March 2001 - syslog-ng - lists.balabit.hu

syslog-ng over network
by Mariusz Bogumil 26 Mar '01

26 Mar '01

I try to send messages over network (server which generates messages and workstation which cachets it are in the other subnets) I have tried such configuration: source s_tcp { tcp( ip(10.12.12.2) port(514) ); sun-streams( "dev/log" door("/etc/.syslog_door") ); internal(); }; destination all { tcp("10.13.12.124" port(514) ); }; -- it used to work when server and workstation are in the same network - when they are in different subnets as above it doesn't. I have tried configuration with UDP source s_tcp { udp( ip(10.12.12.2) port(514) ); sun-streams( "dev/log" door("/etc/.syslog_door") ); internal(); }; destination all { udp(10.13.12.124 port(514)); }; but without success - it compiles without error but I cannot cacht any messages. What should be used tcp or udp? Should I define in syslog-ng any knowledge about routers (I do not think so - but who knows ???) I try to run it on Sprac Solaris 2.6 and 7 (but 2.6 is more critical). Thank yu for help Mariusz

1 0

Syslog tunneling
by Dennis 23 Mar '01

23 Mar '01

Hi, I'm trying to setup a secure way of remote logging by means of tunneling. I'm running syslog-ng so I'm able to do remote logging over tcp instead of udp. But the setup is as usual 1 loghost and several others sending all logs to the port the syslog-ng is listening on on the loghost..I was wondering..is it possible to use stunnel somehow to secure the log packets travelling the hostile internet to the loghost? It would mean that there have to be more tunnels from different hosts towards de one logging... Running out of knowledge and before wasting valuable time, i would like to know if there are people who have set up a secure logging facility in the past for syslog-ng? Dennis,

3 2

RE: [syslog-ng]Syslog Chaining doesn't work as expected
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 23 Mar '01

23 Mar '01

keep_hostname(yes) and use_fqdn(yes) actually does make sense. I use these options together and it makes a difference. If I have keep_hostname(yes) and use_fqdn(no), I get messages with such names as gw1, gw2, gw3. I have 14 gw1 hosts in my area of control so needless to say that is not very revealing. If I use keep_hostname(yes) and use_fqdn(yes), I get names like gw1.mydomain.com, and gw1.otherdomain.com. It does make a difference. You certainly don't want to use chain_hostnames(yes) and keep_hostname(yes) those, I believe, are mutually exclusive. Regards, Drew > -----Original Message----- > From: Gregor Binder [SMTP:gbinder@sysfive.com] > Sent: Friday, March 23, 2001 1:31 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Syslog Chaining doesn't work as expected > > Wiktor Wodecki on Fri, Mar 23, 2001 at 01:05:10PM +0100: > > Hi Wiktor, > > > > depending on how your systems are configured, you might get good > > > results with turning keep_hostname on if that's an option. > > > > nope, that didn't do it, it still writes logs with canonical name and > > not the fqdn. > > well, I could've said that before, it would require your systems know > themselves by their FQDN (and use this name for their log messages). > > > > - Do you use FQDNs in /etc/hosts? > > > > yes, on LOGGINGSERVER, not on GATESERVER > > If I understand your setup correctly, DNS config on GATESERVER (or how > names get resolved and all that) matters, so you do want to make sure > the log clients that go through GATESERVER can be properly qualified. > > > options { long_hostnames(yes); sync(2); use_dns(yes); use_fqdn(yes); > > create_dirs(yes); log_fifo_size(1000); time_reopen(2); > > chain_hostnames(yes); keep_hostname(yes); }; > > keep_hostname(yes) does not make sense with use_dns(yes) and > use_fqdn(yes) since it means "keep the hostname that the log message > contains". IIRC long_hostnames is just an alias for use_fqdn. > > I think you want the following options (besides those not related to > DNS/hostnames): > > LOGGINGSERVER: keep_hostname(yes); chain_hostnames(no); use_fqdn(yes); > GATESERVER: use_dns(yes); use_fqdn(yes); > > And make sure GATESERVER can determine FQDNs. > > If you have clients logging directly to LOGGINGSERVER, you might want to > check if you can specify those options in the source and not global, > since otherwise you would get inconsistent naming. I am not sure if you > can do that though. > > Greetings, > > -- > Gregor Binder <gregor.binder(a)sysfive.com> http://sysfive.com/ > sysfive.com GmbH UNIX. Networking. Security. Applications. > PGP id: 0x20C6DA55 fp: 18AB 2DD0 F8FA D710 1EDC A97A B128 01C0 20C6 DA55 > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Syslog Chaining doesn't work as expected
by Wiktor Wodecki 23 Mar '01

