- syslog-ng - lists.balabit.hu

syslog-ng 1.5.12 and use_time_recvd()
by Jon Bidinger 26 Oct '01

26 Oct '01

I'm using syslog-ng as a syslogd replacement for a centralized log server. I'm also monitoring the logs using swatch. One of the options for swatch is to throttle messages that are repeating over a period of time. The problem I'm having is that I have servers over many different timezones logging to the log server. This seems to confuse swatch since it can't tell which machine is in which timezone. After reading the docs for syslog-ng, use_time_recvd()seemed like the perfect option. However, after putting it in my options, the output doesn't change. Am I doing something wrong or is there a problem with this feature? from my /etc/syslog-ng/syslog-ng.conf options { sync(0); time_reopen(10); log_fifo_size(100); use_time_recvd(yes); }; Thanks, - Jon =============================================================== Jon Bidinger Email: jpb(a)fairisaac.com

3 2

syslog-ng crash
by Thomas Kaehn 26 Oct '01

26 Oct '01

Hello, syslog-ng crashes several times per hour. I get the following error message: ol_object_check: Type error! What is the possible cause of this problem? Is there a possibility to fix it? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

2 2

Fw: [syslog-ng]logger, locales and syslog-ng
by todd glassey 26 Oct '01

26 Oct '01

----- Original Message ----- From: "Gregor Binder" <gb(a)rootnexus.net> Sent: Thursday, October 25, 2001 6:56 AM Subject: Re: [syslog-ng]logger, locales and syslog-ng > Thomas Kaehn on Thu, Oct 25, 2001 at 03:04:04PM +0200: > > > Is it possible to configure syslog-ng that it does > > not look at the date of the incoming log packet? > > use_time_recvd(yes) .. see documentation. Bazsi - Can we create a timestamp_recvd(yes) parameter that digitally timestamps, hashes and signs the timestamps with MD5 and SHA-1/2 routines? Todd > > -- > ____ ____ > / _/| - > Gregor Binder <gb(a)(rootnexus.net|sysfive.com)> > | / || _\ \ > \__ Id: 0xE2F31C4B Fp: 8B8A 5CE3 B79B FBF1 5518 8871 0EFB AFA3 E2F3 1C4B > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

5 6

logger, locales and syslog-ng
by Thomas Kaehn 25 Oct '01

25 Oct '01

Hi, when trying to log to different files, by using the following configuration entry, syslog-ng does not handle all date information correctly. destination syslog { file("/var/log/syslog-$YEAR-$MONTH-$DAY" owner("root") group("adm") perm(0640)); }; If the environment-variable LC_ALL is set to de_DE logger produces a german-language output and syslog-ng logs the message to /var/log/syslog-2000-12-31. Is it possible to configure syslog-ng that it does not look at the date of the incoming log packet? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

2 2

RE: [syslog-ng]Syslog-ng overflow issue
by Clausing, James A (Jim), SOBUS 23 Oct '01

23 Oct '01

I've just noticed this problem when there is a \n embedded in the message, too (in 1.5.10). The stock Solaris syslog, keeps the \n and following string in the same log entry, syslog-ng is splitting it into a new entry and then concatenating the next message onto it. ---Jim Solaris syslogd: ---------------- Oct 23 13:28:41 altiga1 32467 10/23/2001 13:28:43.020 SEV=4 IKE/119 RPT=859 a.b.c.d Group [employee] User [e002808]\nPHASE 1 COMPLETED syslog-ng: ---------- Oct 23 12:29:04 altiga2 4851 10/23/2001 12:29:03.800 SEV=4 IKE/119 RPT=90 e.f.g.h Group [employee] User [e008694] Oct 23 12:29:04 altiga2 PHASE1 COMPLETED<149>4853 10/32/2001 12:29:03.800 SEV=5 IKE/25 RPT=262 e.f.g.h Group [employee] User [e008694] Received remote Proxy Host data in ID Payload: Address 192.168.0.191, Protocol 0, Port 0 -----Original Message----- From: todd glassey [mailto:todd.glassey@worldnet.att.net] Sent: Monday, October 15, 2001 6:42 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Syslog-ng overflow issue Or replicate the previous header and open a new line for this message content - which seems like it would be a whole lot more useful... T. ----- Original Message ----- From: "Mike Kelland" <MKelland(a)jetnet.ca> To: <syslog-ng(a)lists.balabit.hu> Sent: Monday, October 15, 2001 1:11 PM Subject: [syslog-ng]Syslog-ng overflow issue > I'm having a problem where if a syslog message is sent to syslog-ng which > exceeds a certain length, the piece of the message which was truncated off > the end is appended to the beginning of the next message sent. Is there a > way to cause syslog-ng to instead simply loose this truncated piece? > > Thanks, > Mike Kelland > > > <<...OLE_Obj...>> > Michael Kelland > Internetworking Applications Engineer > 333 Preston Street, 3rd Floor, > Ottawa, Ontario. K1S 5N4 > Ph. (613) 237-5995, ext 248 > Fax(613) 237-9002 > www.JETNET.ca > mkelland(a)JETNET.ca > > This communication contains confidential information intended solely for the > use of the individual/s and/or entity or entities to whom it was intended to > be addressed. If you are not the intended recipient, be aware that any > disclosure, copying, distribution or use of the contents of this > transmission is prohibited. If you have received this communication in > error, please contact the sender immediately, delete the communication from > your system and do not disclose its contents to any third party or use its > contents. Any opinions expressed are soley those of the author and do not > necessariy represent those of JETNET Internetworking Services Inc. unless > otherwise specifically stated. > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

type error fix
by Balazs Scheidler 23 Oct '01

23 Oct '01

Hi, The patch below hopefully fixes the "Type Error" problems reported in 1.5.12. I'd appreciate feedback whether it really fixes the bug. (if it does, expect a new version shortly) Thanks for the cooperation for those who helped me to track this issue. diff -urN syslog-ng-1.5.12/src/affile.c syslog-ng-1.5.12-fixed/src/affile.c --- syslog-ng-1.5.12/src/affile.c Sat Oct 20 15:03:59 2001 +++ syslog-ng-1.5.12-fixed/src/affile.c Mon Oct 22 21:22:18 2001 @@ -118,7 +118,7 @@ struct resource_node *res; lseek(fd, 0, SEEK_END); - self->src = io_read(make_io_fd(cfg->backend, fd, self->name), + self->src = io_read(make_io_fd(cfg->backend, fd, ol_string_use(self->name)), make_log_reader(0, c), NULL); res = REMEMBER_RESOURCE(cfg->resources, &self->src->super.super); @@ -218,7 +219,7 @@ self->owner->flags & AFFILE_CREATE_DIRS, &fd)) { self->dest = - io_write(make_io_fd(cfg->backend, fd, self->expanded_fname), + io_write(make_io_fd(cfg->backend, fd, ol_string_use(self->expanded_fname)), make_pkt_buffer_ext(self->owner->sync_freq, MAX(self->owner->super.log_fifo_size + 1, self->owner->sync_freq)), -- Bazsi

2 1

asyncronous logging
by Allen Bettilyon 22 Oct '01

22 Oct '01

Hello, I was wondering if syslog-ng supported asyncronous logging. Much like the "-" option of standard syslog: mail.* -/var/log/maillog -- Allen Bettilyon

2 3

Problem after HANGUP signal
by Jerome Poggi 21 Oct '01

21 Oct '01

I use Syslog-NG 1.5.11 on Linux 2.4.10 and when I send HANGUP signal to syslog-ng, I never seen the stats info more. For having it more long time, I must kill and restart syslog-ng. Is it a bug ? Jerome.

3 4

syslog-ng 1.5.12
by Balazs Scheidler 21 Oct '01

21 Oct '01

Hi, I've released syslog-ng 1.5.12 fixing a couple of bugs. Here's the NEWS entry: News for the 1.5.12 release Sun, 21 Oct 2001 13:03:53 +0200 Couple of bug fixes: * a bug in libol causing problems on PPC was found * fixed pipe chmod() problems * fixed problem with losing log sources during SIGHUP I don't plan to add any new features to this branch of syslog-ng, and plan to release 1.6 as soon as this branch stabilizes. I received reports that there's a crash bug in syslog-ng 1.5.11 (the type error problem) I was unable to reproduce it, but one of the fixes might affect it, so those who encountered this bug, _please_ try this release, and if the bug occurs, send me a syslog-ng -dv output (with --with-debug configure option for both libol and syslog-ng) Thanks. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

syslog-ng 1.5.11
by Balazs Scheidler 21 Oct '01

21 Oct '01

Hi, I released syslog-ng 1.5.11, which hopefully fixes the SIGKILL problem you might have encountered earlier. No further changes for now. The tarball is available at the usual places: http://www.balabit.hu/en/products/syslog-ng (I also updated 1.4.x related links, the webpage is being reorganized and that's why we didn't update the pages for so long. But since the new version is not yet ready I now updated the old pages) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 4

syslogd to syslog-ng
by Dustin H 19 Oct '01

19 Oct '01

in normal syslog i use *.=info;*.=notice;*.=debug;*.warn /dev/tty12 to have it dump to tty12 how can i do that in syslog-ng ?

