November 2001 - syslog-ng - lists.balabit.hu

variables and match()
by Paul Miles 23 Nov '01

23 Nov '01

Hi, We're using syslog-ng daemon although and we think we've noticed a feature that appears to be missing. When you do a pattern match using match(), we require the value of the pattern match to be available as a variable, say $1, $2 etc etc. Our aim is to be able to farm different syslog entries off to different files based on the matched text from the reg. expression. Is this possible. Thanks and kind regards Paul Miles All Secure Networks Visit www.allsecuredomain.com for low cost web hosting and domain registration

2 1

RE: [syslog-ng]TCP Connection Problem
by Mike Kelland 23 Nov '01

23 Nov '01

Well, it's really not much of a change (2 characters on line 341 of afinet.c) but here's the diff: 341c341,345 < self->super.max_connections = 10; --- > self->super.max_connections = 1000; > -----Original Message----- > From: Ed Ravin [mailto:eravin@panix.com] > Sent: Friday, November 16, 2001 10:43 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]TCP Connection Problem > > > Mike Kelland writes: > > This may be a similar situation to the one we ran into. > Syslog-ng allows 10 > > connections from a single source max (appears to be hardcoded into > > afinet.c). > ... > > we are testing a new compile where we have changed the max > connections to > > 1000. We've managed to make the 1000 connections with no > ill effects but > > have not yet stress tested it with these 1000 connections. > > Patches? Patches? Please share... > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1

syslog-ng DNS
by Matt Mariscal 23 Nov '01

23 Nov '01

Hello, I have a question concerning the use_dns option. Is this a global option only, or is there some way to change this per source or destination? I am currently running v 1.4.14 on a Solaris box with multiple logical interfaces. Each logical interface is defined as a separate source within syslog-ng. I would like to enable DNS resolution for specific sources only but it does not appear as though this is possible. It appears as though my alternatives are to either globally enable DNS (not feasible) or run a separate instance of syslog-ng with DNS enabled. Any ideas? Matt Mariscal

2 1

Max number of TCP connections?
by Chris Sibbitt 23 Nov '01

23 Nov '01

SUMMARY: How many connection can I have to a tcp() source? 10? Why? I have been experiencing a problem with a syslog-ng (1.4.11) server seemingly only allowing 10 connections to a tcp() source. A quick tour of the code found the offending code at line 341 in afinet.c: self->super.max_connections = 10; Elsewhere in the file I see this (with code missing): if (c->num_connections >= c->max_connections) { #FAIL TO CONNECT }else{ #SUCCESSFULLY CONNECT } Unless this is not the code to handle tcp() sources, I think I've found what I need to change in order to fix this. My question is to Balazs, or anyone else with insight into the design of this daemon: Why is the limit set to 10? I want to change it, potentially to something very high (100 sounds about right for now), what impact is this going to have? JetNet Logo Chris Sibbitt Operations Development 333 Preston St, 3rd floor Ottawa, Ontario K1S 5N4 Phone (613) 237-5995, ext228 Fax (613) 237-9002

2 1

patch for adding tcp wrappers to syslog-ng?
by Ed Ravin 20 Nov '01

20 Nov '01

I just patched my copy of syslog-ng-1.5.10 to use tcp wrappers - I want to strictly control who is allowed to talk to my log server, and since we do everything else at my shop with TCP wrappers, it seemed sensible to add it in. I am running NetBSD 1.5.2, which provides the tcp wrappers code as part of the base OS. The only other change needed was to add "-lwrap" to the link flags. Is there interest in this feature? The patch below is only for incoming TCP connections - I don't see the point of putting it in for udp, as the packets are trivially spoofable. I haven't had much time to review the syslog-ng code, so I suspect this is not the best way to apply the patch: on second thought, it seems it might belong in libol. -- Ed --- afinet.c 2001/10/27 01:57:51 1.1 +++ afinet.c 2001/10/27 03:29:11 @@ -28,6 +28,13 @@ #include "cfgfile.h" #include "pkt_buffer.h" +#ifndef WE_DONT_WANT_TCP_WRAPPERS +#include "tcpd.h" +int allow_severity; +int deny_severity; +#endif + + #include <errno.h> #include <string.h> #include <assert.h> @@ -210,6 +217,23 @@ CAST(afinet_source, self, c); struct afsocket_source_connection *conn; UINT32 res; + + +#ifndef WE_DONT_WANT_TCP_WRAPPERS + { + struct request_info req; + + request_init(&req, RQ_DAEMON, "syslog-ng", RQ_FILE, client->super.fd, 0); + fromhost(&req); + if (hosts_access(&req) == 0) + { + CAST(inet_address_info, inet_addr, client_addr); + notice("connection from %S:%i refused by hosts_access()\n", inet_addr->ip, inet_addr->port); + close_fd(&client->super, 0); + return ST_OK | ST_GOON; + } + } +#endif if (c->num_connections >= c->max_connections) { CAST(inet_address_info, inet_addr, client_addr);

2 2

setting up a loghost on AIX - please help!!
by Sippel, Christian 19 Nov '01

19 Nov '01

Dear list, I'm trying to set up an AIX-machine as a loghost by using syslog-ng but I can't get syslog-ng working, so I would be very thankful if you could give me some hints. After downloading, compiling and installing libol and syslog-ng on the AIX-machine that should be used as a loghost I wrote the following syslog-ng.conf file in the /etc/syslog-ng direcoty: source src { unix-dgram("/dev/log"); tcp(ip(1.5.19.253) port(514)); udp(ip(1.5.19.253) port(514)); internal(); }; destination test { file("/var/adm/log/test-ng.log"); }; log { source(src); destination(test); }; }; the client machine (also AIX, internal ip-adress 1.5.19.253 ) is running the standard syslogd, in the /etc/syslog.conf is the line: local2.info @dmz-loghost and the /etc/hosts contains the line 1.34.20.20 dmz-loghost sending a log-message with logger -plocal2.info with standard syslog to the loghost works fine (so port 514 should be open) but the file specified in syslog-ng.conf does not contain anything. I really would appreciate if you could give me some hints what I did wrong, Christian Sippel

