- syslog-ng - lists.balabit.hu

Sudden dead
by Francisco Javier Martinez Martinez 30 Jul '04

30 Jul '04

Hello world. I had installed syslog-ng 1.4.15 & libil 0.2.23 sometime ago in a red hat 7.2 box, it works fine as central logger for varius serevers some time, but suddenly it dead. When the daemon is started it show the literal Ok, but the truth is that there is no process running, if I run /etc/rc.d/initd/syslog-ng status it told me that is stopped but that there is a PID file, I didn`t know where syslog-ng log its own activity to be able to see what is wrong, any idea? thanks in advance.

1 0

can't determine log directory with ISO-8859-1 chars
by Kerese Peter 29 Jul '04

29 Jul '04

Hello ! I got a debian sarge server logging all boxes around here using syslog-ng 1.5.15-1.1 via tcp sockets. Logfiles are determinated this way: "$HOST-$MONTH-$DAY.log". Everything works fine except one server which have LC_ALL="hu_HU" (no way to change it). This one sends su session opening events with national letters like ju'l,ma'j,etc. Logfiles are determinated this way: "$HOST-$MONTH-$DAY.log" As it seems syslog-ng can't handle it - it pushes these entries into a false logfile usually int $HOST-12-31.log. I have read the documentation,FAQ, googled (:>) it but can't find anything. Any idea,please? Regards, -- Peter dove(a)koli.rulez.org

