April 2000 - syslog-ng - lists.balabit.hu

local[0-7], can't get them to write to file.
by i＠moe.co.uk 12 Apr '00

12 Apr '00

Hi All, I'm having a few minor problems writing local 6 and 7 to files. I'm most likely doing something incorrect in the config file, can some one help me out please. source src { unix-dgram("/var/run/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination local6 { file("/var/log/local6.log"); }; destination local7 { file("/var/log/local7.log"); } filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; log { source(src); filter(f_local6); destination(local6); }; log { source(src); filter(f_local7); destination(local7); }; Cheers, John

2 3

RE: [syslog-ng] complex filtering
by Hamilton, Andrew Mr. 12 Apr '00

12 Apr '00

I am using 1.4.2 which I assume is still the latest version since I haven't heard of anything new lately and that being the latest on the web site. I will see if I can duplicate what I was doing and get the config to you and the logs I'm getting from it. Drew > -----Original Message----- > From: Leopold Toetsch [SMTP:lt@toetsch.at] > Sent: Thursday, April 06, 2000 12:17 PM > To: syslog-ng(a)venus.terrasoft.hu > Subject: Re: [syslog-ng] complex filtering > > > ----- Original Message ----- > From: Hamilton, Andrew Mr. <HamiltonA(a)hq.5sigcmd.army.mil> > To: <syslog-ng(a)venus.terrasoft.hu> > Sent: Donnerstag, 06. April 2000 07:10 > Subject: RE: [syslog-ng] complex filtering > > > > I've also had problems with the "and not" filtering in syslog-ng. I > ended > > up having to do a kind of a DeMorgan method and change the filtering > around > > a little. I got it to do what I wanted but not quite the way I > expected. > > Are you using the latest version? > There was a bug concerning 'not', which should be fixed now. > > leo > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

write() failed (errno 32)
by Przemek Bak 07 Apr '00

07 Apr '00

Hi, I have following lines in syslog-ng.conf filter aaa { match ("aaa"); }; destination aaa { program ("/usr/bin/mail -s WARN user"); }; log { source(src); filter (aaa); destination(aaa); }; When I run logger: # logger aaaIIII in messages file I have: Apr 5 13:06:26 src@host syslog-ng[1627]: io.c: do_write: write() failed (errno 32), Broken pipe What does it mean ? It happen from time to time, not always. przemol

2 6

Re: tracelogs
by Balazs Scheidler 07 Apr '00

07 Apr '00

On Mon, Mar 27, 2000 at 04:33:18PM +0200, Gero Krueger wrote: > Hi Balazs ! > > HP has sent me a tracing tool. So I recorded a session > where syslog-ng listens on /dev/log and forwards that > to a remote host via tcp. > With the first logentry syslog-ng gets from /dev/log he > produces that huge unterminated output. > > I'm not really sure if this tracing-tool records the > information you need - just have a look at it and > let me know. > > > Thank you very much for your help. Sorry for the long time it took me to answer, but I'm really out of time. I've checked the trace you sent me, and the problem is that the info I need is missing: 3191: read(4 [/dev/log], 0x40019888, 1024) = 1024 The contents of the buffer is not displayed. It's strange that HPUX says that 1024 bytes could be successfully read, something should terminate that string, the question is what it is? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Expanding $PROGRAM and $FACILIITY macros with empty log messges
by Jason Edgecombe 06 Apr '00

06 Apr '00

hi all, i'm running syslog-ng-1.4.2 and I am having a problem with macro expansion an blank log message causes the problem. here is an excerpt from my logs: note, mathlog-pc is our central logging server, it is also running syslog-ng (same version) but is UDP forwarding all logs to the log server Apr 5 08:28:40 src@fret340f-pc/fret340f-pc Apr 5 08:28:40 src@mathlog-pc syslog-ng[1793]: Cannot open file /var/log/syslog-ng/2000/04/05/fret340f-pc/p/ for writing (Is a directory) Apr 5 08:28:40 src@fret340f-pc/fret340f-pc syslog-ng[4481]: Cannot open file /var/log/syslog-ng/2000/04/05/fret340f-pc/ for writing (Is a directory) Any help on this is appreciated. Thanks, Jason

