- syslog-ng - lists.balabit.hu

1.3.9
by Balazs Scheidler 17 Dec '99

17 Dec '99

I've released 1.3.9 and libol 0.2.10 fixing a pipe() bug. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Filter problem
by John Wingenbach 17 Dec '99

17 Dec '99

I have just installed and configure syslog-ng on a couple of solaris boxes. However, I seem to be getting more then I wanted sent out to the ttys. Here is what I have done: source s_all { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; filter f_EmergSanUser { level(emerg) and not facility(user); }; destination d_ttys { usertty("*"); }; log { source(s_all); filter(f_EmergSanUser); destination (d_ttys); }; I am trying to mimic the syslog.conf line: *.emerg;user.none * However, what I am getting is notice level messages on the ttys. -- John C. Wingenbach Broadband Technologies Sr. Systems Administrator Work: (919) 405-4627 Fax: (919) 405-4544

1 0

Memory leak in syslog-ng 1.3.7 & FreeBSD?
by George Madden 16 Dec '99

16 Dec '99

I was running syslog-ng 1.2.3 on FreeBSD 3.2 with no problems. I recompiled 1.3.7 and have been running it for the past couple of days. It appears to have a memory leak. I've been using top to output the processes to a file and I keep seeing the mem stats for syslog-ng grow. The system is a fairly busy logger and I did add the use_dns statement and $HOST parameters. Has anyone else seen this? Here are the lines from top. I output 2 lines every 5 minutes. This is about the last 45 minutes or so: 609 root 2 0 1536K 1220K poll 40:04 10.06% 10.06% syslog-ng 609 root 2 0 1536K 1220K poll 40:29 7.86% 7.86% syslog-ng 609 root 2 0 1536K 1220K poll 40:29 7.62% 7.62% syslog-ng 609 root 32 0 1536K 1220K RUN 40:53 9.52% 9.52% syslog-ng 609 root 2 0 1536K 1220K poll 40:54 9.47% 9.47% syslog-ng 609 root 32 0 1544K 1224K RUN 41:13 7.57% 7.57% syslog-ng 609 root 2 0 1544K 1224K poll 41:13 8.45% 8.45% syslog-ng 609 root 32 0 1560K 1240K RUN 41:34 6.20% 6.20% syslog-ng 609 root 2 0 1560K 1240K poll 41:35 8.89% 8.89% syslog-ng 609 root 30 0 1560K 1240K RUN 41:55 6.40% 6.40% syslog-ng 609 root 2 0 1560K 1240K poll 41:56 6.88% 6.88% syslog-ng 609 root 2 0 1560K 1240K poll 42:12 3.86% 3.86% syslog-ng 609 root 2 0 1560K 1240K poll 42:12 3.76% 3.76% syslog-ng 609 root 2 0 1568K 1248K poll 42:32 5.47% 5.47% syslog-ng 609 root 2 0 1568K 1248K poll 42:32 5.22% 5.22% syslog-ng 609 root 2 0 1580K 1260K poll 42:58 8.20% 8.20% syslog-ng 609 root 2 0 1580K 1260K poll 42:58 8.35% 8.35% syslog-ng 609 root 2 0 1580K 1264K poll 43:20 5.96% 5.96% syslog-ng 609 root 2 0 1580K 1264K poll 43:20 5.81% 5.81% syslog-ng

2 2

syslog-ng and FBSD 3-STABLE
by Lowkrantz, Goran 16 Dec '99

16 Dec '99

All fine, except that src/main.c:39 need to be <sys/wait.h>. Cheers, GLZ --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

2 1

syslog-ng 1.3.8
by Balazs Scheidler 16 Dec '99

16 Dec '99

Hi, I've released syslog-ng 1.3.8 and libol 0.2.9 with a couple of bugfixes. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 2

syslog-ng: destination connection broken, reopening in 60 seconds
by Brian Johnson 15 Dec '99

15 Dec '99

I set-up syslog-ng last week, it's bee working great, but started giving this message every minute src@in syslog-ng: destination connection broken, reopening in 60 seconds I am running syslog-ng with the following command: supervise /var/supervise/syslog-ng /usr/sbin/syslog-ng -d 2>&1 |logger -t syslog-ng & I did it this way because I wanted to use the supervise utility to make sure it stays running, and to do that I needed to keep syslog-ng from becoming a daemon otherwise supervise will think it crashed and run it again and so I'm using the logger command to pass any error messages back into my logs.. in my syslog-nf.conf file all of my destinations are either files or virtual terminals (eg: /dev/tty1) and so I don't see how the connection to any of those could be broken? it seems to be logging ok otherwise.. any thoughts?? btw - I'm running on Redhat 6.0 ..and my thanks to the authors of the program - this is very helpfull

1 0

syslog-ng 1.3.7/Solaris 2.7
by ger 15 Dec '99

15 Dec '99

Hi, don't know if I'm doing something stupid here, or if I'm missing something, but here goes.. I have been running 1.3.6 successfully on Solaris 2.7 as a central logging solution, but I upgraded to 1.3.7 to check the new DNS functionality, and ran into some name resolution problems. I added the use_dns(yes) and use_fqdn(no) options to the options section of the configuration file, but my logfiles were still being created with <facility>.log.<ip_address> rather than <facility>.log.<hostname>, as had previously been the case with 1.3.6. I also tried removing the long_hostnames option in case it was conflicting with the new DNS code, but to no avail. I used the same version of libol for both, as no changes seem to have been made to the libs (0.2.8., Dec 3). Am I missing something, or has anyone else noticed this behaviour? Maybe something to do with the Solaris 7 resolver? Thanks, Ger. -- Ger Mulcahy, Technical Consultant, Harvard Business School

2 1

Logging console?
by Erich Reitz 09 Dec '99

09 Dec '99

Hi, I would like to know if it is possible/wise to log messages sent to the console? Unattended machines without monitors usually report messages during bootup that I never see since they are exclusively directed to the console. During normal operations I believe there are messages that can be sent exclusively to the console (ie: perl -w warning messages when the perl script process is run/forked from a background process without a controlling terminal) and these messages are never seen/logged. I am wondering if I can set the console up as a source for syslog-ng on these machines without monitors?

2 1

RE: [syslog-ng] SIGHUP kills syslog-ng on FreeBSD 3-STABLE
by Lowkrantz, Goran 09 Dec '99

09 Dec '99

Yes, this worked. Cheers, GLZ -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, December 09, 1999 7:01 PM To: syslog-ng(a)venus.terrasoft.hu Subject: Re: [syslog-ng] SIGHUP kills syslog-ng on FreeBSD 3-STABLE On Wed, Dec 08, 1999 at 03:38:42AM +0100, Lowkrantz, Goran wrote: > Hi, > > No, it didn't help. Now it just dies silently, not even a work on the > console. > > The only thing I can see is that if I start the old syslogd immediately > after syslog-ng died on HUP, I get the following on the console: > syslogd: cannot create /var/run/log: Address already in use I have yet another patch which should really fix your problems under BSD. Touch afinet.c.x and afunix.c.x before rebuilding, if you don't have scsh installed. diff -urN syslog-ng-1.3.6/src/afinet.c syslog-ng.bsd/src/afinet.c --- syslog-ng-1.3.6/src/afinet.c Tue Nov 23 20:45:45 1999 +++ syslog-ng.bsd/src/afinet.c Thu Dec 9 16:31:34 1999 @@ -269,11 +269,15 @@ case AFSOCKET_DGRAM: { struct afsocket_source_connection *conn; struct io_fd *client = make_io_fd(cfg->backend, fd); + int res; self->super.num_connections = 1; conn = make_afinet_source_connection(client, NULL, &self->super, self->super.super.super.next); - LOG_HANDLER_INIT(conn, cfg, NULL); - + res = LOG_HANDLER_INIT(conn, cfg, NULL); + if ((res & ST_FAIL) == 0) { + conn->queue_node = + object_queue_add_tail(self->super.connections, &conn->super.super.super); + } break; } default: diff -urN syslog-ng-1.3.6/src/afunix.c syslog-ng.bsd/src/afunix.c --- syslog-ng-1.3.6/src/afunix.c Tue Nov 23 20:32:37 1999 +++ syslog-ng.bsd/src/afunix.c Thu Dec 9 16:33:15 1999 @@ -241,11 +241,16 @@ case AFSOCKET_DGRAM: { struct afsocket_source_connection *conn; struct io_fd *client = make_io_fd(cfg->backend, fd); - + int res; + self->super.num_connections = 1; conn = make_afunix_source_connection(client, NULL, &self->super, self->super.super.super.next); - LOG_HANDLER_INIT(conn, cfg, NULL); - + res = LOG_HANDLER_INIT(conn, cfg, NULL); + + if ((res & ST_FAIL) == 0) { + conn->queue_node = + object_queue_add_tail(self->super.connections, &conn->super.super.super); + } break; } default: -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2

syslog-ng keeps dying on sol 2.6/2.7
by Jacob Zehnder 09 Dec '99

09 Dec '99

on my earlier post i forgot to include which version i was running of syslog-ng. 1.2.2 on all machines * * * * * * * * * * * * * * * * * * Jacob Zehnder * * * * * * * * * Grill Master * * * * * * * * "The dude abides." * * * * 'The Big Lebowski' * * * * * * * * * * * * * *

