- syslog-ng - lists.balabit.hu

Ayuda....
by rlobo 28 Jan '03

28 Jan '03

Buenos dias y disculpen la molestia... necesito la ayuda de ustedes, estoy compilando el syslog -ng version 1.5.23 y el php-syslog-ng-1.2, ya tengo montado los requerimientos para este paquete... El problema es que cuando hago un start al syslog-ng me refleja este erro en el archivo de configuracion del syslog-ng.conf unresolved reference: net Error initializing configuration, exiting. Nota: Ya probe colocando la mi red donde dice net, tambien coloque la ip de la maquina en donde estoy compilando el paquete... Si no soy muy explicativo por favor me lo dicen.... Muchas Gracias.... _/ _/ _/ _/ Richard J. Lobo U. _/ _/ _/ _/ _/ T.S.U. en Informatica _/ _/ _/ _/_/_/ Tecnico de Red. _/_/_/ _/_/_/ _/ _/ Facultad de Ciencias y Rectorado Merida - Venezuela Telf: +58-274-2402437 *** RedULA *** rlobo(a)ula.ve Celular 0414 - 7485627 ------------------------------------------------------------------

1 0

Re: syslog-ng misinterpreting messages from Enterasys Routers ( check_hostname )
by Ted_Rule＠flextech.co.uk 27 Jan '03

27 Jan '03

Thanks for the tip, Bazsi.... A new niggling comments, I'm afraid... check_hostname has been available since July 2002, but the only reference to it in the tar.gz is in the Changelog. There's no corresponding reference in the documentation trees, nor the FAQ. The same is true of bad_hostname of course, but that only been available recently. The code loop which performs the check_hostname check seems to contain a redundant colon check... We have: while ( ..... && *src != ':' ... ) { if ( .... || *src == ':' || ... ) {{_hostname The if clause is never true since the while test precludes it.... In effect the check_hostname option is performing hostname matches /^[A-Za-z0-9-_@:/]+$/ I can see why the "/" is needed to guard against declaring a chained-hostname as bad, but I can't quite see the logic behind the '@' inclusion. Could someone explain, please? Since my initial configuration errored on my Enterasys routers, ( effectively because the "hostname" field terminated in a "," instead of ":" or "[" ) the check_hostname() option obviously defaults to "no". Given how few good hostnames don't match /^[A-Za-z0-9-_@:/]+$/, it might be worthwhile making check_hostname() default to 'yes', or at least heavily recommending enabling the check in the FAQ. I'm guessing the check_hostname() option is a global only.. Under really odd circs, I guess some people might want it as a per-source option as well? so that a global yes can be overridden on some sources. Given that 1.5.25 now has a bad_hostname() option, how's about future releases having a good_hostname() option so that check_hostname(yes) === good_hostname( "^[A-Za-z0-9-_@:/]+$"). A hostname match then only succeeds if it passes both the good_hostname() and bad_hostname() checks, and moving the character set match for check_hostname() out to the configuration file would allow for more accurate site-specific hostname checking. Ted ............ check_hostname code loop in src/log.c /* It's a regular ol' message. */ else { /* If we haven't already found the original hostname, look for it now. */ char hostname_buf[256]; int dst; oldsrc = src; oldleft = left; dst = 0; while (left && *src != ' ' && *src != ':' && *src != '[' && dst < sizeof(hostname_buf) - 1) { if (lm->flags & LF_CHECK_HOSTNAME && !((*src >= 'A' && *src <= 'Z') || (*src >= 'a' && *src <= 'z') || (*src >= '0' && *src <= '9') || *src == '-' || *src == '_' || *src == '.' || *src == ':' || *src == '@' || *src == '/')) { break; } hostname_buf[dst++] = *src; src++; left--; } ............... =================================================================== On Thu, Jan 23, 2003 at 11:21:24AM +0000, Ted_Rule(a)flextech.co.uk wrote: > > > Having finally bitten the bullet and installed syslog-ng ( libol-0.3.6 / > syslog-ng-1.5.24 ), > I've only come across one problem... syslog messages from our Enterasys Routers > are being > corrupted. All Unix and Cisco messages appear Ok. > [snip] > > I note the version 1.5.25 has a bad_hostname() option. Is it possible that this > may be used to alleviate this issue, or is some other workround > needed? I'm guessing "keep_hostname(no)" might fix it, but would that > potentially lead to other problems? Is there a summary of the algorithm > which syslog-ng uses to determine whether the message contains a hostname? There are two ways to overcome your problem: 1) check_hostname() is a global option that disallows '%' in hostnames, turn it on in your global options() section 2) use bad_hostname() -- ================================================================= ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Re: [syslog-ng]syslog-ng 1.5.25 released
by Ted_Rule＠flextech.co.uk 27 Jan '03

