- syslog-ng - lists.balabit.hu

RE: [syslog-ng] syslog-ng 1.3.3
by Lowkrantz, Goran 22 Nov '99

22 Nov '99

Hi, I downloaded 1.3.3 but the file src/afsocket.h.x seems to be missing, so it won't build. Cheers, GLZ -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, November 22, 1999 10:11 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng 1.3.3 Hi, I've released syslog-ng 1.3.3, which completes the afsocket reorganization I introduced in 1.3.2. It should be quite stable now. This fixes a problem with some programs dropping messages (for instance sendmail). It was caused by the fact the syslog-ng dropped all af_unix connections when sent a HUP signal. A new option was added to unix-stream and tcp: keep-alive, which is on by default for unix-stream drivers. Another bug was fixed in the $DAY macro expansion. There was a discussion recently on bugtraq about a syslogd DoS attack. The problem is fixed in distributions by switching to unix-dgram sockets from unix-stream. syslog-ng supports this switch by using another driver, so you only need to change your configuration. An alternative solution will be provided to limit the number of simultaneous connections kept open. If this limit is reached, syslog-ng will be able to send a warning message, and messages will not be simply dropped. IMHO this solution is much better, than reverting to sock_dgram. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

预定春节火车票
by hello 21 Nov '99

21 Nov '99

预定春节火车票，请电26368636咨询

1 0

proftpd
by Jacob Zehnder 21 Nov '99

21 Nov '99

hi, ive got everything working perfectly in my setup but im having one problem. i cant seem to be able to filter out proftpd from messages. i *can* filter it to ftp.log but it still shows up in messages. heres what my messages filter looks like filter f_messages { not facility(mail, kern, proftpd); }; ive substitued proftpd with ftpd, ftp, pro etc.. oh btw, i can filter out just stock ftpd fine, proftpd is the only thing i have problems with. i know that proftpd uses its own syslog util but im still not sure how i should go about seperating it. anyone had similar problems? any suggestions? thanks, -jacob * * * * * * * * * * * * * * * * * * Jacob Zehnder * * * * * * * * * Grill Master * * * * * * * * "The dude abides." * * * * 'The Big Lebowski' * * * * * * * * * * * * * *

3 2

Re: day macro
by Balazs Scheidler 21 Nov '99

21 Nov '99

On Sat, Nov 20, 1999 at 03:19:03PM -0800, Chris Scheller wrote: > i had not heard a response so i thought i would ask again. when i add the > $DAY macro to a destination the date come out 1 day ahead. I thought maybe > it wasn't taking into accoutn GMT or something similar, but everything > seems to be correct. any ideas? apply this patch: --- affile.c 1999/11/20 19:13:39 1.23 +++ affile.c 1999/11/21 14:35:09 @@ -317,7 +317,7 @@ ADD_MACRO_ARG(c_format("%02i", tm->tm_mon + 1)); break; case 'd': - ADD_MACRO_ARG(c_format("%02i", tm->tm_mday + 1)); + ADD_MACRO_ARG(c_format("%02i", tm->tm_mday)); break; } break; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog-ng 1.3.2
by Balazs Scheidler 20 Nov '99

20 Nov '99

Hi, I've released $subject. It contains a fully reworked/cleaned up afsocket implementation, so it may not be fully stable. Please test it as much as you can, and report bugs. Thanks. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog+ng 1.3.1 on FreeBSD 3-STABLE
by Lowkrantz, Goran 19 Nov '99

19 Nov '99

Hi, Two small things and then it works: src/log.c:85 need include of <string.h> so that memset is declared. src/log.c:89 tm.tm_isdst = daylight; There is no daylight variable but if tm_isdst is set negative, mktime will use the system to find out. If I define daylight to -1, it works. Two warnings: gcc -DHAVE_CONFIG_H -I. -I/usr/home/glz/work.d/syslog-ng-1.3.1/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c affile.c affile.c: In function `expand_macros': affile.c:381: warning: passing arg 2 of `c_vformat_length' from incompatible pointer type affile.c:383: warning: passing arg 4 of `c_vformat_write' from incompatible pointer type They are declared as va_list but are passed char *[MAX_MACRO_ARGS]. Cheers, GLZ --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

3 4

syslog-ng 1.3.1
by Balazs Scheidler 18 Nov '99

18 Nov '99

Hi, I've released a new development version to the usual location. It fixes some macro expansion bugs, and some parts have been merged from 1.2.1. It contains support the DEFAULT log statement, which is used on every message, which matches no filters. Here's how you can use it: log { source(src); filter(DEFAULT); destination(dst); }; Only one default statement can be in a configuration. So, download, compile, test and have fun: http://www.balabit.hu/products/syslog-ng -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 4

你想在网上做广告吗？do you have products to sell in net？
by hello 18 Nov '99

18 Nov '99

��Ҫ��棬��㽫��Ҫ��Ĳ�Ʒ�Ͷ��ң��һ�Ϊ�㶨��Ҫ��ַ��۸�30��ַ100Ԫ��һ�ף�һ��ڽ��ҵ��usa123888@yaoweb.com��û��usa123268��usa123368 ��Ҳ��yaoweb.com�� ַ�Ա��ϵ��㲻��Ҫ�ҿ��ҵĹ�棬�뷢�ʼ��û��usa123468 @ yaoweb.com��Ҫ�󳷳��ַ�� д�� do you have products to sell in net ,please contact with me .i can find 300000 emailaddress for you only 10$ ,and i will sent it with a emailsendersoft to you,if you need please sent a mail to me ,my email: username��usa123888(a)yaoweb.com or username:usa123268 or username:usa123368 they are yaoweb.com if you want to remove your emailaddress pleses sent email to username:usa123468 its yaoweb.com and full in your emaiaddress on subject.then i will delete it ��Ҫ��V�棬Ո�㌢��ĮaƷ�� Ҫ�Ŀ͑��V�ң��ҕ��Ҫ��㶨��30�f�]��ַ��r��100Ԫ��10Ԫ��K��һ��]��ܛ��׌��һ��ڽ�؛��ҕ��]��ܛ��l��]�䣬Ԕ��Susa123888(a)yaoweb.com ��Ñ��usa123168 usa123268 usa123368 ��(a)yaoweb.com ��㲻��Ҫ�@�V�棬Ո�l�]�� usa123468��yaoweb.comҪ�󳷳��ژ��}�Ќ��]��ַ��

1 0

default log statement
by Balazs Scheidler 17 Nov '99

17 Nov '99

Hi, There was a feature request to syslog-ng, so that you could add default log statement, where all non filtered traffic goes. My question is that how this should look like in the configuration file? Alternatives: 1) log(DEFAULT) { source(src); destination(dst); }; 2) log { source(src); filter(DEFAULT); destination(dst); }; 3) log { source(src); default; destination(dst); }; 1) would add yet another complication to the grammar, 2) looks ok, 3) is not consistent with the function() like option invocation. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

development version
by Balazs Scheidler 17 Nov '99

17 Nov '99

Hi, I've released the first development version (1.3.0) of syslog-ng to the usual places. It supports macro expansion in destination file names, and a new filter function which calls another filter rule. A new version of libol is needed (0.2.6) to compile this version. To use the new features, use the following config file snippets: 1) calling another rule filter f_mail { facility(mail); }; filter f_ftp { facility(ftp); }; filter f_default { not filter(f_mail); not filter(f_ftp); }; 2) macro expansion in destination filenames destination all { file("/var/log/$HOST.$YEAR$MONTH"); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 2