- syslog-ng - lists.balabit.hu

switching away from scsh
by Tommi Virtanen 03 Jun '99

03 Jun '99

One more correction: The scsh-compability libraries required by the current patch are still non-free; but now that the make_class and friends are ported to Guile, it will be easier to port them away from scsh features. I will provide more patches later. -- Havoc Consulting | unix, linux, perl, mail, www, internet, security consulting +358 50 5486010 | software development, unix administration, training

2 1

Re: [syslog-ng] syslog-ng 1.1.20 and libol version 0.1.18 released
by Balazs Scheidler 29 May '99

29 May '99

> > I have fixed several bugs and build errors in both syslog-ng and libol. It > > compiles cleanly and works for me (tm). It has also been debianized, so it's > > available in a debian package as well. > > > now it compiles OK but every next attempt reread configfile by HUP cause > Segfault: > > > # syslog-ng -d > syslog-ng version 1.1.20 starting > SIGHUP received restarting syslog-ng > new configuration initialized > SIGHUP received restarting syslog-ng > Segmentation fault (core dumped) fixed in version 1.1.21. The problem was that gc deallocated my configuration structure while I was still using it... tarball and .deb package available at http://www.balabit.hu/downloads/syslog-ng -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng 1.1.20 and libol version 0.1.18 released
by Balazs Scheidler 28 May '99

28 May '99

Hi, I have fixed several bugs and build errors in both syslog-ng and libol. It compiles cleanly and works for me (tm). It has also been debianized, so it's available in a debian package as well. Some of the changes: * It is now linked statically against libol, so a dynamic version is not required for running syslog-ng * Fixed a few bugs (the emitted loglines contained embedded \0 characters, and \n was not always interpreted correctly) * Added debian control files, and readded .deb packages to the site. I have personally switched to this release from the standard syslogd on my computer. So as you can see it's quite stable now. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

[pg@gu.net: Re: [syslog-ng] syslog-ng v16 compilation problem]
by Balazs Scheidler 28 May '99

28 May '99

As it seems 1.1.18 fixed the problems you may have encountered. ----- Forwarded message from Pavel Golubev <pg(a)gu.net> ----- Date: Fri, 28 May 1999 02:57:51 +0300 (EEST) From: Pavel Golubev <pg(a)gu.net> To: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] syslog-ng v16 compilation problem On Wed, 26 May 1999, Balazs Scheidler wrote: 1.1.18 compiles OK now :) --- Pavel Golubev PG810-RIPE Global Ukraine Inc. ----- End forwarded message ----- -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng v16 compilation problem
by Pavel Golubev 26 May '99

26 May '99

Hi all, # make Making all in src make[1]: Entering directory `/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src' gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c main.c gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c sources.c sources.c: In function `do_read_line': sources.c:72: warning: `length' might be used uninitialized in this function gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c center.c gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c filters.c gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c destinations.c gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c log.c gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c cfgfile.c gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c cfg-grammar.c cfg-grammar.y: In function `yyparse': cfg-grammar.y:212: dereferencing pointer to incomplete type make[1]: *** [cfg-grammar.o] Error 1 make[1]: Leaving directory `/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src' make: *** [all-recursive] Error 1 --- Pavel Golubev PG810-RIPE Global Ukraine Inc.

2 1

cvs
by Balazs Scheidler 26 May '99

26 May '99

Hi, I have seen several cvs accesses, but those who attempted has most probably noticed that the cvs was NOT up to date. (it is only a mirror of my local cvs, and I update it by hand) I updated it, so it includes 1.1.16 of syslog-ng, and 0.1.16 of libol. Alternatively you can find the snapshots at: http://www.balabit.hu/downloads/syslog-ng/source -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng 1.1.16 & libol-0.1.16
by Balazs Scheidler 25 May '99

25 May '99

Hi, I have released syslog-ng 1.1.16 and the corresponding libol 0.1.16, it fixes several problems: * HP-UX sources should work now * sync () works for files as well as local option * does not lose data on the receipt of a HUP signal This should be much better than 1.1.15 was, please test it. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

