- syslog-ng - lists.balabit.hu

syslog-ng-1.4.0rc3: How to log the domainname
by Joakim Rastberg 03 Mar '00

03 Mar '00

Hi! I just downloaded, installed, configured and ran syslog-ng-1.4.0rc3 and everything looks great! I have just a small question that doesn't get answered in the archive at http://lists.balabit.hu/pipermail/syslog-ng/: How do I get the domainname of the hosts into the logs? I ask this as I collect syslogs from several nameservers for different domains who all have the hostname "ns". One way would be to log the orginating IP-address, but I can't find out how to do that if the host is found in DNS (like -n in netstat would be fine) A cursory look in sources.c around line 157 gives that the code *removes* the domainname but I can't understand why this not is a configurable option. % uname -a SunOS syslog 5.7 Generic_106541-09 sun4m sparc SUNW,SPARCstation-20 % cat /etc/syslog-ng/syslog-ng.conf source stdlog { udp(); }; source local {sun-streams("/dev/log" door("/etc/.syslog_door"));internal();}; destination auto { file("/var/log/$HOST.$FACILITY"); }; log { source(stdlog);source(local); destination(auto); }; /Joakim Rastberg, IT-Security Conslutant. -- "Pioneer Preference" status and "Holder of Past Knowledge" in the DNRC.

2 1

m4?
by mgx＠spruce.lsd.ornl.gov 03 Mar '00

03 Mar '00

good day ... i'm trying to compile the stable version 1.4.0 on solaris 2.6 (SunOS avatar.lsd.ornl.gov 5.6 Generic_105181-11 sun4u sparc SUNW,Ultra-5_10) and i get this error: 40 root@avatar /usr/local/syslog-ng-1.4.0> make Making all in src make[1]: Entering directory `/usr/local/syslog-ng-1.4.0/src' cd /usr/local/syslog-ng-1.4.0 && autoheader Autoconf requires GNU m4 1.1 or later make[1]: *** [/usr/local/syslog-ng-1.4.0/src/stamp-h.in] Error 1 while my version of m4 is: 41 root@avatar /usr/local/syslog-ng-1.4.0> m4 --v GNU m4 1.4 did i miss something simple here? i searched the archives and cannot any reference to this problem. -- -- michael

1 1

syslog-ng 1.4.0 released
by Balazs Scheidler 03 Mar '00

03 Mar '00

Hi, I've finally released 1.4.0 as stable fixing all the bugs you have reported. It should work out of the box on Solaris (I've fixed a configure.in test), and HP-UX (fixed pipe support). You can find it at the usual place: http://www.balabit.hu/products/syslog-ng/ Please tell me if you encounter any problems. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: [syslog-ng] message numbers
by Terje Krogdahl 03 Mar '00

03 Mar '00

Balazs Scheidler <bazsi(a)balabit.hu> writes: > what is this message number? A serial number? Actually it is a sequence number. I see it when my Cisco routers log via syslog. The number is incremented by one every time a router sends a syslog message. Very useful to detect missing log entries, among other things. Here's a hex dump of a complete packet, in case this helps clear things up: 0: 0800 2083 600e 0000 0c76 bf10 0800 4500 .. .`....v....E. 16: 0094 0182 0000 fe11 1690 8243 4ffc 8243 ...........CO..C 32: 4fc4 1ac4 0202 0080 302f 3c31 3930 3e33 O.......0/<190>3 48: 3536 313a 2046 6562 2032 3620 3232 3a33 561: Feb 26 22:3 64: 393a 3138 2e32 3132 3a20 2553 4543 2d36 9:18.212: %SEC-6 80: 2d49 5041 4343 4553 534c 4f47 503a 206c -IPACCESSLOGP: l 96: 6973 7420 3132 3020 6465 6e69 6564 2074 ist 120 denied t 112: 6370 cp ... which produces the following syslog message. Note that I have removed the hostname and part of the message stating IP addresses. Feb 26 22:33:46 xxxxxxx.xx.telenor.net 3561: Feb 26 22:39:18.212: %SEC-6-IPACCESSLOGP: list 120 denied tcp... Syslog-ng is running under Solaris 2.6. -- Terje Krogdahl Nextra AS - I don't buy from spammers.

