October 2003 - syslog-ng - lists.balabit.hu

How to filter XDMCP messages ?
by Gerard Breiner 12 Jan '04

12 Jan '04

Hello, I wonder how to configure syslog-ng to filtering the messages emitted by gdm_xdmcp. this type of messages pollutes my files of logs. Here is messages i don't want : "gdm[3798]: gdm_xdmcp_handle_query: Opcode 1 from ". Best regards Gerard Gerard Breiner Institut d'Astrophysique Spatiale Orsay Campus France

4 5

patch for log parsing bugs (log4j)
by Balazs Scheidler 09 Jan '04

09 Jan '04

hi, Attached you'll find a patch against syslog-ng 1.6.0rc4 which addresses some issues wrt log parsing. Please test if the patch fixes your problems. It might be part of a future release if it proves to interoperate with other platforms. People with not to frequent platforms (HP-UX comes to mind), please also test this patch as it might break there. Thanks. And finally the patch: Index: src/sources.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/sources.c,v retrieving revision 1.37 diff -u -r1.37 sources.c --- src/sources.c 8 Jan 2003 09:31:37 -0000 1.37 +++ src/sources.c 3 Oct 2003 14:22:32 -0000 @@ -107,23 +107,32 @@ } closure->pos += n; + /* UDP packets are complete log lines on their own */ + if (closure->dgram) { + do_handle_line(closure, closure->pos, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); + closure->pos = 0; + return ST_OK | ST_GOON; + } + eol = memchr(closure->buffer, '\0', closure->pos); - if (eol == NULL) - eol = memchr(closure->buffer, '\n', closure->pos); if (closure->pad_size && eol) { + + /* HP-UX sends chunks of pad_size in size, each containing a + * separate message, terminated by NUL */ do_handle_line(closure, eol - closure->buffer, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; } - if (!eol && (closure->dgram || closure->pos == closure->max_log_line)) { - /* we don't have a terminating nl nor \0, and our buffer is - full or we are a datagram receiver, when the message is in - its own packet. - */ + if (eol == NULL) + eol = memchr(closure->buffer, '\n', closure->pos); + if (!eol && closure->pos == closure->max_log_line) { + /* we don't have a terminating nl nor \0, and our buffer is full */ do_handle_line(closure, closure->pos, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; } + + /* iterate through lines */ start = closure->buffer; while (eol) { /* eol points at the newline character. end points at the -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 5

UDP Template
by Gianpiero Porchia 26 Nov '03

26 Nov '03

Hi, I would like to do log relaying, using syslog-ng. But I need to change the log format. The problem is that the "template" directive is not available for the udp destination (even for the tcp destination). Could you suggest me some work around to do that? Thanks in advance. - gian P.S I've thought on a work around, but it doesn't work fine. Hence the "template" directive is available for the pipes, I've used a pipe destination to send the logs. Then, I'm using the same pipe, as source, and I'm relaying the logs from it, to another log server. But syslog-ng thinks that the logs are coming from the server, and I get the following (ie, it uses the standard log format, after the pipe): Message Before the pipe -------------------- [X.Y.Z.K] ufs: [ID 213553 kern.notice] NOTICE: realloccg /u00: file system full Message After the pipe --------------------- Sep 25 18:12:11 Figth_cluB_01 [X.Y.Z.K] ufs: [ID 213553 kern.notice] NOTICE: realloccg /u00: file system full I'm using this configuration: # CONF ############################################# source s_net { udp(); }; source s_pipe_per_NI { pipe(/var/chroot/syslog-ng/dev/pipe_per_NI); }; destination relay_to_NI { udp("A.B.C.D" ); }; destination d_pipe_per_NI { pipe("/dev/pipe_per_NI" template("[$HOST] $MSG\n") ); }; log { source(s_net); destination(d_pipe_per_NI); # Here, I can apply the template }; log { source(s_pipe_per_NI); destination(relay_to_NI); # Here, syslog-ng applies the standard log format :( }; # END CONF ############################################# _____ Ing. Gianpiero Porchia Security Engineer ATS - Advanced Telecom Systems Designing, Testing, Managing Network Quality Via Salgari, 17 - 41100 Modena - ITALY Tel +39 059 821332 Fax +39 059 821492 Cel +39 335 330413 E-mail: gianpiero.porchia(a)atsweb.it messenger.msn.com: http://messenger.msn.com/, gianpiero.porchia(a)atsweb.it Web site: http://www.atsweb.it PGP Key ID: 0xCAE064A4 (pgpkeys.mit.edu:11371) Fingerprint: 080D AD88 C18A FCA3 91BC 0DF2 F05F 7489 CAE0 64A4

