- syslog-ng - lists.balabit.hu

Re: [syslog-ng]1.5.19 and tcp
by Abraham, Ajamu 14 Aug '02

14 Aug '02

-------------------------- Sent from my BlackBerry Wireless Handheld

1 0

klogd and sysctl
by Frank Crawford 10 Aug '02

10 Aug '02

Folks, One thing I noticed on eliminating klogd from my Red Hat 7.3 system was that kernel messages were then being printed on the console. Looking further into it, it seems that klogd invokes a sysctl option to suppress certain messages (in particular packet filtering messages). The same effect can be managed with the command: /sbin/sysctl -n -w kernel.printk=6 on starting syslog-ng, and: /sbin/sysctl -n -w kernel.printk=7 on shutdown. One other item I did to make it a total drop in was write the pid file to /var/run/syslogd.pid, by invoking syslog-ng with: /usr/local/sbin/syslog-ng -p /var/run/syslogd.pid (These are all items that could be in the FAQ.) Frank Crawford -- ac3 Suite G16, Bay 7, Locomotive Workshop Phone: 02 9209 4600 Australian Technology Park Fax: 02 9209 4611 Eveleigh NSW 1430

1 0

Penny L Creech/Nationwide/NWIE is out of the office.
by CREECHP＠Nationwide.com 10 Aug '02

10 Aug '02

I will be out of the office starting 08/09/2002 and will not return until 08/19/2002. I will respond to your message when I return.

1 0

RE: [syslog-ng]Installing on a non-compiler system
by Clausing, James A (Jim), SOLCM 09 Aug '02

09 Aug '02

I build packages to do this all the time (the only way I'll do it). I would be happy to share my Makefile (which gunzips, untars, configures, makes, installs, and pkgmks). I haven't yet added the logic to it to also build & install libol, but I only have that installed on my development/build systems, not where syslog-ng is actually deployed. ---Jim -----Original Message----- From: Nicholas Berry [mailto:nberry@ragingwire.com] Sent: Tuesday, July 30, 2002 11:26 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Installing on a non-compiler system You could build syslog-ng in a Solaris pkg format, but I'm not sure how much of a problem you would have installing the package on your Solaris 2.6 system (might not have a problem if you're up-to-date with the recommended patch cluster). Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. nberry(a)ragingwire.com -----Original Message----- From: Lightfoot.Michael [mailto:Lightfoot.Michael@comcare.gov.au] Sent: Monday, July 29, 2002 8:02 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Installing on a non-compiler system I have built syslog-ng on a development server (Solaris 9) and now wish to install it on another system which doesn't have development tools (it is a fairly standard Solaris 9 installation.) I will also be installing a Solaris 2.6 build on systems in our DMZ which have been hardened and have very little other than the OS. The problem I have struck is that after copying the built source to the target server, "make install" fails with the following error: # make install Making install in src Making install in . make: Fatal error: Don't know how to make target `/usr/local/src/syslog-ng-1.4.15/configure.in' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Any ideas on how I get around this easily? NFS is one option, but will not be for the DMZ systems (and is not used in production on any systems here.) I suppose I could install it on the development server using a filesystem diff before and after trick I have used in the past, but again there are problems doing this with the Solaris 2.6 build (which has to be done on a production server as I don't have a Solaris 2.6 dev machine any more.) Michael Lightfoot Unix Consultant ISG Host Systems Comcare +61 2 62750680 NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

CRITICAL: disk flooding bug - disabling of STATS seems to be broken in 1.5.19
by Dominique Kaiser 09 Aug '02

09 Aug '02

Disabling STATS reporting with options "{ stats(0); }" doesn't work anymore! Instead syslog-ng gets busy reporting STATS all the time without pause - and succeeds in eating up all free disk space in a matter of minutes. If you don't have an extra mount for /var/log your whole system is rendered inoperatible... the upstream Changelog shows an entry from 2002-06-17 concerning STATS which most likely describes the change causing the bug. I didn't fully study the sources but on first sight it seems to me that the error is in main_loop() in src/main.c in the lines 188 and 204. I think it should be if (s.timeout > 0) instead of if (s.timeout <= 0) especially as the callback timers seem to get deleted in line 201. The way it is now STATS might be disabled by providing any positive config value??!! The problem might also be solved if one could use "stats(-1);" to deactivate STATS reporting but syslog-ng doesn't seem to accept negative values (which might be another bug on itself?). In the default installation the default value of 600 seconds is used, so this bug is not a problem if syslog-ng is used with unchanged config options. But whoever does want his/her disks tpo spin down at all will have tried to disable STATS... Cheers, Dominique. P.S.: also reported as Bug #156045 to the Debian BTS... P.P.S.: I'm not a member of the syslog-ng mainling list...

3 2

Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fix
by Balazs Scheidler 09 Aug '02

09 Aug '02

On Thu, Aug 08, 2002 at 08:47:01AM -0500, Caylan Van Larson wrote: > Mr. Scheidler, > > May I ask you the correct way to apply this patch. I have applied kernel > patches before but I am not aware of this syntax (not that it is different > I just am curious on your "Right Way"). I thought it would be best to ask > you instead of trying it 10 different ways hoping it worked. unpack a vanilla 1.5.19 syslog-ng cd syslog-ng-1.5.19 patch -p1 <path to file> touch src/sources.c.x (the last one is needed if you don't have scsh, to satisfy make dependencies) rebuild. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 4

"message repeated N times"
by Andan Lauber 09 Aug '02

09 Aug '02

heya, i've not seen it do it, but i've only the one host running syslog-ng as a central loghost, with generic syslogs reporting to it, but does syslog-ng deal with repeat messages like generic syslog does, in this fashion? host.domain.tld message repeated 4 times or does it just spew out the message again? thanks. (and as a side, if any know of a way to STOP generic syslog from doing this, i'd love to hear it. i'm hoping the answer is "install syslog-ng") thanks. -- Andan Lauber Redback Networks, Inc. Daemonologist http://www.redback.com

2 1

Re: [syslog-ng]1.5.19 and tcp
by CHENNES＠Nationwide.com 09 Aug '02

09 Aug '02

The truss output also shows that the process is ultimately killed. Are you saying you suspect an "external force" is killing the process. Balazs Scheidler <bazsi(a)balabit.hu> T To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin(a)lists.b alabit.hu bcc: Subject: Re: [syslog-ng]1.5.19 and tcp 08/08/02 03:28 AM Please respond to syslog-ng On Wed, Aug 07, 2002 at 02:09:06PM -0400, CHENNES(a)Nationwide.com wrote: > > Here's the gdb backtrace: > > gdb syslog-ng -c core > GNU gdb 4.18 > Copyright 1998 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public License, and you > are > welcome to change it and/or distribute copies of it under certain > conditions. > Type "show copying" to see the conditions. > There is absolutely no warranty for GDB. Type "show warranty" for details. > This GDB was configured as "sparc-sun-solaris2.8"... > Core was generated by `/test/syslog/bin/syslog-ng -f /etc/syslog-ng.conf -p > /etc/s'. > Program terminated with signal 9, Killed. > Reading symbols from /usr/lib/libpthread.so.1...done. > Reading symbols from /usr/lib/libdoor.so.1...done. > Reading symbols from /usr/lib/libl.so.1...done. > Reading symbols from /usr/lib/libsocket.so.1...done. > Reading symbols from /usr/lib/libnsl.so.1...done. > Reading symbols from /usr/lib/libxnet.so.1...done. > Reading symbols from /usr/lib/libc.so.1...done. > Reading symbols from /usr/lib/libdl.so.1...done. > Reading symbols from /usr/lib/libmp.so.2...done. > Reading symbols from > /usr/platform/SUNW,Sun-Fire-880/lib/libc_psr.so.1...done. > Reading symbols from /usr/lib/libthread.so.1...done. > #0 0xff141d00 in _malloc_unlocked () from /usr/lib/libc.so.1 > (gdb) bt > #0 0xff141d00 in _malloc_unlocked () from /usr/lib/libc.so.1 > #1 0xff141ad0 in malloc () from /usr/lib/libc.so.1 > #2 0x2219c in xalloc () > #3 0x17978 in make_log_info (length=0, > msg=0x3d8d8 "<13>Aug 7 13:59:21 test/test user: [ID 702911 > user.notice] test message number 3\n<13>Aug 7 13:59:21 test/ > test user: [ID 702911 user.notice] test message number 4\n<13>Aug 7 > 13:59:21 "..., prefix=0x0) at log.c:263 > #4 0x15be8 in do_handle_line (self=0xffbefa90, length=89, > data=0x3d8d8 "<13>Aug 7 13:59:21 test/test user: [ID 702911 > user.notice] test message number 3\n<13>Aug 7 13:59:21 test > /test user: [ID 702911 user.notice] test message number 4\n<13>Aug 7 > 13:59:21 "..., addr=0x3d8d8, addrlen=0) > at sources.c:67 > #5 0x15de0 in do_read_line (h=0x3d8a0, read=0xffbefa90) at sources.c:134 > #6 0x202f4 in read_callback () > #7 0x1fed4 in io_iter () > #8 0x152dc in main_loop (backend=0x395d8) at main.c:191 > #9 0x159ec in main (argc=6, argv=0xffbefd54) at main.c:513 > (gdb) hmm.. this is not a segfault. the process is killed with signal SIGKILL. the original truss output indicated a segfault. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng]Message forwarding problem
by Dale Amon 09 Aug '02

09 Aug '02

Thanks much, options { keep_hostname(yes); }; on the master server sorted everything out.

