June 2002 - syslog-ng - lists.balabit.hu

Multi filters
by Sofox 18 Jun '02

18 Jun '02

Hi, I am playing with syslog-ng, it seems that config log{ source(src); filter(filterA); filter(filterB); destination(dest); } means log those messages which satisfy both filterA and filterB to dest, am I right? now the question is if i want log messages satisfy filterA or filterB to dest, how should I write the config? Oscar Yen.

2 1

Re: [syslog-ng]BUG: Number in Hostnames?
by Jonathan Marchand 17 Jun '02

17 Jun '02

Balazs, On both hosts the DNS lookup and reverse lookup are working fine: Name: nexus1.webnet.qc.ca Address: 209.71.224.10 And reverse: 10.224.71.209.in-addr.arpa name = nexus1.webnet.qc.ca. Also, I added the line: 209.71.224.10 nexus1.webnet.qc.ca nexus1 to /etc/hosts on both hosts. I did try to sniff the traffic using tcpdump, I used "sniff" to translate the output from hex to ascii. However, the messages were fine but the hostname was not translated properly, it was still hex codes. You know a tool I could use to reliably sniff and translate syslog traffic? Thanks, Jonathan. > > ----- Original Message ----- > From: "Balazs Scheidler" <bazsi(a)balabit.hu> > To: <syslog-ng(a)lists.balabit.hu> > Sent: Monday, June 17, 2002 1:02 PM > Subject: Re: [syslog-ng]BUG: Number in Hostnames? > > > > On Mon, Jun 17, 2002 at 12:05:07PM -0400, Jonathan wrote: > > > Hi, > > > > > > I've been toying a bit with syslog-ng, I'm quite happy so far with all > the > > > possibilities it offer me. But I got a problem getting it to work in my > > > environment. > > > > > > I want to log normal syslogd machines to a LogHost which would run > > > syslog-ng. I've installed syslog-ng 1.5.18 on my LogHost and ran a few > > > tests. > > > > > > With this config: > > > > > > options { sync (0); > > > time_reopen (10); > > > log_fifo_size (1000); > > > long_hostnames (no); > > > chain_hostnames (no); > > > use_dns (no); > > > use_fqdn (no); > > > create_dirs (no); > > > keep_hostname (yes); > > > }; > > > > > > source s_sys { unix-stream ("/dev/log"); internal(); > > > udp (ip(209.71.224.21) port (514)); }; > > > destination mail1 { file("/var/log/mail1"); }; > > > filter filter_mail1 { host("mail1");}; > > > log { source(s_sys); filter(filter_mail1); destination(mail1); }; > > > > > > As you can see, I want to log a host named "mail1" to a file "mail1". > > > However, it doesn't work. The host send its log entries syslog-ng but > > > doesn't recognize "mail1". > > > > > > But, if I change the host("mail1") to host("mail"), it work perfectly. > The > > > hostname in the /var/log/mail1 file is "mail" tho, not "mail1". > > > > > > I ran syslogd into debug mode on my "mail1" machine. I saw it does send > the > > > logs out with the "mail1" tag. > > > > > > I tried this with another of my host, its name is nexus1, I experienced > the > > > same behavior. > > > > > > So, I'm wondering if syslog-ng doesn't like having a number at the end > of > > > the hostname. > > > > > > The hosts running syslogd are RedHat 7.2 and 7.1. > > > > > > Any ideas? :) I'd like to get this working, all my hostnames got > numbers.... > > > > hmm.. I don't care if hostnames contain numbers or not. Does reverse DNS > of > > those hosts contain the correct name (with the number ?) > > > > You could sniff your network interface to see if the hostname is really > > present. (sometimes it is missing, and is added by syslog-ng based on the > > DNS name of the host) > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > > >

1 0

BUG: Number in Hostnames?
by Jonathan 17 Jun '02

17 Jun '02

Hi, I've been toying a bit with syslog-ng, I'm quite happy so far with all the possibilities it offer me. But I got a problem getting it to work in my environment. I want to log normal syslogd machines to a LogHost which would run syslog-ng. I've installed syslog-ng 1.5.18 on my LogHost and ran a few tests. With this config: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (no); chain_hostnames (no); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); udp (ip(209.71.224.21) port (514)); }; destination mail1 { file("/var/log/mail1"); }; filter filter_mail1 { host("mail1");}; log { source(s_sys); filter(filter_mail1); destination(mail1); }; As you can see, I want to log a host named "mail1" to a file "mail1". However, it doesn't work. The host send its log entries syslog-ng but doesn't recognize "mail1". But, if I change the host("mail1") to host("mail"), it work perfectly. The hostname in the /var/log/mail1 file is "mail" tho, not "mail1". I ran syslogd into debug mode on my "mail1" machine. I saw it does send the logs out with the "mail1" tag. I tried this with another of my host, its name is nexus1, I experienced the same behavior. So, I'm wondering if syslog-ng doesn't like having a number at the end of the hostname. The hosts running syslogd are RedHat 7.2 and 7.1. Any ideas? :) I'd like to get this working, all my hostnames got numbers.... Thanks! Jonathan.

