- syslog-ng - lists.balabit.hu

TCP Connection Problem
by Roman Ernst 16 Nov '01

16 Nov '01

Hi! I have configured about 10 Host logging directly to another one (TCP!!!). Unfortunately I have the following problem: When I reboot this logging server then syslog-ng on all the other hosts crashes... Is there any work around or do you already know this bug? I think normal behavour should be trying to reconnect to the logging server... Thanks a lot for your help in advance! Roman Ernst

1 0

RE: [syslog-ng]Sample Solaris config
by Jamie McKnight 15 Nov '01

15 Nov '01

|> |>For the server. Sorry. |> Here is what I use. I have the Solaris 8 syslogd startup with -t so it does not listen to the network on the central log host. Then I have syslog-ng listening for the messages that come in from the network. Messages coming in from the network go to /data/logs/messages.$HOST unless they are su or op(sudo like) and I have those go into seperate files elsewhere for monitoring etc. Pretty generic and works for me. Your milage may vary. Syslog-ng version is 1.4.14. options { sync(0); chain_hostnames(no); }; # Starting with this version of syslog-ng we are letting Solaris syslogd handle # system messages, but start it with a "-t" to tell it not to listen to network # traffic. We then use syslog-ng to only listen on the network. source s_remote { udp(ip(0.0.0.0) port(514)); internal(); }; # Filter defs. How to break out the incoming messages. filter f_hosts { level(err..emerg) or ( facility(kern) and level(debug..emerg)) or ( facility(daemon) and level(notice..emerg)) or ( facility(mail) and level(crit..emerg)); }; filter f_subad { program(su) and match(root) and match(failed); }; filter f_sugood { program(su) and match(root) and match(succeeded); }; filter f_sucombined { program(su) and match(su:); }; filter f_opbad { program(op) and match (FAILED); }; filter f_opgood { program(op) and match (SUCCEDED); }; filter f_opcombined { program(op) and match(op:); }; filter f_panic { match(panic); }; filter f_reboot { match(Generic_); }; # Destination defs. Where the messages go destination d_subad { file("/data/logs/su/bad_su_attempts"); }; destination d_sugood { file("/data/logs/su/good_su_attempts"); }; destination d_sucombined { file("/data/logs/su/su_attempts"); }; destination d_opbad { file("/data/logs/op/bad_op_attempts"); }; destination d_opgood { file("/data/logs/op/good_op_attempts"); }; destination d_opcombined { file("/data/logs/op/op_attempts"); }; destination d_panic { file("/data/logs/panic.log"); }; destination d_reboot { file("/data/logs/reboot.log"); }; destination d_hostmsg { file("/data/logs/hosts/messages.$HOST"); }; # Log actions for messages generated remotely log { source(s_remote); filter(f_subad); destination(d_subad); }; log { source(s_remote); filter(f_sugood); destination(d_sugood); }; log { source(s_remote); filter(f_sucombined); destination(d_sucombined); }; log { source(s_remote); filter(f_opbad); destination(d_opbad); }; log { source(s_remote); filter(f_opgood); destination(d_opgood); }; log { source(s_remote); filter(f_opcombined); destination(d_opcombined); }; log { source(s_remote); filter(f_panic); destination(d_panic); }; log { source(s_remote); filter(f_reboot); destination(d_reboot); }; log { source(s_remote); filter(f_hosts); destination(d_hostmsg); }; Jamie

2 1

udp relays
by Ben Smee 15 Nov '01

15 Nov '01

heya, I have a number of different networks under my control and I am sure like many other people on this list, they are not all routable from one to the other. My problem is that I would like to have a central syslog server that all our machines log back to (yes I know there are other architectures I can use to get around this problem but for the moment I want to try to do it like this for some particular reasons). Given that there is no one network that can route to all others or visa versa, I am wondering what type of udp relays people in similar situations use. I should say that on each network there is in effect at least one machine that has visibility of another network, thus meaning you CAN get from one network to another so long as you authenticate to a socks/ firewall first. I have looked about for some good udp relays but I cant really find any. As far as I can tell syslog-ng doesnt support socks so I am looking for alternatives ... regards, -------------------- Benjamin Smee Technical Specialist Optus Business Operations (NAC) "YES" OPTUS ben.smee(a)optus.net.au Tel: +61-2-93420091 Fax: +61-2-93420998 Perilous to all of us are the devices of an art deeper than we possess ourselves. -- Gandalf the White