1 0

syslog-ng 1.3.7 released
by Balazs Scheidler 09 Dec '99

09 Dec '99

Hi, I've released syslog-ng 1.3.7, which fixes the remaining SIGHUP bugs, and adds two global configuration options: * use_dns() yes/no enables or disables DNS lookups * use_fqdn() yes/no enables or disables FQDN usage Note that these are not too well tested (tm). Since there's a major bug in syslog-ng 1.2.x, which is fixed by 1.3.x, and is cannot be easily backported, I am thinking about releasing 1.4.0 before adding further features. (the bug is that all AF_UNIX and AF_INET connections are dropped when syslog-ng is reinitialized) So please _test_ this release as much as you can, and I'll release 1.4.0 before christmas. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

RE: [syslog-ng] SIGHUP kills syslog-ng on FreeBSD 3-STABLE
by Lowkrantz, Goran 09 Dec '99

09 Dec '99

Hi, No, it didn't help. Now it just dies silently, not even a work on the console. The only thing I can see is that if I start the old syslogd immediately after syslog-ng died on HUP, I get the following on the console: syslogd: cannot create /var/run/log: Address already in use Cheers, GLZ -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, December 07, 1999 10:52 PM To: syslog-ng(a)venus.terrasoft.hu Subject: Re: [syslog-ng] SIGHUP kills syslog-ng on FreeBSD 3-STABLE On Tue, Dec 07, 1999 at 09:37:44PM +0100, Lowkrantz, Goran wrote: > Hi, > > Here it is. This patch should solve the problem with SIGHUP, because it drops messages while the configuration is initialized. The real problem is not solved though, the error message says that for some reason syslog-ng cannot bind to 0.0.0.0:514. I'll check that out too later. diff -u -r1.18 sources.c --- sources.c 1999/11/22 18:26:16 1.18 +++ sources.c 1999/12/07 13:19:22 @@ -182,7 +182,10 @@ CAST(log_source_group, self, c); struct ol_string *name = get_source_hostname(logmsg->saddr); - assert(self->super.next); + if (!self->super.next) { + log_info_free(logmsg); + return; + } logmsg->source = c; if (self->long_hostnames) { if (logmsg->flags & LF_LOCAL) { -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 2

Config file size and performance
by ger 09 Dec '99

09 Dec '99

Hi, I'm configuring syslog-ng for use on a central log server, processing logs from 60 busy syslog clients, and I've realised that without hostname macro expansion in the config file I'm going to end up with a file >600 lines long. Is this likely to cause performance problems with syslog-ng when it's trying to compare each syslog packet against this kind of filter/action list, and has anyone else used it in a similar environment? Thanks, Ger. -- Ger Mulcahy, Technical Consultant, Harvard Business School

3 3

Host Seperation
by Nigel Bovey 09 Dec '99

09 Dec '99

Hi, We run a rather large network, and are looking at running a secured machine for syslog, running syslog-ng hopefully. Obviously, we want to seperate out the log files for each host. Due to the number of hosts, this looks most easily done with the latest beta having the $HOST variable. So its syslog-ng 1.3.6 on debian running 2.2.12 . I made a rough fast configuration (see below). The idea is that the files end up in /syslog/hostname/file. Now, I've turned long_hostnames(on) which I guessed (docs are rather vague on most things) would make it use long host names for comparisons. To test, I didn't create the /syslog/name directories, and ran syslog-ng -d -v and it came up with "unable to open /syslog/max1/debug". Obviously this is incorrect as I wanted it to have a long host name. I thought the obvious method here, is to just remove hostnames all together, and use ip addresses (we use ip's for all radius related stuff, to stop dns dependency). So I remove resolv.conf and restart it with syslog-ng -d -v, this time it comes up with "unable to open /syslog/1.1.1.1/debug" which is fine. So I create the directory 1.1.1.1 and restart the daemon, now it comes up with "unable to write to /syslog/1.1.1.1/debug, its a directory". I switch the names back on and try, and it writes the file fine under /syslog/max1/debug. Turn names off again, and once again it will not write the file. Any ideas ? or is this a bug that may be fixed soon =) The program looks great from where I am standing, if I could sort out this problem. My other annoyance, is that it does partial name matches, unless there is some way to turn this off that I havn't come across. Even with ip addresses, using host(1.1.1.1) matches 1.1.1.1 and 1.1.1.10,100,101 etc etc. Any help greatly appreciated. --- Nigel Bovey IHUG Network Operations Team -------------------------------------------------------------------------- options { long_hostnames(on); sync(0); }; source src { unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; # filters filter f_auth { facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn); }; filter f_emergency { level(emerg); }; # destinations destination auth { file("/syslog/$HOST/auth"); }; destination cron { file("/syslog/$HOST/cron"); }; destination daemon { file("/syslog/$HOST/daemon"); }; destination kern { file("/syslog/$HOST/kern"); }; destination lpr { file("/syslog/$HOST/lpr"); }; destination mail { file("/syslog/$HOST/mail"); }; destination user { file("/syslog/$HOST/user"); }; destination uucp { file("/syslog/$HOST/uucp"); }; destination news { file("/syslog/$HOST/news"); }; destination debug { file("/syslog/$HOST/debug"); }; destination emergency { file("/syslog/$HOST/emergency"); }; destination messages { file("/syslog/$HOST/messages"); }; # log statements log { source(src); filter(f_auth); destination(auth); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_news); destination(news); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(emergency); };

3 6

RE: [syslog-ng] SIGHUP kills syslog-ng on FreeBSD 3-STABLE
by Lowkrantz, Goran 07 Dec '99

07 Dec '99

Hi, Here it is. Cheers, GLZ -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, December 07, 1999 2:21 PM To: syslog-ng(a)venus.terrasoft.hu Subject: Re: [syslog-ng] SIGHUP kills syslog-ng on FreeBSD 3-STABLE Hi, Could you please send me your configuration file? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

source syntax
by Chris Scheller 07 Dec '99

07 Dec '99

I just upgraded to 1.3.6 and i am getting a syntax error on my source line. this is what i have in my conf source s_all { unix-stream("/dev/log" max-connections(10)); udp(); tcp(); }; did something change and i missed it? or did i fubar this source line? Chris Scheller Network One Internet, inc. http://www.networkone.net/ System/Network Administration 1.888.GOT-NET1