4 6

Re: syslog-ng, file source driver
by Balazs Scheidler 01 Mar '00

01 Mar '00

On Wed, Mar 01, 2000 at 11:51:58AM -0800, Alex Schlessinger wrote: > > > > > > what am i doing or understanding incorrectly? > > > > The file source driver is meant to be used on special files like /proc/kmsg. > > If you want to forward the contents of a real file, you could write a simple > > script like: > > > > tail -f <logfile> | logger -p local5.info > > understood, this is basically what i ended up doing. > > however, the documentation is misleading.. > > http://www.balabit.hu/products/syslog-ng/doc/reference.html#AEN303 > > "Of course using this driver you are not limited to special files, you can as well read a > continuosly growing simple file, and syslog-ng will "follow" appended lines, > just like tail -f does." ops, this is a docbug. earlier syslog-ng was able to do this, but this maxed out CPU usage. It is not possible to decide whether new data arrived to a file using poll(), since the main loop uses poll to wait for events, it would be difficult to add this feature. (though not impossible) so for now I corrected the documentation, and leave this feature addition for 1.5.x. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

DOTDOT problem
by Brad Arlt 01 Mar '00

01 Mar '00

Hello.. I am running syslog-ng 1.4.0rc3. I am having a bit of a problem with the '..' operator for priorities. I have a filter : filter authlogs { facility(auth) and priority(emerg..info); }; Error level through info work just fine... but I get nothing above error. However if I expand the '..' I get all the levels between emerg and info. filter authlogs { facility(auth) and priority(emerg,alert,crit,error,warning,notice,info); }; ---- It looks to me like an "array to small" or "counter doesn't go high enough" type problem, but I haven't looked at the source yet (it really is *that* big a deal, its just nice to have to make the config file smaller/prettier) ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_)

2 1

sun-stream problem with syslog-ng on Solaris
by Simon Yang 28 Feb '00

28 Feb '00

Hi folks, I compiled syslog-ng 1.4.0rc2 on Solaris 2.6. When I tried to start syslog-ng, I got the following error: # ./syslog-ng sun-streams support not compiled in (STREAM=/dev/log) Error initializing configuration, exiting. Terminated Did I miss some config parameter when I compiled syslog-ng? Attached is the content of the syslog-ng.conf: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination all { file("/var/log/messages"); }; log { source(local); destination(all); }; Any help will be greatly appreciated.

3 2

message numbers
by Terje Krogdahl 25 Feb '00

25 Feb '00

Hi! I'm in the progress of replacing Suns syslogd with syslog-ng 1.4.0rc2. I'm sure this is an FAQ, but how can I make it include message numbers? With Sun syslogd I get: Feb 23 13:17:58 hostname 1288115: the_message_itself but with syslog-ng I only get: Feb 23 13:17:58 hostname : the_message_itself The number "1288115" is missing, and I cannot figure out how to configure syslog-ng to include it. Unfortunately, I really need this number for post-processing of logs... Any suggestions? -- Terje Krogdahl Nextra AS - I don't buy from spammers.

4 3

syslog-ng 1.4.0rc3
by Balazs Scheidler 25 Feb '00

25 Feb '00

Hi, You'll find rc3 at the usual place (http://www.balabit.hu/products/syslog-ng) Here's my changelog: 2000-02-25 Balazs Scheidler <bazsi(a)balabit.hu> * src/filters.c (do_filter_pri): split this to two functions, priorities are filtered by 8 bits, where the bit position denotes the value of the priority (0-7), at facilities bit position denotes an index to the sl_facilities array, (do_filter_lev): new function, (do_filter_fac) new function * src/cfg-grammar.y: changed the way valid masks are composed for facility/priority filters, display warnings when a priority/facility is unknown, added possibility to select a facility code by number. * src/log.c (parse_log_msg): don't remove programname from the whole message, set programname to "kernel" when a message comes from LOG_KERN facility (needed for SunOS) * src/cfg-lex.l: IDENTIFIER regex fix. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog-ng 1.4.0rc2
by Balazs Scheidler 25 Feb '00

