February 2000 - syslog-ng - lists.balabit.hu

syslog-ng 1.3.17
by Brian Johnson 18 Feb '00

18 Feb '00

I just upgraded to syslog-ng 1.3.17 (from 1.3.14), and I noticed that when I kill syslog-ng it doesn't print "syslog-ng going down" in my logs anymore, but it still does print when it's starting, and when I run it with -d and kill it the same way it does print syslog-ng going down on the screen, so there seems to be a problem with the internal logging?

1 0

create_dirs in 1.3.15
by Sam Howard 18 Feb '00

18 Feb '00

Hi. I'm looking at the ChangeLog for 1.3.15, and it mentions "added create_dirs", and "updated documentation", but I cannot find any docs about the new features... What am I missing??? Thanks! Sam Samuel P. Howard Sr. Unix Systems Administrator 2nd Century Communications Voice: 813-901-1280 mailto:sphoward@2c2.com

3 4

RE: [syslog-ng] create_dirs in 1.3.15
by Sam Howard 18 Feb '00

18 Feb '00

I tried something similar, and found that syslog-ng went balistic and was constantly 'stat(/var)' (according to truss). Also, should it create *any* directory it needs? or only ones that are the result of a variable expansion? For example file("/var/log/make/this/directory/$HOST.log"); where only /var/log exists... BTW, I tried this on 1.3.16 (ahh, fresh code!) Thanks, Sam -----Original Message----- From: Chris Scheller [mailto:schelcj@networkone.net] Sent: Thursday, February 17, 2000 6:24 PM To: syslog-ng(a)venus.terrasoft.hu Subject: Re: [syslog-ng] create_dirs in 1.3.15 I can't seem to get create_dirs to work. When i add it to my options and add a destination such as destination test { file("/var/log/syslog-ng/$HOST/$FACILITY"); }; not only does it not create the directories or the files, but syslog-ng stops logging everything all together. Any thoughts? did i miss something in the conf? Chris Scheller System/Network Administration Network One Internet, inc. http://www.networkone.net/ 1.888.GOT-NET1 On Thu, 17 Feb 2000, Balazs Scheidler wrote: > > I'm looking at the ChangeLog for 1.3.15, and it mentions "added > > create_dirs", and "updated documentation", but I cannot find any docs about > > the new features... > > > > What am I missing??? > > The 1.3.15 tarball doc/sgml/syslog-ng.txt file contains this. (or the .html > version) > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Re: syslog-ng stops listen to UDP after "nmap -sU"?
by kent＠unit.liu.se 17 Feb '00

17 Feb '00

kent(a)unit.liu.se (Kent Engström) writes: > Everything worked fine until I decided to portscan the syslog server. > When I did a UDP scan, syslog-ng stopped logging. This is what happens: > *) I execute "nmap -p 514 -sU xxx.yyy.zzz.www" on a Linux box Using options "-v" and "-d", I catch the following: Read EOF on fd 3. Marking fd 3 for closing. Closing fd 3. It appears that libol is the culprit here. It assumes that a returned read length of 0 means end of file, as when reading from a file or a TCP connection. -- Kent Engström, Linköping University Incident Response Team kent(a)unit.liu.se abuse(a)liu.se +46 13 28 1744 UNIT, Linköping University; SE-581 83 LINKÖPING; SWEDEN

