August 2002 - syslog-ng - lists.balabit.hu

RE: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x
by Dustin Trammell 21 Aug '02

21 Aug '02

The problem entries are only coming from that source. If another system forwards any kernel logs, they come through fine. All other boxes are currently still running the standard syslogd + klogd. The central log server is the only one running syslog-ng. --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Stephen Frost [mailto:sfrost@snowman.net] Sent: Wednesday, August 21, 2002 12:20 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x * Dustin Trammell (DTrammell(a)PENSON.COM) wrote: > source s_kernel { file("/proc/kmsg" log_prefix("kernel: ")); }; Okay, and those kernel messages are being generated from this source, or are they coming from another machine and being delivered to the log server? Stephen

2 1

weekly directory
by Keven Belanger 21 Aug '02

21 Aug '02

Hi guys, is there any way to create a directory for each week?? We can do it by day/month/year but for some host month is too big and day is too small, so can we do something between ? Thanx a lot and have a nice day! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

1 0

RE: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x
by Dustin Trammell 21 Aug '02

21 Aug '02

Here's my conf in full: ### Syslog-NG Config File # Global Options options { # time_reopen(60); # mark(1200); stats(1200); chain_hostnames(no); use_dns(no); gc_idle_threshold(100); gc_busy_threshold(10000); log_fifo_size(2000); log_msg_size(2048); sync(0); }; # Source Objects source s_local { internal(); }; source s_kernel { file("/proc/kmsg" log_prefix("kernel: ")); }; source s_devlog { unix-stream("/dev/log" max-connections(150)); }; source s_udp514 { udp(); }; source s_tcp514 { tcp(ip("127.0.0.1") max-connections(150) keep-alive(yes)); }; # Destination Objects destination d_varlog { file("/var/log/log"); }; destination d_tty8 { pipe("/dev/tty8"); }; destination d_logresp { pipe("/usr/local/logrespond/fifo/log" owner(logrespond) group(root) perm(0600) ); }; destination d_logtraq { pipe("/usr/local/logtraq/logpipe" owner(root) group(logtraq) perm(0640) ); }; # Log Paths log { source(s_local); source(s_kernel); source(s_devlog); source(s_udp514); source(s_tcp514); destination(d_varlog); destination(d_tty8); destination(d_logresp); destination(d_logtraq); }; --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Stephen Frost [mailto:sfrost@snowman.net] Sent: Wednesday, August 21, 2002 11:56 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x * Dustin Trammell (DTrammell(a)PENSON.COM) wrote: > (sigh) ... At least they're no longer getting mangled (as far as I can tell, > I haven't seen any mangled lines since I patched), but some entries are > still getting split between two or more lines. Any ideas Balazs? What's your syslog-ng.conf look like in the sources part? Stephen

2 1

RE: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x
by Dustin Trammell 21 Aug '02

21 Aug '02

Well, that did the trick, and it compiled, however I'm still getting chopped log entries: Aug 21 10:36:54 loghost01 kernel: fwlog input drop cleanup IN=eth0 OUT= MAC=00:06:5b:84:60:7e:00:01:03:31:c1:be:08:00 SRC=172.30.10.42 DST=172.30.8.40 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=30431 DF PROTO=TCP SPT=33711 DPT=817 WINDOW=5840 RES=0x00 SYN URGP=0 Aug 21 10:37:00 loghost01 kernel: fwlog input drop cleanup IN=eth0 OUT= MAC=00:06:5b:84:60:7e:00:01:03:31:c1:be:08:00 SRC=172.30.10.42 DST=172.30.8.40 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=30432 DF PROTO=TCP SPT=33711 DPT=817 WINDOW=5840 RES=0x00 SYN URGP=0 Aug 21 10:37:12 loghost01 kernel: fwlog input drop cleanup IN=eth0 OUT= MAC=00: Aug 21 10:37:12 loghost01 kernel: 06:5b:84:60:7e:00:01:03:31:c1:be:08:00 SRC=172.30.10.42 DST=172.30.8.40 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=30433 DF PROTO=TCP SPT=33711 DPT=817 WINDOW=5840 RES=0x00 SYN URGP=0 Aug 21 10:38:33 loghost01 kernel: fwlog input drop cleanup IN=eth0 OUT= MAC=00:06:5b:84:60:7e:00:01:03:31:c1:be:08:00 SRC=172.30.10.42 DST=172.30.8.40 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=52186 DF PROTO=TCP SPT=33712 DPT=31337 WINDOW=5840 RES=0x00 SYN URGP=0 Aug 21 10:38:57 loghost01 kernel: fwlog input drop cleanup IN=eth0 OUT= MAC=00:06:5b:84:60:7e:00:01:03:31:c1:be:08:00 SRC=172.30.10.42 DST=172.30.8.40 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=52187 DF Aug 21 10:38:57 loghost01 kernel: PROTO=TCP SPT=33712 DPT=31337 WINDOW=5840 RES=0x00 SYN URGP=0 (sigh) ... At least they're no longer getting mangled (as far as I can tell, I haven't seen any mangled lines since I patched), but some entries are still getting split between two or more lines. Any ideas Balazs? --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Stephen Frost [mailto:sfrost@snowman.net] Sent: Wednesday, August 21, 2002 09:59 To: syslog-ng(a)lists.balabit.hu Cc: Dustin Trammell Subject: Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x * Dustin Trammell (DTrammell(a)PENSON.COM) wrote: > Having a bit of a problem with this patch... Using a freshly un-tarred copy > of 1.5.19: The quick and dirty answer is: touch sources.c.x or just touch *.x Stephen