1 0

Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fix
by Ron Braley 08 Aug '02

08 Aug '02

No, I thought about the same things you did at first (configuration, etc.) but can't think of anything else. Going backwards to syslog isn't a good option, as we'd be very limited and all like logs would be dumped into the same file regardless of the originating server. Tell Baszi what you found (or didn't find) and see if he can duplicate and fix it (I wouldn't hold my breath, though). rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> caylan(a)cs.und.edu 08/08/02 12:31PM >>> Hello, I tried to apply the patch and got this: [root@smack src]# patch -p0 < patchto.bazsi patching file sources.c Hunk #1 FAILED at 80. Hunk #2 FAILED at 114. 2 out of 2 hunks FAILED -- saving rejects to file sources.c.rej [root@smack src]# patch -p1 < patchto.bazsi missing header for unified diff at line 8 of patch can't find file to patch at input line 8 Perhaps you used the wrong -p or --strip option? The text leading up to this was: -------------------------- |Index: sources.c |=================================================================== |RCS file: /var/cvs/syslog-ng/syslog-ng/src/sources.c,v |retrieving revision 1.34 |diff -u -r1.34 sources.c |--- sources.c 18 Jul 2002 13:18:02 -0000 1.34 |+++ sources.c 8 Aug 2002 10:01:18 -0000 -------------------------- File to patch: sources.c patching file sources.c Hunk #1 FAILED at 80. Hunk #2 FAILED at 114. 2 out of 2 hunks FAILED -- saving rejects to file sources.c.rej I know what was going on here so I just edited sources.c by hand. Unfortunately after a complete deletion of the src directory, unpacking, copied over sources.c, ./configure, touch src/sources.c.x, make, make install. I restarted syslog-ng had a look at /var/log/kern and these entries were still happening: Aug 8 12:29:23 smack IPTABLES UDP-IN:etOUT= MAC44:00:05:01:fb:e3:fc:08:00 SRC=6EN=141 TOS=0x00 PREC=0x00 UDP SP3014 LEN=121 Aug 8 12:29:28 smack IPTABLES UDP-INOUT= MAC=00:03:47:4e:3:05:01:fb::00 SRC=64.12.51.129 DST=134.129 LEN=141 TOSPROTO=UDP SPT=53 DPTIN: IN=eth1 OUT= MAC=00:03:47:4eRC=64.12.51.129 D0x00 PREC=0x00 L=45 ID=47526 PROTO=UDP SPT=53 D<6> IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:005:fbSR SP<6> IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3fc:08 SRC=1329.9DS89 <6> IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.217.172 DST=134.129.212.30 LEN=244 TOS=0x00 PREC=0x00 TTL=127 ID=60809 PROTO=UDP SPT=138 DPT=138 LEN=224 Aug 8 12:29:29 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.120 DST=134.129.212.30 LEN=78 TOS=0x00 PREC=0x00 TTL=2 I404LEN= Aug 8 12:29:29 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.120 DST=134.129.12.C=0x0TL=12ID6 PRO Aug 8 12:29:30 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.120 DST=134.129.212.30 LEN=78 TOS=0x00 PREC=0x00 TT=127 44047 PROTO=UDP SP37 DPT=137 LEN=58 Aug 8 12:29:33 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08: I have no clue :( Any ideas? Caylan Van Larson Unix Administrator - Systems Team Member University of North Dakota (Aerospace College) caylan(a)cs.und.edu 701-777-6151 (work) On Thu, 8 Aug 2002, Balazs Scheidler wrote: > On Thu, Aug 08, 2002 at 08:47:01AM -0500, Caylan Van Larson wrote: > > Mr. Scheidler, > > > > May I ask you the correct way to apply this patch. I have applied kernel > > patches before but I am not aware of this syntax (not that it is different > > I just am curious on your "Right Way"). I thought it would be best to ask > > you instead of trying it 10 different ways hoping it worked. > > unpack a vanilla 1.5.19 syslog-ng > cd syslog-ng-1.5.19 > patch -p1 <path to file> > touch src/sources.c.x > > (the last one is needed if you don't have scsh, to satisfy make > dependencies) > > rebuild. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Problem with syslogd and syslog-ng...
by BENGT OLSSON 08 Aug '02

08 Aug '02

Hello Can some one help me with this? I have syslog-ng running on the loggserver and syslogd on the clients and syslog-ng servern dosn't trig on all levels. ex. on the client(etc/syslog.conf) *.debug @loghost *.info @loghost #*.notice @loghost #*.warning @loghost #*.err @loghost #*.crit @loghost #*.alert @loghost #*.emerg @loghost gives 2 entries in the logfile #*.debug @loghost *.info @loghost #*.notice @loghost #*.warning @loghost #*.err @loghost #*.crit @loghost #*.alert @loghost #*.emerg @loghost gives zero entries in the logfile?? I want to log all levels from warning to emerg. *.warning @loghost in the syslog.conf file would be enough or is in't? And this should gives one entrie in the logfile? the syslog-ng.conf looks like this: options { use_fqdn(yes); keep_hostname(yes); use_dns(yes); long_hostnames(off); sync(3); log_fifo_size(1000); }; source all { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; # automatic host sorting # set it up destination hosts { file("/var/syslog/hosts/$HOST/$FACILITY_$YEAR-$MONTH-$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; # log by host log { source(all); destination(hosts); }; /Benke -- Bengt Olsson Blekinge Tekniska Högskola Datorenheten Campus Gräsvik Vallhallavägen 1 371 79 Karlskrona Mail: bol(a)bth.se Tel: 0455-385152 Mobil: 0708-787 780

2 1

[PATCH] please test: syslog-ng message mangling fix
by Balazs Scheidler 08 Aug '02

08 Aug '02

Hi, This patch should fix the message mangling problems you might have encountered. As the log parsing routines are quite critical I don't want to release this patch without testing on most platforms. It seems to work on Linux for me, but tests from more exotic platforms are welcome. (the problem this patch fixes occurs only if you have messages longer than the default limit. the limit can be changed by log_msg_size) to test: apply the patch, and touch sources.c.x, and recompile Index: sources.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/sources.c,v retrieving revision 1.34 diff -u -r1.34 sources.c --- sources.c 18 Jul 2002 13:18:02 -0000 1.34 +++ sources.c 8 Aug 2002 09:21:34 -0000 @@ -112,8 +113,8 @@ closure->pos = 0; return ST_OK | ST_GOON; } - if (!eol && closure->pos) { - /* we don't have a terminating nl nor \0 */ + if (!eol && closure->pos == closure->max_log_line) { + /* we don't have a terminating nl nor \0, and our buffer is full */ do_handle_line(closure, closure->pos, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 1

kern (iptable) logs cut off
by Caylan Van Larson 08 Aug '02

08 Aug '02

Greetings, This is on a RedHat 7.3 Box. We were using the latest syslog-ng rpm from redhat and we noticed that upon migration from syslogd to syslog-ng our iptable logs were getting mangled. Here is an exert from syslogd logging of iptables (/var/log/messages): Aug 7 23:41:47 smack kernel: IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.217.37 DST=134.129.212.30 LEN=240 TOS=0x00 PREC=0x00 TTL=127 ID=13570 PROTO=UDP SPT=138 DPT=138 LEN=220 Aug 7 23:41:48 smack kernel: IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.201.29 DST=134.129.212.30 LEN=60 TOS=0x00 PREC=0x00 TTL=61 ID=10095 DF PROTO=TCP SPT=4997 DPT=53 WINDOW=32120 RES=0x00 SYN URGP=0 Aug 7 23:41:48 smack kernel: IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.220.175 DST=134.129.212.30 LEN=78 TOS=0x00 PREC=0x00 TTL=127 ID=12752 PROTO=UDP SPT=137 DPT=137 LEN=58 Aug 7 23:41:49 smack kernel: IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.220.175 DST=134.129.212.30 LEN=78 TOS=0x00 PREC=0x00 TTL=127 ID=13008 PROTO=UDP SPT=137 DPT=137 LEN=58 Aug 7 23:41:49 smack kernel: IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.220.175 DST=134.129.212.30 LEN=78 TOS=0x00 PREC=0x00 TTL=127 ID=13264 PROTO=UDP SPT=137 DPT=137 LEN=58 Very nice as you can see. Now, we would love to use syslog-ng but this is from syslog-ng (/var/log/kern): Aug 7 23:38:17 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00: Aug 7 23:38:17 smack IPTABLES ICMP-IN: IN=eth1 OUT= MAC=00:03: Aug 7 23:38:19 smack IPTABLES ICMP-IN: IN=eth1 OUT= MAC=00:03: Aug 7 23:38:20 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=24.220.215.146 DST=134.129.212.30 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=20216 DF PROTO=TCP SPT=2406 DPT=53 WINDOW=2144 RES=0x00 SYN URGP=0 Aug 7 23:38:20 smack IPTABLES ICMP-IN: IN=eth1 OUT= MAC= Aug 7 23:38:23 smack IPTABLES ICMP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=192.36.148.20 DST=134.129.212.30 LEN=52 TOS=0x00 PREC=0x00 TTL=5 ID=6179 PROTO=ICMP TYPE=8 CODE=0 ID=22608 SEQ=17 Aug 7 23:38:23 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC= Aug 7 23:38:24 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03: Aug 7 23:38:25 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.201.29 DST=134.129.212.30 LEN=60 TOS=0x00 PREC=0x00 TTL=61 ID=6213 DF PROTO=TCP SPT=1030 DPT=53 WINDOW=32120 RES=0x00 SYN URGP=0 Aug 7 23:38:25 smack IPTABLES ICMP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=192.36.148.20 DST=134.129.212.30 LEN=52 TOS=0x00 PREC=0x00 TTL=243 ID=6479 PROTO=ICMP TYPE=8 CODE=0 ID=22608 SEQ=255 At the same time I find this!!! Could this be the other part of whats missing above? [root@smack log]# tail -f user Aug 7 23:42:26 smack TO=0x00 PREC=0x00 TTL=127 ID=14587 PROTO=UDP SPT=137 DPT=137 LEN=58 Aug 7 23:42:37 smack C=UDPT=1 Aug 7 23:42:39 smack 0TL=127 I5998 PROTO=UDP SPT=137 DPT=137 L8 Aug 7 23:42:43 smack 0 PREC=0 TTL=127 ID=18027 PROTO=UDP SPT=17 D37 N= Aug 7 23:42:57 smack =x00L=127D=1826 PROTO=UDP SPT=137 DPT=137N= Aug 7 23:43:05 smack =0x00 TTL7 I14 DF Aug 7 23:43:22 smack O=TCP SPT=4481 DPT=53 WINDOW=16384 RES=0x00 SYN U Aug 7 23:43:24 smack LEN=78 =0x00 PREC=0x00 TTL=127 ID=21968 PROTDP SPT=137 DPT=137 LEN=58 Aug 7 23:43:28 smack T=138 DPT Aug 7 23:43:31 smack T53 W Not to mention some other output going to /var/log/bootup. This output consists of iptable startup information... I have tried every combo of syslog-ng klogd imaginable. I have tried to tinker with the global src using pipes and files for the kernel logging but that got nowhere... Same results. This is experienced using: libol-0.3.3 syslog-ng-1.5.19 syslog-ng-1.5.17-1.i386.rpm The command dmesg gives nice iptables output. So I know it is not iptablse fault. Iptables is configured to log at level 5 for normal dropped packets and log level 5 for other more serious packets. Below is my syslog-ng.conf file. Thank you for any help!!! I need to work on the firewall and it is hard with no logs.. :( Thanks again, Caylan Van Larson --SNIP Here is my syslog-ng.conf: # This file should be compatible with the out-of-the-box # /etc/syslog.conf on Red Hat Linux # global options # options { use_dns(yes); use_fqdn(no); use_time_recvd(no); chain_hostnames(no); mark(0); sync(0); }; # sources # source s_all { internal(); unix-stream("/dev/log"); file("/proc/kmsg"); }; # facility filters # filter f_authpriv { facility(authpriv); }; filter f_auth { facility(auth); }; filter f_boot { facility(local7); }; filter f_2511 { facility(local5); }; filter f_6509-1-log { facility(local4); }; filter f_6509-2-log { facility(local3); }; filter f_cron { facility(cron); }; filter f_kern { facility(kern); }; filter f_user { facility(user); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon); }; filter f_messages { priority(info..emerg) and not facility(mail, news, authpriv, cron, local1, local2, local3, local4, local5, local6); }; filter f_news { facility(news); }; # priority filters # filter f_emerg { priority(emerg); }; filter f_crit { priority(crit..emerg); }; filter f_crit_only { priority(crit); }; filter f_err { priority(err..emerg); }; filter f_err_only { priority(err); }; filter f_warn { priority(warning..emerg); }; filter f_notice { priority(notice..emerg); }; filter f_info { priority(info..emerg); }; filter f_debug { priority(debug..emerg); }; # host filters # filter f_smack { host(smack); }; #destination filters # # *network* destination d_tcp { tcp("134.129.212.33"); }; destination d_udp { udp("134.129.212.33"); }; # *everyone* destination d_all { usertty("*"); }; # *console* destination d_console { file("/dev/console"); }; # *boot* destination d_smacboot { file("/var/log/bootlog"); }; # *cron* destination d_smaccron { file("/var/log/cron"); }; # *mail* destination d_smacmail { file("/var/log/maillog"); }; # *messages* destination d_smacmsg { file("/var/log/messages"); }; # *secure (auth & authpriv)* destination d_smacsec { file("/var/log/secure"); }; # *user* destination d_smacuser { file("/var/log/user"); }; # *kern* destination d_smackern { file("/var/log/kern"); }; # *daemon* destination d_smacdaemon { file("/var/log/daemon"); }; # *spool (lpr)* destination d_smacspool { file("/var/log/spooler"); }; #Everyone gets emergency messages log { source(s_all); filter(f_emerg); destination(d_all); }; #Log messages from Smack log { source(s_all); filter(f_cron); filter(f_debug); filter(f_smack); destination(d_smaccron); destination(d_tcp); }; log { source(s_all); filter(f_authpriv); filter(f_debug); filter(f_smack); destination(d_smacsec); destination(d_tcp); }; log { source(s_all); filter(f_mail); filter(f_warn); filter(f_smack); destination(d_smacmail); destination(d_tcp); }; log { source(s_all); filter(f_boot); filter(f_debug); filter(f_smack);destination(d_smacboot); destination(d_tcp); }; # fw-iptables logs at NOTICE <5> (fragments/unknown protocols) and INFO <6> (known udp/tcp/icmp) # This line will log ALL of kern locally log { source(s_all); filter(f_kern); filter(f_messages); filter(f_debug); filter(f_smack); destination(d_smackern); }; # This line will only remotely log NOTICE <5> and above (5,4,3,2,1,0) log { source(s_all); filter(f_kern); filter(f_messages); filter(f_notice); filter(f_smack); destination(d_tcp); }; log { source(s_all); filter(f_user); filter(f_debug); filter(f_smack); destination(d_smacuser); destination(d_tcp); }; log { source(s_all); filter(f_lpr); filter(f_debug); filter(f_smack); destination(d_smacspool); destination(d_tcp); }; log { source(s_all); filter(f_daemon); filter(f_notice); filter(f_smack); destination(d_smacdaemon); destination(d_tcp); }; --SNAP Whew Thanks, Caylan Van Larson Unix Administrator - Systems Team Member University of North Dakota (Aerospace College) caylan(a)cs.und.edu 701-777-6151 (work)

