January 2003 - syslog-ng - lists.balabit.hu

template() and template_escape() extension for all destination drivers
by Achim Gsell 30 Jan '03

30 Jan '03

Hi, On Wed, Oct 30, 2002 at 20:47:55+0100, Balazs Scheidler wrote: > I came to having some time to integrate pending patches, and found your > patch. I have a couple of comments, which needs to be fixed before releasing > a syslog-ng with these parts integrated. > > * expand_macro & friends should be declared in a header file instead of > declaring it in every referencing module. maybe a new file called > macros.c would be a good way of resolving this problem. > * expand_macros returns a newly allocated string, which must be freed, so > constructs like this cause memory leaks: > + if (self->template_output) > + A_WRITE_STRING(&self->dest_buf->super, > + c_format("<%i>%S\n", > + msg->pri, > expand_macros(self->cfg, self->template_output, self->template_escape, msg))); > > c_format() has an option to free an ol_string by specifying 'f' like this: > > c_format("%fS", expand_macros()) ... > Otherwise your patch looks ok to me. If you want to have it integrated prior > to 1.6.0 is being released, please send a modified diff. In the attachment you find a revised version of the patch. The functions "expand_macros()" & friend are now declared in "macros.h" and coded in "macros.c". The memory leaks are fixed ... Achim

1 0

Differences between 1.5.x and 1.4.x
by Brian E. Seppanen 30 Jan '03

30 Jan '03

How stable is the 1.5.x series of syslog-ng release, and is the only difference that 1.5.x is a development tree? Are their significant configuration file differences? Where would I find information on variations and additional features within 1.5.x series? Thanks for all the help Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

2 1

RE: [syslog-ng]Question about syslog-ng conf file syntax...
by Michael Breton 29 Jan '03

29 Jan '03

> -----Original Message----- > From: Ryan Dooley [mailto:dooleyr@missouri.edu] > Sent: Wednesday, January 29, 2003 4:53 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Question about syslog-ng conf file syntax... > > > Hello All, > > I have a question about syslog-ng conf file... I have a destination > filter that looks like this: > > destination d_somefile { > file("/path/to/file"); > }; > > That "syslog-ng -s" says there is a syntax error... Any ideas? I have a hunch that the third line with the }; need to start with whitespace to be considered on the same line. Michael Breton Commtel

2 2

Question about syslog-ng conf file syntax...
by Ryan Dooley 29 Jan '03

29 Jan '03

Hello All, I have a question about syslog-ng conf file... I have a destination filter that looks like this: destination d_somefile { file("/path/to/file"); }; That "syslog-ng -s" says there is a syntax error... Any ideas? Cheers, Ryan

2 1

RE: [syslog-ng]UDP syslog not being logged by syslog-ng
by Hamilton, Andrew 29 Jan '03

29 Jan '03

Glad you figured it out. Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 1:11 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Drew, Thanks for you help. It was me being stupid! It's the Red Hat firewall stopping it working! Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 5:14 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Joel, I'm not sure this will really make a difference and it may just be a typo in the message, but in the filters you have authprov which should be authpriv, I believe. You could also try logging just source, destination and not use any filters to see what you are getting. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 12:02 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng They are in the local log files either. I tried changing the parameter to yes and still no success. Thanks for the ideas so far... Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 2:23 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Did you check the log file for the log server host? You have keep_hostname(no) so I think that the machine will log as from the local log server. Check to see if they are in the local host log file. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 9:08 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]UDP syslog not being logged by syslog-ng Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]UDP syslog not being logged by syslog-ng
by Moxey, Joel, CND Tech Dev, VF UK 29 Jan '03

29 Jan '03

Drew, Thanks for you help. It was me being stupid! It's the Red Hat firewall stopping it working! Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 5:14 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Joel, I'm not sure this will really make a difference and it may just be a typo in the message, but in the filters you have authprov which should be authpriv, I believe. You could also try logging just source, destination and not use any filters to see what you are getting. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 12:02 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng They are in the local log files either. I tried changing the parameter to yes and still no success. Thanks for the ideas so far... Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 2:23 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Did you check the log file for the log server host? You have keep_hostname(no) so I think that the machine will log as from the local log server. Check to see if they are in the local host log file. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 9:08 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]UDP syslog not being logged by syslog-ng Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]UDP syslog not being logged by syslog-ng
by Hamilton, Andrew 29 Jan '03

29 Jan '03

Joel, I'm not sure this will really make a difference and it may just be a typo in the message, but in the filters you have authprov which should be authpriv, I believe. You could also try logging just source, destination and not use any filters to see what you are getting. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 12:02 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng They are in the local log files either. I tried changing the parameter to yes and still no success. Thanks for the ideas so far... Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 2:23 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Did you check the log file for the log server host? You have keep_hostname(no) so I think that the machine will log as from the local log server. Check to see if they are in the local host log file. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 9:08 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]UDP syslog not being logged by syslog-ng Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]UDP syslog not being logged by syslog-ng
by Moxey, Joel, CND Tech Dev, VF UK 29 Jan '03

29 Jan '03

They are in the local log files either. I tried changing the parameter to yes and still no success. Thanks for the ideas so far... Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 2:23 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Did you check the log file for the log server host? You have keep_hostname(no) so I think that the machine will log as from the local log server. Check to see if they are in the local host log file. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 9:08 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]UDP syslog not being logged by syslog-ng Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]UDP syslog not being logged by syslog-ng
by Hamilton, Andrew 29 Jan '03

29 Jan '03

Did you check the log file for the log server host? You have keep_hostname(no) so I think that the machine will log as from the local log server. Check to see if they are in the local host log file. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 9:08 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]UDP syslog not being logged by syslog-ng Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Problems with Regexp Matching
by Brian E. Seppanen 29 Jan '03

29 Jan '03

Hi Folks: I have a bunch of cisco routers that are all configured on the routers themselves to log at facility local0, and to send their logs to one host (well a couple of hosts simlarily configured, actually). I have the following filter for syslog filter f_syslog { not facility(auth, authpriv, local0, local1, mail) and level(debug..notice) and not match("nsca");}; I've likewise tried it as filter f_syslog { not facility(auth, authpriv, mail) and level(debug..notice) and not match("nsca");}; I then have a bunch of host filters that are supposed to filter router logs filter hostA { facility(local0) and host("192.168.0.1");}; unfortunately the logs are getting into syslog, I assume because they fall within the proper level, but why is the facility not preventing that? The same thing is happening with snmptraps which are received at local1. I'd appreciate any insights. syslog-ng 1.4.16 on redhat linux 7.2 and 7.3 Are there any general rules to follow when constructing filters??? thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

1 0