April 2001 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]Cisco Logging
by Shaw, Richard W 23 Apr '01

23 Apr '01

Hi Drew I've tried your extra setting but I still get nothing about our cisco routers in the cisco.log or the sys.log files I'd setup for syslog-ng. I do however still get them via the syslogd. Is there something I'm missing out of the source bit of the code ? Regards Richard > -----Original Message----- > From: Hamilton, Andrew Mr RAYTHEON 5 SIG CMD > [SMTP:HamiltonA@hq.5sigcmd.army.mil] > Sent: Friday, 6 April 2001 4:03 pm > To: 'syslog-ng(a)lists.balabit.hu' > Subject: RE: [syslog-ng]Cisco Logging > > Richard, > > syslog-ng does a considerably better job at filtering than does syslogd. > This can cause you problems if you are not looking at it correctly. > syslogd > will log up to a priority for a facility in the syslog.conf. syslog-ng > will > log only that facility given in the syslog-ng.conf. Cisco devices log at > the info level by default. So only if you are getting something from the > Cisco devices at the debug level. If you want the same behavior as in > syslogd you need to set your filter to "priority(info..debug)". > > Regards, > Drew > > > -----Original Message----- > > From: Shaw, Richard W [SMTP:Richard.W.Shaw@team.telstra.com] > > Sent: Friday, April 06, 2001 9:50 AM > > To: 'syslog-ng(a)lists.balabit.hu' > > Subject: [syslog-ng]Cisco Logging > > > > Hi Guys > > > > I've just found syslog-ng and am testing/comparing it to our current > > syslogd > > so I can match the logging then push everything to a syslog server. > > > > My problem is that I'm getting no logs for Cisco devices, I don't even > get > > anything in the sys.log file(see below): > > > > syslogd.conf file : > > local7.debug /var/log/cisco.log > > > > syslog-ng.conf file: > > source src { > > udp(); > > tcp(); > > sun-streams("/dev/log" door("/etc/.syslog_door")); > > internal(); > > }; > > destination d_mail { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/mail.log" > > create_dirs(yes) > > ); }; > > destination d_cisco { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/cisco.log" > > create_dirs(ye > > s)); }; > > destination d_sshd { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sshd.log" > > create_dirs(yes > > )); }; > > destination d_tac { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/tacplus.log" > > create_dirs(y > > es)); }; > > > > destination d_sys { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sys.log" > > create_dirs(yes)) > > ; }; > > > > filter f_mail { facility(mail); }; > > filter f_cisco { facility(local7) and priority(debug); }; > > filter f_sshd { match("sshd"); }; > > filter f_tac { facility(local6); }; > > > > log { source(src); filter(f_mail); destination(d_mail); }; > > log { source(src); filter(f_cisco); destination(d_cisco); }; > > log { source(src); filter(f_sshd); destination(d_sshd); }; > > log { source(src); filter(f_tac); destination(d_tac); }; > > > > > > log { source(src); destination(d_sys); }; > > > > > > Thanks in advance for any help > > > > Regards > > Richard Shaw > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Syslog-ng dies with logrotate
by Simeon Johnston 20 Apr '01

20 Apr '01

We am using logrotate to rotate our logs and when I send syslog-ng the HUP signal it dies. We am using version 1.4.11. Here is the config for logrotate. /var/log/serv/VPN.log { postrotate kill -HUP `cat /var/run/syslog-ng.pid` endscript } This is the same rule we use for all the logs. I thought the HUP signal problem was fixed? Should I try the newest 1.5.x version? Would this command work better? killall -HUP syslog-ng Thank you, sim

1 0

circular logging & control structure based destination
by Shawn Davenport 20 Apr '01

20 Apr '01

Hey Folks, Can syslog-ng do circular logging? If you are wondering what I mean by that, I'm referring to writing messages to a file, and when the destination reaches a limit, old messages are removed so the new ones can hang around for a bit. The limit could be file size, message date or time, or something else perhaps. For my needs, I would love to set a file size limit. Say 20megs per destination file. Also the idea of having the destination be chosen through a control structure like an if/then statement is very appealing. The idea being, if destination A is available (network connection, file w/ X amount of disk space, etc) then log there, otherwise check destination B, or the next, and so on... Having the destination be able to change dynamically would be ideal. Unfortunately I don't have the c knowledge to make that happen, so the best thing I've come up with is through the use of a few different syslog-ng.conf files and some perl to watch network connections. Kind of messy... Thoughts, ideas, rude comments? Finding a way to do the first one, and better way for the second would be great! Thanks... Shawn

