- syslog-ng - lists.balabit.hu

variables and match()
by Paul Miles 23 Nov '01

23 Nov '01

Hi, We're using syslog-ng daemon although and we think we've noticed a feature that appears to be missing. When you do a pattern match using match(), we require the value of the pattern match to be available as a variable, say $1, $2 etc etc. Our aim is to be able to farm different syslog entries off to different files based on the matched text from the reg. expression. Is this possible. Thanks and kind regards Paul Miles All Secure Networks Visit www.allsecuredomain.com for low cost web hosting and domain registration

2 1

RE: [syslog-ng]TCP Connection Problem
by Mike Kelland 23 Nov '01

23 Nov '01

Well, it's really not much of a change (2 characters on line 341 of afinet.c) but here's the diff: 341c341,345 < self->super.max_connections = 10; --- > self->super.max_connections = 1000; > -----Original Message----- > From: Ed Ravin [mailto:eravin@panix.com] > Sent: Friday, November 16, 2001 10:43 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]TCP Connection Problem > > > Mike Kelland writes: > > This may be a similar situation to the one we ran into. > Syslog-ng allows 10 > > connections from a single source max (appears to be hardcoded into > > afinet.c). > ... > > we are testing a new compile where we have changed the max > connections to > > 1000. We've managed to make the 1000 connections with no > ill effects but > > have not yet stress tested it with these 1000 connections. > > Patches? Patches? Please share... > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1

syslog-ng DNS
by Matt Mariscal 23 Nov '01

23 Nov '01

Hello, I have a question concerning the use_dns option. Is this a global option only, or is there some way to change this per source or destination? I am currently running v 1.4.14 on a Solaris box with multiple logical interfaces. Each logical interface is defined as a separate source within syslog-ng. I would like to enable DNS resolution for specific sources only but it does not appear as though this is possible. It appears as though my alternatives are to either globally enable DNS (not feasible) or run a separate instance of syslog-ng with DNS enabled. Any ideas? Matt Mariscal

2 1

Max number of TCP connections?
by Chris Sibbitt 23 Nov '01

23 Nov '01

SUMMARY: How many connection can I have to a tcp() source? 10? Why? I have been experiencing a problem with a syslog-ng (1.4.11) server seemingly only allowing 10 connections to a tcp() source. A quick tour of the code found the offending code at line 341 in afinet.c: self->super.max_connections = 10; Elsewhere in the file I see this (with code missing): if (c->num_connections >= c->max_connections) { #FAIL TO CONNECT }else{ #SUCCESSFULLY CONNECT } Unless this is not the code to handle tcp() sources, I think I've found what I need to change in order to fix this. My question is to Balazs, or anyone else with insight into the design of this daemon: Why is the limit set to 10? I want to change it, potentially to something very high (100 sounds about right for now), what impact is this going to have? JetNet Logo Chris Sibbitt Operations Development 333 Preston St, 3rd floor Ottawa, Ontario K1S 5N4 Phone (613) 237-5995, ext228 Fax (613) 237-9002

2 1

patch for adding tcp wrappers to syslog-ng?
by Ed Ravin 20 Nov '01

20 Nov '01

I just patched my copy of syslog-ng-1.5.10 to use tcp wrappers - I want to strictly control who is allowed to talk to my log server, and since we do everything else at my shop with TCP wrappers, it seemed sensible to add it in. I am running NetBSD 1.5.2, which provides the tcp wrappers code as part of the base OS. The only other change needed was to add "-lwrap" to the link flags. Is there interest in this feature? The patch below is only for incoming TCP connections - I don't see the point of putting it in for udp, as the packets are trivially spoofable. I haven't had much time to review the syslog-ng code, so I suspect this is not the best way to apply the patch: on second thought, it seems it might belong in libol. -- Ed --- afinet.c 2001/10/27 01:57:51 1.1 +++ afinet.c 2001/10/27 03:29:11 @@ -28,6 +28,13 @@ #include "cfgfile.h" #include "pkt_buffer.h" +#ifndef WE_DONT_WANT_TCP_WRAPPERS +#include "tcpd.h" +int allow_severity; +int deny_severity; +#endif + + #include <errno.h> #include <string.h> #include <assert.h> @@ -210,6 +217,23 @@ CAST(afinet_source, self, c); struct afsocket_source_connection *conn; UINT32 res; + + +#ifndef WE_DONT_WANT_TCP_WRAPPERS + { + struct request_info req; + + request_init(&req, RQ_DAEMON, "syslog-ng", RQ_FILE, client->super.fd, 0); + fromhost(&req); + if (hosts_access(&req) == 0) + { + CAST(inet_address_info, inet_addr, client_addr); + notice("connection from %S:%i refused by hosts_access()\n", inet_addr->ip, inet_addr->port); + close_fd(&client->super, 0); + return ST_OK | ST_GOON; + } + } +#endif if (c->num_connections >= c->max_connections) { CAST(inet_address_info, inet_addr, client_addr);

2 2

setting up a loghost on AIX - please help!!
by Sippel, Christian 19 Nov '01

19 Nov '01

Dear list, I'm trying to set up an AIX-machine as a loghost by using syslog-ng but I can't get syslog-ng working, so I would be very thankful if you could give me some hints. After downloading, compiling and installing libol and syslog-ng on the AIX-machine that should be used as a loghost I wrote the following syslog-ng.conf file in the /etc/syslog-ng direcoty: source src { unix-dgram("/dev/log"); tcp(ip(1.5.19.253) port(514)); udp(ip(1.5.19.253) port(514)); internal(); }; destination test { file("/var/adm/log/test-ng.log"); }; log { source(src); destination(test); }; }; the client machine (also AIX, internal ip-adress 1.5.19.253 ) is running the standard syslogd, in the /etc/syslog.conf is the line: local2.info @dmz-loghost and the /etc/hosts contains the line 1.34.20.20 dmz-loghost sending a log-message with logger -plocal2.info with standard syslog to the loghost works fine (so port 514 should be open) but the file specified in syslog-ng.conf does not contain anything. I really would appreciate if you could give me some hints what I did wrong, Christian Sippel

1 0

Archiving log file
by Chee Chew 18 Nov '01

18 Nov '01

I wish to split the log file into daily basis by means of different file per day according to the received timestamp. Is there any option in syslog-ng can be configured for this. At normal, the log file will grow bigger and bigger and become more difficult to read especially when we want to search for certain event on certain date. By achiving the log into daily file with meaningful filename, it should be much more convenient. Perhaps if syslog-ng do not have this option, is there any workaround or better method to due with this? Regards

2 1

RE: [syslog-ng]TCP Connection Problem
by Mike Kelland 16 Nov '01

16 Nov '01

This may be a similar situation to the one we ran into. Syslog-ng allows 10 connections from a single source max (appears to be hardcoded into afinet.c). So you could be hitting this limit. In order to fix it, we started by making sure that each server returning syslog only made one connection (some of ours were making 5) by editing the config files and now we are testing a new compile where we have changed the max connections to 1000. We've managed to make the 1000 connections with no ill effects but have not yet stress tested it with these 1000 connections. Has anyone else run into a similar situation btw? I'd be interested to find out if there was a reason that the max connections was hardcoded to such a low number. Thanks, Mike > -----Original Message----- > From: Roman Ernst [mailto:roman_ernst@at.ibm.com] > Sent: Friday, November 16, 2001 7:05 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]TCP Connection Problem > > > Hi! > > I have configured about 10 Host logging directly to another > one (TCP!!!). > > Unfortunately I have the following problem: > > When I reboot this logging server then syslog-ng on all the > other hosts > crashes... > > Is there any work around or do you already know this bug? > > I think normal behavour should be trying to reconnect to the logging > server... > > > Thanks a lot for your help in advance! > > Roman Ernst > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1

TCP Connection Problem
by Roman Ernst 16 Nov '01

16 Nov '01

Hi! I have configured about 10 Host logging directly to another one (TCP!!!). Unfortunately I have the following problem: When I reboot this logging server then syslog-ng on all the other hosts crashes... Is there any work around or do you already know this bug? I think normal behavour should be trying to reconnect to the logging server... Thanks a lot for your help in advance! Roman Ernst