3 3

SIGHUP kills syslog-ng on FreeBSD 3-STABLE
by Lowkrantz, Goran 07 Dec '99

07 Dec '99

Hi again, I rebuilt it with debug and here is the full backtrace. > gdb -c syslog-ng.core src/syslog-ng GNU gdb 4.18 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd"... Core was generated by `syslog-ng'. Program terminated with signal 6, Abort trap. Reading symbols from /usr/lib/libc.so.3...done. Reading symbols from /usr/libexec/ld-elf.so.1...done. #0 0x280a546c in kill () from /usr/lib/libc.so.3 (gdb) bt #0 0x280a546c in kill () from /usr/lib/libc.so.3 #1 0x280d9818 in abort () from /usr/lib/libc.so.3 #2 0x280b53ba in __assert () from /usr/lib/libc.so.3 #3 0x804a284 in do_add_source_name (c=0x8069448, logmsg=0x806d30c) at sources.c:185 #4 0x8051c48 in write_internal_message (level=3, length=71, data=0xbfbfd498 "io.c: bind_inet_socket() bind failed 0.0.0.0:514 Address already in use\n\\b\005\b\204Ú¿¿L\001") at afinter.c:55 #5 0x8055229 in msg_vformat () #6 0x805525e in werror () #7 0x80549cd in bind_inet_socket () #8 0x8054eb4 in io_open_socket () #9 0x80514f9 in do_init_afinet_source (c=0x805e908, cfg=0x805e608, persistent=0x805c668) at afinet.c:246 #10 0x804a3e8 in do_init_group (c=0x8069448, cfg=0x805e608, persistent=0x805c668) at sources.c:222 #11 0x804bd88 in do_init_config (self=0x805e608, p=0x805c668) at cfgfile.c:149 #12 0x8049716 in do_reread_config (c=0x805a014) at main.c:71 #13 0x8053fd9 in io_iter () #14 0x80498b1 in main_loop (backend=0x805d008) at main.c:139 #15 0x8049d13 in main (argc=1, argv=0xbfbfdabc) at main.c:292 #16 0x8049555 in _start () Cheers, GLZ --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

2 2

SIGHUP kills syslog-ng on FreeBSD 3-STABLE
by Lowkrantz, Goran 06 Dec '99

06 Dec '99

Hi, After upgrading to 1.3.6 I get the following problem: Dec 6 00:26:50 src@tandgrisner syslog-ng[56400]: syslog-ng version 1.3.6 starting Dec 6 00:26:56 src@tandgrisner syslog-ng[56400]: SIGHUP received, restarting syslog-ng pid 56400 (syslog-ng), uid 0: exited on signal 6 (core dumped) Here is the bt: # gdb -c syslog-ng.core work.d/syslog-ng-1.3.6/src/syslog-ng GNU gdb 4.18 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd"... (no debugging symbols found)... Core was generated by `syslog-ng'. Program terminated with signal 6, Abort trap. Reading symbols from /usr/lib/libc.so.3...(no debugging symbols found)...done. Reading symbols from /usr/libexec/ld-elf.so.1...(no debugging symbols found)... done. #0 0x280a246c in kill () from /usr/lib/libc.so.3 (gdb) bt #0 0x280a246c in kill () from /usr/lib/libc.so.3 #1 0x280d6818 in abort () from /usr/lib/libc.so.3 #2 0x280b23ba in __assert () from /usr/lib/libc.so.3 #3 0x8049d77 in do_add_source_name () #4 0x804ec2e in write_internal_message () #5 0x8051b91 in msg_vformat () #6 0x8051bc6 in werror () #7 0x8051335 in bind_inet_socket () #8 0x805181c in io_open_socket () #9 0x804e79b in do_init_afinet_source () #10 0x8049e38 in do_init_group () #11 0x804af08 in do_init_config () #12 0x8049563 in do_reread_config () #13 0x8050941 in io_iter () #14 0x804967a in main_loop () #15 0x8049a06 in main () #16 0x8049445 in _start () Any ides? Cheers, GLZ --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

1 0

syslog-ng 1.2.3 & syslog-ng 1.3.6
by Balazs Scheidler 03 Dec '99

03 Dec '99

Hi, I've released syslog-ng 1.2.3 and syslog-ng 1.3.6 fixing two small bugs. 1) If a SIGHUP signal was sent to syslog-ng while restart was in progress, syslog-ng terminated with a segmentation fault. 2) An assertion may have failed in some cases, where it shouldn't. 3) If poll() was interrupted, callouts were not called. Oops, these were three bugs. You know there are three kind of people, one who can calculate, and one who can't. :) You'll find these at the usual place: http://www.balabit.hu/products/syslog-ng -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog-ng 1.2.2 & syslog-ng 1.3.5
by Balazs Scheidler 24 Nov '99

24 Nov '99

Hi, I have released syslog-ng 1.2.2 and syslog-ng 1.3.5. Changes in syslog-ng 1.2.2: * a small log parsing bug caused problems in Solaris STREAMS support Changes in syslog-ng 1.3.5: * A bug in UDP support caused segmentation fault immediately at startup I've removed the debian packaging files from the source distribution, because syslog-ng is now part of debian, and those files are maintained by a debian maintainer. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

RE: [syslog-ng] syslog-ng 1.3.3 on FreeBSD 3-STABLE
by Lowkrantz, Goran 23 Nov '99

23 Nov '99

Hi, Works just fine. Cheers, GLZ -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, November 23, 1999 8:36 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] syslog-ng 1.3.3 on FreeBSD 3-STABLE On Tue, Nov 23, 1999 at 08:25:26PM +0100, Lowkrantz, Goran wrote: > Hi, > > This is what I get when I run gdb on the core. It seems like the child dies, > the parent get a SIGCHLD but will continue to wait. > > GNU gdb 4.18 > Copyright 1998 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public License, and you are > welcome to change it and/or distribute copies of it under certain > conditions. > Type "show copying" to see the conditions. > There is absolutely no warranty for GDB. Type "show warranty" for details. > This GDB was configured as "i386-unknown-freebsd"... > Core was generated by `syslog-ng'. > Program terminated with signal 11, Segmentation fault. > Reading symbols from /usr/lib/libc.so.3...done. > Reading symbols from /usr/libexec/ld-elf.so.1...done. > #0 0x8050f50 in do_init_afinet_source_connection (c=0x8069188, > cfg=0x805f008, > persistent=0x0) at afinet.c:69 > 69 notice("AF_INET client connected from %S, port %i\n", > (gdb) bt oopss.. this is the problem. try to apply the following patch: --- afinet.c 1999/11/23 19:32:37 1.2 +++ afinet.c 1999/11/23 19:33:09 @@ -64,10 +64,12 @@ struct persistent_config *persistent) { CAST(afsocket_source_connection, self, c); - CAST(inet_address_info, inet, self->client_addr); - - notice("AF_INET client connected from %S, port %i\n", - inet->ip, inet->port); + if (self->client_addr) { + CAST(inet_address_info, inet, self->client_addr); + + notice("AF_INET client connected from %S, port %i\n", + inet->ip, inet->port); + } io_read(self->client, make_log_reader(1, c), make_afsocket_source_close_callback(self)); @@ -90,10 +92,13 @@ do_close_afinet_connection(struct afsocket_source_connection *c, int close_reason) { - CAST(inet_address_info, inet, c->client_addr); assert(c->owner); - notice("AF_INET client dropped connection from %S, port %i\n", - inet->ip, inet->port); + if (c->client_addr) { + CAST(inet_address_info, inet, c->client_addr); + + notice("AF_INET client dropped connection from %S, port %i\n", + inet->ip, inet->port); + } object_queue_remove(c->queue_node); c->owner->num_connections--; return ST_OK | ST_GOON; if you have no scsh installed touch afinet.c.x before trying to remake. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng] syslog-ng 1.3.3 on FreeBSD 3-STABLE
by Lowkrantz, Goran 23 Nov '99

