- syslog-ng - lists.balabit.hu

Building a syslog server (syslog-ng) with GUI
by Yu Watanabe 14 Jun '12

14 Jun '12

Hi all! I am planning to build a syslog server using syslog-ng, however, not using the configuration drivers of syslog-ng. Instead, I want to use a third party GUI that has a filtering function and would be better if can set actions for each fitlering. The reason for using other GUI is that because configuration file is getting bit complex. So, the story is make syslog-ng gather the logs and send it to database ( such as mysql ). The the thrid party GUI do the filtering. Cacti - camm plugin is one of my candidates. It would be helpful if people in this mailing list can give us some recommendation for the GUI. Thanks, Yu

6 5

logstore and idx files
by Anup Shetty 13 Jun '12

13 Jun '12

Hello, When using logstore(), it writes to log files with extension .lgs. The .jor files act as buffers before the logs are written on to the disk in .lgs files. Another file that gets created are the .idx files. What are the .idx files for? Each day logs from the servers gets stored into different files as the $Date parameter is used to create the file name. When this happens, suppose on 23:59:59 hrs, the journal file does not fill up to the chunk size defined or the chuck time does not expire and the syslog writes to a new file at 00:00:00hrs then what happens to the logs? do they get written onto the .lgs files? -- Thanks and regards, Anup Shetty +91-9820784185

2 2

php as program()
by Peter Czanik 13 Jun '12

13 Jun '12

Hello, A user in the web based community forum ran into trouble running php from program(). As it on SLES running syslog-ng 2.0 which is out of support for ages, I could not find anybody around me with an answer for it. The forum thread is available at http://communities.balabit.com/balabit/topics/php_as_programm and please register / write your solution there, if you have an answer for the question! (so I don't need to become a forum/list gw :-) ) Bye, -- Peter Czanik (CzP)<czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

FW: syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 13 Jun '12

13 Jun '12

Hi all, We found that the following rewrite caused the issue. We commented this part, and it was not giving any issue. But we need this rewrite option to be available. Can somebody let us know if this got changed in syslog-ng-3.4.0alpha2 ? Any suggestions ? #rewrite rw_msg{subst("\\[.*\\]", "", value("MESSAGE"));}; Thanks Hithendra From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ext anju.raveendrannair(a)wipro.com Sent: Friday, June 08, 2012 5:16 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance. Hi, We are using syslog-ng-3.4.0alpha2 binary and trying to run the syslog-ng server configuration file, but its not starting the syslog ng server. We are getting the following error incase of f__nonconsole_access filter when we ran the syslog-ng binary in debug mode. Filter rule evaluation result; result='match', rule='f_nonconsole_access', location='/ne_data/conf/syslogng/syslog-ng_server.conf:58:29' ** ERROR:logmsg.c:535:log_msg_set_value_indirect: assertion failed: (!log_msg_is_write_protected(self)) Abort (core dumped) PFA the debug.log The server conf is having the following line for the above mentioned filter, template ltemgr_msg_template { template("$S_ISODATE $HOST $FACILITY_NUM/$LEVEL_NUM $MSG\n"); }; #To strip of the msg_id introduced by syslogd rewrite rw_msg{subst("\\[.*\\] <file:///\\[.*\%5d> ", "", value("MESSAGE"));}; source s_LTEMGR_SYSLOG_CLIENTS{ tcp (ip (27.132.98.69) port(6515) max-connections(4) tls( key_file("/ne_data/conf/certificates/MOCM/MOCM_key.pem") cert_file("/ne_data/conf/certificates/MOCM/MOCM_SB_server.pem") ca_dir("/ne_data/conf/certificates/SYSLOGNG") cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SS Lv2") peer_verify(optional-untrusted) ) ); }; ....... destination d_ltemgr_nonconsoleaccess_log {file("/ne_data/syslog/ems" perm(0644) template(ltemgr_msg_template)); }; ...... filter f_nonconsole_access { level(info..notice) and facility(auth) and ( match("Accepted password for" value("MESSAGE")) or match("Failed password for" value("MESSAGE")) ); }; ..... log { source(s_LTEMGR_SYSLOG_CLIENTS); filter(f_nonconsole_access); rewrite(rw_msg); destination(d_ltemgr_nonconsoleaccess_log); }; Without debug mode, we were able to run the server but central logging is not happening when tried with logger command. Thanks, Anju Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

[Bug 183] New: Threaded Syslog-ng chashes resolving locally
by bugzilla＠bugzilla.balabit.com 08 Jun '12

