- syslog-ng - lists.balabit.hu

business offer
by khumalo maka 03 Aug '02

03 Aug '02

INVESTMENT REQUEST Compliment of the season! It is indeed my pleasure to write to you this letter, which i believe, will be a big surprise as we are both complete strangers. I work for the Ministry of Minerals and Energy in South Africa, and by this letter I am representing and also acting on behalf of two of my senior colleague (The Director General and The Group General Manager) whose mandate I have got to contact a trusted and reliable foreign based businessman, concerning the business matter of mutual benefit to all. By this mandate given to me, we are in dire need of a foreign partner to assist us in the transfer/investment of USD 15,00,000,00. (fifteen Million, United States Dollars). The key issues are the transfer and the subsequent investment of the said sum. We are ready to go into an agreement with you and also offer you a negotiable fee for putting together an investment portfolio. It does not matter whether or not you own a company or you have invested funds before. We shall guide you on what to do. The basis will be that a major company won a contract and subcontracted it to you. More often, big trading companies and firms of unrelated field win contracts and subcontracts to more specialized firms for execution. We shall follow strictly all the legal procedures entailed in our laws and international laws in transferring the funds to you. The source of the funds is legitimate and authoritative. Please, be informed that under the South Africa Government monetary policy, strategic positioned government officials are not allowed to operate or own bank account overseas, hence our need for a foreign partner to front for us. We pray that you take the essence of this letter in strict confidence, as the two officials involved would not like to be exposed on this. Kindly notify me via my e-mail, upon you acceptance to assist us. Further details will be made available to you as soon as you reply. We shall provide you with our confidential phone and fax number, once there is positive response from you. Thank you and God bless, as we wait for your urgent response Best Regards. ENGR. KHUMALO MAKA

1 0

syslog-ng 1.4.x troubles : 2nd post
by archi2k＠altern.org 01 Aug '02

01 Aug '02

Please CC me, I'm not subscribed to the list. Okay, to try to isolate the problem shown on my previous post, here is what I did : <snip /etc/init.d/syslog-ng> case "$1" in start) echo -n "Starting system logging: syslog-ng" #start-stop-daemon --start --quiet --exec /usr/local/sbin/syslog-ng strace -f syslog-ng > /var/log/syslog-ng.strace 2>&1 & echo -n " klogd" start-stop-daemon --start --quiet --exec /sbin/klogd -- $KLOGD echo "." ;; </snip> And guess what : when I run syslog-ng thru strace it works!! @#[|%!! Ie when I boot the box syslog-ng is not blocked any more. I finally found a way to make it actually work by not using start-stop-daemon : <snip> #start-stop-daemon --start --quiet --exec /usr/local/sbin/syslog-ng #strace -f syslog-ng > /var/log/syslog-ng.strace 2>&1 & /usr/local/sbin/syslog-ng </snip> simpler! But why?!? ciao

3 3

RE: [syslog-ng]Installing on a non-compiler system
by Lightfoot.Michael 01 Aug '02

01 Aug '02

Thanks for all the replies to my above query. I think that for a few systems, making a Solaris package has too much overhead, but the simple idea of setting DESTDIR and using tar seems fairly efficient (and will work!) > make DESTDIR=/tmp/syslog-ng-bin/ install > > it will install using /tmp/syslog-ng-bin/ as root. tar the > directory and > untar it on your production server relative to root. > > -- > Bazsi NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries.

1 0

syslog-ng 1.4.x troubles
by archi2k＠altern.org 31 Jul '02

31 Jul '02

Please CC me, I'm not subscribed to the list. I have a very annoying problem with 1.4.x (not tried 1.5.x). I run syslog-ng on several boxes from a long time. All these boxes are debian potato or woody. syslog-ng 1.4.x compiled by hand. Here is the pb : Sometimes, syslog-ng stops logging. When this happens, some of the services running on the box stop working. If I issue a netstat on the box, here is what I got : Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State I-Node Path unix 0 [ ACC ] STREAM LISTENING 115 /tmp/mysql.sock unix 0 [ ACC ] STREAM LISTENING 57 /dev/log unix 1 [ ] STREAM CONNECTED 128 @0000000b unix 1 [ ] STREAM CONNECTED 228 @0000000f unix 1 [ ] STREAM CONNECTED 176 @0000000e unix 1 [ ] STREAM CONNECTED 60 @00000001 unix 1 [ ] STREAM CONNECTED 78 @00000004 unix 1 [ ] STREAM CONNECTED 87 @00000005 unix 1 [ ] STREAM CONNECTED 92 @00000007 unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTED 62 /dev/log As you can see, lots of /dev/log sock in the "CONNECTING" state. Sometimes, I have 100 like this ;o) Processes like stunnel then refuse to work. I have to kill -9 syslog-ng and then restart it. For some boxes I have to do that manually each time I boot the box. Any clue? Here is, for one of my boxes, its syslog-ng.conf. # syslog-ng configuration file. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log" max-connections(210)); internal(); file("/proc/kmsg"); }; destination authlog { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/authlog"); }; destination daemon { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/daemon"); }; destination kern { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/kernel"); }; destination maillog { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/maillog"); }; destination messages { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/messages"); }; destination secure { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/secure"); }; destination wtmp { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/wtmp"); }; destination cron { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/cron"); }; destination ftp { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/ftp"); }; destination errors { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/errors"); usertty("root"); }; destination alert { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/alert"); usertty("root"); }; destination notice { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/notice"); }; destination emergency { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/emergency"); usertty(*); }; filter f_kern { facility(kern); }; filter f_syslog { facility(syslog); }; filter f_user { facility(user); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_xferlog { facility(ftp); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_kernel { facility(kern); }; filter f_debug { level(debug); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_alert { level(alert); }; filter f_emerg { level(emerg); }; filter f_err { level(err); }; #log { source(s_sys); destination(d_amethyste_file); }; log { source(s_sys); filter(f_kern); filter(f_debug); destination(messages); }; log { source(s_sys); filter(f_user); filter(f_info); destination(messages); }; log { source(s_sys); filter(f_syslog); filter(f_info); destination(messages); }; log { source(s_sys); filter(f_auth); filter(f_info); destination(authlog); }; log { source(s_sys); filter(f_authpriv); filter(f_debug); destination(secure); }; log { source(s_sys); filter(f_cron); filter(f_info); destination(cron); }; log { source(s_sys); filter(f_daemon); filter(f_info); destination(daemon); }; log { source(s_sys); filter(f_xferlog); filter(f_info); destination(ftp); }; log { source(s_sys); filter(f_mail); filter(f_info); destination(maillog); }; log { source(s_sys); filter(f_kern); destination(kern); }; log { source(s_sys); filter(f_err); destination(errors); }; log { source(s_sys); filter(f_alert); destination(alert); }; log { source(s_sys); filter(f_notice); destination(notice); }; log { source(s_sys); filter(f_auth); filter(f_debug); destination(alert); }; log { source(s_sys); filter(f_emerg); destination(emergency); }; Cheers, a2k