25 Feb '00

Hi, I've released syslog-ng version 1.4.0rc2, fixing all known bugs in previous versions. I've also reorganized the downloads tree, each major version has a distinct directory, and libol was moved up in the directory hierarchy. My website in currently syncing, but as soon as this is completed you'll find 1.4.0rc2 here: http://www.balabit.hu/downloads/syslog-ng/1.4/syslog-ng-1.4.0rc2.tar.gz and libol: http://www.balabit.hu/downloads/libol/0.2/libol-0.2.16.tar.gz -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 3

Re: 1.4.0 rc2 bug
by Balazs Scheidler 23 Feb '00

23 Feb '00

> The .. (DOTDOT) range operator for priority filters seems to be broken with > this release. try this patch: Index: cfg-lex.l =================================================================== RCS file: /home/bazsi/cvs/syslog-ng/src/cfg-lex.l,v retrieving revision 1.8 diff -u -r1.8 cfg-lex.l --- cfg-lex.l 2000/02/22 17:50:29 1.8 +++ cfg-lex.l 2000/02/23 10:24:15 @@ -142,7 +142,7 @@ 0x{digit}+ { yylval.num = strtol(yytext, NULL, 16); return NUMBER; } 0{digit}+ { yylval.num = strtol(yytext, NULL, 8); return NUMBER; } {digit}+ { yylval.num = atoi(yytext); return NUMBER; } -({word}+(\.)?)* { return check_reserved_words(yytext); } +({word}+(\.)?)*{word}+ { return check_reserved_words(yytext); } $ { return '('; } $ { return ')'; } \; { return ';'; } -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Filter troubles
by Brad Arlt 22 Feb '00

22 Feb '00

I am having some difficulty understanding filters. (syslog-ng 1.3.17) I am trying to replicate Solaris's syslog.conf entry: *.err;kern.debug;daemon.notice;auth.err;news.none;user.none as far as I can tell this translates to: filter filname { priority(panic, alert, crit, error) and not facility(user, news); }; which is also the same as filter filname { priority(panic, alert, crit, error) and not facility(user) and not facility(news); }; kern doesn't seem to be logging at all... if I drop facility checking then kern logs.... Any thoughts? Also I noticed that there is a range operator (..) but the above priority(panic, alert, crit, error) does not seem to be the same as priority(panic..error). Am I right in thinking that (..) is broken or am misunderstanding what (..) does. ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_)

6 13

syslog-ng 1.3.17 a.k.a. 1.4.0rc1
by Balazs Scheidler 22 Feb '00

22 Feb '00

Hi, I've released release candidate 1 for 1.4.0 as 1.3.17. I've tried to fix all bugs encountered until now. If you find any showstopper bugs, please tell me about it. http://www.balabit.hu/products/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 3

syslog-ng 1.3.15 compile fails on FreeBSD 3.2R
by George Madden 18 Feb '00

18 Feb '00

I just tried compiling syslog-ng 1.3.15 with libol 0.2.14 on a FreeBSD 3.2R box and it fails with the following: affile.c: In function `do_open_file': affile.c:52: storage size of `st' isn't known affile.c:54: warning: implicit declaration of function `stat' affile.c:55: warning: implicit declaration of function `S_ISDIR' affile.c:61: warning: implicit declaration of function `mkdir' affile.c:52: warning: unused variable `st' *** Error code 1

2 4

syslog-ng 1.3.17
by Brian Johnson 18 Feb '00

18 Feb '00

I just upgraded to syslog-ng 1.3.17 (from 1.3.14), and I noticed that when I kill syslog-ng it doesn't print "syslog-ng going down" in my logs anymore, but it still does print when it's starting, and when I run it with -d and kill it the same way it does print syslog-ng going down on the screen, so there seems to be a problem with the internal logging?