2 1

RE: [syslog-ng]Sample Solaris config
by Ohrberg, Mick 14 Nov '01

14 Nov '01

For a log client or log server? > -----Original Message----- > From: Chuck Kelly [mailto:chuck@qualcomm.com] > Sent: Wednesday, November 14, 2001 2:01 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Sample Solaris config > > > Anyone have a good sample Solaris 8 config? > > > -- > Chuck > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1

Almost garbled messages
by Nicholas Berry 14 Nov '01

14 Nov '01

The messages started coming in like this when I upgraded to syslog-ng 1.5.12, but upgraded to 1.5.13 still with no success to fixing this. The characters after the second mention of hostname and before the third mentioned hostname is what this email is about. Has anyone else seen this? Oct 26 00:15:03 smf-dist-01/smf-dist-01 ´<14>smf-dist-01, Bridge topology change, vlan 200, interface 4/9, changed state to forwarding Oct 26 19:29:07 smf-dist-01/smf-dist-01<14>smf-dist-01, Interface ethernet4/24, state up Oct 26 19:29:10 smf-dist-01/smf-dist-01 <14>smf-dist-01, Bridge topology change, vlan 200, interface 4/24, changed state to forwarding Oct 26 19:30:55 smf-dist-01/smf-dist-01 rw<14>smf-dist-01, Interface ethernet4/24, state up Oct 26 19:30:57 smf-dist-01/smf-dist-01 ü´<14>smf-dist-01, Interface ethernet4/24, state down Oct 26 19:31:04 smf-dist-01/smf-dist-01 GET <14>smf-dist-01, Bridge topology change, vlan 200, interface 4/24, changed state to forwarding Oct 26 22:02:56 smf-dist-01/smf-dist-01 ´<14>smf-dist-01, Interface ethernet3/7, state down Oct 26 22:03:02 smf-dist-01/smf-dist-01 árwta<14>smf-dist-01, Interface ethernet3/7, state up Oct 26 22:03:03 smf-dist-01/smf-dist-01 ´<14>smf-dist-01, Bridge topology change, vlan 201, interface 3/7, changed state to forwarding Oct 29 22:35:27 smf-dist-01/smf-dist-01 GET <14>smf-dist-01, Interface ethernet4/10, state down Oct 29 22:35:51 smf-dist-01/smf-dist-01 dxP"8<14>smf-dist-01, Interface ethernet4/10, state up Oct 30 08:01:31 smf-dist-01/smf-dist-01 ´<14>smf-dist-01, neteng logout from USER EXEC mode Oct 30 18:43:07 smf-dist-01/smf-dist-01 ÒP"<14>smf-dist-01, Bridge topology change, vlan 200, interface 4/6, changed state to forwarding Oct 30 18:53:13 smf-dist-01/smf-dist-01 GET <14>smf-dist-01, Interface ethernet4/6, state down Oct 30 18:53:17 smf-dist-01/smf-dist-01 GET <14>smf-dist-01, Interface ethernet4/6, state up Oct 30 22:19:40 smf-dist-01/smf-dist-01 &<14>smf-dist-01, Interface ethernet4/6, state down Oct 30 23:17:09 smf-dist-01/smf-dist-01 ´<14>smf-dist-01, Interface ethernet4/1, state down Oct 30 23:17:14 smf-dist-01/smf-dist-01 à<14>smf-dist-01, Interface ethernet4/1, state up Oct 30 23:17:16 smf-dist-01/smf-dist-01 ´<14>smf-dist-01, Bridge topology change, vlan 200, interface 4/2, changed state to forwarding Oct 31 00:57:40 smf-dist-01/smf-dist-01 00:56<14>smf-dist-01, Interface ethernet4/9, state down Oct 31 16:38:51 smf-dist-01/smf-dist-01 FDE<14>smf-dist-01, Interface ethernet4/6, state down Oct 31 16:38:57 smf-dist-01/smf-dist-01 árwta<14>smf-dist-01, Interface ethernet4/6, state up Oct 31 16:38:59 smf-dist-01/smf-dist-01 ´<14>smf-dist-01, Bridge topology change, vlan 200, I'm running syslog-ng 1.5.13 with libol-0.3.1 under Solaris 8 (SPARC). These messages are being reported from a Foundry NetIron 800 (L3 switches). Thanks, Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com

