November 2000 - syslog-ng - lists.balabit.hu

Question about program()
by Hyunmoo Rhee 15 Nov '00

15 Nov '00

I installed syslog-ng-1.4.8 yesterday. but program() wasn't operate. why it doesn't operate? my syslog-ng.conf is here. =====================================START======================== options { use_dns(no); }; source router_src { udp(port(514)); }; destination router_total_log { file("/root/logfile/router_total_log"); program(/root/sample.sh); }; destination deny_tcp_all_log { file("/root/logfile/deny_tcp_all_log"); }; destination deny_udp_all_log { file("/root/logfile/deny_udp_all_log"); }; filter deny_tcp_all { match("tcp"); }; filter deny_udp_all { match("udp"); }; log { source(router_src); destination(router_total_log); }; log { source(router_src); filter(deny_tcp_all); destination(deny_tcp_all_log); }; log { source(router_src); filter(deny_udp_all); }; =================================END====================== sample.sh is simple script. (echo asdf >> /root/sample.txt) but doesn't operate. shell script permission is 755. .....

2 1

RE: [syslog-ng]Question about program()
by Hamilton, Andrew Mr. 15 Nov '00

15 Nov '00

In your destination statement for router_total_log you actually have two destinations, while I haven't actually seen in the docs that this isn't possible, it is probably not a good practice. Set up two destinations, one for the file and one for the program, then in your log statement give it two destination statements. That works for me, so no reason to think it won't for you. Regards Drew > -----Original Message----- > From: Hyunmoo Rhee [SMTP:rossi@dreamwiz.com] > Sent: Wednesday, November 15, 2000 8:45 AM > To: syslog-ng > Subject: [syslog-ng]Question about program() > > I installed syslog-ng-1.4.8 yesterday. but program() wasn't operate. why > it doesn't operate? > my syslog-ng.conf is here. > =====================================START======================== > options { use_dns(no); }; > > source router_src { > udp(port(514)); > }; > > destination router_total_log { > file("/root/logfile/router_total_log"); > program(/root/sample.sh); > }; > > destination deny_tcp_all_log { > file("/root/logfile/deny_tcp_all_log"); > }; > > destination deny_udp_all_log { > file("/root/logfile/deny_udp_all_log"); > }; > > filter deny_tcp_all { > match("tcp"); > }; > > filter deny_udp_all { > match("udp"); > }; > > log { > source(router_src); > destination(router_total_log); > }; > > log { > source(router_src); > filter(deny_tcp_all); > destination(deny_tcp_all_log); > }; > > log { > source(router_src); > filter(deny_udp_all); > }; > =================================END====================== > > sample.sh is simple script. (echo asdf >> /root/sample.txt) > but doesn't operate. shell script permission is 755. > ..... > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

RE: [syslog-ng]umask settings?
by Andrew Fort 14 Nov '00

14 Nov '00

> whatever. I still > > might want to create output files with permissions appropriate to > > archive files or make them available for other legitimate users. > > I may add a chmod() call to enforce perm bits. What do others think? Perhaps a "override_umask()" boolean option (global or per destination), with the local overriding the global (so you can change the default to not interact with the umask). Of course, this requires the most code :) -- afort

2 1

umask settings?
by jon＠dumbo.pobox.com 14 Nov '00

14 Nov '00

i noticed something odd when in installed syslog-ng heres my current setup >Linux flatbox 2.4.0-test9 #4 Thu Oct 12 14:03:39 EDT 2000 i686 unknown >syslog-ng 1.4.8 (also had problem with 1.4.7) It seems that syslog-ng is ignoring perm(xxx) in favor of umask. heres the lines from syslog-ng.conf destination macrogenerateddaily { file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY" dir_perm(0755) perm(0644)); }; destination macrogeneratedhourly { file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY.$HOUR" dir_perm(0755) perm(0644)); }; now..when i start syslog-ng with umask 077, i get files generated as 0600 when i start with umask 022, i get files generated with as 0644. i though that perm and dir_perm were set while ignoring umask, this should be noted in the documentation if it uses umask as well. jon

3 3

1.4.8, Solaris and -lthread
by MagerValp 13 Nov '00

13 Nov '00

If you compile and install the latest syslog-ng under Solaris 7 it dies upon starting as it needs to be linked with -lthread to work. Sorry, didn't save the error message, but sticking -lthread in the Makefile fixed the problem. -- ___ . . . . . + . . o _|___|_ + . + . + . . Per Olofsson, konstnär o-o . . . o + MagerValp(a)cling.gu.se - + + . http://www.cling.gu.se/~cl3polof/

