- syslog-ng - lists.balabit.hu

Problems compiling libol / syslog-ng
by Camacho, Christian 14 Aug '02

14 Aug '02

I have Redhat 7.3 and can't configure libol (I have the same problem with syslog-ng). I don't have an alias for ls, I don't know Why I'm having such problem, I've compiled other tar balls before without this error... Any idea?? [root@agua libol-0.3.3]# ./configure creating cache ./config.cache checking for a BSD compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking whether build environment is sane... configure: error: ls -t appears to fail. Make sure there is not a broken alias in your environment configure: error: newly created file is older than distributed files! Check your system clock Thanks, Chris DISCLAIMER: This message may contain confidential information. If you are not the intended recipient please advise the sender and erase the message. Thank you.

1 0

RE: [syslog-ng] logging pauses and log entry truncation
by Dustin Trammell 14 Aug '02

14 Aug '02

One difference I noticed between your log entries and mine is, yours appear to either get mangled and/or truncated, and then that's it, it continues on the next line with a new log entry. I've seen a bit different behavior in mine, where it will mangle and/or truncate a line, but then on the next entry, it continues with the rest of the previous entry. It's like when reading from /proc/kmsg it's erroneously detecting an end of line, sending that bit of data to the destinations, then continues reading from /proc/kmsg, starting where it cut off. For example: Aug 14 10:17:46 loghost01 fwlog input drop cleanup IN=eth0 OUT= MAC=00:06: Aug 14 10:17:46 loghost01 5b:84:60:7e:00:50:04:a5:11:1f:08:00 SRC=172.30.10.33 DST=172.30.8.40 LEN=60 TOS=0x00 PREC=0x00 TTL=219 ID=61008 DF PROTO=TCP SPT=54189 DPT=32601 WINDOW=5840 RES=0x00 SYN URGP=0 Aug 14 10:17:52 loghost01 <4>fwlog input drop cleanup IN=eth0 OUT= MAC=00: Aug 14 10:17:52 loghost01 06:5b:84:60:7e:00:50:04:a5:11:1f:08:00 SRC=172.30.10.33 DST=172.30.8.40 LEN=60 TOS=0x00 PREC=0x00 TTL=219 ID=36311 DF PROTO=TCP SPT=54189 DPT=32601 WINDOW=5840 RES=0x00 SYN URGP=0 As you can see, the first line gets truncated, then on the next line, it continues with the rest of the log entry starting where the previous one got cut off. While writing this, I just saw the most mangled entry I've seen yet: Aug 14 10:16:15 loghost01 fwlog input drop clenup Ib:84:602. PREC=0x00 TTL=79 ID=T=TCP S SYN TCP i OUT MAC=00:06:5b:84172.3072.=5840 RES=0x00 N=0 As opposed to what it /should/ look like: Aug 14 10:17:46 loghost01 fwlog input drop cleanup IN=eth0 OUT= MAC=00:06:5b:84:60:7e:00:50:04:a5:11:1f:08:00 SRC=172.30.10.33 DST=172.30.8.40 LEN=60 TOS=0x00 PREC=0x00 TTL=219 ID=45827 DF PROTO=TCP SPT=38821 DPT=32606 WINDOW=5840 RES=0x00 SYN URGP=0 Weird weird stuff. Hopefully some of this discussion and related log snippets will help Balazs pinpoint the problem. --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Caylan Van Larson [mailto:caylan@cs.und.edu] Sent: Wednesday, August 14, 2002 10:08 To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng] logging pauses and log entry truncation Yes, similar, but also erratic. I have it happening in the MAC addy and toward the end. Sometimes it seems as they are folded in on itself. I have placed a sample on www.cs.und.edu/~caylan/kern for your viewing pleasure. It is not my sytle to make things like this publicly accessible but I want to get this issue resolved. In case you did not see the above URL or are too lazy :P Aug 14 10:02:30 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08: Aug 14 10:02:31 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=63.151.197.164 DST=134.129.212.30 LEN=48 TOS=0x00 PREC=0x00TT14 2103DF PRTCP SW=163 Aug 14 10:02:32 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08: Aug 14 10:02:32 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc: Aug 14 10:02:32 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.215.35 DST=1PSPT7 DPT=137 L Aug 14 10:02:32 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08: Aug 14 10:02:33 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.215.35 DST=134.129.212.30 LEN=9 138 N=20 Aug 14 10:02:33 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08: Thats a pretty damn good sample! Good luck, Caylan Van Larson Unix Administrator - Systems Team Member University of North Dakota (Aerospace College) caylan(a)cs.und.edu 701-777-6151 (work)

2 1

RE: [syslog-ng] logging pauses and log entry truncation
by Dustin Trammell 14 Aug '02

14 Aug '02

I found out why syslog-ng was doing the pausing... I had accidentally left two source entries for /proc/kmsg in my syslog-ng.conf file (I was originally trying to see if using file() vs. pipe() made any difference in the log entry truncation), so I assume it was a locking issue with both of them trying to read from the same place. After removing one of them, I haven't had syslog-ng pause on me once, but I am still getting the log entry truncation on entries from iptables. It usually truncates on iptables log entries that have an empty OUT= tag (no out interface), and truncates just after the OUT= tag and before the MAC= tag, or somewhere halfway through the MAC address in the MAC= tag. Are you getting the truncation at the same place on the same types of log entries? --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Caylan Van Larson [mailto:caylan@cs.und.edu] Sent: Monday, August 12, 2002 15:54 To: Dustin Trammell Cc: 'syslog-ng(a)lists.balabit.hu' Subject: Re: [syslog-ng]logging pauses and log entry truncation I am having very similar truncating going on. Bazsi is working on a fix. However, my logs never paused, maybe for a little bit (5-10seconds) but that is prolly just net traffic jumps. Good luck to Bazsi!!!