2 1

Sample Solaris config
by Chuck Kelly 14 Nov '01

14 Nov '01

Anyone have a good sample Solaris 8 config? -- Chuck

1 0

Sample Solaris config
by Chuck Kelly 14 Nov '01

14 Nov '01

Anyone have a good sample Solaris 8 config? -- Chuck

1 0

(no subject)
by Ben Smee 13 Nov '01

13 Nov '01

heya, rolling syslog-ng to a number of servers here and I have come across a couple of problems. I have build packages for a number of different solaris versions and the following is NOT version specific. I know that ALL the packages I have build work on their respective versions, yet sometimes when I install it i get the following error: # ./syslog-ng -d io.c: Preparing fd 5 for reading io.c: connecting using fd 6 syslog-ng version 1.4.13 starting io.c: Preparing fd 6 for writing io.c: Preparing fd 7 for writing Virtual memory exhaustedAbort - core dumped The fact that it mostly works and then suddenly wont makes me think it is a library error or something similar. Not all boxes have been built the same way so it is entirely feasible that some machines have things installed that others dont. My question is what? :) I checked the basic core packages and couldnt easily see the culprit ... Below is truss output ( sorry about the length) : # truss ./syslog-ng -d execve("./syslog-ng", 0xEFFFFDF8, 0xEFFFFE04) argc =3D 2 stat("syslog-ng", 0xEFFFFAF8) =3D 0 open("/var/ld/ld.config", O_RDONLY) Err#2 ENOENT open("/usr/lib/libpthread.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF7B0000 mmap(0x00000000, 81920, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF790000 mmap(0xEF7A2000, 5500, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 8192) =3D 0xEF7A2000 munmap(0xEF794000, 57344) =3D 0 memcntl(0xEF790000, 12160, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(3) =3D 0 open("/usr/lib/libdoor.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF7B0000 mmap(0x00000000, 73728, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF770000 mmap(0xEF780000, 3868, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF780000 munmap(0xEF772000, 57344) =3D 0 memcntl(0xEF770000, 2608, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(3) =3D 0 open("/usr/lib/libsocket.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF7B0000 mmap(0x00000000, 106496, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF750000 mmap(0xEF766000, 8185, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 24576) =3D 0xEF766000 open("/dev/zero", O_RDONLY) =3D 4 mmap(0xEF768000, 388, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) =3D 0xEF768000 munmap(0xEF758000, 57344) =3D 0 memcntl(0xEF750000, 12072, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(3) =3D 0 open("/usr/lib/libnsl.