- syslog-ng - lists.balabit.hu

template keyword for non-file destinations
by David Parker 11 Oct '02

11 Oct '02

Hi list, I am attempting to use templated output directly to a program's stdin instead of relying on a pipe and seperately starting a proxy process to monitor the pipe. For the curious, I'm using libdbi (http://libdbi.sourceforge.net) to write a tiny C wrapper that feeds its standard input into the database. I also saw a similar post at http://lists.balabit.hu/pipermail/syslog-ng/2002-September/003841.html "template() and template_escape() extension for all destination drivers" Is this or a similar patch likely to be included in an upcoming release? Thanks, David -- David Parker <dparker(a)novacoast.com> Lead Developer, Novacoast NovaGuardian http://www.novacoast.com

1 0

Foreground patch for syslog-ng 1.4.16
by Rolf Petter Halle 11 Oct '02

11 Oct '02

Hi! In order to run syslog-ng under supervise control (http://cr.yp.to/daemontools.html) I've added support to start it in the foreground. Hopefully, this patch (or similar functionality) can be added to the source. Rolf Petter Halle

1 0

logging with $HOST and no $HOST
by JR Mayberry 11 Oct '02

11 Oct '02

When I do an lsof on my syslog-ng server I will see entries like (i'm setup with : file(/log/$HOST/$MONTH-$DAY-$YEAR); ) "/log -- 13" (13 because its 1pm now) "/log -- 10-11-2002/13" So, I'm obviously losing logs, I need to know how I can fix this and get these logs (even if it's to a "dump all poorly malformed log packets to a single file" solution) syslog-ng 1.5.15 thanks. __________________________________________________ Do you Yahoo!? Faith Hill - Exclusive Performances, Videos & More http://faith.yahoo.com

1 0

Re: syslog-ng and libol path
by Balazs Scheidler 11 Oct '02

11 Oct '02

On Fri, Oct 11, 2002 at 11:49:12AM +0200, Steve Alberty wrote: > Hi, > > i'm using your excellent syslog-ng application and have to try update > from verson 1.5.17 to 1.5.21. > > The Problem is, in the current version (1.5.21) the configure script can > not recognize an alternative path to libol. > > eg. > > ./configure --prefix=/usr/local/syslog-ng/1.5.21 > --with-libol=/usr/local/libol/0.3.3/bin > > break-up with: > 'libol-config not found in the specified location' > > I think something is wrong in configure.in, because it test if > libol-config is in the given directory is found, but if I specify the > directory to /usr/local/libol/0.3.3/bin, then building breaks with: > > gcc -DHAVE_CONFIG_H -I. -I/usr/src/syslog-ng-1.5.21/src -I. -g -O2 > -Wall -I/usr/src/libol-0.3.3/src -D_GNU_SOURCE -c main.c > In file included from main.c:26: > syslog-ng.h:31: objects.h: file not found --with-libol option is needed if you didn't install libol itself. If you did, simply set your path prior to running configure: PATH=/usr/local/libol/0.3.3/bin:$PATH ./configure --prefix=... Otherwise do not install libol, and use the configure switch: ./configure --with-libol=../libol-0.3.3 --prefix=... -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Security: syslog-ng 1.4.x and 1.5.x is vulnerable to buffer overflow
by Balazs Scheidler 11 Oct '02

11 Oct '02

Hi, I'm writing this mail to announce that syslog-ng 1.4.x and 1.5.x are both vulnerable to a buffer overflow. Exploiting the bug needs a site specific exploit to be written, as the way the buffer is overwritten depends on the local configuration file. The buffer overflow can be triggered when templated output files or filename templates are used. Everybody is urged to upgrade to 1.4.16 or 1.5.21, these are available at the usual place, http://www.balabit.hu/en/downloads/syslog-ng/downloads/ The bug was found be me, so possibly nobody else knows the details. Of course diffing the new version with the previous one unveils the problem. Bugtraq announcement will be sent out soon. Debian package has been released and accepted (though mirrors need time to get the new one) ps: sigh, this was my first BoF :( -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

5 25

Version 1.5.21
by Jerome Peducasse 11 Oct '02

11 Oct '02

Hello, With syslog-ng 1.5.21 (libol 0.3.4), I can't use udp or tcp destination. Example: # cat ./syslog-ng.conf #Minimal configuration file source s_sys { unix-dgram("/dev/log"); internal(); }; destination d_alllog { file("/var/log/all.log" template_escape(off) owner(root) group(sys) perm(0640)); }; destination d_loghost { udp("loghost" port(514)); }; log { source(s_sys); destination(d_alllog); destination(d_loghost); }; # /usr/local/sbin/syslog-ng.1.5.21 -V syslog-ng 1.5.21 # /usr/local/sbin/syslog-ng.1.5.21 -f ./syslog-ng.conf Error creating AF_INET socket (Succès) Error initializing configuration, exiting. # ps auxw | grep -c [s]yslog 0 # /usr/local/sbin/syslog-ng.1.5.18 -V syslog-ng 1.5.18 # /usr/local/sbin/syslog-ng.1.5.18 -f ./syslog-ng.conf # ps auxw | grep [s]yslog root 12680 0.0 0.6 1484 776 ? S 16:28 0:00 /usr/local/sbin/syslog-ng.1.5.18 -f ./syslog-ng.conf # strace /usr/local/sbin/syslog-ng.1.5.21 -f ./syslog-ng.conf .... .... pipe([3, 4]) = 0 fork() = 12727 close(4) = 0 read(3, Error creating AF_INET socket (Succès) Error initializing configuration, exiting. "\1", 1) = 1 --- SIGCHLD (Le processus `enfant' a terminé.) --- _exit(1) = ? Could you help me please? My OS is Linux -- Jerome Peducasse Wanadoo Portails - Sophia Antipolis

1 0

STILL MANGLED MESSAGES! Please Help!
by harald schmidt 11 Oct '02

11 Oct '02

Hi, Syslog-ng 1.5.21 still produces mangled messages into pipes! This happens ca. 10 times a day. Here an example what syslog-ng writes in the pipe: INSERT INTO all_messages_200210 (host, facility, priority, tag, date, time, program, msg) VALUES ( 'clc', 'daemon', 'debug', '1f', '2002-10-10', '11:24:56', 'nrpe', 'nrpe[15656]: Host is asking for command \'check_total_procs\' to be rINSERT INTO all_messages_200210 (host, facility, priority, tag, date, time, program, msg) VALUES ( 'clc', 'daemon', 'debug', '1f', '2002-10-10', '11:24:57', 'nrpe', 'nrpe[15656]: Return Code: 0, Output: OK - 67 processes running' ); the 3rd line should look like this: '2002-10-10', '11:24:56', 'nrpe', 'nrpe[15656]: Host is asking for command \'check_total_procs\' to be run...' ); But syslog-ng doesn't finish that line. Here another example: INSERT INTO all_messages_200210 (host, facility, priority, tag, date, time, program, msg) VALUES ( 'clc', 'daemon', 'debug', '1f', '2002-10-10', '01:26:52', 'nrpe', 'nrpe[15INSERT INTO all_messages_200210 (host, facility, priority, tag, date, time, program, msg) VALUES ( 'clc', 'daemon', 'debug', '1f', '2002-10-10', '01:26:52', 'nrpe', 'nrpe[15387]: Return Code: 1, Output: 2 users currently logged in' ); Here is my syslog-ng.conf: # # Syslog-ng example configuration for for Debian GNU/Linux # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # # 1.options options { long_hostnames(off); use_fqdn(yes); sync(0); log_fifo_size (500); gc_busy_threshold(768); use_time_recvd(1); }; # 2.sources source s_kernel { pipe("/proc/kmsg"); internal(); }; source s_stream { unix-stream("/dev/log"); internal(); }; source sn_udp { udp(); }; # 3.destinations destination df_all_messages { file("/var/log/all_messages-$YEAR$MONTH$DAY"); }; destination dq_mysql_all_messages { pipe("/var/pipes/mysql.fifo" template("INSERT INTO all_messages_$YEAR$MONTH (host, facility, priority, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; # 4.Log log { source(s_stream); source(s_kernel); source(sn_udp); destination(df_all_messages); }; log { source(s_stream); source(s_kernel); source(sn_udp); destination(dq_mysql_all_messages); }; And here the Script that reads from the pipe (I'm starting a new database every month): #!/bin/sh datum=$(date +%Y%m) if [ -e /var/pipes/mysql.fifo ]; then while [ -e /var/pipes/mysql.fifo ] do /usr/local/mysql/bin/mysql -vvT syslog_$datum < /var/pipes/mysql.fifo done else mkfifo /var/pipes/mysql.fifo fi My system: # uname -a Linux clc 2.4.10-4GB #1 Tue Sep 25 12:33:54 GMT 2001 i686 unknown Could anyone PLEASE help me? thanks Harald -- Holen Sie sich den Turbo fürs Internet: T-DSL! http://bonus.gmx.net/?gid=46842444&prid=11

3 2

FW: [bugtraq] syslog-ng buffer overflow
by Nicholas Berry 10 Oct '02

10 Oct '02

Baszi, Have you (or your group) been notified about this? How valid is the solution given? Will this issue be addressed in the next 1.5 release? Thanks, Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. nberry(a)ragingwire.com -----Original Message----- From: Holtzl Peter [mailto:holtzl.peter@balabit.hu] Sent: Thursday, October 10, 2002 5:44 AM To: bugtraq(a)securityfocus.com Subject: syslog-ng buffer overflow ---------------------------------------------------------------------------- PACKAGE : syslog-ng VERSION : -1.4.15 (stable) and -1.5.20 (development) SUMMARY : buffer overflow TYPE : remote exploit VULNERABLE: : exploitable (not in default configuration) ZORP-OS SPECIFIC : No ZSA-AUTHOR : Balazs Scheidler <balazs.scheidler(a)balabit.com> ZSA-ID : ZSA-2002-014 DATE: : 2002-10-03 15:00 ---------------------------------------------------------------------------- BACKGROUND: Syslog-NG is a portable syslog implementation. Its highlights include regexp based log selection, TCP transport and more. For more information: http://www.balabit.hu/en/downloads/syslog-ng/ Zorp OS is a Debian GNU/Linux based operating system hardened for running Zorp Professional modular application level firewall suite. Its core framework allows the administrator to finetune proxy decisions (with its built-in script language), and fully analyze complex protocols including SSL embedded protocols. For more information: http://www.balabit.hu/en/products/ZorpPro/ DESCRIPTION: To make it easier to specify message destinations, syslog-ng supports macros in destination filenames as the following log snippet shows: destination d_messages_by_host { file("/var/log/$HOST/messages"); }; The same syntax is used when specifying the contents of destination files: destination d_special_messages { file("/var/log/messages" template("$ISODATE $HOST $MSG\n")); }; The problem lies in the way macro expansion handles constant characters. (ie everything other than macro references). As syslog-ng expands macros it usesa buffer, and a variable called 'left', which contains the number of characters available in the buffer. When a constant character is appended, this variable is not decremented, thus when expanding macros incorrect bounds checking is performed. IMPACT: If templated filenames or templated output is used, it is possible to overflow a buffer. The number of bytes exceeding the allocated buffer depends on the exact template being used. It is believed that this overflow can be exploited, given enough constant characters are present in the template string. SOLUTION: Upgrade syslog-ng to 1.5.21 (devel) or 1.4.16 (stable) or apply the following patch: diff -u -r1.52 -r1.53 --- affile.c 21 Aug 2002 14:03:50 -0000 1.52 +++ affile.c 27 Sep 2002 09:11:33 -0000 1.53 @@ -859,7 +859,7 @@ { "SOURCEIP", M_SOURCE_IP } }; char format[cfg->log_msg_size + 1], *format_ptr = format; - int left = sizeof(format); + int left = sizeof(format) - 1; int i, j; i = 0; @@ -888,6 +888,7 @@ *format_ptr = template->data[i]; format_ptr++; i++; + left--; } } *format_ptr = 0; REFERENCES: 1. http://www.balabit.hu/static/zsa/ZSA-2002-014-en.txt 3. http://www.balabit.hu/en/downloads/syslog-ng/ 3. http://www.balabit.hu/en/products/ZorpPro/ Höltzl Péter BalaBit IT Kft | Tel: +36 1 371-0540 | GnuPG Fingerprint: holtzl.peter(a)balabit.hu | Mobil: +36 20 366-9667 | DB30 5E5B 8777 C06F 5A1F http://www.balabit.hu/ | Fax: +36 1 208-0875 | 4586 CEAF 9678 4A89 CFD6