2 1

RE: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x
by Dustin Trammell 21 Aug '02

21 Aug '02

Having a bit of a problem with this patch... Using a freshly un-tarred copy of 1.5.19: [/usr/local/src/syslog-ng-1.5.19/src]# patch -p0 < /root/mangle.patch patching file sources.c [/usr/local/src/syslog-ng-1.5.19]# ./configure (snip - configure completes with no problems) [/usr/local/src/syslog-ng-1.5.19]# make Making all in src make[1]: Entering directory `/usr/local/src/syslog-ng-1.5.19/src' make all-recursive make[2]: Entering directory `/usr/local/src/syslog-ng-1.5.19/src' Making all in . make[3]: Entering directory `/usr/local/src/syslog-ng-1.5.19/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.19/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c main.c make_class <sources.c >sources.c.xT /bin/sh: /usr/local/bin/make_class: bad interpreter: No such file or directory make[3]: *** [sources.c.x] Error 126 make[3]: Leaving directory `/usr/local/src/syslog-ng-1.5.19/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-1.5.19/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.19/src' make: *** [all-recursive] Error 1 Without the patch it configures and compiles fine. Any ideas what could be causing the problem that's related to the patch under Linux 2.4.18 (libc 2.2.3 & libol 0.3.3)? Thanks, --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Wednesday, August 21, 2002 07:51 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fix On Tue, Aug 20, 2002 at 07:38:21AM -0400, Stephen Frost wrote: > Balazs and everyone, > > The first fix which was posted to the list changing the if to be: > > if (!eol && closure->pos == closure->max_log_line) > > appeared to work correctly for me. The second fix posted which > changed the if to be: > > if (!eol && (start_pos == 0 || closure->pos == closure->max_log_line)) > > had the same (broken) behaviour as the unmodified if. This leads me > to conclude that 'closure->pos == closure->max_log_line' is false, > '!eol' is true and 'start_pos == 0' is true. log_msg_size() does not > appear to have any effect. I have increased it to be 2048 and still > my logs are split amoung lines. Message length doesn't appear to > matter either as messages which are longer can end up being intact > while shorter messages are split. The one common factor is that all > of the messages being split are coming from /proc/kmsg. hm. as it seems there was a change on the behaviour of /proc/kmsg. The condition used to be: - if (!eol && closure->pos) { - /* we don't have a terminating nl nor \0 */ and there was no reports on mangled messages. Maybe 2.4 kernel introduced a change, and syslog-ng reads kernel message parts with multiple read() calls. > > Since there was some concern about UDP messages being broken by this > my first thought is to change the if to be: > > if (!eol && (closure->dgram || closure->pos == closure->max_log_line)) > > This makes the assumption that messages coming from streams such as a > TCP connection or /dev/log or a file/pipe will eventually have a > terminating newline or \0. Of course, it keeps the sanity check to > not create messages over max_log_line. I have this working on my > setup now but I don't swear that it's perfect, I'd love to hear > feedback on it, esp. from Balazs. These messages being split causes > me a real problem on my firewall. Relying on closure->dgram seems to me a sane decision. start_pos was only a hack anyway. Here's an updated patch (still against 1.5.19): diff -u -r1.34 sources.c --- sources.c 18 Jul 2002 13:18:02 -0000 1.34 +++ sources.c 21 Aug 2002 12:44:18 -0000 @@ -112,8 +113,11 @@ closure->pos = 0; return ST_OK | ST_GOON; } - if (!eol && closure->pos) { - /* we don't have a terminating nl nor \0 */ + if (!eol && (closure->dgram || closure->pos == closure->max_log_line)) { + /* we don't have a terminating nl nor \0, and our buffer is + full or we are a datagram receiver, when the message is in + its own packet. + */ do_handle_line(closure, closure->pos, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fix
by Stephen Frost 21 Aug '02