2 1

Question on match() expression
by Antai Ning 19 Oct '01

19 Oct '01

Hi there, I know I shouid search the archive first before I ask. So I did that and here is the question that I haven't found an answer... I want to create a filter to capture certain messages from syslog. The message I want to match is something like this: "[out-proxy]: tcp from 192.168.10.28-3933 to 216.191.40.60-80 established". I tried 1. match("\[out-proxy\]: .*tcp from .* to .*-80 established"); 2. match("\[out-proxy]: .*tcp from .* to .*-80 established"); 3. match("[out-proxy]: .*tcp from .* to .*-80 established"); 4. match(".*out-proxy.*: .*tcp from .* to .*-80 established"); Only #4 works. It seems that it doesn't understand "[" and "]" and esc"\". I want a exact match for "[out-proxy]" anyway. So how to do that? Thanks in advance! Andy Internetworking Applications Engineer JETNET InternetWorking Services Inc. Email : aning(a)jetnet.ca Web : http://www.jetnet.ca Phone : (613) 237-5995 x 369 Fax : (613) 271-6229

1 0

syslog-ng 1.4.14 released
by Balazs Scheidler 19 Oct '01

19 Oct '01

Hi, I've released syslog-ng 1.4.14 which fixes a quite important problem with regard to local messages. NEWS entry follows: News for the 1.4.14 release Fri, 19 Oct 2001 14:45:12 +0200 Fixed a problem causing opened unix domain sessions to drop during SIGHUP. This new version can be found at: http://www.balabit.hu/en/products/syslog-ng -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]fully qualified hostname help
by Dawson, Kevin 19 Oct '01

19 Oct '01

Ugh...no. Can't it use DNS to resolve? I had use_dns(yes) set but it didn't work either. The number of hosts I'd have to add to /etc/hosts would be significant as we are relaying from *a bunch* of boxes to a central collection point. Kevin. -----Original Message----- From: Allen Bettilyon [mailto:allen@about-inc.com] Sent: Thursday, October 18, 2001 3:20 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]fully qualified hostname help Do you have the hosts listed in /etc/hosts? -- Allen "Dawson, Kevin" wrote: > I'm sure this has been asked a thousand times before (although I couldn't > find it in the archives), but here it goes. My options line reads: > > options { sync(0); time_reopen(10); log_fifo_size(100); long_hostnames(yes); > chain_hostnames(yes); }; > > I'm running version 1.4.12 on Solaris and the problem is my messages are > still listing the short hostname. Any thoughts on this? > > Best Regards, > Kevin. > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

RE: [syslog-ng]fully qualified hostname help
by Dawson, Kevin 19 Oct '01

19 Oct '01

Allen- Thanks a ton for the help. This fixes the problem - or more specifically my lack of knowledge. Now it's off to update all the hosts...where's the coffee! Best Regards, Kevin. -----Original Message----- From: Allen Bettilyon [mailto:allen@about-inc.com] Sent: Thursday, October 18, 2001 3:51 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]fully qualified hostname help Yes, it can use dns. I was just asking if you ALSO had the hosts listed in your /etc/hosts file. If you did, than it would ask that first. I actually relay about 80 boxes to my loghost, and I prefer having them all listed in /etc/hosts. This way, if dns falls down, my logs still retain hostnames. I think the option your looking for is: use_fqdn (yes); -- Allen "Dawson, Kevin" wrote: > Ugh...no. Can't it use DNS to resolve? I had use_dns(yes) set but itss > didn't work either. The number of hosts I'd have to add to /etc/hosts would > be significant as we are relaying from *a bunch* of boxes to a central > collection point. > > Kevin. > > -----Original Message----- > From: Allen Bettilyon [mailto:allen@about-inc.com] > Sent: Thursday, October 18, 2001 3:20 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]fully qualified hostname help > > Do you have the hosts listed in /etc/hosts? > > -- Allen > > "Dawson, Kevin" wrote: > > > I'm sure this has been asked a thousand times before (although I couldn't > > find it in the archives), but here it goes. My options line reads: > > > > options { sync(0); time_reopen(10); log_fifo_size(100); > long_hostnames(yes); > > chain_hostnames(yes); }; > > > > I'm running version 1.4.12 on Solaris and the problem is my messages are > > still listing the short hostname. Any thoughts on this? > > > > Best Regards, > > Kevin. > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]fully qualified hostname help
by Dawson, Kevin 18 Oct '01

18 Oct '01

Actually both - the remote hosts are running syslog-ng as well with the exception of the routers which simply spit out messages w/o a syslog daemon. BTW, the syslogd daemon was able to resolve the full hostname without any entries in the /etc/hosts file. I changed to syslog-ng...no full hostnames. -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Thursday, October 18, 2001 2:45 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]fully qualified hostname help Also, are you referring to locally generated syslog messages or ones from remote hosts? The difference is important. On Thu, Oct 18, 2001 at 03:19:47PM -0700, Allen Bettilyon wrote: > Do you have the hosts listed in /etc/hosts? > > -- Allen > > "Dawson, Kevin" wrote: > > > I'm sure this has been asked a thousand times before (although I couldn't > > find it in the archives), but here it goes. My options line reads: > > > > options { sync(0); time_reopen(10); log_fifo_size(100); long_hostnames(yes); > > chain_hostnames(yes); }; > > > > I'm running version 1.4.12 on Solaris and the problem is my messages are > > still listing the short hostname. Any thoughts on this? -- Nate Campi <nate(a)campin.net> GnuPG key: 0xC17AEF79 http://www.campin.net But, for my own part, it was Greek to me. -- William Shakespeare, "Julius Caesar" _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

fully qualified hostname help
by Dawson, Kevin 18 Oct '01

18 Oct '01

I'm sure this has been asked a thousand times before (although I couldn't find it in the archives), but here it goes. My options line reads: options { sync(0); time_reopen(10); log_fifo_size(100); long_hostnames(yes); chain_hostnames(yes); }; I'm running version 1.4.12 on Solaris and the problem is my messages are still listing the short hostname. Any thoughts on this? Best Regards, Kevin.

3 2

How to use Macros in file() ?
by Denis Doublet 17 Oct '01

17 Oct '01

Hello, Currently using syslog-ng 1.5.9 on Solaris, I would to see in the generated logs, the Facility and criticity of each line. Could you give me an example of the usage of macros in filename? The documentation is quite light about this subject. Thanks for your help. Denis

1 0

Syslog-ng overflow issue
by Mike Kelland 16 Oct '01

16 Oct '01

I'm having a problem where if a syslog message is sent to syslog-ng which exceeds a certain length, the piece of the message which was truncated off the end is appended to the beginning of the next message sent. Is there a way to cause syslog-ng to instead simply loose this truncated piece? Thanks, Mike Kelland <<...OLE_Obj...>> Michael Kelland Internetworking Applications Engineer 333 Preston Street, 3rd Floor, Ottawa, Ontario. K1S 5N4 Ph. (613) 237-5995, ext 248 Fax(613) 237-9002 www.JETNET.ca mkelland(a)JETNET.ca This communication contains confidential information intended solely for the use of the individual/s and/or entity or entities to whom it was intended to be addressed. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this transmission is prohibited. If you have received this communication in error, please contact the sender immediately, delete the communication from your system and do not disclose its contents to any third party or use its contents. Any opinions expressed are soley those of the author and do not necessariy represent those of JETNET Internetworking Services Inc. unless otherwise specifically stated.

