- syslog-ng - lists.balabit.hu

Re: question on syslog-ng 1.1.32
by Balazs Scheidler 15 Oct '99

15 Oct '99

> Is it possible to make logs like the following: > > Oct 14 08:54:37 last/localhost message repeated 1 time > > unconditionally go through the filter of the message it is > referring to? With my current filtering, it is difficult to tell what > message this actually applies to because it gets written to a different > file than the message itself. Thanks for any help. syslog-ng currently doesn't generate such repetition messages, so it must be something that sends messages to syslog-ng, thus there's no way finding out which message it is referring to. In syslog-ng this will be implemented in the destination drivers, so these messages will go where the one they are referring to. -- Bazsi

1 0

Re: NG Syslog
by Balazs Scheidler 15 Oct '99

15 Oct '99

On Thu, Oct 14, 1999 at 04:05:10PM +0200, Kai U. Reichert wrote: > Hi! > > As I was browsing through your web-site some things were strange ? > Up to the time of Aug 29 you´ve released permanently a new version, but > the latest one is more than one month old; and the CVS-server is down ? > > Have you droped your project or will there be improvements ? > > I´m just asking, because I have need for an sophisticated syslog daemon. The project is not dropped, it's only on hold for some time while I have other things to do. 1.1.32 seemed to be quite stable at least on Linux and BSD. It's not named 1.2.0 yet, because Solaris is not fully supported, because I was unable to borrow an x86 Solaris CD. There are quite a few improvements planned in the next development cycle, for more information check the lists archives. The topic of my master's thesis is the cryptographic enhancements of syslog-ng, so it will definitely be finished until the end of the next semester. -- Bazsi

1 0

Using syslog-ng for NAS
by Naoto MATSUMOTO 12 Oct '99

12 Oct '99

Hi, all I have some question. The Balabit syslog-ng can be relaying UDP to TCP. source and destination syntax eg.) Syntax: udp <ipaddr>,<port>; Sends messages to the given host & port using UDP datagrams. Example: udp 193.6.40.37,514; Is it the best for this situation ? (1) old syslogd style [NAS]........UDP......................... .<Drop!> [NAS]........UDP.........................[Syslog]----IO->(Disk) .<Drop!> [NAS]........UDP......................... NAS: Network Access Server (2) using syslog-ng <Buffered?+Relay!> vvvvvvvvv [NAS]........UDP..[Syslog-ng]______TCP___ . \ [NAS]........UDP. [Syslog-ng]--IO->(Disk) ______ ___/ [NAS]........UDP..[Syslog-ng] TCP ^^^^^^^^^ <Buffered?+Relay!> It's correct? I want to understand that cause of dropping UDP on syslog. (the cause is the UDP stack on kernel(OS)?) Regards, ----- IRI [Internet Research Institute,Inc.] Naoto MATSUMOTO <not(a)iri.co.jp>

2 2

Re: syslog-ng question
by Balazs Scheidler 11 Oct '99

11 Oct '99

On Wed, Oct 06, 1999 at 10:48:38PM -0400, Peter Choynowski wrote: > > I am just starting to look at syslog-ng, and after reading the > documentation, I suspect it will not be able to do what I am after :( I > am trying to setup a log host for a large network, and want to have > messages from each host placed in different directory e.g. for host duey > the directory might be: > > /var/log/duey > > and all the messages from duey would go into files under there. The > problem is that I have a large number of hosts, and having to specify each > host with host("xxx") is not practical ( hosts are added all the time, and > it would be too much effort to add it each time ). > > I guess my question has to do with ability of having macros that would be > defined for each log line ie. lets say %h would get set to host, %ip to > ip, %f to facility, ... - this way the destination could be written using > the macros e.g. > > log { source(...); > filter(facility(auth)); > destination(file("/var/log/%h/%f.log)); ... } This is a planned feature. A lot of people have asked for this. > > If you can think of doing the above ( even if I have to do a simple hack > to the source let me know if it is possible and not too difficult ). it's quite difficult, since you have to keep a cache of recently opened files, and close them automatically after a time interval. > The other question I have has to do with syslog-ng resist message flood > type attacks - can you deal with that, and is there a way to alert admins > using sendmail of a possible attack ? not yet. > > How about dealing with growing logs and if they are about to fill up a > partition - maybe an option should exist to alert admins if the partition > becomes full to some user specified % or some given number of MB is left > free. This can be accomplished by other tools, a simple shell script called from cron would suffice. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Troubles with kernel facility items (firewall DENYs esp.)
by Jason Hollinden 09 Oct '99

09 Oct '99

I've set up syslog-ng as directed by everything I could find. In the .conf file below, yertle is the local machine running syslog-ng, and the other 2 are remote machines. The remote machine lines output everything fine, but the local (yertle) will not report any kernel messages (such as kernel firewall DENYs). I've tried adding the unix-stream /dev/klog for the inside_src, but that didn't help. Here's my .conf: ==========8<--------------------------------------- options { long_hostnames(off); sync(0); }; source inside_src { unix-stream("/dev/log"); internal(); }; source outside_src { udp(ip(0.0.0.0) port(514)); }; filter f_nancy { host("nancy"); }; filter f_hbgb { host("hbgb"); }; destination yertle { file("/var/log/yertle"); }; destination nancy { file("/var/log/nancy"); }; destination hbgb { file("/var/log/hbgb"); }; log { source(inside_src); destination(yertle); }; log { source(outside_src); filter(f_nancy); destination(nancy); }; log { source(outside_src); filter(f_hbgb); destination(hbgb); }; ==========8<--------------------------------------- Since I've only been messing with this for 1 hour, I'm sure I've just glanced over the answer, but any help would be appreciated. -- Liar (HBGB) jasonh(a)kiva.net ----------------------------------------------------------------------- "You can't be a real country unless you have a beer and an airline. It helps if you have some kind of a football team, or some nuclear weapons, but at the very least you need a beer." -Frank Zappa

2 1

filters and directory/filenames
by Christi Lipscomb 09 Oct '99

09 Oct '99

Hi, With syslog-ng, is there anyway to take the date and hostname in the log message and use them as part of the filename in the destination? We would like to use the date as a directory and within that directory save log files by hostname.logtype. Thank you, Christi acl4p(a)virginia.edu

