April 2003 - syslog-ng - lists.balabit.hu

Bug in syslog-ng or stunnel?
by neonman＠7of1.mine.nu 23 Apr '03

23 Apr '03

Hello everyone, ive just set up a syslog-ng remote logging server that logs through stunnel with theese rules: destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY/$FACILITY" owner(root) group(wheel) perm(0600) dir_perm(0700) create_dirs(yes)); }; source recieved { tcp(ip("127.0.0.1") port(515) keep-alive(yes)); }; log { source(recieved); destination(hosts); }; The logging works, but the logs is put into "/var/log/hosts/---/$FACILITY", _NOT_ into "/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY/$FACILITY" Am i doing something wrong? I just upgraded both stunnel and syslog-ng to the lastest version, before that everything worked fine, but now its fucked up.. thanks / neon

2 2

RE: [syslog-ng]$HOST directories
by Hamilton, Andrew 22 Apr '03

22 Apr '03

I probably should have just said a current snapshot. Drew -----Original Message----- From: Jeremy Jones [mailto:jeremy@samnjack.com] Sent: Tuesday, April 22, 2003 4:09 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]$HOST directories Hello all yalls, I've been beating my head against a wall for a couple hours here, but have yet to figure out how to get syslog-ng to create my $HOST directories, or to even use them when I create them manually. When a remote host sends it's syslog messages, they just end up in /var/log/netlog/whatever.log. There's no indication anywhere else in my logs about improper permissions or anything of that sort. I'm trying to use version 1.6.0rc2 and libol-0.3.10. If it's at all interesting, "uname -a" tells me: Linux <my-secret-hostname> 2.4.20 #1 Wed Mar 26 11:34:49 MST 2003 i686 unknown I've gone round and round with all the various dns/hostname related options, to no avail. Anyone have any Great Ideas? Here's some snippets from my syslog-ng.conf file: options { sync(0); time_reopen(10); log_fifo_size(100); keep_hostname (yes); dns_cache (yes); long_hostnames (yes); use_dns (yes); use_fqdn (yes); chain_hostnames (no); create_dirs (yes); owner (root); group (root); stats (600); perm (0660); dir_owner (root); dir_group (root); dir_perm (0770); use_time_recvd (yes); }; <snip> source net { tcp(); udp(); }; destination net_authlog { file("/var/log/netlog/$HOST/auth.log"); }; destination net_userlog { file("/var/log/netlog/$HOST/user.log"); }; destination net_bootlog { file("/var/log/netlog/$HOST/boot.log"); }; destination net_errorlog { file("/var/log/netlog/$HOST/errors.log"); }; destination net_cronlog { file("/var/log/netlog/$HOST/cron.log"); }; destination net_kernlog { file("/var/log/netlog/$HOST/kern.log"); }; destination net_maillog { file("/var/log/netlog/$HOST/mail.log"); }; destination net_messages { file("/var/log/netlog/$HOST/messages"); }; destination net_daemonlog { file("/var/log/netlog/$HOST/daemon.log"); }; destination net_wwwacclog { file("/var/log/netlog/data/www/LOGS/$YEAR/$MONTH/www.access.log.$YEAR.$MONTH .$DAY");}; destination net_wwwerrlog { file("/var/log/netlog/data/www/LOGS/$YEAR/$MONTH/www.errors.log.$YEAR.$MONTH .$DAY");}; log { source(net); filter(f_authpriv); destination(net_authlog); }; log { source(net); filter(f_user); destination(net_userlog); }; log { source(net); filter(f_boot); destination(net_bootlog); }; log { source(net); filter(f_err); destination(net_errorlog); }; log { source(net); filter(f_cron); destination(net_cronlog); }; log { source(net); filter(f_kern); destination(net_kernlog); }; log { source(net); filter(f_mail); destination(net_maillog); }; log { source(net); filter(f_daemon); destination(net_daemonlog); }; log { source(net); filter(f_messages); destination(net_messages); }; log { source(net); filter(f_www); filter(f_info); destination(net_wwwacclog); }; log { source(net); filter(f_www); filter(f_err); destination(net_wwwerrlog); }; Thanks a million Jeremy <please send inspectors to my country... i think we may have weapons of mass destruciton> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]$HOST directories
by Hamilton, Andrew 22 Apr '03

