October 2002 - syslog-ng - lists.balabit.hu

Syslog forwarding
by Fernando Cardoso 30 Oct '02

30 Oct '02

Hi all I'm designing a solution where I need to forward syslog messages to 2 different servers (Cisco Works and a log correlation system). The messages will be sent from Cisco routers and PIXes to a box running syslog-ng that will forward the messages to the servers according to the facility and levels defined on filters. My question regards the origin of the messages as they will be seen by the end servers. Since both Cisco Works and the log correlation engine rely on the source IP to acknowledge and trigger alarms, will they see the syslog-ng box IP or the original IP address of the routers and PIXes? In other words will syslog-ng spoof the source IP addresses when forwarding the messages? Thanks in advance Fernando _____________________________________________________________________ INTERNET MAIL FOOTER A presente mensagem pode conter informação considerada confidencial. Se o receptor desta mensagem não for o destinatário indicado, fica expressamente proibido de copiar ou endereçar a mensagem a terceiros. Em tal situação, o receptor deverá destruir a presente mensagem e por gentileza informar o emissor de tal facto. --------------------------------------------------------------------- Privileged or confidential information may be contained in this message. If you are not the addressee indicated in this message, you may not copy or deliver this message to anyone. In such case, you should destroy this message and kindly notify the sender by reply email. ---------------------------------------------------------------------

1 0

RE: [syslog-ng]Failed build 1.4.7 on Solaris 8
by Nomar Oscar Mora Tovar 30 Oct '02

30 Oct '02

Thanks :-) I'll do Nomar At 11:48 a.m. 30/10/2002 -0500, you wrote: >Use either libol-2.* with version 1.4.* or use version 1.5.*. libol-0.3.* >goes with syslog-ng 1.5.*. The two don't mix and match that much. > >Regards, > >Drew > > > -----Original Message----- > > From: Nomar Oscar Mora Tovar [mailto:nmora@unet.edu.ve] > > Sent: Wednesday, October 30, 2002 11:44 AM > > To: Syslog-ng List > > Subject: [syslog-ng]Failed build 1.4.7 on Solaris 8 > > > > << Message: >> << File: Nomar Oscar Mora Tovar.asc >> > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html -- +----------------------------+-------------------+ |Nomar Oscar Mora Tovar |nmora(a)unet.edu.ve | |Administrador de RedUNET |nmora(a)funtha.gov.ve| |HP certified IT professional| | +----------------------------+-------------------+ http://www.unet.edu.ve/~nmora "El truco esta en trabajar con el Universo no en SU contra" Nomar Mora 24 de Abril de 2002 1b884fa.jpg

1 0

template() and template_escape() extension for all destination drivers
by Achim Gsell 30 Oct '02

30 Oct '02

Hi, We need the "template()" and "template_escape()" options in all destination drivers, not only in the "file" driver. The attached patch adds these options to all other destination drivers in syslog-ng 1.5.20. We test the patch on Linux 2.2.20 and Solaris 8. Is there a reason to have these options available only in the "file" destination driver? Achim

2 2

RE: [syslog-ng]Failed build 1.4.7 on Solaris 8
by Hamilton, Andrew 30 Oct '02

30 Oct '02

Use either libol-2.* with version 1.4.* or use version 1.5.*. libol-0.3.* goes with syslog-ng 1.5.*. The two don't mix and match that much. Regards, Drew > -----Original Message----- > From: Nomar Oscar Mora Tovar [mailto:nmora@unet.edu.ve] > Sent: Wednesday, October 30, 2002 11:44 AM > To: Syslog-ng List > Subject: [syslog-ng]Failed build 1.4.7 on Solaris 8 > > << Message: >> << File: Nomar Oscar Mora Tovar.asc >>

2 1

Failed build 1.4.7 on Solaris 8
by Nomar Oscar Mora Tovar 30 Oct '02

30 Oct '02

Hello all: Ths is the output of make command, I'm using Libol 0.3.5, can anyone help me on this?? gcc -DHAVE_CONFIG_H -I. -I/tmp/gtools/syslogd/syslog-ng-1.4.7/src -I. -O2 -Wall -I/tmp/gtools/syslogd/libol-0.3.5/src -D_GNU_SOURCE -c cfg-grammar.c gcc -DHAVE_CONFIG_H -I. -I/tmp/gtools/syslogd/syslog-ng-1.4.7/src -I. -O2 -Wall -I/tmp/gtools/syslogd/libol-0.3.5/src -D_GNU_SOURCE -c cfg-lex.c gcc -DHAVE_CONFIG_H -I. -I/tmp/gtools/syslogd/syslog-ng-1.4.7/src -I. -O2 -Wall -I/tmp/gtools/syslogd/libol-0.3.5/src -D_GNU_SOURCE -c affile.c affile.c: In function `do_init_affile_source': affile.c:109: too few arguments to function `make_io_fd' affile.c: In function `do_init_dest_writer': affile.c:203: too few arguments to function `make_io_fd' make[2]: *** [affile.o] Error 1 make[2]: Leaving directory `/tmp/gtools/syslogd/syslog-ng-1.4.7/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/tmp/gtools/syslogd/syslog-ng-1.4.7/src' make: *** [all-recursive-am] Error 2 bash-2.03# pwd /tmp/gtools/syslogd/syslog-ng-1.4.7/src bash-2.03# Thanks in advance Nomar Mora -- +----------------------------+-------------------+ |Nomar Oscar Mora Tovar |nmora(a)unet.edu.ve | |Administrador de RedUNET |nmora(a)funtha.gov.ve| |HP certified IT professional| | +----------------------------+-------------------+ http://www.unet.edu.ve/~nmora "El truco esta en trabajar con el Universo no en SU contra" Nomar Mora 24 de Abril de 2002 ec1cf6.jpg