21 Aug '02

Balazs and everyone, The first fix which was posted to the list changing the if to be: if (!eol && closure->pos == closure->max_log_line) appeared to work correctly for me. The second fix posted which changed the if to be: if (!eol && (start_pos == 0 || closure->pos == closure->max_log_line)) had the same (broken) behaviour as the unmodified if. This leads me to conclude that 'closure->pos == closure->max_log_line' is false, '!eol' is true and 'start_pos == 0' is true. log_msg_size() does not appear to have any effect. I have increased it to be 2048 and still my logs are split amoung lines. Message length doesn't appear to matter either as messages which are longer can end up being intact while shorter messages are split. The one common factor is that all of the messages being split are coming from /proc/kmsg. Since there was some concern about UDP messages being broken by this my first thought is to change the if to be: if (!eol && (closure->dgram || closure->pos == closure->max_log_line)) This makes the assumption that messages coming from streams such as a TCP connection or /dev/log or a file/pipe will eventually have a terminating newline or \0. Of course, it keeps the sanity check to not create messages over max_log_line. I have this working on my setup now but I don't swear that it's perfect, I'd love to hear feedback on it, esp. from Balazs. These messages being split causes me a real problem on my firewall. Thanks, Stephen

2 1

Re: [syslog-ng]logging into database
by Michael Earls 21 Aug '02

21 Aug '02

thank you,, I will make note of that in my mini how to >>> bazsi(a)balabit.hu 08/21/02 08:08 AM >>> On Fri, Aug 16, 2002 at 02:10:53PM -0400, Michael Earls wrote: > I have not had any trouble logging messages to the mysql database with > this option set in syslog-ng. The one thing I have noticed from pple > asking for help is that this example only explains how to setup > syslog-ng to log from udp/external source, and not log internal > messages. > > Bazi * What is the correct syntax " template-escape or > template_escape" it is the same. currently I prefer using _ in names, but those introduced earlier contain '-' as well. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Cisco PIX TCP syslog stream format - and UDP truncation.
by Ted_Rule＠flextech.co.uk 21 Aug '02

21 Aug '02

I have a little problem with a PIX using UDP syslog to an old syslogd server, which I'm hoping members of the list may be able to assist me with. Some time ago, I noticed that some of the bigger messages were being truncated. Further investigation suggested that Cisco were imposing a 256 character limit on messages sent via syslog. The problem is rarely seen - mostly it shows up with IPSEC key renewal messages which happen to be very long. After several "oh yes it does, oh no it doesn't" rounds of trying to convince our suppliers, and in turn Cisco - who initially swore blind they couldn't reproduce the fault - Cisco finally admitted that they do indeed impose a 256 limit on UDP syslog messages. The PIX is perfectly capable of handling bigger UDP messages than that - it has to do in order just to process DNS messages - so the problem only affects the PIX UDP syslog stream. Cisco also recommend , of course, using TCP instead, which they haven't apparently imposed such a restriction on; TCP usage would also help to improve the general security of the logging process, which would also be a good thing anyway. Cisco don't appear to be very interested in my request to patch the UDP message buffer size; I think it would be nothing more than a single line code change to raise the buffer size to 512 which should easily cover any IPSEC syslog messages I can see being truncated. I'm strongly considering migrating the syslog server to syslog-ng so that I could support TCP syslog streams anyway, but in order to defend against any migration problems I wanted a backup plan for PIX TCP stream support. My current plan is some form of very temporary perl daemon listening on TCP redirecting to the Unix Domain syslog socket. So. Does anyone on the list have experience of Cisco PIX TCP Syslog stream talking to syslog-ng? Does anyone on the list have a good idea of the internal layout of the PIX TCP syslog stream - in particular how is the end of message encoded? ( Under UDP of course , EOM is implied by end of packet, but under TCP some explicit EOM marker would have(?) to be added to the stream. ) Would anyone be able to send me some tcpdumps or similar for me to decode the format so that I could generate some test data to fire at the listener? Ted *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