23 Nov '99

Hi, This is what I get when I run gdb on the core. It seems like the child dies, the parent get a SIGCHLD but will continue to wait. GNU gdb 4.18 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd"... Core was generated by `syslog-ng'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/lib/libc.so.3...done. Reading symbols from /usr/libexec/ld-elf.so.1...done. #0 0x8050f50 in do_init_afinet_source_connection (c=0x8069188, cfg=0x805f008, persistent=0x0) at afinet.c:69 69 notice("AF_INET client connected from %S, port %i\n", (gdb) bt #0 0x8050f50 in do_init_afinet_source_connection (c=0x8069188, cfg=0x805f008, persistent=0x0) at afinet.c:69 #1 0x805156e in do_init_afinet_source (c=0x805f108, cfg=0x805f008, persistent=0x0) at afinet.c:270 #2 0x804a390 in do_init_group (c=0x805d2c8, cfg=0x805f008, persistent=0x0) at sources.c:222 #3 0x804bd30 in do_init_config (self=0x805f008, p=0x0) at cfgfile.c:149 #4 0x8049c28 in main (argc=1, argv=0xbfbfdabc) at main.c:268 #5 0x8049555 in _start () I will check further. Cheers, GLZ -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, November 23, 1999 8:06 PM To: syslog-ng(a)venus.terrasoft.hu Subject: Re: [syslog-ng] syslog-ng 1.3.3 on FreeBSD 3-STABLE On Tue, Nov 23, 1999 at 07:56:38PM +0100, Lowkrantz, Goran wrote: > > There seems to be somthing wrong with the forking in the new version. It > never goes deamon. > > Here are the truss lists from 1.3.1 and 1.3.4 resp. I'm currently downloading FreeBSD, so I can test this. Under Linux it works o.k. > Any ideas or pointers where to look? syslog-ng goes to background the following way: parent: read configuration if config syntactically correct then fork(); wait for SIGTERM signal child: initialize configuration (open sockets etc.) if successful; close fds 0, 1, 2, become a session leader, send SIGTERM signal to parent You can find all of this in main.c -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

syslog-ng 1.3.3 on FreeBSD 3-STABLE
by Lowkrantz, Goran 23 Nov '99

23 Nov '99

There seems to be somthing wrong with the forking in the new version. It never goes deamon. Here are the truss lists from 1.3.1 and 1.3.4 resp. 1.3.1 ======================================= # truss /usr/local/sbin/syslog-ng syscall __sysctl(0xbfbfd9c8,0x2,0x2806518c,0xbfbfd9d0,0x0,0x0) returns 0 (0x0) syscall mmap(0x0,32768,0x3,0x1002,-1,0x0) returns 671506432 (0x28066000) syscall geteuid() returns 0 (0x0) syscall getuid() returns 0 (0x0) syscall getegid() returns 0 (0x0) syscall getgid() returns 0 (0x0) syscall open("/var/run/ld-elf.so.hints",0,05001446514) returns 3 (0x3) syscall read(0x3,0xbfbfd97c,0x80) returns 128 (0x80) syscall lseek(3,0x80,0) returns 128 (0x80) syscall read(0x3,0x2806a000,0x67) returns 103 (0x67) syscall close(3) returns 0 (0x0) syscall access("/usr/lib/libc.so.3",0) returns 0 (0x0) syscall open("/usr/lib/libc.so.3",0,05001446514) returns 3 (0x3) syscall read(0x3,0xbfbfc9f8,0x1000) returns 4096 (0x1000) syscall mmap(0x0,528384,0x5,0x2,3,0x0) returns 671539200 (0x2806e000) syscall mmap(0x280db000,20480,0x3,0x12,3,0x6c000) returns 671985664 (0x280db000) syscall mmap(0x280e0000,61440,0x3,0x1012,-1,0x0) returns 672006144 (0x280e0000) syscall close(3) returns 0 (0x0) syscall readlink("/etc/malloc.conf",0xbfbfd96c,63) errno 2 'No such file or directory' syscall mmap(0x0,4096,0x3,0x1002,-1,0x0) returns 672067584 (0x280ef000) syscall break(0x8059000) returns 0 (0x0) syscall break(0x805a000) returns 0 (0x0) syscall break(0x805b000) returns 0 (0x0) syscall open("/etc/syslog-ng/syslog-ng.conf",0,0666) returns 3 (0x3) syscall break(0x8060000) returns 0 (0x0) syscall ioctl(3,TIOCGETA,0xbfbfd484) errno 25 'Inappropriate ioctl for device' syscall fstat(3,0xbfbfd400) returns 0 (0x0) syscall break(0x8062000) returns 0 (0x0) syscall read(0x3,0x8060000,0x2000) returns 2523 (0x9db) syscall read(0x3,0x8060000,0x2000) returns 0 (0x0) syscall break(0x8063000) returns 0 (0x0) syscall break(0x8064000) returns 0 (0x0) syscall break(0x8065000) returns 0 (0x0) syscall break(0x8066000) returns 0 (0x0) syscall ioctl(3,TIOCGETA,0xbfbfd478) errno 25 'Inappropriate ioctl for device' syscall close(3) returns 0 (0x0) syscall fork() returns 498 (0x1f2) syscall sigaction(0xf,0xbfbfd9e8,0xbfbfd9dc) returns 0 (0x0) syscall sigprocmask(0x1,0x0) returns 0 (0x0) SIGNAL 15 SIGNAL 15 syscall sigaction(0xf,0xbfbfd948,0xbfbfd93c) returns 0 (0x0) syscall sigreturn(0xbfbfd980) returns 0 (0x0) ======================================= 1.3.4 ======================================= # truss src/syslog-ng syscall __sysctl(0xbfbfd9d4,0x2,0x2806618c,0xbfbfd9dc,0x0,0x0) returns 0 (0x0) syscall mmap(0x0,32768,0x3,0x1002,-1,0x0) returns 671510528 (0x28067000) syscall geteuid() returns 0 (0x0) syscall getuid() returns 0 (0x0) syscall getegid() returns 0 (0x0) syscall getgid() returns 0 (0x0) syscall open("/var/run/ld-elf.so.hints",0,05001456514) returns 3 (0x3) syscall read(0x3,0xbfbfd988,0x80) returns 128 (0x80) syscall lseek(3,0x80,0) returns 128 (0x80) syscall read(0x3,0x2806b000,0x67) returns 103 (0x67) syscall close(3) returns 0 (0x0) syscall access("/usr/lib/libc.so.3",0) returns 0 (0x0) syscall open("/usr/lib/libc.so.3",0,05001456514) returns 3 (0x3) syscall read(0x3,0xbfbfca04,0x1000) returns 4096 (0x1000) syscall mmap(0x0,528384,0x5,0x2,3,0x0) returns 671543296 (0x2806f000) syscall mmap(0x280dc000,20480,0x3,0x12,3,0x6c000) returns 671989760 (0x280dc000) syscall mmap(0x280e1000,61440,0x3,0x1012,-1,0x0) returns 672010240 (0x280e1000) syscall close(3) returns 0 (0x0) syscall readlink("/etc/malloc.conf",0xbfbfd974,63) errno 2 'No such file or directory' syscall mmap(0x0,4096,0x3,0x1002,-1,0x0) returns 672071680 (0x280f0000) syscall break(0x805a000) returns 0 (0x0) syscall break(0x805b000) returns 0 (0x0) syscall break(0x805c000) returns 0 (0x0) syscall break(0x805d000) returns 0 (0x0) syscall open("/etc/syslog-ng/syslog-ng.conf",0,0666) returns 3 (0x3) syscall break(0x8062000) returns 0 (0x0) syscall ioctl(3,TIOCGETA,0xbfbfd490) errno 25 'Inappropriate ioctl for device' syscall fstat(3,0xbfbfd40c) returns 0 (0x0) syscall break(0x8064000) returns 0 (0x0) syscall read(0x3,0x8062000,0x2000) returns 2523 (0x9db) syscall read(0x3,0x8062000,0x2000) returns 0 (0x0) syscall break(0x8065000) returns 0 (0x0) syscall break(0x8066000) returns 0 (0x0) syscall break(0x8067000) returns 0 (0x0) syscall break(0x8068000) returns 0 (0x0) syscall ioctl(3,TIOCGETA,0xbfbfd484) errno 25 'Inappropriate ioctl for device' syscall close(3) returns 0 (0x0) syscall fork() returns 808 (0x328) syscall sigaction(0xf,0xbfbfd9f4,0xbfbfd9e8) returns 0 (0x0) syscall sigprocmask(0x1,0x0) returns 0 (0x0) SIGNAL 20 ======================================= Any ideas or pointers where to look? Cheers, GLZ --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

