March 2003 - syslog-ng - lists.balabit.hu

28 Mar '03

I should have known that, as soon as I posted a question, I'd find the answer myself. D'OHHHHH!!!!! RTFM! RTFM! RTFM! http://www.campin.net/syslog-ng/faq.html Much apologies in advance :-) T.E. --- On Fri 03/28, T. < t_esting(a)excite.com > wrote: From: T. [mailto: t_esting(a)excite.com] To: syslog-ng(a)lists.balabit.hu Date: Fri, 28 Mar 2003 13:59:33 -0500 (EST) Subject: [syslog-ng]OpenBSD I have enjoyed syslog-ng on Solaris for several years so I'm now suffering from a bit of withdrawal having built my fresh, new OpenBSD 3.3 system. I am able to get libol and syslog-ng built just fine. However, I'm noticing that BSD's syslogd creates /dev/log upon initiation and tears it down during shutdown. I saw the patch for casting (void *) NULL in af_program.c in the ports tree but, besides that, I can't seem to find any other patches that would cause syslog-ng to behave similarly. Does anyone have recommendations for the proper set of source() statements to use on OpenBSD? Much thanks in advance. T.E. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web! _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.c ampin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

file/directory permissions
by netsec novice 27 Mar '03

27 Mar '03

I am a linux newbie so please don't blast me for my ignorance. I have set up syslog-ng on my SUSE box and even managed to configure the syslog-ng.conf so that any newcoming syslog messages are organized by IP address as a directory and a new file is created for each day. I now need to allow others to view these logs but default privileges are for owner=root and group=root. I need all newly created directories and files to allow access to a group named syslog that I created. Is it a matter of starting the syslog service with different privileges or 'owner'. Currently, I'm having to go into the syslog file structure and chgrp and chmod to my desired settings on a daily basis. I'm open to any suggestions.... Nicole _________________________________________________________________ MSN 8 helps eliminate e-mail viruses. Get 2 months FREE*. http://join.msn.com/?page=features/virus

2 1

OpenBSD configuration
by T. 27 Mar '03

27 Mar '03

I'm a bit new to OpenBSD but have been a big syslog-ng fan on Solaris. Can anyone give me a quick pointer on the proper source() statements to use on OpenBSD? I can get syslog-ng compiled and started up but I'm not quite sure which log device to get it to listen on or which input driver to select. Much thanks in advance. t_esting(a)excite.com _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

reference manual - problem with tcp example
by Martin Pala 27 Mar '03

27 Mar '03

Hi, i read used example from syslog-ng reference manual - there's extra semi-colon, which causes syslog-ng to fail during startup: Reference manual part: Example 3-9. Using the tcp() driver destination d_tcp { tcp("10.1.2.3" port(1999); localport(999)); }; ^^^ Correct is: destination d_tcp { tcp("10.1.2.3" port(1999) localport(999)); }; Cheers, Martin Pala

1 0

RE: [syslog-ng]$MSG into different variables?
by email lists 26 Mar '03

26 Mar '03

ditto to this... tia -----Original Message----- From: McNutt, Justin M. [mailto:McNuttJ@missouri.edu] Sent: Friday, 21 March 2003 4:06 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]$MSG into different variables? If you find a solution to this, *please please please* post it to the list! :-) Thanks! --J