1 0

RE: [syslog-ng]Sample Solaris config
by Jamie McKnight 15 Nov '01

15 Nov '01

|> |>For the server. Sorry. |> Here is what I use. I have the Solaris 8 syslogd startup with -t so it does not listen to the network on the central log host. Then I have syslog-ng listening for the messages that come in from the network. Messages coming in from the network go to /data/logs/messages.$HOST unless they are su or op(sudo like) and I have those go into seperate files elsewhere for monitoring etc. Pretty generic and works for me. Your milage may vary. Syslog-ng version is 1.4.14. options { sync(0); chain_hostnames(no); }; # Starting with this version of syslog-ng we are letting Solaris syslogd handle # system messages, but start it with a "-t" to tell it not to listen to network # traffic. We then use syslog-ng to only listen on the network. source s_remote { udp(ip(0.0.0.0) port(514)); internal(); }; # Filter defs. How to break out the incoming messages. filter f_hosts { level(err..emerg) or ( facility(kern) and level(debug..emerg)) or ( facility(daemon) and level(notice..emerg)) or ( facility(mail) and level(crit..emerg)); }; filter f_subad { program(su) and match(root) and match(failed); }; filter f_sugood { program(su) and match(root) and match(succeeded); }; filter f_sucombined { program(su) and match(su:); }; filter f_opbad { program(op) and match (FAILED); }; filter f_opgood { program(op) and match (SUCCEDED); }; filter f_opcombined { program(op) and match(op:); }; filter f_panic { match(panic); }; filter f_reboot { match(Generic_); }; # Destination defs. Where the messages go destination d_subad { file("/data/logs/su/bad_su_attempts"); }; destination d_sugood { file("/data/logs/su/good_su_attempts"); }; destination d_sucombined { file("/data/logs/su/su_attempts"); }; destination d_opbad { file("/data/logs/op/bad_op_attempts"); }; destination d_opgood { file("/data/logs/op/good_op_attempts"); }; destination d_opcombined { file("/data/logs/op/op_attempts"); }; destination d_panic { file("/data/logs/panic.log"); }; destination d_reboot { file("/data/logs/reboot.log"); }; destination d_hostmsg { file("/data/logs/hosts/messages.$HOST"); }; # Log actions for messages generated remotely log { source(s_remote); filter(f_subad); destination(d_subad); }; log { source(s_remote); filter(f_sugood); destination(d_sugood); }; log { source(s_remote); filter(f_sucombined); destination(d_sucombined); }; log { source(s_remote); filter(f_opbad); destination(d_opbad); }; log { source(s_remote); filter(f_opgood); destination(d_opgood); }; log { source(s_remote); filter(f_opcombined); destination(d_opcombined); }; log { source(s_remote); filter(f_panic); destination(d_panic); }; log { source(s_remote); filter(f_reboot); destination(d_reboot); }; log { source(s_remote); filter(f_hosts); destination(d_hostmsg); }; Jamie

2 1

udp relays
by Ben Smee 15 Nov '01

15 Nov '01

heya, I have a number of different networks under my control and I am sure like many other people on this list, they are not all routable from one to the other. My problem is that I would like to have a central syslog server that all our machines log back to (yes I know there are other architectures I can use to get around this problem but for the moment I want to try to do it like this for some particular reasons). Given that there is no one network that can route to all others or visa versa, I am wondering what type of udp relays people in similar situations use. I should say that on each network there is in effect at least one machine that has visibility of another network, thus meaning you CAN get from one network to another so long as you authenticate to a socks/ firewall first. I have looked about for some good udp relays but I cant really find any. As far as I can tell syslog-ng doesnt support socks so I am looking for alternatives ... regards, -------------------- Benjamin Smee Technical Specialist Optus Business Operations (NAC) "YES" OPTUS ben.smee(a)optus.net.au Tel: +61-2-93420091 Fax: +61-2-93420998 Perilous to all of us are the devices of an art deeper than we possess ourselves. -- Gandalf the White

2 1

RE: [syslog-ng]Sample Solaris config
by Ohrberg, Mick 14 Nov '01

14 Nov '01

For a log client or log server? > -----Original Message----- > From: Chuck Kelly [mailto:chuck@qualcomm.com] > Sent: Wednesday, November 14, 2001 2:01 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Sample Solaris config > > > Anyone have a good sample Solaris 8 config? > > > -- > Chuck > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1

Almost garbled messages
by Nicholas Berry 14 Nov '01

14 Nov '01

The messages started coming in like this when I upgraded to syslog-ng 1.5.12, but upgraded to 1.5.13 still with no success to fixing this. The characters after the second mention of hostname and before the third mentioned hostname is what this email is about. Has anyone else seen this? Oct 26 00:15:03 smf-dist-01/smf-dist-01 ´<14>smf-dist-01, Bridge topology change, vlan 200, interface 4/9, changed state to forwarding Oct 26 19:29:07 smf-dist-01/smf-dist-01<14>smf-dist-01, Interface ethernet4/24, state up Oct 26 19:29:10 smf-dist-01/smf-dist-01 <14>smf-dist-01, Bridge topology change, vlan 200, interface 4/24, changed state to forwarding Oct 26 19:30:55 smf-dist-01/smf-dist-01 rw<14>smf-dist-01, Interface ethernet4/24, state up Oct 26 19:30:57 smf-dist-01/smf-dist-01 ü´<14>smf-dist-01, Interface ethernet4/24, state down Oct 26 19:31:04 smf-dist-01/smf-dist-01 GET <14>smf-dist-01, Bridge topology change, vlan 200, interface 4/24, changed state to forwarding Oct 26 22:02:56 smf-dist-01/smf-dist-01 ´<14>smf-dist-01, Interface ethernet3/7, state down Oct 26 22:03:02 smf-dist-01/smf-dist-01 árwta<14>smf-dist-01, Interface ethernet3/7, state up Oct 26 22:03:03 smf-dist-01/smf-dist-01 ´<14>smf-dist-01, Bridge topology change, vlan 201, interface 3/7, changed state to forwarding Oct 29 22:35:27 smf-dist-01/smf-dist-01 GET <14>smf-dist-01, Interface ethernet4/10, state down Oct 29 22:35:51 smf-dist-01/smf-dist-01 dxP"8<14>smf-dist-01, Interface ethernet4/10, state up Oct 30 08:01:31 smf-dist-01/smf-dist-01 ´<14>smf-dist-01, neteng logout from USER EXEC mode Oct 30 18:43:07 smf-dist-01/smf-dist-01 ÒP"<14>smf-dist-01, Bridge topology change, vlan 200, interface 4/6, changed state to forwarding Oct 30 18:53:13 smf-dist-01/smf-dist-01 GET <14>smf-dist-01, Interface ethernet4/6, state down Oct 30 18:53:17 smf-dist-01/smf-dist-01 GET <14>smf-dist-01, Interface ethernet4/6, state up Oct 30 22:19:40 smf-dist-01/smf-dist-01 &<14>smf-dist-01, Interface ethernet4/6, state down Oct 30 23:17:09 smf-dist-01/smf-dist-01 ´<14>smf-dist-01, Interface ethernet4/1, state down Oct 30 23:17:14 smf-dist-01/smf-dist-01 à<14>smf-dist-01, Interface ethernet4/1, state up Oct 30 23:17:16 smf-dist-01/smf-dist-01 ´<14>smf-dist-01, Bridge topology change, vlan 200, interface 4/2, changed state to forwarding Oct 31 00:57:40 smf-dist-01/smf-dist-01 00:56<14>smf-dist-01, Interface ethernet4/9, state down Oct 31 16:38:51 smf-dist-01/smf-dist-01 FDE<14>smf-dist-01, Interface ethernet4/6, state down Oct 31 16:38:57 smf-dist-01/smf-dist-01 árwta<14>smf-dist-01, Interface ethernet4/6, state up Oct 31 16:38:59 smf-dist-01/smf-dist-01 ´<14>smf-dist-01, Bridge topology change, vlan 200, I'm running syslog-ng 1.5.13 with libol-0.3.1 under Solaris 8 (SPARC). These messages are being reported from a Foundry NetIron 800 (L3 switches). Thanks, Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com

