March 2000 - syslog-ng - lists.balabit.hu

syslog-ng-1.4.0rc3: How to log the domainname
by Joakim Rastberg 03 Mar '00

03 Mar '00

Hi! I just downloaded, installed, configured and ran syslog-ng-1.4.0rc3 and everything looks great! I have just a small question that doesn't get answered in the archive at http://lists.balabit.hu/pipermail/syslog-ng/: How do I get the domainname of the hosts into the logs? I ask this as I collect syslogs from several nameservers for different domains who all have the hostname "ns". One way would be to log the orginating IP-address, but I can't find out how to do that if the host is found in DNS (like -n in netstat would be fine) A cursory look in sources.c around line 157 gives that the code *removes* the domainname but I can't understand why this not is a configurable option. % uname -a SunOS syslog 5.7 Generic_106541-09 sun4m sparc SUNW,SPARCstation-20 % cat /etc/syslog-ng/syslog-ng.conf source stdlog { udp(); }; source local {sun-streams("/dev/log" door("/etc/.syslog_door"));internal();}; destination auto { file("/var/log/$HOST.$FACILITY"); }; log { source(stdlog);source(local); destination(auto); }; /Joakim Rastberg, IT-Security Conslutant. -- "Pioneer Preference" status and "Holder of Past Knowledge" in the DNRC.

2 1

m4?
by mgx＠spruce.lsd.ornl.gov 03 Mar '00

03 Mar '00

good day ... i'm trying to compile the stable version 1.4.0 on solaris 2.6 (SunOS avatar.lsd.ornl.gov 5.6 Generic_105181-11 sun4u sparc SUNW,Ultra-5_10) and i get this error: 40 root@avatar /usr/local/syslog-ng-1.4.0> make Making all in src make[1]: Entering directory `/usr/local/syslog-ng-1.4.0/src' cd /usr/local/syslog-ng-1.4.0 && autoheader Autoconf requires GNU m4 1.1 or later make[1]: *** [/usr/local/syslog-ng-1.4.0/src/stamp-h.in] Error 1 while my version of m4 is: 41 root@avatar /usr/local/syslog-ng-1.4.0> m4 --v GNU m4 1.4 did i miss something simple here? i searched the archives and cannot any reference to this problem. -- -- michael

1 1

syslog-ng 1.4.0 released
by Balazs Scheidler 03 Mar '00

03 Mar '00

Hi, I've finally released 1.4.0 as stable fixing all the bugs you have reported. It should work out of the box on Solaris (I've fixed a configure.in test), and HP-UX (fixed pipe support). You can find it at the usual place: http://www.balabit.hu/products/syslog-ng/ Please tell me if you encounter any problems. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: [syslog-ng] message numbers
by Terje Krogdahl 03 Mar '00

03 Mar '00

Balazs Scheidler <bazsi(a)balabit.hu> writes: > what is this message number? A serial number? Actually it is a sequence number. I see it when my Cisco routers log via syslog. The number is incremented by one every time a router sends a syslog message. Very useful to detect missing log entries, among other things. Here's a hex dump of a complete packet, in case this helps clear things up: 0: 0800 2083 600e 0000 0c76 bf10 0800 4500 .. .`....v....E. 16: 0094 0182 0000 fe11 1690 8243 4ffc 8243 ...........CO..C 32: 4fc4 1ac4 0202 0080 302f 3c31 3930 3e33 O.......0/<190>3 48: 3536 313a 2046 6562 2032 3620 3232 3a33 561: Feb 26 22:3 64: 393a 3138 2e32 3132 3a20 2553 4543 2d36 9:18.212: %SEC-6 80: 2d49 5041 4343 4553 534c 4f47 503a 206c -IPACCESSLOGP: l 96: 6973 7420 3132 3020 6465 6e69 6564 2074 ist 120 denied t 112: 6370 cp ... which produces the following syslog message. Note that I have removed the hostname and part of the message stating IP addresses. Feb 26 22:33:46 xxxxxxx.xx.telenor.net 3561: Feb 26 22:39:18.212: %SEC-6-IPACCESSLOGP: list 120 denied tcp... Syslog-ng is running under Solaris 2.6. -- Terje Krogdahl Nextra AS - I don't buy from spammers.

4 6

Re: syslog-ng, file source driver
by Balazs Scheidler 01 Mar '00

01 Mar '00

On Wed, Mar 01, 2000 at 11:51:58AM -0800, Alex Schlessinger wrote: > > > > > > what am i doing or understanding incorrectly? > > > > The file source driver is meant to be used on special files like /proc/kmsg. > > If you want to forward the contents of a real file, you could write a simple > > script like: > > > > tail -f <logfile> | logger -p local5.info > > understood, this is basically what i ended up doing. > > however, the documentation is misleading.. > > http://www.balabit.hu/products/syslog-ng/doc/reference.html#AEN303 > > "Of course using this driver you are not limited to special files, you can as well read a > continuosly growing simple file, and syslog-ng will "follow" appended lines, > just like tail -f does." ops, this is a docbug. earlier syslog-ng was able to do this, but this maxed out CPU usage. It is not possible to decide whether new data arrived to a file using poll(), since the main loop uses poll to wait for events, it would be difficult to add this feature. (though not impossible) so for now I corrected the documentation, and leave this feature addition for 1.5.x. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

DOTDOT problem
by Brad Arlt 01 Mar '00

01 Mar '00

Hello.. I am running syslog-ng 1.4.0rc3. I am having a bit of a problem with the '..' operator for priorities. I have a filter : filter authlogs { facility(auth) and priority(emerg..info); }; Error level through info work just fine... but I get nothing above error. However if I expand the '..' I get all the levels between emerg and info. filter authlogs { facility(auth) and priority(emerg,alert,crit,error,warning,notice,info); }; ---- It looks to me like an "array to small" or "counter doesn't go high enough" type problem, but I haven't looked at the source yet (it really is *that* big a deal, its just nice to have to make the config file smaller/prettier) ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_)

2 1