September 2001 - syslog-ng - lists.balabit.hu

newbie problem
by Henry Dziewa 18 Sep '01

18 Sep '01

Hi there, I just compiled and installed syslog-ng-1.5.9. Everything seems to be working ok but I'm not able to receive any traps from my cisco devices. I tried multiple devices and nothing seems to be getting to the syslog server. I know that they work fine with regular syslog on o0ther machines. I'm using Solaris 2.6. Here is a config file I found on this list and tried to use: options { time_reopen ( 0 ); sync ( 0 ); chain_hostnames ( no ); use_dns ( yes ); use_fqdn ( yes ); }; ########################################### # Global Source statments for the program ########################################### source src { sun-streams ( "/dev/log" door( "/etc/.syslog_door" )); internal ( ); # tcp ( max-connections( 1000 ) ); udp ( ); }; destination d_all_ms { file("/logs/machine_specific/$HOST/all.$YEAR$MONTH$DAY" group(systems) perm(0664) dir_perm(0664) create_dirs(yes) );}; destination d_cisco { file("/logs/cisco/cisco.messages" );}; # CISCO (local7) messages: filter f_cisco { facility(local7); }; # NO CISCO (local7) messages: filter f_no_cisco { not facility(local7); }; #Forward all messages to machine specific log monitored by system admins log { source(src); filter(f_no_cisco); destination(d_all_ms); }; # Log all messages coming in on local7 facility to /logs/cisco/cisco.messages log { source(src); filter(f_cisco); destination(d_cisco); }; The only messages I'm getting is from d_all_ms for the local machine: Sep 18 12:22:44 sys-backup syslog-ng[10513]: STATS: dropped 0 Sep 18 12:22:45 sys-backup syslog-ng[10513]: STATS: dropped 0 Sep 18 12:22:46 sys-backup syslog-ng[10513]: STATS: dropped 0 Sep 18 12:22:47 sys-backup syslog-ng[10513]: STATS: dropped 0 Any help would be very appreciated !

1 0

Random crashes with version 1.5.10 under Linux.
by Stephane Enten 18 Sep '01

18 Sep '01

I'm experiencing weird crashes with the mentioned version of syslog-ng running on Linux. Syslog-ng starts fine and without any warning/error, but within minutes it crashes with signal 11 (segfault) or 6 (aborted). Running syslog-ng with -d shows this error before crash: ol_object_check: Type error! I've been running it in debug and with strace logs for days no but haven't found anything obvious. Does anyone already got this behaviour ? Regards, Stephane

