From cclark at quadrantsec.com  Mon Dec  2 20:52:26 2013
From: cclark at quadrantsec.com (Champ Clark III)
Date: Mon, 02 Dec 2013 14:52:26 -0500
Subject: [Lognorm] Minor issue with liblognorm 1.0.0 release.
In-Reply-To: <CAAq4--TGs=0f0vn744na5kGVJs4Fue7oqTTUf5JJ5Jdvzk9VjQ@mail.gmail.com>
References: <CAAq4--TGs=0f0vn744na5kGVJs4Fue7oqTTUf5JJ5Jdvzk9VjQ@mail.gmail.com>
Message-ID: <529CE4FA.7090706@quadrantsec.com>


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Just started working with Sagan and liblognorm 1.0.0.  I've cleaned my
dev box off all old versions of libee, libestr and liblognorm.   Then
rebuilt from git using my normal process.

It appears that liblognorm.h is trying to call:

#include <json.h>

My json-c is located in the /usr/include/json/json.h

Easy fix manually,  but just thought you might want to know.



- -- 
- - Quadrant Information Security
  Champ Clark III
  o: 800.538.9357 x 101
  c: 850.443.2440
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEbBAEBAgAGBQJSnOT6AAoJENnmXt7Lmc3Kl4AH9Rc6kpnygMRHW8UJEMCaP6fj
YcXfr0MWLVMx7UJu31UsPHynUtmyOcOxbalFg/aG2rKl/f5FbX43jyCTO/MNWpeS
cDh2IVOGVvouknMJIcU9ht60m7XUqZiQFzoMO4bVZp5Xp5wIPhKgrF+4qu/XlTgy
Wdnjukp1jY1w/J7SAJxyAjbzd5XQzMXj7hidHeMWwvhdnUY40Aaym6ck+LYSe3yb
0AWzoLd6qikJZbIB+ITDoQGOkNrlLUlqGQhMLsUIw6yafTHIiUhsq+ubUJYiDmY9
OIriNHy5oBH+tYSjbW572sIAYwArgXV2dC57q2x6D5wCtFZC8YxoeI1xYabFew==
=aCJp
-----END PGP SIGNATURE-----


From pavel at levshin.spb.ru  Tue Dec  3 06:23:53 2013
From: pavel at levshin.spb.ru (Pavel Levshin)
Date: Tue, 03 Dec 2013 09:23:53 +0400
Subject: [Lognorm] Minor issue with liblognorm 1.0.0 release.
In-Reply-To: <529CE4FA.7090706@quadrantsec.com>
References: <CAAq4--TGs=0f0vn744na5kGVJs4Fue7oqTTUf5JJ5Jdvzk9VjQ@mail.gmail.com>
	<529CE4FA.7090706@quadrantsec.com>
Message-ID: <529D6AE9.3060408@levshin.spb.ru>

02.12.2013 23:52, Champ Clark III:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Just started working with Sagan and liblognorm 1.0.0.  I've cleaned my
> dev box off all old versions of libee, libestr and liblognorm.   Then
> rebuilt from git using my normal process.
>
> It appears that liblognorm.h is trying to call:
>
> #include <json.h>
>
> My json-c is located in the /usr/include/json/json.h
>
> Easy fix manually,  but just thought you might want to know.
>
>

Thank you for the report. The header's location has changed in json-c 
0.11. Using exact path in #include would lead to complex conditional 
directives each time this header is needed.

Liblognorm makes use of pkg_config to find json-c package. There should 
be something like this in the system (this example is from RHEL6):

$ cat /usr/lib64/pkgconfig/json.pc

prefix=/usr
exec_prefix=/usr
libdir=/usr/lib64
includedir=/usr/include

Name: json
Description: JSON implementation in C
Version: 0.10
Requires:
Libs:  -L${libdir} -ljson
Cflags: -I${includedir}/json


Cflags are used to find correct header's path.