3 2

Re: [syslog-ng]1.5.19 and tcp
by CHENNES＠Nationwide.com 08 Aug '02

08 Aug '02

Here's the gdb backtrace: gdb syslog-ng -c core GNU gdb 4.18 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "sparc-sun-solaris2.8"... Core was generated by `/test/syslog/bin/syslog-ng -f /etc/syslog-ng.conf -p /etc/s'. Program terminated with signal 9, Killed. Reading symbols from /usr/lib/libpthread.so.1...done. Reading symbols from /usr/lib/libdoor.so.1...done. Reading symbols from /usr/lib/libl.so.1...done. Reading symbols from /usr/lib/libsocket.so.1...done. Reading symbols from /usr/lib/libnsl.so.1...done. Reading symbols from /usr/lib/libxnet.so.1...done. Reading symbols from /usr/lib/libc.so.1...done. Reading symbols from /usr/lib/libdl.so.1...done. Reading symbols from /usr/lib/libmp.so.2...done. Reading symbols from /usr/platform/SUNW,Sun-Fire-880/lib/libc_psr.so.1...done. Reading symbols from /usr/lib/libthread.so.1...done. #0 0xff141d00 in _malloc_unlocked () from /usr/lib/libc.so.1 (gdb) bt #0 0xff141d00 in _malloc_unlocked () from /usr/lib/libc.so.1 #1 0xff141ad0 in malloc () from /usr/lib/libc.so.1 #2 0x2219c in xalloc () #3 0x17978 in make_log_info (length=0, msg=0x3d8d8 "<13>Aug 7 13:59:21 test/test user: [ID 702911 user.notice] test message number 3\n<13>Aug 7 13:59:21 test/ test user: [ID 702911 user.notice] test message number 4\n<13>Aug 7 13:59:21 "..., prefix=0x0) at log.c:263 #4 0x15be8 in do_handle_line (self=0xffbefa90, length=89, data=0x3d8d8 "<13>Aug 7 13:59:21 test/test user: [ID 702911 user.notice] test message number 3\n<13>Aug 7 13:59:21 test /test user: [ID 702911 user.notice] test message number 4\n<13>Aug 7 13:59:21 "..., addr=0x3d8d8, addrlen=0) at sources.c:67 #5 0x15de0 in do_read_line (h=0x3d8a0, read=0xffbefa90) at sources.c:134 #6 0x202f4 in read_callback () #7 0x1fed4 in io_iter () #8 0x152dc in main_loop (backend=0x395d8) at main.c:191 #9 0x159ec in main (argc=6, argv=0xffbefd54) at main.c:513 (gdb) Balazs Scheidler <bazsi(a)balabit.hu> T To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin(a)lists.b alabit.hu bcc: Subject: Re: [syslog-ng]1.5.19 and tcp 08/07/02 11:24 AM Please respond to syslog-ng On Wed, Aug 07, 2002 at 09:31:50AM -0400, CHENNES(a)Nationwide.com wrote: > I am having difficulty keeping 1.5.19 running when receiving syslog > messages via tcp. I have a central logging host that receives messages via > tcp from collection hosts. The collection hosts are receiving messages > from various hosts via udp and tcp. Essentially, the ng process > immediately dies on the central logging host as soon as I start it. > However, if I alter the configurations to use only udp, I have no problems. > The central logging host and the collection hosts are all running Solaris 8 > with 1.5.19. I have tested the same exact scenario using a previous > version of ng (1.4.14) on the central logging host and it works just fine. > I have included some configuration information below. can you provide a gdb backtrace based on the core file? gdb syslog-ng -c core gdb> bt and the results. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng]new... simple examples?
by Michael Earls 07 Aug '02

07 Aug '02

look at the FAQ page Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >>> dbarber(a)tdschas.com 08/07/02 02:12PM >>> Hi, Does anyone have a simple example for a config file which will log all logs to a remote host via tcp? or a site that has some examples? thanks, Dan _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

Re: [syslog-ng]new... simple examples?
by Michael Earls 07 Aug '02

07 Aug '02

not sure if it has a config file for logging syslog via tcp, but there are some examples of logging via udp, here is an example to log udp and filter based on ip address, # Tucson # destination 12.9.1.226 { file("/var/syslog/Arizona/Tucson/JC-Tucson/redback/JC-Tucson.log"); }; filter f_12.9.1.226 { host(12.9.1.226); }; log { source(net); filter(f_12.9.1.226); destination(12.9.1.226); }; destination 12.126.138.90 { file("/var/syslog/Arizona/Tucson/JC-Tucson/router/JC-Tucson.log"); }; filter f_12.126.138.90 { host(12.126.138.90); }; log { source(net); filter(f_12.126.138.90); destination(12.126.138.90); }; Nate — do we have an example of syslog-ng config file for logging via tcp? >>> dbarber(a)tdschas.com 08/07/02 02:47PM >>> I must be missing something... Michael, can you point out in the FAQ where it has a link to or specific examples of a config log which uses tcp to log remotely? thanks, Dan On Wed, 2002-08-07 at 14:22, Michael Earls wrote: > look at the FAQ page > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > >>> dbarber(a)tdschas.com 08/07/02 02:12PM >>> > Hi, > > Does anyone have a simple example for a config file which will log all > logs to a remote host via tcp? > > or a site that has some examples? > > thanks, > > Dan > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

new... simple examples?
by Dan Barber 07 Aug '02

07 Aug '02

Hi, Does anyone have a simple example for a config file which will log all logs to a remote host via tcp? or a site that has some examples? thanks, Dan

1 0

Message forwarding problem
by Dale Amon 07 Aug '02

07 Aug '02

I've got the following situation: Host A can talk to Host B Host B can talk to Host C Host A can NOT talk to Host C directly Host C is the master logger So I'm trying to set up Host B to act as a forwarder. This "mostly" works: HOST A: destination mylogger { tcp(<HOST B> port(1999) localport(999)); }; filter all { level(info..err); }; log { source(src); filter(all); destination(console_all); destination(mylogger); }; HOST B: source s_tcp { tcp(localip(<HOST B>) port(1999) max-connections(50)); }; destination mylogger { tcp(<HOST C> port(1999) localport(999)); }; filter all { level(info..err); }; log { source(s_tcp); source(src); filter(all); destination(console_all); destination(mylogger); }; HOST C source s_tcp { tcp(localip(<HOST C>) port(1999) max-connections(50)); }; destination logtest { file("/var/log/logtest.log" owner("root") group("adm") perm(0640)); }; filter drop1 { not match ( " session opened|closed for user root|mail") and not match ("STATS: dropped 0"); }; log { source(s_tcp); source(src); filter(drop1); destination(logtest); }; The problem is, HOST B rewrites the message source to itself, so all messages from HOST A arriving at HOST C appear to have "occurred" on HOST B. Is there a way to do real forwarding rather than hacking it as I did above?