2 2

Difficulty compiling syslog-ng 1.4.12 on Solaris 8
by Ken Paris 17 Sep '01

17 Sep '01

Greetings, Since I am having trouble with getting syslog-ng 1.4.9a to log external messages, I am attempting to get the next stable version,1.4.12 going. On Solaris 8, I will go to a Development version if there is a consensus that I would fair better. What 1.5 version would be suggested. Disclaimer: Compiling software is not my specialty by any strech of the imagination, but I seem to get by ;-) Platform: SunOS dv-netlog 5.8 Generic_108528-09 sun4u sparc SUNW,Ultra-5_10 configure seems to do fine ... sudo ./configure loading cache ./config.cache checking for a BSD compatible install... ./install-sh -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... (cached) yes checking for working aclocal... missing checking for working autoconf... missing checking for working automake... missing checking for working autoheader... missing checking for working makeinfo... missing checking whether build environment is sane... yes checking for gcc... (cached) gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ANSI C... (cached) none needed checking for bison... no checking for byacc... no checking how to run the C preprocessor... (cached) gcc -E checking for flex... (cached) lex checking for flex... (cached) lex checking for yywrap in -ll... (cached) yes checking lex output file root... (cached) lex.yy checking whether yytext is a pointer... (cached) no checking whether make sets ${MAKE}... (cached) yes checking for ANSI C header files... (cached) yes checking for malloc.h... (cached) yes checking for unistd.h... (cached) yes checking for door.h... (cached) yes checking for stropts.h... (cached) yes checking for sys/strlog.h... (cached) yes checking for stdarg.h... (cached) yes checking for working const... (cached) yes checking whether time.h and sys/time.h may both be included... (cached) yes checking for modern utmp... (cached) yes checking size of short... (cached) 2 checking size of int... (cached) 4 checking size of long... (cached) 4 checking for I_CONSLOG... (cached) yes checking for working alloca.h... (cached) yes checking for alloca... (cached) yes checking for vprintf... (cached) yes checking for door_create in -ldoor... (cached) yes checking for select... (cached) yes checking for snprintf... (cached) yes checking for vsnprintf... (cached) yes checking for strerror... (cached) yes checking for inet_aton... (cached) no checking for strncpy... (cached) yes checking for getutent... (cached) yes checking for getopt_long... (cached) no checking for strcasecmp... (cached) yes checking for pthread.h... (cached) yes checking for pthread_create in -lpthread... (cached) yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking libol version >= 0.2.23... ok creating ./config.status creating Makefile creating src/Makefile creating src/tests/Makefile creating doc/Makefile creating doc/sgml/Makefile creating contrib/Makefile creating syslog-ng.spec creating src/config.h Make seems like a problem and does not complete. kparis@dv-netlog$ sudo make Making all in src make[1]: Entering directory `/usr/local/install/syslog-ng-1.4.12/src' make all-recursive make[2]: Entering directory `/usr/local/install/syslog-ng-1.4.12/src' Making all in . make[3]: Entering directory `/usr/local/install/syslog-ng-1.4.12/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/install/syslog-ng-1.4.12/src -I. -O2 - Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c: In function `io_stream_get': afstreams.c:167: too few arguments to function `init_file' make[3]: *** [afstreams.o] Error 1 make[3]: Leaving directory `/usr/local/install/syslog-ng-1.4.12/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/install/syslog-ng-1.4.12/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/install/syslog-ng-1.4.12/src' make: *** [all-recursive] Error 1 If any additional info is required, I will be more than happy to provide it if I know how to. Any assistance would be appreciated. Best regards, Ken Paris/ Senior Network Engineer Bluestar Solutions, Inc.

1 0

afstreams.c:167: too few arguments to function `init_file'
by Manutsiri Chansutthirangkool 17 Sep '01

17 Sep '01

Dear All I got a problem when I tried to intall syslog-ng-1.4.12 with libol-0.2.23 on solaris sparc 2.6. When I run make, it appeared as following: gcc -DHAVE_CONFIG_H -I. -I/export/home/nms/software/syslog/syslog-ng-1.4.12/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c: In function `io_stream_get': afstreams.c:167: too few arguments to function `init_file' *** Error code 1 make: Fatal error: Command failed for target `afstreams.o' Current working directory /export/home/nms/software/syslog/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /export/home/nms/software/syslog/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /export/home/nms/software/syslog/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' What is the problem? Regards, Manutsiri Chansutthirangkool

3 3

Difficulty with source(net) on Solaris 8 [syslog-ng-1.4.9a]
by Ken Paris 16 Sep '01

16 Sep '01

Greetings, I did as you suggested and I do see the recvfrom() when a message arrives. Never uised truss befor. Interesting, but nothing into the log file. kparis@netlog$ ps -aef | grep sysl kparis 25013 24857 0 13:38:59 pts/1 0:00 grep sysl root 23643 1 0 Sep 12 ? 0:00 /usr/local/sbin/syslog-ng - f /usr/local/etc/syslog-ng.conf -p /var/run/syslog-n truss -p 23643 poll(0xFFBEF658, 3, 60000) = 1 recvfrom(3, " < 5 > 6 7 5 : S e p ".., 519, 0, 0xFFBEF448, 0xFFBEF444) = 99 time() = 1000499766 poll(0xFFBEF658, 3, 100) = 0 poll(0xFFBEF658, 3, 60000) (sleeping...) signotifywait() (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) This repeats anytime I change the config on the cisco device ( which immediately sends a message to loghost ) My current config is: kparis@netlog$ cat syslog-ng.conf options { sync(0); keep_hostname(yes); chain_hostnames(no); log_fifo_size (30000); }; source s_local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal (); }; source s_net_udp { udp(); }; destination d_local { file("/var/log/default"); }; log { source(s_local); source(s_net_udp); destination(d_local); }; kparis@netlog$ ls -l /var/log total 34 -rw------- 1 root sys 0 Aug 17 14:41 authlog -rw------- 1 root root 9057 Sep 14 13:29 default .... I can see this indicates the message is arriving to syslog-ng. Am I close ? I am not sure how to proceed from this point. Thanks for your suggestions and support. Best regards, Ken Paris/ >try truss-ing syslog-ng whether it receives packets. you should see >recvfrom() calls when a message arrives. > >-- >Bazsi

