- syslog-ng - lists.balabit.hu

RE: [syslog-ng]chroot/syslog-ng/Solaris8
by Roy G Davis 16 Aug '04

16 Aug '04

yes, thanks, i have seen that link. i tried that, but may not have done it exactly right. there is still something i am missing here. thx again -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu on behalf of Nate Campi Sent: Fri 8/13/2004 7:30 PM To: syslog-ng(a)lists.balabit.hu Cc: Subject: Re: [syslog-ng]chroot/syslog-ng/Solaris8 On Fri, Aug 13, 2004 at 01:26:54PM -0500, Roy G Davis wrote: > does anyone have experience using syslog-ng with chroot-ed applications > on Solaris 8? > specifically, i am running ssh/sftp chroot-ed (with sftp logging patch) > and i get no logging. > i know it is something about /dev/log etc in the chroot environment but > cant find exact info. Try this, you might not have found it since it might seem postfix specific, but it applies to anything chrooted: http://www.campin.net/syslog-ng/faq.html#postfix -- Nate To sysadmin or not to sysadmin... that is the question, whether tis nobler in the minde to suffer the slings and arrowes of outragious fortune, or climb to the top of the building with a high-power rifle and scope. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

two syslog-ngs?
by markzero＠logik.ath.cx 16 Aug '04

16 Aug '04

Hmm, having got stunnel mostly working, I'm left with a little more confusion. I'm about to attempt to build the loghost, the only problem is that I'll need to chroot syslog-ng. /chroot/syslogng Surely, this is going to cause problems as the chrooted syslog will need to do the logging for the local machine as well, and as such will need access to /dev/log. It can't be as simple as: ln -s /dev/log /chroot/syslogng/dev/log ...can it? Other than this, the only solution I can think of is to run two copies of syslogng, one chrooted for accepting network connections and one un-chrooted (that is an annoyingly awkward word in conversation) for doing local logging for the machine itself. Anyone come up with a better way?

2 1

check_hostname(yes) - parse error
by Smith, Krista 16 Aug '04

16 Aug '04

Hello, I've got syslog-ng (1.4.17) working on a Solaris 9 central logserver, except for one small thing. I'm trying to use the option "check_hostname(yes)" but I get a parse error when I add it to my options. My options line looks like this: options { create_dirs(yes); keep_hostname(yes); check_hostname(yes); }; If I remove that portion of the line, it gives no error. I've checked for invisible characters, searched Google and the syslog-ng archives, but cannot find anything suggesting what the problem might be. If anyone can point me in the right direction I'd be grateful. Thanks, Krista -- Krista Smith Unix Analyst EnCana Corporation desk: (403) 645-3121 cell: (403) 830-2334 krista.smith(a)encana.com www.encana.com <www.encana.com>

2 1

RE: [syslog-ng](no subject)
by Andrews, Glenn J (Glenn) 16 Aug '04

16 Aug '04

Great. Now virus via syslog ;-) "Antigen for Exchange removed new__price.zip->price.exe since it was found to be infected with VIRUS= Win32/Unknown.Trojan (CA(InoculateIT)) virus." -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Bazsi Sent: Monday, August 09, 2004 3:04 PM To: Syslog-ng Subject: [syslog-ng](no subject) price

2 1

Reply-To: syslog-ng@lists.balabit.hu
by G. C. 16 Aug '04

16 Aug '04

I modified the file afinet.c inserting the line as suggested and gave the following commands: ./configure --enable-spoof-source --> ok make --> ERROR The error is the following: make_class <afinet.c >afinet.c.xT /bin/sh: /usr/local/bin/make_class: \: bad interpreter: No such file or directory make[3]: *** [afinet.c.x] Error 126 make[3]: Leaving directory `/usr/src/syslog-ng-1.6.4/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/syslog-ng-1.6.4/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/src/syslog-ng-1.6.4/src' make: *** [all-recursive] Error 1 Sorry but not being a developer I might have mistaken something... P. _____________________________________________________ > >Hmm.. I possible forgot to free something in that path. I'll check it out >for you. Can you check if this one works for you? Index: src/afinet.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/afinet.c,v retrieving revision 1.25.4.6 diff -u -r1.25.4.6 afinet.c --- src/afinet.c 5 Aug 2004 11:35:12 -0000 1.25.4.6 +++ src/afinet.c 6 Aug 2004 18:15:32 -0000 @@ -653,6 +653,7 @@ if (libnet_write(self->lnet_ctx) < 0) { werror("Error sending raw frame, error: %z", libnet_geterror(self->lnet_ctx)); } + ol_string_free(msg_line); } else { fallback_socket: _________________________________________________________________ Protect your PC - get McAfee.com VirusScan Online http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

2 1

syslog-ng : concurrent readling & writing tasks ?
by Loic SPINDLER 16 Aug '04

16 Aug '04

Hello, I noticed that both reading input process and writing to output are not running concurrent in the syslog-ng. Is it planned for a future release ?

