November 2002 - syslog-ng - lists.balabit.hu

Re: [syslog-ng]logging from a chrooted process
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

> > it would be perfect if I can write a thing like : > > > > source s_chroot { unix-stream("/chroot/*/dev/log"); }; > > I wouldn't like to implement this feature. You could write a script with the > same functionality instead that would generate you syslog-ng.conf. OK! Regards, Guillaume

1 0

internal()
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

To which facility go internal() messages ? Here is my box config : Debian Linux running provided syslogd/klogd syslog-ng 1.5.21 chrooted running as a log collector for all others box in the lan the debian provided syslogd also redirect all his messages to the log collector (this piggy conf will be cleaned soon. Only syslog-ng will stay) - - syslog-ng.conf - - options { use_dns(yes); chain_hostnames(no); sync(0); }; source s_internal { internal(); }; source s_net { udp( ip(192.168.12.2) port(514) ); }; source s_ntpd { unix-stream("/chroot/ntpd/dev/log"); }; destination d_hosts { file( "/var/log/$HOST/$YEAR/$MONTH/$DAY/$FACILITY"\ create_dirs(yes) owner("root") group("root")\ perm(0600) dir_perm(0700) ); }; log { source(s_internal); source(s_net); source(s_ntpd); destination(d_hosts); }; - - syslog-ng.conf - - when grepping syslog from /var/log/MyBox/*/*/*/* I attempted to find some messages about syslog-ng. But no the only syslog occurences found only refers to debian provided syslog Where can I find internal syslog-ng messages ? Thanks

1 0

source definition with pipe / 1.4x or 1.5x
by D. Pille 07 Nov '02

07 Nov '02

Hello Balázs, I would like to migrate our servers from syslog to syslog-ng (we´re using SuSE 5.4 to 8.1, some clustered, mostly all Internet). Can you say about the next stable release or better: Should I use 1.4x now and then I can switch over to 1.5x - without greater reconfigurations? And another questions: source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; Is this source definition enough to leave klogd behind? Is it possible to use "pipe" in this manner for other logs - like them from proftpd? It´s for me not clear how to grep a log message in a logfile to a central log-server when the source isn´t at /proc or /dev. Will "pipe" as source driver look around the file and, if a new line appears, pipe this new lines? Regards, Detlef Pille NWN-Admin -- /"\ ASCII Ribbon Campaign \ / X No HTML in / \ email & news

2 1

Re: [syslog-ng]replacing Linux klogd by a chrooted syslog-ng running as a non root user
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

Balazs Scheidler wrote : > On Thu, Nov 07, 2002 at 02:25:44PM +0100, Guillaume LACHENAL wrote: > > from http://www.campin.net/syslog-ng/faq.html > > > > As /proc/kmsg and /dev/log are outside the jail, is there a way to do the > > same thing with a chrooted syslog-ng ? > > configuration initialization is performed prior to chroot-ing, so syslog-ng > first opens the necessary devices, and then chroots itself. OK. So if I understand when using syslog-ng '-C' options there is no need that $JAIL/etc contains syslog-ng.conf. It can stay in /etc > you cannot restart the daemon though, unless you do the following: OK I've seen it. You make me not to create a new thread on the list ;-) Is it for the same reasons that I have (almost) every time to send SIGTERM *twice* for syslog-ng to terminate ? > - mount /proc under the chroot jail as well (can be mounted multiple times) > - create a symlink in /dev/log to /chroot/dev/log > > then instead of using syslog-ng's own chroot feature, use the chroot Are you sure a chrooted process can follow symlinks outside the jail ? > command, so the config initialization is performed _inside_ the jail. These > have drawbacks as well: > > - you need libc and other libs in the jail (while when starting from > outside, these are mapped from the system at startup) libc is also needed when using the '-C' switch ! ldd syslog-ng libnsl.so.1 => /lib/libnsl.so.1 (0x00126000) libc.so.6 => /lib/libc.so.6 (0x0013d000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x00110000) and I've 'discover' during my jail creation that libresolv and libnss_* are also needed (remember the thread "chroot and hostname resolution problem [was : Re: [syslog-ng]centralized loghost]") I don't think we can say it's a drawback > - /proc might provide too much information inside the jail so you might as > well run syslog-ng outside the jail ;) Exactly opposite to the secure way we try to follow ;-) > The latter problem can be solved by restricting /proc access with a patch > like openwall, and I might provide a patch for the first, to chroot first, > and then initialize. I'll check it latter, when my platform will be 100% OK and have more spare time ;-) Thanks Regards Guillaume

2 1

logging from a chrooted process
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

I'm currently trying to chroot some services on a Linux box (ntpd) strace'ing it to find the missing libs, I've seen that the process can't log as /dev/log is outside the jail > 9135 connect(4, {sin_family=AF_UNIX, path=" /dev/log"}, 16) = -1 ENOENT (No such file or directory) How to make a /dev/log into the jail ? or send the log via network to a log collector ? Thanks Regards Guillaume

2 1

replacing Linux klogd by a chrooted syslog-ng running as a non root user
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

from http://www.campin.net/syslog-ng/faq.html > Q: I want to replace syslogd *and* klogd on my Linux box with syslog-ng. > > A: Use a source line like this in your conf file to read kernel messages, too. > source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; > > Note: do not run klogd and syslog-ng fetching local kernel messages at the > same time. It may cause syslog-ng to block which makes all logging local > daemons unusable. As /proc/kmsg and /dev/log are outside the jail, is there a way to do the same thing with a chrooted syslog-ng ? Thanks Regards, Guillaume

