July 2001 - syslog-ng - lists.balabit.hu

config file problem in 1.5.8
by Balazs Scheidler 13 Jul '01

13 Jul '01

Hi, syslog-ng won't be able to open its config file because of a missing slash, the following patch fixes this problem: Index: syslog-ng.h =================================================================== RCS file: /var/cvs/syslog-ng/src/syslog-ng.h,v retrieving revision 1.19 diff -u -r1.19 syslog-ng.h --- syslog-ng.h 2001/07/08 17:04:21 1.19 +++ syslog-ng.h 2001/07/13 10:50:55 @@ -34,7 +34,7 @@ #define PATH_SYSLOG_NG_CONF "syslog-ng.conf" #define PATH_PIDFILE "syslog-ng.pid" #else -#define PATH_SYSLOG_NG_CONF PATH_SYSCONFDIR "syslog-ng.conf" +#define PATH_SYSLOG_NG_CONF PATH_SYSCONFDIR "/syslog-ng.conf" #define PATH_PIDFILE "/var/run/syslog-ng.pid" #endif -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

syslog-ng 1.4.12 and 1.5.8 release
by Balazs Scheidler 13 Jul '01

13 Jul '01

Hi, I released syslog-ng 1.4.12 and 1.5.8 yesterday. You can find it at the usual places. 1.5.8 users beware: - filter(DEFAULT) was removed, and some log processing flags were added instead: * catchall * final * fallback The usage is: log { source(src); destination(dst); fallback; }; I still don't like the syntax it is using, so this might change in the future. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]stupid regexp question
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 13 Jul '01

13 Jul '01

Michael, Your format is annoying and make take some tweaking of your filters to get around. Syslog-ng, as you know, does various types of matching, on the program, the host, the message, etc, there are different functions that do those things. For the message portion there is match(), for the program portion there is program(), and for host there is host(), you get the idea. I think you are matching a field other than the message when you are using the match function. It's hard to be sure since I'm not familiar with the NT logging format, but that is what I am guessing. Try using one of the other functions to match your expression. Another way you might get a handle on the structure as syslog-ng sees the messages is to use a destination that structures the messages using the DEFAULT filter and the macros, $HOST, $FACILITY, $PRIORITY, etc that will tell you the format of the message so you can filter out the way syslog-ng sees it. In version 1.5.X there is also the template() function that lets you format the output from syslog-ng however you want. Hope this helps. Regards, Drew -----Original Message----- From: Michael Hargadon [mailto:MHargadon@ITDepartment.com] Sent: Thursday, July 12, 2001 11:41 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]stupid regexp question Good afternoon. I use a linux box as a concentration point for the system logs of several NT servers I monitor. This is done through services running on the NT machine which provide standard syslog functionality -- they forward any messages written to the NT event log to a destination I specify. The format in which the messages are received is somewhat irritating, eg: Jul 12 17:36:25 1.2.3.4 Thu Jul 12 17:34:00 2001: SOMEHOST/Security (528) - "Successful Logon: User Name: xservice Domain: SOMEDOMAIN Logon ID: (0x0,0x34616CAB) Logon Type: 3 Logon Process: NtLmSsp Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: SOMESTATION" A large number of the messages we receive we'd prefer not to log to disk. I set up a destination pointing to /dev/null for this purpose. My intention is to use regular expressions to separate useful messages from the useless (and repetitive) ones. As an example of the above, I defined a filter as follows: filter f_nt0001 { match("Security (528)"); }; As well as a log rule as follows: log { source(src); filter(f_nt0002); destination(null); }; However, I'm having issues getting the match rule to work. I suspect it's the parantheses, since AFAIK they're supposed to be a regexp-reserved character. If, however, I escape them with \( messages received which fall into this category don't hit the filter. I know there's something fundamentally obvious that I'm overlooking here but I can't figure it out. Can anyone offer any assistance? Regards, Michael Hargadon mhargadon(a)itdepartment.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

stupid regexp question
by Michael Hargadon 12 Jul '01

12 Jul '01

Good afternoon. I use a linux box as a concentration point for the system logs of several NT servers I monitor. This is done through services running on the NT machine which provide standard syslog functionality -- they forward any messages written to the NT event log to a destination I specify. The format in which the messages are received is somewhat irritating, eg: Jul 12 17:36:25 1.2.3.4 Thu Jul 12 17:34:00 2001: SOMEHOST/Security (528) - "Successful Logon: User Name: xservice Domain: SOMEDOMAIN Logon ID: (0x0,0x34616CAB) Logon Type: 3 Logon Process: NtLmSsp Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: SOMESTATION" A large number of the messages we receive we'd prefer not to log to disk. I set up a destination pointing to /dev/null for this purpose. My intention is to use regular expressions to separate useful messages from the useless (and repetitive) ones. As an example of the above, I defined a filter as follows: filter f_nt0001 { match("Security (528)"); }; As well as a log rule as follows: log { source(src); filter(f_nt0002); destination(null); }; However, I'm having issues getting the match rule to work. I suspect it's the parantheses, since AFAIK they're supposed to be a regexp-reserved character. If, however, I escape them with \( messages received which fall into this category don't hit the filter. I know there's something fundamentally obvious that I'm overlooking here but I can't figure it out. Can anyone offer any assistance? Regards, Michael Hargadon mhargadon(a)itdepartment.com