08 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=183 Summary: Threaded Syslog-ng chashes resolving locally Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: egon(a)local.ee Type of the Report: bug Estimated Hours: 0.0 Syslog-ng crashes with segfault with following combination: threaded(yes); use_dns(persist_only); dns_cache_hosts(/etc/hosts); Jun 8 11:32:09 kernel: [5626308.537129] syslog-ng[15155]: segfault at 10 ip 00007fb09a512208 sp 00007fb0962b52a0 error 4 in libc-2.13.so[7fb09a49a000+17d000] Also tried to compile from source and on Debian squeeze distro, same issue occurred. System info: Debian GNU/Linux wheezy/sid \n \l Linux dev1 2.6.32-5-xen-amd64 #1 SMP Mon Jan 16 20:48:30 UTC 2012 x86_64 dpkg -l | grep -e syslog-ng -e libevtlog ii libevtlog0 0.2.12-5 Syslog event logger library ii libsyslog-ng-3.3.5:amd64 3.3.5-2 Next generation system logging daemon (private library) ii syslog-ng 3.3.5-2 Next generation system logging daemon (metapackage) ii syslog-ng-core 3.3.5-2 Next generation system logging daemon (core) ii syslog-ng-mod-json 3.3.5-2 Next generation system logging daemon (JSON plugin) ii syslog-ng-mod-mongodb 3.3.5-2 Next generation system logging daemon (MongoDB plugin) ii syslog-ng-mod-sql 3.3.5-2 Next generation system logging daemon (SQL plugin) # /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid -F --enable-core *** glibc detected *** /usr/sbin/syslog-ng: double free or corruption (fasttop): 0x00007f2ef25584c0 *** ======= Backtrace: ========= /lib/x86_64-linux-gnu/libc.so.6(+0x75b46)[0x7f2eeef75b46] /lib/x86_64-linux-gnu/libc.so.6(cfree+0x6c)[0x7f2eeef7a87c] /usr/lib/x86_64-linux-gnu/libsyslog-ng-3.3.5.so(main_loop_io_worker_thread_stop+0x65)[0x7f2ef0843755] /usr/lib/x86_64-linux-gnu/libsyslog-ng-3.3.5.so(+0x55b5b)[0x7f2ef085eb5b] /usr/lib/x86_64-linux-gnu/libsyslog-ng-3.3.5.so(+0x56226)[0x7f2ef085f226] /lib/x86_64-linux-gnu/libpthread.so.0(+0x6b50)[0x7f2eef28db50] /lib/x86_64-linux-gnu/libc.so.6(clone+0x6d)[0x7f2eeefd89dd] ======= Memory map: ======== 7f2ee4000000-7f2ee4022000 rw-p 00000000 00:00 0 7f2ee4022000-7f2ee8000000 ---p 00000000 00:00 0 7f2eea308000-7f2eea31d000 r-xp 00000000 ca:01 1180084 /lib/x86_64-linux-gnu/libgcc_s.so.1 7f2eea31d000-7f2eea51d000 ---p 00015000 ca:01 1180084 /lib/x86_64-linux-gnu/libgcc_s.so.1 7f2eea51d000-7f2eea51e000 rw-p 00015000 ca:01 1180084 /lib/x86_64-linux-gnu/libgcc_s.so.1 7f2eea51e000-7f2eea51f000 ---p 00000000 00:00 0 7f2eea51f000-7f2eead1f000 rw-p 00000000 00:00 0 7f2eead1f000-7f2eead20000 ---p 00000000 00:00 0 7f2eead20000-7f2eeb520000 rw-p 00000000 00:00 0 7f2eeb520000-7f2eeb527000 r-xp 00000000 ca:01 2886205 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1 7f2eeb527000-7f2eeb726000 ---p 00007000 ca:01 2886205 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1 7f2eeb726000-7f2eeb727000 r--p 00006000 ca:01 2886205 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1 7f2eeb727000-7f2eeb728000 rw-p 00007000 ca:01 2886205 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1 7f2eeb728000-7f2eeb729000 r-xp 00000000 ca:01 3020751 /usr/lib/syslog-ng/3.3.5/libtfjson.so 7f2eeb729000-7f2eeb929000 ---p 00001000 ca:01 3020751 /usr/lib/syslog-ng/3.3.5/libtfjson.so 7f2eeb929000-7f2eeb92a000 r--p 00001000 ca:01 3020751 /usr/lib/syslog-ng/3.3.5/libtfjson.so 7f2eeb92a000-7f2eeb92b000 rw-p 00002000 ca:01 3020751 /usr/lib/syslog-ng/3.3.5/libtfjson.so 7f2eeb92b000-7f2eeb93d000 r-xp 00000000 ca:01 2886210 /usr/lib/x86_64-linux-gnu/libmongo-client.so.0.3.1 7f2eeb93d000-7f2eebb3d000 ---p 00012000 ca:01 2886210 /usr/lib/x86_64-linux-gnu/libmongo-client.so.0.3.1 7f2eebb3d000-7f2eebb3e000 r--p 00012000 ca:01 2886210 /usr/lib/x86_64-linux-gnu/libmongo-client.so.0.3.1 7f2eebb3e000-7f2eebb3f000 rw-p 00013000 ca:01 2886210 /usr/lib/x86_64-linux-gnu/libmongo-client.so.0.3.1 7f2eebb3f000-7f2eebb49000 r-xp 