- syslog-ng - lists.balabit.hu

perm() and dir_perm()
by John_Delisle＠ceridian.ca 04 Apr '01

04 Apr '01

Hi everyone! I'm having issues getting perm() and dirperm() working. Here is my destination line: destination d_devices { file("/var/log/devices/$HOST/$PRIORITY" perm(0644) create_dirs(yes) dir_perm(0755)); }; The files are created with 600, and dirs with 700. Any ideas? My umask is 022. I've tried adjusting the above values (I added 22 to them) and it didn't make a difference. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately.

1 0

RE: [syslog-ng]odd problem
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 03 Apr '01

03 Apr '01

I'm not 100% certain but I don't think that will work. syslog-ng picks the first log statement and logs the message to that. After that it considers the message logged and will log nothing to the next log statement. What I am curious about is why the multiple destination thing didn't work. I use it often and it works for me just fine. I am using 1.4.7 in production but I have been testing the 1.5 series and will go to production with it soon. Both seem to do this just fine. What is the error you are getting from the multiple destination configuration? Regards, Drew > -----Original Message----- > From: Chad C. Walstrom [SMTP:chewie@wookimus.net] > Sent: Monday, April 02, 2001 11:19 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]odd problem > > On Mon, Apr 02, 2001 at 04:38:30PM -0400, jon(a)dumbo.pobox.com wrote: > > syslog-ng-1.4.11/ > > libol-0.2.21/ > > > > i guess i'll try upgrading.... > > > > how does one log to multiple destinations without putting everything > into the same > > destination XXX {} container? > > > > i've tried seperate destinations > > ie... > > destination x { tcp(208.210.124.50 port(514)); } > > destinayion y { > file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY" > dir_perm(0755) perm(0644)) } > > > > and then in the log directive > > log { > > source(src); > > destination(x); > > destination(y); > > } > > > > but that gives me errors > > Try: > log{ source(src); destination(x); }; > log{ source(src); destination(y); }; > > -- > Chad Walstrom <chewie(a)wookimus.net> | a.k.a. ^chewie > http://www.wookimus.net/ | s.k.a. gunnarr > Key fingerprint = B4AB D627 9CBD 687E 7A31 1950 0CC7 0B18 206C 5AFD >

2 1

Solaris 7 TCP Destination Error syslog-ng 1.4.11
by David C Niemi 02 Apr '01

02 Apr '01

I am trying to forward logs to another box from a Solaris 7 (SPARC) machine. The error I get is puzzling: sinetva99{SUPERUSER:25}/tmp# syslog-ng -d -f syslog-remote.conf io.c: Preparing fd 3 for reading io.c: connecting using fd 4 Error creating AF_INET socket (Operation now in progress) Error initializing configuration, exiting. Solaris' man page for connect defines EINPROGRESS quite cryptically: EINPROGRESS The socket is non-blocking and the connection can- not be completed immediately. It is possible to select(3C) for completion by selecting the socket for writing. However, this is only possible if the socket STREAMS module is the topmost module on the protocol stack with a write service procedure. This will be the normal case. So it sounds vaguely like the socket needs to be blocking, but I don't see any option in syslog-ng for accomplishing this. The relevant part of my .conf file: source src { file("/dev/log"); internal(); }; destination remote { tcp(208.214.21.133 port(514) ); }; log { source(src); destination(remote); }; I've managed to use virtually the same configuration to forward successfully under TCP using a Linux source. I also find that sending to localhost works fine under Solaris, but I get the error whenever I try a remote TCP destination from Solaris. "truss" does not return anything terribly interesting. --------------------------------------------------------- David C. Niemi (Reston, Virginia, USA) niemi(a)tuxers.net Know the difference between the color of the wine and the color of the glass. (Jalaluddin Rumi) ---------------------------------------------------------

2 2

AIX error
by Kathia Juca 02 Apr '01

02 Apr '01

Hi I'm running syslog-ng 1.4.11 on AIX . I intend log 80 machines to one hosts using syslog-ng. But, I use one server for compile. I need install in 80 machines . What syslog-ng and libol packages ??. Can'I transfer code after compile ?? I tried transfer and error message was : # /usr/local/sbin/syslog-ng Could not load program /usr/local/sbin/syslog-ng Symbol io_callout_set_drop in syslog-ng is undefined Symbol io_callout_flush in syslog-ng is undefined Error was: Exec format error What's right procedure for this ?? Thanks Kathia Juca Universidade Federal de Santa Catarina Florianopolis - Santa Catarina - Brazil