1 0

some basic questions syslog-ng
by Ravi Malghan 12 Jul '01

12 Jul '01

Hi I have few basic questions about syslog-ng. If somebody can give me answers or give me some pointers. I am using syslog-ng to log syslog messages from a client to server and a firewall between them. 1. How is the sysloging TCP instead of UDP? Is this something the syslog-ng needs to be configured. 2. The client which initiates the syslog logging, is this normal syslog client? or do I need to install syslog-ng there too? 3.When it uses TCP, which port does it use? Does the user have control over the port number? Thanks in advance Ravi __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

1 0

unscribe
by Simon Yang 11 Jul '01

11 Jul '01

unscribe

1 0

RE: [syslog-ng]syslog-ng.conf
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 11 Jul '01

11 Jul '01

And there is always a macro filter $HOST that you could separate all the hosts into their own files. destination d_host_logs { file("/var/adm/hosts/$HOST.log"); }; That would save you the performance hit unless there were a great deal of hosts and you may run out of open file descriptor slots. Of course this may not be really what you want as this would put everything in a separate file by host. Depends on what you need to do. Regards, Drew -----Original Message----- From: Nijs, Daniel [mailto:NijsD@telergy.net] Sent: Wednesday, July 11, 2001 3:13 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]syslog-ng.conf This is what I had in mind, but I am not sure what the performance overhead will be when I have many rules of this type where I want the data in a seperate file. For now it will do the job, but hopefully this (a directive to stop processing the rules any further) could be an option added to the filter statement in a future release. Thanks for the help. Best regards, Dan -----Original Message----- From: Hamilton, Andrew Mr RAYTHEON 5 SIG CMD [mailto:HamiltonA@hq.5sigcmd.army.mil] Sent: Wednesday, July 11, 2001 6:13 AM To: 'syslog-ng(a)lists.balabit.hu' Cc: Nijs, Daniel Subject: RE: [syslog-ng]syslog-ng.conf Dan, It's true that syslog-ng continues to log after a match was found and this is a necessary function of the software. It logs as long as a match is found. Your best bet on filtering out the things you don't want in the log by using the boolean operators in you filters: filter f_host_ip { facility(daemon) and not host("10.10.10.10"); }; Something of this nature and then add your host in a filter: filter f_myhost { facility(daemon) and host("10.10.10.10"); }; Like that. Hope that helps. Regards, Drew -----Original Message----- From: Nijs, Daniel [mailto:NijsD@telergy.net] Sent: Tuesday, July 10, 2001 9:28 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng.conf Hello, I am relatively new to syslog-ng (only been running it for a month) and love the software. I would like to congratulate the author on doing such a great job. This is a powerful product, and with this comes complexity, and I have a few questions I am not able to find an answer for. I have a webserver logging to a centralized host, and I filter the logs using specific criteria (i.e. document name). Let's give this file a name to make this question easier to understand. I log this data to hits.log. Now, I want to filter out a certain IP to a separate file (ip.log), and not show the entries that were logged to ip.log in hits.log. It seems that syslog-ng keeps processing all rules, even after there was a match. I was hoping that there was an option to stop processing any further rules for that matched data to solve this problem, but am unable to find any solution. Does anyone have any suggestions on how to do this? Thanks. Best regards, Dan _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]syslog-ng.conf
by Nijs, Daniel 11 Jul '01