00000000 ca:01 3020746 /usr/lib/syslog-ng/3.3.5/libafmongodb.so 7f2eebb49000-7f2eebd48000 ---p 0000a000 ca:01 3020746 /usr/lib/syslog-ng/3.3.5/libafmongodb.so 7f2eebd48000-7f2eebd49000 r--p 00009000 ca:01 3020746 /usr/lib/syslog-ng/3.3.5/libafmongodb.so 7f2eebd49000-7f2eebd4a000 rw-p 0000a000 ca:01 3020746 /usr/lib/syslog-ng/3.3.5/libafmongodb.so 7f2eebd4a000-7f2eebd55000 r-xp 00000000 ca:01 1180101 /lib/x86_64-linux-gnu/libnss_files-2.13.so 7f2eebd55000-7f2eebf54000 ---p 0000b000 ca:01 1180101 /lib/x86_64-linux-gnu/libnss_files-2.13.so 7f2eebf54000-7f2eebf55000 r--p 0000a000 ca:01 1180101 /lib/x86_64-linux-gnu/libnss_files-2.13.so 7f2eebf55000-7f2eebf56000 rw-p 0000b000 ca:01 1180101 /lib/x86_64-linux-gnu/libnss_files-2.13.so 7f2eebf56000-7f2eebf60000 r-xp 00000000 ca:01 1180097 /lib/x86_64-linux-gnu/libnss_nis-2.13.so 7f2eebf60000-7f2eec15f000 ---p 0000a000 ca:01 1180097 /lib/x86_64-linux-gnu/libnss_nis-2.13.so 7f2eec15f000-7f2eec160000 r--p 00009000 ca:01 1180097 /lib/x86_64-linux-gnu/libnss_nis-2.13.so 7f2eec160000-7f2eec161000 rw-p 0000a000 ca:01 1180097 /lib/x86_64-linux-gnu/libnss_nis-2.13.so 7f2eec161000-7f2eec168000 r-xp 00000000 ca:01 1180090 /lib/x86_64-linux-gnu/libnss_compat-2.13.so 7f2eec168000-7f2eec367000 ---p 00007000 ca:01 1180090 /lib/x86_64-linux-gnu/libnss_compat-2.13.so 7f2eec367000-7f2eec368000 r--p 00006000 ca:01 1180090 /lib/x86_64-linux-gnu/libnss_compat-2.13.so 7f2eec368000-7f2eec369000 rw-p 00007000 ca:01 1180090 /lib/x86_64-linux-gnu/libnss_compat-2.13.so 7f2eec369000-7f2eec36b000 r-xp 00000000 ca:01 3015504 /usr/lib/syslog-ng/3.3.5/libconfgen.so 7f2eec36b000-7f2eec56a000 ---p 00002000 ca:01 3015504 /usr/lib/syslog-ng/3.3.5/libconfgen.so 7f2eec56a000-7f2eec56b000 r--p 00001000 ca:01 3015504 /usr/lib/syslog-ng/3.3.5/libconfgen.so 7f2eec56b000-7f2eec56c000 rw-p 00002000 ca:01 3015504 /usr/lib/syslog-ng/3.3.5/libconfgen.so 7f2eec56c000-7f2eec570000 r-xp 00000000 ca:01 3015523 /usr/lib/syslog-ng/3.3.5/libsyslogformat.so 7f2eec570000-7f2eec76f000 ---p 00004000 ca:01 3015523 /usr/lib/syslog-ng/3.3.5/libsyslogformat.so 7f2eec76f000-7f2eec770000 r--p 00003000 ca:01 3015523 /usr/lib/syslog-ng/3.3.5/libsyslogformat.so 7f2eec770000-7f2eec771000 rw-p 00004000 ca:01 3015523 /usr/lib/syslog-ng/3.3.5/libsyslogformat.so 7f2eec771000-7f2eec787000 r-xp 00000000 ca:01 3015515 /usr/lib/syslog-ng/3.3.5/libdbparser.so 7f2eec787000-7f2eec987000 ---p 00016000 ca:01 3015515 /usr/lib/syslog-ng/3.3.5/libdbparser.so 7f2eec987000-7f2eec988000 r--p 00016000 ca:01 3015515 /usr/lib/syslog-ng/3.3.5/libdbparser.so 7f2eec988000-7f2eec989000 rw-p 00017000 ca:01 3015515 /usr/lib/syslog-ng/3.3.5/libdbparser.so 7f2eec989000-7f2eec991000 r-xp 00000000 ca:01 3015509 /usr/lib/syslog-ng/3.3.5/libcsvparser.so 7f2eec991000-7f2eecb91000 ---p 00008000 ca:01 3015509 /usr/lib/syslog-ng/3.3.5/libcsvparser.so 7f2eecb91000-7f2eecb92000 r--p 00008000 ca:01 3015509 /usr/lib/syslog-ng/3.3.5/libcsvparser.so 7f2eecb92000-7f2eecb93000 rw-p 00009000 ca:01 3015509 /usr/lib/syslog-ng/3.3.5/libcsvparser.so 7f2eecb93000-7f2eecb95000 r-xp 00000000 ca:01 3015503 /usr/lib/syslog-ng/3.3.5/libbasicfuncs.so 7f2eecb95000-7f2eecd95000 ---p 00002000 ca:01 3015503 /usr/lib/syslog-ng/3.3.5/libbasicfuncs.so 7f2eecd95000-7f2eecd96000 r--p 00002000 ca:01 3015503 /usr/lib/syslog-ng/3.3.5/libbasicfuncs.so 7f2eecd96000-7f2eecd97000 rw-p 00003000 ca:01 3015503 /usr/lib/syslog-ng/3.3.5/libbasicfuncs.so 7f2eecd97000-7f2eece18000 r-xp 00000000 ca:01 1180092 /lib/x86_64-linux-gnu/libm-2.13.so 7f2eece18000-7f2eed017000 ---p 00081000 ca:01 1180092 /lib/x86_64-linux-gnu/libm-2.13.so 7f2eed017000-7f2eed018000 r--p 00080000 ca:01 1180092 /lib/x86_64-linux-gnu/libm-2.13.so 7f2eed018000-7f2eed019000 rw-p 00081000 ca:01 1180092 /lib/x86_64-linux-gnu/libm-2.13.soAborted (core dumped) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