1 0

RE: [syslog-ng] complex filtering
by Hamilton, Andrew Mr. 06 Apr '00

06 Apr '00

I've also had problems with the "and not" filtering in syslog-ng. I ended up having to do a kind of a DeMorgan method and change the filtering around a little. I got it to do what I wanted but not quite the way I expected. filter f_messages { level(info..warn) and not facility(local2,kern,auth); }; The above didn't work the way I expected it should have. I ended up doing filter f_messages { level(info..warn) and facility(mail,news,etc..); }; This seemed to work ok. I'm not sure if syslog-ng is evaluating the "and not" construct the way you'd expect. Of course it may be that I just wasn't using it correctly as well. Drew > -----Original Message----- > From: Balazs Scheidler [SMTP:bazsi@balabit.hu] > Sent: Wednesday, April 05, 2000 5:08 PM > To: syslog-ng(a)venus.terrasoft.hu > Subject: Re: [syslog-ng] complex filtering > > > > > Im currently building our loghost syslog-ng conf file and encounter a > problem. How can I filter message so that only not-alredy-routed line will > be routed/filtered again ? > > > > For example, I am trying to send ssh line to a dedicated log file, since > sshd send its message to the deamon facility and that ( generic) daemon > facility are send to a generic file, a given line appereas in both file > and that waste my disk space :-). > > > > I am trying to solve that by adding "and not filter(f_ssh)" in my dameon > filter but it does nothing ( not even syntax error message). > > > > Is there any error ? Is there another way ? > > > > Thanks for any help. > > The filter way should work, if it doesn't, it's a bug. There's a feature > you > may use here. You can define default log statements: > > log { source(src); filter(DEFAULT); destination(dst); }; > > This is a catchall statement, and should catch all messages which were not > accepted any of the previous statements. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

program
by Przemek Bak 05 Apr '00

05 Apr '00

Hi, I have following lines in syslog-ng.conf filter aaa { match ("aaa"); }; destination aaa { program ("/usr/bin/mail -s WARN user"); }; log { source(src); filter (aaa); destination(aaa); }; When I run logger: # logger aaa it doesn't always work. Why ? I just want to have lines of messages sent to me by mail. przemol

1 0

syslog-ng and empty lines
by Balazs Scheidler 05 Apr '00

05 Apr '00

Many of you reported that syslog-ng emits empty loglines beginning with 1.4.2. This patch should fix the problem: diff -u -r1.23.2.2 sources.c --- sources.c 2000/03/24 10:57:28 1.23.2.2 +++ sources.c 2000/04/05 05:54:05 @@ -118,7 +118,8 @@ length = end - start; - do_handle_line(closure, length, start, salen ? (abstract_addr *) &sabuf : NULL , salen); + if (length) + do_handle_line(closure, length, start, salen ? (abstract_addr *) &sabuf : NULL , salen); start = end + 1; #if 0 -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Collecting Logs on Loghost
by Wolfgang Braun 05 Apr '00

05 Apr '00

Greetings I'm writing my thesis on the subject of collecting and analysing logfiles. i'm in the information gathering and i'm interested in your opinions on the topic. the primary idea is that hosts log all their syslog (and maybe other files like http-logs) to a dedicated loghost where the log messages are inserted into a DB. additionally there should be a filter program that scans the message stream for certain patterns and triggers actions (information gathering like backfinger, ripe data etc). things to be evaluated now are o how much net load does syslog create? one pitfall could be that logging to the extreme could have an impact on network performance making it impossible to transfer all logging information. my view (not yet supported by numbers) is that the impact on net performance should be rather low, but i'm setting up a test environment to packet count. since i assume thet remote logging is common practice i'm interested in your experiences. o how much data does a host generate? this is of course dependant on which services are running on the machine and the usage of the services. question is how much data a DB (e.g. PostgreSQL) can handle (real time queries should be possible). this will be taken care of in the test environment, too. o common tools i'm aware of several analyzing tools (swatch, logsurfer ... from freshmeat). i like the logsurfer approach on creating contexts (to gather information from different sources into a small report on specified events). are there more tools like that that do a good job? some unsorted ideas: + doing long term analysis via the DB interface, to maybe trace long term patterns (slow portscans or door knob testing come to mind) + central administration of configurations and pushing of configurations to 'agents' running on each host + default filter configurations to handle standard services and their logs (bind, sendmail, ftpd), creation of regular reports as said, i'd be very interested on your thoughts on the topic, your experiences and maybe references to papers/tools. wolfi -- Internet ist das Ding mit den Kabeln. Usenet ist das Ding mit den Menschen. -- Hubert Partl

2 1