- syslog-ng - lists.balabit.hu

closed TCP streams
by Bradley Urberg Carlson 19 Aug '99

19 Aug '99

If I am using a destination: destination tcptest { tcp("137.192.192.104" port(4020) ); }; ...and I kill and restart the TCP server at my end, then syslog-ng complains: io.c: do_write: write() failed (errno 32), Broken pipe ...but does not try to reconnect until HUP or restart. -Bradley

1 0

multiple facilities/streams into a named pipe?
by streiner-syslogng＠sgi.net 17 Aug '99

17 Aug '99

This is a pretty off-the-wall question, but I figure I'd give it a shot ;-) I work in a largely Solaris shop and have to deal with many of the quirks of its syslog implementation. One of these quirks came up when I tried on a hunch to get multiple event streams to feed into the same named pipe, which would then get pushed off to a network management system. The reason I wanted to do this was organizational; i.e. have all routers log to local7.debug on my log server, switches log to local6.debug, ras servers to local5.debug and so on. From what I've seen in early tests, this type of setup either causes Sun's syslogd fits or could potentially clobber data being written to the pipe. My questions are: 1) has anyone ever tried anything like this? 2) is syslog-ng capable of supporting a setup like this on a Solaris 2.7 box? tia jms

2 1

Re: syslog-ng 1.1.31 && Solaris 2.6 SPARC
by Bradley Urberg Carlson 17 Aug '99

17 Aug '99

Erik M. Beebe erik(a)infi.net wrote on Thu, 12 Aug 1999 16:56:37 -0400: > I have recently installed syslog-ng 1.1.31 && libol-0.2.3 on a machine > running SPARC Solaris 2.6; If I connect to port 514/UDP using NetCat, > syslog-ng logs it just fine. If I try to use "logger" locally, it does > not. ... > I don't believe it's any problems with the destination/filter/log lines > causing this problem -- it looks like syslog-ng just isn't getting what is > sent to /dev/log. Anyone have any idea what could be causing this? There are a bunch of messages in the June archive with the thread "syslog-ng and solaris doors again". Apparently, there is still some work going into logging messages locally under solaris. I also tried v1.1.31 with Solaris and found the same problem. My workaround was to run syslog-ng AND the Solaris syslogd, with syslogd forwarding all local messages to syslog-ng on the localhost using UDP. Since syslog-ng works fine from UDP, this gets all the messages (network-generated + locally-generated) into syslog-ng. Details: -syslogd listens to bogus/unused UDP port 999, and sends local messages to syslog-ng using UDP 999: *** /etc/services~ Mon Aug 16 21:02:39 1999 --- /etc/services Mon Aug 16 20:28:30 1999 *************** *** 61,63 **** who 513/udp whod ! syslog 514/udp talk 517/udp --- 61,63 ---- who 513/udp whod ! syslog 999/udp talk 517/udp *** /etc/syslog.conf~ Mon Mar 29 10:17:35 1999 --- /etc/syslog.conf Mon Aug 16 21:05:03 1999 *************** *** 1,1 **** ! *.debug @loghost --- 1,1 ---- ! *.debug @localhost -syslog-ng listens to the network-generated messages coming in on 514/UDP, and also listens to locally-generated messages coming in from syslogd on 999/UDP: source s_network { udp(ip(0.0.0.0) port(514)); }; source s_syslogd { udp(ip(localhost) port(999)); };