2 1

Re: [syslog-ng]1.5.19 and tcp
by Abraham, Ajamu 14 Aug '02

14 Aug '02

-------------------------- Sent from my BlackBerry Wireless Handheld

1 0

klogd and sysctl
by Frank Crawford 10 Aug '02

10 Aug '02

Folks, One thing I noticed on eliminating klogd from my Red Hat 7.3 system was that kernel messages were then being printed on the console. Looking further into it, it seems that klogd invokes a sysctl option to suppress certain messages (in particular packet filtering messages). The same effect can be managed with the command: /sbin/sysctl -n -w kernel.printk=6 on starting syslog-ng, and: /sbin/sysctl -n -w kernel.printk=7 on shutdown. One other item I did to make it a total drop in was write the pid file to /var/run/syslogd.pid, by invoking syslog-ng with: /usr/local/sbin/syslog-ng -p /var/run/syslogd.pid (These are all items that could be in the FAQ.) Frank Crawford -- ac3 Suite G16, Bay 7, Locomotive Workshop Phone: 02 9209 4600 Australian Technology Park Fax: 02 9209 4611 Eveleigh NSW 1430

1 0

Penny L Creech/Nationwide/NWIE is out of the office.
by CREECHP＠Nationwide.com 10 Aug '02

10 Aug '02

I will be out of the office starting 08/09/2002 and will not return until 08/19/2002. I will respond to your message when I return.

1 0

RE: [syslog-ng]Installing on a non-compiler system
by Clausing, James A (Jim), SOLCM 09 Aug '02

09 Aug '02

I build packages to do this all the time (the only way I'll do it). I would be happy to share my Makefile (which gunzips, untars, configures, makes, installs, and pkgmks). I haven't yet added the logic to it to also build & install libol, but I only have that installed on my development/build systems, not where syslog-ng is actually deployed. ---Jim -----Original Message----- From: Nicholas Berry [mailto:nberry@ragingwire.com] Sent: Tuesday, July 30, 2002 11:26 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Installing on a non-compiler system You could build syslog-ng in a Solaris pkg format, but I'm not sure how much of a problem you would have installing the package on your Solaris 2.6 system (might not have a problem if you're up-to-date with the recommended patch cluster). Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. nberry(a)ragingwire.com -----Original Message----- From: Lightfoot.Michael [mailto:Lightfoot.Michael@comcare.gov.au] Sent: Monday, July 29, 2002 8:02 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Installing on a non-compiler system I have built syslog-ng on a development server (Solaris 9) and now wish to install it on another system which doesn't have development tools (it is a fairly standard Solaris 9 installation.) I will also be installing a Solaris 2.6 build on systems in our DMZ which have been hardened and have very little other than the OS. The problem I have struck is that after copying the built source to the target server, "make install" fails with the following error: # make install Making install in src Making install in . make: Fatal error: Don't know how to make target `/usr/local/src/syslog-ng-1.4.15/configure.in' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Any ideas on how I get around this easily? NFS is one option, but will not be for the DMZ systems (and is not used in production on any systems here.) I suppose I could install it on the development server using a filesystem diff before and after trick I have used in the past, but again there are problems doing this with the Solaris 2.6 build (which has to be done on a production server as I don't have a Solaris 2.6 dev machine any more.) Michael Lightfoot Unix Consultant ISG Host Systems Comcare +61 2 62750680 NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

CRITICAL: disk flooding bug - disabling of STATS seems to be broken in 1.5.19
by Dominique Kaiser 09 Aug '02

09 Aug '02

Disabling STATS reporting with options "{ stats(0); }" doesn't work anymore! Instead syslog-ng gets busy reporting STATS all the time without pause - and succeeds in eating up all free disk space in a matter of minutes. If you don't have an extra mount for /var/log your whole system is rendered inoperatible... the upstream Changelog shows an entry from 2002-06-17 concerning STATS which most likely describes the change causing the bug. I didn't fully study the sources but on first sight it seems to me that the error is in main_loop() in src/main.c in the lines 188 and 204. I think it should be if (s.timeout > 0) instead of if (s.timeout <= 0) especially as the callback timers seem to get deleted in line 201. The way it is now STATS might be disabled by providing any positive config value??!! The problem might also be solved if one could use "stats(-1);" to deactivate STATS reporting but syslog-ng doesn't seem to accept negative values (which might be another bug on itself?). In the default installation the default value of 600 seconds is used, so this bug is not a problem if syslog-ng is used with unchanged config options. But whoever does want his/her disks tpo spin down at all will have tried to disable STATS... Cheers, Dominique. P.S.: also reported as Bug #156045 to the Debian BTS... P.P.S.: I'm not a member of the syslog-ng mainling list...