1 0

create_dirs in 1.3.15
by Sam Howard 18 Feb '00

18 Feb '00

Hi. I'm looking at the ChangeLog for 1.3.15, and it mentions "added create_dirs", and "updated documentation", but I cannot find any docs about the new features... What am I missing??? Thanks! Sam Samuel P. Howard Sr. Unix Systems Administrator 2nd Century Communications Voice: 813-901-1280 mailto:sphoward@2c2.com

3 4

RE: [syslog-ng] create_dirs in 1.3.15
by Sam Howard 18 Feb '00

18 Feb '00

I tried something similar, and found that syslog-ng went balistic and was constantly 'stat(/var)' (according to truss). Also, should it create *any* directory it needs? or only ones that are the result of a variable expansion? For example file("/var/log/make/this/directory/$HOST.log"); where only /var/log exists... BTW, I tried this on 1.3.16 (ahh, fresh code!) Thanks, Sam -----Original Message----- From: Chris Scheller [mailto:schelcj@networkone.net] Sent: Thursday, February 17, 2000 6:24 PM To: syslog-ng(a)venus.terrasoft.hu Subject: Re: [syslog-ng] create_dirs in 1.3.15 I can't seem to get create_dirs to work. When i add it to my options and add a destination such as destination test { file("/var/log/syslog-ng/$HOST/$FACILITY"); }; not only does it not create the directories or the files, but syslog-ng stops logging everything all together. Any thoughts? did i miss something in the conf? Chris Scheller System/Network Administration Network One Internet, inc. http://www.networkone.net/ 1.888.GOT-NET1 On Thu, 17 Feb 2000, Balazs Scheidler wrote: > > I'm looking at the ChangeLog for 1.3.15, and it mentions "added > > create_dirs", and "updated documentation", but I cannot find any docs about > > the new features... > > > > What am I missing??? > > The 1.3.15 tarball doc/sgml/syslog-ng.txt file contains this. (or the .html > version) > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Re: syslog-ng stops listen to UDP after "nmap -sU"?
by kent＠unit.liu.se 17 Feb '00

17 Feb '00

kent(a)unit.liu.se (Kent Engström) writes: > Everything worked fine until I decided to portscan the syslog server. > When I did a UDP scan, syslog-ng stopped logging. This is what happens: > *) I execute "nmap -p 514 -sU xxx.yyy.zzz.www" on a Linux box Using options "-v" and "-d", I catch the following: Read EOF on fd 3. Marking fd 3 for closing. Closing fd 3. It appears that libol is the culprit here. It assumes that a returned read length of 0 means end of file, as when reading from a file or a TCP connection. -- Kent Engström, Linköping University Incident Response Team kent(a)unit.liu.se abuse(a)liu.se +46 13 28 1744 UNIT, Linköping University; SE-581 83 LINKÖPING; SWEDEN

2 1

syslog-ng stops listen to UDP after "nmap -sU"?
by kent＠unit.liu.se 17 Feb '00

17 Feb '00

Today, I installed syslog-ng 1.3.15 on Solaris 7. I have the following very simple config file (I am still evaluating syslog-ng): options { use_fqdn(yes); }; source syslog_udp { udp(ip(xxx.yyy.zzz.www) port(514)); }; source syslog_internal { internal(); }; destination syslog_file { file("/somepath/logs/$YEAR-$MONTH-$DAY-$HOST-$FACILITY"); }; log { source(syslog_udp); source(syslog_internal); destination(syslog_file); }; xxx.yyy.zzz.www is a virtual IP-address that is assigned to whatever server that is currently providing syslog service to the rest of the internal network. Everything worked fine until I decided to portscan the syslog server. When I did a UDP scan, syslog-ng stopped logging. This is what happens: *) I start syslog-ng *) I connect to our mail server, and see how the connection is logged in the file /somepath/logs/2000-02-17-mailserver.our.domain-mail *) I run netstat -a and observe the line xxx.yyy.zzz.www.514 Idle *) I execute "nmap -p 514 -sU xxx.yyy.zzz.www" on a Linux box *) I run netstat -a and observe that there is no longer any entry for port 514. *) The syslog-ng process is still running, though. *) I connect to our mail server again. The connection is not logged by syslog-ng. In fact, nothing seems to be logged at all. The packet that is sent by nmap during an "-sU scan" is a UDP packet with zero bytes of data. Obviously, this could be an easy way for a cracker do disable a loghost in preparation for an attack on another host. Can anybody repeat this? -- Kent Engström, Linköping University Incident Response Team kent(a)unit.liu.se abuse(a)liu.se +46 13 28 1744 UNIT, Linköping University; SE-581 83 LINKÖPING; SWEDEN