2 1

/dev/log is not a socket error on startup
by Tony Karakashian 26 Nov '03

26 Nov '03

Howdy. Doing some updates to my Linux box today when I noticed I still hadn't gotten around to setting up log rotation. It was then that I've noticed syslog-ng wasn't running. I tried to start it manually, but get the following: io.c: bind_unix_socket(): /dev/log not a socket Error initializing configuration, exiting. I just upgraded to latest libol (0.3.11) and syslog-ng (1.6.rc4) today, same results. Any ideas? Thanks -T

2 2

Preserving syslogd formatting
by Kenneth Gray 26 Nov '03

26 Nov '03

Howdy, I'm using syslog-ng for the first time. I have several scripts that break because the output from the log files created by syslog-ng does not have the hostname bracketed as it does in syslogd. Is there any option to emulate the syslogd formatting? Example: syslog-ng Oct 3 06:29:13 10.11.27.1/10.11.27.1 1164: syslogd Oct 1 22:48:41 [10.11.27.1.218.94] 2354:

2 1

syslog-ng to mysql
by Ali, Tahir 26 Nov '03

26 Nov '03

Hey, I'am running syslog-ng Version: 1.5.15-1. I pipe all the syslog messages to a mysql database. Every thing works fine, but some times it stop logging to the database. I run mysql Version: 3.23.49-8. When i restart syslog-ng it work fine again. It can work fine for weeks. Have any else experience the same problem ? Regards Tahir

2 1

chain_hostnames = long_hostnames option?
by seberino＠spawar.navy.mil 30 Oct '03

30 Oct '03

-- _______________________________________ Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax : (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

2 2

Syslog-ng Apache and Samba logs
by Rui Teixeira 30 Oct '03

30 Oct '03

Can someone indicate me the way so i can catch the logs of Samba and Apache with Syslog-ng?? I can't find a way to do this... Thanks in advance Rui Teixeira

2 1

re-writing hostnames before sending over TCP
by nate 30 Oct '03

30 Oct '03

I am tryin to configure a semi-secure syslog setup. The primary program that will be logging to it is java via log4j. log4j apparently cannot log to a socket with syslog(as far as I can tell?) only to a udp source, so I configured syslog-ng to bind to 127.0.0.1 on port 514 tcp/udp and it recives the messages fine but the 'host' that is being logged is localhost. I can re-write the log entries using a template for local files but I can't seem to get it workin for sending to a remote syslog server. No matter what options I use it always ends up either localhost or 127.0.0.1 for the hostname. One thing I haven't tried is setting up a filter on the remote server using the host() option but I don't think it would work because the host there would be localhost too not the host of the server sending the message ? is there a way to get syslog-ng to ignore the hostname that's in the message itself and use the hostname/ip of the system that is actually sending the message? or is there another way to accomplish this while keeping syslog-ng bound to the loopback interface? on the local server I also have syslog-ng logging everything to a file, and without using the template all log entries from log4j also appear as being from the host 'localhost'. I suppose I could have log4j log directly to the remote server but rather would use the local one as a buffer incase there is a network problem or something. using ssyslog-ng 1.5.26(on both systems). If I need to upgrade I could .. thanks! nate

2 3

Syslog-ng and Apache logs
by Rui Teixeira 28 Oct '03

28 Oct '03

Hi to all. Can someone tell me how can i catch the apache logs in a machine so the syslog-ng can process them? I can't find the correct facility. Thanks in advance. Rui Teixeira

1 0