2 1

syslog-ng 1.3.4
by Balazs Scheidler 23 Nov '99

23 Nov '99

Hi, I've released syslog-ng 1.3.4, fixing the missing afsocket.h.x bug, and adding support for a max-connections option for connection-oriented protocol drivers (e.g. unix-stream & unix-dgram) This is needed to fix the recently DoS attack against syslogd discussed on bugtraq. Default limit of connections: unix-stream: 100 tcp: 10 To change this, you'll need your change your source statement: source src { unix-stream("/dev/log" max-connections(10)); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 1

syslog-ng 1.3.3
by Balazs Scheidler 23 Nov '99

23 Nov '99

Hi, I've released syslog-ng 1.3.3, which completes the afsocket reorganization I introduced in 1.3.2. It should be quite stable now. This fixes a problem with some programs dropping messages (for instance sendmail). It was caused by the fact the syslog-ng dropped all af_unix connections when sent a HUP signal. A new option was added to unix-stream and tcp: keep-alive, which is on by default for unix-stream drivers. Another bug was fixed in the $DAY macro expansion. There was a discussion recently on bugtraq about a syslogd DoS attack. The problem is fixed in distributions by switching to unix-dgram sockets from unix-stream. syslog-ng supports this switch by using another driver, so you only need to change your configuration. An alternative solution will be provided to limit the number of simultaneous connections kept open. If this limit is reached, syslog-ng will be able to send a warning message, and messages will not be simply dropped. IMHO this solution is much better, than reverting to sock_dgram. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 2

RE: [syslog-ng] syslog-ng 1.3.3
by Lowkrantz, Goran 23 Nov '99

23 Nov '99

Ok, I installed scsh but still get make: don't know how to make afsocket.h.x. Stop *** Error code 1 Cheers, GLZ -----Original Message----- From: Chris Scheller [mailto:schelcj@networkone.net] Sent: Monday, November 22, 1999 11:26 PM To: 'syslog-ng(a)venus.terrasoft.hu' Subject: RE: [syslog-ng] syslog-ng 1.3.3 I had the same problem and was told to install scsh. i did so and compile worked great. scsh can be found at ftp-swiss.ai.mit.edu/pub/su/scsh/scsh.tar.gz Chris Scheller Network One Internet, inc. http://www.networkone.net/ System/Network Administration 1.888.GOT-NET1 On Mon, 22 Nov 1999, Lowkrantz, Goran wrote: > Hi, > > I downloaded 1.3.3 but the file src/afsocket.h.x seems to be missing, so it > won't build. > > Cheers, > GLZ > > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: Monday, November 22, 1999 10:11 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] syslog-ng 1.3.3 > > > Hi, > > I've released syslog-ng 1.3.3, which completes the afsocket reorganization I > introduced in 1.3.2. It should be quite stable now. > > This fixes a problem with some programs dropping messages (for instance > sendmail). It was caused by the fact the syslog-ng dropped all af_unix > connections when sent a HUP signal. A new option was added to unix-stream > and tcp: keep-alive, which is on by default for unix-stream drivers. > > Another bug was fixed in the $DAY macro expansion. > > There was a discussion recently on bugtraq about a syslogd DoS attack. The > problem is fixed in distributions by switching to unix-dgram sockets from > unix-stream. syslog-ng supports this switch by using another driver, so you > only need to change your configuration. > > An alternative solution will be provided to limit the number of simultaneous > connections kept open. If this limit is reached, syslog-ng will be able to > send a warning message, and messages will not be simply dropped. IMHO this > solution is much better, than reverting to sock_dgram. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Re: syslog-ng digest, Vol 1 #109 - 6 msgs
by Christopher James THOMPSON 23 Nov '99

