- syslog-ng - lists.balabit.hu

portability fixes
by Balazs Scheidler 28 Apr '99

28 Apr '99

Hello, I have released syslog-ng 1.1.10, and libol 0.1.8 fixes a couple of bugs compiling it on Solaris (tested on "SunOS almos 5.6 Generic sun4d sparc SUNW,SPARCcenter-2000") and should also fix that BSD header problem. (though this is not tested yet) Nothing else changed now. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng 1.1.9
by Balazs Scheidler 28 Apr '99

28 Apr '99

I have released syslog-ng version 1.1.9, the latest development version of syslog-ng. I have added parameter parsing, the ability to go into the background and several bugfixes. You'll need libol 0.1.7, so be sure to download that one too. This version is something that could also be used in production environment. libol has been completely split off, and it is installed as a shared library on your system. I have removed the --with-libol switch from configure, syslog-ng will automatically find your installed version of libol. (using the installed libol-config script) I think I'll do a feature freeze now, stabilize syslog-ng, and release 1.2.x as it is, since advanced features are not important for everyone. So please tell me any build and runtime problems you encounter. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

2 4

Re: syslog-ng -- confirmation of subscription -- request 502636
by Stefan Monnier 28 Apr '99

28 Apr '99

confirm 502636

1 0

Re: syslog-ng -- confirmation of subscription -- request 502634
by Stefan Monnier 28 Apr '99

28 Apr '99

confirm 502634

1 0

Re: syslog-ng -- confirmation of subscription -- request 502636
by Stefan Monnier 28 Apr '99

28 Apr '99

confirm 502636

1 0

Re: syslog-ng -- confirmation of subscription -- request 502636
by Stefan Monnier 27 Apr '99

27 Apr '99

confirm 502636

1 0

Re: [syslog-ng] syslog-ng 1.1.7 released
by Stefan Monnier 27 Apr '99

27 Apr '99

Richi Plana said: > One problem Un*x systems administrator haven't totally agreed on is > how to rotate the logs if there was no way to reset the daemon which > had opened the log (and kept it open). The problem has to do with I have never had such a problem and any such program should just be fixed (or not be used). > filehandles. Some programs open a log and keep it open instead of > closing and reopening them when the need arises. Some admins say log > rotators should just cp the log to a backup and do the equivalent of a > 'cat /dev/null > logfile'. (which may cause some problems in some > situations). You'll end up creating big sparse files, which is OK except that `cp' will most likely not keep the sparseness so the backups will be big mostly empty (but not sparse) files. > Personally, I believe there to be three solutions to log rotation: 1) > If the program doesn't support log rotation, kill the daemon, rotate > the logs and restart the program; 2) if the program only supports > SIGHUP to re-read the configs and close and reopen the logs, just cp > the file and SIGHUP it; and, 3) (the best solution) if the program > supports a way to close, mv and reopen a new log file, then all your > problems are solved. If you don't like the name the program used for > the backup, just mv it. Solution 2 is bogus because it suffers from a race condition. You really don't want to use `cp' but `mv' there: mv log log.bak touch log; chmod 640 log kill -HUP <daemon> Solution 3 is only acceptable if the destination of the `mv' is known so that you can easily do postprocessing of this backed up log file. I'm thoroughly against any logrotation support in any program, except for the usual reopen-upon-sighup. The few programs that support it never support a wide enough range of alternatives. Log rotation is better served by separate tools. Of course, as long as you can turn off the logrotation (and use the conventional mv+sighup method), it's only a question of wasted resources (human resources for coding, mostly) and an additional source of bugs. Stefan

2 1

central log host
by Valur Guðmundsson 26 Apr '99

26 Apr '99

Is it posible to set up a central log host that takes log messages from many machines through the same port and then sorts the messages depending on name of the host that sent it.

