<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="Section1">
<p class="MsoNormal"><span style="color:#1F497D">We are trying to streamline the syslog-ng v3.x data from the RHEL server-clients to the RHEL DCS/Syslog server while also providing another destination to a local Tripwire Log Center server.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I previously had the version 3.0.8 options (as seen below), which recorded the data files correctly on the DCS server with the correct hostname attribute:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">options {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> chain_hostnames(no);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> time_reopen(10);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> time_reap(360);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> log_fifo_size(1000);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> group(adm);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> perm(0644);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> dir_perm(0755);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> use_dns(yes);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> use_fqdn(yes);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> create_dirs(yes);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> keep_hostname(yes);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> log_msg_size(32768);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> stats_freq(0);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> flush_lines(0);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">};<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Destination (directory and log file structure):
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">destination d_general {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> file ("/var/log/syslog/general/$HOST/$FULLHOST-$MONTH.$DAY.$YEAR.log"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> template("$DATE $HOST <$FACILITY.$PRIORITY> $MSGHDR $MSG\n")<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> template_escape(no)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> );<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">};<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Example: /var/log/syslog/general/CH33Test-WebCO/CH33Test-WebCO-10.25.2010.log<br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">However, we found today that Tripwire Log Center (which we are now required to use for log aggregation/reporting needs) doesn’t have the ability to do hostname translation (i.e. regex the sender’s hostname seen
in the datastream and give it an IP address so that it can be tracked). So this means the data file that is being sent from the RHEL clients will need to keep the sender’s IP address in the actual data stream. So if I do keep_hostname(no) and still enable
the facility.priority template on the DCS server, it will show the IP address rather than the hostname of the reporting client:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Oct 25 18:51:12 10.153.13.70 <syslog.err> syslog-ng[2820]: EOF occurred while idle; fd='9'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Oct 25 18:51:12 10.153.13.70 <syslog.notice> syslog-ng[2820]: Syslog connection broken; fd='9', server='AF_INET(10.153.29.235:514)', time_reopen='10'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Oct 25 18:51:22 10.153.13.70 <syslog.notice> syslog-ng[2820]: Syslog connection established; fd='9', server='AF_INET(10.153.29.235:514)', local='AF_INET(0.0.0.0:0)'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">However, this now causes a problem on the Syslog/DCS server with the local log file storage requirements:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Old Version: /var/log/syslog/general/CH33Test-WebCO/CH33Test-WebCO-10.25.2010.log<br>
New Version: /var/log/syslog/general/10.153.13.70/10.153.13.70-10.25.2010.log<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">NOTE: We don’t have a local DNS that all of the servers can be queried against and that putting in nearly 100+ sender hosts in the /etc/hosts really isn’t a viable option.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">How do I satisfy each requirement:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">1) Allow the incoming data stream to be saved in a format based on the incoming sender’s hostname for the directory structure (ex: "/var/log/syslog/general/$HOST/$FULLHOST-$MONTH.$DAY.$YEAR.log”)?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">2) Allow the IP address of the sender to be seen in the actual data file once saved to the DCS server (ex: “Oct 25 18:51:12 10.153.13.70 <syslog.err>…”)?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">3) Is there an option to have the incoming sender’s data saved with both the hostname and IP address in the same header format (ex: “Oct 25 18:51:12 CH33Test-WebCO 10.153.13.70 <syslog.err>…”)?<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">-- Michael<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1">CONFIDENTIALITY NOTICE: This email and any attachments are intended solely for the use of the named recipient(s). This email may contain confidential and/or proprietary information of Scientific Research Corporation.
If you are not a named recipient, you are prohibited from reviewing, copying, using, disclosing or distributing to others the information in this email and attachments. If you believe you have received this email in error, please notify the sender immediately
and permanently delete the email, any attachments, and all copies thereof from any drives or storage media and destroy any printouts of the email or attachments.<br>
<br>
EXPORT COMPLIANCE NOTICE: This email and any attachments may contain technical data subject to U.S export restrictions under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR). Export or transfer of this technical
data and/or related information to any foreign person(s) or entity(ies), either within the U.S. or outside of the U.S., may require advance export authorization by the appropriate U.S. Government agency prior to export or transfer. In addition, technical data
may not be exported or transferred to certain countries or specified designated nationals identified by U.S. embargo controls without prior export authorization. By accepting this email and any attachments, all recipients confirm that they understand and will
comply with all applicable ITAR, EAR and embargo compliance requirements.<br>
</font>
</body>
</html>