1 0

FW: UNSTABLE syslog-ng 1.4.15 + redhat-7.3
by _/CaT\_ 31 Jul '02

31 Jul '02

After Core's dump problem I've got another with FREE-BSD 4.6, I'm still waiting for an helping hand ;). I tried to install syslog-ng 1.4.15 on a redhat-7.3 system but it's Unstable without CORE Dump File. The attachment is the debug's backtrace with installed packets and configuration files... Another question, the last, what is the most STABLE version of REDHAT or FreeBDS I'd use?? Thnks. _/CaT\_ PS: If I succeed in my syslog-server Mission when you'll come to Rome (Caput Mundi), I 'll offer you the real pizza with a real red wine to "ZOZZONE's" --- gcc version 2.96 20000731 (Red Hat Linux 7.3 2.96-110) flex version 2.5.4 (rpm flex-2.5.4a-23) bison (GNU Bison) 1.35 (rpm bison-1.35-1) yacc 1.9 (rpm byacc-1.9-19) scsh-0.6.2 libol-0.2.23 syslog-ng-1.4.15 --- GNU gdb Red Hat Linux (5.2-2) Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux"... (gdb) run -v Starting program: /usr/local/sbin/syslog-ng -v binding fd 5, inetaddr: 0.0.0.0, port: 514 Program received signal SIGTERM, Terminated. 0x420b4ae7 in pause () from /lib/i686/libc.so.6 (gdb) bt #0 0x420b4ae7 in pause () from /lib/i686/libc.so.6 #1 0x08049d0d in go_background () #2 0x08049e93 in main () #3 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6 ---- ######################################################################## ## options { long_hostnames(off); keep_hostname(no); sync(0); use_dns(no); log_fifo_size(1000); gc_idle_threshold(100); gc_busy_threshold(3000); }; ######################################################################## ## source src { internal(); udp(ip(0.0.0.0) port(514)); }; ######################################################################## ### ###Destination #Sorting degl'hosts # destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(mspns) perm(0644) dir_perm(0700) create_dirs(yes)); }; # destination all { file("/var/log/all.log" owner(root) group(mspns) perm(0644)); }; # destination send_trap_prova { program("/usr/local/script/syslogtrapper_test"); }; # ######################################################################## #### ####Filtering # filter f_prova { host ("10.11.5.37") and not match ("message repeated"); }; # ######################################################################## ##### ###Logging # log { source(src); destination(hosts); }; # log { source(src); destination(all); }; # log { source(src); filter(f_prova); destination(send_trap_prova); }; # ######################################################################## ##### # /usr/local/script/syslogtrapper_test # #!/bin/bash while read line do snmptrap -c xxxxxx! 10.11.8.14 .1.3.6.1.4.1.2620.1.1.0 10.11.5.48 6 2 '' .1.3.6.1.4.1.2620.1.1.6 s "prova invio trap V1: $line" done exit

2 6

RE: [syslog-ng]Installing on a non-compiler system
by Lightfoot.Michael 31 Jul '02

31 Jul '02

I should go and eat more often. After returning from a delightfully relaxing lunch (baked vegetables and mug of Soya flat white) and digesting another 4 or 5 pages of Herodotus (Xerxes is just about to attack Greece), I reread my message and realised all I had to do was creat a symlink from /export/home to /usr/local/src and it would all work. I'm still not sure what to do if the DMZ systems don't have make. > # make install > Making install in src > Making install in . > make: Fatal error: Don't know how to make target > `/usr/local/src/syslog-ng-1.4.15/configure.in' > Current working directory /export/home/syslog-ng-1.4.15/src > *** Error code 1 > make: Fatal error: Command failed for target > `install-recursive' Current working directory > /export/home/syslog-ng-1.4.15/src > *** Error code 1 > make: Fatal error: Command failed for target `install-recursive' m. NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries.