2 1

Example configurations
by Feldmann Scott M. 13 Sep '01

13 Sep '01

Can someone please forward on to me your configurations that are directing log files comming from snmptrapd. I have been unable to figure out how to split them based on the host of the original snmp trap. Thank you for your help. > Scott Feldmann > Senior Network Infrastructure Analyst > UW Hospital and Clinics Information Systems > E-Mail: sm.feldmann(a)hosp.wisc.edu >

1 0

Difficulty with source(net) on Solaris 8 [syslog-ng-1.4.9a]
by Ken Paris 13 Sep '01

13 Sep '01

Thanks for your reply Shawn, I tried your sample config, and still get no messages logged from external sources. ps -aef | grep syslog kparis@dv-netlog$ proc syslog-ng. root 23643 1 0 10:55:03 ? 0:00 /usr/local/sbin/syslog-ng - f /usr/local/etc/syslog-ng.conf -p /var/run/syslog-n in the log I get only Sep 12 10:55:03 dv-netlog syslog-ng[23643]: syslog-ng version 1.4.9a starting when I snoop interface and change a cisco config, I get: kparis@netlog$ sudo snoop 112.139.47.241 Using device /dev/hme (promiscuous mode) 112.139.47.241 -> netlog SYSLOG C port=57785 <5>660: Sep 12 10:52 Still confused ... Megs of thanks, Ken Paris

2 1

RE: [syslog-ng]Difficulty with source(net) on Solaris 8 [syslog-n g-1.4.9a]
by Shawn Davenport 11 Sep '01