1 0

no carriage returns on logserver
by Stefan Schewczik 26 Mar '03

26 Mar '03

we are running a centralized logserver (suse 8.0) with the standard syslog daemon (version 1.4.1) and several clients (pld 1.0) with syslog-ng (version 1.4.17). the logfiles on the logserver looks like this. Mar 26 11:35:17 grz-1 grz-1 watchdog[1243]: current load is 0 0 0 <30>Mar 26 11:35:17 grz-1 watchdog[1243]: current load is 0 0 0 <30>Mar 26 11:35:17 grz-1 watchdog[1243]: was able to ping process 1617 (/var/run/syslog-ng.pid). <30>Mar 26 11:35:17 grz-1 watchdog[1243]: was able to ping process 1617 (/var/run/syslog-ng.pid). whereas the logfiles on the clients itself look ok. Mar 26 11:35:17 grz-1 watchdog[1243]: current load is 0 0 0 Mar 26 11:35:17 grz-1 watchdog[1243]: was able to ping process 1617 (/var/run/syslog-ng.pid). Mar 26 11:35:32 grz-1 watchdog[1243]: current load is 0 0 0 Mar 26 11:35:32 grz-1 watchdog[1243]: was able to ping process 1617 (/var/run/syslog-ng.pid). Mar 26 11:35:47 grz-1 watchdog[1243]: current load is 0 0 0 Mar 26 11:35:47 grz-1 watchdog[1243]: was able to ping process 1617 (/var/run/syslog-ng.pid). Mar 26 11:36:02 grz-1 watchdog[1243]: current load is 0 0 0 Mar 26 11:36:02 grz-1 watchdog[1243]: was able to ping process 1617 (/var/run/syslog-ng.pid). Mar 26 11:36:17 grz-1 watchdog[1243]: current load is 0 0 0 as you can see, there are no carriage returns in the logfiles of the logserver, so its very hard to read the logs. any help would be appreciated. /etc/syslog-ng/syslog-ng.conf: (clients) options { long_hostnames(off); sync(0); }; source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; # uncomment below line if you want setup syslog server #source net { udp(); }; destination loghost { udp("backup.domain.com"); }; destination kern { file("/var/log/kernel"); }; destination messages { file("/var/log/messages"); }; destination authlog { file("/var/log/secure"); }; destination mail { file("/var/log/maillog"); }; destination uucp { file("/var/log/spooler"); }; destination debug { file("/var/log/debug"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; destination xconsole { pipe("/dev/xconsole"); }; destination mailinfo { file("/var/log/mail/info"); }; destination mailwarn { file("/var/log/mail/warn"); }; destination mailerr { file("/var/log/mail/err"); }; destination newscrit { file("/var/log/news/news.crit" owner(news) group(news)); }; destination newserr { file("/var/log/news/news.err" owner(news) group(news)); }; destination newsnotice { file("/var/log/news/news.notice" owner(news) group(news)); }; destination cron { file("/var/log/cron"); }; destination syslog { file("/var/log/syslog"); }; destination daemon { file("/var/log/daemon"); }; destination lpr { file("/var/log/lpr"); }; destination user { file("/var/log/user"); }; destination ppp { file("/var/log/ppp"); }; # Log iptables messages to separate file destination iptables { file("/var/log/iptables"); }; filter f_syslog { not facility(authpriv, mail, news) and not match("IN=[A-Za-z0-9]* OUT=[A-Za-z0-9]*") and not match("cron") ; }; filter f_iptables { facility(kern) and match("IN=[A-Za-z0-9]* OUT=[A-Za-z0-9]*"); }; filter f_kern { facility(kern) and not match("IN=[A-Za-z0-9]* OUT=[A-Za-z0-9]*") ; }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv) and not match("cron"); }; filter f_cron { facility(cron) or match("cron"); }; filter f_daemon { facility(daemon); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_ppp { facility(daemon) and program(pppd) or program(chat); }; filter f_news { facility(news); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news, daemon); }; filter p_debug { level(debug); }; filter p_info { level(info); }; filter p_notice { level(notice); }; filter p_warn { level(warn); }; filter p_err { level(err); }; filter p_alert { level(alert); }; filter p_crit { level(crit); }; filter p_emergency { level(emerg); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_ppp); destination(ppp); }; log { source(src); filter(p_debug); destination(debug); }; log { source(src); filter(p_emergency); destination(console); }; log { source(src); destination(console_all); }; log { source(src); filter(f_mail); destination(mail); }; #log { source(src); filter(f_mail); filter(p_info); destination(mailinfo); }; #log { source(src); filter(f_mail); filter(p_warn); destination(mailwarn); }; #log { source(src); filter(f_mail); filter(p_err); destination(mailerr); }; log { source(src); filter(f_news); filter(p_crit); destination(uucp); }; log { source(src); filter(f_news); filter(p_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(p_err); destination(newserr); }; log { source(src); filter(f_news); filter(p_warn); destination(newsnotice); }; log { source(src); filter(f_news); filter(p_notice); destination(newsnotice); }; log { source(src); filter(f_news); filter(p_info); destination(newsnotice); }; log { source(src); filter(f_news); filter(p_debug); destination(newsnotice); }; log { source(src); filter(f_iptables); destination(iptables); }; log { source(src); filter(f_authpriv); destination(loghost); }; log { source(src); filter(f_syslog); destination(loghost); }; log { source(src); filter(f_cron); destination(loghost); }; log { source(src); filter(f_daemon); destination(loghost); }; log { source(src); filter(f_lpr); destination(loghost); }; log { source(src); filter(f_user); destination(loghost); }; log { source(src); filter(f_uucp); destination(loghost); }; log { source(src); filter(f_messages); destination(loghost); }; log { source(src); filter(f_ppp); destination(loghost); }; log { source(src); filter(p_debug); destination(loghost); }; log { source(src); filter(p_emergency); destination(loghost); }; /etc/syslog.conf (of the logserver) # /etc/syslog.conf - Configuration file for syslogd(8) # # For info about the format of this file, see "man syslog.conf". # # # # print most on tty10 and on the xconsole pipe # *.* /dev/tty12 kern.warn;*.err;authpriv.none /dev/tty10 kern.warn;*.err;authpriv.none |/dev/xconsole *.emerg * # enable this, if you want that root is informed # immediately, e.g. of logins #*.alert root # # all email-messages in one file # mail.* -/var/log/mail # # all news-messages # # these files are rotated and examined by "news.daily" news.crit -/var/log/news/news.crit news.err -/var/log/news/news.err news.notice -/var/log/news/news.notice # enable this, if you want to keep all news messages # in one file #news.* -/var/log/news.all # # Warnings in one file # *.=warn;*.=err -/var/log/warn *.crit /var/log/warn # # save the rest in one file # *.*;mail.none;news.none -/var/log/messages # # enable this, if you want to keep all messages # in one file #*.* -/var/log/allmessages # # Some foreign boot scripts require local7 # local0,local1.* -/var/log/localmessages local2,local3.* -/var/log/localmessages local4,local5.* -/var/log/localmessages local6,local7.* -/var/log/localmessages kern.* -/var/log/firewall

