- syslog-ng - lists.balabit.hu

Re: Re: Syslog-ng: [wishlitst ;)] make it color. :)
by Siddall 12 Aug '99

12 Aug '99

>On Sat, Jul 31, 1999 at 11:24:11PM +0200, Dawid Kuroczko wrote: >> Hello! >> >> I have a suggestion, a feature I'd really like to see in a syslog >> daemon, but I haven't found do far. Please make it use ANSI color >> escapes ("\033[31;41;1m") while presenting messages to console, >> for example to make important messages red, standard grey and >> network green. I think it should be configurable, but I don't >> know where. :) Maybe a special color foo { ... } section, or >> maybe special additions in destination bar { ... } ? I think >> you're the best person to decide. I'm sorry I cannot send you >> a patch, but I'm to weak at C, unfortunately. :) > >Hi, > >I think this will be possible with the rewrite rules to be introduced in the >1.3.x series, but you'll have to wait for that a bit. > >-- >Bazsi >PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD >804E C82C 8EB1 > url: http://www.balabit.hu/pgpkey.txt I am new to this program, and new to the Linux world in general (6 days old) however I have this to offer: I would like to propose a small amendment to that idea. Simply allow user definable message PREFIX (msgpfx) and SUFIXs (msgsfx) that would automatically be appended onto the alert. Allow this to be done in the destination field so that you have the most control. Then the config file might look something like this. destination tty1 { msgpfx("\[\033[34m\]**ALERT!!!**"); msgsfx("**ALERT!!!**\[\033[0m\]); pipe("/dev/tty1"); usertty("administrator"); }; -Corbin B. Siddall, MCSE, CCNA

1 0

syslog-ng 1.1.31 && Solaris 2.6 SPARC
by Erik M. Beebe 12 Aug '99

12 Aug '99

Hello; I have recently installed syslog-ng 1.1.31 && libol-0.2.3 on a machine running SPARC Solaris 2.6; If I connect to port 514/UDP using NetCat, syslog-ng logs it just fine. If I try to use "logger" locally, it does not. Here are my source lines: source stdlog { sun-streams("/dev/log" door("/etc/.syslog_door")); }; source src { internal(); udp(ip(0.0.0.0) port(514)); }; I don't believe it's any problems with the destination/filter/log lines causing this problem -- it looks like syslog-ng just isn't getting what is sent to /dev/log. Anyone have any idea what could be causing this? Thanks much in advance, Erik -- Erik M. Beebe Infinet System Administrator Phone: (757) 664-2227 Email: ebeebe(a)infi.net http://www.infi.net

1 0

Re: [syslog-ng] Compile Error for syslog-ng-1.1.30
by Balazs Scheidler 11 Aug '99

11 Aug '99

On Fri, Aug 06, 1999 at 02:28:19PM +0900, bazsi wrote: > > > < static utmp ut; > > > --- > > > > static struct utmp ut; > > > > getutent() emulation for systems which not have one is still broken in at > > least one way. getutent() should return NULL when the EOF is reached. > > Though I don't understand C language very well... > > If read() read EOF then return (ssize_t)NULL. It's right. > But, Can I hope stored NULL to &ut by read() at the time? No. I have fixed it now. But Solaris should support getutent() calls, so you don't need those routines. This is the correct getutent() call for those interested: struct utmp *getutent(void) { static struct utmp ut; if (utent_fd == -1) { utent_fd = open(_PATH_UTMP, O_RDONLY | O_NOCTTY); } if (utent_fd == -1) return NULL; rc = read(utent_fd, &ut, sizeof(ut)); if (rc <= 0) { close(utent_fd); utent_fd = -1; return NULL; } else { return &ut; } } > > Could you provide some messages before the first door_return call? Maybe in > > a private message. > > OK. The following is what I Executed commands. > > # cp /dev/null /var/log/test.log > # ls -l /var/log/test.log > -rw-r--r-- 1 root other 0 Aug 6 13:41 /var/log/test.log > # /usr/local/sbin/syslog-ng > Terminated > # su - > # su - > # ps -ef | grep syslog-ng > root 21724 1 0 13:43:29 ? 0:00 /usr/local/sbin/syslog-ng > # cat /var/log/test.log > Aug 6 13:43:29 src@sun1 syslog-ng[21724]: syslog-ng version 1.1.30 starting I'd need a bit different truss outputs. 1) Launch syslog-ng using the truss -o syslog-ng.truss ./syslog-ng -dv Using -dv will prevent forking. 2) While the previous truss is running, on a different terminal (or VT session): truss -o logger.truss logger "This is a message" The files syslog-ng.truss and logger.truss is what I need. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

