November 2000 - syslog-ng - lists.balabit.hu

config questions
by MagerValp 23 Nov '00

23 Nov '00

With the sync parameter i can set how many lines are buffered before logs are written to disk, but is it possible to have this buffer flushed after a certain time period? Running with sync(0) eats up too much I/O-performance. I also vaguely remember someone mentioning a way of outputting all the log messages that don't get caught by any filter rules to a file. Anyone know what I'm talking about? It's basically to check that I'm not missing anything important with my current config. Another problem is a bug in Solaris 7 that causes a lot of messages like this to show up in the logs: Nov 9 19:24:08 src@enterprise top[7530]: ypbind client: can't get rdev Nov 9 19:24:37 src@enterprise top[7535]: ypbind client: can't get rdev Nov 9 19:24:42 src@enterprise top[7537]: ypbind client: can't get rdev Nov 9 19:24:46 src@enterprise top[7539]: ypbind client: can't get rdev Nov 10 05:40:00 src@enterprise ypcat[11591]: ypbind client: can't get rdev Nov 10 05:40:00 src@enterprise ypcat[11591]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise yppush[11595]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise ypxfr[11596]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise ypxfr[11596]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise ypcat[11605]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise ypcat[11605]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise yppush[11609]: ypbind client: can't get rdev There's a fix but it requires a reboot and that won't happen for a while on the log server. Is there a way of filtering out these messages? I guess putting and not match("client: can't get rdev") in all the filter rules should work, but I'm looking for a more elegant solution. Thanks, -- ___ . . . . . + . . o _|___|_ + . + . + . . Per Olofsson, konstnär o-o . . . o + MagerValp(a)cling.gu.se - + + . http://www.cling.gu.se/~cl3polof/

1 0

problem with syslog-ng 1.4.9
by Marko Veelma 22 Nov '00

22 Nov '00

Hi, after upgrade from 1.4.5 to 1.4.9: Nov 16 00:04:11 backup syslog-ng[6797]: syslog-ng version 1.4.5 starting Nov 22 23:09:11 backup syslog-ng[27598]: syslog-ng version 1.4.9 starting Nov 22 23:10:00 backup syslog-ng[27598]: io.c: do_recv(): Zero length read was requested. Nov 22 23:10:00 backup syslog-ng[27598]: io.c: do_recv(): Zero length read was requested. Nov 22 23:10:00 backup syslog-ng[27598]: io.c: do_recv(): Zero length read was requested. [--- 160588 lines deleted ---] Nov 22 23:10:21 backup syslog-ng[27598]: io.c: do_recv(): Zero length read was requested. Nov 22 23:10:21 backup syslog-ng[27598]: io.c: do_recv(): Zero length read was requested. Nov 22 23:10:21 backup syslog-ng[27598]: io.c: do_recv(): Zero length read was requested. Nov 22 23:10:31 backup syslog-ng[27864]: syslog-ng version 1.4.5 starting It generates 160594 lines of this error within 21 sec. Environment: SuSE Linux 7.0, kernel 2.2.16 (SuSE default), i686, shlibs 2.1.3-134 --- Cougar

1 0

RE: [syslog-ng]Solaris Question
by Ohrberg, Mick 22 Nov '00

22 Nov '00

I am currently running syslog-ng on several Solaris8 boxes with absolutely no problem. > -----Original Message----- > From: Jesse Keefe [mailto:jkeefe@convergys.com] > Sent: Wednesday, November 22, 2000 11:07 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Solaris Question > > > I had a question about when support for Solaris 8 will be available > for syslog-ng? > > > Thanks, > > Jesse Keefe > Analyst > Convergys IMG > Cincinnati Oh > > 513-723-3689 > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