1 0

RE: [syslog-ng]crashbug fix in recent syslog-ng versions
by Hamilton, Andrew 30 Oct '02

30 Oct '02

I also said it might help some people. Not everyone. You can use it or not as it suits you and Bazsi already came up with a better solution. It is not necessarily wrong just not right for everyone. -----Original Message----- From: Borzenkov Andrey [mailto:Andrej.Borsenkow@mow.siemens.ru] Sent: Wednesday, October 30, 2002 8:57 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]crashbug fix in recent syslog-ng versions > Well with a couple of changes I got it to work correctly on Solaris 8 x86. > I ran configure a bunch of times with various corrections to configure.in > because I originally got the HAVE_RES_INIT problem like the others did. > Then of course the link problem with -lresolv came up during the compile. > But I used the patch that Andrey sent for acconfig.h then I added a line > to > configure.in and voila! it worked perfectly for me "out of the box" so to > speak. > > *** configure.in.orig Tue Oct 29 20:00:52 2002 > --- configure.in Tue Oct 29 20:20:34 2002 > *************** > *** 151,156 **** > --- 151,157 ---- > > if test "x$blb_cv_c_res_init" = "xyes"; then > AC_DEFINE(HAVE_RES_INIT) > + LIBS="$LIBS -lresolv" > fi > > dnl Checks for library functions. > This patch is obviously wrong. You cannot assume that libresolv exists just because res_init is found in some header. What is the right thing to do is to search for library that contains res_init. -andrey _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]crashbug fix in recent syslog-ng versions
by Hamilton, Andrew 30 Oct '02

30 Oct '02

Well with a couple of changes I got it to work correctly on Solaris 8 x86. I ran configure a bunch of times with various corrections to configure.in because I originally got the HAVE_RES_INIT problem like the others did. Then of course the link problem with -lresolv came up during the compile. But I used the patch that Andrey sent for acconfig.h then I added a line to configure.in and voila! it worked perfectly for me "out of the box" so to speak. *** configure.in.orig Tue Oct 29 20:00:52 2002 --- configure.in Tue Oct 29 20:20:34 2002 *************** *** 151,156 **** --- 151,157 ---- if test "x$blb_cv_c_res_init" = "xyes"; then AC_DEFINE(HAVE_RES_INIT) + LIBS="$LIBS -lresolv" fi dnl Checks for library functions. That's all it took. This may work for some others that are having the -lresolv link error. I saw where it looked like it was checking for res_init twice, once it said yes then the next time it said no, I think what it is doing the first time it is looking for the function definition inside the header and the next time it is looking inside libresolv because when the line above was added it said "yes" both times instead of "no" the second time. Regards, Drew -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, October 29, 2002 3:25 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]crashbug fix in recent syslog-ng versions > > I have found two problems which are the possible cause of the crashes > > reported on this list. expect a new release soon if the fixes below prove > > to be effective. > > I am very happy to report that 1.5.23+libol-0.3.5 are running just fine > in my environment. Before I discovered 1.5.23 was available I had > already tested 1.5.21+the sources.c patch, and that worked for me as > well. > > Thanks very much for taking the time to stomp this bug out of existence! cool, and thanks for testing the fix. if syslog-ng 1.5.23 proves to be stable, I'll release 1.6.0 Could you - not specifically you, rather the list - please test the configure.in changes as well on different platforms? I've tested it on Debian GNU/Linux, and Solaris 8 (Linux on x86, Solaris on Sparc). A test on one of the BSDs and HP-UX would be welcome. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

RE: [syslog-ng]crashbug fix in recent syslog-ng versions
by Hamilton, Andrew 30 Oct '02

