November 2000 - syslog-ng - lists.balabit.hu

syslog-ng 1.4.10 and 1.5.0
by Balazs Scheidler 30 Nov '00

30 Nov '00

I've released syslog-ng 1.4.10 with the patch I posted recently applied. 1.5.0 is also released containing the feature suggested by Andrew Fort <afort(a)staff.webcentral.com.au>. You can find these at the usual places: http://www.balabit.com/products/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

RE: [syslog-ng]syslog-ng 1.4.10 and 1.5.0
by Andrew Fort 29 Nov '00

29 Nov '00

Just for the record, Any credit for the patch mentioned (to 1.5.0) patch should actually go to Matthew Melvin <matthewm(a)staff.webcentral.com.au> ; he wrote it :-) -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Wednesday, 29 November 2000 22:01 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.4.10 and 1.5.0 I've released syslog-ng 1.4.10 with the patch I posted recently applied. 1.5.0 is also released containing the feature suggested by Andrew Fort <afort(a)staff.webcentral.com.au>. You can find these at the usual places: http://www.balabit.com/products/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: syslog-ng filter order patch
by Balazs Scheidler 29 Nov '00

29 Nov '00

Hi, I've read your posting and had a quick glance at your patch. I've applied it now with a few changes: 1) I changed the list append routine to append at the end of the list, so default statements should go last 2) the patch didn't unref the message it was distributing, so syslog-ng may become a memory hog quickly. 3) I branch the 1.4.x tree to 1.5.x and apply this patch there. Expect an 1.4.10 and 1.5.0 release soon. > Balazs, this is the patch for syslog-ng I posted to the list the other day, > I was wondering if you'd take a quick look if you haven't been reading the > list.. > > I've have this working against 1.4.9a (with the 1.4.9a patch from the > mailing list also applied, which I needed to stop logs being mixed up on my > RedHat 6.2/Linux 2.2.16 box). > > This patch changes only the order of evaluation of rules in the log{} lines > > Since the only time you check to see if a log entry has 'already matched' is > when you test for the DEFAULT filter, if you have a rule with no filter, > your logic will cause the DEFAULT filter to never be handled, because > "everything has matched" and do_distribute_log forces DEFAULT to be handled > last. > > The patch just makes the filters get evaluated in the order they appear in > the linked list, which allows configurations like the following: > > log { source(s_sys); destination(d_tty12); }; > log { source(s_sys); filter(DEFAULT); destination(d_mesg); }; > log { source(s_sys); filter(f_PAM); destination(d_pam); }; > log { source(s_sys); filter(f_auth); destination(d_auth); }; > log { source(s_sys); filter(f_filter4); destination(d_mail); }; > > To have a 'match everything from s_sys' to go to my /dev/tty12 for console > debugging, as well as match a default rule, since the DEFAULT is evaluated > before the rule without a filter. > > The patch was written by my workmate, Matthew Melvin > (matthewm(a)staff.webcentral.com.au) > > --snip-- > > --- src/center.c.old Mon Nov 27 14:20:14 2000 > +++ src/center.c Mon Nov 27 15:08:38 2000 > @@ -71,14 +71,21 @@ > static void do_distribute_log(struct log_handler *c, struct log_info *msg) > { > CAST(log_center, self, c); > - struct log_connection *p, *def_connection = NULL; > + struct log_connection *p; > int match = 0; > > for (p = self->connections; p; p = p->next) { > struct log_endpoint_info *s; > > if (p->flags & LOG_CONN_DEFAULT) { > - def_connection = p; > + struct log_endpoint_info *d; > + if (match) continue; > + for (d = p->nodes; d; d = d->next) { > + if (d->type == EP_DESTINATION) { > + assert(d->ref); > + HANDLE_LOG(d->ref, > log_info_use(msg)); > + } > + } > continue; > } > for (s = p->nodes; s; s = s->next) { > @@ -107,16 +114,6 @@ > > next_connection: > } > - if (!match && def_connection) { > - struct log_endpoint_info *d; > - for (d = def_connection->nodes; d; d = d->next) { > - if (d->type == EP_DESTINATION) { > - assert(d->ref); > - HANDLE_LOG(d->ref, log_info_use(msg)); > - } > - } > - } > - log_info_free(msg); > } > > struct log_handler *make_log_center(struct log_connection *connections) > > --snip-- > > > -- > Andrew Fort -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