23 Nov '99

Hi syslog-ng Anyone had any luck getting scsh ??? I ran 'site idle 7200' and still get timeouts !!! > get scsh-0.5.1.tar.gz Receiving file: scsh-0.5.1.tar.gz 0 1468685 bytes. ETA: --:--Er ror: Error occurred during read! Reason: Connection timed out ** Aborting Transfer ** Transfer aborted. Data connection closed. 0% 0 > 1468685 bytes. ETA:769:55 scsh-0.5.1.tar.gz: 1448 bytes received in 45.61 seconds, 31.75 Bytes/s. ftp-swiss.ai.mit.edu /pub/su/scsh ftp-swiss> Kind Regards Chris Thompson syslog-ng-admin(a)venus.terrasoft.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the web, visit > http://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > You can reach the person managing the list at > syslog-ng-admin(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific than > "Re: Contents of syslog-ng digest..." > > Today's Topics: > > 1. syslog-ng 1.3.3 (Balazs Scheidler) > 2. RE: syslog-ng 1.3.3 (Lowkrantz, Goran) > 3. RE: syslog-ng 1.3.3 (Chris Scheller) > 4. RE: syslog-ng 1.3.3 (Lowkrantz, Goran) > 5. Re: syslog-ng 1.3.3 (Chris Scheller) > 6. Re: syslog-ng 1.3.3 (Chris Scheller) > > --__--__-- > > Message: 1 > Date: Mon, 22 Nov 1999 22:11:14 +0100 > From: Balazs Scheidler <bazsi(a)balabit.hu> > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] syslog-ng 1.3.3 > Reply-To: syslog-ng(a)lists.balabit.hu > > Hi, > > I've released syslog-ng 1.3.3, which completes the afsocket reorganization I > introduced in 1.3.2. It should be quite stable now. > > This fixes a problem with some programs dropping messages (for instance > sendmail). It was caused by the fact the syslog-ng dropped all af_unix > connections when sent a HUP signal. A new option was added to unix-stream > and tcp: keep-alive, which is on by default for unix-stream drivers. > > Another bug was fixed in the $DAY macro expansion. > > There was a discussion recently on bugtraq about a syslogd DoS attack. The > problem is fixed in distributions by switching to unix-dgram sockets from > unix-stream. syslog-ng supports this switch by using another driver, so you > only need to change your configuration. > > An alternative solution will be provided to limit the number of simultaneous > connections kept open. If this limit is reached, syslog-ng will be able to > send a warning message, and messages will not be simply dropped. IMHO this > solution is much better, than reverting to sock_dgram. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > --__--__-- > > Message: 2 > From: "Lowkrantz, Goran" <Goran.Lowkrantz(a)infologigruppen.se> > To: "'syslog-ng(a)venus.terrasoft.hu'" <syslog-ng(a)venus.terrasoft.hu> > Subject: RE: [syslog-ng] syslog-ng 1.3.3 > Date: Mon, 22 Nov 1999 22:48:14 +0100 > charset="windows-1252" > Reply-To: syslog-ng(a)lists.balabit.hu > > Hi, > > I downloaded 1.3.3 but the file src/afsocket.h.x seems to be missing, so it > won't build. > > Cheers, > GLZ > > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: Monday, November 22, 1999 10:11 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] syslog-ng 1.3.3 > > Hi, > > I've released syslog-ng 1.3.3, which completes the afsocket reorganization I > introduced in 1.3.2. It should be quite stable now. > > This fixes a problem with some programs dropping messages (for instance > sendmail). It was caused by the fact the syslog-ng dropped all af_unix > connections when sent a HUP signal. A new option was added to unix-stream > and tcp: keep-alive, which is on by default for unix-stream drivers. > > Another bug was fixed in the $DAY macro expansion. > > There was a discussion recently on bugtraq about a syslogd DoS attack. The > problem is fixed in distributions by switching to unix-dgram sockets from > unix-stream. syslog-ng supports this switch by using another driver, so you > only need to change your configuration. > > An alternative solution will be provided to limit the number of simultaneous > connections kept open. If this limit is reached, syslog-ng will be able to > send a warning message, and messages will not be simply dropped. IMHO this > solution is much better, than reverting to sock_dgram. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > --__--__-- > > Message: 3 > Date: Mon, 22 Nov 1999 14:26:27 -0800 (PST) > From: Chris Scheller <schelcj(a)networkone.net> > To: "'syslog-ng(a)venus.terrasoft.hu'" <syslog-ng(a)venus.terrasoft.hu> > Subject: RE: [syslog-ng] syslog-ng 1.3.3 > Reply-To: syslog-ng(a)lists.balabit.hu > > I had the same problem and was told to install scsh. i did so and compile > worked great. scsh can be found at > ftp-swiss.ai.mit.edu/pub/su/scsh/scsh.tar.gz > > Chris Scheller > Network One Internet, inc. > http://www.networkone.net/ > System/Network Administration > 1.888.GOT-NET1 > > On Mon, 22 Nov 1999, Lowkrantz, Goran wrote: > > > Hi, > > > > I downloaded 1.3.3 but the file src/afsocket.h.x seems to be missing, so it > > won't build. > > > > Cheers, > > GLZ > > > > -----Original Message----- > > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > > Sent: Monday, November 22, 1999 10:11 PM > > To: syslog-ng(a)lists.balabit.hu > > Subject: [syslog-ng] syslog-ng 1.3.3 > > > > > > Hi, > > > > I've released syslog-ng 1.3.3, which completes the afsocket reorganization I > > introduced in 1.3.2. It should be quite stable now. > > > > This fixes a problem with some programs dropping messages (for instance > > sendmail). It was caused by the fact the syslog-ng dropped all af_unix > > connections when sent a HUP signal. A new option was added to unix-stream > > and tcp: keep-alive, which is on by default for unix-stream drivers. > > > > Another bug was fixed in the $DAY macro expansion. > > > > There was a discussion recently on bugtraq about a syslogd DoS attack. The > > problem is fixed in distributions by switching to unix-dgram sockets from > > unix-stream. syslog-ng supports this switch by using another driver, so you > > only need to change your configuration. > > > > An alternative solution will be provided to limit the number of simultaneous > > connections kept open. If this limit is reached, syslog-ng will be able to > > send a warning message, and messages will not be simply dropped. IMHO this > > solution is much better, than reverting to sock_dgram. > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > > url: http://www.balabit.hu/pgpkey.txt > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > --__--__-- > > Message: 4 > From: "Lowkrantz, Goran" <Goran.Lowkrantz(a)infologigruppen.se> > To: "'syslog-ng(a)venus.terrasoft.hu'" <syslog-ng(a)venus.terrasoft.hu> > Subject: RE: [syslog-ng] syslog-ng 1.3.3 > Date: Tue, 23 Nov 1999 01:18:52 +0100 > charset="windows-1252" > Reply-To: syslog-ng(a)lists.balabit.hu > > Ok, I installed scsh but still get > > make: don't know how to make afsocket.h.x. Stop > *** Error code 1 > > Cheers, > GLZ > > -----Original Message----- > From: Chris Scheller [mailto:schelcj@networkone.net] > Sent: Monday, November 22, 1999 11:26 PM > To: 'syslog-ng(a)venus.terrasoft.hu' > Subject: RE: [syslog-ng] syslog-ng 1.3.3 > > I had the same problem and was told to install scsh. i did so and compile > worked great. scsh can be found at > ftp-swiss.ai.mit.edu/pub/su/scsh/scsh.tar.gz > > Chris Scheller > Network One Internet, inc. > http://www.networkone.net/ > System/Network Administration > 1.888.GOT-NET1 > > On Mon, 22 Nov 1999, Lowkrantz, Goran wrote: > > > Hi, > > > > I downloaded 1.3.3 but the file src/afsocket.h.x seems to be missing, so > it > > won't build. > > > > Cheers, > > GLZ > > > > -----Original Message----- > > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > > Sent: Monday, November 22, 1999 10:11 PM > > To: syslog-ng(a)lists.balabit.hu > > Subject: [syslog-ng] syslog-ng 1.3.3 > > > > > > Hi, > > > > I've released syslog-ng 1.3.3, which completes the afsocket reorganization > I > > introduced in 1.3.2. It should be quite stable now. > > > > This fixes a problem with some programs dropping messages (for instance > > sendmail). It was caused by the fact the syslog-ng dropped all af_unix > > connections when sent a HUP signal. A new option was added to unix-stream > > and tcp: keep-alive, which is on by default for unix-stream drivers. > > > > Another bug was fixed in the $DAY macro expansion. > > > > There was a discussion recently on bugtraq about a syslogd DoS attack. The > > problem is fixed in distributions by switching to unix-dgram sockets from > > unix-stream. syslog-ng supports this switch by using another driver, so > you > > only need to change your configuration. > > > > An alternative solution will be provided to limit the number of > simultaneous > > connections kept open. If this limit is reached, syslog-ng will be able to > > send a warning message, and messages will not be simply dropped. IMHO this > > solution is much better, than reverting to sock_dgram. > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > > url: http://www.balabit.hu/pgpkey.txt > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > --__--__-- > > Message: 5 > Date: Mon, 22 Nov 1999 16:44:54 -0800 (PST) > From: Chris Scheller <schelcj(a)networkone.net> > To: syslog-ng(a)venus.terrasoft.hu > cc: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng] syslog-ng 1.3.3 > Reply-To: syslog-ng(a)lists.balabit.hu > > Is it possible ( and i just missed it ) to do a destination like this > destination test { file("/var/log/syslog-ng/$YEAR/$MONTH/$HOST-$DAY"); }; > using the macros to create directories? > > Chris Scheller > Network One Internet, inc. > http://www.networkone.net/ > System/Network Administration > 1.888.GOT-NET1 > > On Mon, 22 Nov 1999, Balazs Scheidler wrote: > > > Hi, > > > > I've released syslog-ng 1.3.3, which completes the afsocket reorganization I > > introduced in 1.3.2. It should be quite stable now. > > > > This fixes a problem with some programs dropping messages (for instance > > sendmail). It was caused by the fact the syslog-ng dropped all af_unix > > connections when sent a HUP signal. A new option was added to unix-stream > > and tcp: keep-alive, which is on by default for unix-stream drivers. > > > > Another bug was fixed in the $DAY macro expansion. > > > > There was a discussion recently on bugtraq about a syslogd DoS attack. The > > problem is fixed in distributions by switching to unix-dgram sockets from > > unix-stream. syslog-ng supports this switch by using another driver, so you > > only need to change your configuration. > > > > An alternative solution will be provided to limit the number of simultaneous > > connections kept open. If this limit is reached, syslog-ng will be able to > > send a warning message, and messages will not be simply dropped. IMHO this > > solution is much better, than reverting to sock_dgram. > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > > url: http://www.balabit.hu/pgpkey.txt > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > --__--__-- > > Message: 6 > Date: Mon, 22 Nov 1999 16:44:54 -0800 (PST) > From: Chris Scheller <schelcj(a)networkone.net> > To: syslog-ng(a)venus.terrasoft.hu > cc: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng] syslog-ng 1.3.3 > Reply-To: syslog-ng(a)lists.balabit.hu > > Is it possible ( and i just missed it ) to do a destination like this > destination test { file("/var/log/syslog-ng/$YEAR/$MONTH/$HOST-$DAY"); }; > using the macros to create directories? > > Chris Scheller > Network One Internet, inc. > http://www.networkone.net/ > System/Network Administration > 1.888.GOT-NET1 > > On Mon, 22 Nov 1999, Balazs Scheidler wrote: > > > Hi, > > > > I've released syslog-ng 1.3.3, which completes the afsocket reorganization I > > introduced in 1.3.2. It should be quite stable now. > > > > This fixes a problem with some programs dropping messages (for instance > > sendmail). It was caused by the fact the syslog-ng dropped all af_unix > > connections when sent a HUP signal. A new option was added to unix-stream > > and tcp: keep-alive, which is on by default for unix-stream drivers. > > > > Another bug was fixed in the $DAY macro expansion. > > > > There was a discussion recently on bugtraq about a syslogd DoS attack. The > > problem is fixed in distributions by switching to unix-dgram sockets from > > unix-stream. syslog-ng supports this switch by using another driver, so you > > only need to change your configuration. > > > > An alternative solution will be provided to limit the number of simultaneous > > connections kept open. If this limit is reached, syslog-ng will be able to > > send a warning message, and messages will not be simply dropped. IMHO this > > solution is much better, than reverting to sock_dgram. > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > > url: http://www.balabit.hu/pgpkey.txt > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > --__--__-- > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > End of syslog-ng Digest

