- syslog-ng - lists.balabit.hu

(no subject)
by Grenier, Scott 1 - San Mateo, CA 19 Sep '02

19 Sep '02

Hiya- I'm setting up new syslog servers using syslog-ng in a mostly Solaris environment. Regular syslog logs messages from hosts with the actual hostname, but syslog-ng is logging the host's IP address instead. Not all machines are in DNS. Here's what I have: options { chain_hostnames(no); use_time_recvd(yes); log_fifo_size(1000); }; source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; destination d_hostlogs { file("/logs1/HOSTS/$HOST/capturedmessages.$HOST.$YEAR$MONTH$DAY" owner(root) group(sys) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(src); destination(d_hostlogs); }; Syslog-ng creates the files and dirs nicely. I just can't get the actual hostname like I used to when running regular ol' out-o'-the-box syslogd. I checked out the FAQ on Nate's site already (Nice job on the site and FAQ, Nate. It's been a very useful resource for me.). Many thanks. -->scottg

2 1

Unwanted logging
by BENGT OLSSON 17 Sep '02

17 Sep '02

Hi I get some unwanted loggin from strange hosts.... The syslog-ng.conf-file looks like; options { use_fqdn(yes); keep_hostname(yes); use_dns(yes); long_hostnames(off); sync(0); log_fifo_size(1000); }; source all { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; destination hosts { file("/var/syslog/hosts/$HOST/$FACILITY_$YEAR-$MONTH-$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(all) ; destination(hosts) ; }; An example of unwanted "hosts"-directory in the /var/syslog/hosts-directory; 0x0.0x5da74da 0x0.0x5dc3cea 0x0.0x5dc3d5a 0x0.0x5dc4077 0x0.0x5dca334 0x0.0x5dcea7a 0x0.0x637fb77 0x0.0x642bad8 0x0.0x64c5ea8 An example of correct hosts -directory in the /var/syslog/hosts-directory looks like this; trillian.student.bth.se trumma.bth.se viking.student.bth.se viola.bth.se violin.bth.se vogonjeltz.student.bth.se voyager.student.bth.se vroomfondel.student.bth.se zaphod.student.bth.se Is there some internal logging or what is it comming from? A minor problem is that i have the "long_hostnames" to off and still it loging whit long hostnames....any guess? Best Regards -- Bengt Olsson Blekinge Tekniska Högskola Datorenheten Campus Gräsvik Vallhallavägen 1 371 79 Karlskrona Mail: bol(a)bth.se Tel: 0455-385152 Mobil: 0708-787 780

3 2

RE: [syslog-ng]Unwanted logging
by Hamilton, Andrew 17 Sep '02

17 Sep '02

I can help with the long_hostnames part. You have use_fqdn(yes) which turns on the full qualified domain name of the host. Regards, Drew -----Original Message----- From: BENGT OLSSON [mailto:bol@bth.se] Sent: Tuesday, September 17, 2002 8:32 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Unwanted logging Hi I get some unwanted loggin from strange hosts.... The syslog-ng.conf-file looks like; options { use_fqdn(yes); keep_hostname(yes); use_dns(yes); long_hostnames(off); sync(0); log_fifo_size(1000); }; source all { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; destination hosts { file("/var/syslog/hosts/$HOST/$FACILITY_$YEAR-$MONTH-$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(all) ; destination(hosts) ; }; An example of unwanted "hosts"-directory in the /var/syslog/hosts-directory; 0x0.0x5da74da 0x0.0x5dc3cea 0x0.0x5dc3d5a 0x0.0x5dc4077 0x0.0x5dca334 0x0.0x5dcea7a 0x0.0x637fb77 0x0.0x642bad8 0x0.0x64c5ea8 An example of correct hosts -directory in the /var/syslog/hosts-directory looks like this; trillian.student.bth.se trumma.bth.se viking.student.bth.se viola.bth.se violin.bth.se vogonjeltz.student.bth.se voyager.student.bth.se vroomfondel.student.bth.se zaphod.student.bth.se Is there some internal logging or what is it comming from? A minor problem is that i have the "long_hostnames" to off and still it loging whit long hostnames....any guess? Best Regards -- Bengt Olsson Blekinge Tekniska Högskola Datorenheten Campus Gräsvik Vallhallavägen 1 371 79 Karlskrona Mail: bol(a)bth.se Tel: 0455-385152 Mobil: 0708-787 780 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

