May 2002 - syslog-ng - lists.balabit.hu

How to get logs from firewall through syslog-ng
by Krishna 15 May '02

15 May '02

Hi, Wednesday, May 15, 2002 1:02:10 PM I am using syslog-ng 1.4.14 . I want to know how I should configure syslog-ng to get logs from firewall. I am using RedHat6.0 Please Help -- regards, Krishna mailto:Krishna_shekhar@gmx.net Krishna Shekhar Network Administrator Wiplash.Net ___ __________________________________________ __ __ | / /___ _/__ __ \__ /___ |_ ___/__ / / / __ | /| / / __ / __ /_/ /_ / __ /| |____ \__ /_/ / __ |/ |/ / __/ / _ ____/_ /___ ___ |___/ /_ __ / ____/|__/ /___/ /_/ /_____/_/ |_/____/ /_/ /_/ http://Wiplash2000.com

1 0

syslog-ng doesn't re-open the TCP connection - resolved
by Rosenberg, Relu (Exchange) 14 May '02

14 May '02

This was an OS patching issue, not related with syslog-ng Relu Rosenberg *********************************************************************** Bear Stearns is not responsible for any recommendation, solicitation, offer or agreement or any information about any transaction, customer account or account activity contained in this communication. ***********************************************************************

1 0

RE: [syslog-ng]syslog-ng + Snort RESOLVED
by Elton Ramos Carvalho 14 May '02

14 May '02

Folksm, I resolved my problem removing LOG_ALERT from snort configuration file. ;o) -----Original Message----- From: Elton Ramos Carvalho [mailto:elton_carvalho@datasul.com.br] Sent: Tuesday, May 14, 2002 9:56 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng + Snort Hi, The syslog-ng don't log any alert of snort. I'm using syslog-ng-1.5.17 and the configuration file syslog-ng.conf.sample tha come with it. The syslog is loging all snort alerts without problem. I'm using snort with -s option and LOG_ATHPRIV and LOG_ALERT in configuration file Tks

1 0

syslog-ng + Snort
by Elton Ramos Carvalho 14 May '02

14 May '02

Hi, The syslog-ng don't log any alert of snort. I'm using syslog-ng-1.5.17 and the configuration file syslog-ng.conf.sample tha come with it. The syslog is loging all snort alerts without problem. I'm using snort with -s option and LOG_ATHPRIV and LOG_ALERT in configuration file Tks

1 0

Forwarding syslog messages via UDP not working , help with config file please.
by Subodh Nijsure 13 May '02

13 May '02

Hello, I have following statement in my config file destination udp_forw { udp("192.168.58.150", port(514)); }; log { source(blade17) ; destination(blade17log) ; destination(udp_forw); }; What I observe is the messages are getting logged to local file, but the remote syslog daemon doesn't receive those messages. The remote syslogd is not syslog-ng its a standard syslogd. /Subodh Nijsure

2 1

Problem with syslog-ng on HP-UX 11.0
by dcntrnoc＠cmp.com 08 May '02

08 May '02

Hi all, I have been running syslog-ng on a handful of Solaris boxes for some time now with no problems, and am attempting to get it running on HP-UX. I have compiled (with gcc) and installed syslog-ng 1.5.16 and libol 0.3.2 on a system running HP-UX 11.00. I am using the following source statement in my config file: source s_sys { pipe("/dev/log"); internal(); }; The filters are based on facility. It seems that the only readable output in the destination files come from either the internal source (ex. May 7 17:47:24 myhost syslog-ng[5675]: SIGHUP received, restarting syslog-ng), or from a message I sent via logger. The rest of the output looks like this: May 7 17:48:22 myhost ^F May 7 17:48:22 myhost ^B May 7 17:48:22 myhost ^B May 7 17:48:22 myhost À^_'^SÀ^_'^S^?|Fä May 7 17:48:22 myhost ^?~^U` May 7 17:48:22 myhost ^?|Fä May 7 17:48:22 myhost ^?|Fä^?|FäÀ^Ve{À^XAW May 7 17:48:22 myhost ^?|Ç@ May 7 17:48:22 myhost >@^?{à May 7 17:48:22 myhost ^O May 7 17:48:22 myhost ^A May 7 17:48:22 myhost ^?|Fä^?|FäÀ^_Î^[À^X¯^_ May 7 17:48:22 myhost ^D^?~^U`^?{à May 7 17:48:22 myhost May 7 17:48:22 myhost ^A May 7 17:48:22 myhost ^?|Fä^?|FäÀ^_Õs May 7 17:48:22 myhost ^?|Fä May 7 17:48:22 myhost À^XD» May 7 17:48:22 myhost @ May 7 17:48:22 myhost >@^?|¿À^?{à May 7 17:48:22 myhost À^XA May 7 17:48:22 myhost ^A^?|¡À May 7 17:48:22 myhost ^B^?|¡ÔÀ^S«H May 7 17:48:22 myhost ^?|Fä May 7 17:48:22 myhost À^X^[wÀ E¯ May 7 17:48:22 myhost ^?|¿ÀÀ^Wåp Any ideas? I don't know quite what to make of this. Thanks, Sharon. __________________________________________________________________________________________ Any views or opinions are solely those of the author and do not necessarily represent those of CMP Media. The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. If you are not the intended recipient of this message please do not read, copy, use or disclose this communication and notify the sender immediately. It should be noted that any review, retransmission, dissemination or other use of, or taking action or reliance upon, this information by persons or entities other than the intended recipient is prohibited. __________________________________________________________________________________________

