April 2003 - syslog-ng - lists.balabit.hu

How to filter XDMCP messages ?
by Gerard Breiner 12 Jan '04

12 Jan '04

Hello, I wonder how to configure syslog-ng to filtering the messages emitted by gdm_xdmcp. this type of messages pollutes my files of logs. Here is messages i don't want : "gdm[3798]: gdm_xdmcp_handle_query: Opcode 1 from ". Best regards Gerard Gerard Breiner Institut d'Astrophysique Spatiale Orsay Campus France

4 5

syslog-ng misinterpreting messages from Enterasys Routers.
by Ted_Rule＠flextech.co.uk 30 Jul '03

30 Jul '03

Having finally bitten the bullet and installed syslog-ng ( libol-0.3.6 / syslog-ng-1.5.24 ), I've only come across one problem... syslog messages from our Enterasys Routers are being corrupted. All Unix and Cisco messages appear Ok. As an example, these raw packets from an SSR and a Cisco: tcpdump -s 512 -x -e -l -n udp and port 514 and host fttv-gps-core-ssrA | tcpdumpascii.pl tcpdump: listening on eth0 10:29:54.111864 0:e0:63:93:25:bf 0:50:8b:f3:93:46 ip 100: 192.168.32.11.4739 > 172.17.12.6.syslog: udp 58 4500 0056 73a2 0000 3f11 6f2a c0a8 200b E..Vs...?.o*.. . ac11 0c06 1283 0202 0042 b5ba 3c31 3838 .........B..<188 3e4a 616e 2032 3320 3130 3a32 393a 3533 >Jan 23 10:29:53 2025 434f 4e53 2d57 2d42 4144 5041 5353 %CONS-W-BADPASS 5744 2c20 696e 636f 7272 6563 7420 7061 WD, incorrect pa 7373 776f 7264 ssword 1 packets received by filter 0 packets dropped by kernel tcpdump -s 512 -x -e -l -n udp and port 514 and host gps-enterprise-cisco-e0 | tcpdumpascii.pl tcpdump: listening on eth0 10:30:44.037939 0:10:7b:80:f:fb 0:50:8b:f3:93:46 ip 138: 172.17.8.76.8800 > 172.17.12.6.syslog: udp 96 4500 007c 29b5 0000 ff11 2547 ac11 084c E..|).....%G...L ac11 0c06 2260 0202 0068 187a 3c31 3839 ...."`...h.z<189 3e31 3036 3737 3a20 4a61 6e20 3233 2031 >10677: Jan 23 1 303a 3330 3a34 3320 474d 543a 2025 5359 0:30:43 GMT: %SY 532d 352d 434f 4e46 4947 5f49 3a20 436f S-5-CONFIG_I: Co 6e66 6967 7572 6564 2066 726f 6d20 636f nfigured from co 6e73 6f6c 6520 6279 2076 7479 3020 2831 nsole by vty0 (1 3732 2e31 372e 3132 2e37 3229 72.17.12.72) Result in this in the log: Jan 23 10:29:53 %CONS-W-BADPASSWD, incorrect password Jan 23 10:30:44 gps-enterprise-cisco-e0 10677: Jan 23 10:30:43 GMT: %SYS-5-CONFIG_I: Configured from console by vty0 (172.17.12.72) It looks as if syslog-ng is assuming %CONS-W-BADPASSWD is a hostname....and the Cisco message picks up a hostname via DNS, which is NOT included in the packet. I note the version 1.5.25 has a bad_hostname() option. Is it possible that this may be used to alleviate this issue, or is some other workround needed? I'm guessing "keep_hostname(no)" might fix it, but would that potentially lead to other problems? Is there a summary of the algorithm which syslog-ng uses to determine whether the message contains a hostname? Current Options settings laid out below. ............... # Global Options Settings options { chain_hostnames(no); keep_hostname (yes); use_dns (yes); use_fqdn (no); long_hostnames (off); dns_cache(yes); dns_cache_size(100); dns_cache_expire(600); dns_cache_expire_failed(120); create_dirs (no); dir_owner(root); dir_group(root); dir_perm(0755); owner(root); group(root); perm(0600); stats(120); sync(10); time_reopen (10); time_reap(20); use_time_recvd(no); log_fifo_size (1000); log_msg_size (1024); gc_idle_threshold(100); ### default 100 gc_busy_threshold(3000); ### default 3000 }; ............... Thanks, Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