27 Jan '03

From "Stevens'" great Unix Network Programming bible .... "Traditionally , System V has returned the error EAGAIN for a non-blocking I/O operation that cannot be satisfied while Berkeley-derived implementations have returned the error EWOULDBLOCK. To confuse things even more, Posix.1 specifies that EAGAIN is used while Posix.1g specifes that EWOULDBLOCK is used. Fortunately, most current systems ( including SysV and 4.4BSD ) define these two error codes to be the same ( check <sys/errno.h ), so it doesn't matter which one we use. In this text we use EWOULDBLOCK, as specified by Posix.1g" Dontcha just lurrv so many standards.... Ted Balazs Scheidler <bazsi(a)balabit.hu> on 24/01/2003 09:03:25 Please respond to syslog-ng(a)lists.balabit.hu To: syslog-ng(a)lists.balabit.hu cc: (bcc: Ted Rule/160GPS/Flextech/UK) Subject: Re: [syslog-ng]syslog-ng 1.5.25 released On Thu, Jan 23, 2003 at 07:12:53PM +0100, Roberto Nibali wrote: > >>Would you care to explain to me this fix, please? As I read it, it only > >>kicks in in case write(2) returns with a 0. But this 0 doesn't mean 0 > >>bytes have been written, but something else. I'm a bit confused. Keep in > >>mind that I haven't read your code all too well yet ;). > > > >check fd_write in libol/src/io.c, which handles EINTR and EAGAIN and > >returns 0 > >instead of -1 for those reasons. > > I see, thanks for the pointer (I'm surprised EWOULDBLOCK is portable > enough). Syslog-ng has been running on a couple of Unixes and nobody complained about EWOULDBLOCK. I think it is defined as EAGAIN on most platforms. > > Additional question: Have you or anyone else done any tests with O_SYNC or > mounting the log partition with noatime? I'm asking because I'm trying to > isolate a performance issue on a central loghost. O_SYNC would certainly increase your load. noatime could help though. Checking the output of vmstat (disk i/o, swap i/o, system and user cpu time spent) usually helps locating performance issues. > > >thanks for the report. > > I should also like to ask you about the status of the template() patch [1] > done by one of my team mates. He's not working on this project anymore and > I've taken over. If I get around to fix your concerns mentioned in [2], > would you still consider it for inclusion into 1.6.0? yes. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Re: [syslog-ng]logs getting stomped on
by Michael Rogan 27 Jan '03

27 Jan '03

Brian, This happened to me when I had the files on a filesystem that had a 2GB file size limit and I hit the 2GB limit. Michael -------------------------- Sent from my BlackBerry Wireless Handheld (www.BlackBerry.net) -----Original Message----- From: Brian Landers <packetslave(a)sapient.com> To: syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> Sent: Sun Jan 26 22:56:47 2003 Subject: [syslog-ng]logs getting stomped on I have 3 remote servers, logging to a central syslog-ng server over a reverse SSH tunnel, i.e the central server SSH's to the remote hosts, then opens a tunnel back. All servers are running 1.5.25 on Solaris 8. My problem is this, every night around 10 or 10:30pm, the log file gets overwritten, meaning it suddenly goes from starting at 00:00:01 to starting at 22:28:05 or whatever, and all the log entries prior to that are lost. There are no log rotation or other processes that would be causing this that I can find, syslog-ng appears to just mysteriously decide to start over at the begnning. Help! Relevant configs are below. --- central server --- options { time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); use_time_recvd(yes); }; source net { udp(); tcp( keep-alive(yes) ); }; destination inboundlog { file("/system/inbound_mail/logs/$YEAR-$MONTH-$DAY.log"); }; log { source(net); destination(inboundlog); }; --- remote server --- options { time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; destination loghost { tcp( "127.0.0.1" port(51400) ); }; log { source(local); destination(loghost); }; -- Brian Landers | packetslave(a)sapient.com Network System Exorcist | vox://404/439.4117 Sapient Information Technology | aim://Bluecoat93 CCNA, SCSA, EIEIO | yim://brian_landers "I know," said Harry. "We can all hang out. Go to the beach. Watch Malfoy not get tan." _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

