- syslog-ng - lists.balabit.hu

libol license?
by atonns＠mail.ivillage.com 30 Apr '04

30 Apr '04

This isn't syslog-ng related directly but... I just downloaded libol-0.3.13.tar.gz from http://www.balabit.com/downloads/syslog-ng/libol/0.3/ It says on that page: Some of our download able products are free software, licensed under GNU General Public License, others have a more restrictive license. The exact license terms of those programs are available in a file named COPYING or LICENSE. However, there is no COPYING or LICENSE files in the libol-0.3.13.tar.gz tarball. This is an oversight, right? I assume it would be the LGPL, correct? -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 1

RE: [syslog-ng]Not finding libol, please help
by Edwards, Thomas 30 Apr '04

30 Apr '04

Get the new version of libol, it needs 0.3.13. You can get it here http://www.balabit.com/downloads/libol/0.3/libol-0.3.13.tar.gz Here is the main page. http://www.balabit.com/downloads/libol/0.3/ When I upgraded libol it went smoothly. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Keith Olmstead Sent: Friday, April 30, 2004 10:28 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Not finding libol, please help Hello, Trying to upgrade my syslog-ng install and during the config, it is not finding my libol. checking libol version >= 0.3.13... no configure: error: Required libol version not found but I have libol installed. libol-config --version 0.3.9 Just a default install of libol. Can anyone help me as to why it is not seeing libol. It is in my path and I can not find a reason why it is not finding it. This is on a RH9 box. Thanks, Keith -- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ******************************************** This message is intended only for the use of the Addressee and may contain information that is PRIVILEGED and CONFIDENTIAL. If you are not the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please erase all copies of the message and its attachments and notify us immediately. Thank you. ********************************************

1 0

Not finding libol, please help
by Keith Olmstead 30 Apr '04

30 Apr '04

Hello, Trying to upgrade my syslog-ng install and during the config, it is not finding my libol. checking libol version >= 0.3.13... no configure: error: Required libol version not found but I have libol installed. libol-config --version 0.3.9 Just a default install of libol. Can anyone help me as to why it is not seeing libol. It is in my path and I can not find a reason why it is not finding it. This is on a RH9 box. Thanks, Keith --

1 0

RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 29 Apr '04

29 Apr '04

Aw crap. Forget all this. I looked at it again, and anyone would be able to DoS sec.pl using logger. ::sigh:: It looks like signal propagation from syslog-ng to sec.pl is the right way of doing this. -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com > -----Original Message----- > From: atonns(a)mail.ivillage.com [mailto:atonns@mail.ivillage.com] > Sent: Thursday, April 29, 2004 12:13 PM > To: syslog-ng(a)lists.balabit.hu > Subject: RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does > > After a night of sleeping on it, I came up with a alternate > solution - have > SEC detect restarts of syslog-ng. Below is the result. The > only fuzzy part > is in the sec-cleanup.pl script below - what to do if you > don't get a TERM > signal from sec.pl. I don't think using "logger" is the best > idea since > things are restarting, etc. etc. I _guess_ it could send email out. In > reality, it's all up to the end user. > > ### syslog-ng.conf ### > > source s_src { > sun-stream("/dev/log" door("/etc/.syslog_door")); > tcp(max-connections(1024)); > udp(); > internal(); > }; > > destination d_sec { > program("/usr/local/sbin/sec.pl -intevents -input=\"-\" > -conf=/usr/local/etc/sec.conf"); > }; > > log { > source(s_src); > destination(d_sec); > }; > > ### sec.conf ### > > type=Single > continue=TakeNext > ptype=RegExp > pattern=syslog-ng version .+ going down > desc=syslog-ng shutdown > action= shellcmd /usr/local/sbin/sec-cleanup.pl > > type=Single > continue=TakeNext > ptype=RegExp > pattern=SIGHUP received, restarting syslog-ng > desc=syslog-ng restart > action= shellcmd /usr/local/sbin/sec-cleanup.pl > > ### sec-cleanup.pl ### > > #!/usr/local/bin/perl -w > # > # sec-cleanup.pl > # > # ATonns Thu Apr 29 11:42:10 EDT 2004 > # > # $Id$ > # > > use strict; > my $PROGNAME="sec-cleanup.pl"; > my $waittime = 10; # in seconds > > ## CODE ## > > my $pid = $$; > my $ppid = getppid; > $SIG{'TERM'} = sub { > print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: got TERM > signal, exiting gracefully.\n"; > exit(0); > }; > print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: killing parent > $ppid\n"; > kill('TERM',$ppid); > sleep($waittime); > print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: not > good - timed out > waiting for TERM signal. Exiting.\n"; > exit(1); > > -- > "Computer science is as much about computers as > astronomy is about telescopes" -- Edsger Dijkstra > --------------------------------------------------------- > Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com > iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - > iVillage Inc. is a > leading women's media company that includes iVillage.com, Women.com, > gURL.com, Astrology.com, Promotions.com, iVillage Parenting > Network, The > Newborn Channel, Lamaze Publishing, Business Women's Network, > Diversity Best > Practices, Best Practices in Corporate Communications, and iVillage > Consulting. The information contained in this communication may be > confidential, is intended only for the use of the recipient > named above, and > may be construed under applicable law to be a commercial > email. If you have > received this communication in error, please delete this > message from your > computer system. If you are the recipient named above and do > not wish to > receive any future commercial emails, please reply to the > sender with a > message stating such preference. > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

