Re: logsurfer: test config file: ´.*´ - - - 0 ex ec "/bin/echo $0"

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

--411112949-232480929-1256917652=:9825
Content-Type: TEXT/PLAIN; charset=ISO-8859-1
Content-Transfer-Encoding: QUOTED-PRINTABLE


Hello,

First, I would like to suggest that you try Logsurfer+ instead of=20
Logsurfer.  It has a couple of additional features and its development is=
=20
still active :)  I'm /technically/ listed as a developer of Logsurfer+,=20
but I think thats only for my moral support :)  I do /honestly/ think it=20
is a better way to go. :)

Are you specifying the filename of the input file? (or, are you typing any=
=20
input to STDIN when running logsurfer?)

I was able to use Logsurfer+ version 1.7 with the config file:
'.*' - - - 0 exec "/bin/echo $0"

and it dutifully printed each line of input.

HTH,
Jim

James E. Prewett                    [email protected] [email protected]=20
Systems Team Leader           LoGS: http://www.hpc.unm.edu/~download/LoGS/=
=20
Designated Security Officer         OpenPGP key: pub 1024D/31816D93   =20
HPC Systems Engineer III   UNM HPC  505.277.8210

On Thu, 29 Oct 2009, J4 wrote:

> Dear all log analysers,
>=20
> =09I compiled & installed logsurfer1.5b from Source Forge.
>=20
> The logsurfer man page states that when I use a configuration file
> containing this line then all std in ought to be sent to std out.
> =B4.*=B4 - - - 0 exec "/bin/echo $0"
>=20
> Just to check that echo is there,
> # which echo
> /bin/echo
>=20
>=20
> However, this does not happen in my case:
>=20
> # logsurfer -c testfile
> warning: logsurfer started as root
> de
> ^Cexiting program - please wait...
> dumping state to /dev/null
> sending timeout to contexts...
> cleaning up memory...
>=20
> Is there something that I have missed?
>=20
> Here follows the trace, in case someone really wants to read it.  I
> think that you can ignore the access("/etc/ld.so.preload", because I
> think its an environmental check for Debian world and this is an
> openSUSE 11.0 (X86-64) system.
>=20
>=20
> # strace logsurfer -c testfile
> execve("/usr/local/bin/logsurfer", ["logsurfer", "-c", "testfile"], [/*
> 59 vars */]) =3D 0
> brk(0)                                  =3D 0x611000
> mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
> =3D 0x7fd03e32b000
> mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
> =3D 0x7fd03e32a000
> access("/etc/ld.so.preload", R_OK)      =3D -1 ENOENT (No such file or
> directory)
> open("/etc/ld.so.cache", O_RDONLY)      =3D 3
> fstat(3, {st_mode=3DS_IFREG|0644, st_size=3D72946, ...}) =3D 0
> mmap(NULL, 72946, PROT_READ, MAP_PRIVATE, 3, 0) =3D 0x7fd03e318000
> close(3)                                =3D 0
> open("/lib64/libc.so.6", O_RDONLY)      =3D 3
> read(3,
> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\345\1\0\0\0\0\0"...,
> 832) =3D 832
> fstat(3, {st_mode=3DS_IFREG|0755, st_size=3D1495120, ...}) =3D 0
> mmap(NULL, 3506872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3,
> 0) =3D 0x7fd03ddb6000
> fadvise64(3, 0, 3506872, POSIX_FADV_WILLNEED) =3D 0
> mprotect(0x7fd03df05000, 2097152, PROT_NONE) =3D 0
> mmap(0x7fd03e105000, 20480, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14f000) =3D 0x7fd03e105000
> mmap(0x7fd03e10a000, 17080, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) =3D 0x7fd03e10a000
> close(3)                                =3D 0
> mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
> =3D 0x7fd03e317000
> mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
> =3D 0x7fd03e316000
> arch_prctl(ARCH_SET_FS, 0x7fd03e3166f0) =3D 0
> open("/dev/urandom", O_RDONLY)          =3D 3
> read(3, "\313\323Mb(\232\216\r", 8)     =3D 8
> close(3)                                =3D 0
> mprotect(0x7fd03e105000, 16384, PROT_READ) =3D 0
> mprotect(0x60e000, 4096, PROT_READ)     =3D 0
> mprotect(0x7fd03e32c000, 4096, PROT_READ) =3D 0
> munmap(0x7fd03e318000, 72946)           =3D 0
> getuid()                                =3D 0
> write(2, "warning: logsurfer started as ro"..., 35warning: logsurfer
> started as root
> ) =3D 35
> brk(0)                                  =3D 0x611000
> brk(0x632000)                           =3D 0x632000
> open("testfile", O_RDONLY)              =3D 3
> read(3, "\302\264.*\302\264 - - - 0 exec \"/bin/echo $"..., 1023) =3D 35
> read(3, "", 1023)                       =3D 0
> close(3)                                =3D 0
> rt_sigaction(SIGUSR1, {0x402c25, [], SA_RESTORER|SA_RESTART,
> 0x7fd03dde8660}, NULL, 8) =3D 0
> rt_sigaction(SIGHUP, {0x402e02, [], SA_RESTORER|SA_RESTART,
> 0x7fd03dde8660}, NULL, 8) =3D 0
> rt_sigaction(SIGTERM, {0x402c53, [], SA_RESTORER|SA_RESTART,
> 0x7fd03dde8660}, NULL, 8) =3D 0
> rt_sigaction(SIGINT, {0x402c53, [], SA_RESTORER|SA_RESTART,
> 0x7fd03dde8660}, NULL, 8) =3D 0
> read(0, de
> "de\n", 4095)                   =3D 3
> wait4(-1, NULL, WNOHANG, NULL)          =3D -1 ECHILD (No child processes=
)
> read(0, ^C <unfinished ...>
> exiting program - please wait...
> dumping state to /dev/null
> sending timeout to contexts...
> cleaning up memory...
>=20
> Best regards, S.
> _______________________________________________
> LogAnalysis mailing list
> [email protected]
> http://www.loganalysis.org/mailman/listinfo/loganalysis
>=20
--411112949-232480929-1256917652=:9825
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
LogAnalysis mailing list
[email protected]
http://www.loganalysis.org/mailman/listinfo/loganalysis
--411112949-232480929-1256917652=:9825--