- syslog-ng - lists.balabit.hu

RE: [syslog-ng]syslog-ng
by Hamilton, Andrew 14 Apr '03

14 Apr '03

See embedded remarks... Regards, Drew -----Original Message----- From: Hong Tian [mailto:htian@ias.edu] Sent: Friday, April 11, 2003 5:51 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng Hi, Our purpose is to set up a syslog-ng server to receive the log messages from other unix servers (linux and solaris) based on each hostname. I am setting syslog-ng 1.6 on Red Hat 7.3 for the first time. The compiling installation looks ok (./configure, make, and make install) on both libol-0.3.9 and syslog-ng-1.6.0rc1. After compiling I copied a starup script and a syslog-ng.conf as followings: # cp syslog-ng-1.6.0rc1/contrib/syslog-ng.conf.RedHat /etc/syslog-ng/syslog-ng.conf # cp syslog-ng-1.6.0rc1/contrib/init.d.RedHat-7.3 /etc/init.d/syslog-ng # /etc/init.d/syslog stop # /etc/init.d/syslog-ng start Starting syslog-ng: Cannot open configuration file /usr/local/etc/syslog-ng/syslog-ng.conf for reading Parse error reading configuration file, exiting. (line 1) [Failed] Only after I moved syslog-ng.conf to /usr/local/etc/syslog-ng, syslog-ng could start. # mv /etc/syslog-ng/syslog-ng.conf /usr/local/etc/syslog-ng # /etc/init.d/syslog-ng start Starting syslog-ng: [ OK ] (1) My question is why it forced me to use /usr/local/etc/syslog-ng instead of default location of /etc/syslog-ng/syslog-ng.conf? **** /usr/local/etc/syslog-ng is the default not /etc/syslog-ng, you can either **** modify this at compile time or start syslog-ng with the -f flag and point **** it to /etc/syslog-ng/syslog-ng.conf (2) After starting syslog-ng, I am trying to set up a basic config file to receive log messages from each Unix servers based on hostname. I am look for the good examples of a basic config file for my requirments. Could anyone provide some information? **** You can use a destination with a predfined macro called $HOST i.e. **** destination d_hosts { file("/var/log/hosts/$HOST.log"); }; (3) I think that I only need to install syslog-ng on the central log server. I don't need to install syslog-ng on every Unix servers, am I right? If I don't need to install syslog-ng on each syslog-ng client, should I do anything on each syslog-ng client? **** This is correct. You don't have to use syslog-ng on the clients. **** Unless you want to use something like tcp. Thanks, Hong _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

feature request - adding template functonality to program()
by email lists 13 Apr '03

13 Apr '03

Hi All, Such functionality already exists for pipe() and file() destination types so extending this to the program() destination type I imagine would not be too difficult nor time consuming. The following scenarios would benefit from this: - move logic to e-mail type notifications (and othe custom scripts) back into syslog-ng.conf - adds flexibility of formating sql statements and passing the sql statements directly into the database (having the near real time advantages of using pipe(), but having a reliability closer to a db buffer file as the process in not likely to die unexpectedly). tia, Darren Mackay

2 1

Syslog-ng 1.6.0rc2 specfile (20030412 snapshot)
by Jose Pedro Oliveira 12 Apr '03

