April 2003 - syslog-ng - lists.balabit.hu

Filter question.
by Jay Davis 29 Apr '03

29 Apr '03

If I set up a filter to allow messages from a wide spectrum of systems. (whole subnets) can I block a particular host that is a potential flood device. i.e. allow 10.1.20.* but block 10.1.20.36? -- Jay Davis Cell: 443-253-0469

2 1

1.6.0rc3 released
by Balazs Scheidler 29 Apr '03

29 Apr '03

Hi, I have released 1.6.0rc3 which should resolve the macro issue in 1.6.0rc2 I still have a backlog of applying patches, I hope to get them integrated by the final 1.6.0 version. Here is the NEWS entry: News for the 1.6.0rc3 release Fri, 25 Apr 2003 08:56:57 +0200 * fixed TCP wrapper detection for Solaris * fixed macro expansion which had a bug in 1.6.0rc2 -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 2

RE: [syslog-ng]Filter question.
by Hamilton, Andrew 29 Apr '03

29 Apr '03

You can use tcpwrappers to do this. Compile syslog-ng with tcpwrappers turned on and in your hosts.allow file put your network address, then add your chatter box to hosts.deny. Regards, Drew -----Original Message----- From: Jay Davis [mailto:jay_davis@fanniemae.com] Sent: Monday, April 28, 2003 11:01 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Filter question. If I set up a filter to allow messages from a wide spectrum of systems. (whole subnets) can I block a particular host that is a potential flood device. i.e. allow 10.1.20.* but block 10.1.20.36? -- Jay Davis Cell: 443-253-0469 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Double timestamps cause DB issue
by Robin Brown 26 Apr '03

26 Apr '03

Hello, Running syslog-ng version 1.5.26 on Solaris 8. All is working well, except now I want to log to a MySQL database. I can also get that to work, the problem is the double time stamp in the syslog entry. When it gets put in the database the second timestamp ends up in the program field instead of the actual program. Looking thru the archives, I can find reference to the template macros, but there only appears to be one MSG macro available. Below is a sample log line: Apr 25 11:40:36 mydevice.mydomain.com Apr 25 2003 11:13:09: %PIX-4-106023: Deny tcp src inside:111.222.333.444/1343 dst outside:555.999.777.888/80 by access-group "outbound" And my database definition from syslog-ng.conf: destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date,time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG','$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; And a sample from the database: host,facility,priority,level,tag,date,time,program,msg,seq mydevice.mydomain.com,local5,warning,warning,ac,2003-04-25,10:26:14,Apr, Apr 25 2003 09:58:46: %PIX-4-106023: Deny tcp src inside:192.168.176.204/3954 dst outside:216.23.181.206/80 by access-group "outbound",1 "Apr" is put in the program field and the message plus the second timestamp is added to the msg filed. Any suggestions appreciated. Regards, Robin

3 7

Compiling with something other than GCC
by Jay Davis 25 Apr '03

25 Apr '03

Are there any issues with using something besided gcc for the build of syslog-ng. Has anyone else done this. I have had a couple of responses (sugestions) but am wondering if anyone has actually tried it.

2 1

AW: [syslog-ng]Filter for currupt syslog-messages?
by Meinecke, Sebastian 24 Apr '03

