- syslog-ng - lists.balabit.hu

change directory/file permissions
by Stefan M. Brandl 26 Jun '02

26 Jun '02

Hi, I have the following line in syslog-ng.conf: destination router { file("/opt/syslog-ng/var/$YEAR/$MONTH/$YEAR$MONTH$DAY-$HOST" create_dirs(yes) perm(0644)); }; This creates automaticaly the directorys and changes the file-permissions to 644. But it only changes the permissions of the file, not of the directories. What can I do, that also the directories get 644? Regards Stefan

2 4

Re: Thinking about linking
by klaas.vangend＠philips.com 26 Jun '02

26 Jun '02

On 2002-06-26 06:25:05 AM syslog-ng-admin wrote: > > Message: 4 > Date: Tue, 25 Jun 2002 17:06:22 +0200 > From: Jay Goldberg <jg(a)open.ch> > To: syslog-ng(a)lists.balabit.hu > Organization: Open Systems AG - http://www.open.ch > Gecko/20020530 > Subject: [syslog-ng]Thinking about linking > Reply-To: syslog-ng(a)lists.balabit.hu > > Hi, syslog-ng'ers > > A quick question for all - I've been using syslog-ng, but instead of using > the excellent built-in $YEAR $MONTH and $DAY macros for automatic logfile > rotation, I've been using a different solution - > > I use the cronolog program (www.cronolog.org) as a destination for any files > that I want to keep locally. It's not optimal, but it allows me to do one > thing that keeps our complex management environment intact after the cutover > from syslog to syslog-ng, and that's to maintain a symbolic link to the > latest and previous logfiles in the place where folks/scripts would normally > think to look for them. So for example: > > /reallybigdisk/logs/2002/06/messages.25 and > /reallybigdisk/logs/2002/06/messages.24 > > would be today's and yesterdays 'messages' file. But with cronolog, I'm able > to specify options so that /var/adm/messages is just a symlink to whatever file > we're logging to now, and /var/adm/messages.0 is a symlink to whatever file > we logged to last: > > host# ls -l /var/adm/messages* > lrwxrwxrwx 1 root root 34 Jun 25 01:16 /var/adm/messages -> > /reallybigdisk/logs/2002/06/messages.25 > lrwxrwxrwx 1 root root 34 Jun 24 01:16 /var/adm/messages.0 -> > /reallybigdisk/logs/2002/06/messages.24 > > I'm not sure if I missed this in the documentation for syslog-ng or perhaps > I'm just insane for thinking that this is useful :) > > So I guess my questions after all this are: > > - did I miss this in the documentation? > - am I insane for wanting such a feature? > - would it be a lot of trouble to add this feature? > > ...I was thinking something along the lines of a 'maintain_symlink' option for > a file destination that takes the target of the symlink (e.g., > /var/adm/messages) > as an option. As far as I know (and I've probably been the last person looking over that code), there is no such option currently available. It wouldn't be too hard to write, if and only if creating symlinks is portable over all UNIX implementations. Being a Linux&Windows programmer only, I don't know for sure. Anyway, following the lines of my latest patch (the "remove_if_older" patch, submitted Feb1 2002, included in 1.5.15), it shouldn't be too difficult to implement. I currently don't have time for it, but I think your suggestion makes sense and maybe I can persuade my boss to give me some time to implement it. Groetjes, Klaas van Gend

1 0

Thinking about linking
by Jay Goldberg 25 Jun '02

25 Jun '02

Hi, syslog-ng'ers A quick question for all - I've been using syslog-ng, but instead of using the excellent built-in $YEAR $MONTH and $DAY macros for automatic logfile rotation, I've been using a different solution - I use the cronolog program (www.cronolog.org) as a destination for any files that I want to keep locally. It's not optimal, but it allows me to do one thing that keeps our complex management environment intact after the cutover from syslog to syslog-ng, and that's to maintain a symbolic link to the latest and previous logfiles in the place where folks/scripts would normally think to look for them. So for example: /reallybigdisk/logs/2002/06/messages.25 and /reallybigdisk/logs/2002/06/messages.24 would be today's and yesterdays 'messages' file. But with cronolog, I'm able to specify options so that /var/adm/messages is just a symlink to whatever file we're logging to now, and /var/adm/messages.0 is a symlink to whatever file we logged to last: host# ls -l /var/adm/messages* lrwxrwxrwx 1 root root 34 Jun 25 01:16 /var/adm/messages -> /reallybigdisk/logs/2002/06/messages.25 lrwxrwxrwx 1 root root 34 Jun 24 01:16 /var/adm/messages.0 -> /reallybigdisk/logs/2002/06/messages.24 I'm not sure if I missed this in the documentation for syslog-ng or perhaps I'm just insane for thinking that this is useful :) So I guess my questions after all this are: - did I miss this in the documentation? - am I insane for wanting such a feature? - would it be a lot of trouble to add this feature? ...I was thinking something along the lines of a 'maintain_symlink' option for a file destination that takes the target of the symlink (e.g., /var/adm/messages) as an option. I thought I'd ask first in case anyone's working on this already - it would save me from hacking at and most likely desecrating the code. I've had a look through, and it's a far tidier job than anything I've done in a long time. But then I haven't been a C programmer for the last 9 years :( Thanks! Jay -- jay goldberg senior engineer open systems ag raeffelstrasse 29 ch-8045 zurich t: +41 1 455 74 00 f: +41 1 455 74 01 jg(a)open.ch http://www.open.ch