syslog-ng-3.4.0alpha2 syslog-ng binary failure for server instance.
by anju.raveendrannair＠wipro.com 08 Jun '12

08 Jun '12

Hi, We are using syslog-ng-3.4.0alpha2 binary and trying to run the syslog-ng server configuration file, but its not starting the syslog ng server. We are getting the following error incase of f__nonconsole_access filter when we ran the syslog-ng binary in debug mode. Filter rule evaluation result; result='match', rule='f_nonconsole_access', location='/ne_data/conf/syslogng/syslog-ng_server.conf:58:29' ** ERROR:logmsg.c:535:log_msg_set_value_indirect: assertion failed: (!log_msg_is_write_protected(self)) Abort (core dumped) PFA the debug.log The server conf is having the following line for the above mentioned filter, template ltemgr_msg_template { template("$S_ISODATE $HOST $FACILITY_NUM/$LEVEL_NUM $MSG\n"); }; #To strip of the msg_id introduced by syslogd rewrite rw_msg{subst("\\[.*\\]", "", value("MESSAGE"));}; source s_LTEMGR_SYSLOG_CLIENTS{ tcp (ip (27.132.98.69) port(6515) max-connections(4) tls( key_file("/ne_data/conf/certificates/MOCM/MOCM_key.pem") cert_file("/ne_data/conf/certificates/MOCM/MOCM_SB_server.pem") ca_dir("/ne_data/conf/certificates/SYSLOGNG") cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SSLv2") peer_verify(optional-untrusted) ) ); }; ....... destination d_ltemgr_nonconsoleaccess_log {file("/ne_data/syslog/ems" perm(0644) template(ltemgr_msg_template)); }; ...... filter f_nonconsole_access { level(info..notice) and facility(auth) and ( match("Accepted password for" value("MESSAGE")) or match("Failed password for" value("MESSAGE")) ); }; ..... log { source(s_LTEMGR_SYSLOG_CLIENTS); filter(f_nonconsole_access); rewrite(rw_msg); destination(d_ltemgr_nonconsoleaccess_log); }; Without debug mode, we were able to run the server but central logging is not happening when tried with logger command. Thanks, Anju Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