syslog-ng 1.1.31
by Balazs Scheidler 07 Aug '99

07 Aug '99

Hi, To fix the encountered build bugs in 1.1.30, I release 1.1.31. I tried to track the memory leak someone has mentioned, but it simply doesn't leak for me. I sent syslog-ng 100 simoultenious connections, 1000 messages each connection, from both local programs, and from network connections. It doesn't grow. Maybe who reported this, doesn't run the latest version? I've also released a new version of libol, though not much is changed there. A few error messages have been changed to be only verbose messages. Here's the changelog: 1999-08-07 Balazs Scheidler <bazsi(a)balabit.hu> * afuser.c: works on old utmp structures too (NetBSD) * configure.in: added test for modern utmp structure, bumped version number, changed required libol version to 0.2.3 * utils.c: fixed a bug in getutent() implementation * main.c: fixed a bug in SIGTERM handling, exit message is now displayed I've also updated the .deb packages, they are exact copies of what I am using on my computer. You can find this at the usual places: http://www.balabit.hu/products/syslog-ng and http://www.balabit.hu/downloads/syslog-ng Have fun! PS: I am going to a canoe tour next week, so I won't be able to respond to my mail. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Compile Error for syslog-ng-1.1.30
by georg.funke＠netcologne.de 06 Aug '99

06 Aug '99

Hi, when i try to syslog-ng-1.1.30, i get the following error: utils.c: In function `getutent': utils.c:70: syntax error before `ut' utils.c:77: `ut' undeclared (first use in this function) utils.c:77: (Each undeclared identifier is reported only once utils.c:77: for each function it appears in.) utils.c:79: warning: control reaches end of non-void function My System is Redhat 6.0 with kernel 2.2.10 and the compiler is gcc-2.95. Can you help me why i get this error? Thanks Georg -- Georg Funke Crowns & Flames SDC Cologne, Germany; http://www.geocities.com/Colosseum/4893 "Friendship is Square Dancing's greatest Reward"

3 4

syslog-ng 1.1.30
by Balazs Scheidler 04 Aug '99

04 Aug '99

Hi, I have released syslog-ng 1.1.30 and the corresponding libol version 0.2.2. Changes include: * Sun-Streams support cleaned up, it does compile (and it is really compiled in), and should work, but it's now completely untested. Please report success/failure you may had. * NetBSD didn't have getutent() calls, so I implemented them in utils.c. Again this is untested, I have no *BSD machines lieing around. Nothing has changed in libol, only a new symbol has been made public. You can find these at the usual place: http://www.balabit.hu/products/syslog-ng And the tarballs & pgp signatures at: http://www.balabit.hu/downloads/syslog-ng/source -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

