.balabit.hu/ | 4586 CEAF 9678 4A89 CFD6

3 3

RE: [syslog-ng]Problems compiling libol / syslog-ng
by Camacho, Christian 22 Aug '02

22 Aug '02

That's a weird error, the time was a couple of minutes ahead, I changed it now, but that's not the problem.... Anyone has compiled it on Redhat 7.3 before?? Christian -----Mensaje original----- De: Dustin Trammell [mailto:DTrammell@PENSON.COM] Enviado el: Miércoles, 14 de Agosto de 2002 13:07 Para: 'syslog-ng(a)lists.balabit.hu' Asunto: RE: [syslog-ng]Problems compiling libol / syslog-ng Check the time on your system, it's probably wrong. Usually configure won't continue if it finds files that are newer than current date/time, or it creates a file that is older than current date/time. --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Camacho, Christian [mailto:CCamacho@golder.cl] Sent: Wednesday, August 14, 2002 11:04 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Problems compiling libol / syslog-ng I have Redhat 7.3 and can't configure libol (I have the same problem with syslog-ng). I don't have an alias for ls, I don't know Why I'm having such problem, I've compiled other tar balls before without this error... Any idea?? [root@agua libol-0.3.3]# ./configure creating cache ./config.cache checking for a BSD compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking whether build environment is sane... configure: error: ls -t appears to fail. Make sure there is not a broken alias in your environment configure: error: newly created file is older than distributed files! Check your system clock Thanks, Chris DISCLAIMER: This message may contain confidential information. If you are not the intended recipient please advise the sender and erase the message. Thank you. DISCLAIMER: This message may contain confidential information. If you are not the intended recipient please advise the sender and erase the message. Thank you.

4 7

Updated Red Hat config file
by Frank Crawford 22 Aug '02

22 Aug '02

Folks, I've modified the contributed configuration file for Red Hat to update it to be more compatible with Red Hat 7.3. In particular, I've modified it to totally remove the requirement for running klogd (as described in the FAQ). In particular, I've added a template to include the program type "kernel:" for kernel messages. This is normally done by klogd, and is expected by such utilities as logwatch. The one question I have here is that I have two opens of "/var/log/messages" with different options, and I'm not sure if it is legal, although it does seem to work. Are there any possible problems with this? Thanks Frank Crawford -- ac3 Suite G16, Bay 7, Locomotive Workshop Phone: 02 9209 4600 Australian Technology Park Fax: 02 9209 4611 Eveleigh NSW 1430

2 4

compressed log
by Keven Belanger 22 Aug '02

22 Aug '02

Sorry I forgot to ask this one; can we compress log on the fly with gzip or something like that? So use a gz file as output Thanx again! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

2 1

Somebody help me !
by Le Nguyen Vu 22 Aug '02

22 Aug '02

Hi all, Sorry, my poor english... I install syslog-ng on my PC (flatform OS's Redhat Linux 7.3). But i can't get any log message form other machine (i.e Router, Server run on unix (linux) and windows 2000 server flatform). Some body know about it ? Please tell me how to config syslog-ng on redhat linux 7.3. Thanks, Please mail to me at misterde(a)wmail.saigonnet.vn. Thank again. Mister De misterde(a)wmail.saigonnet.vn

1 0

Re: OK
by Le Nguyen Vu 22 Aug '02

22 Aug '02

confirm 253008

1 0