12 Apr '03

Balazs Scheidler, The attached patch does the following: - creates two new files in the contrib directory * a logrotate file for Red Hat systems * a sysconfig file also for Red Hat systems - reorganizes the spec file - corrects the %post, %postun, and %preun scripts - pumps the libol version to 0.3.10 - creates an option for future inclusion of mysql related files (commented all the files containing references Requirements: Apply first the patch in this email (still not included in the latest snapshots) https://lists.balabit.hu/pipermail/syslog-ng/2003-April/004896.html Regards, jpo -- José Pedro Oliveira mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo diff -ruN syslog-ng-1.6.0rc2+20030412manual-original/contrib/syslog-ng.logrotate syslog-ng-1.6.0rc2+20030412manual-modified/contrib/syslog-ng.logrotate --- syslog-ng-1.6.0rc2+20030412manual-original/contrib/syslog-ng.logrotate Thu Jan 1 01:00:00 1970 +++ syslog-ng-1.6.0rc2+20030412manual-modified/contrib/syslog-ng.logrotate Tue Mar 18 20:51:55 2003 @@ -0,0 +1,6 @@ +/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron { + sharedscripts + postrotate + /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true + endscript +} diff -ruN syslog-ng-1.6.0rc2+20030412manual-original/contrib/syslog-ng.sysconfig syslog-ng-1.6.0rc2+20030412manual-modified/contrib/syslog-ng.sysconfig --- syslog-ng-1.6.0rc2+20030412manual-original/contrib/syslog-ng.sysconfig Thu Jan 1 01:00:00 1970 +++ syslog-ng-1.6.0rc2+20030412manual-modified/contrib/syslog-ng.sysconfig Tue Mar 18 21:42:33 2003 @@ -0,0 +1,15 @@ +#---------------------------------------------------------------------- +# Options +#---------------------------------------------------------------------- +# -C - <chroot-dir> +# -d - Set "debug mode". Prints out various messages to aid in +# debugging and stops it from becoming a daemon. To activate +# debugging in the yacc parser, either use this option twice or +# combine with -v. +# -p - <filename> Write the current PID information to the specified +# file. +# -v - Enable verbose mode. Process will not become a daemon. Prints +# out fewer messages, compared to -d. +# -V - Print the version number. +#---------------------------------------------------------------------- +SYSLOGNG_OPTIONS="" diff -ruN syslog-ng-1.6.0rc2+20030412manual-original/syslog-ng.spec.in syslog-ng-1.6.0rc2+20030412manual-modified/syslog-ng.spec.in --- syslog-ng-1.6.0rc2+20030412manual-original/syslog-ng.spec.in Thu Apr 10 11:51:00 2003 +++ syslog-ng-1.6.0rc2+20030412manual-modified/syslog-ng.spec.in Sat Apr 12 18:40:15 2003 @@ -1,44 +1,31 @@ -#-------------------------------------------------------------------------------- -# Program: syslog-ng.spec -# -# Purpose: This is the data file user to genertae RPM files so that we can -# distrbute 'canned' versions of what we have done more easily. -#-------------------------------------------------------------------------------- -# 08-Dec-02 - REP - Initial version - -#-------------------------------------------------------------------------------- -# Some basic definitions for use to use later in the file. We really only want -# to define things once, and have to change things in only one place. -#-------------------------------------------------------------------------------- -%define name syslog-ng -%define version @VERSION@ -%define release 1 -%define libver 0.3.9 -%define mandir /usr/share/man -%define sbindir /sbin - -#-------------------------------------------------------------------------------- -# Basic package information -#-------------------------------------------------------------------------------- +%define libver 0.3.10 +%define sbindir /sbin + +%define con_mysql 0 + +# Overriding default with --define: +# rpm -ba --define 'with_mysql 1' +%{?with_mysql:%define con_mysql 1} + + Summary: Syslog replacement daemon -Name: %{name} -Version: %{version} -Release: %{release} -Group: System/Kernel and hardware +Name: syslog-ng +Version: @VERSION@ +Release: 1 +Group: System Environment/Daemons License: GPL Url: http://www.balabit.com/products/syslog_ng/ -Source0: %{name}-%{version}.tar.gz -Source1: syslog-ng.conf -Source2: syslog-ng.init -Source3: mysql-syslog.pipe -Source4: mysql-syslog.buffer -Source5: syslog-ng.sysconfig -Requires: libol >= %{libver} -Buildroot: %{_tmppath}/%{name}-buildroot - -#-------------------------------------------------------------------------------- -# Description of the package -#-------------------------------------------------------------------------------- +Source: http://www.balabit.hu/downloads/syslog-ng/1.6/%{name}-%{version}.tar.gz +#Source1: mysql-syslog.pipe +#Source2: mysql-syslog.buffer +Buildroot: %{_tmppath}/%{name}-%{version}-buildroot +BuildRequires: libol-devel >= %{libver} +BuildRequires: tcp_wrappers +Requires(post,preun): chkconfig +Requires(postun,preun): initscripts +Conflicts: sysklogd + + %description syslog-ng, as the name shows, is a syslogd replacement, but with new functionality for the new generation. The original syslogd allows @@ -48,95 +35,88 @@ Forwarding logs over TCP and remembering all forwarding hops makes it ideal for firewalled environments. -#-------------------------------------------------------------------------------- -# What things to do in preperation of making the package -#-------------------------------------------------------------------------------- %prep -%setup +%setup -q -#-------------------------------------------------------------------------------- -# The build process for the package -#-------------------------------------------------------------------------------- %build - -#-------------------------------------------------------------------------------- -# Configuration