2 1

Sample Solaris config
by Chuck Kelly 14 Nov '01

14 Nov '01

Anyone have a good sample Solaris 8 config? -- Chuck

1 0

Sample Solaris config
by Chuck Kelly 14 Nov '01

14 Nov '01

Anyone have a good sample Solaris 8 config? -- Chuck

1 0

(no subject)
by Ben Smee 13 Nov '01

13 Nov '01

heya, rolling syslog-ng to a number of servers here and I have come across a couple of problems. I have build packages for a number of different solaris versions and the following is NOT version specific. I know that ALL the packages I have build work on their respective versions, yet sometimes when I install it i get the following error: # ./syslog-ng -d io.c: Preparing fd 5 for reading io.c: connecting using fd 6 syslog-ng version 1.4.13 starting io.c: Preparing fd 6 for writing io.c: Preparing fd 7 for writing Virtual memory exhaustedAbort - core dumped The fact that it mostly works and then suddenly wont makes me think it is a library error or something similar. Not all boxes have been built the same way so it is entirely feasible that some machines have things installed that others dont. My question is what? :) I checked the basic core packages and couldnt easily see the culprit ... Below is truss output ( sorry about the length) : # truss ./syslog-ng -d execve("./syslog-ng", 0xEFFFFDF8, 0xEFFFFE04) argc =3D 2 stat("syslog-ng", 0xEFFFFAF8) =3D 0 open("/var/ld/ld.config", O_RDONLY) Err#2 ENOENT open("/usr/lib/libpthread.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF7B0000 mmap(0x00000000, 81920, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF790000 mmap(0xEF7A2000, 5500, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 8192) =3D 0xEF7A2000 munmap(0xEF794000, 57344) =3D 0 memcntl(0xEF790000, 12160, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(3) =3D 0 open("/usr/lib/libdoor.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF7B0000 mmap(0x00000000, 73728, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF770000 mmap(0xEF780000, 3868, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF780000 munmap(0xEF772000, 57344) =3D 0 memcntl(0xEF770000, 2608, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(3) =3D 0 open("/usr/lib/libsocket.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF7B0000 mmap(0x00000000, 106496, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF750000 mmap(0xEF766000, 8185, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 24576) =3D 0xEF766000 open("/dev/zero", O_RDONLY) =3D 4 mmap(0xEF768000, 388, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) =3D 0xEF768000 munmap(0xEF758000, 57344) =3D 0 memcntl(0xEF750000, 12072, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(3) =3D 0 open("/usr/lib/libnsl.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF7B0000 mmap(0x00000000, 581632, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF680000 mmap(0xEF700000, 33204, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 458752) =3D 0xEF700000 mmap(0xEF70A000, 16272, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) =3D 0xEF70A000 munmap(0xEF6F2000, 57344) =3D 0 memcntl(0xEF680000, 70252, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(3) =3D 0 open("/usr/lib/libxnet.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF7B0000 mmap(0x00000000, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 4, 0) =3D 0xEF740000 close(3) =3D 0 open("/usr/lib/libc.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF730000 mmap(0x00000000, 712704, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF580000 mmap(0xEF624000, 29740, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 606208) =3D 0xEF624000 mmap(0xEF62C000, 3648, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) =3D 0xEF62C000 munmap(0xEF616000, 57344) =3D 0 memcntl(0xEF580000, 101988, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(3) =3D 0 open("/usr/lib/libdl.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0xEF730000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF730000 close(3) =3D 0 open("/usr/lib/libmp.so.2", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF720000 mmap(0x00000000, 81920, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF660000 mmap(0xEF672000, 3581, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 8192) =3D 0xEF672000 munmap(0xEF664000, 57344) =3D 0 memcntl(0xEF660000, 3020, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(3) =3D 0 open("/usr/platform/SUNW,Ultra-5_10/lib/libc_psr.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF6FC) =3D 0 mmap(0xEF720000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF720000 mmap(0x00000000, 16384, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF650000 close(3) =3D 0 open("/usr/lib/libthread.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0xEF720000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF720000 mmap(0x00000000, 204800, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF540000 mmap(0xEF566000, 9584, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 90112) =3D 0xEF566000 mmap(0xEF56A000, 28580, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) =3D 0xEF56A000 munmap(0xEF558000, 57344) =3D 0 memcntl(0xEF540000, 25132, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(3) =3D 0 close(4) =3D 0 munmap(0xEF720000, 8192) =3D 0 brk(0x00038EC0) =3D 0 sysconfig(_CONFIG_PAGESIZE) =3D 8192 sigfillset(0xEF62BBE4) =3D 0 lwp_self() =3D 1 lwp_self() =3D 1 sigprocmask(SIG_SETMASK, 0x00000000, 0xEFFFF980) =3D 0 sigprocmask(SIG_SETMASK, 0xEF567D90, 0x00000000) =3D 0 sigaction(SIGLWP, 0xEF5683D0, 0x00000000) =3D 0 sigaction(SIGCANCEL, 0xEF5683D0, 0x00000000) =3D 0 sigaction(SIGSEGV, 0xEF5683D0, 0x00000000) =3D 0 brk(0x00038EC0) =3D 0 brk(0x0003AEC0) =3D 0 open("/dev/zero", O_RDWR) =3D 3 mmap(0x00000000, 8454144, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_NORESERVE, 3, 0) =3D 0xEEC00000 close(3) =3D 0 mprotect(0xEEC00000, 8192, PROT_NONE) =3D 0 mprotect(0xEED02000, 8192, PROT_NONE) =3D 0 mprotect(0xEEE04000, 8192, PROT_NONE) =3D 0 mprotect(0xEEF06000, 8192, PROT_NONE) =3D 0 mprotect(0xEF008000, 8192, PROT_NONE) =3D 0 mprotect(0xEF10A000, 8192, PROT_NONE) =3D 0 mprotect(0xEF20C000, 8192, PROT_NONE) =3D 0 mprotect(0xEF30E000, 8192, PROT_NONE) =3D 0 lwp_create(0xEFFFF6B8, 0x0100, 0xEF40FE04) =3D 2 lwp_create(0xEFFFF6B8, 0x0100, 0xEF40FE04) =3D -276885348 door_create(0xEF552728, 0x00000000, 0x00000002) =3D 3 getpid() =3D 18009 [18008] lwp_schedctl(SC_STATE|SC_BLOCK, 3, 0xEFFFF8BC) =3D 0 door_info(3, 0xEF56A7A8) =3D 0 open("/dev/zero", O_RDWR) =3D 4 mmap(0x00000000, 24576, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_NORESERVE, 4, 0) =3D 0xEF640000 close(4) =3D 0 mprotect(0xEF640000, 8192, PROT_NONE) =3D 0 lwp_create(0xEFFFF6A0, 0x00C0, 0xEF645E04) =3D 3 lwp_continue(3) =3D 0 lwp_create(0x00000001, 0x6000, 0xEFFFF83C) =3D 0 close(3) =3D 0 lwp_schedctl(SC_STATE|SC_BLOCK, -1, 0xEF645D0C) =3D 0 lwp_schedctl(SC_DOOR, 0, 0x00000000) =3D 3 door_bind(3) =3D 0 close(3) =3D 0 sigaction(SIGWAITING, 0xEF567C00, 0x00000000) =3D 0 lwp_self() =3D 1 open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) =3D 