3 2

1.5.19 and tcp
by CHENNES＠Nationwide.com 07 Aug '02

07 Aug '02

I am having difficulty keeping 1.5.19 running when receiving syslog messages via tcp. I have a central logging host that receives messages via tcp from collection hosts. The collection hosts are receiving messages from various hosts via udp and tcp. Essentially, the ng process immediately dies on the central logging host as soon as I start it. However, if I alter the configurations to use only udp, I have no problems. The central logging host and the collection hosts are all running Solaris 8 with 1.5.19. I have tested the same exact scenario using a previous version of ng (1.4.14) on the central logging host and it works just fine. I have included some configuration information below. **** output from command truss -fael syslog-ng -d syslog-ng version 1.5.19 starting 1548/1: write(2, " s y s l o g - n g v e".., 34) = 34 1548/1: sigaction(SIGPIPE, 0xFFBEFA18, 0xFFBEFB18) = 0 1548/1: sigaction(SIGHUP, 0xFFBEFA18, 0xFFBEFB18) = 0 1548/1: sigaction(SIGTERM, 0xFFBEFA18, 0xFFBEFB18) = 0 1548/1: sigaction(SIGCLD, 0xFFBEFA18, 0xFFBEFB18) = 0 1548/1: time() = 1028722452 1548/1: poll(0xFFBEFB38, 2, 100) = 0 1548/1: poll(0xFFBEFB38, 2, 60000) (sleeping...) 1548/2: signotifywait() (sleeping...) 1548/3: door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) 1548/4: lwp_cond_wait(0xFF0F5550, 0xFF0F5560, 0xFF0EEDB8) (sleeping...) 1548/5: door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) 1548/1: poll(0xFFBEFB38, 2, 60000) = 1 1548/1: accept(3, 0xFFBEF9C8, 0xFFBEF9C4, 1) = 7 1548/1: fcntl(7, F_GETFL, 0xFFFFFFFF) = 130 1548/1: fstat64(7, 0xFFBEF698) = 0 1548/1: getsockopt(7, 65535, 8192, 0xFFBEF798, 0xFFBEF790, 0) = 0 1548/1: fstat64(7, 0xFFBEF698) = 0 1548/1: getsockopt(7, 65535, 8192, 0xFFBEF798, 0xFFBEF794, 0) = 0 1548/1: setsockopt(7, 65535, 8192, 0xFFBEF798, 4, 0) = 0 1548/1: fcntl(7, F_SETFL, 0x00000082) = 0 1548/1: fcntl(7, F_SETFD, 0x00000001) = 0 AF_INET client connected from 10.1.1.1, port 38896 1548/1: write(2, " A F _ I N E T c l i e".., 55) = 55 io.c: Preparing fd 7 for reading 1548/1: write(2, " i o . c : P r e p a r".., 33) = 33 1548/1: time() = 1028722460 1548/1: poll(0xFFBEFB30, 3, 100) = 1 1548/1: read(7, " < 1 3 > A u g 7 0".., 2049) = 2049 1548/1: Incurred fault #6, FLTBOUNDS %pc = 0xFF141D00 1548/1: siginfo: SIGSEGV SEGV_MAPERR addr=0x3103F700 1548/1: Received signal #11, SIGSEGV [default] 1548/1: siginfo: SIGSEGV SEGV_MAPERR addr=0x3103F700 1548/1: *** process killed *** **** syslog-ng.conf from central logging host: options { sync(0); time_reopen(10); log_fifo_size(1000); keep_hostname(yes); use_dns(yes); use_fqdn(no); use_time_recvd(yes); gc_idle_threshold(1000); }; source ng_local { internal(); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); }; source remote { tcp(ip("10.1.1.10") port(5514)); }; destination ng_messages { file("/var/log/syslog-ng" owner(root) group(staff) perm(0440) create_dirs(yes) dir_perm(0755)); }; destination local_messages { file("/var/adm/messages" owner(root) group(staff) create_dirs(yes) dir_perm(0755)); }; destination remote_messages { file("/logfiles/$MONTH_$DAY_$YEAR/$HOST/messages" owner(root) group(corenet) perm(0440) create_dirs(yes) dir_perm(0755)); }; log { source(ng_local); destination(ng_messages); }; log { source(local); destination(local_messages); }; log { source(remote); destination(remote_messages); }; **** syslog-ng.conf from collection hosts: options { sync(0); time_reopen(10); log_fifo_size(2000); keep_hostname(yes); use_fqdn(no);}; source ng_local { internal(); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); }; source remote { udp(ip("10.1.1.1") port(514)); tcp(ip("10.1.1.1") port(5514)); }; destination ng_messages { file("/var/log/syslog-ng" owner(root) group(staff) create_dirs(yes) dir_perm(0755)); }; destination local_messages { file("/var/adm/messages" owner(root) group(staff) create_dirs(yes) dir_perm(0755)); }; destination remote_messages { tcp("10.1.1.10" port(5514)); }; log { source(ng_local); destination(ng_messages); }; log { source(local); destination(local_messages); }; log { source(remote); destination(remote_messages); };

2 1

Re: syslog-ng bug?
by Balazs Scheidler 07 Aug '02

07 Aug '02

On Tue, Aug 06, 2002 at 03:03:51PM -0500, Dustin Trammell wrote: > Did you ever get a chance to take a look at this? I've looked into it. and it's not a bug, it's a feature :) so syslog-ng sets restrictive permissions of files by default which behaviour can be changed. use options { owner(logsystem); group(staff); }; if you want syslog-ng not to touch owner/group/permissions use the following: options { owner("-1") group("-1"); perm("-1"); }; the quotation marks are currently necessary as syslog-ng expects to find a string there (which is not a number) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Silly Scam #766 - 1 msg
by Christopher_Leonardos＠interliant.com 05 Aug '02

05 Aug '02

I hope everyone is aware, that this is a silly scam. Originally started by some people in Nigeria, this appears to be the "south african" version of the same old scam. Regards, Christopher Leonardos Security Engineer Interliant Inc. 12 Gill Street Woburn, MA 01801 781-756-3761 781-756-3737 FAX christopher_leonardos(a)interliant.com

1 0

information
by 4u2glamour＠justice.com 04 Aug '02

04 Aug '02

1 0

business offer
by khumalo maka 03 Aug '02

03 Aug '02

INVESTMENT REQUEST Compliment of the season! It is indeed my pleasure to write to you this letter, which i believe, will be a big surprise as we are both complete strangers. I work for the Ministry of Minerals and Energy in South Africa, and by this letter I am representing and also acting on behalf of two of my senior colleague (The Director General and The Group General Manager) whose mandate I have got to contact a trusted and reliable foreign based businessman, concerning the business matter of mutual benefit to all. By this mandate given to me, we are in dire need of a foreign partner to assist us in the transfer/investment of USD 15,00,000,00. (fifteen Million, United States Dollars). The key issues are the transfer and the subsequent investment of the said sum. We are ready to go into an agreement with you and also offer you a negotiable fee for putting together an investment portfolio. It does not matter whether or not you own a company or you have invested funds before. We shall guide you on what to do. The basis will be that a major company won a contract and subcontracted it to you. More often, big trading companies and firms of unrelated field win contracts and subcontracts to more specialized firms for execution. We shall follow strictly all the legal procedures entailed in our laws and international laws in transferring the funds to you. The source of the funds is legitimate and authoritative. Please, be informed that under the South Africa Government monetary policy, strategic positioned government officials are not allowed to operate or own bank account overseas, hence our need for a foreign partner to front for us. We pray that you take the essence of this letter in strict confidence, as the two officials involved would not like to be exposed on this. Kindly notify me via my e-mail, upon you acceptance to assist us. Further details will be made available to you as soon as you reply. We shall provide you with our confidential phone and fax number, once there is positive response from you. Thank you and God bless, as we wait for your urgent response Best Regards. ENGR. KHUMALO MAKA

1 0

syslog-ng 1.4.x troubles : 2nd post
by archi2k＠altern.org 01 Aug '02

01 Aug '02

Please CC me, I'm not subscribed to the list. Okay, to try to isolate the problem shown on my previous post, here is what I did : <snip /etc/init.d/syslog-ng> case "$1" in start) echo -n "Starting system logging: syslog-ng" #start-stop-daemon --start --quiet --exec /usr/local/sbin/syslog-ng strace -f syslog-ng > /var/log/syslog-ng.strace 2>&1 & echo -n " klogd" start-stop-daemon --start --quiet --exec /sbin/klogd -- $KLOGD echo "." ;; </snip> And guess what : when I run syslog-ng thru strace it works!! @#[|%!! Ie when I boot the box syslog-ng is not blocked any more. I finally found a way to make it actually work by not using start-stop-daemon : <snip> #start-stop-daemon --start --quiet --exec /usr/local/sbin/syslog-ng #strace -f syslog-ng > /var/log/syslog-ng.strace 2>&1 & /usr/local/sbin/syslog-ng </snip> simpler! But why?!? ciao

3 3

RE: [syslog-ng]Installing on a non-compiler system
by Lightfoot.Michael 01 Aug '02

01 Aug '02

Thanks for all the replies to my above query. I think that for a few systems, making a Solaris package has too much overhead, but the simple idea of setting DESTDIR and using tar seems fairly efficient (and will work!) > make DESTDIR=/tmp/syslog-ng-bin/ install > > it will install using /tmp/syslog-ng-bin/ as root. tar the > directory and > untar it on your production server relative to root. > > -- > Bazsi NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries.

1 0

syslog-ng 1.4.x troubles
by archi2k＠altern.org 31 Jul '02

31 Jul '02

Please CC me, I'm not subscribed to the list. I have a very annoying problem with 1.4.x (not tried 1.5.x). I run syslog-ng on several boxes from a long time. All these boxes are debian potato or woody. syslog-ng 1.4.x compiled by hand. Here is the pb : Sometimes, syslog-ng stops logging. When this happens, some of the services running on the box stop working. If I issue a netstat on the box, here is what I got : Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State I-Node Path unix 0 [ ACC ] STREAM LISTENING 115 /tmp/mysql.sock unix 0 [ ACC ] STREAM LISTENING 57 /dev/log unix 1 [ ] STREAM CONNECTED 128 @0000000b unix 1 [ ] STREAM CONNECTED 228 @0000000f unix 1 [ ] STREAM CONNECTED 176 @0000000e unix 1 [ ] STREAM CONNECTED 60 @00000001 unix 1 [ ] STREAM CONNECTED 78 @00000004 unix 1 [ ] STREAM CONNECTED 87 @00000005 unix 1 [ ] STREAM CONNECTED 92 @00000007 unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTED 62 /dev/log As you can see, lots of /dev/log sock in the "CONNECTING" state. Sometimes, I have 100 like this ;o) Processes like stunnel then refuse to work. I have to kill -9 syslog-ng and then restart it. For some boxes I have to do that manually each time I boot the box. Any clue? Here is, for one of my boxes, its syslog-ng.conf. # syslog-ng configuration file. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log" max-connections(210)); internal(); file("/proc/kmsg"); }; destination authlog { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/authlog"); }; destination daemon { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/daemon"); }; destination kern { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/kernel"); }; destination maillog { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/maillog"); }; destination messages { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/messages"); }; destination secure { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/secure"); }; destination wtmp { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/wtmp"); }; destination cron { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/cron"); }; destination ftp { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/ftp"); }; destination errors { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/errors"); usertty("root"); }; destination alert { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/alert"); usertty("root"); }; destination notice { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/notice"); }; destination emergency { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/emergency"); usertty(*); }; filter f_kern { facility(kern); }; filter f_syslog { facility(syslog); }; filter f_user { facility(user); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_xferlog { facility(ftp); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_kernel { facility(kern); }; filter f_debug { level(debug); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_alert { level(alert); }; filter f_emerg { level(emerg); }; filter f_err { level(err); }; #log { source(s_sys); destination(d_amethyste_file); }; log { source(s_sys); filter(f_kern); filter(f_debug); destination(messages); }; log { source(s_sys); filter(f_user); filter(f_info); destination(messages); }; log { source(s_sys); filter(f_syslog); filter(f_info); destination(messages); }; log { source(s_sys); filter(f_auth); filter(f_info); destination(authlog); }; log { source(s_sys); filter(f_authpriv); filter(f_debug); destination(secure); }; log { source(s_sys); filter(f_cron); filter(f_info); destination(cron); }; log { source(s_sys); filter(f_daemon); filter(f_info); destination(daemon); }; log { source(s_sys); filter(f_xferlog); filter(f_info); destination(ftp); }; log { source(s_sys); filter(f_mail); filter(f_info); destination(maillog); }; log { source(s_sys); filter(f_kern); destination(kern); }; log { source(s_sys); filter(f_err); destination(errors); }; log { source(s_sys); filter(f_alert); destination(alert); }; log { source(s_sys); filter(f_notice); destination(notice); }; log { source(s_sys); filter(f_auth); filter(f_debug); destination(alert); }; log { source(s_sys); filter(f_emerg); destination(emergency); }; Cheers, a2k