3 2

Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fix
by Balazs Scheidler 09 Aug '02

09 Aug '02

On Thu, Aug 08, 2002 at 08:47:01AM -0500, Caylan Van Larson wrote: > Mr. Scheidler, > > May I ask you the correct way to apply this patch. I have applied kernel > patches before but I am not aware of this syntax (not that it is different > I just am curious on your "Right Way"). I thought it would be best to ask > you instead of trying it 10 different ways hoping it worked. unpack a vanilla 1.5.19 syslog-ng cd syslog-ng-1.5.19 patch -p1 <path to file> touch src/sources.c.x (the last one is needed if you don't have scsh, to satisfy make dependencies) rebuild. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 4

"message repeated N times"
by Andan Lauber 09 Aug '02

09 Aug '02

heya, i've not seen it do it, but i've only the one host running syslog-ng as a central loghost, with generic syslogs reporting to it, but does syslog-ng deal with repeat messages like generic syslog does, in this fashion? host.domain.tld message repeated 4 times or does it just spew out the message again? thanks. (and as a side, if any know of a way to STOP generic syslog from doing this, i'd love to hear it. i'm hoping the answer is "install syslog-ng") thanks. -- Andan Lauber Redback Networks, Inc. Daemonologist http://www.redback.com

2 1

Re: [syslog-ng]1.5.19 and tcp
by CHENNES＠Nationwide.com 09 Aug '02

09 Aug '02

The truss output also shows that the process is ultimately killed. Are you saying you suspect an "external force" is killing the process. Balazs Scheidler <bazsi(a)balabit.hu> T To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin(a)lists.b alabit.hu bcc: Subject: Re: [syslog-ng]1.5.19 and tcp 08/08/02 03:28 AM Please respond to syslog-ng On Wed, Aug 07, 2002 at 02:09:06PM -0400, CHENNES(a)Nationwide.com wrote: > > Here's the gdb backtrace: > > gdb syslog-ng -c core > GNU gdb 4.18 > Copyright 1998 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public License, and you > are > welcome to change it and/or distribute copies of it under certain > conditions. > Type "show copying" to see the conditions. > There is absolutely no warranty for GDB. Type "show warranty" for details. > This GDB was configured as "sparc-sun-solaris2.8"... > Core was generated by `/test/syslog/bin/syslog-ng -f /etc/syslog-ng.conf -p > /etc/s'. > Program terminated with signal 9, Killed. > Reading symbols from /usr/lib/libpthread.so.1...done. > Reading symbols from /usr/lib/libdoor.so.1...done. > Reading symbols from /usr/lib/libl.so.1...done. > Reading symbols from /usr/lib/libsocket.so.1...done. > Reading symbols from /usr/lib/libnsl.so.1...done. > Reading symbols from /usr/lib/libxnet.so.1...done. > Reading symbols from /usr/lib/libc.so.1...done. > Reading symbols from /usr/lib/libdl.so.1...done. > Reading symbols from /usr/lib/libmp.so.2...done. > Reading symbols from > /usr/platform/SUNW,Sun-Fire-880/lib/libc_psr.so.1...done. > Reading symbols from /usr/lib/libthread.so.1...done. > #0 0xff141d00 in _malloc_unlocked () from /usr/lib/libc.so.1 > (gdb) bt > #0 0xff141d00 in _malloc_unlocked () from /usr/lib/libc.so.1 > #1 0xff141ad0 in malloc () from /usr/lib/libc.so.1 > #2 0x2219c in xalloc () > #3 0x17978 in make_log_info (length=0, > msg=0x3d8d8 "<13>Aug 7 13:59:21 test/test user: [ID 702911 > user.notice] test message number 3\n<13>Aug 7 13:59:21 test/ > test user: [ID 702911 user.notice] test message number 4\n<13>Aug 7 > 13:59:21 "..., prefix=0x0) at log.c:263 > #4 0x15be8 in do_handle_line (self=0xffbefa90, length=89, > data=0x3d8d8 "<13>Aug 7 13:59:21 test/test user: [ID 702911 > user.notice] test message number 3\n<13>Aug 7 13:59:21 test > /test user: [ID 702911 user.notice] test message number 4\n<13>Aug 7 > 13:59:21 "..., addr=0x3d8d8, addrlen=0) > at sources.c:67 > #5 0x15de0 in do_read_line (h=0x3d8a0, read=0xffbefa90) at sources.c:134 > #6 0x202f4 in read_callback () > #7 0x1fed4 in io_iter () > #8 0x152dc in main_loop (backend=0x395d8) at main.c:191 > #9 0x159ec in main (argc=6, argv=0xffbefd54) at main.c:513 > (gdb) hmm.. this is not a segfault. the process is killed with signal SIGKILL. the original truss output indicated a segfault. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng]Message forwarding problem
by Dale Amon 09 Aug '02

09 Aug '02

Thanks much, options { keep_hostname(yes); }; on the master server sorted everything out.

1 0

Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fix
by Ron Braley 08 Aug '02