3 brk(0x0003AEC0) =3D 0 brk(0x0003EEC0) =3D 0 ioctl(3, TCGETA, 0xEFFFFADC) Err#25 ENOTTY fstat64(3, 0xEFFFF498) =3D 0 brk(0x0003EEC0) =3D 0 brk(0x00040EC0) =3D 0 ioctl(3, TCGETA, 0xEFFFF424) Err#25 ENOTTY read(3, " # A u t h o r : B e".., 8192) =3D 1415 read(3, 0x0003D7F4, 8192) =3D 0 brk(0x00040EC0) =3D 0 brk(0x00042EC0) =3D 0 ioctl(3, TCGETA, 0xEFFFF4FC) Err#25 ENOTTY llseek(3, 0, SEEK_CUR) =3D 1415 close(3) =3D 0 open("/dev/log", O_RDONLY|O_NONBLOCK|O_NOCTTY) =3D 3 ioctl(3, I_STR, 0xEFFFFB80) =3D 0 stat("/etc/.syslog_door", 0xEFFFFAC0) =3D 0 umount("/etc/.syslog_door") =3D 0 door_create(0x0001E018, 0x00000000, 0x00000000) =3D 4 getpid() =3D 18009 [18008] lwp_create(0xEFFFF680, 0x00C0, 0xEF20BE04) =3D 4 lwp_continue(4) =3D 0 lwp_create(0xEFFFF680, 0x00C0, 0xEF20BE04) =3D 147456 lwp_self() =3D 4 lwp_schedctl(SC_STATE, -1, 0xEF20BD6C) =3D 0 yield() =3D 0 ioctl(4, I_CANPUT, 0x00000000) Err#89 ENOSYS door_info(4, 0xEFFFFA28) =3D 0 mount("", "/etc/.syslog_door", MS_DATA, "namefs", 0xEFFFFA24, 4) =3D 0 so_socket(2, 1, 17, "", 1) =3D 5 fcntl(5, F_GETFL, 0x00000000) =3D 2 fstat64(5, 0xEFFFF908) =3D 0 getsockopt(5, 65535, 8192, 0xEFFFFA0C, 0xEFFFFA04) =3D 0 fstat64(5, 0xEFFFF908) =3D 0 getsockopt(5, 65535, 8192, 0xEFFFFA0C, 0xEFFFFA08) =3D 0 setsockopt(5, 65535, 8192, 0xEFFFFA0C, 4) =3D 0 fcntl(5, F_SETFL, 0x00000082) =3D 0 fcntl(5, F_SETFD, 0x00000001) =3D 0 setsockopt(5, 65535, 4, 0xEFFFFA98, 4) =3D 0 bind(5, 0xEFFFFAA0, 16) =3D 0 fcntl(5, F_GETFL, 0x00038400) =3D 130 fstat64(5, 0xEFFFF908) =3D 0 getsockopt(5, 65535, 8192, 0xEFFFFA0C, 0xEFFFFA04) =3D 0 fstat64(5, 0xEFFFF908) =3D 0 getsockopt(5, 65535, 8192, 0xEFFFFA0C, 0xEFFFFA08) =3D 0 setsockopt(5, 65535, 8192, 0xEFFFFA0C, 4) =3D 0 fcntl(5, F_SETFL, 0x00000082) =3D 0 fcntl(5, F_SETFD, 0x00000001) =3D 0 io.c: Preparing fd 5 for reading write(2, " i o . c : P r e p a r".., 33) =3D 33 so_socket(2, 1, 17, "", 1) =3D 6 fcntl(6, F_GETFL, 0x00000000) =3D 2 fstat64(6, 0xEFFFF908) =3D 0 getsockopt(6, 65535, 8192, 0xEFFFFA0C, 0xEFFFFA04) =3D 0 fstat64(6, 0xEFFFF908) =3D 0 getsockopt(6, 65535, 8192, 0xEFFFFA0C, 0xEFFFFA08) =3D 0 setsockopt(6, 65535, 8192, 0xEFFFFA0C, 4) =3D 0 fcntl(6, F_SETFL, 0x00000082) =3D 0 fcntl(6, F_SETFD, 0x00000001) =3D 0 io.c: connecting using fd 6 write(2, " i o . c : c o n n e c".., 28) =3D 28 open("/etc/netconfig", O_RDONLY) =3D 7 fstat64(7, 0xEFFFF238) =3D 0 brk(0x00042EC0) =3D 0 brk(0x00044EC0) =3D 0 ioctl(7, TCGETA, 0xEFFFF1C4) Err#25 ENOTTY read(7, " #\n # T h e " N e t".., 8192) =3D 1064 read(7, 0x0004111C, 8192) =3D 0 llseek(7, 0, SEEK_CUR) =3D 1064 llseek(7, 0, SEEK_SET) =3D 0 read(7, " #\n # T h e " N e t".., 8192) =3D 1064 read(7, 0x0004111C, 8192) =3D 0 llseek(7, 0, SEEK_CUR) =3D 1064 close(7) =3D 0 open64("/etc/.name_service_door", O_RDONLY) =3D 7 fcntl(7, F_SETFD, 0x00000001) =3D 0 door_info(7, 0xEF62BA68) Err#9 EBADF close(7) =3D 0 open("/etc/nsswitch.conf", O_RDONLY) =3D 7 fstat64(7, 0xEFFFD440) =3D 0 ioctl(7, TCGETA, 0xEFFFD3CC) Err#25 ENOTTY read(7, " #\n # / e t c / n s s".., 8192) =3D 690 read(7, 0x0004111C, 8192) =3D 0 llseek(7, 0, SEEK_CUR) =3D 690 close(7) =3D 0 open("/usr/lib/nss_files.so.1", O_RDONLY) =3D 7 fstat(7, 0xEFFFD3AC) =3D 0 mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 7, 0) =3D 0xEF530000 mmap(0x00000000, 81920, PROT_READ|PROT_EXEC, MAP_PRIVATE, 7, 0) =3D 0xEF510000 mmap(0xEF522000, 6788, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 7, 8192) =3D 0xEF522000 munmap(0xEF514000, 57344) =3D 0 open("/dev/zero", O_RDONLY) =3D 8 mmap(0x00000000, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 8, 0) =3D 0xEF500000 memcntl(0xEF510000, 4936, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(7) =3D 0 close(8) =3D 0 munmap(0xEF530000, 8192) =3D 0 open("/etc/hosts", O_RDONLY) =3D 7 fstat64(7, 0xEFFFD3A0) =3D 0 ioctl(7, TCGETA, 0xEFFFD32C) Err#25 ENOTTY read(7, " #\n # I n t e r n e t".., 8192) =3D 8192 llseek(7, 0xFFFFFFFFFFFFE058, SEEK_CUR) =3D 88 close(7) =3D 0 connect(6, 0xEFFFFAA0, 16) =3D 0 syslog-ng version 1.4.13 starting write(2, " s y s l o g - n g v e".., 34) =3D 34 sigaction(SIGPIPE, 0xEFFFFB00, 0xEFFFFC00) =3D 0 sigaction(SIGHUP, 0xEFFFFB00, 0xEFFFFC00) =3D 0 sigaction(SIGTERM, 0xEFFFFB00, 0xEFFFFC00) =3D 0 sigaction(SIGCLD, 0xEFFFFB00, 0xEFFFFC00) =3D 0 time() =3D 1005608296 poll(0xEFFFFC18, 3, 100) =3D 2 getsockopt(6, 65535, 4103, 0xEFFFFBA4, 0xEFFFFBA0) =3D 0 fcntl(6, F_GETFL, 0x00038400) =3D 130 fstat64(6, 0xEFFFF878) =3D 0 getsockopt(6, 65535, 8192, 0xEFFFF97C, 0xEFFFF974) =3D 0 fstat64(6, 0xEFFFF878) =3D 0 getsockopt(6, 65535, 8192, 0xEFFFF97C, 0xEFFFF978) =3D 0 setsockopt(6, 65535, 8192, 0xEFFFF97C, 4) =3D 0 fcntl(6, F_SETFL, 0x00000082) =3D 0 fcntl(6, F_SETFD, 0x00000001) =3D 0 door_return(0x00000000, 0, 0x00000000, 0) =3D 0 io.c: Preparing fd 6 for writing write(2, " i o . c : P r e p a r".., 33) =3D 33 open("/dev/zero", O_RDWR) =3D 7 mmap(0x00000000, 24576, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_NORESERVE, 7, 0) =3D 0xEF530000 close(7) =3D 0 mprotect(0xEF530000, 8192, PROT_NONE) =3D 0 lwp_create(0xEF645A38, 0x00C0, 0xEF535E04) =3D 5 lwp_continue(5) =3D 0 lwp_create(0x00000001, 0x6000, 0xEF645BD4) =3D 0 lwp_schedctl(SC_STATE|SC_BLOCK, -1, 0xEF535D0C) =3D 0 getmsg(3, 0xEFFFD2F0, 0xEFFFD2B0, 0xEFFFD26C) =3D 0 lwp_schedctl(SC_DOOR, 0, 0x00000000) =3D 7 door_bind(7) =3D 0 close(7) =3D 0 sigaction(SIGWAITING, 0xEF567C20, 0x00000000) =3D 0 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 uname(0xEFFFCBF8) =3D 1 open("/usr/share/lib/zoneinfo/Australia/NSW", O_RDONLY) =3D 7 read(7, "\0\0\0\0\0\0\0\0\0\0\0\0".., 8192) =3D 785 close(7) =3D 0 open("/var/adm/syslog-local", O_WRONLY|O_APPEND|O_NONBLOCK|O_CREAT|O_NOCTTY, 0600) =3D 7 chown("/var/adm/syslog-local", 0, 0) =3D 0 fcntl(7, F_GETFL, 0x00038400) =3D 137 fstat64(7, 0xEFFFCDC0) =3D 0 fstat64(7, 0xEFFFCDC0) =3D 0 fcntl(7, F_SETFL, 0x00000089) =3D 0 fcntl(7, F_SETFD, 0x00000001) =3D 0 io.c: Preparing fd 7 for writing write(2, " i o . c : P r e p a r".., 33) =3D 33 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 brk(0x00044EC0) =3D 0 brk(0x00046EC0) =3D 0 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 brk(0x00046EC0) =3D 0 brk(0x00048EC0) =3D 0 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 poll(0xEFFFFC10, 4, 100) =3D 2 write(7, " N o v 1 3 1 0 : 3 8".., 4096) =3D 4096 Virtual memory exhaustedwrite(2, " V i r t u a l m e m o".., 24) =3D 24 sigaction(SIGABRT, 0x00000000, 0xEFFFE870) =3D 0 llseek(0, 0, SEEK_CUR) =3D 67186 sigaction(SIGABRT, 0xEFFFE6C0, 0xEFFFE7C0) =3D 0 sigprocmask(SIG_SETMASK, 0xEF570A90, 0xEFFFE728) =3D 0 sigprocmask(SIG_SETMASK, 0xEF570A90, 0xEFFFE488) =3D 0 lwp_kill(1, SIGABRT) =3D 0 sigprocmask(SIG_SETMASK, 0xEFFFE728, 0x00000000) =3D 0 Received signal #6, SIGABRT [default] siginfo: SIGABRT pid=3D18009 uid=3D0 code=3D-1 *** process killed *** # -------------------- Benjamin Smee Technical Specialist Optus Business Operations (NAC) "YES" OPTUS ben.smee(a)optus.net.au Tel: +61-2-93420091 Fax: +61-2-93420998 Perilous to all of us are the devices of an art deeper than we possess ourselves. -- Gandalf the White