1 0

FW: UNSTABLE syslog-ng 1.4.15 + redhat-7.3
by _/CaT\_ 31 Jul '02

31 Jul '02

After Core's dump problem I've got another with FREE-BSD 4.6, I'm still waiting for an helping hand ;). I tried to install syslog-ng 1.4.15 on a redhat-7.3 system but it's Unstable without CORE Dump File. The attachment is the debug's backtrace with installed packets and configuration files... Another question, the last, what is the most STABLE version of REDHAT or FreeBDS I'd use?? Thnks. _/CaT\_ PS: If I succeed in my syslog-server Mission when you'll come to Rome (Caput Mundi), I 'll offer you the real pizza with a real red wine to "ZOZZONE's" --- gcc version 2.96 20000731 (Red Hat Linux 7.3 2.96-110) flex version 2.5.4 (rpm flex-2.5.4a-23) bison (GNU Bison) 1.35 (rpm bison-1.35-1) yacc 1.9 (rpm byacc-1.9-19) scsh-0.6.2 libol-0.2.23 syslog-ng-1.4.15 --- GNU gdb Red Hat Linux (5.2-2) Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux"... (gdb) run -v Starting program: /usr/local/sbin/syslog-ng -v binding fd 5, inetaddr: 0.0.0.0, port: 514 Program received signal SIGTERM, Terminated. 0x420b4ae7 in pause () from /lib/i686/libc.so.6 (gdb) bt #0 0x420b4ae7 in pause () from /lib/i686/libc.so.6 #1 0x08049d0d in go_background () #2 0x08049e93 in main () #3 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6 ---- ######################################################################## ## options { long_hostnames(off); keep_hostname(no); sync(0); use_dns(no); log_fifo_size(1000); gc_idle_threshold(100); gc_busy_threshold(3000); }; ######################################################################## ## source src { internal(); udp(ip(0.0.0.0) port(514)); }; ######################################################################## ### ###Destination #Sorting degl'hosts # destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(mspns) perm(0644) dir_perm(0700) create_dirs(yes)); }; # destination all { file("/var/log/all.log" owner(root) group(mspns) perm(0644)); }; # destination send_trap_prova { program("/usr/local/script/syslogtrapper_test"); }; # ######################################################################## #### ####Filtering # filter f_prova { host ("10.11.5.37") and not match ("message repeated"); }; # ######################################################################## ##### ###Logging # log { source(src); destination(hosts); }; # log { source(src); destination(all); }; # log { source(src); filter(f_prova); destination(send_trap_prova); }; # ######################################################################## ##### # /usr/local/script/syslogtrapper_test # #!/bin/bash while read line do snmptrap -c xxxxxx! 10.11.8.14 .1.3.6.1.4.1.2620.1.1.0 10.11.5.48 6 2 '' .1.3.6.1.4.1.2620.1.1.6 s "prova invio trap V1: $line" done exit

2 6

RE: [syslog-ng]Installing on a non-compiler system
by Lightfoot.Michael 31 Jul '02

31 Jul '02

I should go and eat more often. After returning from a delightfully relaxing lunch (baked vegetables and mug of Soya flat white) and digesting another 4 or 5 pages of Herodotus (Xerxes is just about to attack Greece), I reread my message and realised all I had to do was creat a symlink from /export/home to /usr/local/src and it would all work. I'm still not sure what to do if the DMZ systems don't have make. > # make install > Making install in src > Making install in . > make: Fatal error: Don't know how to make target > `/usr/local/src/syslog-ng-1.4.15/configure.in' > Current working directory /export/home/syslog-ng-1.4.15/src > *** Error code 1 > make: Fatal error: Command failed for target > `install-recursive' Current working directory > /export/home/syslog-ng-1.4.15/src > *** Error code 1 > make: Fatal error: Command failed for target `install-recursive' m. NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries.

2 1

can't log to remote host -- error message in syslog
by Adam Tworkowski 30 Jul '02

30 Jul '02

Hi, I've been having issues logging to a remote server on another segment. I have no issue with logging from machines that are on the same segment as the logging server. I am getting the following error in the error log. Can someone interpret this for me. Thanks. src@hostname syslog-ng[12920]: Error connecting to remote host IF_INET(loghost:514), reattempting in 60 seconds

2 1

RE: [syslog-ng]Installing on a non-compiler system
by Nicholas Berry 30 Jul '02

30 Jul '02

You could build syslog-ng in a Solaris pkg format, but I'm not sure how much of a problem you would have installing the package on your Solaris 2.6 system (might not have a problem if you're up-to-date with the recommended patch cluster). Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. nberry(a)ragingwire.com -----Original Message----- From: Lightfoot.Michael [mailto:Lightfoot.Michael@comcare.gov.au] Sent: Monday, July 29, 2002 8:02 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Installing on a non-compiler system I have built syslog-ng on a development server (Solaris 9) and now wish to install it on another system which doesn't have development tools (it is a fairly standard Solaris 9 installation.) I will also be installing a Solaris 2.6 build on systems in our DMZ which have been hardened and have very little other than the OS. The problem I have struck is that after copying the built source to the target server, "make install" fails with the following error: # make install Making install in src Making install in . make: Fatal error: Don't know how to make target `/usr/local/src/syslog-ng-1.4.15/configure.in' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Any ideas on how I get around this easily? NFS is one option, but will not be for the DMZ systems (and is not used in production on any systems here.) I suppose I could install it on the development server using a filesystem diff before and after trick I have used in the past, but again there are problems doing this with the Solaris 2.6 build (which has to be done on a production server as I don't have a Solaris 2.6 dev machine any more.) Michael Lightfoot Unix Consultant ISG Host Systems Comcare +61 2 62750680 NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Installing on a non-compiler system
by Lightfoot.Michael 30 Jul '02

30 Jul '02

I have built syslog-ng on a development server (Solaris 9) and now wish to install it on another system which doesn't have development tools (it is a fairly standard Solaris 9 installation.) I will also be installing a Solaris 2.6 build on systems in our DMZ which have been hardened and have very little other than the OS. The problem I have struck is that after copying the built source to the target server, "make install" fails with the following error: # make install Making install in src Making install in . make: Fatal error: Don't know how to make target `/usr/local/src/syslog-ng-1.4.15/configure.in' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Any ideas on how I get around this easily? NFS is one option, but will not be for the DMZ systems (and is not used in production on any systems here.) I suppose I could install it on the development server using a filesystem diff before and after trick I have used in the past, but again there are problems doing this with the Solaris 2.6 build (which has to be done on a production server as I don't have a Solaris 2.6 dev machine any more.) Michael Lightfoot Unix Consultant ISG Host Systems Comcare +61 2 62750680 NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries.

1 0

Re: [syslog-ng]Re: problem with truncated kernel logs
by Ron Braley 29 Jul '02

29 Jul '02

No, it's still a problem. rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 07/29/02 11:32AM >>> On Mon, Jul 29, 2002 at 09:48:30AM -0500, Ron Braley wrote: > Bazsi > > Sorry - I forgot to change the subject line! > > No, klogd isn't running in addition to syslog-ng. Just to be sure, I > checked processes, which did show klogd -2 and then shut down the > syslog-ng service. I then checked processes and saw klogd was no longer > running. > > Thanks in advance for your expert advise! hmm. I don't really understand whether your problem is solved, or not? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: problem with truncated kernel logs
by Ron Braley 29 Jul '02

29 Jul '02

Bazsi Sorry - I forgot to change the subject line! No, klogd isn't running in addition to syslog-ng. Just to be sure, I checked processes, which did show klogd -2 and then shut down the syslog-ng service. I then checked processes and saw klogd was no longer running. Thanks in advance for your expert advise! rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 07/29/02 03:03AM >>> On Fri, Jul 26, 2002 at 03:11:10PM -0500, Ron Braley wrote: > Hi bazi. > > We're having a problem with syslog-ng 1.5. It appears to be truncating > our iptables firewall logs. > > The following shows good logs as viewed through dmesg, and actual log > entries as processed by syslog-ng: > > *** Good (dmesg): > IPTABLES TCP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:08:00:20:a7:53:e9:08:00 > SRC=134.129.212.23 DST=134.129.212.30 LEN=48 TOS=0x00 PREC=0x00 TTL=64 > ID=64525 DF > PROTO=TCP SPT=36788 DPT=53 WINDOW=24820 RES=0x00 SYN URGP=0 > > IPTABLES UDP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 > SRC=134.129.214.80 DST=134.129.212.30 LEN=239 TOS=0x00 PREC=0x00 > TTL=127 ID=21813 > PROTO=UDP SPT=138 DPT=138 LEN=219 > > *** Bad (syslog [/var/log/kern]): > Jul 25 16:16:12 smack IPTABLES TCP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:a0:c9:a9:b2:6c:08:00 > SRC=134.129.212.33 DST=134.129.212.30 LEN=60 TOS=0x00 > PREC=0x03NDOW=5840 > > Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:05:01:fECP1389 > > Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:05:01:fb3::0 > SRC=134.12920.134 DST=134.129.212.0 LEN=78 TOS=0x00 > PREC=0xTTL=1272ROTO=UDP SPT=137 DPT=137N=58 Please start a new thread if you send something unrelated to current threads. wrt your problem, are you sure you are not running klogd in addition to syslog-ng? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] 1.5.19 patch for hostname and hpux pipe
by Ron Braley 29 Jul '02