23 Mar '01

Hello folks, I've got a problem with chaining syslog messages. Basically I try to forward syslog messages via a host to our loggingserver, but the loggingserver doesn't get that's it's from an other host and not the "forwarder". Here is my setup: LOGGINSERVER (valid IP adress) | | GATESERVER (valid IP adress + internal 192.x.x.x adress on second nic) | | SERVER (internet IP) Gateserver and Server both shall log to LOGGINGSERVER. This is my logserver setup: options { long_hostnames(yes); sync(0); time_reap(1); use_time_recvd(yes); use_dns(yes); use_fqdn(yes); create_dirs(yes); log_fifo_size(10000); chain_hostnames(no); }; source frontier { tcp(ip(xx.xxx.x.xxx) port(540) max-connections (20)); } destination blackhole { file("/var/log/frontier/$YEAR$MONTH/$HOST"); }; log { source(frontier); destination(blackhole); } as you see it logs everything from a connecting host to an own file. If I forward the logs from SERVER via GATESERVER, the loggingserver writes all logfiles of SERVER to the logfile of GATESERVER since it sees it coming from the IP. That's correct and that's how it supposed to work (documentation). now if I switch the option chain_hostnames to yes it does what I want, it writes an own logfile for SERVER. However, it stops writing fqdn's and start writing the logs with the canonical name of the machines. An example: Before I turn chain_hostnames to yes it logs file from the machine abc.de.fg to a file called "abc.de.fg" - If I turn the option on it starts logging to the file "abc". Since I have many machines with the same name but with different fqdn's I can't use that. Since I've turned on logn_hostnames and use_fqdn I'm a bit curious what to do. Is this a bug or did I miss an option in the docs? All hosts are in /etc/hosts on the Loggingserver and all three machines use current stable release 1.4.11. Thanks in advance for the help -- Regards, Wiktor Wodecki, Unix Administration | Wapme-Systems AG Tel.: +49-211-748450 | Muensterstrasse 248 Fax: +49-211-74845176 | 40470 Duesseldorf E-Mail: wodecki(a)wapme-systems.de | http://www.wapme-systems.de 1024/E22253B9 084C 7950 4D65 0E92 46D1 48AF F3F7 3201 E222 53B9

2 3

creation of filter
by pierrick le fol 22 Mar '01

22 Mar '01

I will wish to write a script to filter the event of my equipment by address IP. But I cannot program in Shell. If anyone has any ideas, please forward them to me also. Thanks Pierrick

2 1

RE: [syslog-ng]Re: desperatly need your help
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 22 Mar '01