2 1

can't log to remote host -- error message in syslog
by Adam Tworkowski 30 Jul '02

30 Jul '02

Hi, I've been having issues logging to a remote server on another segment. I have no issue with logging from machines that are on the same segment as the logging server. I am getting the following error in the error log. Can someone interpret this for me. Thanks. src@hostname syslog-ng[12920]: Error connecting to remote host IF_INET(loghost:514), reattempting in 60 seconds

2 1

RE: [syslog-ng]Installing on a non-compiler system
by Nicholas Berry 30 Jul '02

30 Jul '02

You could build syslog-ng in a Solaris pkg format, but I'm not sure how much of a problem you would have installing the package on your Solaris 2.6 system (might not have a problem if you're up-to-date with the recommended patch cluster). Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. nberry(a)ragingwire.com -----Original Message----- From: Lightfoot.Michael [mailto:Lightfoot.Michael@comcare.gov.au] Sent: Monday, July 29, 2002 8:02 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Installing on a non-compiler system I have built syslog-ng on a development server (Solaris 9) and now wish to install it on another system which doesn't have development tools (it is a fairly standard Solaris 9 installation.) I will also be installing a Solaris 2.6 build on systems in our DMZ which have been hardened and have very little other than the OS. The problem I have struck is that after copying the built source to the target server, "make install" fails with the following error: # make install Making install in src Making install in . make: Fatal error: Don't know how to make target `/usr/local/src/syslog-ng-1.4.15/configure.in' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Any ideas on how I get around this easily? NFS is one option, but will not be for the DMZ systems (and is not used in production on any systems here.) I suppose I could install it on the development server using a filesystem diff before and after trick I have used in the past, but again there are problems doing this with the Solaris 2.6 build (which has to be done on a production server as I don't have a Solaris 2.6 dev machine any more.) Michael Lightfoot Unix Consultant ISG Host Systems Comcare +61 2 62750680 NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Installing on a non-compiler system
by Lightfoot.Michael 30 Jul '02

30 Jul '02

I have built syslog-ng on a development server (Solaris 9) and now wish to install it on another system which doesn't have development tools (it is a fairly standard Solaris 9 installation.) I will also be installing a Solaris 2.6 build on systems in our DMZ which have been hardened and have very little other than the OS. The problem I have struck is that after copying the built source to the target server, "make install" fails with the following error: # make install Making install in src Making install in . make: Fatal error: Don't know how to make target `/usr/local/src/syslog-ng-1.4.15/configure.in' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Any ideas on how I get around this easily? NFS is one option, but will not be for the DMZ systems (and is not used in production on any systems here.) I suppose I could install it on the development server using a filesystem diff before and after trick I have used in the past, but again there are problems doing this with the Solaris 2.6 build (which has to be done on a production server as I don't have a Solaris 2.6 dev machine any more.) Michael Lightfoot Unix Consultant ISG Host Systems Comcare +61 2 62750680 NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries.

1 0

Re: [syslog-ng]Re: problem with truncated kernel logs
by Ron Braley 29 Jul '02

29 Jul '02

No, it's still a problem. rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 07/29/02 11:32AM >>> On Mon, Jul 29, 2002 at 09:48:30AM -0500, Ron Braley wrote: > Bazsi > > Sorry - I forgot to change the subject line! > > No, klogd isn't running in addition to syslog-ng. Just to be sure, I > checked processes, which did show klogd -2 and then shut down the > syslog-ng service. I then checked processes and saw klogd was no longer > running. > > Thanks in advance for your expert advise! hmm. I don't really understand whether your problem is solved, or not? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: problem with truncated kernel logs
by Ron Braley 29 Jul '02

29 Jul '02

Bazsi Sorry - I forgot to change the subject line! No, klogd isn't running in addition to syslog-ng. Just to be sure, I checked processes, which did show klogd -2 and then shut down the syslog-ng service. I then checked processes and saw klogd was no longer running. Thanks in advance for your expert advise! rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 07/29/02 03:03AM >>> On Fri, Jul 26, 2002 at 03:11:10PM -0500, Ron Braley wrote: > Hi bazi. > > We're having a problem with syslog-ng 1.5. It appears to be truncating > our iptables firewall logs. > > The following shows good logs as viewed through dmesg, and actual log > entries as processed by syslog-ng: > > *** Good (dmesg): > IPTABLES TCP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:08:00:20:a7:53:e9:08:00 > SRC=134.129.212.23 DST=134.129.212.30 LEN=48 TOS=0x00 PREC=0x00 TTL=64 > ID=64525 DF > PROTO=TCP SPT=36788 DPT=53 WINDOW=24820 RES=0x00 SYN URGP=0 > > IPTABLES UDP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 > SRC=134.129.214.80 DST=134.129.212.30 LEN=239 TOS=0x00 PREC=0x00 > TTL=127 ID=21813 > PROTO=UDP SPT=138 DPT=138 LEN=219 > > *** Bad (syslog [/var/log/kern]): > Jul 25 16:16:12 smack IPTABLES TCP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:a0:c9:a9:b2:6c:08:00 > SRC=134.129.212.33 DST=134.129.212.30 LEN=60 TOS=0x00 > PREC=0x03NDOW=5840 > > Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:05:01:fECP1389 > > Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:05:01:fb3::0 > SRC=134.12920.134 DST=134.129.212.0 LEN=78 TOS=0x00 > PREC=0xTTL=1272ROTO=UDP SPT=137 DPT=137N=58 Please start a new thread if you send something unrelated to current threads. wrt your problem, are you sure you are not running klogd in addition to syslog-ng? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] 1.5.19 patch for hostname and hpux pipe
by Ron Braley 29 Jul '02