localport binding...still not working.
by Robert D. Beal 17 Sep '02

17 Sep '02

>>I'm trying to get syslog-ng (1.5.20) to use 514 as its source port when >>using the udp destination driver as follows: >> >> <<Following taken from my syslog-ng.conf>> >> >> source s_sys { unix-stream("/dev/log"); internal(); }; >> destination d_syslog { udp("192.168.0.2" destport(514) >> localport(514)); }; >> log { source(s_src); destination(d_syslog); }; >> >>but it always seems to send the syslog udp datagrams using the next >>available non-privileged port as its source (>1024). I'm running as root >>(on RedHat 7.3) and syslogd is not running. Syslog-ng doesn't choke on the >>config, so I'm assuming its not a syntax problem, but I just can't seem to >>get it to use 514 as its source port?! Does anyone have any ideas what I >>may be doing wrong here? Or is it just silently ignoring my request to use >>port 514? > >As it seems the docs is buggy, Robert is right. The bug lies in libol, it >only binds the local socket if the local address is defined. So there are >two solutions: > >* supply localip as well as localport >* apply this patch to libol, and recompile > > >diff -u -r1.26 -r1.28 >--- io.c 11 Oct 2001 18:25:14 -0000 1.26 >+++ io.c 16 Sep 2002 08:23:22 -0000 1.28 >@@ -829,9 +834,9 @@ > memcpy(sa, &a->sa, sizeof(a->sa)); > return 1; > } >- if (a->ip && !tcp_addr(in, >- a->ip->length, a->ip->data, >- a->port)) >+ if (tcp_addr(in, >+ a ? a->ip->length : 7, a ? a->ip->data : "0.0.0.0", >+ a->port)) > return 0; > else > if (!a->ip && !tcp_addr(in, 0, NULL, a->port)) > > >-- >Bazsi >PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 I tried modifying my syslog-ng.conf as follows: source s_sys { unix-stream("/dev/log"); internal(); }; destination d_syslog { udp("192.168.0.2" destport(514) localip("192.168.0.10") localport(514)); }; log { source(s_src); destination(d_syslog); }; and I'm now getting a segmentation fault. 192.168.0.10 is the IP of the system I'm running on. I also tried 127.0.0.1 as the localip with the same result. Do I have the syntax incorrect? Syslog-ng didn't complain. I also tried the patch, but not being really strong in C/C++ I may have messed something up. I applied the patch, and now make errors out: make_class <io.c > io.c.xt /bin/sh: /home/src/syslog-ng/libol-0.3.3/utils/make_class: \: bad interpreter: No such file or directory make[1]: ***[io.c.x]: Error 126 make[1]: Leaving directory '/home/src/syslog-ng/libol-0.3.3/src` make{[1]: *** [all-recursive] Error 1 Any suggestions? I can live with syslog-ng binding to whatever source port, but I'd have to open up my router access lists a little more than I would like.

2 1

Problem compiling on FreeBSD
by Nicolai Strøm Gylling 16 Sep '02

16 Sep '02

Hi I'm trying to compile syslog-ng_1.5.20 on FreeBSD 4.6.2-RELEASE, but I get the error below. I'm using Libol 0.3.3. Anyone got some clues to what might be wrong? gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.5.20/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afremctrl.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.5.20/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c nscache.c In file included from nscache.c:55: /usr/include/netinet/in.h:233: syntax error before `in_addr_t' /usr/include/netinet/in.h:285: syntax error before `u_char' In file included from /usr/include/netinet/in.h:467, from nscache.c:55: /usr/include/netinet6/in6.h:122: syntax error before `u_int8_t' /usr/include/netinet6/in6.h:144: syntax error before `u_int8_t' /usr/include/netinet6/in6.h:149: syntax error before `u_int32_t' /usr/include/netinet6/in6.h:612: syntax error before `*' /usr/include/netinet6/in6.h:614: syntax error before `*' /usr/include/netinet6/in6.h:614: warning: data definition has no type or storage class /usr/include/netinet6/in6.h:615: syntax error before `u_int8_t' /usr/include/netinet6/in6.h:616: syntax error before `u_int8_t' /usr/include/netinet6/in6.h:631: syntax error before `u_int8_t' /usr/include/netinet6/in6.h:636: syntax error before `u_int8_t' /usr/include/netinet6/in6.h:638: syntax error before `u_int8_t' nscache.c: In function `nscache_new': nscache.c:112: structure has no member named `s_addr' nscache.c: In function `nscache_lookup': nscache.c:178: structure has no member named `s_addr' nscache.c:183: structure has no member named `s_addr' nscache.c:183: structure has no member named `s_addr' nscache.c:245: structure has no member named `s_addr' nscache.c:245: structure has no member named `s_addr' nscache.c:247: fixed or forbidden register 0 (ax) was spilled for class AREG. nscache.c:247: This may be due to a compiler bug or to impossible asm nscache.c:247: statements or clauses. nscache.c:247: This is the instruction: (insn 56 55 58 (parallel[ (set (reg:SI 2 %ecx) (udiv:SI (reg/v:SI 2 %ecx) (reg:SI 1 %edx))) (set (reg:SI 1 %edx) (umod:SI (reg/v:SI 2 %ecx) (reg:SI 1 %edx))) ] ) 243 {udivmodsi4} (insn_list 49 (insn_list 55 (nil))) (expr_list:REG_DEAD (reg/v:SI 2 %ecx) (expr_list:REG_DEAD (reg:SI 1 %edx) (expr_list:REG_UNUSED (reg:SI 2 %ecx) (nil))))) *** Error code 1 Stop in /tmp/syslog-ng-1.5.20/src. *** Error code 1 Best regards Nicolai Gylling