22 Mar '01

I tested this on my Solaris 7 machine and it worked as expected. I used version 1.5.3 and libol version 0.2.21. So whatever it is it is not Solaris 7. Regards, Drew > -----Original Message----- > From: Balazs Scheidler [SMTP:bazsi@balabit.hu] > Sent: Wednesday, March 21, 2001 4:48 PM > To: Mariusz Bogumil > Cc: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Re: desperatly need your help > > On Wed, Mar 21, 2001 at 03:31:16PM +0100, Mariusz Bogumil wrote: > > I think that I really desperatly need your help. I have tested all > > possible configuration and I still cannot filter messages from snort > > from my /var/log/messages and I start thinking that such configuration > > is impossible. Please tell me what I am doing wrong. > > > > To this mail I attach my syslog-ng.conf - with only with lines that > > describe my problem and complete config too. > > > > I run it on Sprac Solaris 7 > > I tried the following configuration: > > source src { unix-stream("log"); internal(); }; > > destination d1 { file("d1"); }; > destination d2 { file("d2"); }; > destination d3 { file("d3"); }; > > filter fn_snort { not match("snort"); }; > filter f_snort { match("snort"); }; # it works > > log { source(src); filter(fn_snort); destination(d1); }; > log { source(src); filter(f_snort); destination(d2); }; > log { source(src); destination(d3); }; > > and I sent the following log messages: > > logger -u log "valami" > logger -u log -t snort hallo > > It correctly sent messages to their appropriate destination. I suspect a > bug > in either Solaris or in Solaris/syslog-ng interoperation. Could anybody > check this? > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]Hostname determination and AIX
by John_Delisle＠ceridian.ca 21 Mar '01