29 Jul '02

Hi bazi. We're having a problem with syslog-ng 1.5. It appears to be truncating our iptables firewall logs. The following shows good logs as viewed through dmesg, and actual log entries as processed by syslog-ng: *** Good (dmesg): IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:08:00:20:a7:53:e9:08:00 SRC=134.129.212.23 DST=134.129.212.30 LEN=48 TOS=0x00 PREC=0x00 TTL=64 ID=64525 DF PROTO=TCP SPT=36788 DPT=53 WINDOW=24820 RES=0x00 SYN URGP=0 IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.80 DST=134.129.212.30 LEN=239 TOS=0x00 PREC=0x00 TTL=127 ID=21813 PROTO=UDP SPT=138 DPT=138 LEN=219 *** Bad (syslog [/var/log/kern]): Jul 25 16:16:12 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:a0:c9:a9:b2:6c:08:00 SRC=134.129.212.33 DST=134.129.212.30 LEN=60 TOS=0x00 PREC=0x03NDOW=5840 Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fECP1389 Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb3::0 SRC=134.12920.134 DST=134.129.212.0 LEN=78 TOS=0x00 PREC=0xTTL=1272ROTO=UDP SPT=137 DPT=137N=58 Can you help, please? Thanks! rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax)

2 1

1.5.19 patch for hostname and hpux pipe
by Trapp, Michael 26 Jul '02

26 Jul '02

hi bazsi, i still see some problems with pipe support on hpux and the pad_size option. the message ist shorter but there is at least 1, sometimes a few additional lines in the log containing useless characters appended to the origin message. a few day's ago i've send you a patch regarding hostname options (check_hostname) would you integrate it into 1.5.20 ? i would appreciate it to find this feature in a future release ... thanx michael

2 1

Probs with RH7.3 and syslog-ng 1.4.15
by Torsten Schuchort 25 Jul '02

25 Jul '02

Hi all, i´ve probs with syslog-ng 1.4.15 and redhat 7.3 90% works well, but the facility kern not, so i have no kernellogging. Have anyone an idea? Greetings Torsten Schuchort

4 4

Fwd: Syslog-ng doesn't parse certain log messages
by Michael Renner 25 Jul '02

25 Jul '02

>Date: Wed, 17 Jul 2002 15:52:32 +0200 >To: syslog-ng(a)lists.balabit.hu >From: Michael Renner <m.renner(a)inode.at> >Subject: Syslog-ng doesn't parse certain log messages > >Hi! > >It seems that our syslog-ng (1.5.18, upgraded from 1.5.14 today) stopped >logging messages from some routers. It seems to be a syslog-ng problem >because the routers don't have anything in common (except that all of them >are ciscos, but completely different hardware/ios versions). Just wanted to let you know that this was caused by UDP-Packets with wrong UDP Checksums, caused by a buggy IOS in one of the routers. "tcpdump -vvv -s0 -X" made this easily visible =) mfg/best regards -- Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at/ Michael Renner - Junior System Engineer m.renner(a)inode.at, Tel.: +43 59999 0 Fax.: +43 59999 6599 Buero Wien - Millennium Tower Handelskai 94-96/43 - A-1200 Wien Buero Graz - Schmiedlstrasse 1 - A-8042 Graz Buero Sbg - Schillerstrasse 30 - A-5020 Salzburg Buero Ibk - Eduard Bodem Gasse 5-7 - A-6020 Innsbruck

1 0

UNSTABLE syslog-ng 1.4.15 + redhat-7.3
by Cataldi Roger 25 Jul '02

25 Jul '02

After Core's dump problem I've got another with FREE-BSD 4.6, I'm still waiting for an helping hand ;). I tried to install syslog-ng 1.4.15 on a redhat-7.3 system but it's Unstable without CORE Dump File. The attachment is the debug's backtrace with installed packets and configuration files... Another question, the last, what is the most STABLE version of REDHAT or FreeBDS I'd use?? Thnks. _/CaT\_ PS: If I succeed in my syslog-server Mission when you'll come to Rome (Caput Mundi), I 'll offer you the real pizza with a real red wine to "ZOZZONE's" --- gcc version 2.96 20000731 (Red Hat Linux 7.3 2.96-110) flex version 2.5.4 (rpm flex-2.5.4a-23) bison (GNU Bison) 1.35 (rpm bison-1.35-1) yacc 1.9 (rpm byacc-1.9-19) scsh-0.6.2 libol-0.2.23 syslog-ng-1.4.15 --- GNU gdb Red Hat Linux (5.2-2) Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux"... (gdb) run -v Starting program: /usr/local/sbin/syslog-ng -v binding fd 5, inetaddr: 0.0.0.0, port: 514 Program received signal SIGTERM, Terminated. 0x420b4ae7 in pause () from /lib/i686/libc.so.6 (gdb) bt #0 0x420b4ae7 in pause () from /lib/i686/libc.so.6 #1 0x08049d0d in go_background () #2 0x08049e93 in main () #3 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6 ---- ########################################################################## options { long_hostnames(off); keep_hostname(no); sync(0); use_dns(no); log_fifo_size(1000); gc_idle_threshold(100); gc_busy_threshold(3000); }; ########################################################################## source src { internal(); udp(ip(0.0.0.0) port(514)); }; ########################################################################### ###Destination #Sorting degl'hosts # destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(mspns) perm(0644) dir_perm(0700) create_dirs(yes)); }; # destination all { file("/var/log/all.log" owner(root) group(mspns) perm(0644)); }; # destination send_trap_prova { program("/usr/local/script/syslogtrapper_test"); }; # ############################################################################ ####Filtering # filter f_prova { host ("10.11.5.37") and not match ("message repeated"); }; # ############################################################################ # ###Logging # log { source(src); destination(hosts); }; # log { source(src); destination(all); }; # log { source(src); filter(f_prova); destination(send_trap_prova); }; # ############################################################################ # # /usr/local/script/syslogtrapper_test # #!/bin/bash while read line do snmptrap -c xxxxxx! 10.11.8.14 .1.3.6.1.4.1.2620.1.1.0 10.11.5.48 6 2 '' .1.3.6.1.4.1.2620.1.1.6 s "prova invio trap V1: $line" done exit

