- syslog-ng - lists.balabit.hu

Re: [syslog-ng]SIGXXX logrotate patch suggestion.
by Ted_Rule＠flextech.co.uk 04 Nov '02

04 Nov '02

Many many thanks, Balazs. Ted ************************************************************************************************ ************************************************************************************************ WATCH THE LATEST SERIES OF WILL AND GRACE EVERY WEDNESDAY AT 8PM, FROM NOVEMBER 13TH ONLY ON LIVING TV - RESPONSIBLE OWNERS OF WILL AND GRACE. ************************************************************************************************ ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

SIGXXX logrotate patch suggestion.
by Ted_Rule＠flextech.co.uk 04 Nov '02

04 Nov '02

This is allied to my previous request a few weeks ago that syslog-ng doesn't close and re-open listener sockets across a SIGHUP/reconfigure - all in a desire to drop as few messages as possible across the overnight log rotation. How's about another variation on the same theme, namely to provide a separate signal for rotating logs, in a similar manner to Squid which has separate signals for daemon reconfiguration and log rotation. The action of the new signal would merely be to close all existing output descriptors, and re-open them with the same parameters. This would allow overnight logrotate commands to rename logs before SIGXXX'ing syslog-ng and thus achieve log rotation without requiring listener's are closed/re-opened across the logrotate. Whether or not this is particulary easy given the current layout of the output file objects, I'm afraid I don't know, but it feels to me as though this might be easier to code than the reworking of SIGHUP to preserve listeners across a reconfigure. Any takers? Ted ************************************************************************************************ ************************************************************************************************ WATCH THE LATEST SERIES OF WILL AND GRACE EVERY WEDNESDAY AT 8PM, FROM NOVEMBER 13TH ONLY ON LIVING TV - RESPONSIBLE OWNERS OF WILL AND GRACE. ************************************************************************************************ ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

2 1

Re: [syslog-ng]compile problem HAVE_RES_INIT
by BONIKOWSKE, SCOTT 31 Oct '02

31 Oct '02

--- Received from WPS.SBONIKOW (608) 226-2630 10-31-02 953a If I remember correctly, doesn't libol installation still require an ldconfig after it is installed? Thanks Scott ****************************************************************************** From: xyf(a)nixnotes.org To: syslog-ng(a)lists.balabit.hu Date: Thu, 31 Oct 2002 08:47:15 -0600 Subject: Re: [syslog-ng]compile problem HAVE_RES_INIT On Thu, Oct 31, 2002 at 09:36:23AM -0500, Hamilton, Andrew wrote: > All these includes are part of the libol package. For some reason it is not > finding them. OK even though I installed libol-0.3.5 ./configure couldn't seem to find it so I ran "./configure --with-libol=/path/to/libol" and everything is happy:) Thanks so much for your help. kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ---- 10-31-02 953a ---- Sent to --------------------------------------- -> syslog-ng(a)lists.balabit.hu -> xyf(a)nixnotes.org

1 0

RE: [syslog-ng]compile problem HAVE_RES_INIT
by Hamilton, Andrew 31 Oct '02

31 Oct '02

All these includes are part of the libol package. For some reason it is not finding them. -----Original Message----- From: ktb [mailto:xyf@nixnotes.org] Sent: Thursday, October 31, 2002 9:28 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]compile problem HAVE_RES_INIT On Thu, Oct 31, 2002 at 09:04:58AM -0500, Hamilton, Andrew wrote: > Try this: > > FWIW the following patch seems to have fixed it: > > --- syslog-ng-1.5.23/acconfig.h.orig Wed Apr 3 12:37:02 2002 > +++ syslog-ng-1.5.23/acconfig.h Tue Oct 29 17:00:12 2002 > @@ -40,4 +40,5 @@ > #undef PATH_SYSCONFDIR > > #undef ENABLE_TCP_WRAPPER > - > \ No newline at end of file > + > +#undef HAVE_RES_INIT > > Drew I'm not a programmer so wasn't completely sure how to implement this but assumed the "-" meant to take those lines out of acconfig.h and the "+" meant to add "#undef HAVE_RES_INIT" to the file in question. I ended up with the errors below - make[3]: Entering directory `/usr/local/src/syslog-ng-1.5.23/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.23/src -I. -g -O2 -Wall -D_G NU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33: list.h: No such file or directory main.c:29: format.h: No such file or directory main.c:30: werror.h: No such file or directory main.c:31: queue.h: No such file or directory main.c:32: pkt_buffer.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make: *** [all-recursive] Error 1 Thanks for the quick respons:) kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]compile problem HAVE_RES_INIT
by Hamilton, Andrew 31 Oct '02

31 Oct '02

Ok. Where is libol? Did you install it or tell it where it is? -----Original Message----- From: ktb [mailto:xyf@nixnotes.org] Sent: Thursday, October 31, 2002 9:35 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]compile problem HAVE_RES_INIT On Thu, Oct 31, 2002 at 09:33:38AM -0500, Hamilton, Andrew wrote: > After the patch did you rerun configure? > Ya, I did a "make clean && ./configure && make" kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]compile problem HAVE_RES_INIT
by Hamilton, Andrew 31 Oct '02

