January 2003 - syslog-ng - lists.balabit.hu

Re: [syslog-ng]replacing part of prog name with hostname
by Noam Meltzer 04 Jan '03

04 Jan '03

--- On Fri 01/03, Balazs Scheidler wrote:From: Balazs Scheidler [mailto: bazsi(a)balabit.hu]To: syslog-ng(a)lists.balabit.huDate: Fri, 3 Jan 2003 12:13:20 +0100Subject: Re: [syslog-ng]replacing part of prog name with hostnameOn Fri, Jan 03, 2003 at 05:03:03AM -0500, Noam Meltzer wrote:> I won't expect Sun to change their native syslogd. Their syslogd is> working good in its native environment, and its "harmonic" with other> native syslogd is evry good. For me it doesn't seem like a bug. Just> another mechanism. It is not Solaris's syslogd that has the bug. It's ctld which sends bogusdata in its messages.> And many other Solaris' internal mechanisms, like a warning that "/var/adm/utmp exists", and then in another line "for more information refer to the manpage of utmp". and when you have problems with you hd, you get bad warnings then, and when the lpr complains about printing, it also send a two line logs. This is just a different method of sending the logs. Solaris counts on you that you will reverse resolve the originating machine, and not to interpeter the data line you get. I can send you reports of my sniffing to show you that this is not a bug in syslogd of solaris, if you would like me to. (even though i'm sure you have a reachable solaris machine, and already done it yourself) Solaris' syslogd recognize the hostname by doing> reverse-resolution for each packet. And I don't think it's such a bad> idea. The current mechanism of syslog-ng is trying to run some regexp on> the data string (If I understood you correctly). I believe that the> Solaris mechanism is more secure because that way you know for sure that> the originating IP is who it claims to be. (Yes, you can always hijack> (hope i spelled this correct) an IP in the network, but I guess that in> that case you have other trouble). In syslog-ng mechanism, some1 can> inject you fake logs. (I don't know what good it can give an attacker...> but I'm sure that some criminal mind can find what to do with this).in keep_hostname(no) state, syslog-ng does not trust the host name in anyway. but this interacts badly with ctld. You still haven't answered about my security-question. Noam _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

syslog server config question
by Mark Schipper 04 Jan '03

04 Jan '03

syslog-ng seems to work quite well for sorting logs by facility and/or priority to the nth degree....but I'm struggling to do something that one would expect to be fairly simple (perhaps it is, and I'm even more simple...). I'm trying to setup a syslog server that sorts input by hostname and throws that input into /var/log/HOSTS/$hostname file. It's strictly for a backup copy of each system log for audit puposes in case a host is compromised, but I'd prefer to have each host have its own file. Easier to find stuff that way. I was expecting to setup the syslog servers syslog.conf file (not using syslog-ng) to pipe to a shell or perl script that did the parsing, but everything I ran across looked like it was aimed at intrusion detection. A quick search convinced me that syslog-ng was my best bet so I compiled and replaced syslogd with syslog-ng, but it is still logging my client logs to /var/log/messages (yes, I killed syslogd first), even though I setup the following at the end of the syslog-ng.conf file: # automatic host sorting (usually used on a loghost) # destination std { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$HOST_$YEAR_$MONTH_$D AY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # log it log { source(src); destination(std); }; I obviously need to spend some more time on this, but perhaps someone has a quick suggestion or knows of a better way to do what I'm looking for. In the meantime I'll read 'til my eyes bleed....... I'm not on the list, so please reply to mschipper(a)lightsurf.com Thanks.

2 1

log checking
by Peter Straka 03 Jan '03

03 Jan '03

Hi What about log-checking? I tried logcheck,logscanner,logsurger,logwatch,swatch, but every-one is only like better grep. Which is the best log checker? I expect somethink on statistical base - somethink like http analyze. I have centralized loghost with directory structure: log/HOSTS/<IPadr>/facility.<YYMMDD>.log How to setup logchecker to control all logs? Use the PIPE? What are you thinking about? Is somewhere else discussion about that? by peter ________ Pocitacove hry? http://hry.sme.sk

1 0

chatt for linux
by Peter Straka 03 Jan '03

03 Jan '03

Hi I use syslog-ng on linux platform and I in crontab I use chattr to change log files (imutable and appendable) I think it would be goot idea to have implemented option attr() {like perm()}. And for acl somethinf like acl option. Would be this posible in future version? by peter ________ Pocitacove hry? http://hry.sme.sk

1 0

�ؼ��&�Կ��
by �� 03 Jan '03

03 Jan '03

特价新书75折！自考教材、辅导、试卷：一律8折，深圳市提供送货上门服务！深圳网络书店祝您新年愉快！点击进入深圳网络书店：　http://www.szbookshop.com ----------------------------------------------------------------------- 使用极星邮件群发，无须通过邮件服务器，直达对方邮箱，速度绝对一流！下载网址：http://love2net.51.net/，更多免费的超酷软件等你来下…… ---------------------------------------------------- INFORMATION This message has been sent using a trial-run version of the TSmtpRelayServer Delphi Component. ----------------------------------------------------

1 0

Re: [syslog-ng]replacing part of prog name with hostname
by Noam Meltzer 03 Jan '03