Re: [syslog-ng] regular expressions?
by Balazs Scheidler 24 May '99

24 May '99

Hi, >I'd like to ask you if the current stable/development version supports >filtering through regular expressions? Yes, both versions support this. In the stable version you can use both match and matchfile. match has a single parameter describing the regexp to match against, matchfile refers to a file containing several regexps (one per line). -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

regular expressions?
by Arek Jankowski 24 May '99

24 May '99

Hello, I'd like to ask you if the current stable/development version supports filtering through regular expressions? --- Arek J.

1 0

problems with 1.1.15
by Scott Dellinger 24 May '99

24 May '99

Today I had my first chance to try out syslog-ng 1.1.15, and I'm having some weird problems. When I send test messages locally and from another Linux box via UDP, the "message repeated" lines seem to be random. In the following, the text of each message sent was "test". There were a total of four messages sent locally, and two from the remote system. May 21 08:50:55 logger/logger syslog-ng[15831]: syslog-ng version 1.1.15 starting May 21 08:51:00 src@logger root: test May 21 08:51:07 last/kilrah message repeated 5 times May 21 08:51:38 src@logger root: test May 21 08:56:52 last/kilrah message repeated 3 times May 21 08:01:07 src@logger root: test May 21 08:01:07 src@logger root: test It's reporting repeated messages that aren't, and not reporting some that are. Then, when I try to send a message from an HP-UX box, syslog-ng *seems* to ignore it for a bit, but a few minutes later, spews onto the screen (using the default syslog-ng.conf) many, many lines along the lines of: May 21:09:19:28 logger/logger syslog-ng[15831]: io.c: do_read(): Zero length read was requested On the plus side, syslog-ng is no longer closing the UDP socket immediately upon reception of messages from HP-UX... -- Scott Dellinger Systems Administrator, JMU Technical Services dellinsd(a)jmu.edu

2 1

syslog-ng 1.1.15 & libol 0.1.14
by Balazs Scheidler 17 May '99

17 May '99

Hi, I have released $SUBJECT. udp and hostname problems are resolved and I added an option to turn off long hostname generation. (compatible with earlier syslogd): options { long_hostname(no); }; You can set sync frequency using: options { sync(10); }; which will set _global_ file sync setting. Please note that this is still buggy. Known bugs: - syslog-ng loses data, when sync is not equal to 1, and receives a HUP signal - local setting doesn't work yet (file /var/log/messages sync(10);) You'll need libol-0.1.14 to compile. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

UDP problems with 1.1.14
by Scott Dellinger 15 May '99

15 May '99

Having had success running syslog-ng 1.1.14 locally, I tried just now setting it up to receive messages via UDP, but I can't get it to work. Using the output of 'lsof' as a guide, I can see that the UDP port is opened, but once I send syslog-ng a message from a remote machine, the message "vanishes" and the UDP port is closed, though the program continues to run and accept local messages. -- Scott Dellinger Systems Administrator, JMU Technical Services dellinsd(a)jmu.edu

2 5

Source IP of UDP packets
by Asmodeus 13 May '99

13 May '99

Unless I'm really wrong (and my IP logger is more broken than I thought), doesn't: inet_ntoa(packet.ip.ip_src); give you the source IP (in a nice, readable string form)? Garnered from the Linux UDP header file. .Shawn

2 1

poll() system call emulation in libc (linux)
by Balazs Scheidler 11 May '99

11 May '99

Hi, It turned out recently that the Linux libc (2.0.7 or below) emulation of poll system call is buggy. If it passed -1 as timeout (infinite), it returns immediately. This may cause bad behaviour of syslog-ng or lsh, if compiled under these systems. Future versions of libol will have a workaround this bug. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

some questions
by Pavel Golubev 11 May '99

11 May '99

Hi all, I see that version 14 version does not support "sync" now ( -/var/log/xxx.log alternative in standard syslogd). As a rule a big logging may incredible slow down logstation without "-" mode. It's too bad for central logstation. Next. Standard syslogd writes "host" field correct - corresponding to client name, but remote client's messages in syslog-ng always looks like "srcname/syslog-ng_server_name". It's too hard for admin to separate logfiles visually. For last :) Can somebody give me _working_ example of log separating by remote hostname or IP address. It's not trivial for me :) PS: all _announced_ features works fine for me, including UDP remote logging with "program" and "match" filters. Thanks to autor. --- Pavel Golubev PG810-RIPE Global Ukraine Inc.