29 Jul '02

Hi bazi. We're having a problem with syslog-ng 1.5. It appears to be truncating our iptables firewall logs. The following shows good logs as viewed through dmesg, and actual log entries as processed by syslog-ng: *** Good (dmesg): IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:08:00:20:a7:53:e9:08:00 SRC=134.129.212.23 DST=134.129.212.30 LEN=48 TOS=0x00 PREC=0x00 TTL=64 ID=64525 DF PROTO=TCP SPT=36788 DPT=53 WINDOW=24820 RES=0x00 SYN URGP=0 IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.80 DST=134.129.212.30 LEN=239 TOS=0x00 PREC=0x00 TTL=127 ID=21813 PROTO=UDP SPT=138 DPT=138 LEN=219 *** Bad (syslog [/var/log/kern]): Jul 25 16:16:12 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:a0:c9:a9:b2:6c:08:00 SRC=134.129.212.33 DST=134.129.212.30 LEN=60 TOS=0x00 PREC=0x03NDOW=5840 Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fECP1389 Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb3::0 SRC=134.12920.134 DST=134.129.212.0 LEN=78 TOS=0x00 PREC=0xTTL=1272ROTO=UDP SPT=137 DPT=137N=58 Can you help, please? Thanks! rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax)

2 1

1.5.19 patch for hostname and hpux pipe
by Trapp, Michael 26 Jul '02

26 Jul '02

hi bazsi, i still see some problems with pipe support on hpux and the pad_size option. the message ist shorter but there is at least 1, sometimes a few additional lines in the log containing useless characters appended to the origin message. a few day's ago i've send you a patch regarding hostname options (check_hostname) would you integrate it into 1.5.20 ? i would appreciate it to find this feature in a future release ... thanx michael

2 1

Probs with RH7.3 and syslog-ng 1.4.15
by Torsten Schuchort 25 Jul '02

25 Jul '02

Hi all, i´ve probs with syslog-ng 1.4.15 and redhat 7.3 90% works well, but the facility kern not, so i have no kernellogging. Have anyone an idea? Greetings Torsten Schuchort

4 4

Fwd: Syslog-ng doesn't parse certain log messages
by Michael Renner 25 Jul '02

25 Jul '02

>Date: Wed, 17 Jul 2002 15:52:32 +0200 >To: syslog-ng(a)lists.balabit.hu >From: Michael Renner <m.renner(a)inode.at> >Subject: Syslog-ng doesn't parse certain log messages > >Hi! > >It seems that our syslog-ng (1.5.18, upgraded from 1.5.14 today) stopped >logging messages from some routers. It seems to be a syslog-ng problem >because the routers don't have anything in common (except that all of them >are ciscos, but completely different hardware/ios versions). Just wanted to let you know that this was caused by UDP-Packets with wrong UDP Checksums, caused by a buggy IOS in one of the routers. "tcpdump -vvv -s0 -X" made this easily visible =) mfg/best regards -- Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at/ Michael Renner - Junior System Engineer m.renner(a)inode.at, Tel.: +43 59999 0 Fax.: +43 59999 6599 Buero Wien - Millennium Tower Handelskai 94-96/43 - A-1200 Wien Buero Graz - Schmiedlstrasse 1 - A-8042 Graz Buero Sbg - Schillerstrasse 30 - A-5020 Salzburg Buero Ibk - Eduard Bodem Gasse 5-7 - A-6020 Innsbruck

1 0

UNSTABLE syslog-ng 1.4.15 + redhat-7.3
by Cataldi Roger 25 Jul '02

25 Jul '02

After Core's dump problem I've got another with FREE-BSD 4.6, I'm still waiting for an helping hand ;). I tried to install syslog-ng 1.4.15 on a redhat-7.3 system but it's Unstable without CORE Dump File. The attachment is the debug's backtrace with installed packets and configuration files... Another question, the last, what is the most STABLE version of REDHAT or FreeBDS I'd use?? Thnks. _/CaT\_ PS: If I succeed in my syslog-server Mission when you'll come to Rome (Caput Mundi), I 'll offer you the real pizza with a real red wine to "ZOZZONE's" --- gcc version 2.96 20000731 (Red Hat Linux 7.3 2.96-110) flex version 2.5.4 (rpm flex-2.5.4a-23) bison (GNU Bison) 1.35 (rpm bison-1.35-1) yacc 1.9 (rpm byacc-1.9-19) scsh-0.6.2 libol-0.2.23 syslog-ng-1.4.15 --- GNU gdb Red Hat Linux (5.2-2) Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux"... (gdb) run -v Starting program: /usr/local/sbin/syslog-ng -v binding fd 5, inetaddr: 0.0.0.0, port: 514 Program received signal SIGTERM, Terminated. 0x420b4ae7 in pause () from /lib/i686/libc.so.6 (gdb) bt #0 0x420b4ae7 in pause () from /lib/i686/libc.so.6 #1 0x08049d0d in go_background () #2 0x08049e93 in main () #3 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6 ---- ########################################################################## options { long_hostnames(off); keep_hostname(no); sync(0); use_dns(no); log_fifo_size(1000); gc_idle_threshold(100); gc_busy_threshold(3000); }; ########################################################################## source src { internal(); udp(ip(0.0.0.0) port(514)); }; ########################################################################### ###Destination #Sorting degl'hosts # destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(mspns) perm(0644) dir_perm(0700) create_dirs(yes)); }; # destination all { file("/var/log/all.log" owner(root) group(mspns) perm(0644)); }; # destination send_trap_prova { program("/usr/local/script/syslogtrapper_test"); }; # ############################################################################ ####Filtering # filter f_prova { host ("10.11.5.37") and not match ("message repeated"); }; # ############################################################################ # ###Logging # log { source(src); destination(hosts); }; # log { source(src); destination(all); }; # log { source(src); filter(f_prova); destination(send_trap_prova); }; # ############################################################################ # # /usr/local/script/syslogtrapper_test # #!/bin/bash while read line do snmptrap -c xxxxxx! 10.11.8.14 .1.3.6.1.4.1.2620.1.1.0 10.11.5.48 6 2 '' .1.3.6.1.4.1.2620.1.1.6 s "prova invio trap V1: $line" done exit

