April 2000 - syslog-ng - lists.balabit.hu

new destination-file with group zzz
by Wolfgang Koessler 03 Nov '00

03 Nov '00

hello, I have some problems with the group of new destination-files of syslog-ng-1.3.13: my logrotate creats immediately after rotation the new log file: ~~~~~~~~~~~ /var/log/ns/f/newfile.log{ daily notifempty create 640 root zzz postrotate /usr/bin/killall -HUP syslog-ng endscript } ~~~~~~~~~~~ When syslog-ng writes in newfile.log, the group changes to "root". Can I specify in the sylog-ng.conf the group-affilation of the destination-file? Apart from this problem syslog-ng works fine! Thanks! wok ~~~ Wolfgang Kössler ZID Universität Innsbruck http://infoA.uibk.ac.at/c102/

2 1

Syslog-ng Dies - core dump
by John Wingenbach 07 Jun '00

07 Jun '00

I just installed and configured syslog-ng 1.4.3 on a Solaris 2.6 system. It cores out on startup. It apparently doesn't like part of my configuration. Debug output is: #> /opt/syslog-ng/sbin/syslog-ng -d -v binding fd 5, inetaddr: 0.0.0.0, port: 514 io.c: Preparing fd 5 for reading syslog-ng version 1.4.3 starting Segmentation Fault(coredump) My configuration is (Note below the comments regarding code which if removed allows it to live): source s_all { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; # Level Filters filter f_info { level(info .. emerg); }; filter f_warning { level(warning .. emerg); }; filter f_debug { level(debug .. emerg); }; filter f_crit { level(crit .. emerg); }; filter f_err { level(err .. emerg); }; filter f_emerg { level(emerg); }; # Facility Filters filter f_user { facility(user); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon); }; filter f_auth { facility(auth); }; filter f_lpr { facility(lpr); }; filter f_news { facility(news); }; filter f_kern { facility(kern); }; filter f_uucp { facility(uucp); }; filter f_cron { facility(cron); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # Complex Filters filter f_mailerror { filter (f_mail) and filter (f_err); }; filter f_axsyslog { filter (f_info) or filter(f_mailerror); }; ------ It would seem that the following filters used to build a summary syslog cause the problem. ------ filter f_errsanuser { filter (f_err) and not facility(user); }; filter f_kerndebug { filter (f_kern) and filter (f_debug); }; filter f_mailwarning { filter (f_mail) and filter (f_warning); }; filter f_summary { filter (f_errsanuser) or filter (f_kerndebug) or filter (f_daemon) or filter (f_mailwarning); }; destination d_all { file("/var/log/messages"); }; destination d_ttys { usertty("*"); }; destination d_console { file ("/dev/console"); }; destination d_kernfile { file ("/var/log/kern"); }; destination d_syslogfile { file ("/var/log/syslog"); }; destination d_userfile { file ("/var/log/user"); }; destination d_mailfile { file ("/var/log/mail"); }; destination d_mailcritfile { file ("/var/log/mail.crit"); }; destination d_mailwarnfile { file ("/var/log/mail.warning"); }; destination d_daemonfile { file ("/var/log/daemon"); }; destination d_daemonwarningfile { file ("/var/log/daemon.warning"); }; destination d_authfile { file ("/var/log/auth"); }; destination d_lprfile { file ("/var/log/lpr"); }; destination d_newsfile { file ("/var/log/news"); }; destination d_uucpfile { file ("/var/log/uucp"); }; destination d_cronfile { file ("/var/log/cron"); }; destination d_local0file { file ("/var/log/local0"); }; destination d_local1file { file ("/var/log/local1"); }; destination d_local2file { file ("/var/log/local2"); }; destination d_local3file { file ("/var/log/local3"); }; destination d_local4file { file ("/var/log/local4"); }; destination d_local5file { file ("/var/log/local5"); }; destination d_local6file { file ("/var/log/local6"); }; destination d_local7file { file ("/var/log/local7"); }; destination d_axentsyslog { file ("/axent/ita/system/falcon/syslog"); }; destination d_axentmail { file ("/axent/ita/system/falcon/syslog.mdbg"); }; log { source(s_all); filter (f_kern); filter (f_debug); destination (d_kernfile); }; log { source(s_all); filter (f_user); filter (f_debug); destination (d_userfile); }; log { source(s_all); filter (f_mail); filter (f_debug); destination (d_mailfile); }; log { source(s_all); filter (f_mail); filter (f_crit); destination (d_mailcritfile); }; log { source(s_all); filter (f_mail); filter (f_warning); destination (d_mailwarnfile); }; log { source(s_all); filter (f_daemon); filter (f_debug); destination (d_daemonfile); }; log { source(s_all); filter (f_daemon); filter (f_warning); destination (d_daemonwarningfile); }; log { source(s_all); filter (f_auth); filter (f_debug); destination (d_authfile); }; log { source(s_all); filter (f_lpr); filter (f_debug); destination (d_lprfile); }; log { source(s_all); filter (f_news); filter (f_debug); destination (d_newsfile); }; log { source(s_all); filter (f_uucp); filter (f_debug); destination (d_uucpfile); }; log { source(s_all); filter (f_cron); filter (f_debug); destination (d_cronfile); }; log { source(s_all); filter (f_local0); destination (d_local0file); }; log { source(s_all); filter (f_local1); filter (f_debug); destination (d_local1file); }; log { source(s_all); filter (f_local2); destination (d_local2file); }; log { source(s_all); filter (f_local3); destination (d_local3file); }; log { source(s_all); filter (f_local4); filter (f_debug); destination (d_local4file); }; log { source(s_all); filter (f_local5); filter (f_debug); destination (d_local5file); }; log { source(s_all); filter (f_local6); filter (f_debug); destination (d_local6file); }; log { source(s_all); filter (f_local7); filter (f_debug); destination (d_local7file); }; log { source(s_all); filter (f_axsyslog); destination (d_axentsyslog); }; log { source(s_all); filter (f_mail); filter (f_debug); destination (d_axentmail); }; log { source(s_all); filter (f_summary); destination (d_syslogfile); }; -- John C. Wingenbach Pliant Systems, Inc. Sr. Systems Administrator Work: (919) 405-4627 Fax: (919) 405-4544

