- syslog-ng - lists.balabit.hu

inetd/tcp_wrappers and syslog-ng
by Nathaniel Couper-Noles 21 Jun '99

21 Jun '99

Has anyone had any success integrating syslog-ng and inetd and/or tcp_wrappers? Running syslog-ng inside of inetd on a linux 2.0.36 box seems to generate unfavorable results. Each time a remote system reports data to udp 514, the system loads a new instatiation of syslog-ng, until there are literally 50+ copies running parallel. Any possibility for future support of these services? TIA Nathaniel

3 2

syslog-ng and solaris doors again
by Balazs Scheidler 21 Jun '99

21 Jun '99

Hi, I have digged into low level solaris. I found the followings: * I receive NULL's in the server procs parameters, because they are sent as NULLs. (I've put a breakpoint in _door_call, and after familiarizing myself with SPARC assembly, I could find the passed door_arg_t structure, and the fields are indeed NULLs. * Seeing the truss output of the logger program I found that the message is also sent to the sun STREAMS device /dev/log So as it seems the native syslogd receives the message using STREAMS instead of the door. The reason for this is unknown, maybe if the message is successfully sent using STREAMS, it is not sent via the DOOR. I have began implementing the STREAMS driver. (to be exact, I have already hacked it together, currently trying to compile it) -- Bazsi

2 7

[bazsi@blurp.balabit.hu: Fwd: Re: Solaris and syslogd]
by Balazs Scheidler 17 Jun '99

17 Jun '99

Hi, Good news. The problem with sun-doors are solved: ----- Forwarded message from Balazs Scheidler <bazsi(a)blurp.balabit.hu> ----- Date: Thu, 17 Jun 1999 22:48:14 +0200 From: Balazs Scheidler <bazsi(a)blurp.balabit.hu> To: bazsi(a)balabit.hu Subject: Fwd: Re: Solaris and syslogd Path: news.iif.hu!news.bme.hu!news-ge.switch.ch!newsfeed.berkeley.edu!dispose.news.demon.net!demon!colt.net!easynet-tele!easynet.net!btnet-feed2!btnet!carbon.eu.sun.com!uk-usenet.uk.sun.com!nl-usenet.holland.sun.com!not-for-mail From: Casper.Dik(a)Holland.Sun.Com (Casper H.S. Dik - Network Security Engineer) Newsgroups: comp.unix.solaris Subject: Re: Solaris and syslogd Date: 15 Jun 1999 07:46:58 GMT Organization: Sun Microsystems, Netherlands Distribution: inet Message-ID: <casper.929432774(a)nl-usenet.sun.com> References: <slrn7m85qd.2gg.bazsi(a)blurp.balabit.hu> NNTP-Posting-Host: room101.holland.sun.com Mail-Copies-To: never Lines: 22 [[ PLEASE DON'T SEND ME EMAIL COPIES OF POSTINGS ]] bazsi(a)blurp.balabit.hu (Balazs Scheidler) writes: >I am writing a portable syslogd replacement, and I have a small problem with >Solaris. I hope someone can help me out. >So, the facts I know: Solaris uses the new multithreaded door mechanism to >send messages from client programs to the syslogd server. The used door is >called /etc/.syslog_door. No, it doesn't. It uses the msglog device to sendmessages. The syslog door is used to confirm that syslogd is still running. Casper -- Expressed in this posting are my opinions. They are in no way related to opinions held by my employer, Sun Microsystems. Statements on Sun products included here are not gospel and may be fiction rather than truth. ----- End forwarded message ----- -- Bazsi

1 0

Re: syslog-ng
by Balazs Scheidler 17 Jun '99

17 Jun '99

On Thu, Jun 17, 1999 at 11:35:53AM -0400, Forrest Aldrich wrote: > Okay, perhaps I don't understand. Syslog takes a number of attributes > and logs them into a file /var/log/syslog (or whatever you define). Those > attributes could be translated into a schema/table and inserted into > the database each time. Then, those same fields can be keyed or > indexed, searched against... reports run. I would think that would > be very useful. > > The alternative is to hack shell and perl scripts together to pull out that > data... or by viewing them manually, which involves sore eyes and headaches. The problem with exactly this "translation into a schema/table". log messages are quite different, and it is very difficult to write a general parser, which extracts information from log messages. I do not want to put this difficulty to syslog-ng itself, however it is possible to write this functionality to an external program or perl script. -- Bazsi

1 0

Re: syslog-ng
by Balazs Scheidler 17 Jun '99

17 Jun '99

On Tue, Jun 15, 1999 at 05:33:16PM -0400, Forrest Aldrich wrote: > What about a database backend... like MySQL. To have the > capability to log syslog messages into (perhaps multiple) SQL > databases would be very useful, I think. I think logging to an SQL table with only one column has no point. Analyzed log entries would have a point, but analyzing messages is beyond the scope of syslog-ng. An external program hooked to syslog-ng with a local communication mechanism (unix-stream, or named pipe) should be used instead. -- Bazsi