2 1

Filtering question
by nija＠magicaldesk.com 09 Nov '00

09 Nov '00

Hello all, I am having a problem with filtering. Here is my statement: filter noallnumbers { not program ("[0-9][0-9]*"); }; filter nostartperiod { not program ("^\." ); }; filter nostartslash { not program ("^\/" ); }; filter noparen1 { not program ("\\$" ); }; filter noparen2 { not program ("\\$" ); }; filter nocomma { not program ("\\\," ); }; filter nospace { not program ("\\\ " ); }; filter noamp { not program ("\\\@" ); }; filter goodlog { filter (noallnumbers) or filter(nostartperiod) or filter (nostartslash) or filter(noparen1) or filter (noparen2) or filter(nocomma) or filter (nospace) or filter(noamp); }; This statement does not work. If I take the top filter, noallnumbers, and use just that, the filter works. I am logging by program, so this is so I will not get error messages in the syslog-ng log. Any help? Thank you, Nija _____________________________________________________________ Global Virtual Desktop Get your free Desktop at http://www.magicaldesk.com

1 0

RE: [syslog-ng]Real time .conf?
by Brian Leveille 09 Nov '00

09 Nov '00

Bazsi & Matt, Thanks for your help. After strace-ing I found that the culprit was DNS. DNS lookups were blocking the daemon. Adding use_dns(no) to the global config fixed the problem. Messages are now being written to disk in real time and I am losing nothing! Now, if I want my 'pretty' directory structure and filenames do I add my remote machines to /etc/hosts or do I make my syslog-ng machine a caching name server? Will these block? Brian Leveille ------------------- Senior Internetworking Engineer DefendNet Solutions, Inc. www.defendnet.com -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, November 09, 2000 3:42 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Real time .conf? Hi, > Thanks. Somehow though, I don't think that worked. Here is my config file. > > # this file show more or less all the features of syslog-ng > > options {sync(0); create_dirs(yes);}; > > source int { unix-stream("/dev/log"); internal(); }; > source src { udp(port(514)); }; > > destination everything { > file("/NetscreenLogs/$HOST/$HOST.$MONTH-$DAY-$YEAR.log" > owner(NetscreenLogs) > group(NetscreenLogs) > perm(0777) > dir_perm(0777)); > }; > > destination internallogs { file("/var/log/messages"); }; > > > log { source(src); destination(everything); }; > log { filter(DEFAULT); destination(internallogs); }; > > > > All I am trying to do is have my remote boxes send their syslog messages to > my server, and have the server create some semblance of a directory > structure. Simple. > > But, when I watch packets with tcpdump, it seems there are A LOT more udp > port 514 packets than there are log records. My tcpdump sessions shows > hundreds of udp port 514 packets while my tail -f of my log RARELY updates. > > Am I losing data?!?!?!? I don't think so. Can you strace syslog-ng to see if it does receive those messages? strace -s 256 -p <pidofsyslog-ng> -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2

restarting syslog-ng
by Erich Reitz 09 Nov '00

09 Nov '00

Hi, When I restart syslog-ng, should I be restarting all other applications that write to the log files? I have noticed that when I restart syslog-ng (/etc/init.d/syslog restart - redhat 7) I will lose certain messages to my maillog from sendmail. If I don't restart my cron daemon, it no longer has any new messages in its log file (/var/log/cron). This is true of other apps as well. The stopping/restarting of syslog-ng is handled by redhat's "daemon syslog-ng" and "killproc syslog-ng" scripts within /etc/init.d/syslog.

3 3

RE: [syslog-ng]Real time .conf?
by Brian Leveille 09 Nov '00

09 Nov '00

Matt, Thanks. Somehow though, I don't think that worked. Here is my config file. # this file show more or less all the features of syslog-ng options {sync(0); create_dirs(yes);}; source int { unix-stream("/dev/log"); internal(); }; source src { udp(port(514)); }; destination everything { file("/NetscreenLogs/$HOST/$HOST.$MONTH-$DAY-$YEAR.log" owner(NetscreenLogs) group(NetscreenLogs) perm(0777) dir_perm(0777)); }; destination internallogs { file("/var/log/messages"); }; log { source(src); destination(everything); }; log { filter(DEFAULT); destination(internallogs); }; All I am trying to do is have my remote boxes send their syslog messages to my server, and have the server create some semblance of a directory structure. Simple. But, when I watch packets with tcpdump, it seems there are A LOT more udp port 514 packets than there are log records. My tcpdump sessions shows hundreds of udp port 514 packets while my tail -f of my log RARELY updates. Am I losing data?!?!?!? Brian Leveille ------------------- Senior Internetworking Engineer DefendNet Solutions, Inc. www.defendnet.com -----Original Message----- From: matthew.copeland(a)honeywell.com [mailto:matthew.copeland@honeywell.com] Sent: Wednesday, November 08, 2000 5:22 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: Re: [syslog-ng]Real time .conf? Add sync(0) to your config file. Matthew M. Copeland Software Engineer On Wed, 8 Nov 2000, Brian Leveille wrote: > What conf settings can I use for my syslog-ng.conf file so that messages are > written to disk the instant they are received? > > Thanks, > > Brian Leveille > ------------------- > Senior Internetworking Engineer > DefendNet Solutions, Inc. > www.defendnet.com > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Zorp
by Jay Soffian 09 Nov '00

09 Nov '00

Shawn, This might be useful for the bastion host: http://www.balabit.hu/products/zorp/ j.

1 0