remote DoS in syslog-ng
by Balazs Scheidler 22 Nov '00

22 Nov '00

Here's the security advisory I'm about to send to bugtraq. Everyone is urged to upgrade. BalaBit security advisory Advisory ID: BB-2000/01 Package: syslog-ng Versions affected: versions prior to and including 1.4.8 Problem type: remote DoS attack 1) Background syslog-ng is a portable syslog implementation. Its highlights include regexp based log selection, TCP transport and more. For more information: http://www.balabit.hu/products/syslog-ng/ 2) Problem description When syslog-ng parses log messages a variable named "left" is used to store the remaining length of the log message. The priority part in the message should look like this: <6> When the line ends without the closing '>' this "left" variable becomes -1 due a to a bug. The remaining part of the message parsing routine checks if there's any characters left using the condition: left != 0, since -1 is not 0, this condition evaluates to true. Syslog-ng versions after 1.4.7 filters out \r and \n characters from log messages and replaces them with spaces to avoid cluttering logfiles. Due to a problem in the parsing of log messages, this character change may access unaccessible memory region. This causes a segmentation fault. So sending a "<6", terminated with a newline to one of the input channels causes a SIGSEGV. Prior to 1.4.7, this character change was not implemented, so mounting a DoS attack is not so trivial, but is still possible. (it's left to the reader as an exercise) It is believed that no other exploitation is possible. 3) Impact Sending a carefully crafted syslog packet may cause syslog-ng to exit with a Segmentation Fault. 4) Solution Upgrade syslog-ng to 1.4.9, which is a security upgrade, and changes nothing compared to 1.4.8 or apply this patch: diff -urN syslog-ng-1.4.8/src/log.c syslog-ng-1.4.9/src/log.c --- syslog-ng-1.4.8/src/log.c Tue Oct 10 15:05:52 2000 +++ syslog-ng-1.4.9/src/log.c Wed Nov 22 16:45:11 2000 @@ -67,8 +67,10 @@ left--; } lm->pri = pri; - src++; - left--; + if (left) { + src++; + left--; + } } else { lm->pri = LOG_USER | LOG_NOTICE; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

dmesg
by B. Weldon 20 Nov '00

20 Nov '00

I have syslog-ng ver 1.4.0.rc3 w/ libol 0.2.16 running on Solaris 2.6. The problem I am having is when I roll the syslog file and HUP syslog, upon syslog-ng's restart, it dump's me an output from dmesg which is very annoying to the network monitoring system's output... Is there a way to get ride of this functionality without building elaborate filters to catch all the dmesg stuff? I don't want the dmesg stuff at all. Thanks...

1 0

RE: [Fwd: RE: [syslog-ng]Odd problem]
by Hamilton, Andrew Mr. 20 Nov '00

20 Nov '00

Sometimes I lose messages. Usually our analysts get things rerouted fairly swiftly so for the most part I don't lose too much, but in a network as large as ours it is impossible to get every message anyway. We usually have multiple routes to most of our regions. I realize that in life sometimes there are things that you can't do anything about. This is one of them. There are way too many devices for me to keep track of EVERY message from ALL of them. I do my best to get what they send and that is all I can do. syslog-ng is considerably better at helping me do that than syslogd. Regards Drew > -----Original Message----- > From: Przemek Bak [SMTP:przemolicc@poczta.fm] > Sent: Monday, November 20, 2000 11:59 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [Fwd: RE: [syslog-ng]Odd problem] > > ----- Forwarded message from "Hamilton, Andrew Mr." > <HamiltonA(a)hq.5sigcmd.army.mil> ----- > > > From: "Hamilton, Andrew Mr." <HamiltonA(a)hq.5sigcmd.army.mil> > > To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> > > Subject: RE: [syslog-ng]Odd problem > > Date: Fri, 17 Nov 2000 12:31:40 +0100 > > > > Actually yes. I use syslog-ng to log from about 1500 sources. Most of > it > > is not real intense, but I get around 5 gigabytes per day. I use every > > facility. Some of the facilities are used for more than one program. > Which > > before syslog-ng wasn't possible to do. The granularity I get from > syslog-ng > > is considerably better than syslogd and my life is much simpler for it. > > Because of our security processes the logging from the routers used to > go > > three places, our security people, our sysadmins, and our management > tools. > > The router was sending every message three times. Now they go to our > > central system and the logs that need to go to the security people are > > forwarded to them and the same with our management tools, with the > correct > > host name. And the traffic is much less over the WAN. Which was the > goal > > of the exercise. I would say for us that syslog-ng has been very > > successful. > > How do you manage when part of the net is down ? For example, > router is sending messages to your central logging host, > but the messages go through another router which is down for a while. > > > przemol > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