Re: syslog-ng memory usage
by Balazs Scheidler 04 Aug '99

04 Aug '99

On Tue, Aug 03, 1999 at 09:05:04AM -0400, mr(a)noc.1st.net wrote: > Here's what it looked like today: > > root 13410 0.3 54.2 70452 69716 ? S Aug02 5:00 syslog-ng > > I've attached the conf file. What kind of system do you have? I mean is it Linux or something else? I tried to track down that memory leak, but syslog-ng was not growing at all for any of the stresstests I used. (I tried both the file and the udp source driver, and file destination driver) I see the following possibilities: 1) your malloc() implementation in the libc doesn't like fragmentation. syslog-ng allocates lots of memory blocks, but frees them as well, maybe your malloc() implementation may have problems with fragmented memory. You may have a look at GNU Malloc, which is AFAIR available separate from libc, and can be compiled to a standalone shared lib. 2) The output queues of syslog-ng begin to fill up, because it is unable to handle the load. This should not be a problem though, since by default the output queues are 100 entries long for each file. (using 200 bytes as an estimated length of a message we get 20*100*200 = 400000 Bytes for twenty file destinations) 3) The libc itself leaks somewhere. I use GNU libc 2.1.1, GNU/Linux Debian, potato distribution. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

.. beginner question src Sol 7 (intel)
by Werner Dundler 04 Aug '99

04 Aug '99

hello after trying to get a usefull logging with the standart solaris syslog i removed that damn program and install the newest version of syslog-ng. i compiled it (straight) using gcc and took a basic configuration and changed it. but i ran into one trouble.... my syslog-ng deamon runs fine and when i send a -HUP to it i get a nice message that syslog-ng initiolized a new configuration. but i can´t get it to log system messages. i used: source src { unix-stream("/dev/log"); internal(); }; and source src { unix-stream("/etc/.syslog_door"); internal(); }; i tested both configurations with # logger -t auth.debug "bla" .. but never got a response into my logfile. system is a solaris 7 intel machine. filter and log for auth.* should be up and running .... does anybody know what i did wrong ? ciao and thx werner

2 1

Syslog ng 1.1.29 under Solaris 7
by Rob See 04 Aug '99

04 Aug '99

I've been attempting to get syslog-ng to run under solaris 7, and have been running into the same problems that were mentioned in a previous message. The config script seems to only be checking for stropts.h and not strlog.h, so the sun-stream support isn't getting compiled in no matter what. When I change afstream.c so that it will compile that support in, it has problems with tmp not being defined. the line "char tmp[MAX_LINE + 1]" around line 70 is commented out. When I uncomment it, it compiles, but segfaults any time a message is sent to it in _vformat_length. Does anyone have any ideas that could help ? -Rob See

1 0

Re: [syslog-ng] Re: syslog-ng 1.1.29 and Solaris 7 support
by Balazs Scheidler 03 Aug '99

03 Aug '99

> > > On Mon, Aug 02, 1999 at 01:00:49PM -0400, Mike Wade wrote: > > > > How do I enable Solaris 7 internal syslog support with syslog-ng 1.1.29? > > > > Currently, I get an error saying 'sun-streams support not compiled in > > > > (STREAM=/dev/log)' > > > > Me too. > > > > > The configure script detects whether you have the necessary header files or > > > not. You need strlog.h and stropts.h, and for door support you need door.h. > > > Check the config.log file and configure output why those files were not > > > found. > > > > I don't know usage of configure very well. > > But, I think syslog-ng's configure is not check about strlog.h. > > What does the script 'make_class' require? That also appears to be a > problem for me. make_class requires scheme shell to run, but it's required only for syslog-ng development, nothing else. scsh is available in source at ftp://ftp-swiss.ai.mit.edu/pub/su/scsh/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: syslog-ng 1.1.29 and Solaris 7 support
by Balazs Scheidler 02 Aug '99

02 Aug '99

On Mon, Aug 02, 1999 at 01:00:49PM -0400, Mike Wade wrote: > How do I enable Solaris 7 internal syslog support with syslog-ng 1.1.29? > Currently, I get an error saying 'sun-streams support not compiled in > (STREAM=/dev/log)' The configure script detects whether you have the necessary header files or not. You need strlog.h and stropts.h, and for door support you need door.h. Check the config.log file and configure output why those files were not found. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: Syslog-ng: [wishlitst ;)] make it color. :)
by Balazs Scheidler 02 Aug '99