2 1

Where are some docs?
by Marcin Okraszewski 25 Apr '99

25 Apr '99

Can anyone tell me, where can I find documents that describe config file. There wasn't any doc directory in the archive (1.1.8), and in README was written that there should be. -- -------------------------------------------------------------------- Marcin Okraszewski mailto:okrasz@vlo.ids.gda.pl http://www.vlo.ids.gda.pl/~okrasz/ --------------------------------------------------------------------

3 2

syslog-ng 1.1.8 and libol 0.1.6
by Balazs Scheidler 20 Apr '99

20 Apr '99

Hi, I have released syslog-ng 1.1.8 and the corresponding libol version 0.1.6. This version adds support for udp, tcp and unix destinations. (1.1.7 only supported them as sources) Error recovery is not there yet, so if a given destination is not running, it will cause problems for syslog-ng. libol 0.1.6 fixes a few bugs, and I added a libol-config script (similar to gtk-config in gtk) I hope this eliminates build problems some of you encountered on Solaris. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

spam
by spy 19 Apr '99

19 Apr '99

------Transcript of session follows ------- syslog-ng(a)vekoll.saturnus.vein.hu 550 <spy(a)twilight.webbernet.net>... No spam please Subject: remote logging Date: Sat, 17 Apr 1999 08:43:33 +0200 From: s <spy(a)twilight.webbernet.net> To: syslog-ng(a)vekoll.saturnus.vein.hu References: 1 ello, what do you think about a new option in syslog-ng? I though "remote logging" could be very usefull. If someone hacks one system the first thing he will do is to clean the logs. Its very easy to clean the logs because they are in plain ascii format. If you could improve syslog-ng so that it can log remotly, intruders cannot clean the logs and its very easy to exemine the logs and trace him. What do u think about this improvement? spy(a)exploits.to Ì got these mail back, cuz of spam. Please configure your mailing-list better regards, spy

2 1

Re: [syslog-ng] main.c.x missing?
by Scott Dellinger 16 Apr '99

16 Apr '99

On Fri, 16 Apr 1999, Tommi Virtanen wrote: > > > After you install scsh, run make -C src main.c.x > > > - creating that is missing from the Makefiles. > > Umm... reread my last sentence. I can't compile scsh -- there are a > > number of compiler errors. The only RPM I can find is old and doesn't work > > right on my system. Could you just send the main.c.x file? It shouldn't > > be more than a few lines long; I think it only has one class definition in > > it. > Ouch. Misparsed "but it" as "but it [syslog-ng] still.." I figured that's what you had thought. > Here you go. [code snipped] *Much* better. :) Thanks; now it compiles happily. -- Scott Dellinger Systems Administrator, JMU Technical Services dellinsd(a)jmu.edu

1 0

main.c.x missing?
by Scott Dellinger 16 Apr '99

16 Apr '99

I am having problems compiling syslog-ng 1.1.7. Should main.c.x have been included in the distribution? Without it, 'make' tries to call 'make_class', which doesn't work since I don't have scsh. I actually tried installing scsh, but it doesn't compile cleanly on my RedHat 5.2 system. -- Scott Dellinger Systems Administrator, JMU Technical Services dellinsd(a)jmu.edu

2 2

syslog-ng 1.1.7 released
by Balazs Scheidler 15 Apr '99

15 Apr '99

Hi, I have released version 1.1.7 and libol 0.1.4. I added support for udp and tcp sources, and added a program filter, which filters messages based on program name. In addition it is now possible to restart syslog-ng by sending it a HUP signal. Except for sending messages over the network, all syslogd functionality is in place. I am thinking about builtin support for logfile rotation. One could specify rotation parameters in destination statements: destination d_messages { file /var/log/messages rotate(weekly, 9) compress }; What do you think? -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

4 5

Mailman upgrade
by Balazs Scheidler 12 Apr '99

12 Apr '99

Hi, Due to several bugs in our listprocessor mailman 1.0b6, I upgraded to mailman 1.0b11, which seems much more stable. Sadly enough mailman has binary config files, and for several reasons I couldn't simply copy the old configuration to the new one, thus I resubscribed everyone by hand. So you do not need to subscribe again, but any personal settings & passwords have been lost. If you want to modify your settings, simply go to the list preferences page at: http://vekoll.vein.hu/mailman/listinfo Choose the "Email my password" button, and as you have your password, set your preferences as you like it. If you have any problems, please send me them at: bazsi(a)balabit.hu -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

Mailman upgrade
by Balazs Scheidler 12 Apr '99

12 Apr '99

Hi, Due to several bugs in our listprocessor mailman 1.0b6, I upgraded to mailman 1.0b11, which seems much more stable. Sadly enough mailman has binary config files, and for several reasons I couldn't simply copy the old configuration to the new one, thus I resubscribed everyone by hand. So you do not need to subscribe again, but any personal settings & passwords have been lost. If you want to modify your settings, simply go to the list preferences page at: http://vekoll.vein.hu/mailman/listinfo Choose the "Email my password" button, and as you have your password, set your preferences as you like it. If you have any problems, please send me them at: bazsi(a)balabit.hu -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng 1.1.6 & libol 0.1.3
by Balazs Scheidler 11 Apr '99