2 1

Erreur configuration file
by Laurent Mesuré 09 Oct '02

09 Oct '02

Hi, i ve used the HOWTO from Ben Russo to install syslog-ng on a Mandrake Linux box. I ve already have a PostgreSQL running on this box. I 've build both libol and syslog-ng without any problem. I ve made all steps specified in the HOWTO. But when i launch my /etc/init.d/syslog-ng i go the following error: Starting syslog-ng: parse error at 37 Parse error reading configuration file, exiting. And in the configuration file at line 37 i have the following lines: destination d_msgs { file("/var/log/messages" template("$FULLDATE $HOST $FACILITY.$PRIORITY $MSG\n")); }; What happened? regards -- Laurent Mesuri Steria Group http://www.steria.com SAF/DAF Boulogne Billancourt France Tel: +33.1.46.20.65.57 Fax: +33.1.46.20.65.65 Mob: +33.6.82.68.15.22

3 3

Re: Solved: Re: troubles with postfix and syslog-ng 1.5.21: lost log lines
by Balazs Scheidler 09 Oct '02

09 Oct '02

Hi, Thanks for finding this out. Ccing to the syslog-ng list. postfix is chrooted, and thus cannot reopen log connections from the chrooted jail. if one runs postfix it is advisably to fetch logs from /var/spool/postfix/dev/log It's not syslog-ng specific though. Nate could you add this to the FAQ? On Wed, Oct 09, 2002 at 03:05:07PM +0200, Dr. Peter Bieringer wrote: > > > --On Dienstag, 8. Oktober 2002 15:48 +0200 Balazs Scheidler > <bazsi(a)balabit.hu> wrote: > > >> 2) after restarting syslog-ng, postfix/nqmgr do no longer log > >> > >> That's very strange, I don't find a solution until now. Do you have > >> hints? > > > > this is a libc issue IMHO, libc doesn't immediately reopen log connections > > if sending a message fails. as you restart syslog-ng the connections to > > the previous instance of syslog-ng are lost. > > Looks like through a magic mechanism, logging works on startup also by the > chrooted-postfix process. To reestablish the log on syslog-ng restart, the > log socket has to be connected again: > > > -- syslog-ng.conf 8 Oct 2002 12:13:53 -0000 1.9 > +++ syslog-ng.conf 9 Oct 2002 12:54:56 -0000 > @@ -13,6 +13,7 @@ > > source s_local { internal(); > unix-stream("/dev/log" keep-alive(yes) > max-connections(100)); > + unix-stream("/var/spool/postfix/dev/log" keep-alive(yes) > max-connections(100)); > file("/proc/kmsg"); > }; > > > Perhaps an entry for a FAQ. Also the one with the too few log connect > limits. > > Peter > -- > Dr. Peter Bieringer Phone: +49-8102-895190 > AERAsec Network Services and Security GmbH Fax: +49-8102-895199 > Wagenberger Straße 1 Mobile: +49-174-9015046 > D-85662 Hohenbrunn mailto:pbieringer@aerasec.de > Germany Internet: http://www.aerasec.de > PGP/GPG: http://www.aerasec.de/wir/publickeys/PeterBieringer.asc > -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

apache logs, again
by Andreas Hasenack 08 Oct '02

08 Oct '02

Ok, I'm using the tail | logger thing and it sort of works. But there is a problem: date/time. I get entries like this in mysql: (long line below, sorry) 714 machine local4 info 2001-12-31 00:00:00 apache: 127.0.0.1 - - [07/Oct/2002:17:43:41 -0300] "POST /syslog/results.php HTTP/1.1" 200 700 Of course, only the date/time of the entry itself (msg field) is correct. Logger doesn't seem to add date/time info to the logs it sends. Any clever way around this? Is this a logger bug?

2 3

getting a build error on Solaris8,
by Todd S. Ness 08 Oct '02

08 Oct '02

here is the output from my make command: I see that res_init is defined in resolve.h on my system in /usr/include/resolve.h, I don't know where to look for yywrap problem. Thanks Todd. make Making all in src make all-recursive Making all in . gcc -g -O2 -Wall -I/opt/a/src/syslog-ng/SunOS5.8/libol-0.3.3/src -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor /opt/a/src/syslog-ng/SunOS5.8/libol-0.3.3/src/.libs/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file res_init main.o yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /opt/a/src/syslog-ng/SunOS5.8/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /opt/a/src/syslog-ng/SunOS5.8/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /opt/a/src/syslog-ng/SunOS5.8/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' -- ToddNess - EDS/StorageTek Infrastructure Specialist 303-661-5854 Better to keep quiet and be thought wise than to speak up and remove all doubt.

2 2

How can I get logs without date,time hostname and facility ?
by alexch 07 Oct '02

07 Oct '02

ok I have correct this line in my syslog-ng.conf destination hosts { file("/var/log/hosts/$HOST/$FACILITY/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" template("$MSG\n") owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; and now log looks like this squid: 1033739673.117 10818 192.168.1.29 TCP_REFRESH_MISS/200 19595 GET http://lists.balabit.hu/pipermail/syslog-ng/ - DIRECT/62.80.73.147 text/html squid: 1033739687.778 3124 192.168.1.29 TCP_MISS/200 180 GET http://216.239.33.102/search? - DIRECT/216.239.33.102 text/html I need exclude word "squid" from logs, it need for SQRMGLOG. It doesn't work correctly with this log How ????????? Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628

2 1

Apologies
by Brett Dubroy 07 Oct '02

07 Oct '02

Hello, It's been brought to my attention that I inadvertently posted a "I'm going home sick" type message to the mailing list; If anyone on the list is in Ottawa, I highly recommend *not* catching the latest round of the flu ;-) TTYL & Apologies Brett --- Brett Dubroy Jetnet Internetworking Services Email : bdubroy(a)jetnet.ca Phone : (613) 237-5995 x 227 This communication contains confidential information intended solely for the use of the individual/s and/or entity or entities to whom it was intended to be addressed. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this transmission is prohibited. If you have received this communication in error, please contact the sender immediately, delete the communication from your system and do not disclose its contents to any third party or use its contents. Any opinions expressed are solely those of the author and do not necessarily represent those of JETNET Internetworking Services Inc. unless otherwise specifically stated.

1 0

internal logging problem
by Carlos Velasco 04 Oct '02

04 Oct '02

Hi, I have tried syslog-ng versions 1.5.18 and 1.5.21 with the same problem. My system is: > uname -a Linux atlas 2.4.19 #1 Tue Aug 6 01:59:40 CEST 2002 i586 unknown syslog-ng.conf: source src { internal(); }; destination syslog { file("/var/log/syslog.log"); }; log { source(src); destination(syslog); }; I can't see any internal messages in /var/log/syslog.log file tcp, udp and unix-streams works fine, only problem is with internal. Any help would be apreciated. Regards, Carlos Velasco

2 7

RE: [syslog-ng]How can I get logs without date,time hostname and facility ?
by Hamilton, Andrew 04 Oct '02

04 Oct '02

It means that you want to define your own logfile format. To do this you use the template function. $MESSAGE is a MACRO that is defined inside syslog-ng and returns only the message portion of the log entry which is what you said you were looking for. -----Original Message----- From: alexch [mailto:alexch@gc.lviv.ua] Sent: Friday, October 04, 2002 8:22 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]How can I get logs without date,time hostname and facility ? What does it mean ???? template("$MESSAGE\n"); Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

How can I get logs without date,time hostname and facility ?
by alexch 04 Oct '02

04 Oct '02

What does it mean ???? template("$MESSAGE\n"); Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628

1 0

RE: [syslog-ng]How can I get logs without date,time hostname and facility ?
by Hamilton, Andrew 04 Oct '02

04 Oct '02

Alex, Try use the template function to in your destination file definition. I haven't used this so I'm not 100% sure of the syntax but you can try the destination. You might have to tweak it a bit to get it right. destination hosts { file("/var/log/hosts/$HOST/$FACILITY/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(src); destination(hosts); template("$MESSAGE\n"); }; Regards, Drew -----Original Message----- From: alexch [mailto:alexch@gc.lviv.ua] Sent: Friday, October 04, 2002 7:53 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]How can I get logs without date,time hostname and facility ? Ok I have done that my squid's access.log works via syslog-ng. That's nice. I get log given below -------------cut----------------- Oct 4 14:34:48 gw squid: 1033731288.219 1234 192.168.1.29 TCP_MISS/000 0 GET http://www.sans.org/infosecFAQ/sec_solaris.htm - NONE/- - Oct 4 14:34:48 gw squid: 1033731288.755 1764 192.168.1.29 TCP_MISS/200 192 GET http://216.239.33.102/search? - DIRECT/216.239.33.102 text/html -------------cut----------------- but I want to get log without "Oct 4 14:34:48 gw squid:" (date,time hostname and facility) How can I do it??? my syslog-ng.conf ------begin------------- options { keep_hostname(no); long_hostnames(off); sync(0); }; # source src { unix-dgram("/var/run/log"); # udp(); internal(); file("/dev/klog"); udp(ip("192.168.1.7") port(514)); destination hosts { file("/var/log/hosts/$HOST/$FACILITY/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(src); destination(hosts); }; -----end------ Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

How can I get logs without date,time hostname and facility ?
by alexch 04 Oct '02

04 Oct '02

Ok I have done that my squid's access.log works via syslog-ng. That's nice. I get log given below -------------cut----------------- Oct 4 14:34:48 gw squid: 1033731288.219 1234 192.168.1.29 TCP_MISS/000 0 GET http://www.sans.org/infosecFAQ/sec_solaris.htm - NONE/- - Oct 4 14:34:48 gw squid: 1033731288.755 1764 192.168.1.29 TCP_MISS/200 192 GET http://216.239.33.102/search? - DIRECT/216.239.33.102 text/html -------------cut----------------- but I want to get log without "Oct 4 14:34:48 gw squid:" (date,time hostname and facility) How can I do it??? my syslog-ng.conf ------begin------------- options { keep_hostname(no); long_hostnames(off); sync(0); }; # source src { unix-dgram("/var/run/log"); # udp(); internal(); file("/dev/klog"); udp(ip("192.168.1.7") port(514)); destination hosts { file("/var/log/hosts/$HOST/$FACILITY/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(src); destination(hosts); }; -----end------ Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628