[Bug 182] New: Support utmpx in afuser, along with the legacy utmp
by bugzilla＠bugzilla.balabit.com 08 Jun '12

08 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=182 Summary: Support utmpx in afuser, along with the legacy utmp Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: FreeBSD Status: ASSIGNED Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 FreeBSD 9 had utmp support removed, so in the ports tree they were doing some sed magic to convert from utmp to utmpx. Instead of that, we should support both, and prefer utmpx if both are supported (like on Linux). A patch to implement this, based on the sed magic, and a patch by Alex Zimnitsky is available on the hotfix/3.3/fbsd9-utmpx branch of my git repo. Once tested, I will merge it to master. The commit in question is available at https://github.com/algernon/syslog-ng/commit/4b450a09da83bc8e27bd7c8adccea3… -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[PATCH] afuser: Use utmpx when available, instead of utmp
by Gergely Nagy 08 Jun '12

08 Jun '12

FreeBSD 9 removed support for utmp, and one must use the POSIX-specified utmpx instead. The same utmpx is available on Linux too (and it is the same as utmp there). The patch below converts afuser to use utmpx when available, utmp otherwise. It is based on the post-build sed magic applied to syslog-ng within the FreeBSD ports collection, with other bits based on a patch from Alex Zimnitsky. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 4 ++-- lib/utils.c | 4 +++- lib/utils.h | 7 ++++++- modules/afuser/afuser.c | 20 +++++++++++++++++++- 4 files changed, 30 insertions(+), 5 deletions(-) diff --git a/configure.in b/configure.in index aafb980..c76d7d9 100644 --- a/configure.in +++ b/configure.in @@ -383,7 +383,7 @@ dnl *************************************************************************** AC_HEADER_STDC AC_CHECK_HEADER(dmalloc.h) -AC_CHECK_HEADERS(strings.h getopt.h stropts.h sys/strlog.h door.h sys/capability.h sys/prctl.h) +AC_CHECK_HEADERS(strings.h getopt.h stropts.h sys/strlog.h door.h sys/capability.h sys/prctl.h utmpx.h) AC_CHECK_HEADERS(tcpd.h) @@ -479,7 +479,7 @@ if test "x$enable_linux_caps" = "xyes" -o "x$enable_linux_caps" = "xauto"; then AC_CHECK_LIB(cap, cap_set_proc, LIBCAP_LIBS="-lcap") fi -AC_CHECK_FUNCS(strdup strtol strtoll strtoimax inet_aton inet_ntoa getopt_long getaddrinfo getutent pread pwrite strcasestr memrchr localtime_r gmtime_r) +AC_CHECK_FUNCS(strdup strtol strtoll strtoimax inet_aton inet_ntoa getopt_long getaddrinfo getutent getutxent pread pwrite strcasestr memrchr localtime_r gmtime_r) old_LIBS=$LIBS LIBS=$BASE_LIBS AC_CHECK_FUNCS(clock_gettime) diff --git a/lib/utils.c b/lib/utils.c index 2b5c525..1f06e12 100644 --- a/lib/utils.c +++ b/lib/utils.c @@ -33,7 +33,9 @@ #include <netinet/in.h> #include <arpa/inet.h> #include <fcntl.h> +#if HAVE_UTMP_H #include <utmp.h> +#endif #include "utils.h" @@ -47,7 +49,7 @@ int inet_aton(const char *cp, struct in_addr *addr) } #endif -#ifndef HAVE_GETUTENT +#if !defined(HAVE_GETUTENT) && !defined(HAVE_GETUTXENT) && defined(HAVE_UTMP_H) static int utent_fd = -1; diff --git a/lib/utils.h b/lib/utils.h index 86e3a7f..a0f3dcc 100644 --- a/lib/utils.h +++ b/lib/utils.h @@ -28,13 +28,18 @@ #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> + +#ifdef HAVE_UTMPX_H +#include <utmpx.h> +#else #include <utmp.h> +#endif #ifndef HAVE_INET_ATON int inet_aton(const char *cp, struct in_addr *addr); #endif -#ifndef HAVE_GETUTENT +#if !defined(HAVE_GETUTENT) && !defined(HAVE_GETUTXENT) struct utmp *getutent(void); void endutent(void); #endif diff --git a/modules/afuser/afuser.c b/modules/afuser/afuser.c index 8f170e5..7d082b2 100644 --- a/modules/afuser/afuser.c +++ b/modules/afuser/afuser.c @@ -25,7 +25,13 @@ #include "alarms.h" #include "messages.h" +#ifdef HAVE_UTMPX_H +#include <utmpx.h> +#define ut_name ut_user +#else #include <utmp.h> +#endif + #include <string.h> #include <fcntl.h> #include <unistd.h> @@ -46,7 +52,11 @@ afuser_dd_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, { AFUserDestDriver *self = (AFUserDestDriver *) s; gchar buf[8192]; +#ifdef HAVE_UTMPX_H + struct utmpx *ut; +#else struct utmp *ut; +#endif GString *timestamp; time_t now; @@ -63,7 +73,11 @@ afuser_dd_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, g_string_free(timestamp, TRUE); /* NOTE: there's a private implementations of getutent in utils.c on Systems which do not provide one. */ - while ((ut = getutent())) +#ifdef HAVE_GETUTXENT + while ((ut = getutxent())) +#else + while ((ut = getutent())) +#endif { #if HAVE_MODERN_UTMP if (ut->ut_type == USER_PROCESS && @@ -106,7 +120,11 @@ afuser_dd_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, } } } +#if HAVE_UTMPX_H + endutxent(); +#else endutent(); +#endif finish: log_msg_ack(msg, path_options); log_msg_unref(msg); -- 1.7.9