11 Sep '01

Hey Ken, Give this a try as your syslog-ng.conf file, options { sync(0); keep_hostname(yes); chain_hostnames(no); log_fifo_size(30000); }; source s_local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_net_udp { udp(); }; destination d_local { file("/logs/messages"); }; log { source(s_local); source(s_net_udp); destination(d_local); }; Note: the source s_net_udp will set syslog-ng to accept ALL incoming UPD(514) messages from ANY host. The cisco conf looks ok, and yes both syslogd and -ng can be running at the same time, at least I've had no problems doing that on Solaris. If the above does work for you, and gets the cisco messages into /var/adm/messages let me know and I can toss a few more examples your way... such as other destinations and filters, and sources. Best of luck. Shawn -----Original Message----- From: Ken Paris [mailto:kparis@netstars.org] Sent: Tuesday, September 11, 2001 12:28 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Difficulty with source(net) on Solaris 8 [syslog-ng-1.4.9a] Greetings. I must request your assistance. First I wish to say that I greatly appreciate the professional level of this list. I am looking forward to getting syslog-ng functioning properly, as it will greatly reduce my workload. It compiled .... I thought the rest would be easy ;-) I have read through most of the archived list, and thought I had this baby down, but I cannot get syslogs comming from sources other than from the local system to appear. I have tested with the following script and log everything except level(emerg), which is correct, and odly I do not get any facility(kern), which I thought I would, but which is also not quite so important at the moment. ... but still none from external sources. for f in {kern,user,daemon,auth,syslog,local0,local1,local2,local3,local4,local5,loca l6,l ocal7} do for i in {debug,info,notice,warning,err,crit,alert,emerg} do logger -p $f.$i "Facility $f Level $i" echo "Facility $f Level $i" done done Works great! My main goal is to receive and filter syslogs from Cisco routers, switches, and firewalls. If the standard syslogd is running I can see those external log entries in /var/adm/messages. They look like this: Sep 10 16:41:34 [112.139.47.241.225.185] 645: Sep 10 16:36:52: %SYS-5-CONFIG_I: Configured from console by kparis on vty0 (112.139.47.250) Sep 10 17:03:43 [112.139.47.241.225.185] 646: Sep 10 16:59:00: %SYS-5-CONFIG_I: Configured from console by kparis on vty1 (112.139.47.250) Sep 10 20:30:42 [112.139.47.244.196.210] 2036: Sep 10 20:25:25.921: %SYS-5- CONFIG_I: Configured from console by kparis on vty0 (112.139.47.250) Sep 10 20:30:57 [112.139.47.244.196.210] 2037: Sep 10 20:25:40.997: %SYS-5- CONFIG_I: Configured from console by kparis on vty0 (112.139.47.250) ( I still don't get the format of the host stamp [112.139.47.244.196.210] .... but I believe this is a syslogd thing, and don't think it's the culprit here. ) ( Clarification: Can the standard syslogd be running at the same time as syslog- ng? I have tried it both ways ) If I snoop the interface, I can see the syslog packets arrive. I fear I am missing something fairly basic. I believe I am having difficulty with the "source net", but I can't seem to find what is wrong when compared to the many examples I have seen on this list. None of the "source net" entries shown, nor any variation I can think of, seems to work. I have also tried changing "/etc/.syslog_door" to "/var/run/syslog_door", but this makes no difference either. If I can provide any more clues, I certainly will if I know how. Any help would be appreciated. ********************* Begin Config Stuff *************** Cisco Logging Config: logging buffered 9000 debugging logging rate-limit console 10 except errors logging source-interface FastEthernet1/0 logging 172.16.7.250 ( The default here is logging facility local7. I have also tried logging facility local6, which should werk too ... I am avoiding kern like the plague ) Platform: SunOS 172.16.7.250 5.8 Generic_108528-09 sun4u sparc SUNW,Ultra-5_10 Version: syslog-ng-1.4.9a syslog-ng config: ( with which I expect to see any message that arrives except level(emerg) ) # /usr/local/etc/syslog-ng.conf # Start command: /usr/local/sbin/syslog-ng -f /usr/local/etc/syslog-ng.conf - p /var/run/syslog-ng.pid # Re-start command: kill -HUP `cat /var/run/syslog-ng.pid` # Begin # -------- OPTIONS --------------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; # -------- SOURCES --------------- #source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp (ip(0.0.0.0) port(514)); }; # Didn't werk ... seperate out for clarity source src { sun-streams("/dev/log" door("/etc/.syslog_door")); }; source int { internal(); }; source net { udp(ip(172.16.7.250) port(514)); }; #source net { udp(); }; #source net { sun-streams("/dev/log" door("/etc/.syslog_door")); udp(ip (0.0.0.0) port(514)); }; # Something is not right in the source department ! # # -------- DESTINATIONS ---------- destination d_default { file("/var/adm/log/$MONTH/default"); }; # Many more places in mind # # -------- FILTERS --------------- filter f_debug { level(debug .. alert) and facility(kern, daemon, user, auth, syslog, local0, local1, local2, local3, local4, local5, local6, local7); }; # Catch all for now... I got a book of "matches" in my pocket # # -------- ACTIONS --------------- log { source(src); filter(f_debug); destination(d_default); }; # Add loggers to match added sources log { source(net); filter(f_debug); destination(d_default); }; log { source(int); filter(f_debug); destination(d_default); }; #log { source(src); filter(DEFAULT); destination(d_default); }; # Blast ... All that reading, and I think I still need some help # End Megs of thanks, Ken Paris Sr. Network Systems Engineer, Bluestar Solutions, Inc. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Difficulty with source(net) on Solaris 8 [syslog-ng-1.4.9a]
by Ken Paris 11 Sep '01

