- syslog-ng - lists.balabit.hu

Mailman upgrade
by Balazs Scheidler 12 Apr '99

12 Apr '99

Hi, Due to several bugs in our listprocessor mailman 1.0b6, I upgraded to mailman 1.0b11, which seems much more stable. Sadly enough mailman has binary config files, and for several reasons I couldn't simply copy the old configuration to the new one, thus I resubscribed everyone by hand. So you do not need to subscribe again, but any personal settings & passwords have been lost. If you want to modify your settings, simply go to the list preferences page at: http://vekoll.vein.hu/mailman/listinfo Choose the "Email my password" button, and as you have your password, set your preferences as you like it. If you have any problems, please send me them at: bazsi(a)balabit.hu -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

syslog-ng 1.1.6 & libol 0.1.3
by Balazs Scheidler 11 Apr '99

11 Apr '99

Hi, I released $SUBJECT, which implements filtering syntax as suggested Richi Plana <richip(a)mozcom.com>, and fixes some of the build problems reported earlier. You can find them at the usual places. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi(a)balabit.hu

1 0

Question on semantics
by Richi Plana 11 Apr '99

11 Apr '99

Hi, Not to mean to be nitpicking, but the original syslog man pages state that priority is defined to be: priority ::= facility . level So shouldn't the config semantics be: filter f_messages { ( level(info) or level(notice) or level(warn) ) and not facility(auth) and not facility(authpriv) and not facility(cron) and not facility(daemon) and not facility(mail) and not facility(news); }; or better yet, filter f_messages { level(info,notice,warn..crit) and not facility(auth,authpriv,cron,daemon,mail,news); }; L L Richi Plana 8^) ,-,-. ,-,-. ,-,-. ,-,-. ,- LL LL Systems Administrator / / \ \ / / \ \ / / \ \ / / \ \ / / LLLLL Mosaic Communications, Inc. \ \ / / \ \ / / \ \ / / \ \ / / LLLLL mailto:richip@mozcom.com `-'-' `-'-' `-'-' `-'-' ------PGP key http://www2.mozcom.com/~richip/richip.asc ----------------

2 2

libol 0.1.1 compile problem and a suggestion
by Richi Plana 11 Apr '99

11 Apr '99

You wrote: |o| I have released $SUBJ, though did not announce them widely, only on |o| this list. I worked on parsing and evaluating filter statements. The new |o| syntax will be similar to function calls: I tried compiling libol-0.1.1 on a RH5.2 Linux system and came up with the ff. error: make[1]: Entering directory `/home/richip/src/libol-0.1.2/src' cd /home/richip/src/libol-0.1.2 && autoheader /usr/bin/autoheader: Symbol `HAVE_ATTRIBUTE' is not covered by /usr/lib/autoconf/acconfig.h ./acconfig.h I am not familiar with autoconf and I'm hoping someone on the list could tell me what to do. I did see the ff. line in the output of 'configure': checking for __attribute__... yes and thought it would be safe to add '#define HAVE_ATTRIBUTE 1' in ./acconfig.h . Was that bad? |o| The only issue left is how to deal with priorities. Original |o| syslogd accepts a message above or equal to the a specific |o| priority (and not only the specific priority). I may add an |o| optional parameter to priority() so that the relation could also |o| be specified: |o| |o| priority(info, GE) How about a level range specified using the '..' operator: priority(debug..notice,err,alert..) L L Richi Plana 8^) ,-,-. ,-,-. ,-,-. ,-,-. ,- LL LL Systems Administrator / / \ \ / / \ \ / / \ \ / / \ \ / / LLLLL Mosaic Communications, Inc. \ \ / / \ \ / / \ \ / / \ \ / / LLLLL mailto:richip@mozcom.com `-'-' `-'-' `-'-' `-'-' ------PGP key http://www2.mozcom.com/~richip/richip.asc ----------------

2 1

Link to new conf style on web page is wrong
by Richi Plana 11 Apr '99

11 Apr '99

Hi, On the syslog-ng web page, the link to the new conf style is: http://www.balabit.hu/products/syslog-ng.conf.sample-1.1 when it actually is: http://www.balabit.hu/products/syslog-ng.sample-1.1 L L Richi Plana 8^) ,-,-. ,-,-. ,-,-. ,-,-. ,- LL LL Systems Administrator / / \ \ / / \ \ / / \ \ / / \ \ / / LLLLL Mosaic Communications, Inc. \ \ / / \ \ / / \ \ / / \ \ / / LLLLL mailto:richip@mozcom.com `-'-' `-'-' `-'-' `-'-' ------PGP key http://www2.mozcom.com/~richip/richip.asc ----------------

