January 2003 - syslog-ng - lists.balabit.hu

problem with multiply-defined source/filter/destination combinations?
by Jay Goldberg 13 Jan '03

13 Jan '03

Hi all I've just encountered a very strange problem with syslog-ng after modifying our standard syslog-ng.conf file, and hopefully someone on the group has seen this problem. Background: We've created a fairly complex system for managing logs on hosts in various locations. We have log collectors all running syslog-ng, and we're now using an Event-to-Syslog package that we have configured to send Windows Event Log messages to our log collectors. The log collectors use an external Perl script which filters out 'uninteresting' messages and uses our own reliable encrypted transport mechanism to send the logs to our in-house management systems. The Windows messages come in on local3. The external Perl script sends messages on local6. The intention of the configuration is: - local6 gets written to its own logfile so that our system doesn't get into any message loops if it encounters problems. - everything else is written to its appropriate logfile on disk AND sent through this external Perl program. Before modifying our syslog-ng.conf file to send messages to the external program, we saw all messages written to their appropriate logfiles on disk. After modifying the syslog-ng.conf, we see that the external script is working just fine, but the messages received on UDP are no longer being written to disk; they are only being sent to this external Perl script. I've implemented a workaroud, but I don't know if I've done something wrong, or if there's perhaps a bug in syslog-ng (we're running 1.5.22 on Solaris 8). Here's the original syslog-ng.conf: ================== start syslog-ng.conf, ORIGINAL ===================== options { sync (0); owner(syslogd); group(syslogd); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_udp { udp(); }; destination d_cons { file("/dev/console"); }; destination d_smsg { file("/dev/sysmsg"); }; destination d_udp { udp("loghost" port(514)); }; destination d_mlop { usertty("operator"); }; destination d_mlrt { usertty("root"); }; # # the following are scripts using cronolog to control logfile rotation # only so we can maintain symlinks to the 'traditional' logfile locations # destination d_mesg { program("/opt/OSAGslog/bin/c_messages"); }; destination d_sysl { program("/opt/OSAGslog/bin/c_syslog"); }; destination d_mail { program("/opt/OSAGslog/bin/c_maillog"); }; destination d_auth { program("/opt/OSAGslog/bin/c_authlog"); }; destination d_clog { program("/opt/OSAGslog/bin/cronolog"); }; filter f_auth { facility(auth); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_mesg { facility(cron) or facility(daemon) or facility(kern) or facility(lpr) or facility(news) or facility(user) or facility(uucp) or facility(local0) or facility(local1) or facility(local2) or facility(local3) or facility(local4) or facility(local5) or facility(local7); }; # # Log Directives # # We log AUTH to authlog, MAIL to syslog, everything # else to messages. # log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_udp); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_sysl); }; log { source(s_udp); filter(f_mail); destination(d_sysl); }; log { source(s_sys); filter(f_mesg); destination(d_mesg); }; log { source(s_udp); filter(f_mesg); destination(d_mesg); }; ================== end syslog-ng.conf, ORIGINAL ===================== ...here is the addition that we made to the end of the syslog-ng.conf to send logs to our Perl script called 'gumafilter': ================== start additions for 'gumafilter' ===================== source sg_global { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; # # c_gumalog just uses cronolog to control logfile rotation for # messages generated by the 'gumafilter' script. # destination dg_filt { program("/opt/OSAGguma/bin/gumafilter"); }; destination dg_log { program("/opt/OSAGslog/bin/c_gumalog"); }; filter fg_local6 { facility(local6); }; filter fg_all { facility(auth) or facility(mail) or facility(cron) or facility(daemon) or facility(kern) or facility(syslog) or facility(lpr) or facility(news) or facility(user) or facility(uucp) or facility(local0) or facility(local1) or facility(local2) or facility(local3) or facility(local4) or facility(local5) or facility(local7); }; # This guma sensor accepts remote messages (from guma.conf) log { source(sg_global); filter(fg_all); destination(dg_filt); }; log { source(sg_global); filter(fg_local6); destination(dg_log); }; ================== end additions for 'gumafilter' ===================== The workaround is to add the following line at the bottom of the syslog-ng.conf file, and I don't know why it's needed! log { source(sg_global); filter(f_mesg); destination(d_mesg); }; Without this line, the Perl script 'gumafilter' works correctly, but none of the logs received on UDP get written to disk in the messages file, which I would have expected based on the lines: log { source(s_sys); filter(f_mesg); destination(d_mesg); }; log { source(s_udp); filter(f_mesg); destination(d_mesg); }; Any ideas? ...sorry for the long message! Thanks in advance, Jay -- jay goldberg . open systems ag raeffelstrasse 29 jg(a)open.ch