1 0

RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 29 Apr '04

29 Apr '04

After a night of sleeping on it, I came up with a alternate solution - have SEC detect restarts of syslog-ng. Below is the result. The only fuzzy part is in the sec-cleanup.pl script below - what to do if you don't get a TERM signal from sec.pl. I don't think using "logger" is the best idea since things are restarting, etc. etc. I _guess_ it could send email out. In reality, it's all up to the end user. ### syslog-ng.conf ### source s_src { sun-stream("/dev/log" door("/etc/.syslog_door")); tcp(max-connections(1024)); udp(); internal(); }; destination d_sec { program("/usr/local/sbin/sec.pl -intevents -input=\"-\" -conf=/usr/local/etc/sec.conf"); }; log { source(s_src); destination(d_sec); }; ### sec.conf ### type=Single continue=TakeNext ptype=RegExp pattern=syslog-ng version .+ going down desc=syslog-ng shutdown action= shellcmd /usr/local/sbin/sec-cleanup.pl type=Single continue=TakeNext ptype=RegExp pattern=SIGHUP received, restarting syslog-ng desc=syslog-ng restart action= shellcmd /usr/local/sbin/sec-cleanup.pl ### sec-cleanup.pl ### #!/usr/local/bin/perl -w # # sec-cleanup.pl # # ATonns Thu Apr 29 11:42:10 EDT 2004 # # $Id$ # use strict; my $PROGNAME="sec-cleanup.pl"; my $waittime = 10; # in seconds ## CODE ## my $pid = $$; my $ppid = getppid; $SIG{'TERM'} = sub { print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: got TERM signal, exiting gracefully.\n"; exit(0); }; print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: killing parent $ppid\n"; kill('TERM',$ppid); sleep($waittime); print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: not good - timed out waiting for TERM signal. Exiting.\n"; exit(1); -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

1 0

Sylog-ng OpenBSD Problems
by Johannes Geier 29 Apr '04

29 Apr '04

Hello, I run syslog-ng-1.5.24 on OpenBSD 3.4 sparc64, i have some problems, its not working in the way i want it, my config looks in this way: options { long_hostnames(off); chain_hostnames(off); use_fqdn (yes); sync(0); }; source s_udp { udp(); }; destination test { file("/var/log/info"); }; log { source(s_udp); destination(test); }; no biggie at all tail -f /var/log/info shows: Apr 28 16:23:18 syslog/syslog 1552866: Apr 28 16:42:18: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1:14, changed state to down Apr 28 16:23:23 syslog/syslog 1552872: Apr 28 16:42:24: %LINK-3-UPDOWN: Interface Serial1/0:2, changed state to down There is no Router source IP, just syslog/syslog syslog is the name of the logging box # uname -a OpenBSD syslog.srv.test.com 3.4 GENERIC#85 sparc64 when i run that box with the normal syslogd the source ip, gets shown, and even when i erase all options in syslog-ng.conf : source s_udp { udp(); }; destination test { file("/var/log/info"); }; log { source(s_udp); destination(test); }; the source ip never comes in, i just want the sourceip no dns name nothing any ideas? Greets Johannes -- Die e-Mail-Boxes von Brennercom sind Virus-gesichert und Spam-gefiltert. Le caselle e-Mail di Brennercom sono protette da sistemi antivirus e antispam. http://www.brennercom.it