2 3

running environment
by Arek Jankowski 10 May '99

10 May '99

Hello, What environment do you people use for building and running syslog-ng? I use gcc 2.7.2.3 and linux 2.0.29 libc5 system and have only segfaults when try to run this program. Has it got any requirements concerning the system libraries? --- Arek J.

2 3

Re: [syslog-ng] syslog-ng 1.1.12 problem
by s 09 May '99

09 May '99

Hello, thank you for this tip. I could compile that code but i have got another problem now. ---- root@shell [/home/spy/syslog-ng-1.1.14]# syslog-ng **** syslog-ng: error in loading shared libraries: libol.so.0: cannot open shared object file: No such file or directory **** root@shell [/home/spy/syslog-ng-1.1.14]# id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) root@shell [/home/spy/syslog-ng-1.1.14]# ls -l src/syslog-ng -rwxr-xr-x 1 root root 51147 May 7 10:42 src/syslog-ng* root@shell [/home/spy/syslog-ng-1.1.14]# --------- checking for getopt_long... yes checking libol version == 0.1.10... ok updating cache ./config.cache ----------- root@shell [/home/spy/syslog-ng-1.1.14]# whereis libol.so.0 libol.so: /usr/local/lib/libol.so.0 /usr/local/lib/libol.so root@shell [/home/spy/syslog-ng-1.1.14]# ls -l /usr/local/lib/libol.so.0 lrwxrwxrwx 1 root root 14 May 7 10:41 /usr/local/lib/libol.so.0 -> libol.so.0.0.0* root@shell [/home/spy/syslog-ng-1.1.14]# ls -l /usr/local/lib/libol.so.0.0.0 -rwxr-xr-x 1 root root 40523 May 7 10:41 /usr/local/lib/libol.so.0.0.0* root@shell [/home/spy/syslog-ng-1.1.14]# ----------- Can someone help me please? thank you, Osman Taskin >Grab the latest version 1.1.14 (fixed compile error) you'll also need to >get updated libol as well. >--Jubal --- Jubal Kessler, Chief Systems Administrator, interQ Incorporated PGP Key Fingerprint: 5D32 BEB1 8E4B B454 6B9A FDCD 2D4C 19DD 9B47 7DC4 On Fri, 7 May 1999, s wrote: > > Hello there, > > i have got RH52 with 2.2.3-5 kernel and i always had problems with compiling > syslog. Can someone gimme a tip what to fix, so > i can compile it please?

2 4

syslog-ng-1.1.14
by s 08 May '99

08 May '99

Hello, i have installed s.1.1.4 and libol0.10 on my other RH5.2 (Kernel 2.0.36) box. its the same result; libol.so.0: cannot open shared object file: No such file or directory i tried that on 2 different boxes and kernels. Its the same. I wonder why noone reported that before. can someone else confirm that or do i make something wrong? regards, osman taskin