1 0

unable to use tcp/udp forward.
by User Un 17 Feb '00

17 Feb '00

Hello, I am evaluating syslog-ng as we want TCP ( reliable) syslog message, however, I am unable to comply due to strange "syntax error": destination all { # file( "/tmp/messages"); # ok # tcp( ip( 172.16.32.35) port( 1999)); # nok # udp( ip( 172.16.32.35) port( 514)); # nok udp( 172.16.32.35,514); # nok # usertty( un); # ok # program( "cat >/tmp/messges_cat"); # ok }; all "nok" failed with error like: /net/ts/opt/syslog-ng-1.3.14/sbin/syslog-ng -f /net/ts/opt/syslog-ng-1.3.14/etc/syslog-ng.conf -d -v parse error at 33 Parse error reading configuration file, exiting. I tryed with version 1.3.14 & 1.2.3. Thanks for any help. S.R.

3 2

Syslog stop fordward
by Victor Barahona 17 Feb '00

17 Feb '00

-----BEGIN PGP SIGNED MESSAGE----- Hi I loging a web server to a log-machine so I put the next configuration in the web server: ---------------- options { sync(0); time_reopen(10); log_fifo_size(100); }; source local { sun-stream("/dev/log" door("/etc/.syslog_door")); }; source syslog { internal(); }; source rincon { file("/www/logs/rincon-access.log"); }; destination brezo { tcp("150.244.9.2" port(514)); }; log { source(rincon); destination(brezo); }; ----------------------------------------------- The log-server has this config-file: ----------------------------------------------- options { sync(10); time_reopen(10); log_fifo_size(100); }; source local { internal(); }; source red { tcp(); }; destination rincon { file("/var/log/filer/rincon-access.log"); }; filter rincon { host(limonero) and match(HTTP/1); }; log { source(red); destination(rincon); }; ------------------------------------------------------ When I run with this configuration, te log-server stops to write lines in the file when fifo size is full (I think) so I increase the fifo size to 1000 first and to 150000 later. The destination file grown but seems no be sort by date as the source and finally stops the write lines (but the daemon is OK). Two things: 1)Everytime I run the syslog-ng in the web server, process all the file, instead only the appending lines. Who can I chage this? 2)Why the daemon stops writting in the log-server's file? It's a problem with big files? The origin file is about 8Mb and it grow to 11Mb due the header of the syslog-ng. There is some limit? Thanks -- "Making predictions is difficult, particularly about the future" Niels Bohr ------------------------------------------------------------------------ Victor Barahona..........................http://www.sdi.uam.es/~barahona Soporte Seguridad en red.................http://www.sdi.uam.es/utc/ss Unidad Tecnica de Comunicaciones Universidad Autonoma de Madrid Tlf.- 91 397 5525 PGP ID-0x8750AB79 ------------------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use MessageID: DwGwcnUdWLU9WfN4xS9DVnhJ0deLgA1M iQA/AwUBOKrOekoW8ByHUKt5EQICpgCfWBkBFnAR+/iGjZSTBX8vFqdBBRkAoIpq A9+ShW9YEy1RbygI+P8Yzfyb =6Ii6 -----END PGP SIGNATURE-----