02 Aug '99

On Sat, Jul 31, 1999 at 11:24:11PM +0200, Dawid Kuroczko wrote: > Hello! > > I have a suggestion, a feature I'd really like to see in a syslog > daemon, but I haven't found do far. Please make it use ANSI color > escapes ("\033[31;41;1m") while presenting messages to console, > for example to make important messages red, standard grey and > network green. I think it should be configurable, but I don't > know where. :) Maybe a special color foo { ... } section, or > maybe special additions in destination bar { ... } ? I think > you're the best person to decide. I'm sorry I cannot send you > a patch, but I'm to weak at C, unfortunately. :) Hi, I think this will be possible with the rewrite rules to be introduced in the 1.3.x series, but you'll have to wait for that a bit. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

suggestion: format of logline
by Bjorn Andersson 27 Jul '99

27 Jul '99

Here is a feature that I have been missing from other syslog programs as well as syslog-ng: I would like to give as an option the format of the logline. It would, for instance, be nice to see the priority and facilty of the logline in the log. This way I would not need to have a lot of logfiles just so that that I afterwards could find out the priority and facility. This would also give me the possibility not to write out the host information, as this information is redundant if I only have a single host or if each host has its own directory of logfiles. Here's an example of such a line: Jul 27 04:53:10 daemon notice proftpd[7423]: FTP session closed. The configuration option could be something like: log_format("%m %d %t %f %l %m"); where %m = month %d = day %t = time %f = facility %l = level %m = message Please send any comments to me as well as the mailinglist. Regards, Björn -- Björn Andersson <bjorn(a)lifix.fi>

2 1

suggestion: sync in log statement
by Bjorn Andersson 27 Jul '99

27 Jul '99

I just tested syslog-ng. I think it is better than the standard syslogd and will start using it. I have two suggestions. I will post them in separate mails so that the discussion can go on in their own threads. Here's the first one: I would like to be able to put the sync option in log statements, instead of having a global value. This would give me the possibilty to buffer less important messages (for example frequent debug messages) and not buffer more critical messages (such as those with a priority of emerg and alert). Please send any comments to me as well as the mailinglist. Regards, Björn -- Björn Andersson <bjorn(a)lifix.fi>

1 1

syslog-ng 1.1.29
by Balazs Scheidler 26 Jul '99

26 Jul '99

Hi, I have silently released 1.1.29 of syslog-ng, which contains the previous patch I posted here against 1.1.28. This contains the single quotation marks patch, so that you can specify regexps more easily. Tell me if you have problems. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Weird behavior
by Nathaniel Couper-Noles 22 Jul '99