2 1

not match()
by markzero＠logik.ath.cx 16 Aug '04

16 Aug '04

# $Xanthus: syslog-ng.conf,v 1.1 2004/07/27 02:56:44 markzero Exp $ # syslog-ng config # options { long_hostnames(off); create_dirs(yes); owner(_syslogng); group(_syslogng); perm(0600); dir_owner(_syslogng); dir_group(_syslogng); dir_perm(0700); use_dns(no); sync(0); }; source src { unix-dgram("/dev/log" owner("_syslogng") group("_syslogng") perm(0600)); internal(); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination mail { file("/var/log/mail.log"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; #destination console { usertty("root"); }; #destination console_all { file("/dev/tty12"); }; #destination loghost { udp("loghost" port(999)); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_no_stats { not match("STATS: dropped 0"); }; log { source(src); filter(f_authpriv); filter(f_no_stats); destination(authlog); }; log { source(src); filter(f_syslog); filter(f_no_stats); destination(syslog); }; log { source(src); filter(f_cron); filter(f_no_stats); destination(cron); }; log { source(src); filter(f_daemon); filter(f_no_stats); destination(daemon); }; log { source(src); filter(f_kern); filter(f_no_stats); destination(kern); }; log { source(src); filter(f_lpr); filter(f_no_stats); destination(lpr); }; log { source(src); filter(f_mail); filter(f_no_stats); destination(mail); }; log { source(src); filter(f_user); filter(f_no_stats); destination(user); }; log { source(src); filter(f_uucp); filter(f_no_stats); destination(uucp); }; log { source(src); filter(f_mail); filter(f_no_stats); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_no_stats); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_no_stats); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_no_stats); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_no_stats); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_no_stats); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); filter(f_no_stats); destination(debug); }; log { source(src); filter(f_messages); filter(f_no_stats); destination(messages); }; #log { source(src); filter(f_emergency); filter(f_no_stats); destination(console); }; #log { source(src); destination(console_all); }; Now, let me draw your attention to this line: not match("STATS: dropped 0"); For some reason, I repeatedly get this popping up on the command line: bash-2.05b# STATS: dropped 0 ..when either logged in as root or using su. This doesn't seem to make sense to me, not only is the filter not apparently working,but the lines to log to roots tty are commented out! Anyone had a similar problem? I checked the list archives first, and found a few vague examples of this, but nothing quite the same... mark

2 2

Question
by Jim Gifford 16 Aug '04

16 Aug '04

I have always wondered about this. Why are the libol and syslog-ng separate packages? To me it seems that they should be one package since they depend on each other. -- ---- Jim Gifford maillist(a)jg555.com

2 1

syslog-ng & stunnel, the saga continues
by markzero＠logik.ath.cx 14 Aug '04

14 Aug '04

I'm trying to use stunnel to wrap syslog-ng in SSL. The only problem is that all the documentation for stunnel presumes you're using Red Hat. I'm using OpenBSD. This means I have to generate the certificates myself, and I'm confused here. For a decent level of security, as I understand it, the server needs a certificate, signed by a CA (in this case, as it's for internal networking, the CA is me). What does the client need? I basically created a CA, created a public key and signed it to create the server certificate, what do I need to do for the clients? (I would prefer it if they all had the same certificate, to preserve my sanity). If I hear the phrase "on red hat, go to /usr/share/ssl/certs" one more time, somebody is going to find themselves eating several poorly generated certificates. :) cheers mark

2 2

chroot/syslog-ng/Solaris8
by Roy G Davis 14 Aug '04

14 Aug '04

does anyone have experience using syslog-ng with chroot-ed applications on Solaris 8? specifically, i am running ssh/sftp chroot-ed (with sftp logging patch) and i get no logging. i know it is something about /dev/log etc in the chroot environment but cant find exact info. THX

2 1