December 2002 - syslog-ng - lists.balabit.hu

sshd2 logging needed
by wolverine 10 Dec '02

10 Dec '02

Hello, I have spent the last day hacking around with syslog-ng, and thinks is great. I have just one problem that I have not found an answer to in searching google. I am having difficulty getting it to pick up the entries from sshd2. I have sshd2 set up for SyslogFacility AUTH, and get authentication attempts logged in /var/log/secure using the standard logger, but cannot get them picked up by syslog-ng. I have tried some of the various filters that I have found, but still no information shows up. Anyone have this working? syslog-ng version 1.4.17 Mandrake 8.1, 8.2, 9.0, SSH 3.2.2 At this point, just getting it to log local is fine, as I have been able to get logs to be sent using stunnel, but pretty much gutted the configs down to get this working. Thanks go out to all for syslog-ng and for their support. -Wolverine

3 4

syslog-ng server
by Razham, Razak 10 Dec '02

10 Dec '02

Hi, I kinda new to this list and syslog-ng too. I need to build a syslog server. The syslog server will do the logging for 3 snort machine, 2 web server, 2 mail server and maybe another 2 squid. I am wondering what kind of server requirement, ie, processor, RAM, hdd space etc I am looking in. thanks. am

1 0

RE: [syslog-ng]no startup
by Hamilton, Andrew 09 Dec '02

09 Dec '02

filter f_filter7 has a stray ; there should be no semicolon before the and. Regards, Drew -----Original Message----- From: sergioajr(a)ig.com.br [mailto:sergioajr@ig.com.br] Sent: Saturday, December 07, 2002 2:09 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]no startup Hello all, I am nothing statup syslog-ng. This is program return error on runing script of start: Starting syslog-ng: parse error at 38 Parse error reading configuration file, exiting. My conf file content: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source stdlog { unix-stream("/dev/log"); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(mail); and not match("[pP]op3|[pP]op"); }; log { source(stdlog); filter(f_filter1); destination(d_cons); }; log { source(stdlog); filter(f_filter2); destination(d_mesg); }; log { source(stdlog); filter(f_filter3); destination(d_auth); }; log { source(stdlog); filter(f_filter4); destination(d_mail); }; log { source(stdlog); filter(f_filter5); destination(d_mlal); }; log { source(stdlog); filter(f_filter6); destination(d_spol); }; Please, how to resolving problem? Thanks a lot P.S.: sorry my bad english. []'s ========================================== Sergio A Lima Jr. Support Analist GNU/Linux-FreeBSD Sistemas ========================================== _________________________________________________________ Voce quer um iGMail protegido contra vírus e spams? Clique aqui: http://www.igmailseguro.ig.com.br _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Parse error on line 1 (no change after update)
by Wes Hall 08 Dec '02

08 Dec '02

I think that was it. I set list in vi and cleaned out some characters but that didn't fix the problem. There must be something else hiding in there. Anyway I started typing the file in from scratch, It's probably quicker that way. I orginally thought my syntax was wrong. Thanks for your help everyone. wes

1 0

no startup
by sergioajr＠ig.com.br 07 Dec '02

07 Dec '02

Hello all, I am nothing statup syslog-ng. This is program return error on runing script of start: Starting syslog-ng: parse error at 38 Parse error reading configuration file, exiting. My conf file content: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source stdlog { unix-stream("/dev/log"); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(mail); and not match("[pP]op3|[pP]op"); }; log { source(stdlog); filter(f_filter1); destination(d_cons); }; log { source(stdlog); filter(f_filter2); destination(d_mesg); }; log { source(stdlog); filter(f_filter3); destination(d_auth); }; log { source(stdlog); filter(f_filter4); destination(d_mail); }; log { source(stdlog); filter(f_filter5); destination(d_mlal); }; log { source(stdlog); filter(f_filter6); destination(d_spol); }; Please, how to resolving problem? Thanks a lot P.S.: sorry my bad english. []'s ========================================== Sergio A Lima Jr. Support Analist GNU/Linux-FreeBSD Sistemas ========================================== _________________________________________________________ Voce quer um iGMail protegido contra vírus e spams? Clique aqui: http://www.igmailseguro.ig.com.br

1 0

config question
by Jackson, Aaron D. (OCTO) 07 Dec '02

07 Dec '02

I have syslog-ng installed on several Solaris 8 machines and it is working fine. The other day an application (Cisco Secure) blew up and started generating millions of the following log messages in a very short period: Dec 4 15:34:31 acs CiscoSecure: [ID 310893 local0.error] ERROR - error on accept # cat local0.log | grep 'ERROR - error on' | wc -l 13578934 The log file is 1GB in size and is too big to really browse through it. This situation happened once before when I was using the Solaris syslog server, however instead of logging all the messages Cisco Secure generated, it had log entries something like: Dec 4 15:34:31 acs CiscoSecure: [ID 310893 local0.error] ERROR - error on accept Last message repeated 100,000 times. Is there a way to get syslog-ng to do this? I looked through the docs, but didn't see a way. Thanks. Aaron

