On Thu, Dec 14, 2006, Thomas Lotterer wrote:
>Bill,
>
>Bill Campbell<[EMAIL PROTECTED]> wrote on 2006-12-13 19:04:
>> Is there any easy way to identify the program that's causing
>> entries to end up in the %{l_prefix}/var/fsl/fsl.log file?
>>
>this is really a challenge because fsl doesn't know the application it is
>linked into and the application being faked into believing it is using syslog
>doesn't know about fsl!
OK:
I've tracked this down to the libwrap implementation in openssh where
it calls the tcpwrappers ``refuse'' routine which uses syslog without
an openlog first. This is done in the sshd.c file. The openssh log.c
routines go through some machinations to determine whether to user
openlog_r or openlog, but do the right thing.
Interestingly enough there's a comment in the log.c file around line
291 that recognized that libwrap may have done syslog things without a
proper open.
A crude hack might be to call the ``logit'' routine from sshd.c just
before calling ``refuse''. It would end up with an extra line in the
logs, but would get them all in the right place.
Bill
--
INTERNET: [EMAIL PROTECTED] Bill Campbell; Celestial Software, LLC
URL: http://www.celestial.com/ PO Box 820; 6641 E. Mercer Way
FAX: (206) 232-9186 Mercer Island, WA 98040-0820; (206) 236-1676
``Microsoft IIS has more holes than a wheel of Swiss Cheese after a shotgun
blast'' -- John Dvorak
______________________________________________________________________
The OpenPKG Project www.openpkg.org
Developer Communication List openpkg-dev@openpkg.org