2 1

MySQL Destination
by H D Moore 28 Sep '99

28 Sep '99

Hi, I started writing a MySQL based version of syslogd a couple weeks ago, it turns out that the original sysklogd package is an ugly mess and it wasnt feasible to try rewriting it for mysql support. Would you consider adding a mysql destination to the syslog-ng source? Would you mind if I write one and distributed it as a patch/module/etc? Would anyone else want to work on this? The original product page is located at http://www.phunc.com/~spinux (myLog). -HD Like Nmap? Try Nlog! (http://nlog.ings.com) IEEE Member (http://www.ieee.org)

2 1

CVS updated
by Balazs Scheidler 06 Sep '99

06 Sep '99

Hi, The previously mentioned compilation fixes are available in the CVS repository, only *BSD users are affected. For CVS instructions, see the webpage. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 2

Standard TCP port for Syslog?
by Lowkrantz, Goran 06 Sep '99

06 Sep '99

Has there been any desision for a TCP syslog port, as 514 is taken? Cheers, GLZ --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

2 1

syslog-ng 1.1.32 on FreeBSD
by Lowkrantz, Goran 06 Sep '99

06 Sep '99

Hi, Built the 1.1.32 on FreeBSD 3.3-RC today and there are just two small things to make this a compleat joy. 1 - The configure script don't find thet FreeBSD should have #define HAVE_MODERN_UTMP 0. 2 - The following warnings are generated at the inclusion of /usr/include/arpa/inet.h in src/utils.c I have added the lines from the system header that generates the warning. In file included from utils.c:32: /usr/include/arpa/inet.h:89: warning: parameter has incomplete type unsigned long inet_lnaof __P((struct in_addr)); /usr/include/arpa/inet.h:92: warning: parameter has incomplete type unsigned long inet_netof __P((struct in_addr)); /usr/include/arpa/inet.h:96: warning: parameter has incomplete type char *inet_ntoa __P((struct in_addr)); Cheers, GLZ --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

2 1

Re: syslog-ng under OpenBSD
by Balazs Scheidler 02 Sep '99

02 Sep '99

> > > > Could you send me your config.log and config.h files? > > I sent them as separate e-mails with proper subject lines. Thanks. I've fixed these compilation problems. Will be available in the next release. > > > > > > also, I get these warnings: > > > > > > parameter list > > > /usr/include/arpa/inet.h:79: warning: parameter has incomplete type > > > /usr/include/arpa/inet.h:82: warning: parameter has incomplete type > > > /usr/include/arpa/inet.h:86: warning: parameter has incomplete type > > > > In which file? > > during this command, here: > gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.1.32/src -I. -O2 -Wall -I/usr/local/include/libol -c utils.c Fixed this one too. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

updated documentation
by Balazs Scheidler 01 Sep '99

01 Sep '99

Hi! I've updated the documentation on the webpage. It's not complete yet, but it's definitely more complete than it was previously. http://www.balabit.hu/products/syslog-ng/doc/book1.html -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

Remote loging and facility seperation of incoming logs.
by deant＠stsi.net 01 Sep '99

01 Sep '99

Salutations all, I am attempting to set up a network log server for our Debian and RedHat servers. I can cause the other boxen to send the information to the log server. The log server receives the packets. However, I am having some difficulty separating the inbound packets by box and routing them to different files by facility. Any assistance would be appreciated. ****************************************************** * <<<<<<<<<<<<<< SouthNet <> TeleComm >>>>>>>>>>>>>> * ****************************************************** * Man generally seeks wisdom * T. Dean Tate * * only after all other options * deant(a)stsi.net * * have been exhausted. * UNIX Administration * ******************************************************

2 3

regular expressions ...
by Josef Bergmann 01 Sep '99

01 Sep '99

Hi! I made some fine Deb-Pakets from libol 0.2.3 and syslog-ng 1.1.31 and installed it on a Debian 2.1 system. Everthing works/logs nicely :-) Now I want enable the "hashing-feature" and filter against a file with regex- terms but I found now proper info in the docs. How can configure this features? (I don't found "genh0" and "checkhash" as mentioned in the syslog-ng manpage). How can I realize a system which for example executes a script if a regex- target gets hit. The idea is to get a realtime logchecker which mails faults to the admin ... Thanks for help. bye Josef -- BERGMANN engineering & consulting http://bec.at/ 'While we liked developing Windows applications, we never inhaled.' - Philippe Kahn, 1992

2 5

configuration problem?
by The March Hare 31 Aug '99

31 Aug '99

I am having trouble getting syslog-ng to log anything besides its own startup and shutdown. I have used the following configuration file, which is very similar to the sample from the distribution: options { sync(0); time_reopen(10); log_fifo_size(100); }; source src { unix-stream("/var/run/log"); udp(); tcp(ip("127.0.0.1") port(1000) mac(allow) authentication(required) encry pt(allow)); tcp(); # sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination everything { file("/var/log/syslog-ng" compress(on) sync(0) log_fifo_size(10)); }; filter f_host1 { host("host1"); }; log { source(src); destination(everything); }; Is there anything obviously wrong here? -- Felicia ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I am not the poet of goodness only....I do not decline to be the poet of wickedness also. -Walt Whitman ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 2

Re: problems with syslogd-ng under openbsd
by Balazs Scheidler 31 Aug '99

31 Aug '99

On Tue, Aug 31, 1999 at 04:21:38PM -0400, Rex A. Roof wrote: > > I'm trying to use syslogd-ng under OpenBSD on a sparc machine. > > I get parse errors if I try and have a destination line like this: > > destination local { file/var/log/local/general; }; > > so, I changed them to look like this: > > destination local { file(/var/log/local/general); }; > > and, I don't get parse errors anymore, but, I don't know if it's working > or not. I can't seem to get any log {}; directives to work, > this is just one of the ones I have, but I get parse errors on it: > > log { source src; destination default; }; log { source(src); destination(default); }; I'll try to update, and complete the documentation ASAP. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: logging to another machine
by Balazs Scheidler 19 Aug '99

19 Aug '99

Hi, On Mon, Aug 16, 1999 at 11:35:06AM -0400, Jamie Orzechowski wrote: > Hi There ... I have your AWSOME syslog-ng installed and just have a few > questions > > 1) does it log TCP/UDP ?? .. so I can log port scans and attacks on my > machine ... syslog-ng listens on an UDP or TCP socket to get log messages from the network. It's not a portscan detection tool. For portscan detection you could use tcplogd, or ippl. > 2) I need a config line to send all the logs to another host (I have abackup > logging host) It's not a problem, but the needed source declaration depends on the platform you are trying to run syslog-ng. On a Linux box all local messages are sent to a UNIX SOCK_STREAM socket named /dev/log. On other operating systems, this can be something else. So to send all messages to another host from a Linux system use: source src { unix-stream("/dev/log"); internal(); }; destination all { udp("xxx.xxx.xxx.xxx"); }; log { source src; destination all; }; Substitute the IP address of your loghost to xxx.xxx.xxx.xxx. You could use a hostname as well, but syslog-ng has to be able to resolv this name upon startup. (e.g. you have to include it in your /etc/hosts file) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog-ng
by Stefan Monnier 19 Aug '99