1 0

syslog-ng on win
by Jas Amidzic 25 Jun '02

25 Jun '02

Syslog-ng is excellent tool, but to make it work for me I need to run it on at least one win200 box. Did anyone considered porting syslog-ng to the win environment? Thanks Jas ----------------------------------------------- ABS Web Site: www.abs.gov.au

3 2

RE: [syslog-ng]program() with template()..how or workaround?
by Michael Earls 24 Jun '02

24 Jun '02

You should look on http://www.campin.net/syslog-ng/faq.html there are some sites that list how to format syslog-ng to sql statements. michael -----Original Message----- From: thelittleprince(a)asteroid-b612.org Sent: Monday, June 24, 2002 2:40 PM To: <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng]program() with template()..how or workaround? i need to use template with program in order to send a specific format to a modified sqlsyslogd. I'm running the latest devel of syslog ng. can this be done? if not, is there some sort of workaround i can use with pipe to get the formatted data into sqlsyslogd? or maybe do something like.. program("/usr/local/bin/sqlsyslogd < echo $HOST $FACILITY"); i know that syntax wont work, but you get the gist. :) Thanx! Tony . ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. . Anthony J. Biacco Network Administrator/Engineer thelittleprince@asteroid b612.org http://www.asteroid b612.org "Strange, but it seems, there's a mutiny brewing inside of me" . ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. . _______________________________________________ syslog ng maillist syslog ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog ng Frequently asked questions at http://www.campin.net/syslog ng/faq.html

1 0

program() with template()..how or workaround?
by The Little Prince 24 Jun '02

24 Jun '02

i need to use template with program in order to send a specific format to a modified sqlsyslogd. I'm running the latest devel of syslog-ng. can this be done? if not, is there some sort of workaround i can use with pipe to get the formatted data into sqlsyslogd? or maybe do something like.. program("/usr/local/bin/sqlsyslogd < echo $HOST $FACILITY"); i know that syntax wont work, but you get the gist. :) Thanx! --Tony .-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-. Anthony J. Biacco Network Administrator/Engineer thelittleprince(a)asteroid-b612.org http://www.asteroid-b612.org "Strange, but it seems, there's a mutiny brewing inside of me" .-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-.

1 0

io.c:263: failed assertion `i == nfds'
by Doug Winter 24 Jun '02

24 Jun '02

Hi syslog-ng people, I've just installed syslog-ng 1.4.15, using libol 0.2.23 as directed in the INSTALL instructions. I am running it on a: SunOS 5.7 Generic_106541-11 sun4u sparc SUNW,Ultra-250 When I run syslog-ng with the attached configuration file, it runs for a short period (< 10 minutes) and exits. When it exits, I get this message in one of the output files: syslog:io.c:263: failed assertion `i == nfds' which file it appears in varies, which is presumably down to a file descriptor mixup. line 263 of io.c in libol is indeed: assert(i == nfds); When I run syslog-ng in debugging mode (with the -d -v switches), this problem does not occur (I have run for two days without the fault). I assume this is because in debugging mode fds 0,1 & 2 are kept open, whereas they are closed when syslog-ng becomes a daemon (note many assumptions :). I have tried to find reference to this problem on the web without success - the archives of this list aren't searchable as far as I can find, so apologies if this is a known and fixed problem. Many Thanks, Doug Winter -- 020 79610341 / 07879 423002 / dwinter(a)icpeurope.net 3 Waterhouse Square, Holborn Bars, 142 Holborn, London EC1N 2NX www.businesseurope.com www.icpeurope.net www.venturedome.com 1024D/1AB26B8C C88E DC6D A578 DEFB C493 A44D 0156 0479 1AB2 6B8C

1 0

Well, I use the last version of Syslog-ng (1.5.18). Well it looks as if syslog-ng was crashing itself and then all programsthat are usually logged via syslog-ng are unable to perform their ownactions (that's why ssh doesn't work anymore)... In some words, it looks like syslog-ng was becoming blocking for allapplications.On Fri, 2002-06-21 at 10:28, Balazs Scheidler wrote:> On Fri, Jun 21, 2002 at 10:23:24AM +0200, Yan DENET wrote:> > Hi all,> > > > Some quite strange things have happened in my ne
by Yan DENET 24 Jun '02

