November 2003 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]Please help with logging remote machines
by Hamilton Andrew 19 Nov '03

19 Nov '03

Looks to me like you are using some flavor of linux. My process table on Redhat only has one entry for syslog-ng. I think you should probably stop the syslog-ng process via your usual startup/shutdown method to see what process it thinks it is running. Then look to see what processes are still alive. Kill those via the kill command then restart syslog-ng via your normal startup procedure. That might clear up some of your issues. Regards, Drew -----Original Message----- From: Daniel Flick [mailto:dflick@pdq.net] Sent: Wednesday, November 19, 2003 2:39 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Please help with logging remote machines On Wed, 2003-11-19 at 12:26, Balazs Scheidler wrote: > On Wed, Nov 19, 2003 at 08:53:51AM -0600, Daniel Flick wrote: > > On Tue, 2003-11-18 at 03:06, Balazs Scheidler wrote: > > > On Mon, Nov 17, 2003 at 02:56:49PM -0600, Daniel Flick wrote: > > > > I have been beating my head against a wall getting this to work but no > > > > joy. Syslog-ng is running and logging on the local system but no remote > > > > logs are being saved. Devices in question are PIX firewalls and > > > > NetCache proxies. > > > > > > Have you checked whether syslog-ng is actually receiving messages ? > > > > > > tcpdump and strace would help here. > > tcpdump shows that the firewalls are contacting the machine. > > > > I was not able to get anything of value with "strace syslog-ng" I am > > new to this tool so I may not be using it right. This is the only error > > I could find but I don't know what that means. > > > > open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or > > directory) > > check the pid of the syslog-ng process as it is running in the background, > and attach to it using strace > > strace -s 256 -o /tmp/syslog-ng.trace -p <syslog-ng pid> > > run it for a couple of seconds, to let your firewall send syslog messages. > Then grep the file /tmp/syslog-ng.trace for the string "recvfrom" > > Each received message should have a corresponding recvfrom() call. If you > can't see anything either syslog-ng is not correctly bound, or your packet > filter drops syslog traffic Interesting that I have so many syslog-ng processes. Is this normal? ps -aux | grep [s]yslog root 11118 0.0 0.0 1780 808 ? S Nov17 1:31 syslog-ng root 11994 0.0 0.0 1724 696 ? S 08:31 0:01 syslog-ng root 11999 0.0 0.0 1712 724 ? S 09:00 0:00 syslog-ng all all root 12066 0.0 0.0 1708 680 ? S 09:22 0:00 syslog-ng root 12071 0.0 0.0 1680 652 ? S 09:23 0:00 syslog-ng root 12075 0.0 0.0 1688 660 ? S 09:23 0:00 syslog-ng root 12079 0.0 0.0 1680 652 ? S 09:23 0:00 syslog-ng root 12083 0.0 0.0 1700 672 ? S 09:24 0:00 syslog-ng root 12087 0.0 0.0 1688 656 ? S 09:24 0:00 syslog-ng root 12091 0.0 0.0 1684 656 ? S 09:24 0:00 syslog-ng root 12095 0.0 0.0 1728 740 ? S 09:25 0:11 syslog-ng I attached to 11999 and a few others and could not find recvfrom anywhere. The file is rather small and I posted one here. I also tries to attach to several other syslog-ng processes with the same results. I also verified that no filters are running that may be dropping the packets. cat /tmp/syslog-ng.trace time(NULL) = 1069271394 poll([{fd=8, events=0}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 5, 100) = 0 poll([{fd=8, events=0}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 5, 31000) = 0 time(NULL) = 1069271425 poll([{fd=8, events=0}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 5, 100) = 0 poll([{fd=8, events=0}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 5, 0) = 0 getpid() = 11999 time(NULL) = 1069271425 time(NULL) = 1069271425 time(NULL) = 1069271425 poll([{fd=8, events=0}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 5, 100) = 0 poll( <unfinished ...> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Flood Protection
by Thomas Vögtle 19 Nov '03

19 Nov '03

Hello, we are using syslog-ng on our servers and we are quite satiesfied with it. But there is still one question open for me: is there any kind of flood protection like the old syslog has? One stupid program got mad and flooded our logs until the harddisk was full. I want to have the same as that: Nov 18 15:58:56 tv2 user: allwaysthesame Nov 18 15:58:56 tv2 last message repeated 137 times No way to configure this behaviour? Thanks, Thomas

3 3

RE: [syslog-ng]Flood Protection
by Rule, Ted 19 Nov '03

19 Nov '03

Surely one can code round that little problem. Instead of maintaining a history table which records the number of times the last message has been received, one records the number of times in the last N seconds that a given client's last message has been repeated. The history table, instead of being one count, and one string buffer, becomes an array indexed by clients of with each item containing a count and a buffer and a timestamp. Obviously the table would have to be size limited and probably idle-time-purged, to avoid it eating up resource. Ted > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Jason Haar > Sent: Tuesday 18 November 2003 22:10 > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Flood Protection > > > On Wed, 2003-11-19 at 04:02, Thomas Vögtle wrote: > > I want to have the same as that: > > Nov 18 15:58:56 tv2 user: allwaysthesame > > Nov 18 15:58:56 tv2 last message repeated 137 times > > > > One problem with this feature is that it can only work if the last 137 > syslog events to occur were the same event. We run a large centralized > syslog server environment, with lots of syslog clients, and > as such this > sort of limiting feature never really gets to work, as it's quite rare > for one event to occur record after record without some other client > squirting in a new record. > > Oh well... > > Cheers > > Jason Haar > Information Security Manager, Trimble Navigation Ltd. > Phone: +64 3 9635 377 Fax: +64 3 9635 417 > PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Compilation Problems!
by Vijayant J Singh 17 Nov '03