1 0

Re: success: syslog-ng on OSX 10.3.4
by Ken Toney 27 Jul '04

27 Jul '04

On Jul 26, 2004, at 3:03 PM, OpenMacNews wrote: > you've not set your path to INCLUDE "/usr/local/bin" > > from your config.log: > > PATH: /sw/bin > PATH: /sw/sbin > PATH: /bin > PATH: /sbin > PATH: /usr/bin > PATH: /usr/sbin > > you'll need to set your ENV vars to properly reflect your dev env. > > richard Okay, so I set my ENV variables and it configured successfully. Then when I run make I error out again. This is the output. Trying to understand the output, I verified that libol is installed in /usr/local/include. Sorry for so many questions but I'm new to this. Thanks for all of you help. Ken ******************************** Making all in src make all-recursive Making all in . gcc -DHAVE_CONFIG_H -I. -I/Users/xxx/Desktop/syslog-ng-1.6.4/src -I. -W -Wno-unused -g -DYYDEBUG -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c macros.c macros.c: In function `append_string': macros.c:84: warning: comparison between signed and unsigned macros.c:84: warning: signed and unsigned type in conditional expression macros.c: In function `format_tzofs': macros.c:118: error: `tm' undeclared (first use in this function) macros.c:118: error: (Each undeclared identifier is reported only once macros.c:118: error: for each function it appears in.) macros.c: In function `expand_macro': macros.c:385: warning: comparison between signed and unsigned In file included from macros.c:527: macros-gperf.c: In function `find_macro': macros-gperf.c:119: warning: missing initializer macros-gperf.c:119: warning: (near initialization for `wordlist[0].id') macros-gperf.c:119: warning: missing initializer macros-gperf.c:119: warning: (near initialization for `wordlist[1].id') macros-gperf.c:120: warning: missing initializer macros-gperf.c:120: warning: (near initialization for `wordlist[2].len') macros-gperf.c:121: warning: missing initializer macros-gperf.c:121: warning: (near initialization for `wordlist[3].id') macros-gperf.c:122: warning: missing initializer macros-gperf.c:122: warning: (near initialization for `wordlist[4].len') macros-gperf.c:123: warning: missing initializer macros-gperf.c:123: warning: (near initialization for `wordlist[5].id') macros-gperf.c:123: warning: missing initializer macros-gperf.c:123: warning: (near initialization for `wordlist[6].id') macros-gperf.c:123: warning: missing initializer macros-gperf.c:123: warning: (near initialization for `wordlist[7].id') macros-gperf.c:124: warning: missing initializer macros-gperf.c:124: warning: (near initialization for `wordlist[8].len') macros-gperf.c:125: warning: missing initializer macros-gperf.c:125: warning: (near initialization for `wordlist[9].len') macros-gperf.c:126: warning: missing initializer macros-gperf.c:126: warning: (near initialization for `wordlist[10].len') macros-gperf.c:127: warning: missing initializer macros-gperf.c:127: warning: (near initialization for `wordlist[11].id') macros-gperf.c:128: warning: missing initializer macros-gperf.c:128: warning: (near initialization for `wordlist[12].len') macros-gperf.c:129: warning: missing initializer macros-gperf.c:129: warning: (near initialization for `wordlist[13].id') macros-gperf.c:130: warning: missing initializer macros-gperf.c:130: warning: (near initialization for `wordlist[14].len') macros-gperf.c:131: warning: missing initializer macros-gperf.c:131: warning: (near initialization for `wordlist[15].len') macros-gperf.c:132: warning: missing initializer macros-gperf.c:132: warning: (near initialization for `wordlist[16].id') macros-gperf.c:133: warning: missing initializer macros-gperf.c:133: warning: (near initialization for `wordlist[17].len') macros-gperf.c:134: warning: missing initializer macros-gperf.c:134: warning: (near initialization for `wordlist[18].id') macros-gperf.c:135: warning: missing initializer macros-gperf.c:135: warning: (near initialization for `wordlist[19].len') macros-gperf.c:136: warning: missing initializer macros-gperf.c:136: warning: (near initialization for `wordlist[20].len') macros-gperf.c:137: warning: missing initializer macros-gperf.c:137: warning: (near initialization for `wordlist[21].len') macros-gperf.c:138: warning: missing initializer macros-gperf.c:138: warning: (near initialization for `wordlist[22].len') macros-gperf.c:139: warning: missing initializer macros-gperf.c:139: warning: (near initialization for `wordlist[23].len') macros-gperf.c:140: warning: missing initializer macros-gperf.c:140: warning: (near initialization for `wordlist[24].len') macros-gperf.c:141: warning: missing initializer macros-gperf.c:141: warning: (near initialization for `wordlist[25].len') macros-gperf.c:142: warning: missing initializer macros-gperf.c:142: warning: (near initialization for `wordlist[26].len') macros-gperf.c:143: warning: missing initializer macros-gperf.c:143: warning: (near initialization for `wordlist[27].id') macros-gperf.c:144: warning: missing initializer macros-gperf.c:144: warning: (near initialization for `wordlist[28].len') macros-gperf.c:145: warning: missing initializer macros-gperf.c:145: warning: (near initialization for `wordlist[29].len') macros-gperf.c:146: warning: missing initializer macros-gperf.c:146: warning: (near initialization for `wordlist[30].len') macros-gperf.c:147: warning: missing initializer macros-gperf.c:147: warning: (near initialization for `wordlist[31].len') macros-gperf.c:148: warning: missing initializer macros-gperf.c:148: warning: (near initialization for `wordlist[32].id') macros-gperf.c:149: warning: missing initializer macros-gperf.c:149: warning: (near initialization for `wordlist[33].len') macros-gperf.c:150: warning: missing initializer macros-gperf.c:150: warning: (near initialization for `wordlist[34].len') macros-gperf.c:151: warning: missing initializer macros-gperf.c:151: warning: (near initialization for `wordlist[35].len') macros-gperf.c:152: warning: missing initializer macros-gperf.c:152: warning: (near initialization for `wordlist[36].len') macros-gperf.c:153: warning: missing initializer macros-gperf.c:153: warning: (near initialization for `wordlist[37].id') macros-gperf.c:154: warning: missing initializer macros-gperf.c:154: warning: (near initialization for `wordlist[38].len') macros-gperf.c:155: warning: missing initializer macros-gperf.c:155: warning: (near initialization for `wordlist[39].len') macros-gperf.c:156: warning: missing initializer macros-gperf.c:156: warning: (near initialization for `wordlist[40].len') macros-gperf.c:157: warning: missing initializer macros-gperf.c:157: warning: (near initialization for `wordlist[41].id') macros-gperf.c:158: warning: missing initializer macros-gperf.c:158: warning: (near initialization for `wordlist[42].len') macros-gperf.c:159: warning: missing initializer macros-gperf.c:159: warning: (near initialization for `wordlist[43].len') macros-gperf.c:160: warning: missing initializer macros-gperf.c:160: warning: (near initialization for `wordlist[44].len') macros-gperf.c:161: warning: missing initializer macros-gperf.c:161: warning: (near initialization for `wordlist[45].len') macros-gperf.c:162: warning: missing initializer macros-gperf.c:162: warning: (near initialization for `wordlist[46].id') macros-gperf.c:163: warning: missing initializer macros-gperf.c:163: warning: (near initialization for `wordlist[47].len') macros-gperf.c:164: warning: missing initializer macros-gperf.c:164: warning: (near initialization for `wordlist[48].id') macros-gperf.c:165: warning: missing initializer macros-gperf.c:165: warning: (near initialization for `wordlist[49].len') macros-gperf.c:166: warning: missing initializer macros-gperf.c:166: warning: (near initialization for `wordlist[50].len') macros-gperf.c:167: warning: missing initializer macros-gperf.c:167: warning: (near initialization for `wordlist[51].id') macros-gperf.c:168: warning: missing initializer macros-gperf.c:168: warning: (near initialization for `wordlist[52].len') macros-gperf.c:169: warning: missing initializer macros-gperf.c:169: warning: (near initialization for `wordlist[53].len') macros-gperf.c:170: warning: missing initializer macros-gperf.c:170: warning: (near initialization for `wordlist[54].id') macros-gperf.c:170: warning: missing initializer macros-gperf.c:170: warning: (near initialization for `wordlist[55].id') macros-gperf.c:170: warning: missing initializer macros-gperf.c:170: warning: (near initialization for `wordlist[56].id') macros-gperf.c:171: warning: missing initializer macros-gperf.c:171: warning: (near initialization for `wordlist[57].len') macros-gperf.c:172: warning: missing initializer macros-gperf.c:172: warning: (near initialization for `wordlist[58].len') macros-gperf.c:173: warning: missing initializer macros-gperf.c:173: warning: (near initialization for `wordlist[59].id') macros-gperf.c:173: warning: missing initializer macros-gperf.c:173: warning: (near