1 0

Re: syslog_ng suggestion
by Marc Duponcheel 14 Jun '99

14 Jun '99

On 1999 Jun 14, Balazs Scheidler wrote: > Hi, > > (cc-ing the message to the syslog-ng mailing list) Thanks, I better subscibe ! > On Mon, Jun 14, 1999 at 01:45:02AM +0200, Marc Duponcheel wrote: > > First of all: CONGRATULATIONS with syslog_ng! > > > > UNIX is waiting 20 years already to get rid of the limited syslog > > daemon ;-) > > Thanks. > > > Since you use a real language to write syslog_ng.conf I would like you > > to propose a generalisation, which, I believe, should be easy (and > > powerful). > > > > You may have noticed that big parts of a syslog_ng.conf are simply > > substitutions of some template ... > > > > What about variables (coming out of the log itself)? > > > > like: > > variables=level,facility,program,host > > > > Then syslog_ng could interpret generic specifications resulting in > > generating multiple log files without the syslog_ng.conf writer having > > to worry about the actual possible values. For 'program' and 'host' I > > believe this could be a real win. > > > > Of course you should make ${program}=foo for such things like > > foo[NNN]: and foo: > > > > destination d_${variable} { > > file /var/log/${variable}; > > }; > > filter f_${variable} { > > level(${variable}); > > }; > > log { source src; > > filter f_${variable}; > > destination d_${variable}; > > }; > > > > > > In fact one could combine variables (2 below) to generate any kind of > > combinations. > > > > destination d_${level}.${program} { > > file /var/log/${level}.${program}; > > }; > > filter f_${level}.${program} { > > level(${level}); > > program(${program}) > > }; > > log { source src; > > filter f_${level}.${program}; > > destination d_${level}.${program}; > > }; > > this approach has some difficulties. > > syslog-ng opens all files at startup and keeps them open, and using > variables above would make it rather difficult to find out the possible > files at startup. (= impossible) Yeah, I was somewhat aware of this and also about the dangers of having too many files opening closing all the time ... > A workaround would be to open a destination only when some output is written > there, but this would require quite big changes in syslog-ng internally. And would probably slow down things ... I don't know. > The same effect you proposed above could be done using some config file > generation script: > > for fac in mail news auth; do > for lev in crit alert debug; do > cat syslog-ng.template | > sed -e "s/\$\{facility\}/$fac/g" -e "s/\$\{level\}/$lev" > done > done That's indeed what I do for (fac, lev) ;-) but for program and hostname I don't have a list ... since any program or host could suddenly decide to log something, a fact by the way a sysadmin might be interested in (such a new program or host). -- Marc Duponcheel marc(a)offline.be [home] +32 (0)3 449.44.94 mduponch(a)cisco.com [work] +32 (0)2 704.52.40

1 0

Re: syslog_ng suggestion
by Balazs Scheidler 14 Jun '99

14 Jun '99

Hi, (cc-ing the message to the syslog-ng mailing list) On Mon, Jun 14, 1999 at 01:45:02AM +0200, Marc Duponcheel wrote: > First of all: CONGRATULATIONS with syslog_ng! > > UNIX is waiting 20 years already to get rid of the limited syslog > daemon ;-) Thanks. > > Since you use a real language to write syslog_ng.conf I would like you > to propose a generalisation, which, I believe, should be easy (and > powerful). > > You may have noticed that big parts of a syslog_ng.conf are simply > substitutions of some template ... > > What about variables (coming out of the log itself)? > > like: > variables=level,facility,program,host > > Then syslog_ng could interpret generic specifications resulting in > generating multiple log files without the syslog_ng.conf writer having > to worry about the actual possible values. For 'program' and 'host' I > believe this could be a real win. > > Of course you should make ${program}=foo for such things like > foo[NNN]: and foo: > > destination d_${variable} { > file /var/log/${variable}; > }; > filter f_${variable} { > level(${variable}); > }; > log { source src; > filter f_${variable}; > destination d_${variable}; > }; > > > In fact one could combine variables (2 below) to generate any kind of > combinations. > > destination d_${level}.${program} { > file /var/log/${level}.${program}; > }; > filter f_${level}.${program} { > level(${level}); > program(${program}) > }; > log { source src; > filter f_${level}.${program}; > destination d_${level}.${program}; > }; this approach has some difficulties. syslog-ng opens all files at startup and keeps them open, and using variables above would make it rather difficult to find out the possible files at startup. (= impossible) A workaround would be to open a destination only when some output is written there, but this would require quite big changes in syslog-ng internally. The same effect you proposed above could be done using some config file generation script: for fac in mail news auth; do for lev in crit alert debug; do cat syslog-ng.template | sed -e "s/\$\{facility\}/$fac/g" -e "s/\$\{level\}/$lev" done done -- Bazsi

1 0

syslog-ng and solaris again
by Balazs Scheidler 13 Jun '99

13 Jun '99

Hi, I further inverstigated the Solaris problem. Any door calls arriving to syslog-ng contain NULL as the log message. I tried to call the door using my small .c program, and it was successful, and the message arrived without problems. So solaris is playing some nasty games here. If this problem is solved, there's still one thing to be resolved: I must interrupt the poll() syscall when a message arrives from a thread (because destinations are written in nonblocking fashion, and when poll() was called the buffered output was not yet available, the thread changes this state, but poll will not know this, another solution would be to use a pipe to communicate with the nonblocking i/o layer from the threads. -- Bazsi