08 Aug '02

No, I thought about the same things you did at first (configuration, etc.) but can't think of anything else. Going backwards to syslog isn't a good option, as we'd be very limited and all like logs would be dumped into the same file regardless of the originating server. Tell Baszi what you found (or didn't find) and see if he can duplicate and fix it (I wouldn't hold my breath, though). rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> caylan(a)cs.und.edu 08/08/02 12:31PM >>> Hello, I tried to apply the patch and got this: [root@smack src]# patch -p0 < patchto.bazsi patching file sources.c Hunk #1 FAILED at 80. Hunk #2 FAILED at 114. 2 out of 2 hunks FAILED -- saving rejects to file sources.c.rej [root@smack src]# patch -p1 < patchto.bazsi missing header for unified diff at line 8 of patch can't find file to patch at input line 8 Perhaps you used the wrong -p or --strip option? The text leading up to this was: -------------------------- |Index: sources.c |=================================================================== |RCS file: /var/cvs/syslog-ng/syslog-ng/src/sources.c,v |retrieving revision 1.34 |diff -u -r1.34 sources.c |--- sources.c 18 Jul 2002 13:18:02 -0000 1.34 |+++ sources.c 8 Aug 2002 10:01:18 -0000 -------------------------- File to patch: sources.c patching file sources.c Hunk #1 FAILED at 80. Hunk #2 FAILED at 114. 2 out of 2 hunks FAILED -- saving rejects to file sources.c.rej I know what was going on here so I just edited sources.c by hand. Unfortunately after a complete deletion of the src directory, unpacking, copied over sources.c, ./configure, touch src/sources.c.x, make, make install. I restarted syslog-ng had a look at /var/log/kern and these entries were still happening: Aug 8 12:29:23 smack IPTABLES UDP-IN:etOUT= MAC44:00:05:01:fb:e3:fc:08:00 SRC=6EN=141 TOS=0x00 PREC=0x00 UDP SP3014 LEN=121 Aug 8 12:29:28 smack IPTABLES UDP-INOUT= MAC=00:03:47:4e:3:05:01:fb::00 SRC=64.12.51.129 DST=134.129 LEN=141 TOSPROTO=UDP SPT=53 DPTIN: IN=eth1 OUT= MAC=00:03:47:4eRC=64.12.51.129 D0x00 PREC=0x00 L=45 ID=47526 PROTO=UDP SPT=53 D<6> IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:005:fbSR SP<6> IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3fc:08 SRC=1329.9DS89 <6> IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.217.172 DST=134.129.212.30 LEN=244 TOS=0x00 PREC=0x00 TTL=127 ID=60809 PROTO=UDP SPT=138 DPT=138 LEN=224 Aug 8 12:29:29 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.120 DST=134.129.212.30 LEN=78 TOS=0x00 PREC=0x00 TTL=2 I404LEN= Aug 8 12:29:29 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.120 DST=134.129.12.C=0x0TL=12ID6 PRO Aug 8 12:29:30 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.120 DST=134.129.212.30 LEN=78 TOS=0x00 PREC=0x00 TT=127 44047 PROTO=UDP SP37 DPT=137 LEN=58 Aug 8 12:29:33 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08: I have no clue :( Any ideas? Caylan Van Larson Unix Administrator - Systems Team Member University of North Dakota (Aerospace College) caylan(a)cs.und.edu 701-777-6151 (work) On Thu, 8 Aug 2002, Balazs Scheidler wrote: > On Thu, Aug 08, 2002 at 08:47:01AM -0500, Caylan Van Larson wrote: > > Mr. Scheidler, > > > > May I ask you the correct way to apply this patch. I have applied kernel > > patches before but I am not aware of this syntax (not that it is different > > I just am curious on your "Right Way"). I thought it would be best to ask > > you instead of trying it 10 different ways hoping it worked. > > unpack a vanilla 1.5.19 syslog-ng > cd syslog-ng-1.5.19 > patch -p1 <path to file> > touch src/sources.c.x > > (the last one is needed if you don't have scsh, to satisfy make > dependencies) > > rebuild. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Problem with syslogd and syslog-ng...
by BENGT OLSSON 08 Aug '02

08 Aug '02

Hello Can some one help me with this? I have syslog-ng running on the loggserver and syslogd on the clients and syslog-ng servern dosn't trig on all levels. ex. on the client(etc/syslog.conf) *.debug @loghost *.info @loghost #*.notice @loghost #*.warning @loghost #*.err @loghost #*.crit @loghost #*.alert @loghost #*.emerg @loghost gives 2 entries in the logfile #*.debug @loghost *.info @loghost #*.notice @loghost #*.warning @loghost #*.err @loghost #*.crit @loghost #*.alert @loghost #*.emerg @loghost gives zero entries in the logfile?? I want to log all levels from warning to emerg. *.warning @loghost in the syslog.conf file would be enough or is in't? And this should gives one entrie in the logfile? the syslog-ng.conf looks like this: options { use_fqdn(yes); keep_hostname(yes); use_dns(yes); long_hostnames(off); sync(3); log_fifo_size(1000); }; source all { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; # automatic host sorting # set it up destination hosts { file("/var/syslog/hosts/$HOST/$FACILITY_$YEAR-$MONTH-$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; # log by host log { source(all); destination(hosts); }; /Benke -- Bengt Olsson Blekinge Tekniska Högskola Datorenheten Campus Gräsvik Vallhallavägen 1 371 79 Karlskrona Mail: bol(a)bth.se Tel: 0455-385152 Mobil: 0708-787 780

2 1

[PATCH] please test: syslog-ng message mangling fix
by Balazs Scheidler 08 Aug '02

08 Aug '02

Hi, This patch should fix the message mangling problems you might have encountered. As the log parsing routines are quite critical I don't want to release this patch without testing on most platforms. It seems to work on Linux for me, but tests from more exotic platforms are welcome. (the problem this patch fixes occurs only if you have messages longer than the default limit. the limit can be changed by log_msg_size) to test: apply the patch, and touch sources.c.x, and recompile Index: sources.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/sources.c,v retrieving revision 1.34 diff -u -r1.34 sources.c --- sources.c 18 Jul 2002 13:18:02 -0000 1.34 +++ sources.c 8 Aug 2002 09:21:34 -0000 @@ -112,8 +113,8 @@ closure->pos = 0; return ST_OK | ST_GOON; } - if (!eol && closure->pos) { - /* we don't have a terminating nl nor \0 */ + if (!eol && closure->pos == closure->max_log_line) { + /* we don't have a terminating nl nor \0, and our buffer is full */ do_handle_line(closure, closure->pos, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 1