11 Jul '01

This is what I had in mind, but I am not sure what the performance overhead will be when I have many rules of this type where I want the data in a seperate file. For now it will do the job, but hopefully this (a directive to stop processing the rules any further) could be an option added to the filter statement in a future release. Thanks for the help. Best regards, Dan -----Original Message----- From: Hamilton, Andrew Mr RAYTHEON 5 SIG CMD [mailto:HamiltonA@hq.5sigcmd.army.mil] Sent: Wednesday, July 11, 2001 6:13 AM To: 'syslog-ng(a)lists.balabit.hu' Cc: Nijs, Daniel Subject: RE: [syslog-ng]syslog-ng.conf Dan, It's true that syslog-ng continues to log after a match was found and this is a necessary function of the software. It logs as long as a match is found. Your best bet on filtering out the things you don't want in the log by using the boolean operators in you filters: filter f_host_ip { facility(daemon) and not host("10.10.10.10"); }; Something of this nature and then add your host in a filter: filter f_myhost { facility(daemon) and host("10.10.10.10"); }; Like that. Hope that helps. Regards, Drew -----Original Message----- From: Nijs, Daniel [mailto:NijsD@telergy.net] Sent: Tuesday, July 10, 2001 9:28 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng.conf Hello, I am relatively new to syslog-ng (only been running it for a month) and love the software. I would like to congratulate the author on doing such a great job. This is a powerful product, and with this comes complexity, and I have a few questions I am not able to find an answer for. I have a webserver logging to a centralized host, and I filter the logs using specific criteria (i.e. document name). Let's give this file a name to make this question easier to understand. I log this data to hits.log. Now, I want to filter out a certain IP to a separate file (ip.log), and not show the entries that were logged to ip.log in hits.log. It seems that syslog-ng keeps processing all rules, even after there was a match. I was hoping that there was an option to stop processing any further rules for that matched data to solve this problem, but am unable to find any solution. Does anyone have any suggestions on how to do this? Thanks. Best regards, Dan _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]syslog-ng.conf
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 11 Jul '01

11 Jul '01

Dan, It's true that syslog-ng continues to log after a match was found and this is a necessary function of the software. It logs as long as a match is found. Your best bet on filtering out the things you don't want in the log by using the boolean operators in you filters: filter f_host_ip { facility(daemon) and not host("10.10.10.10"); }; Something of this nature and then add your host in a filter: filter f_myhost { facility(daemon) and host("10.10.10.10"); }; Like that. Hope that helps. Regards, Drew -----Original Message----- From: Nijs, Daniel [mailto:NijsD@telergy.net] Sent: Tuesday, July 10, 2001 9:28 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng.conf Hello, I am relatively new to syslog-ng (only been running it for a month) and love the software. I would like to congratulate the author on doing such a great job. This is a powerful product, and with this comes complexity, and I have a few questions I am not able to find an answer for. I have a webserver logging to a centralized host, and I filter the logs using specific criteria (i.e. document name). Let's give this file a name to make this question easier to understand. I log this data to hits.log. Now, I want to filter out a certain IP to a separate file (ip.log), and not show the entries that were logged to ip.log in hits.log. It seems that syslog-ng keeps processing all rules, even after there was a match. I was hoping that there was an option to stop processing any further rules for that matched data to solve this problem, but am unable to find any solution. Does anyone have any suggestions on how to do this? Thanks. Best regards, Dan _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

syslogging snmptraps
by Brian E. Seppanen 10 Jul '01

10 Jul '01

Hello: I'm using syslog-ng-1.4.11 on a solaris 2.6 host. The box is likewise configured as an snmptrap host, which are then logged. Is there a field length limit for the messages that will be logged with syslog-ng or syslog in general. Some traps seem to run out of space and stop prematurely. An example below Jul 10 14:53:09 host snmptrapd[8971]: host: Enterprise Specific Trap (ciscoNetRegFreeAddressLow) Uptime: 21 days, 10:02:46.00, system.sysDescr = Cisco Systems, Inc. blah blah blah blah blah blah, enterprises.cisco.ciscoMgmt.ciscoNetworkRegistrarMIB.ciscoNetworkRegistrarMIBObjects.cnrDHCP.cnrDHCPScopeTable.cnrDHCPScopeEntry.cnrDHCPScopeFreeAddrLowThreshold.78.87.45.84.86.67.45.85.66.82.49.45.73.80.66.85.78.68.76.69.53.45.80.67 = Wrong Type (should be Gauge32 or Unsigned32): 20, enterprises.cisco.ciscoMgmt.ciscoNetworkRegistrarMIB.ciscoNetworkRegistrarMIBObjects.cnrDHCP.cnrDHCPScopeTable.cnrDHCPScopeEntry.cnrDHCPScopeFreeAddrValue.78.87.45.84.86.67.45.85.66.82.49.45.73.80.66.85.78.68.76.69.53.45.80.67 = Wrong Type (should be Gauge32 or Unsigned32): 20, enterprises.cisco.ciscoMgmt.ciscoNetworkRegistrarMIB.ciscoNetworkRegistrarMIBObjects.cnrDHCP.cnrDHCPScopeTable.cnrDHCPScopeEntry.cnrDHCPScopeFreeAddrUnits.78.87.45.84.86.67.45.85.66.82.49.45.73.80.66.85.78.68.76.69.53.45.80.67 = percen Any insights appreciated. Thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

1 0