process for the package -#-------------------------------------------------------------------------------- -%configure --prefix=%{_prefix} \ - --sbindir=%{sbindir} \ - --sysconfdir=%{_sysconfdir} \ - --mandir=%{mandir} \ +%configure --sbindir=%{sbindir} \ --enable-tcp-wrapper make -#-------------------------------------------------------------------------------- -# The install process for the package -#-------------------------------------------------------------------------------- %install -[ -n "%{buildroot}" -a "%{buildroot}" != / ] && rm -rf %{buildroot} -mkdir -p %{buildroot}%{_initrddir} -mkdir -p %{buildroot}%{_sysconfdir}/%{name} -mkdir -p %{buildroot}/etc/sysconfig - -make DESTDIR=%{buildroot} mandir=%{_mandir} install-strip - -install -m644 %{SOURCE1} %{buildroot}%{_sysconfdir}/%{name}/syslog-ng.conf -install -m755 %{SOURCE2} %{buildroot}%{_initrddir}/syslog-ng -install -m700 %{SOURCE3} %{buildroot}%{_sysconfdir}/%{name}/mysql-syslog.pipe -install -m700 %{SOURCE4} %{buildroot}%{_sysconfdir}/%{name}/mysql-syslog.buffer -install -m700 %{SOURCE5} %{buildroot}/etc/sysconfig/syslog-ng - -#-------------------------------------------------------------------------------- -# Things to run after it has been installed. We will be adding syslog-ng to the -# startup, and shutting down the old syslog -#-------------------------------------------------------------------------------- +rm -rf ${RPM_BUILD_ROOT} + +#make DESTDIR=%{RPM_BUILD_ROOT} mandir=%{_mandir} install-strip +%makeinstall sbindir=$RPM_BUILD_ROOT%{sbindir} +# +# Problem: the binary RPM is being assembled with an unstripped +# version of syslog-ng. +# Solution: strip file manually. +# +strip $RPM_BUILD_ROOT%{sbindir}/%{name} + +install -d $RPM_BUILD_ROOT%{_initrddir} +install -d $RPM_BUILD_ROOT%{_sysconfdir}/%{name} +install -d $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig +install -d $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d + +install -m755 contrib/init.d.RedHat-7.3 $RPM_BUILD_ROOT%{_initrddir}/syslog-ng +install -m644 contrib/syslog-ng.conf.RedHat $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/syslog-ng.conf +install -m644 contrib/syslog-ng.sysconfig $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/syslog-ng +install -m644 contrib/syslog-ng.logrotate $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/syslog-ng +%if %{con_mysql} +#install -m700 %{SOURCE1} $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/mysql-syslog.pipe +#install -m700 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/mysql-syslog.buffer +%endif + + %post +# rpm {-i|-U|-F} /sbin/chkconfig --add syslog-ng -/sbin/chkconfig --del syslog -sed -e "s/syslogd/syslog-ng/g" /etc/logrotate.d/syslog > /tmp/syslog-ng.tmp.$$ -cp -f /tmp/syslog-ng.tmp.$$ /etc/logrotate.d/syslog -rm -f /tmp/syslog-ng.tmp.$$ - -#-------------------------------------------------------------------------------- -# Well, if we uninstall, then we need to put some syslog in place to run for -# this system. -#-------------------------------------------------------------------------------- + %preun -/sbin/chkconfig --del syslog-ng -/sbin/chkconfig --add syslog -sed -e "s/syslog-ng/syslogd/g" /etc/logrotate.d/syslog > /tmp/syslog-ng.tmp.$$ -cp -f /tmp/syslog-ng.tmp.$$ /etc/logrotate.d/syslog -rm -f /tmp/syslog-ng.tmp.$$ - -#-------------------------------------------------------------------------------- -# What files and permissions are included in the package -#-------------------------------------------------------------------------------- +# only rpm -e (not rpm {-U|-F}) +if [ $1 = 0 ]; then + /sbin/service syslog-ng stop > /dev/null 2>&1 + /sbin/chkconfig --del syslog-ng +fi + +%postun +# only rpm {-U|-F} (not rpm -e) +if [ $1 = 1 ]; then + /sbin/service syslog-ng condrestart > /dev/null 2>&1 +fi + + %files %defattr(-,root,root) %doc AUTHORS COPYING README ChangeLog INSTALL NEWS PORTS -%doc doc/sgml/syslog-ng.txt +%doc doc/sgml/syslog-ng.txt doc/sgml/syslog-ng.ps %doc doc/*.demo doc/*.sample doc/*.solaris -%config(noreplace) %{_sysconfdir}/%{name}/syslog-ng.conf -%config(noreplace) %{_sysconfdir}/%{name}/mysql-syslog.pipe -%config(noreplace) %{_sysconfdir}/%{name}/mysql-syslog.buffer +%doc contrib/syslog2ng doc/stresstest.sh %config(noreplace) %{_initrddir}/syslog-ng -%config(noreplace) /etc/sysconfig/syslog-ng +%config(noreplace) %{_sysconfdir}/%{name}/syslog-ng.conf +%config(noreplace) %{_sysconfdir}/sysconfig/syslog-ng +%config(noreplace) %{_sysconfdir}/logrotate.d/syslog-ng +%if %{con_mysql} +#%config(noreplace) %{_sysconfdir}/%{name}/mysql-syslog.pipe +#%config(noreplace) %{_sysconfdir}/%{name}/mysql-syslog.buffer +%endif %{sbindir}/syslog-ng -%{_mandir}/man5/syslog-ng.conf.5* -%{_mandir}/man8/syslog-ng.8* +%{_mandir}/man5/* +%{_mandir}/man8/* + -#-------------------------------------------------------------------------------- -# What final cleanup should occur after the package construction has been -# completed -#-------------------------------------------------------------------------------- %clean -[ -n "%{buildroot}" -a "%{buildroot}" != / ] && rm -rf %{buildroot} -rm -r $RPM_BUILD_DIR/%{name}-%{version} +rm -rf ${RPM_BUILD_ROOT} + -#-------------------------------------------------------------------------------- -# Changelog -#-------------------------------------------------------------------------------- %changelog +* Sat Apr 12 2003 Jose Pedro Oliveira <jpo(a)di.uminho.pt> 1.6.0rc2 snapshot + - Reorganized specfile + - Corrected the scripts (%post, %postun, and %preun) + - Commented the mysql related lines; create an option for future inclusion + * Thu Feb 27 2003 Richard E. Perlotto II <richard(a)perlotto.com> 1.6.0rc1-1 - Updated for new version