1 0

syslog-ng 1.1.24
by Balazs Scheidler 13 Jun '99

13 Jun '99

Hi, This release fixes the solaris compilation bugs. Nothing else is changed now. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

4 10

Re: syslog-ng digest, Vol 1 #39 - 14 msgs
by Marcin Okraszewski 13 Jun '99

13 Jun '99

> Yes, it's a good idea. My solution will be that I'll simply call a script > and the local sysadmin can do anything he wants. By default a script which > sends a pgp encrypted message will be supplied. I don't think it is good idea to call external script. It can be simply repleaced by any one who will get root privileges in any way. -- -------------------------------------------------------------------- Marcin Okraszewski mailto:okrasz@vlo.ids.gda.pl http://www.vlo.ids.gda.pl/~okrasz/ -------------------------------------------------------------------- PGP key: http://www.vlo.ids.gda.pl/~okrasz/pgp.txt finger okrasz(a)vlo.ids.gda.pl

2 1

hdd crash
by Balazs Scheidler 13 Jun '99

13 Jun '99

Hi, Sorry for the unresponsiveness from my part but I had a major HDD crash. Luckily I had backups about my most important things, and at the end I could also save the whole disk. Replacement is due next week, so my development efforts will be stalled a bit. I am sorry for not answering mails etc. -- Bazsi

1 0

Re: hashing
by canacar＠ea.eee.metu.edu.tr 10 Jun '99

10 Jun '99

> Or yet another, I like this one best. syslog-ng generates a random value > which it will use to generate hash #0, then a copy of this random value is > sent to the sysadmin in an email message. Later when somebody wants to check > logfile integrity, a copy of this key is needed. This could also be a > security risk if that message remains on the same box. This security risk can be reduced if the message is encrypted using the administrators (pgp) public key. Only the admin with the correct passphrase (and private key) will be able to obtain the random key. Can --=< Can Erkin Acar (canacar(a)bigfoot.com, canacar(a)eee.metu.edu.tr) >=--

1 0

Chroot jails
by Ian Vaudrey 10 Jun '99

10 Jun '99

Hi, Would I be right in thinking that Syslog-ng's ability to use multiple message sources could be useful in building chroot jails on Linux, e.g. would source src { unix-stream /dev/log; /chroot/named/dev/log; internal; }; work in place of using holelogd? - Ian

2 1

RE: [syslog-ng] hashing
by Ian Vaudrey 10 Jun '99

10 Jun '99

On 09 June 1999 18:29, Balazs Scheidler wrote: <snip> > Or yet another, I like this one best. syslog-ng generates a random value > which it will use to generate hash #0, then a copy of this random value is > sent to the sysadmin in an email message. Later when somebody wants to check > logfile integrity, a copy of this key is needed. This could also be a > security risk if that message remains on the same box. I'm very much a *n?x newbie so this may be an incredibly stupid idea, but FWIW how about PGP encrypting the email using the admin's public key? - Ian

2 1

compile problem
by Rob Cermak 10 Jun '99

10 Jun '99

I'd love to trash my current syslogd on Solaris. I'd like to see this work and transmit logging back to a Linux box to collate all the messages. Let me know if you need anything else...willing to take patches to test. I'll see what changed between version .22 and .23... uname -a SunOS magellan1 5.6 Generic_105181-03 sun4m sparc SUNW,SPARCstation-20 System: Solaris 2.6 / # gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.6/egcs-2.90.29/specs gcc version egcs-2.90.29 980515 (egcs-1.0.3 release) syslog-ng-1.1.23 / libol-0.1.19 I compiled the prior release fine, but it core dumped once it was started and I forced a message to the syslog. Compiling the new version I hit this: gcc -DHAVE_CONFIG_H -I. -I/h0/cermak/src/syslog-ng-1.1.23/src -I. -O2 -Wall -I/usr/local/include/libol -c center.c center.c:72: warning: missing braces around initializer for `loglock.__pthread_mutex_flags' center.c: In function `do_distribute_log': center.c:101: warning: implicit declaration of function `pthread_lock_mutex' center.c:105: warning: implicit declaration of function `pthread_unlock_mutex' gcc -O2 -Wall -I/usr/local/include/libol -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afinter.o afuser.o afdoor.o utils.o syslog-names.o getopt.c getopt1.c -lpthread -ldoor -ll /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file pthread_lock_mutex center.o pthread_unlock_mutex center.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /h0/cermak/src/syslog-ng-1.1.23/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive'

3 4

hashing
by Balazs Scheidler 09 Jun '99

09 Jun '99

Hi, I am thinking about the way digital hashes on output files should work. Syslog-ng version 1.0.x implemented things this way: The hash #0 is generated using some random salt and a password supplied by the system administrator. The next hash is always generated by the previous one (or #0 if this is the first) and the current log message sent to the file. Each hash is stored in a file. Verifying the hashes is simple, you give the password and check all the written hash entries for validity. The hash algorithm used was sha1, though it could use md5 just as well. The problem with the above approach is logrotation. To be really secure the password may not be saved to the disk, and since starting the hash required a password, new log files cannot be started automatically. A solution could be "delayed hash start". This means, that when logfiles are restarted no starthash is generated, and hashing is not done as long as the system admin logs in, and initializes hashing by giving his password. After initialization, hash is calculated for each message written this far. And hashing could continue as normal. The problem with the above may be that, if huge amounts of log had been written, regenerating hashes could take some time, and could take log service down for a while. Other solution could be "interactive logrotation", where the system administrator would have to give his password to restart logrotation. Or yet another, I like this one best. syslog-ng generates a random value which it will use to generate hash #0, then a copy of this random value is sent to the sysadmin in an email message. Later when somebody wants to check logfile integrity, a copy of this key is needed. This could also be a security risk if that message remains on the same box. Does anybody else have an idea? -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