1 0

Re: 1.5.19, pad_size and check_hostname extension
by Balazs Scheidler 24 Jul '02

24 Jul '02

On Mon, Jul 22, 2002 at 07:20:18PM +0200, Trapp, Michael wrote: > hi bazsi, > > i've experienced a problem with the hostname options. > we have several network components sending sl-msg without a hostname. > due to the lack of the hostname syslog.ng interprets the first tag of the message > as a hostname even if it contains [^a-zA-Z-.] > to avoid the substitution of the first tag (we don't want to keep the original name anyway, > chain_hostname = 0, keep_hostname = 0) i extended the config and source with check_hostname. > maybe you could apply the attached patch. it would be great to find this option in future > releases. I've implemented check_hostname differently. It is verified during log parsing so it behaves consistently in all log paths. My patch is attached to this message. > i also tested the pad_size option on my hpux-11.00 and it works ! > well, it took me a few minutes to understand how it should work and how to configure ;-) Index: ChangeLog =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/ChangeLog,v retrieving revision 1.57 diff -u -r1.57 ChangeLog --- ChangeLog 23 Jul 2002 12:08:49 -0000 1.57 +++ ChangeLog 24 Jul 2002 09:27:16 -0000 @@ -1,3 +1,9 @@ +2002-07-24 Balazs Scheidler <bazsi(a)balabit.balabit> + + * src/log.c: implemented check_hostname by verifying whether a + hostname only contains [A-Za-z0-9./@:], the check is triggered if + check_hostname is enabled in global config + 2002-07-23 Balazs Scheidler <bazsi(a)balabit.balabit> * updated INSTALL file to reflect latest OS hints Index: INSTALL =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/INSTALL,v retrieving revision 1.11 diff -u -r1.11 INSTALL --- INSTALL 23 Jul 2002 12:08:49 -0000 1.11 +++ INSTALL 24 Jul 2002 09:27:16 -0000 @@ -123,11 +123,12 @@ ---------------------- AIX does support STREAMS, but its log transport doesn't use it. As it - seems /dev/log is a simple unix socket, though I can't find out whether - it uses SOCK_DGRAM or SOCK_STREAM semantics. + seems /dev/log is a simple SOCK_DGRAM type unix socket, so it works using: + + source stdlog { unix-dgram("/dev/log"); }; HP-UX (HP-UX 11.0) - ------------------------ + ------------------ HP-UX uses a named pipe called /dev/log for log transport, and you can use this with the pipe() driver with an additional option. HP-UX pads Index: src/affile.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/affile.c,v retrieving revision 1.51 diff -u -r1.51 affile.c --- src/affile.c 18 Jul 2002 13:18:01 -0000 1.51 +++ src/affile.c 24 Jul 2002 09:27:16 -0000 @@ -162,7 +162,7 @@ if (do_open_file(self->name, flags, -1, -1, -1, -1, -1, -1, 0, &fd)) { lseek(fd, 0, SEEK_END); self->src = io_read(make_io_fd(cfg->backend, fd, ol_string_use(self->name)), - make_log_reader(0, self->prefix, cfg->log_msg_size, self->pad_size, c), + make_log_reader(0, self->prefix, cfg->log_msg_size, self->pad_size, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, c), NULL); self->res = REMEMBER_RESOURCE(cfg->resources, &self->src->super.super); return ST_OK | ST_GOON; Index: src/afinet.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/afinet.c,v retrieving revision 1.19 diff -u -r1.19 afinet.c --- src/afinet.c 18 Jul 2002 13:18:01 -0000 1.19 +++ src/afinet.c 24 Jul 2002 09:27:16 -0000 @@ -89,13 +89,13 @@ notice("AF_INET client connected from %S, port %i\n", inet->ip, inet->port); io_read(self->client, - make_log_reader(0, NULL, cfg->log_msg_size, 0, c), + make_log_reader(0, NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, c), make_afsocket_source_close_callback(self)); } else { /* SOCK_DGRAM */ io_read(self->client, - make_log_reader(1, NULL, cfg->log_msg_size, 0, c), + make_log_reader(1, NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, c), make_afsocket_source_close_callback(self)); } Index: src/afstreams.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/afstreams.c,v retrieving revision 1.13 diff -u -r1.13 afstreams.c --- src/afstreams.c 26 Apr 2002 09:43:54 -0000 1.13 +++ src/afstreams.c 24 Jul 2002 09:27:16 -0000 @@ -145,7 +145,7 @@ length = eol - bol; if (length) { - li = make_log_info(length, bol, NULL); + li = make_log_info(length, bol, NULL, 0); li->pri = pri; HANDLE_LOG(self->pipe, li); } Index: src/afunix.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/afunix.c,v retrieving revision 1.22 diff -u -r1.22 afunix.c --- src/afunix.c 18 Jul 2002 13:18:01 -0000 1.22 +++ src/afunix.c 24 Jul 2002 09:27:16 -0000 @@ -51,7 +51,7 @@ CAST(afsocket_source_connection, self, c); io_read(self->client, - make_log_reader(0, NULL, cfg->log_msg_size, 0, c), + make_log_reader(0, NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, c), make_afsocket_source_close_callback(self)); return ST_OK | ST_GOON; Index: src/cfg-grammar.y =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/cfg-grammar.y,v retrieving revision 1.55 diff -u -r1.55 cfg-grammar.y --- src/cfg-grammar.y 18 Jul 2002 13:18:01 -0000 1.55 +++ src/cfg-grammar.y 24 Jul 2002 09:27:16 -0000 @@ -75,7 +75,7 @@ /* option items */ %token