22 Apr '03

With 1.6.0rc2 you have to have a snapshot beyond 4/18. Do that and it works great. Regards, Drew -----Original Message----- From: Jeremy Jones [mailto:jeremy@samnjack.com] Sent: Tuesday, April 22, 2003 4:09 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]$HOST directories Hello all yalls, I've been beating my head against a wall for a couple hours here, but have yet to figure out how to get syslog-ng to create my $HOST directories, or to even use them when I create them manually. When a remote host sends it's syslog messages, they just end up in /var/log/netlog/whatever.log. There's no indication anywhere else in my logs about improper permissions or anything of that sort. I'm trying to use version 1.6.0rc2 and libol-0.3.10. If it's at all interesting, "uname -a" tells me: Linux <my-secret-hostname> 2.4.20 #1 Wed Mar 26 11:34:49 MST 2003 i686 unknown I've gone round and round with all the various dns/hostname related options, to no avail. Anyone have any Great Ideas? Here's some snippets from my syslog-ng.conf file: options { sync(0); time_reopen(10); log_fifo_size(100); keep_hostname (yes); dns_cache (yes); long_hostnames (yes); use_dns (yes); use_fqdn (yes); chain_hostnames (no); create_dirs (yes); owner (root); group (root); stats (600); perm (0660); dir_owner (root); dir_group (root); dir_perm (0770); use_time_recvd (yes); }; <snip> source net { tcp(); udp(); }; destination net_authlog { file("/var/log/netlog/$HOST/auth.log"); }; destination net_userlog { file("/var/log/netlog/$HOST/user.log"); }; destination net_bootlog { file("/var/log/netlog/$HOST/boot.log"); }; destination net_errorlog { file("/var/log/netlog/$HOST/errors.log"); }; destination net_cronlog { file("/var/log/netlog/$HOST/cron.log"); }; destination net_kernlog { file("/var/log/netlog/$HOST/kern.log"); }; destination net_maillog { file("/var/log/netlog/$HOST/mail.log"); }; destination net_messages { file("/var/log/netlog/$HOST/messages"); }; destination net_daemonlog { file("/var/log/netlog/$HOST/daemon.log"); }; destination net_wwwacclog { file("/var/log/netlog/data/www/LOGS/$YEAR/$MONTH/www.access.log.$YEAR.$MONTH .$DAY");}; destination net_wwwerrlog { file("/var/log/netlog/data/www/LOGS/$YEAR/$MONTH/www.errors.log.$YEAR.$MONTH .$DAY");}; log { source(net); filter(f_authpriv); destination(net_authlog); }; log { source(net); filter(f_user); destination(net_userlog); }; log { source(net); filter(f_boot); destination(net_bootlog); }; log { source(net); filter(f_err); destination(net_errorlog); }; log { source(net); filter(f_cron); destination(net_cronlog); }; log { source(net); filter(f_kern); destination(net_kernlog); }; log { source(net); filter(f_mail); destination(net_maillog); }; log { source(net); filter(f_daemon); destination(net_daemonlog); }; log { source(net); filter(f_messages); destination(net_messages); }; log { source(net); filter(f_www); filter(f_info); destination(net_wwwacclog); }; log { source(net); filter(f_www); filter(f_err); destination(net_wwwerrlog); }; Thanks a million Jeremy <please send inspectors to my country... i think we may have weapons of mass destruciton> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

