- syslog-ng - lists.balabit.hu

syslog-ng 1.4.0rc2
by Balazs Scheidler 25 Feb '00

25 Feb '00

Hi, I've released syslog-ng version 1.4.0rc2, fixing all known bugs in previous versions. I've also reorganized the downloads tree, each major version has a distinct directory, and libol was moved up in the directory hierarchy. My website in currently syncing, but as soon as this is completed you'll find 1.4.0rc2 here: http://www.balabit.hu/downloads/syslog-ng/1.4/syslog-ng-1.4.0rc2.tar.gz and libol: http://www.balabit.hu/downloads/libol/0.2/libol-0.2.16.tar.gz -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 3

Re: 1.4.0 rc2 bug
by Balazs Scheidler 23 Feb '00

23 Feb '00

> The .. (DOTDOT) range operator for priority filters seems to be broken with > this release. try this patch: Index: cfg-lex.l =================================================================== RCS file: /home/bazsi/cvs/syslog-ng/src/cfg-lex.l,v retrieving revision 1.8 diff -u -r1.8 cfg-lex.l --- cfg-lex.l 2000/02/22 17:50:29 1.8 +++ cfg-lex.l 2000/02/23 10:24:15 @@ -142,7 +142,7 @@ 0x{digit}+ { yylval.num = strtol(yytext, NULL, 16); return NUMBER; } 0{digit}+ { yylval.num = strtol(yytext, NULL, 8); return NUMBER; } {digit}+ { yylval.num = atoi(yytext); return NUMBER; } -({word}+(\.)?)* { return check_reserved_words(yytext); } +({word}+(\.)?)*{word}+ { return check_reserved_words(yytext); } $ { return '('; } $ { return ')'; } \; { return ';'; } -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Filter troubles
by Brad Arlt 23 Feb '00

23 Feb '00

I am having some difficulty understanding filters. (syslog-ng 1.3.17) I am trying to replicate Solaris's syslog.conf entry: *.err;kern.debug;daemon.notice;auth.err;news.none;user.none as far as I can tell this translates to: filter filname { priority(panic, alert, crit, error) and not facility(user, news); }; which is also the same as filter filname { priority(panic, alert, crit, error) and not facility(user) and not facility(news); }; kern doesn't seem to be logging at all... if I drop facility checking then kern logs.... Any thoughts? Also I noticed that there is a range operator (..) but the above priority(panic, alert, crit, error) does not seem to be the same as priority(panic..error). Am I right in thinking that (..) is broken or am misunderstanding what (..) does. ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_)

6 13

syslog-ng 1.3.17 a.k.a. 1.4.0rc1
by Balazs Scheidler 22 Feb '00

22 Feb '00

Hi, I've released release candidate 1 for 1.4.0 as 1.3.17. I've tried to fix all bugs encountered until now. If you find any showstopper bugs, please tell me about it. http://www.balabit.hu/products/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 3

syslog-ng 1.3.15 compile fails on FreeBSD 3.2R
by George Madden 18 Feb '00

18 Feb '00

I just tried compiling syslog-ng 1.3.15 with libol 0.2.14 on a FreeBSD 3.2R box and it fails with the following: affile.c: In function `do_open_file': affile.c:52: storage size of `st' isn't known affile.c:54: warning: implicit declaration of function `stat' affile.c:55: warning: implicit declaration of function `S_ISDIR' affile.c:61: warning: implicit declaration of function `mkdir' affile.c:52: warning: unused variable `st' *** Error code 1

2 4

syslog-ng 1.3.17
by Brian Johnson 18 Feb '00

18 Feb '00

I just upgraded to syslog-ng 1.3.17 (from 1.3.14), and I noticed that when I kill syslog-ng it doesn't print "syslog-ng going down" in my logs anymore, but it still does print when it's starting, and when I run it with -d and kill it the same way it does print syslog-ng going down on the screen, so there seems to be a problem with the internal logging?