2 1

syslog-ng stops listen to UDP after "nmap -sU"?
by kent＠unit.liu.se 17 Feb '00

17 Feb '00

Today, I installed syslog-ng 1.3.15 on Solaris 7. I have the following very simple config file (I am still evaluating syslog-ng): options { use_fqdn(yes); }; source syslog_udp { udp(ip(xxx.yyy.zzz.www) port(514)); }; source syslog_internal { internal(); }; destination syslog_file { file("/somepath/logs/$YEAR-$MONTH-$DAY-$HOST-$FACILITY"); }; log { source(syslog_udp); source(syslog_internal); destination(syslog_file); }; xxx.yyy.zzz.www is a virtual IP-address that is assigned to whatever server that is currently providing syslog service to the rest of the internal network. Everything worked fine until I decided to portscan the syslog server. When I did a UDP scan, syslog-ng stopped logging. This is what happens: *) I start syslog-ng *) I connect to our mail server, and see how the connection is logged in the file /somepath/logs/2000-02-17-mailserver.our.domain-mail *) I run netstat -a and observe the line xxx.yyy.zzz.www.514 Idle *) I execute "nmap -p 514 -sU xxx.yyy.zzz.www" on a Linux box *) I run netstat -a and observe that there is no longer any entry for port 514. *) The syslog-ng process is still running, though. *) I connect to our mail server again. The connection is not logged by syslog-ng. In fact, nothing seems to be logged at all. The packet that is sent by nmap during an "-sU scan" is a UDP packet with zero bytes of data. Obviously, this could be an easy way for a cracker do disable a loghost in preparation for an attack on another host. Can anybody repeat this? -- Kent Engström, Linköping University Incident Response Team kent(a)unit.liu.se abuse(a)liu.se +46 13 28 1744 UNIT, Linköping University; SE-581 83 LINKÖPING; SWEDEN

1 0

unable to use tcp/udp forward.
by User Un 17 Feb '00

17 Feb '00

Hello, I am evaluating syslog-ng as we want TCP ( reliable) syslog message, however, I am unable to comply due to strange "syntax error": destination all { # file( "/tmp/messages"); # ok # tcp( ip( 172.16.32.35) port( 1999)); # nok # udp( ip( 172.16.32.35) port( 514)); # nok udp( 172.16.32.35,514); # nok # usertty( un); # ok # program( "cat >/tmp/messges_cat"); # ok }; all "nok" failed with error like: /net/ts/opt/syslog-ng-1.3.14/sbin/syslog-ng -f /net/ts/opt/syslog-ng-1.3.14/etc/syslog-ng.conf -d -v parse error at 33 Parse error reading configuration file, exiting. I tryed with version 1.3.14 & 1.2.3. Thanks for any help. S.R.

3 2

Syslog stop fordward
by Victor Barahona 17 Feb '00

17 Feb '00

-----BEGIN PGP SIGNED MESSAGE----- Hi I loging a web server to a log-machine so I put the next configuration in the web server: ---------------- options { sync(0); time_reopen(10); log_fifo_size(100); }; source local { sun-stream("/dev/log" door("/etc/.syslog_door")); }; source syslog { internal(); }; source rincon { file("/www/logs/rincon-access.log"); }; destination brezo { tcp("150.244.9.2" port(514)); }; log { source(rincon); destination(brezo); }; ----------------------------------------------- The log-server has this config-file: ----------------------------------------------- options { sync(10); time_reopen(10); log_fifo_size(100); }; source local { internal(); }; source red { tcp(); }; destination rincon { file("/var/log/filer/rincon-access.log"); }; filter rincon { host(limonero) and match(HTTP/1); }; log { source(red); destination(rincon); }; ------------------------------------------------------ When I run with this configuration, te log-server stops to write lines in the file when fifo size is full (I think) so I increase the fifo size to 1000 first and to 150000 later. The destination file grown but seems no be sort by date as the source and finally stops the write lines (but the daemon is OK). Two things: 1)Everytime I run the syslog-ng in the web server, process all the file, instead only the appending lines. Who can I chage this? 2)Why the daemon stops writting in the log-server's file? It's a problem with big files? The origin file is about 8Mb and it grow to 11Mb due the header of the syslog-ng. There is some limit? Thanks -- "Making predictions is difficult, particularly about the future" Niels Bohr ------------------------------------------------------------------------ Victor Barahona..........................http://www.sdi.uam.es/~barahona Soporte Seguridad en red.................http://www.sdi.uam.es/utc/ss Unidad Tecnica de Comunicaciones Universidad Autonoma de Madrid Tlf.- 91 397 5525 PGP ID-0x8750AB79 ------------------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use MessageID: DwGwcnUdWLU9WfN4xS9DVnhJ0deLgA1M iQA/AwUBOKrOekoW8ByHUKt5EQICpgCfWBkBFnAR+/iGjZSTBX8vFqdBBRkAoIpq A9+ShW9YEy1RbygI+P8Yzfyb =6Ii6 -----END PGP SIGNATURE-----