2 1

Compile problem on Solaris (8)
by Gehring, Andrew x66132 06 Nov '02

06 Nov '02

Just downloaded 1.5.21 and libol 0.3.3. Libol compiles fine - installed into /usr/local/... I'm getting the following error with the syslog-ng compile... gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor -lfl /usr/local/lib/libol.a -lsocket -lnsl -lxnet main.o: In function `main_loop': /opt/source/syslog-ng/syslog-ng-1.5.21/src/main.c:225: undefined reference to `res_init' Anyone else seen this? Direction? TIA Andrew

2 1

Problem of recording
by Stefano Tanfoglio 06 Nov '02

06 Nov '02

I am Stefano Tanfoglio, I work from one bank in Italy. I use syslog-ng for archive the log of 176 computer. ( 2 router - 125 windows server - 51 linux server ). In Windows server i use ntsyslog service. protocol = udp destination server = ip syslog-ng server destination port = 514 Ntsyslog send all log In Linux server i use the syslog auth.* @syslog01.xxxx.it authpriv.* @syslog01.xxxx.it kernel.=err;kernel.=warn @syslog01.xxxx.it mail.=err;mail.=warn @syslog01.xxxx.it daemon.=err;daemon.=warn @syslog01.xxxx.it local7.=err;local7.=warn @syslog01.xxxx.it ... ... Configuratione syslong-ng.conf: Versione: syslog-ng-1.4.14-2mdk options { sync (0); time_reopen (10); log_fifo_size (3000); long_hostnames (on); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); }; source remote { udp(); }; destination linux { file("/var/log/HOSTS/LINUX/$HOST/$FACILITY" dir_perm(0755) perm(0655)); }; destination windows { file("/var/log/HOSTS/WINDOWS/$HOST/$FACILITY" dir_perm(0755) perm(0655)); }; destination router { file("/var/log/HOSTS/ROUTER/$HOST/$FACILITY" dir_perm(0755) perm(0655)); }; filter f_linux { host("name1.domain.tld|name2.domain.tld|name3.domain.tld|...........|51"); } ; filter f_windows { host("name1.domain.tld|name2.domain.tld|name3.domain.tld|...........|125"); }; filter f_router { host("name1.domain.tld|name2.domain.tld"); }; log { source(remote); filter(f_linux); destination(linux); }; log { source(remote); filter(f_windows); destination(windows); }; log { source(remote); filter(f_router); destination(router); }; Problem: 1) In the windows section I have 125 machine and only 80 recording. I try to move the last hostname in first position: filter f_windows { host("125|name1.domain.tld|name2.domain.tld|name3.domain.tld|...........|124 "); }; the test it ok, hostname logger and recording. 2)Every 10-15 minutes the syslog-ng system it down. 3) I try the new version but I have not obtained the positive information. 4) I have modified the syslog-ng.conf: .... .... destination tem { file("/var/log/HOSTS/ALL/$HOST" dir_perm(0755) perm(0655)); }; ... ... ... log { source(remote); destination(tem); }; .. .. The all machine recording and the server don' t crash with this solution. I don't try the DB recording. Thanks for the collaboration. Stefano Tanfoglio Assyrus Srl www.assyrus.it ICQ:146827274

3 2

Re: chroot and hostname resolution problem [was : Re: [syslog-ng]centralized
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

The last missing lib was : 8677 open("/lib/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) Thanks to all who helped me. But as I'm just starting playing with syslog-ng, I think I'll be back quickly with some other questions ... ;-) Regards, Guillaume - - - Balazs Scheidler wrote : (snip) > those files are loaded dynamically by the libc ok I now understand better > do you have resolv.conf/host.conf ? You're right ! 8561 open("/etc/resolv.conf", O_RDONLY) = 5 8561 open("/etc/host.conf", O_RDONLY) = -1 ENOENT (No such file or directory) question : what's the difference, in name resolution process, between /etc/hosts.conf and /etc/nsswitch.conf my updated config : $JAIL/etc/resolv.conf is ok and working (tested outside the jail) $JAIL/etc/nsswitch.conf contain "hosts: dns" $JAIL/etc/hosts.conf contain "order bind" syslog-ng continue to resolve hostnames only if they are in $JAIL/etc/hosts

1 0

Re: chroot and hostname resolution problem [was : Re: [syslog-ng]centralized
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

Gregor Binder wrote : > Msg from Guillaume LACHENAL: > > Hi Guillaume, > > > and I suppose those libs are needed by the resolver ... > > most likely :) > > > Why 'ldd syslog-ng' does not reported this two files ? > > (nor ldd on the libs returned by the previous commands) > > You might find them if you continue to search recursively through the > results. This is what I've done ! : G> nor ldd on the libs returned by the previous command > > > How could I 'guessed' that I need to copy this files into the jail ? > > I've set up quite a few chroots for all kinds of services. Experience > says, that guessing (i.e. trying to figure out in advance) will usually > only save you the first few trace-sessions but almost never make the > chrooted service work 100% right away. Ok > > Althougt my $JAIL/etc/nsswitch.conf contains "hosts dns", > > hostnames are only resolved if they are in $JAIL/etc/hosts ! > > Amazing ... > > As you seem to start having fun with process tracing, try to find out > where resolving fails, or if it is attempted at all. I'm on this way ! > Regards, > Gregor.

2 1