1 0

Re: Bug #161915
by Balazs Scheidler 04 Oct '02

04 Oct '02

On Thu, Oct 03, 2002 at 04:09:27PM -0700, Brian Thomas wrote: > On Thu, Oct 03, 2002 at 12:54:41PM +0200, Balazs Scheidler wrote: > > Hi, > > > > Thanks for the information you provided. > > > > The problem is that the programs do not send \n at the end of line while > > syslog-ng expects one for STREAM oriented sources. (such as unix-stream), > > This seems like a bug in the packages like cron, I would think. If using > a stream source I'd think the daemon would be expected to provide > \n's? libc should do that. there's nothing saying that syslog() calls should be made with a string terminated with NLs. > > > > > Earlier versions of syslog-ng took a message as a full message in the > > following cases: > > 1) either NL or NUL was found in the incoming stream > > 2) after a single read and the source is datagram oriented (UDP or unix-dgram) > > 3) after the incoming buffer is full (specified via log_msg_size()) > > > > For stream oriented sources either 1) or 3) must be true. The strace you > > sent me indicates that some programs do not terminate their messages by > > '\n'. > > > > Checking out the libc sources shows that libc automatically terminates > > messages by NL if LOG_PERROR is set, and also adds a \0 at the end of the > > line if STREAM sockets are used. So both syslog-ng and libc behaviour seems > > to be correct. Something must be wrong anyway as the strace didn't show > > terminating NUL characters. > > > > I assumed that you are using unix-stream sources, but this assumption > > should be true as syslog-ng issues read() instead of recvfrom(). > > I should have provided my syslog-ng.conf. Here's the sources line: > > source src { unix-dgram("/dev/log"); internal(); file("/proc/kmsg" > log_prefix("kernel: ")); udp(); }; > > So no, I'm not using streams, I'm using sockets. And this is > interesting, because this was the default .conf that was installed, and > from looking at the man page I'd think that should be > unix-socket("/dev/log"), right? hmm... unix-dgram sources should call recvfrom and not read. I verified this and they do indeed use recvfrom. (I've just found a bug in the kernel, it returns bogus sockaddrs from recvfrom on SOCK_DGRAM sockets) I workaround in libol is now available at the end of this message. I've also attached the kernel patch that should fix the problem. > > As syslog-ng reads no terminating NUL characters, I think this should be a > > libc issue. stream sockets should always have line terminations, as it is > > not guaranteed by the kernel that a single write will be read by single read > > calls. > > > > I don't know where to submit this bug, to the libc people, or to the cron > > people? > > Assuming that my confusion about unix-dgram vs. unix-stream is just me > being confused, and that I'm using streams even when I specify > unix-dgram, than I would think this is a cron issue. It seems like > they're being sloppy in their logging. can you check lsof -p <syslogng pid> just to see what fd 3 is ? If it is really a unix-dgram socket, it should not be read by read() syslog-ng should have used recvfrom() instead. On my testbox it correctly used recvfrom. PS: please Cc syslog-ng(a)lists.balabit.hu in followups. Kernel patch, which fixes the unix domain socket issue (against 2.4.18): --- af_unix.c~ Mon Feb 25 20:38:16 2002 +++ af_unix.c Fri Oct 4 09:46:26 2002 @@ -1392,6 +1392,9 @@ sk->protinfo.af_unix.addr->name, sk->protinfo.af_unix.addr->len); } + else { + ((struct sockaddr *) msg->msg_name)->sa_family = AF_UNIX; + } } static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg, int size, Libol patch, which works around the problem above: diff -u -r1.28 io.c --- io.c 16 Sep 2002 08:23:22 -0000 1.28 +++ io.c 4 Oct 2002 08:53:41 -0000 @@ -368,7 +368,16 @@ } for (;;) { - int res = recvfrom(closure->fd, buffer, length, 0, (struct sockaddr *) addr, (socklen_t *) addrlen); + int res; + + res = recvfrom(closure->fd, buffer, length, 0, (struct sockaddr *) addr, (socklen_t *) addrlen); + + if (*addrlen == 2) { + /* HACK: this is a workaround of a Linux 2.2 & 2.4 bug, + * it doesn't return anything sensible in sockaddr buf + */ + ((struct sockaddr *) addr)->sa_family = AF_UNIX; + } if (res == 0) { /* on SOCK_DGRAM protocols 0 returned bytes doesn't mean anything */ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

keeping socket open
by Adam Steffes 03 Oct '02

03 Oct '02

Is it possible to make syslog-ng keep a socket open? A developer has some perl code that passes a message to syslog-ng, which opens a socket, sends the message along, then closes the socket. Data that he attempts to write to the same socket isn't written because syslog-ng has already closed the socket. Any help is appreciated. -Adam

