March 2003 - syslog-ng - lists.balabit.hu

How to filter XDMCP messages ?
by Gerard Breiner 12 Jan '04

12 Jan '04

Hello, I wonder how to configure syslog-ng to filtering the messages emitted by gdm_xdmcp. this type of messages pollutes my files of logs. Here is messages i don't want : "gdm[3798]: gdm_xdmcp_handle_query: Opcode 1 from ". Best regards Gerard Gerard Breiner Institut d'Astrophysique Spatiale Orsay Campus France

4 5

syslog-ng misinterpreting messages from Enterasys Routers.
by Ted_Rule＠flextech.co.uk 30 Jul '03

30 Jul '03

Having finally bitten the bullet and installed syslog-ng ( libol-0.3.6 / syslog-ng-1.5.24 ), I've only come across one problem... syslog messages from our Enterasys Routers are being corrupted. All Unix and Cisco messages appear Ok. As an example, these raw packets from an SSR and a Cisco: tcpdump -s 512 -x -e -l -n udp and port 514 and host fttv-gps-core-ssrA | tcpdumpascii.pl tcpdump: listening on eth0 10:29:54.111864 0:e0:63:93:25:bf 0:50:8b:f3:93:46 ip 100: 192.168.32.11.4739 > 172.17.12.6.syslog: udp 58 4500 0056 73a2 0000 3f11 6f2a c0a8 200b E..Vs...?.o*.. . ac11 0c06 1283 0202 0042 b5ba 3c31 3838 .........B..<188 3e4a 616e 2032 3320 3130 3a32 393a 3533 >Jan 23 10:29:53 2025 434f 4e53 2d57 2d42 4144 5041 5353 %CONS-W-BADPASS 5744 2c20 696e 636f 7272 6563 7420 7061 WD, incorrect pa 7373 776f 7264 ssword 1 packets received by filter 0 packets dropped by kernel tcpdump -s 512 -x -e -l -n udp and port 514 and host gps-enterprise-cisco-e0 | tcpdumpascii.pl tcpdump: listening on eth0 10:30:44.037939 0:10:7b:80:f:fb 0:50:8b:f3:93:46 ip 138: 172.17.8.76.8800 > 172.17.12.6.syslog: udp 96 4500 007c 29b5 0000 ff11 2547 ac11 084c E..|).....%G...L ac11 0c06 2260 0202 0068 187a 3c31 3839 ...."`...h.z<189 3e31 3036 3737 3a20 4a61 6e20 3233 2031 >10677: Jan 23 1 303a 3330 3a34 3320 474d 543a 2025 5359 0:30:43 GMT: %SY 532d 352d 434f 4e46 4947 5f49 3a20 436f S-5-CONFIG_I: Co 6e66 6967 7572 6564 2066 726f 6d20 636f nfigured from co 6e73 6f6c 6520 6279 2076 7479 3020 2831 nsole by vty0 (1 3732 2e31 372e 3132 2e37 3229 72.17.12.72) Result in this in the log: Jan 23 10:29:53 %CONS-W-BADPASSWD, incorrect password Jan 23 10:30:44 gps-enterprise-cisco-e0 10677: Jan 23 10:30:43 GMT: %SYS-5-CONFIG_I: Configured from console by vty0 (172.17.12.72) It looks as if syslog-ng is assuming %CONS-W-BADPASSWD is a hostname....and the Cisco message picks up a hostname via DNS, which is NOT included in the packet. I note the version 1.5.25 has a bad_hostname() option. Is it possible that this may be used to alleviate this issue, or is some other workround needed? I'm guessing "keep_hostname(no)" might fix it, but would that potentially lead to other problems? Is there a summary of the algorithm which syslog-ng uses to determine whether the message contains a hostname? Current Options settings laid out below. ............... # Global Options Settings options { chain_hostnames(no); keep_hostname (yes); use_dns (yes); use_fqdn (no); long_hostnames (off); dns_cache(yes); dns_cache_size(100); dns_cache_expire(600); dns_cache_expire_failed(120); create_dirs (no); dir_owner(root); dir_group(root); dir_perm(0755); owner(root); group(root); perm(0600); stats(120); sync(10); time_reopen (10); time_reap(20); use_time_recvd(no); log_fifo_size (1000); log_msg_size (1024); gc_idle_threshold(100); ### default 100 gc_busy_threshold(3000); ### default 3000 }; ............... Thanks, Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