--
Pavel Levshin


From cclark at quadrantsec.com  Fri Dec  6 20:56:05 2013
From: cclark at quadrantsec.com (Champ Clark III)
Date: Fri, 06 Dec 2013 14:56:05 -0500
Subject: [Lognorm] Minor issue with liblognorm 1.0.0 release.
In-Reply-To: <529CE4FA.7090706@quadrantsec.com>
References: <CAAq4--TGs=0f0vn744na5kGVJs4Fue7oqTTUf5JJ5Jdvzk9VjQ@mail.gmail.com>
	<529CE4FA.7090706@quadrantsec.com>
Message-ID: <52A22BD5.70606@quadrantsec.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

A Sagan user brought this up on the sagan-users mailing list as well.
 Here's how I resolved it in Sagan:

In my configure.ac

- --<snip>--

# Check multiple locations for json-c headers

AC_CHECK_HEADERS([json/json.h json.h], [break], [AC_MSG_ERROR([json-c
headers not found or not usable])])

# Check multple names of json-c libraries.

AC_CHECK_LIB(json, main,, [ AC_CHECK_LIB(json-c,
main,,AC_MSG_ERROR(The json library cannot be found. This library is
important for the correlation aspects of Sagan! Please see
https://wiki.quadrantsec.com/bin/view/Main/LibLogNorm. To disable this
feature use the --disable lognorm flag.)) ],)

- --<snip>--

In my source (sagan-liblognorm.c),  I added:

- --<snip>--

#if defined(HAVE_JSON_JSON_H)
#  include <json/json.h>
#else
#  include <json.h>
#endif

- --<snip>--

It should resolve the issue building on Gentoo, Fedora 19, etc).

Hope this helps.



On 12/2/13, 2:52 PM, Champ Clark III wrote:
> 
> Just started working with Sagan and liblognorm 1.0.0.  I've cleaned
> my dev box off all old versions of libee, libestr and liblognorm.
> Then rebuilt from git using my normal process.
> 
> It appears that liblognorm.h is trying to call:
> 
> #include <json.h>
> 
> My json-c is located in the /usr/include/json/json.h
> 
> Easy fix manually,  but just thought you might want to know.
> 
> 
> 
> 

- -- 
- - Champ Clark III (cclark at quadrantsec.com)
  Quadrant Information Security (http://quadrantsec.com)
  Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A
  GPG Key ID: 0381878A
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJSoivVAAoJENnmXt7Lmc3KheYH/RcoSbFfQIfuIXvzebLOVe9T
Py6SgnP2HUVFBGhzBjg3eH9cV0YRlObzZSggJ9KLl/D+sydXcmTIWaJDGOFGZfwH
UP3yytujn18pMzCMEP1YvA+793gG/wTKcIotWM2lXTuF7/AMkdvVLjAHqj1jYjYT
MTohhXDelGxJv8kmOUof9Ik1X6oIePvAq2R0HMwRdbU/4PQbscN6lWucFg1mcNgb
Ad77vcmVfZerQlzbEkw4xilIDnCmealoFZONzWvT5OEn+BY+qwAvivAdlmSYQdj8
YKHVUNkL8w74kvAve6ayb4P2c2Tya95a5iisMEkFxCb7gLVz3di2uVfC/jaUE7A=
=To8v
-----END PGP SIGNATURE-----

From cclark at quadrantsec.com  Fri Dec  6 21:28:55 2013
From: cclark at quadrantsec.com (Champ Clark III)
Date: Fri, 06 Dec 2013 15:28:55 -0500
Subject: [Lognorm] Minor issue with liblognorm 1.0.0 release.
In-Reply-To: <52A22BD5.70606@quadrantsec.com>
References: <CAAq4--TGs=0f0vn744na5kGVJs4Fue7oqTTUf5JJ5Jdvzk9VjQ@mail.gmail.com>
	<529CE4FA.7090706@quadrantsec.com> <52A22BD5.70606@quadrantsec.com>
Message-ID: <5dd97129-19f8-40dd-8544-3fb022bcbce3@email.android.com>

On last thing.   I have Sagan now using the new API and I really like it!  Nicely done!