3 2

Re: [syslog-ng]logging into database
by Michael Earls 21 Aug '02

21 Aug '02

I have not had any trouble logging messages to the mysql database with this option set in syslog-ng. The one thing I have noticed from pple asking for help is that this example only explains how to setup syslog-ng to log from udp/external source, and not log internal messages. Bazi * What is the correct syntax " template-escape or template_escape" Thanks Michael Earls http://www.vermeer.org >>> mdodson(a)coremetrics.com 08/16/02 12:56PM >>> I noticed one thing. In the following section -- "template-escape" should be "template_escape" " d_mysql { > > pipe("/tmp/mysql.pipe" > > template("INSERT INTO logs (host, facility, priority, > level, tag, date, > time, > program, msg) VALUES ( '$HOST', '$FACILITY', > '$PRIORITY', '$LEVEL', '$TAG', > > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', > '$MSG' );\n") template-escape(yes));" On Fri, 2002-08-16 at 06:49, hicham rahimi wrote: > > hi, > > i want to setup logging syslog-ng'messages into a > mysql database ,in order to make the messages > organization more powerful. > > i have tested an exemple given in www.vermeer.com > but it doesn't work. > if any one have tested it , tell me please if it > contain a bug or not > thanks > hicham; > > here the exemple: > > Centralized syslog-ng to mysql database > > > by Michael Earls > > To established a centralized location for syslog-ng > collection in order to facilitate: > > Immediate log reporting (both real time and summary > reporting) > Long term log storage (for archival and for possible > later analysis). > Tools used: > syslog-ng -- template() destinations are only > supported by the 1.5.x releases. > mysql > My Own PhP Files > phpmyedit > phpmyadmin > Syslog-ng/Pipe Scripts > MySql Replication > > > Demo https://daffy.chmcc.org/syslog// > This site is still in testing phase > > > Demo-files The files I used for the Demo -- NEW DEMO > FILE -- > > To setup syslog-ng to log to a mysql database. This > assumes that you have installed and setup syslog-ng > and mysql. > > Edit the syslog-ng.conf file > This tells syslog-ng to pipe to a fifo template > > Add the following lines -- > > ## Log syslog-ng > to mysql database > ## > > destination > d_mysql { > > pipe("/tmp/mysql.pipe" > > template("INSERT INTO logs (host, facility, priority, > level, tag, date, > time, > program, msg) VALUES ( '$HOST', '$FACILITY', > '$PRIORITY', '$LEVEL', '$TAG', > > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', > '$MSG' );\n") template-escape(yes)); > }; > log { > source(net); destination(d_mysql); > }; > > Then comment out this line -- > > # This is the > default behavior of sysklogd package > # Logs may > come from unix stream, but not from another machine. > # > #source src { > unix-dgram("/dev/log"); internal(); }; > > Then uncomment out this line -- > > # If you wish > to get logs from remote machine you should uncomment > # this and > comment the above source line. > # > source src { > unix-dgram("/etc/log/log"); internal(); }; > source net { > udp(); }; > > > > Create the database for syslog-ng -- > > Create a file called syslog.sql and paste this > below, this will create the database " syslog" and > table " logs" in mysql. > > # > # Table structure for table > `logs` > # > > CREATE DATABASE syslog; > > USE syslog; > > CREATE TABLE logs ( > host varchar(32) default NULL, > facility varchar(10) default > NULL, > priority varchar(10) default > NULL, > level varchar(10) default > NULL, > tag varchar(10) default NULL, > date date default NULL, > time time default NULL, > program varchar(15) default > NULL, > msg text, > seq int(10) unsigned NOT NULL > auto_increment, > PRIMARY KEY (seq), > KEY host (host), > KEY seq (seq), > KEY program (program), > KEY time (time), > KEY date (date), > KEY priority (priority), > KEY facility (facility) > ) TYPE=MyISAM; > > Run this command > > mysql -u root -p < syslog.sql > > This will install the database into mysql. > > Create a fifo pipe file -- > This is the file that syslog-ng will store > records before writing to the database. > > > mkfifo /tmp/mysql.pipe > > You need to restart syslog-ng -- > > /etc/init.d/syslog-ng stop # Stop > syslog-ng > /etc/ini.d/syslog-ng start # Start > syslog-ng > > Run this command to pipe the file mysql.pipe to mysql > database > > You need to create a script that will check to make > sure this command is running and restart if stopped. > Syslog-ng/Pipe scripts > > When this file is started it will hang, You > need to create a script and have it run on startup. > > mysql -u root --password=passwd > syslog < /tmp/mysql.pipe > > > > > -------------------------------------------------------------------------------- > > > This is a mini how-to and is in the second > draft::Thanks again to everyone.. > > Michael > > Any questions just email me > --Michael(a)michaelearls.com-- > > Created Jan 18, 2002 > Last Updated May 18, 2002 > > > > ___________________________________________________________ > Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! > Yahoo! Mail : http://fr.mail.yahoo.com > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