1 0

Seeking suggestions on a secure central syslog-ng setup..
by Sean McNamara 12 Nov '01

12 Nov '01

Hello all, First of all, please excuse me if this is off-topic; but seeing as I'm looking for something which will interface/work with syslog-ng, I thought that this would be as good of a place as any to get a start. To move on... We're currently running two central syslog servers (specifically syslog-ng) on Solaris 8/Sparc, and are investigating methods of setting up a central location where these logs may be processed (i.e. searching, alert generation, etc.) and viewed via a web-enabled console of some sorts that, ideally offers some method for access control to define varying levels of access to log reports, raw data, etc. Though, that would be ideal, it's by no means _absolutely_ necessary. My current idea is as follows: to have a third server that acts as the 'processing/viewing' server which NFS (ala WVrpcbind for security) mounts the log directories on the remote logserver, and does the processing remotely, rather than on the already burdened logserver. I'm sure this is no amazing idea.. however, I'm just not sure I've reviewed all of my options as far as what would be doing the processing portion of the task. We have a large variety of logs maintained at these locations, amongst them, named(BIND), DHCP, PIX(firewall), IPFilters, RADIUS(Interlink Networks), ssh, inetd, authlog(i.e. login attempts/failures), kernel logs, etc., etc. so, yet another consideration in addition to all mentioned is for the software to have the ability to, at least somewhat be able to parse the logfile data in order to generate alerts, and in some cases (if there exists an 'access control' feature), allow for some of the logfile data to be 'sugar coated', that is- basically to simplify information from the raw logs to cater to less technical individuals, e.g. helpdesk staff, etc, who may have a need to view specific log data, but may not be able to (or have the will to) read the technical details of raw log files. I know I've specified a bit of a wishlist beyond just basic syslog log viewing/reporting, but I supposed I ought to aim high and see what comes out of it. I'm toying with the idea of writing such a system such as above, but, I don't know if I have the time to dedicate to it; so I'm hoping that at least something will come somewhere close. So, this is where I turn it over to you -- can anyone give me any examples of how you may have managed a situation like this? Or specifically of any software available to do as I described? Any comments, examples, or pointers to resources would be greatly appreciated. Many thanks in advance, ..Sean R. McNamara. Network Systems Administrator, Villanova University UNIT- Data Network Services

1 0

Syslog-ng crash
by Roman Ernst 12 Nov '01

12 Nov '01

Hello, I have been using syslog-ng now for several weeks. Unfortunately from time to time it hangs up with the following error report (AIX - errpt): ====================================================================================================== errpt -a --------------------------------------------------------------------------- LABEL: CORE_DUMP IDENTIFIER: C60BB505 Date/Time: Mon Nov 12 14:09:22 Sequence Number: 767 Class: S Type: PERM Resource Name: SYSPROC Description SOFTWARE PROGRAM ABNORMALLY TERMINATED Probable Causes SOFTWARE PROGRAM User Causes USER GENERATED SIGNAL Recommended Actions CORRECT THEN RETRY Failure Causes SOFTWARE PROGRAM Recommended Actions RERUN THE APPLICATION PROGRAM IF PROBLEM PERSISTS THEN DO THE FOLLOWING CONTACT APPROPRIATE SERVICE REPRESENTATIVE Detail Data SIGNAL NUMBER 6 USER'S PROCESS ID: 25968 FILE SYSTEM SERIAL NUMBER 5 INODE NUMBER 4480 PROGRAM NAME syslog-ng ADDITIONAL INFORMATION pthread_k 88 ?? _p_raise 64 raise 34 abort B8 fatal[DS] 48 xalloc 2C ol_string 24 c_format 60 do_flush CC write_cal E8 io_iter 4C4 main_loop 19C main 450 __start 8C Symptom Data REPORTABLE 1 INTERNAL ERROR 0 SYMPTOM CODE PCSS/SPI2 FLDS/syslog-ng SIG/6 FLDS/main_loop VALU/19c ====================================================================================================== Would be great if somebody could fix this... if you need more information don't hesitate to contact me... Best regards Roman Ernst

1 0

Slow capturing syslog
by Chee Chew 12 Nov '01

12 Nov '01

Thank you to all. It is really the DNS problem here. Now, it is working fast. On Sun, Nov 11, 2001 at 08:32:58PM -0800, Chee Chew wrote: > I tested with kiwi syslog generator and I found either syslog-ng or syslogd > is putting the log into file destination very slow at fastest exactly 10sec > per log. At the rest of the log is queue in buffer. If syslog-ng were to run > in environment that has log input with consistently 1 log per second, this > will not work even we set the buffer large. Also not real time. > > I believe this is something to do with the synchronisation of SOCK_STREAM > socket because I am using linux. Do you know how to fine tune this. I've captured around 2 million messages in the last 3 days on a linux loghost, so I don't think Linux is your problem. Post your config here, especially whether you're using DNS or not and we can help out. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 Microsoft Vaccine 2000 is configuring your immune system. This may take a few minutes. If your body stops responding for a long time and there is no brain activity please die. Setup will continue after you are reborn. --__--__-- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng End of syslog-ng Digest

1 0

Slow capturing syslog
by Chee Chew 11 Nov '01

11 Nov '01

I tested with kiwi syslog generator and I found either syslog-ng or syslogd is putting the log into file destination very slow at fastest exactly 10sec per log. At the rest of the log is queue in buffer. If syslog-ng were to run in environment that has log input with consistently 1 log per second, this will not work even we set the buffer large. Also not real time. I believe this is something to do with the synchronisation of SOCK_STREAM socket because I am using linux. Do you know how to fine tune this. Regards

4 3

what to do with syslogd
by Chee Chew 10 Nov '01

10 Nov '01

I am going to use syslog-ng for receiving remote host syslog. What am I going to do with the existing syslogd? If I turn off syslogd, will I still able to capture all internal system syslog? regards

3 2

priority level ?
by Tony Moran 10 Nov '01

10 Nov '01

Hi all, I was wondering.. When I create a filter, if I specify a priority level, for example 'err' does that also imply all facility levels greater than err are also matched ? On the face of it this doesnt seem likely given I'm filter matching, but looking at the syslog-ng.conf.SunOS file in contribs/ and other examples this is what it can only seem to be saying. For example for /dev/console the example filter is { level(err) or (level(notice) and facility (auth, kern)); }; I'm hardly going to leave out everything above err, or notice for auth and kern if I am to send important messages to the console. Thanks for your help, Tony

2 1

different message shows up on loghost than on client
by Nate Campi 10 Nov '01

10 Nov '01

I have syslog-ng loghosts in out datacenters that receive messages via UDP from mostly solaris syslogd. The loghosts in the datacenters then relay the messages over TCP/stunnel to a central loghost for archiving/analysis/input into database. The problem is that a message like this on a solaris 2.6 box: Nov 7 04:05:45 ballys ctld 5.0.6[22164]: [0] Error: unable to read header - Status: NoMoreData. ...will arrive (via UDP) on my linux loghost (syslog-ng 1.4.12) like this: Nov 7 04:05:45 ballys.hotwired.com 5.0.6[22164]: [0] Error: unable to read header - Status: NoMoreData. I have no idea why it would cut out the program name (ctld) like that. Is this a known issue? This is really messing up my log tables, and I'd like to keep all the data straight in the database. Here's my options from the linux loghost: options { use_fqdn(yes); long_hostnames(off); keep_hostname(no); use_dns(yes); sync(0); }; Plus, when did it become an option to buffer messages with sync? Is is only the in devel branch? I'd like to set sync(5) or something to take it easy on the disk. TIA, -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 The only way to convince some people that HTML is about content, not style is with a 2x4 <PLANK>.

