- syslog-ng - lists.balabit.hu

syslog-ng-1.5.15 with tcp-wrapper support
by Stefan M. Brandl 12 Apr '02

12 Apr '02

Hi, I tried to compile syslog-ng-1.5.15 with tcp-wrapper support but had no success. First I had to patch afinet.c with the patch mentioned in http://lists.balabit.hu/pipermail/syslog-ng/2002-February/002962.html But when compiling I get: make[3]: Entering directory `/root/syslog-ng-1.5.15/src' make_class <afinet.c >afinet.c.xT Warning: use of macro doesn't match definition (syntax-rules '() ((let-and (expr) clause clauses ...) (and expr (let-and clause clauses ...))) ((let-and (name expr) clause clauses ...) (let ((name expr)) (and name (let-and clause clauses ...)))) ((let-and expr) expr)) Error: attempt to call a non-procedure ('syntax-error '(#{Name let-and} ((pair? expr)) (op-matches (match # #)) (arg-matches (match # #)) (append op-matches arg-matches)) '#{Procedure 2489 (unnamed in make-name-generator in names)} '#{Procedure 2486 (unnamed in make-keyword-comparator in names)}) make[3]: *** [afinet.c.x] Error 1 make[3]: Leaving directory `/root/syslog-ng-1.5.15/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/syslog-ng-1.5.15/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/root/syslog-ng-1.5.15/src' make: *** [all-recursive] Error 1 Is this a know problem or am I missing something? Regards Stefan

3 2

Re: [syslog-ng]syslog-ng-1.5.15 with tcp-wrapper support
by Stefan M. Brandl 12 Apr '02

12 Apr '02

Ed Ravin eravin(a)panix.com wrote: > This is a bug of some kind in make_class, which comes with the lib-ol > package (and is probably installed in your /usr/local/bin). A kind soul > on the syslog-ng list turned in this patch to fix make_class (you'll > want to edit by hand or apply with "patch -l" since I'm screwing up > the whitespace by posting it this way). > > --- /usr/local/bad/make_class Wed Feb 6 15:59:34 2002 > +++ ./make_class Wed Mar 6 12:10:32 2002 > @@ -19,7 +19,7 @@ > ;; FIXME: Turn this into a scheme48 module > > (define-syntax let-and > - (syntax-rules '() > + (syntax-rules () > ((let-and (expr) clause clauses ...) > (and expr (let-and clause clauses ...))) > ((let-and (name expr) clause clauses ...) Great, this works. Thanks Stefan

1 0

Newbie: System inter-process communication ?
by Jacques.Riopel＠equant.com 11 Apr '02

11 Apr '02

Hi all. Using syslog-ng version 1.4.15. I'm trying to set up a network of machines all running syslog-ng in a testbed. Some machines run Solaris 5.8, others are Sun-Cobalts runing a flavor of Linux. I have successfully compiled when necessary and replaced all the syslogd with syslog-ng on my 4 test machines. Now the hard part is making them all talk to each other, and discovering how to set them to use different ports and TCP vs UDP in some cases. I have the following questions so far: Question 1: Is it possible to specify the upd port to listen on, ie something like "source s_udp { udp (666); };" and then instruct the syslog-ng on the sending machine to use that UDP port as a destination? When I tried the above, I got a parsing error when starting up syslog-ng. My whole test scenario is to have one machine called "A1" at the top level "A", that will listen on port 514 for syslog messages using a TCP connection from machine "B1" at level "B". Machine "B1" is a syslog consolidator, that passes syslog messages to A1 over TCP(514) and receives syslogs from other machines "C1", "C2" on level "C". I want to try to configure machine "C1" to output to machine "B1" using UDP(514), and at the same time have machine "C2" forward its syslogs to machine "B1" using TCP(514). It's possible to have many machines at level "C" all writing to machine "B1"'s port TCP(514), right? For the bonus point, can someone help me with the pertinent syntax for source, destination and log statements for my 4 machines? My job depends on me making this work... 8-) (If someone can replace my generic code below with exact code that will be parsed OK...) Machine A1 (10.5.11.9 - Solaris 5.8) source s_tcp { }; destination d_jnr { usertty("jnriopel"); }; log { source (s_tcp); destination (d_jnr); }; Machine B1 (10.5.10.4 - Linux) source s_tcp { frommachineC2}; source s_udp { frommachineC1}; destination d_tcp { tomachineA1 }; log { source (s_tcp, s_udp); destination (d_tcp); }; Machine C1 (10.5.2.8 - Linux) source src {unix stream }; destination d_udptoB1 { udp (machineB1 }; log { source (src); destination (d_udptoB1); }; Machine C2 (10.5.2.16 - Linux) source src {unix stream }; destination d_TCPtoB1 { tcp (machineB1 }; log { source (src); destination (d_TCPtoB1); }; Question 2: PMI, but I understand from my IP theory that I can send messages to another machine using UDP whether that machine is listening or not and not get errors, whereas is I want to talk using TCP, the machine I am talking to needs to have a listen set up first, ie I need to have syslog-ng running on A1 before I can start it on B1 otherwise B1 will complain about not being able to set up the connection, right? Will messages get lost or queued while waiting for A1 to start listening? Question 3: What is the syntax of the source and destination statements for two machines using syslog-ng and wanting to communicate over TCP port 666, say? (As in my link between A1 and B1 above except for the non-standard port number.) Jacques