Champ Clark III <cclark at quadrantsec.com> wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>A Sagan user brought this up on the sagan-users mailing list as well.
> Here's how I resolved it in Sagan:
>
>In my configure.ac
>
>- --<snip>--
>
># Check multiple locations for json-c headers
>
>AC_CHECK_HEADERS([json/json.h json.h], [break], [AC_MSG_ERROR([json-c
>headers not found or not usable])])
>
># Check multple names of json-c libraries.
>
>AC_CHECK_LIB(json, main,, [ AC_CHECK_LIB(json-c,
>main,,AC_MSG_ERROR(The json library cannot be found. This library is
>important for the correlation aspects of Sagan! Please see
>https://wiki.quadrantsec.com/bin/view/Main/LibLogNorm. To disable this
>feature use the --disable lognorm flag.)) ],)
>
>- --<snip>--
>
>In my source (sagan-liblognorm.c),  I added:
>
>- --<snip>--
>
>#if defined(HAVE_JSON_JSON_H)
>#  include <json/json.h>
>#else
>#  include <json.h>
>#endif
>
>- --<snip>--
>
>It should resolve the issue building on Gentoo, Fedora 19, etc).
>
>Hope this helps.
>
>
>
>On 12/2/13, 2:52 PM, Champ Clark III wrote:
>> 
>> Just started working with Sagan and liblognorm 1.0.0.  I've cleaned
>> my dev box off all old versions of libee, libestr and liblognorm.
>> Then rebuilt from git using my normal process.
>> 
>> It appears that liblognorm.h is trying to call:
>> 
>> #include <json.h>
>> 
>> My json-c is located in the /usr/include/json/json.h
>> 
>> Easy fix manually,  but just thought you might want to know.
>> 
>> 
>> 
>> 
>
>- -- 
>- - Champ Clark III (cclark at quadrantsec.com)
>  Quadrant Information Security (http://quadrantsec.com)
>  Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A
>  GPG Key ID: 0381878A
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
>Comment: GPGTools - http://gpgtools.org
>Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
>iQEcBAEBAgAGBQJSoivVAAoJENnmXt7Lmc3KheYH/RcoSbFfQIfuIXvzebLOVe9T
>Py6SgnP2HUVFBGhzBjg3eH9cV0YRlObzZSggJ9KLl/D+sydXcmTIWaJDGOFGZfwH
>UP3yytujn18pMzCMEP1YvA+793gG/wTKcIotWM2lXTuF7/AMkdvVLjAHqj1jYjYT
>MTohhXDelGxJv8kmOUof9Ik1X6oIePvAq2R0HMwRdbU/4PQbscN6lWucFg1mcNgb
>Ad77vcmVfZerQlzbEkw4xilIDnCmealoFZONzWvT5OEn+BY+qwAvivAdlmSYQdj8
>YKHVUNkL8w74kvAve6ayb4P2c2Tya95a5iisMEkFxCb7gLVz3di2uVfC/jaUE7A=
>=To8v
>-----END PGP SIGNATURE-----
>_______________________________________________
>Lognorm mailing list
>Lognorm at lists.adiscon.com
>http://lists.adiscon.net/mailman/listinfo/lognorm

-- 
Quadrant Information Security
800.538.9357
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20131206/10440b36/attachment.html>

From pavel at levshin.spb.ru  Sat Dec  7 10:51:23 2013
From: pavel at levshin.spb.ru (Pavel Levshin)
Date: Sat, 07 Dec 2013 13:51:23 +0400
Subject: [Lognorm] Minor issue with liblognorm 1.0.0 release.
In-Reply-To: <52A22BD5.70606@quadrantsec.com>
References: <CAAq4--TGs=0f0vn744na5kGVJs4Fue7oqTTUf5JJ5Jdvzk9VjQ@mail.gmail.com>	<529CE4FA.7090706@quadrantsec.com>
	<52A22BD5.70606@quadrantsec.com>
Message-ID: <52A2EF9B.1030908@levshin.spb.ru>

Hello,

Could you please explain, why pkg_config does not work well in your 
case? It should set correct -I option and find the header automagically. 
Unless json.pc (pkg_config description file) is incorrect on 
distribution you are using.