22 Jul '99

I have setup syslog-ng version 1.1.27 on a i386 running a (nearly) pure Debian Linux 2.1 install, libol version 0.2. This machine is being used to collect logs sent from NT machines running a program called EventSlog. I am trying to use the match() function to direct logs containing the string "/Security (" to a file bob.security, logs containing the string "/Applications (" to a file bob.app, logs containing the string "/SYSTEM (" to a file called bob.system, and logs that contain none of these strings to a file called bob.misc. My first attempt at this is in the first attachment to this document. It erred by redirecting all of the logs to each of the three files bob.app, bob.security, and bob.system all of the input to port 514. bob.misc was empty. Figuring perhaps that multiple filters aren't and'ed together in a log statement, I then wrote the conditional statements inside the filters, as in the second attachment to this email. This setup erred in the same way. I noticed also that the appropriately syntaxed configurations would behave similarly using syslog-ng version 1.2.23 and libol 0.1.19. Am I misusing the match() call? Or perhaps the logical connectors? Thanks for a great program! PS if there is a syntactical error in the files it is because I copied them wrong...syslog-ng always ran without explicit error... PPS I noticed the version-printing command line option syslog-ng -V does not work...though it is listed in the man page. _______________________________________________ Nathaniel Couper-Noles Department of Information Techonology School of Social Administration University of Chicago options { long_hostnames(off); sync(0); }; # sources source ntboxes { udp ( port(514) ); }; source sysl-ng { internal(); }; # destinations destination bob.security { file ("/var/log/bob.security"); }; destination bob.system { file ("/var/log/bob.system"); }; destination bob.app { file ("/var/log/bob.app"); }; destination bob.misc { file ("/var/log/bob.misc"); }; # filters filter f_security { match ("/Security ("); }; filter f_app { match ("/Application ("); }; filter f_system { match ("/SYSTEM ("); }; filter f_misc { not match ("/Security (") and not match ("/SYSTEM (") and not match ("/Application ("); }; filter f_bob { host ("bob"); }; # logs log { source (ntboxes); filter (f_bob); filter (f_security); destination (bob.security); }; log { source (ntboxes); filter (f_bob); filter (f_system); destination (bob.system); }; log { source (ntboxes); filter (f_bob); filter (f_app); destination (bob.app); }; log { source (ntboxes); filter (f_bob); filter (f_misc); destination (bob.misc); }; options { long_hostnames(off); sync(0); }; # sources source ntboxes { udp ( port(514) ); }; source sysl-ng { internal(); }; # destinations destination bob.security { file ("/var/log/bob.security"); }; destination bob.system { file ("/var/log/bob.system"); }; destination bob.app { file ("/var/log/bob.app"); }; destination bob.misc { file ("/var/log/bob.misc"); }; # filters filter f_bob_security { host ("bob") and match ("/Security ("); }; filter f_bob_app { host ("bob") and match ("/Application ("); }; filter f_bob_system { host ("bob") and match ("/SYSTEM ("); }; filter f_bob_misc { host ("bob") and not match ("/Security (") and not match ("/SYSTEM (") and not match ("/Application ("); }; # logs log { source (ntboxes); filter (f_bob_app); destination (bob.security); }; log { source (ntboxes); filter (f_bob_security); destination (bob.system); }; log { source (ntboxes); filter (f_bob_system); destination (bob.app); }; log { source (ntboxes); filter (f_bob_misc); destination (bob.misc); };

2 1

elso kerdes :) (fwd)
by Boda Karoly jr. 22 Jul '99

22 Jul '99

Udvozletem mindenkinek ! Uj vagyok a listan, kezdem is egy kerdessel :) adott a kovetkezo konfigreszlet: source src { unix-stream("/dev/log"); internal(); }; source net { udp(); }; destination console_all { file("/dev/tty13"); }; destination mailconsolerhye { file("/dev/tty22"); }; destination mailconsolerusalka { file("/dev/tty23"); }; destination rusalkalog { file("/dev/tty24"); }; filter f_mail { facility(mail); }; filter n_mail {not facility(mail); }; log { source(src); filter(n_mail); destination(console_all); }; log { source(src); filter(f_mail); destination(mailconsolerhye); }; log { source(net); filter(f_mail); destination(mailconsolerusalka); }; log { source(net); filter(n_mail); destination(rusalkalog); }; A kerdes a kovetkezo: A /dev/tty23-ra miert kerul az _osszes_ maillog, az is, ami a src-bol van ? A /dev/tty22 jol mukodik, oda csak a megfelelo mailuzenetek kerulnek. A /dev/tty13 es a /dev/tty24 szinten jol mukodnek, nem kerulnek oda a maillogok. -- Woockie ..."what is there in this world that makes living worthwhile?" Death thought about it. "CATS," he said eventually, "CATS ARE NICE." (Terry Pratchett, Sourcery)

1 0

syslog-ng-1.1.28
by georg.funke＠netcologne.de 22 Jul '99

22 Jul '99

Hi, you have forgot to patch configure, to work with libol-0.2.1, at the moment it insist on libol-0.2.0. After i patch this, it compiles well. Georg -- Georg Funke Crowns & Flames SDC Cologne, Germany; http://www.geocities.com/Colosseum/4893 "Friendship is Square Dancing's greatest Reward"