2 1

problems with receiving messages from other host
by Michael Wahlbrink 15 Oct '01

15 Oct '01

hi, I'm trying to install a linux loghost (running syslog-ng) which should collect the log-messages of the other linuxboxes in our dmz. The problem is that if on the other pcs also the syslog-ng is running the loghost seems not to receive any messages fom the other pcs. On one box I've tried to install the 'original' syslog and I received the messages .......... So here are the important Parts of my config files: the loghost: options { long_hostnames(on); sync(0); create_dirs(yes); }; ##################################################################### # Direct all local messages to the source s_local ##################################################################### source s_local { unix-stream("/dev/log"); internal(); }; ##################################################################### # Accept all messages from dmz.testlan.propack-data.de # and direct them to the source s_net_dmz.bw ##################################################################### source s_net_dmz.testlan { udp(ip(123.45.67.89) port(514)); }; ##################################################################### # Print all messages from swan (local) on tty10 ##################################################################### destination d_console10 { file("/dev/tty10"); }; log { source(s_local); destination(d_console10); }; ##################################################################### # Log all messages to /var/log/messages ##################################################################### destination messages { file("/var/log/messages" owner(root) group(root) perm(0640) dir_perm(0755)); }; log { source(s_local); source(s_net_dmz.testlan); destination(messages); }; the other host: ##################################################################### # define options for syslog ##################################################################### options { long_hostnames(on); sync(0); }; ##################################################################### # define the source pipe for all local messages ##################################################################### source src { unix-stream("/dev/log"); internal(); }; ##################################################################### # print all messages on tty10 ##################################################################### destination console { file("/dev/tty10"); }; log { source(src); destination(console); }; ##################################################################### # send all messages to the loghost loghost.testlan.propack-data.de ##################################################################### destination loghost { udp("123.45.67.89" port(514)); }; log { source(src); destination(loghost); }; I hope you can help me with my problem ;-) and sorry for my bad english thanx micha

1 0

Outputting UTC time strings?
by Rory Toma 13 Oct '01

13 Oct '01

For the life of me, I can't seem to find out where msg->date gets set. I changed destinations.c to only use "%s" in strftime, but it only affects the startup syslog message, not the other messages. Where do I make the change to use UTC time instead of the time string that it currently uses? -- Rory Toma rory(a)colinburns.com Game Master http://www.colinburns.com Colin Burns Games

1 0

filter problem: level()
by Michael D. (Mick) Bauer 11 Oct '01

11 Oct '01

Hi, all. I've got a puzzling problem (to me ;-) with the level() function in my syslog-ng.conf file. I'm using a filter whose sole criterion is level(debug .. alert); as a sort of "catch-all" filter. But if I send syslog-ng eight messages, each with a different priority (i.e., one of each level), only the ones with levels "crit," "alert," and "emerg" get logged. But wait! Those "emerg" messages shouldn't be making it past the filter! What *on earth* is going on here? (Could it be some sort of weirdness between logger & syslog-ng?) Here's my config file, etc.: # begin syslog-ng.conf options { long_hostnames(off); sync(0); }; source src { unix-dgram("/dev/log"); internal(); }; destination d_local { file("/var/log/messages"); }; filter f_mick { level(debug .. alert); }; log { source(src); filter(f_mick); destination(d_local); }; # end syslog-ng.conf # begin bash-commands (logger) to test above config curious-george:/etc/init.d# for i in {debug,info,notice,warning,err,crit,alert, emerg} >do >logger -p auth.$i "Priority level $i" >echo "Priority level $i" >done Priority level debug Priority level info Priority level notice Priority level warning Priority level err Priority level crit Priority level alert Priority level emerg # end bash-commands & output # begin excerpt from /var/log/messages Sep 5 00:13:04 curious-george darthelm: Priority level crit Sep 5 00:13:04 curious-george darthelm: Priority level alert Sep 5 00:13:04 curious-george darthelm: Priority level emerg # end excerpt TIA, Mick /=============================\ | Michael D.(Mick) Bauer | | Network Security Consultant | | St. Paul, Minnesota (USA) | | mick<at>visi.com | \=============================/

2 2

Macro Substitution
by Jeremy Shaffner 11 Oct '01

11 Oct '01

Howdy, I'm currently using a template to output logs to a pipe for importing into a DB. Is it possible to isolate a portion of the $MSG macro using regexps? Such that it equates to: echo $MSG | sed 's/denied ip $1.1.1.1$ -> $2.2.2.2$/\1 \2/' I'm trying to put the IPs in their own column in the table. Thanks, -- -Jeremy

2 3

syslog-ng.conf.RedHat
by James Riordan 11 Oct '01

11 Oct '01

Howdy- I think that there might be an inconsistency between the behavior determined by syslog.conf and that by syslog-ng.conf.RedHat (from syslog-ng-1.4.12.tar.gz and syslog-ng-1.5.9.tar.gz). The stock syslog.conf file sends a message to /var/log/messages if it is of level info or higher unless it comes from facility mail, authpriv, or cron: # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages whereas, if I understand it correctly, the relevant lines from syslog-ng.conf.RedHat destination d_mesg { file("/var/log/messages"); }; filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; send a message to /var/log/messages if it is exactly of level info, or if it comes from facility mail or authpriv. I am not sure about the the internals of filter evaluation (is it lazy?) so as to write the fastest rule but filter f_filter2 { not level(debug) and not (facility(mail) or facility(authpriv) or facility(cron)); }; seems to work. Also, thanks for such a nice package. Regards, james -- Dr. James Riordan email: rij(a)zurich.ibm.com IBM Research notes: James Riordan/Zurich/IBM Säumerstrasse 4 Tel +41 (0) 1 724 89 81 CH-8803 Rüschlikon, Switzerland Fax +41 (0) 1 724 89 53

1 0

Fields defined in the logs
by Denis Doublet 10 Oct '01

10 Oct '01

> Hello, > > Using syslog-ng 1.5.9 on Solaris 7 and Solaris 8, > I would like to see logs containing the facility, level.... > I can't find how to add these fields to logs. > > Best Regards > > Denis