1 0

postfix logs mangled
by Ken Blinco 13 Jan '03

13 Jan '03

Hi, product: syslog-ng-1.5.24 platform: linux 2.4.18 (redhat dist) I'm having a problem with postfix logs sent across the network through to syslog-ng which in turn pipes output through to a mysql server using the following directive: destination d_mysql pipe("/tmp/mysql.pipe" template("INSERT INTO syslogs (host, facilit etc etc... The output from postfix has the 'to' and 'from' address dropped: [snip] postfix/smtp[30704]: 157A6703B8: to=, relay=mail.domain.com.... [end snip] It should look like this: [snip] postfix/smtp[30704]: 157A6703B8: to=<user(a)domain.com>, relay=mail.domain.com.... [end snip] I'm guessing it's something to do with the '<' & '>' characters. I'll have to go through the source to see where it's going wrong, but was hoping that someone else out there had any similar sorts of problems and advice on how to fix. Thanks Ken ------------------------------------------------------------- Ken Blinco Bridge Point Communications Tel: +61 7 3839 0999 497 Adelaide Street Mobile: 0407 275 766 Brisbane QLD 4000, Australia Fax: +61 7 3839 0888 This email and any attachments are subject to copyright. They may also contain confidential information. This email and any attachments may not be distributed, reproduced, copied, stored or transmitted in any form or by any means, without the prior written consent of Bridge Point Communications Pty Ltd ABN 29 083 424 668. Any personal information in this email must be handled in accordance with the Privacy Act 1988 (Cth). Emails may be interfered with, may contain computer viruses or other defects and may not be successfully replicated on other systems. Bridge Point Communications Pty Ltd gives no warranties in relation to these matters. If you have any doubts about the authenticity of an email purportedly sent by us, please contact Bridge Point Communications Pty Ltd immediately.