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF7B0000 mmap(0x00000000, 581632, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF680000 mmap(0xEF700000, 33204, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 458752) =3D 0xEF700000 mmap(0xEF70A000, 16272, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) =3D 0xEF70A000 munmap(0xEF6F2000, 57344) =3D 0 memcntl(0xEF680000, 70252, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(3) =3D 0 open("/usr/lib/libxnet.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF7B0000 mmap(0x00000000, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 4, 0) =3D 0xEF740000 close(3) =3D 0 open("/usr/lib/libc.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF730000 mmap(0x00000000, 712704, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF580000 mmap(0xEF624000, 29740, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 606208) =3D 0xEF624000 mmap(0xEF62C000, 3648, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) =3D 0xEF62C000 munmap(0xEF616000, 57344) =3D 0 memcntl(0xEF580000, 101988, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(3) =3D 0 open("/usr/lib/libdl.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0xEF730000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF730000 close(3) =3D 0 open("/usr/lib/libmp.so.2", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF720000 mmap(0x00000000, 81920, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF660000 mmap(0xEF672000, 3581, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 8192) =3D 0xEF672000 munmap(0xEF664000, 57344) =3D 0 memcntl(0xEF660000, 3020, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(3) =3D 0 open("/usr/platform/SUNW,Ultra-5_10/lib/libc_psr.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF6FC) =3D 0 mmap(0xEF720000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF720000 mmap(0x00000000, 16384, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF650000 close(3) =3D 0 open("/usr/lib/libthread.so.1", O_RDONLY) =3D 3 fstat(3, 0xEFFFF894) =3D 0 mmap(0xEF720000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) =3D 0xEF720000 mmap(0x00000000, 204800, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =3D 0xEF540000 mmap(0xEF566000, 9584, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 90112) =3D 0xEF566000 mmap(0xEF56A000, 28580, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) =3D 0xEF56A000 munmap(0xEF558000, 57344) =3D 0 memcntl(0xEF540000, 25132, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(3) =3D 0 close(4) =3D 0 munmap(0xEF720000, 8192) =3D 0 brk(0x00038EC0) =3D 0 sysconfig(_CONFIG_PAGESIZE) =3D 8192 sigfillset(0xEF62BBE4) =3D 0 lwp_self() =3D 1 lwp_self() =3D 1 sigprocmask(SIG_SETMASK, 0x00000000, 0xEFFFF980) =3D 0 sigprocmask(SIG_SETMASK, 0xEF567D90, 0x00000000) =3D 0 sigaction(SIGLWP, 0xEF5683D0, 0x00000000) =3D 0 sigaction(SIGCANCEL, 0xEF5683D0, 0x00000000) =3D 0 sigaction(SIGSEGV, 0xEF5683D0, 0x00000000) =3D 0 