2 1

Losing 25% of messages using UDP
by Bill Graham 12 Apr '03

12 Apr '03

I have syslog-ng-1.6.0rc1 compiled on Solaris 9 and I am intend to use the system as a central log server and I need to log every message that makes it to the system. I am testing it out with Kiwi Syslog Message generator with bursts of 100 messages every 10 seconds. Syslog-ng is only logging about 20-25% of the messages. I have verified that the messages are getting to the system. Is there some additional tuning that I have to do to get this to work. Here is a copy of my syslog-ng: options { use_fqdn(yes); keep_hostname(yes); use_dns(no); long_hostnames(off); sync(0); gc_idle_threshold(5000); gc_busy_threshold(1000); log_fifo_size(10240); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source network { udp();}; destination all { file("/var/log/messages"); }; log { source(local); destination(all); }; log { source(network); destination(all); }; Thanks, Bill

4 11

syslog-ng
by Hong Tian 11 Apr '03

11 Apr '03

Hi, Our purpose is to set up a syslog-ng server to receive the log messages from other unix servers (linux and solaris) based on each hostname. I am setting syslog-ng 1.6 on Red Hat 7.3 for the first time. The compiling installation looks ok (./configure, make, and make install) on both libol-0.3.9 and syslog-ng-1.6.0rc1. After compiling I copied a starup script and a syslog-ng.conf as followings: # cp syslog-ng-1.6.0rc1/contrib/syslog-ng.conf.RedHat /etc/syslog-ng/syslog-ng.conf # cp syslog-ng-1.6.0rc1/contrib/init.d.RedHat-7.3 /etc/init.d/syslog-ng # /etc/init.d/syslog stop # /etc/init.d/syslog-ng start Starting syslog-ng: Cannot open configuration file /usr/local/etc/syslog-ng/syslog-ng.conf for reading Parse error reading configuration file, exiting. (line 1) [Failed] Only after I moved syslog-ng.conf to /usr/local/etc/syslog-ng, syslog-ng could start. # mv /etc/syslog-ng/syslog-ng.conf /usr/local/etc/syslog-ng # /etc/init.d/syslog-ng start Starting syslog-ng: [ OK ] (1) My question is why it forced me to use /usr/local/etc/syslog-ng instead of default location of /etc/syslog-ng/syslog-ng.conf? (2) After starting syslog-ng, I am trying to set up a basic config file to receive log messages from each Unix servers based on hostname. I am look for the good examples of a basic config file for my requirments. Could anyone provide some information? (3) I think that I only need to install syslog-ng on the central log server. I don't need to install syslog-ng on every Unix servers, am I right? If I don't need to install syslog-ng on each syslog-ng client, should I do anything on each syslog-ng client? Thanks, Hong

