- syslog-ng - lists.balabit.hu

configure 1.4.15 fails to detect libol 0.3.3
by Diogo Zulli 01 Jun '02

01 Jun '02

Hi, I am installing syslog-ng for the first here and found a little problem in configure script. I got syslog-ng 1.4.15 and libol 0.3.3 and the syslog-ng configure script fails to detect libol 0.3.3 because it requires at least 0.2.23: configure.in: ... LIBOL_REQ_PATCH=23 ... if test "$LIBOL_MAJOR" != "$LIBOL_REQ_MAJOR" -o \ "$LIBOL_MINOR" -lt "$LIBOL_REQ_MINOR" -o \ >>>HERE>>> "$LIBOL_PATCH" -lt "$LIBOL_REQ_PATCH"; then AC_MSG_RESULT(no) AC_MSG_ERROR(Required libol version not found) fi As you can see 3 is -lt 23. I worked around changing required LIBOL_REQ_PATCH do 2. Thanks for the great software. I hope I debugged it right and didn't missed something and maybe will help you to fix the problem. - Diogo Zulli -- [ http://sphynx.com.br - diogo(a)sphynx.com.br - ICQ# 112204935 ]

1 0

Re: where is ftp location for syslog-ng
by Steve Cobrin 31 May '02

31 May '02

Follow up to my question regarding broken ftp link on syslog-ng web page -- Steve ---------- Forwarded Message ---------- Subject: Re: inaccessible syslog-ng directories Date: Fri, 31 May 2002 18:17:15 +0200 (CEST) From: Attila Nagy <bra(a)fsn.hu> To: Steve Cobrin <cobrin(a)highbury.net> Hello, > Hi I'm trying to download syslog-ng and libol, but have been unable to > access the following directories for several months That's because Balabit has always forgotten to start rsyncd on their webserver, so I asked them to decide, wether they want me to mirror the stuff, or not. I got no answer, so I first restricted the directory and now deleted all the stuff. Please use http://www.balabit.hu/ instead. Thanks, --------[ Free Software ISOs - ftp://ftp.fsn.hu/pub/CDROM-Images/ ]------- Attila Nagy e-mail: Attila.Nagy(a)fsn.hu Free Software Network (FSN.HU) phone @work: +361 210 1415 (194) cell.: +3630 306 6758 ------------------------------------------------------- On Tuesday 07 May 2002 23:29, Steve Cobrin wrote: > Hi there, I'm interested in experimenting with syslog-ng. > > I usually much prefer to download software using ftp rather than http. Is > there a main ftp site or mirror site.? > > The syslog-ng web page refers to ftp://ftp.fsn.hu/pub/syslog-ng but I have > been unable to connect to the site since January, with the site complaining > that the directory doesn't have read permission. > > Can anybody help? > > -- Steve

1 0

Re: Fwd: [syslog-ng]Logging Remotely from Solaris to Linux
by Ron Braley 31 May '02