logs getting stomped on
by Brian Landers 27 Jan '03

27 Jan '03

I have 3 remote servers, logging to a central syslog-ng server over a reverse SSH tunnel, i.e the central server SSH's to the remote hosts, then opens a tunnel back. All servers are running 1.5.25 on Solaris 8. My problem is this, every night around 10 or 10:30pm, the log file gets overwritten, meaning it suddenly goes from starting at 00:00:01 to starting at 22:28:05 or whatever, and all the log entries prior to that are lost. There are no log rotation or other processes that would be causing this that I can find, syslog-ng appears to just mysteriously decide to start over at the begnning. Help! Relevant configs are below. --- central server --- options { time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); use_time_recvd(yes); }; source net { udp(); tcp( keep-alive(yes) ); }; destination inboundlog { file("/system/inbound_mail/logs/$YEAR-$MONTH-$DAY.log"); }; log { source(net); destination(inboundlog); }; --- remote server --- options { time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; destination loghost { tcp( "127.0.0.1" port(51400) ); }; log { source(local); destination(loghost); }; -- Brian Landers | packetslave(a)sapient.com Network System Exorcist | vox://404/439.4117 Sapient Information Technology | aim://Bluecoat93 CCNA, SCSA, EIEIO | yim://brian_landers "I know," said Harry. "We can all hang out. Go to the beach. Watch Malfoy not get tan."

1 0

30��ַ100Ԫ��һ��
by tiffany＠ges.com.tw 27 Jan '03

27 Jan '03

��Ҫ��棬��㽫��Ҫ��Ĳ�Ʒ�Ͷ��ң��һ�Ϊ�㶨��Ҫ��ַ��۸�30��ַ100Ԫ��һ�ף�һ��ڽ��ҵ��usa123568(a)yaoweb.com >��ַ�Ա��ϵ��㲻��Ҫ��ҵĹ�棬�뷢�ʼ��û��usa123468 @ yaoweb.com��Ҫ�󳷳��ַ�� д�� >do you have products to sell in net ,please contact with me .i can find >300000 emailaddress for you only 10$ ,and i will sent it with a emailsendersoft to you,if you need please sent a mail to me ,my email: usa123568(a)yaoweb.com >if you want to remove your emailaddress pleses sent email to username:usa123468 its yaoweb.com and full in your emaiaddress on subject.then i will delete it

1 0

remove libol & syslog-ng after install
by Douglas, Stuart 24 Jan '03

24 Jan '03

Hello, I finally got a copy of the tarballs that would install (I did have to install flex to get syslog-ng to go). Of course I realized after doing ./configure, make, make install for both that I forgot to follow the rpm path instead by doing rpm -tb on both tarballs. I'd prefer to have the installation from the rpm packages, so how do I go about uninstalling my current setup? Should I even worry about it and just use what I've done? Thanks, Stuart

2 1

Program destination doesn't accept template. Bug?
by henriksa＠telia.com 24 Jan '03

24 Jan '03

Defining a template for a program destination causes a "Parse error reading configuration file". What's that all about? I'd like to send a short version of the log message to my mailscript that will fit nicely in the topic field. It would be a lot easier to be able to do this with syslog-ng that trying to regexp it in the script. I'm using version 1.5.23 of syslog-ng. /Henrik