2 1

program destination, not respawning programs ?
by Thomas Ackermann 11 Apr '02

11 Apr '02

hy! i'm using syslog-ng to send remote log messages over an stunnel to a log server. everything's running quite fine, besides one little problem i have.. i'm starting the stunnel with program("/usr/sbin/stunnel -r 192.168.3.125:6543 -c"); when the stunnel is killed or quits because of a bad connection, syslog-ng doesn't even bother 'bout trying to restart it. is that a wanted behaviour and, or, is there a way to gat syslog-ng to respawn processes called with program() ? thx, thomas

1 0

Re: [syslog-ng]hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 11 Apr '02

11 Apr '02

Hmm OK, how should I set the permissions of the file? Thanks, Bret Balazs Scheidler <bazsi(a)balabit.hu> 11/04/2002 03:26 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: (bcc: WATSON Bret/IT/CHRT/ST Group) Subject: Re: [syslog-ng]hosts... today's stupid question :} On Thu, Apr 11, 2002 at 08:18:51AM +0800, bretwatson(a)charteredsemi.com wrote: > Hi Bazsi, > but it is listed as a valid macro and digging through the code it is > actually there as in the macroexpansion proc... > > does that mean not all macro identifiers are currently being expanded? > Which ones are valid? > > destination host { file("/usr/log1/$HOST/$YEAR$MONTH$DAY" owner(root) group(logusers) perm(0640) dir_perm(0755)); }; ^^^^ macros are not reserved words, I meant the name of your destination. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Re: [syslog-ng]hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 11 Apr '02

11 Apr '02

Hi Bazsi, but it is listed as a valid macro and digging through the code it is actually there as in the macroexpansion proc... does that mean not all macro identifiers are currently being expanded? Which ones are valid? Cheers Bret Balazs Scheidler <bazsi(a)balabit.hu> 10/04/2002 05:26 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: (bcc: WATSON Bret/IT/CHRT/ST Group) Subject: Re: [syslog-ng]hosts... today's stupid question :} On Wed, Apr 10, 2002 at 08:22:26AM +0800, bretwatson(a)charteredsemi.com wrote: > > Hi All, > a stupid question most probably, > I'd like to build a generic destination for my default filter so that any > new hosts get dropped into their own directory > > something like > destination host { file("/usr/log1/$HOST/$YEAR$MONTH$DAY" owner(root) > group(logusers) perm(0640) dir_perm(0755)); }; > > But syslog-ng doesn't seem to like it and complains of syntax errors all > the time.. host is a reserved word, don't use it for identifiers. the best bet is to prefix identifiers with the purpose, e.g. d_host for destination f_host for filters and so on. It will not collide with reserved words then. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

2 1

Re: [syslog-ng]hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 11 Apr '02

11 Apr '02

hmm must have been a typo somewhere in the command - I started afresh and now it works :} Cheers, Bret [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

1 0

[PATCH] Unixtime (again)
by Gert Menke 10 Apr '02

10 Apr '02

Hi! Here's my Unixtime-Patch again, this time against syslog-ng-1.5.15. Balazs, I understand that you don't have much time, but please tell me what you think of it and if you will include it in 1.5.16, or why you won't. Also, I would like to have an option do define one or more default templates, perhaps like this: template t_unixtime { "$S_UNIXTIME $R_UNIXTIME $SOURCEIP $HOST $MSG\n" }; template t_isotime { "$S_ISOTIME $R_ISOTIME $SOURCEIP $HOST $MSG\n" }; destination d_foo { file("foo.log"); template(t_unixtime); }; destination d_bar { file("bar.log"); template(t_unixtime); }; destination d_human-readable { file("human-readable.log"); template(t_isotime); }; How can I do this? Could you help me implementing it? Greetings Gert

1 0

hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 10 Apr '02

10 Apr '02

Hi All, a stupid question most probably, I'd like to build a generic destination for my default filter so that any new hosts get dropped into their own directory something like destination host { file("/usr/log1/$HOST/$YEAR$MONTH$DAY" owner(root) group(logusers) perm(0640) dir_perm(0755)); }; But syslog-ng doesn't seem to like it and complains of syntax errors all the time.. Any hints? Thanks, Bret [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

2 1

RE: Passing IP address to a program
by Kevin Welch 09 Apr '02

09 Apr '02

Ignore that, its early. -----Original Message----- From: Kevin Welch Sent: Tuesday, April 09, 2002 8:04 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: Passing IP address to a program When my log events come in, I want to pass some of them to an external program to e-mail them, since the log event does not contain the ip address of the host, is there a way to pass this information along with the syslog event? -- Kevin

1 0