30 Oct '02

Yeah that's better. Drew -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Wednesday, October 30, 2002 8:45 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]crashbug fix in recent syslog-ng versions On Tue, Oct 29, 2002 at 02:38:11PM -0500, Hamilton, Andrew wrote: > Well with a couple of changes I got it to work correctly on Solaris 8 x86. > I ran configure a bunch of times with various corrections to configure.in > because I originally got the HAVE_RES_INIT problem like the others did. > Then of course the link problem with -lresolv came up during the compile. > But I used the patch that Andrey sent for acconfig.h then I added a line to > configure.in and voila! it worked perfectly for me "out of the box" so to > speak. > > *** configure.in.orig Tue Oct 29 20:00:52 2002 > --- configure.in Tue Oct 29 20:20:34 2002 > *************** > *** 151,156 **** > --- 151,157 ---- > > if test "x$blb_cv_c_res_init" = "xyes"; then > AC_DEFINE(HAVE_RES_INIT) > + LIBS="$LIBS -lresolv" > fi > > dnl Checks for library functions. > > That's all it took. This may work for some others that are having the > -lresolv link error. I saw where it looked like it was checking for > res_init twice, once it said yes then the next time it said no, I think what > it is doing the first time it is looking for the function definition inside > the header and the next time it is looking inside libresolv because when the > line above was added it said "yes" both times instead of "no" the second > time. I'd rather add an AC_CHECK_LIB() function. Here's a diff against the configure.in found in 1.5.23, can you check if this is ok? diff -u -r1.59 configure.in --- configure.in 28 Oct 2002 08:52:51 -0000 1.59 +++ configure.in 30 Oct 2002 13:43:50 -0000 @@ -146,7 +146,7 @@ AC_DEFINE(HAVE_O_LARGEFILE, 1) fi -AC_CACHE_CHECK(for res_init, blb_cv_c_res_init, +AC_CACHE_CHECK(for res_init in <resolv.h>, blb_cv_c_res_init, [AC_EGREP_HEADER(res_init, resolv.h, blb_cv_c_res_init=yes)]) if test "x$blb_cv_c_res_init" = "xyes"; then @@ -156,9 +156,11 @@ dnl Checks for library functions. AC_FUNC_ALLOCA AC_FUNC_VPRINTF +AC_CHECK_LIB(resolv, res_init) +dnl on Linux res_init is a macro +AC_CHECK_LIB(resolv, __res_init) AC_CHECK_LIB(door, door_create) AC_CHECK_FUNCS(select snprintf vsnprintf strerror inet_aton strncpy getutent) -AC_CHECK_FUNCS(res_init) AC_CHECK_FUNC(getopt_long,,[LIBOBJS="getopt.o getopt1.o $LIBOBJS"]) AC_CHECK_FUNC(strcasecmp,,[LIBOBJS="strcasecmp.o $LIBOBJS"]) AC_CHECK_FUNC(strptime,,[LIBOBJS="strptime.o $LIBOBJS"]) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng]centralized loghost
by Guillaume LACHENAL 30 Oct '02

30 Oct '02

/etc/nsswitch.conf is available in the jail ktrace & truss are command not found on the box, i'll search for it when not chrooted, syslog-ng correctly resolve hostnames. "Ed Ravin" <eravin(a)panix.com> Sent by: syslog-ng-admin(a)lists.balabit.hu 10/28/02 17:31 Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: Subject: Re: [syslog-ng]centralized loghost Guillaume LACHENAL writes: > As syslog-ng run chrooted, I've copied /etc/resolv.conf & /etc/hosts > into the jail. > It does not fix the issue Does your system also require /etc/nsswitch.conf in the chroot? Do a ktrace/truss on the startup in the chroot and see if it finds all the files it needs to do DNS lookups. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]centralized loghost
by Guillaume LACHENAL 30 Oct '02

30 Oct '02

name resolution can rely on /etc/hosts depending on /etc/nsswitch.conf of course. but use_dns has to be set to yes, even using only /etc/hosts for resolution (tested) "Guillaume LACHENAL" <glachenal(a)on-x.com> Sent by: syslog-ng-admin(a)lists.balabit.hu 10/24/02 22:33 Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: Subject: RE: [syslog-ng]centralized loghost OK. I'll modify it tomorrow when back at work. Is there a way hostname resolution rely on /etc/hosts ? I'll prefer this setting. Just in case the DNS suffer a DoS thanks a lot regards, Guillaume "Hamilton, Andrew" <Andrew.Hamilton(a)afccc.af.mil> Sent by: syslog-ng-admin(a)lists.balabit.hu 10/24/2002 11:52 AM AST Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: bcc: Subject: RE: [syslog-ng]centralized loghost You have use_dns(no). Therefore the value of $HOST is the IP address. If you want the hostname instead then you need to turn on the use_dns option. Regards, Drew -----Original Message----- From: Guillaume LACHENAL [mailto:glachenal@on-x.com] Sent: Thursday, October 24, 2002 11:19 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]centralized loghost I've just install syslog-ng 1.5.21 for centralizing all servers log's Here is the conf file : - - syslog-ng.conf - - options { use_dns(no); sync(0); }; source s_internal { internal(); }; source net { udp( ip(192.168.12.2) port(514) ); }; destination hosts { file( "/var/log/$HOST/$YEAR/$MONTH/$DAY/$FACILITY"\ create_dirs(yes) owner("root") group("root")\ perm(0600) dir_perm(0700) ); }; log { source(s_internal); source(net); destination(hosts); }; - - the problem is that logs go to /var/log/IP_of_$HOST/ ... Thanks for help G. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0