3 2

syslog-ng blanks in Servicename
by Unger, Christian 06 May '03

06 May '03

Hi, i log many informations via NT-Syslog to syslog-ng. Windows 2000 have some services with a blank in the Servicename. ex: NTDS ISAM the log entry from syslog-ng seams as following: Apr 15 15:42:33 ntds isam[info] 700 NTDS (268) Online defragmentation is beginning a full pass on database 'C:\WINNT\NTDS\ntds.dit'. NTDS ist NOT my hostname, thats the problem! I think thats the problem is in RFC. But i don't read it. ( no time :[ ) is there a easy escape? or will the next version of syslog-ng have a escape? Thanks for help Christian Unger

2 1

RE: [syslog-ng]FQDN in the destination - FIXED
by Glasser, Rob 01 May '03

01 May '03

Figured it out. Problem was two fold. First problem, the host I was testing with was in my /etc/hosts file with a shortname first, and my nsswitch.conf file was looking there first. Second problem, I had chrooted the environment. When I chrooted the environment all name resolution failed, all I got was IP addresses. After I removed that option I got the short name again, as soon as I commented out the shortname entry in /etc/hosts I got the FQDN. Thanks everyone for their help.

1 0

RE: [syslog-ng]FQDN in the destination
by Glasser, Rob 30 Apr '03

30 Apr '03

I tried that order and it didn't work. I guess I left out some important information before. This is on solaris8, accepting traffic inbound over udp from stock solaris syslogd entries, I don't know if that hoses things up or not. Also I'm running syslog-ng-1.6.0rc3+20030429. In fact, I think the DNS piece is completely hosed, because when I tell it to use dns I start getting $HOST variables set to IP addresses. The only way I can get the shortname back is to turn off all the functions to try and get the hostname and just keep the name sent over with the syslog message. I've tested this from another system running syslog-ng-1.6.0rc3+20030429 sending via UDP and it has the same symptoms, though it at least gets the short name. -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Wednesday, April 30, 2003 3:05 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]FQDN in the destination On Wed, Apr 30, 2003 at 02:24:32PM -0700, Glasser, Rob wrote: > I'm trying to use the fully qualified domain name in my directory naming > structure in a destination function. Here is what I have: I do this: use_fqdn(yes); keep_hostname(yes); use_dns(yes); long_hostnames(off); then.. destination hosts { file( "/var/log/HOSTS/$HOST/$FACILITY/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$D AY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) template("$DATE $FULLHOST $MESSAGE [$FACILITY.$LEVEL]\n") template_escape(no) ); }; log { source(src); destination(hosts); }; Works for me with 1.5.26 on debian woody. -- Nate Campi http://www.campin.net _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

1.6.0rc1 / SunOS 5.8 (Solaris 8) - entries not logged with IP address
by Brian C. Hill 30 Apr '03

30 Apr '03

I am still trying to solve this problem. I have verirified from debugging that there is some disconnect in the values salen and addrlen and between A_RECV(read, closure->max_log_line - closure->pos, closure-> buffer + closure->pos, (abstract_addr *) &sabuf, &salen); in syslog-ng-1.6rc0/src/sources.c and res = recvfrom(closure->fd, buffer, length, 0, (struct sockaddr *) addr, (socklen_t *) addrlen); in libol-0.3.9/src/io.c. salen is set to 256 before and after the A_RECV() is called, but addrlen is set to 0 and sockaddr seems to point to nothing in before recvfrom() is called. As a result recvfrom() simply doesn't record the address information of the sending host. This is on SunOS-5.8-sparc in 64-bit mode with gcc 3.2.1 compiling 64-bit binaries. Anyway, the result is that syslog-ng is unable to record the address of the sending host and winds up prepending all logged messages with it's own hostname, rather than the sending host's. With all of the casting and and abstraction involved in the code, I am not sure what to try next. Any suggestions? Is this a 64-bit problem? Brian

2 6

FQDN in the destination
by Glasser, Rob 30 Apr '03

30 Apr '03

I'm trying to use the fully qualified domain name in my directory naming structure in a destination function. Here is what I have: options { dns_cache(yes); (tried without) chain_hostnames(no); (tried yes as well) keep_hostname(yes); (tried no as well) long_hostnames(off); (tried on) use_dns(yes); (tried without) use_fqdn(yes); }; Then in the destination I've tried: destination network_log { file("/var/log/syslog-ng/$HOST/$FACILITY.$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; and destination network_log { file("/var/log/syslog-ng/$FULLHOST/$FACILITY.$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; Neither seems to create a directory with the fqdn, I always end up with the short name. Am I missing something or does this just not work? Thanks Rob