1 0

1.1.14 being bashful?
by Justin Wienckowski 08 May '99

08 May '99

Hey all, Recently downloaded, compiled, and installed syslog-ng 1.1.14 and libol. After a few mistarts with the config file, syslog-ng started up without any error messages. However, it doesn't appear that any messages are actually getting logged. None of the logfiles specified recieve data nor are they opened. The only files syslog-ng seems to open are two sockets, /dev/tty10, and /dev/tty9. Any ideas? My config file is attached. -Justin Wienckowski jwiencko(a)vt.edu ---syslog-ng.conf--- # # /etc/syslog-ng/syslog-ng.conf # # Last update: 1999 04 07 # # sources source src { udp 0.0.0.0,512; unix-stream /dev/log; internal; }; # destinations destination console { file /dev/console; }; destination kernel_log { file /var/log/kernel.log; }; destination secure_log { file /var/log/secure.log; }; destination ssh_log { file /var/log/ssh.log; }; destination mail_log { file /var/log/mail.log; }; destination ftp_log { file /var/log/ftp.log; }; destination msgs_log { file /var/log/messages.log; }; destination crit_log { file /var/log/crit.log; }; destination log_term { file /dev/tty10; }; destination secure_term { file /dev/tty9; }; # filters filter kernel { facility(kern) or program("kernel"); }; filter mail { facility(mail) or program("qmail"); }; filter ftp { program(".*ftpd"); }; filter ssh { match("ssh.*"); }; filter secure { ( facility(authpriv) or match("Overseer") ) and not match("ssh.*"); }; filter crit { priority(crit); }; filter other { not ( facility(kern) or facility(mail) or facility(authpriv) ) or match("Overseer"); }; # loging directives log { source src; filter other; destination msgs_log; destination log_term; }; log { source src; filter kernel; destination kernel_log; }; log { source src; filter mail; destination mail_log; }; log { source src; filter ftp; destination ftp_log; }; log { source src; filter ssh; destination ssh_log; }; log { source src; filter secure; destination secure_log; destination secure_term; }; log { source src; filter crit; destination console; destination crit_log; };

2 2

syslog-ng 1.1.14 and the promised host filter
by Balazs Scheidler 07 May '99

07 May '99

Hi, I have released syslog-ng 1.1.14 which implements two additional filters, which you can use to direct log messages: host(regexp) match against the source hostname (where the message came from) with this you can use syslog-ng as a central log host match(regexp) match against the content of the log message And the implementation of program() has been changed, so that it uses regexps too. I have found the hopefully last leak in syslog-ng, which caused it to eat some memory when HUP signals were sent to it. This version requires libol 0.1.10. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

2 1

host & match filter in cvs
by Balazs Scheidler 06 May '99

06 May '99

Hi, For those interested I added the following filters to syslog-ng: host(regexp) - filters based on the host part of a log message match(regexp) - filters based on message contents And changed the program filter to use regexps instead of simple strings. CVS instructions can be found on the web page. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

compilation fix for 1.1.12
by Balazs Scheidler 05 May '99

05 May '99

Hi, Version 1.1.12 has a compilation error regarding yydebug. Simply uncomment the line 159 in cfgfile.c: if ((cfg = fopen(name, "r")) != NULL) { yyin = cfg; /* yydebug = 1; */ <-- this line res = yyparse(); fclose(cfg); if (!res) { -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 1

syslog-ng 1.1.12 and libol 0.1.9
by Balazs Scheidler 04 May '99

04 May '99

Hi, I have released $SUBJ containing yet another bunch of fixes. It should really be stable by now, though not all features are there. I have added some preliminary man pages, and some documentation. Please tell me any grammatical mistakes, spelling errors. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng 1.1.11
by Balazs Scheidler 04 May '99

04 May '99

Hi, Some bugs were introduced in the previous portability fixes in 1.1.10, so here is version 1.1.11, which fixes them. Also if an internal log source was not specified a segmentation fault occured. The previous libol 0.1.8 release will do, so you don't need to upgrade that. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

Re: Syslog-ng man pages
by Balazs Scheidler 03 May '99

03 May '99

Hi, I don't know if you are on the syslog-ng mailing lists, that's why I am CC there too. > If you like a hand rewritting the man pages for syslog-ng i'd be > glad to help. Only thing I would need is the syntax for the pages, i'm > afriad i'm not a programmer and i'm a bit new to syslog-ng but I have a > tendency to learn quick So if you still have some time to write some of syslog-ng man pages, please do so. I am going to write a short introduction to syslog-ng configuration file format. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0