- syslog-ng - lists.balabit.hu

pipe cleanup
by Balazs Scheidler 04 Mar '00

04 Mar '00

Hi, I've began working on 1.5.0 and cleaned up pipe support. Thanks for the idea about O_RDWR pipes for "Klaus Groenhoej" <kgr(a)kmd.dk>. No need to check for spuriously closed pipes now. I've backported the patch to 1.4.0 and is available attached to this mail. This adds no additional functionality, and 1.4.0 should be o.k. as well, so I don't release 1.4.1 immediately, rather I wait for feedback on 1.4.0. Index: affile.c =================================================================== RCS file: /home/bazsi/cvs/syslog-ng/src/affile.c,v retrieving revision 1.30 diff -u -r1.30 affile.c --- affile.c 2000/03/03 14:43:20 1.30 +++ affile.c 2000/03/04 19:56:34 @@ -179,7 +179,6 @@ (vars (owner object affile_dest) (dest object io_fd) - (dest_buf object abstract_buffer) (reap simple "struct callout *") (expanded_fname string) (prev object affile_dest_writer) @@ -190,42 +189,30 @@ do_init_dest_writer(struct log_handler *c, struct syslog_config *cfg, struct persistent_config *persistent) { CAST(affile_dest_writer, self, c); - int fd; + int fd, flags; - if (self->dest) - self->dest->buffer = NULL; - if (!self->dest_buf) - self->dest_buf = make_pkt_buffer_ext(self->owner->sync_freq, - MAX(self->owner->super.log_fifo_size + 1, - self->owner->sync_freq)); - self->dest = NULL; - if (do_open_file(self->expanded_fname, O_WRONLY | O_CREAT | O_APPEND | O_NOCTTY | O_NONBLOCK, self->owner->perm, self->owner->flags & AFFILE_CREATE_DIRS, self->owner->dir_perm, &fd)) { - struct resource_node *res; + if (self->owner->flags & AFFILE_PIPE) + flags = O_RDWR | O_NOCTTY | O_NONBLOCK; + else + flags = O_WRONLY | O_CREAT | O_APPEND |O_NOCTTY | O_NONBLOCK; + if (do_open_file(self->expanded_fname, flags, self->owner->perm, self->owner->flags & AFFILE_CREATE_DIRS, self->owner->dir_perm, &fd)) { chown(self->expanded_fname->data, self->owner->uid, self->owner->gid); - self->dest = io_write(make_io_fd(cfg->backend, fd), - self->dest_buf, - NULL); - res = REMEMBER_RESOURCE(cfg->resources, &self->dest->super.super); - self->dest->super.close_callback = - make_driver_reinit_on_close(c, res, cfg->time_reopen, cfg); + self->dest = + io_write(make_io_fd(cfg->backend, fd), + make_pkt_buffer_ext(self->owner->sync_freq, + MAX(self->owner->super.log_fifo_size + 1, + self->owner->sync_freq)), + NULL); + REMEMBER_RESOURCE(cfg->resources, &self->dest->super.super); if ((self->owner->flags & AFFILE_NO_EXPAND) == 0) self->reap = io_callout(cfg->backend, TIME_REAP_DEST, make_affile_dest_reaper(self)); /* self->attempts = 0; */ } else { - if (errno == ENXIO) { - /* opening the write side of the fifo failed */ - /* self->attempts++; */ - io_callout(cfg->backend, cfg->time_reopen, make_driver_reinit(c, cfg)); - if ((self->owner->flags & AFFILE_NO_EXPAND) == 0) - self->reap = io_callout(cfg->backend, TIME_REAP_DEST, make_affile_dest_reaper(self)); - } - else { - werror("Cannot open file %S for writing (%z)\n", self->expanded_fname, strerror(errno)); - return ST_FAIL | ST_QUIT; - } + werror("Cannot open file %S for writing (%z)\n", self->expanded_fname, strerror(errno)); + return ST_FAIL | ST_QUIT; } return ST_OK | ST_GOON; @@ -235,8 +222,8 @@ { CAST(affile_dest_writer, self, c); - if (self->dest_buf) { - A_WRITE_STRING(&self->dest_buf->super, c_format("%S %S %S\n", msg->date, msg->host, msg->msg)); + if (self->dest) { + A_WRITE_STRING(&self->dest->buffer->super, c_format("%S %S %S\n", msg->date, msg->host, msg->msg)); if (self->reap) io_callout_set_timeout(self->reap, TIME_REAP_DEST); } -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog-ng-1.4.0rc3: How to log the domainname
by Joakim Rastberg 03 Mar '00