2 1

again: qmgr stops logging
by Florian Kessler 15 Jun '02

15 Jun '02

Hi all, i discussed an obviously well-known problem on postfix-users yesterday: me: > Hi all, > > i'm using debian/testing with postfix and syslog-ng here. > I have the same problems a lot of people (i.e. Othmar, > http://archives.neohapsis.com/archives/postfix/2000-12/0432.html) have > had long time before: > > qmgr entries are all missing in log after restarting syslog(-ng)! > > The only proposal to solve the problem i could find on the web is to > update syslogd > I've tried syslog-ng/unstable and sysklogd, but this didn't solve the > problem. > > Any other hints? > > Thanks in advance, > Florian Wietse and Varadi: -specify an extra logging socket: not done, because i´m not using chrooted postfix! -update to syslog-ng 1.5.15: done -try SIGHUP instead of restart: done but i keep loosing qmgr messages after a syslog-ng restart/reload in the meantime i updated my system to postfix from unstable (mail_version = 1.1.7) Wietses final word: > There's little Postfix can do about it. > > The syslog() CLIENT code is part of your system library. Some > syslog() implementations will attempt to reconnect when they find > out that the server is disconnected. > > Wietse So, any hints? Thanks in advance, Florian

1 0

Error when compiling with tcp-wrappers
by Jim Gifford 14 Jun '02

14 Jun '02

When I compile with the option --enable-tcp-wrapper, I get the following error. afinet.o: In function `do_open_afinet_connection': afinet.o(.text+0x38b): undefined reference to `request_init' afinet.o(.text+0x394): undefined reference to `sock_host' afinet.o(.text+0x39c): undefined reference to `hosts_access' collect2: ld returned 1 exit status I have enclosed the error.log and a copy of the makefile. Any ideas??

4 13

syslog-ng on Solaris
by Matthew C Valites 14 Jun '02

14 Jun '02

I'm using syslog-ng over stunnel to log to a remote mysql database. I have it working perfectly on all my linux machines, but when I attempt to go over to Solaris, I run into problems. I have recompiled with the "--enable-sun-streams" and "--enable-sun-door" and edited my conf file, and this is the error I get when I try to run syslog-ng: root@diamond: syslog-ng -Fv do_init_afstreams_source: Cannot enable console logging on sun-stream /var/log (Inappropriate ioctl for device) Error initializing configuration, exiting. This is my syslog-ng.conf file: # # Syslog-ng example configuration for for Debian GNU/Linux # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # options { sync(2); time_reopen (10); long_hostnames (off); use_fqdn (no); keep_hostname (yes); #use_dns(yes); }; ###source lets your receive messages source src { sun-streams("/var/log"); }; destination cron { file("/var/log/cron.log"); }; destination mail { file("/var/log/mail.log"); }; destination messages { file("/var/adm/messages"); }; destination sysmsg { file("/var/log/messages"); }; destination authlog { file("/var/log/authlog"); }; destination syslog { file("/var/log/syslog-ng"); }; destination local0 { file("/var/log/local0"); }; destination local1 { file("/var/log/local1"); }; destination local2 { file("/var/log/local2"); }; destination local3 { file("/var/log/local3"); }; destination local4 { file("/var/log/local4"); }; destination local5 { file("/var/log/local5"); }; destination local6 { file("/var/log/local6"); }; destination local7 { file("/var/log/local7"); }; destination staley { tcp("127.0.0.1" port(2220)); }; filter f_auth { facility(auth); }; filter f_kern { facility(kern); }; filter f_cron { facility(cron); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_alert { level(alert); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_debug { level(debug); }; filter f_syslog { level(info) and not facility(mail); }; ################################################################################# set up logging to a loghost (staley) forwarded from localhost via stunnel # as defined at top of file: # destination staley { tcp("127.0.0.1" port(2221)); }; ################################################################################ #Logging to Paskow for testing purposes log { source(src); filter(f_err); destination(staley); }; log { source(src); filter(f_notice); destination(staley); }; log { source(src); filter(f_alert); destination(staley); }; log { source(src); filter(f_mail); filter(f_info); destination(staley); }; log { source(src); filter(f_info); destination(staley); }; #Logging all local.debug to Paskow for testing purposes log { source(src); filter(f_local0); filter(f_debug); destination(staley); }; log { source(src); filter(f_local1); filter(f_debug); destination(staley); }; log { source(src); filter(f_local2); filter(f_debug); destination(staley); }; log { source(src); filter(f_local3); filter(f_debug); destination(staley); }; log { source(src); filter(f_local4); filter(f_debug); destination(staley); }; log { source(src); filter(f_local5); filter(f_debug); destination(staley); }; log { source(src); filter(f_local6); filter(f_debug); destination(staley); }; I had the doors option in the destination src, but there's no doors file on my machine. I'd appreciate any help that anybody can provide. I will be extremely grateful if this works. ~Matt Valites Unix Admin Banta-IM