11 Apr '99

Hi, I released $SUBJECT, which implements filtering syntax as suggested Richi Plana <richip(a)mozcom.com>, and fixes some of the build problems reported earlier. You can find them at the usual places. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

Question on semantics
by Richi Plana 11 Apr '99

11 Apr '99

Hi, Not to mean to be nitpicking, but the original syslog man pages state that priority is defined to be: priority ::= facility . level So shouldn't the config semantics be: filter f_messages { ( level(info) or level(notice) or level(warn) ) and not facility(auth) and not facility(authpriv) and not facility(cron) and not facility(daemon) and not facility(mail) and not facility(news); }; or better yet, filter f_messages { level(info,notice,warn..crit) and not facility(auth,authpriv,cron,daemon,mail,news); }; L L Richi Plana 8^) ,-,-. ,-,-. ,-,-. ,-,-. ,- LL LL Systems Administrator / / \ \ / / \ \ / / \ \ / / \ \ / / LLLLL Mosaic Communications, Inc. \ \ / / \ \ / / \ \ / / \ \ / / LLLLL mailto:richip@mozcom.com `-'-' `-'-' `-'-' `-'-' ------PGP key http://www2.mozcom.com/~richip/richip.asc ----------------

2 2

libol 0.1.1 compile problem and a suggestion
by Richi Plana 11 Apr '99

11 Apr '99

You wrote: |o| I have released $SUBJ, though did not announce them widely, only on |o| this list. I worked on parsing and evaluating filter statements. The new |o| syntax will be similar to function calls: I tried compiling libol-0.1.1 on a RH5.2 Linux system and came up with the ff. error: make[1]: Entering directory `/home/richip/src/libol-0.1.2/src' cd /home/richip/src/libol-0.1.2 && autoheader /usr/bin/autoheader: Symbol `HAVE_ATTRIBUTE' is not covered by /usr/lib/autoconf/acconfig.h ./acconfig.h I am not familiar with autoconf and I'm hoping someone on the list could tell me what to do. I did see the ff. line in the output of 'configure': checking for __attribute__... yes and thought it would be safe to add '#define HAVE_ATTRIBUTE 1' in ./acconfig.h . Was that bad? |o| The only issue left is how to deal with priorities. Original |o| syslogd accepts a message above or equal to the a specific |o| priority (and not only the specific priority). I may add an |o| optional parameter to priority() so that the relation could also |o| be specified: |o| |o| priority(info, GE) How about a level range specified using the '..' operator: priority(debug..notice,err,alert..) L L Richi Plana 8^) ,-,-. ,-,-. ,-,-. ,-,-. ,- LL LL Systems Administrator / / \ \ / / \ \ / / \ \ / / \ \ / / LLLLL Mosaic Communications, Inc. \ \ / / \ \ / / \ \ / / \ \ / / LLLLL mailto:richip@mozcom.com `-'-' `-'-' `-'-' `-'-' ------PGP key http://www2.mozcom.com/~richip/richip.asc ----------------

2 1

Link to new conf style on web page is wrong
by Richi Plana 11 Apr '99

11 Apr '99

Hi, On the syslog-ng web page, the link to the new conf style is: http://www.balabit.hu/products/syslog-ng.conf.sample-1.1 when it actually is: http://www.balabit.hu/products/syslog-ng.sample-1.1 L L Richi Plana 8^) ,-,-. ,-,-. ,-,-. ,-,-. ,- LL LL Systems Administrator / / \ \ / / \ \ / / \ \ / / \ \ / / LLLLL Mosaic Communications, Inc. \ \ / / \ \ / / \ \ / / \ \ / / LLLLL mailto:richip@mozcom.com `-'-' `-'-' `-'-' `-'-' ------PGP key http://www2.mozcom.com/~richip/richip.asc ----------------