brk(0x00038EC0) =3D 0 brk(0x0003AEC0) =3D 0 open("/dev/zero", O_RDWR) =3D 3 mmap(0x00000000, 8454144, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_NORESERVE, 3, 0) =3D 0xEEC00000 close(3) =3D 0 mprotect(0xEEC00000, 8192, PROT_NONE) =3D 0 mprotect(0xEED02000, 8192, PROT_NONE) =3D 0 mprotect(0xEEE04000, 8192, PROT_NONE) =3D 0 mprotect(0xEEF06000, 8192, PROT_NONE) =3D 0 mprotect(0xEF008000, 8192, PROT_NONE) =3D 0 mprotect(0xEF10A000, 8192, PROT_NONE) =3D 0 mprotect(0xEF20C000, 8192, PROT_NONE) =3D 0 mprotect(0xEF30E000, 8192, PROT_NONE) =3D 0 lwp_create(0xEFFFF6B8, 0x0100, 0xEF40FE04) =3D 2 lwp_create(0xEFFFF6B8, 0x0100, 0xEF40FE04) =3D -276885348 door_create(0xEF552728, 0x00000000, 0x00000002) =3D 3 getpid() =3D 18009 [18008] lwp_schedctl(SC_STATE|SC_BLOCK, 3, 0xEFFFF8BC) =3D 0 door_info(3, 0xEF56A7A8) =3D 0 open("/dev/zero", O_RDWR) =3D 4 mmap(0x00000000, 24576, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_NORESERVE, 4, 0) =3D 0xEF640000 close(4) =3D 0 mprotect(0xEF640000, 8192, PROT_NONE) =3D 0 lwp_create(0xEFFFF6A0, 0x00C0, 0xEF645E04) =3D 3 lwp_continue(3) =3D 0 lwp_create(0x00000001, 0x6000, 0xEFFFF83C) =3D 0 close(3) =3D 0 lwp_schedctl(SC_STATE|SC_BLOCK, -1, 0xEF645D0C) =3D 0 lwp_schedctl(SC_DOOR, 0, 0x00000000) =3D 3 door_bind(3) =3D 0 close(3) =3D 0 sigaction(SIGWAITING, 0xEF567C00, 0x00000000) =3D 0 lwp_self() =3D 1 open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) =3D 3 brk(0x0003AEC0) =3D 0 brk(0x0003EEC0) =3D 0 ioctl(3, TCGETA, 0xEFFFFADC) Err#25 ENOTTY fstat64(3, 0xEFFFF498) =3D 0 brk(0x0003EEC0) =3D 0 brk(0x00040EC0) =3D 0 ioctl(3, TCGETA, 0xEFFFF424) Err#25 ENOTTY read(3, " # A u t h o r : B e".., 8192) =3D 1415 read(3, 0x0003D7F4, 8192) =3D 0 brk(0x00040EC0) =3D 0 brk(0x00042EC0) =3D 0 ioctl(3, TCGETA, 0xEFFFF4FC) Err#25 ENOTTY llseek(3, 0, SEEK_CUR) =3D 1415 close(3) =3D 0 open("/dev/log", O_RDONLY|O_NONBLOCK|O_NOCTTY) =3D 3 ioctl(3, I_STR, 0xEFFFFB80) =3D 0 stat("/etc/.syslog_door", 0xEFFFFAC0) =3D 0 umount("/etc/.syslog_door") =3D 0 door_create(0x0001E018, 0x00000000, 0x00000000) =3D 4 getpid() =3D 18009 [18008] lwp_create(0xEFFFF680, 0x00C0, 0xEF20BE04) =3D 4 lwp_continue(4) =3D 0 lwp_create(0xEFFFF680, 0x00C0, 0xEF20BE04) =3D 147456 lwp_self() =3D 4 lwp_schedctl(SC_STATE, -1, 0xEF20BD6C) =3D 0 yield() =3D 0 ioctl(4, I_CANPUT, 0x00000000) Err#89 ENOSYS door_info(4, 0xEFFFFA28) =3D 0 mount("", "/etc/.syslog_door", MS_DATA, "namefs", 0xEFFFFA24, 4) =3D 0 so_socket(2, 1, 17, "", 1) =3D 5 fcntl(5, F_GETFL, 0x00000000) =3D 2 fstat64(5, 0xEFFFF908) =3D 0 getsockopt(5, 65535, 8192, 0xEFFFFA0C, 0xEFFFFA04) =3D 0 fstat64(5, 0xEFFFF908) =3D 0 getsockopt(5, 65535, 8192, 0xEFFFFA0C, 0xEFFFFA08) =3D 0 setsockopt(5, 65535, 8192, 0xEFFFFA0C, 4) =3D 0 fcntl(5, F_SETFL, 0x00000082) =3D 0 fcntl(5, F_SETFD, 0x00000001) =3D 0 setsockopt(5, 65535, 4, 0xEFFFFA98, 