1 0

config help
by Nicholas Bernstein 25 Mar '03

25 Mar '03

What I think this should be doing: reads src, parses, creates file, writes to file, next. at the very least it it not doing the write. I would imagine more, but I'm not sure how I can tell. Could someone please take a look at the config file and tell me if I am doing something wrong? The examples of the type of data I'm looking for: ftp: Mar 25 14:38:22 da2 ftp(pam_unix)[12722]: session opened for user nick by (uid=0) Mar 25 14:39:45 da2 ftpd[12995]: wu-ftpd - TLS settings: control allow, client_cert allow, data allow Mar 25 14:39:49 da2 ftp(pam_unix)[12995]: session opened for user nick by (uid=0) fw: Mar 23 23:23:34 da2 kernel: IN=eth0 OUT= MAC=00:08:02:b0:67:c1:00:50:54:ff:12:6a:08:00 SRC=68.69.59.21 DST=192.168.210.13 LEN=60 TOS=0x00 PREC=0x00 TTL=42 ID=43080 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=23547 Mar 23 23:23:34 da2 kernel: IN= OUT=eth0 SRC=192.168.210.13 DST=68.69.59.21 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=55063 PROTO=ICMP TYPE=0 CODE=0 ID=512 SEQ=23547 TIA! Nick syslog-ng.conf: -------------------------------------------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); #MY ADDITIONS: create_dirs (yes); dir_owner(root); dir_group(wheel); dir_perm(775); keep_hostname (yes); owner(root); group(wheel); perm(660); }; # A LOT OF THIS IS STANDARD TO THE EXAMPLE CONFIG... SKIP TO <MY ADDITIONS> # THE REST IS PROVIDED FOR COMPLETENESS & CONTEXT source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; # <MY ADDITIONS> # FTPD RULES BELOW +++++++++++++++++++++++++++++++++ destination ftpd { file("/var/log/ftpd.log"); }; filter f_ftpd { facility(kern) and match ("ftpd"); }; log { source(s_sys); filter(f_ftpd); destination(ftpd); }; # # BELOW IS STANDARD TO THE EXAMPLE CONFIG # # FIREWALL RULES ++++++++++++++++++++++++++++++++++ destination d_fw { file("/var/log/firewall.log"); }; filter f_fw { facility(kern) and match (": IN="); }; log { source(s_sys); filter(f_fw); destination(d_fw); }; # </MY ADDITIONS> log { source(s_sys); filter(f_filter1); destination(d_cons); }; # # BELOW IS STANDARD TO THE EXAMPLE CONFIG # log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; -- +---------------------------------------------------------------+ | Nicholas Bernstein | nick(a)docmagic.com | | UNIX Systems Administrator | http://www.docmagic.com | | Document Systems Inc. | | +---------------------------------------------------------------+

