October 2003 - syslog-ng - lists.balabit.hu

RE: syslog-ng digest, Vol 1 #1042 - 12 msgs
by Jay Davis 27 Oct '03

27 Oct '03

This may be a bit late, but I am doing exactly the same thing you need with network devices. I doubt you want chain_hostnames. This just puts the chain of hostnames with the path (hosts) that the message has passed through. We log to several (load balanced) dedicated syslog hosts, which then forward the messages to an event management system. We also use syslog-ng to then forward all messages to a central syslog system that we have simple Web apps to peruse the messages. This last part will soon be an applicance (can't mention the vendor). I have found that the syslog-ng.conf.doc file in the contrib directory will have everything you could possibly need to know about syslog-ng. Plus the very smart peeps that read this listserv. Here are my options. I certainly hope this helps. If you need to feel free to give me a shout. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); dns_cache_size(1000); dns_cache_expire_failed(5); use_fqdn (no); create_dirs (no); perm(644); keep_hostname (yes); }; ==========Christians Part. ( Cut and paste job. ) My little brainless syslog-ng.conf below NEEDS the one option you see or else the log file will refer to host as "src@myhostname" instead of just "myhostname". Please explain a little better what chain_hostnames does/means and why it fixes this problem. Is there some other simpler way to fix aforementioned problem?? options {chain_hostnames(no);}; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. ===========================

1 0

Some device doesn't write to file
by Santa Lau 27 Oct '03

27 Oct '03

Hi, I just upgrade the hardware and software of the syslog-ng server to 1.60rc4 from 1.5 to log about 30 firewalls syslog. After upgarde, I did find that nearly half of the firewalls log doesn't write to the file. I did check with tcpdump and it did receive the tons of logs but did't log into the file. The iptables/ipchains has all been disabled. Is there any way to identify the source of problem. Thanks for your help. B. Regards, Santa

2 5

John K Brooks is out of the office.
by John K Brooks 27 Oct '03

27 Oct '03

I will be out of the office starting 10/24/2003 and will not return until 10/29/2003. I will not be able to check my mail during this time. For network management issues, please contact John Oo at 973-682-4458 or Rich Molinaro at 973-682-4457. Thank you, John -- This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

1 0

syslog-ng & BSD Relay Host
by Philip Webster 27 Oct '03

27 Oct '03

Hello, I'm having some trouble with a BSD relay host, and wonder if anyone out there may have a solution. The relay picks up messages from routers, switches, PIXes, etc and sends them via UDP (standard syslog daemon) to a central syslog-ng host. The messages 'on the wire' look like this (tcpdump output): Forwarded from host.domain: Oct 27 2003 09:43:47: %PIX-4-106023: Msg ... So the hostname in the syslog message is 'Forwarded from host.domain'. This appears to be interpreted by syslog-ng as 'Forwarded', which adheres (as it should) to RFC 3164. I'm splitting up the logs based on hostname, so I'd like to be able to log to a file named after the host which sent the log. So far all of my playing around with options has resulted in either: 1) logs go to a file named relayhost with the entry: relayhost from host.domain: Oct 27 2003 09:43:47: %PIX-4-106023: Message so this is just the message on with wire with the 'relayhost' in place of 'Forwarded', 2) logs go to a file named 'Forwarded' with the entry: Forwarded from host.domain: Oct 27 2003 09:43:47: %PIX-4-106023: Message so the word 'Forwarded' is taken to be the hostname, or 3) logs go to a file named 'Forwarded' with the entry: Forwarded/relayhost from host.domain: Oct 27 2003 09:43:47: %PIX-4-106023: Message so the hostname still appears to be 'Forwarded', but the chaining options also show the relay host. What I would like is to have the logs placed in a file named after the original sender (host.domain in the tcpdump output above). Is this possible? All my attempts have relied around using global options and file templates - I haven't looked at using filters yet, so maybe this is what I need to do. This appears to be a BSD problem, as it modifies the actual message before relaying it on, but I cannot find an option to stop BSD syslog from doing this. Any thoughts? Thanks Phil

1 0

I don't understand chain_hostnames option & why it fixes this problem...
by seberino＠spawar.navy.mil 24 Oct '03

24 Oct '03

My little brainless syslog-ng.conf below NEEDS the one option you see or else the log file will refer to host as "src@myhostname" instead of just "myhostname". Please explain a little better what chain_hostnames does/means and why it fixes this problem. Is there some other simpler way to fix aforementioned problem?? options {chain_hostnames(no);}; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; -- _______________________________________ Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax : (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