4) =3D 0 bind(5, 0xEFFFFAA0, 16) =3D 0 fcntl(5, F_GETFL, 0x00038400) =3D 130 fstat64(5, 0xEFFFF908) =3D 0 getsockopt(5, 65535, 8192, 0xEFFFFA0C, 0xEFFFFA04) =3D 0 fstat64(5, 0xEFFFF908) =3D 0 getsockopt(5, 65535, 8192, 0xEFFFFA0C, 0xEFFFFA08) =3D 0 setsockopt(5, 65535, 8192, 0xEFFFFA0C, 4) =3D 0 fcntl(5, F_SETFL, 0x00000082) =3D 0 fcntl(5, F_SETFD, 0x00000001) =3D 0 io.c: Preparing fd 5 for reading write(2, " i o . c : P r e p a r".., 33) =3D 33 so_socket(2, 1, 17, "", 1) =3D 6 fcntl(6, F_GETFL, 0x00000000) =3D 2 fstat64(6, 0xEFFFF908) =3D 0 getsockopt(6, 65535, 8192, 0xEFFFFA0C, 0xEFFFFA04) =3D 0 fstat64(6, 0xEFFFF908) =3D 0 getsockopt(6, 65535, 8192, 0xEFFFFA0C, 0xEFFFFA08) =3D 0 setsockopt(6, 65535, 8192, 0xEFFFFA0C, 4) =3D 0 fcntl(6, F_SETFL, 0x00000082) =3D 0 fcntl(6, F_SETFD, 0x00000001) =3D 0 io.c: connecting using fd 6 write(2, " i o . c : c o n n e c".., 28) =3D 28 open("/etc/netconfig", O_RDONLY) =3D 7 fstat64(7, 0xEFFFF238) =3D 0 brk(0x00042EC0) =3D 0 brk(0x00044EC0) =3D 0 ioctl(7, TCGETA, 0xEFFFF1C4) Err#25 ENOTTY read(7, " #\n # T h e " N e t".., 8192) =3D 1064 read(7, 0x0004111C, 8192) =3D 0 llseek(7, 0, SEEK_CUR) =3D 1064 llseek(7, 0, SEEK_SET) =3D 0 read(7, " #\n # T h e " N e t".., 8192) =3D 1064 read(7, 0x0004111C, 8192) =3D 0 llseek(7, 0, SEEK_CUR) =3D 1064 close(7) =3D 0 open64("/etc/.name_service_door", O_RDONLY) =3D 7 fcntl(7, F_SETFD, 0x00000001) =3D 0 door_info(7, 0xEF62BA68) Err#9 EBADF close(7) =3D 0 open("/etc/nsswitch.conf", O_RDONLY) =3D 7 fstat64(7, 0xEFFFD440) =3D 0 ioctl(7, TCGETA, 0xEFFFD3CC) Err#25 ENOTTY read(7, " #\n # / e t c / n s s".., 8192) =3D 690 read(7, 0x0004111C, 8192) =3D 0 llseek(7, 0, SEEK_CUR) =3D 690 close(7) =3D 0 open("/usr/lib/nss_files.so.1", O_RDONLY) =3D 7 fstat(7, 0xEFFFD3AC) =3D 0 mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 7, 0) =3D 0xEF530000 mmap(0x00000000, 81920, PROT_READ|PROT_EXEC, MAP_PRIVATE, 7, 0) =3D 0xEF510000 mmap(0xEF522000, 6788, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 7, 8192) =3D 0xEF522000 munmap(0xEF514000, 57344) =3D 0 open("/dev/zero", O_RDONLY) =3D 8 mmap(0x00000000, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 8, 0) =3D 0xEF500000 memcntl(0xEF510000, 4936, MC_ADVISE, 0x0003, 0, 0) =3D 0 close(7) =3D 0 close(8) =3D 0 munmap(0xEF530000, 8192) =3D 0 open("/etc/hosts", O_RDONLY) =3D 7 fstat64(7, 0xEFFFD3A0) =3D 0 ioctl(7, TCGETA, 0xEFFFD32C) Err#25 ENOTTY read(7, " #\n # I n t e r n e t".., 8192) =3D 8192 llseek(7, 0xFFFFFFFFFFFFE058, SEEK_CUR) =3D 88 close(7) =3D 0 connect(6, 0xEFFFFAA0, 16) =3D 0 syslog-ng version 1.4.13 starting write(2, " s y s l o g - n g v e".., 34) =3D 34 sigaction(SIGPIPE, 0xEFFFFB00, 0xEFFFFC00) =3D 0 sigaction(SIGHUP, 0xEFFFFB00, 0xEFFFFC00) =3D 0 sigaction(SIGTERM, 0xEFFFFB00, 0xEFFFFC00) =3D 0 sigaction(SIGCLD, 0xEFFFFB00, 0xEFFFFC00) =3D 0 