1 0

snapshots of 1.6.0rc2 available
by Balazs Scheidler 11 Apr '03

11 Apr '03

Hi, Although not officially released, I have uploaded a test version of 1.6.0rc2 to our website: http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshots/syslog-ng-1.6.… The accompanying libol snapshot is also available. This release should fix the configure problems in 1.6.0rc1 and also adds performance improvements with the gperf based macro name resolution. If no problems are reported within a day or two I'll release syslog-ng 1.6.0rc2 officially. -- Bazsi

3 11

logrotate question (not working with syslog-ng)...
by seberino＠spawar.navy.mil 11 Apr '03

11 Apr '03

For some reason every time logrotate rotates /var/log/messages, my syslog-ng stops working. The permissions look ok.. [office root /var/log] # ls -l mess* -rw------- 1 root root 0 Apr 6 04:02 messages -rw------- 1 root root 378135 Apr 7 15:15 messages.1 -rw------- 1 root root 908864 Mar 31 15:50 messages.2 -rw------- 1 root root 1795514 Mar 25 14:06 messages.3 -rw------- 1 root root 945373 Mar 19 11:31 messages.4 -rw------- 1 root root 7 Apr 7 14:24 messages.offset Why does logrotate cause syslog-ng to not put any new stuff in /var/log/messages? Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

7 21

syslog-ng 1.6.0rc1 a bit erratic at kernel logs
by Jason Haar 11 Apr '03

11 Apr '03

Hi there We've got a central syslog-ng server here with incoming feeds from old syslog clients (HPUX,Cisco,printers,etc) as well as TCP-based feeds from syslog-ng clients. In general it all works well. However, there seems to be a problem with kernel messages on the localhost. The fact that they are processname=kernel appears to be lost on syslog-ng - instead of seeing: server kern info kernel: device eth0 left promiscuous mode I see server kern info device eth0 left promiscuous mode This is with a template of: template("$R_ISODATE $HOST $FACILITY $PRIORITY $MSG\n") As it only seems to affect kernel messages on syslog-ng hosts, I think it's more of a generation problem than a receiving problem. On all the hosts affected, then source entry is: source s_local { internal(); unix-stream("/dev/log" keep-alive(yes) max-connections(100)); pipe("/proc/kmsg"); unix-stream("/var/spool/mysqld/dev/log" keep-alive(yes) max-con nections(10)); unix-stream("/var/log/snort/dev/log" keep-alive(yes) max-connect ions(10)); tcp(ip("1.2.3.4") port(514) keep-alive(yes) max-connections( 100)); tcp(ip("127.0.0.1") port(514) keep-alive(yes) max-connections(1 00)); udp(); }; Any ideas what's wrong/bug? Thanks for a great product! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 2

Syslog-ng conf file options not working!!!!
by TIM MOORE 10 Apr '03

10 Apr '03

Thanks for the help. The syntax for the second option worked. I just have to wait to see if it will work correctly. Thanks, Tim Moore DNS/Linux/Cisco Admin ODJFS

1 0

Re: [syslog-ng]logrotate question (not working with syslog-ng)...
by Ted_Rule＠flextech.co.uk 10 Apr '03