version 1.1.23 released
by Balazs Scheidler 09 Jun '99

09 Jun '99

Hi, I have found the Solaris bug I mentioned yesterday, so I released a new version of syslog-ng, this time 1.1.23. The "bug" was in libol, so I released 0.1.19 of libol as well. Here's the changelog of libol: 1999-06-09 Balazs Scheidler <bazsi(a)balabit.hu> * wait at most 60 seconds in poll (so that pending closes are really closed in at most 60 seconds) * changed fatal() to werror() if the poll fails syslog-ng has not changed since yesterday. The exact bug on solaris has been fixed by the 2nd change above. poll failed in libol since the config file I tested syslog-ng with was referring to /dev/tty as a destination. When syslog-ng forked and became a session leader trying to poll /dev/tty failed. poll() returned an ENXIO error (which by the way is undocumented) and fatal() aborted the program. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

cvs tree
by Balazs Scheidler 09 Jun '99

09 Jun '99

Hi, I could not deal with a solaris bug I encountered, so I don't release any snapshots now. What I have done since last release, and what's available in cvs: 1999-06-08 Balazs Scheidler <bazsi(a)balabit.hu> * named pipes work now with the file driver (I may introduce a pipe driver later on, which could be an alias for "file") * fixed a bug in log_handler.destroy handling * changed -HUP handling, it reverts to the old config if the new cannot be initialized * changed afsocket_dest_reopen to be a general callback, capable of reinitializing any log_handler (and moved to destinations.c) * debian control file fixes (reported by Peter Gervai, grin(a)tolna.net) * internal source driver checks if used once * fixed a bug in syslog-ng.h, which used the config file in cwd even if debugging was turned off 1999-06-06 Balazs Scheidler <bazsi(a)balabit.hu> * added reference documentation to doc/syslog-ng.html * changed the parser, so IDENTIFIER's can always be quoted using quotation marks (") There have been some bugfixes, and the documentation was added to the tree. I have a quite major problem on solaris. As it seems the way syslog-ng exits the parent process when backgrounding itself conflicts with solaris thread libraries. The parent process waits until the configuration is initialized, so no log messages sent directly after syslog-ng backgrounds itself is not lost. This is accomplished via the TERM signal: parent: wait until term signal arrives child: initialize config send SIGTERM to parent The parent exits without problems, but the child gets a SIGABRT for some unknown reason. If I use the -d switch, which prevents syslog-ng to background itself, everything works fine. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

2 2

Re: syslog-ng 1.2.22 runtime problems
by Balazs Scheidler 09 Jun '99

09 Jun '99

Hi, cc-ing to the syslog-ng list. > Thank you for implementing compatibility with syslog_door. I've installed > syslog-ng files in /usr/local, but I have some problems with a few things. > > uname -a: > > SunOS logserver 5.7 Generic sun4m sparc SUNW,SPARCstation-5 > > I start /usr/local/bin/syslog-ng manually. When I do so I get this error > message: > > ld.so.1: /usr/local/bin/syslog-ng: fatal: libol.so.0: open failed: No such > file or directory > Killed > > I can get around this (sloppy) by: > > env LD_LIBRARY_PATH=/lib:/usr/lib:/usr/local/lib /usr/local/bin/syslog-ng Yes, you have to either add the /usr/local/lib directory to your /etc/ld.so.conf (at least this is the file under Linux), or set the above environment variable. > > Then an error with parsing the configuration file occurs. I removed the > > options { sync(10) }; > > line, and then syslog-ng executes without an error. That's strange. sync options _should_ work, and work on my box without problems. The file shipped with syslog-ng 1.1.22 is the same I test syslog-ng with. To check what might be wrong, please ./configure syslog-ng with the --with-debug switch, and send me the output of syslog-ng -y, which will display yacc debug output. > > However, it doesn't seem to be doing anything. > > I do a 'truss' (like strace) to see what it's doing, and it is sleeping. > It doesn't background itself like normal syslogd does. When I stop the > process (control-C) it core dumps... This may happen when configuration initialization blocks somewhere. syslog-ng first reads and parses configuration, if this is successful, tries to initialize it, and if this is successful too, it backgrounds itself. It most probably blocked in the initialization phase. The truss output should help. > > Now, from reading your web site I understand that "libol-config" is > important in running syslog-ng, but I cannot find out how to use it. libol-config is just a small script which makes it easy for syslog-ng to find libol header files and libraries. It is only meant for development (e.g. programs using libol) > > Perhaps you could begin a document on your web site which explains how to > get the daemon running. I have a minimal configuration file which is from > the src/ directory in your 1.2.22 distribution. It looks like this: > > options { sync(10); }; > source src { udp 0.0.0.0,1999; sun-door /etc/.syslog-door; internal; }; > destination everything { file /dev/tty10 sync(2); usertty root; }; > log { source src; destination everything; }; > > Unchanged, this configuration file is not parsed correctly by syslog-ng. I > deleted the first line and removed sync(2) from 'destination everything' > and that did not work, either. Then I deleted 'source src' altogether and > syslog-ng went into sleep mode. > > I do not know what I am supposed to be doing :) Can you help? First of all I think /dev/tty10 does not exist under Solaris. Under linux this means the 10th virtual terminal on the console. I don't have any other idea, so please send me the truss output, and the yacc debug messages I mentioned earlier. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