time() =3D 1005608296 poll(0xEFFFFC18, 3, 100) =3D 2 getsockopt(6, 65535, 4103, 0xEFFFFBA4, 0xEFFFFBA0) =3D 0 fcntl(6, F_GETFL, 0x00038400) =3D 130 fstat64(6, 0xEFFFF878) =3D 0 getsockopt(6, 65535, 8192, 0xEFFFF97C, 0xEFFFF974) =3D 0 fstat64(6, 0xEFFFF878) =3D 0 getsockopt(6, 65535, 8192, 0xEFFFF97C, 0xEFFFF978) =3D 0 setsockopt(6, 65535, 8192, 0xEFFFF97C, 4) =3D 0 fcntl(6, F_SETFL, 0x00000082) =3D 0 fcntl(6, F_SETFD, 0x00000001) =3D 0 door_return(0x00000000, 0, 0x00000000, 0) =3D 0 io.c: Preparing fd 6 for writing write(2, " i o . c : P r e p a r".., 33) =3D 33 open("/dev/zero", O_RDWR) =3D 7 mmap(0x00000000, 24576, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_NORESERVE, 7, 0) =3D 0xEF530000 close(7) =3D 0 mprotect(0xEF530000, 8192, PROT_NONE) =3D 0 lwp_create(0xEF645A38, 0x00C0, 0xEF535E04) =3D 5 lwp_continue(5) =3D 0 lwp_create(0x00000001, 0x6000, 0xEF645BD4) =3D 0 lwp_schedctl(SC_STATE|SC_BLOCK, -1, 0xEF535D0C) =3D 0 getmsg(3, 0xEFFFD2F0, 0xEFFFD2B0, 0xEFFFD26C) =3D 0 lwp_schedctl(SC_DOOR, 0, 0x00000000) =3D 7 door_bind(7) =3D 0 close(7) =3D 0 sigaction(SIGWAITING, 0xEF567C20, 0x00000000) =3D 0 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 uname(0xEFFFCBF8) =3D 1 open("/usr/share/lib/zoneinfo/Australia/NSW", O_RDONLY) =3D 7 read(7, "\0\0\0\0\0\0\0\0\0\0\0\0".., 8192) =3D 785 close(7) =3D 0 open("/var/adm/syslog-local", O_WRONLY|O_APPEND|O_NONBLOCK|O_CREAT|O_NOCTTY, 0600) =3D 7 chown("/var/adm/syslog-local", 0, 0) =3D 0 fcntl(7, F_GETFL, 0x00038400) =3D 137 fstat64(7, 0xEFFFCDC0) =3D 0 fstat64(7, 0xEFFFCDC0) =3D 0 fcntl(7, F_SETFL, 0x00000089) =3D 0 fcntl(7, F_SETFD, 0x00000001) =3D 0 io.c: Preparing fd 7 for writing write(2, " i o . c : P r e p a r".., 33) =3D 33 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 brk(0x00044EC0) =3D 0 brk(0x00046EC0) =3D 0 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 brk(0x00046EC0) =3D 0 brk(0x00048EC0) =3D 0 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 time() =3D 1005608296 poll(0xEFFFFC10, 4, 100) =3D 2 write(7, " N o v 1 3 1 0 : 3 8".., 4096) =3D 4096 Virtual memory exhaustedwrite(2, " V i r t u a l m e m o".., 24) =3D 24 sigaction(SIGABRT, 0x00000000, 0xEFFFE870) =3D 0 llseek(0, 0, SEEK_CUR) =3D 67186 sigaction(SIGABRT, 0xEFFFE6C0, 0xEFFFE7C0) =3D 0 sigprocmask(SIG_SETMASK, 0xEF570A90, 0xEFFFE728) =3D 0 sigprocmask(SIG_SETMASK, 0xEF570A90, 0xEFFFE488) =3D 0 lwp_kill(1, SIGABRT) =3D 0 sigprocmask(SIG_SETMASK, 0xEFFFE728, 0x00000000) =3D 0 Received signal #6, SIGABRT [default] siginfo: SIGABRT pid=3D18009 uid=3D0 code=3D-1 *** process killed *** # -------------------- Benjamin Smee Technical Specialist Optus Business Operations (NAC) "YES" OPTUS ben.smee(a)optus.net.au Tel: +61-2-93420091 Fax: +61-2-93420998 Perilous to all of us are the devices of an art deeper than we possess ourselves. -- Gandalf the White