31 Oct '02

After the patch did you rerun configure? -----Original Message----- From: ktb [mailto:xyf@nixnotes.org] Sent: Thursday, October 31, 2002 9:28 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]compile problem HAVE_RES_INIT On Thu, Oct 31, 2002 at 09:04:58AM -0500, Hamilton, Andrew wrote: > Try this: > > FWIW the following patch seems to have fixed it: > > --- syslog-ng-1.5.23/acconfig.h.orig Wed Apr 3 12:37:02 2002 > +++ syslog-ng-1.5.23/acconfig.h Tue Oct 29 17:00:12 2002 > @@ -40,4 +40,5 @@ > #undef PATH_SYSCONFDIR > > #undef ENABLE_TCP_WRAPPER > - > \ No newline at end of file > + > +#undef HAVE_RES_INIT > > Drew I'm not a programmer so wasn't completely sure how to implement this but assumed the "-" meant to take those lines out of acconfig.h and the "+" meant to add "#undef HAVE_RES_INIT" to the file in question. I ended up with the errors below - make[3]: Entering directory `/usr/local/src/syslog-ng-1.5.23/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.23/src -I. -g -O2 -Wall -D_G NU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33: list.h: No such file or directory main.c:29: format.h: No such file or directory main.c:30: werror.h: No such file or directory main.c:31: queue.h: No such file or directory main.c:32: pkt_buffer.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make: *** [all-recursive] Error 1 Thanks for the quick respons:) kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]compile problem HAVE_RES_INIT
by Hamilton, Andrew 31 Oct '02

31 Oct '02

Try this: FWIW the following patch seems to have fixed it: --- syslog-ng-1.5.23/acconfig.h.orig Wed Apr 3 12:37:02 2002 +++ syslog-ng-1.5.23/acconfig.h Tue Oct 29 17:00:12 2002 @@ -40,4 +40,5 @@ #undef PATH_SYSCONFDIR #undef ENABLE_TCP_WRAPPER - \ No newline at end of file + +#undef HAVE_RES_INIT Drew -----Original Message----- From: ktb [mailto:xyf@nixnotes.org] Sent: Thursday, October 31, 2002 8:57 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]compile problem HAVE_RES_INIT I'm trying to compile syslog-ng-1.5.23 on a RedHat 6.0 machine. When I run "make" I get the following error - make[1]: Entering directory `/usr/local/src/syslog-ng-1.5.23/src' cd /usr/local/src/syslog-ng-1.5.23 && autoheader /usr/bin/autoheader: Symbol `HAVE_RES_INIT' is not covered by /usr/share/autoconf/acconfig.h ./acconfig.h make[1]: *** [/usr/local/src/syslog-ng-1.5.23/src/stamp-h.in] Error 1 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make: *** [all-recursive] Error 1 Anyone know how I can get around this error? Thanks, kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

compile problem HAVE_RES_INIT
by ktb 31 Oct '02

31 Oct '02

I'm trying to compile syslog-ng-1.5.23 on a RedHat 6.0 machine. When I run "make" I get the following error - make[1]: Entering directory `/usr/local/src/syslog-ng-1.5.23/src' cd /usr/local/src/syslog-ng-1.5.23 && autoheader /usr/bin/autoheader: Symbol `HAVE_RES_INIT' is not covered by /usr/share/autoconf/acconfig.h ./acconfig.h make[1]: *** [/usr/local/src/syslog-ng-1.5.23/src/stamp-h.in] Error 1 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make: *** [all-recursive] Error 1 Anyone know how I can get around this error? Thanks, kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation)

1 0

Re: [syslog-ng]Syslog forwarding - PIXos...
by Ted_Rule＠flextech.co.uk 31 Oct '02

31 Oct '02

If you're playing with PIXies... please beware all my previous findings on this mailing list regarding the current stupidity of PIXos syslog implementation... Namely a 256 byte message limit, a total lack of properly defined message boundaries on PIX syslog over TCP, and Cisco's complete unwillingness to fix such glaring oversights. Ted *********************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. *************************************************************************************************

1 0

RE: [syslog-ng]Syslog forwarding
by Hamilton, Andrew 31 Oct '02

31 Oct '02

Fernando, I did the very same thing you are doing for several years. syslog-ng is perfect for that in that it will allow you to configure both ways. It will spoof the name or it will leave the name. By setting various options you can get a combination of the two even. Look at keep_hostname(yes) this tells syslog-ng to keep the hostname it got from the message, use_fqdn(yes), fqdn is important if you have multiple domains with the same hostname in different domains such as ns1. Also chain_hostnames(no), syslog-ng will chain the hostnames together if you don't turn this off. For CiscoWorks you want to turn this off. Realize also that if you have a central loghost that is different from the CiscoWorks machine you must also run syslog-ng on that host as well. Regards, Drew -----Original Message----- From: Fernando Cardoso [mailto:fernando.cardoso@whatevernet.com] Sent: Wednesday, October 30, 2002 3:32 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Syslog forwarding Hi all I'm designing a solution where I need to forward syslog messages to 2 different servers (Cisco Works and a log correlation system). The messages will be sent from Cisco routers and PIXes to a box running syslog-ng that will forward the messages to the servers according to the facility and levels defined on filters. My question regards the origin of the messages as they will be seen by the end servers. Since both Cisco Works and the log correlation engine rely on the source IP to acknowledge and trigger alarms, will they see the syslog-ng box IP or the original IP address of the routers and PIXes? In other words will syslog-ng spoof the source IP addresses when forwarding the messages? Thanks in advance Fernando _____________________________________________________________________ INTERNET MAIL FOOTER A presente mensagem pode conter informação considerada confidencial. Se o receptor desta mensagem não for o destinatário indicado, fica expressamente proibido de copiar ou endereçar a mensagem a terceiros. Em tal situação, o receptor deverá destruir a presente mensagem e por gentileza informar o emissor de tal facto. --------------------------------------------------------------------- Privileged or confidential information may be contained in this message. If you are not the addressee indicated in this message, you may not copy or deliver this message to anyone. In such case, you should destroy this message and kindly notify the sender by reply email. --------------------------------------------------------------------- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1