1 0

RE: [syslog-ng]Mystic crashes of 1.5.10
by Nicholas Berry 10 Oct '01

10 Oct '01

I too am having the same issue with crashing under Solaris 8 with syslog-ng 1.5.10, but my crashes happen several hours between each other. _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048 -----Original Message----- From: Andreas Schulze [mailto:Andreas.Schulze@mediaWays.NET] Sent: Wednesday, October 10, 2001 6:01 AM To: syslog-ng list Subject: [syslog-ng]Mystic crashes of 1.5.10 Hello Bazsi, thanks a lot for the stats() feature in the new version. But unfortunately 1.5.10 crashes a few minutes after starting. We are running your software on SUN Solaris 8 boxes. I read about a similiar problem with Linux boxes some weeks ago in this list. For your convenience the backtrace is attached. The calling deps between #17 and #1 can differ in each core. But it crashed _always_ in __sigprocmask () from /usr/lib/libthread.so.1 And it crashed _always_ by receiving SIGKILL. Seems a little bit mystic for me, because I don't know why and who's sending the SIGKILL. Coredumps by SIGSEGV are more familiar to me :) Thx. for a fast fix --Andreas > root@host [/root] >>gdb /usr/sbin/syslog-ng.1.5.10 core > GNU gdb 5.0 > Copyright 2000 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public License, and > you are welcome to change it and/or distribute copies of it under > certain conditions. Type "show copying" to see the conditions. There > is absolutely no warranty for GDB. Type "show warranty" for details. > This GDB was configured as "sparc-sun-solaris2.8"... > > Core was generated by `/usr/sbin/syslog-ng.1.5.10 -v -f > /etc/syslog-ng/syslog-ng.conf'. Program terminated with signal 9, > Killed. Reading symbols from /usr/lib/libpthread.so.1...done. Loaded > symbols for /usr/lib/libpthread.so.1 Reading symbols from > /usr/lib/libdoor.so.1...done. Loaded symbols for /usr/lib/libdoor.so.1 > Reading symbols from /usr/lib/libl.so.1...done. > Loaded symbols for /usr/lib/libl.so.1 > Reading symbols from /usr/lib/libsocket.so.1...done. > Loaded symbols for /usr/lib/libsocket.so.1 > Reading symbols from /usr/lib/libnsl.so.1...done. > Loaded symbols for /usr/lib/libnsl.so.1 > Reading symbols from /usr/lib/libxnet.so.1...done. > Loaded symbols for /usr/lib/libxnet.so.1 > Reading symbols from /usr/lib/libc.so.1...done. > Loaded symbols for /usr/lib/libc.so.1 > Reading symbols from /usr/lib/libdl.so.1...done. > Loaded symbols for /usr/lib/libdl.so.1 > Reading symbols from /usr/lib/libmp.so.2...done. > Loaded symbols for /usr/lib/libmp.so.2 > Reading symbols from /usr/platform/SUNW,UltraSPARC-IIi-cEngine/lib/libc_psr.so.1...done. > Loaded symbols for /usr/platform/SUNW,UltraSPARC-IIi-cEngine/lib/libc_psr.so.1 > Reading symbols from /usr/lib/libthread.so.1...done. > Loaded symbols for /usr/lib/libthread.so.1 > #0 0xff0d9a04 in __sigprocmask () from /usr/lib/libthread.so.1 > (gdb) bt > #0 0xff0d9a04 in __sigprocmask () from /usr/lib/libthread.so.1 > #1 0xff0ce460 in _resetsig () from /usr/lib/libthread.so.1 > #2 0xff0cdc00 in _sigon () from /usr/lib/libthread.so.1 > #3 0xff0d0c14 in _thrp_kill () from /usr/lib/libthread.so.1 > #4 0xff14afe8 in raise () from /usr/lib/libc.so.1 > #5 0xff1357c4 in abort () from /usr/lib/libc.so.1 > #6 0x29324 in do_object_queue_mark () > #7 0x29d50 in ol_object_check () > #8 0x1f70c in do_handle_dest_writer (c=0x9ffc0, msg=0x60314) at affile.c:247 > #9 0x20c90 in do_handle_affile_log (c=0x4a7d0, msg=0x60314) at affile.c:738 > #10 0x1866c in do_handle_log (c=0x4a8d8, msg=0x60314) at destinations.c:103 > #11 0x17374 in do_distribute_log (c=0x47020, msg=0x60314) at center.c:149 > #12 0x169a8 in do_add_source_name (c=0x4a748, logmsg=0x60314) at sources.c:238 > #13 0x225e0 in do_handle_afinet_line (c=0x470c0, msg=0x60314) at afinet.c:107 > #14 0x160bc in do_handle_line (self=0x47108, length=110, > data=0x47120 "<189>121625: Oct 10 14:30:57 MESZ: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0:1, changed state to upolding time expiredired0 secondsws-gtso-de15) 2/6 (1)..net) 2/48 (1)..", addr=0xffbef518, addrlen=16) > at sources.c:67 > #15 0x162f4 in do_read_line (h=0x470a0, read=0xffbef6b8) at sources.c:105 > #16 0x27bc4 in read_callback () > #17 0x27870 in io_iter () > #18 0x153ac in main_loop (backend=0x42eb0) at main.c:174 > #19 0x15e8c in main (argc=4, argv=0xffbefb2c) at main.c:469 > (gdb) q > root@host [/root] >> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Feature request for stats() in 1.5.10
by Andreas Schulze 10 Oct '01

10 Oct '01

Hello Bazsi, thanks a lot for the stats() feature in the new version. Is it possible to break down the stats() output to the destination layer? I.e. generate stats() output per destination. It would be very useful, if it's possible to find out the destination that makes the 'dropping' problem. > STATS: dropped 234 on destination 'd_dest_1' > STATS: dropped 0 on destination 'd_dest_a' > STATS: dropped 34 on destination 'd_dest_x' > ... Thx. --Andreas

1 0

Mystic crashes of 1.5.10
by Andreas Schulze 10 Oct '01

10 Oct '01

Hello Bazsi, thanks a lot for the stats() feature in the new version. But unfortunately 1.5.10 crashes a few minutes after starting. We are running your software on SUN Solaris 8 boxes. I read about a similiar problem with Linux boxes some weeks ago in this list. For your convenience the backtrace is attached. The calling deps between #17 and #1 can differ in each core. But it crashed _always_ in __sigprocmask () from /usr/lib/libthread.so.1 And it crashed _always_ by receiving SIGKILL. Seems a little bit mystic for me, because I don't know why and who's sending the SIGKILL. Coredumps by SIGSEGV are more familiar to me :) Thx. for a fast fix --Andreas > root@host [/root] >>gdb /usr/sbin/syslog-ng.1.5.10 core > GNU gdb 5.0 > Copyright 2000 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public License, and you are > welcome to change it and/or distribute copies of it under certain conditions. > Type "show copying" to see the conditions. > There is absolutely no warranty for GDB. Type "show warranty" for details. > This GDB was configured as "sparc-sun-solaris2.8"... > > Core was generated by `/usr/sbin/syslog-ng.1.5.10 -v -f /etc/syslog-ng/syslog-ng.conf'. > Program terminated with signal 9, Killed. > Reading symbols from /usr/lib/libpthread.so.1...done. > Loaded symbols for /usr/lib/libpthread.so.1 > Reading symbols from /usr/lib/libdoor.so.1...done. > Loaded symbols for /usr/lib/libdoor.so.1 > Reading symbols from /usr/lib/libl.so.1...done. > Loaded symbols for /usr/lib/libl.so.1 > Reading symbols from /usr/lib/libsocket.so.1...done. > Loaded symbols for /usr/lib/libsocket.so.1 > Reading symbols from /usr/lib/libnsl.so.1...done. > Loaded symbols for /usr/lib/libnsl.so.1 > Reading symbols from /usr/lib/libxnet.so.1...done. > Loaded symbols for /usr/lib/libxnet.so.1 > Reading symbols from /usr/lib/libc.so.1...done. > Loaded symbols for /usr/lib/libc.so.1 > Reading symbols from /usr/lib/libdl.so.1...done. > Loaded symbols for /usr/lib/libdl.so.1 > Reading symbols from /usr/lib/libmp.so.2...done. > Loaded symbols for /usr/lib/libmp.so.2 > Reading symbols from /usr/platform/SUNW,UltraSPARC-IIi-cEngine/lib/libc_psr.so.1...done. > Loaded symbols for /usr/platform/SUNW,UltraSPARC-IIi-cEngine/lib/libc_psr.so.1 > Reading symbols from /usr/lib/libthread.so.1...done. > Loaded symbols for /usr/lib/libthread.so.1 > #0 0xff0d9a04 in __sigprocmask () from /usr/lib/libthread.so.1 > (gdb) bt > #0 0xff0d9a04 in __sigprocmask () from /usr/lib/libthread.so.1 > #1 0xff0ce460 in _resetsig () from /usr/lib/libthread.so.1 > #2 0xff0cdc00 in _sigon () from /usr/lib/libthread.so.1 > #3 0xff0d0c14 in _thrp_kill () from /usr/lib/libthread.so.1 > #4 0xff14afe8 in raise () from /usr/lib/libc.so.1 > #5 0xff1357c4 in abort () from /usr/lib/libc.so.1 > #6 0x29324 in do_object_queue_mark () > #7 0x29d50 in ol_object_check () > #8 0x1f70c in do_handle_dest_writer (c=0x9ffc0, msg=0x60314) at affile.c:247 > #9 0x20c90 in do_handle_affile_log (c=0x4a7d0, msg=0x60314) at affile.c:738 > #10 0x1866c in do_handle_log (c=0x4a8d8, msg=0x60314) at destinations.c:103 > #11 0x17374 in do_distribute_log (c=0x47020, msg=0x60314) at center.c:149 > #12 0x169a8 in do_add_source_name (c=0x4a748, logmsg=0x60314) at sources.c:238 > #13 0x225e0 in do_handle_afinet_line (c=0x470c0, msg=0x60314) at afinet.c:107 > #14 0x160bc in do_handle_line (self=0x47108, length=110, > data=0x47120 "<189>121625: Oct 10 14:30:57 MESZ: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0:1, changed state to upolding time expiredired0 secondsws-gtso-de15) 2/6 (1)..net) 2/48 (1)..", addr=0xffbef518, addrlen=16) > at sources.c:67 > #15 0x162f4 in do_read_line (h=0x470a0, read=0xffbef6b8) at sources.c:105 > #16 0x27bc4 in read_callback () > #17 0x27870 in io_iter () > #18 0x153ac in main_loop (backend=0x42eb0) at main.c:174 > #19 0x15e8c in main (argc=4, argv=0xffbefb2c) at main.c:469 > (gdb) q > root@host [/root] >>