2 3

elegant swatch solution
by Nate Campi 10 Nov '01

10 Nov '01

I found a clean way to use swatch to watch all your syslog messages from syslog-ng. Normally you need to tell swatch to tail a file, so if you want swatch to watch all your logs you have to either send all messages to one file or run multiple instances of swatch. I came up with this tonight: # hack to get swatch to read from stdin destination swatch { program("/usr/bin/swatch --read-pipe=\"cat /dev/fd/0\""); }; # send all logs to swatch log { source(src); destination(swatch); }; The source "src" is all my logs on that box. This works like a charm, and if syslog-ng is restarted, so is swatch, so you don't need to worry about HUP'ing/restarting swatch - ever! This way you can let swatch monitor your logs instead of using match() directives - since swatch has built in throttling on alerts I find it nicer to use. swatch keeps my pager from going nuts after the first message which caused the alarm, subsequent messages are ignored for a defined amount of time, using the "throttle feature". -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 "Only two things are infinite, the universe and human stupidity, and I'm not sure about the former" -- Albert Einstein.

1 0

Re: [syslog-ng]Documentation/manual etc..
by bretwatson＠charteredsemi.com 09 Nov '01

09 Nov '01

Great, looks like in the next week or so I should be able to get out a first draft of teh manual.. The fun part will come with getting examples etc.. Cheers, Bret Balazs Scheidler <bazsi(a)balabit.hu> 09/11/2001 04:51 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: (bcc: WATSON Bret/Mgr/CSM/ST Group) Subject: Re: [syslog-ng]Documentation/manual etc.. On Fri, Nov 09, 2001 at 11:09:44AM +0800, bretwatson(a)charteredsemi.com wrote: > Hi Baltasar, > some questions on the options list.... > > I've dug through the cfg-lex.l file and found it is looking for a bunch of > options - some of which exist int eh current docs.. so some questions: > > What does "Keep_hostname" do? to not touch the hostname part of the received message, and leave it intact. > is "use_fqdn" the same as "long_hostnames"? no, long_hostnames is an alias to chain_hostnames, the latter being the preferred one. (this ambiguity caused me to change it) use_fqdn means to use fully qualified domain names, otherwise the domain is chopped after the first '.' character in the hostname. > What does "gc_threshold" do? gc_threshold is the same as gc_busy_threshold > What does "create_dir" do? if macro expansion is used in destination filenames, directory references to non-existing directories can be made, if create_dir is true, those directories are automatically created. > > and what about the following? are any enabled? > localip, ip, localport, port, destport, owner, group, perm, dir_owner, > dir_group, dir_perm, keep-alive, keep_alive, max-connections, mac, > authentication, encrypt, required, allow, deny. compress mac, authentication, encrypt and compress each accept one of triple as argument: required, allow or deny, though none of these are currently implemented. All the other options are (or supposed to be ) working: localip & localport: specifies the source ip & port of a connection (before connection is made, useful if your box has several IPs) ip means localip for sources destport: specifies the destination port for destinations owner, group, perm: file permission information for created files dir_owner, dir_group, dir_perm: directory permission information for created dirs keep-alive, keep_alive: do not drop connections when the config is reloaded max-connections: how many concurrent connections are permitted at a time -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Documentation/manual etc..
by bretwatson＠charteredsemi.com 09 Nov '01

09 Nov '01

Hi Baltasar, some questions on the options list.... I've dug through the cfg-lex.l file and found it is looking for a bunch of options - some of which exist int eh current docs.. so some questions: What does "Keep_hostname" do? is "use_fqdn" the same as "long_hostnames"? What does "gc_threshold" do? What does "create_dir" do? and what about the following? are any enabled? localip, ip, localport, port, destport, owner, group, perm, dir_owner, dir_group, dir_perm, keep-alive, keep_alive, max-connections, mac, authentication, encrypt, required, allow, deny. compress Thanks, Bret

2 1

RE: weird... please help
by bretwatson＠charteredsemi.com 09 Nov '01

09 Nov '01

Thanks, that works... Cheers, Bret "Baltasar Cevc" <baltasar(a)cevc-topp.de> 09/11/2001 06:01 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: <syslog-ng(a)lists.balabit.hu> cc: (bcc: WATSON Bret/Mgr/CSM/ST Group) Subject: RE: [syslog-ng]weird... please help Hi, Bret! > But what happens is that everything ends up in teh "all" destination instead of the vpn destination.... It should end to be shown in both... Try to add ".*" to your host check regexp. Perhaps it doesn't match because there is something more than the single host IP. And for the all destination: you could use a third filter like this to prevent VPN messages getting there like this: filter fallb { not (filter (f_vpnhosts) or filter (f_vpnhosts2)); }; bye.baltasar ::: B A L T A S A R C E V C mailto: baltasar(a)cevc-topp.de Tel.: +49 89 99020515 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

weird... please help
by bretwatson＠charteredsemi.com 08 Nov '01

08 Nov '01

Hmm I'm stuffed up I guess, but I can't work out where... Please help!!! Thanks, Bret Here is my syslog-ng.conf file options { sync(0); time_reopen(10); log_fifo_size(100); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source net { udp(); }; destination all { file("/var/adm/messages"); }; destination vpn { file("/usr/log1/vpn.log"); }; filter f_vpnhosts { host("203.126.246.216") or host("203.126.246.217") or host("203.126.246.218"); }; filter f_vpnhosts2 { host("10.84.3.10"); }; log { source(net); filter(f_vpnhosts); destination(vpn); }; log { source(net); filter(f_vpnhosts2); destination(vpn); }; log { source(local); destination(all); }; log { source(net); destination(all); }; Here is the log lines I'm trying to re-direct to the vpn.log Nov 7 08:15:55 10.84.3.10/10.84.3.10 [1:33947706:Gate7520:CHARTERED 01:203.126.246.216]2001/11/07 16:27:41 Isakmp ScSA: Rekey Phase 2: Loc:10.200.*.*, Rem:10.84.3.50 (66.68.164.196) But what happens is that everything ends up in teh "all" destination instead of the vpn destination....

2 1

Documentation/manual etc..
by bretwatson＠charteredsemi.com 08 Nov '01

08 Nov '01

Hi All, I'm looking to have a go at a configuration manual for Syslog-ng.. the reason being that the current one sucks (sorry, but true).. It will be for teh stable branch only For starters I'm pulling variables from the c code... so here are the globals.. chain_hostnames keep_hostname mark_freq sync_freq time_reopen time_reap log_fifo_size use_time_recvd use_fqdn use_dns create_dirs uid gid perm dir_uid dir_gid dir_perm gc_busy_threshold gc_idle_threshold Can someone tell me what inputs these configs take and what their function is? - some are in the docs, but some (like create_dirs) are not... I'll post to this list as it comes together... Cheers, Bret

2 1

link error
by Holger.Woehle＠arcor.net 06 Nov '01

06 Nov '01

Hello, i want to compile syslog-ng under linux kernel 2.4.13 glibc 2.2.4 . After ./configure, i get following error running make: make[3]: Entering directory `/usr/src/syslog-ng-1.4.14/src' gcc -O2 -Wall -I/usr/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o utils.o syslog-names.o /usr/lib/libol.a -lnsl cfg-lex.o: In function `yylex': cfg-lex.o(.text+0x4ae): undefined reference to `yywrap' cfg-lex.o: In function `input': cfg-lex.o(.text+0xa28): undefined reference to `yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive-am] Error 2 make: *** [all-recursive] Error 1 anonybody a idea where the bug sits ? with regards cu Holgi