kern (iptable) logs cut off
by Caylan Van Larson 08 Aug '02

08 Aug '02

Greetings, This is on a RedHat 7.3 Box. We were using the latest syslog-ng rpm from redhat and we noticed that upon migration from syslogd to syslog-ng our iptable logs were getting mangled. Here is an exert from syslogd logging of iptables (/var/log/messages): Aug 7 23:41:47 smack kernel: IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.217.37 DST=134.129.212.30 LEN=240 TOS=0x00 PREC=0x00 TTL=127 ID=13570 PROTO=UDP SPT=138 DPT=138 LEN=220 Aug 7 23:41:48 smack kernel: IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.201.29 DST=134.129.212.30 LEN=60 TOS=0x00 PREC=0x00 TTL=61 ID=10095 DF PROTO=TCP SPT=4997 DPT=53 WINDOW=32120 RES=0x00 SYN URGP=0 Aug 7 23:41:48 smack kernel: IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.220.175 DST=134.129.212.30 LEN=78 TOS=0x00 PREC=0x00 TTL=127 ID=12752 PROTO=UDP SPT=137 DPT=137 LEN=58 Aug 7 23:41:49 smack kernel: IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.220.175 DST=134.129.212.30 LEN=78 TOS=0x00 PREC=0x00 TTL=127 ID=13008 PROTO=UDP SPT=137 DPT=137 LEN=58 Aug 7 23:41:49 smack kernel: IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.220.175 DST=134.129.212.30 LEN=78 TOS=0x00 PREC=0x00 TTL=127 ID=13264 PROTO=UDP SPT=137 DPT=137 LEN=58 Very nice as you can see. Now, we would love to use syslog-ng but this is from syslog-ng (/var/log/kern): Aug 7 23:38:17 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00: Aug 7 23:38:17 smack IPTABLES ICMP-IN: IN=eth1 OUT= MAC=00:03: Aug 7 23:38:19 smack IPTABLES ICMP-IN: IN=eth1 OUT= MAC=00:03: Aug 7 23:38:20 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=24.220.215.146 DST=134.129.212.30 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=20216 DF PROTO=TCP SPT=2406 DPT=53 WINDOW=2144 RES=0x00 SYN URGP=0 Aug 7 23:38:20 smack IPTABLES ICMP-IN: IN=eth1 OUT= MAC= Aug 7 23:38:23 smack IPTABLES ICMP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=192.36.148.20 DST=134.129.212.30 LEN=52 TOS=0x00 PREC=0x00 TTL=5 ID=6179 PROTO=ICMP TYPE=8 CODE=0 ID=22608 SEQ=17 Aug 7 23:38:23 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC= Aug 7 23:38:24 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03: Aug 7 23:38:25 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.201.29 DST=134.129.212.30 LEN=60 TOS=0x00 PREC=0x00 TTL=61 ID=6213 DF PROTO=TCP SPT=1030 DPT=53 WINDOW=32120 RES=0x00 SYN URGP=0 Aug 7 23:38:25 smack IPTABLES ICMP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=192.36.148.20 DST=134.129.212.30 LEN=52 TOS=0x00 PREC=0x00 TTL=243 ID=6479 PROTO=ICMP TYPE=8 CODE=0 ID=22608 SEQ=255 At the same time I find this!!! Could this be the other part of whats missing above? [root@smack log]# tail -f user Aug 7 23:42:26 smack TO=0x00 PREC=0x00 TTL=127 ID=14587 PROTO=UDP SPT=137 DPT=137 LEN=58 Aug 7 23:42:37 smack C=UDPT=1 Aug 7 23:42:39 smack 0TL=127 I5998 PROTO=UDP SPT=137 DPT=137 L8 Aug 7 23:42:43 smack 0 PREC=0 TTL=127 ID=18027 PROTO=UDP SPT=17 D37 N= Aug 7 23:42:57 smack =x00L=127D=1826 PROTO=UDP SPT=137 DPT=137N= Aug 7 23:43:05 smack =0x00 TTL7 I14 DF Aug 7 23:43:22 smack O=TCP SPT=4481 DPT=53 WINDOW=16384 RES=0x00 SYN U Aug 7 23:43:24 smack LEN=78 =0x00 PREC=0x00 TTL=127 ID=21968 PROTDP SPT=137 DPT=137 LEN=58 Aug 7 23:43:28 smack T=138 DPT Aug 7 23:43:31 smack T53 W Not to mention some other output going to /var/log/bootup. This output consists of iptable startup information... I have tried every combo of syslog-ng klogd imaginable. I have tried to tinker with the global src using pipes and files for the kernel logging but that got nowhere... Same results. This is experienced using: libol-0.3.3 syslog-ng-1.5.19 syslog-ng-1.5.17-1.i386.rpm The command dmesg gives nice iptables output. So I know it is not iptablse fault. Iptables is configured to log at level 5 for normal dropped packets and log level 5 for other more serious packets. Below is my syslog-ng.conf file. Thank you for any help!!! I need to work on the firewall and it is hard with no logs.. :( Thanks again, Caylan Van Larson --SNIP Here is my syslog-ng.conf: # This file should be compatible with the out-of-the-box # /etc/syslog.conf on Red Hat Linux # global options # options { use_dns(yes); use_fqdn(no); use_time_recvd(no); chain_hostnames(no); mark(0); sync(0); }; # sources # source s_all { internal(); unix-stream("/dev/log"); file("/proc/kmsg"); }; # facility filters # filter f_authpriv { facility(authpriv); }; filter f_auth { facility(auth); }; filter f_boot { facility(local7); }; filter f_2511 { facility(local5); }; filter f_6509-1-log { facility(local4); }; filter f_6509-2-log { facility(local3); }; filter f_cron { facility(cron); }; filter f_kern { facility(kern); }; filter f_user { facility(user); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon); }; filter f_messages { priority(info..emerg) and not facility(mail, news, authpriv, cron, local1, local2, local3, local4, local5, local6); }; filter f_news { facility(news); }; # priority filters # filter f_emerg { priority(emerg); }; filter f_crit { priority(crit..emerg); }; filter f_crit_only { priority(crit); }; filter f_err { priority(err..emerg); }; filter f_err_only { priority(err); }; filter f_warn { priority(warning..emerg); }; filter f_notice { priority(notice..emerg); }; filter f_info { priority(info..emerg); }; filter f_debug { priority(debug..emerg); }; # host filters # filter f_smack { host(smack); }; #destination filters # # *network* destination d_tcp { tcp("134.129.212.33"); }; destination d_udp { udp("134.129.212.33"); }; # *everyone* destination d_all { usertty("*"); }; # *console* destination d_console { file("/dev/console"); }; # *boot* destination d_smacboot { file("/var/log/bootlog"); }; # *cron* destination d_smaccron { file("/var/log/cron"); }; # *mail* destination d_smacmail { file("/var/log/maillog"); }; # *messages* destination d_smacmsg { file("/var/log/messages"); }; # *secure (auth & authpriv)* destination d_smacsec { file("/var/log/secure"); }; # *user* destination d_smacuser { file("/var/log/user"); }; # *kern* destination d_smackern { file("/var/log/kern"); }; # *daemon* destination d_smacdaemon { file("/var/log/daemon"); }; # *spool (lpr)* destination d_smacspool { file("/var/log/spooler"); }; #Everyone gets emergency messages log { source(s_all); filter(f_emerg); destination(d_all); }; #Log messages from Smack log { source(s_all); filter(f_cron); filter(f_debug); filter(f_smack); destination(d_smaccron); destination(d_tcp); }; log { source(s_all); filter(f_authpriv); filter(f_debug); filter(f_smack); destination(d_smacsec); destination(d_tcp); }; log { source(s_all); filter(f_mail); filter(f_warn); filter(f_smack); destination(d_smacmail); destination(d_tcp); }; log { source(s_all); filter(f_boot); filter(f_debug); filter(f_smack);destination(d_smacboot); destination(d_tcp); }; # fw-iptables logs at NOTICE <5> (fragments/unknown protocols) and INFO <6> (known udp/tcp/icmp) # This line will log ALL of kern locally log { source(s_all); filter(f_kern); filter(f_messages); filter(f_debug); filter(f_smack); destination(d_smackern); }; # This line will only remotely log NOTICE <5> and above (5,4,3,2,1,0) log { source(s_all); filter(f_kern); filter(f_messages); filter(f_notice); filter(f_smack); destination(d_tcp); }; log { source(s_all); filter(f_user); filter(f_debug); filter(f_smack); destination(d_smacuser); destination(d_tcp); }; log { source(s_all); filter(f_lpr); filter(f_debug); filter(f_smack); destination(d_smacspool); destination(d_tcp); }; log { source(s_all); filter(f_daemon); filter(f_notice); filter(f_smack); destination(d_smacdaemon); destination(d_tcp); }; --SNAP Whew Thanks, Caylan Van Larson Unix Administrator - Systems Team Member University of North Dakota (Aerospace College) caylan(a)cs.und.edu 701-777-6151 (work)