1 0

syslog-ng-1.1.5
by Balazs Scheidler 10 Apr '99

10 Apr '99

Hi, I have released syslog-ng 1.1.5, in which I implemented the new filtering code. This version could even be used as a syslogd replacement, since you can use priorities and facilities to direct log messages, though advanced syslog-ng features are not ready yet. Here is a sample configuration file I used to test the code: --- source src { unix-stream /dev/log; }; destination messages { file /dev/tty9; }; destination other { file /dev/tty10; }; filter f_messages { (priority(= info) or priority(= notice) or priority(= warn)) and not facility(auth) and not facility(authpriv) and not facility(cron) and not facility(daemon) and not facility(mail) and not facility(news); }; log { source src; filter f_messages; destination messages; }; log { source src; destination other; }; --- I am going to announce this on freshmeat, please test this version for both program- and build errors. Thanks. -- Bazsi

1 0

syslog-ng 1.1.4 & libol 0.1.1
by Balazs Scheidler 09 Apr '99

09 Apr '99

Hi, I have released $SUBJ, though did not announce them widely, only on this list. I worked on parsing and evaluating filter statements. The new syntax will be similar to function calls: filter f_messages { priority(info) and not facility(authpriv) }; you can use parentheses and several and/or operators. I hope this will make syslog-ng easier to use and configure. The only issue left is how to deal with priorities. Original syslogd accepts a message above or equal to the a specific priority (and not only the specific priority). I may add an optional parameter to priority() so that the relation could also be specified: priority(info, GE) which would mean that priorities of info and above are forwarded. I am going out the next two days, but on returning I plan to continue working on syslog-ng. -- Bazsi

1 0

syslog-ng 1.1.3
by Balazs Scheidler 09 Apr '99

09 Apr '99

Hi, I have released syslog-ng 1.1.3, which fixes the dependency on scsh, and adds affile.c.x to the distribution. I have began implementing filter statement parsing, though only syntax checking is done. -- Bazsi

1 0

snapshot 1.1.2 has been released
by Balazs Scheidler 09 Apr '99

09 Apr '99

Hello, I have released version 1.1.2 of syslog-ng. It is available at http://www.balabit.hu/downloads/syslog-ng/source. Together with the source tarball you'll need the libol package, which I have split off from the main distribution tree. For installation instructions see the web page (http://www.balabit.hu/products/syslog-ng) As several of you (and sometimes even me) has troubles using filter statements, and I am about to reimplement them, I ask you to tell me about your proposals on a better syntax. I think both AND and OR connections between expressions should be allowed in one statement, e.g: filter f_messages { (priority info AND not facility authpriv) or facility mail }; maybe to make syntax cleaner, I'll make functions from priority and facility, so that the above line would become: filter f_messages { (priority(info) and facility(authpriv) or facility(mail); }; What do you think? -- Bazsi

3 6

Problems with syslog-ng 1.0.4
by Cristiano Lincoln Mattos 06 Apr '99

06 Apr '99

Hi, Im trying to replace syslog with syslog-ng at my site. Version 1.0.4, libc5 (rh42). Everything compiled fine, but i am having trouble getting the equivalent to this syslog line below to work: *.info;mail.none;authpriv.none /var/log/messages Here is what i tried: source local { udp 0.0.0.0,514; unix-stream /dev/log; }; destination d_messages { file /var/log/messages; }; destination d_authpriv { file /var/log/secure; }; destination d_mail { file /var/log/maillog; }; filter f_mail { facility mail; }; filter f_authpriv { facility authpriv; }; filter f_mess { priority info; not facility mail; not facility authpriv; }; log { source local; filter f_mail; destination d_mail; }; log { source local; filter f_mess; destination d_messages; }; log { source local; filter f_authpriv; destination d_authpriv; }; When i generate messages for mail.notice, it goes to /var/log/messages *and* /var/log/maillog, and when i generate them for authpriv.notice, they go to /var/log/messages *and* to /var/log/secure, which is wrong (they are not supposed to go to /var/log/messages). The strange thing is, if i try this filter line: filter f_mess { priority info; not facility mail; }; .. and generate messages for mail.notice, it goes (correctly) to only /var/log/maillog. Also, if i try this: filter f_mess { priority info; not facility authpriv; }; ... and generate messages for authpriv.notice, it goes (correctly) to only /var/log/authpriv. So... if i put both together, it doesn't work, if i put each one separately, they do. Is this correct? Is there any other way i can use that syslog-type line? PS: i tried using the conf-convert.pl script, and it did not work, either. Thank you, -- Cristiano Lincoln Mattos Recife / Brazil

3 2