2 1

syslog-ng 1.1.28
by Balazs Scheidler 21 Jul '99

21 Jul '99

Hi, I have released syslog-ng 1.1.28 and libol 0.2.1 to fix the bugs that appeared on this mailing list lately: syslog-ng: * on *BSD recvfrom() does not return the source address on connection-oriented sockets (e.g. on TCP channels the source hostname was not found correctly) * The parser took two variables the same if they began with the same string libol: * the number of pending callouts were not counted correctly, so when syslog-ng was restarted via the HUP signal, it may have terminated because no event handlers were left. Otherwise syslog-ng were quite stable, so if nothing goes wrong at the end of July, I'll release 1.2.0. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: syslog-ng: new destination driver
by Balazs Scheidler 21 Jul '99

21 Jul '99

cc-ing to the syslog-ng mailing list. On Mon, Jul 19, 1999 at 03:31:21PM -0700, Jeremy Fitzhardinge wrote: > Hi, > > We need a syslog which can parse messages and then farm them out to > other alert mechanisms, which are dynamic and configurable, such as SNMP > traps, emails, pagers, etc... My original idea was to add a regexp > mechanism to syslog and fire off lines which match to the various > programs. After looking around, it looks like your syslog-ng is the > closest to our requirements, but it doesn't have the mechanism to > actually send lines to a program. Indeed it does, but the program statement you suggest below is on my todo list. To send lines to a program, you could use a named pipe. mkfifo /var/run/pager the program would then: #!/bin/sh cat /var/run/pager | batch_and_send and in syslog-ng declare a destination: destination { pipe("/var/run/pager"); }; However since it's impossible to pass arguments to the given script this way, a program destination driver should - and will - be implemented. > > I'm thinking of something along the lines of: > > destination pager { prog("/usr/local/bin/pager.pl") }; > > Each destination using a prog() would start a new instance, which is > persistent for the duration of syslog's life. This is so that they can > batch things together, rather than sending one email for each line of a > multi-line message. > > I've been going through the source to see how to implement it, and it > looks pretty clean. The only thing I don't understand is all the .x > files and make_class. How do these fit together, and what do I need to > do to implement a new afprog.*? syslog-ng uses make_class as a preprocessor to create data structures for object classes, and to generate code needed by the mark & sweep garbage collector. To create a new destination driver, you would create a class from (or directly use) log_dest_driver defined in destinations.h. If you look at affile.c (as one of the simplest destination driver), it derives a class: /* CLASS: (class (name affile_dest) (super log_dest_driver) (vars (name string) (flags simple int) (dest object io_fd) (dest_buf object abstract_buffer) (sync_freq simple UINT32))) */ The constructor of a class is called make_<classname> by convention, so affile_dest is created by make_affile_dest: struct log_dest_driver *make_affile_dest(const char *name, int flags) { NEW(affile_dest, self); self->super.super.init = do_init_affile_dest; self->super.super.handler = do_handle_affile_log; self->super.log_fifo_size = -1; self->name = c_format_cstring("%z", name); self->flags = flags; self->sync_freq = -1; /* use global setting */ return &self->super; } This returns "struct log_dest_driver *" because the derived class itself is private to this module, and externally only the log_dest_driver is known. NEW creates a new instance of affile_dest, and stores a pointer to this instance in self. Then the method pointers are initialized. Internally log messages flow in log-pipes: log_source_driver -> log_source_group -> log_center -> log_dest_group -> log_dest_driver Several log_source_drivers may point to the same source_group, and several source_groups may point to a log_center. There's only one log_center per configuration, and log_center is the one which applies filter rules, and in case they match, it chooses the appropriate log_dest_group, thus sends the log message to all the log_dest_driver belonging to that group. An element of this pipe must be a descendant of log_handler (defined in log.h) Since several element has a next pointer (all except the last log_dest_driver) a less general class: log_handler_pipe is introduced here, which has an additional next field. The above pipe is constructed as the configuration file is read, and if the configuration is found to be syntactically valid, everything is initialized. (this is log_handler.init) Source drivers open source sockets, and install read hooks to get events on them. As a message is read it is passed towards the central log_center using the next->handler method. There's an optional method in log_handlers, which is called destroy. It is called when the log pipe is destroyed. So this is the internal data structure in syslog-ng, for detailed information about the class definition language parsed by make_class, download lsh (ftp://ftp.lysator.liu.se/pub/security/lsh/lsh*.tar.gz) and read the file HACKING. make_class requires scsh (Scheme shell) to run, though make_class is being ported to more free implementations of scheme, like guile. I hope this helps, -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