3 2

Re: [syslog-ng]1.5.19 and tcp
by CHENNES＠Nationwide.com 08 Aug '02

08 Aug '02

Here's the gdb backtrace: gdb syslog-ng -c core GNU gdb 4.18 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "sparc-sun-solaris2.8"... Core was generated by `/test/syslog/bin/syslog-ng -f /etc/syslog-ng.conf -p /etc/s'. Program terminated with signal 9, Killed. Reading symbols from /usr/lib/libpthread.so.1...done. Reading symbols from /usr/lib/libdoor.so.1...done. Reading symbols from /usr/lib/libl.so.1...done. Reading symbols from /usr/lib/libsocket.so.1...done. Reading symbols from /usr/lib/libnsl.so.1...done. Reading symbols from /usr/lib/libxnet.so.1...done. Reading symbols from /usr/lib/libc.so.1...done. Reading symbols from /usr/lib/libdl.so.1...done. Reading symbols from /usr/lib/libmp.so.2...done. Reading symbols from /usr/platform/SUNW,Sun-Fire-880/lib/libc_psr.so.1...done. Reading symbols from /usr/lib/libthread.so.1...done. #0 0xff141d00 in _malloc_unlocked () from /usr/lib/libc.so.1 (gdb) bt #0 0xff141d00 in _malloc_unlocked () from /usr/lib/libc.so.1 #1 0xff141ad0 in malloc () from /usr/lib/libc.so.1 #2 0x2219c in xalloc () #3 0x17978 in make_log_info (length=0, msg=0x3d8d8 "<13>Aug 7 13:59:21 test/test user: [ID 702911 user.notice] test message number 3\n<13>Aug 7 13:59:21 test/ test user: [ID 702911 user.notice] test message number 4\n<13>Aug 7 13:59:21 "..., prefix=0x0) at log.c:263 #4 0x15be8 in do_handle_line (self=0xffbefa90, length=89, data=0x3d8d8 "<13>Aug 7 13:59:21 test/test user: [ID 702911 user.notice] test message number 3\n<13>Aug 7 13:59:21 test /test user: [ID 702911 user.notice] test message number 4\n<13>Aug 7 13:59:21 "..., addr=0x3d8d8, addrlen=0) at sources.c:67 #5 0x15de0 in do_read_line (h=0x3d8a0, read=0xffbefa90) at sources.c:134 #6 0x202f4 in read_callback () #7 0x1fed4 in io_iter () #8 0x152dc in main_loop (backend=0x395d8) at main.c:191 #9 0x159ec in main (argc=6, argv=0xffbefd54) at main.c:513 (gdb) Balazs Scheidler <bazsi(a)balabit.hu> T To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin(a)lists.b alabit.hu bcc: Subject: Re: [syslog-ng]1.5.19 and tcp 08/07/02 11:24 AM Please respond to syslog-ng On Wed, Aug 07, 2002 at 09:31:50AM -0400, CHENNES(a)Nationwide.com wrote: > I am having difficulty keeping 1.5.19 running when receiving syslog > messages via tcp. I have a central logging host that receives messages via > tcp from collection hosts. The collection hosts are receiving messages > from various hosts via udp and tcp. Essentially, the ng process > immediately dies on the central logging host as soon as I start it. > However, if I alter the configurations to use only udp, I have no problems. > The central logging host and the collection hosts are all running Solaris 8 > with 1.5.19. I have tested the same exact scenario using a previous > version of ng (1.4.14) on the central logging host and it works just fine. > I have included some configuration information below. can you provide a gdb backtrace based on the core file? gdb syslog-ng -c core gdb> bt and the results. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng]new... simple examples?
by Michael Earls 07 Aug '02