1 0

create_dirs in 1.3.15
by Sam Howard 18 Feb '00

18 Feb '00

Hi. I'm looking at the ChangeLog for 1.3.15, and it mentions "added create_dirs", and "updated documentation", but I cannot find any docs about the new features... What am I missing??? Thanks! Sam Samuel P. Howard Sr. Unix Systems Administrator 2nd Century Communications Voice: 813-901-1280 mailto:sphoward@2c2.com

3 4

RE: [syslog-ng] create_dirs in 1.3.15
by Sam Howard 18 Feb '00

18 Feb '00

I tried something similar, and found that syslog-ng went balistic and was constantly 'stat(/var)' (according to truss). Also, should it create *any* directory it needs? or only ones that are the result of a variable expansion? For example file("/var/log/make/this/directory/$HOST.log"); where only /var/log exists... BTW, I tried this on 1.3.16 (ahh, fresh code!) Thanks, Sam -----Original Message----- From: Chris Scheller [mailto:schelcj@networkone.net] Sent: Thursday, February 17, 2000 6:24 PM To: syslog-ng(a)venus.terrasoft.hu Subject: Re: [syslog-ng] create_dirs in 1.3.15 I can't seem to get create_dirs to work. When i add it to my options and add a destination such as destination test { file("/var/log/syslog-ng/$HOST/$FACILITY"); }; not only does it not create the directories or the files, but syslog-ng stops logging everything all together. Any thoughts? did i miss something in the conf? Chris Scheller System/Network Administration Network One Internet, inc. http://www.networkone.net/ 1.888.GOT-NET1 On Thu, 17 Feb 2000, Balazs Scheidler wrote: > > I'm looking at the ChangeLog for 1.3.15, and it mentions "added > > create_dirs", and "updated documentation", but I cannot find any docs about > > the new features... > > > > What am I missing??? > > The 1.3.15 tarball doc/sgml/syslog-ng.txt file contains this. (or the .html > version) > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Re: syslog-ng stops listen to UDP after "nmap -sU"?
by kent＠unit.liu.se 17 Feb '00

17 Feb '00

kent(a)unit.liu.se (Kent Engström) writes: > Everything worked fine until I decided to portscan the syslog server. > When I did a UDP scan, syslog-ng stopped logging. This is what happens: > *) I execute "nmap -p 514 -sU xxx.yyy.zzz.www" on a Linux box Using options "-v" and "-d", I catch the following: Read EOF on fd 3. Marking fd 3 for closing. Closing fd 3. It appears that libol is the culprit here. It assumes that a returned read length of 0 means end of file, as when reading from a file or a TCP connection. -- Kent Engström, Linköping University Incident Response Team kent(a)unit.liu.se abuse(a)liu.se +46 13 28 1744 UNIT, Linköping University; SE-581 83 LINKÖPING; SWEDEN

2 1

syslog-ng stops listen to UDP after "nmap -sU"?
by kent＠unit.liu.se 17 Feb '00

17 Feb '00

Today, I installed syslog-ng 1.3.15 on Solaris 7. I have the following very simple config file (I am still evaluating syslog-ng): options { use_fqdn(yes); }; source syslog_udp { udp(ip(xxx.yyy.zzz.www) port(514)); }; source syslog_internal { internal(); }; destination syslog_file { file("/somepath/logs/$YEAR-$MONTH-$DAY-$HOST-$FACILITY"); }; log { source(syslog_udp); source(syslog_internal); destination(syslog_file); }; xxx.yyy.zzz.www is a virtual IP-address that is assigned to whatever server that is currently providing syslog service to the rest of the internal network. Everything worked fine until I decided to portscan the syslog server. When I did a UDP scan, syslog-ng stopped logging. This is what happens: *) I start syslog-ng *) I connect to our mail server, and see how the connection is logged in the file /somepath/logs/2000-02-17-mailserver.our.domain-mail *) I run netstat -a and observe the line xxx.yyy.zzz.www.514 Idle *) I execute "nmap -p 514 -sU xxx.yyy.zzz.www" on a Linux box *) I run netstat -a and observe that there is no longer any entry for port 514. *) The syslog-ng process is still running, though. *) I connect to our mail server again. The connection is not logged by syslog-ng. In fact, nothing seems to be logged at all. The packet that is sent by nmap during an "-sU scan" is a UDP packet with zero bytes of data. Obviously, this could be an easy way for a cracker do disable a loghost in preparation for an attack on another host. Can anybody repeat this? -- Kent Engström, Linköping University Incident Response Team kent(a)unit.liu.se abuse(a)liu.se +46 13 28 1744 UNIT, Linköping University; SE-581 83 LINKÖPING; SWEDEN

1 0