initialization for `wordlist[60].id') macros-gperf.c:173: warning: missing initializer macros-gperf.c:173: warning: (near initialization for `wordlist[61].id') macros-gperf.c:173: warning: missing initializer macros-gperf.c:173: warning: (near initialization for `wordlist[62].id') macros-gperf.c:174: warning: missing initializer macros-gperf.c:174: warning: (near initialization for `wordlist[63].len') macros-gperf.c:175: warning: missing initializer macros-gperf.c:175: warning: (near initialization for `wordlist[64].len') macros-gperf.c:176: warning: missing initializer macros-gperf.c:176: warning: (near initialization for `wordlist[65].len') macros-gperf.c:177: warning: missing initializer macros-gperf.c:177: warning: (near initialization for `wordlist[66].len') macros-gperf.c:178: warning: missing initializer macros-gperf.c:178: warning: (near initialization for `wordlist[67].id') macros-gperf.c:179: warning: missing initializer macros-gperf.c:179: warning: (near initialization for `wordlist[68].len') macros-gperf.c:180: warning: missing initializer macros-gperf.c:180: warning: (near initialization for `wordlist[69].id') macros-gperf.c:181: warning: missing initializer macros-gperf.c:181: warning: (near initialization for `wordlist[70].len') macros-gperf.c:182: warning: missing initializer macros-gperf.c:182: warning: (near initialization for `wordlist[71].len') macros-gperf.c:183: warning: missing initializer macros-gperf.c:183: warning: (near initialization for `wordlist[72].id') macros-gperf.c:184: warning: missing initializer macros-gperf.c:184: warning: (near initialization for `wordlist[73].len') macros-gperf.c:185: warning: missing initializer macros-gperf.c:185: warning: (near initialization for `wordlist[74].id') macros-gperf.c:186: warning: missing initializer macros-gperf.c:186: warning: (near initialization for `wordlist[75].len') macros-gperf.c:187: warning: missing initializer macros-gperf.c:187: warning: (near initialization for `wordlist[76].id') macros-gperf.c:187: warning: missing initializer macros-gperf.c:187: warning: (near initialization for `wordlist[77].id') macros-gperf.c:188: warning: missing initializer macros-gperf.c:188: warning: (near initialization for `wordlist[78].len') macros-gperf.c:189: warning: missing initializer macros-gperf.c:189: warning: (near initialization for `wordlist[79].id') macros-gperf.c:190: warning: missing initializer macros-gperf.c:190: warning: (near initialization for `wordlist[80].len') macros-gperf.c:191: warning: missing initializer macros-gperf.c:191: warning: (near initialization for `wordlist[81].id') macros-gperf.c:191: warning: missing initializer macros-gperf.c:191: warning: (near initialization for `wordlist[82].id') macros-gperf.c:191: warning: missing initializer macros-gperf.c:191: warning: (near initialization for `wordlist[83].id') macros-gperf.c:191: warning: missing initializer macros-gperf.c:191: warning: (near initialization for `wordlist[84].id') macros-gperf.c:192: warning: missing initializer macros-gperf.c:192: warning: (near initialization for `wordlist[85].len') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[86].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[87].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[88].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[89].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[90].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[91].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[92].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[93].id') macros-gperf.c:193: warning: missing initializer macros-gperf.c:193: warning: (near initialization for `wordlist[94].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[95].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[96].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[97].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[98].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[99].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[100].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[101].id') macros-gperf.c:194: warning: missing initializer macros-gperf.c:194: warning: (near initialization for `wordlist[102].id') macros-gperf.c:195: warning: missing initializer macros-gperf.c:195: warning: (near initialization for `wordlist[103].len') make[3]: *** [macros.o] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive-am] Error 2 make: *** [all-recursive] Error 1

