February 2003 - syslog-ng - lists.balabit.hu

Anyone using swatch with R_ISODATE set?
by Jason Haar 24 Feb '03

24 Feb '03

Hi there I'm using swatch 3.1beta and it's throttling option isn't too happy about me using R_ISODATE in my syslogs. i.e. 2003-02-24T20:21:17+0000 server.name mail info qmail: 1046118077.034427 status: local 0/10 remote 0/100 As you can see, I've put all possible information about each syslog record in: UTC timestamped, plus facility and priority. Anyway, swatch doesn't like that timestamp format and probably doesn't like the rest either. I've tried using the new perl_code option to remap how it matches, but it looks like it didn't expect anyone to be screwing around with the timestamp so much :-) Anyone else got it to work? At the moment I'm having to pump the syslogs through a prefilter to convert back into "standard" syslog format to keep swatch happy - it works, but a hack is a hack... Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

1 0

RE: [syslog-ng]syslog-ng and regex
by Hamilton, Andrew 24 Feb '03

24 Feb '03

Yes, it should. Regards, Drew -----Original Message----- From: Micha Holzmann [mailto:holzmann@mhnet.de] Sent: Monday, February 24, 2003 2:49 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng and regex Hello Andrew, Hamilton, Andrew wrote: > To match a program name you use the program function in the filter. > > filter f_antivir { program("antivir"); }; The corresponding syslog messages are: >--- cut here ---- Feb 24 14:00:02 kaliba antivir[1718]: AntiVir is up-to-date Feb 24 15:00:11 kaliba antivir[2451]: AntiVir is up-to-date Feb 24 16:00:02 kaliba antivir[2662]: AntiVir is up-to-date Feb 24 17:02:49 kaliba antivir[2979]: reloaded AntiVir mail scanner successfully Feb 24 17:02:49 kaliba antivir[2979]: AntiVir successfully updated itself (antivir.vdf) >--- cut here ---- The filter statement "filter f_antivir { program("antivir"); };" catch syslog messages like these above? Best regards, Micha Holzmann -- UNIX is user friendly, it's just picky about who its friends are

1 0

RE: [syslog-ng]syslog-ng and regex
by Hamilton, Andrew 24 Feb '03

24 Feb '03

To match a program name you use the program function in the filter. filter f_antivir { program("antivir"); }; Regards, Drew -----Original Message----- From: Micha Holzmann [mailto:holzmann@mhnet.de] Sent: Monday, February 24, 2003 12:42 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng and regex Hello, i am very new at syslog-ng and at its list. I am running two Debian GNU/Linux boxes. One as a DSL Router and the other as my workstation. Today i have installed syslog-ng via apt-get (1.5.15-1.1). I tried to setup remote logging. I want my router/firewall logging additional to my workstation. On the router i have the following entries in syslog-ng.conf Hostname of router = xenia >--- cut here ---- destination loghost {udp("192.168.1.1" port(514));}; log { source(src); destination(loghost); }; >--- cut here ---- Hostname of workstation = kaliba On my workstation i have in syslog-ng.conf: >--- cut here ---- destination rlogging { file("/var/log/syslog-ng/$HOST/syslog.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; filter f_xenia { match("xenia"); }; log { source(src); filter(f_xenia); destination(rlogging); }; >--- cut here ---- I am not sure if this setup is correct. May you can give me some advices. If it is necessary to have my configs, please tell me, i will post them afterwards. Now i have a seceond question, on my workstation runs a cron job which looks for new antivir definition file or new program version (binary file). I tried to put the syslog entries in a separate file. Can i use regex in the match()? May like this: match("antivir\[[0-9]+\]") to catch antivir[19129] >--- cut here ---- destination antivir { file("/var/log/antivir.log"); }; filter f_antivir { match("kaliba antivir"); }; log { source(src); filter(f_antivir); destination(antivir); }; >--- cut here ---- But the logfile entries does not arrive in /var/log/antivir.log. Did i anything wrong? Best regards, Micha Holzmann -- My software never has bugs. It just develops random features.

2 1

Betr.: Re: [syslog-ng]syslog-ng 1.6.0rc1 available
by EDL.Essed＠belastingdienst.nl 24 Feb '03

24 Feb '03

>can you check if the latest snapshot fixes these issues? > >http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot/syslog-ng-1.6.0… Thanks, this solved the problem compiling the lex file. No other problems occured afterwards. (The file 'configure' still has to be changed though). Esteban ___________________________________________ Esteban Essed B/CICT, Sector Continuiteit MPS/Midrange WBC-F305 Tel: (055 - 528) 3586 ___________________________________________ wok, n.: Something to thwow at a wabbit. ___________________________________________ ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

1 0

Re: [syslog-ng]syslog-ng 1.6.0rc1 available
by EDL.Essed＠belastingdienst.nl 24 Feb '03

24 Feb '03

Hi, I'm having problems building, checking for libol fails. ./configure --with-libol=/home/essee05/logging/src/libol-0.3.9 checking libol version >= 0.3.9... no configure: error: Required libol version not found Looking at configure.in, I see the sed part has changed. Changing it back to the 3 lines from 1.5.26 makes it work again. Next to that the lex part fails to compile, but this might be related, as I get a warning that I don't have autoheader on my system, needed after changing configure.in: flex cfg-lex.l && mv lex.yy.c cfg-lex.c gcc -DHAVE_CONFIG_H -I. -I/home/essee05/logging/src/syslog-ng-1.6.0rc1/src -I. -g -O2 -Wall -I/home/essee05/logging/src/libol-0.3.9/src -D_GNU_SOURCE -c cfg-lex.c cfg-lex.l:83: `KW_FILE_TEMPLATE' undeclared here (not in a function) cfg-lex.l:83: initializer element is not constant cfg-lex.l:83: (near initialization for `keywords[39].kw_token') make: 1254-004 The error code from the last command is 1. Any help appriciated. Esteban. ___________________________________________ Esteban Essed B/CICT, Sector Continuiteit MPS/Midrange WBC-F305 Tel: (055 - 528) 3586 ___________________________________________ wok, n.: Something to thwow at a wabbit. ___________________________________________ ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