4 19

strange thing
by Stefan Seufert 30 Apr '00

30 Apr '00

Hi, yesterday I experienced a very strange problem with syslog-ng which I'd like to report. Maybe someone here has a clue what might have caused this. I am not able to reproduce that problem (on a different machine and I don't want to try it on the machnie I had experienced it since this fast the main server of my company. Well, what happened? I was playing around with syslog-ng. I had added a program(); destination but for some reason it seemed not to work as i wanted (due to a name resolution problem, there always was the IP instead of the hostname in the logfiles so my script did not parse the input correctly, but that not relevant). In order to see what was going on I added a "destination home { udp(1.2.3.4); };" and a "log (source(net); destination(home); };" At home, from where i was working I had a simple VB program running on my win workstation which was listening on port 514 udp and putting everything it recieved in a log-window. However, no messages appaered. So I decided to write the messages to a log file wich should be more reliable than sending them about a dialup connection, so I modified the log statement to "log (source(net); destination(home); destination(all); };" where all was "destination all { file("/var/log/allmessages"); };". From that moment on (i.e. after the HUP) the whole system went to sleep. Every process trying to use syslog blocked. Within a few seconds I had some hundred pop3d and sendmail tasks running, my own ssh was blocked since I tried to issued a logger command. I was not able to telnet or ssh to this host since both daemon tried to log when I connected. Luckily enough someone else at my company still had an open telnet. I called him and advised him to remove the malicious lines from the config and send syslog-ng a SIGHUP. No Effect. Only a SIGKILL was able to help us out of this strange situation. Within seconds all the daemons went back to work again. I really have no idea what might have caused this and I am not able to give you more details. As I said, I was not able to reproduce this situation on a test server. I am an developer myself and I perfectly know that this description is nearly useless because it is lacking facts, but I am not able to deliever some and I thought that it might be better to state that their might be a problem so that if someone else will report something similar it might help to make it easier to puzzle the whole thing together. Please note that the system is very old (Kernel 2.0.35, still libc) and has an uptime of more than 300 days now without having ECC ram. This system became "to important to be upgraded". It will be replaced in the near future with a new machine so that we do not have to take it down but could switch softly. Maybe I can reproduce that situation then and send you some straces etc. Stefan --- Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning.