2 1

RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers
by Amaral, Angelo 27 Jul '04

27 Jul '04

Ted I look in my configuration: $ strings /usr/lib/libwrap.a | grep twist twist twist %s to %s twist_option: dup: %m twist_option: /bin/sh: %m twist option in resident process twist_option But in my Linux Redhat 3.1AS, tcpwrappers don´t work. Please dou you help me. Thanks, Angelo Amaral -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Rule, Ted Sent: terça-feira, 27 de julho de 2004 10:00 To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers An odd thing showed up on some of my Solaris boxes the other day, which might be pertinent. Does the libwrap library definitely support :deny in the allow file? This is dependent on the library's compile time options, but may be checked with strings libwrap.so | grep twist For :deny support to exist in the library, there must be references to twist in the library. e.g.: $ strings /usr/lib/libwrap.a | grep twist twist twist option in resident process twist %s to %s twist_option: dup: %m twist_option: /bin/sh: %m twist_option $ If there are no twist references, :deny cant be used in /etc/hosts.allow, but it's much worse than that. If :deny appears in the allow file on a twistless library, the library interprets /etc/hosts.allow as if you'd said :allow. Ouch. It all boils down to use of -DPROCESS_OPTIONS at library compile time. Ted > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Amaral, Angelo > Sent: Tuesday July 27 2004 13:49 > To: syslog-ng(a)lists.balabit.hu > Subject: RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers > > Thanks, Musashino-shi. > > But, I don´t make syslog-ng works with tcpwrappers. > > > ************************************************************** > ******************************************* > I show how I compile my syslog-ng: > > 1- Intall libnet (libnet-1.1.2.1-2.fc2.i386.rpm) in my linux > RedHat 3.1AS. > > 2- Compile syslog-ng: > # ./configure --enable-tcp-wrapper --enable-sp > oof-source > loading cache ./config.cache > checking for a BSD compatible install... (cached) /usr/bin/install -c > checking whether build environment is sane... yes > checking whether make sets ${MAKE}... (cached) yes > checking for working aclocal-1.4... found > checking for working autoconf... found > checking for working automake-1.4... found > checking for working autoheader... found > checking for working makeinfo... found > checking whether build environment is sane... yes > checking for gcc... (cached) gcc > checking whether the C compiler (gcc ) works... yes > checking whether the C compiler (gcc ) is a cross-compiler... no > checking whether we are using GNU C... (cached) yes > checking whether gcc accepts -g... (cached) yes > checking for gcc option to accept ANSI C... (cached) none needed > checking for bison... (cached) bison -y > checking how to run the C preprocessor... (cached) gcc -E > checking for flex... (cached) flex > checking for flex... (cached) flex > checking for yywrap in -lfl... (cached) yes > checking lex output file root... (cached) lex.yy > checking whether yytext is a pointer... (cached) yes > checking whether make sets ${MAKE}... (cached) yes > checking for ANSI C header files... (cached) yes > checking for malloc.h... (cached) yes > checking for unistd.h... (cached) yes > checking for door.h... (cached) no > checking for stropts.h... (cached) yes > checking for sys/strlog.h... (cached) no > checking for stdarg.h... (cached) yes > checking for sys/klog.h... (cached) yes > checking for arpa/nameser.h... (cached) yes > checking for tcpd.h... (cached) yes > checking for working const... (cached) yes > checking whether time.h and sys/time.h may both be > included... (cached) yes > checking for modern utmp... (cached) yes > checking for global timezone variable... (cached) yes > checking size of short... (cached) 2 > checking size of int... (cached) 4 > checking size of long... (cached) 4 > checking for I_CONSLOG... (cached) no > checking for O_LARGEFILE... (cached) yes > checking for res_init in <resolv.h>... (cached) yes > checking for working alloca.h... (cached) yes > checking for alloca... (cached) yes > checking for vprintf... (cached) yes > checking for res_init in -lresolv... (cached) no > checking for __res_init in -lresolv... (cached) yes > checking for door_create in -ldoor... (cached) no > checking for socket in -lsocket... (cached) no > checking for gethostbyname in -lnsl... (cached) yes > checking for select... (cached) yes > checking for snprintf... (cached) yes > checking for vsnprintf... (cached) yes > checking for strerror... (cached) yes > checking for inet_aton... (cached) yes > checking for strncpy... (cached) yes > checking for getutent... (cached) yes > checking for getopt_long... (cached) yes > checking for strcasecmp... (cached) yes > checking for strptime... (cached) yes > checking for TCP wrapper library... (cached) -lwrap > checking whether to enable Sun STREAMS support... no > checking whether to enable Sun door support... no > checking whether to enable TCP wrapper support... yes > checking whether to enable spoof_source support... yes > checking libol version >= 0.3.13... ok > creating ./config.status > creating Makefile > creating src/Makefile > creating src/tests/Makefile > creating doc/Makefile > creating doc/sgml/Makefile > creating contrib/Makefile > creating syslog-ng.spec > creating src/config.h > src/config.h is unchanged > > 3- Look ldd: > # ldd /usr/local/sbin/syslog-ng > libnsl.so.1 => /lib/libnsl.so.1 (0xb75c7000) > libresolv.so.2 => /lib/libresolv.so.2 (0xb75b5000) > libwrap.so.0 => /usr/lib/libwrap.so.0 (0xb75ac000) > libc.so.6 => /lib/tls/libc.so.6 (0xb7475000) > /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0xb75eb000) > > ************************************************************** > ******************************************* > > And the configuration continue not working. > May you help me, please. > > Thanks. > > Angelo Amaral > > > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of michihito > matsubara > Sent: sábado, 24 de julho de 2004 00:01 > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers > > > Angelo > > On Thu, 22 Jul 2004 11:10:40 -0300 > Subject: RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers > "Amaral, Angelo" <angelo.amaral(a)hp.com> wrote: > > Another senario. > Have you ever run ldd against syslog-ng itself? > This will show how syslog-ng linked against libwrap library or not. > > On my Linux box, > > $ ldd /sbin/syslog-ng > libnsl.so.1 => /lib/libnsl.so.1 (0x40020000) > libresolv.so.2 => /lib/libresolv.so.2 (0x40034000) > libwrap.so.0 => /usr/lib/libwrap.so.0 (0x40044000) > libnet.so.2 => /usr/lib/libnet1/libnet.so.2 (0x4004c000) > libc.so.6 => /lib/libc.so.6 (0x4005e000) > /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) > > And, on my FreeBSD box, > > % ldd /usr/local/sbin/syslog-ng > /usr/local/sbin/syslog-ng: > libwrap.so.3 => /usr/lib/libwrap.so.3 (0x2807c000) > libc.so.4 => /usr/lib/libc.so.4 (0x28084000) > > > HTH > mitch > > > > Andrew, > > > > I put in my system, the hosts.allow below: > > > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > ++++++++++++++++ > > > > # hosts.allow This file describes the names of the hosts which are > > # allowed to use the local INET services, as decided > > # by the '/usr/sbin/tcpd' server. > > # > > > > in.tftpd: ALL :allow > > sshd: ALL :allow > > ALL: ALL :deny > > > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > ++++++++++++++++ > > > > And the configuration continue not working. > > May you help me, please. > > > > Thanks. > > -- > Musashino-shi, Tokyo, Japan > K12LTSP in Japanese ; http://open-mitch.dyndns.org/k12ltsp/ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers
by Rule, Ted 27 Jul '04