2 1

RE: [syslog-ng]Feature Request
by Andrew Fort 01 Apr '01

01 Apr '01

> Next thing to ask for is a feature request that would make our use of > syslog infintely more flexible: a string formatter module. Take this > hypothetical syslog-ng.conf entry as an example: the 1.5 development releases allow you to specify what fields to go the output for some destinations. i've attached a previous post of mine with the field list inside, and quoting Balazs' original feature announcement. you may be able to use this in conjunction with other facilities, a log watcher, the program destination, whatever, to achieve your goal. -afort

5 9

Syslog-ng and a log checker
by Dennis Kruyt 01 Apr '01

01 Apr '01

Hi, I'm logging from about 20 machines to a log server and i want to use a program that checks the log files. So wich program works good with syslog-ng??? Dennis,

2 1

Syslog-NG Performance
by Scott, Joshua 30 Mar '01

30 Mar '01

I plan on using 1 server with Syslog-ng to maintain all of the log files for my firewalls. I want to make sure I don't overload this server. This server is a PIII 800Mhz with 512MB ram. At this point the amount of data I'll be sending to syslog-ng will be approx 2GB daily. Can anyone tell me how what experiences they've had with this type of scenario? Is there a limit to the amount of devices syslog-ng can handle? > Joshua Scott > Security Systems Analyst > Jacobs Engineering Group > IS - Network Services > 1111 South Arroyo Parkway > Pasadena, California, 91105 > Office: (626) 568-7024 > Mobile: (866) 810-5234 > Fax: (626) 578-6967 >