17 Nov '03

Hi, I'm Getting following messege while performing 'make' after './configure' ... Root@stonegate ~/syslog-ng-1.9.1 # make make all-recursive make[1]: Entering directory `/root/syslog-ng-1.9.1' Making all in src make[2]: Entering directory `/root/syslog-ng-1.9.1/src' make[2]: *** No rule to make target `fdread.h', needed by `logreader.o'. Stop. make[2]: Leaving directory `/root/syslog-ng-1.9.1/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/syslog-ng-1.9.1' make: *** [all-recursive-am] Error 2 please help me out! Thanks VJS Get Your Private, Free E-mail from Indiatimes at http://email.indiatimes.com Buy The Best In BOOKS at http://www.bestsellers.indiatimes.com Bid for for Air Tickets @ Re.1 on Air Sahara Flights. Just log on to http://airsahara.indiatimes.com and Bid Now!

1 0

Compilation Problems!
by Vijayant J Singh 17 Nov '03

17 Nov '03

Hi, I'm Getting following messege while performing 'make' after './configure' ... Root@stonegate ~/syslog-ng-1.9.1 # make make all-recursive make[1]: Entering directory `/root/syslog-ng-1.9.1' Making all in src make[2]: Entering directory `/root/syslog-ng-1.9.1/src' make[2]: *** No rule to make target `fdread.h', needed by `logreader.o'. Stop. make[2]: Leaving directory `/root/syslog-ng-1.9.1/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/syslog-ng-1.9.1' make: *** [all-recursive-am] Error 2 please help me out! Thanks VJS Get Your Private, Free E-mail from Indiatimes at http://email.indiatimes.com Buy The Best In BOOKS at http://www.bestsellers.indiatimes.com Bid for for Air Tickets @ Re.1 on Air Sahara Flights. Just log on to http://airsahara.indiatimes.com and Bid Now!

1 0

Filter postfix log messages
by Florian Lindner 14 Nov '03

14 Nov '03

Hello, I want to filter out all log messages from postfix. They look like these: Nov 9 14:16:28 s_sys@bastet postfix/pickup[24484]: 4D92C4580B7: uid=30 from=<wwwrun> Nov 9 14:16:28 s_sys@bastet postfix/cleanup[24510]: 4D92C4580B7: message-id=<20031109131628.4D92C4580B7(a)bastet.centershock.net> How can I do that? I tried: filter f_postfix { match(".{16,16}s_sys@bastet postfix"); }; But it doesn't work... Thanks, Florian

2 1

GUI Monitoring tool ?
by Tom McGee 13 Nov '03

13 Nov '03

Hi, I'm a real newbie to syslog-ng so sorry if this has been asked before. I'm looking for something that will allow me to keep an eye on syslog via some GUI. Ideally via a browser... Any suggestions ? Thanks Tom. _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

2 1

RE: [syslog-ng]GUI Monitoring tool ?
by Hamilton Andrew 13 Nov '03

13 Nov '03

What do you mean by "keep an eye on"? Do you want logging stats, or just "is it running"? There are a number of system monitoring tools out there that will let "watch" various processes including syslog-ng. I use Big Brother(http://www.bb4.com). I wrote a couple of scripts that monitor the syslog-ng process and plugged them into Big Brother so I could ensure that it was alive and kicking. The BB results are posted on a series of web pages, all of which are customizable. I know there are several others out there and some of the other folks here use them so perhaps they will respond as well. Regards, Drew -----Original Message----- From: Tom McGee [mailto:tom_mcgee_2@hotmail.com] Sent: Wednesday, November 12, 2003 4:00 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]GUI Monitoring tool ? Hi, I'm a real newbie to syslog-ng so sorry if this has been asked before. I'm looking for something that will allow me to keep an eye on syslog via some GUI. Ideally via a browser... Any suggestions ? Thanks Tom. _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3

Backslash-escaped quotes in message strings
by Jos Vos 11 Nov '03

11 Nov '03

Hi, When a single (') or double (") quote appears in a syslog message, this quote gets escaped with a backslash by syslog-ng, which results in pretty ugly output, different from what the standard Linux sysklogd does (this doesn't change the message). Can this be considered a bug (or is it a feature)? Thanks, -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204

3 5

RE: [syslog-ng]Use template() for Program()
by Kenneth Webber 10 Nov '03

10 Nov '03

>the template() function applies to file destination too in syslog-ng 1.6. >( and if i'm not wrong it applies to all destination now even udp() and >tcp() ) >I cannot remember when syslog-ng starts to apply template function to file >but there is a patch for 1.5.20. Thanks, I was on syslog-ng 1.5.26. I am now upgraded to 1.6.0rc4 and it works great. _________________________________________________________________ Crave some Miles Davis or Grateful Dead? Your old favorites are always playing on MSN Radio Plus. Trial month free! http://join.msn.com/?page=offers/premiumradio

1 0