2 4

RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 29 Apr '04

29 Apr '04

Nate, I don't think it's perl, but syslog-ng. What version of syslog-ng are you running? I looked at the source for 'afprogram.c' in both 1.6.2 and the 1.7.0+20040428 where it forks the child to run the program. Using the code as follows, how could you do anything _but_ run /bin/sh -c ... if (pid == 0) { int fd = open("/dev/null", O_WRONLY); dup2(msgpipe[0], 0); dup2(fd, 1); dup2(fd, 2); close(fd); close(msgpipe[1]); execl("/bin/sh", "/bin/sh", "-c", self->progname->data, NULL); _exit(127); } I'm still reading through the code, but I don't think that syslog-ng passes along the necessary signals to it's children. When I HUP syslog-ng, it spawns another sec.pl as well, not SIGTERM'ing the first one. Am I not understanding the behavior of syslog-ng, doing something wrong, or is this some sort of bug in syslog-ng? FYI, sec.pl's behavior is documented as follows in the SEC man page: SIGTERM SEC will terminate gracefully (all SEC child processes will receive SIGTERM). Shouldn't syslog-ng do the same? Thanks, Tony -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com > -----Original Message----- > From: Nate Campi [mailto:nate@campin.net] > Sent: Wednesday, April 28, 2004 5:06 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]cannot get sec.pl to exit after syslog-ng does > > I read your message too fast the first time, it appears that you still > have it spawned by a shell with no shell redirection characters. > > 23330 ? S 2:11 /sbin/syslog-ng > 23331 ? S 0:00 \_ /usr/bin/perl /usr/bin/swatch > --script-dir=/root --read-pipe=cat /dev > 23346 ? S 0:31 | \_ perl /root/.swatch_script.23331 > 23370 ? S 0:02 | \_ cat /dev/fd/0 > 23334 ? S 3:24 \_ /usr/bin/perl -w > /usr/local/sbin/sec.pl -input=- -conf=/usr/local/etc > > I don't have a shell starting sec on linux. Maybe it's perl on solaris > doing this. I can't say. > -- > Nate > > "Guide to understanding a net.addict's day: Slow day: didn't have much > to do, so spent three hours on usenet. Busy day: managed to work in > three hours of usenet. Bad day: barely squeezed in three hours of > usenet." - Unknown > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 2

cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 28 Apr '04

28 Apr '04

I've tried the various configurations in the FAQ and I still get sec.pl spawned by a shell. Then after killing syslog-ng, sec.pl doesn't exit. Below are the configs and the output from ptree. I'm using Solaris 7, syslog-ng 1.6.2, sec 2.2.2 and perl 5.00503. I'm thinking of adding stats(60) to the syslog-ng config and then using the -input_timeout and -timeout_script options for sec.pl, but I have figured out how the sub-script would tell the difference between the abandoned sec.pl and the new one that's a child of the current syslog-ng. as per FAQ: ----------- destination d_sec { program("/usr/local/sbin/sec.pl -intevents -input=\"-\" -conf=/usr/local/etc/sec.conf"); }; 25879 /usr/local/sbin/syslog-ng 25880 /bin/sh -c /usr/local/sbin/sec.pl -intevents -input="-" -conf=/usr/local/etc/se 25881 /usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input=- -conf=/usr/lo another config: --------------- destination d_sec { program("/usr/local/sbin/sec.pl -intevents -input=\"-\" -conf=/usr/local/etc/sec.conf > /var/log/sec.log 2>&1"); }; 26428 /usr/local/sbin/syslog-ng 26429 /bin/sh -c /usr/local/sbin/sec.pl -intevents -input="-" -conf=/usr/local/etc/se 26430 /usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input=- -conf=/usr/lo pure desperation: ----------------- destination d_sec { program("/usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input=\"-\" -conf=/usr/local/etc/sec.conf"); }; 27478 /usr/local/sbin/syslog-ng 27479 /bin/sh -c /usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input="-" 27480 /usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input=- -conf=/usr/lo -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 2

No facility/level logged
by me 28 Apr '04

28 Apr '04

Hello, I've compiled syslog-ng for AIX 5L and want the facility/level information be logged to the log file(s) (I assume this shuold be included in the message part as described in the syslog protocol rfc). Well, my investigations lend me to the "syslog" subroutine, which is called during the log of an event. This concerns in fact the os and not really syslog-ng. But maybe someone had the same requirement... Thanks for any feedback! Btw: Solaris syslogd logs this way, including the facility/level information. -- "Sie haben neue Mails!" - Die GMX Toolbar informiert Sie beim Surfen! Jetzt aktivieren unter http://www.gmx.net/info

3 3

program destination driver and template option
by Jim Mozley 28 Apr '04

28 Apr '04

I'm using syslog-ng 1.6.2 which I believe from the changelog supports the template option for the program driver. When I comment/uncomment the line from the config file below the destination will work with the template options commented out, but not with them uncommented. destination d_add_message { program("/path/to/my/test.pl" #template("$HOST $MESSAGE") template_escape(no) ); }; No parse errors are reported when syslog-ng starts. I have googled for examples of correct usage (although I cannot get through to the faq site at present) and cannot see anything wrong with the above, although I assume the problem is with the conf file definition. Jim Mozley

1 0