1 0

Archiving log file
by Chee Chew 18 Nov '01

18 Nov '01

I wish to split the log file into daily basis by means of different file per day according to the received timestamp. Is there any option in syslog-ng can be configured for this. At normal, the log file will grow bigger and bigger and become more difficult to read especially when we want to search for certain event on certain date. By achiving the log into daily file with meaningful filename, it should be much more convenient. Perhaps if syslog-ng do not have this option, is there any workaround or better method to due with this? Regards

2 1

RE: [syslog-ng]TCP Connection Problem
by Mike Kelland 16 Nov '01

16 Nov '01

This may be a similar situation to the one we ran into. Syslog-ng allows 10 connections from a single source max (appears to be hardcoded into afinet.c). So you could be hitting this limit. In order to fix it, we started by making sure that each server returning syslog only made one connection (some of ours were making 5) by editing the config files and now we are testing a new compile where we have changed the max connections to 1000. We've managed to make the 1000 connections with no ill effects but have not yet stress tested it with these 1000 connections. Has anyone else run into a similar situation btw? I'd be interested to find out if there was a reason that the max connections was hardcoded to such a low number. Thanks, Mike > -----Original Message----- > From: Roman Ernst [mailto:roman_ernst@at.ibm.com] > Sent: Friday, November 16, 2001 7:05 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]TCP Connection Problem > > > Hi! > > I have configured about 10 Host logging directly to another > one (TCP!!!). > > Unfortunately I have the following problem: > > When I reboot this logging server then syslog-ng on all the > other hosts > crashes... > > Is there any work around or do you already know this bug? > > I think normal behavour should be trying to reconnect to the logging > server... > > > Thanks a lot for your help in advance! > > Roman Ernst > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1

TCP Connection Problem
by Roman Ernst 16 Nov '01

16 Nov '01

Hi! I have configured about 10 Host logging directly to another one (TCP!!!). Unfortunately I have the following problem: When I reboot this logging server then syslog-ng on all the other hosts crashes... Is there any work around or do you already know this bug? I think normal behavour should be trying to reconnect to the logging server... Thanks a lot for your help in advance! Roman Ernst

1 0

RE: [syslog-ng]Sample Solaris config
by Jamie McKnight 15 Nov '01

15 Nov '01

|> |>For the server. Sorry. |> Here is what I use. I have the Solaris 8 syslogd startup with -t so it does not listen to the network on the central log host. Then I have syslog-ng listening for the messages that come in from the network. Messages coming in from the network go to /data/logs/messages.$HOST unless they are su or op(sudo like) and I have those go into seperate files elsewhere for monitoring etc. Pretty generic and works for me. Your milage may vary. Syslog-ng version is 1.4.14. options { sync(0); chain_hostnames(no); }; # Starting with this version of syslog-ng we are letting Solaris syslogd handle # system messages, but start it with a "-t" to tell it not to listen to network # traffic. We then use syslog-ng to only listen on the network. source s_remote { udp(ip(0.0.0.0) port(514)); internal(); }; # Filter defs. How to break out the incoming messages. filter f_hosts { level(err..emerg) or ( facility(kern) and level(debug..emerg)) or ( facility(daemon) and level(notice..emerg)) or ( facility(mail) and level(crit..emerg)); }; filter f_subad { program(su) and match(root) and match(failed); }; filter f_sugood { program(su) and match(root) and match(succeeded); }; filter f_sucombined { program(su) and match(su:); }; filter f_opbad { program(op) and match (FAILED); }; filter f_opgood { program(op) and match (SUCCEDED); }; filter f_opcombined { program(op) and match(op:); }; filter f_panic { match(panic); }; filter f_reboot { match(Generic_); }; # Destination defs. Where the messages go destination d_subad { file("/data/logs/su/bad_su_attempts"); }; destination d_sugood { file("/data/logs/su/good_su_attempts"); }; destination d_sucombined { file("/data/logs/su/su_attempts"); }; destination d_opbad { file("/data/logs/op/bad_op_attempts"); }; destination d_opgood { file("/data/logs/op/good_op_attempts"); }; destination d_opcombined { file("/data/logs/op/op_attempts"); }; destination d_panic { file("/data/logs/panic.log"); }; destination d_reboot { file("/data/logs/reboot.log"); }; destination d_hostmsg { file("/data/logs/hosts/messages.$HOST"); }; # Log actions for messages generated remotely log { source(s_remote); filter(f_subad); destination(d_subad); }; log { source(s_remote); filter(f_sugood); destination(d_sugood); }; log { source(s_remote); filter(f_sucombined); destination(d_sucombined); }; log { source(s_remote); filter(f_opbad); destination(d_opbad); }; log { source(s_remote); filter(f_opgood); destination(d_opgood); }; log { source(s_remote); filter(f_opcombined); destination(d_opcombined); }; log { source(s_remote); filter(f_panic); destination(d_panic); }; log { source(s_remote); filter(f_reboot); destination(d_reboot); }; log { source(s_remote); filter(f_hosts); destination(d_hostmsg); }; Jamie

2 1