2 1

RE: [syslog-ng]syslog-ng 1.5.5 compilation trouble
by Ohrberg, Mick 30 Mar '01

30 Mar '01

Bazsi, That did it! With one exception. I had to add #ifndef INADDR_NONE #define INADDR_NONE ((unsigned long) -1) #endif to nscache.c, but after that, it compiled like a champ! (Sorry, don't know how to make patches... :-/ ) Thanks!! > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: Friday, March 30, 2001 9:09 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]syslog-ng 1.5.5 compilation trouble > > > On Fri, Mar 30, 2001 at 08:13:59AM -0600, Ohrberg, Mick wrote: > > Hmm, Maybe I'm just messing up horribly on this wonderful > Friday morning. I > > can't compile syslog-ng 1.5.5! > > > > ... > > checking whether to enable Sun STREAMS support... yes > > checking whether to enable Sun door support... yes > > checking libol version >= 0.2.22... ./configure: !: not found > > ok > > updating cache ./config.cache > > ... > > > > Woah there! I DO have libol 0.2.22 installed! I found a > problem in my > > configure... Anyone else run into this problem? Instead of doing > > > > if ! test -x ... > > > > I changed it to > > > > if [ ! -x ... ]; do > > ops... bash eats the first construct, but it doesn't seem to > be portable. > > nscache.h seems to be missing from the dist. The patch below fixes the > problem above, and adds nscache.h: > > diff -urN syslog-ng-1.5.5/configure syslog-ng-1.5.5a/configure > --- syslog-ng-1.5.5/configure Fri Mar 30 14:12:39 2001 > +++ syslog-ng-1.5.5a/configure Fri Mar 30 17:03:02 2001 > @@ -700,7 +700,7 @@ > > PACKAGE=syslog-ng > > -VERSION="1.5.5" > +VERSION="1.5.5a" > > if test "`cd $srcdir && pwd`" != "`pwd`" && test -f > $srcdir/config.status; then > { echo "configure: error: source directory already > configured; run "make distclean" there first" 1>&2; exit 1; } > @@ -2670,7 +2670,7 @@ > echo "configure:2671: checking libol version >= > $LIBOL_REQ_MAJOR.$LIBOL_REQ_MINOR.$LIBOL_REQ_PATCH" >&5 > > if test "$with_libol" = ""; then > - if ! test -x `which libol-config` ; then > + if test ! -x `which libol-config` ; then > { echo "configure: error: libol-config not > found, either install libol or supply its location with > --with-libol" 1>&2; exit 1; } > fi > LIBOL_VERSION=`libol-config --version` > @@ -2678,7 +2678,7 @@ > LIBOL_LIBS=`libol-config --static-libs` > MAKE_CLASS="make_class" > else > - if ! test -x $with_libol/libol-config; then > + if test ! -x $with_libol/libol-config; then > { echo "configure: error: libol-config not > found in the specified location" 1>&2; exit 1; } > fi > LIBOL_VERSION=`$with_libol/libol-config --version` > diff -urN syslog-ng-1.5.5/configure.in syslog-ng-1.5.5a/configure.in > --- syslog-ng-1.5.5/configure.in Fri Mar 30 14:12:37 2001 > +++ syslog-ng-1.5.5a/configure.in Fri Mar 30 17:02:31 2001 > @@ -1,8 +1,8 @@ > -dnl $Id: configure.in,v 1.32 2001/02/25 12:01:38 bazsi Exp $ > +dnl $Id: configure.in,v 1.33 2001/03/30 15:02:31 bazsi Exp $ > dnl Process this file with autoconf to produce a configure script. > AC_INIT(src/affile.c) > > -AM_INIT_AUTOMAKE(syslog-ng, "1.5.5") > +AM_INIT_AUTOMAKE(syslog-ng, "1.5.5a") > LIBOL_REQ_MAJOR=0 > LIBOL_REQ_MINOR=2 > LIBOL_REQ_PATCH=22 > @@ -148,7 +148,7 @@ > AC_MSG_CHECKING(libol version >= > $LIBOL_REQ_MAJOR.$LIBOL_REQ_MINOR.$LIBOL_REQ_PATCH) > > if test "$with_libol" = ""; then > - if ! test -x `which libol-config` ; then > + if test ! -x `which libol-config` ; then > AC_ERROR([libol-config not found, either > install libol or supply its location with --with-libol]) > fi > LIBOL_VERSION=`libol-config --version` > @@ -156,7 +156,7 @@ > LIBOL_LIBS=`libol-config --static-libs` > MAKE_CLASS="make_class" > else > - if ! test -x $with_libol/libol-config; then > + if test ! -x $with_libol/libol-config; then > AC_ERROR(libol-config not found in the > specified location) > fi > LIBOL_VERSION=`$with_libol/libol-config --version` > diff -urN syslog-ng-1.5.5/doc/sgml/syslog-ng.sgml > syslog-ng-1.5.5a/doc/sgml/syslog-ng.sgml > --- syslog-ng-1.5.5/doc/sgml/syslog-ng.sgml Fri Mar 30 14:41:01 2001 > +++ syslog-ng-1.5.5a/doc/sgml/syslog-ng.sgml Fri Mar 30 15:08:27 2001 > @@ -1074,7 +1074,7 @@ > as commands to the SQL server. > </entry> > <entry> > - a format conforming to default logfile format. > + yes > </entry> > </row> > </tbody> > diff -urN syslog-ng-1.5.5/doc/sgml/syslog-ng.txt > syslog-ng-1.5.5a/doc/sgml/syslog-ng.txt > --- syslog-ng-1.5.5/doc/sgml/syslog-ng.txt Fri Mar 30 14:41:50 2001 > +++ syslog-ng-1.5.5a/doc/sgml/syslog-ng.txt Fri Mar 30 17:03:37 2001 > @@ -553,8 +553,7 @@ > template_escape() yes or no Turns on escaping ' and " in templated > output files. It is useful for generating SQL statements > and quoting > string contents so that parts of your log message don't get > - interpreted as commands to the SQL server. a format conforming to > - default logfile format. > + interpreted as commands to the SQL server. yes > > _________________________________________________________________ > > pipe() > diff -urN syslog-ng-1.5.5/src/Makefile.am > syslog-ng-1.5.5a/src/Makefile.am > --- syslog-ng-1.5.5/src/Makefile.am Sun Feb 25 13:00:22 2001 > +++ syslog-ng-1.5.5a/src/Makefile.am Fri Mar 30 17:02:31 2001 > @@ -1,5 +1,5 @@ > ## Run automake to produce Makefile.in > -## $Id: Makefile.am,v 1.43 2001/02/24 12:38:02 bazsi Exp $ > +## $Id: Makefile.am,v 1.44 2001/03/30 15:02:31 bazsi Exp $ > > YFLAGS = @YFLAGS@ > MAKE_CLASS = @MAKE_CLASS@ > @@ -21,7 +21,8 @@ > afstreams.h \ > afprogram.h \ > utils.h \ > - syslog-names.h > + syslog-names.h \ > + nscache.h > > dist_x_files = \ > cfgfile.h.x \ > diff -urN syslog-ng-1.5.5/src/Makefile.in > syslog-ng-1.5.5a/src/Makefile.in > --- syslog-ng-1.5.5/src/Makefile.in Fri Mar 30 14:41:41 2001 > +++ syslog-ng-1.5.5a/src/Makefile.in Fri Mar 30 17:03:22 2001 > @@ -71,7 +71,7 @@ > > SUBDIRS = . tests > > -dist_h_files = syslog-ng.h cfgfile.h > sources.h center.h filters.h destinations.h > log.h afinter.h affile.h afsocket.h > afuser.h afstreams.h afprogram.h utils.h > syslog-names.h > +dist_h_files = syslog-ng.h cfgfile.h > sources.h center.h filters.h destinations.h > log.h afinter.h affile.h afsocket.h > afuser.h afstreams.h afprogram.h utils.h > syslog-names.h nscache.h > > > dist_x_files = cfgfile.h.x destinations.h.x > log.h.x sources.c.x sources.h.x cfgfile.h.x > center.h.x center.c.x afsocket.h.x afsocket.c.x > afunix.c.x afinet.c.x affile.c.x afuser.c.x > afstreams.c.x afprogram.c.x filters.h.x > filters.c.x main.c.x > diff -urN syslog-ng-1.5.5/src/nscache.h syslog-ng-1.5.5a/src/nscache.h > --- syslog-ng-1.5.5/src/nscache.h Thu Jan 1 01:00:00 1970 > +++ syslog-ng-1.5.5a/src/nscache.h Mon Mar 19 15:13:47 2001 > @@ -0,0 +1,24 @@ > +#ifndef __NSCACHE_H > +#define __NSCACHE_H > + > +#include <config.h> > + > +#if WITH_DEBUG > +#define NSCACHE_DEBUG > +#endif > + > +#include <netinet/in.h> > + > +struct nscache; > + > +struct nscache * nscache_new(int size, int expire, int > expire_failed); > +void nscache_free(struct nscache *); > +char * nscache_lookup(struct nscache *, struct in_addr); > + > +#ifdef NSCACHE_DEBUG > +void nscache_dump(struct nscache *); > +#else > +#define nscache_dump(cache) {} > +#endif > + > +#endif > diff -urN syslog-ng-1.5.5/syslog-ng.spec > syslog-ng-1.5.5a/syslog-ng.spec > --- syslog-ng-1.5.5/syslog-ng.spec Fri Mar 30 14:15:52 2001 > +++ syslog-ng-1.5.5a/syslog-ng.spec Fri Mar 30 17:03:07 2001 > @@ -1,5 +1,5 @@ > %define name syslog-ng > -%define version 1.5.5 > +%define version 1.5.5a > %define release 0 > %define prefix /usr > > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD > 804E C82C 8EB1 > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1