KW_FLAGS KW_CATCHALL KW_FALLBACK KW_FINAL -%token KW_FSYNC KW_MARK_FREQ KW_SYNC_FREQ KW_STATS_FREQ KW_CHAIN_HOSTNAMES KW_KEEP_HOSTNAME +%token KW_FSYNC KW_MARK_FREQ KW_SYNC_FREQ KW_STATS_FREQ KW_CHAIN_HOSTNAMES KW_KEEP_HOSTNAME KW_CHECK_HOSTNAME %token KW_LOG_FIFO_SIZE KW_LOG_MSG_SIZE %token KW_TIME_REOPEN KW_TIME_REAP KW_USE_TIME_RECVD %token KW_USE_DNS KW_USE_FQDN KW_GC_BUSY_THRESHOLD @@ -574,6 +574,7 @@ | KW_STATS_FREQ '(' NUMBER ')' { configuration->stats_freq = $3; } | KW_CHAIN_HOSTNAMES '(' yesno ')' { configuration->chain_hostnames = $3; } | KW_KEEP_HOSTNAME '(' yesno ')' { configuration->keep_hostname = $3; } + | KW_CHECK_HOSTNAME '(' yesno ')' { configuration->check_hostname = $3; } | KW_USE_TIME_RECVD '(' yesno ')' { configuration->use_time_recvd = $3; } | KW_USE_FQDN '(' yesno ')' { configuration->use_fqdn = $3; }; | KW_USE_DNS '(' yesno ')' { configuration->use_dns = $3; }; Index: src/cfg-lex.l =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/cfg-lex.l,v retrieving revision 1.24 diff -u -r1.24 cfg-lex.l --- src/cfg-lex.l 18 Jul 2002 13:18:02 -0000 1.24 +++ src/cfg-lex.l 24 Jul 2002 09:27:16 -0000 @@ -60,6 +60,7 @@ { "use_time_recvd", KW_USE_TIME_RECVD }, { "use_fqdn", KW_USE_FQDN }, { "use_dns", KW_USE_DNS }, + { "check_hostname", KW_CHECK_HOSTNAME }, { "gc_threshold", KW_GC_BUSY_THRESHOLD }, { "gc_busy_threshold", KW_GC_BUSY_THRESHOLD }, { "gc_idle_threshold", KW_GC_IDLE_THRESHOLD }, Index: src/cfgfile.h =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/cfgfile.h,v retrieving revision 1.23 diff -u -r1.23 cfgfile.h --- src/cfgfile.h 26 Apr 2002 09:43:54 -0000 1.23 +++ src/cfgfile.h 24 Jul 2002 09:27:16 -0000 @@ -56,6 +56,7 @@ (use_time_recvd simple UINT32) (use_fqdn simple UINT32) (use_dns simple UINT32) + (check_hostname simple UINT32) (create_dirs simple UINT32) (uid simple int) (gid simple int) Index: src/log.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/log.c,v retrieving revision 1.26 diff -u -r1.26 log.c --- src/log.c 26 Apr 2002 09:43:54 -0000 1.26 +++ src/log.c 24 Jul 2002 09:27:16 -0000 @@ -161,6 +161,15 @@ while (left && *src != ' ' && *src != ':' && *src != '[') { + if (lm->flags & LF_CHECK_HOSTNAME && + !((*src >= 'A' && *src <= 'Z') || + (*src >= 'a' && *src <= 'z') || + (*src >= '0' && *src <= '9') || + *src == '-' || *src == '_' || + *src == '.' || *src == ':' || + *src == '@' || *src == '/')) { + break; + } src++; left--; } @@ -256,11 +265,12 @@ } } -struct log_info *make_log_info(UINT32 length, UINT8 *msg, UINT8 *prefix) +struct log_info *make_log_info(UINT32 length, UINT8 *msg, UINT8 *prefix, UINT32 flags) { struct log_info *self; NEW_SPACE(self); + self->flags = flags & LF_USER_FLAGS; parse_log_msg(self, length, msg, prefix); self->use_cnt = 1; self->recvd = time(NULL); Index: src/log.h =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/log.h,v retrieving revision 1.17 diff -u -r1.17 log.h --- src/log.h 26 Apr 2002 09:43:54 -0000 1.17 +++ src/log.h 24 Jul 2002 09:27:16 -0000 @@ -56,6 +56,9 @@ #define LF_INTERNAL 0x0001 #define LF_MARK 0x0002 #define LF_LOCAL 0x0004 +#define LF_CHECK_HOSTNAME 0x0100 + +#define LF_USER_FLAGS 0xff00 /* CLASS: (class @@ -86,7 +89,7 @@ struct log_info *log_info_use(struct log_info *msg); void log_info_free(struct log_info *msg); -struct log_info *make_log_info(UINT32 length, UINT8 *data, UINT8 *prefix); +struct log_info *make_log_info(UINT32 length, UINT8 *data, UINT8 *prefix, UINT32 flags); struct log_info *make_internal_message(UINT32 pri, UINT32 length, UINT8 *data); struct log_info *make_mark_message(void); Index: src/sources.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/sources.c,v retrieving revision 1.34 diff -u -r1.34 sources.c --- src/sources.c 18 Jul 2002 13:18:02 -0000 1.34 +++ src/sources.c 24 Jul 2002 09:27:16 -0000 @@ -53,6 +53,7 @@ (buffer space UINT8) (max_log_line simple UINT32) (pad_size simple UINT32) + (msg_flags simple UINT32) (next object log_handler))) */ @@ -64,7 +65,7 @@ { struct log_info *logmsg; - logmsg = make_log_info(length, data, self->prefix); + logmsg = make_log_info(length, data, self->prefix, self->msg_flags); if (addrlen) { logmsg->saddr = sockaddr2address_info(addrlen, addr); } @@ -150,6 +151,7 @@ UINT8 *prefix, UINT32 max_log_line, UINT32 pad_size, + UINT32 msg_flags, struct log_handler *next) { NEW(log_reader, self); @@ -160,6 +162,7 @@ self->prefix = prefix; self->max_log_line = MAX(max_log_line, pad_size) + 1; self->pad_size = pad_size; + self->msg_flags = msg_flags; self->buffer = ol_space_alloc(max_log_line); return &self->super; Index: src/sources.h =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/sources.h,v retrieving revision 1.15 diff -u -r1.15 sources.h --- src/sources.h 18 Jul 2002 13:18:02 -0000 1.15 +++ src/sources.h 24 Jul 2002 09:27:16 -0000 @@ -65,6 +65,7 @@ UINT8 *prefix, UINT32 max_log_line, UINT32 pad_size, + UINT32 msg_flags, struct log_handler *next); struct log_source_group *make_source_group(const char *name, struct log_source_driver *drvs); -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]Installing syslog-ng in AIX 4.3.3
by Deepu George 23 Jul '02