1 0

RE: [syslog-ng] syslog-ng 1.3.3
by Lowkrantz, Goran 22 Nov '99

22 Nov '99

Hi, I downloaded 1.3.3 but the file src/afsocket.h.x seems to be missing, so it won't build. Cheers, GLZ -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, November 22, 1999 10:11 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng 1.3.3 Hi, I've released syslog-ng 1.3.3, which completes the afsocket reorganization I introduced in 1.3.2. It should be quite stable now. This fixes a problem with some programs dropping messages (for instance sendmail). It was caused by the fact the syslog-ng dropped all af_unix connections when sent a HUP signal. A new option was added to unix-stream and tcp: keep-alive, which is on by default for unix-stream drivers. Another bug was fixed in the $DAY macro expansion. There was a discussion recently on bugtraq about a syslogd DoS attack. The problem is fixed in distributions by switching to unix-dgram sockets from unix-stream. syslog-ng supports this switch by using another driver, so you only need to change your configuration. An alternative solution will be provided to limit the number of simultaneous connections kept open. If this limit is reached, syslog-ng will be able to send a warning message, and messages will not be simply dropped. IMHO this solution is much better, than reverting to sock_dgram. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

预定春节火车票
by hello 21 Nov '99

21 Nov '99

预定春节火车票，请电26368636咨询

1 0

proftpd
by Jacob Zehnder 21 Nov '99

21 Nov '99

hi, ive got everything working perfectly in my setup but im having one problem. i cant seem to be able to filter out proftpd from messages. i *can* filter it to ftp.log but it still shows up in messages. heres what my messages filter looks like filter f_messages { not facility(mail, kern, proftpd); }; ive substitued proftpd with ftpd, ftp, pro etc.. oh btw, i can filter out just stock ftpd fine, proftpd is the only thing i have problems with. i know that proftpd uses its own syslog util but im still not sure how i should go about seperating it. anyone had similar problems? any suggestions? thanks, -jacob * * * * * * * * * * * * * * * * * * Jacob Zehnder * * * * * * * * * Grill Master * * * * * * * * "The dude abides." * * * * 'The Big Lebowski' * * * * * * * * * * * * * *

3 2

Re: day macro
by Balazs Scheidler 21 Nov '99

21 Nov '99

On Sat, Nov 20, 1999 at 03:19:03PM -0800, Chris Scheller wrote: > i had not heard a response so i thought i would ask again. when i add the > $DAY macro to a destination the date come out 1 day ahead. I thought maybe > it wasn't taking into accoutn GMT or something similar, but everything > seems to be correct. any ideas? apply this patch: --- affile.c 1999/11/20 19:13:39 1.23 +++ affile.c 1999/11/21 14:35:09 @@ -317,7 +317,7 @@ ADD_MACRO_ARG(c_format("%02i", tm->tm_mon + 1)); break; case 'd': - ADD_MACRO_ARG(c_format("%02i", tm->tm_mday + 1)); + ADD_MACRO_ARG(c_format("%02i", tm->tm_mday)); break; } break; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog-ng 1.3.2
by Balazs Scheidler 20 Nov '99

20 Nov '99

Hi, I've released $subject. It contains a fully reworked/cleaned up afsocket implementation, so it may not be fully stable. Please test it as much as you can, and report bugs. Thanks. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog+ng 1.3.1 on FreeBSD 3-STABLE
by Lowkrantz, Goran 19 Nov '99

19 Nov '99

Hi, Two small things and then it works: src/log.c:85 need include of <string.h> so that memset is declared. src/log.c:89 tm.tm_isdst = daylight; There is no daylight variable but if tm_isdst is set negative, mktime will use the system to find out. If I define daylight to -1, it works. Two warnings: gcc -DHAVE_CONFIG_H -I. -I/usr/home/glz/work.d/syslog-ng-1.3.1/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c affile.c affile.c: In function `expand_macros': affile.c:381: warning: passing arg 2 of `c_vformat_length' from incompatible pointer type affile.c:383: warning: passing arg 4 of `c_vformat_write' from incompatible pointer type They are declared as va_list but are passed char *[MAX_MACRO_ARGS]. Cheers, GLZ --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

3 4

syslog-ng 1.3.1
by Balazs Scheidler 18 Nov '99

18 Nov '99

Hi, I've released a new development version to the usual location. It fixes some macro expansion bugs, and some parts have been merged from 1.2.1. It contains support the DEFAULT log statement, which is used on every message, which matches no filters. Here's how you can use it: log { source(src); filter(DEFAULT); destination(dst); }; Only one default statement can be in a configuration. So, download, compile, test and have fun: http://www.balabit.hu/products/syslog-ng -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 4

你想在网上做广告吗？do you have products to sell in net？
by hello 18 Nov '99

18 Nov '99

��Ҫ��棬��㽫��Ҫ��Ĳ�Ʒ�Ͷ��ң��һ�Ϊ�㶨��Ҫ��ַ��۸�30��ַ100Ԫ��һ�ף�һ��ڽ��ҵ��usa123888@yaoweb.com��û��usa123268��usa123368 ��Ҳ��yaoweb.com�� ַ�Ա��ϵ��㲻��Ҫ�ҿ��ҵĹ�棬�뷢�ʼ��û��usa123468 @ yaoweb.com��Ҫ�󳷳��ַ�� д�� do you have products to sell in net ,please contact with me .i can find 300000 emailaddress for you only 10$ ,and i will sent it with a emailsendersoft to you,if you need please sent a mail to me ,my email: username��usa123888(a)yaoweb.com or username:usa123268 or username:usa123368 they are yaoweb.com if you want to remove your emailaddress pleses sent email to username:usa123468 its yaoweb.com and full in your emaiaddress on subject.then i will delete it ��Ҫ��V�棬Ո�㌢��ĮaƷ�� Ҫ�Ŀ͑��V�ң��ҕ��Ҫ��㶨��30�f�]��ַ��r��100Ԫ��10Ԫ��K��һ��]��ܛ��׌��һ��ڽ�؛��ҕ��]��ܛ��l��]�䣬Ԕ��Susa123888(a)yaoweb.com ��Ñ��usa123168 usa123268 usa123368 ��(a)yaoweb.com ��㲻��Ҫ�@�V�棬Ո�l�]�� usa123468��yaoweb.comҪ�󳷳��ژ��}�Ќ��]��ַ��

1 0

default log statement
by Balazs Scheidler 17 Nov '99

17 Nov '99

Hi, There was a feature request to syslog-ng, so that you could add default log statement, where all non filtered traffic goes. My question is that how this should look like in the configuration file? Alternatives: 1) log(DEFAULT) { source(src); destination(dst); }; 2) log { source(src); filter(DEFAULT); destination(dst); }; 3) log { source(src); default; destination(dst); }; 1) would add yet another complication to the grammar, 2) looks ok, 3) is not consistent with the function() like option invocation. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

development version
by Balazs Scheidler 17 Nov '99

17 Nov '99

Hi, I've released the first development version (1.3.0) of syslog-ng to the usual places. It supports macro expansion in destination file names, and a new filter function which calls another filter rule. A new version of libol is needed (0.2.6) to compile this version. To use the new features, use the following config file snippets: 1) calling another rule filter f_mail { facility(mail); }; filter f_ftp { facility(ftp); }; filter f_default { not filter(f_mail); not filter(f_ftp); }; 2) macro expansion in destination filenames destination all { file("/var/log/$HOST.$YEAR$MONTH"); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 2

syslog-ng 1.2.1 & solaris support
by Balazs Scheidler 15 Nov '99

15 Nov '99

Hi, I'm pleased to announce that finally syslog-ng supports Solaris natively. I was lent a Solaris CD, and after installing it I could find the problem in a half an hour. (installation, +downloading the required GNU packages took a day! and I HATE vi :) You can find the updated packages at http://www.balabit.hu/products/syslog-ng along with their PGP signatures. I'm thinking about releasing a development snapshot 1.3.0, which introduces the macro support I was promising earlier. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

genh0
by Julian Gordon 15 Nov '99

15 Nov '99

It is mentioned in the documents: "syslog-ng supports keeping of hash values along side the actual log file. To initialize hashing for the first time, you will need to use the program genh0, which gener- ates the initial hash for a log file based on random salt and the passphrase you enter. " However, the distribution does not some to include this program, nor is this program available on the source site. What's up? Julian