1 0

RE: [syslog-ng]Disabling stats for syslog-ng
by Nicholas Berry 09 Oct '01

09 Oct '01

I was able to compile after defining PATH_SYSCONFDIR. This was not auto-generated when running ./configure, will this be fixed in the future or should I jot this down for future reference? -Nick -----Original Message----- From: Balazs Scheidler Sent: Tue 10/9/2001 2:31 AM To: syslog-ng(a)lists.balabit.hu Cc: Subject: Re: [syslog-ng]Disabling stats for syslog-ng On Thu, Oct 04, 2001 at 09:59:11AM -0700, Nicholas Berry wrote: > I have the GNU gcc 2.95.3, make, automake, autoconf, and libol 0.2.24 > > Here is the error I get after "./configure > --with-libol=/tmp/libol-0.2.24 && make" > gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.5.10/src -I. -g -O2 -Wall > -I/tmp/libol-0.2.24/src -D_GNU_SOURCE -c main.c > main.c:47: `PATH_SYSCONFDIR' undeclared here (not in a function) > main.c:47: parse error before string constant > main.c: In function `usage': > main.c:318: parse error before `PATH_SYSCONFDIR' > main.c: In function `main': > main.c:396: warning: passing arg 2 of `resolve_user_group' from > incompatible pointer type > main.c:396: warning: passing arg 3 of `resolve_user_group' from > incompatible pointer type > main.c:400: warning: passing arg 2 of `resolve_group' from incompatible > pointer type > *** Error code 1 > make: Fatal error: Command failed for target `main.o' is PATH_SYSCONFDIR defined in your config.h? (it is in mine) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Encrypted messages
by Forrest Aldrich 09 Oct '01

09 Oct '01

Where are the plans of implementing encrypted messaging/logging?

5 14

RE: [syslog-ng]Disabling stats for syslog-ng
by Nicholas Berry 09 Oct '01

09 Oct '01

I have the GNU gcc 2.95.3, make, automake, autoconf, and libol 0.2.24 Here is the error I get after "./configure --with-libol=/tmp/libol-0.2.24 && make" gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.5.10/src -I. -g -O2 -Wall -I/tmp/libol-0.2.24/src -D_GNU_SOURCE -c main.c main.c:47: `PATH_SYSCONFDIR' undeclared here (not in a function) main.c:47: parse error before string constant main.c: In function `usage': main.c:318: parse error before `PATH_SYSCONFDIR' main.c: In function `main': main.c:396: warning: passing arg 2 of `resolve_user_group' from incompatible pointer type main.c:396: warning: passing arg 3 of `resolve_user_group' from incompatible pointer type main.c:400: warning: passing arg 2 of `resolve_group' from incompatible pointer type *** Error code 1 make: Fatal error: Command failed for target `main.o' _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048 -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, October 04, 2001 9:26 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Disabling stats for syslog-ng On Thu, Oct 04, 2001 at 08:56:55AM -0700, Nicholas Berry wrote: > I could not get 1.5.10 to compile under Solaris 8. > > Is there a patch released to fix this? And what was the problem? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

filtering programs and subprograms
by Baltasar Cevc 06 Oct '01

06 Oct '01

Hi, everybody! I'm using Syslog-NG on a Linux server - as I like the great set of features it supports. Now I wonder if there is any possibility to filter the program name and the next field (e.g. "kernel" and is "IN="). I need this in order to separate the packet filter logs from the other kernel stuff. Thanx for help in advance. bye.baltasar ::: B A L T A S A R C E V C mailto: baltasar(a)cevc-topp.de Tel.: +49 89 99020515

2 1

Help on fine tunning/bottlenecks
by Huelbe Arizon Garcia 05 Oct '01

05 Oct '01

Hello, [First of all, I would like to apologize for the long message...] In our company, we have lots of Network Access Servers (aka NAS) which we would like to have syslog. We tried to use the original syslog packed with Linux and we found it was 'dropping' a lot of information. Then, we changed to syslog-ng a few months ago. The results are much better, but the logs are still incomplete. It seems to have some 'bottleneck': when I put an equipment sending logs both to my main syslog server (which runs syslog-ng and receives syslog from all NAS) and other box running only common syslog (receiving external syslog only from this equipment), this second Linux box gets much more information than the first one (almost twice more events/lines). Well, I would like to ask for some tips to find the bottleneck or some configuration fine-tunning. I'll appreciate all comments. Here is my scenario: Main log server: Linux 2.2.14-5.0 Intel Pentium II 450Mhz 64 Mbytes RAM hda: QUANTUM FIREBALL CR6.4A, 6149MB w/418kB Cache (System disk) IDE hdc: QUANTUM FIREBALLlct15 30, 28629MB w/418kB Cache (Log files disk) IDE The syslog-senders (NAS): There are about 70 NAS, each sending up to 15Mbytes/day (about 115.000 lines) of syslog messages. When the log file is cut/rotated (at midnight sharp), the log file has about 600Mbytes The syslog-ng Version 1.5.9 Options configured: options { long_hostnames(off); use_dns(no); log_fifo_size(10000); gc_busy_threshold(10000); gc_idle_threshold(500); }; After running syslog for 20 hours, 'top' shows: 9:35pm up 175 days, 14:48, 1 user, load average: 0.38, 2.28, 2.59 29 processes: 28 sleeping, 1 running, 0 zombie, 0 stopped CPU states: 3.3% user, 1.3% system, 0.0% nice, 95.2% idle Mem: 64104K av, 58496K used, 5608K free, 9852K shrd, 4800K buff Swap: 265032K av, 4304K used, 260728K free 42520K cached PID USER PRI NI SIZE RSS SHARE STAT LIB %CPU %MEM TIME COMMAND 21337 root 20 0 512 472 176 S 0 3.5 0.7 108:16 syslog-ng (The load average is a little higher than normal as I ran grep/wc commands to check some statistics in this mail) Regards, Huelbe Garcia.

1 0

RE: [syslog-ng]Disabling stats for syslog-ng
by Nicholas Berry 04 Oct '01

04 Oct '01

I could not get 1.5.10 to compile under Solaris 8. Is there a patch released to fix this? _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048 -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, October 04, 2001 3:58 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Disabling stats for syslog-ng On Wed, Oct 03, 2001 at 09:25:00AM -0700, Nicholas Berry wrote: > My log is flooded with messages like the one listed below: Oct 3 > 16:22:04 local@smf-syslog syslog-ng[364]: STATS: dropped 0 > > Can I disable this? upgrade to 1.5.10 -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Documentation
by Ohrberg, Mick 04 Oct '01

04 Oct '01

Hi all, Is there any new, fully updated documentation (or a will to create such) for syslog-ng? I think that some well-written documentation would alleviate a lot of the questions that have been raised here. I also believe that a FAQ of some sort would be helpful. *plink of $.02* /Mick

2 1

Disabling stats for syslog-ng
by Nicholas Berry 04 Oct '01

04 Oct '01

My log is flooded with messages like the one listed below: Oct 3 16:22:04 local@smf-syslog syslog-ng[364]: STATS: dropped 0 Can I disable this? Is there documentation that outlines _all_ available parameters for the various directives (options, file, log, etc)? _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048

2 1

Computer name
by Laurent 04 Oct '01

04 Oct '01

Hello, Is some one can tell me how can i have ip adresse instead of the computer's name in log files ? Thanks -- Best regards, Laurent mailto:lau@ovh.net

2 1

TCP/IP connection - server SIGHUP problem
by Roman Ernst 03 Oct '01

03 Oct '01

First of all: thanks for your help with my little TCP/IP connection-drop-determination-problem. Of course the idea using a monitoring software would solve the problem, but I think many people don't have / use such a tool... So... it should be possible to catch such an error by other means... Somebody wrote that i could figure out via "netstat -an | grep tcp ...." whether connection is okay or not. Unfortenately when plugging out the network cable AIX does not recognize this, i.e. with netstat -an the connection seems to be still available. Only the client tries to close the connection when he tries to send a log message and can't reach the log server (after TCP timeout...). So... the client isn't the problem. But the server never tries to send a package to the client... so he will never recognize whether the client is available or not. Maybe it would be useful to introduce some sort of TCP heartbeat (server sends some packages to the client every xxx minutes) . This way the server take care of unreachable clients and logs such problems... If I'm totally wrong with my opinion please let me know... Okay... another problem: Sending a SIGHUP to the syslog-ng client results in restarting syslog-ng on the client, dropping connection to server, reconnecting to the server and initializing the new configuration (=> that's what the server log says...) => is it really necessary to drop the connection? Sending a SIGHUP to the syslog-ng server results in restarting the syslog-ng on the server and initializing the new configuration (that's what the server log says...) => So far so good... now the problem. If the client tries to send messages to the server the following happens (CLIENT and SERVER LOG) AF_INET client connected from 10.x.x.1, port xxxxx (SERVER LOG) io.c: do_write: write () failed (errno 32), Broken pipe (CLIENT + SERVER LOG) pkt_buffer::do_flush(): Error flushing data (CLIENT + SERVER LOG) Connection broken to AF_INET 10.x.x.2, reopening in 10 seconds (CLIENT + SERVER LOG) AND: one log message is missing afterwards... Okay... that's it. Maybe someone can help me. Thanks in advance! Best regards Roman Ernst

