August 2001 - syslog-ng - lists.balabit.hu

timestamp issues
by Mickey Everts 12 Aug '01

12 Aug '01

How is it possible to have out of order time stamps? My first thought would be that somehow the device itself is sending the timestamp. Do devices have the option of sending a timestamp or not? I would prefer that the syslog daemon itself always write the timestamp if possible to avoid confusion when trying to diagnose multiple device events. Aug 2 15:11:24 ap01.yipes.com KERN: NV:Completed configuration save (secondary) operation Aug 2 15:10:47 t3-0-2-0.jp02.yipes.com mgd[13087]: UI_JUNOSCRIPT_ERROR: junoscript error: syntax error, expecting <command> Aug 2 15:11:26 t3-0-2-0.jp02.yipes.com mgd[13087]: UI_CMDLINE_READ_LINE: user 'auser', command 'start shell ' -MiC Mickey Everts 415.901.2223 direct Unix System Administrator 415.901.2000 main Yipes Communications, Inc. 415.533.1402 cell http://www.yipes.com/ 415.358.4112 fax

3 3

Loganalysis mailing list
by Tina Bird 09 Aug '01

09 Aug '01

The Log Analysis mailing list is a forum for system administrators who are building and using a centralized logging infrastructure in their networks. Most of the discussion will focus on the care and feeding of syslog -- central loghosts, how to configure the devices in your network, how to secure your log infrastructure. We also talk about how to manage and process your log data. One of my primary goals for this list is to collect log data from attacks "in the wild," and to build configuration files for swatch and logsurfer that contain samples of these known attack signatures. Hopefully this will encourage more people to look at their logfiles regularly. I will also be publishing syslog configurations for devices as I collect them. This list is moderated by Tina Bird. To subscribe to the LogAnalysis mailing list, send an empty e-mail message to loganalysis-subscribe(a)securityfocus.com from the account you want to add. You'll be asked to confirm the subscription request, and sent a list of administrative commands for your subscription. And start talking! Thanks -- tbird

1 0

RE: [syslog-ng]syslog-ng tcp ports
by nothingsTrivial - 09 Aug '01

09 Aug '01

Hi Ravi, I think all you need to change is the source statements listen address. Try, something like this; source s_net_tcp { tcp(ip(0.0.0.0) port(4474)); }; Hope that helps. Shawn -----Original Message----- From: Ravi Malghan [mailto:rmalghan@yahoo.com] Sent: Thursday, August 09, 2001 5:19 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng tcp ports Hello: I have a environment where the syslog clients are out side the firewall and the server is inside. The clients are configured to connect to port 4474 using TCP. I enabled this port on the firewall but still the connections donot go through. Are there any pther ports I need to enable on the firewall? Server side: source syslog-ng-client_tcp {tcp(ip(192.168.17.90) port(4474));}; Client side destination syslog-ng-server1 { tcp("192.168.17.90" port(4474)); }; TIA Ravi _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

1 0

syslog-ng tcp ports
by Ravi Malghan 09 Aug '01

09 Aug '01

Hello: I have a environment where the syslog clients are out side the firewall and the server is inside. The clients are configured to connect to port 4474 using TCP. I enabled this port on the firewall but still the connections donot go through. Are there any pther ports I need to enable on the firewall? Server side: source syslog-ng-client_tcp {tcp(ip(192.168.17.90) port(4474));}; Client side destination syslog-ng-server1 { tcp("192.168.17.90" port(4474)); }; TIA Ravi

1 0

Re: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

6 6

RE: Can someone please stop this: RE: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie)
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 08 Aug '01

08 Aug '01

Bazsi blocked him you can take the rule out. -----Original Message----- From: Robert Andersson [mailto:robert@ling.gu.se] Sent: Wednesday, August 08, 2001 11:12 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: Can someone please stop this: RE: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie) jon, >>>>> "JN" == Jon Nistor <nistor(a)snickers.org> writes: JN> .procmailrc -> JN> :0 JN> * ^(To|From|cc).*Erick.Staal(a)onl.pinkroccade.nl JN> /dev/null thanx, now his emails will be lost in cyber space... errr... thus does also probably mean that i will be annoyed by him forever cause i can never read his eamil where he appologises for this... :) /robert _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

1 0

Re: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

1 0

Re: Can someone please stop this: RE: [syslog-ng]smallsyslog-ng1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

1 0

small syslog-ng 1.5.8 bug
by Jay Soffian 08 Aug '01

08 Aug '01

I haven't tracked this down yet, but it appears that when you send syslog-ng a SIGHUP while it is running with '-v', it terminates instead of restarting. # uname -a Linux syslog01 2.2.16-3smp #1 SMP Mon Jun 19 19:00:35 EDT 2000 i686 unknown # syslog-ng -V syslog-ng 1.5.8 j.

2 1