1 0

RE: [syslog-ng]libol & syslog-ng tarballs error out
by Michael Breton 23 Jan '03

23 Jan '03

Try unpacking them this way: gunzip -c /path/to/libol-0.2.23.tar.gz | tar xvf - gunzip -c /path/to/syslog-ng-1.4.17.tar.gz | tar xvf - -----Original Message----- From: Douglas, Stuart [mailto:stuart.douglas@agt.com] Sent: Thursday, January 23, 2003 3:15 PM To: Syslog-Ng@Lists. Balabit. Hu (E-mail) Subject: [syslog-ng]libol & syslog-ng tarballs error out Hello, I'm running RH 7.3 and am not able to install from the tarballs. I've downloaded and attempted this several times, and the results are always the same. When I do a 'tar zxvf' on either file, they give the following: libol-0.2.23/ libol-0.2.23/src/ libol-0.2.23/src/gc.c libol-0.2.23/src/gc.h libol-0.2.23/src/io.c libol-0.2.23/src/io.h libol-0.2.23/src/list.h.x libol-0.2.23/src/xalloc.c libol-0.2.23/src/xalloc.h libol-0.2.23/src/jpoll.c libol-0.2.23/src/jpoll.h libol-0.2.23/src/read_line.c libol-0.2.23/src/read_line.h libol-0.2.23/src/resource.c libol-0.2.23/src/resource.h libol-0.2.23/src/werror.c tar: Skipping to next header tar: Archive contains obsolescent base-64 headers gzip: stdin: invalid compressed data--crc error gzip: stdin: invalid compressed data--length error tar: Child returned status 1 tar: Error exit delayed from previous errors ...and... syslog-ng-1.4.17/ syslog-ng-1.4.17/doc/ syslog-ng-1.4.17/doc/sgml/ syslog-ng-1.4.17/doc/sgml/syslog-ng.html.tar.gz syslog-ng-1.4.17/doc/sgml/syslog-ng.ps syslog-ng-1.4.17/doc/sgml/Makefile.am syslog-ng-1.4.17/doc/sgml/Makefile.in syslog-ng-1.4.17/doc/sgml/syslog-ng.dvi syslog-ng-1.4.17/doc/sgml/syslog-ng.txt syslog-ng-1.4.17/doc/sgml/syslog-ng.sgml syslog-ng-1.4.17/doc/syslog-ng.conf.sample syslog-ng-1.4.17/doc/syslog-ng.8 syslog-ng-1.4.17/doc/syslog-ng.conf.5 syslog-ng-1.4.17/doc/syslog-ng.old.txt syslog-ng-1.4.17/doc/syslog-ng.conf.solaris syslog-ng-1.4.17/doc/syslog-ng.conf.demo syslog-ng-1.4.17/doc/Makefile.am syslog-ng-1.4.17/doc/Makefile.in syslog-ng-1.4.17/doc/stresstest.sh syslog-ng-1.4.17/src/ syslog-ng-1.4.17/src/center.c syslog-ng-1.4.17/src/center.h syslog-ng-1.4.17/src/afunix.c syslog-ng-1.4.17/src/cfg-lex.c syslog-ng-1.4.17/src/cfg-lex.l syslog-ng-1.4.17/src/afuser.c syslog-ng-1.4.17/src/afuser.h syslog-ng-1.4.17/src/afprogram.c.x syslog-ng-1.4.17/src/afstreams.c.x syslog-ng-1.4.17/src/afinter.c syslog-ng-1.4.17/src/afinter.h syslog-ng-1.4.17/src/afsocket.c syslog-ng-1.4.17/src/afsocket.h syslog-ng-1.4.17/src/log.c syslog-ng-1.4.17/src/log.h syslog-ng-1.4.17/src/tests/ syslog-ng-1.4.17/src/tests/testall syslog-ng-1.4.17/src/tests/syslog-ng.conf.eval syslog-ng-1.4.17/src/tests/Makefile.am syslog-ng-1.4.17/src/tests/Makefile.in syslog-ng-1.4.17/src/tests/test.eval syslog-ng-1.4.17/src/syslog-ng.h syslog-ng-1.4.17/src/filters.c syslog-ng-1.4.17/src/filters.h syslog-ng-1.4.17/src/strcasecmp.c syslog-ng-1.4.17/src/filters.c.x syslog-ng-1.4.17/src/filters.h.x syslog-ng-1.4.17/src/afunix.c.x syslog-ng-1.4.17/src/afprogram.c syslog-ng-1.4.17/src/afprogram.h syslog-ng-1.4.17/src/log.h.x syslog-ng-1.4.17/src/cfg-grammar.c tar: Skipping to next header tar: Archive contains obsolescent base-64 headers gzip: stdin: invalid compressed data--crc error gzip: stdin: invalid compressed data--length error tar: Child returned status 1 tar: Error exit delayed from previous errors Are there any other sources for these than the balabit website? Anyone have any other ideas? Thanks, Stuart