21 Mar '01

I've run into the same irritating problem with IBM's non-standard syslogd. If anyone has any ideas, please forward them to me also. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Jon Marks <j-marks(a)uiuc.edu> To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: [syslog-ng]Hostname determination and AIX balabit.hu 2001/03/21 03:44 PM Please respond to syslog-ng Hello, I saw this issue arose previously in the mailing list, but I'm not sure what the resolution was. I'm running syslog-ng 1.4.11 on AIX 4.3.3. This machine is meant to be a loghost for a number of different kinds of systems including other AIX boxes. I'd like to organize messages into a directory structure on a per-host basis (a typical syslog-ng use, I assume). The trouble is that the hostname is improperly interpreted upon receipt of messages from other AIX machines. Thus, strange output files appear. The following is a sample of my syslog-ng.conf: ###################################################################### source s_ccso { unix-dgram("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; destination d_psg_connections { file("/services/syslog/systems/$HOST/connections-$YEAR$MONTH$DAY" owner(psg) group(psg) perm(0600) dir_perm(0755) create_dirs(yes)); }; filter f_psg_connections { facility(local3) and level(info); }; log { source(s_ccso); filter(f_psg_connections); destination(d_psg_connections); }; ###################################################################### Using a test program, I generate a bunch of messages on a remote AIX client host that end up looking like this (at LOCAL3.INFO) in the *remote client* log: Mar 21 15:06:44 vader TEST[4234]: (0) TEST MESSAGE (0) Mar 21 15:06:44 vader TEST[4234]: (1) TEST MESSAGE (1) Mar 21 15:06:44 vader TEST[4234]: (2) TEST MESSAGE (2) Mar 21 15:06:44 vader TEST[4234]: (3) TEST MESSAGE (3) Mar 21 15:06:44 vader TEST[4234]: (4) TEST MESSAGE (4) Mar 21 15:06:44 vader TEST[4234]: (5) TEST MESSAGE (5) Mar 21 15:06:44 vader TEST[4234]: (6) TEST MESSAGE (6) Mar 21 15:06:44 vader TEST[4234]: (7) TEST MESSAGE (7) Mar 21 15:06:44 vader TEST[4234]: (8) TEST MESSAGE (8) Mar 21 15:06:44 vader TEST[4234]: (9) TEST MESSAGE (9) Mar 21 15:06:44 vader TEST[4234]: REPS: 10 Time: 0 s 1 ms 886 us The remote host (vader) sends these to the loghost, as well; but rewrites them since that's what AIX's syslogd does. They land in the following location on the loghost: /services/syslog/systems/From/connections-20010321 ^^^^ Note the incorrect hostname. This is what they look like inside that particular log: Mar 21 15:06:44 From/vader vader: TEST[4234]: (0) TEST MESSAGE (0) Mar 21 15:06:44 From/vader vader: TEST[4234]: (1) TEST MESSAGE (1) Mar 21 15:06:44 From/vader vader: TEST[4234]: (2) TEST MESSAGE (2) Mar 21 15:06:44 From/vader vader: TEST[4234]: (3) TEST MESSAGE (3) Mar 21 15:06:44 From/vader vader: TEST[4234]: (4) TEST MESSAGE (4) Mar 21 15:06:44 From/vader vader: TEST[4234]: (5) TEST MESSAGE (5) Mar 21 15:06:44 From/vader vader: TEST[4234]: (6) TEST MESSAGE (6) Mar 21 15:06:44 From/vader vader: TEST[4234]: (7) TEST MESSAGE (7) Mar 21 15:06:44 From/vader vader: TEST[4234]: (8) TEST MESSAGE (8) Mar 21 15:06:44 From/vader vader: TEST[4234]: (9) TEST MESSAGE (9) Mar 21 15:06:44 From/vader vader: TEST[4234]: REPS: 10 Time: 0 s 1 ms 886 us ^^^^ Notice how the word "From" squeezes its way into the hostname. This is what the log would have looked like if done by AIX's native syslogd: Mar 21 15:19:39 vader From vader: TEST[4248]: (0) TEST MESSAGE (0) Mar 21 15:19:39 vader From vader: TEST[4248]: (2) TEST MESSAGE (2) Mar 21 15:19:39 vader From vader: TEST[4248]: (1) TEST MESSAGE (1) Mar 21 15:19:39 vader From vader: TEST[4248]: (3) TEST MESSAGE (3) Mar 21 15:19:39 vader From vader: TEST[4248]: (4) TEST MESSAGE (4) Mar 21 15:19:39 vader From vader: TEST[4248]: (5) TEST MESSAGE (5) Mar 21 15:19:39 vader From vader: TEST[4248]: (6) TEST MESSAGE (6) Mar 21 15:19:39 vader From vader: TEST[4248]: (7) TEST MESSAGE (7) Mar 21 15:19:39 vader From vader: TEST[4248]: (8) TEST MESSAGE (8) Mar 21 15:19:39 vader From vader: TEST[4248]: (9) TEST MESSAGE (9) Mar 21 15:19:39 vader From vader: TEST[4248]: REPS: 10 Time: 0 s 1 ms 923 us So the "From" comes out of what AIX's syslogd sends to the loghost when it forwards its own messags. This particular format is what you get when you run AIX's syslogd with the '-s' command-line option; normally it's even more obnoxious (I learned this on this mailing list). This more verbose, obnoxious output causes the same problem. I'll use it to make another quick example of the problem. This is from the same AIX client running native syslogd without '-s': On the client (remote host): Mar 21 15:30:28 vader TEST[4270]: (1) TEST MESSAGE (1) Mar 21 15:30:28 vader TEST[4270]: (2) TEST MESSAGE (2) On the loghost (running AIX's syslogd): Mar 21 15:30:28 vader Message forwarded from vader: TEST[4270]: (0) TEST MESSAGE (0) Mar 21 15:30:28 vader Message forwarded from vader: TEST[4270]: (1) TEST MESSAGE (1) A similar example, on the loghost running syslog-ng (these are mistakenly located in /services/syslog/systems/Message/connections-20010321): ^^^^^^^ Mar 21 15:34:33 Message/vader forwarded from vader: TEST[4282]: (0) TEST MESSAGE (0) Mar 21 15:34:33 Message/vader forwarded from vader: TEST[4282]: (1) TEST MESSAGE (1) ^^^^^^^ Notice both AIX's obnoxious message prefix string and how syslog-ng handles it when interpreting the hostname. This server will be hosting logs for lots of people's machines; I can't mandate that everybody uses syslog-ng. Some people are going to run AIX boxes and so I'll have to put up with these kinds of messages. Is there anything syslog-ng can do? Is this addressed in the development version? Thanks for your help! -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Hostname determination and AIX
by Jon Marks 21 Mar '01

