- syslog-ng - lists.balabit.hu

Linefeed in incoming messages
by Michael.Garvin＠carolinabroadband.com 18 Apr '01

18 Apr '01

We have a piece of network equipment which appears to be logging in a not entirely friendly fashion (to be politically correct), in that it is including a linefeed (0x0a ASCII hex) in log messages for formatting purposes. Unfortunately, from what I can tell syslog-ng 1.4.11 is getting confused with the linefeed, so the log message up to the linefeed is getting logged correctly but the part after the linefeed is being prepended to the next incoming message. Therefore the filter for this unit is applied to the first part, resulting in it being written to its file, but the filter for the next message is applied to the remainder (the next message plus the prepended remainder from the previous). (Yes, I know it's confusing, I've just spent a while tracking it down. I can provide additional detail if needed...) My question is, is there somewhere in the syslog-ng code where I can easily parse the incoming syslog message and replace linefeeds with something benign, such as spaces or tabs? Or is there another solution that would be better? In the meantime we're opening a bug with the vendor since I consider this their issue, but knowing vendors I'm not confident in their addressing the problem quickly. Thanks for any help... And thanks for syslog-ng! -- Michael Garvin mailto:mgarvin@carolinabroadband.com

3 2

Can't send log to destination machine
by Rodrigo Pace de Barros 17 Apr '01

17 Apr '01

Hi... that's my problem... I can generate logs and store them in the local machine, but when i try to configure the syslog-ng.conf with the DESTINATION sending the results to other machine, this doesn't work.... I've tried this in the syslog-ng.conf: destination log_host { udp (ip(xxx.xxx.xxx.xxx) port(xxxxx));}; and destination log_host { udp xxx.xxx.xxx.xxx,xxx }; |-------------| |-| IP Port How can i do that? Are them both incorrect? (or no?) Thank's for your help! Best regards... -- ---------------------- Rodrigo Pace de Barros - pace(a)acme-ids.org ---------------------- Acme! - Advanced Counter-measures Environment Computer Security Research Ciencia da Computacao - Unesp - S. J. Rio Preto - Brasil ----------------------

2 1

Compiling in Socksification with Syslog-ng
by Matt Weatherford 15 Apr '01

15 Apr '01

Forgive me if this is a faq, but has any one out there compiled in socksification with Syslog ng? Any pointers or gotchas or discussions of "where the landmines are buried" would be helpful... thanks, Matt

1 0

chmod() and template escaping for pipes
by Balazs Scheidler 14 Apr '01

14 Apr '01

Hi, The patch below adds chmod() calls for created directories and files so they are created with modes independent from the current umask. The other change adds the template-escape() option for pipes. This will be integrated into the next release. Index: affile.c =================================================================== RCS file: /var/cvs/syslog-ng/src/affile.c,v retrieving revision 1.35 diff -u -r1.35 affile.c --- affile.c 2001/03/30 15:02:31 1.35 +++ affile.c 2001/04/14 07:56:51 @@ -78,6 +78,7 @@ if (mkdir(name->data, dir_mode) == -1) return 0; chown(name->data, dir_uid, dir_gid); + chmod(name->data, dir_mode); } *p = '/'; p = strchr(p + 1, '/'); @@ -85,6 +86,7 @@ *fd = open(name->data, flags, mode); } chown(name->data, uid, gid); + chmod(name->data, mode); return *fd != -1; } Index: cfg-grammar.y =================================================================== RCS file: /var/cvs/syslog-ng/src/cfg-grammar.y,v retrieving revision 1.41 diff -u -r1.41 cfg-grammar.y --- cfg-grammar.y 2001/03/30 15:02:31 1.41 +++ cfg-grammar.y 2001/04/14 07:56:51 @@ -398,6 +398,7 @@ | KW_GROUP '(' string ')' { affile_set_group(last_dest_driver, $3); free($3); } | KW_PERM '(' NUMBER ')' { affile_set_perm(last_dest_driver, $3); } | KW_FILE_TEMPLATE '(' string ')' { affile_set_file_template(last_dest_driver, $3); free($3); } + | KW_TEMPLATE_ESCAPE '(' yesno ')' { affile_set_template_escape(last_dest_driver, $3); } ; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

syslog-ng problem description(again)
by Bencsath Boldizsar 13 Apr '01

13 Apr '01

So the exact problem was the following, who missed it: syslog-ng doesn't start if a unix socket soruce exists in the config file ( source src { unix-stream("/dev/log"); internal(); file("/proc/kmsg"); }; ) strace: [pid 14144] unlink("/dev/log") = -1 ENOENT (No such file or directory) [pid 14144] bind(4, {sin_family=AF_UNIX, path=" /dev/log"}, 110) = -1 EPERM (Operation not permitted) (Apr 12 19:02:24 db rsbac_adf_request_rc(): rsbac_get_attr() returned error -1017! Apr 12 19:02:24 db rsbac_adf_request(): request READ_WRITE_OPEN, caller_pid 15361, caller_prog_name syslog-ng, caller_uid 0, target-type IPC, tid ???-ID 134521299, attr sockaddr, value 3437575888, result NOT_GRANTED by RC) Two problems: why has the bind command 110 bytes path attribute, why not only "/dev/log". But: However why does rsbac stops at such ipc requests. workaround: delete unix-stream from the syslog-ng config file. problem on: 2.4.3+rsbac 1.2.1 pre 1 , 1.1.1, no problem on emergency kernel (I'm not really sure cause at one boot it said there is some problem but after that it worked) with: syslog-ng (potato,unstable) in debian, and syslog-ng 1.4.11 and 1.5.5a from source boldi