1 0

NEW SOLUTION MYSQL INSERT
by _/CaT\_ 03 Oct '02

03 Oct '02

Hi *, It is the code of a system which inserts syslog events into a Mysql DB whith best performances in a more secure and stable way. All the scripts are written in Perl, PAM(DBI,Sys::Syslog) and PERL are required. 1) Inserdb.pl v.1.1 it's the daemon that verify and inserts the data. 2) Allow_ip_table_db.pl v.1.1 This wizard inserts Authorized Ips that are allowed to write on DB (It's important for ddos problems) 3) Load_ip_allows.txt the conf file that inserts authorized Ips 4) Make_facility_level.sql creates tables facility and level 5) syslog_db_insert starts the service under RH 7.3 6) syslog-ng option ------------------------------------------------------------------------ ------------------------------------------------------------ (1) ######################################################################## ############ #!/usr/bin/perl # # SYSLOG_DB_INSERT # inserdb.pl # v.1.1 # # Script to implement INSERT INTO DB MYSQL # # description: Utility for insert syslog events # # by _/CaT\_: # Script Author: # GDM & _/CaT\_ cat_roger22(a)hotmail.com ######################################################################## ############# $|=1; use DBI; #use strict; use Sys::Syslog; use POSIX qw(strftime); sub log_syslog($$); sub warn_log_exit($$); sub error_log_exit($$); &log_syslog('info'," Start $0 - Syslog-ng "); $ENV{'DBI_DSN'}='xxxxxxx'; $ENV{'DBI_USER'}='xxxxxx'; $ENV{'DBI_PASS'}='xxxxxx'; $ENV{'DBI_TABLE_SYSLOG'}='xxxxx'; $ENV{'DBI_PIPE_SYSLOG'}='/path/xxxxx.pipe'; $ENV{'ERR_MSG'}='/path/err_DB_msg.log'; my $DB_SB='mysql'; ### ### Debug mode = 1 ### my $DEBUG = 0; my $test_dsn = $ENV{'DBI_DSN'} || die "DSN not set\n"; my $test_user = $ENV{'DBI_USER'} || die "User not set\n"; my $test_password = $ENV{'DBI_PASS'} || die "Password not set\n"; my $table = $ENV{'DBI_TABLE_SYSLOG'} || die "Table not set\n"; my $pipe = $ENV{'DBI_PIPE_SYSLOG'} || die "Pipe file not set\n"; my $errmsg = $ENV{'ERR_MSG'} || die "File ERR_MSG not set\n"; my $DATA_SOURCE='dbi:mysql:'.$test_dsn.';mysql_compression=1'; my $dbh; my $sth; my $riga; ### normal-signals ### These are the signals which a program might normally expect to encounter and which by default cause it to ### terminate. They are HUP, INT, PIPE and TERM. ### ### error-signals ### These signals usually indicate a serious problem with the Perl interpreter or with your script. They are ### ABRT, BUS, EMT, FPE, ILL, QUIT, SEGV, SYS and TRAP. ### ### old-interface-signals ### These are the signals which were trapped by default by the old sigtrap interface, they are ABRT, BUS, EMT, ### FPE, ILL, PIPE, QUIT, SEGV, SYS, TERM, and TRAP. If no signals or signals lists are passed to sigtrap, ### this list is used. ### local $SIG{HUP} = sub { &error_log_exit('SIGHUP',"Eseguito un kill -1") }; local $SIG{INT} = sub { &error_log_exit('SIGINT',"Eseguito un kill -2") }; local $SIG{QUIT} = sub { &error_log_exit('SIGQUIT',"Eseguito un kill -3") }; local $SIG{TRAP} = sub { &error_log_exit('SIGTRAP',"Eseguito un kill -5") }; local $SIG{KILL} = sub { &error_log_exit('SIGKILL',"Eseguito un kill -9") }; local $SIG{ABRT} = sub { &error_log_exit('SIGABRT',"Eseguito un kill -6") }; local $SIG{BUS} = sub { &error_log_exit('SIGBUS',"Eseguito un kill -7") }; local $SIG{FPE} = sub { &error_log_exit('SIGFPE',"Eseguito un kill -8") }; local $SIG{SEGV} = sub { &error_log_exit('SIGSEGV',"Eseguito un kill -11") }; local $SIG{PIPE} = sub { &error_log_exit('SIGPIPE',"Eseguito un kill -13") }; local $SIG{ALRM} = sub { &error_log_exit('SIGALRM',"Eseguito un kill -14") }; local $SIG{TERM} = sub { &error_log_exit('SIGTERM',"Eseguito un kill -15") }; local $SIG{CHLD} = sub { &error_log_exit('SIGCHLD',"Eseguito un kill -17") }; local $SIG{STOP} = sub { &error_log_exit('SIGSTOP',"Eseguito un kill -19") }; local $SIG{SYS} = sub { &error_log_exit('SIGSYS',"Eseguito un kill -31") }; $dbh = DBI->connect( $DATA_SOURCE, $test_user, $test_password, { RaiseError => 1, PrintError => 2, AutoCommit =>1 } ) or &error_log_exit('DB CONNECT',"$DBI::errstr"); &log_syslog('info','Connect to DB...Start'); ##################################################### ### Load table facility ##################################################### my $exe; my $sth; my $id; my $query; my $facility; my %facility; my $priority; my $level; my %level; $query='SELECT * FROM facility'; $sth=$dbh->prepare($query) || &error_log_exit("$query",$dbh->errstr); $exe=$sth->execute() || &error_log_exit('EXEC',$dbh->errstr); eval { while(($id,$facility) = $sth->fetchrow_array) { $facility{$id}=$facility; print STDOUT "FACILITY: $id -> $facility\n" if $DEBUG ge 1; } }; &error_log_exit('FETCH',$dbh->errstr) if $@; #################################################### ### Load table level ################################################### $query='SELECT * FROM level'; $sth=$dbh->prepare($query) || &error_log_exit("$query",$dbh->errstr); $exe=$sth->execute() || &error_log_exit('EXEC',$dbh->errstr); eval { while(($priority,$level) = $sth->fetchrow_array) { $level{$priority}=$level; print STDOUT "LEVEL: ".$priority.' -> '.$level."\n" if $DEBUG ge 1; } }; &error_log_exit('FETCH',$dbh->errstr) if $@; #################################################### ### Load tables hosts ################################################### if ( $DEBUG ge 1 ) { my @tables; my $val; @tables = map{ $_ =~ s/^.*\.//; $_ } $dbh->tables(); foreach $val (@tables) { print STDOUT "TABLE: $val\n"; } } #################################################### ### Core Function ################################################### open(FF,"$pipe") || &error_log_exit('PIPE_ERROR_1',"Error on read pipe $pipe; $!"); while($riga=<FF>) { my $date; my $host; my $facility; my $level; my $tag; my $program; my @msg=(); my $val; my $time; ### ### CHECK SINTAX ### Syntax ### |<|$YEAR/$MONTH/$DAY $HOUR:$MIN:$SEC $HOST $FACILITY $LEVEL $TAG $PROGRAM $MSG|>| ### chomp($riga); print STDOUT "BEFORE:$riga\n" if $DEBUG ge 1; if ( $riga =~ /^\|\<\|(.+)\|\>\|$/) { $riga=$1; if ( $riga =~ /\|\>\|\|\<\|/ ) { &warn_log_exit("SYNTAX_ERROR_1",$riga); ### ### Decomenntando no recupera piu le possibili righe.. ### #next; $riga=~ s/^(.+)\|\>\|\|\<\|.+$/$1/; } } else { &warn_log_exit("SYNTAX_ERROR_2",$riga); next; } ($date,$time,$host,$facility,$level,$tag,$program,@msg)=split(/\ /,$riga); ### ### forza la variabile program al primo campo del message togliendo il pid ### if ( $program !~ /\w/ ) { $program=$msg[0]; $program=~s/(.+)\[.+/$1/; } ### ### Create string (Pattern Substitution) - Conversione facility e level in numero ### foreach $val (keys %facility) { if ( $facility eq $facility{$val} ) { $facility=$val; } } foreach $val (keys %level) { if ( $level eq $level{$val} ) { $level=$val; } } print STDOUT "NEXT:$date $time $host $facility $level $tag $program @msg\n" if $DEBUG ge 1; ### ### CHECK TABLES ### | ### if exists -> INSERT INTO ... ### else -> Scrive su file my $sth=""; my $exe=""; my $query=""; ### ### IMPORTANTE!!! ### Conversione IP in INDICE TABELLA ### my $index=$host; $index=~s/\./_/g; # converte ip in id $query="SELECT id FROM main_allow_syslog WHERE id = \'$index\' AND state = 1"; $sth=$dbh->prepare($query) || &warn_log_exit('PREPARE',"$query $dbh->errstr"); $exe=$sth->execute() || &warn_log_exit('EXEC',$dbh->errstr); my $numrows=$sth->rows; print STDOUT "stato= $exe - righe=$numrows\n" if $DEBUG ge 1; if ($numrows eq 1) { ### ### Inserisce nel DB ### ### +----------+--------------+------+-----+---------------------+-------+ ### | Field | Type | Null | Key | Default | Extra | ### +----------+--------------+------+-----+---------------------+-------+ ### | date | datetime | | | 0000-00-00 00:00:00 | | ### | facility | int(2) | | | 0 | | ### | level | int(2) | | | 0 | | ### | tag | varchar(4) | | | | | ### | program | varchar(64) | | | | | ### | msg | varchar(255) | | | | | ### +----------+--------------+------+-----+---------------------+-------+ ### $query="INSERT INTO $index(date,facility,level,tag,program,msg) VALUES (\'$date $time\',\'$facility\',\'$level\',\'$tag\',\'$program\',\'@msg\')"; $dbh->do($query) || &warn_log_exit('INSERT_FAILED_1',$query); print STDOUT "INSERT SUCCESS on $index: $query\n" if $DEBUG ge 1; } else { &warn_log_exit('INSERT_FAILED_2',"QUERY=\"$query\": RIGA=\"$riga\""); } } close(FF); $dbh->disconnect() or &error_log_exit('DB_CLOSE',"$DBI::errstr"); log_syslog('info','Session to DB closed...'); ################################################# ### ### SUB ### ################################################# sub log_syslog($$) { my ($tipo,$mess)=@_; openlog($0, 'cons,pid', 'user'); syslog($tipo,$mess); closelog(); }; sub warn_log_exit($$) { local ($in,$err)=@_; local $tme; $time=strftime("%Y/%m/%d %H:%M:%S",localtime); print STDOUT "$time WARN:$in:$err\n" if $DEBUG ge 1; open(ERRMSG,">>$errmsg") || die "Error on WRITE on $errmsg: $!\n"; print ERRMSG "$time WARN:$in:$err \n"; close(ERRMSG); }; sub error_log_exit($$) { local ($in,$err)=@_; local $tme; $time=strftime("%Y/%m/%d %H:%M:%S",localtime); print STDOUT "$time ERROR:$in:$err\n" if $DEBUG ge 1; open(ERRMSG,">>$errmsg") || die "Error on WRITE on $errmsg: $!\n"; print ERRMSG "$time ERROR:$in:$err \n"; close(ERRMSG); exit 1; }; ######################################################################## ############# #EOF ######################################################################## ############# (2) ######################################################################## ############ #!/usr/bin/perl # # SYSLOG_DB_INSERT # allow_ip_table_db.pl # v.1.1 # # Script to implement ALLOW TO INSERT INTO DB MYSQL # # description: Wizard for allow IP to write into DB # # by _/CaT\_: # Script Author: # GDM & _/CaT\_ cat_roger22(a)hotmail.com ######################################################################## ############## $|=1; use DBI; #use strict; use Sys::Syslog; use POSIX qw(strftime); sub log_syslog($$); sub warn_log_exit($$); sub error_log_exit($$); &log_syslog('info',"|--------- Start $0 ---------|"); $ENV{'DBI_DSN'}='xxxxxx'; $ENV{'DBI_USER'}='xxxxx'; $ENV{'DBI_PASS'}='xxxxx'; $ENV{'DBI_TABLE_SYSLOG'}='xxx'; $ENV{'ERR_MSG'}='/path/err_DB_msg.log'; my $DB_SB='mysql'; ### ### Debug mode = 1 ### my $DEBUG = 1; my $test_dsn = $ENV{'DBI_DSN'} || die "DSN not set\n"; my $test_user = $ENV{'DBI_USER'} || die "User not set\n"; my $test_password = $ENV{'DBI_PASS'} || die "Password not set\n"; my $table = $ENV{'DBI_TABLE_SYSLOG'} || die "Table not set\n"; my $errmsg = $ENV{'ERR_MSG'} || die "File ERR_MSG not set\n"; ############################################### ### ### IMPORTANT!!! ### File load IP allowed to write into DB ### ############################################### my $file_in='/path/xxxxxxxx.txt'; my $DATA_SOURCE='dbi:mysql:'.$test_dsn.';mysql_compression=1'; my $dbh; my $sth; my $riga; my $BaseTable='main_allow_syslog'; $dbh = DBI->connect($DATA_SOURCE, $test_user, $test_password, {RaiseError => 1,PrintError => 2,AutoCommit =>1}) or die "Can\'t connect: $DBI::errstr\n"; &log_syslog('info','Connect to DB...Done'); ############################################## ### Make base table ############################################## ### ### +---------+--------------+------+-----+---------------------+-------+ ### | Field | Type | Null | Key | Default | Extra | ### +---------+--------------+------+-----+---------------------+-------+ ### | id | varchar(15) | | PRI | | | ### | ip | varchar(15) | | | | | ### | name | varchar(48) | | | | | ### | state | int(1) | | | 0 | | ### | c_time | datetime | | | 0000-00-00 00:00:00 | | ### | comment | varchar(126) | YES | | NULL | | ### +---------+--------------+------+-----+---------------------+-------+ ### my @tables; my $found=0; my $query; @tables = map{ $_ =~ s/^.*\.//; $_ } $dbh->tables(); while($table=<@tables> and $found == 0 ) { if ($table eq $BaseTable) { $found=1; } } if ( $found ne 1 ) { $query="CREATE TABLE $BaseTable( id varchar(15) PRIMARY KEY NOT NULL, ip varchar(15) NOT NULL, name varchar(48) NOT NULL, state int(1) NOT NULL, c_time DATETIME NOT NULL, m_time DATETIME NOT NULL, comment varchar(126) )"; $dbh->do($query); &warn_log_exit("CREATION TABLE","$query"); } ##################################################### ### Load tables ##################################################### my $exe; my $sth; my $id; my $priority; my $riga; my $ip; my $state; my $name; my @comment=(); my $todo; open(FF,"<$file_in") || &error_log_exit("FILE READ","$!"); while($riga=<FF>) { chomp($riga); ($todo,$ip,$name,$state,@comment)=split(/\s+/,$riga); ### ### CHECK SYNTAX ### next if ( $riga =~ /^#|^$/ ) ; &error_log_exit('SYNTAX ERROR READ_1',"IP errato") if ( $ip !~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/ ) ; &error_log_exit('SYNTAX ERROR READ_2',"state errato") if ( $state !~ /0|1/ ) ; &error_log_exit('SYNTAX ERROR READ_2',"Name errato") if ($name !~ /\w/) ; ### ### NOTE!!! ### ### The coma -.- in the IP is traslate in Underscore - _ - ### $iptraslate=$ip; $iptraslate=~ s/\./_/g; ### ### make query for update $BaseTable ### $ctime=strftime("%Y/%m/%d %H:%M:%S",localtime); print STDOUT "IpTraslate -> $iptraslate date -> $ctime todo -> $todo\n" if $DEBUG ge 1; if ( $todo eq 'ADD' ) { &ADD(*BaseTable,*iptraslate,*ip,*name,*state,*ctime,*comment); } elsif ( $todo eq 'DISABLE' ) { &DISABLE(*BaseTable,*iptraslate,*ip,*ctime); } elsif ( $todo eq 'ENABLE' ) { &ENABLE(*BaseTable,*iptraslate,*ip,*ctime); } elsif ( $todo eq 'REMOVE' ) { &REMOVE(*BaseTable,*iptraslate,*ip) } } close(FF); $dbh->disconnect() or die "ERROR on close: $DBI::errstr\n"; log_syslog('info','Session to DB closed...'); ################################################# ### ### SUB ### ################################################# sub log_syslog($$) { my ($tipo,$mess)=@_; openlog($0, 'cons,pid', 'user'); syslog($tipo,$mess); closelog(); }; sub warn_log_exit($$) { my ($in,$err)=@_; print STDOUT "WARN:$in:$err\n" if $DEBUG ge 1; open(ERRMSG,">>$errmsg") || die "Error on WRITE on $errmsg: $!\n"; print ERRMSG "WARN:$in:$err \n"; close(ERRMSG); }; sub error_log_exit($$) { my ($in,$err)=@_; print STDOUT "ERROR:$in:$err\n" if $DEBUG ge 1; open(ERRMSG,">>$errmsg") || die "Error on WRITE on $errmsg: $!\n"; print ERRMSG "ERROR:$in:$err \n"; close(ERRMSG); exit 1; }; sub ADD($$$$$$) { local (*BaseTable,*iptraslate,*ip,*name,*state,*ctime,*comment)=@_; $query="INSERT INTO $BaseTable (id,ip,name,state,c_time,m_time,comment) VALUES (\'$iptraslate\',\'$ip\',\'$name\',\'$state\',\'$ctime\',\'$ctime\',\'@c omment\')"; print STDOUT "Query=$query\n"; $sth=$dbh->prepare($query) || &error_log_exit("$query",$dbh->errstr); $exe=$sth->execute() || &error_log_exit('EXEC',$dbh->errstr); ######################################################### ### Make new Table for IP ######################################################### ### ### +----------+--------------+------+-----+---------------------+-------+ ### | Field | Type | Null | Key | Default | Extra | ### +----------+--------------+------+-----+---------------------+-------+ ### | date | datetime | | | 0000-00-00 00:00:00 | | ### | facility | int(2) | | | 0 | | ### | level | int(2) | | | 0 | | ### | tag | varchar(4) | | | | | ### | program | varchar(64) | | | | | ### | msg | varchar(255) | | | | | ### +----------+--------------+------+-----+---------------------+-------+ ### $query="CREATE TABLE $iptraslate( date DATETIME NOT NULL, facility int(2) NOT NULL, level int(2) NOT NULL, tag varchar(4) NOT NULL, program varchar(64) NOT NULL, msg varchar(255) NOT NULL )"; $dbh->do($query); &warn_log_exit("CREATION TABLE $ip","$query"); }; sub DISABLE($$$$) { local (*BaseTable,*iptraslate,*ip,*ctime)=@_; $query="UPDATE $BaseTable SET state = \'0\' , m_time = \'$ctime\' WHERE id = \'$iptraslate\' AND ip = \'$ip\'"; print STDOUT "Query=$query\n"; $sth=$dbh->prepare($query) || &error_log_exit("$query",$dbh->errstr); $exe=$sth->execute() || &error_log_exit('EXEC',$dbh->errstr); }; sub ENABLE($$$$) { local (*BaseTable,*iptraslate,*ip,*ctime)=@_; $query="UPDATE $BaseTable SET state = \'1\' , m_time = \'$ctime\' WHERE id = \'$iptraslate\' AND ip = \'$ip\'"; print STDOUT "Query=$query\n"; $sth=$dbh->prepare($query) || &error_log_exit("$query",$dbh->errstr); $exe=$sth->execute() || &error_log_exit('EXEC',$dbh->errstr); }; ######################################################################## ############ #EOF ######################################################################## ############ (3) ######################################################################## ############## #### #### File for wizard the IP allowed to write into DB #### #### ADD -> Aggiunge tabelle #### DISABLE -> Disabilita la scrittura sulla tabella #### ENABLE -> riabilita la tabella #### #### IMPORTANT - after the insert clean the entry or comment #### #### Exaple: #### +-----------+-----------------+-----------+-----------+-----------+ #### | Func | IP | Hostname | State | Comment | #### +-----------+-----------------+-----------+-----------+-----------+ #### |ADD |192.168.69.254 |pippo |1 |honeypot | #### +-----------+-----------------+-----------+-----------+-----------+ ADD 192.168.69.254 pippo 1 honeypot #ADD 192.168.70.57 pippone 1 WS di GDM ######################################################################## ################ #EOF ######################################################################## ################ (4) ######################################################################## ############ # SQL script for load the tables: facility and level ######################################################################## ############ drop table facility; drop table level; create table facility ( id int(2), facility varchar(16) ); create table level ( priority int(2), level varchar(16) ); insert into facility(id,facility) values ('0','kern'); insert into facility(id,facility) values ('1','user'); insert into facility(id,facility) values ('2','mail'); insert into facility(id,facility) values ('3','daemon'); insert into facility(id,facility) values ('4','auth'); insert into facility(id,facility) values ('5','syslog'); insert into facility(id,facility) values ('6','lpr'); insert into facility(id,facility) values ('7','news'); insert into facility(id,facility) values ('8','uucp'); insert into facility(id,facility) values ('9','cron'); insert into facility(id,facility) values ('10','local0'); insert into facility(id,facility) values ('11','local1'); insert into facility(id,facility) values ('12','local2'); insert into facility(id,facility) values ('13','local3'); insert into facility(id,facility) values ('14','local4'); insert into facility(id,facility) values ('15','local5'); insert into facility(id,facility) values ('16','local6'); insert into facility(id,facility) values ('17','local7'); insert into level(priority,level) values ('0','emerg'); insert into level(priority,level) values ('1','alert'); insert into level(priority,level) values ('2','crit'); insert into level(priority,level) values ('3','err'); insert into level(priority,level) values ('4','warning'); insert into level(priority,level) values ('5','notice'); insert into level(priority,level) values ('6','info'); insert into level(priority,level) values ('7','debug'); insert into level(priority,level) values ('8','none'); commit; ######################################################################## ############## #EOF ######################################################################## ############## (5) ######################################################################## ######## #!/bin/bash # # Program: syslog_db_insert init script # # Description: # # chkconfig: 2345 12 88 # Description: ######################################################################## ######### ######################################################################## ######## # configuration # INIT_DB_PROG="/path/insertdb.pl" # Full path to daemon PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/script INIT_DB=`basename "$INIT_DB_PROG"` # Source Redhat function library. # . /etc/rc.d/init.d/functions [ -x $INIT_DB_PROG ] || exit 0 RETVAL=0 umask 077 ulimit -c 0 # See how we were called. case "$1" in start) echo -n "Starting $INIT_DB: " nohup $INIT_DB_PROG & RETVAL=$? echo [ $RETVAL -eq 0 ] && touch "/var/lock/subsys/${INIT_DB}" ;; stop) echo -n "Stopping $INIT_DB: " killproc $INIT_DB_PROG RETVAL=$? echo [ $RETVAL -eq 0 ] && rm -f "/var/lock/subsys/${INIT_DB}" ;; status) status $INIT_DB_PROG RETVAL=$? ;; restart|reload) $0 stop $0 start RETVAL=$? ;; *) echo "Usage: $0 {start|stop|status|restart|reload}" exit 1 esac exit $RETVAL ###################################################################### #EOF ###################################################################### (6) ######################################################################## #### #LOG TO MYSQL destination d_mysql { pipe("/dev/mysql.pipe" template("|<|$YEAR/$MONTH/$DAY $HOUR:$MIN:$SEC $HOST $FACILITY $LEVEL $TAG $PROGRAM $MSG|>|\n")); }; ######################################################################## #### Cheers _/CaT\_