31 May '02

Bazsi I've tested every facility and priority, and present the final results of testing facilities and priorities from the Solaris box to the Linux log host: - The only cron facility from the Solaris box recorded at the Linux log host was cron.emerg. No other cron priorities would show up at the log host, but they did log locally OK. - Two daemon facility priorities would not get recorded at the loghost from the Solaris server: daemon.info and daemon. debug. All other daemon priorities worked fine. All other facilities and priorities worked fine from the Solaris box to the Linux log host (except kern, which you addressed earlier). All facility and priorities work fine from the Linux servers to the log host. Thoughts? rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 05/31/02 02:45AM >>> On Thu, May 30, 2002 at 09:58:23PM -0500, Ron Braley wrote: > Hi Bazsi. > > Here's where things are with the syslog-ng and Solaris vs Linux: > > Using facility filters (i.e. f_cron) on the Linux box will result in > not logging any messages from the Solaris box. Other Linux boxes work > fine with the facility filters, though. Here's the list of facilities that Solaris uses, and the same on Linux: Solaris: #define LOG_KERN (0<<3) /* kernel messages */ #define LOG_USER (1<<3) /* random user-level messages */ #define LOG_MAIL (2<<3) /* mail system */ #define LOG_DAEMON (3<<3) /* system daemons */ #define LOG_AUTH (4<<3) /* security/authorization messages */ #define LOG_SYSLOG (5<<3) /* messages generated internally by syslogd */ #define LOG_LPR (6<<3) /* line printer subsystem */ #define LOG_NEWS (7<<3) /* netnews subsystem */ #define LOG_UUCP (8<<3) /* uucp subsystem */ #define LOG_CRON (15<<3) /* cron/at subsystem */ /* other codes through 15 reserved for system use */ #define LOG_LOCAL0 (16<<3) /* reserved for local use */ #define LOG_LOCAL1 (17<<3) /* reserved for local use */ #define LOG_LOCAL2 (18<<3) /* reserved for local use */ #define LOG_LOCAL3 (19<<3) /* reserved for local use */ #define LOG_LOCAL4 (20<<3) /* reserved for local use */ #define LOG_LOCAL5 (21<<3) /* reserved for local use */ #define LOG_LOCAL6 (22<<3) /* reserved for local use */ #define LOG_LOCAL7 (23<<3) /* reserved for local use */ Linux: #define LOG_KERN (0<<3) /* kernel messages */ #define LOG_USER (1<<3) /* random user-level messages */ #define LOG_MAIL (2<<3) /* mail system */ #define LOG_DAEMON (3<<3) /* system daemons */ #define LOG_AUTH (4<<3) /* security/authorization messages */ #define LOG_SYSLOG (5<<3) /* messages generated internally by syslogd */ #define LOG_LPR (6<<3) /* line printer subsystem */ #define LOG_NEWS (7<<3) /* network news subsystem */ #define LOG_UUCP (8<<3) /* UUCP subsystem */ #define LOG_CRON (9<<3) /* clock daemon */ #define LOG_AUTHPRIV (10<<3) /* security/authorization messages (private) */ #define LOG_FTP (11<<3) /* ftp daemon */ /* other codes through 15 reserved for system use */ #define LOG_LOCAL0 (16<<3) /* reserved for local use */ #define LOG_LOCAL1 (17<<3) /* reserved for local use */ #define LOG_LOCAL2 (18<<3) /* reserved for local use */ #define LOG_LOCAL3 (19<<3) /* reserved for local use */ #define LOG_LOCAL4 (20<<3) /* reserved for local use */ #define LOG_LOCAL5 (21<<3) /* reserved for local use */ #define LOG_LOCAL6 (22<<3) /* reserved for local use */ #define LOG_LOCAL7 (23<<3) /* reserved for local use */ You can define facilities by their number, so if you want to select CRON messages from a Solaris box, you can use the filter: filter f_cron { facility(15); }; > On a non-Solaris related issue, if I try to test the kern facility by > doing a command like "logger -p kern.crit TEST" nothing happens locally > or on the loghost. Is there a reason why that should act differently > than other facilities? kernel messages are read from a special file (/proc/kmsg on linux), I suppose logger refuses to send a message with facility=kern from userspace. Try using truss on logger to see whether logger sends the message at all. (it does work on Linux however as strace shows) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: Fwd: [syslog-ng]Logging Remotely from Solaris to Linux
by Ron Braley 31 May '02