1 0

pattern tags in syslog
by system＠ra-schaal.de 08 Jun '12

08 Jun '12

Hi all, i´ve a problem with pdbtool / using tags with syslog 3.3.5: If I tag a message inside a pattern containing a "-", the tags are not used within syslog and "pbtool match": <ruleset id='c5a92074c59aca552764af9037cd895b' name='mirror'> <pattern>clam-clientsync</pattern> <rules> <rule class='mirror' id='c5a92074c59aca552764af9037cd895b' provider='fs'> <patterns> <pattern>safebrowsing</pattern> <pattern>deleting</pattern> <pattern>main</pattern> <pattern>daily</pattern> <pattern>bytecode</pattern> <pattern>local_blacklist_apache</pattern> <pattern>timestamp</pattern> <pattern>sent @NUMBER::@ bytes</pattern> <pattern>total size is @NUMBER::@</pattern> </patterns> <tags> <tag>clamav-mirror</tag> </tags> </rule> </rules> </ruleset> # pdbtool match -p mirror.pdb -P clam-clientsync -M "safebrowsing" -D Pattern matching part: safebrowsing Matching part: safebrowsing Values: MESSAGE=safebrowsing PROGRAM=clam-clientsync .classifier.class=mirror .classifier.rule_id=c5a92074c59aca552764af9037cd895b TAGS= BTW: if I skip "-D" everything is fine. But in my syslog-ng.conf i can´t use clamav-mirror in the filter. Instead I must use clamavmirror: filter f_rsync_clamav { tags("clamavmirror"); }; tags("clamav-mirror") won´t work.

1 0

Writes garbled kernel messages to logs
by shih dane 08 Jun '12

08 Jun '12

Hi All Lately I've setup syslog server on Fedora 12 l want to get iscsi connection log but get some garbled kernel messages syslog-ng version : syslog-ng 3.3.1 syslog-ng.conf @version: 3.3 @include "scl.conf" options { stats_freq(0); create_dirs(yes); dir_perm(0777); perm(0644); }; source src { system(); internal(); udp(); }; destination information { file("/raid/syslog/information"); }; destination error { file("/raid/syslog/error"); }; destination warning { file("/raid/syslog/warning"); }; filter f_info { level(info); }; filter f_error { level(error); }; filter f_warning { level(warning); }; log { source(src); filter(f_info); destination(information); }; log { source(src); filter(f_error); destination(error); }; log { source(src); filter(f_warning); destination(warning); }; Thanks for any advice Best Regard Dane

1 0