2 3

syslog-ng minor tcp-wrappers bug
by Ed Ravin 23 Oct '03

23 Oct '03

test_nscache.c refuses to build on NetBSD 1.5 if --enable-tcp-wrapper is set. The patch below fixes the problem. I don't know if test_nscache actually works since I'm not clear on what it does and I've always lived without it in the past, but at least with the patch applied I don't get error messages (undefined reference allow_severity & deny_severity) when I run "make". diff -u -r1.1 test_nscache.c --- test_nscache.c 2003/10/23 21:50:13 1.1 +++ test_nscache.c 2003/10/23 21:50:16 @@ -2,6 +2,12 @@ #include "nscache.h" #include <stdio.h> +#if ENABLE_TCP_WRAPPER +#include <tcpd.h> +int allow_severity = 0; +int deny_severity = 0; +#endif + int main() { struct in_addr in;

1 0

newbie questions about hostname related options
by seberino＠spawar.navy.mil 21 Oct '03

21 Oct '03

I got syslog-ng working and am happy with it but I had one question about necessary syslog-ng.conf options that is bugging me. I don't know what hostname related options are necessary for a little log server with 3 clients: use_fqdn keep_hostname long_hostnames chain_hostnames I remember NEEDING chain_hostnames(off) to solve a problem but I wonder: 1. if problem could have been solved with another option in list above 2. what are minimum options that make a good little syslog-ng installation. (I wonder if keep_hostname(yes) solves 99% of the problems and is good enough. I don't know.) Any help would be greatly appreciated. Sincerely, Chris -- _______________________________________ Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax : (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

3 5

Where did netmask() come from ?
by Wayne Sweatt 16 Oct '03

16 Oct '03

I did not have a clue about this function. This should do just what I want in getting the logs from clients on various networks logged into different log directories. Thanks to Mr Verde! So when did this added netmask() function appear? Is the documentation old? What version of syslog-ng/libol was this introduced in? Does the on-line documentation need updating? Thanks, Wayne Sweatt Sr. UNIX System Administrator Comforce Technical Services LANL SCC Team

2 1

Sort/filter logs on source IP address
by Wayne Sweatt 15 Oct '03

15 Oct '03

I've asked this question before in a slightly different manner (Can I run multiple instances of Syslog-NG - One for Mac OS X, one for other UNIX...), but still have not a satisfactory answer to that on, so.. I'd thought I'd ask a similar question and hope for a more definitive answer: Is there a way to filter or regexp match an incoming UDP log by IP Address so that logging clients from certain networks go to certain log directories/destinations ? For example, I want to log everything from 128.128.1.0 in /var/log/NetworkA, and log everything from 128.128.2.0 in /var/log/NetworkB/. I know host() will operate on hostname, but I don't want to have to maintain a list of hosts to match against - I want it be dynamic, so when a new client is added, it can log automatically to the appropriate directory. Syslog-ng has the source IP with each log, so this shouldn't be a problem, right? I am using the latest version of syslog-ng, and UDP as the protocol. Reminder: I do not want to know about TCP Wrappers, I don't want to block IPs, just direct logs from certain IP subnets to certain directories/file-systems. Wayne Sweatt Sr. UNIX System Administrator Comforce Technical Services LANL SCC Team

3 2

Re: bug in syslog-ng?
by Balazs Scheidler 15 Oct '03

15 Oct '03

On Tue, Oct 14, 2003 at 11:33:10AM +0200, Marc Silver wrote: > Hi Balázs, > > I just upgraded from syslog-ng-1.6.0rc2 to syslog-ng-1.6.0rc4 and have > noticed that there is now an odd binary character in my pix log files. > Is this a bug, or something new in syslog-ng? A quick strace shows: > > write(10, "Oct 14 11:25:40\0 pixname %PIX-4-"..., 133) = 133 > > As you can see, it's writing a \0 after the datestamp, which it didn't > seem to be doing before. > > Any information you could provide on this would help. it is definitely a bug, and is caused by the new PIX date stamp parsing code. This patch seems to fix the bug for me: diff -u syslog-ng/src/log.c:1.31 syslog-ng/src/log.c:1.32 --- syslog-ng/src/log.c:1.31 Fri Oct 3 16:16:38 2003 +++ syslog-ng/src/log.c Wed Oct 15 10:26:44 2003 @@ -99,6 +99,7 @@ tm.tm_isdst = -1; lm->date = ol_string_alloc(16); strftime(lm->date->data, 16, "%b %e %H:%M:%S", &tm); + lm->date->length--; src[20] = ':'; src += 21; left -= 21; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0