3 2

Re: [syslog-ng]1.4.11 fixes SIGHUP problems?
by John_Delisle＠ceridian.ca 18 Apr '01

18 Apr '01

I'm not sure thats a bug, it may be a feature actually. If you look at /var/log/messages, theres an entry saying the new config is bad, and syslog-ng will continue running with the old config. This prevents lost syslog messages. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 jon(a)dumbo.pobox.com Sent by: To: syslog-ng(a)lists.balabit.hu syslog-ng-admin@lists. cc: balabit.hu Subject: Re: [syslog-ng]1.4.11 fixes SIGHUP problems? 2001/03/12 11:21 AM Please respond to syslog-ng i noticed one problem. if the configuration file is broken to the point syslog-ng will not start, HUP does not notice this ie. if you forget a semicolon somewhere kill -HUP syslog-ng-pid works w/o erros but kill syslog-ng-pid and syslog-ng dies... y On Fri, Mar 09, 2001 at 10:01:08AM +0100, Balazs Scheidler wrote: | Hi, | | I was wondering whether the 1.4.11 release did really fix the SIGHUP | problems many of you encountered? Some feedback would be useful. | | TIA, | -- | Bazsi | PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 | | _______________________________________________ | syslog-ng maillist - syslog-ng(a)lists.balabit.hu | https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

6 7

Re: [syslog-ng]Linefeed in incoming messages
by Michael.Garvin＠carolinabroadband.com 18 Apr '01

18 Apr '01

> On 0, Balazs Scheidler <bazsi(a)balabit.hu> inscribed onto the electric medium... > > My question is, is there somewhere in the syslog-ng code where I can > > easily parse the incoming syslog message and replace linefeeds with > > something benign, such as spaces or tabs? Or is there another solution > > that would be better? In the meantime we're opening a bug with the > > vendor since I consider this their issue, but knowing vendors I'm not > > confident in their addressing the problem quickly. > > Vendor == cisco, perhaps? Not to name names, but... Yes. :-) One of their acquisitions to be precise. > > linefeeds take an important role in syslog messages, they terminate them. So > > I disagree. > > I just had to track this one down myself; the cisco vpn concentrator > is logging stuff with embedded newlines. The RH linux box was logging > the whole messages, but the Irix box wasn't. Hence clearly the > linefeed doesn't have any true bearing on the length of the syslog > message; it should be determined by the length of the incoming > message. Any imbedded newlines should be ignored; translated to > spaces (as the linux syslog does) or ^M (as the [patched] irix syslog > does.) Deja vu... This is exactly what we were running into. There's now an open TAC case with Cisco on it, since I call it a bug on their part. I'd tend to agree with Balazs on this point, to which end I added code to remove all but the final linefeed before processing. In 'src/sources.c' (I've included the existing line before and after for reference): closure->pos += n; start = closure->buffer; eol = closure->buffer + closure->pos; while (start++ < eol) if (start[-1] == '\n') start[-1] = ' '; eol = memchr(closure->buffer, '\0', closure->pos); It's not pretty, but so far it's gotten the job done. > "Be gracious in what you accept, and conservative in what you send." > (paraphrased sendmail quotation.) > > There's no RFC on syslog messages, is there? The Irix syslogd traces > its route all the way back to BSD 4.2, and the check that terminated > parsing when it hit a newline had been in there from the beginning. No, but there is a task force working on one if I recall. Better late than never? Thanks for the assistance, I think this is taken care of.

1 0

Re: [syslog-ng]Linefeed in incoming messages
by todd.glassey＠att.net 18 Apr '01

18 Apr '01

B-Man - one easy fix is to send the message length as an optional flag to the system, that is if this could be added to the "offensive piece of networking equipment". Then if the LF is detected before the EOM count is reached then there is some residual processing that this message will need , whatever that is. T. -- Regards, Todd > > My question is, is there somewhere in the syslog-ng code where I can > > easily parse the incoming syslog message and replace linefeeds with > > something benign, such as spaces or tabs? Or is there another solution > > that would be better? In the meantime we're opening a bug with the > > vendor since I consider this their issue, but knowing vendors I'm not > > confident in their addressing the problem quickly. > > linefeeds take an important role in syslog messages, they terminate them. So > syslog-ng takes its input packet, splits it by linefeeds and splits each of > these parts as separate messages. As you see it would be difficult to skip > processing linefeed characters because it would broke other syslog clients. > You may try looking around the function do_read_line() in sources.c and > change it the way that fits you, or wait for your vendor to fix the problem. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Linefeed in incoming messages
by Michael.Garvin＠carolinabroadband.com 18 Apr '01