19 Aug '99

Why is a `source' necessary in a `log' statement ? the example configuration in http://www.balabit.hu/products/syslog-ng/syslog-ng-1.1.22.html clearly shows that this has the nasty tendency to be verbose and redundant. Why not allow the set of sources to be empty in which case the source is the same as the last `log' statement (for example) ? Also having the words `source' `filter' and `destination' appear all the time seems too verbose. They don't seem to be necessary. I'd love to be able to say destination console { file /dev/tty11; }; log { ; facility(ppp); console } where the redundant keywords have been dropped, the default source is used and the filter appears directly in the `log' command. Apart from that, I have some trouble checking out the CVS repository: ~/install-1% cvs -d :pserver:cvs@cvs.balabit.hu:/usr/local/cvs checkout -d syslog-ng syslog-ng libol cvs server: Updating syslog-ng/syslog-ng cvs server: failed to create lock directory in repository `/usr/local/cvs/syslog-ng': Permission denied cvs server: failed to obtain dir lock in repository `/usr/local/cvs/syslog-ng' cvs [server aborted]: read lock failed - giving up ~/install-1% [ the login went though flawlessly ] Stefan "very happy about syslog-ng despite the present gripes" PS: I wish syslog-ng were a perl script so that the config file could use the full perl power (and you'd have saved all the parsing trouble: just say "do '/etc/syslogng.conf';" and that's it).

2 1

closed TCP streams
by Bradley Urberg Carlson 19 Aug '99

19 Aug '99

If I am using a destination: destination tcptest { tcp("137.192.192.104" port(4020) ); }; ...and I kill and restart the TCP server at my end, then syslog-ng complains: io.c: do_write: write() failed (errno 32), Broken pipe ...but does not try to reconnect until HUP or restart. -Bradley

1 0

multiple facilities/streams into a named pipe?
by streiner-syslogng＠sgi.net 17 Aug '99

17 Aug '99

This is a pretty off-the-wall question, but I figure I'd give it a shot ;-) I work in a largely Solaris shop and have to deal with many of the quirks of its syslog implementation. One of these quirks came up when I tried on a hunch to get multiple event streams to feed into the same named pipe, which would then get pushed off to a network management system. The reason I wanted to do this was organizational; i.e. have all routers log to local7.debug on my log server, switches log to local6.debug, ras servers to local5.debug and so on. From what I've seen in early tests, this type of setup either causes Sun's syslogd fits or could potentially clobber data being written to the pipe. My questions are: 1) has anyone ever tried anything like this? 2) is syslog-ng capable of supporting a setup like this on a Solaris 2.7 box? tia jms

2 1

Re: syslog-ng 1.1.31 && Solaris 2.6 SPARC
by Bradley Urberg Carlson 17 Aug '99

17 Aug '99

Erik M. Beebe erik(a)infi.net wrote on Thu, 12 Aug 1999 16:56:37 -0400: > I have recently installed syslog-ng 1.1.31 && libol-0.2.3 on a machine > running SPARC Solaris 2.6; If I connect to port 514/UDP using NetCat, > syslog-ng logs it just fine. If I try to use "logger" locally, it does > not. ... > I don't believe it's any problems with the destination/filter/log lines > causing this problem -- it looks like syslog-ng just isn't getting what is > sent to /dev/log. Anyone have any idea what could be causing this? There are a bunch of messages in the June archive with the thread "syslog-ng and solaris doors again". Apparently, there is still some work going into logging messages locally under solaris. I also tried v1.1.31 with Solaris and found the same problem. My workaround was to run syslog-ng AND the Solaris syslogd, with syslogd forwarding all local messages to syslog-ng on the localhost using UDP. Since syslog-ng works fine from UDP, this gets all the messages (network-generated + locally-generated) into syslog-ng. Details: -syslogd listens to bogus/unused UDP port 999, and sends local messages to syslog-ng using UDP 999: *** /etc/services~ Mon Aug 16 21:02:39 1999 --- /etc/services Mon Aug 16 20:28:30 1999 *************** *** 61,63 **** who 513/udp whod ! syslog 514/udp talk 517/udp --- 61,63 ---- who 513/udp whod ! syslog 999/udp talk 517/udp *** /etc/syslog.conf~ Mon Mar 29 10:17:35 1999 --- /etc/syslog.conf Mon Aug 16 21:05:03 1999 *************** *** 1,1 **** ! *.debug @loghost --- 1,1 ---- ! *.debug @localhost -syslog-ng listens to the network-generated messages coming in on 514/UDP, and also listens to locally-generated messages coming in from syslogd on 999/UDP: source s_network { udp(ip(0.0.0.0) port(514)); }; source s_syslogd { udp(ip(localhost) port(999)); };

1 0

RE: [syslog-ng] Got 1.1.31 running on FreeBSD3
by Lowkrantz, Goran 14 Aug '99

14 Aug '99

And then I missed the obvious. I have attached the patch of src/utils.c, just a missing variable. Cheers, Goran L -----Original Message----- From: Lowkrantz, Goran [mailto:Goran.Lowkrantz@infologigruppen.se] Sent: Saturday, August 14, 1999 3:13 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng] Got 1.1.31 running on FreeBSD3 Hi, I got the 1.1.31 version up and running on FreeBSD 3.1R and 3.2S with two small glitches. 1: src/config.h: #define HAVE_MODERN_UTMP 0 2: When compiling util.c I get the following messages. gcc -DHAVE_CONFIG_H -I. -I/usr/home/glz/work.d/syslog-ng-1.1.31/src -I. -O2 -Wall -I/usr/local/include/libol -c utils.c In file included from utils.c:32: /usr/include/arpa/inet.h:89: warning: parameter has incomplete type /usr/include/arpa/inet.h:92: warning: parameter has incomplete type /usr/include/arpa/inet.h:96: warning: parameter has incomplete type I will track them down later today if no-one have a quick answer. The tests I have made so far work OK. Cheers, Goran L --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Got 1.1.31 running on FreeBSD3
by Lowkrantz, Goran 14 Aug '99