[bazsi@balabit.hu: Re: [syslog-ng] Re: bug?]
by Balazs Scheidler 19 Jul '99

19 Jul '99

This mail contains two patches you may be interested in. (especially under *BSD) ----- Forwarded message from Balazs Scheidler <bazsi(a)balabit.hu> ----- Date: Mon, 19 Jul 1999 23:42:49 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> To: joeym(a)inficad.com Subject: Re: [syslog-ng] Re: bug? > > Sometimes when I SIGHUP syslog-ng (client or server), I will get this > too: > > SIGHUP received, restarting syslog-ng > new configuration initialized > io_iter(): no waiting fds and no callouts! exiting... > > However, every once in a while, it will say 'new configuration > initilized' and keep right on going. But most of the time, it gives the > io_iter() err and exits. Please try this patch against libol: --- libol-0.2.0/src/io.c Sat Jul 10 15:23:09 1999 +++ libol/src/io.c Mon Jul 19 23:04:46 1999 @@ -268,9 +268,7 @@ ol_queue_remove(&n->header); ol_space_free(n); } - else { - nco++; - } + nco++; } } if (!nfds && !nco) { The other problem should be BSD specific. (or my solution is Linux specific some way. I assumed that recvfrom() on connected sockets return the source address of the connection, but as it seems under BSD this is not the case.) Try the following somewhat (ugly) patch, to see if this is the problem: --- syslog-ng-1.1.27/src/afsocket.c Sat Jul 10 17:58:33 1999 +++ syslog-ng/src/afsocket.c Mon Jul 19 23:22:37 1999 @@ -106,6 +106,16 @@ static void do_handle_afinet_line(struct log_handler *c, struct log_info *msg) { CAST(afsocket_source_connection, self, c); + if (!msg->saddr) { + char sockaddr_buf[256]; + struct sockaddr *sa = (struct sockaddr *) &sockaddr_buf; + int salen = sizeof(sockaddr_buf); + + if (getpeername(self->fd, sa, &salen) != -1) { + msg->saddr = ol_space_alloc(salen); + memcpy(msg->saddr, sa, salen); + } + } HANDLE_LOG(self->super.next, msg); } I've fixed another problem not reported by you. Variable names beginning with the same bytestring (e.g. f_router & f_router_acct) were resolved incorrectly. Check out the mailing list (or the archive at http://lists.balabit.hu/pipermail) for that patch. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt ----- End forwarded message ----- -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: syslog-ng parser bug?
by Balazs Scheidler 19 Jul '99

19 Jul '99

On Mon, Jul 19, 1999 at 07:11:55PM +0200, Rolf Offermanns wrote: > Hi Balazs! > I think I have found a bug in the config file parser in 1.2.27. > I will try to describe it as exactly as my english allows me to... Thanks for the report. The problem was that the first few bytes of those variable names were the same, so the same filter rule was applied to both log statement. Try this patch: --- syslog-ng-1.1.27/src/cfgfile.c Sat Jul 10 17:58:33 1999 +++ syslog-ng/src/cfgfile.c Mon Jul 19 23:38:44 1999 @@ -18,7 +18,7 @@ * * Inspired by nsyslog, originally written by Darren Reed. * - * $Id: cfgfile.c,v 1.17 1999/07/10 15:58:33 bazsi Exp $ + * $Id: cfgfile.c,v 1.18 1999/07/18 12:56:11 bazsi Exp $ * ***************************************************************************/ @@ -62,7 +62,8 @@ #define RESOLVE_VAR(s, first, next, i) \ for (s = first; s; s = s->next) { \ - if (strncmp(i->name->data, s->name->data, i->name->length) == 0) { \ + if (i->name->length == s->name->length && \ + strncmp(i->name->data, s->name->data, i->name->length) == 0) { \ i->ref = (struct ol_object *) s; \ break; \ } \ @@ -154,7 +155,7 @@ self->init = do_init_config; self->destroy = do_destroy_config; self->backend = backend; - self->sync_freq = 1; + self->sync_freq = 0; self->mark_freq = 1200; /* 20 minutes */ self->long_hostnames = 1; self->time_reopen = 60; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: bug?
by Balazs Scheidler 18 Jul '99