27 Jul '04

An odd thing showed up on some of my Solaris boxes the other day, which might be pertinent. Does the libwrap library definitely support :deny in the allow file? This is dependent on the library's compile time options, but may be checked with strings libwrap.so | grep twist For :deny support to exist in the library, there must be references to twist in the library. e.g.: $ strings /usr/lib/libwrap.a | grep twist twist twist option in resident process twist %s to %s twist_option: dup: %m twist_option: /bin/sh: %m twist_option $ If there are no twist references, :deny cant be used in /etc/hosts.allow, but it's much worse than that. If :deny appears in the allow file on a twistless library, the library interprets /etc/hosts.allow as if you'd said :allow. Ouch. It all boils down to use of -DPROCESS_OPTIONS at library compile time. Ted > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Amaral, Angelo > Sent: Tuesday July 27 2004 13:49 > To: syslog-ng(a)lists.balabit.hu > Subject: RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers > > Thanks, Musashino-shi. > > But, I don´t make syslog-ng works with tcpwrappers. > > > ************************************************************** > ******************************************* > I show how I compile my syslog-ng: > > 1- Intall libnet (libnet-1.1.2.1-2.fc2.i386.rpm) in my linux > RedHat 3.1AS. > > 2- Compile syslog-ng: > # ./configure --enable-tcp-wrapper --enable-sp > oof-source > loading cache ./config.cache > checking for a BSD compatible install... (cached) /usr/bin/install -c > checking whether build environment is sane... yes > checking whether make sets ${MAKE}... (cached) yes > checking for working aclocal-1.4... found > checking for working autoconf... found > checking for working automake-1.4... found > checking for working autoheader... found > checking for working makeinfo... found > checking whether build environment is sane... yes > checking for gcc... (cached) gcc > checking whether the C compiler (gcc ) works... yes > checking whether the C compiler (gcc ) is a cross-compiler... no > checking whether we are using GNU C... (cached) yes > checking whether gcc accepts -g... (cached) yes > checking for gcc option to accept ANSI C... (cached) none needed > checking for bison... (cached) bison -y > checking how to run the C preprocessor... (cached) gcc -E > checking for flex... (cached) flex > checking for flex... (cached) flex > checking for yywrap in -lfl... (cached) yes > checking lex output file root... (cached) lex.yy > checking whether yytext is a pointer... (cached) yes > checking whether make sets ${MAKE}... (cached) yes > checking for ANSI C header files... (cached) yes > checking for malloc.h... (cached) yes > checking for unistd.h... (cached) yes > checking for door.h... (cached) no > checking for stropts.h... (cached) yes > checking for sys/strlog.h... (cached) no > checking for stdarg.h... (cached) yes > checking for sys/klog.h... (cached) yes > checking for arpa/nameser.h... (cached) yes > checking for tcpd.h... (cached) yes > checking for working const... (cached) yes > checking whether time.h and sys/time.h may both be > included... (cached) yes > checking for modern utmp... (cached) yes > checking for global timezone variable... (cached) yes > checking size of short... (cached) 2 > checking size of int... (cached) 4 > checking size of long... (cached) 4 > checking for I_CONSLOG... (cached) no > checking for O_LARGEFILE... (cached) yes > checking for res_init in <resolv.h>... (cached) yes > checking for working alloca.h... (cached) yes > checking for alloca... (cached) yes > checking for vprintf... (cached) yes > checking for res_init in -lresolv... (cached) no > checking for __res_init in -lresolv... (cached) yes > checking for door_create in -ldoor... (cached) no > checking for socket in -lsocket... (cached) no > checking for gethostbyname in -lnsl... (cached) yes > checking for select... (cached) yes > checking for snprintf... (cached) yes > checking for vsnprintf... (cached) yes > checking for strerror... (cached) yes > checking for inet_aton... (cached) yes > checking for strncpy... (cached) yes > checking for getutent... (cached) yes > checking for getopt_long... (cached) yes > checking for strcasecmp... (cached) yes > checking for strptime... (cached) yes > checking for TCP wrapper library... (cached) -lwrap > checking whether to enable Sun STREAMS support... no > checking whether to enable Sun door support... no > checking whether to enable TCP wrapper support... yes > checking whether to enable spoof_source support... yes > checking libol version >= 0.3.13... ok > creating ./config.status > creating Makefile > creating src/Makefile > creating src/tests/Makefile > creating doc/Makefile > creating doc/sgml/Makefile > creating contrib/Makefile > creating syslog-ng.spec > creating src/config.h > src/config.h is unchanged > > 3- Look ldd: > # ldd /usr/local/sbin/syslog-ng > libnsl.so.1 => /lib/libnsl.so.1 (0xb75c7000) > libresolv.so.2 => /lib/libresolv.so.2 (0xb75b5000) > libwrap.so.0 => /usr/lib/libwrap.so.0 (0xb75ac000) > libc.so.6 => /lib/tls/libc.so.6 (0xb7475000) > /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0xb75eb000) > > ************************************************************** > ******************************************* > > And the configuration continue not working. > May you help me, please. > > Thanks. > > Angelo Amaral > > > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of michihito > matsubara > Sent: sábado, 24 de julho de 2004 00:01 > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers > > > Angelo > > On Thu, 22 Jul 2004 11:10:40 -0300 > Subject: RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers > "Amaral, Angelo" <angelo.amaral(a)hp.com> wrote: > > Another senario. > Have you ever run ldd against syslog-ng itself? > This will show how syslog-ng linked against libwrap library or not. > > On my Linux box, > > $ ldd /sbin/syslog-ng > libnsl.so.1 => /lib/libnsl.so.1 (0x40020000) > libresolv.so.2 => /lib/libresolv.so.2 (0x40034000) > libwrap.so.0 => /usr/lib/libwrap.so.0 (0x40044000) > libnet.so.2 => /usr/lib/libnet1/libnet.so.2 (0x4004c000) > libc.so.6 => /lib/libc.so.6 (0x4005e000) > /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) > > And, on my FreeBSD box, > > % ldd /usr/local/sbin/syslog-ng > /usr/local/sbin/syslog-ng: > libwrap.so.3 => /usr/lib/libwrap.so.3 (0x2807c000) > libc.so.4 => /usr/lib/libc.so.4 (0x28084000) > > > HTH > mitch > > > > Andrew, > > > > I put in my system, the hosts.allow below: > > > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > ++++++++++++++++ > > > > # hosts.allow This file describes the names of the hosts which are > > # allowed to use the local INET services, as decided > > # by the '/usr/sbin/tcpd' server. > > # > > > > in.tftpd: ALL :allow > > sshd: ALL :allow > > ALL: ALL :deny > > > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > ++++++++++++++++ > > > > And the configuration continue not working. > > May you help me, please. > > > > Thanks. > > -- > Musashino-shi, Tokyo, Japan > K12LTSP in Japanese ; http://open-mitch.dyndns.org/k12ltsp/ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers
by Amaral, Angelo 27 Jul '04