23 Jul '02

Thanks Bazsi . The libol part worked. Now when installing syslog-ng I am getting the following error when doing a make. I removed -Wall here also. cc -DHAVE_CONFIG_H -I. -I/data8/security/syslog-ng-1.4.15/src -I. -O 2 -I/usr/local/include/libol -D_GNU_SOURCE -c center.c "center.c", line 109.9: 1506-046 (S) Syntax error. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 2. Best regards Deepu -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, July 22, 2002 5:25 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Installing syslog-ng in AIX 4.3.3 On Sat, Jul 20, 2002 at 12:51:42PM +0100, Deepu George wrote: > Hi All, > > I am trying to install syslog-ng in AIX 4.3.3. The > compiler I am using is C++ for AIX 5. I am getting the > following error when running make while installing > libol. Attached is the error > > > Target "all" is up to date. > Making all in src > cd .. && CONFIG_FILES= > CONFIG_HEADERS=src/olconfig.h /bin/sh ./config.status > creating src/olconfig.h > src/olconfig.h is unchanged > /bin/sh ../libtool --mode=compile cc > -DHAVE_CONFIG_H -I. -I/data8/security/libol-0.2.23/src > -I. -D_GNU_SOURCE -Wall -O2 -c format.c > cc -DHAVE_CONFIG_H -I. > -I/data8/security/libol-0.2.23/src -I. -D_GNU_SOURCE > -Wall -O2 -c -DPIC format.c -o format.lo > cc: 1501-210 command option Wall contains an incorrect > subargument syslog-ng has only been tested to compile using gcc the problem here is that your compiler doesn't understand -Wall, this very problem can be solved by removing -Wall from the generated Makefile -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html DISCLAIMER: Information contained and transmitted by this E-MAIL is proprietary to Mascot Systems Limited and is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If this is a forwarded message, the content of this E-MAIL may not have been sent with the authority of the Company. If you are not the intended recipient, an agent of the intended recipient or a person responsible for delivering the information to the named recipient, you are notified that any use, distribution, transmission, printing, copying or dissemination of this information in any way or in any manner is strictly prohibited. If you have received this communication in error, please delete this mail & notify us immediately at Mailadmin(a)mascotsystems.com Before opening attachments, please scan for viruses.