3 2

Trying to compile with SUN's cc compiler.
by Jay Davis 30 Apr '03

30 Apr '03

Here is the results after running make. I had to change this in the configure file: if test $enable_debug = "yes"; then CFLAGS="-Wall -g" else # CFLAGS="-Wall -O2" CFLAGS="-w -fast" fi -fast is optimzed. -w is supress warnings. The offending line in objbase.h is: #ifdef DEBUG_ALLOC struct ol_string_header { int magic; /* For a sentinel value */ }; #else /* !DEBUG_ALLOC */ struct ol_string_header {}; <--------------Line 67. #endif /* !DEBUG_ALLOC */ My C is a little old. I'll have to crack out my very old Kernigan book. Can you create a null pointer to a struct like that? Is this a picky compiler and should ignore it? I was able to get this compiled using. gcc. I HAVE to get this compiled with the SUN compiler. Yes I am brave. Making all in utils sed -e "s,_SCSH_,," make_class.in >make_class chmod +x make_class Making all in src /bin/sh ../libtool --mode=compile cc -DHAVE_CONFIG_H -I. -I/export/epm/syslog-ng/libol-0.3.9/src -I. -D_GNU_SOURCE -w -fast -c format.c rm -f .libs/format.lo cc -DHAVE_CONFIG_H -I. -I/export/epm/syslog-ng/libol-0.3.9/src -I. -D_GNU_SOURCE -w -fast -c format.c -KPIC -DPIC -o format.o cc: Warning: -xarch=native has been explicitly specified, or implicitly specified by a macro option, -xarch=native on this architecture implies -xarch=v8plusa which generates code that does not run on pre-UltraSPARC processors "./objbase.h", line 67: syntax error before or at: } "./objbase.h", line 73: incomplete struct/union/enum ol_string_header: header "./objbase.h", line 81: cannot recover from previous errors cc: acomp failed for format.c *** Error code 1 make: Fatal error: Command failed for target `format.lo' Current working directory /export/epm/syslog-ng/libol-0.3.9/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' -- Jay Davis Cell: 443-253-0469

2 1

RE: [syslog-ng]Problem with built in variables in syslog-ng
by Glasser, Rob 30 Apr '03

30 Apr '03

Thank you Dan and Achim, upgrading to the rc3 fixed the problem. I guess my test box was still running an older version than rc2, and when I installed the package with rc2 it hosed everything. Rob Glasser desk (425)288-2562; cell (206)915-4327 rob.glasser(a)attws.com / 2069154327(a)mobile.att.net -----Original Message----- From: Dan Edwards [mailto:dme@duda.com] Sent: Tuesday, April 29, 2003 5:32 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Problem with built in variables in syslog-ng I had this problem with RC2, never looked at why just found that snapshot from 4/18 fixed it, surprised it returned in another final build. Dan Edwards Network Specialist A. Duda & Sons, Inc. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Achim Gsell Sent: Tuesday, April 29, 2003 8:18 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Problem with built in variables in syslog-ng On Wednesday 30 April 2003 01:28, Glasser, Rob wrote: > I'm banging my head here and can't figure out for the life of me what > happened. I had everything working, and after packaging up the binaries > into a solaris package and reinstalling via package to test the package, > some of the built in variables do not work. For example I have this > destination statement: > > destination network_log { > file("/var/log/syslog-ng/$HOST/$FACILITY.$YEAR$MONTH$DAY" > owner(root) group(root) perm(0600) dir_perm(0700) > create_dirs(yes) > ); > }; > > Before it worked correctly, I'd end up with a log entry like > /var/log/syslog-ng/hostabc/auth.20030429 > Now I get: /var/log/syslog-ng/.29 This is a known bug in version 1.6.0rc2, update to version 1.6.0rc3. Achim _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Problem with built in variables in syslog-ng
by Glasser, Rob 30 Apr '03

30 Apr '03

I'm banging my head here and can't figure out for the life of me what happened. I had everything working, and after packaging up the binaries into a solaris package and reinstalling via package to test the package, some of the built in variables do not work. For example I have this destination statement: destination network_log { file("/var/log/syslog-ng/$HOST/$FACILITY.$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; Before it worked correctly, I'd end up with a log entry like /var/log/syslog-ng/hostabc/auth.20030429 Now I get: /var/log/syslog-ng/.29 Only the $DAY variable appears to be working, all of the others are resolving to null. When I truss the process I see it trying to access the file like: open("/var/log/syslog-ng//.29", O_WRONLY|O_APPEND|O_NONBLOCK|O_CREAT|O_NOCTTY|O_LARGEFILE, 0600) = 7 I've compared the binaries built when I compilied vs what I have in the package and I don't see any changes. Any input anyone has would be greatly appreciated. BTW I'm running syslog-ng 1.6.0rc2 compiled and installed on Solaris 8 Sparc, Ultra 2 to be exact. Thank you Rob

3 2