November 2001 - syslog-ng - lists.balabit.hu

syslog-ng messages sent to outside prog
by Nate Campi 06 Nov '01

06 Nov '01

I setup a match line to match the string "attackalert" from portsentry, and I pipe this off to a script that mails it to me. This works great, but I get emails with "<29>" prepended to it. Example: <29>Nov 5 12:46:37 skitzo portsentry[121]: attackalert: Host 209.202.221.43 has been blocked via dropped route using command: "/usr/local/sbin/iptables -I INPUT -s 209.202.221.43 -j DROP" I just setup sqlsyslogd to output to a mysql database from a program() destination, and it prepends the <29> to the messages sent there as well. I checked out http://www.ietf.org/rfc/rfc3164.txt and it looks like this is a priority. How can I keep this from showing up in the output? I hacked sqlsyslogd to print the string from 4 chars into the timestamp, so my mysql inputs are clean, but what do I do to clean up the mail? -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79

4 6

RE: [syslog-ng]syslog-ng messages sent to outside prog
by Robert Glad 06 Nov '01

06 Nov '01

Relax man, this is not one of those eLiTe-BBSes in the early nineties.. ;) Robert -----Original Message----- From: Snortball [mailto:snortball@hotmail.com] Sent: den 6 november 2001 16:53 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng messages sent to outside prog I'M VERY VERY SORRY! This was supposed to go to the sender, not the list....I promise I'll stop being stupid.... ----- Original Message ----- From: "Snortball" <snortball(a)hotmail.com> To: <syslog-ng(a)lists.balabit.hu> Sent: Tuesday, November 06, 2001 9:25 AM Subject: Re: [syslog-ng]syslog-ng messages sent to outside prog > Hi, > > Is there any chance that I can get a copy of your mail script? I can't seem > to get one to work. Yes, I'm a newbie.....but I'm trying! > > Thanks, > > Sb > ----- Original Message ----- > From: "Nate Campi" <nate(a)campin.net> > To: <syslog-ng(a)lists.balabit.hu> > Sent: Monday, November 05, 2001 6:03 PM > Subject: [syslog-ng]syslog-ng messages sent to outside prog > > > > I setup a match line to match the string "attackalert" from portsentry, > > and I pipe this off to a script that mails it to me. > > > > This works great, but I get emails with "<29>" prepended to it. Example: > > > > <29>Nov 5 12:46:37 skitzo portsentry[121]: attackalert: Host > > 209.202.221.43 has been blocked via dropped route using command: > > "/usr/local/sbin/iptables -I INPUT -s 209.202.221.43 -j > > DROP" > > > > I just setup sqlsyslogd to output to a mysql database from a program() > > destination, and it prepends the <29> to the messages sent there as > > well. > > > > I checked out http://www.ietf.org/rfc/rfc3164.txt and it looks like this > > is a priority. How can I keep this from showing up in the output? I > > hacked sqlsyslogd to print the string from 4 chars into the timestamp, > > so my mysql inputs are clean, but what do I do to clean up the mail? > > -- > > Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 > > Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

NEWBIE question: Email as destination
by Snortball 05 Nov '01

05 Nov '01

Hello all, Sorry if this has already been covered, but I can't find the answer in any docs. I am trying to have syslog-ng send certain syslog messages via email so that I don't have to bother with a log watcher like swatch, etc. I tried different combinations of: destination email { pipe("/bin/mail"); }; But that just overwrote the mail bianry (not fun). Any advice? TIA Sb

2 2

syslog-ng and Cisco boxes
by Brian D. Olesen 05 Nov '01

05 Nov '01

I am in the process of setting up a syslog server for a large number of Cisco boxes, and have faced some difficulties which may be due to an error in syslog-ng 1.4.13 on Solaris 8 regarding the source statement. source net { udp(); }; As far as I can understand from the documentation, this ought to listen to all incoming udp packets on port 514. Contrary to the documentation, I never got this to work at all. I even tried to stop the native syslogd, but to no avail. source net { udp(ip("xxx.xxx.xxx.22") port(514)); }; Stating the service ip address and syslog port works perfectly. On the Cisco IOS side, it took me some time to realize that logging source-interface Ethernet0 is essential to do remote logging. This is the interface with the ip address which have access to the remote syslog host. Other experiences, especially best practices, with syslog-ng and Cisco boxes are greatly appreciated. Best regards, Brian D. Olesen UNIX Administrator Orange DK

6 6

issues using NOT in an filter.
by Matthew Schumacher 05 Nov '01

05 Nov '01

Hello all, I can't seem to figure this out. I want to log level(info) and facility(authpriv) to my messages file, but I don't want to see facility(local4). Now some of the facility(local4) messages are level(info) but I still don't want them. Anyway, I was trying something like this and it doesn't work: filter f_messages { (level(info) or facility(authpriv)) not facility(local4); }; I tried using () to clean it up and that doesn't work. In all of the combinations I tried it simply will not parse the config file with NOT in the filter unless I put an and in front of it like this: "and not" Anyone have a sec to help me out with this? Thanks, schu

2 1

RE: [syslog-ng]question about flags + fix to compile under solaris (PATH_SYSCONFDIRprob)
by Nicholas Berry 02 Nov '01