3 2

syslog-ng and regex
by Micha Holzmann 10 Apr '03

10 Apr '03

Hello, i am very new at syslog-ng and at its list. I am running two Debian GNU/Linux boxes. One as a DSL Router and the other as my workstation. Today i have installed syslog-ng via apt-get (1.5.15-1.1). I tried to setup remote logging. I want my router/firewall logging additional to my workstation. On the router i have the following entries in syslog-ng.conf Hostname of router = xenia >--- cut here ---- destination loghost {udp("192.168.1.1" port(514));}; log { source(src); destination(loghost); }; >--- cut here ---- Hostname of workstation = kaliba On my workstation i have in syslog-ng.conf: >--- cut here ---- destination rlogging { file("/var/log/syslog-ng/$HOST/syslog.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; filter f_xenia { match("xenia"); }; log { source(src); filter(f_xenia); destination(rlogging); }; >--- cut here ---- I am not sure if this setup is correct. May you can give me some advices. If it is necessary to have my configs, please tell me, i will post them afterwards. Now i have a seceond question, on my workstation runs a cron job which looks for new antivir definition file or new program version (binary file). I tried to put the syslog entries in a separate file. Can i use regex in the match()? May like this: match("antivir\[[0-9]+\]") to catch antivir[19129] >--- cut here ---- destination antivir { file("/var/log/antivir.log"); }; filter f_antivir { match("kaliba antivir"); }; log { source(src); filter(f_antivir); destination(antivir); }; >--- cut here ---- But the logfile entries does not arrive in /var/log/antivir.log. Did i anything wrong? Best regards, Micha Holzmann -- My software never has bugs. It just develops random features.

6 14

Expression match problem in filters
by Rodrigo Borges Pereira 06 Apr '03

06 Apr '03

Hello, I can't match anything with parenthesis, for use in my filters. I tried escaping, but same result. My filter looks something like: filter f_xpto { match("something") and not match("other(xyz)"); }; I get that "other(xyz)" logged anyway.. "other$xyz$" does not work either. Is this an issue with syslog-ng or am i missing something? I'm using syslog-ng 1.5.23. Thanks in advance

3 2

syslog-ng keeps erasing my log file - I don't know why
by seberino＠spawar.navy.mil 01 Apr '03

01 Apr '03

I made a little syslog-ng.conf as follows and tried running syslog-ng. I just checked after a few days and now my /var/log/messages is wiped out. Why did syslog-ng wipe out my /var/log/messages?? Is the fault my syslog-ng.conf below?? options {chain_hostnames(off);}; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

1 0

latest stable version of libol?
by Burv 31 Mar '03

31 Mar '03

Can someone tell me what the latest _stable_ version of libol is? I'm installing syslog-ng, and need to install libol.. __________________________________________________ Do you Yahoo!? Yahoo! Platinum - Watch CBS' NCAA March Madness, live on your desktop! http://platinum.yahoo.com

1 0

RE: [syslog-ng]$MSG into different variables?
by McNutt, Justin M. 31 Mar '03

31 Mar '03

> > Is this possible to do in syslog-ng? Or is there any other method of > > getting the values from the $MSG variable? > > > > I could of course read it from the pipe with some awk or > perl script and > > build the sql-syntax from there. But since I will have quite a few > > different table formats it would then need a perl > interpreter running for > > each table. Not very pretty IMO. > > something similar is available in 1.9.x but that is still not > ready for > production environments. > > the syntax is to use $1 .. $9 in place of $MSG[13] Excellent! We will be waiting anxiously for this. In fact... If you want a server or two to test, I think I could swing that. I have at least one machine here that runs named (hence gets a fair number of log messages) that is just a test box if you want to try it out. RedHat 7.3 (fully patched). --J

1 0

$MSG into different variables?
by m＠ervius.net 29 Mar '03

29 Mar '03

Hi, I'm trying to insert a variety of different logs into a MySql database from syslog-ng. The logs are coming from cisco routers, squid proxys, FW1 etc. and have a varying number of fields. The database tables are created with fields that match the different log formats, - src IP, dest IP, protocol etc. Since I can match the incoming logs with regexps, it is possible to be absolutely sure that a given log message will fit into a given table. What I then would like to do is to split the $MSG into its different columns (separated by whitespace) and call the corresponding destination which would look something like this: destination cisco_icmp { pipe("/tmp/icmp.pipe" template("INSERT INTO router_icmp (host, priority, date, time, program, access_list, if, type_code ) VALUES ( '$HOST', '$PRIORITY', '$YEAR-$MONTH-$DAY', $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG[6]', '$MSG[8]', '$MSG[13]' );\n") template-escape(yes)); }; Is this possible to do in syslog-ng? Or is there any other method of getting the values from the $MSG variable? I could of course read it from the pipe with some awk or perl script and build the sql-syntax from there. But since I will have quite a few different table formats it would then need a perl interpreter running for each table. Not very pretty IMO. Any suggestions? Have I missed something? Thanks! // Martin

2 1

re: [syslog-ng]OpenBSD
by T. 28 Mar '03

28 Mar '03

By the way, if anyone has OpenBSD configs that they would like to post, I'd still be interested in sharing info. It's looking like source s_dgram { unix-dgram("/dev/log"); }; is the way to go, but I've only done some scant preliminary testing. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

OpenBSD
by T. 28 Mar '03

28 Mar '03

I have enjoyed syslog-ng on Solaris for several years so I'm now suffering from a bit of withdrawal having built my fresh, new OpenBSD 3.3 system. I am able to get libol and syslog-ng built just fine. However, I'm noticing that BSD's syslogd creates /dev/log upon initiation and tears it down during shutdown. I saw the patch for casting (void *) NULL in af_program.c in the ports tree but, besides that, I can't seem to find any other patches that would cause syslog-ng to behave similarly. Does anyone have recommendations for the proper set of source() statements to use on OpenBSD? Much thanks in advance. T.E. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1