$HOST directories
by Jeremy Jones 22 Apr '03

22 Apr '03

Hello all yalls, I've been beating my head against a wall for a couple hours here, but have yet to figure out how to get syslog-ng to create my $HOST directories, or to even use them when I create them manually. When a remote host sends it's syslog messages, they just end up in /var/log/netlog/whatever.log. There's no indication anywhere else in my logs about improper permissions or anything of that sort. I'm trying to use version 1.6.0rc2 and libol-0.3.10. If it's at all interesting, "uname -a" tells me: Linux <my-secret-hostname> 2.4.20 #1 Wed Mar 26 11:34:49 MST 2003 i686 unknown I've gone round and round with all the various dns/hostname related options, to no avail. Anyone have any Great Ideas? Here's some snippets from my syslog-ng.conf file: options { sync(0); time_reopen(10); log_fifo_size(100); keep_hostname (yes); dns_cache (yes); long_hostnames (yes); use_dns (yes); use_fqdn (yes); chain_hostnames (no); create_dirs (yes); owner (root); group (root); stats (600); perm (0660); dir_owner (root); dir_group (root); dir_perm (0770); use_time_recvd (yes); }; <snip> source net { tcp(); udp(); }; destination net_authlog { file("/var/log/netlog/$HOST/auth.log"); }; destination net_userlog { file("/var/log/netlog/$HOST/user.log"); }; destination net_bootlog { file("/var/log/netlog/$HOST/boot.log"); }; destination net_errorlog { file("/var/log/netlog/$HOST/errors.log"); }; destination net_cronlog { file("/var/log/netlog/$HOST/cron.log"); }; destination net_kernlog { file("/var/log/netlog/$HOST/kern.log"); }; destination net_maillog { file("/var/log/netlog/$HOST/mail.log"); }; destination net_messages { file("/var/log/netlog/$HOST/messages"); }; destination net_daemonlog { file("/var/log/netlog/$HOST/daemon.log"); }; destination net_wwwacclog { file("/var/log/netlog/data/www/LOGS/$YEAR/$MONTH/www.access.log.$YEAR.$MONTH.$DAY");}; destination net_wwwerrlog { file("/var/log/netlog/data/www/LOGS/$YEAR/$MONTH/www.errors.log.$YEAR.$MONTH.$DAY");}; log { source(net); filter(f_authpriv); destination(net_authlog); }; log { source(net); filter(f_user); destination(net_userlog); }; log { source(net); filter(f_boot); destination(net_bootlog); }; log { source(net); filter(f_err); destination(net_errorlog); }; log { source(net); filter(f_cron); destination(net_cronlog); }; log { source(net); filter(f_kern); destination(net_kernlog); }; log { source(net); filter(f_mail); destination(net_maillog); }; log { source(net); filter(f_daemon); destination(net_daemonlog); }; log { source(net); filter(f_messages); destination(net_messages); }; log { source(net); filter(f_www); filter(f_info); destination(net_wwwacclog); }; log { source(net); filter(f_www); filter(f_err); destination(net_wwwerrlog); }; Thanks a million Jeremy <please send inspectors to my country... i think we may have weapons of mass destruciton>

1 0

1.6rc2 build problem
by Aaron Jackson 22 Apr '03

22 Apr '03

I just got finished building 1.6rc2 on a Solaris 8 system with gcc 3.2.2. The problem I ran into was that the build stopped with the following error: Undefined first referenced symbol in file yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /export/home/jackson/syslog-ng-1.6.0rc2/src As it turns out, I just installed gcc3.2.2 on /usr/local. The problem is that the freeware packages Sun distributes with Solaris install on /opt/sfw. Therefore the gcc just I installed does not look in /opt/swf/lib by default. I just edited LDFLAGS (-L/opt/sfw) LIBS (-lfl) in src/Makefile and everything compiled file. Looking into config.cache I see that configure couldn't find libfl (ac_cv_lib_fl_yywrap=${ac_cv_lib_fl_yywrap='no'}). It would seem that if libfl is required in order to build syslog-ng, that either the build process should stop if it is not found, or you should be able to give it as an option to configure. Of course, this is only a problem if flex is not installed in gcc's default search path. This is a minor nit, but I thought I would mention it. Aaron

2 1

10x
by nikola somlev 22 Apr '03

22 Apr '03

Hi, I had the "non-working macro" problem with 1.6.rc2. Then I searched the list atchive and found the solution, proposed by Dan Edwards - upgrade to 4/18 snapshot. I seems to work fine now. 10x __________________________________________________ Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo http://search.yahoo.com

1 0

Re: [syslog-ng]Iptables logging
by Ted_Rule＠flextech.co.uk 22 Apr '03

22 Apr '03

Better still, you can use iptables' log-prefix option to make it easier for syslog-ng to regex match iptables entries. Something like: iptables -t filter -N droplog iptables -t filter -A droplog -j LOG --log-prefix "iptables: warning: DROP: " --log-level warning iptables -t filter -A droplog -j DROP And then in syslog-ng.conf: filter iptables { match("^iptables: "); }; or similar should work I believe. This assumes fine grained total control over all the syslogging iptables entities of course - if you're just capturing logs from Smoothwall or some other embedded Linux product you may not be quite so lucky. Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