18 Apr '01

We have a piece of network equipment which appears to be logging in a not entirely friendly fashion (to be politically correct), in that it is including a linefeed (0x0a ASCII hex) in log messages for formatting purposes. Unfortunately, from what I can tell syslog-ng 1.4.11 is getting confused with the linefeed, so the log message up to the linefeed is getting logged correctly but the part after the linefeed is being prepended to the next incoming message. Therefore the filter for this unit is applied to the first part, resulting in it being written to its file, but the filter for the next message is applied to the remainder (the next message plus the prepended remainder from the previous). (Yes, I know it's confusing, I've just spent a while tracking it down. I can provide additional detail if needed...) My question is, is there somewhere in the syslog-ng code where I can easily parse the incoming syslog message and replace linefeeds with something benign, such as spaces or tabs? Or is there another solution that would be better? In the meantime we're opening a bug with the vendor since I consider this their issue, but knowing vendors I'm not confident in their addressing the problem quickly. Thanks for any help... And thanks for syslog-ng! -- Michael Garvin mailto:mgarvin@carolinabroadband.com

3 2

Can't send log to destination machine
by Rodrigo Pace de Barros 17 Apr '01

17 Apr '01

Hi... that's my problem... I can generate logs and store them in the local machine, but when i try to configure the syslog-ng.conf with the DESTINATION sending the results to other machine, this doesn't work.... I've tried this in the syslog-ng.conf: destination log_host { udp (ip(xxx.xxx.xxx.xxx) port(xxxxx));}; and destination log_host { udp xxx.xxx.xxx.xxx,xxx }; |-------------| |-| IP Port How can i do that? Are them both incorrect? (or no?) Thank's for your help! Best regards... -- ---------------------- Rodrigo Pace de Barros - pace(a)acme-ids.org ---------------------- Acme! - Advanced Counter-measures Environment Computer Security Research Ciencia da Computacao - Unesp - S. J. Rio Preto - Brasil ----------------------

2 1

Compiling in Socksification with Syslog-ng
by Matt Weatherford 15 Apr '01

15 Apr '01

Forgive me if this is a faq, but has any one out there compiled in socksification with Syslog ng? Any pointers or gotchas or discussions of "where the landmines are buried" would be helpful... thanks, Matt

1 0

chmod() and template escaping for pipes
by Balazs Scheidler 14 Apr '01

14 Apr '01

Hi, The patch below adds chmod() calls for created directories and files so they are created with modes independent from the current umask. The other change adds the template-escape() option for pipes. This will be integrated into the next release. Index: affile.c =================================================================== RCS file: /var/cvs/syslog-ng/src/affile.c,v retrieving revision 1.35 diff -u -r1.35 affile.c --- affile.c 2001/03/30 15:02:31 1.35 +++ affile.c 2001/04/14 07:56:51 @@ -78,6 +78,7 @@ if (mkdir(name->data, dir_mode) == -1) return 0; chown(name->data, dir_uid, dir_gid); + chmod(name->data, dir_mode); } *p = '/'; p = strchr(p + 1, '/'); @@ -85,6 +86,7 @@ *fd = open(name->data, flags, mode); } chown(name->data, uid, gid); + chmod(name->data, mode); return *fd != -1; } Index: cfg-grammar.y =================================================================== RCS file: /var/cvs/syslog-ng/src/cfg-grammar.y,v retrieving revision 1.41 diff -u -r1.41 cfg-grammar.y --- cfg-grammar.y 2001/03/30 15:02:31 1.41 +++ cfg-grammar.y 2001/04/14 07:56:51 @@ -398,6 +398,7 @@ | KW_GROUP '(' string ')' { affile_set_group(last_dest_driver, $3); free($3); } | KW_PERM '(' NUMBER ')' { affile_set_perm(last_dest_driver, $3); } | KW_FILE_TEMPLATE '(' string ')' { affile_set_file_template(last_dest_driver, $3); free($3); } + | KW_TEMPLATE_ESCAPE '(' yesno ')' { affile_set_template_escape(last_dest_driver, $3); } ; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0