1 0

RE: [syslog-ng] Got 1.1.31 running on FreeBSD3
by Lowkrantz, Goran 14 Aug '99

14 Aug '99

And then I missed the obvious. I have attached the patch of src/utils.c, just a missing variable. Cheers, Goran L -----Original Message----- From: Lowkrantz, Goran [mailto:Goran.Lowkrantz@infologigruppen.se] Sent: Saturday, August 14, 1999 3:13 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng] Got 1.1.31 running on FreeBSD3 Hi, I got the 1.1.31 version up and running on FreeBSD 3.1R and 3.2S with two small glitches. 1: src/config.h: #define HAVE_MODERN_UTMP 0 2: When compiling util.c I get the following messages. gcc -DHAVE_CONFIG_H -I. -I/usr/home/glz/work.d/syslog-ng-1.1.31/src -I. -O2 -Wall -I/usr/local/include/libol -c utils.c In file included from utils.c:32: /usr/include/arpa/inet.h:89: warning: parameter has incomplete type /usr/include/arpa/inet.h:92: warning: parameter has incomplete type /usr/include/arpa/inet.h:96: warning: parameter has incomplete type I will track them down later today if no-one have a quick answer. The tests I have made so far work OK. Cheers, Goran L --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Got 1.1.31 running on FreeBSD3
by Lowkrantz, Goran 14 Aug '99

14 Aug '99

Hi, I got the 1.1.31 version up and running on FreeBSD 3.1R and 3.2S with two small glitches. 1: src/config.h: #define HAVE_MODERN_UTMP 0 2: When compiling util.c I get the following messages. gcc -DHAVE_CONFIG_H -I. -I/usr/home/glz/work.d/syslog-ng-1.1.31/src -I. -O2 -Wall -I/usr/local/include/libol -c utils.c In file included from utils.c:32: /usr/include/arpa/inet.h:89: warning: parameter has incomplete type /usr/include/arpa/inet.h:92: warning: parameter has incomplete type /usr/include/arpa/inet.h:96: warning: parameter has incomplete type I will track them down later today if no-one have a quick answer. The tests I have made so far work OK. Cheers, Goran L --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

1 0

Re: Re: Syslog-ng: [wishlitst ;)] make it color. :)
by Siddall 12 Aug '99

12 Aug '99

>On Sat, Jul 31, 1999 at 11:24:11PM +0200, Dawid Kuroczko wrote: >> Hello! >> >> I have a suggestion, a feature I'd really like to see in a syslog >> daemon, but I haven't found do far. Please make it use ANSI color >> escapes ("\033[31;41;1m") while presenting messages to console, >> for example to make important messages red, standard grey and >> network green. I think it should be configurable, but I don't >> know where. :) Maybe a special color foo { ... } section, or >> maybe special additions in destination bar { ... } ? I think >> you're the best person to decide. I'm sorry I cannot send you >> a patch, but I'm to weak at C, unfortunately. :) > >Hi, > >I think this will be possible with the rewrite rules to be introduced in the >1.3.x series, but you'll have to wait for that a bit. > >-- >Bazsi >PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD >804E C82C 8EB1 > url: http://www.balabit.hu/pgpkey.txt I am new to this program, and new to the Linux world in general (6 days old) however I have this to offer: I would like to propose a small amendment to that idea. Simply allow user definable message PREFIX (msgpfx) and SUFIXs (msgsfx) that would automatically be appended onto the alert. Allow this to be done in the destination field so that you have the most control. Then the config file might look something like this. destination tty1 { msgpfx("\[\033[34m\]**ALERT!!!**"); msgsfx("**ALERT!!!**\[\033[0m\]); pipe("/dev/tty1"); usertty("administrator"); }; -Corbin B. Siddall, MCSE, CCNA

1 0

syslog-ng 1.1.31 && Solaris 2.6 SPARC
by Erik M. Beebe 12 Aug '99

12 Aug '99

Hello; I have recently installed syslog-ng 1.1.31 && libol-0.2.3 on a machine running SPARC Solaris 2.6; If I connect to port 514/UDP using NetCat, syslog-ng logs it just fine. If I try to use "logger" locally, it does not. Here are my source lines: source stdlog { sun-streams("/dev/log" door("/etc/.syslog_door")); }; source src { internal(); udp(ip(0.0.0.0) port(514)); }; I don't believe it's any problems with the destination/filter/log lines causing this problem -- it looks like syslog-ng just isn't getting what is sent to /dev/log. Anyone have any idea what could be causing this? Thanks much in advance, Erik -- Erik M. Beebe Infinet System Administrator Phone: (757) 664-2227 Email: ebeebe(a)infi.net http://www.infi.net