2 1

Parse error on line 1 (no change after update)
by wes 06 Dec '02

06 Dec '02

Well it must be something on my system that is odd. See new attempt after install of 1.5.23 below. Any ideas? Is there any debug info I can use to track down the parse error? Wes [root@EARTH syslog-ng]# cat syslog-ng.conf #options { sync(0); }; source src { udp(); internal(); }; destination misc{file("/var/log/misc");}; log{source(src); destination (misc);}; [root@EARTH syslog-ng]# /usr/local/sbin/syslog-ng -v -d -f /etc/syslog-ng/syslog -ng.conf parse error at 2 Parse error reading configuration file, exiting. (line 2)

2 1

Parse error on line 1
by wes 06 Dec '02

06 Dec '02

Yep looks like the right file. If I edit it I can move the parse error. I'll rebuild syslog-ng from scratch and see if that works. Wes Version:1.4.17 OS: Mandrake 2.4.8-34.1mdk Screen dump of 2nd try: [root@EARTH syslog-ng]# cat syslog-ng.conf options { sync(0); }; source src { udp(); internal(); }; destination misc{file("/var/log/misc");}; log{source(src); destination (misc);}; [root@EARTH syslog-ng]# whereis syslog-ng syslog-ng: /etc/syslog-ng /usr/local/sbin/syslog-ng [root@EARTH syslog-ng]# /usr/local/sbin/syslog-ng -v -d -f /etc/syslog-ng/syslog-ng.conf parse error at 1 Parse error reading configuration file, exiting. [root@EARTH syslog-ng]# cat syslog syslog-ng.conf syslog-ng.conf.old [root@EARTH syslog-ng]# cat syslog-ng.conf options { sync(0); }; source src { udp(); internal(); }; destination misc{file("/var/log/misc");}; log{source(src); destination (misc);}; [root@EARTH syslog-ng]# vi sy syslog-ng.conf syslog-ng.conf.old [root@EARTH syslog-ng]# vi syslog-ng.conf [root@EARTH syslog-ng]# /usr/local/sbin/syslog-ng -v -d -f /etc/syslog-ng/syslog -ng.conf parse error at 2 Parse error reading configuration file, exiting. [root@EARTH syslog-ng]# cat syslog-ng.conf #options { sync(0); }; source src { udp(); internal(); }; destination misc{file("/var/log/misc");}; log{source(src); destination (misc);}; [root@EARTH syslog-ng]#

2 1

Re: [syslog-ng]Chrooted syslog-ng and DNS in Solaris 8
by Guillaume LACHENAL 06 Dec '02

06 Dec '02

assuming solaris lib names are almost the same as my linux box, you need : aludra:/chroot/syslog-ng/lib# ls -l total 252 -rwxr-xr-x 1 root root 85654 Aug 14 13:37 ld-2.1.3.so lrwxrwxrwx 1 root root 11 Aug 14 13:38 ld-linux.so.2 -> ld-2.1.3.so -rw-r--r-- 1 root root 76032 Oct 30 12:01 libnsl-2.1.3.so lrwxrwxrwx 1 root root 15 Aug 14 13:36 libnsl.so.1 -> libnsl-2.1.3.so -rw-r--r-- 1 root root 11452 Nov 6 12:01 libnss_dns-2.1.3.so lrwxrwxrwx 1 root root 19 Nov 6 12:02 libnss_dns.so.2 -> libnss_dns-2.1.3.so -rw-r--r-- 1 root root 31084 Nov 6 12:01 libnss_files-2.1.3.so lrwxrwxrwx 1 root root 21 Nov 6 12:02 libnss_files.so.2 -> libnss_files-2.1.3.so -rw-r--r-- 1 root root 46624 Nov 6 15:23 libresolv-2.1.3.so lrwxrwxrwx 1 root root 18 Nov 6 15:23 libresolv.so.2 -> libresolv-2.1.3.so aludra:/chroot/syslog-ng/lib# libnss_dns / libnssfiles depends on your $CHROOT/etc/host.conf / $CHROOT/etc/nsswitch.conf regards, Guillaume henriksa(a)telia.com Sent by: syslog-ng-admin(a)lists.balabit.hu 12/06/02 14:45 Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: Subject: [syslog-ng]Chrooted syslog-ng and DNS in Solaris 8 I saw there was a discussion about this last month but that was a bit messy so I was wondering if someone could explain this a little better to me. What files do I need to copy to the chroot jail in Solaris 8 so that syslog-ng can resolve hostnames when use_dns(yes) is used? /Henrik _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Chrooted syslog-ng and DNS in Solaris 8
by henriksa＠telia.com 06 Dec '02

06 Dec '02

I saw there was a discussion about this last month but that was a bit messy so I was wondering if someone could explain this a little better to me. What files do I need to copy to the chroot jail in Solaris 8 so that syslog-ng can resolve hostnames when use_dns(yes) is used? /Henrik

1 0