3 4

Experiences and question from a newbie
by Stefan Seufert 08 Jun '99

08 Jun '99

Hi, today i had some free minutes was able to play around with syslog-ng the first time. First some experiences I made while installing syslog-ng: I downloaded the latest releases of libol and syslog-ng nd tried to compile them on my test-box (2.0.35, a SuSE 5.3 system). The configuration, making ant the installation of libol succeded without any problems. But when I used configure in the syslog-ng it was unable to find libol-config although it had detected libol (It displayed the correct version number). After adding the source-path of libol to $path I was was able to compile syslog-ng without any further errors. If this is the normal behaviour it might be a good idea to add a hint to the documentation. From this point on everything worked as expected. Thanks for this great product. Now, some questions: - In the sample config file in the debian/ subdirectory there is a line wich states that support for special files is not fully implemented. I am currently using the "old" syslog-package on one of my hosts to log data into a FIFO from which the data is fetched by a perl script, analysed and put into a database. Syslog-ng seems currently not be able to handle fifos correctly. When can we expect this to be implemented? - Is there a howto or a detailed description for writing additional (destination) drivers for syslog-ng? I have serveral ideas how to enhance syslog-ng by some new drivers (keywords: mail, program, mysql, lpr) and will maybe able to contribute. Stefan

3 4

Switching libol away from scsh
by Tommi Virtanen 07 Jun '99

07 Jun '99

Hi. Currently, scsh's license is non-free. The author has promised to fix this, but seems to be incredibly busy with other issues, or just disinterested. Meanwhile, I'd like syslog-ng to be as free as possible; that includes not needing scsh to work. I recently made minor modifications to lsh to make it work without scsh (Ray Dassen will be integrating my changes in the lsh distribution shortly; I will provide the patch by email if requested), and as syslog-ng and libol share the same backend, those modifications were quite easy to port to libol. What follows is a diff file that modifies libol to use Guile instead of scsh. Hopefully you will integrate this into your distribution. Thank You. -- Havoc Consulting | unix, linux, perl, mail, www, internet, security consulting +358 50 5486010 | software development, unix administration, training

3 2

Documentation for syslog-ng
by Balazs Scheidler 06 Jun '99

06 Jun '99

Hi, I have released some reference documentation for syslog-ng. It is available at: http://www.balabit.hu/products/syslog-ng Please note that I have moved the webpage of syslog-ng to the above url instead of the old one, so please update your bookmarks. (The old one still works with a Redirect) -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng 1.1.22
by Balazs Scheidler 05 Jun '99

05 Jun '99

Hi, I have released syslog-ng 1.1.22, which adds the following new features. * a new destination, usertty, which writes messages to the given users' terminal * a new source, called sun-door, which implements the native log protocol of Solaris 2.5 and above. This is highly experimental, could someone with root access to a solaris box test this out? * documentation updates (someone with experienced man page creation skills, could help me out with this) No bugs have been fixed, since none were reported. (which either means that there are no bugs, or that nobody uses syslog-ng :) I hope that the first version is true. I don't plan to announce this version to a wider audience as long as the previously mentioned features are tested a bit. Please note that I have changed pgp keys. This doesn't mean that my old key has been compromised. It only means that I thought 768 bits is not secure enough. You can get my new 2048bit key either by fingering me, or downloading from the web site. The new key is signed with the old one, so you can trust the new one as much as you trusted the previous one. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

switching away from scsh
by Tommi Virtanen 03 Jun '99

03 Jun '99

One more correction: The scsh-compability libraries required by the current patch are still non-free; but now that the make_class and friends are ported to Guile, it will be easier to port them away from scsh features. I will provide more patches later. -- Havoc Consulting | unix, linux, perl, mail, www, internet, security consulting +358 50 5486010 | software development, unix administration, training

2 1

Re: [syslog-ng] syslog-ng 1.1.20 and libol version 0.1.18 released
by Balazs Scheidler 29 May '99

29 May '99

> > I have fixed several bugs and build errors in both syslog-ng and libol. It > > compiles cleanly and works for me (tm). It has also been debianized, so it's > > available in a debian package as well. > > > now it compiles OK but every next attempt reread configfile by HUP cause > Segfault: > > > # syslog-ng -d > syslog-ng version 1.1.20 starting > SIGHUP received restarting syslog-ng > new configuration initialized > SIGHUP received restarting syslog-ng > Segmentation fault (core dumped) fixed in version 1.1.21. The problem was that gc deallocated my configuration structure while I was still using it... tarball and .deb package available at http://www.balabit.hu/downloads/syslog-ng -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng 1.1.20 and libol version 0.1.18 released
by Balazs Scheidler 28 May '99