1 0

Re: 1.5.19, pad_size and check_hostname extension
by Balazs Scheidler 24 Jul '02

24 Jul '02

On Mon, Jul 22, 2002 at 07:20:18PM +0200, Trapp, Michael wrote: > hi bazsi, > > i've experienced a problem with the hostname options. > we have several network components sending sl-msg without a hostname. > due to the lack of the hostname syslog.ng interprets the first tag of the message > as a hostname even if it contains [^a-zA-Z-.] > to avoid the substitution of the first tag (we don't want to keep the original name anyway, > chain_hostname = 0, keep_hostname = 0) i extended the config and source with check_hostname. > maybe you could apply the attached patch. it would be great to find this option in future > releases. I've implemented check_hostname differently. It is verified during log parsing so it behaves consistently in all log paths. My patch is attached to this message. > i also tested the pad_size option on my hpux-11.00 and it works ! > well, it took me a few minutes to understand how it should work and how to configure ;-) Index: ChangeLog =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/ChangeLog,v retrieving revision 1.57 diff -u -r1.57 ChangeLog --- ChangeLog 23 Jul 2002 12:08:49 -0000 1.57 +++ ChangeLog 24 Jul 2002 09:27:16 -0000 @@ -1,3 +1,9 @@ +2002-07-24 Balazs Scheidler <bazsi(a)balabit.balabit> + + * src/log.c: implemented check_hostname by verifying whether a + hostname only contains [A-Za-z0-9./@:], the check is triggered if + check_hostname is enabled in global config + 2002-07-23 Balazs Scheidler <bazsi(a)balabit.balabit> * updated INSTALL file to reflect latest OS hints Index: INSTALL =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/INSTALL,v retrieving revision 1.11 diff -u -r1.11 INSTALL --- INSTALL 23 Jul 2002 12:08:49 -0000 1.11 +++ INSTALL 24 Jul 2002 09:27:16 -0000 @@ -123,11 +123,12 @@ ---------------------- AIX does support STREAMS, but its log transport doesn't use it. As it - seems /dev/log is a simple unix socket, though I can't find out whether - it uses SOCK_DGRAM or SOCK_STREAM semantics. + seems /dev/log is a simple SOCK_DGRAM type unix socket, so it works using: + + source stdlog { unix-dgram("/dev/log"); }; HP-UX (HP-UX 11.0) - ------------------------ + ------------------ HP-UX uses a named pipe called /dev/log for log transport, and you can use this with the pipe() driver with an additional option. HP-UX pads Index: src/affile.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/affile.c,v retrieving revision 1.51 diff -u -r1.51 affile.c --- src/affile.c 18 Jul 2002 13:18:01 -0000 1.51 +++ src/affile.c 24 Jul 2002 09:27:16 -0000 @@ -162,7 +162,7 @@ if (do_open_file(self->name, flags, -1, -1, -1, -1, -1, -1, 0, &fd)) { lseek(fd, 0, SEEK_END); self->src = io_read(make_io_fd(cfg->backend, fd, ol_string_use(self->name)), - make_log_reader(0, self->prefix, cfg->log_msg_size, self->pad_size, c), + make_log_reader(0, self->prefix, cfg->log_msg_size, self->pad_size, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, c), NULL); self->res = REMEMBER_RESOURCE(cfg->resources, &self->src->super.super); return ST_OK | ST_GOON; Index: src/afinet.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/afinet.c,v retrieving revision 1.19 diff -u -r1.19 afinet.c --- src/afinet.c 18 Jul 2002 13:18:01 -0000 1.19 +++ src/afinet.c 24 Jul 2002 09:27:16 -0000 @@ -89,13 +89,13 @@ notice("AF_INET client connected from %S, port %i\n", inet->ip, inet->port); io_read(self->client, - make_log_reader(0, NULL, cfg->log_msg_size, 0, c), + make_log_reader(0, NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, c), make_afsocket_source_close_callback(self)); } else { /* SOCK_DGRAM */ io_read(self->client, - make_log_reader(1, NULL, cfg->log_msg_size, 0, c), + make_log_reader(1, NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, c), make_afsocket_source_close_callback(self)); } Index: src/afstreams.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/afstreams.c,v retrieving revision 1.13 diff -u -r1.13 afstreams.c --- src/afstreams.c 26 Apr 2002 09:43:54 -0000 1.13 +++ src/afstreams.c 24 Jul 2002 09:27:16 -0000 @@ -145,7 +145,7 @@ length = eol - bol; if (length) { - li = make_log_info(length, bol, NULL); + li = make_log_info(length, bol, NULL, 0); li->pri = pri; HANDLE_LOG(self->pipe, li); } Index: src/afunix.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/afunix.c,v retrieving revision 1.22 diff -u -r1.22 afunix.c --- src/afunix.c 18 Jul 2002 13:18:01 -0000 1.22 +++ src/afunix.c 24 Jul 2002 09:27:16 -0000 @@ -51,7 +51,7 @@ CAST(afsocket_source_connection, self, c); io_read(self->client, - make_log_reader(0, NULL, cfg->log_msg_size, 0, c), + make_log_reader(0, NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, c), make_afsocket_source_close_callback(self)); return ST_OK | ST_GOON; Index: src/cfg-grammar.y =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/cfg-grammar.y,v retrieving revision 1.55 diff -u -r1.55 cfg-grammar.y --- src/cfg-grammar.y 18 Jul 2002 13:18:01 -0000 1.55 +++ src/cfg-grammar.y 24 Jul 2002 09:27:16 -0000 @@ -75,7 +75,7 @@ /* option items */ %token KW_FLAGS KW_CATCHALL KW_FALLBACK KW_FINAL -%token KW_FSYNC KW_MARK_FREQ KW_SYNC_FREQ KW_STATS_FREQ KW_CHAIN_HOSTNAMES KW_KEEP_HOSTNAME +%token KW_FSYNC KW_MARK_FREQ KW_SYNC_FREQ KW_STATS_FREQ KW_CHAIN_HOSTNAMES KW_KEEP_HOSTNAME KW_CHECK_HOSTNAME %token KW_LOG_FIFO_SIZE KW_LOG_MSG_SIZE %token KW_TIME_REOPEN KW_TIME_REAP KW_USE_TIME_RECVD %token KW_USE_DNS KW_USE_FQDN KW_GC_BUSY_THRESHOLD @@ -574,6 +574,7 @@ | KW_STATS_FREQ '(' NUMBER ')' { configuration->stats_freq = $3; } | KW_CHAIN_HOSTNAMES '(' yesno ')' { configuration->chain_hostnames = $3; } | KW_KEEP_HOSTNAME '(' yesno ')' { configuration->keep_hostname = $3; } + | KW_CHECK_HOSTNAME '(' yesno ')' { configuration->check_hostname = $3; } | KW_USE_TIME_RECVD '(' yesno ')' { configuration->use_time_recvd = $3; } | KW_USE_FQDN '(' yesno ')' { configuration->use_fqdn = $3; }; | KW_USE_DNS '(' yesno ')' { configuration->use_dns = $3; }; Index: src/cfg-lex.l =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/cfg-lex.l,v retrieving revision 1.24 diff -u -r1.24 cfg-lex.l --- src/cfg-lex.l 18 Jul 2002 13:18:02 -0000 1.24 +++ src/cfg-lex.l 24 Jul 2002 09:27:16 -0000 @@ -60,6 +60,7 @@ { "use_time_recvd", KW_USE_TIME_RECVD }, { "use_fqdn", KW_USE_FQDN }, { "use_dns", KW_USE_DNS }, + { "check_hostname", KW_CHECK_HOSTNAME }, { "gc_threshold", KW_GC_BUSY_THRESHOLD }, { "gc_busy_threshold", KW_GC_BUSY_THRESHOLD }, { "gc_idle_threshold", KW_GC_IDLE_THRESHOLD }, Index: src/cfgfile.h =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/cfgfile.h,v retrieving revision 1.23 diff -u -r1.23 cfgfile.h --- src/cfgfile.h 26 Apr 2002 09:43:54 -0000 1.23 +++ src/cfgfile.h 24 Jul 2002 09:27:16 -0000 @@ -56,6 +56,7 @@ (use_time_recvd simple UINT32) (use_fqdn simple UINT32) (use_dns simple UINT32) + (check_hostname simple UINT32) (create_dirs simple UINT32) (uid simple int) (gid simple int) Index: src/log.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/log.c,v retrieving revision 1.26 diff -u -r1.26 log.c --- src/log.c 26 Apr 2002 09:43:54 -0000 1.26 +++ src/log.c 24 Jul 2002 09:27:16 -0000 @@ -161,6 +161,15 @@ while (left && *src != ' ' && *src != ':' && *src != '[') { + if (lm->flags & LF_CHECK_HOSTNAME && + !((*src >= 'A' && *src <= 'Z') || + (*src >= 'a' && *src <= 'z') || + (*src >= '0' && *src <= '9') || + *src == '-' || *src == '_' || + *src == '.' || *src == ':' || + *src == '@' || *src == '/')) { + break; + } src++; left--; } @@ -256,11 +265,12 @@ } } -struct log_info *make_log_info(UINT32 length, UINT8 *msg, UINT8 *prefix) +struct log_info *make_log_info(UINT32 length, UINT8 *msg, UINT8 *prefix, UINT32 flags) { struct log_info *self; NEW_SPACE(self); + self->flags = flags & LF_USER_FLAGS; parse_log_msg(self, length, msg, prefix); self->use_cnt = 1; self->recvd = time(NULL); Index: src/log.h =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/log.h,v retrieving revision 1.17 diff -u -r1.17 log.h --- src/log.h 26 Apr 2002 09:43:54 -0000 1.17 +++ src/log.h 24 Jul 2002 09:27:16 -0000 @@ -56,6 +56,9 @@ #define LF_INTERNAL 0x0001 #define LF_MARK 0x0002 #define LF_LOCAL 0x0004 +#define LF_CHECK_HOSTNAME 0x0100 + +#define LF_USER_FLAGS 0xff00 /* CLASS: (class @@ -86,7 +89,7 @@ struct log_info *log_info_use(struct log_info *msg); void log_info_free(struct log_info *msg); -struct log_info *make_log_info(UINT32 length, UINT8 *data, UINT8 *prefix); +struct log_info *make_log_info(UINT32 length, UINT8 *data, UINT8 *prefix, UINT32 flags); struct log_info *make_internal_message(UINT32 pri, UINT32 length, UINT8 *data); struct log_info *make_mark_message(void); Index: src/sources.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/sources.c,v retrieving revision 1.34 diff -u -r1.34 sources.c --- src/sources.c 18 Jul 2002 13:18:02 -0000 1.34 +++ src/sources.c 24 Jul 2002 09:27:16 -0000 @@ -53,6 +53,7 @@ (buffer space UINT8) (max_log_line simple UINT32) (pad_size simple UINT32) + (msg_flags simple UINT32) (next object log_handler))) */ @@ -64,7 +65,7 @@ { struct log_info *logmsg; - logmsg = make_log_info(length, data, self->prefix); + logmsg = make_log_info(length, data, self->prefix, self->msg_flags); if (addrlen) { logmsg->saddr = sockaddr2address_info(addrlen, addr); } @@ -150,6 +151,7 @@ UINT8 *prefix, UINT32 max_log_line, UINT32 pad_size, + UINT32 msg_flags, struct log_handler *next) { NEW(log_reader, self); @@ -160,6 +162,7 @@ self->prefix = prefix; self->max_log_line = MAX(max_log_line, pad_size) + 1; self->pad_size = pad_size; + self->msg_flags = msg_flags; self->buffer = ol_space_alloc(max_log_line); return &self->super; Index: src/sources.h =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/sources.h,v retrieving revision 1.15 diff -u -r1.15 sources.h --- src/sources.h 18 Jul 2002 13:18:02 -0000 1.15 +++ src/sources.h 24 Jul 2002 09:27:16 -0000 @@ -65,6 +65,7 @@ UINT8 *prefix, UINT32 max_log_line, UINT32 pad_size, + UINT32 msg_flags, struct log_handler *next); struct log_source_group *make_source_group(const char *name, struct log_source_driver *drvs); -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]Installing syslog-ng in AIX 4.3.3
by Deepu George 23 Jul '02

23 Jul '02

Thanks Bazsi . The libol part worked. Now when installing syslog-ng I am getting the following error when doing a make. I removed -Wall here also. cc -DHAVE_CONFIG_H -I. -I/data8/security/syslog-ng-1.4.15/src -I. -O 2 -I/usr/local/include/libol -D_GNU_SOURCE -c center.c "center.c", line 109.9: 1506-046 (S) Syntax error. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 2. Best regards Deepu -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, July 22, 2002 5:25 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Installing syslog-ng in AIX 4.3.3 On Sat, Jul 20, 2002 at 12:51:42PM +0100, Deepu George wrote: > Hi All, > > I am trying to install syslog-ng in AIX 4.3.3. The > compiler I am using is C++ for AIX 5. I am getting the > following error when running make while installing > libol. Attached is the error > > > Target "all" is up to date. > Making all in src > cd .. && CONFIG_FILES= > CONFIG_HEADERS=src/olconfig.h /bin/sh ./config.status > creating src/olconfig.h > src/olconfig.h is unchanged > /bin/sh ../libtool --mode=compile cc > -DHAVE_CONFIG_H -I. -I/data8/security/libol-0.2.23/src > -I. -D_GNU_SOURCE -Wall -O2 -c format.c > cc -DHAVE_CONFIG_H -I. > -I/data8/security/libol-0.2.23/src -I. -D_GNU_SOURCE > -Wall -O2 -c -DPIC format.c -o format.lo > cc: 1501-210 command option Wall contains an incorrect > subargument syslog-ng has only been tested to compile using gcc the problem here is that your compiler doesn't understand -Wall, this very problem can be solved by removing -Wall from the generated Makefile -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html DISCLAIMER: Information contained and transmitted by this E-MAIL is proprietary to Mascot Systems Limited and is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If this is a forwarded message, the content of this E-MAIL may not have been sent with the authority of the Company. If you are not the intended recipient, an agent of the intended recipient or a person responsible for delivering the information to the named recipient, you are notified that any use, distribution, transmission, printing, copying or dissemination of this information in any way or in any manner is strictly prohibited. If you have received this communication in error, please delete this mail & notify us immediately at Mailadmin(a)mascotsystems.com Before opening attachments, please scan for viruses.

3 9

Forwarding syslog messages to multiple UDP destination.
by Subodh Nijsure 22 Jul '02

22 Jul '02

Hello, I am trying to forward syslog messages to multiple IP destination, I tried using statements like destination udp_forw { udp("192.168.58.150", port(514)); udp("192.168.19.1", port(514)); }; And it doesn't work, it forwards messages to first destination, is this supposed to work the way I have put config statement? /Subodh Nijsure

2 1

(no subject)
by Deepu George 22 Jul '02

22 Jul '02

Thanks Bazsi . The libol part worked. Now when installing syslog-ng I am getting the following error when doing a make. I removed -Wall here also. cc -DHAVE_CONFIG_H -I. -I/data8/security/syslog-ng-1.4.15/src -I. -O 2 -I/usr/local/include/libol -D_GNU_SOURCE -c center.c center.c, line 109.9: 1506-046 (S) Syntax error. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 2. Best regards Deepu ________________________________________________________________________ Want to sell your car? advertise on Yahoo Autos Classifieds. It's Free!! visit http://in.autos.yahoo.com