2 5

option use_dns & use_fqdn problem with syslog-ng tcp connection t o syslog-ng?
by Russo, Ben 14 Jun '02

14 Jun '02

syslog-ng 1.5.18 with libol 0.3.3 on RedHat 7.3 i386 EXCERPTS FROM syslog-ng.conf options { long_hostnames (on); use_dns (yes); use_fqdn (yes); keep_hostname (no); }; destination d_files { file("/var/log/syslog-ng/$HOST/$FACILITY.$LEVEL" template("$ISODATE $HOST $FACILITY $PRIORITY $PROCESS $MSG\n")); }; For network nodes using OLD syslog daeomons that send using UDP (solaris, HP-UX, Linux etc...) The $HOST value is the FQDN as defined in in DNS reverse lookup. However if I have syslog-ng on a remote box and it uses a TCP connection to my central syslog receiver then the hostname is missing the domain? I have lots of servers named "dns1" or "www" so this becomes a problem. Am I missing an option somewhere? Thanks, -Ben.

2 2

Re: syslog-ng / libol Solaris 8 and Sun CC
by Balazs Scheidler 14 Jun '02

14 Jun '02

On Thu, Jun 13, 2002 at 12:02:43PM -0500, Luc I. Suryo wrote: > Hello, > > Are the sourecs based solley on GNU tools? I've never had anything else than GNU tools. > Compile give me some issue, can solve them be wondering, could you help > me with these questions? > > 1) -Wall -O2 in configure(in): works only for GCC under CC one can/should use -O > so why not a check against GCC and then set teh flags OR get it > from the variable set? CC=cc CFLAGS="-.." ./configure? it should get CFLAGS from the environment, if it doesn't it's a bug. > > > 2) alloca : from the man pages: > The alloca() function is machine-, compiler-, and most of > all, system-dependent. Its use is strongly discouraged. > > any reason not using a diff call? alloca allocates space on the stack, just like an automatic variable would. of course malloc() can also be used, but then the allocated block must be freed explicitly. So it was used for simplicity, I didn't know it was not portable. > > 3) utils / make_class(in) : need a defined (by location & found) > of the variable _SCSH_, what is this variable?, the file/script > is not a csh one so it has to be something else :), so what is > this and do i need it? it is scsh aka scheme shell, you only need this if you change the class declarations. read the end of README where it is described what it is. > 4) not sure but don't you think syslog-ng should always be > compiled against a static lib. instead of a shared? but that is no > compile issue, more looking into securtity, just my 2c it is linked statically against libol, but if you install libol first, it can also link to it dynamically. libc is linked dynamically. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Square Brackets in match()
by Clayton L. Scott 14 Jun '02

14 Jun '02

Syslog-ng: 1.5.18 and 1.4.11 If I have a message that looks like this: Jun 3 00:16:52 X.X.X.X/X.X.X.X rido-ott[System]: request for unserviced tcp:X.X.X.X-25 from X.X.X.X denied if I want to match this part [System]: request for unserviced I have to leave out the leading '['. eg match("[System]: request for unserviced") will not but match("System]: request for unserviced") will Is this a bug in the matching grammar? If I used normal regexp syntax and escape the '[' as in '\[' is stiil won't work. Clayton PS Thanks Balazs for your anwsers to my last question and for syslog-ng