Anyway, your solution will probably break with next release of json-c:

0.11
   * IMPORTANT: the name of the library has changed to libjson-c.so and
      the header files are now in include/json-c.
      The pkgconfig name has also changed from json to json-c.
      You should change your build to use appropriate -I and -l options.
      A compatibility shim is in place so builds using the old name will
      continue to work, but that will be removed in the next release.


--
Pavel Levshin


06.12.2013 23:56, Champ Clark III:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> A Sagan user brought this up on the sagan-users mailing list as well.
>   Here's how I resolved it in Sagan:
>
> In my configure.ac
>
> - --<snip>--
>
> # Check multiple locations for json-c headers
>
> AC_CHECK_HEADERS([json/json.h json.h], [break], [AC_MSG_ERROR([json-c
> headers not found or not usable])])
>
> # Check multple names of json-c libraries.
>
> AC_CHECK_LIB(json, main,, [ AC_CHECK_LIB(json-c,
> main,,AC_MSG_ERROR(The json library cannot be found. This library is
> important for the correlation aspects of Sagan! Please see
> https://wiki.quadrantsec.com/bin/view/Main/LibLogNorm. To disable this
> feature use the --disable lognorm flag.)) ],)
>
> - --<snip>--
>
> In my source (sagan-liblognorm.c),  I added:
>
> - --<snip>--
>
> #if defined(HAVE_JSON_JSON_H)
> #  include <json/json.h>
> #else
> #  include <json.h>
> #endif
>
> - --<snip>--
>
> It should resolve the issue building on Gentoo, Fedora 19, etc).
>
> Hope this helps.
>
>
>
> On 12/2/13, 2:52 PM, Champ Clark III wrote:
>> Just started working with Sagan and liblognorm 1.0.0.  I've cleaned
>> my dev box off all old versions of libee, libestr and liblognorm.
>> Then rebuilt from git using my normal process.
>>
>> It appears that liblognorm.h is trying to call:
>>
>> #include <json.h>
>>
>> My json-c is located in the /usr/include/json/json.h
>>
>> Easy fix manually,  but just thought you might want to know.
>>
>>
>>
>>
> - -- 
> - - Champ Clark III (cclark at quadrantsec.com)
>    Quadrant Information Security (http://quadrantsec.com)
>    Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A
>    GPG Key ID: 0381878A
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQEcBAEBAgAGBQJSoivVAAoJENnmXt7Lmc3KheYH/RcoSbFfQIfuIXvzebLOVe9T
> Py6SgnP2HUVFBGhzBjg3eH9cV0YRlObzZSggJ9KLl/D+sydXcmTIWaJDGOFGZfwH
> UP3yytujn18pMzCMEP1YvA+793gG/wTKcIotWM2lXTuF7/AMkdvVLjAHqj1jYjYT
> MTohhXDelGxJv8kmOUof9Ik1X6oIePvAq2R0HMwRdbU/4PQbscN6lWucFg1mcNgb
> Ad77vcmVfZerQlzbEkw4xilIDnCmealoFZONzWvT5OEn+BY+qwAvivAdlmSYQdj8
> YKHVUNkL8w74kvAve6ayb4P2c2Tya95a5iisMEkFxCb7gLVz3di2uVfC/jaUE7A=
> =To8v
> -----END PGP SIGNATURE-----
> _______________________________________________
> Lognorm mailing list
> Lognorm at lists.adiscon.com
> http://lists.adiscon.net/mailman/listinfo/lognorm


From cclark at quadrantsec.com  Mon Dec  9 18:48:46 2013
From: cclark at quadrantsec.com (Champ Clark III)
Date: Mon, 09 Dec 2013 12:48:46 -0500
Subject: [Lognorm] Minor issue with liblognorm 1.0.0 release.
In-Reply-To: <52A2EF9B.1030908@levshin.spb.ru>
References: <CAAq4--TGs=0f0vn744na5kGVJs4Fue7oqTTUf5JJ5Jdvzk9VjQ@mail.gmail.com>	<529CE4FA.7090706@quadrantsec.com>	<52A22BD5.70606@quadrantsec.com>
	<52A2EF9B.1030908@levshin.spb.ru>
Message-ID: <52A6027E.7080807@quadrantsec.com>


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I understand.   I was just tested building liblognorm on Ubuntu 12.04.  
I have the stock package from Ubuntu for json-c.