[Fwd: RE: [syslog-ng]Odd problem]
by Przemek Bak 20 Nov '00

20 Nov '00

----- Forwarded message from "Hamilton, Andrew Mr." <HamiltonA(a)hq.5sigcmd.army.mil> ----- > From: "Hamilton, Andrew Mr." <HamiltonA(a)hq.5sigcmd.army.mil> > To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> > Subject: RE: [syslog-ng]Odd problem > Date: Fri, 17 Nov 2000 12:31:40 +0100 > > Actually yes. I use syslog-ng to log from about 1500 sources. Most of it > is not real intense, but I get around 5 gigabytes per day. I use every > facility. Some of the facilities are used for more than one program. Which > before syslog-ng wasn't possible to do. The granularity I get from syslog-ng > is considerably better than syslogd and my life is much simpler for it. > Because of our security processes the logging from the routers used to go > three places, our security people, our sysadmins, and our management tools. > The router was sending every message three times. Now they go to our > central system and the logs that need to go to the security people are > forwarded to them and the same with our management tools, with the correct > host name. And the traffic is much less over the WAN. Which was the goal > of the exercise. I would say for us that syslog-ng has been very > successful. How do you manage when part of the net is down ? For example, router is sending messages to your central logging host, but the messages go through another router which is down for a while. przemol

1 0

RE: [syslog-ng]Odd problem
by Hamilton, Andrew Mr. 17 Nov '00

17 Nov '00

Actually yes. I use syslog-ng to log from about 1500 sources. Most of it is not real intense, but I get around 5 gigabytes per day. I use every facility. Some of the facilities are used for more than one program. Which before syslog-ng wasn't possible to do. The granularity I get from syslog-ng is considerably better than syslogd and my life is much simpler for it. Because of our security processes the logging from the routers used to go three places, our security people, our sysadmins, and our management tools. The router was sending every message three times. Now they go to our central system and the logs that need to go to the security people are forwarded to them and the same with our management tools, with the correct host name. And the traffic is much less over the WAN. Which was the goal of the exercise. I would say for us that syslog-ng has been very successful. Thanks > -----Original Message----- > From: Balazs Scheidler [SMTP:bazsi@balabit.hu] > Sent: Friday, November 17, 2000 11:52 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Odd problem > > > hostname, gw1, ts1, etc. This is insufficient since we have over 1100 > > routers to maintain. There are many gw1's and gw2's, etc. As soon as I > > turned on use_fqdn and started getting the domain name added on, which > is > > sufficient to identify the source, all is great from my perspective. > > I'd be interested if syslog-ng is used to collect all logs from these > routers. If yes, I think we found a great success story :) > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Odd problem
by Hamilton, Andrew Mr. 17 Nov '00