14 Aug '99

Hi, I got the 1.1.31 version up and running on FreeBSD 3.1R and 3.2S with two small glitches. 1: src/config.h: #define HAVE_MODERN_UTMP 0 2: When compiling util.c I get the following messages. gcc -DHAVE_CONFIG_H -I. -I/usr/home/glz/work.d/syslog-ng-1.1.31/src -I. -O2 -Wall -I/usr/local/include/libol -c utils.c In file included from utils.c:32: /usr/include/arpa/inet.h:89: warning: parameter has incomplete type /usr/include/arpa/inet.h:92: warning: parameter has incomplete type /usr/include/arpa/inet.h:96: warning: parameter has incomplete type I will track them down later today if no-one have a quick answer. The tests I have made so far work OK. Cheers, Goran L --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

1 0

Re: Re: Syslog-ng: [wishlitst ;)] make it color. :)
by Siddall 12 Aug '99

12 Aug '99

>On Sat, Jul 31, 1999 at 11:24:11PM +0200, Dawid Kuroczko wrote: >> Hello! >> >> I have a suggestion, a feature I'd really like to see in a syslog >> daemon, but I haven't found do far. Please make it use ANSI color >> escapes ("\033[31;41;1m") while presenting messages to console, >> for example to make important messages red, standard grey and >> network green. I think it should be configurable, but I don't >> know where. :) Maybe a special color foo { ... } section, or >> maybe special additions in destination bar { ... } ? I think >> you're the best person to decide. I'm sorry I cannot send you >> a patch, but I'm to weak at C, unfortunately. :) > >Hi, > >I think this will be possible with the rewrite rules to be introduced in the >1.3.x series, but you'll have to wait for that a bit. > >-- >Bazsi >PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD >804E C82C 8EB1 > url: http://www.balabit.hu/pgpkey.txt I am new to this program, and new to the Linux world in general (6 days old) however I have this to offer: I would like to propose a small amendment to that idea. Simply allow user definable message PREFIX (msgpfx) and SUFIXs (msgsfx) that would automatically be appended onto the alert. Allow this to be done in the destination field so that you have the most control. Then the config file might look something like this. destination tty1 { msgpfx("\[\033[34m\]**ALERT!!!**"); msgsfx("**ALERT!!!**\[\033[0m\]); pipe("/dev/tty1"); usertty("administrator"); }; -Corbin B. Siddall, MCSE, CCNA

1 0

syslog-ng 1.1.31 && Solaris 2.6 SPARC
by Erik M. Beebe 12 Aug '99

12 Aug '99

Hello; I have recently installed syslog-ng 1.1.31 && libol-0.2.3 on a machine running SPARC Solaris 2.6; If I connect to port 514/UDP using NetCat, syslog-ng logs it just fine. If I try to use "logger" locally, it does not. Here are my source lines: source stdlog { sun-streams("/dev/log" door("/etc/.syslog_door")); }; source src { internal(); udp(ip(0.0.0.0) port(514)); }; I don't believe it's any problems with the destination/filter/log lines causing this problem -- it looks like syslog-ng just isn't getting what is sent to /dev/log. Anyone have any idea what could be causing this? Thanks much in advance, Erik -- Erik M. Beebe Infinet System Administrator Phone: (757) 664-2227 Email: ebeebe(a)infi.net http://www.infi.net

1 0

Re: [syslog-ng] Compile Error for syslog-ng-1.1.30
by Balazs Scheidler 11 Aug '99

11 Aug '99

On Fri, Aug 06, 1999 at 02:28:19PM +0900, bazsi wrote: > > > < static utmp ut; > > > --- > > > > static struct utmp ut; > > > > getutent() emulation for systems which not have one is still broken in at > > least one way. getutent() should return NULL when the EOF is reached. > > Though I don't understand C language very well... > > If read() read EOF then return (ssize_t)NULL. It's right. > But, Can I hope stored NULL to &ut by read() at the time? No. I have fixed it now. But Solaris should support getutent() calls, so you don't need those routines. This is the correct getutent() call for those interested: struct utmp *getutent(void) { static struct utmp ut; if (utent_fd == -1) { utent_fd = open(_PATH_UTMP, O_RDONLY | O_NOCTTY); } if (utent_fd == -1) return NULL; rc = read(utent_fd, &ut, sizeof(ut)); if (rc <= 0) { close(utent_fd); utent_fd = -1; return NULL; } else { return &ut; } } > > Could you provide some messages before the first door_return call? Maybe in > > a private message. > > OK. The following is what I Executed commands. > > # cp /dev/null /var/log/test.log > # ls -l /var/log/test.log > -rw-r--r-- 1 root other 0 Aug 6 13:41 /var/log/test.log > # /usr/local/sbin/syslog-ng > Terminated > # su - > # su - > # ps -ef | grep syslog-ng > root 21724 1 0 13:43:29 ? 0:00 /usr/local/sbin/syslog-ng > # cat /var/log/test.log > Aug 6 13:43:29 src@sun1 syslog-ng[21724]: syslog-ng version 1.1.30 starting I'd need a bit different truss outputs. 1) Launch syslog-ng using the truss -o syslog-ng.truss ./syslog-ng -dv Using -dv will prevent forking. 2) While the previous truss is running, on a different terminal (or VT session): truss -o logger.truss logger "This is a message" The files syslog-ng.truss and logger.truss is what I need. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

syslog-ng 1.1.31
by Balazs Scheidler 07 Aug '99

07 Aug '99

Hi, To fix the encountered build bugs in 1.1.30, I release 1.1.31. I tried to track the memory leak someone has mentioned, but it simply doesn't leak for me. I sent syslog-ng 100 simoultenious connections, 1000 messages each connection, from both local programs, and from network connections. It doesn't grow. Maybe who reported this, doesn't run the latest version? I've also released a new version of libol, though not much is changed there. A few error messages have been changed to be only verbose messages. Here's the changelog: 1999-08-07 Balazs Scheidler <bazsi(a)balabit.hu> * afuser.c: works on old utmp structures too (NetBSD) * configure.in: added test for modern utmp structure, bumped version number, changed required libol version to 0.2.3 * utils.c: fixed a bug in getutent() implementation * main.c: fixed a bug in SIGTERM handling, exit message is now displayed I've also updated the .deb packages, they are exact copies of what I am using on my computer. You can find this at the usual places: http://www.balabit.hu/products/syslog-ng and http://www.balabit.hu/downloads/syslog-ng Have fun! PS: I am going to a canoe tour next week, so I won't be able to respond to my mail. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Compile Error for syslog-ng-1.1.30
by georg.funke＠netcologne.de 06 Aug '99

