November 2000 - syslog-ng - lists.balabit.hu

Re: [syslog-ng]syslog-ng 1.4.9a mixing up log sources?
by kent＠unit.liu.se 25 Nov '00

25 Nov '00

Andreas Östling <andreaso(a)it.su.se> writes: > > can you check if this one fixes your problem: > > The patch seems to work for me. I agree. I have not seen any more "mixed-up lines" since I applied the patch. A quick 'egrep "<[0-9]*>" *' did not find anything today. Regards, -- Kent Engström, Linköping University Incident Response Team kent(a)unit.liu.se abuse(a)liu.se +46 13 28 1744 UNIT, Linköping University; SE-581 83 LINKÖPING; SWEDEN

1 0

syslog-ng 1.4.9a mixing up log sources?
by kent＠unit.liu.se 25 Nov '00

25 Nov '00

Today, I upgraded to 1.4.9a on our Solaris log server. Some hours later, my "logcheck clone" reported strange things; our webserver's logs contained lines for netsrvm (part of the Mimer database). However, we do not run Mimer on that machine, but on some others. Sample log line (host names/IP:s changed): Nov 24 13:29:08 web.example/web.example netsrvm[15501]: connect from mimerclient.example<30>sshd[9892]: log: Connection from 192.168.1.1 port 57733 The second part could be a correct entry for the web machine. Please contact me personally if unmodified log lines are needed for some debugging. -- Kent Engström, Linköping University Incident Response Team kent(a)unit.liu.se abuse(a)liu.se +46 13 28 1744 UNIT, Linköping University; SE-581 83 LINKÖPING; SWEDEN

3 4

Problems with PID file
by Martin Grimsehl 24 Nov '00

24 Nov '00

hi everybody, we use syslog-ng in a large cluster of some online services. however we do encounter problems with the pid-file handling. i start syslog-ng as syslog-ng --pidfile=/var/run/syslog-ng.pid --cfgfile=/usr/global/etc/syslog-ng.conf and its running fine. yesterday i did: # ps auxw| grep syslog-ng root 5366 ...syslog-ng --pidfile=/var/run/syslog-ng.pid... # cat /var/run/syslog-ng.pid 5366 today i did: # ps auxw| grep syslog-ng root 18357 ...syslog-ng --pidfile=/var/run/syslog-ng.pid... # cat /var/run/syslog-ng.pid 5366 so for some mysterious reasons a) syslog-ng restarts (maybe some cron job to logrotate the systems syslog) b) the pid in /var/run/syslog-ng.pid does not get updated syslog-ng is running here on Tru64 4.0 alpha. martin

2 1

Re: DoS possibility in syslog-ng
by Balazs Scheidler 24 Nov '00

24 Nov '00

> Upgrade syslog-ng to 1.4.9, which is a security upgrade, and changes > nothing compared to 1.4.8 or apply this patch: > > I am looking for the 1.4.9a tar ball, but the "1.4.x (stable branch)" > section doesn't list it. Do you have a direct URL for the tar ball? /downloads/syslog-ng/1.4/ I forgot to update the download url, though it points to the 1.4.9a tarball (even if it still references to 1.4.9) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

RE: [syslog-ng]config questions
by Andrew Fort 23 Nov '00

23 Nov '00

> I think it's syslog-ng, f ex I have > > filter f_lpr { facility(lpr) and not level(debug..info); }; > > and logging to lpr.debug does not end up anywhere (and there's no > other filter that takes care of *.debug or anything). Strange, Is any local logging working? If not, is your local source input configured correctly for your operating system? -- afort

2 1

RE: [syslog-ng]config questions
by Andrew Fort 23 Nov '00

23 Nov '00

> AF> yep, there is a predefined filter named "DEFAULT" which should do > AF> what you're after. > > Ah, you're quite right. Though > > destination default { file("/var/log/default-$YEAR$MONTH$DAY"); }; > log { source(src); filter(DEFAULT); destination(default); }; > > doesn't seem to work, no file is created. Any ideas? Are any messages from source(src) making it to the default filter? If not, no file will ever be created. Find a situation your other rules dont cater for (an unusual facility, for instance), and use 'logger' to create log messages to see if the problem is syslog-ng or simply you dont have any 'extra' messages which need catching by a default rule. -- afort

2 1

do_recv() problem with 1.4.9
by Alex Howansky 23 Nov '00

23 Nov '00

Hello, I just upgraded from 1.4.8 to 1.4.9. I compiled with the default options and I'm using the same configuration file as I did with 1.4.8. The only thing that has changed is the syslog-ng binary itself. When I started 1.4.9, it wasn't logging normal events. I have the "internal" messages logging to a separate file, so I checked that. In the few minutes that had passed since I started the daemon, the file had filled up to 250 meg with continuous repetitions of this message: Nov 22 12:43:30 flogm syslog-ng[27074]: io.c: do_recv(): Zero length read was requested. Any ideas? -- Alex Howansky Wankwood Associates http://www.wankwood.com/

2 2

Solaris Question
by Jesse Keefe 23 Nov '00

23 Nov '00

I had a question about when support for Solaris 8 will be available for syslog-ng? Thanks, Jesse Keefe Analyst Convergys IMG Cincinnati Oh 513-723-3689

2 1

"message-only" logging
by Andrew Fort 23 Nov '00

23 Nov '00

Is there a way to configure syslog-ng, using the file() output driver, to write JUST the message (no timestamp) to the output? Thanks, -- andrew fort

1 0

RE: [syslog-ng]config questions
by Andrew Fort 23 Nov '00

23 Nov '00

> I also vaguely remember someone mentioning a way of outputting all > the log messages that don't get caught by any filter rules to a file. > Anyone know what I'm talking about? It's basically to check that I'm > not missing anything important with my current config. yep, there is a predefined filter named "DEFAULT" which should do what you're after.

2 1