2 1

qmail.
by Jacob Zehnder 13 Nov '99

13 Nov '99

ahoy, i recently switched to syslog-ng and am loving it, though im having one small problem. i use qmail and am logging it like this destination qmail { file ("/var/log/maillog" compress(on) sync(0) log_fifo_size(10)); }; it logs fine to /var/log/maillog.. only problem is it also wont stop logging to /var/log/messages. i was wondering if theres a way i can restrict qmails access to /var/log/messages in syslog-ng without having to do some knarly perm changes :> thank yah --jacob * * * * * * * * * * * * * * * * * * Jacob Zehnder * * * * * * * * * Grill Master * * * * * * * * "The dude abides." * * * * 'The Big Lebowski' * * * * * * * * * * * * * *

2 1

CDMA手机包月卡你办了吗？288元可打足一个月的包月卡！详情请电26368636咨询
by hello 06 Nov '99

06 Nov '99

CDMA包月卡包含市区内打进打出的话费（不含长途费，和短信息）：手续费300元市话通500元送400话费详情请电26368636咨询

1 0

Re: syslog-ng
by Balazs Scheidler 01 Nov '99

01 Nov '99

> >Hi > > > >Im trying to build syslog-ng on an SGI Indy running irix-6.5 but the > >build fails with: > > > >ld32: ERROR 33: Unresolved text symbol "door_revoke" -- 1st referenced > >by afstreams.o. > > Use linker option -v to see when and which objects, archives and > >dsos are loaded. > > > >I dont think irix has any of the door functions. > > > >TIA > > > >BB > > > I have just gone to compile syslog-ng on Digital Unix 4.0e and again > there appears to be no door functions/files available. Do you think door > files will come to IRIX and DU before syslog-ng does? Is there anything > we can do? Sorry for not answering this message so long, but I'm a bit overloaded nowadays. So the problem might be that you have a door.h available somewhere in your include directory, and this makes the configure script think, that you have doors. What you could do temporarily (until I fix this problem): * Rename /usr/include/door.h to something else, and rerun configure, but first delete the config.cache file in the syslog-ng directory. * Edit the file config.h after the configure script has been run, and change the line #define HAVE_DOOR_H 1 to #undef HAVE_DOOR_H and rebuild. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

release plans
by Balazs Scheidler 27 Oct '99

27 Oct '99

Hi, I'm planning to release version 1.2.0 of syslog-ng, and start a fork a new development cycle. I was waiting so long to fix Solaris support, but decided to release 1.2.0 anyhow, Solaris support will be fixed later. The recently added macro support will be released as 1.3.0, and development will continue on that branch. So 1.2.0 as I release it now should work without problems on *BSD and Linux, and using a workaround on Solaris. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: Welcome To "syslog-ng"!
by Gael Martinez 27 Oct '99

27 Oct '99

Hi I have some trouble with syslog-ng and Solaris 7 x86 Generic_106542-07 I put that in the .conf file source src { sun-streams("/dev/log" door("/etc/.syslog_door")); }; and when I launch the daemon I get that do_init_afstreams_source: Cannot open sun-stream /dev/log (Operation not supported on transport endpoint) Error initializing configuration, exiting. Terminated Any Clue ? Regards Gael -- Gael MARTINEZ Spacestar Communications, Inc. Dial-up to DS-3 Serving - MN WI ND MI IL www.spacestar.net / Fax (612) 996-0123

2 1

destination filename macro expansion
by Balazs Scheidler 26 Oct '99

26 Oct '99

Hi, I've worked a bit on syslog-ng and implemented macro expansion on destination filenames. It's not complete yet, but anyone interested may play with it a bit. Here's an example how to use this: ----------------------------------------------------- options { long_hostnames(on); time_reopen(2); }; source src { unix-stream("log1"); internal(); }; destination all { file("/var/log/$HOST.log"); }; log { source(src); destination(all); }; ------------------------------------------------------ You'll need to grab the source from the CVS to use this. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: Problems configuring syslog-ng
by Balazs Scheidler 22 Oct '99

22 Oct '99

On Fri, Oct 22, 1999 at 11:35:42PM +1000, John Doe wrote: > Hi, > I just downloaded syslog-ng 1.1.33 and I'm trying to run it on FreeBSD > 3.3. syslog-ng compiles and installs without any problems at all, but nice to hear. > when it comes to running it I get no log entries. The following is my > syslog-ng.conf file which I am using, and I'd guess that I've made some > terrible problem there, if you could please point me to where I am going > wrong it would be much appreciated. > > #----cut----- > options { sync(0); time_reopen(10); log_fifo_size(100) }; > > source src { > unix-stream("/var/run/log"); > internal(); > }; > > destination everything { > file("/var/log/newsyslog" compress(on) sync(0) log_fifo_size(10)); > }; > > log { source(src); destination(everything); }; > #----cut------ The problem is that BSD systems use unix-dgram sockets to send local log messages. So your source statement should look like: source src { unix-dgram("/var/run/log"); internal(); }; This is described in the INSTALL file: BSDi: ----- BSD is similar to Linux (or vice-versa Linux is similar to BSD, but this is another issue), so BSD has also a unix socket for log communication, but it's of type SOCK_DGRAM, and it is located at /var/run/log. So the source statement you are looking for is: source stdlog { unix-dgram("/var/run/log"); }; Or in the .sgml generated documentation doc/sgml/syslog-ng.txt: > I intend to run syslog-ng over (remote logging) my LAN (Linux, OpenBSD > and FreeBSD machines) when I get it going with what-ever > encryption/hashing syslog-ng supports. Sorry for the poor question, > however there doesn't appear to be much documention included with > syslog-ng. Suggestion: how about you include 5 sample setup files which > syslog-ng users have put into effect on their systems in a doc/samples > directory. If you cannot help me with my log-configuration file above, > perhaps you could send me your syslog-ng config file (well actaully I'd > be interested in seeing how you've implemented syslog-ng anway). You can find a demo configuration file which includes all possible parameters syslog-ng parses (doc/syslog-ng.conf.demo), even those syslog-ng doesn't implement yet (compress, encrypt etc. come to mind), and another one meant as a default configuration file: doc/syslog-ng.conf.sample -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Redhat init script?
by David Robinson 22 Oct '99

22 Oct '99

Has anyone made up a standard syslog-ng start/stop init script for Redhat 6? I noticed there was a debian one.. I'm currently just starting syslog-ng from the rc.local script. If not I'll create one but I don't want to do it if someone has already done it. Regards, David Robinson.

3 5

building syslog-ng on irix-6.5, door functions
by Bevan Broun 21 Oct '99

21 Oct '99

Hi Im trying to build syslog-ng on an SGI Indy running irix-6.5 but the build fails with: ld32: ERROR 33: Unresolved text symbol "door_revoke" -- 1st referenced by afstreams.o. Use linker option -v to see when and which objects, archives and dsos are loaded. I dont think irix has any of the door functions. TIA BB -- Bevan Broun ph (08) 9380 1587 Computer Systems Officer fax (08) 9380 1065 Dept. Electrical and Electronic Engineering University of Western Australia rm. G70

1 0

syslog-ng 1.1.33
by Balazs Scheidler 20 Oct '99

20 Oct '99

Hi, I've released a new version of syslog-ng. Nothing really new, just incorporated a few BSD build fixes, and reorganized the build system a bit. I'm taking part in the syslog-sec discussions initiated by the IETF. I'll try to keep syslog-ng up to date with respect with the new syslog specification. I've also updated the web page a bit: http://www.balabit.hu/products/syslog-ng -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

你有产品要在网上宣传吗？找我啊
by hello 17 Oct '99

17 Oct '99

你如果需要做广告，请你将你所要宣传的产品和对象告诉我，我会为你定制你所要的邮址，价格：30万邮址100元，送软件一套，一日内交货，我的邮箱用户名是usa123888或usa123168或usa123268或usa123368 邮箱是属于HOTMAIL.COM的请留你的邮箱地址以便联系，如果你不需要我看到我的广告，请发邮件到用户名usa123468 的hotmai。com中要求撤除你的邮箱地址。

1 0