1 0

Re: [syslog-ng] Compile Error for syslog-ng-1.1.30
by Balazs Scheidler 11 Aug '99

11 Aug '99

On Fri, Aug 06, 1999 at 02:28:19PM +0900, bazsi wrote: > > > < static utmp ut; > > > --- > > > > static struct utmp ut; > > > > getutent() emulation for systems which not have one is still broken in at > > least one way. getutent() should return NULL when the EOF is reached. > > Though I don't understand C language very well... > > If read() read EOF then return (ssize_t)NULL. It's right. > But, Can I hope stored NULL to &ut by read() at the time? No. I have fixed it now. But Solaris should support getutent() calls, so you don't need those routines. This is the correct getutent() call for those interested: struct utmp *getutent(void) { static struct utmp ut; if (utent_fd == -1) { utent_fd = open(_PATH_UTMP, O_RDONLY | O_NOCTTY); } if (utent_fd == -1) return NULL; rc = read(utent_fd, &ut, sizeof(ut)); if (rc <= 0) { close(utent_fd); utent_fd = -1; return NULL; } else { return &ut; } } > > Could you provide some messages before the first door_return call? Maybe in > > a private message. > > OK. The following is what I Executed commands. > > # cp /dev/null /var/log/test.log > # ls -l /var/log/test.log > -rw-r--r-- 1 root other 0 Aug 6 13:41 /var/log/test.log > # /usr/local/sbin/syslog-ng > Terminated > # su - > # su - > # ps -ef | grep syslog-ng > root 21724 1 0 13:43:29 ? 0:00 /usr/local/sbin/syslog-ng > # cat /var/log/test.log > Aug 6 13:43:29 src@sun1 syslog-ng[21724]: syslog-ng version 1.1.30 starting I'd need a bit different truss outputs. 1) Launch syslog-ng using the truss -o syslog-ng.truss ./syslog-ng -dv Using -dv will prevent forking. 2) While the previous truss is running, on a different terminal (or VT session): truss -o logger.truss logger "This is a message" The files syslog-ng.truss and logger.truss is what I need. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

syslog-ng 1.1.31
by Balazs Scheidler 07 Aug '99

07 Aug '99

Hi, To fix the encountered build bugs in 1.1.30, I release 1.1.31. I tried to track the memory leak someone has mentioned, but it simply doesn't leak for me. I sent syslog-ng 100 simoultenious connections, 1000 messages each connection, from both local programs, and from network connections. It doesn't grow. Maybe who reported this, doesn't run the latest version? I've also released a new version of libol, though not much is changed there. A few error messages have been changed to be only verbose messages. Here's the changelog: 1999-08-07 Balazs Scheidler <bazsi(a)balabit.hu> * afuser.c: works on old utmp structures too (NetBSD) * configure.in: added test for modern utmp structure, bumped version number, changed required libol version to 0.2.3 * utils.c: fixed a bug in getutent() implementation * main.c: fixed a bug in SIGTERM handling, exit message is now displayed I've also updated the .deb packages, they are exact copies of what I am using on my computer. You can find this at the usual places: http://www.balabit.hu/products/syslog-ng and http://www.balabit.hu/downloads/syslog-ng Have fun! PS: I am going to a canoe tour next week, so I won't be able to respond to my mail. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Compile Error for syslog-ng-1.1.30
by georg.funke＠netcologne.de 06 Aug '99

06 Aug '99

Hi, when i try to syslog-ng-1.1.30, i get the following error: utils.c: In function `getutent': utils.c:70: syntax error before `ut' utils.c:77: `ut' undeclared (first use in this function) utils.c:77: (Each undeclared identifier is reported only once utils.c:77: for each function it appears in.) utils.c:79: warning: control reaches end of non-void function My System is Redhat 6.0 with kernel 2.2.10 and the compiler is gcc-2.95. Can you help me why i get this error? Thanks Georg -- Georg Funke Crowns & Flames SDC Cologne, Germany; http://www.geocities.com/Colosseum/4893 "Friendship is Square Dancing's greatest Reward"

3 4