1 1

Leaving early today ...
by Brett Dubroy 03 Oct '02

03 Oct '02

Well, I've managed to succumb to the bug that's been going around (and I don't mean from Bugzilla ;-) ); I'm headed home to try and sleep it off after picking up some meds to combat the effects (Yeah NyQuil & DayQuil ! :-) ) I can be reached @ home, 237-7724, if required. TTYL Brett --- Brett Dubroy Jetnet Internetworking Services Email : bdubroy(a)jetnet.ca Phone : (613) 237-5995 x 227 This communication contains confidential information intended solely for the use of the individual/s and/or entity or entities to whom it was intended to be addressed. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this transmission is prohibited. If you have received this communication in error, please contact the sender immediately, delete the communication from your system and do not disclose its contents to any third party or use its contents. Any opinions expressed are solely those of the author and do not necessarily represent those of JETNET Internetworking Services Inc. unless otherwise specifically stated.

1 0

syslog-ng+squid+apache
by alexch 03 Oct '02

03 Oct '02

I solved task On the first server run script #/!bin/sh tail -f /usr/local/squid/logs/access.log | logger -p notice -t squid on the log server find directory /server1/user/logfile for a squid only, but it is better than nothing :-) Any ideas about httpd-access.log ??? Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628

1 0

syslog-ng+squid+apache
by alexch 03 Oct '02

03 Oct '02

I have 2 servers. Squid and apache works with first server and second server is a log server. I need write squid's access.log and apaches's httpd-access.log to logserver Does anyone know how??? Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628

2 1

Re: Bug #161915
by Balazs Scheidler 03 Oct '02

03 Oct '02

Hi, Thanks for the information you provided. The problem is that the programs do not send \n at the end of line while syslog-ng expects one for STREAM oriented sources. (such as unix-stream), Earlier versions of syslog-ng took a message as a full message in the following cases: 1) either NL or NUL was found in the incoming stream 2) after a single read and the source is datagram oriented (UDP or unix-dgram) 3) after the incoming buffer is full (specified via log_msg_size()) For stream oriented sources either 1) or 3) must be true. The strace you sent me indicates that some programs do not terminate their messages by '\n'. Checking out the libc sources shows that libc automatically terminates messages by NL if LOG_PERROR is set, and also adds a \0 at the end of the line if STREAM sockets are used. So both syslog-ng and libc behaviour seems to be correct. Something must be wrong anyway as the strace didn't show terminating NUL characters. I assumed that you are using unix-stream sources, but this assumption should be true as syslog-ng issues read() instead of recvfrom(). As syslog-ng reads no terminating NUL characters, I think this should be a libc issue. stream sockets should always have line terminations, as it is not guaranteed by the kernel that a single write will be read by single read calls. I don't know where to submit this bug, to the libc people, or to the cron people? > read(3, "<38>Oct 2 15:49:02 PAM_unix[4971]: (cron) session closed for user list", 2049) = 71 > read(3, "<38>Oct 2 15:50:01 PAM_unix[4974]: (cron) session opened for user root by (uid=0)", 1978) = 82 > read(3, "<38>Oct 2 15:50:01 PAM_unix[4975]: (cron) session opened for user list by (uid=0)", 1896) = 82 > read(3, "<78>Oct 2 15:50:01 /USR/SBIN/CRON[4977]: (list) CMD ( [ -x /usr/bin/python -a -f /usr/lib/mailman/cron/qrunner ] && /usr/bin/python /usr/lib/mailman/cron/qrunner)", 1814) = 165 > read(3, "<78>Oct 2 15:50:01 /USR/SBIN/CRON[4976]: (root) CMD (if [ -x /usr/bin/mrtg ] && [ -r /etc/mrtg.cfg ]; then /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log 2>&1; fi)", 1649) = 171 > read(3, "<38>Oct 2 15:50:01 PAM_unix[4974]: (cron) session closed for user root", 1478) = 71 ^^^^^ missing nl or nul character -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

missing 33% of syslog messages
by Bob Kupiec 03 Oct '02

03 Oct '02

Included is a log of number of messages logged over a period. There should be hundreds of messages per minute from this one source machine, but I miss many minutes with not one entry logged! # Date Time ---------------- 932 Sep 28 00:31 0 Sep 28 00:32 0 Sep 28 00:33 0 Sep 28 00:34 0 Sep 28 00:35 0 Sep 28 00:36 0 Sep 28 00:37 166 Sep 28 00:38 . . . 139 Sep 28 01:53 0 Sep 28 01:54 0 Sep 28 01:55 0 Sep 28 01:56 206 Sep 28 01:57 . . . 276 Sep 28 02:15 0 Sep 28 02:16 163 Sep 28 02:17 . . . 35 Sep 28 03:30 0 Sep 28 03:31 0 Sep 28 03:32 0 Sep 28 03:33 0 Sep 28 03:34 0 Sep 28 03:35 0 Sep 28 03:36 0 Sep 28 03:37 303 Sep 28 03:38 . . . 189 Sep 28 04:26 0 Sep 28 04:27 0 Sep 28 04:28 0 Sep 28 04:29 0 Sep 28 04:30 0 Sep 28 04:31 0 Sep 28 04:32 0 Sep 28 04:33 0 Sep 28 04:34 0 Sep 28 04:35 0 Sep 28 04:36 0 Sep 28 04:37 0 Sep 28 04:38 0 Sep 28 04:39 0 Sep 28 04:40 0 Sep 28 04:41 0 Sep 28 04:42 0 Sep 28 04:43 0 Sep 28 04:44 204 Sep 28 04:45 . . . 159 Sep 28 05:11 0 Sep 28 05:12 0 Sep 28 05:13 0 Sep 28 05:14 0 Sep 28 05:15 0 Sep 28 05:16 0 Sep 28 05:17 0 Sep 28 05:18 0 Sep 28 05:19 0 Sep 28 05:20 0 Sep 28 05:21 0 Sep 28 05:22 0 Sep 28 05:23 0 Sep 28 05:24 0 Sep 28 05:25 0 Sep 28 05:26 0 Sep 28 05:27 285 Sep 28 05:28 . . . -- Bob Kupiec Security/Network Administrator Email: kupiec(a)ias.edu Institute for Advanced Study Phone: 609-734-8179 Einstein Drive (A208) Fax: 609-951-4418 Princeton, NJ 08540-4907

3 2

RE: [syslog-ng]missing 33% of syslog messages
by Hamilton, Andrew 02 Oct '02

02 Oct '02

Bob, Ok, then there are a couple of things to try next. Setup the DEFAULT filter as the last line in your config file and send that to a junk file just to see if the messages are missing your filters and being discarded by syslog-ng. Also run syslog in a shell with the -dv switches turned on so you can watch the messages come in. Turn the daemon off before you run it in a shell. Drew -----Original Message----- From: Bob Kupiec [mailto:kupiec@ias.edu] Sent: Wednesday, October 02, 2002 1:38 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]missing 33% of syslog messages Drew, I tried tweaking sync() to 25 and to 100. No real change. I still average capturing about 80% to 85% of the syslog data. See my previous message for my configs and version. All the packets are hitting the machine, verfied by tcpdump, but are getting lost after that. The machine has a hardware RAID 5 array and it's only running syslog-ng, it's not a hardware issue. Tuning syslog-ng.conf doesn't do anything noticeable. How do I go about fixing/debugging syslog-ng further? >From Andrew.Hamilton(a)afccc.af.mil Thu, 19 Sep 2002 12:47:25 -0400 >Date: Thu, 19 Sep 2002 12:47:25 -0400 >From: Hamilton, Andrew Andrew.Hamilton(a)afccc.af.mil >Subject: [syslog-ng]missing 33% of syslog messages > >Bob, > >Have you checked to see that the messages are getting to the loghost? On a >busy network it is possible to lose a number of packets. With UDP you never >know. You could use a network sniffer to find out. Something else you >might try is raising sync some. If you are getting a ton of messages you >might be getting lost in I/O somewhere. sync(0) writes immediately so you >might crank it up a little to get some buffering going. You might have to >play around with some of the options to get it to work with your >configuration. I believe that stats are where you have the internal >source going. It is just a line in the file I think. > -- Bob Kupiec Security/Network Administrator Email: kupiec(a)ias.edu Institute for Advanced Study Phone: 609-734-8179 Einstein Drive (A208) Fax: 609-951-4418 Princeton, NJ 08540-4907 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

missing 33% of syslog messages
by Bob Kupiec 02 Oct '02

02 Oct '02

Drew, I tried tweaking sync() to 25 and to 100. No real change. I still average capturing about 80% to 85% of the syslog data. See my previous message for my configs and version. All the packets are hitting the machine, verfied by tcpdump, but are getting lost after that. The machine has a hardware RAID 5 array and it's only running syslog-ng, it's not a hardware issue. Tuning syslog-ng.conf doesn't do anything noticeable. How do I go about fixing/debugging syslog-ng further? >From Andrew.Hamilton(a)afccc.af.mil Thu, 19 Sep 2002 12:47:25 -0400 >Date: Thu, 19 Sep 2002 12:47:25 -0400 >From: Hamilton, Andrew Andrew.Hamilton(a)afccc.af.mil >Subject: [syslog-ng]missing 33% of syslog messages > >Bob, > >Have you checked to see that the messages are getting to the loghost? On a >busy network it is possible to lose a number of packets. With UDP you never >know. You could use a network sniffer to find out. Something else you >might try is raising sync some. If you are getting a ton of messages you >might be getting lost in I/O somewhere. sync(0) writes immediately so you >might crank it up a little to get some buffering going. You might have to >play around with some of the options to get it to work with your >configuration. I believe that stats are where you have the internal >source going. It is just a line in the file I think. > -- Bob Kupiec Security/Network Administrator Email: kupiec(a)ias.edu Institute for Advanced Study Phone: 609-734-8179 Einstein Drive (A208) Fax: 609-951-4418 Princeton, NJ 08540-4907

1 0

lost messages when logging to a database
by harald schmidt 02 Oct '02

02 Oct '02

hy, I am using syslog-ng on a loghost with a MySQL-database. Everything seems to work fine. But when I compare the number of messages which are logged to the SQL-database and which are logged to a file, I recognize that some messages are lost in the MySQL-database. Could it be that sys-ng is to fast for the pipe which goes to MySQL? I'm using syslog-ng v1.5.21 on a PIII-1000,512MB,SCSI-Raid1,SuSE 7.3, my config is like that: source s_kernel { pipe("/proc/kmsg"); internal(); }; source s_stream { unix-stream("/dev/log"); internal(); }; source sn_udp { udp(); }; destination df_all_messages { file("/var/log/all_messages-$YEAR$MONTH$DAY"); }; destination dq_mysql_all_messages { pipe("/var/pipes/mysql.fifo" template("INSERT INTO all_messages_$YEAR$MONTH (host, facility, priority, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(s_stream); source(s_kernel); source(sn_udp); destination(df_all_messages); };log { source(s_stream); source(s_kernel); source(sn_udp); destination(dq_mysql_all_messages); }; the script that reads from the pipe is like that: #!/bin/sh datum=$(date +%Y%m) if [ -e /var/pipes/mysql.fifo ]; then while [ -e /var/pipes/mysql.fifo ] do mysql syslog_$datum < /var/pipes/mysql.fifo done else mkfifo /var/pipes/mysql.fifo fi I thought my problem with the lost messages would be fixed after the update from 1.5.19 to 1.5.21. In one second there were 43 messages logged to the file, but only 24 to mysql. Could it be that the pipe is too "thin" to fit 43 messages per second? thanks for any help in advance. Harald -- paybox macht Ihr Handy zur Geldbörse! http://bonus.gmx.net/?gid=46842444&prid=540

1 0

localport binding...
by Robert D. Beal 01 Oct '02

01 Oct '02

I'm trying to get syslog-ng (1.5.20) to use 514 as its source port when using the udp destination driver as follows: <<Following taken from my syslog-ng.conf>> source s_sys { unix-stream("/dev/log"); internal(); }; destination d_syslog { udp("192.168.0.2" destport(514) localport(514)); }; log { source(s_src); destination(d_syslog); }; but it always seems to send the syslog udp datagrams using the next available non-privileged port as its source (>1024). I'm running as root (on RedHat 7.3) and syslogd is not running. Syslog-ng doesn't choke on the config, so I'm assuming its not a syntax problem, but I just can't seem to get it to use 514 as its source port?! Does anyone have any ideas what I may be doing wrong here? Or is it just silently ignoring my request to use port 514? Thanks.