06 Aug '99

Hi, when i try to syslog-ng-1.1.30, i get the following error: utils.c: In function `getutent': utils.c:70: syntax error before `ut' utils.c:77: `ut' undeclared (first use in this function) utils.c:77: (Each undeclared identifier is reported only once utils.c:77: for each function it appears in.) utils.c:79: warning: control reaches end of non-void function My System is Redhat 6.0 with kernel 2.2.10 and the compiler is gcc-2.95. Can you help me why i get this error? Thanks Georg -- Georg Funke Crowns & Flames SDC Cologne, Germany; http://www.geocities.com/Colosseum/4893 "Friendship is Square Dancing's greatest Reward"

3 4

syslog-ng 1.1.30
by Balazs Scheidler 04 Aug '99

04 Aug '99

Hi, I have released syslog-ng 1.1.30 and the corresponding libol version 0.2.2. Changes include: * Sun-Streams support cleaned up, it does compile (and it is really compiled in), and should work, but it's now completely untested. Please report success/failure you may had. * NetBSD didn't have getutent() calls, so I implemented them in utils.c. Again this is untested, I have no *BSD machines lieing around. Nothing has changed in libol, only a new symbol has been made public. You can find these at the usual place: http://www.balabit.hu/products/syslog-ng And the tarballs & pgp signatures at: http://www.balabit.hu/downloads/syslog-ng/source -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

Re: syslog-ng memory usage
by Balazs Scheidler 04 Aug '99

04 Aug '99

On Tue, Aug 03, 1999 at 09:05:04AM -0400, mr(a)noc.1st.net wrote: > Here's what it looked like today: > > root 13410 0.3 54.2 70452 69716 ? S Aug02 5:00 syslog-ng > > I've attached the conf file. What kind of system do you have? I mean is it Linux or something else? I tried to track down that memory leak, but syslog-ng was not growing at all for any of the stresstests I used. (I tried both the file and the udp source driver, and file destination driver) I see the following possibilities: 1) your malloc() implementation in the libc doesn't like fragmentation. syslog-ng allocates lots of memory blocks, but frees them as well, maybe your malloc() implementation may have problems with fragmented memory. You may have a look at GNU Malloc, which is AFAIR available separate from libc, and can be compiled to a standalone shared lib. 2) The output queues of syslog-ng begin to fill up, because it is unable to handle the load. This should not be a problem though, since by default the output queues are 100 entries long for each file. (using 200 bytes as an estimated length of a message we get 20*100*200 = 400000 Bytes for twenty file destinations) 3) The libc itself leaks somewhere. I use GNU libc 2.1.1, GNU/Linux Debian, potato distribution. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

.. beginner question src Sol 7 (intel)
by Werner Dundler 04 Aug '99

04 Aug '99

hello after trying to get a usefull logging with the standart solaris syslog i removed that damn program and install the newest version of syslog-ng. i compiled it (straight) using gcc and took a basic configuration and changed it. but i ran into one trouble.... my syslog-ng deamon runs fine and when i send a -HUP to it i get a nice message that syslog-ng initiolized a new configuration. but i can´t get it to log system messages. i used: source src { unix-stream("/dev/log"); internal(); }; and source src { unix-stream("/etc/.syslog_door"); internal(); }; i tested both configurations with # logger -t auth.debug "bla" .. but never got a response into my logfile. system is a solaris 7 intel machine. filter and log for auth.* should be up and running .... does anybody know what i did wrong ? ciao and thx werner

2 1

Syslog ng 1.1.29 under Solaris 7
by Rob See 04 Aug '99

04 Aug '99

I've been attempting to get syslog-ng to run under solaris 7, and have been running into the same problems that were mentioned in a previous message. The config script seems to only be checking for stropts.h and not strlog.h, so the sun-stream support isn't getting compiled in no matter what. When I change afstream.c so that it will compile that support in, it has problems with tmp not being defined. the line "char tmp[MAX_LINE + 1]" around line 70 is commented out. When I uncomment it, it compiles, but segfaults any time a message is sent to it in _vformat_length. Does anyone have any ideas that could help ? -Rob See

1 0

Re: [syslog-ng] Re: syslog-ng 1.1.29 and Solaris 7 support
by Balazs Scheidler 04 Aug '99

04 Aug '99

> > > On Mon, Aug 02, 1999 at 01:00:49PM -0400, Mike Wade wrote: > > > > How do I enable Solaris 7 internal syslog support with syslog-ng 1.1.29? > > > > Currently, I get an error saying 'sun-streams support not compiled in > > > > (STREAM=/dev/log)' > > > > Me too. > > > > > The configure script detects whether you have the necessary header files or > > > not. You need strlog.h and stropts.h, and for door support you need door.h. > > > Check the config.log file and configure output why those files were not > > > found. > > > > I don't know usage of configure very well. > > But, I think syslog-ng's configure is not check about strlog.h. > > What does the script 'make_class' require? That also appears to be a > problem for me. make_class requires scheme shell to run, but it's required only for syslog-ng development, nothing else. scsh is available in source at ftp://ftp-swiss.ai.mit.edu/pub/su/scsh/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: syslog-ng 1.1.29 and Solaris 7 support
by Balazs Scheidler 02 Aug '99

02 Aug '99

On Mon, Aug 02, 1999 at 01:00:49PM -0400, Mike Wade wrote: > How do I enable Solaris 7 internal syslog support with syslog-ng 1.1.29? > Currently, I get an error saying 'sun-streams support not compiled in > (STREAM=/dev/log)' The configure script detects whether you have the necessary header files or not. You need strlog.h and stropts.h, and for door support you need door.h. Check the config.log file and configure output why those files were not found. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: Syslog-ng: [wishlitst ;)] make it color. :)
by Balazs Scheidler 02 Aug '99