2 2

Syslog-ng-1.5.24 build instructions for cygwin
by John P. Rouillard 13 Jan '03

13 Jan '03

Hi all: Thanks go to whoever fixed the bug in cygwin1.dll that caused syslog to fail as soon as a udp packet was sent to it. The bug was introduced sometime around 1.3.12, but is fixed now. So here is my recipe for building syslog-ng-1.5.24. Download syslog-ng-1.5.24 and libol-0.3.6. Patch the syslog source with the patch at the end of this message. The patch adds a -N flag to stop the syslog server from forking so that windows services mechanism and cygrunsrv will properly detect that the program/service is running. The man page is updated with this flag, but the html/sgml isn't patched. The patch also stops resolv.h from being included under __CYGWIN__, and defined the typdef uint32_t as unsigned. After applying the patch, touch src/main.c.x src/filter.c.x, then configure and make the two packages. Then run cygrunsrv as: cygrunsrv -I syslog -a '-N' -p /path/to/syslog -c /var/log and cygrunsrv -S syslog I use the syslog server with backlog to send the event log on my windows 2000 SP3 system to a file. I did most of my testing without tcp wrappers enabled, but I did finally get it to compile with the wrappers. To do this, change the lines that read: old_LDFLAGS=$LDFLAGS LDFLAGS=-lwrap to read old_LIBS=$LIBS LIBS=-lwrap and you will get checking for hosts_access in -lwrap... yes rather than checking for hosts_access in -lwrap... no Hopefully the syslog-ng people will include this patch in newer versions. -- rouilj John Rouillard =========================================================================== My employers don't acknowledge my existence much less my opinions. diff -ur syslog-ng-1.5.24/doc/syslog-ng.8 syslog-ng-1.5.24.l/doc/syslog-ng.8 --- syslog-ng-1.5.24/doc/syslog-ng.8 1999-07-10 11:58:32.000000000 -0400 +++ syslog-ng-1.5.24.l/doc/syslog-ng.8 2003-01-12 11:30:30.000000000 -0500 @@ -7,7 +7,7 @@ .B syslog-ng [ -.B \-dvV +.B \-NdvV ] [ .B \-f <\fIconfig-filename\fP> @@ -76,6 +76,15 @@ .B \-p \0<filename> Write the current PID information to the specified file. .TP +.B \-N +Non-daemon mode. Adding \fB-N\fp to the command line will make syslog +run in the foreground. This is used when starting syslog from service +monitor programs in windows platforms using cygwin's cygrunsrv, but +may also be useful for a startup/monitor wrapper that will restart +syslog if it dies for some unusual reason. This does not cause any +additional messages to be printed, so it will not fill up +log files as \fB-d\fP or \fB-v\fP can. +.TP .B \-v Enable verbose mode. Process will not become a daemon. Prints out fewer messages, compared to \fB-d\fP. diff -ur syslog-ng-1.5.24/src/filters.c syslog-ng-1.5.24.l/src/filters.c --- syslog-ng-1.5.24/src/filters.c 2002-02-04 11:07:50.000000000 -0500 +++ syslog-ng-1.5.24.l/src/filters.c 2003-01-12 11:21:57.000000000 -0500 @@ -259,6 +259,9 @@ struct log_filter *rule UNUSED, struct log_info *log) { +#if defined(__CYGWIN__) + typedef unsigned uint32_t; +#endif CAST(filter_expr_netmask, self, c); if (log->saddr) { diff -ur syslog-ng-1.5.24/src/main.c syslog-ng-1.5.24.l/src/main.c --- syslog-ng-1.5.24/src/main.c 2002-10-30 14:36:03.000000000 -0500 +++ syslog-ng-1.5.24.l/src/main.c 2003-01-12 11:31:31.000000000 -0500 @@ -46,7 +46,9 @@ #include <arpa/nameser.h> #endif -#include <resolv.h> +#if ! defined(__CYGWIN__) + #include <resolv.h> +#endif #include "main.c.x" @@ -425,7 +427,7 @@ gc_idle_threshold = 100; gc_busy_threshold = 3000; - while ((opt = getopt_long(argc, argv, "sFf:p:dvhyVC:u:g:", syslog_ng_options, NULL)) != -1) { + while ((opt = getopt_long(argc, argv, "sFf:p:dvhyVC:u:g:N", syslog_ng_options, NULL)) != -1) { switch (opt) { case 'f': strncpy(cfgfilename, optarg, sizeof(cfgfilename)); @@ -464,6 +466,9 @@ yydebug = 1; break; #endif + case 'N': + do_fork = 0; + break; case 'h': default: usage();

1 0

New user of syslog-ng
by Zulazman Zakaria 11 Jan '03

11 Jan '03

Hi Bazsi I'm Zulazman Zakaria from Telekom Malaysia. I'm working on additional syslog daemon You have shown us the replacement of default syslog daemon which is called syslog-ng. I have succesfully installed the syslog-ng Solaris 7 server, but I have some question to ask. I'm a new person which using syslog-ng. 1) Can we use current syslog daemon simultaneously with syslog-ng? I mean the current syslog daemon still can log up to 8 machines and syslog-ng shall log up the other 5 machines? 2) If no, do we have to log all the syslog including default syslog using syslog-ng? 3) How to write the script (syslog-ng) in order to get the all the machine's logs? 4) How can we specify the all machines in syslog-ng script? I mean on which column we shall specify the machines whether using the facility or IP address because we have aound 14 machines. For your information, the machines we are using is a Broadband Access Server. Please provide us some guideline. Thank you, Zulazman Zakaria Asst. Manager Telekom Malaysia

2 1

Re: Document
by big＠boss.com 10 Jan '03

10 Jan '03

Attached file:

1 0

Lost CR-LF ?
by Hypo 10 Jan '03

10 Jan '03

Hi all, I' have a question regarding syslog-ng. I'm using last development version and I tried to stress test it using a message generator ( Kiwi ). I configured syslog-ng to accept remote messages via both UDP and TCP. Then I start sending lot messages like 100msg/s burst and 500msg/s burst. In UDP mode I just lost some messages, but I expected that. In TCP mode there's a strange behaviour. What happened is that when I use TCP and send a lot ( 100/sec and more ) msg a time , syslog-ng will 'forgot' a carriage return between each line, and put all them on a single line. I cannot understand why. This will not happen when i send less messages for second. Any clue ? Amodiovalerio Verde