02 Nov '01

I have also noticed this problem with PATH_SYSCONFDIR in src/config.h. After running the configure script, PATH_SYSCONFDIR is defined in src/config.h, but when running `make`, something (perhaps autoconf) removes PATH_SYSCONFDIR from src/config.h and causes the compile to fail. After re-adding '#define PATH_SYSCONDIR "/usr/local/etc/syslog-ng"' back into src/config.h, everything compiles fine. Also, defining "--sysconfdir=<alternate dir>" when running the configure script is not reflected in src/config.h I'm using autoconf 2.13, automake 1.4, make 3.79, m4 1.4, and gcc 2.95.3 all under Solar 8 SPARC. Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com -----Original Message----- From: Asher Yanich [mailto:ayanic01@cs.fiu.edu] Sent: Friday, November 02, 2001 9:41 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]question about flags + fix to compile under solaris (PATH_SYSCONFDIRprob) I am currently running syslog-ng 1.5.7 and using the DEFAULT keyword. I see that this is removed from the newer 1.5.x releases in favor of flags. I cant seem to find any documentation on the syntax or usage. Can someone help me out? Also, I had not been able to compile any syslog-ng 1.5.x releases for awhile, I finally fixed the compilation problem. --- syslog-ng.h Wed Jul 25 05:20:53 2001 +++ /depot/syslog-ng/src/syslog-ng-1.5.13/src/syslog-ng.h Fri Nov 2 11:42:39 2001 @@ -34,7 +34,7 @@ #define PATH_SYSLOG_NG_CONF "syslog-ng.conf" #define PATH_PIDFILE "syslog-ng.pid" #else -#define PATH_SYSLOG_NG_CONF PATH_SYSCONFDIR "/syslog-ng.conf" +#define PATH_SYSLOG_NG_CONF "/syslog-ng.conf" #define PATH_PIDFILE "/var/run/syslog-ng.pid" #endif -asher yanich _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

question about flags + fix to compile under solaris (PATH_SYSCONFDIR prob)
by Asher Yanich 02 Nov '01

02 Nov '01

I am currently running syslog-ng 1.5.7 and using the DEFAULT keyword. I see that this is removed from the newer 1.5.x releases in favor of flags. I cant seem to find any documentation on the syntax or usage. Can someone help me out? Also, I had not been able to compile any syslog-ng 1.5.x releases for awhile, I finally fixed the compilation problem. --- syslog-ng.h Wed Jul 25 05:20:53 2001 +++ /depot/syslog-ng/src/syslog-ng-1.5.13/src/syslog-ng.h Fri Nov 2 11:42:39 2001 @@ -34,7 +34,7 @@ #define PATH_SYSLOG_NG_CONF "syslog-ng.conf" #define PATH_PIDFILE "syslog-ng.pid" #else -#define PATH_SYSLOG_NG_CONF PATH_SYSCONFDIR "/syslog-ng.conf" +#define PATH_SYSLOG_NG_CONF "/syslog-ng.conf" #define PATH_PIDFILE "/var/run/syslog-ng.pid" #endif -asher yanich

1 0

syslog record size limitation?
by Ed.Schernau＠guardent.com 02 Nov '01

02 Nov '01

Hello all, Solaris 8. I'm logging some rather long text entries via TCP, and they are getting chopped off at 1024 characters. Is this a limitation of syslog-ng itself, or Solaris native syslog? Any help appreciated. Ed

1 0

STATS: dropped 59
by Thomas Kaehn 02 Nov '01

02 Nov '01

Hi, syslog-ng seems to drop log-messages (syslog-ng[16854]: STATS: dropped 59). How can I avoid this, besides from using syslog-ng and TCP on all hosts? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

3 2

RE: [syslog-ng]Re: Level/Priority of 'none'
by Denis Doublet 02 Nov '01

02 Nov '01

-----Message d'origine----- De : Brad Stockdale [mailto:bradsprt@greenepa.net] Envoyé : vendredi 2 novembre 2001 02:09 À : syslog-ng(a)lists.balabit.hu Objet : [syslog-ng]Re: Level/Priority of 'none' Hello all, I'm a newbie to syslog-ng, and am trying to convert our local servers from sysklogd to syslog-ng... I'm having a bit of a problem, though... I might just be blind to the answer of this question, though... It seems pretty simple... In the syslog.conf file that is currently in place (the default redhat one), there's a line that reads: >*.info;mail.none;news.none;authpriv.none /var/log/messages Seems logical... How do I do the same thing in syslog-ng? Try destination d_local { file("/var/adm/messages/"); }; filter no_mail { not facility(mail); }; filter no_news { not facility(news); }; filter no_authpriv { not facility(authpriv); }; filter info { level(info .. emerg); }; log { source(s_local); filter no_mail; filter no_news; filter no_authpriv; filter info; destination(d_local); }; The syslog.conf manpages state: >The keyword none stands for no priority of the given facility. So, if I'm understanding this right, syslog was receiving a facility name, but no level/priority setting? And this mapped to "none." i.e : filter f_critical { level(crit .. emerg) or facility(syslog); }; Does this help you? Does syslog-ng provide a similar thing? Or do these daemons really send out the facility and level/priority, but it's some default one? Thanks for any help in advance... I'm sure this is an easy thing to fix, but just don't know the internals of syslog or syslog-ng very well yet... I've always just used the default configuration and left things alone... Thanks in advance, Brad _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0