21 Mar '01

Hello, I saw this issue arose previously in the mailing list, but I'm not sure what the resolution was. I'm running syslog-ng 1.4.11 on AIX 4.3.3. This machine is meant to be a loghost for a number of different kinds of systems including other AIX boxes. I'd like to organize messages into a directory structure on a per-host basis (a typical syslog-ng use, I assume). The trouble is that the hostname is improperly interpreted upon receipt of messages from other AIX machines. Thus, strange output files appear. The following is a sample of my syslog-ng.conf: ###################################################################### source s_ccso { unix-dgram("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; destination d_psg_connections { file("/services/syslog/systems/$HOST/connections-$YEAR$MONTH$DAY" owner(psg) group(psg) perm(0600) dir_perm(0755) create_dirs(yes)); }; filter f_psg_connections { facility(local3) and level(info); }; log { source(s_ccso); filter(f_psg_connections); destination(d_psg_connections); }; ###################################################################### Using a test program, I generate a bunch of messages on a remote AIX client host that end up looking like this (at LOCAL3.INFO) in the *remote client* log: Mar 21 15:06:44 vader TEST[4234]: (0) TEST MESSAGE (0) Mar 21 15:06:44 vader TEST[4234]: (1) TEST MESSAGE (1) Mar 21 15:06:44 vader TEST[4234]: (2) TEST MESSAGE (2) Mar 21 15:06:44 vader TEST[4234]: (3) TEST MESSAGE (3) Mar 21 15:06:44 vader TEST[4234]: (4) TEST MESSAGE (4) Mar 21 15:06:44 vader TEST[4234]: (5) TEST MESSAGE (5) Mar 21 15:06:44 vader TEST[4234]: (6) TEST MESSAGE (6) Mar 21 15:06:44 vader TEST[4234]: (7) TEST MESSAGE (7) Mar 21 15:06:44 vader TEST[4234]: (8) TEST MESSAGE (8) Mar 21 15:06:44 vader TEST[4234]: (9) TEST MESSAGE (9) Mar 21 15:06:44 vader TEST[4234]: REPS: 10 Time: 0 s 1 ms 886 us The remote host (vader) sends these to the loghost, as well; but rewrites them since that's what AIX's syslogd does. They land in the following location on the loghost: /services/syslog/systems/From/connections-20010321 ^^^^ Note the incorrect hostname. This is what they look like inside that particular log: Mar 21 15:06:44 From/vader vader: TEST[4234]: (0) TEST MESSAGE (0) Mar 21 15:06:44 From/vader vader: TEST[4234]: (1) TEST MESSAGE (1) Mar 21 15:06:44 From/vader vader: TEST[4234]: (2) TEST MESSAGE (2) Mar 21 15:06:44 From/vader vader: TEST[4234]: (3) TEST MESSAGE (3) Mar 21 15:06:44 From/vader vader: TEST[4234]: (4) TEST MESSAGE (4) Mar 21 15:06:44 From/vader vader: TEST[4234]: (5) TEST MESSAGE (5) Mar 21 15:06:44 From/vader vader: TEST[4234]: (6) TEST MESSAGE (6) Mar 21 15:06:44 From/vader vader: TEST[4234]: (7) TEST MESSAGE (7) Mar 21 15:06:44 From/vader vader: TEST[4234]: (8) TEST MESSAGE (8) Mar 21 15:06:44 From/vader vader: TEST[4234]: (9) TEST MESSAGE (9) Mar 21 15:06:44 From/vader vader: TEST[4234]: REPS: 10 Time: 0 s 1 ms 886 us ^^^^ Notice how the word "From" squeezes its way into the hostname. This is what the log would have looked like if done by AIX's native syslogd: Mar 21 15:19:39 vader From vader: TEST[4248]: (0) TEST MESSAGE (0) Mar 21 15:19:39 vader From vader: TEST[4248]: (2) TEST MESSAGE (2) Mar 21 15:19:39 vader From vader: TEST[4248]: (1) TEST MESSAGE (1) Mar 21 15:19:39 vader From vader: TEST[4248]: (3) TEST MESSAGE (3) Mar 21 15:19:39 vader From vader: TEST[4248]: (4) TEST MESSAGE (4) Mar 21 15:19:39 vader From vader: TEST[4248]: (5) TEST MESSAGE (5) Mar 21 15:19:39 vader From vader: TEST[4248]: (6) TEST MESSAGE (6) Mar 21 15:19:39 vader From vader: TEST[4248]: (7) TEST MESSAGE (7) Mar 21 15:19:39 vader From vader: TEST[4248]: (8) TEST MESSAGE (8) Mar 21 15:19:39 vader From vader: TEST[4248]: (9) TEST MESSAGE (9) Mar 21 15:19:39 vader From vader: TEST[4248]: REPS: 10 Time: 0 s 1 ms 923 us So the "From" comes out of what AIX's syslogd sends to the loghost when it forwards its own messags. This particular format is what you get when you run AIX's syslogd with the '-s' command-line option; normally it's even more obnoxious (I learned this on this mailing list). This more verbose, obnoxious output causes the same problem. I'll use it to make another quick example of the problem. This is from the same AIX client running native syslogd without '-s': On the client (remote host): Mar 21 15:30:28 vader TEST[4270]: (1) TEST MESSAGE (1) Mar 21 15:30:28 vader TEST[4270]: (2) TEST MESSAGE (2) On the loghost (running AIX's syslogd): Mar 21 15:30:28 vader Message forwarded from vader: TEST[4270]: (0) TEST MESSAGE (0) Mar 21 15:30:28 vader Message forwarded from vader: TEST[4270]: (1) TEST MESSAGE (1) A similar example, on the loghost running syslog-ng (these are mistakenly located in /services/syslog/systems/Message/connections-20010321): ^^^^^^^ Mar 21 15:34:33 Message/vader forwarded from vader: TEST[4282]: (0) TEST MESSAGE (0) Mar 21 15:34:33 Message/vader forwarded from vader: TEST[4282]: (1) TEST MESSAGE (1) ^^^^^^^ Notice both AIX's obnoxious message prefix string and how syslog-ng handles it when interpreting the hostname. This server will be hosting logs for lots of people's machines; I can't mandate that everybody uses syslog-ng. Some people are going to run AIX boxes and so I'll have to put up with these kinds of messages. Is there anything syslog-ng can do? Is this addressed in the development version? Thanks for your help! -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign

1 0

Re: desperatly need your help
by Balazs Scheidler 21 Mar '01

21 Mar '01

On Wed, Mar 21, 2001 at 03:31:16PM +0100, Mariusz Bogumil wrote: > I think that I really desperatly need your help. I have tested all > possible configuration and I still cannot filter messages from snort > from my /var/log/messages and I start thinking that such configuration > is impossible. Please tell me what I am doing wrong. > > To this mail I attach my syslog-ng.conf - with only with lines that > describe my problem and complete config too. > > I run it on Sprac Solaris 7 I tried the following configuration: source src { unix-stream("log"); internal(); }; destination d1 { file("d1"); }; destination d2 { file("d2"); }; destination d3 { file("d3"); }; filter fn_snort { not match("snort"); }; filter f_snort { match("snort"); }; # it works log { source(src); filter(fn_snort); destination(d1); }; log { source(src); filter(f_snort); destination(d2); }; log { source(src); destination(d3); }; and I sent the following log messages: logger -u log "valami" logger -u log -t snort hallo It correctly sent messages to their appropriate destination. I suspect a bug in either Solaris or in Solaris/syslog-ng interoperation. Could anybody check this? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

not match problem once again
by Mariusz Bogumil 21 Mar '01

21 Mar '01

I have searched the whole archive but I have not found any solution to my problem. ----------------- destination messages { file("/var/log/messages.log"); }; filter f_messages { level(info..warn) and not macht("snort") and not facility(auth, news, mail); }; log { source(s_tcp); filter(f_messages); destination(messages); }; ---------------------- I want logs that contain word "snort" not to be directed to /var/log/messages but it seems that filter not match("snort") does not work. Thank you in advance for your help marbo

3 2