2 6

Re: syslog-ng && kern.*
by Balazs Scheidler 30 Apr '00

30 Apr '00

> Have you managed to log any kernel messages with syslog-ng? > I have tried almost anything already. What I have is latest version > of syslog-ng and redhat-6.1 klogd running. I've just checked, and it does write kernel messages to the appropriate file. > and on other console.. > [root@cyrex /root]# klogd > [root@cyrex /root]# > [root@cyrex /root]# logger -p kern.info somemessage > and on first console.. > io.c: Preparing fd 4 for reading > io.c: Preparing fd 5 for writing > io.c: Preparing fd 6 for writing > io.c: Preparing fd 7 for writing > io.c: Preparing fd 8 for writing > io.c: Preparing fd 9 for writing > Read EOF on fd 4. > Marking fd 4 for closing. > Closing fd 4. > Garbage collecting while idle... > Objects alive: 160, garbage collected: 5 > > .. and surprise: > [root@cyrex syslog-ng-1.4.3]# tail /var/log/syslog -n 1 > Apr 28 11:05:27 cyrex tontsa: somemessage > [root@cyrex syslog-ng-1.4.3]# tail /var/log/kern.log -n 1 > > Shows up nothing. Any ideas? I'm almost willing to try anything :). > Normal syslog kills my machine when I'm running syslog intensive > jobs and printk() logging isn't nice to look when klogd -f /somefile is run. hmm.. try an strace dump of klogd, and check the priority value it sends to syslog-ng. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

1.5.x?
by Jeremy Hansen 29 Apr '00

29 Apr '00

Just got on the list?. Is there an archive anywhere? Basically I'm looking for information on 1.5.x and the purposed encryption implimentation. We're looking for a way to setup a centralized syslog server and have the traffic from remote machines encrypt the data going to the syslog server. I looked at ssyslog, but it doesn't seem to work the way I initially thought. Data on the local machine is encrpyted but attackers could still potentially screw things up on the local machine. -jeremy -- http://www.xxedgexx.com | jeremy(a)xxedgexx.com ---------------------------------------------

2 1

delay
by Balazs Scheidler 26 Apr '00

26 Apr '00

Hi, Sorry for the long delay it takes for me to answer messages nowadays, but I'm in the middle of several things. (incorporating a new firm, getting furniture to my office, completing my major's thesis etc) Things will be better in one or two weeks, so please be patient, I'll answer all questions and also fix bugs. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

A question concerning filter(DEFAULT);
by Jan Niemann 26 Apr '00

26 Apr '00

Hi, can I use other log paths after using filter(DEFAULT); ? is the order of the log-path entrys important for filter(DEFAULT); ? regards, Jan Niemann

1 0

complex filtering
by Un L'Unique 25 Apr '00

25 Apr '00

Hello, Im currently building our loghost syslog-ng conf file and encounter a problem. How can I filter message so that only not-alredy-routed line will be routed/filtered again ? For example, I am trying to send ssh line to a dedicated log file, since sshd send its message to the deamon facility and that ( generic) daemon facility are send to a generic file, a given line appereas in both file and that waste my disk space :-). I am trying to solve that by adding "and not filter(f_ssh)" in my dameon filter but it does nothing ( not even syntax error message). Is there any error ? Is there another way ? Thanks for any help. Un .... filter f_ssh { program("ssh.*"); }; filter f_cyrus-imapd { program("deliver.*") or program( "imapd.*"); }; filter f_named { program("named.*"); }; filter f_ntp { program(".*ntp.*"); }; filter f_kern { facility(kern); }; filter f_user { facility(user); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon) and not filter(f_cyrus-imapd) and not filter(f_ssh) and not filter(f_ntp) and not filter(f_named); }; ....

2 2

regexp in match() function
by Przemek Bak 21 Apr '00

21 Apr '00

Does match() function really use regexp to match a string ? For example I'd like to match following strings: Err err ERR eRR ... What should I write in config file ? Is something like that ok: filter f { match ("[Ee][Rr][Rr]"); }; przemol

1 0

bug ?
by Jan Niemann 21 Apr '00

21 Apr '00

Hi, I think i found a bug in syslog-ng-1.4.3; I'm currently running SuSE's Linux 6.3. every user account uses his own language with glibc's locales. So if I'm logged in as normal user i speak german with my computer; some months have other abbreviations : March (Mar) -> März (Mär) May (May) -> Mai (Mai) So if the time is somewhere in may, and my user logs something it'll look like this : May ... May ... Mai ... :-( May ... The problem : if i have a destination like destination{ file("/var/log/messages-$MONTH-$YEAR"); }; and i'm in March/May 2000 and my normal user uses logger or other programs like su; a file /var/log/messages-12-1999 gets created containing all localized log-entrys. Bye, Jan Niemann

1 0