1 0

RE: [syslog-ng]Errors Compiling 1.5.19 with TCP_WRAPPERS
by Sangbutsarakum, Patai 16 Sep '02

16 Sep '02

I can't success also. I got suggestion to use other feature of syslog-ng that can do access-list like as TCP_WRAPPER. Hope this help Pat. -----Original Message----- From: Victor [mailto:victord@paid.com] Sent: Thursday, August 22, 2002 10:15 To: Syslog-ng Subject: [syslog-ng]Errors Compiling 1.5.19 with TCP_WRAPPERS I am trying to compile with tcp_wrappers, but I get this error: gcc -O2 -march=i686 -pipe -Wall -I/root/syslog-ng/work/src/libol-0.3.3/src -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o -lfl /root/syslog-ng/work/src/libol-0.3.3/src/.libs/libol.a -lnsl afinet.o: In function `do_open_afinet_connection': afinet.o(.text+0x3c3): undefined reference to `request_init' afinet.o(.text+0x3cf): undefined reference to `sock_host' afinet.o(.text+0x3d8): undefined reference to `hosts_access' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 Shouldn't it have something like -lwrap on the line above? Also, I heard on the mailing list that there is a patch for 1.5.19? Is there a link to it? What's the proper patch command to apply it? Thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

4 3

Memory not released in syslog-ng
by Rolf Böhme 13 Sep '02

13 Sep '02

Hello, according my notice about the memory problems with syslog-ng I have tested again with the actual stable version og syslog-ng. My Configuration is SuSE Linux 7.1 on Compaq Computer, 164MB RAM, 20GB Harddisk, syslog-ng 1.4.15, libol 0.2.23. Eight other Computers (Linux and WinNT 4.0/my modified ntsyslog) send their Information to the Log-Server. After about 23 to 32 hours running syslog-ng the Linux operating system kills the syslog-ng demon with a memory allocation error. The free memory is down to about 10MB. The memory used b syslog-ng was not released. I am using the following syslog-ng.conf: # Konfigurationsdatei fuer syslgd-ng # RB 020827 options { sync(0); keep_hostname(yes); long_hostnames(off); use_dns(yes); }; source s_default { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination d_messages { file("/logfiles/clients/$HOST/$YEAR-$MONTH-$DAY.$FACILITY.$PRIORITY" create_dirs(yes) ); }; log { source(s_default); destination(d_messages); }; What is wrong? Regards Rolf Böhme staatl. gepr. Informatikassistent CNA, Systemadministrator mailto:rolf.boehme@gno.de

2 1

TimeZone Macros Patch
by Robin * Slomkowski 13 Sep '02

13 Sep '02

I have created a patch based on syslog-ng-1.5.20 That adds two new macros. TZOFFSET The time-zone as hour offset from GMT. e.g. '-0700' TZ The time zone or name or abbreviation. e.g. 'PDT' usable like all other macros. $TZ and $TZOFFSET the affected source files are doc/sgml/syslog-ng.sgml documentation update src/affile.c The code change you also need to /bin/touch src/affile.c.x to get it to build correctly after you have applied the patch. and you need to explicitly rebuild the documentation if you want the documentation updates. I have the need for this as I have to coordinate syslog files with other application log files that are in multiple data centers. And since a standard syslog entry does not contain the timezone, I need the log file name to contain the GMT offset so I can correlate the data in a useful manner with the logs in other timezones, and daylight saving times. Hope this patch meets the code standards for this project and that others may find it useful. -- -R*S San Francisco, CA Robin * Slomkowski pretender(a)rslomkow.org