1 0

syslog-ng doesn't re-open the TCP connection
by Rosenberg, Relu (Exchange) 08 May '02

08 May '02

This is syslog-ng 1.4.13 on Solaris 8, reading from named pipe and sending over tcp to a central server syslog-ng. Configuration file: options { long_hostnames (on) ; use_dns (no) ; use_fqdn (yes) ; keep_hostname (yes) ; chain_hostnames (no) ; log_fifo_size(1000) ; } ; source s_pipe { pipe ("/tmp/.syslog-ng.pipe") ; internal () ; } ; destination d_tcp { tcp (remote_host port(2222)) ; } ; log { source (s_pipe) ; destination (d_tcp) ; } ; In order not to replace the syslog I tail the /var/adm/messages and redirect into the /tmp/.syslog-ng.pipe. Syslog-ng is reading the pipe and sending to remote syslog-ng over tcp. At a point in time it stopped sending messages, doesn't try to re-open the lost TCP connection. The connection may have been lost due to network outage or maintenance work, but it should reopen. This happens to over 10 clients, I have over 300 working this way. The truss output shows the read of new messages from named pipe, but no attempt to write, or to re-open the connection to the remote server 51/1: poll(0xFFBEFB10, 2, 60000) = 1 351/1: read(3, " M a y 7 1 8 : 2 8".., 1024) = 70 351/1: time() = 1020810505 351/1: time() = 1020810505 351/1: time() = 1020810505 351/1: time() = 1020810505 351/1: poll(0xFFBEFB10, 2, 100) = 0 351/1: poll(0xFFBEFB10, 2, 60000) (sleeping...) 351/2: signotifywait() (sleeping...) 351/3: lwp_cond_wait(0xFF0F55B0, 0xFF0F55C0, 0xFF1F5C48) (sleeping...) thanks Relu Rosenberg **************************************************************** Bear Stearns is not responsible for any recommendation, solicitation, offer or agreement or any information about any transaction, customer account or account activity contained in this communication. ***********************************************************************

1 0

where is ftp location for syslog-ng
by Steve Cobrin 08 May '02

08 May '02

Hi there, I'm interested in experimenting with syslog-ng. I usually much prefer to download software using ftp rather than http. Is there a main ftp site or mirror site.? The syslog-ng web page refers to ftp://ftp.fsn.hu/pub/syslog-ng but I have been unable to connect to the site since January, with the site complaining that the directory doesn't have read permission. Can anybody help? -- Steve

1 0

Syslog Dropping Information
by Jim Gifford 07 May '02

07 May '02

I have noticed over the last few weeks, that it seems that I have been dropping information from the kernel log. I am not sure if it is my configuration. I have tried two different ways of accessing information from /proc/kmsg. I have tried pipe without klogd. I have tried file with klogd. It seems to happen at random times. Here is my system information. Linux 2.4.18 Syslog-ng 1.5.17 Here is a copy of my config. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames(off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source src { unix-stream("/dev/log"); internal(); file("/proc/kmsg"); }; destination authlog { file("/var/log/authorize.log"); }; destination syslog { file("/var/log/syslog.log"); }; destination fcron { file("/var/log/fcron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kernel { file("/var/log/kernel.log"); }; destination cups { file("/var/log/cups.log"); }; destination user { file("/var/log/user.log"); }; destination mail { file("/var/log/mail.log"); }; destination fetchmail { file("/var/log/fetchmail.log"); }; destination news { file("/var/log/news.log"); }; destination debug { file("/var/log/debug.log"); }; destination messages { file("/var/log/messages.log"); }; destination everything { file("/var/log/everything.log"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; destination iptables { file("/var/log/iptables.log"); }; destination hacker { file("/var/log/hacker.log"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_fcron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kernel { facility(kern); }; filter f_cups { facility(lpr); }; filter f_mail { facility(mail); }; filter f_fetchmail { match("fetchmail"); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_everything { level(debug..emerg); }; filter f_iptables { match("IN="); }; filter f_hacker { match("Hacker"); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_fcron); destination(fcron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kernel); destination(kernel); }; log { source(src); filter(f_cups); destination(cups); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_fetchmail); destination(fetchmail); }; log { source(src); filter(f_news); destination(news); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(f_everything); destination(everything); }; log { source(src); filter(f_iptables); destination(iptables); }; log { source(src); filter(f_hacker); destination(hacker); }; log { source(src); destination(console_all); };

3 3

Year problems?
by William Yodlowsky 06 May '02

06 May '02

I haven't seen this one before. Running syslog-ng 1.5.13 on Solaris 8 64bit. It only handles logs locally for that one machine (config below). The problem: when the logfiles rolled over to May, I ended up with two logfiles for May 1: a "maillog-05-01-2001" and "maillog-05-01-2002". I know the file isn't simply leftover from last year, because this box didn't exist last year. :) Oddly enough, it seems that the 2001 file was used for May 1 up until 3:59am, and at 4:00am the 2002 file picks up where it left off. The machine has no crontabs that run at 4am (or 3am for that matter). No one logged in and did anything. Any ideas at all? Thanks in advance... syslog-ng.conf: --------------- options { long_hostnames(off); keep_hostname(yes); use_dns(no); }; source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination mail { file("/var/log/maillog-$MONTH-$DAY-$YEAR" create_dirs(yes)); }; destination others { file("/var/log/messages-$YEAR-$MONTH" create_dirs(yes)); }; filter mail { program("postfix") or program("amavis") or program("amavisd"); }; filter others { not program("postfix"); }; log { source(src); filter(mail); destination(mail); }; log { source(src); filter(others); destination(others);};

2 2