secure remote syslog
by Frank Nijenhuis 29 Nov '00

29 Nov '00

ok, got it working. syslog-ng tunneled with stunnel, below a quick&dirty howto for the archives. As for now I've got two hosts logging to the loghost and i certainly don't know what performance and results will be when there are 10 or more hosts heavily logging. Install openssl, latest (0.9.6 - www.openssl.org) install stunnel (www.stunnel.org) Compile openssl, stunnel, probably out of the box up&running). Add to /etc/services on all hosts: syslog-ngs 1801/tcp #syslog-ng secure syslog-ng 1800/tcp #syslog-ng (or whatever port you would like). syslog-ng config on loghost: source remote { tcp(ip("<ip of localhost>") port(1800));}; stunnel on loghost: /usr/local/sbin/stunnel -p /opt/install/stunnel-3.8p4/stunnel.pem -d syslog-ngs -r <ip of the loghost>:syslog-ng syslog-ng config on other hosts: destination remote { tcp("<ip of localhost>" port(1800)); }; stunnel config on the other hosts: /usr/local/sbin/stunnel -c -d syslog-ng -r <ip of the loghost>:syslog-ngs restart or start all three syslog-ng's and verify the logging. Frank Nijenhuis.

1 0

linux kernel message
by Georgi Chorbadzhiyski 29 Nov '00

29 Nov '00

Hi! After installing syslog-ng. I no longer can log my kernel messages. I'm using Slackware 7.1 with klogd 1.4 and syslog-ng 1.4.9a. Yes klogd is running and with original syslogd everything was just fine. source src2 { unix-dgram("/dev/log"); }; ^^^^^^^^^^ I put this here because in this mailing list somebody suggested using this on RedHat > 6 It doesn't work :-( Georgi Chorbadzhiyski System Administrator top.bg Here is my configuration file. options { long_hostnames(on); sync(0); }; source src { unix-stream("/dev/log"); internal(); }; source src2 { unix-dgram("/dev/log"); }; destination kern { file("/var/log/kern.log"); }; destination tty11 { file("/dev/tty11"); }; destination tty12 { file("/dev/tty12"); }; filter f_kern { facility(kern); }; log { source(src); filter(f_kern); destination(kern); destination(tty11); }; log { source(src2); filter(f_kern); destination(kern); destination(tty12); };

1 0

Security and Integrity support?
by Yazz D. Atlas 29 Nov '00

29 Nov '00

Anyone know when syslog-ng will be supporting encryption and digital signatures for file integrity. Plus is there a way to only allow connections to the main syslog-ng server based on for example 10.2.*.* Also the doc's are just "a little" out of date and the syslog-ng.conf.demo is confussing since the syslog-ng.ps document states as of 1.3.4 encrypt() and compress() are nolonger supported. What about mac() and authentication() are they supported? Yazz Atlas -- Yazz D. Atlas <yazz(a)osdn.com> Systems and Network Engineer O | S | D | N, 50 Nagog Park, Acton, MA 01720 http://www.osdn.com/ Open Source Development Network

4 4

secure remote logging...
by Frank Nijenhuis 28 Nov '00

28 Nov '00

I need a way of secure remote logging for an part of our network connected to internet, I know the most secure way would be first of add another interface to all hosts and connect them to a private network with the loghost, but that's not possible right now. Is there anyone here who has set up some sort of encrypted log network with multiple hosts logging to one logserver? I was looking at stunnel, tunnel through ssl and using the tcp log function of syslog-ng. Can anyone here confirm that this is a setup which should work ? (stunnel works with ssl and can be found at www.stunnel.org) Any comments on a secure setup would be more than welcome! Frank Nijenhuis

1 0

www.goliat.hu - Hallott mar rola ?
by marketing＠goliat.hu 27 Nov '00

27 Nov '00

Tisztelt Internet felhasználó! http://www.goliat.hu - Új keresõ a magyar weben! A vezetõ technológiával készített keresõrendszer kivételesen felhasználóbarát, nagyon gyors, hatékony és nagy adatbázissal rendelkezik. Keressen és találjon ! http://www.goliat.hu A keresõ metódus mellett rendelkezik egy "témakörök" nevû linkgyûjteménnyel is, amely 28 témában segíti az interneten való gyors eligazodást. Ezek a http://www.goliat.hu legfõbb ismérvei! Egy próbát megér! --------------------------------------------------------------- E-mail címéhez az Interneten elhelyezett oldalakon találtunk rá ! Amennyiben nem óhajt több információt kapni Tõlünk, kérjük írjon a bug(a)goliat.hu címre. Figyelmét és türelmét köszönjük! GFX Média

1 0

www.goliat.hu - Hallott mar rola ?
by marketing＠goliat.hu 27 Nov '00

27 Nov '00

Tisztelt Internet felhasználó! http://www.goliat.hu - Új keresõ a magyar weben! A vezetõ technológiával készített keresõrendszer kivételesen felhasználóbarát, nagyon gyors, hatékony és nagy adatbázissal rendelkezik. Keressen és találjon ! http://www.goliat.hu A keresõ metódus mellett rendelkezik egy "témakörök" nevû linkgyûjteménnyel is, amely 28 témában segíti az interneten való gyors eligazodást. Ezek a http://www.goliat.hu legfõbb ismérvei! Egy próbát megér! --------------------------------------------------------------- E-mail címéhez az Interneten elhelyezett oldalakon találtunk rá ! Amennyiben nem óhajt több információt kapni Tõlünk, kérjük írjon a bug(a)goliat.hu címre. Figyelmét és türelmét köszönjük! GFX Média