31 May '02

Bazsi I'll give these a try this morning. As always, thanks for the quick, expert response. :) Have a great weekend! rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 05/31/02 02:45AM >>> On Thu, May 30, 2002 at 09:58:23PM -0500, Ron Braley wrote: > Hi Bazsi. > > Here's where things are with the syslog-ng and Solaris vs Linux: > > Using facility filters (i.e. f_cron) on the Linux box will result in > not logging any messages from the Solaris box. Other Linux boxes work > fine with the facility filters, though. Here's the list of facilities that Solaris uses, and the same on Linux: Solaris: #define LOG_KERN (0<<3) /* kernel messages */ #define LOG_USER (1<<3) /* random user-level messages */ #define LOG_MAIL (2<<3) /* mail system */ #define LOG_DAEMON (3<<3) /* system daemons */ #define LOG_AUTH (4<<3) /* security/authorization messages */ #define LOG_SYSLOG (5<<3) /* messages generated internally by syslogd */ #define LOG_LPR (6<<3) /* line printer subsystem */ #define LOG_NEWS (7<<3) /* netnews subsystem */ #define LOG_UUCP (8<<3) /* uucp subsystem */ #define LOG_CRON (15<<3) /* cron/at subsystem */ /* other codes through 15 reserved for system use */ #define LOG_LOCAL0 (16<<3) /* reserved for local use */ #define LOG_LOCAL1 (17<<3) /* reserved for local use */ #define LOG_LOCAL2 (18<<3) /* reserved for local use */ #define LOG_LOCAL3 (19<<3) /* reserved for local use */ #define LOG_LOCAL4 (20<<3) /* reserved for local use */ #define LOG_LOCAL5 (21<<3) /* reserved for local use */ #define LOG_LOCAL6 (22<<3) /* reserved for local use */ #define LOG_LOCAL7 (23<<3) /* reserved for local use */ Linux: #define LOG_KERN (0<<3) /* kernel messages */ #define LOG_USER (1<<3) /* random user-level messages */ #define LOG_MAIL (2<<3) /* mail system */ #define LOG_DAEMON (3<<3) /* system daemons */ #define LOG_AUTH (4<<3) /* security/authorization messages */ #define LOG_SYSLOG (5<<3) /* messages generated internally by syslogd */ #define LOG_LPR (6<<3) /* line printer subsystem */ #define LOG_NEWS (7<<3) /* network news subsystem */ #define LOG_UUCP (8<<3) /* UUCP subsystem */ #define LOG_CRON (9<<3) /* clock daemon */ #define LOG_AUTHPRIV (10<<3) /* security/authorization messages (private) */ #define LOG_FTP (11<<3) /* ftp daemon */ /* other codes through 15 reserved for system use */ #define LOG_LOCAL0 (16<<3) /* reserved for local use */ #define LOG_LOCAL1 (17<<3) /* reserved for local use */ #define LOG_LOCAL2 (18<<3) /* reserved for local use */ #define LOG_LOCAL3 (19<<3) /* reserved for local use */ #define LOG_LOCAL4 (20<<3) /* reserved for local use */ #define LOG_LOCAL5 (21<<3) /* reserved for local use */ #define LOG_LOCAL6 (22<<3) /* reserved for local use */ #define LOG_LOCAL7 (23<<3) /* reserved for local use */ You can define facilities by their number, so if you want to select CRON messages from a Solaris box, you can use the filter: filter f_cron { facility(15); }; > On a non-Solaris related issue, if I try to test the kern facility by > doing a command like "logger -p kern.crit TEST" nothing happens locally > or on the loghost. Is there a reason why that should act differently > than other facilities? kernel messages are read from a special file (/proc/kmsg on linux), I suppose logger refuses to send a message with facility=kern from userspace. Try using truss on logger to see whether logger sends the message at all. (it does work on Linux however as strace shows) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: Fwd: [syslog-ng]Logging Remotely from Solaris to Linux
by Ron Braley 31 May '02

31 May '02

Hi Bazsi. Here's where things are with the syslog-ng and Solaris vs Linux: Using facility filters (i.e. f_cron) on the Linux box will result in not logging any messages from the Solaris box. Other Linux boxes work fine with the facility filters, though. The following is a syslog-ng.conf excerpt that lets all facilities (except mail and LPR) from the Solaris box log to /var/log/messages: destination d_messages { file("/var/log/messages"); }; log { source(s_all); filter(f_sirius); filter(f_warn); destination(d_messages); }; Again, if I add "filter(f_cron)" then nothing from the Solaris box works. The entry "filter(f_sirius)" a host filter, and that works fine. On a non-Solaris related issue, if I try to test the kern facility by doing a command like "logger -p kern.crit TEST" nothing happens locally or on the loghost. Is there a reason why that should act differently than other facilities? Thanks much for your help in these two matters. rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax)

2 1

syslog-ng-1.4.15 patch for libol-0.3.3
by Carlos Velasco 30 May '02

30 May '02

Hello, I tried to run "configure" with libol-0.3.3 and found out that configure was not capable to find or use my libol-0.3.3 although I tried to specify "--with-libol=" parameter. Looking into the code I see that libol version needed is at least: 0.2.23 As my libol is 0.3.3, configure script does a comparation between 23 and 3, seeing that 3 is minor (23 > 3), it abort compilation. I have issued the next patch: --- configure Fri Apr 26 11:45:46 2002 +++ configure.new2 Thu May 30 20:21:12 2002 @@ -2623,7 +2623,7 @@ LIBOL_MAJOR=`echo $LIBOL_VERSION | sed -e 's/$[0-9]*$\.[0-9]*\.[0-9]*/\1/'` LIBOL_MINOR=`echo $LIBOL_VERSION | sed -e 's/[0-9]*\.$[0-9]*$\.[0-9]*/\1/'` -LIBOL_PATCH=`echo $LIBOL_VERSION | sed -e 's/[0-9]*\.[0-9]*\.$[0-9]*$/\1/'` +LIBOL_PATCH=`echo $LIBOL_VERSION | sed -e 's/[0-9]*\.[0-9]*\.$[0-9]*$/\1/' | sed -e 's/^$[0-9]$$/\10/'` if test "$LIBOL_MAJOR" != "$LIBOL_REQ_MAJOR" -o \ "$LIBOL_MINOR" -lt "$LIBOL_REQ_MINOR" -o \ "$LIBOL_PATCH" -lt "$LIBOL_REQ_PATCH"; then Regards, Carlos Velasco