2 1

Can't background syslog-ng
by Andrew Dixon 02 Oct '01

02 Oct '01

Hi All, I'm trying to get syslog-ng-1.5.10 up under a Linux system running on a powerpc. I can compile without errors and if I run: #syslog-ng -F syslog-ng version ` starting 7 so that syslog-ng doesn't background itself it works fine. When I try to back ground it though it fails: #syslog-ng -d io.c: Preparing fd 268600320 for io.c: Preparing fd 0 for reading syslog-ng version ` starting 7gc_mark: Marking object of class '8!' (1) !ÿøàSegmentation fault Has anyone else come across this? I straced syslog-ng and it complained about "Inappropriate ioctl for device" but I'm not sure which device it's trying to manipulate. Any help would be greatly appreciated and if anyone else is running syslog-ng on a PPC Linux system it'd be nice that it is possible. Thanks, Andy P.S. here's the strace: #strace ./syslog-ng execve("./syslog-ng", ["./syslog-ng"], [/* 23 vars */]) = 0 uname({sys="Linux", node="wolf", ...}) = 0 brk(0) = 0x100281f0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30015000 open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 4 SYS_197(0x4, 0x7fffedd8, 0x7fffedd8, 0x30027850, 0x7f7f7f7f) = 0 mmap(NULL, 24719, PROT_READ, MAP_PRIVATE, 4, 0) = 0x30016000 close(4) = 0 open("/lib/libnsl.so.1", O_RDONLY) = 4 read(4, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\0J0"..., 1024) = 1024 SYS_197(0x4, 0x7fffede0, 0x7fffede0, 0x30015280, 0x30027d50) = 0 mmap(0xffc9000, 157316, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0xffc9000 mprotect(0xffdb000, 83588, PROT_NONE) = 0 mmap(0xffe9000, 16384, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0x10000) = 0xffe9000 mmap(0xffed000, 9860, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffed000 close(4) = 0 open("/lib/libc.so.6", O_RDONLY) = 4 read(4, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\2\251"..., 1024) = 1024 SYS_197(0x4, 0x7fffedc0, 0x7fffedc0, 0x30015460, 0x30027d50) = 0 mmap(0xfe6b000, 1366404, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0xfe6b000 mprotect(0xff85000, 211332, PROT_NONE) = 0 mmap(0xff8b000, 167936, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0x110000) = 0xff8b000 mmap(0xffb4000, 18820, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffb4000 close(4) = 0 munmap(0x30016000, 24719) = 0 brk(0) = 0x100281f0 brk(0x10028240) = 0x10028240 brk(0x10029000) = 0x10029000 open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) = 4 brk(0x1002e000) = 0x1002e000 ioctl(4, TCGETS, 0x7ffff798) = -1 ENOTTY (Inappropriate ioctl for device) SYS_197(0x4, 0x7ffff288, 0x7ffff288, 0x100282e8, 0x10014904) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30016000 read(4, "#\n# Syslog-ng configuration file"..., 8192) = 5352 read(4, "", 4096) = 0 socket(PF_UNIX, SOCK_STREAM, 0) = 5 connect(5, {sin_family=AF_UNIX, path=" /var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory) close(5) = 0 open("/etc/nsswitch.conf", O_RDONLY) = 5 SYS_197(0x5, 0x7ffff238, 0x7ffff238, 0x1002cb88, 0x18) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 read(5, "# /etc/nsswitch.conf\n#\n# Example"..., 4096) = 465 read(5, "", 4096) = 0 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/ld.so.cache", O_RDONLY) = 5 SYS_197(0x5, 0x7fff3fb0, 0x7fff3fb0, 0x30027850, 0x7f7f7f7f) = 0 mmap(NULL, 24719, PROT_READ, MAP_PRIVATE, 5, 0) = 0x30017000 close(5) = 0 open("/lib/libnss_compat.so.2", O_RDONLY) = 5 read(5, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\0\35"..., 1024) = 1024 SYS_197(0x5, 0x7fff3fb8, 0x7fff3fb8, 0x1002cbc0, 0) = 0 mmap(0xfe3f000, 113332, PROT_READ|PROT_EXEC, MAP_PRIVATE, 5, 0) = 0xfe3f000 mprotect(0xfe4b000, 64180, PROT_NONE) = 0 mmap(0xfe4f000, 49152, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 5, 0) = 0xfe4f000 close(5) = 0 munmap(0x30017000, 24719) = 0 uname({sys="Linux", node="wolf", ...}) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 socket(PF_UNIX, SOCK_STREAM, 0) = 5 connect(5, {sin_family=AF_UNIX, path=" /var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory) close(5) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 brk(0x1002f000) = 0x1002f000 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 brk(0x10030000) = 0x10030000 brk(0x10031000) = 0x10031000 brk(0x10032000) = 0x10032000 read(4, "", 8192) = 0 ioctl(4, TCGETS, 0x7ffff258) = -1 ENOTTY (Inappropriate ioctl for device) close(4) = 0 munmap(0x30016000, 4096) = 0 pipe([4, 5]) = 0 fork() = 289 close(5) = 0 read(4, "\0", 1) = 1 exit(0) = ? -- Andrew Dixon Software Engineer Seranoa Networks 978.897.3434 x231

2 2

syslog-ng 1.4.13 on solaris 5.6 and 5.8
by Jasper Jans 02 Oct '01

02 Oct '01

Balazs, Thanks for the help. If I use the ip address instead of the FQDN it does work. Strange to see the other hosts do work with the FQDN. Oh well - it's fixed. Jasper 4:58pm up 20 day(s), 20:52, 21 users, load average: 0.10, 0.12, 0.16

1 0

syslog-ng 1.4.13 on solaris 5.6 and 5.8
by Jasper Jans 02 Oct '01

02 Oct '01

Config file looks like this: jans01@mimas:/etc/local/syslog-ng-1.4.13/etc$ cat syslog-ng.conf # SYSLOG-NG Configuration File # # SSDC GENERIC 2001.06.22.00 options { long_hostnames (off) ; use_dns (no) ; use_fqdn (yes) ; keep_hostname (yes) ; chain_hostnames (no) ; } ; source syslog { sun-streams ("/dev/log" door ("/etc/.syslog_door")) ; internal () ; } ; destination d_loghost { tcp (host.domain.net port(514)) ; } ; destination d_messages { file ("/var/adm/messages") ; } ; filter f_messages { level (error) or facility (auth, kern) and level (notice) or facility (mail) and level (crit) ; } ; log { source (syslog) ; filter (f_messages) ; destination (d_messages) ; } ; log { source (syslog) ; destination (d_loghost) ; } ; nslookup on the syslog host works: ---- jans01@mimas:/etc/local/syslog-ng-1.4.13/etc$ nslookup host.domain.net Server: xxxxxx.xxxxx.xxxxx Address: xxx.xxx.xxx.xxx Name: xxxxxxxx.xxxxxxx.xxxxxx Address: xxx.xxx.xxx.xxx Aliases: host.domain.net ---- Hope this helps. Btw - I use this same configuration file on all the other hosts that do work as well. J.