28 May '99

Hi, I have fixed several bugs and build errors in both syslog-ng and libol. It compiles cleanly and works for me (tm). It has also been debianized, so it's available in a debian package as well. Some of the changes: * It is now linked statically against libol, so a dynamic version is not required for running syslog-ng * Fixed a few bugs (the emitted loglines contained embedded \0 characters, and \n was not always interpreted correctly) * Added debian control files, and readded .deb packages to the site. I have personally switched to this release from the standard syslogd on my computer. So as you can see it's quite stable now. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

[pg@gu.net: Re: [syslog-ng] syslog-ng v16 compilation problem]
by Balazs Scheidler 28 May '99

28 May '99

As it seems 1.1.18 fixed the problems you may have encountered. ----- Forwarded message from Pavel Golubev <pg(a)gu.net> ----- Date: Fri, 28 May 1999 02:57:51 +0300 (EEST) From: Pavel Golubev <pg(a)gu.net> To: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] syslog-ng v16 compilation problem On Wed, 26 May 1999, Balazs Scheidler wrote: 1.1.18 compiles OK now :) --- Pavel Golubev PG810-RIPE Global Ukraine Inc. ----- End forwarded message ----- -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng v16 compilation problem
by Pavel Golubev 26 May '99

26 May '99

Hi all, # make Making all in src make[1]: Entering directory `/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src' gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c main.c gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c sources.c sources.c: In function `do_read_line': sources.c:72: warning: `length' might be used uninitialized in this function gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c center.c gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c filters.c gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c destinations.c gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c log.c gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c cfgfile.c gcc -DHAVE_CONFIG_H -I. -I/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src -I. -O2 -Wall -I/tmp/syslog-ng/include/libol -c cfg-grammar.c cfg-grammar.y: In function `yyparse': cfg-grammar.y:212: dereferencing pointer to incomplete type make[1]: *** [cfg-grammar.o] Error 1 make[1]: Leaving directory `/usr/src/testing/syslog-ng/syslog-ng-1.1.16/src' make: *** [all-recursive] Error 1 --- Pavel Golubev PG810-RIPE Global Ukraine Inc.

2 1

cvs
by Balazs Scheidler 26 May '99

26 May '99

Hi, I have seen several cvs accesses, but those who attempted has most probably noticed that the cvs was NOT up to date. (it is only a mirror of my local cvs, and I update it by hand) I updated it, so it includes 1.1.16 of syslog-ng, and 0.1.16 of libol. Alternatively you can find the snapshots at: http://www.balabit.hu/downloads/syslog-ng/source -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng 1.1.16 & libol-0.1.16
by Balazs Scheidler 25 May '99

25 May '99

Hi, I have released syslog-ng 1.1.16 and the corresponding libol 0.1.16, it fixes several problems: * HP-UX sources should work now * sync () works for files as well as local option * does not lose data on the receipt of a HUP signal This should be much better than 1.1.15 was, please test it. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

Re: [syslog-ng] regular expressions?
by Balazs Scheidler 24 May '99

24 May '99

Hi, >I'd like to ask you if the current stable/development version supports >filtering through regular expressions? Yes, both versions support this. In the stable version you can use both match and matchfile. match has a single parameter describing the regexp to match against, matchfile refers to a file containing several regexps (one per line). -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

regular expressions?
by Arek Jankowski 24 May '99

24 May '99

Hello, I'd like to ask you if the current stable/development version supports filtering through regular expressions? --- Arek J.

1 0

problems with 1.1.15
by Scott Dellinger 24 May '99

24 May '99

Today I had my first chance to try out syslog-ng 1.1.15, and I'm having some weird problems. When I send test messages locally and from another Linux box via UDP, the "message repeated" lines seem to be random. In the following, the text of each message sent was "test". There were a total of four messages sent locally, and two from the remote system. May 21 08:50:55 logger/logger syslog-ng[15831]: syslog-ng version 1.1.15 starting May 21 08:51:00 src@logger root: test May 21 08:51:07 last/kilrah message repeated 5 times May 21 08:51:38 src@logger root: test May 21 08:56:52 last/kilrah message repeated 3 times May 21 08:01:07 src@logger root: test May 21 08:01:07 src@logger root: test It's reporting repeated messages that aren't, and not reporting some that are. Then, when I try to send a message from an HP-UX box, syslog-ng *seems* to ignore it for a bit, but a few minutes later, spews onto the screen (using the default syslog-ng.conf) many, many lines along the lines of: May 21:09:19:28 logger/logger syslog-ng[15831]: io.c: do_read(): Zero length read was requested On the plus side, syslog-ng is no longer closing the UDP socket immediately upon reception of messages from HP-UX... -- Scott Dellinger Systems Administrator, JMU Technical Services dellinsd(a)jmu.edu

2 1

syslog-ng 1.1.15 & libol 0.1.14
by Balazs Scheidler 17 May '99

17 May '99

Hi, I have released $SUBJECT. udp and hostname problems are resolved and I added an option to turn off long hostname generation. (compatible with earlier syslogd): options { long_hostname(no); }; You can set sync frequency using: options { sync(10); }; which will set _global_ file sync setting. Please note that this is still buggy. Known bugs: - syslog-ng loses data, when sync is not equal to 1, and receives a HUP signal - local setting doesn't work yet (file /var/log/messages sync(10);) You'll need libol-0.1.14 to compile. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