07 Aug '02

look at the FAQ page Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >>> dbarber(a)tdschas.com 08/07/02 02:12PM >>> Hi, Does anyone have a simple example for a config file which will log all logs to a remote host via tcp? or a site that has some examples? thanks, Dan _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

Re: [syslog-ng]new... simple examples?
by Michael Earls 07 Aug '02

07 Aug '02

not sure if it has a config file for logging syslog via tcp, but there are some examples of logging via udp, here is an example to log udp and filter based on ip address, # Tucson # destination 12.9.1.226 { file("/var/syslog/Arizona/Tucson/JC-Tucson/redback/JC-Tucson.log"); }; filter f_12.9.1.226 { host(12.9.1.226); }; log { source(net); filter(f_12.9.1.226); destination(12.9.1.226); }; destination 12.126.138.90 { file("/var/syslog/Arizona/Tucson/JC-Tucson/router/JC-Tucson.log"); }; filter f_12.126.138.90 { host(12.126.138.90); }; log { source(net); filter(f_12.126.138.90); destination(12.126.138.90); }; Nate — do we have an example of syslog-ng config file for logging via tcp? >>> dbarber(a)tdschas.com 08/07/02 02:47PM >>> I must be missing something... Michael, can you point out in the FAQ where it has a link to or specific examples of a config log which uses tcp to log remotely? thanks, Dan On Wed, 2002-08-07 at 14:22, Michael Earls wrote: > look at the FAQ page > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > >>> dbarber(a)tdschas.com 08/07/02 02:12PM >>> > Hi, > > Does anyone have a simple example for a config file which will log all > logs to a remote host via tcp? > > or a site that has some examples? > > thanks, > > Dan > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

new... simple examples?
by Dan Barber 07 Aug '02

07 Aug '02

Hi, Does anyone have a simple example for a config file which will log all logs to a remote host via tcp? or a site that has some examples? thanks, Dan

1 0

Message forwarding problem
by Dale Amon 07 Aug '02

07 Aug '02

I've got the following situation: Host A can talk to Host B Host B can talk to Host C Host A can NOT talk to Host C directly Host C is the master logger So I'm trying to set up Host B to act as a forwarder. This "mostly" works: HOST A: destination mylogger { tcp(<HOST B> port(1999) localport(999)); }; filter all { level(info..err); }; log { source(src); filter(all); destination(console_all); destination(mylogger); }; HOST B: source s_tcp { tcp(localip(<HOST B>) port(1999) max-connections(50)); }; destination mylogger { tcp(<HOST C> port(1999) localport(999)); }; filter all { level(info..err); }; log { source(s_tcp); source(src); filter(all); destination(console_all); destination(mylogger); }; HOST C source s_tcp { tcp(localip(<HOST C>) port(1999) max-connections(50)); }; destination logtest { file("/var/log/logtest.log" owner("root") group("adm") perm(0640)); }; filter drop1 { not match ( " session opened|closed for user root|mail") and not match ("STATS: dropped 0"); }; log { source(s_tcp); source(src); filter(drop1); destination(logtest); }; The problem is, HOST B rewrites the message source to itself, so all messages from HOST A arriving at HOST C appear to have "occurred" on HOST B. Is there a way to do real forwarding rather than hacking it as I did above?