10 Apr '03

It's perfectly possible to use logrotate on RedHat with syslog-ng... here's my logrotate.conf stripped of irrelevant detail: $ cat /etc/logrotate.d/syslog-ng /var/log/secure { } /var/log/maillog { } /var/log/spooler { } ........ /var/log/messages { ....... postrotate /etc/rc.d/init.d/syslog-ng reconfig ....... endscript } $ And the corresponding tweaks to init script to allow for a reconfig option, plus some extra features relating preventing syslog-ng restart when the config is broken, emulating klogd, and handling syslog-ng startup prior to named an ipchains only central logging server with dns hostname lookup enabled.. $ cat /etc/rc.d/init.d/syslog-ng #!/bin/sh # # syslog-ng Starts syslog-ng # # chkconfig: 2345 30 99 # description: Syslog-ng is the facility by which many daemons use to log \ # messages to various system log files. It is a good idea to always \ # run syslog-ng. ################################################################################ # Source function library. if [ -d /etc/init.d ]; then . /etc/init.d/functions else . /etc/rc.d/init.d/functions fi . /etc/sysconfig/network if [ ${NETWORKING} = "no" ] then exit 0 fi # General security measures.. umask 077 ulimit -c 0 INIT_PROG="/usr/local/sbin/syslog-ng" # Full path to daemon INIT_CONF="/etc/syslog-ng/syslog-ng.conf" # Full path to config INIT_OPTS="" PRINTKLEVEL=2 # Get per-service config overrides if [ -f /etc/sysconfig/syslog-ng ]; then . /etc/sysconfig/syslog-ng fi [ -x $INIT_PROG ] || exit 1 [ -s $INIT_CONF ] || exit 1 INIT_NAME=`basename "$INIT_PROG"` # Correct the setting of raw printk kernel logging to mimic klogd behaviour printkset() { currentprintk=`awk '{print $1}' /proc/sys/kernel/printk` if [ ${PRINTKLEVEL} -ne ${currentprintk} ]; then action "Setting kernel console default printk to ${PRINTKLEVEL}" dmesg -n ${PRINTKLEVEL} fi } validconfig() { $INIT_PROG -s -f $INIT_CONF RETVAL=$? echo -n "Syslog-ng configuration check" [ $RETVAL -ne 0 ] && failure "Syslog-ng configuration check" && echo && exit 1 [ $RETVAL -eq 0 ] && success "Syslog-ng configuration check" && echo } findsyslogchain () { rulenum=`ipchains -L input --line-numbers | awk '{print $1,$2,$3,$5,$9}' | grep "DENY udp anywhere syslog" | awk '{print $1}' | sort -rn` if [ "$rulenum" = "" ]; then rulenum=0 fi #Chain input (policy ACCEPT): #num target prot opt source destination ports #1 DENY udp ------ anywhere anywhere any -> syslog } isdnsrunning () { if [ -n "`/sbin/pidof named`" ]; then dnsrunning=1 else dnsrunning=0 fi } RETVAL=0 # See how we were called. case "$1" in start) validconfig printkset isdnsrunning [ $dnsrunning -ne 1 ] && $0 local echo -n "Starting $INIT_NAME: " daemon --check $INIT_PROG "$INIT_PROG -f $INIT_CONF $INIT_OPTS" RETVAL=$? echo [ $dnsrunning -eq 1 ] && $0 remote [ $RETVAL -eq 0 ] && touch "/var/lock/subsys/${INIT_NAME}" # Warn sendmail that syslog has restarted /etc/rc.d/init.d/sendmail reconfig ;; stop) echo -n "Shutting down $INIT_NAME: " killproc $INIT_PROG RETVAL=$? echo [ $RETVAL -eq 0 ] && rm -f "/var/lock/subsys/${INIT_NAME}" ;; status) status $INIT_PROG #status klogd RETVAL=$? ;; reconfig) validconfig printkset isdnsrunning [ $dnsrunning -ne 1 ] && $0 local echo -n "Re-HUPing $INIT_NAME daemon" killproc $INIT_PROG -HUP RETVAL=$? echo [ $dnsrunning -eq 1 ] && $0 remote ;; restart|reload) $0 stop $0 start RETVAL=$? ;; local) findsyslogchain if [ "$rulenum" = "0" ]; then action "Disabling remote syslogging" ipchains -I input 1 -i eth+ --proto udp --dport syslog -j DENY RETVAL=$? fi ;; remote) findsyslogchain if [ "$rulenum" != "0" ]; then for rule in `echo $rulenum` do action "Enabling remote syslogging - remove ipchains rule $rule" ipchains -D input ${rule} RETVAL=$? done fi ;; validate) validconfig ;; printkset) printkset RETVAL=$? ;; *) echo "Usage: syslog {start|stop|status|reconfig|restartlocal|remote|validate|printkset}" exit 1 esac exit $RETVAL $ ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0