17 Nov '00

I wish I could retract this since the solution was simple. But since I posted it I guess I should at least qualify this. This turned out to be not a problem with the syslog at all. It was a problem with the person looking at the logs who claimed there was a problem and at first glance I thought it was a problem. After doing more digging I found that the routers actually send the their log messages exactly as they appear in the log file. The three letter region specification on the front turns out to be an alias that the network analysts were using. Since I mostly do internal logging I didn't have use_fqdn turned on and the only thing they were seeing was the hostname, gw1, ts1, etc. This is insufficient since we have over 1100 routers to maintain. There are many gw1's and gw2's, etc. As soon as I turned on use_fqdn and started getting the domain name added on, which is sufficient to identify the source, all is great from my perspective. Thanks for your time and sorry to bother everyone. Drew > -----Original Message----- > From: Hamilton, Andrew Mr. [SMTP:HamiltonA@hq.5sigcmd.army.mil] > Sent: Wednesday, November 15, 2000 3:06 PM > To: 'syslog-ng(a)lists.balabit.hu' > Subject: [syslog-ng]Odd problem > > I am getting something very strange in my syslogs. This doesn't happen > for > every host but it appears that most of the hostnames are getting the front > truncated. Here is a sample of the logfile and my config file. I am > running syslog-ng 1.4.7. > > Nov 15 13:57:03 gw1.hanau.army.mil 172593: Nov 15 13:57:18: > %SEC-6-IPACCESSLOGP: list 196 permitted tcp 140.156.30.6(48879) -> > 192.73.27.115(33658), 725 packets > Nov 15 13:57:03 gw7.mannheim.army.mil 93065: Nov 15 13:57:18: > %LANCE-5-LATECOLL: Unit 0, late collision error > Nov 15 13:57:03 bggw.heidelberg.army.mil 3078332: Nov 15 13:57:18: > %SEC-6-IPACCESSLOGP: list 191 denied tcp 64.4.16.24(80) -> > 147.37.199.194(1509), 1 packet > Nov 15 13:57:03 bggw.ansbach.army.mil 437279: Nov 15 13:57:18: > %SEC-6-IPACCESSLOGP: list 193 denied udp 136.218.199.6(1704) -> > 169.254.102.246(1112), 1 packet > Nov 15 13:57:03 BGGW-ETHER0-1.STUTTGART.ARMY.MIL 1236689: 6w6d: > %SEC-6-IPACCESSLOGP: list 192 permitted tcp 199.211.200.34(1488) -> > 136.221.21.11(80), 6 packets > > The hostname should have hnu-gw1.hanau.army.mil in the first one and > likewise for the rest. There is some 3 letter representation of the > region > on the front of the hostname. Here is my config, partly anyway. > > options { long_hostnames(yes); use_fqdn(yes); chain_hostnames(no); > sync(0); > keep_hostname(yes); create_dirs(yes); }; > source src { sun-streams("/dev/log" door("/etc/.syslog_door")); > internal(); > udp(); }; > > destination d_cisco { file("/logs/cisco/ciscologs"); }; > > destination d_reno { udp("host.mydomain.mil"); }; > > filter f_cisco { facility(local7) }; > > log { source(src); filter(f_cisco); destination(d_cisco); > destination(d_host); }; > > Seems to actually function fine but is truncating the front part. > > Any ideas? > > Regards, > Drew > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Odd problem
by Hamilton, Andrew Mr. 15 Nov '00

15 Nov '00

I am getting something very strange in my syslogs. This doesn't happen for every host but it appears that most of the hostnames are getting the front truncated. Here is a sample of the logfile and my config file. I am running syslog-ng 1.4.7. Nov 15 13:57:03 gw1.hanau.army.mil 172593: Nov 15 13:57:18: %SEC-6-IPACCESSLOGP: list 196 permitted tcp 140.156.30.6(48879) -> 192.73.27.115(33658), 725 packets Nov 15 13:57:03 gw7.mannheim.army.mil 93065: Nov 15 13:57:18: %LANCE-5-LATECOLL: Unit 0, late collision error Nov 15 13:57:03 bggw.heidelberg.army.mil 3078332: Nov 15 13:57:18: %SEC-6-IPACCESSLOGP: list 191 denied tcp 64.4.16.24(80) -> 147.37.199.194(1509), 1 packet Nov 15 13:57:03 bggw.ansbach.army.mil 437279: Nov 15 13:57:18: %SEC-6-IPACCESSLOGP: list 193 denied udp 136.218.199.6(1704) -> 169.254.102.246(1112), 1 packet Nov 15 13:57:03 BGGW-ETHER0-1.STUTTGART.ARMY.MIL 1236689: 6w6d: %SEC-6-IPACCESSLOGP: list 192 permitted tcp 199.211.200.34(1488) -> 136.221.21.11(80), 6 packets The hostname should have hnu-gw1.hanau.army.mil in the first one and likewise for the rest. There is some 3 letter representation of the region on the front of the hostname. Here is my config, partly anyway. options { long_hostnames(yes); use_fqdn(yes); chain_hostnames(no); sync(0); keep_hostname(yes); create_dirs(yes); }; source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; destination d_cisco { file("/logs/cisco/ciscologs"); }; destination d_reno { udp("host.mydomain.mil"); }; filter f_cisco { facility(local7) }; log { source(src); filter(f_cisco); destination(d_cisco); destination(d_host); }; Seems to actually function fine but is truncating the front part. Any ideas? Regards, Drew

1 0