2 1

syslog-ng messages sent to outside prog
by Nate Campi 06 Nov '01

06 Nov '01

I setup a match line to match the string "attackalert" from portsentry, and I pipe this off to a script that mails it to me. This works great, but I get emails with "<29>" prepended to it. Example: <29>Nov 5 12:46:37 skitzo portsentry[121]: attackalert: Host 209.202.221.43 has been blocked via dropped route using command: "/usr/local/sbin/iptables -I INPUT -s 209.202.221.43 -j DROP" I just setup sqlsyslogd to output to a mysql database from a program() destination, and it prepends the <29> to the messages sent there as well. I checked out http://www.ietf.org/rfc/rfc3164.txt and it looks like this is a priority. How can I keep this from showing up in the output? I hacked sqlsyslogd to print the string from 4 chars into the timestamp, so my mysql inputs are clean, but what do I do to clean up the mail? -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79

4 6

RE: [syslog-ng]syslog-ng messages sent to outside prog
by Robert Glad 06 Nov '01

06 Nov '01

Relax man, this is not one of those eLiTe-BBSes in the early nineties.. ;) Robert -----Original Message----- From: Snortball [mailto:snortball@hotmail.com] Sent: den 6 november 2001 16:53 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng messages sent to outside prog I'M VERY VERY SORRY! This was supposed to go to the sender, not the list....I promise I'll stop being stupid.... ----- Original Message ----- From: "Snortball" <snortball(a)hotmail.com> To: <syslog-ng(a)lists.balabit.hu> Sent: Tuesday, November 06, 2001 9:25 AM Subject: Re: [syslog-ng]syslog-ng messages sent to outside prog > Hi, > > Is there any chance that I can get a copy of your mail script? I can't seem > to get one to work. Yes, I'm a newbie.....but I'm trying! > > Thanks, > > Sb > ----- Original Message ----- > From: "Nate Campi" <nate(a)campin.net> > To: <syslog-ng(a)lists.balabit.hu> > Sent: Monday, November 05, 2001 6:03 PM > Subject: [syslog-ng]syslog-ng messages sent to outside prog > > > > I setup a match line to match the string "attackalert" from portsentry, > > and I pipe this off to a script that mails it to me. > > > > This works great, but I get emails with "<29>" prepended to it. Example: > > > > <29>Nov 5 12:46:37 skitzo portsentry[121]: attackalert: Host > > 209.202.221.43 has been blocked via dropped route using command: > > "/usr/local/sbin/iptables -I INPUT -s 209.202.221.43 -j > > DROP" > > > > I just setup sqlsyslogd to output to a mysql database from a program() > > destination, and it prepends the <29> to the messages sent there as > > well. > > > > I checked out http://www.ietf.org/rfc/rfc3164.txt and it looks like this > > is a priority. How can I keep this from showing up in the output? I > > hacked sqlsyslogd to print the string from 4 chars into the timestamp, > > so my mysql inputs are clean, but what do I do to clean up the mail? > > -- > > Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 > > Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

NEWBIE question: Email as destination
by Snortball 05 Nov '01

05 Nov '01

Hello all, Sorry if this has already been covered, but I can't find the answer in any docs. I am trying to have syslog-ng send certain syslog messages via email so that I don't have to bother with a log watcher like swatch, etc. I tried different combinations of: destination email { pipe("/bin/mail"); }; But that just overwrote the mail bianry (not fun). Any advice? TIA Sb

2 2

syslog-ng and Cisco boxes
by Brian D. Olesen 05 Nov '01

05 Nov '01

I am in the process of setting up a syslog server for a large number of Cisco boxes, and have faced some difficulties which may be due to an error in syslog-ng 1.4.13 on Solaris 8 regarding the source statement. source net { udp(); }; As far as I can understand from the documentation, this ought to listen to all incoming udp packets on port 514. Contrary to the documentation, I never got this to work at all. I even tried to stop the native syslogd, but to no avail. source net { udp(ip("xxx.xxx.xxx.22") port(514)); }; Stating the service ip address and syslog port works perfectly. On the Cisco IOS side, it took me some time to realize that logging source-interface Ethernet0 is essential to do remote logging. This is the interface with the ip address which have access to the remote syslog host. Other experiences, especially best practices, with syslog-ng and Cisco boxes are greatly appreciated. Best regards, Brian D. Olesen UNIX Administrator Orange DK

6 6

issues using NOT in an filter.
by Matthew Schumacher 05 Nov '01

05 Nov '01

Hello all, I can't seem to figure this out. I want to log level(info) and facility(authpriv) to my messages file, but I don't want to see facility(local4). Now some of the facility(local4) messages are level(info) but I still don't want them. Anyway, I was trying something like this and it doesn't work: filter f_messages { (level(info) or facility(authpriv)) not facility(local4); }; I tried using () to clean it up and that doesn't work. In all of the combinations I tried it simply will not parse the config file with NOT in the filter unless I put an and in front of it like this: "and not" Anyone have a sec to help me out with this? Thanks, schu

2 1

RE: [syslog-ng]question about flags + fix to compile under solaris (PATH_SYSCONFDIRprob)
by Nicholas Berry 02 Nov '01

02 Nov '01

I have also noticed this problem with PATH_SYSCONFDIR in src/config.h. After running the configure script, PATH_SYSCONFDIR is defined in src/config.h, but when running `make`, something (perhaps autoconf) removes PATH_SYSCONFDIR from src/config.h and causes the compile to fail. After re-adding '#define PATH_SYSCONDIR "/usr/local/etc/syslog-ng"' back into src/config.h, everything compiles fine. Also, defining "--sysconfdir=<alternate dir>" when running the configure script is not reflected in src/config.h I'm using autoconf 2.13, automake 1.4, make 3.79, m4 1.4, and gcc 2.95.3 all under Solar 8 SPARC. Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com -----Original Message----- From: Asher Yanich [mailto:ayanic01@cs.fiu.edu] Sent: Friday, November 02, 2001 9:41 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]question about flags + fix to compile under solaris (PATH_SYSCONFDIRprob) I am currently running syslog-ng 1.5.7 and using the DEFAULT keyword. I see that this is removed from the newer 1.5.x releases in favor of flags. I cant seem to find any documentation on the syntax or usage. Can someone help me out? Also, I had not been able to compile any syslog-ng 1.5.x releases for awhile, I finally fixed the compilation problem. --- syslog-ng.h Wed Jul 25 05:20:53 2001 +++ /depot/syslog-ng/src/syslog-ng-1.5.13/src/syslog-ng.h Fri Nov 2 11:42:39 2001 @@ -34,7 +34,7 @@ #define PATH_SYSLOG_NG_CONF "syslog-ng.conf" #define PATH_PIDFILE "syslog-ng.pid" #else -#define PATH_SYSLOG_NG_CONF PATH_SYSCONFDIR "/syslog-ng.conf" +#define PATH_SYSLOG_NG_CONF "/syslog-ng.conf" #define PATH_PIDFILE "/var/run/syslog-ng.pid" #endif -asher yanich _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

question about flags + fix to compile under solaris (PATH_SYSCONFDIR prob)
by Asher Yanich 02 Nov '01

02 Nov '01

I am currently running syslog-ng 1.5.7 and using the DEFAULT keyword. I see that this is removed from the newer 1.5.x releases in favor of flags. I cant seem to find any documentation on the syntax or usage. Can someone help me out? Also, I had not been able to compile any syslog-ng 1.5.x releases for awhile, I finally fixed the compilation problem. --- syslog-ng.h Wed Jul 25 05:20:53 2001 +++ /depot/syslog-ng/src/syslog-ng-1.5.13/src/syslog-ng.h Fri Nov 2 11:42:39 2001 @@ -34,7 +34,7 @@ #define PATH_SYSLOG_NG_CONF "syslog-ng.conf" #define PATH_PIDFILE "syslog-ng.pid" #else -#define PATH_SYSLOG_NG_CONF PATH_SYSCONFDIR "/syslog-ng.conf" +#define PATH_SYSLOG_NG_CONF "/syslog-ng.conf" #define PATH_PIDFILE "/var/run/syslog-ng.pid" #endif -asher yanich

1 0

syslog record size limitation?
by Ed.Schernau＠guardent.com 02 Nov '01

02 Nov '01

Hello all, Solaris 8. I'm logging some rather long text entries via TCP, and they are getting chopped off at 1024 characters. Is this a limitation of syslog-ng itself, or Solaris native syslog? Any help appreciated. Ed