03 Mar '00

Hi! I just downloaded, installed, configured and ran syslog-ng-1.4.0rc3 and everything looks great! I have just a small question that doesn't get answered in the archive at http://lists.balabit.hu/pipermail/syslog-ng/: How do I get the domainname of the hosts into the logs? I ask this as I collect syslogs from several nameservers for different domains who all have the hostname "ns". One way would be to log the orginating IP-address, but I can't find out how to do that if the host is found in DNS (like -n in netstat would be fine) A cursory look in sources.c around line 157 gives that the code *removes* the domainname but I can't understand why this not is a configurable option. % uname -a SunOS syslog 5.7 Generic_106541-09 sun4m sparc SUNW,SPARCstation-20 % cat /etc/syslog-ng/syslog-ng.conf source stdlog { udp(); }; source local {sun-streams("/dev/log" door("/etc/.syslog_door"));internal();}; destination auto { file("/var/log/$HOST.$FACILITY"); }; log { source(stdlog);source(local); destination(auto); }; /Joakim Rastberg, IT-Security Conslutant. -- "Pioneer Preference" status and "Holder of Past Knowledge" in the DNRC.

2 1

m4?
by mgx＠spruce.lsd.ornl.gov 03 Mar '00

03 Mar '00

good day ... i'm trying to compile the stable version 1.4.0 on solaris 2.6 (SunOS avatar.lsd.ornl.gov 5.6 Generic_105181-11 sun4u sparc SUNW,Ultra-5_10) and i get this error: 40 root@avatar /usr/local/syslog-ng-1.4.0> make Making all in src make[1]: Entering directory `/usr/local/syslog-ng-1.4.0/src' cd /usr/local/syslog-ng-1.4.0 && autoheader Autoconf requires GNU m4 1.1 or later make[1]: *** [/usr/local/syslog-ng-1.4.0/src/stamp-h.in] Error 1 while my version of m4 is: 41 root@avatar /usr/local/syslog-ng-1.4.0> m4 --v GNU m4 1.4 did i miss something simple here? i searched the archives and cannot any reference to this problem. -- -- michael

1 1

syslog-ng 1.4.0 released
by Balazs Scheidler 03 Mar '00

03 Mar '00

Hi, I've finally released 1.4.0 as stable fixing all the bugs you have reported. It should work out of the box on Solaris (I've fixed a configure.in test), and HP-UX (fixed pipe support). You can find it at the usual place: http://www.balabit.hu/products/syslog-ng/ Please tell me if you encounter any problems. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: [syslog-ng] message numbers
by Terje Krogdahl 03 Mar '00

03 Mar '00

Balazs Scheidler <bazsi(a)balabit.hu> writes: > what is this message number? A serial number? Actually it is a sequence number. I see it when my Cisco routers log via syslog. The number is incremented by one every time a router sends a syslog message. Very useful to detect missing log entries, among other things. Here's a hex dump of a complete packet, in case this helps clear things up: 0: 0800 2083 600e 0000 0c76 bf10 0800 4500 .. .`....v....E. 16: 0094 0182 0000 fe11 1690 8243 4ffc 8243 ...........CO..C 32: 4fc4 1ac4 0202 0080 302f 3c31 3930 3e33 O.......0/<190>3 48: 3536 313a 2046 6562 2032 3620 3232 3a33 561: Feb 26 22:3 64: 393a 3138 2e32 3132 3a20 2553 4543 2d36 9:18.212: %SEC-6 80: 2d49 5041 4343 4553 534c 4f47 503a 206c -IPACCESSLOGP: l 96: 6973 7420 3132 3020 6465 6e69 6564 2074 ist 120 denied t 112: 6370 cp ... which produces the following syslog message. Note that I have removed the hostname and part of the message stating IP addresses. Feb 26 22:33:46 xxxxxxx.xx.telenor.net 3561: Feb 26 22:39:18.212: %SEC-6-IPACCESSLOGP: list 120 denied tcp... Syslog-ng is running under Solaris 2.6. -- Terje Krogdahl Nextra AS - I don't buy from spammers.