1 0

RE: [syslog-ng]config questions
by Andrew Fort 27 Nov '00

27 Nov '00

Okay, I think I see what you mean now, since I see this behaviour also. We noticed this since we have a couple of "catch-all" rules in our confile file, i.e., log {} entries with a source and destination, but no filter. For instance, log { source(s_sys); destination(d_tty12); }; to write everything logged at source s_sys to destination d_tty12, no exceptions. However, this changes the behaviour of the DEFAULT filter. One of our other sysadmins and I have traced through the soruce, and he (Matthew Melvin) has written a patch, which I'll attempt to explain. When the config file syslog-ng.conf is read (from beginning to end), the linked list "self" (ptr stuct syslog_config) is created, inside "do_init_config()" (src/cfgfile.c) When you create a linked list, the easiest way is to link the ptr to the list as the 'next' variable in the current list entry, essentially pushing list entries onto the stack. So when the list is read forwards, you're reading _backwards_ through the order in the config file (the list reads; last entry through to first entry in the config file, in other words). In center.c, function do_distribute_list evaluates the linked list to write the log message being currently processed to all valid destinations. The logic in the code provided is to always treat the DEFAULT rule last - no matter its position within the linked list, and treat all other rules first. However, if you have a catch-all rule (no filter), the code which causes the log message to be handled sets a "match" flag to true. When we get to the end, and it's time to handle the default rule, it checks to see if the log message being currently processed has already been matched and if a DEFAULT rule is set: if (!match && def_connection) { Since we've already matched everything, the DEFAULT rule does nothing. Matthew's patch changes this logic so that all rules are evaluated in the exact order they appear in the linked list (remember, this is the reverse order they appear in the config file). So, by applying this patch, then placing your "catch-all" rule(s) first in the config file, then the DEFAULT rule next, then any other rules, you should get the behaviour that you expect. Credits for this patch go to Matthew Melvin (matthewm(a)staff.webcentral.com.au) To apply the patch below: Since we've modified center.c, make_class must run, so you'll need to have scsh (scheme shell) installed, and you'll need to rebuild libol if you've updated the scheme shell libraries (otherwise you'll get a segfault when running the updated syslog-ng). If you're having problems with the scheme_shell bit, you may need to modify make_class to point at scheme shell's path explicitly. Apply the patch via changing to the directory you extracted the syslog-ng source into (e.g. /usr/local/src/syslog-ng-1.4.9a/), save the patch file below to a file, and run patch -p0 < /path/to/patchfile.below Then rebuild syslog-ng: ./configure, make, make install. --snip-- --- src/center.c.old Mon Nov 27 14:20:14 2000 +++ src/center.c Mon Nov 27 15:08:38 2000 @@ -71,14 +71,21 @@ static void do_distribute_log(struct log_handler *c, struct log_info *msg) { CAST(log_center, self, c); - struct log_connection *p, *def_connection = NULL; + struct log_connection *p; int match = 0; for (p = self->connections; p; p = p->next) { struct log_endpoint_info *s; if (p->flags & LOG_CONN_DEFAULT) { - def_connection = p; + struct log_endpoint_info *d; + if (match) continue; + for (d = p->nodes; d; d = d->next) { + if (d->type == EP_DESTINATION) { + assert(d->ref); + HANDLE_LOG(d->ref, log_info_use(msg)); + } + } continue; } for (s = p->nodes; s; s = s->next) { @@ -107,16 +114,6 @@ next_connection: } - if (!match && def_connection) { - struct log_endpoint_info *d; - for (d = def_connection->nodes; d; d = d->next) { - if (d->type == EP_DESTINATION) { - assert(d->ref); - HANDLE_LOG(d->ref, log_info_use(msg)); - } - } - } - log_info_free(msg); } struct log_handler *make_log_center(struct log_connection *connections) --snip-- An example of what I mean by our filter rules is: log { source(s_sys); destination(d_tty12); }; log { source(s_sys); filter(DEFAULT); destination(d_mesg); }; log { source(s_sys); filter(f_PAM); destination(d_pam); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; I hope this helps! Balazs, this may not be your preferred method of handling this logic, but Matthew and I would appreciate hearing from you about it.. -- Andrew Fort Webcentral > >>>>> "AF" == Andrew Fort <afort(a)staff.webcentral.com.au> writes: > > AF> Is any local logging working? If not, is your local source input > AF> configured correctly for your operating system? > > Apart from filter(DEFAULT), everything seems dandy:

1 0