logging pauses and log entry truncation
by Dustin Trammell 21 Aug '02

21 Aug '02

Has anyone else experienced syslog-ng occasionally pausing for a few minutes, immediately after logging one or more truncated entries? It usually pauses for anywhere from 1-10 minutes or so, and the process seems to be fine during this time (still bound to the port, doesn't appear to be zombied or using up all the CPU or memory, etc), then it continues after the pause as if nothing happened. The entry immediately after the pause is sometimes truncated also. The lines that are getting truncated appear to always be kernel log entries, more specifically from iptables, so I tried both using klogd as well as a file() source using /proc/kmsg, both with the same results. I saw a thread a few days ago about garbled/truncated entries, and what I got from that thread was to set the log_msg_size() option to something larger than the largest line your expecting. I set mine to 2048, and that still has not solved the problem, so I'm not sure if it's the same issue that has been discussed in the previous thread or something different. Below I've listed a few log entries (gathered from tail -f logfile), and my syslog-ng.conf file is appended below my sig. ---8<-----(snip)-----8<--- Aug 12 08:10:01 172.30.10.3 arpwatch: eth7 bogon 192.168.168.14 0:4:c0:3:a8:0 Aug 12 08:10:01 172.30.10.60 traqer: doing 10 minute stuff Aug 12 08:10:01 172.30.10.60 kernel: fwlog output accept db IN= OUT=ipsec0 SRC=172.30.10.60 DST=172.30.10.61 LEN=60 TOS=0x00 PREC=0x00 TTL=232 ID=1196 PROTO=TCP SPT=51118 DPT=5432 WINDOW=32440 RES=0x00 CWR ECE SYN URGP=0 Aug 12 08:10:01 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC=00:06:5b:84:60:7e:00:08:02:10: (pause) Aug 12 08:20:01 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC=00:06: Aug 12 08:11:05 loghost01 stunnel[23914]: httpd connected from 172.30.8.40:47705 Aug 12 08:11:05 loghost01 stunnel[23914]: SSL_accept: Peer suddenly disconnected ---8<-----(snip)-----8<--- Aug 12 11:01:29 172.30.10.60 pluto[3590]: "itdb" #814: ignoring Delete SA payload Aug 12 11:01:29 172.30.10.60 pluto[3590]: "itdb" #814: received and ignored informational message Aug 12 11:01:29 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC=00:06:5b:84:60:7e:00:08: Aug 12 11:01:29 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC= Aug 12 11:01:29 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC= (pause) Aug 12 11:06:49 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC=00:06: Aug 12 11:02:07 loghost01 snmptrapd[31633]: 209.48.214.5: Enterprise Specific Trap (500) Uptime: 6 days, 16:43:47.00, SNMPv2-SMI::enterprises.3224.2.1 = 40, SNMPv2-SMI::enterprises.3224.2.3 = "ALARM: vpn \"LC*Lon-VPN\" is up. (08/12/2002 11:01:27)" Aug 12 11:02:06 loghost01 stunnel[11455]: httpd connected from 172.30.8.40:40969 Aug 12 11:02:06 loghost01 stunnel[11455]: SSL_accept: Peer suddenly disconnected ---8<-----(snip)-----8<--- Aug 12 11:06:49 10.10.2.200 kernel: fwlog inet accept ssl IN=eth0 OUT=eth3 SRC=195.126.219.35 DST=192.168.200.20 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=59691 DF PROTO=TCP SPT=19846 DPT=443 WINDOW=32120 RES=0x00 SYN URGP=0 Aug 12 11:06:49 172.31.1.5 LasColinas-NS10: ALARM: vpn "LC*Lon-VPN" is up. (08/12/2002 11:01:27) Aug 12 11:06:49 172.30.10.3 arpwatch: eth1 bogon 172.19.1.6 0:3:fe:60:8:40 Aug 12 11:06:49 172.31.1.5 LasColinas-NS10: Can't connect to E-mail server 172.30.2.51 (08/12/2002 11:01:49) Aug 12 11:06:49 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC=00:06:5b:84:60:7e:00:08:02:10: (pause) Aug 12 11:08:36 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC=00:06: Aug 12 11:08:07 loghost01 stunnel[24185]: httpd connected from 172.30.8.40:60549 Aug 12 11:08:07 loghost01 stunnel[24185]: SSL_accept: Peer suddenly disconnected ---8<-----(snip)-----8<--- Aug 12 11:16:13 172.31.1.5 LasColinas-NS10: NetScreen Traffic Log: device_id=LasColinas-NS10 start_time="08/12/2002 11:09:21" src=172.30.8.76 dst=172.31.1.5 service=icmp proto=1 policy_id=18 direction=incoming duration=1 sent=96 rcvd=96 action=Tunnel (LC*Dal-VPN) icmp type=8 Aug 12 11:20:01 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= Aug 12 11:11:04 loghost01 tac_plus[9564]: Read -1 bytes from 172.30.8.40 , expecting 12 (pause) Aug 12 11:20:01 loghost01 MAC=00:06:5b:84:60:7e:00:08:02:10:cb:a4:08:00 SRC=172.30.10.61 DST=172.30.8.40 LEN=275 TOS=0x00 PREC=0x00 TTL=134 ID=4745 DF PROTO=UDP SPT=514 DPT=514 LEN=255 Aug 12 11:20:01 172.31.1.5 LasColinas-NS10: NetScreen Traffic Log: device_id=LasColinas-NS10 start_time="08/12/2002 11:09:20" src=172.30.8.5 dst=172.31.1.5 service=icmp proto=1 policy_id=18 direction=incoming duration=1 sent=112 rcvd=112 action=Tunnel (LC*Dal-VPN) icmp type=8 ---8<-----(snip)-----8<--- If anyone has experienced this or has any other ideas that I may not have tried yet, any info you can provide would be most appreciated. Thanks, --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. ### Syslog-NG Config File # Global Options options { chain_hostnames(no); use_dns(no); log_fifo_size(2000); log_msg_size(2048); sync(0); }; # Source Objects source s_local { internal(); }; source s_kmsg { file("/proc/kmsg"); }; source s_devlog { unix-stream("/dev/log" max-connections(150)); }; source s_udp514 { udp(); }; source s_tcp514 { tcp(ip("127.0.0.1") max-connections(150) keep-alive(yes)); }; source s_kernel { file("/proc/kmsg"); }; # Destination Objects destination d_varlog { file("/var/log/log"); }; destination d_tty8 { pipe("/dev/tty8"); }; destination d_logresp { pipe("/usr/local/logrespond/fifo/log" owner(logrespond) group(root) perm(0600) ); }; destination d_logtraq { pipe("/usr/local/logtraq/logpipe" owner(root) group(logtraq) perm(0640) ); }; # Log Paths log { source(s_local); source(s_kmsg); source(s_devlog); source(s_udp514); source(s_tcp514); source(s_kernel); destination(d_varlog); destination(d_tty8); destination(d_logresp); destination(d_logtraq); };

3 2