4 6

Re: syslog-ng, file source driver
by Balazs Scheidler 02 Mar '00

02 Mar '00

On Wed, Mar 01, 2000 at 11:51:58AM -0800, Alex Schlessinger wrote: > > > > > > what am i doing or understanding incorrectly? > > > > The file source driver is meant to be used on special files like /proc/kmsg. > > If you want to forward the contents of a real file, you could write a simple > > script like: > > > > tail -f <logfile> | logger -p local5.info > > understood, this is basically what i ended up doing. > > however, the documentation is misleading.. > > http://www.balabit.hu/products/syslog-ng/doc/reference.html#AEN303 > > "Of course using this driver you are not limited to special files, you can as well read a > continuosly growing simple file, and syslog-ng will "follow" appended lines, > just like tail -f does." ops, this is a docbug. earlier syslog-ng was able to do this, but this maxed out CPU usage. It is not possible to decide whether new data arrived to a file using poll(), since the main loop uses poll to wait for events, it would be difficult to add this feature. (though not impossible) so for now I corrected the documentation, and leave this feature addition for 1.5.x. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

DOTDOT problem
by Brad Arlt 01 Mar '00

01 Mar '00

Hello.. I am running syslog-ng 1.4.0rc3. I am having a bit of a problem with the '..' operator for priorities. I have a filter : filter authlogs { facility(auth) and priority(emerg..info); }; Error level through info work just fine... but I get nothing above error. However if I expand the '..' I get all the levels between emerg and info. filter authlogs { facility(auth) and priority(emerg,alert,crit,error,warning,notice,info); }; ---- It looks to me like an "array to small" or "counter doesn't go high enough" type problem, but I haven't looked at the source yet (it really is *that* big a deal, its just nice to have to make the config file smaller/prettier) ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_)

2 1

sun-stream problem with syslog-ng on Solaris
by Simon Yang 28 Feb '00

28 Feb '00

Hi folks, I compiled syslog-ng 1.4.0rc2 on Solaris 2.6. When I tried to start syslog-ng, I got the following error: # ./syslog-ng sun-streams support not compiled in (STREAM=/dev/log) Error initializing configuration, exiting. Terminated Did I miss some config parameter when I compiled syslog-ng? Attached is the content of the syslog-ng.conf: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination all { file("/var/log/messages"); }; log { source(local); destination(all); }; Any help will be greatly appreciated.

3 2

message numbers
by Terje Krogdahl 25 Feb '00

25 Feb '00

Hi! I'm in the progress of replacing Suns syslogd with syslog-ng 1.4.0rc2. I'm sure this is an FAQ, but how can I make it include message numbers? With Sun syslogd I get: Feb 23 13:17:58 hostname 1288115: the_message_itself but with syslog-ng I only get: Feb 23 13:17:58 hostname : the_message_itself The number "1288115" is missing, and I cannot figure out how to configure syslog-ng to include it. Unfortunately, I really need this number for post-processing of logs... Any suggestions? -- Terje Krogdahl Nextra AS - I don't buy from spammers.

4 3

syslog-ng 1.4.0rc3
by Balazs Scheidler 25 Feb '00

25 Feb '00

Hi, You'll find rc3 at the usual place (http://www.balabit.hu/products/syslog-ng) Here's my changelog: 2000-02-25 Balazs Scheidler <bazsi(a)balabit.hu> * src/filters.c (do_filter_pri): split this to two functions, priorities are filtered by 8 bits, where the bit position denotes the value of the priority (0-7), at facilities bit position denotes an index to the sl_facilities array, (do_filter_lev): new function, (do_filter_fac) new function * src/cfg-grammar.y: changed the way valid masks are composed for facility/priority filters, display warnings when a priority/facility is unknown, added possibility to select a facility code by number. * src/log.c (parse_log_msg): don't remove programname from the whole message, set programname to "kernel" when a message comes from LOG_KERN facility (needed for SunOS) * src/cfg-lex.l: IDENTIFIER regex fix. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0