2 1

syslog-ng 1.4.13 on solaris 5.6 and 5.8
by Jasper Jans 02 Oct '01

02 Oct '01

Hi, I'm running syslog-ng on Solaris machines. So far I have two machines with will not start syslog-ng properly. ----- root@mimas:/etc/local/syslog-ng-1.4.13/etc$ /etc/init.d/syslog-ng start Starting Syslog-NG Error creating AF_INET socket (Error 0) Error initializing configuration, exiting. root@mimas:/etc/local/syslog-ng-1.4.13/etc$ uname -a SunOS mimas 5.6 Generic_105181-23 sun4u sparc SUNW,Ultra-80 ----- The Solaris 5.8 machine has the same problem. Funny thing is - other Solaris 5.8 machines do run syslog-ng just fine. Idea's anyone? Thanks, Jasper 12:07pm up 20 day(s), 16:01, 20 users, load average: 0.14, 0.14, 0.13

2 2

syslog-ng 1.4.13 on solaris 5.6 and 5.8
by Jasper Jans 02 Oct '01

02 Oct '01

bash-2.04# truss ./syslog-ng -f /etc/local/syslog-ng-1.4.13/etc/syslog-ng.conf -dv execve("./syslog-ng", 0xEFFFFD48, 0xEFFFFD5C) argc = 4 stat("syslog-ng", 0xEFFFFA50) = 0 open("/var/ld/ld.config", O_RDONLY) Err#2 ENOENT open("/usr/lib/libpthread.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF7B0000 mmap(0x00000000, 81920, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF790000 mmap(0xEF7A2000, 5500, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 8192) = 0xEF7A2000 munmap(0xEF794000, 57344) = 0 memcntl(0xEF790000, 12160, MC_ADVISE, 0x0003, 0, 0) = 0 close(3) = 0 open("/usr/lib/libdoor.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF7B0000 mmap(0x00000000, 73728, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF770000 mmap(0xEF780000, 3868, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF780000 munmap(0xEF772000, 57344) = 0 memcntl(0xEF770000, 2608, MC_ADVISE, 0x0003, 0, 0) = 0 close(3) = 0 open("/usr/lib/libsocket.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF7B0000 mmap(0x00000000, 106496, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF750000 mmap(0xEF766000, 8185, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 24576) = 0xEF766000 open("/dev/zero", O_RDONLY) = 4 mmap(0xEF768000, 388, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) = 0xEF768000 munmap(0xEF758000, 57344) = 0 memcntl(0xEF750000, 12072, MC_ADVISE, 0x0003, 0, 0) = 0 close(3) = 0 open("/usr/lib/libnsl.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF7B0000 mmap(0x00000000, 581632, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF680000 mmap(0xEF700000, 32812, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 458752) = 0xEF700000 mmap(0xEF70A000, 15880, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) = 0xEF70A000 munmap(0xEF6F2000, 57344) = 0 memcntl(0xEF680000, 70140, MC_ADVISE, 0x0003, 0, 0) = 0 close(3) = 0 open("/usr/lib/libxnet.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF7B0000 mmap(0x00000000, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0xEF740000 close(3) = 0 open("/usr/lib/libc.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF730000 mmap(0x00000000, 704512, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF580000 mmap(0xEF622000, 29984, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 598016) = 0xEF622000 mmap(0xEF62A000, 4144, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) = 0xEF62A000 munmap(0xEF614000, 57344) = 0 memcntl(0xEF580000, 101660, MC_ADVISE, 0x0003, 0, 0) = 0 close(3) = 0 open("/usr/lib/libdl.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0xEF730000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF730000 close(3) = 0 open("/usr/lib/libmp.so.2", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF720000 mmap(0x00000000, 81920, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF660000 mmap(0xEF672000, 3581, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 8192) = 0xEF672000 munmap(0xEF664000, 57344) = 0 memcntl(0xEF660000, 3020, MC_ADVISE, 0x0003, 0, 0) = 0 close(3) = 0 open("/usr/platform/SUNW,Ultra-80/lib/libc_psr.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF654) = 0 mmap(0xEF720000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF720000 mmap(0x00000000, 16384, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF650000 close(3) = 0 open("/usr/lib/libthread.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0xEF720000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF720000 mmap(0x00000000, 204800, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF540000 mmap(0xEF566000, 9808, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 90112) = 0xEF566000 mmap(0xEF56A000, 28804, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) = 0xEF56A000 munmap(0xEF558000, 57344) = 0 memcntl(0xEF540000, 25132, MC_ADVISE, 0x0003, 0, 0) = 0 close(3) = 0 close(4) = 0 munmap(0xEF720000, 8192) = 0 brk(0x000375D8) = 0 sysconfig(_CONFIG_PAGESIZE) = 8192 sigfillset(0xEF629DD0) = 0 lwp_self() = 1 lwp_self() = 1 sigprocmask(SIG_SETMASK, 0x00000000, 0xEFFFF8D8) = 0 sigprocmask(SIG_SETMASK, 0xEF567E70, 0x00000000) = 0 sigaction(SIGLWP, 0xEF5684B0, 0x00000000) = 0 sigaction(SIGCANCEL, 0xEF5684B0, 0x00000000) = 0 sigaction(SIGSEGV, 0xEF5684B0, 0x00000000) = 0 brk(0x000375D8) = 0 brk(0x000395D8) = 0 open("/dev/zero", O_RDWR) = 3 mmap(0x00000000, 8454144, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_NORESERVE, 3, 0) = 0xEEC00000 close(3) = 0 mprotect(0xEEC00000, 8192, PROT_NONE) = 0 mprotect(0xEED02000, 8192, PROT_NONE) = 0 mprotect(0xEEE04000, 8192, PROT_NONE) = 0 mprotect(0xEEF06000, 8192, PROT_NONE) = 0 mprotect(0xEF008000, 8192, PROT_NONE) = 0 mprotect(0xEF10A000, 8192, PROT_NONE) = 0 mprotect(0xEF20C000, 8192, PROT_NONE) = 0 mprotect(0xEF30E000, 8192, PROT_NONE) = 0 lwp_create(0xEFFFF610, 0x0100, 0xEF40FE04) = 2 lwp_create(0xEFFFF610, 0x0100, 0xEF40FE04) = -276885348 door_create(0xEF552808, 0x00000000, 0x00000002) = 3 getpid() = 9323 [9322] lwp_schedctl(SC_STATE|SC_BLOCK, 3, 0xEFFFF814) = 0 door_info(3, 0xEF56A888) = 0 open("/dev/zero", O_RDWR) = 4 mmap(0x00000000, 24576, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_NORESERVE, 4, 0) = 0xEF640000 close(4) = 0 mprotect(0xEF640000, 8192, PROT_NONE) = 0 lwp_create(0xEFFFF5F8, 0x00C0, 0xEF645E04) = 3 lwp_continue(3) = 0 lwp_create(0x00000001, 0x6000, 0xEFFFF794) = 0 lwp_schedctl(SC_STATE|SC_BLOCK, -1, 0xEF645D0C) = 0 lwp_schedctl(SC_DOOR, 0, 0x00000000) = 4 door_bind(4) = 0 close(4) = 0 close(3) = 0 sigaction(SIGWAITING, 0xEF567CE0, 0x00000000) = 0 lwp_self() = 1 open("/etc/local/syslog-ng-1.4.13/etc/syslog-ng.conf", O_RDONLY) = 3 brk(0x000395D8) = 0 brk(0x0003D5D8) = 0 ioctl(3, TCGETA, 0xEFFFFA44) Err#25 ENOTTY fstat64(3, 0xEFFFF450) = 0 brk(0x0003D5D8) = 0 brk(0x0003F5D8) = 0 ioctl(3, TCGETA, 0xEFFFF3DC) Err#25 ENOTTY read(3, " # S Y S L O G - N G ".., 8192) = 676 read(3, 0x0003BF0C, 8192) = 0 brk(0x0003F5D8) = 0 brk(0x000415D8) = 0 ioctl(3, TCGETA, 0xEFFFF4B4) Err#25 ENOTTY llseek(3, 0, SEEK_CUR) = 676 close(3) = 0 open("/dev/log", O_RDONLY|O_NONBLOCK|O_NOCTTY) = 3 ioctl(3, I_STR, 0xEFFFFB18) = 0 stat("/etc/.syslog_door", 0xEFFFFA90) = 0 umount("/etc/.syslog_door") = 0 door_create(0x0001C728, 0x00000000, 0x00000000) = 4 getpid() = 9323 [9322] lwp_create(0xEFFFF650, 0x00C0, 0xEF20BE04) = 4 lwp_continue(4) = 0 lwp_create(0xEFFFF650, 0x00C0, 0xEF20BE04) = -268437784 lwp_self() = 4 lwp_schedctl(SC_STATE, -1, 0xEF20BD6C) = 0 yield() = 0 ioctl(4, I_CANPUT, 0x00000000) Err#89 ENOSYS door_info(4, 0xEFFFF9F8) = 0 mount("", "/etc/.syslog_door", MS_DATA, "namefs", 0xEFFFF9F4, 4) = 0 so_socket(2, 2, 6, "", 1) = 5 fcntl(5, F_GETFL, 0x00000000) = 2 fstat64(5, 0xEFFFF870) = 0 getsockopt(5, 65535, 8192, 0xEFFFF974, 0xEFFFF96C) = 0 fstat64(5, 0xEFFFF870) = 0 getsockopt(5, 65535, 8192, 0xEFFFF974, 0xEFFFF970) = 0 setsockopt(5, 65535, 8192, 0xEFFFF974, 4) = 0 fcntl(5, F_SETFL, 0x00000082) = 0 fcntl(5, F_SETFD, 0x00000001) = 0 io.c: connecting using fd 5 write(2, " i o . c : c o n n e c".., 28) = 28 open("/etc/netconfig", O_RDONLY) = 6 fstat64(6, 0xEFFFF1B8) = 0 brk(0x000415D8) = 0 brk(0x000435D8) = 0 ioctl(6, TCGETA, 0xEFFFF144) Err#25 ENOTTY read(6, " #\n # T h e " N e t".., 8192) = 1064 read(6, 0x0003FB6C, 8192) = 0 llseek(6, 0, SEEK_CUR) = 1064 llseek(6, 0, SEEK_SET) = 0 read(6, " #\n # T h e " N e t".., 8192) = 1064 read(6, 0x0003FB6C, 8192) = 0 llseek(6, 0, SEEK_CUR) = 1064 close(6) = 0 open64("/etc/.name_service_door", O_RDONLY) = 6 fcntl(6, F_SETFD, 0x00000001) = 0 door_info(6, 0xEF629C58) = 0 door_call(6, 0xEFFFD688) = 0 signotifywait() = 32 lwp_sigredirect(0, SIGWAITING) = 0 sigaction(SIGWAITING, 0xEF567D00, 0x00000000) = 0 open("/dev/zero", O_RDWR) = 7 mmap(0x00000000, 16384, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_NORESERVE, 7, 0) = 0xEF530000 close(7) = 0 mprotect(0xEF530000, 8192, PROT_NONE) = 0 lwp_create(0xEF40FAF0, 0x00C0, 0xEF533E04) = 5 lwp_continue(5) = 0 lwp_create(0x00000001, 0x4000, 0xEF40FC8C) = 0 lwp_schedctl(SC_STATE|SC_BLOCK, -1, 0xEF533D0C) = 0 time() = 1002019652 close(5) = 0 Error creating AF_INET socket (Error 0) write(2, " E r r o r c r e a t i".., 40) = 40 Error initializing configuration, exiting. write(2, " E r r o r i n i t i a".., 43) = 43 llseek(0, 0, SEEK_CUR) = 25235 _exit(2)