2 1

use_fqdn()
by Graham Thomas 17 Feb '00

17 Feb '00

hi, Just putting together a config file for syslog-ng-1.2.3 on solaris and it doesn't appear to like the line: options { use_fqdn(yes); }; I've tried different options and all numerical ones are excepted ok. Options with accepted values described as 'yes' or 'no' in the documentation cause the deamon to fail on start-up. Have I got the syntax wrong? Do I need a newer version to enable this feature? If so, Is there a different option that will give me the full domain name in this version? thanks, graham

2 1

Syslog-ng fails with more than one program destination
by George Madden 15 Feb '00

15 Feb '00

I was testing with 1.3.13 and found it fails with a kill -HUP when more than one "program" destination is used. Syslog-ng never restarts and starts using all the cpu. I tested this on both Redhat 6.1 and FreeBSD 3.3. When I remove all but one program destination, it works fine. It also works fine under syslog-ng 1.2.3. I assume I can have more than one program destination but maybe not. Here is the debug output. It never closes the fd and the cpu goes to about 97% binding fd 3, inetaddr: 0.0.0.0, port: 514 io.c: Preparing fd 3 for reading io.c: listening on fd 4 io.c: Preparing fd 6 for writing io.c: Preparing fd 7 for writing io.c: Preparing fd 8 for writing syslog-ng version 1.3.13 starting io.c: Preparing fd 5 for writing Garbage collecting while idle... Objects alive: 68, garbage collected: 4 Garbage collecting while idle... Objects alive: 68, garbage collected: 14 Garbage collecting while idle... Objects alive: 68, garbage collected: 28 Garbage collecting while idle... Objects alive: 68, garbage collected: 37 SIGHUP received, restarting syslog-ng Marking fd 3 for closing. Marking fd 5 for closing. Marking fd 8 for closing. Here are the files from the Redhat system: syslog-ng.conf ## options { long_hostnames(off); sync(0); log_fifo_size(10); }; source src { unix-stream("/dev/log"); internal(); }; source net { udp(); }; # destination all { file ("/var/log/all" sync(0)); }; destination net { file ("/var/log/net" sync(100)); }; # destination authenfail {program ("/etc/scripts/authenfail.sh"); }; destination authendeny {program ("/etc/scripts/authendeny.sh"); }; destination poolmess {program ("/etc/scripts/poolmess.sh"); }; # filter f_authen { match ("PIX-6-10900"); }; filter f_authenfail { match ("PIX-6-109006"); }; filter f_authendeny { match ("PIX-6-109009"); }; filter f_poolfail { match ("laddr 10.10.01.254"); }; # log { source(src); destination(all); }; log { source(net); destination(net); }; # log { source(net); filter(f_authenfail); destination(authenfail); }; log { source(net); filter(f_authendeny); destination(authendeny); }; log { source(net); filter(f_poolfail); destination(poolmess); }; Here are the scripts: authendeny.sh #!/bin/sh while read LINE; do echo $LINE | mail -s "Athentication Denied" root done authenfail.sh #!/bin/sh while read LINE; do # use awk to get the second field with a ' as a delimiter NAME=`echo $LINE | awk -F\' '{print $2}'` echo $NAME echo $LINE | mail -s "Athentication Failed for $NAME" root done poolmess.sh #!/bin/sh while read LINE; do echo $LINE | mail -s "Possible pool overload" pixadmin done

2 6

syslog-ng 1.3.15 and libol 0.2.14
by Balazs Scheidler 13 Feb '00

13 Feb '00

I've released syslog-ng 1.3.15 with libol 0.2.14. News for the 1.3.15 release Added the possibility to create directories on the fly. You'll need to enable the create_dirs() option. Added a -V flag to display version number. Updated documentation, destination file() driver now fully documented. Fixed a few bugs. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0