1 0

STATS: dropped 59
by Thomas Kaehn 02 Nov '01

02 Nov '01

Hi, syslog-ng seems to drop log-messages (syslog-ng[16854]: STATS: dropped 59). How can I avoid this, besides from using syslog-ng and TCP on all hosts? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

3 2

RE: [syslog-ng]Re: Level/Priority of 'none'
by Denis Doublet 02 Nov '01

02 Nov '01

-----Message d'origine----- De : Brad Stockdale [mailto:bradsprt@greenepa.net] Envoyé : vendredi 2 novembre 2001 02:09 À : syslog-ng(a)lists.balabit.hu Objet : [syslog-ng]Re: Level/Priority of 'none' Hello all, I'm a newbie to syslog-ng, and am trying to convert our local servers from sysklogd to syslog-ng... I'm having a bit of a problem, though... I might just be blind to the answer of this question, though... It seems pretty simple... In the syslog.conf file that is currently in place (the default redhat one), there's a line that reads: >*.info;mail.none;news.none;authpriv.none /var/log/messages Seems logical... How do I do the same thing in syslog-ng? Try destination d_local { file("/var/adm/messages/"); }; filter no_mail { not facility(mail); }; filter no_news { not facility(news); }; filter no_authpriv { not facility(authpriv); }; filter info { level(info .. emerg); }; log { source(s_local); filter no_mail; filter no_news; filter no_authpriv; filter info; destination(d_local); }; The syslog.conf manpages state: >The keyword none stands for no priority of the given facility. So, if I'm understanding this right, syslog was receiving a facility name, but no level/priority setting? And this mapped to "none." i.e : filter f_critical { level(crit .. emerg) or facility(syslog); }; Does this help you? Does syslog-ng provide a similar thing? Or do these daemons really send out the facility and level/priority, but it's some default one? Thanks for any help in advance... I'm sure this is an easy thing to fix, but just don't know the internals of syslog or syslog-ng very well yet... I've always just used the default configuration and left things alone... Thanks in advance, Brad _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: Level/Priority of 'none'
by Brad Stockdale 02 Nov '01

02 Nov '01

Hello all, I'm a newbie to syslog-ng, and am trying to convert our local servers from sysklogd to syslog-ng... I'm having a bit of a problem, though... I might just be blind to the answer of this question, though... It seems pretty simple... In the syslog.conf file that is currently in place (the default redhat one), there's a line that reads: >*.info;mail.none;news.none;authpriv.none /var/log/messages Seems logical... How do I do the same thing in syslog-ng? The syslog.conf manpages state: >The keyword none stands for no priority of the given facility. So, if I'm understanding this right, syslog was receiving a facility name, but no level/priority setting? And this mapped to "none." Does syslog-ng provide a similar thing? Or do these daemons really send out the facility and level/priority, but it's some default one? Thanks for any help in advance... I'm sure this is an easy thing to fix, but just don't know the internals of syslog or syslog-ng very well yet... I've always just used the default configuration and left things alone... Thanks in advance, Brad

1 0

$HOST Variable in syslog-ng.conf
by Mike Kelland 30 Oct '01

30 Oct '01

When syslog-ng recieves a tcp syslog from another host, it tags the front of the message with '127.0.0.1/127.0.0.1/' before the host ip that the message actually came from. It also makes the host variable for that message '127.0.0.1' instead of the host the message actually came from. So if I'm logging all messages from syslog-ng to a file called $HOST.txt, all of my tcp syslog messages (ie messages coming from another syslog-ng) are logged to 127.0.0.1.txt . Does anyone know of a workaround to this problem? Thanks, Mike

1 0

syslog-ng's matching vs a perl-regex match
by Seth Vidal 30 Oct '01

30 Oct '01

Hi all, I am using syslog-ng version 1.4.12 on red hat linux 7.1. I have been doing some matches to get certain events out of my logs and have certain programs react to them. I was wondering if it would be faster to pipe ALL output to a perl script and have it do its own regex matching. I'm not sure how fast syslog-ng's matching is and if I take a performance hit by using it. thanks -sv

3 2

Chroot syslog-ng
by Jerome Poggi 29 Oct '01

29 Oct '01

Did somebody have any experiences of chroot syslog-ng on Linux or other operating system ? Thanks, -- Jerome POGGI Jerome.Poggi(a)hsc.fr Herve Schauer Consultants -=- Consultant en sécurité informatique http://www.hsc.fr/ Tel : +33 141 409 700

2 1

Linelength problems..
by Robert Glad 29 Oct '01

29 Oct '01

Hello all, I have a problem with syslog-ng that is quite strange. We have been running syslog-ng for a while now, it has worked fine but today i noticed one thing that is not that good at all. It seems like when loglines get too long, syslog-ng just truncates them. I looked around in the sources and found a define in syslog-ng.h, MAX_LOG_LINE. I boosted it up to 4096, recompiled, deployed the new binary but the problem remains.. Any ideas? Regards.. Robert

2 1

Syslog-ng's memory footprint growing constantly on DEC alpha
by Wim-Jan Hilgenbos 29 Oct '01

29 Oct '01

Hi, I have quite a lot of trouble with syslog-ng. More specific with the memory footage. It grows within a day to a size of over 130M after which it stops logging except for its own internal messages and then a short time later it dies. I have tried all kinds of combinations of compilers/compiler options. motivated in part by the unaligned messages and the former emails on this list. I'm able to get rid of the analigned access messages by using the native compiler, but I can't get a stable memory-size. My idea is that log messages are only partially freed. When I look at the core I see a lot of 'tails of logmessages' varying in length from 2 to 15 chars. The whole application becomes more stable and grows slower when I use the '-taso' option of the native compiler, which directs the loader to load the modules in 31-bit address space. Debug output shows a stable number of Objects in memory, around 290. I've used serveral versions: 1.4.8, 1.4.12, 1.4.13, 1.5.7, 1.5.10, 1.5.11 and probably some more (I'm not at my workstation now ;-< We use Compaq True64. The message load of the appl. we're develloping is rather high so we use syslog-ng exclusively for that application. We don't use NIS+. Does anyone have any solutions? Thnx in advance. Wim-Jan Hilgenbos

2 2

Syslog-ng Log Files
by Denis Doublet 29 Oct '01

29 Oct '01

Hi, With syslog-ng, is there anyway to take the facility, level,date,hostname in the log message ? We log in a fifo file, and without facility end level, the message log can't be sorted, every messages have the same form. We tried many syntaxes, like destination probe_netcool { pipe("/var/adm/netcool_pipe"); "$LEVEL" }; or destination probe_netcool { pipe("/var/adm/netcool_pipe"); '$LEVEL' }; and many others, but every syntax we tried generated a "Syntax error reading config file, using old configuration" message. I must avoid syntax like : destination probe_netcool { file("/var/adm/$HOST.log"); }; because only one fifo can be scanned (question of licences..) Thank you Denis

1 0

solaris 8 x86 errors
by Nate Campi 26 Oct '01

26 Oct '01

I'm running syslog-ng 1.4.14 on a solaris 8 x86 box, logging over TCP to another syslog-ng loghost. I'm getting this error sporadically: pkt_buffer::do_flush(): Error flushing data Is this anything to worry about? All I see on this is a patch from 1999: http://lists.balabit.hu/pipermail/syslog-ng/1999-December/000376.html -- Nate Campi <nate(a)campin.net> www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 A mathematician is an engine for converting coffee into theorems.

2 2

RE: [syslog-ng]deleting log files - syslog-ng]
by Christian Hammers 26 Oct '01

26 Oct '01

Hello On Fri, Oct 26, 2001 at 12:11:48PM +0200, Thomas Kaehn wrote: > cp /some/where/file.log /some/where/old/file.log.old > cp /dev/null /some/where/file.log > This way, file still exists and file descriptos are not closed. > However, this is not atomic, one might lose logged lines before > file is truncated. Better idea: mv logfile logfile.old kill -WHATEVER syslog-ng This way it would continue writing into the moved file until I restart it which would flush buffers, close the file and then crate a new one. But a fstat() call at each write would be a more elegant solutuion if it doesn't slow down writing too much. > -MNi bye, -christian- -- Christian Hammers WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 ch(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

4 3

deleting log files - syslog-ng
by Thomas Kaehn 26 Oct '01

26 Oct '01

Hello, is it possible that I have to restart syslog-ng, when deleting a log file? I log from different hosts to different files using $HOST in the config-file. If I delete one file of them it is not created until restarting syslog-ng. Is it possible to change this behaviour. Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

3 2