3 2

1.5.19 and tcp
by CHENNES＠Nationwide.com 07 Aug '02

07 Aug '02

I am having difficulty keeping 1.5.19 running when receiving syslog messages via tcp. I have a central logging host that receives messages via tcp from collection hosts. The collection hosts are receiving messages from various hosts via udp and tcp. Essentially, the ng process immediately dies on the central logging host as soon as I start it. However, if I alter the configurations to use only udp, I have no problems. The central logging host and the collection hosts are all running Solaris 8 with 1.5.19. I have tested the same exact scenario using a previous version of ng (1.4.14) on the central logging host and it works just fine. I have included some configuration information below. **** output from command truss -fael syslog-ng -d syslog-ng version 1.5.19 starting 1548/1: write(2, " s y s l o g - n g v e".., 34) = 34 1548/1: sigaction(SIGPIPE, 0xFFBEFA18, 0xFFBEFB18) = 0 1548/1: sigaction(SIGHUP, 0xFFBEFA18, 0xFFBEFB18) = 0 1548/1: sigaction(SIGTERM, 0xFFBEFA18, 0xFFBEFB18) = 0 1548/1: sigaction(SIGCLD, 0xFFBEFA18, 0xFFBEFB18) = 0 1548/1: time() = 1028722452 1548/1: poll(0xFFBEFB38, 2, 100) = 0 1548/1: poll(0xFFBEFB38, 2, 60000) (sleeping...) 1548/2: signotifywait() (sleeping...) 1548/3: door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) 1548/4: lwp_cond_wait(0xFF0F5550, 0xFF0F5560, 0xFF0EEDB8) (sleeping...) 1548/5: door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) 1548/1: poll(0xFFBEFB38, 2, 60000) = 1 1548/1: accept(3, 0xFFBEF9C8, 0xFFBEF9C4, 1) = 7 1548/1: fcntl(7, F_GETFL, 0xFFFFFFFF) = 130 1548/1: fstat64(7, 0xFFBEF698) = 0 1548/1: getsockopt(7, 65535, 8192, 0xFFBEF798, 0xFFBEF790, 0) = 0 1548/1: fstat64(7, 0xFFBEF698) = 0 1548/1: getsockopt(7, 65535, 8192, 0xFFBEF798, 0xFFBEF794, 0) = 0 1548/1: setsockopt(7, 65535, 8192, 0xFFBEF798, 4, 0) = 0 1548/1: fcntl(7, F_SETFL, 0x00000082) = 0 1548/1: fcntl(7, F_SETFD, 0x00000001) = 0 AF_INET client connected from 10.1.1.1, port 38896 1548/1: write(2, " A F _ I N E T c l i e".., 55) = 55 io.c: Preparing fd 7 for reading 1548/1: write(2, " i o . c : P r e p a r".., 33) = 33 1548/1: time() = 1028722460 1548/1: poll(0xFFBEFB30, 3, 100) = 1 1548/1: read(7, " < 1 3 > A u g 7 0".., 2049) = 2049 1548/1: Incurred fault #6, FLTBOUNDS %pc = 0xFF141D00 1548/1: siginfo: SIGSEGV SEGV_MAPERR addr=0x3103F700 1548/1: Received signal #11, SIGSEGV [default] 1548/1: siginfo: SIGSEGV SEGV_MAPERR addr=0x3103F700 1548/1: *** process killed *** **** syslog-ng.conf from central logging host: options { sync(0); time_reopen(10); log_fifo_size(1000); keep_hostname(yes); use_dns(yes); use_fqdn(no); use_time_recvd(yes); gc_idle_threshold(1000); }; source ng_local { internal(); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); }; source remote { tcp(ip("10.1.1.10") port(5514)); }; destination ng_messages { file("/var/log/syslog-ng" owner(root) group(staff) perm(0440) create_dirs(yes) dir_perm(0755)); }; destination local_messages { file("/var/adm/messages" owner(root) group(staff) create_dirs(yes) dir_perm(0755)); }; destination remote_messages { file("/logfiles/$MONTH_$DAY_$YEAR/$HOST/messages" owner(root) group(corenet) perm(0440) create_dirs(yes) dir_perm(0755)); }; log { source(ng_local); destination(ng_messages); }; log { source(local); destination(local_messages); }; log { source(remote); destination(remote_messages); }; **** syslog-ng.conf from collection hosts: options { sync(0); time_reopen(10); log_fifo_size(2000); keep_hostname(yes); use_fqdn(no);}; source ng_local { internal(); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); }; source remote { udp(ip("10.1.1.1") port(514)); tcp(ip("10.1.1.1") port(5514)); }; destination ng_messages { file("/var/log/syslog-ng" owner(root) group(staff) create_dirs(yes) dir_perm(0755)); }; destination local_messages { file("/var/adm/messages" owner(root) group(staff) create_dirs(yes) dir_perm(0755)); }; destination remote_messages { tcp("10.1.1.10" port(5514)); }; log { source(ng_local); destination(ng_messages); }; log { source(local); destination(local_messages); }; log { source(remote); destination(remote_messages); };

2 1

Re: syslog-ng bug?
by Balazs Scheidler 07 Aug '02

07 Aug '02

On Tue, Aug 06, 2002 at 03:03:51PM -0500, Dustin Trammell wrote: > Did you ever get a chance to take a look at this? I've looked into it. and it's not a bug, it's a feature :) so syslog-ng sets restrictive permissions of files by default which behaviour can be changed. use options { owner(logsystem); group(staff); }; if you want syslog-ng not to touch owner/group/permissions use the following: options { owner("-1") group("-1"); perm("-1"); }; the quotation marks are currently necessary as syslog-ng expects to find a string there (which is not a number) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Silly Scam #766 - 1 msg
by Christopher_Leonardos＠interliant.com 05 Aug '02

05 Aug '02

I hope everyone is aware, that this is a silly scam. Originally started by some people in Nigeria, this appears to be the "south african" version of the same old scam. Regards, Christopher Leonardos Security Engineer Interliant Inc. 12 Gill Street Woburn, MA 01801 781-756-3761 781-756-3737 FAX christopher_leonardos(a)interliant.com

1 0

information
by 4u2glamour＠justice.com 04 Aug '02

04 Aug '02

1 0