2 1

use_fqdn()
by Graham Thomas 17 Feb '00

17 Feb '00

hi, Just putting together a config file for syslog-ng-1.2.3 on solaris and it doesn't appear to like the line: options { use_fqdn(yes); }; I've tried different options and all numerical ones are excepted ok. Options with accepted values described as 'yes' or 'no' in the documentation cause the deamon to fail on start-up. Have I got the syntax wrong? Do I need a newer version to enable this feature? If so, Is there a different option that will give me the full domain name in this version? thanks, graham

2 1

Syslog-ng fails with more than one program destination
by George Madden 15 Feb '00

15 Feb '00

I was testing with 1.3.13 and found it fails with a kill -HUP when more than one "program" destination is used. Syslog-ng never restarts and starts using all the cpu. I tested this on both Redhat 6.1 and FreeBSD 3.3. When I remove all but one program destination, it works fine. It also works fine under syslog-ng 1.2.3. I assume I can have more than one program destination but maybe not. Here is the debug output. It never closes the fd and the cpu goes to about 97% binding fd 3, inetaddr: 0.0.0.0, port: 514 io.c: Preparing fd 3 for reading io.c: listening on fd 4 io.c: Preparing fd 6 for writing io.c: Preparing fd 7 for writing io.c: Preparing fd 8 for writing syslog-ng version 1.3.13 starting io.c: Preparing fd 5 for writing Garbage collecting while idle... Objects alive: 68, garbage collected: 4 Garbage collecting while idle... Objects alive: 68, garbage collected: 14 Garbage collecting while idle... Objects alive: 68, garbage collected: 28 Garbage collecting while idle... Objects alive: 68, garbage collected: 37 SIGHUP received, restarting syslog-ng Marking fd 3 for closing. Marking fd 5 for closing. Marking fd 8 for closing. Here are the files from the Redhat system: syslog-ng.conf ## options { long_hostnames(off); sync(0); log_fifo_size(10); }; source src { unix-stream("/dev/log"); internal(); }; source net { udp(); }; # destination all { file ("/var/log/all" sync(0)); }; destination net { file ("/var/log/net" sync(100)); }; # destination authenfail {program ("/etc/scripts/authenfail.sh"); }; destination authendeny {program ("/etc/scripts/authendeny.sh"); }; destination poolmess {program ("/etc/scripts/poolmess.sh"); }; # filter f_authen { match ("PIX-6-10900"); }; filter f_authenfail { match ("PIX-6-109006"); }; filter f_authendeny { match ("PIX-6-109009"); }; filter f_poolfail { match ("laddr 10.10.01.254"); }; # log { source(src); destination(all); }; log { source(net); destination(net); }; # log { source(net); filter(f_authenfail); destination(authenfail); }; log { source(net); filter(f_authendeny); destination(authendeny); }; log { source(net); filter(f_poolfail); destination(poolmess); }; Here are the scripts: authendeny.sh #!/bin/sh while read LINE; do echo $LINE | mail -s "Athentication Denied" root done authenfail.sh #!/bin/sh while read LINE; do # use awk to get the second field with a ' as a delimiter NAME=`echo $LINE | awk -F\' '{print $2}'` echo $NAME echo $LINE | mail -s "Athentication Failed for $NAME" root done poolmess.sh #!/bin/sh while read LINE; do echo $LINE | mail -s "Possible pool overload" pixadmin done

2 6

syslog-ng 1.3.15 and libol 0.2.14
by Balazs Scheidler 13 Feb '00

13 Feb '00

I've released syslog-ng 1.3.15 with libol 0.2.14. News for the 1.3.15 release Added the possibility to create directories on the fly. You'll need to enable the create_dirs() option. Added a -V flag to display version number. Updated documentation, destination file() driver now fully documented. Fixed a few bugs. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

RE: [syslog-ng] syslog-ng 1.3.14
by Lowkrantz, Goran 06 Feb '00

06 Feb '00

Hi, FreeBSD 3.4-STABLE: libol-0.2.13/src/io.c:24->src/io.h:27->src/abstract_io.h:31 - sys/socket.h need sys/types.h for some typedefs. Cheers, GLZ -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, February 04, 2000 8:38 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng 1.3.14 I've released $subject with some bugfixes. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0