1 0

syslog-ng-1.1.5
by Balazs Scheidler 10 Apr '99

10 Apr '99

Hi, I have released syslog-ng 1.1.5, in which I implemented the new filtering code. This version could even be used as a syslogd replacement, since you can use priorities and facilities to direct log messages, though advanced syslog-ng features are not ready yet. Here is a sample configuration file I used to test the code: --- source src { unix-stream /dev/log; }; destination messages { file /dev/tty9; }; destination other { file /dev/tty10; }; filter f_messages { (priority(= info) or priority(= notice) or priority(= warn)) and not facility(auth) and not facility(authpriv) and not facility(cron) and not facility(daemon) and not facility(mail) and not facility(news); }; log { source src; filter f_messages; destination messages; }; log { source src; destination other; }; --- I am going to announce this on freshmeat, please test this version for both program- and build errors. Thanks. -- Bazsi

1 0

syslog-ng 1.1.4 & libol 0.1.1
by Balazs Scheidler 09 Apr '99

09 Apr '99

Hi, I have released $SUBJ, though did not announce them widely, only on this list. I worked on parsing and evaluating filter statements. The new syntax will be similar to function calls: filter f_messages { priority(info) and not facility(authpriv) }; you can use parentheses and several and/or operators. I hope this will make syslog-ng easier to use and configure. The only issue left is how to deal with priorities. Original syslogd accepts a message above or equal to the a specific priority (and not only the specific priority). I may add an optional parameter to priority() so that the relation could also be specified: priority(info, GE) which would mean that priorities of info and above are forwarded. I am going out the next two days, but on returning I plan to continue working on syslog-ng. -- Bazsi

1 0

syslog-ng 1.1.3
by Balazs Scheidler 09 Apr '99

09 Apr '99

Hi, I have released syslog-ng 1.1.3, which fixes the dependency on scsh, and adds affile.c.x to the distribution. I have began implementing filter statement parsing, though only syntax checking is done. -- Bazsi

1 0

snapshot 1.1.2 has been released
by Balazs Scheidler 09 Apr '99

09 Apr '99

Hello, I have released version 1.1.2 of syslog-ng. It is available at http://www.balabit.hu/downloads/syslog-ng/source. Together with the source tarball you'll need the libol package, which I have split off from the main distribution tree. For installation instructions see the web page (http://www.balabit.hu/products/syslog-ng) As several of you (and sometimes even me) has troubles using filter statements, and I am about to reimplement them, I ask you to tell me about your proposals on a better syntax. I think both AND and OR connections between expressions should be allowed in one statement, e.g: filter f_messages { (priority info AND not facility authpriv) or facility mail }; maybe to make syntax cleaner, I'll make functions from priority and facility, so that the above line would become: filter f_messages { (priority(info) and facility(authpriv) or facility(mail); }; What do you think? -- Bazsi

3 6

Problems with syslog-ng 1.0.4
by Cristiano Lincoln Mattos 06 Apr '99

06 Apr '99

Hi, Im trying to replace syslog with syslog-ng at my site. Version 1.0.4, libc5 (rh42). Everything compiled fine, but i am having trouble getting the equivalent to this syslog line below to work: *.info;mail.none;authpriv.none /var/log/messages Here is what i tried: source local { udp 0.0.0.0,514; unix-stream /dev/log; }; destination d_messages { file /var/log/messages; }; destination d_authpriv { file /var/log/secure; }; destination d_mail { file /var/log/maillog; }; filter f_mail { facility mail; }; filter f_authpriv { facility authpriv; }; filter f_mess { priority info; not facility mail; not facility authpriv; }; log { source local; filter f_mail; destination d_mail; }; log { source local; filter f_mess; destination d_messages; }; log { source local; filter f_authpriv; destination d_authpriv; }; When i generate messages for mail.notice, it goes to /var/log/messages *and* /var/log/maillog, and when i generate them for authpriv.notice, they go to /var/log/messages *and* to /var/log/secure, which is wrong (they are not supposed to go to /var/log/messages). The strange thing is, if i try this filter line: filter f_mess { priority info; not facility mail; }; .. and generate messages for mail.notice, it goes (correctly) to only /var/log/maillog. Also, if i try this: filter f_mess { priority info; not facility authpriv; }; ... and generate messages for authpriv.notice, it goes (correctly) to only /var/log/authpriv. So... if i put both together, it doesn't work, if i put each one separately, they do. Is this correct? Is there any other way i can use that syslog-type line? PS: i tried using the conf-convert.pl script, and it did not work, either. Thank you, -- Cristiano Lincoln Mattos Recife / Brazil

3 2