1 0

Re: Syslog-ng-1.5.17+"--enable-tcpwrapper"
by Balazs Scheidler 30 May '02

30 May '02

On Thu, May 30, 2002 at 06:28:05PM +0300, Sergey Holod wrote: > ? ?????? ?? ?? 30 ??? 2002 15:38 ?? ????????: > > On Thu, May 30, 2002 at 12:02:43PM +0300, Sergey Holod wrote: > > > ? ?????? ?? ?? 30 ??? 2002 11:55 ?? ????????: > > > > On Thu, May 30, 2002 at 10:21:55AM +0300, Sergey Holod wrote: > > > > can you send me your configure output and config.log? > $./configure --enable-tcp-wrapper ok, when I fixed the detection of libwrap, I made a mistake, so -lwrap wasn't added to LIBS. Try this patch (and regenerate your configure script using autoconf ) diff -u -r1.49 configure.in --- configure.in 29 May 2002 10:24:42 -0000 1.49 +++ configure.in 30 May 2002 15:43:42 -0000 @@ -190,7 +190,7 @@ if test "x$enable_tcp_wrapper" = "xyes"; then AC_CHECK_HEADERS(tcpd.h) dnl AC_CHECK_LIB(wrap, hosts_access) - if test $blb_cv_c_lwrap = "xyes"; then + if test "x$blb_cv_c_lwrap" = "xyes"; then LIBS="$LIBS -lwrap" fi fi -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Re: [syslog-ng]syslog-ng 1.5.18 released
by Michael Earls 30 May '02

30 May '02

On this new ver does it fix the broken pipe on debian? michael >>> bazsi(a)balabit.hu 05/30/02 02:32 AM >>> Hi, I've released syslog-ng 1.5.18 with the folowing NEWS entry: News for the 1.5.18 release Wed, 29 May 2002 12:23:45 +0200 Changes: * fixed a crash bug when an UDP destination was unreachable In addition to this you can now specify log_prefix() for pipe sources. It can be downloaded from the usual places: http://www.balabit.hu/en/downloads/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

1.5.18/bison-1.32/stdio.h problem
by Borsenkow Andrej 30 May '02

30 May '02

Obviously new bison includes stdio.h only when debugging is enabled. Without it fails miserably in yyerror: /* Enable debugging if requested. */ #if YYDEBUG # ifndef YYFPRINTF # ifdef __cplusplus # include <cstdio> /* INFRINGES ON USER NAME SPACE */ # else # include <stdio.h> /* INFRINGES ON USER NAME SPACE */ # endif # define YYFPRINTF YYSTD (fprintf) # endif (this is not the original cfg-grammar.c but regenerated locally). The following patch is bandaid but I am not sure how to do it portably enough (meaning - accounting for earlier bison versions). One possibility is of course move yyerror out of cfg-grammar.y to avoid confusion. -andrej --- syslog-ng-1.5.18/src/cfg-grammar.y.orig Thu May 30 11:39:06 2002 +++ syslog-ng-1.5.18/src/cfg-grammar.y Thu May 30 11:39:52 2002 @@ -698,6 +698,8 @@ extern int linenum; +#include <stdio.h> + void yyerror(char *msg) { fprintf(stderr, "%s at %d\n", msg, linenum);

2 1

syslog-ng 1.5.18 released
by Balazs Scheidler 30 May '02

30 May '02

Hi, I've released syslog-ng 1.5.18 with the folowing NEWS entry: News for the 1.5.18 release Wed, 29 May 2002 12:23:45 +0200 Changes: * fixed a crash bug when an UDP destination was unreachable In addition to this you can now specify log_prefix() for pipe sources. It can be downloaded from the usual places: http://www.balabit.hu/en/downloads/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1