RE: [syslog-ng]permission denied on syslog-ng
by Nica Smith 22 Apr '03

22 Apr '03

this is wat i received after running sh -x /etc/init.d/syslog-ng start [root@netengeng root]# sh -x /etc/init.d/syslog-ng start + INIT_PROG=syslog-ng + . /etc/rc.d/init.d/functions ++ TEXTDOMAIN=initscripts ++ TEXTDOMAINDIR=/etc/locale ++ umask 022 ++ PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin ++ export PATH ++ '[' -z '' ']' ++ COLUMNS=80 ++ '[' -z '' ']' +++ /sbin/consoletype ++ CONSOLETYPE=pty ++ '[' -f /etc/sysconfig/i18n -a -z '' ']' ++ . /etc/sysconfig/i18n +++ LANG=en_US.UTF-8 +++ SUPPORTED=en_US.UTF-8:en_US:en +++ SYSFONT=latarcyrheb-sun16 ++ '[' pty '!=' pty ']' ++ export LANG ++ '[' -z '' ']' ++ '[' -f /etc/sysconfig/init ']' ++ . /etc/sysconfig/init +++ BOOTUP=color +++ RES_COL=60 +++ MOVE_TO_COL=echo -en \033[60G +++ SETCOLOR_SUCCESS=echo -en \033[0;32m +++ SETCOLOR_FAILURE=echo -en \033[0;31m +++ SETCOLOR_WARNING=echo -en \033[0;33m +++ SETCOLOR_NORMAL=echo -en \033[0;39m +++ LOGLEVEL=3 +++ PROMPT=yes ++ '[' pty = serial ']' ++ '[' color '!=' verbose ']' ++ INITLOG_ARGS=-q + SYSLOGNG_PATH=:/usr/local/sbin + PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin:/usr/local/sbin + export PATH + '[' -f /etc/sysconfig/syslog-ng ']' + SYSLOGNG_OPTIONS= + RETVAL=0 + umask 077 + ulimit -c 0 + start + echo -n 'Starting syslog-ng: ' Starting syslog-ng: + daemon syslog-ng + local gotbase= force= + local base= user= nice= bg= pid= + nicelevel=0 + '[' syslog-ng '!=' syslog-ng ']' + '[' -z '' ']' + base=syslog-ng + '[' -f /var/run/syslog-ng.pid ']' + '[' -n '' -a -z '' ']' + ulimit -S -c 0 + '[' color = verbose -a -z '' ']' + '[' -z '' ']' + initlog -q -c syslog-ng + '[' 0 -eq 0 ']' + success 'syslog-ng startup' + '[' -z '' ']' + initlog -q -n /etc/init.d/syslog-ng -s 'syslog-ng startup' -e 1 + '[' color '!=' verbose -a -z '' ']' + echo_success + '[' color = color ']' + echo -en '\033[60G' + echo -n '[ ' [ + '[' color = color ']' + echo -en '\033[0;32m' + echo -n OK OK+ '[' color = color ']' + echo -en '\033[0;39m' + echo -n ' ]' ]+ echo -ne '\r' + return 0 + return 0 + RETVAL=0 + echo + '[' 0 -eq 0 ']' + touch /var/lock/subsys/syslog-ng + return 0 + exit 0 when i tried to do /etc/init.d/syslog-ng start, i received this error message.. [root@netengeng root]# /etc/init.d/syslog-ng start -bash: /etc/init.d/syslog-ng: Permission denied [root@netengeng ~]# /etc/init.d/syslog-ng start /etc/init.d/syslog-ng: Permission denied. thank you. - wander. -- On Tue, 15 Apr 2003 13:57:29 Clausing, James A (Jim), SOLCM wrote: > > As root run > ># sh -x /etc/init.d/syslog-ng start > > This will show the script executing. Respond back to the list >and let us know where in the script the error is being generated (the >last few lines with '+' in front of them). Then also give us the >complete error message. We don't have enough info to troubleshoot this. > >-----Original Message----- >From: Nica Smith [mailto:wanderlust27@lycos.com] >Sent: Tuesday, April 15, 2003 04:30 >To: syslog-ng(a)lists.balabit.hu >Subject: [syslog-ng]permission denied on syslog-ng > > >my syslog-ng.conf is located at >usr/local/etc/syslog-ng/syslog-ng.conf > >then i copied init.d.RedHat-7.3 /etc/init.d (from contrib) to >/etc/init.d/syslog-ng > >when i do /etc/init.d/syslog-ng start, i received an error "permission >denied". > >what did i miss? need ur help. tnx. > > >- wander > > >____________________________________________________________ >Get advanced SPAM filtering on Webmail or POP Mail ... Get Lycos Mail! >http://login.mail.lycos.com/r/referral?aid=27005 >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > ____________________________________________________________ Get advanced SPAM filtering on Webmail or POP Mail ... Get Lycos Mail! http://login.mail.lycos.com/r/referral?aid=27005