UDP problems with 1.1.14
by Scott Dellinger 15 May '99

15 May '99

Having had success running syslog-ng 1.1.14 locally, I tried just now setting it up to receive messages via UDP, but I can't get it to work. Using the output of 'lsof' as a guide, I can see that the UDP port is opened, but once I send syslog-ng a message from a remote machine, the message "vanishes" and the UDP port is closed, though the program continues to run and accept local messages. -- Scott Dellinger Systems Administrator, JMU Technical Services dellinsd(a)jmu.edu

2 5

Source IP of UDP packets
by Asmodeus 13 May '99

13 May '99

Unless I'm really wrong (and my IP logger is more broken than I thought), doesn't: inet_ntoa(packet.ip.ip_src); give you the source IP (in a nice, readable string form)? Garnered from the Linux UDP header file. .Shawn

2 1

poll() system call emulation in libc (linux)
by Balazs Scheidler 11 May '99

11 May '99

Hi, It turned out recently that the Linux libc (2.0.7 or below) emulation of poll system call is buggy. If it passed -1 as timeout (infinite), it returns immediately. This may cause bad behaviour of syslog-ng or lsh, if compiled under these systems. Future versions of libol will have a workaround this bug. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

some questions
by Pavel Golubev 11 May '99

11 May '99

Hi all, I see that version 14 version does not support "sync" now ( -/var/log/xxx.log alternative in standard syslogd). As a rule a big logging may incredible slow down logstation without "-" mode. It's too bad for central logstation. Next. Standard syslogd writes "host" field correct - corresponding to client name, but remote client's messages in syslog-ng always looks like "srcname/syslog-ng_server_name". It's too hard for admin to separate logfiles visually. For last :) Can somebody give me _working_ example of log separating by remote hostname or IP address. It's not trivial for me :) PS: all _announced_ features works fine for me, including UDP remote logging with "program" and "match" filters. Thanks to autor. --- Pavel Golubev PG810-RIPE Global Ukraine Inc.

2 3

running environment
by Arek Jankowski 10 May '99

10 May '99

Hello, What environment do you people use for building and running syslog-ng? I use gcc 2.7.2.3 and linux 2.0.29 libc5 system and have only segfaults when try to run this program. Has it got any requirements concerning the system libraries? --- Arek J.

2 3

Re: [syslog-ng] syslog-ng 1.1.12 problem
by s 09 May '99

09 May '99

Hello, thank you for this tip. I could compile that code but i have got another problem now. ---- root@shell [/home/spy/syslog-ng-1.1.14]# syslog-ng **** syslog-ng: error in loading shared libraries: libol.so.0: cannot open shared object file: No such file or directory **** root@shell [/home/spy/syslog-ng-1.1.14]# id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) root@shell [/home/spy/syslog-ng-1.1.14]# ls -l src/syslog-ng -rwxr-xr-x 1 root root 51147 May 7 10:42 src/syslog-ng* root@shell [/home/spy/syslog-ng-1.1.14]# --------- checking for getopt_long... yes checking libol version == 0.1.10... ok updating cache ./config.cache ----------- root@shell [/home/spy/syslog-ng-1.1.14]# whereis libol.so.0 libol.so: /usr/local/lib/libol.so.0 /usr/local/lib/libol.so root@shell [/home/spy/syslog-ng-1.1.14]# ls -l /usr/local/lib/libol.so.0 lrwxrwxrwx 1 root root 14 May 7 10:41 /usr/local/lib/libol.so.0 -> libol.so.0.0.0* root@shell [/home/spy/syslog-ng-1.1.14]# ls -l /usr/local/lib/libol.so.0.0.0 -rwxr-xr-x 1 root root 40523 May 7 10:41 /usr/local/lib/libol.so.0.0.0* root@shell [/home/spy/syslog-ng-1.1.14]# ----------- Can someone help me please? thank you, Osman Taskin >Grab the latest version 1.1.14 (fixed compile error) you'll also need to >get updated libol as well. >--Jubal --- Jubal Kessler, Chief Systems Administrator, interQ Incorporated PGP Key Fingerprint: 5D32 BEB1 8E4B B454 6B9A FDCD 2D4C 19DD 9B47 7DC4 On Fri, 7 May 1999, s wrote: > > Hello there, > > i have got RH52 with 2.2.3-5 kernel and i always had problems with compiling > syslog. Can someone gimme a tip what to fix, so > i can compile it please?