27 Jul '04

Thanks, Musashino-shi. But, I don´t make syslog-ng works with tcpwrappers. ********************************************************************************************************* I show how I compile my syslog-ng: 1- Intall libnet (libnet-1.1.2.1-2.fc2.i386.rpm) in my linux RedHat 3.1AS. 2- Compile syslog-ng: # ./configure --enable-tcp-wrapper --enable-sp oof-source loading cache ./config.cache checking for a BSD compatible install... (cached) /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... (cached) yes checking for working aclocal-1.4... found checking for working autoconf... found checking for working automake-1.4... found checking for working autoheader... found checking for working makeinfo... found checking whether build environment is sane... yes checking for gcc... (cached) gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ANSI C... (cached) none needed checking for bison... (cached) bison -y checking how to run the C preprocessor... (cached) gcc -E checking for flex... (cached) flex checking for flex... (cached) flex checking for yywrap in -lfl... (cached) yes checking lex output file root... (cached) lex.yy checking whether yytext is a pointer... (cached) yes checking whether make sets ${MAKE}... (cached) yes checking for ANSI C header files... (cached) yes checking for malloc.h... (cached) yes checking for unistd.h... (cached) yes checking for door.h... (cached) no checking for stropts.h... (cached) yes checking for sys/strlog.h... (cached) no checking for stdarg.h... (cached) yes checking for sys/klog.h... (cached) yes checking for arpa/nameser.h... (cached) yes checking for tcpd.h... (cached) yes checking for working const... (cached) yes checking whether time.h and sys/time.h may both be included... (cached) yes checking for modern utmp... (cached) yes checking for global timezone variable... (cached) yes checking size of short... (cached) 2 checking size of int... (cached) 4 checking size of long... (cached) 4 checking for I_CONSLOG... (cached) no checking for O_LARGEFILE... (cached) yes checking for res_init in <resolv.h>... (cached) yes checking for working alloca.h... (cached) yes checking for alloca... (cached) yes checking for vprintf... (cached) yes checking for res_init in -lresolv... (cached) no checking for __res_init in -lresolv... (cached) yes checking for door_create in -ldoor... (cached) no checking for socket in -lsocket... (cached) no checking for gethostbyname in -lnsl... (cached) yes checking for select... (cached) yes checking for snprintf... (cached) yes checking for vsnprintf... (cached) yes checking for strerror... (cached) yes checking for inet_aton... (cached) yes checking for strncpy... (cached) yes checking for getutent... (cached) yes checking for getopt_long... (cached) yes checking for strcasecmp... (cached) yes checking for strptime... (cached) yes checking for TCP wrapper library... (cached) -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... yes checking whether to enable spoof_source support... yes checking libol version >= 0.3.13... ok creating ./config.status creating Makefile creating src/Makefile creating src/tests/Makefile creating doc/Makefile creating doc/sgml/Makefile creating contrib/Makefile creating syslog-ng.spec creating src/config.h src/config.h is unchanged 3- Look ldd: # ldd /usr/local/sbin/syslog-ng libnsl.so.1 => /lib/libnsl.so.1 (0xb75c7000) libresolv.so.2 => /lib/libresolv.so.2 (0xb75b5000) libwrap.so.0 => /usr/lib/libwrap.so.0 (0xb75ac000) libc.so.6 => /lib/tls/libc.so.6 (0xb7475000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0xb75eb000) ********************************************************************************************************* And the configuration continue not working. May you help me, please. Thanks. Angelo Amaral -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of michihito matsubara Sent: sábado, 24 de julho de 2004 00:01 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers Angelo On Thu, 22 Jul 2004 11:10:40 -0300 Subject: RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers "Amaral, Angelo" <angelo.amaral(a)hp.com> wrote: Another senario. Have you ever run ldd against syslog-ng itself? This will show how syslog-ng linked against libwrap library or not. On my Linux box, $ ldd /sbin/syslog-ng libnsl.so.1 => /lib/libnsl.so.1 (0x40020000) libresolv.so.2 => /lib/libresolv.so.2 (0x40034000) libwrap.so.0 => /usr/lib/libwrap.so.0 (0x40044000) libnet.so.2 => /usr/lib/libnet1/libnet.so.2 (0x4004c000) libc.so.6 => /lib/libc.so.6 (0x4005e000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) And, on my FreeBSD box, % ldd /usr/local/sbin/syslog-ng /usr/local/sbin/syslog-ng: libwrap.so.3 => /usr/lib/libwrap.so.3 (0x2807c000) libc.so.4 => /usr/lib/libc.so.4 (0x28084000) HTH mitch > Andrew, > > I put in my system, the hosts.allow below: > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > > # hosts.allow This file describes the names of the hosts which are > # allowed to use the local INET services, as decided > # by the '/usr/sbin/tcpd' server. > # > > in.tftpd: ALL :allow > sshd: ALL :allow > ALL: ALL :deny > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > > And the configuration continue not working. > May you help me, please. > > Thanks. -- Musashino-shi, Tokyo, Japan K12LTSP in Japanese ; http://open-mitch.dyndns.org/k12ltsp/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

?? Connection broken to AF_INET(127.0.0.1:514), reopening in 60 seconds
by seberino＠spawar.navy.mil 27 Jul '04