2 1

Strange behaviour in syslog-ng file creation.
by Luca Villani 13 Jun '02

13 Jun '02

Hi all. First, I'm sorry: I'm afraid my english is very poor. :-| Actually we run a medium log server, with a dozen of host logging on it via tcp. syslog-ng is 1.4.15, OS is Linux RedHat 7.2. We find some trouble in file creation: we want syslog-ng create files with an user, a group and a bitmask, but it fail in bitmap setting for some files and do it successfuly for other files. This is a snap of our configuration file (I'm sorry for lines wrap): >--------------------------- START --------------------------------< # bayonne logfiles destination bayonne_all {file("/var/log/bayonne/bayonne.log" owner("root") group("bayonne") perm(0660)); }; destination bayonne_debug {file("/var/log/bayonne/debug.log" owner("root") group("bayonne") perm(0660)); }; destination bayonne_info {file("/var/log/bayonne/info.log" owner("root") group("bayonne") perm(0660)); }; destination bayonne_err {file("/var/log/bayonne/error.log" owner("root") group("bayonne") perm(0660)); }; destination bayonne_crit {file("/var/log/bayonne/critical.log" owner("root") group("bayonne") perm(0660)); }; # bayonne-avvenire logfiles destination avvenire_all {file("/var/log/bayonne/avvenire/avvenire.log" owner("root") group("bayonne") perm(0660)); }; destination avvenire_debug {file("/var/log/bayonne/avvenire/debug.log" owner("root") group("bayonne") perm(0660)); }; destination avvenire_info {file("/var/log/bayonne/avvenire/info.log" owner("root") group("bayonne") perm(0660)); }; destination avvenire_warn {file("/var/log/bayonne/avvenire/warning.log" owner("root") group("bayonne") perm(0660)); }; destination avvenire_err {file("/var/log/bayonne/avvenire/error.log" owner("root") group("bayonne") perm(0660)); }; >--------------------------- END --------------------------------< What we want is something like this: >--------------------------- START --------------------------------< [root@platone root]# ls -l /var/log/bayonne total 7552 drwxrwx--- 2 root bayonne 4096 Jun 11 17:58 avvenire -rw-rw---- 1 root bayonne 2860663 Jun 13 17:12 bayonne.log -rw-rw---- 1 root bayonne 23267 Jun 13 16:34 calls -rw-rw---- 1 root bayonne 0 Jun 13 04:02 critical.log -rw-rw---- 1 root bayonne 2541445 Jun 13 17:12 debug.log -rw-rw---- 1 root bayonne 6613 Jun 13 17:08 error.log -rw-rw---- 1 root bayonne 312605 Jun 13 17:12 info.log [root@platone root]# ls -l /var/log/bayonne/avvenire/ total 320 -rw-rw---- 1 root bayonne 126474 Jun 13 17:10 avvenire.log -rw-rw---- 1 root bayonne 75780 Jun 13 17:10 debug.log -rw-rw---- 1 root bayonne 1365 Jun 13 17:08 error.log -rw-rw---- 1 root bayonne 44628 Jun 13 17:10 info.log -rw-rw---- 1 root bayonne 4701 Jun 13 17:08 warning.log [root@platone root]# >--------------------------- END --------------------------------< In real world, this is the results: >--------------------------- START --------------------------------< [root@platone root]# ls -l /var/log/bayonne total 7552 drwx------ 2 root root 4096 Jun 11 17:58 avvenire -rw-rw---- 1 root bayonne 2860663 Jun 13 17:12 bayonne.log -rw-rw---- 1 root bayonne 23267 Jun 13 16:34 calls -rw-rw---- 1 root bayonne 0 Jun 13 04:02 critical.log -rw-rw---- 1 root bayonne 2541445 Jun 13 17:12 debug.log -rw-rw---- 1 root bayonne 6613 Jun 13 17:08 error.log -rw-rw---- 1 root bayonne 312605 Jun 13 17:12 info.log [root@platone root]# ls -l /var/log/bayonne/avvenire/ total 320 -rw-r----- 1 root bayonne 126474 Jun 13 17:10 avvenire.log -rw-r----- 1 root bayonne 75780 Jun 13 17:10 debug.log -rw-r----- 1 root bayonne 1365 Jun 13 17:08 error.log -rw-r----- 1 root bayonne 44628 Jun 13 17:10 info.log -rw-r----- 1 root bayonne 4701 Jun 13 17:08 warning.log [root@platone root]# >--------------------------- END --------------------------------< First, the directory /var/log/bayonne/avvenire/ is property of root.root with a bitmask drwx------ Second, all files in this directory are properties of root.bayonne and this is correct, but the bitmask is -rw-r----- and not -rw-rw---- All files in /var/log/bayonne/, pheraps, have corret owner and permission bitmask!!! If I perform a chown on directory /var/log/bayonne/avvenire/, it works, but if I perform a manual chmod on all files in this directory it *temporary* work, but permission are changhed at first a log line is appended in every file. Have someone out there experimented this behavoiur? -- Ciao da Villo - GPG public key available

2 1