2 1

mailing list archives
by Nate Campi 21 Feb '03

21 Feb '03

The list archives at https://lists.balabit.hu/pipermail/syslog-ng/ aren't working anymore. -- Nate Campi http://www.campin.net

1 0

[PATCH] more complete RPMs for RedHat 7.3 and beyond.
by Blaise St-Laurent 21 Feb '03

21 Feb '03

I've attached a spec file that makes building and installing syslog-ng 1.6.0rc1 on Redhat quite a bit easier. Once the rpm files are built, all that is required is a service syslog stop chkconfig --del syslog chkconfig --add syslog-ng service syslog-ng start I've altered the spec file (i also fixed a typo in the source: url) and added the necessary files (/etc/sysconfig/syslog-ng) to be able to use the supplied init script (as found in the contrib directory) Hopefully this can get into the next version so i can stop giving my client a custom build :) If there are any problems, please report them to me. Blaise St-Laurent Senior Security Architect 613-266-4258 ____________________________________________________________________ Okiok Data http://www.okiok.com (450) 681-1681 Solutions de sécurité d'entreprise et d'affaires électroniques Enterprise and e-business security solutions This e-mail message (including attachments, if any) is intended for the use of the individual or entity to which it is addressed and may contain information that is privileged, proprietary, confidential and exempt from disclosure. If you are not the intended recipient, you are notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender and erase this e-mail message immediately. Le présent message électronique (y compris les pièces qui y sont annexées, le cas échéant) s'adresse au destinataire indiqué et peut contenir des renseignements de caractère privé ou confidentiel. Si vous n'êtes pas le destinataire de ce document, nous vous signalons qu'il est strictement interdit de le diffuser, de le distribuer ou de le reproduire. Si ce message vous a été transmis par erreur, veuillez en informer l'expéditeur et le supprimer immédiatement.

1 0

syslog-ng 1.6.0rc1 available
by Balazs Scheidler 20 Feb '03

20 Feb '03

Hi, Let me use this opportunity to also announce our new website and the new features it provides. * Until now both the English and Hungarian contents were available on both www.balabit.com and www.balabit.hu, this has now changed. English content is only available on www.balabit.com, Hungarian is only available at www.balabit.hu. * Daily snapshots are now available in the src-snapshot directory of a given major version. These snapshots are generated from my internal CVS tree, thus patches sent to the mailing list are usually integrated. Snapshots have a version number like 1.6.0rc1+20030220 where '+' separates the current actual version number and the date the snapshot was generated. Snapshots are not tested in any way, so it is possible that they do not compile, however new patches are integrated there first. * Security advisories are put into a single location so both Zorp and syslog-ng related advisories can be found at the same location. And now the more important thing: I have released syslog-ng 1.6.0rc1 which is available at http://www.balabit.com/products/syslog-ng/upgrades.bbq or in Hungarian: http://www.balabit.hu/products/syslog-ng/upgrades.bbq with the following changes: News for the 1.6.0rc1 release Thu, 20 Feb 2003 11:19:52 +0100 * Reconnect if a problem occurs during connection establishment (earlier only ECONNREFUSED was handled) * Fixed the file source to close the file descriptor prior to opening it again during HUP, fixes kernel log reading on BSD systems. * applied a patch by Achim Gsell to add template() functions to all destination drivers -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

writing to /dev/log hungs system
by Elan Ruusamäe 20 Feb '03

20 Feb '03

hi since time to time all applications hung that write to syslog, and i cannot ^C ^Z ^\ them ;( i cannot su to root and kill syslog-ng too. this has happened several times over several machines i've turned off dns lookups, since i guessed dns downtime affects this, but that did not help the problem, when it's arisen, gets solved by some 6 hours i guess the hung arises on high flood to syslog here's some strace too: socket(PF_UNIX, SOCK_DGRAM, 0) = 3 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 connect(3, {sin_family=AF_UNIX, path="/dev/log"}, 16) = -1 EPROTOTYPE (Protocol wrong type for socket) close(3) = 0 socket(PF_UNIX, SOCK_STREAM, 0) = 3 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 connect(3, {sin_family=AF_UNIX, path="/dev/log"}, 16 <HUNGS HERE> i'm using syslog-ng 1.4.17 os is linux, redhat based kernel varies, but mostly 2.4.18 (redhat patches) config options: options { long_hostnames(off); sync(0); use_dns (no); use_fqdn (no); }; source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; -- glen

2 1

RE: [syslog-ng]Trouble using syslog-ng on Solaris 8
by Michael Breton 19 Feb '03

19 Feb '03

> -----Original Message----- > From: Robin Brown [mailto:robin_brown@totalcomm.com] > Sent: Wednesday, February 19, 2003 1:36 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Trouble using syslog-ng on Solaris 8 > > > Hi, running solaris 8 and syslog-ng 1.5.26. It all seems to > start just > fine, no errors at startup or when running. But none of the logs get > populated and I can see the UDP traffic is still coming in. > Any way to > see if it's simply not matching the host criteria for some reason? > > Below is my config, any help is appreciated: Config looks fine. What verison of libol did you install? There was a bug in a prior version that did the same thing to me. Just upgrade to the latest version of libol and recompile syslog-ng. libol does not need to be installed (Although it can be), but make sure syslog-ng isn't being compiled with the old version of libol. Michael Breton Commtel

2 1