1 0

libol & syslog-ng tarballs error out
by Douglas, Stuart 23 Jan '03

23 Jan '03

Hello, I'm running RH 7.3 and am not able to install from the tarballs. I've downloaded and attempted this several times, and the results are always the same. When I do a 'tar zxvf' on either file, they give the following: libol-0.2.23/ libol-0.2.23/src/ libol-0.2.23/src/gc.c libol-0.2.23/src/gc.h libol-0.2.23/src/io.c libol-0.2.23/src/io.h libol-0.2.23/src/list.h.x libol-0.2.23/src/xalloc.c libol-0.2.23/src/xalloc.h libol-0.2.23/src/jpoll.c libol-0.2.23/src/jpoll.h libol-0.2.23/src/read_line.c libol-0.2.23/src/read_line.h libol-0.2.23/src/resource.c libol-0.2.23/src/resource.h libol-0.2.23/src/werror.c tar: Skipping to next header tar: Archive contains obsolescent base-64 headers gzip: stdin: invalid compressed data--crc error gzip: stdin: invalid compressed data--length error tar: Child returned status 1 tar: Error exit delayed from previous errors ...and... syslog-ng-1.4.17/ syslog-ng-1.4.17/doc/ syslog-ng-1.4.17/doc/sgml/ syslog-ng-1.4.17/doc/sgml/syslog-ng.html.tar.gz syslog-ng-1.4.17/doc/sgml/syslog-ng.ps syslog-ng-1.4.17/doc/sgml/Makefile.am syslog-ng-1.4.17/doc/sgml/Makefile.in syslog-ng-1.4.17/doc/sgml/syslog-ng.dvi syslog-ng-1.4.17/doc/sgml/syslog-ng.txt syslog-ng-1.4.17/doc/sgml/syslog-ng.sgml syslog-ng-1.4.17/doc/syslog-ng.conf.sample syslog-ng-1.4.17/doc/syslog-ng.8 syslog-ng-1.4.17/doc/syslog-ng.conf.5 syslog-ng-1.4.17/doc/syslog-ng.old.txt syslog-ng-1.4.17/doc/syslog-ng.conf.solaris syslog-ng-1.4.17/doc/syslog-ng.conf.demo syslog-ng-1.4.17/doc/Makefile.am syslog-ng-1.4.17/doc/Makefile.in syslog-ng-1.4.17/doc/stresstest.sh syslog-ng-1.4.17/src/ syslog-ng-1.4.17/src/center.c syslog-ng-1.4.17/src/center.h syslog-ng-1.4.17/src/afunix.c syslog-ng-1.4.17/src/cfg-lex.c syslog-ng-1.4.17/src/cfg-lex.l syslog-ng-1.4.17/src/afuser.c syslog-ng-1.4.17/src/afuser.h syslog-ng-1.4.17/src/afprogram.c.x syslog-ng-1.4.17/src/afstreams.c.x syslog-ng-1.4.17/src/afinter.c syslog-ng-1.4.17/src/afinter.h syslog-ng-1.4.17/src/afsocket.c syslog-ng-1.4.17/src/afsocket.h syslog-ng-1.4.17/src/log.c syslog-ng-1.4.17/src/log.h syslog-ng-1.4.17/src/tests/ syslog-ng-1.4.17/src/tests/testall syslog-ng-1.4.17/src/tests/syslog-ng.conf.eval syslog-ng-1.4.17/src/tests/Makefile.am syslog-ng-1.4.17/src/tests/Makefile.in syslog-ng-1.4.17/src/tests/test.eval syslog-ng-1.4.17/src/syslog-ng.h syslog-ng-1.4.17/src/filters.c syslog-ng-1.4.17/src/filters.h syslog-ng-1.4.17/src/strcasecmp.c syslog-ng-1.4.17/src/filters.c.x syslog-ng-1.4.17/src/filters.h.x syslog-ng-1.4.17/src/afunix.c.x syslog-ng-1.4.17/src/afprogram.c syslog-ng-1.4.17/src/afprogram.h syslog-ng-1.4.17/src/log.h.x syslog-ng-1.4.17/src/cfg-grammar.c tar: Skipping to next header tar: Archive contains obsolescent base-64 headers gzip: stdin: invalid compressed data--crc error gzip: stdin: invalid compressed data--length error tar: Child returned status 1 tar: Error exit delayed from previous errors Are there any other sources for these than the balabit website? Anyone have any other ideas? Thanks, Stuart

1 0