1 0

New to the List.
by Nicholas Bernstein 25 Mar '03

25 Mar '03

First off, I wanted to say hello and introduce myself to everyone. I'm new to using syslog-ng, but from the reading I've been doing over the last day or two, it seems very nice. :) It's probably going to take me a little while to get used to it though. I do have a few questions: 1. Does anyone know of a syslog-ng rpm package that works with RedHat 7.3? I try to automate the setup of my servers and installing from an rpm only take one line in the script per package as opposed to building it from scratch which is messier. 2. I want to set up two custom filters; one for ftpd* -> seperate log file and a second where all kernel messages about iptables logged packets go. Does this look right? ** example of ftp log entry: ---------- Mar 25 11:39:33 da ftpd[6035]: FTP session closed Mar 25 11:39:35 da ftpd[6231]: FTP LOGIN FROM www2.docmagic.com [192.168.210.22], webftp --------- ** example of kernel packet log entry: --------- Mar 23 23:23:34 da2 kernel: IN=eth0 OUT= MAC=00:08:02:b0:67:c1:00:50:54:ff:12:6a :08:00 SRC=68.69.59.21 DST=192.168.210.13 LEN=60 TOS=0x00 PREC=0x00 TTL=42 ID=43 080 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=23547 Mar 23 23:23:34 da2 kernel: IN= OUT=eth0 SRC=192.168.210.13 DST=68.69.59.21 LEN= 60 TOS=0x00 PREC=0x00 TTL=64 ID=55063 PROTO=ICMP TYPE=0 CODE=0 ID=512 SEQ=23547 --------- is this correct: destination ftpd { file("/var/log/ftpd.log"); }; destination firewall { file("/var/log/firewaill.log"); }; filter f_ftpd { program("ftpd*:*") } filter f_firewall { program("kernel:*") and match("(IN=eth0|IN= )") } log { source(src); filter(f_ftpd); destination(ftpd); }; log { source(src); filter(f_firewall); destination(firewall); }; ------------------- Also, I'm using the /syslog-ng-1.6.0rc1/contrib/syslog-ng.conf.RedHat to get started. What are some of the general reccomended additions to it? ----- [nick@da2 syslog-ng]$ more syslog-ng.conf # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 10 Aug 2002 # - for Red Hat 7.3 # - totally do away with klogd # - add message "kernel:" as is done with klogd. # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 22 Aug 2002 # - use the log_prefix option as per Balazs Scheidler's email # options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/lo g"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; ------- Thanks, look forward to hearing from you all, Nick -- +---------------------------------------------------------------+ | Nicholas Bernstein | nick(a)docmagic.com | | UNIX Systems Administrator | http://www.docmagic.com | | Document Systems Inc. | | +---------------------------------------------------------------+

1 0

destination driver question
by Dave Patterson 24 Mar '03

24 Mar '03

Hi all, Im' running syslog-ng version 1.6.0rc1 on FreeBSD 4.7 I'm having great difficulty in getting the "remove_if_older" file option to work. My current syslog-ng.conf has this line which works fine: destination d_program { file("/var/syslog-ng/$HOST/$PROGRAM/$MONTH_$DAY" perm(0640)); }; I tried to add the remove_if_older option like so: destination d_program { file("/var/syslog-ng/$HOST/$PROGRAM/$MONTH_$DAY" perm(0640)); remove_if_older("604800"); }; when I add the remove option, I get a parse error. I have also tried to added it to the options line: options { long_hostnames(off); sync(0); create_dirs(yes); chain_hostnames(on); time_reopen (30); remove_if_older("604800"); }; same error, does anyone have any ideas ? Dave Patterson Open LabNet Staff patterson29(a)llnl.gov To repair, press this button: NO... NOOO NOT THAT ONE !!! ............. Fatal Exception Error: press any key to reboot

1 0

Syslog-ng and MySQL
by Madziarczyk, Jonathan 24 Mar '03

24 Mar '03

So I'm trying to log to a MySQL database with Syslog-ng. I followed the directions on "campin.net" and everything looks good. However when I try to look at the data, I get the message "[MySQL][ODBC 3.51 Driver] Access Denied for user: 'root@(IPAddr)' (Using password: YES). I'm using the odbc driver on a pc to look at the server. Is this a MySQL permissions problem or is there something else I should be looking at? If it is, what do I need to add to let this work? Thanks

1 0