4 3

patch for systems without res_init
by Balazs Scheidler 30 Sep '02

30 Sep '02

Hi, for those complaining that syslog-ng 1.5.21 didn't compile because of a missing res_init function, apply this patch: diff -u -r1.55 configure.in --- configure.in 27 Sep 2002 09:11:33 -0000 1.55 +++ configure.in 29 Sep 2002 11:59:12 -0000 @@ -151,6 +151,7 @@ AC_FUNC_VPRINTF AC_CHECK_LIB(door, door_create) AC_CHECK_FUNCS(select snprintf vsnprintf strerror inet_aton strncpy getutent) +AC_CHECK_FUNCS(res_init) AC_CHECK_FUNC(getopt_long,,[LIBOBJS="getopt.o getopt1.o $LIBOBJS"]) AC_CHECK_FUNC(strcasecmp,,[LIBOBJS="strcasecmp.o $LIBOBJS"]) AC_CHECK_FUNC(strptime,,[LIBOBJS="strptime.o $LIBOBJS"]) diff -u -r1.44 main.c --- src/main.c 4 Sep 2002 14:52:25 -0000 1.44 +++ src/main.c 29 Sep 2002 11:59:12 -0000 @@ -222,7 +222,9 @@ if (sighuprecvd) { sighuprecvd = 0; if (!backend->super.reloading) { +#if HAVE_RES_INIT res_init(); +#endif notice("SIGHUP received, restarting syslog-ng\n"); if (!debug_flag) { set_error_stream(2, 0); -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 3

A CRY FOR HELP
by KENNETH MOBUTU SESE SEKO 29 Sep '02

29 Sep '02

DEAR FRIEND THROUGH THE COURTESY OF BUSINESS OPPORTUNITY, I TAKE LIBERTY ANCHORED ON A STRONG DESIRE TO SOLICIT YOUR ASSISTANCE ON THIS MUTUALLY BENEFICIAL AND RISKFREE TRANSACTION WHICH I HOPE YOU WILL GIVE YOUR URGENT ATTENTION. I AM MR.KENNETH MOBUTU SESE-SEKO,SON OF LATE PRESIDENT MOBUTU SESE- SEKO OF ZAIRE NOW KNOWN AS DEMOCRATIC REPUBLIC OF CONGO(DRC). I AM MOVED TO WRITE YOU THIS LETTER ,THIS WAS IN CONFIDENCE CONSIDERING OUR PRESENT CIRCUMSTANCE AND SITUATION. I ESCAPED WITH MY FATHER AND MOTHER ALONG WITH TWO OF MY BROTHERS BENSON AND BASHER OUT OF DEMOCRATIC REPUBLIC OF CONGO(DRC)TO ABIDJAN, COTE D'IVOIRE WHERE MY FAMILY AND I SETTLED, WHILE WE LATER MOVED TO SETTLE IN MORROCO WHERE MY FATHER LATER DIED OF CANCER DISEASE.SINCE THE DEATH OF MY LATE FATHER SOME YEARS AGO WE HAVE BEEN RESIDING IN GHANA ON TEMPORARY POLITICAL ASYLUM. HOWEVER DUE TO THIS SITUATION WE DECIDED TO CHANGE MOST OF MY FATHERS BILLIONS OF DOLLARS DEPOSITED IN SWISS BANK AND OTHER COUNTRIES INTO OTHER FORMS OF MONEY CODED FOR SAFE PURPOSE BECAUSE THE NEW HEAD OF STATES(DR.)MR.LAURENT KABILA MADE ARRANGEMENTS WITH THE SWISS GOVERNMENT AND OTHER EUROPEAN COUNTRIES TO FREEZE ALL MY LATE FATHERS TREASURES DEPOSITED IN SOME EUROPEAN COUNTRIES,HENCE MY MOTHER,MRS.MARY SESE-SEKO AND I ALONG WITH MY BROTHERS BENSON AND BASHER DECIDED LAYING LOW IN AFRICA TO STUDY THE SITUATION TILL WHEN THINGS GETS BETTER,SINCE PRESIDENT KABILA IS DEAD AND THE SON TAKING OVER GOVERNMENT (JOSEPH KABILA). ONE OF MY FATHERS CHATEAU IN SOUTHERN FRANCE WAS CONFISCATED BY THE FRENCH GOVERNMENT,AND AS SUCH WE HAD TO CHANGE OUR IDENTITY SO THAT OUR INVESTMENT WILL NOT BE TRACED AND CONFISCATED.MY MOTHER HAVE DEPOSITED THE SUM OF THIRTY MILLION,FIVE HUNDRED THOUSAND UNITED STATES DOLLARS(US$30,500,000)WITH A SECURITY COMPANY FOR SAFEKEEPING. THE FUNDS ARE SECURITY CODED TO PREVENT THEM FROM KNOWING THE CONTENTS.WHAT I WANT YOU TO DO NOW IS TO INDICATE YOUR INTEREST THAT YOU WILL ASSIST US BY RECEIVING THE MONEY ON OUR BEHALF. THE ACCOUNT REQUIRED FOR THIS PROJECT CAN EITHER BE PERSONAL,COMPANY OR AN OFFSHORE ACCOUNT THAT YOU HAVE TOTAL CONTROL OVER,YOUR AREA OF SPECIALISATION WILL NOT BE A HINDERANCE TO THE SUCCESSFUL EXECUTION OF THIS TRANSACTION.ACKOWLEDGE THIS MESSAGE,SO THAT I CAN INTRODUCE YOU TO MY FAMILY AS OUR FOREIGN TRUSTED PARTNER WHO SHALL TAKE CHARGE OF OUR INVESTMENT ABROAD WHERE WE NOW PLAN TO SETTLE. I WANT YOU TO ASSIST US IN INVESTING THIS MONEY,BUT I WILL NOT WANT OUR IDENTITY REVEALED.I WILL ALSO WANT TO BUY PROPERTIES AND STOCKS IN MULTI-NATIONAL COMPANIES AND TO ENGAGE IN OTHER SAFE AND NON SPECULATIVE INVESTMENTS. WE HAVE BEEN THROUGH A LOT OF HEALTH AND SPIRITUAL TURMOIL,HENCE WILL NEED YOUR UNDERSTANDING AND ASSISTANCE.MAY I AT THIS POINT EMPHASIZE THE HIGH LEVEL OF CONFIDENTIALLITY WHICH THIS BUSINESS DEMANDS AND HOPE YOU WILL NOT BETRAY THE TRUST AND CONFIDENCE WHICH WE REPOSE IN YOU.I SHALL PUT YOU IN THE PICTURE OF THIS BUSINESS,I.E TELL YOU WHERE THE FUNDS ARE CURRENTLY BEING MAINTAINED AND ALSO DISCUSS OTHER MODALITIES INCLUDING REMUNERATION FOR YOUR SERVICES. IS THIS PROPOSITION ATTAINABLE?IF IT IS,PLEASE KINDLY FURNISH ME IMMEDIATELY BY E-MAIL WITH YOUR DIRECT TELEPHONE AND FAX NUMBERS TO ENHANCE THE CONFIDENTIALLITY WHICH THIS BUSINESS DEMANDS. BEST REGARDS MR.KENNETH MOBUTU.SESE SEKO. FOR FAMILY. N.B. REPLY TO:kmosse@myself.com

1 0

A CRY FOR HELP
by KENNETH MOBUTU SESE SEKO 29 Sep '02

29 Sep '02

DEAR FRIEND THROUGH THE COURTESY OF BUSINESS OPPORTUNITY, I TAKE LIBERTY ANCHORED ON A STRONG DESIRE TO SOLICIT YOUR ASSISTANCE ON THIS MUTUALLY BENEFICIAL AND RISKFREE TRANSACTION WHICH I HOPE YOU WILL GIVE YOUR URGENT ATTENTION. I AM MR.KENNETH MOBUTU SESE-SEKO,SON OF LATE PRESIDENT MOBUTU SESE- SEKO OF ZAIRE NOW KNOWN AS DEMOCRATIC REPUBLIC OF CONGO(DRC). I AM MOVED TO WRITE YOU THIS LETTER ,THIS WAS IN CONFIDENCE CONSIDERING OUR PRESENT CIRCUMSTANCE AND SITUATION. I ESCAPED WITH MY FATHER AND MOTHER ALONG WITH TWO OF MY BROTHERS BENSON AND BASHER OUT OF DEMOCRATIC REPUBLIC OF CONGO(DRC)TO ABIDJAN, COTE D'IVOIRE WHERE MY FAMILY AND I SETTLED, WHILE WE LATER MOVED TO SETTLE IN MORROCO WHERE MY FATHER LATER DIED OF CANCER DISEASE.SINCE THE DEATH OF MY LATE FATHER SOME YEARS AGO WE HAVE BEEN RESIDING IN GHANA ON TEMPORARY POLITICAL ASYLUM. HOWEVER DUE TO THIS SITUATION WE DECIDED TO CHANGE MOST OF MY FATHERS BILLIONS OF DOLLARS DEPOSITED IN SWISS BANK AND OTHER COUNTRIES INTO OTHER FORMS OF MONEY CODED FOR SAFE PURPOSE BECAUSE THE NEW HEAD OF STATES(DR.)MR.LAURENT KABILA MADE ARRANGEMENTS WITH THE SWISS GOVERNMENT AND OTHER EUROPEAN COUNTRIES TO FREEZE ALL MY LATE FATHERS TREASURES DEPOSITED IN SOME EUROPEAN COUNTRIES,HENCE MY MOTHER,MRS.MARY SESE-SEKO AND I ALONG WITH MY BROTHERS BENSON AND BASHER DECIDED LAYING LOW IN AFRICA TO STUDY THE SITUATION TILL WHEN THINGS GETS BETTER,SINCE PRESIDENT KABILA IS DEAD AND THE SON TAKING OVER GOVERNMENT (JOSEPH KABILA). ONE OF MY FATHERS CHATEAU IN SOUTHERN FRANCE WAS CONFISCATED BY THE FRENCH GOVERNMENT,AND AS SUCH WE HAD TO CHANGE OUR IDENTITY SO THAT OUR INVESTMENT WILL NOT BE TRACED AND CONFISCATED.MY MOTHER HAVE DEPOSITED THE SUM OF THIRTY MILLION,FIVE HUNDRED THOUSAND UNITED STATES DOLLARS(US$30,500,000)WITH A SECURITY COMPANY FOR SAFEKEEPING. THE FUNDS ARE SECURITY CODED TO PREVENT THEM FROM KNOWING THE CONTENTS.WHAT I WANT YOU TO DO NOW IS TO INDICATE YOUR INTEREST THAT YOU WILL ASSIST US BY RECEIVING THE MONEY ON OUR BEHALF. THE ACCOUNT REQUIRED FOR THIS PROJECT CAN EITHER BE PERSONAL,COMPANY OR AN OFFSHORE ACCOUNT THAT YOU HAVE TOTAL CONTROL OVER,YOUR AREA OF SPECIALISATION WILL NOT BE A HINDERANCE TO THE SUCCESSFUL EXECUTION OF THIS TRANSACTION.ACKOWLEDGE THIS MESSAGE,SO THAT I CAN INTRODUCE YOU TO MY FAMILY AS OUR FOREIGN TRUSTED PARTNER WHO SHALL TAKE CHARGE OF OUR INVESTMENT ABROAD WHERE WE NOW PLAN TO SETTLE. I WANT YOU TO ASSIST US IN INVESTING THIS MONEY,BUT I WILL NOT WANT OUR IDENTITY REVEALED.I WILL ALSO WANT TO BUY PROPERTIES AND STOCKS IN MULTI-NATIONAL COMPANIES AND TO ENGAGE IN OTHER SAFE AND NON SPECULATIVE INVESTMENTS. WE HAVE BEEN THROUGH A LOT OF HEALTH AND SPIRITUAL TURMOIL,HENCE WILL NEED YOUR UNDERSTANDING AND ASSISTANCE.MAY I AT THIS POINT EMPHASIZE THE HIGH LEVEL OF CONFIDENTIALLITY WHICH THIS BUSINESS DEMANDS AND HOPE YOU WILL NOT BETRAY THE TRUST AND CONFIDENCE WHICH WE REPOSE IN YOU.I SHALL PUT YOU IN THE PICTURE OF THIS BUSINESS,I.E TELL YOU WHERE THE FUNDS ARE CURRENTLY BEING MAINTAINED AND ALSO DISCUSS OTHER MODALITIES INCLUDING REMUNERATION FOR YOUR SERVICES. IS THIS PROPOSITION ATTAINABLE?IF IT IS,PLEASE KINDLY FURNISH ME IMMEDIATELY BY E-MAIL WITH YOUR DIRECT TELEPHONE AND FAX NUMBERS TO ENHANCE THE CONFIDENTIALLITY WHICH THIS BUSINESS DEMANDS. BEST REGARDS MR.KENNETH MOBUTU.SESE SEKO. FOR FAMILY. N.B. REPLY TO:kmosse@myself.com