syslog-ng 1.5.5 compilation trouble
by Ohrberg, Mick 30 Mar '01

30 Mar '01

Hmm, Maybe I'm just messing up horribly on this wonderful Friday morning. I can't compile syslog-ng 1.5.5! ... checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking libol version >= 0.2.22... ./configure: !: not found ok updating cache ./config.cache ... Woah there! I DO have libol 0.2.22 installed! I found a problem in my configure... Anyone else run into this problem? Instead of doing if ! test -x ... I changed it to if [ ! -x ... ]; do in a few select places. That gets the configure through. I still can't compile though. # make Making all in src make all-recursive Making all in . make: Fatal error: Don't know how to make target `nscache.h' Current working directory /root/Projects/syslog-ng-1.5.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /root/Projects/syslog-ng-1.5.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /root/Projects/syslog-ng-1.5.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Am I just being really stupid? *scratches head* Let me know if anyone have this problem and if there's a patch to fix it. :) Thanks all! Regards, -- Mick Öhrberg Open Systems Administrator, UMB Bank na [NYSE:UMBF] Ph: (816)860-1064 Fax: (816)860-3934 PGP: http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0xD98D5C7B

2 1

RE: [syslog-ng]syslog-ng 1.5.5 and libol 0.2.22 released
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 30 Mar '01

30 Mar '01

Bazsi, I would be willing to spend some time updating the docs. It really needs to be done. Any info you wanted to pass on to make the job simpler would be helpful. Drew > -----Original Message----- > From: Balazs Scheidler [SMTP:bazsi@balabit.hu] > Sent: Friday, March 30, 2001 3:14 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]syslog-ng 1.5.5 and libol 0.2.22 released > > Hi, > > I've released syslog-ng 1.5.5 and the corresponding libol 0.2.22 with the > following changes: > > News for the 1.5.5 release > Fri, 30 Mar 2001 14:23:55 +0200 > > * Fixed a bug in -HUP handling (implemented a cleaner solution, > though less tested than in 1.4.11). > * Added DNS cache implemented by Gael Roualland. > * Added klogctl program to control kernel logging level on Linux > (to make it easier to set up a completely klogd-less logging) > * Template support for output files. > * Documentation somewhat updated. > > > some of these functions were implemented in 1.5.3 but that version didn't > have a NEWS entry, that's why I added it here. Somebody requested that > syslog-ng should make it possible to escape templated output files, it's > now > possible with the template-escape() option. I've updated the docs, though > my > changes touch only the surface. > > Any help for updating the documentation is welcome. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1

1 0