02 Aug '99

On Sat, Jul 31, 1999 at 11:24:11PM +0200, Dawid Kuroczko wrote: > Hello! > > I have a suggestion, a feature I'd really like to see in a syslog > daemon, but I haven't found do far. Please make it use ANSI color > escapes ("\033[31;41;1m") while presenting messages to console, > for example to make important messages red, standard grey and > network green. I think it should be configurable, but I don't > know where. :) Maybe a special color foo { ... } section, or > maybe special additions in destination bar { ... } ? I think > you're the best person to decide. I'm sorry I cannot send you > a patch, but I'm to weak at C, unfortunately. :) Hi, I think this will be possible with the rewrite rules to be introduced in the 1.3.x series, but you'll have to wait for that a bit. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

suggestion: format of logline
by Bjorn Andersson 27 Jul '99

27 Jul '99

Here is a feature that I have been missing from other syslog programs as well as syslog-ng: I would like to give as an option the format of the logline. It would, for instance, be nice to see the priority and facilty of the logline in the log. This way I would not need to have a lot of logfiles just so that that I afterwards could find out the priority and facility. This would also give me the possibility not to write out the host information, as this information is redundant if I only have a single host or if each host has its own directory of logfiles. Here's an example of such a line: Jul 27 04:53:10 daemon notice proftpd[7423]: FTP session closed. The configuration option could be something like: log_format("%m %d %t %f %l %m"); where %m = month %d = day %t = time %f = facility %l = level %m = message Please send any comments to me as well as the mailinglist. Regards, Björn -- Björn Andersson <bjorn(a)lifix.fi>

2 1

suggestion: sync in log statement
by Bjorn Andersson 27 Jul '99

27 Jul '99

I just tested syslog-ng. I think it is better than the standard syslogd and will start using it. I have two suggestions. I will post them in separate mails so that the discussion can go on in their own threads. Here's the first one: I would like to be able to put the sync option in log statements, instead of having a global value. This would give me the possibilty to buffer less important messages (for example frequent debug messages) and not buffer more critical messages (such as those with a priority of emerg and alert). Please send any comments to me as well as the mailinglist. Regards, Björn -- Björn Andersson <bjorn(a)lifix.fi>

1 1

syslog-ng 1.1.29
by Balazs Scheidler 26 Jul '99

26 Jul '99

Hi, I have silently released 1.1.29 of syslog-ng, which contains the previous patch I posted here against 1.1.28. This contains the single quotation marks patch, so that you can specify regexps more easily. Tell me if you have problems. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Weird behavior
by Nathaniel Couper-Noles 22 Jul '99

22 Jul '99

I have setup syslog-ng version 1.1.27 on a i386 running a (nearly) pure Debian Linux 2.1 install, libol version 0.2. This machine is being used to collect logs sent from NT machines running a program called EventSlog. I am trying to use the match() function to direct logs containing the string "/Security (" to a file bob.security, logs containing the string "/Applications (" to a file bob.app, logs containing the string "/SYSTEM (" to a file called bob.system, and logs that contain none of these strings to a file called bob.misc. My first attempt at this is in the first attachment to this document. It erred by redirecting all of the logs to each of the three files bob.app, bob.security, and bob.system all of the input to port 514. bob.misc was empty. Figuring perhaps that multiple filters aren't and'ed together in a log statement, I then wrote the conditional statements inside the filters, as in the second attachment to this email. This setup erred in the same way. I noticed also that the appropriately syntaxed configurations would behave similarly using syslog-ng version 1.2.23 and libol 0.1.19. Am I misusing the match() call? Or perhaps the logical connectors? Thanks for a great program! PS if there is a syntactical error in the files it is because I copied them wrong...syslog-ng always ran without explicit error... PPS I noticed the version-printing command line option syslog-ng -V does not work...though it is listed in the man page. _______________________________________________ Nathaniel Couper-Noles Department of Information Techonology School of Social Administration University of Chicago options { long_hostnames(off); sync(0); }; # sources source ntboxes { udp ( port(514) ); }; source sysl-ng { internal(); }; # destinations destination bob.security { file ("/var/log/bob.security"); }; destination bob.system { file ("/var/log/bob.system"); }; destination bob.app { file ("/var/log/bob.app"); }; destination bob.misc { file ("/var/log/bob.misc"); }; # filters filter f_security { match ("/Security ("); }; filter f_app { match ("/Application ("); }; filter f_system { match ("/SYSTEM ("); }; filter f_misc { not match ("/Security (") and not match ("/SYSTEM (") and not match ("/Application ("); }; filter f_bob { host ("bob"); }; # logs log { source (ntboxes); filter (f_bob); filter (f_security); destination (bob.security); }; log { source (ntboxes); filter (f_bob); filter (f_system); destination (bob.system); }; log { source (ntboxes); filter (f_bob); filter (f_app); destination (bob.app); }; log { source (ntboxes); filter (f_bob); filter (f_misc); destination (bob.misc); }; options { long_hostnames(off); sync(0); }; # sources source ntboxes { udp ( port(514) ); }; source sysl-ng { internal(); }; # destinations destination bob.security { file ("/var/log/bob.security"); }; destination bob.system { file ("/var/log/bob.system"); }; destination bob.app { file ("/var/log/bob.app"); }; destination bob.misc { file ("/var/log/bob.misc"); }; # filters filter f_bob_security { host ("bob") and match ("/Security ("); }; filter f_bob_app { host ("bob") and match ("/Application ("); }; filter f_bob_system { host ("bob") and match ("/SYSTEM ("); }; filter f_bob_misc { host ("bob") and not match ("/Security (") and not match ("/SYSTEM (") and not match ("/Application ("); }; # logs log { source (ntboxes); filter (f_bob_app); destination (bob.security); }; log { source (ntboxes); filter (f_bob_security); destination (bob.system); }; log { source (ntboxes); filter (f_bob_system); destination (bob.app); }; log { source (ntboxes); filter (f_bob_misc); destination (bob.misc); };

2 1

elso kerdes :) (fwd)
by Boda Karoly jr. 22 Jul '99

22 Jul '99

Udvozletem mindenkinek ! Uj vagyok a listan, kezdem is egy kerdessel :) adott a kovetkezo konfigreszlet: source src { unix-stream("/dev/log"); internal(); }; source net { udp(); }; destination console_all { file("/dev/tty13"); }; destination mailconsolerhye { file("/dev/tty22"); }; destination mailconsolerusalka { file("/dev/tty23"); }; destination rusalkalog { file("/dev/tty24"); }; filter f_mail { facility(mail); }; filter n_mail {not facility(mail); }; log { source(src); filter(n_mail); destination(console_all); }; log { source(src); filter(f_mail); destination(mailconsolerhye); }; log { source(net); filter(f_mail); destination(mailconsolerusalka); }; log { source(net); filter(n_mail); destination(rusalkalog); }; A kerdes a kovetkezo: A /dev/tty23-ra miert kerul az _osszes_ maillog, az is, ami a src-bol van ? A /dev/tty22 jol mukodik, oda csak a megfelelo mailuzenetek kerulnek. A /dev/tty13 es a /dev/tty24 szinten jol mukodnek, nem kerulnek oda a maillogok. -- Woockie ..."what is there in this world that makes living worthwhile?" Death thought about it. "CATS," he said eventually, "CATS ARE NICE." (Terry Pratchett, Sourcery)