2 4

syslog-ng-1.1.14
by s 08 May '99

08 May '99

Hello, i have installed s.1.1.4 and libol0.10 on my other RH5.2 (Kernel 2.0.36) box. its the same result; libol.so.0: cannot open shared object file: No such file or directory i tried that on 2 different boxes and kernels. Its the same. I wonder why noone reported that before. can someone else confirm that or do i make something wrong? regards, osman taskin

1 0

1.1.14 being bashful?
by Justin Wienckowski 08 May '99

08 May '99

Hey all, Recently downloaded, compiled, and installed syslog-ng 1.1.14 and libol. After a few mistarts with the config file, syslog-ng started up without any error messages. However, it doesn't appear that any messages are actually getting logged. None of the logfiles specified recieve data nor are they opened. The only files syslog-ng seems to open are two sockets, /dev/tty10, and /dev/tty9. Any ideas? My config file is attached. -Justin Wienckowski jwiencko(a)vt.edu ---syslog-ng.conf--- # # /etc/syslog-ng/syslog-ng.conf # # Last update: 1999 04 07 # # sources source src { udp 0.0.0.0,512; unix-stream /dev/log; internal; }; # destinations destination console { file /dev/console; }; destination kernel_log { file /var/log/kernel.log; }; destination secure_log { file /var/log/secure.log; }; destination ssh_log { file /var/log/ssh.log; }; destination mail_log { file /var/log/mail.log; }; destination ftp_log { file /var/log/ftp.log; }; destination msgs_log { file /var/log/messages.log; }; destination crit_log { file /var/log/crit.log; }; destination log_term { file /dev/tty10; }; destination secure_term { file /dev/tty9; }; # filters filter kernel { facility(kern) or program("kernel"); }; filter mail { facility(mail) or program("qmail"); }; filter ftp { program(".*ftpd"); }; filter ssh { match("ssh.*"); }; filter secure { ( facility(authpriv) or match("Overseer") ) and not match("ssh.*"); }; filter crit { priority(crit); }; filter other { not ( facility(kern) or facility(mail) or facility(authpriv) ) or match("Overseer"); }; # loging directives log { source src; filter other; destination msgs_log; destination log_term; }; log { source src; filter kernel; destination kernel_log; }; log { source src; filter mail; destination mail_log; }; log { source src; filter ftp; destination ftp_log; }; log { source src; filter ssh; destination ssh_log; }; log { source src; filter secure; destination secure_log; destination secure_term; }; log { source src; filter crit; destination console; destination crit_log; };

2 2

syslog-ng 1.1.14 and the promised host filter
by Balazs Scheidler 07 May '99

07 May '99

Hi, I have released syslog-ng 1.1.14 which implements two additional filters, which you can use to direct log messages: host(regexp) match against the source hostname (where the message came from) with this you can use syslog-ng as a central log host match(regexp) match against the content of the log message And the implementation of program() has been changed, so that it uses regexps too. I have found the hopefully last leak in syslog-ng, which caused it to eat some memory when HUP signals were sent to it. This version requires libol 0.1.10. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

2 1

host & match filter in cvs
by Balazs Scheidler 06 May '99

06 May '99

Hi, For those interested I added the following filters to syslog-ng: host(regexp) - filters based on the host part of a log message match(regexp) - filters based on message contents And changed the program filter to use regexps instead of simple strings. CVS instructions can be found on the web page. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

compilation fix for 1.1.12
by Balazs Scheidler 05 May '99

05 May '99

Hi, Version 1.1.12 has a compilation error regarding yydebug. Simply uncomment the line 159 in cfgfile.c: if ((cfg = fopen(name, "r")) != NULL) { yyin = cfg; /* yydebug = 1; */ <-- this line res = yyparse(); fclose(cfg); if (!res) { -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 1

syslog-ng 1.1.12 and libol 0.1.9
by Balazs Scheidler 04 May '99

04 May '99

Hi, I have released $SUBJ containing yet another bunch of fixes. It should really be stable by now, though not all features are there. I have added some preliminary man pages, and some documentation. Please tell me any grammatical mistakes, spelling errors. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng 1.1.11
by Balazs Scheidler 04 May '99

04 May '99

Hi, Some bugs were introduced in the previous portability fixes in 1.1.10, so here is version 1.1.11, which fixes them. Also if an internal log source was not specified a segmentation fault occured. The previous libol 0.1.8 release will do, so you don't need to upgrade that. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

Re: Syslog-ng man pages
by Balazs Scheidler 03 May '99

03 May '99

Hi, I don't know if you are on the syslog-ng mailing lists, that's why I am CC there too. > If you like a hand rewritting the man pages for syslog-ng i'd be > glad to help. Only thing I would need is the syntax for the pages, i'm > afriad i'm not a programmer and i'm a bit new to syslog-ng but I have a > tendency to learn quick So if you still have some time to write some of syslog-ng man pages, please do so. I am going to write a short introduction to syslog-ng configuration file format. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

portability fixes
by Balazs Scheidler 28 Apr '99

28 Apr '99

Hello, I have released syslog-ng 1.1.10, and libol 0.1.8 fixes a couple of bugs compiling it on Solaris (tested on "SunOS almos 5.6 Generic sun4d sparc SUNW,SPARCcenter-2000") and should also fix that BSD header problem. (though this is not tested yet) Nothing else changed now. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng 1.1.9
by Balazs Scheidler 28 Apr '99

28 Apr '99

I have released syslog-ng version 1.1.9, the latest development version of syslog-ng. I have added parameter parsing, the ability to go into the background and several bugfixes. You'll need libol 0.1.7, so be sure to download that one too. This version is something that could also be used in production environment. libol has been completely split off, and it is installed as a shared library on your system. I have removed the --with-libol switch from configure, syslog-ng will automatically find your installed version of libol. (using the installed libol-config script) I think I'll do a feature freeze now, stabilize syslog-ng, and release 1.2.x as it is, since advanced features are not important for everyone. So please tell me any build and runtime problems you encounter. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

2 4