2 3

reopening of udp connections
by klaas.vangend＠philips.com 13 Apr '01

13 Apr '01

Hi, We use syslog-ng to log messages from our Linux PC to one or more Windows NT PCs running a propriatary tool to display and maintain log and statistics information of a Linux app. Approx every second a log message is sent using UDP. Unfortunately, if the NT log application is not running, the NT box returns an ICMP message, stating that the chosen UDP port number is not listened to. Then syslog-ng pauses sending UDP logs, and retries after 60 seconds. It also logs a message stating that the UDP connection was broken. (which isn't true because UDP doesn't create connections) If succesfull, it then sends all (?) accumulated log messages at once. If our NT app starts immediately after syslog-ng paused, we don't receive any logging for 59 seconds... This is unwanted behaviour for our system. I know that I can have syslog-ng retry more often, but I don't want retries. Every UDP packet should "just disappear" if not delivered, and every packet should be sent anyway, thus having "below second" responsetime. (This is what happens if NT didn't return those darn ICMP messages). How should I proceed? -- Groetjes, Klaas --------------------------------------------------------------------- Philips CryptoWorks 040-2722600 klaas.vangend(a)philips.com Sioux Technische Software Ontwikkeling BV 040-2677100 klaas.van.gend(a)sioux.nl

2 1

Re: question
by Balazs Scheidler 13 Apr '01

13 Apr '01

On Thu, Apr 12, 2001 at 04:03:08PM -0400, Andrew Ryder wrote: > Any planned support for injection into mysql logs? you could use the tamplate feature in 1.5.5 and pipes: destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO log (date, host) VALUES ('$YEAR-$MONTH-$DAY', '$HOST')\n") template-escape(yes) }; and run mysql client reading sql from the pipe: mysql -h <host> LOG < /tmp/mysql.pipe of course the pipe should be located some protected directory with appropriate permissions. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

log statement parsing
by John_Delisle＠ceridian.ca 12 Apr '01

12 Apr '01

Hi guys, Anyone know how syslog-ng handles the log statements when you have two log statements that would apply? I think this will make more sense after looking at the example. source s_src { unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514));}; destination d_messages { file("/var/log/messages"); }; destination d_test { file("/var/log/test"); }; filter f_test { host("testhost"); }; filter f_local7 { facility(local7); }; log { source(s_src); filter(f_test); filter(f_local7); destination(d_test); }; log { source(s_src); filter(f_local7); destination(d_messages); }; Would messages sent from host "testhost" with facility local7 go to just the first or both logs? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately.

2 1

Logrotate problems
by Simeon Johnston 12 Apr '01

12 Apr '01

I am trying to rotate the logs but am having problems with logrotate. This may not be a problem with syslog-ng. This is the command used. /var/log/logfile { postrotate /usr/bin/killall -HUP `cat /var/run/syslog-ng.pid` endscript } The problem with this is that the syslog-ng.pid file seems to be generated in whatever directory you started syslog-ng from instead of /var/run/*. Is this a configuration problem of the system? If a system problem how do I go about fixing it ( if this is not too far off topic )? Is there a simpler way to send an HUP signal? I am using Redhat-6.2 on an ALPHA with syslog-ng 1.4.11. Thanks, sim

2 3

Re: [syslog-ng]umask/perm (was: Re: One last try...)
by John_Delisle＠ceridian.ca 12 Apr '01

12 Apr '01

I take it that means it doesn't work yet? I'm not complaining, I love syslog-ng, but that should be in the release notes! =) John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 |--------+--------------------------------> | | Balazs Scheidler | | | <bazsi(a)balabit.hu> | | | Sent by: | | | syslog-ng-admin(a)lists.| | | balabit.hu | | | | | | | | | 2001/04/12 08:30 AM | | | Please respond to | | | syslog-ng | | | | |--------+--------------------------------> >-----------------------------------------------------------------------------------------------------------| | | | To: syslog-ng(a)lists.balabit.hu | | cc: | | Subject: Re: [syslog-ng]umask/perm (was: Re: One last try...) | >-----------------------------------------------------------------------------------------------------------| > > destination d_devices { file("/var/log/devices/$HOST/$PRIORITY" perm(0644) > > create_dirs(yes) dir_perm(0755)); }; > > > > When it creates them instead of being 755 and 644, they are 700 and 600. > > > > Can anyone help? Is this a known issue? Has anyone got it working > > correctly? How is syslog-ng changing the perms, maybe I'm missing some > > system call or something! I'm open to suggestions/tips!! > > has explicit setting of modes ((f)chmod() vs. open() with mode_t) made > it into the source yet? nope. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately.

1 0