1 0

Seeking suggestions on a secure central syslog-ng setup..
by Sean McNamara 12 Nov '01

12 Nov '01

Hello all, First of all, please excuse me if this is off-topic; but seeing as I'm looking for something which will interface/work with syslog-ng, I thought that this would be as good of a place as any to get a start. To move on... We're currently running two central syslog servers (specifically syslog-ng) on Solaris 8/Sparc, and are investigating methods of setting up a central location where these logs may be processed (i.e. searching, alert generation, etc.) and viewed via a web-enabled console of some sorts that, ideally offers some method for access control to define varying levels of access to log reports, raw data, etc. Though, that would be ideal, it's by no means _absolutely_ necessary. My current idea is as follows: to have a third server that acts as the 'processing/viewing' server which NFS (ala WVrpcbind for security) mounts the log directories on the remote logserver, and does the processing remotely, rather than on the already burdened logserver. I'm sure this is no amazing idea.. however, I'm just not sure I've reviewed all of my options as far as what would be doing the processing portion of the task. We have a large variety of logs maintained at these locations, amongst them, named(BIND), DHCP, PIX(firewall), IPFilters, RADIUS(Interlink Networks), ssh, inetd, authlog(i.e. login attempts/failures), kernel logs, etc., etc. so, yet another consideration in addition to all mentioned is for the software to have the ability to, at least somewhat be able to parse the logfile data in order to generate alerts, and in some cases (if there exists an 'access control' feature), allow for some of the logfile data to be 'sugar coated', that is- basically to simplify information from the raw logs to cater to less technical individuals, e.g. helpdesk staff, etc, who may have a need to view specific log data, but may not be able to (or have the will to) read the technical details of raw log files. I know I've specified a bit of a wishlist beyond just basic syslog log viewing/reporting, but I supposed I ought to aim high and see what comes out of it. I'm toying with the idea of writing such a system such as above, but, I don't know if I have the time to dedicate to it; so I'm hoping that at least something will come somewhere close. So, this is where I turn it over to you -- can anyone give me any examples of how you may have managed a situation like this? Or specifically of any software available to do as I described? Any comments, examples, or pointers to resources would be greatly appreciated. Many thanks in advance, ..Sean R. McNamara. Network Systems Administrator, Villanova University UNIT- Data Network Services

1 0

Syslog-ng crash
by Roman Ernst 12 Nov '01

12 Nov '01

Hello, I have been using syslog-ng now for several weeks. Unfortunately from time to time it hangs up with the following error report (AIX - errpt): ====================================================================================================== errpt -a --------------------------------------------------------------------------- LABEL: CORE_DUMP IDENTIFIER: C60BB505 Date/Time: Mon Nov 12 14:09:22 Sequence Number: 767 Class: S Type: PERM Resource Name: SYSPROC Description SOFTWARE PROGRAM ABNORMALLY TERMINATED Probable Causes SOFTWARE PROGRAM User Causes USER GENERATED SIGNAL Recommended Actions CORRECT THEN RETRY Failure Causes SOFTWARE PROGRAM Recommended Actions RERUN THE APPLICATION PROGRAM IF PROBLEM PERSISTS THEN DO THE FOLLOWING CONTACT APPROPRIATE SERVICE REPRESENTATIVE Detail Data SIGNAL NUMBER 6 USER'S PROCESS ID: 25968 FILE SYSTEM SERIAL NUMBER 5 INODE NUMBER 4480 PROGRAM NAME syslog-ng ADDITIONAL INFORMATION pthread_k 88 ?? _p_raise 64 raise 34 abort B8 fatal[DS] 48 xalloc 2C ol_string 24 c_format 60 do_flush CC write_cal E8 io_iter 4C4 main_loop 19C main 450 __start 8C Symptom Data REPORTABLE 1 INTERNAL ERROR 0 SYMPTOM CODE PCSS/SPI2 FLDS/syslog-ng SIG/6 FLDS/main_loop VALU/19c ====================================================================================================== Would be great if somebody could fix this... if you need more information don't hesitate to contact me... Best regards Roman Ernst

1 0