03 Jan '03

I won't expect Sun to change their native syslogd. Their syslogd is working good in its native environment, and its "harmonic" with other native syslogd is evry good. For me it doesn't seem like a bug. Just another mechanism. Solaris' syslogd recognize the hostname by doing reverse-resolution for each packet. And I don't think it's such a bad idea. The current mechanism of syslog-ng is trying to run some regexp on the data string (If I understood you correctly). I believe that the Solaris mechanism is more secure because that way you know for sure that the originating IP is who it claims to be. (Yes, you can always hijack (hope i spelled this correct) an IP in the network, but I guess that in that case you have other trouble). In syslog-ng mechanism, some1 can inject you fake logs. (I don't know what good it can give an attacker... but I'm sure that some criminal mind can find what to do with this). Noam --- On Fri 01/03, Balazs Scheidler wrote:From: Balazs Scheidler [mailto: bazsi(a)balabit.hu]To: syslog-ng(a)lists.balabit.huDate: Fri, 3 Jan 2003 10:48:51 +0100Subject: Re: [syslog-ng]replacing part of prog name with hostnameOn Thu, Jan 02, 2003 at 03:28:49PM -0500, Noam Meltzer wrote:> I thing you confused it a little...> According to my last message (and a similar thread I created recently)> The problem with the hostname resolving of Solaris is fixed with using:> > keep_hostname(no)> > But, I would really like to understand what's going on in there.> Is my assumption correct?No. syslog-ng parses the incoming message, but the format of messages is_very_ vague. Depending on the sender the message itself can have many form.The problem here was the sender program contains a space, and Solarissyslogd does not add originating hostname to its local messages (unless itrelays the message) Thus it is not possible to decide whether the messagereceived contains 'hostname' & 'program' or a single 'program' but with aspace in it.keep_hostname() is not a solution, just a workaround, so syslog-ng itselfdoes not rewrite the hostname. The filter expression host('^hostname$')would still use the part before the space (e.g. the program name).The solution is to fix the sender program, no better workaround exists insyslog-ng.Nate, the problem does not apply to local messages only, it happens to caseswhen Solaris sends these messages via UDP. It is not a solution to simplyassume that there is no hostname for local messages-- BazsiPGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1

RE: [syslog-ng]Syslog and Checkpoint-NG
by Nicholas Berry 02 Jan '03

02 Jan '03

We haven't upgraded to NG yet, but pre-NG works fine. When we start testing NG, I can let you know what results we get. Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. nberry(a)ragingwire.com -----Original Message----- From: Jason Howell [mailto:jason.howell@triadbeemers.org] Sent: Sunday, December 29, 2002 10:06 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Syslog and Checkpoint-NG Has anyone heard of any problems getting Checkpoint-NG to syslog to a remote server? I am running CP-NG on RH7.3 and I can get it to syslog local but it won't send the logs to a remote server. J

1 0

Re: [syslog-ng](no subject)(solaris hostnames wrongly discovered)
by Noam Meltzer 02 Jan '03

02 Jan '03

Here's the solution: There's a parameter you can set in the configuration of the logserver itslef: keep_hostname() it should be set to: "NO" Some info about it: In order to understand things better, i sniffed the syslog network traffic, to see what i can learn about the problem. The main differences between syslog-ng and Solaris native syslog are: 1. It seems that syslog-ng terminates a single line of data with "\n" Like Balazs said). Native Solaris syslog terminates the line with nothing. 2. Syslog-ng adds in the beginning of the data line, the hostname which originated the log. Solaris' native doesn't do that, and counts on the log-server to reverse-resolve the originating IP, and get the host name. Now (and this is only my assumption, i haven't got into syslog-ng sources), when there's an host which sends two seperate packets of syslog data, which follows each other instantly, syslog-ng reverse resolve the first packet, and gets the hostname correctly. After that, it's supposed to cache the hostname from the earlier packet (according to the default value of keep_hostname(yes) ), and according to that to know the 2nd packet originating host. But, something goes wrong. Instead, syslog-ng tries to run some regexp or something of the kind of the data packet itself, and because there's no hostname written in the data, it finds some other word and decides that "THIS IS THE HOSTNAME!!!" (weepee!). setting "keep_hostname(no)" as I suggested overcomes this bug. (Or some other bug. The last paragraph is only my assumption what's going on inthere) Have a pleasent new year, Noam --- On Tue 12/31, Balazs Scheidler wrote:From: Balazs Scheidler [mailto: bazsi(a)balabit.hu]To: syslog-ng(a)lists.balabit.huDate: Tue, 31 Dec 2002 09:07:46 +0100Subject: Re: [syslog-ng](no subject)On Mon, Dec 30, 2002 at 05:32:09PM -0500, Noam Meltzer wrote:> > I did a little experiment and tried sending logs from one native solaris syslog to another. It worked just fine (except the fact i can't into hostnames...)> I looked at the big log "/var/adm/messages" (of two hosts) and saw that the "bad" logs, were logged by the native logger just fine, with stating the originating host as it should be in the beginning of the line.> > I tried simulating this using the command "logger" with no sucess.> > I suspect that sends the data of each packet, not to lines as> syslog-ng expects and this cause its mechanism to fail recognizing the> originating host succesfully.> > Did any1 encountered this problem? How did you solve it? syslog-ng terminates messages at '\n' even in UDP packets unless you areusing a recent version of syslog-ng.-- BazsiPGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0