1 0

syslog-ng-1.1.28
by georg.funke＠netcologne.de 22 Jul '99

22 Jul '99

Hi, you have forgot to patch configure, to work with libol-0.2.1, at the moment it insist on libol-0.2.0. After i patch this, it compiles well. Georg -- Georg Funke Crowns & Flames SDC Cologne, Germany; http://www.geocities.com/Colosseum/4893 "Friendship is Square Dancing's greatest Reward"

2 1

syslog-ng 1.1.28
by Balazs Scheidler 21 Jul '99

21 Jul '99

Hi, I have released syslog-ng 1.1.28 and libol 0.2.1 to fix the bugs that appeared on this mailing list lately: syslog-ng: * on *BSD recvfrom() does not return the source address on connection-oriented sockets (e.g. on TCP channels the source hostname was not found correctly) * The parser took two variables the same if they began with the same string libol: * the number of pending callouts were not counted correctly, so when syslog-ng was restarted via the HUP signal, it may have terminated because no event handlers were left. Otherwise syslog-ng were quite stable, so if nothing goes wrong at the end of July, I'll release 1.2.0. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: syslog-ng: new destination driver
by Balazs Scheidler 21 Jul '99

21 Jul '99

cc-ing to the syslog-ng mailing list. On Mon, Jul 19, 1999 at 03:31:21PM -0700, Jeremy Fitzhardinge wrote: > Hi, > > We need a syslog which can parse messages and then farm them out to > other alert mechanisms, which are dynamic and configurable, such as SNMP > traps, emails, pagers, etc... My original idea was to add a regexp > mechanism to syslog and fire off lines which match to the various > programs. After looking around, it looks like your syslog-ng is the > closest to our requirements, but it doesn't have the mechanism to > actually send lines to a program. Indeed it does, but the program statement you suggest below is on my todo list. To send lines to a program, you could use a named pipe. mkfifo /var/run/pager the program would then: #!/bin/sh cat /var/run/pager | batch_and_send and in syslog-ng declare a destination: destination { pipe("/var/run/pager"); }; However since it's impossible to pass arguments to the given script this way, a program destination driver should - and will - be implemented. > > I'm thinking of something along the lines of: > > destination pager { prog("/usr/local/bin/pager.pl") }; > > Each destination using a prog() would start a new instance, which is > persistent for the duration of syslog's life. This is so that they can > batch things together, rather than sending one email for each line of a > multi-line message. > > I've been going through the source to see how to implement it, and it > looks pretty clean. The only thing I don't understand is all the .x > files and make_class. How do these fit together, and what do I need to > do to implement a new afprog.*? syslog-ng uses make_class as a preprocessor to create data structures for object classes, and to generate code needed by the mark & sweep garbage collector. To create a new destination driver, you would create a class from (or directly use) log_dest_driver defined in destinations.h. If you look at affile.c (as one of the simplest destination driver), it derives a class: /* CLASS: (class (name affile_dest) (super log_dest_driver) (vars (name string) (flags simple int) (dest object io_fd) (dest_buf object abstract_buffer) (sync_freq simple UINT32))) */ The constructor of a class is called make_<classname> by convention, so affile_dest is created by make_affile_dest: struct log_dest_driver *make_affile_dest(const char *name, int flags) { NEW(affile_dest, self); self->super.super.init = do_init_affile_dest; self->super.super.handler = do_handle_affile_log; self->super.log_fifo_size = -1; self->name = c_format_cstring("%z", name); self->flags = flags; self->sync_freq = -1; /* use global setting */ return &self->super; } This returns "struct log_dest_driver *" because the derived class itself is private to this module, and externally only the log_dest_driver is known. NEW creates a new instance of affile_dest, and stores a pointer to this instance in self. Then the method pointers are initialized. Internally log messages flow in log-pipes: log_source_driver -> log_source_group -> log_center -> log_dest_group -> log_dest_driver Several log_source_drivers may point to the same source_group, and several source_groups may point to a log_center. There's only one log_center per configuration, and log_center is the one which applies filter rules, and in case they match, it chooses the appropriate log_dest_group, thus sends the log message to all the log_dest_driver belonging to that group. An element of this pipe must be a descendant of log_handler (defined in log.h) Since several element has a next pointer (all except the last log_dest_driver) a less general class: log_handler_pipe is introduced here, which has an additional next field. The above pipe is constructed as the configuration file is read, and if the configuration is found to be syntactically valid, everything is initialized. (this is log_handler.init) Source drivers open source sockets, and install read hooks to get events on them. As a message is read it is passed towards the central log_center using the next->handler method. There's an optional method in log_handlers, which is called destroy. It is called when the log pipe is destroyed. So this is the internal data structure in syslog-ng, for detailed information about the class definition language parsed by make_class, download lsh (ftp://ftp.lysator.liu.se/pub/security/lsh/lsh*.tar.gz) and read the file HACKING. make_class requires scsh (Scheme shell) to run, though make_class is being ported to more free implementations of scheme, like guile. I hope this helps, -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