The error is:

gcc -DHAVE_CONFIG_H -I. -I..     -g -O2 -MT sagan-config.o -MD -MP -MF
.deps/sagan-config.Tpo -c -o sagan-config.o sagan-config.c
In file included from sagan-config.c:49:0:
/usr/include/liblognorm.h:64:18: fatal error: json.h: No such file or
directory

In the /usr/include/liblognorm.h,  the location for json.h is hardcoded to:

#include <json.h>

The easy fix is to manually change this to:

#include <json/json.h>

I'm assuming that different distro's put the json.h in /usr/include or
/usr/include/json.   To get around this in Sagan,  I did this:

#if defined(HAVE_JSON_JSON_H)
#  include <json/json.h>
#else
#  include <json.h>
#endif

I've seen this minor build issue on Gentoo, Fedora and Ubuntu.




On 12/07/2013 04:51 AM, Pavel Levshin wrote:
> Hello,
>
> Could you please explain, why pkg_config does not work well in your
case? It should set correct -I option and find the header automagically.
Unless json.pc (pkg_config description file) is incorrect on
distribution you are using.
>
> Anyway, your solution will probably break with next release of json-c:
>
> 0.11
>   * IMPORTANT: the name of the library has changed to libjson-c.so and
>      the header files are now in include/json-c.
>      The pkgconfig name has also changed from json to json-c.
>      You should change your build to use appropriate -I and -l options.
>      A compatibility shim is in place so builds using the old name will
>      continue to work, but that will be removed in the next release.
>


- -- 
- - Quadrant Information Security
  Champ Clark III
  o: 800.538.9357 x 101
  c: 850.443.2440
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJSpgJ9AAoJENnmXt7Lmc3KHb4H/2jZHIDmqfo3X7Q5xxxAhjZS
IK+wlmzCBR2dnq09HXckwSXzK5vNOvf+Zl46096VG8Vivbw+KslTzYyiiF9ytZpR
O8+8jxWmweLO5oMMpexhw63zJeApqPikgDg22jCJqtqFrMd3JlUQK2a3r7g9a0tb
p9u0ca+sm7+LWdo+anpQ9WbgLceugrDLqIShldCxQDvYtTmJ7QnyOAQEwXJWAGAm
VYOffwJ+Jmq/cyealeRlx8QkER2hl8sSEKij7j8jHvzHI5ff4wudiIDFL8wd1JNU
wJR6mTGt5VORu++4toXHYwWuATnGQWi7Fo3kvcVXgm+5YcqU2QTK2BrjJFJHm+g=
=imOc
-----END PGP SIGNATURE-----

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20131209/74b3eb70/attachment-0001.html>

From pavel at levshin.spb.ru  Mon Dec 23 14:10:05 2013
From: pavel at levshin.spb.ru (Pavel Levshin)
Date: Mon, 23 Dec 2013 17:10:05 +0400
Subject: [Lognorm] liblognorm documentation
Message-ID: <52B8362D.2050400@levshin.spb.ru>

Hello all.

I am trying to refresh liblognorm documentation, as a part of our 
documentation effort. Current results can be seen in my own GitHub 
repository; I will push them when I'll be sure they are reasonable.

Here is the repository: 
https://github.com/flicker581/liblognorm/tree/master-doc/doc

And here are generated and published docs: 
http://flicker581.github.io/liblognorm/

Feedbacks are welcome. Currently, I'm just trying all this framework 
(sphinx, autoconf/automake, github). Chances are that many things are 
done in a broken way.


--
Pavel Levshin