24 Apr '03

At first: thanks for your quick help! I downloaded the new Version 1.6.0rc2 of syslog-ng and installed it as usual. The problem now is, that macros don´t work. Variables like $HOST $FACILITY etc. are null, although there hadn´t been any errors during compling and installing. I´m using the config-file that properly worked under the 1.5.24-version. Destinations like destination d_mysql_pipe { pipe("/logs/mysql.pipe" template("INSERT INTO logs (host, facility, priority, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM','$MSG' );\n") template-escape(yes)); }; produce SQL-statements like INSERT INTO logs (host, facility, priority, date, time, program, msg) VALUES ( '', '', '', '--', '::', '','' ); I didn´t find any notices about changes in the config-file-syntax that could produce such stuff... or maybe I only fooled myself ;-) again: thanks in advance, Sebastian On Thu, Apr 24, 2003 at 04:18:45PM +0200, Meinecke, Sebastian wrote: > Hello everyone, > > I´ve set up a Linux box with syslog-ng 1.5.24 running. It is configured, > that it puts all syslog-messages from other Unix hosts in the network via > the "template" > function as a SQL-Statement into a pipe. This pipe is read by a mysql-Client > that writes everything into the MySQL-database. > > > Everything works fine, until I try to stress the system using a tool, that > sends corrupt syslog-messages to the Syslog-ng-Server. The result is, that > these "corrupt" messages > are not written into the database (that´s OK; I don´t want them there...). > But the problem is that syslog-messages arriving a little time before or > after the > corrupt ones will also not be put into the database, because the fragments > of the corrupt SQL-statements that are built out of the corrupt messages > also damage the "good ones". > > > So my question: Is there any possibility to filter messages that are corrupt > or don´t match RFC 3164 via the "filter"-function of syslog-ng? > Or does anybody of you know a different solution? there were some line reassembling problems in earlier 1.5.x versions. you might try to upgrade first and check whether that version also has some problems. (the latest snapshots of 1.6.0rc2 should be ok) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Filter for currupt syslog-messages?
by Meinecke, Sebastian 24 Apr '03

24 Apr '03

Hello everyone, I´ve set up a Linux box with syslog-ng 1.5.24 running. It is configured, that it puts all syslog-messages from other Unix hosts in the network via the "template" function as a SQL-Statement into a pipe. This pipe is read by a mysql-Client that writes everything into the MySQL-database. Everything works fine, until I try to stress the system using a tool, that sends corrupt syslog-messages to the Syslog-ng-Server. The result is, that these "corrupt" messages are not written into the database (that´s OK; I don´t want them there...). But the problem is that syslog-messages arriving a little time before or after the corrupt ones will also not be put into the database, because the fragments of the corrupt SQL-statements that are built out of the corrupt messages also damage the "good ones". So my question: Is there any possibility to filter messages that are corrupt or don´t match RFC 3164 via the "filter"-function of syslog-ng? Or does anybody of you know a different solution? Much thanks in advance, Sebastian Meinecke

2 1

logrotate
by Mark Ultor 24 Apr '03

24 Apr '03

Hi all, I'm just wondering why I have to restart syslog-ng after logrotate ? If I can do echo -n > /var/log/messages and everything works fine then why logrotate can not do it ? I believe that if I restart syslog-ng there is potential risk of loosing one line of logs, when syslog-ng is down. I assume it is better not to restart it then. Am I thinking correct or not ? Thank you. M.

1 0

extra escape sequences
by SUGIMURA Takashi 杉村貴士 24 Apr '03

24 Apr '03

Hello all developers, I've been using your syslog-ng for including our software package of log management system. I'm trying its version 1.6.0rc1 and libol-0.3.9, and I'll also try the newest version later. I found that syslog-ng can not handle some characters well when the syslog-ng receives logs by tcp. I tested this problem only by tcp, but I think that other sources might cause this problem. I send the log message by tcp the follows: ----- 192.168.254.111 - - [22/Apr/2003:14:30:30 +0900] "GET /~sugimura/ HTTP/1.0" 200 3448 "-" "-" ----- You know, this log was created by apache. When syslog-ng receives this log, it writes down with extra escape sequences as the follows: ----- 192.168.254.111 - - [22/Apr/2003:14:30:30 +0900] \"GET /~sugimura/ HTTP/1.0\" 200 3448 \"-\" \"-\" ----- I think syslog-ng can not handle these kind of characters which defined by C language strings, which are ', ", \, and so on. Would you please check and fix this problem? Thanks in advance, --- SUGIMURA Takashi <sugimura(a)infoscience.co.jp>

2 2

Performance Tests
by Jack Krolen 23 Apr '03

23 Apr '03

I downloaded and installed syslog-ng.1.5.26 and then I read some problems with performance. Now say I use syslog-ng on my logging server. And all my production servers use syslogd. Now am I to understand that since syslogd uses UDP that there is going to be a considerable loss in message transfer ? Second of all since syslog-ng seems to have some problems is syslogd more reliable for this ? _________________________________________________________________ Add photos to your messages with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

2 1