1 0

A CRY FOR HELP
by KENNETH MOBUTU SESE SEKO 29 Sep '02

29 Sep '02

DEAR FRIEND THROUGH THE COURTESY OF BUSINESS OPPORTUNITY, I TAKE LIBERTY ANCHORED ON A STRONG DESIRE TO SOLICIT YOUR ASSISTANCE ON THIS MUTUALLY BENEFICIAL AND RISKFREE TRANSACTION WHICH I HOPE YOU WILL GIVE YOUR URGENT ATTENTION. I AM MR.KENNETH MOBUTU SESE-SEKO,SON OF LATE PRESIDENT MOBUTU SESE- SEKO OF ZAIRE NOW KNOWN AS DEMOCRATIC REPUBLIC OF CONGO(DRC). I AM MOVED TO WRITE YOU THIS LETTER ,THIS WAS IN CONFIDENCE CONSIDERING OUR PRESENT CIRCUMSTANCE AND SITUATION. I ESCAPED WITH MY FATHER AND MOTHER ALONG WITH TWO OF MY BROTHERS BENSON AND BASHER OUT OF DEMOCRATIC REPUBLIC OF CONGO(DRC)TO ABIDJAN, COTE D'IVOIRE WHERE MY FAMILY AND I SETTLED, WHILE WE LATER MOVED TO SETTLE IN MORROCO WHERE MY FATHER LATER DIED OF CANCER DISEASE.SINCE THE DEATH OF MY LATE FATHER SOME YEARS AGO WE HAVE BEEN RESIDING IN GHANA ON TEMPORARY POLITICAL ASYLUM. HOWEVER DUE TO THIS SITUATION WE DECIDED TO CHANGE MOST OF MY FATHERS BILLIONS OF DOLLARS DEPOSITED IN SWISS BANK AND OTHER COUNTRIES INTO OTHER FORMS OF MONEY CODED FOR SAFE PURPOSE BECAUSE THE NEW HEAD OF STATES(DR.)MR.LAURENT KABILA MADE ARRANGEMENTS WITH THE SWISS GOVERNMENT AND OTHER EUROPEAN COUNTRIES TO FREEZE ALL MY LATE FATHERS TREASURES DEPOSITED IN SOME EUROPEAN COUNTRIES,HENCE MY MOTHER,MRS.MARY SESE-SEKO AND I ALONG WITH MY BROTHERS BENSON AND BASHER DECIDED LAYING LOW IN AFRICA TO STUDY THE SITUATION TILL WHEN THINGS GETS BETTER,SINCE PRESIDENT KABILA IS DEAD AND THE SON TAKING OVER GOVERNMENT (JOSEPH KABILA). ONE OF MY FATHERS CHATEAU IN SOUTHERN FRANCE WAS CONFISCATED BY THE FRENCH GOVERNMENT,AND AS SUCH WE HAD TO CHANGE OUR IDENTITY SO THAT OUR INVESTMENT WILL NOT BE TRACED AND CONFISCATED.MY MOTHER HAVE DEPOSITED THE SUM OF THIRTY MILLION,FIVE HUNDRED THOUSAND UNITED STATES DOLLARS(US$30,500,000)WITH A SECURITY COMPANY FOR SAFEKEEPING. THE FUNDS ARE SECURITY CODED TO PREVENT THEM FROM KNOWING THE CONTENTS.WHAT I WANT YOU TO DO NOW IS TO INDICATE YOUR INTEREST THAT YOU WILL ASSIST US BY RECEIVING THE MONEY ON OUR BEHALF. THE ACCOUNT REQUIRED FOR THIS PROJECT CAN EITHER BE PERSONAL,COMPANY OR AN OFFSHORE ACCOUNT THAT YOU HAVE TOTAL CONTROL OVER,YOUR AREA OF SPECIALISATION WILL NOT BE A HINDERANCE TO THE SUCCESSFUL EXECUTION OF THIS TRANSACTION.ACKOWLEDGE THIS MESSAGE,SO THAT I CAN INTRODUCE YOU TO MY FAMILY AS OUR FOREIGN TRUSTED PARTNER WHO SHALL TAKE CHARGE OF OUR INVESTMENT ABROAD WHERE WE NOW PLAN TO SETTLE. I WANT YOU TO ASSIST US IN INVESTING THIS MONEY,BUT I WILL NOT WANT OUR IDENTITY REVEALED.I WILL ALSO WANT TO BUY PROPERTIES AND STOCKS IN MULTI-NATIONAL COMPANIES AND TO ENGAGE IN OTHER SAFE AND NON SPECULATIVE INVESTMENTS. WE HAVE BEEN THROUGH A LOT OF HEALTH AND SPIRITUAL TURMOIL,HENCE WILL NEED YOUR UNDERSTANDING AND ASSISTANCE.MAY I AT THIS POINT EMPHASIZE THE HIGH LEVEL OF CONFIDENTIALLITY WHICH THIS BUSINESS DEMANDS AND HOPE YOU WILL NOT BETRAY THE TRUST AND CONFIDENCE WHICH WE REPOSE IN YOU.I SHALL PUT YOU IN THE PICTURE OF THIS BUSINESS,I.E TELL YOU WHERE THE FUNDS ARE CURRENTLY BEING MAINTAINED AND ALSO DISCUSS OTHER MODALITIES INCLUDING REMUNERATION FOR YOUR SERVICES. IS THIS PROPOSITION ATTAINABLE?IF IT IS,PLEASE KINDLY FURNISH ME IMMEDIATELY BY E-MAIL WITH YOUR DIRECT TELEPHONE AND FAX NUMBERS TO ENHANCE THE CONFIDENTIALLITY WHICH THIS BUSINESS DEMANDS. BEST REGARDS MR.KENNETH MOBUTU.SESE SEKO. FOR FAMILY. N.B. REPLY TO:kmosse@myself.com

1 0

1.52 Solaris didn't include -lresov
by Lancashire, Pete 27 Sep '02

27 Sep '02

Hi, syslog-ng(a)lists.balabit.hu New to the list so don't know if this is new or not the 1.5.12 configure does not add -lresolv to the list of required lib's and not in the 'warning' list of bugs, gcc 3.0.3 gcc -DHAVE_CONFIG_H -I. -I/usr/local/tmp/syslog-ng-1.5.21/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c main.c main.c: In function `main': main.c:438: warning: passing arg 2 of `resolve_user_group' from incompatible pointer type main.c:438: warning: passing arg 3 of `resolve_user_group' from incompatible pointer type main.c:442: warning: passing arg 2 of `resolve_group' from incompatible pointer type gcc -DHAVE_CONFIG_H -I. -I/usr/local/tmp/syslog-ng-1.5.21/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c center.c center.c: In function `do_distribute_log': center.c:157: warning: deprecated use of label at end of compound statement gcc -DHAVE_CONFIG_H -I. -I/usr/local/tmp/syslog-ng-1.5.21/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c filters.c filters.c: In function `do_filter_call': filters.c:342: warning: implicit declaration of function `memcmp' and in src/test testall use /bin/sh but uses bash features export SYSLOG_NG=../syslog-ng export LOGGER=logger for file in test.*; do ./$file done the export's have to be on seporate lines for sh, but are ok for bash the tests use logger -u, the version of logger I have is from solaris 5.8, it does not have a -u option. -pete

1 0

Linking error
by Aaron Jackson 27 Sep '02

27 Sep '02

I just downloaded syslog-ng-1.5.21 and libol 0.3.3 and tried to compile them on a Solaris 8 gcc 2.95 system. The build process stops with the following error: gcc -DHAVE_CONFIG_H -I. -I/export/home/jackson/syslog-ng-1.5.21/src -I. -g - O2 -Wall -I/export/home/jackson/libol-0.3.3/src -D_GNU_SOURCE -c getopt1.c gcc -g -O2 -Wall -I/export/home/jackson/libol-0.3.3/src -D_GNU_SOURCE -o syslo g-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-gr ammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afst reams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getop t1.o -lpthread -ldoor -lfl /export/home/jackson/libol-0.3.3/src/.libs/libol.a - lsocket -lnsl -lxnet Undefined first referenced symbol in file res_init main.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /export/home/jackson/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /export/home/jackson/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /export/home/jackson/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' I did a man res_init, and it appears that this function is a resolver library function. So I added -lresolv to the Makefile and everything compiled OK. Aaron Jackson

1 0

use_time_recvd
by Trapp, Michael 27 Sep '02

27 Sep '02

hi bazsi, i was a little bit surprised about the use_time_recvd option. obviously it has no impact on the timestamp of a recieved msg if there is already a timestamp included. i thought that the recvd-timestamp is used anyway ... well, i've attached a patch to fix that. regards michael