27 Jul '04

I don't know what is the trouble with my remote syslog-ng/stunnel setup since I turned off packet filtering. Any guidance would be greatly appreciated. Here is error message in log: Jul 26 11:06:47 seberino3 syslog-ng[3245]: Connection broken to AF_INET(127.0.0.1:514), reopening in 60 seconds Here is my syslog-ng.conf: options {long_hostnames(no); keep_hostname(yes); chain_hostnames(no);}; source client_sources {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination local_dest {file("/var/log/messages");}; destination remote_dest {tcp("127.0.0.1" port(514));}; log {source(client_sources); destination(local_dest);}; log {source(client_sources); destination(remote_dest);}; Chris

3 4

logging messages from Netscreen to syslog-ng - need to pipe to MySQL db now
by Brandon Rodak 26 Jul '04

26 Jul '04

This might be a basic question but I am missing something. I believe I am successfully sending the Netscreen firewall messages to a remote syslog server (running syslog-ng) as I have them stored in an appropriate log file. What I want to do now is pipe this file to a MySQL database so that I can retrieve the data later for analysis and to post to a web interface. I have even tried the simple syslong-ng.conf example below (unrelated to my Netscreen logs) in an attempt to pipe data. destination database { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY','$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; Nothing ever appears in the mysql.pipe file. Also I need advice on what fields I should be extrapolating out of the log for use in the Database; I realize the fields above are not the ones I would need from my Netscreen log but any information or leads on how to use the Netscreen logs correctly with a database would be awesome. Thanks for any and all help! It is greatly appreciated! Brandon -- Brandon Rodak Web Services Computer Marketing Corporation http://www.cmcflex.com

1 0

Re: syslog-ng on OSX 10.3.4
by Ken Toney 26 Jul '04

26 Jul '04

Richard, I haven't gotten syslog-ng installed on OS X 10.3.4 yet, but can share with you some resources I have for information. You might try reading <http://sial.org/howto/logging/> <http://www.campin.net/newlogcheck.html> I'd be happy to share my conf file with you once I get syslog-ng running, but I am one step behind you. I am trying to install syslog-ng 1.6.4 on OS X 10.3.4 and can't. Did you run into any problems installing syslog-ng? Thanks, Ken On Jul 14, 2004, at 3:53 AM, syslog-ng-request(a)lists.balabit.hu wrote: > Message: 4 > Date: Fri, 09 Jul 2004 12:26:26 -0700 > From: OpenMacNews <syslog-ng.20.openmacnews(a)spamgourmet.com> > To: syslog-ng <syslog-ng(a)lists.balabit.hu> > Subject: [syslog-ng]syslog-ng on OSX 10.3.4 > Reply-To: syslog-ng(a)lists.balabit.hu > > hi all, > > i'm new to syslog-ng. > > i've installed 1.7x on OSX 10.3.4; now, starting to deal with the > config file. > > i dl'd and searched thru the list archives for pointers, etc. and > found the last relevant, post by Kim Cary, but nothing further. > > i contacted Kim -- not yet finished/successful. > > soooooo, to ask: has anyone here got syslog-ng up/running on OSX, and > would you be willing to share your conf file? > > thx! > > richard

2 3

Jailing syslog-ng on OpenBSD 3.5
by markzero＠logik.ath.cx 26 Jul '04

26 Jul '04

Hello. I'm having difficulty jailing syslog-ng under OpenBSD 3.5. My exact steps so far (after having added group _syslogng and user _syslogng): # mkdir -p /jail/sysng # mkdir -p /jail/sysng/usr/local/sbin # mkdir -p /jail/sysng/usr/lib # mkdir -p /jail/sysng/usr/libexec # mkdir -p /jail/sysng/dev # mkdir -p /jail/sysng/var/log # mkdir -p /jail/sysng/etc/syslog-ng # cp /usr/local/sbin/syslog-ng /jail/sysng/usr/local/sbin # cp /usr/lib/libc.so.30.3 /jail/sysng/usr/lib # cp /usr/libexec/ld.so /jail/sysng/usr/libexec # cp /etc/syslog-ng/syslog-ng.conf /jail/sysng/etc/syslog-ng/ # chown -R _syslogng._syslogng /jail/sysng # ln /dev/log /jail/sysng/dev/log I should explain that I installed syslog-ng from a package, as I have no access to a compiler on this machine (and my other machine is currently in pieces being repaired) - therefore I just moved the binaries into the jail. Running the command: # chroot -g _syslogng -u _syslogng /jail/sysng /usr/local/sbin/syslog-ng Does not give any errors, and log files are indeed created in /jail/var/log (as per the configuration file) - HOWEVER, nothing on the system is actually logged. Syslog-ng logs its own 'birth and death' but does not, for example, log mail or even the reboot command. Is there some glaring error here? The debugging output from syslog-ng gives no errors either, I'm lost as to where to go next to track down the problem. mark ps: I excluded my config as it's pretty much the stock sample config with uccp and ppp removed. If this is relevant, I will attach it to my next email.

1 1