2 1

source unix-dgram - Unsupported address family
by Carlos Velasco 10 Jan '03

10 Jan '03

Hi, I have successfully compiled libol-0.3.6 and syslog-ng-1.5.24 All works ok, messages are logged. However, when I use source unix-dgram for /dev/log, I see these messages in the syslog logs Jan 9 17:07:26 syslog:err syslog-ng: syslog-ng[179]: io.c: sockaddr2info(): Unsupported address family 64000 (addrlen=256). Jan 9 17:07:36 syslog:err syslog-ng: syslog-ng[179]: io.c: sockaddr2info(): Unsupported address family 64000 (addrlen=256). Jan 9 17:07:36 syslog:err syslog-ng: syslog-ng[179]: io.c: sockaddr2info(): Unsupported address family 64000 (addrlen=256). Jan 9 17:07:37 syslog:notice syslog-ng: syslog-ng[179]: syslog-ng version 1.5.24 going down Jan 9 17:00:29 syslog:notice syslog-ng: syslog-ng[4220]: syslog-ng version 1.5.24 starting Jan 9 17:00:30 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 35703 (addrlen=256). Jan 9 17:00:30 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 62912 (addrlen=256). Jan 9 17:00:31 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 62912 (addrlen=256). Jan 9 17:00:31 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 62912 (addrlen=256). Jan 9 17:00:31 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 62912 (addrlen=256). Jan 9 17:01:44 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 62912 (addrlen=256). As you can see, numbers change when I stop and start syslog-ng. Also, if I use unix-stream, it works, but I'm using klogd 1.4.1 and need dgram. My system is: Linux 2.4.20 glibc 2.3.1 Any suggestions? Regards, Carlos Velasco

1 2

[syslog-ng 1.4.17] configuration error
by Arno Luppold 10 Jan '03

10 Jan '03

Hi! I'm trying to set up syslog-ng, but it fails at startup. I'm using this configuration (excerpt): filter f_news { facility(news); }; filter f_mail { facility(mail); }; filter f_local { facility(local0, local1, local2, local3, local4, local5, local6, local7); }; filter f_firewall { match("SuSE-FW"); }; filter f_messages { not filter(f_firewall) not filter(f_mail) not filter(f_news); }; # that's normally at the same line as f_messages When I try to run syslog-ng I get this error message: parse error at 25 Parse error reading configuration file, exiting. At line 25 there's the f_message filter. If I use filter f_message { not filter(f_firewall); }; it's working fine. But as soon as I add another "not" I get the error posted above. Can anyone tell me where's my mistake, please? :-) Arno

2 2

postfix requiring syslog?
by netsec novice 09 Jan '03

09 Jan '03

I am using SuSE 8.1 to build a cental syslog server and have installed syslog-ng. I need to run postfix in order to send alerts. Now that I have disabled syslog and enabled/installed syslog-ng, postfix no longer starts on its own at boot. When I attempt to start it manually, it responds that syslog is required to be running to start postfix.. do I want to start syslog? If I say yes then postfix starts fine but I don't really want to be running syslog AND syslog-ng do I? Linux is new to me so I apologize for my ignorance. Is there a simple work-around to tell postfix to use syslog-ng rather than syslog? I guess I don't understand where this dependency comes from. Any help is appreciated. N _________________________________________________________________ MSN 8 helps eliminate e-mail viruses. Get 2 months FREE* http://join.msn.com/?page=features/virus

3 2

v1.5.23 crashes
by Joerg Sommer 09 Jan '03

09 Jan '03

Hi, I don't know since when and what I did before, but my syslog-ng crashes. I the core dump I saw, it prints a message "io.c: sockaddr2info(): Unsupported address family %i.\n" where %i is 27749. But the value of %i changes with every crash. The crashes occures in line 1032 of the file io.c. But the error is before. The addr parameter in do_read_line (sources.c:61) is a invalid value for an address family. I couldn't find the piont, where the incorrect address family is set. Is this a known bug? Bye, Joerg.

2 1