2 1

I NEED YOUR HELP
by monicaalfred monica 12 Sep '02

12 Sep '02

FROM :ABIDJAN-COTE D'IVOIRE E MAIL.monica.monicaalfred(a)caramail.com DEAR SIR IT IS MY PLEASURE TO WRITE TO YOU AFTER MYSEVEN DAYS FASTING AND PRAYERS, l AM MRS MONICA THE WIFE OF LATE MR ALFRED JACK FROM KWAZULU-NATAL IN REPUBLIC OF SOUTH AFRICA, MY HUSBAND OWNS A LIMITED LIABILITY COMPANY OF COCOA AND GOLD IN JOHANESBURG SOUTH AFRICA MY COUNTRY. AFTER HIS TRIP TO ABIDJAN COTE DIVIORE TO NEGOTIATEON A COCOA AND GOLD BUSINESS HE WANTED TO INVEST IN ABIDJAN .ONE WEEK HE CAME BACK FROM HIS TRIP TO ABIDJAN HE HAD A MOTOR ACCIDENT, WHICH MY DAUGHTER DIED INSTANTLY BUT MY HUSBAND DIED AFTER FIVE DAYS IN A PRIVATE HOSPITAL IN MY COUNTRY . IT WAS LIKE MY HUSBAND KNEW HE WAS GOING TO DIE (MAY HIS GENTLE SOUL REST IN PREFECT PEACE). HE DISCLOSED TO ME AND MY SON THAT HE DEPOSITED THE SUM OF ($9,500,000) INTO ONE OF THE BANK IN COTE DIVIORE THAT THE MONEY WAS MEANT FOR HIS COCOA AND GOLD BUSINESS HE WANTEDTO ESTABLISH IN ABIDJAN. MY HUSBAND HANDED ME THE DOCUMENTS COVERING THE LODGMENT AND INSTRUCTED ME AND MY SON TO SEEK FOR A RELIABLE AND TRUST WORTHY BUSINESS PARTNER FOR OUR LIFE TIME INVESTMENT THAT IS WHY I DECIDED TO CONTACT YOU , NOW I HAVE SUCCEEDED IN LOCATING THE BANK HERE IN ABIDJAN AND I HAVE CONCLUDED WITH THE BANK MODALITIES OF TRANSFERRING THE FUND INTO AN ACCOUNT ABROAD . NOW I AM SOLICITING FOR YOUR ASSISTANCE TO HELP ME PROVIDE AN ACCOUNT FACILITY WHERE I CAN TRANSFER THE MONEY INTO SO THAT WE CAN INVEST IT IN ANY LUCRATIVE BUSINESS IN YOUR COUNTRY BECAUSE THIS IS MY ONLY HOPE IN LIFE ,WE HAVE PROMISED TO GRATIFY YOU WITt 15% OF THE TOTAL SUM FOR YOUR KIND ASSISTANCE. I AM WAITING ANXIOUSLY TO HEAR FROM YOU SO THAT WE CAN DISCUSS THE MODALITIES OF THIS TRANSACTION YOU CAN CONTACT ME IMMEDIATELY FOR MORE DISCUSSION . NB: FOR PRIVATE AND CONFIDENTIAL CONTACT ME ON ABOVE E-MAIL. THANKS FOR YOUR KIND ASSISTANCE YOURS SINCERELY MRS.MONICA.ALFRED ______________________________________________________ Boîte aux lettres - Caramail - http://www.caramail.com

1 0

Re: [syslog-ng]source socket keepalive patch suggestion
by Ted_Rule＠flextech.co.uk 12 Sep '02

12 Sep '02

Ah.. perhaps the light begins to clear. I think I must have misinterpreted what the keep-alive option really does. I had thought it avoided re-opening a listener on the same socket on SIGHUP. From your reply, I'm now assme that all it does is ensure that 'ephemeral' connections accept()'ed from a listener are left open across a SIGHUP even if the listener is taken away. Is this nearer the truth? In which case , as you say, my patch is irrelevant to my real desire to avoid a re-open of any given listener ( of potentially any flavour ) across a SIGHUP, and the previous post about repairing the 'broken' glibc/syslog() call across a re-opened Unix DGRAM socket potentially provides an easier fix than a rewrite of syslog-ng. And/or avoiding use of Unix DGRAM sockets at all on glibc platforms until such a fix is in place. Ted *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

3 2