2 1

Lost information now with 1.6.0rc2
by Wayne Sweatt 21 Apr '03

21 Apr '03

Dear Balabit, New Problem today: >:>(( I am no longer getting any information, such as $FULLHOST, $FACILITY,$MONTH, etc when using templates that worked fine with 1.6.0rc1. Now my $HOST = "-", and the other values are null. It is logging, but to the newly created "-" directory ( I was previously logging to $HOST/$MONTH-$YEAR) I could not download 1.6.0rc1 now - it has been removed from the Balabit site, so I installed 1.5.26, and now the information is being parsed just fine, again. What is the change in rc2 that clobbered the values returned from the templates? Can you fix this please? Can I get rc1 again? Sorry, but I'm getting very wary of this product, as it does not seem to have been tested under Solaris 8. Is this true? Here's the OS and software configurations of note: Solaris 8, with latest recommended patch cluster. Libol 0.3.9 Wayne Sweatt UNIX System Administrator Comforce Technical Services LANL SCC Team

2 1

Re: [syslog-ng]Solaris 8 configure errors with libol version & tcp_wrappers
by Wayne Sweatt 21 Apr '03

21 Apr '03

Dear Balasz, I have upgraded to the most current relase - 1.6.0rc2, and the problems with detecting the libol version were resolved. Thank you. I still have the problem of getting syslog-ng to compile with tcp_wrappers/libwrap though. I would like to get a response on this problem so I can move on with further testing of syslog-ng. Part of the draw to this product was it's ability to compile with libwrap. Support issues: I am reposting my previous post, since I could not find out what the method was for replying to posts and I did not get an email reponse - I had to go to the archive to view the response that was posted by Balasz. What is the mechanism for responding to posts? Can you please help me resolve this issue? I need to know if this can be resolved before I abandon this "open" code and move on to a more supported product. I am also interested if we can purchase support to increase the level of support for syslog-ng. Here is the original post of the tcp_wrappers problem (see #2-4 below): > I had previously installed syslog-ng .1.6.0rc1 on RH8 Linux just fine. > Now I have to get it running on a Solaris 8/Sun Blade 100. > Here's the OS and software configurations of note: > > Solaris 8, with latest recommended patch cluster. > Tcp_Wrappers 7.6 > libol 0.3.9 > > GNU software: > gcc 3.2.2 > flex 2.5.4a > bison 1.875 > autoconf 2.57 > automake 1.7.2 > make 3.80 > glib 1.2.10 > > The problems are all related to "errors" within the configure file: > ( I am using the command: "./configure --enable-tcp-wrapper") 1. (Resolved libol issue) > 2. It didn't find libwrap.h. I relocated it to /usr/local/include and > /usr/include, and then it found it. > 3. It returns: "checking for hosts_access in -lwrap. no" Beats me - > it's in there just like it's been for years - by default. > Wrappers are working just fine for everything else. I also compiled > wrappers with "STYLE = -DPROCESS_OPTIONS" > 4. It returns "checking whether to enable TCP wrapper support. no" > > Subsequently, I do not compile with lwrap. UNIX System Administrator Comforce Technical Services LANL SCC Team

1 0