1 0

RE: [syslog-ng]Solaris 8 + syslog-ng-1.5.18
by Sangbutsarakum, Patai 22 Jul '02

22 Jul '02

If so, how can I allow/deny syslog connection as tcpwrapper did.? Is there any filter? please suggest. Pat. -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, July 19, 2002 16:18 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Solaris 8 + syslog-ng-1.5.18 On Fri, Jul 19, 2002 at 12:50:55PM +0400, Borsenkow Andrej wrote: > > > > > you enabled tcp wrapper support, and the configure script didn't > detect > > -lwrap, you might want to change the generated Makefile, and add > -lwrap to > > LDFLAGS > > > > Should not configure disable tcp_wrappers if -lwrap was not found? Or, > better, if needed functions are missing? it should, however as I don't use tcp wrappers at all, configure checks for the tcp wrapper has some problems. I've just commited a change, which should help some: Index: configure.in =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/configure.in,v retrieving revision 1.51 retrieving revision 1.52 diff -u -r1.51 -r1.52 --- configure.in 18 Jul 2002 13:18:01 -0000 1.51 +++ configure.in 19 Jul 2002 09:15:33 -0000 1.52 @@ -196,10 +196,13 @@ AC_MSG_CHECKING(whether to enable TCP wrapper support) if test "x$enable_tcp_wrapper" = "xyes"; then - if test "x$ac_cv_header_tcpd_h" = "xyes"; then + if test "x$ac_cv_header_tcpd_h" = "xyes" -a "x$blb_cv_c_lwrap" = "xyes"; then AC_DEFINE(ENABLE_TCP_WRAPPER) enable_tcp_wrapper=yes AC_MSG_RESULT(yes) + else + AC_MSG_RESULT(no) + enable_tcp_wrapper=no fi else AC_MSG_RESULT(no) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

Installing syslog-ng in AIX 4.3.3
by Deepu George 22 Jul '02

22 Jul '02

Hi All, I am trying to install syslog-ng in AIX 4.3.3. The compiler I am using is C++ for AIX 5. I am getting the following error when running make while installing libol. Attached is the error Target "all" is up to date. Making all in src cd .. && CONFIG_FILES= CONFIG_HEADERS=src/olconfig.h /bin/sh ./config.status creating src/olconfig.h src/olconfig.h is unchanged /bin/sh ../libtool --mode=compile cc -DHAVE_CONFIG_H -I. -I/data8/security/libol-0.2.23/src -I. -D_GNU_SOURCE -Wall -O2 -c format.c cc -DHAVE_CONFIG_H -I. -I/data8/security/libol-0.2.23/src -I. -D_GNU_SOURCE -Wall -O2 -c -DPIC format.c -o format.lo cc: 1501-210 command option Wall contains an incorrect subargument make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Stop. Best regards Deepu ________________________________________________________________________ Want to sell your car? advertise on Yahoo Autos Classifieds. It's Free!! visit http://in.autos.yahoo.com

2 1

Conf. syntax error?
by Gruber Zsolt 19 Jul '02

19 Jul '02

Hi, i would like to set up the syslog-ng, but by starting it, I get always syntax error messages for the first line of the config file. (it is independent from the containt of the 1. line) I made a very simly version: options { chain_hostnames(no); sync(0); }; but I got syntax error again : ... syslog-ng.conf: line 1 : syntax error near unexpected token `chains_hostnames(n' ... syslog-ng.conf: line 1 : `options { chain_hostnames(no); sync(0); };' What made I wrong? ( the syslog-ng 1.4.15 and the libol 0.2.23 was compiled from the source without errors) regards Zsolt

2 1

Solaris 8 + syslog-ng-1.5.18
by Sangbutsarakum, Patai 19 Jul '02

19 Jul '02

Dear friends, Anyone success to compile syslog-ng-1.5.18 on Solaris 8. I've try to search from mailing list, I've add stdio.h to cfg-grammar.c already (otherwise, error in make time) But after I passed that error. I still faced with the below error. Please suggest me to deal with the below error messages. Thanks in advance Pat. [..snipped..] D_GNU_SOURCE -c getopt.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c getopt1.c gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor -ll /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file request_init afinet.o sock_host afinet.o hosts_access afinet.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive

4 4

syslog-ng 1.5.19 released
by Balazs Scheidler 19 Jul '02

19 Jul '02

syslog-ng 1.5.19 has been released: News for the 1.5.19 release Thu, 18 Jul 2002 15:16:37 +0200 * Fixed a compile problem, which prevented non-debug compiles (stdio.h in cfg-grammar.y) * initial support for padded pipe sources (used on HP-UX /dev/log) * Other minor fixes it is available at http://www.balabit.hu/en/downloads/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]Solaris 8 + syslog-ng-1.5.18
by Sangbutsarakum, Patai 19 Jul '02

19 Jul '02

I'm using tcpwrapper that support IPV6 in my solaris 8 box $ pwd /usr/local/lib $ ls -al total 9758 drwxr-xr-x 4 bin bin 512 Jul 18 01:27 . drwxr-xr-x 11 root other 512 Jul 8 23:55 .. drwxr-xr-x 3 bin bin 512 Jun 3 12:02 gcc-lib drwxr-xr-x 2 root other 512 Jun 3 15:18 ipv4 -rw-r--r-- 1 bin bin 329544 Mar 16 2001 libiberty.a -rw-r--r-- 1 root other 58016 Jul 18 01:27 libol.a -rwxr-xr-x 1 root other 714 Jul 18 01:27 libol.la lrwxrwxrwx 1 root other 14 Jul 18 01:27 libol.so -> libol.so.0.0.0 lrwxrwxrwx 1 root other 14 Jul 18 01:27 libol.so.0 -> libol.so.0.0.0 -rwxr-xr-x 1 root other 52980 Jul 18 01:27 libol.so.0.0.0 -rw-r--r-- 1 bin bin 2222756 Mar 16 2001 libstdc++.a.2.10.0 -r-xr-xr-x 1 bin bin 2232464 Mar 16 2001 libstdc++.so.2.10.0 -rw-r--r-- 1 root other 51592 Jul 8 22:10 libwrap.a Am I correct? Please suggest Pat. -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, July 19, 2002 14:21 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Solaris 8 + syslog-ng-1.5.18 On Fri, Jul 19, 2002 at 01:52:35PM +0700, Sangbutsarakum, Patai wrote: > Dear firends, > Thanks for your suggest, I've done as shown below. > Unlucky, problem still occur > > gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 > -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c getopt1.c > gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -lwrap -o > syslog-ng -lwrap main.o sources.o center.o filters.o destinations.o log.o > cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o > afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o > syslog-names.o getopt.o getopt1.o -lpthread -ldoor -ll > /usr/local/lib/libol.a -lsocket -lnsl -lxnet > Undefined first referenced > symbol in file > request_init afinet.o > sock_host afinet.o > hosts_access afinet.o do you have a -lwrap at all? maybe you should not use --enable-tcp-wrappers commandline option. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]Solaris 8 + syslog-ng-1.5.18
by Sangbutsarakum, Patai 19 Jul '02

19 Jul '02

Dear firends, Thanks for your suggest, I've done as shown below. Unlucky, problem still occur ======================= Add -lwrap to LDFLAGS ======================= $ pwd /usr/local/src/syslog-ng-1.5.18/src $ grep LDFLAG * Makefile:LDFLAGS = -lwrap <<============= Makefile:syslog_ng_LDFLAGS = -lwrap <<============= Makefile:LINK = $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ Makefile: $(LINK) $(syslog_ng_LDFLAGS) $(syslog_ng_OBJECTS) $(syslog_ng_LDADD) $(LIBS) Makefile.in:LDFLAGS = @LDFLAGS@ Makefile.in:syslog_ng_LDFLAGS = -lwrap <<============ Makefile.in:LINK = $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ Makefile.in: $(LINK) $(syslog_ng_LDFLAGS) $(syslog_ng_OBJECTS) $(syslog_ng_LDADD) $(LIBS) ======================= Compile errors ======================= [..snipped..] gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c getopt1.c gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -lwrap -o syslog-ng -lwrap main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor -ll /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file request_init afinet.o sock_host afinet.o hosts_access afinet.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Thanks in advance Pat. -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, July 18, 2002 20:08 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Solaris 8 + syslog-ng-1.5.18 On Thu, Jul 18, 2002 at 04:43:24PM +0700, Sangbutsarakum, Patai wrote: > Dear friends, > > Anyone success to compile syslog-ng-1.5.18 on Solaris 8. > I've try to search from mailing list, > I've add stdio.h to cfg-grammar.c already (otherwise, error in make > time) > But after I passed that error. I still faced with the below error. > Please suggest me to deal with the below error messages. > > Thanks in advance > Pat. > > [..snipped..] > > D_GNU_SOURCE -c getopt.c > gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g > -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c getopt1.c > gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng > main.o sources.o center.o filters.o destinations.o log.o cfgfile.o > cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o > afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o > syslog-names.o getopt.o getopt1.o -lpthread -ldoor -ll > /usr/local/lib/libol.a -lsocket -lnsl -lxnet > Undefined first referenced > symbol in file > request_init afinet.o > sock_host afinet.o > hosts_access afinet.o > ld: fatal: Symbol referencing errors. No output written to syslog-ng > collect2: ld returned 1 exit status > *** Error code 1 > make: Fatal error: Command failed for target `syslog-ng' > Current working directory /usr/local/src/syslog-ng-1.5.18/src > *** Error code 1 > make: Fatal error: Command failed for target `all-recursive' > Current working directory /usr/local/src/syslog-ng-1.5.18/src > *** Error code 1 > make: Fatal error: Command failed for target `all-recursive-am' > Current working directory /usr/local/src/syslog-ng-1.5.18/src > *** Error code 1 > make: Fatal error: Command failed for target `all-recursive you enabled tcp wrapper support, and the configure script didn't detect -lwrap, you might want to change the generated Makefile, and add -lwrap to LDFLAGS -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: Very strange syslog-ng log forwarding behavior
by Balazs Scheidler 19 Jul '02

19 Jul '02

On Thu, Jul 18, 2002 at 04:53:20PM -0400, Steve Lin wrote: > I have the following syslog-ng configuration on one machine. > > > source s_sys { unix-stream ("/dev/log"); internal(); }; > source s_udp { udp(); }; > > destination err { file("/var/log/err.log"); }; > destination external { tcp(xxx.xxx.xxx.xxx); }; > > filter err { level(err); }; > > log { source(s_sys); source(s_udp); filter(err); destination(err); }; > log { source(s_sys); source(s_udp); filter(err); destination(external); }; > > > And the following configuration on a second machine I'm trying to forward logs to: > > > source s_tcp { tcp(); }; > destination external { file("/var/log/$HOST_err.log"); }; > log { source(s_tcp); destination(external); }; > > > On the source machine, there is a java process running that is generating lots of ERROR messages to syslog using the Apache log4j java syslog utility. What I'm seeing is that the ERROR messages are getting logged on the source machine into "/var/log/err.log" but they fail to reach the destination machine. Now, here's where it gets weird, when I run the following command from command-line: > > logger -p local0.error -t TEST "This is a test ERROR message" > > The generated log message gets logged on the source machine AND it also reaches the destination machine and gets logged correctly. This is the expected behavior. So why are the java program generated ERROR logs only getting logged on the source machine and not on the destination machine? > > Any help you could provide is greatly appreciated, thanks. Try strace-ing both syslog-ng processes as you send a message from Java. It is interesting how the message looks like and whether the message is sent to the 2nd syslog-ng or dropped on the first -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0