1 0

Monitoring connection
by Roman Ernst 02 Oct '01

02 Oct '01

Good morning! Have a question regarding syslog-ng TCP/IP connection... Is it possible to configure an SYSLOG-COLLECTION-SERVER to give any kind of alert whenever the connection between this server and any syslog-client is dropped? My problem is: if i plug out the network cable neither the server (AIX) nor the client (an AIX too) do recognize this within an acceptable period of time... Does there exist something like a "SERVER-CLIENT heartbeat" ??? Or... does anybody have an idea how to solve this problem another way? Best regards Roman Ernst

3 2

quick questions
by Ben Smee 02 Oct '01

02 Oct '01

heya, I am looking to setup syslog-ng for some tests here and I was wondering where the latest documentaion is available. I checked the man page but it suggests the html version is the latest, however, looking at the html version and comparing that to the samples that come with the latest package I can see that there are a huge number of features that appear to not be documented. Can anyone therefore point me to the best place to get the most updated doco's? Also is it possible to get a search function put on the list archive? Would make life easier :) thanks, -------------------- Benjamin Smee Technical Specialist Optus Business Operations (NAC) "YES" OPTUS ben.smee(a)optus.net.au Tel: +61-2-93420091 Fax: +61-2-93420998 Perilous to all of us are the devices of an art deeper than we possess ourselves. -- Gandalf the White

2 1

RE: RE:[syslog-ng]using ^ and/or $ in a regular expression match
by Masahiro Hirako 02 Oct '01

02 Oct '01

Thank you for the answer, Mr. Korschan, It worked! I misunderstood "the regular expression" as the one of the shells. Thanks a lot! >> The problem is '*' '?', or '+' in match() function. >> The following filter below seems to fail. >> >> ------------------------------- >> filter f1 { match("abc*");}; >> --------------------------------- >> >> I also tried match("abc\*"), match("abc\\*"), but those didn't work >> too. >> I know match("abc") is enough to resolve the sample problem, and it >> worked, but I want to make a filter like "abc*:xyz". >> >> Dose the match() function really resolve the regular expression? >> Or is the way I use match() wrong? >> > >Hmm - I assume you want to match "abc*:xyz": > >try match("abc.*") or match("abc.*:xyz") > >to be really exact you can try match("^abc.*:xyz$") > >Not that ".*" matches 0 or more characters, "\*" would match exactly >one "*" > >See regexp(5) (section may differ in your case) > >regards >-- >Christian Korschan Systems Specialist CTBTO/IDC >Vienna International Centre Email: Christian.Korschan(a)CTBTO.ORG >P.O. BOX 1200 Phone: +43(1)26030 6184 >A-1400 Vienna, Austria FAX: +43(1)26030 5932

1 0

RE:[syslog-ng]using ^ and/or $ in a regular expression match
by Masahiro Hirako 02 Oct '01

02 Oct '01

Hello, I've just begun using syslog-ng 1.4.12. Excuse me if the following problem is a FAQ, but I couldn't find an answer from the log, manual, reference. On Thu, 14 Jun 2001, nick nick(a)digitalwest.net wrote about the match() function problem, and I also have the similar one. (http://lists.balabit.hu/pipermail/syslog-ng/2001-June/001584.html) The problem is '*' '?', or '+' in match() function. The following filter below seems to fail. ------------------------------- filter f1 { match("abc*");}; --------------------------------- I also tried match("abc\*"), match("abc\\*"), but those didn't work too. I know match("abc") is enough to resolve the sample problem, and it worked, but I want to make a filter like "abc*:xyz". Dose the match() function really resolve the regular expression? Or is the way I use match() wrong? Thank you for reading. Masahiro Hirako

2 1

file() syntax
by Nicholas Berry 02 Oct '01

02 Oct '01

Just for background info, I compiled syslog-ng v1.5.9 under Solaris 8. I would like to make a statement similar to this: log { file("/var/log/$host/$year/$month"); }; to write the log to "/var/log/ns01/2001/10". I know this is possible by several filters, but that would be a ton of filters (especially since this will be breaking up at least 20 hosts). I've read over the online documentation and the man page for syslog-ng.conf and the closest I've seen to what I'm looking for is the file( ) macros. Can someone provide examples of using the macros or point me to online documentation outlining this? _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048

2 1

Unaligned trap errors on Alpha-Linux
by Jon Stearley 28 Sep '01

28 Sep '01

has a fix been found to the "unaligned trap" messages alpha users have been seeing? http://lists.balabit.hu/pipermail/syslog-ng/2000-May/000609.html http://lists.svlug.org/pipermail/svlug/2000-October/004209.html http://pusa.uv.es/~ulisses/kernelnewbies/kernelnewbies.25Jul00 i've got tons of them i'd like to eliminate from my alpha/linux-2.2.18/redhat6.2/syslog-ng-1.4.12/libol-0.2.23 clusters. it looks like an internal message, but it still occurs when i take internal() out of my source definition (?). thx for any pointers. -- +--------------------------------------------------------------+ | Jon Stearley (505) 845-7571 (FAX 844-2067) | | Compaq Federal LLC High Performance Solutions | | Sandia National Laboratories Scalable Systems Integration | +--------------------------------------------------------------+ here's one of my hosts, it keeps repeating: Sep 23 17:43:35 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005278: 00000001201249cc 2d 0 Sep 23 17:43:35 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 000000012000527c: 00000001201249f4 29 1 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 00000001200051d8: 00000001201249f4 2d 0 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005220: 00000001201249f4 29 16 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005278: 00000001201249cc 2d 0 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 000000012000527c: 00000001201249f4 29 1 Sep 23 17:44:12 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 00000001200051d8: 00000001201249f4 2d 0 Sep 23 17:44:12 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005220: 00000001201249f4 29 16

2 2

Thanks.
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 28 Sep '01

28 Sep '01

All, Thanks for all your help and advice over the last couple of years. I have tried to give back some of the help I have gotten as well as some of the experience I have gained using the software. This has been an outstanding piece of software and has been very helpful to the organization for which I work. But my contract here is up and I am moving on to a straight programming job, (no more sysadmin work). Anyway, best of luck to all of you. Bazsi, thanks for the hard work and support. Andrew Hamilton

2 1