24 Jun '02

Well, I use the last version of Syslog-ng (1.5.18). Well it looks as if syslog-ng was crashing itself and then all programs that are usually logged via syslog-ng are unable to perform their own actions (that's why ssh doesn't work anymore)... In some words, it looks like syslog-ng was becoming blocking for all applications. On Fri, 2002-06-21 at 10:28, Balazs Scheidler wrote: > On Fri, Jun 21, 2002 at 10:23:24AM +0200, Yan DENET wrote: > > Hi all, > > > > Some quite strange things have happened in my network since i set up my > > syslog-ng as a log centralizer... > > Actually, when launched, my syslog-ng ends up to grab all resources of > > the machine on which it's installed. Then, no way to ssh to it... > > It's really strange cause normally, syslog-ng should use only very few > > resources... like syslog ! > > Whereas with syslog, everything goes well.. > > > > Don't know what's happening. Could somebody help me ? > > we can't help you unless you provide more information. which version are you > using, and what do you mean it ate up all resources? > > does it eat memory, or use all cpu cycles or? > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 --

2 1

CONGRATULATIONS: FINAL NOTICE!!!
by werken.bij.delotto＠HotPOP.com 23 Jun '02

23 Jun '02

WERKEN BIJ DE LOTTO, 41132, NL-1007 DB AMSTERDAM, THE NETHERLANDS. FROM: THE DESK OF THE DIRECTOR PROMOTIONS, INTERNATIONAL PROMOTIONS/PRIZE AWARD DEPARTMENT, REF: WBL/67-AO91657984 ATTENTION: AWARD NOTIFICATION; FINAL NOTICE We are pleased to inform you of the announcement today, 23RD JUNE 2002, of winners of the WERKEN BIJ DE LOTTO/ INTERNATIONAL PROGRAMS held on 1ST JUNE 2002. Your company, attached to ticket number 013-2316-2002-477, with serial number A025-09 drew the lucky numbers 37-13-34-85-56-42, and consequently won in category C. You have therefore been approved for a lump sum pay out of US$1,500,000.00 in cash credited to file REF NO. REF: WBL/67-AO91657984. This is from total prize money of US$22,500,000.00 shared among the fifteen international winners in the category C. All participants were selected through a computer ballot system drawn from 30,000 names from Australia, New Zealand, America, Asia, Europe and North America as part our International Promotions Program, which is conducted annually. CONGRATULATIONS! Your fund is now deposited with a Finance and Security House insured in your name. Due to the mix up of some numbers and names, we ask that you keep this award strictly from public notice until your claim has been processed and your money remitted to your account. This is part of our security protocol to avoid double claiming or unscrupulous acts by participants of this program. We hope with a part of you prize, you will participate in our end of year high stakes US$1.3 billion International lotto. To begin your claim, please contact your claims officer immediately: JANSEN DAVIS FOREIGN SERVICE MANAGER, EUROLITE BV, TEL: 31 205241592 FAX: 31 205241597 EMAIL: eurolitebv(a)poboxes.com For due processing and remittance of your prize money to a designated account of your choice. Remember, you must contact your claims officer not later than 29TH of JUNE 2002. After this date, all funds will be returned as unclaimed. NOTE: In order to avoid unnecessary delays and complications, please remember to quote your reference number in every one of your correspondences with your officer. Furthermore, should there be any change of your address, do inform your claims officer as soon as possible. Congratulations again from all our staff and thank you for being part of our promotions program. Sincerely, THE DIRECTOR PROMOTIONS, WERKEN BIJ DE LOTTO. www.werken-bij-delotto.net N.B. Any breach of confidentiality on the part of the winners will result to disqualification. Please do not reply this mail.

1 0

problems building 1.5.18 on solaris
by Bret Watson 23 Jun '02

23 Jun '02

Hi All, things don't seem to build on solaris 8 for 1.5.18.. here are the errors.. Making all in src make[1]: Entering directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' cd /home/bret/syslog-ng-beta/syslog-ng-1.5.18 && autoheader make all-recursive make[2]: Entering directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' Making all in . make[3]: Entering directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c main.c main.c: In function `main': main.c:437: warning: passing arg 2 of `resolve_user_group' from incompatible pointer type main.c:437: warning: passing arg 3 of `resolve_user_group' from incompatible pointer type main.c:441: warning: passing arg 2 of `resolve_group' from incompatible pointer type gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c sources.c gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c center.c center.c: In function `do_distribute_log': center.c:157: warning: deprecated use of label at end of compound statement gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c filters.c filters.c: In function `do_filter_call': filters.c:342: warning: implicit declaration of function `memcmp' gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c destinations.c gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c log.c gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c cfgfile.c gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c cfg-grammar.c cfg-grammar.y: In function `yyerror': cfg-grammar.y:703: warning: implicit declaration of function `fprintf' cfg-grammar.y:703: `stderr' undeclared (first use in this function) cfg-grammar.y:703: (Each undeclared identifier is reported only once cfg-grammar.y:703: for each function it appears in.) make[3]: *** [cfg-grammar.o] Error 1 make[3]: Leaving directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' make: *** [all-recursive] Error 1 Don't know if this is fixed in cvs?... Bret Technical Incursion Countermeasures www.ticm.com The Insider www.ticm.com/info/insider

1 0