3 9

Forwarding syslog messages to multiple UDP destination.
by Subodh Nijsure 22 Jul '02

22 Jul '02

Hello, I am trying to forward syslog messages to multiple IP destination, I tried using statements like destination udp_forw { udp("192.168.58.150", port(514)); udp("192.168.19.1", port(514)); }; And it doesn't work, it forwards messages to first destination, is this supposed to work the way I have put config statement? /Subodh Nijsure

2 1

(no subject)
by Deepu George 22 Jul '02

22 Jul '02

Thanks Bazsi . The libol part worked. Now when installing syslog-ng I am getting the following error when doing a make. I removed -Wall here also. cc -DHAVE_CONFIG_H -I. -I/data8/security/syslog-ng-1.4.15/src -I. -O 2 -I/usr/local/include/libol -D_GNU_SOURCE -c center.c center.c, line 109.9: 1506-046 (S) Syntax error. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 2. Best regards Deepu ________________________________________________________________________ Want to sell your car? advertise on Yahoo Autos Classifieds. It's Free!! visit http://in.autos.yahoo.com

1 0

RE: [syslog-ng]Solaris 8 + syslog-ng-1.5.18
by Sangbutsarakum, Patai 22 Jul '02

22 Jul '02

If so, how can I allow/deny syslog connection as tcpwrapper did.? Is there any filter? please suggest. Pat. -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, July 19, 2002 16:18 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Solaris 8 + syslog-ng-1.5.18 On Fri, Jul 19, 2002 at 12:50:55PM +0400, Borsenkow Andrej wrote: > > > > > you enabled tcp wrapper support, and the configure script didn't > detect > > -lwrap, you might want to change the generated Makefile, and add > -lwrap to > > LDFLAGS > > > > Should not configure disable tcp_wrappers if -lwrap was not found? Or, > better, if needed functions are missing? it should, however as I don't use tcp wrappers at all, configure checks for the tcp wrapper has some problems. I've just commited a change, which should help some: Index: configure.in =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/configure.in,v retrieving revision 1.51 retrieving revision 1.52 diff -u -r1.51 -r1.52 --- configure.in 18 Jul 2002 13:18:01 -0000 1.51 +++ configure.in 19 Jul 2002 09:15:33 -0000 1.52 @@ -196,10 +196,13 @@ AC_MSG_CHECKING(whether to enable TCP wrapper support) if test "x$enable_tcp_wrapper" = "xyes"; then - if test "x$ac_cv_header_tcpd_h" = "xyes"; then + if test "x$ac_cv_header_tcpd_h" = "xyes" -a "x$blb_cv_c_lwrap" = "xyes"; then AC_DEFINE(ENABLE_TCP_WRAPPER) enable_tcp_wrapper=yes AC_MSG_RESULT(yes) + else + AC_MSG_RESULT(no) + enable_tcp_wrapper=no fi else AC_MSG_RESULT(no) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

Installing syslog-ng in AIX 4.3.3
by Deepu George 22 Jul '02

22 Jul '02

Hi All, I am trying to install syslog-ng in AIX 4.3.3. The compiler I am using is C++ for AIX 5. I am getting the following error when running make while installing libol. Attached is the error Target "all" is up to date. Making all in src cd .. && CONFIG_FILES= CONFIG_HEADERS=src/olconfig.h /bin/sh ./config.status creating src/olconfig.h src/olconfig.h is unchanged /bin/sh ../libtool --mode=compile cc -DHAVE_CONFIG_H -I. -I/data8/security/libol-0.2.23/src -I. -D_GNU_SOURCE -Wall -O2 -c format.c cc -DHAVE_CONFIG_H -I. -I/data8/security/libol-0.2.23/src -I. -D_GNU_SOURCE -Wall -O2 -c -DPIC format.c -o format.lo cc: 1501-210 command option Wall contains an incorrect subargument make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Stop. Best regards Deepu ________________________________________________________________________ Want to sell your car? advertise on Yahoo Autos Classifieds. It's Free!! visit http://in.autos.yahoo.com

2 1

Conf. syntax error?
by Gruber Zsolt 19 Jul '02

19 Jul '02

Hi, i would like to set up the syslog-ng, but by starting it, I get always syntax error messages for the first line of the config file. (it is independent from the containt of the 1. line) I made a very simly version: options { chain_hostnames(no); sync(0); }; but I got syntax error again : ... syslog-ng.conf: line 1 : syntax error near unexpected token `chains_hostnames(n' ... syslog-ng.conf: line 1 : `options { chain_hostnames(no); sync(0); };' What made I wrong? ( the syslog-ng 1.4.15 and the libol 0.2.23 was compiled from the source without errors) regards Zsolt

2 1

Solaris 8 + syslog-ng-1.5.18
by Sangbutsarakum, Patai 19 Jul '02

19 Jul '02

Dear friends, Anyone success to compile syslog-ng-1.5.18 on Solaris 8. I've try to search from mailing list, I've add stdio.h to cfg-grammar.c already (otherwise, error in make time) But after I passed that error. I still faced with the below error. Please suggest me to deal with the below error messages. Thanks in advance Pat. [..snipped..] D_GNU_SOURCE -c getopt.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c getopt1.c gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor -ll /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file request_init afinet.o sock_host afinet.o hosts_access afinet.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive

4 4

syslog-ng 1.5.19 released
by Balazs Scheidler 19 Jul '02

19 Jul '02

syslog-ng 1.5.19 has been released: News for the 1.5.19 release Thu, 18 Jul 2002 15:16:37 +0200 * Fixed a compile problem, which prevented non-debug compiles (stdio.h in cfg-grammar.y) * initial support for padded pipe sources (used on HP-UX /dev/log) * Other minor fixes it is available at http://www.balabit.hu/en/downloads/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0