<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#0050d0">
Sent: Mon Aug 29 2011 17:10:19 GMT-0600 (MST)<br>
From: Matt Zagrabelny <a class="moz-txt-link-rfc2396E" href="mailto:mzagrabe@d.umn.edu"><mzagrabe@d.umn.edu></a><br>
To: <a class="moz-txt-link-abbreviated" href="mailto:syslogng@feystorm.net">syslogng@feystorm.net</a> "Syslog-ng users' and developers' mailing
list" <a class="moz-txt-link-rfc2396E" href="mailto:syslog-ng@lists.balabit.hu"><syslog-ng@lists.balabit.hu></a><br>
Subject: Re: [syslog-ng] malformed syslog packets?
<blockquote
cite="mid:CAOLfK3Ue+A82oW-KjS7z7fdeqxhfNH-FFqQ_pmpptu9S_6EXnw@mail.gmail.com"
type="cite">
<pre wrap="">On Mon, Aug 29, 2011 at 5:10 PM, <a class="moz-txt-link-rfc2396E" href="mailto:syslogng@feystorm.net"><syslogng@feystorm.net></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
Sent: Mon Aug 29 2011 15:20:51 GMT-0600 (MST)
From: Matt Zagrabelny <a class="moz-txt-link-rfc2396E" href="mailto:mzagrabe@d.umn.edu"><mzagrabe@d.umn.edu></a>
To: Syslog-ng users' and developers' mailing list
<a class="moz-txt-link-rfc2396E" href="mailto:syslog-ng@lists.balabit.hu"><syslog-ng@lists.balabit.hu></a>
Subject: [syslog-ng] malformed syslog packets?
Hi!
I've got a central log server running the OSE 3.1.3 version of syslog-ng:
dpkg -l syslog-ng
Desired=Unknown/Install/Remove/Purge/Hold
|
Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version
Description
+++-========================================-========================================-================================================================================================
ii syslog-ng 3.1.3-3
Next generation logging daemon
I have dns lookup turned on via:
options {
use_dns(yes);
dns_cache(2000);
dns_cache_expire(87600);
};
And this seems to work just fine...except for a certain type of device
on our network.
We have a number of UPSes that log to our central log server and it
seems that the dns look ups do not work for those (types of devices).
% cd /var/log/syslog-ng/remote_clients
% ls -d 10.*
10.25.32.4 10.25.5.15 10.25.5.19 10.25.5.26 10.25.5.35 10.25.5.4
10.25.5.44 10.25.5.51 10.25.5.6 10.25.5.65 10.25.5.69
10.25.5.76
10.25.5.1 10.25.5.16 10.25.5.2 10.25.5.27 10.25.5.36 10.25.5.40
10.25.5.49 10.25.5.52 10.25.5.60 10.25.5.66 10.25.5.7
10.25.5.79
10.25.5.10 10.25.5.17 10.25.5.20 10.25.5.28 10.25.5.37 10.25.5.41
10.25.5.5 10.25.5.55 10.25.5.61 10.25.5.67 10.25.5.72
10.25.5.81
10.25.5.14 10.25.5.18 10.25.5.23 10.25.5.3 10.25.5.38 10.25.5.43
10.25.5.50 10.25.5.58 10.25.5.62 10.25.5.68 10.25.5.75 10.25.5.9
When I look up those IP addresses, they are *all* APC batteries (UPSes).
For instance:
% dig -x 10.25.5.43 +short
kplz246Abat1.d.umn.edu
.
Is it possible that they are sending some sort of munged data to the
log server and syslog-ng is not able to perform the (reverse) name
lookup?
Any advice?
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
What macro are you using for the file name?
</pre>
</blockquote>
<pre wrap="">
I believe $HOST.
destination d_remote_clients {
file(
"/var/log/syslog-ng/remote_clients/$HOST/$YEAR/$MONTH/$DAY/$FACILITY"
owner(root)
group(root)
perm(0644)
dir_perm(0755)
create_dirs(yes)
);
};
-mz
</pre>
</blockquote>
<br>
<br>
That would be the issue. You want $HOST_FROM<br>
<br>
<br>
From the user guide:<br>
<h3 class="title">HOST</h3>
<span class="guilabel"><strong>Description:</strong></span> The name
of the source host where the message originates from. If the message
traverses several hosts and the <a class="link"
href="http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.1-guide-admin-en.html/index.html-single.html#option_chain_hostnames"
title="chain_hostnames()"> <em class="parameter"><code>chain_hostnames()</code></em>
</a> option is on, the first host in the chain is used. To use this
macro, make sure that the <em class="parameter"><code>keep_hostname()</code></em>
option is enabled.
<div class="simplesect" title="HOST_FROM">
<div class="titlepage">
<div>
<div>
<h3 class="title">
HOST_FROM</h3>
</div>
</div>
</div>
<span class="guilabel"><strong>Description:</strong></span> Name
of the host that sent the message to syslog-ng, as resolved by
syslog-ng using DNS. If the message traverses several hosts, this
is the last host in the chain. To use this macro, make sure that
the <em class="parameter"><code>keep_hostname()</code></em>
option is enabled.
</div>
<br>
</body>
</html>