[bazsi@balabit.hu: Re: [syslog-ng] Re: bug?]
by Balazs Scheidler 19 Jul '99

19 Jul '99

This mail contains two patches you may be interested in. (especially under *BSD) ----- Forwarded message from Balazs Scheidler <bazsi(a)balabit.hu> ----- Date: Mon, 19 Jul 1999 23:42:49 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> To: joeym(a)inficad.com Subject: Re: [syslog-ng] Re: bug? > > Sometimes when I SIGHUP syslog-ng (client or server), I will get this > too: > > SIGHUP received, restarting syslog-ng > new configuration initialized > io_iter(): no waiting fds and no callouts! exiting... > > However, every once in a while, it will say 'new configuration > initilized' and keep right on going. But most of the time, it gives the > io_iter() err and exits. Please try this patch against libol: --- libol-0.2.0/src/io.c Sat Jul 10 15:23:09 1999 +++ libol/src/io.c Mon Jul 19 23:04:46 1999 @@ -268,9 +268,7 @@ ol_queue_remove(&n->header); ol_space_free(n); } - else { - nco++; - } + nco++; } } if (!nfds && !nco) { The other problem should be BSD specific. (or my solution is Linux specific some way. I assumed that recvfrom() on connected sockets return the source address of the connection, but as it seems under BSD this is not the case.) Try the following somewhat (ugly) patch, to see if this is the problem: --- syslog-ng-1.1.27/src/afsocket.c Sat Jul 10 17:58:33 1999 +++ syslog-ng/src/afsocket.c Mon Jul 19 23:22:37 1999 @@ -106,6 +106,16 @@ static void do_handle_afinet_line(struct log_handler *c, struct log_info *msg) { CAST(afsocket_source_connection, self, c); + if (!msg->saddr) { + char sockaddr_buf[256]; + struct sockaddr *sa = (struct sockaddr *) &sockaddr_buf; + int salen = sizeof(sockaddr_buf); + + if (getpeername(self->fd, sa, &salen) != -1) { + msg->saddr = ol_space_alloc(salen); + memcpy(msg->saddr, sa, salen); + } + } HANDLE_LOG(self->super.next, msg); } I've fixed another problem not reported by you. Variable names beginning with the same bytestring (e.g. f_router & f_router_acct) were resolved incorrectly. Check out the mailing list (or the archive at http://lists.balabit.hu/pipermail) for that patch. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt ----- End forwarded message ----- -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: syslog-ng parser bug?
by Balazs Scheidler 19 Jul '99

19 Jul '99

On Mon, Jul 19, 1999 at 07:11:55PM +0200, Rolf Offermanns wrote: > Hi Balazs! > I think I have found a bug in the config file parser in 1.2.27. > I will try to describe it as exactly as my english allows me to... Thanks for the report. The problem was that the first few bytes of those variable names were the same, so the same filter rule was applied to both log statement. Try this patch: --- syslog-ng-1.1.27/src/cfgfile.c Sat Jul 10 17:58:33 1999 +++ syslog-ng/src/cfgfile.c Mon Jul 19 23:38:44 1999 @@ -18,7 +18,7 @@ * * Inspired by nsyslog, originally written by Darren Reed. * - * $Id: cfgfile.c,v 1.17 1999/07/10 15:58:33 bazsi Exp $ + * $Id: cfgfile.c,v 1.18 1999/07/18 12:56:11 bazsi Exp $ * ***************************************************************************/ @@ -62,7 +62,8 @@ #define RESOLVE_VAR(s, first, next, i) \ for (s = first; s; s = s->next) { \ - if (strncmp(i->name->data, s->name->data, i->name->length) == 0) { \ + if (i->name->length == s->name->length && \ + strncmp(i->name->data, s->name->data, i->name->length) == 0) { \ i->ref = (struct ol_object *) s; \ break; \ } \ @@ -154,7 +155,7 @@ self->init = do_init_config; self->destroy = do_destroy_config; self->backend = backend; - self->sync_freq = 1; + self->sync_freq = 0; self->mark_freq = 1200; /* 20 minutes */ self->long_hostnames = 1; self->time_reopen = 60; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: bug?
by Balazs Scheidler 18 Jul '99

18 Jul '99

Hi, Thanks for reporting this. I am going to fix these as soon as I'll have some time. On Wed, Jul 14, 1999 at 10:15:06AM -0700, joeym(a)inficad.com wrote: > Sorry to bother you again, but I have noticed some strange behavior when > logging over TCP. > > Client Machine is BSDI 4.0 running syslog-ng. 'Server' machine is > FreeBSD 3.2-STABLE running syslog-ng and receiving UDP, TCP, and local > syslog msgs. When the client machine sends messages via UDP back to the > server machine, the server machine sees the tag as the correct hostname. > When the messages are sent from the client -> server via TCP, then the > server marks those messages as coming from its own hostname, and not the > client's hostname. > > Also, I noticed that sending SIGHUP to syslog-ng on the BSDI client > machine causes this message (in debug mode) to be sent : > new configuration initialized > io_iter(): no waiting fds and no callouts! exiting... > > and then it exits.. If i SIGHUP syslog-ng on the 'server' machine, it > reloads its config and moves happily on. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 1

Re: Small conf suggestion
by Balazs Scheidler 13 Jul '99

13 Jul '99

On Mon, Jul 12, 1999 at 09:01:21PM -0700, joey miller wrote: > I'm currently evaluating syslog-ng for use as a central syslog server in > our facilities, and have come across something that may cut down similar > setups (config file wise) like what I'm implementing by a large margin. > > I plan to have multiple hosts log back to a single syslog-ng server, and > am going to keep each machine/Cisco's logs seperated in a structure such > as: > /var/log/machine1.inficad.com/messages > /var/log/machine1.inficad.com/daemon.log > /var/log/routerX.inficad.com/messages > .. etc .. > > However, I've noticed it's going to require multiple (somewhat redundant) > destination {} entries to get this going the way I'd like. What I was > thinking was something along the lines of allowing a replacable string in > a file(); definition. For example, I could do: > > destination d_auth { file("/var/log/$HOST/auth.log"); }; > > This would allow me to have a single entry for the d_auth destination, > instead of requiring a seperate destination{} entry for each machine + log > level. > > If there is something like this available already, please let me know, as > I'm still exploring the syslog-ng package and haven't even begun to > exploit its full potential yet. It is not available yet, but as it has already been suggested by at least 3 people, I'll implement this in 1.3.x series. For now you have to stick to several destination fields. To make this problem easier to maintain, simply write a shell script or such to generate the config file. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: [syslog-ng] syslog-ng 1.1.27
by Ispanovits imre 11 Jul '99

11 Jul '99

Balazs Scheidler, SZO, 10 JÚL 1999-n írta: >>Hello, > >I have released version 1.1.27 aka 1.2.0rc1 of syslog-ng and the >corresponding libol versioned 0.2.0. I worked on this release a lot to >make it as bugfree as possible, and make installation flawless. T > >Syslog-ng is available at the usual places: > >http://www.balabit.hu/downloads/syslog-ng/source/ > >The official webpage is at: > >http://www.balabit.hu/products/syslog-ng/ >^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Hali! Biztos, hogy kint van? Miért nem látom? Imre ----------------------------------------------------------------- Cyrix 6x86 PR200MX/Amptron PM9900A/80MB/QFB EL5.1A/R6 6.0/2.2.9/KDE-1.1.1 -----------------------------------------------------------------

1 0

Archive test
by Balazs Scheidler 11 Jul '99

11 Jul '99

Archiver test, sorry for inconvinence

1 0

Archive test
by root 11 Jul '99

11 Jul '99

Archiver test, sorry for inconvinence

1 0