1 0

crash version 1.5.20 under stress with tcp
by Puschmann Johannes 26 Sep '02

26 Sep '02

Hi List. I am testing syslog-ng 1.5.20. Its an RH 7.2 kernel 2.4.18 syslog-ng was compiled from source. When you flood the machine with messages over tcp, it crashes Under udp port 514 its looks nice. (20000 messages/min no Problem) see Backtrace and configfile below. Looks like the template makes problems. best regards Johannes gc_mark: Marking object of class 'UNKNOWN' (1) AF_INET client connected from 192.168.129.102, port 1609 io.c: Preparing fd 8 for reading 192.168.129.102... adding as 707 (1 iters). io.c: Preparing fd 9 for writing io.c: Preparing fd 10 for writing Program received signal SIGSEGV, Segmentation fault. 0x080526a0 in expand_macros (cfg=0x6f6c7379, template=0x65742067, template_escape=1830843507, msg=0x61737365) at affile.c:866 866 while (left && (i < template->length)) { (gdb) bt #0 0x080526a0 in expand_macros (cfg=0x6f6c7379, template=0x65742067, template_escape=1830843507, msg=0x61737365) at affile.c:866 #1 0x53207369 in ?? () Cannot access memory at address 0x20736968 ------------------------------------------------------------------- options { dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname(yes); }; source local { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); internal(); }; # *.* @192.168.129.164 filter f_1 { level(debug...emerg); }; #destination d_1 { # udp("192.168.129.164" port(514)); #}; #log { source(local); filter(f_1); destination(d_1); }; # *.info;mail.none;news.none;authpriv.none;cron.none;daemon.none /var/log/messages filter f_2 { not facility(authpriv); }; filter f_3 { not facility(cron); }; filter f_4 { not facility(daemon); }; filter f_5 { level(info...emerg); }; filter f_6 { not facility(mail); }; filter f_7 { not facility(news); }; destination d_2 { file("/var/log/messages" create_dirs(yes)); }; log { source(local); filter(f_2); filter(f_3); filter(f_4); filter(f_5); filter(f_6); filter(f_7); destination(d_2); }; # authpriv.* /var/log/secure filter f_8 { facility(authpriv) and level(debug...emerg); }; destination d_3 { file("/var/log/secure" create_dirs(yes)); }; log { source(local); filter(f_8); destination(d_3); }; # daemon.* /var/log/daemon filter f_9 { facility(daemon) and level(debug...emerg); }; destination d_4 { file("/var/log/daemon" create_dirs(yes)); }; log { source(local); filter(f_9); destination(d_4); }; # mail.* /var/log/maillog filter f_10 { facility(mail) and level(debug...emerg); }; destination d_5 { file("/var/log/maillog" create_dirs(yes)); }; log { source(local); filter(f_10); destination(d_5); }; # cron.* /var/log/cron filter f_11 { facility(cron) and level(debug...emerg); }; destination d_6 { file("/var/log/cron" create_dirs(yes)); }; log { source(local); filter(f_11); destination(d_6); }; # *.emerg * filter f_12 { level(emerg); }; destination d_7 { usertty("*"); }; log { source(local); filter(f_12); destination(d_7); }; # uucp,news.crit /var/log/spooler filter f_13 { facility(uucp,news) and level(crit...emerg); }; destination d_8 { file("/var/log/spooler" create_dirs(yes)); }; log { source(local); filter(f_13); destination(d_8); }; # local7.* /var/log/boot.log filter f_14 { facility(local7) and level(debug...emerg); }; destination d_9 { file("/var/log/boot.log" create_dirs(yes)); }; log { source(local); filter(f_14); destination(d_9); }; # news.=crit /var/log/news/news.crit filter f_15 { facility(news) and level(crit...emerg); }; destination d_10 { file("/var/log/news/news.crit" create_dirs(yes)); }; log { source(local); filter(f_15); destination(d_10); }; # news.=err /var/log/news/news.err filter f_16 { facility(news) and level(err...emerg); }; destination d_11 { file("/var/log/news/news.err" create_dirs(yes)); }; log { source(local); filter(f_16); destination(d_11); }; # news.notice /var/log/news/news.notice filter f_17 { facility(news) and level(notice...emerg); }; destination d_12 { file("/var/log/news/news.notice" create_dirs(yes)); }; log { source(local); filter(f_17); destination(d_12); }; ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(local); destination(d_mysql); }; [root@test src]#

1 0

dns_cache problems with v1.5.13
by colm ennis 26 Sep '02

26 Sep '02

hi all, im currently using syslog-ng version 1.5.13. i have experienced problems where negatively cached records were preserved indefinitely. only a full restart would cause these ips to be resolved, even a hup would fail. i've now turned off caching cos we rely on ips being resolved in these log files. impt part of the config attached, thanks, colm -- options { sync(0); log_fifo_size(1000); use_dns(yes); dns_cache(yes); use_fqdn(yes); chain_hostnames(no); };

2 2

Re: [syslog-ng]MYSQL problem
by Michael Earls 25 Sep '02

25 Sep '02

What ver of syslog-ng are u running? The dbName, dbPassword, and dbUsername are stored in the script and that script then takes the input from the mysql.pipe, or from the command line mysql -u root --password=passwd syslog < /tmp/mysql.pipe Look the scripts,, http://www.vermeer.org/syslog/scripts michael >>> cat_roger22(a)hotmail.com 09/24/02 08:13AM >>> Hi *, I didn't understood the posts on the mailing list about the entryes inserted into syslog-db, I've some questions: destination d_mysql { pipe("/var/chroot/syslog-ng/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template_escape(yes)); }; I verified the conf file with "-s" option and it didn't returned any error. The Db works fine and I noticed that other people have the same problem...What is the solution ? ...And... Where is set the DB name variable ?...in a conf file I suppose....but where is that ? I Activated the debug option but the output was : gc_mark: Marking object of class 'UNKNOWN' (1) I see the same output even if I don't use mysql option.... Ciao _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

MYSQL problem
by _/CaT\_ 24 Sep '02

24 Sep '02

Hi *, I didn't understood the posts on the mailing list about the entryes inserted into syslog-db, I've some questions: destination d_mysql { pipe("/var/chroot/syslog-ng/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template_escape(yes)); }; I verified the conf file with "-s" option and it didn't returned any error. The Db works fine and I noticed that other people have the same problem...What is the solution ? ...And... Where is set the DB name variable ?...in a conf file I suppose....but where is that ? I Activated the debug option but the output was : gc_mark: Marking object of class 'UNKNOWN' (1) I see the same output even if I don't use mysql option.... Ciao

1 0

RE: [syslog-ng]syslog-ng on Solaris 9
by Hamilton, Andrew 20 Sep '02

20 Sep '02

Fritz, Make sure you don't have anything else bound to that port. Regular syslog uses it and snmpd will sometimes use it. Try kicking off "syslog-ng -dv" and see what the error is. It may tell you that something is bound there already. Regards, Drew -----Original Message----- From: Fritz Buetikofer [mailto:Fritz.Buetikofer@id.unibe.ch] Sent: Friday, September 20, 2002 8:39 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng on Solaris 9 Dear all I'm currently testing syslog-ng 1.5.20 on a new Solaris 9 server. When starting up the daemon, it does not bind on the UDP port 514, so network syslog packets are not processed. Any idea what I did wrong ? Thanks and best regards, --Fritz. ============= University of Bern Computer Services Dept. Fritz Buetikofer. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng on Solaris 9
by Fritz Buetikofer 20 Sep '02

20 Sep '02

Dear all I'm currently testing syslog-ng 1.5.20 on a new Solaris 9 server. When starting up the daemon, it does not bind on the UDP port 514, so network syslog packets are not processed. Any idea what I did wrong ? Thanks and best regards, --Fritz. ============= University of Bern Computer Services Dept. Fritz Buetikofer.

1 0

register
by Fritz Buetikofer 20 Sep '02

20 Sep '02

register btkfr(a)id.unibe.ch

1 0

RE: [syslog-ng]missing 33% of syslog messages
by Hamilton, Andrew 19 Sep '02

19 Sep '02

Bob, Have you checked to see that the messages are getting to the loghost? On a busy network it is possible to lose a number of packets. With UDP you never know. You could use a network sniffer to find out. Something else you might try is raising sync some. If you are getting a ton of messages you might be getting lost in I/O somewhere. sync(0) writes immediately so you might crank it up a little to get some buffering going. You might have to play around with some of the options to get it to work with your configuration. I believe that stats are where you have the internal source going. It is just a line in the file I think. Regards, Drew -----Original Message----- From: Bob Kupiec [mailto:kupiec@ias.edu] Sent: Thursday, September 19, 2002 12:25 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]missing 33% of syslog messages I'm running syslog-ng 1.4.14 on Linux. This server is a loghost for all my syslog clients. It's got plenty of cpu, memory, disk, and bandwidth. The servers that it's accepting logs from are on the same switch as the loghost. That said, I'm losing about 33% of my syslog messages from each client. I tried 1.5.20 with the slightly worse results. All the clients are UDP, and need to stay that way. There are times when minutes go by without recording anything from the clients. Also, where are the "stats" recorded to? Here is my config: ---------------------------------------------------------------------------- options { sync (0); time_reopen (10); # Increased buffer size to 50*256 (50 hosts). -rjk log_fifo_size (12800); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); stats (600); owner (root); group (syslog); perm (0644); dir_owner (root); dir_group (syslog); dir_perm (0755); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/lo g"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; destination remote { file("/var/log/remote/$HOST/$FACILITY.log" log_fifo_size (12800)); }; source net { udp(); }; log { source(net); destination(remote); }; ---------------------------------------------------------------------------- -- Bob Kupiec Security/Network Administrator Email: kupiec(a)ias.edu Institute for Advanced Study Phone: 609-734-8179 Einstein Drive (A208) Fax: 609-951-4418 Princeton, NJ 08540-4907 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

missing 33% of syslog messages
by Bob Kupiec 19 Sep '02

19 Sep '02

I'm running syslog-ng 1.4.14 on Linux. This server is a loghost for all my syslog clients. It's got plenty of cpu, memory, disk, and bandwidth. The servers that it's accepting logs from are on the same switch as the loghost. That said, I'm losing about 33% of my syslog messages from each client. I tried 1.5.20 with the slightly worse results. All the clients are UDP, and need to stay that way. There are times when minutes go by without recording anything from the clients. Also, where are the "stats" recorded to? Here is my config: ---------------------------------------------------------------------------- options { sync (0); time_reopen (10); # Increased buffer size to 50*256 (50 hosts). -rjk log_fifo_size (12800); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); stats (600); owner (root); group (syslog); perm (0644); dir_owner (root); dir_group (syslog); dir_perm (0755); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/lo g"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; destination remote { file("/var/log/remote/$HOST/$FACILITY.log" log_fifo_size (12800)); }; source net { udp(); }; log { source(net); destination(remote); }; ---------------------------------------------------------------------------- -- Bob Kupiec Security/Network Administrator Email: kupiec(a)ias.edu Institute for Advanced Study Phone: 609-734-8179 Einstein Drive (A208) Fax: 609-951-4418 Princeton, NJ 08540-4907

1 0

question about logrotate (little offtopic ;)
by Buerger, Manfred 19 Sep '02

19 Sep '02

hello, my syslog-ng server is runnig fine, but a have little problem with logrotate. please take a look... syslog-ng writes the log files into "/var/log/syslog-ng/" in this directory for each host a subdirectory is created e.g.: /var/log/syslog-ng/10.10.10.2/ /var/log/syslog-ng/10.10.10.3/ usw... in /etc/logrotate.conf i made the following entry: /var/log/syslog-ng/* { rotate 5 daily size=500M postrotate /usr/bin/killall -HUP syslog-ng endscript compress } but this dont work! i have to specify the whole path to the log files: /var/log/syslog-ng/10.10.10.3/* ist there a way to rotate a directory with its subdirectory?? thanks in advance manfred

1 0

(no subject)
by Grenier, Scott 1 - San Mateo, CA 19 Sep '02

19 Sep '02

Hiya- I'm setting up new syslog servers using syslog-ng in a mostly Solaris environment. Regular syslog logs messages from hosts with the actual hostname, but syslog-ng is logging the host's IP address instead. Not all machines are in DNS. Here's what I have: options { chain_hostnames(no); use_time_recvd(yes); log_fifo_size(1000); }; source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; destination d_hostlogs { file("/logs1/HOSTS/$HOST/capturedmessages.$HOST.$YEAR$MONTH$DAY" owner(root) group(sys) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(src); destination(d_hostlogs); }; Syslog-ng creates the files and dirs nicely. I just can't get the actual hostname like I used to when running regular ol' out-o'-the-box syslogd. I checked out the FAQ on Nate's site already (Nice job on the site and FAQ, Nate. It's been a very useful resource for me.). Many thanks. -->scottg

2 1

Unwanted logging
by BENGT OLSSON 17 Sep '02

17 Sep '02

Hi I get some unwanted loggin from strange hosts.... The syslog-ng.conf-file looks like; options { use_fqdn(yes); keep_hostname(yes); use_dns(yes); long_hostnames(off); sync(0); log_fifo_size(1000); }; source all { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; destination hosts { file("/var/syslog/hosts/$HOST/$FACILITY_$YEAR-$MONTH-$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(all) ; destination(hosts) ; }; An example of unwanted "hosts"-directory in the /var/syslog/hosts-directory; 0x0.0x5da74da 0x0.0x5dc3cea 0x0.0x5dc3d5a 0x0.0x5dc4077 0x0.0x5dca334 0x0.0x5dcea7a 0x0.0x637fb77 0x0.0x642bad8 0x0.0x64c5ea8 An example of correct hosts -directory in the /var/syslog/hosts-directory looks like this; trillian.student.bth.se trumma.bth.se viking.student.bth.se viola.bth.se violin.bth.se vogonjeltz.student.bth.se voyager.student.bth.se vroomfondel.student.bth.se zaphod.student.bth.se Is there some internal logging or what is it comming from? A minor problem is that i have the "long_hostnames" to off and still it loging whit long hostnames....any guess? Best Regards -- Bengt Olsson Blekinge Tekniska Högskola Datorenheten Campus Gräsvik Vallhallavägen 1 371 79 Karlskrona Mail: bol(a)bth.se Tel: 0455-385152 Mobil: 0708-787 780

3 2