11 Sep '01

Greetings. I must request your assistance. First I wish to say that I greatly appreciate the professional level of this list. I am looking forward to getting syslog-ng functioning properly, as it will greatly reduce my workload. It compiled .... I thought the rest would be easy ;-) I have read through most of the archived list, and thought I had this baby down, but I cannot get syslogs comming from sources other than from the local system to appear. I have tested with the following script and log everything except level(emerg), which is correct, and odly I do not get any facility(kern), which I thought I would, but which is also not quite so important at the moment. ... but still none from external sources. for f in {kern,user,daemon,auth,syslog,local0,local1,local2,local3,local4,local5,local6,l ocal7} do for i in {debug,info,notice,warning,err,crit,alert,emerg} do logger -p $f.$i "Facility $f Level $i" echo "Facility $f Level $i" done done Works great! My main goal is to receive and filter syslogs from Cisco routers, switches, and firewalls. If the standard syslogd is running I can see those external log entries in /var/adm/messages. They look like this: Sep 10 16:41:34 [112.139.47.241.225.185] 645: Sep 10 16:36:52: %SYS-5-CONFIG_I: Configured from console by kparis on vty0 (112.139.47.250) Sep 10 17:03:43 [112.139.47.241.225.185] 646: Sep 10 16:59:00: %SYS-5-CONFIG_I: Configured from console by kparis on vty1 (112.139.47.250) Sep 10 20:30:42 [112.139.47.244.196.210] 2036: Sep 10 20:25:25.921: %SYS-5- CONFIG_I: Configured from console by kparis on vty0 (112.139.47.250) Sep 10 20:30:57 [112.139.47.244.196.210] 2037: Sep 10 20:25:40.997: %SYS-5- CONFIG_I: Configured from console by kparis on vty0 (112.139.47.250) ( I still don't get the format of the host stamp [112.139.47.244.196.210] .... but I believe this is a syslogd thing, and don't think it's the culprit here. ) ( Clarification: Can the standard syslogd be running at the same time as syslog- ng? I have tried it both ways ) If I snoop the interface, I can see the syslog packets arrive. I fear I am missing something fairly basic. I believe I am having difficulty with the "source net", but I can't seem to find what is wrong when compared to the many examples I have seen on this list. None of the "source net" entries shown, nor any variation I can think of, seems to work. I have also tried changing "/etc/.syslog_door" to "/var/run/syslog_door", but this makes no difference either. If I can provide any more clues, I certainly will if I know how. Any help would be appreciated. ********************* Begin Config Stuff *************** Cisco Logging Config: logging buffered 9000 debugging logging rate-limit console 10 except errors logging source-interface FastEthernet1/0 logging 172.16.7.250 ( The default here is logging facility local7. I have also tried logging facility local6, which should werk too ... I am avoiding kern like the plague ) Platform: SunOS 172.16.7.250 5.8 Generic_108528-09 sun4u sparc SUNW,Ultra-5_10 Version: syslog-ng-1.4.9a syslog-ng config: ( with which I expect to see any message that arrives except level(emerg) ) # /usr/local/etc/syslog-ng.conf # Start command: /usr/local/sbin/syslog-ng -f /usr/local/etc/syslog-ng.conf - p /var/run/syslog-ng.pid # Re-start command: kill -HUP `cat /var/run/syslog-ng.pid` # Begin # -------- OPTIONS --------------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; # -------- SOURCES --------------- #source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp (ip(0.0.0.0) port(514)); }; # Didn't werk ... seperate out for clarity source src { sun-streams("/dev/log" door("/etc/.syslog_door")); }; source int { internal(); }; source net { udp(ip(172.16.7.250) port(514)); }; #source net { udp(); }; #source net { sun-streams("/dev/log" door("/etc/.syslog_door")); udp(ip (0.0.0.0) port(514)); }; # Something is not right in the source department ! # # -------- DESTINATIONS ---------- destination d_default { file("/var/adm/log/$MONTH/default"); }; # Many more places in mind # # -------- FILTERS --------------- filter f_debug { level(debug .. alert) and facility(kern, daemon, user, auth, syslog, local0, local1, local2, local3, local4, local5, local6, local7); }; # Catch all for now... I got a book of "matches" in my pocket # # -------- ACTIONS --------------- log { source(src); filter(f_debug); destination(d_default); }; # Add loggers to match added sources log { source(net); filter(f_debug); destination(d_default); }; log { source(int); filter(f_debug); destination(d_default); }; #log { source(src); filter(DEFAULT); destination(d_default); }; # Blast ... All that reading, and I think I still need some help # End Megs of thanks, Ken Paris Sr. Network Systems Engineer, Bluestar Solutions, Inc.

1 0

Firewall syslog-ng.conf?
by Bob Tanner 08 Sep '01

08 Sep '01

hostA 192.168.100.1-+ | hostB | 192.160.100.3-+--> local logger <---> firewall <--> VPN <--> central logger | 192.168.100.100 <public IP> hostC | 192.168.100.3-+ I'm trying to setup a centralized syslog server for several geographically diverse locations. The hostA, hostB, hostC computers all log to local logger (192.168.100.100). And this server logs to the central logger. I'm a little confused on what settings I need: long_hostnames or chain_hostnames? Looking at the web, it seems like they are aliases for the same functionality. keep_hostname(no), because I want hostA/local logger in the log files collected at the central logger? Others, I played with, but I cannot get the combo to work right. use_dns(yes)? use_fqdn(yes)? If I was the logs in central logger to look like hostA/local logger, which commands so I turn on? If I get this to work, I'll add it to the sample configs. -- Bob Tanner <tanner(a)real-time.com> | Phone : (952)943-8700 http://www.mn-linux.org | Fax : (952)943-8500 Key fingerprint = 6C E9 51 4F D5 3E 4C 66 62 A9 10 E5 35 85 39 D9

1 0