September 2000 - syslog-ng - lists.balabit.hu

new destination-file with group zzz
by Wolfgang Koessler 03 Nov '00

03 Nov '00

hello, I have some problems with the group of new destination-files of syslog-ng-1.3.13: my logrotate creats immediately after rotation the new log file: ~~~~~~~~~~~ /var/log/ns/f/newfile.log{ daily notifempty create 640 root zzz postrotate /usr/bin/killall -HUP syslog-ng endscript } ~~~~~~~~~~~ When syslog-ng writes in newfile.log, the group changes to "root". Can I specify in the sylog-ng.conf the group-affilation of the destination-file? Apart from this problem syslog-ng works fine! Thanks! wok ~~~ Wolfgang Kössler ZID Universität Innsbruck http://infoA.uibk.ac.at/c102/

2 1

Answer to the reliability problem
by Jeffrey W. Baker 30 Sep '00

30 Sep '00

Well, I have found the answer to the reliability problem! The flaw is in this code in pkt_buffer.c: static int do_write_str(struct abstract_write *c, struct ol_string *string) { CAST(pkt_buffer, self, c); debug("do_write_str\n"); if (self->super.closed) { ol_string_free(string); return ST_FAIL | ST_CLOSE; } if (self->queue_size == self->queue_max) { /* fifo full */ ol_string_free(string); return ST_FAIL | ST_OK; } So you can see that when the queue is full, the messages simply get dropped. That's bad! The solution is to flush the queue when it is full, and then continue looping over the available input. The question is, what code should be responsible for doing this flushing? Shouldn't some piece of code be checking for the ST_FAIL return code? Cheers, Jeffrey

2 2

Doubt !!
by Kleyson Rios 29 Sep '00

29 Sep '00

The expression : log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; write for destination(mailinfo) the messages where " filter(f_mail) AND filter(f_info) " is true or " filter(f_mail) OR filter(f_info) " is true ? Because in my syslog-ng.conf I have : destination mailinfo { file("/var/log/syslog-ng/gandalf/mail.info"); }; destination mailwarn { file("/var/log/syslog-ng/gandalf/mail.warn"); }; filter f_mail { facility(mail); }; filter f_info { level(info); }; filter f_warn { level(warn); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; and my logs "mailinfo" and "mailwarn" are same . Kleyson Rios. Brazil.

2 1

syslog-ng 1.4.7 and libol 0.2.20
by Balazs Scheidler 29 Sep '00

29 Sep '00

Hi, I've released syslog-ng 1.4.7 and libol 0.2.20, which you can find at the usual places. This release fixes a quite serious memory leak bug. Scott, please check if this one fixes your problems. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

RE: [syslog-ng]SQL support with syslog
by Hamilton, Andrew Mr. 26 Sep '00

26 Sep '00

The easiest thing to do is to send the log output to scripts. Then you can parse and feed it to whatever application you want, however you want. Drew > -----Original Message----- > From: offset [SMTP:offset@privacyx.com] > Sent: Monday, September 25, 2000 9:46 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]SQL support with syslog > > I am trying to come up with a centralized syslog solution and I wanted > to hear from other people that have a centralized solution in place. > > I was thinking about using syslog-ng running on the collection server > but I'm not sure how to go about doing the real-time alerting and > long-term storage for possible forensics use. > > I've heard good things about logsurfer, so I was going to explore using > this tool http://www.cert.dfn.de/eng/logsurf/ > > How do I go about gathering syslog data directly into a SQL database in > real-time (or near real-time) such as Postgresql, or mysql? > > Thanks, > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

SQL support with syslog
by offset 25 Sep '00

25 Sep '00

I am trying to come up with a centralized syslog solution and I wanted to hear from other people that have a centralized solution in place. I was thinking about using syslog-ng running on the collection server but I'm not sure how to go about doing the real-time alerting and long-term storage for possible forensics use. I've heard good things about logsurfer, so I was going to explore using this tool http://www.cert.dfn.de/eng/logsurf/ How do I go about gathering syslog data directly into a SQL database in real-time (or near real-time) such as Postgresql, or mysql? Thanks,

1 0

RE: [syslog-ng]Simple question.
by Shawn Davenport 25 Sep '00

25 Sep '00

Larry, give this a try... destination all { udp("192.168.0.24" port(514)); }; hope that helps. thanks... shawn -----Original Message----- From: Cashdollar, Larry [mailto:larry.cashdollar@akamai.com] Sent: Monday, September 25, 2000 11:01 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Simple question. I have setup an OpenBSD logging host. I am installing syslog-ng on all my solaris boxes. I am having a little trouble getting syslog-ng to log to a remote host. From the man page/documentation I came up with destination all {udp ("192.168.0.24","514");}; This returns a syntax error. Any help would be appreciated. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Simple question.
by Cashdollar, Larry 25 Sep '00

25 Sep '00

I have setup an OpenBSD logging host. I am installing syslog-ng on all my solaris boxes. I am having a little trouble getting syslog-ng to log to a remote host. From the man page/documentation I came up with destination all {udp ("192.168.0.24","514");}; This returns a syntax error. Any help would be appreciated.

1 0

Syslog-ng in Solaris
by Kleyson Rios 25 Sep '00

25 Sep '00

Hi, I can run syslog-ng in Solaris Intel ?? Thank You .

2 1

Re: [syslog-ng]chain_hostname(yes) complicates use of $HOST
by John A. Parker 25 Sep '00

25 Sep '00

In order to get around the problem I mentioned earlier with messages being logged to the $HOST (s) "Message" and "last", I altered the sources.c file do_add_source_name subroutine lines from: if (logmsg->host) logmsg->host = c_format("%fS/%fS", logmsg->host, name); to: if (logmsg->host) logmsg->host = c_format("%fS/%fS", name, logmsg->host); After making this change (swapping name and logmsg->host arguments), messages that used to look like: Sep 20 02:08:22 Message/aaaa.bbbb.cornell.edu forwarded from aaaa: sshd[40128]: log: ... Now appear as: Sep 20 02:08:22 aaaa.bbbb.cornell.edu/Message forwarded from aaaa: sshd[40128]: log: ... (To be honest, I think the second format looks better anyway.) I actually changed (simplified) the entire do_add_source_name subroutine chain_hostnames block in accordance with our needs. I'm including below the patch I generated to show how that code now looks. *** sources.c Tue Aug 22 04:44:55 2000 --- sources.c.new Wed Sep 20 06:25:53 2000 *************** *** 198,223 **** name = get_source_hostname(logmsg->saddr, self->use_dns, self->use_fqdn); if (self->chain_hostnames) { ! if (logmsg->flags & LF_LOCAL) { ! /* local */ ! ol_string_free(logmsg->host); ! logmsg->host = c_format("%S@%fS", ! self->name, name); ! } ! else if (!logmsg->host) { ! /* remote && no hostname */ ! logmsg->host = c_format("%S/%fS", name, name); ! } ! else { ! /* everything else, append source hostname */ ! if (logmsg->host) ! logmsg->host = ! c_format("%fS/%fS", ! logmsg->host, name); ! else ! logmsg->host = ! c_format("%fS", name); ! } } else { ol_string_free(logmsg->host); --- 198,208 ---- name = get_source_hostname(logmsg->saddr, self->use_dns, self->use_fqdn); if (self->chain_hostnames) { ! if (logmsg->host) ! logmsg->host = c_format("%fS/%fS", ! name, logmsg->host); ! else ! logmsg->host = c_format("%fS", name); } else { ol_string_free(logmsg->host); --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

3 4