18 Jul '99

Hi, Thanks for reporting this. I am going to fix these as soon as I'll have some time. On Wed, Jul 14, 1999 at 10:15:06AM -0700, joeym(a)inficad.com wrote: > Sorry to bother you again, but I have noticed some strange behavior when > logging over TCP. > > Client Machine is BSDI 4.0 running syslog-ng. 'Server' machine is > FreeBSD 3.2-STABLE running syslog-ng and receiving UDP, TCP, and local > syslog msgs. When the client machine sends messages via UDP back to the > server machine, the server machine sees the tag as the correct hostname. > When the messages are sent from the client -> server via TCP, then the > server marks those messages as coming from its own hostname, and not the > client's hostname. > > Also, I noticed that sending SIGHUP to syslog-ng on the BSDI client > machine causes this message (in debug mode) to be sent : > new configuration initialized > io_iter(): no waiting fds and no callouts! exiting... > > and then it exits.. If i SIGHUP syslog-ng on the 'server' machine, it > reloads its config and moves happily on. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 1

Re: Small conf suggestion
by Balazs Scheidler 13 Jul '99

13 Jul '99

On Mon, Jul 12, 1999 at 09:01:21PM -0700, joey miller wrote: > I'm currently evaluating syslog-ng for use as a central syslog server in > our facilities, and have come across something that may cut down similar > setups (config file wise) like what I'm implementing by a large margin. > > I plan to have multiple hosts log back to a single syslog-ng server, and > am going to keep each machine/Cisco's logs seperated in a structure such > as: > /var/log/machine1.inficad.com/messages > /var/log/machine1.inficad.com/daemon.log > /var/log/routerX.inficad.com/messages > .. etc .. > > However, I've noticed it's going to require multiple (somewhat redundant) > destination {} entries to get this going the way I'd like. What I was > thinking was something along the lines of allowing a replacable string in > a file(); definition. For example, I could do: > > destination d_auth { file("/var/log/$HOST/auth.log"); }; > > This would allow me to have a single entry for the d_auth destination, > instead of requiring a seperate destination{} entry for each machine + log > level. > > If there is something like this available already, please let me know, as > I'm still exploring the syslog-ng package and haven't even begun to > exploit its full potential yet. It is not available yet, but as it has already been suggested by at least 3 people, I'll implement this in 1.3.x series. For now you have to stick to several destination fields. To make this problem easier to maintain, simply write a shell script or such to generate the config file. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: [syslog-ng] syslog-ng 1.1.27
by Ispanovits imre 11 Jul '99

11 Jul '99

Balazs Scheidler, SZO, 10 JÚL 1999-n írta: >>Hello, > >I have released version 1.1.27 aka 1.2.0rc1 of syslog-ng and the >corresponding libol versioned 0.2.0. I worked on this release a lot to >make it as bugfree as possible, and make installation flawless. T > >Syslog-ng is available at the usual places: > >http://www.balabit.hu/downloads/syslog-ng/source/ > >The official webpage is at: > >http://www.balabit.hu/products/syslog-ng/ >^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Hali! Biztos, hogy kint van? Miért nem látom? Imre ----------------------------------------------------------------- Cyrix 6x86 PR200MX/Amptron PM9900A/80MB/QFB EL5.1A/R6 6.0/2.2.9/KDE-1.1.1 -----------------------------------------------------------------

1 0