April 2003 - syslog-ng - lists.balabit.hu

Iptables logging
by Jonathan Galand 20 Apr '03

20 Apr '03

Hi all, i would like to have some iptables logs but only in a specific file ( /var/log/iptables.log in my config ). how can I do that ?? here's my config : options { long_hostnames(off); sync(0); stats(43200); }; source src { unix-stream("/dev/log"); file("/proc/kmsg"); internal(); }; destination authlog { file ("/var/log/auth.log"); }; destination syslog { file ("/var/log/syslog"); }; destination cron { file ("/var/log/cron.log"); }; destination daemon { file ("/var/log/daemon.log"); }; destination kern { file ("/var/log/kern.log"); }; destination lpr { file ("/var/log/lpr.log"); }; destination user { file ("/var/log/user.log"); }; destination uucp { file ("/var/log/uucp.log"); }; destination ppp { file ("/var/log/ppp.log"); }; destination mail { file ("/var/log/mail.log"); }; destination mailinfo { file ("/var/log/mail.info"); }; destination mailwarn { file ("/var/log/mail.warn"); }; destination mailerr { file ("/var/log/mail.err"); }; destination newscrit { file ("/var/log/news/news.crit"); }; destination newserr { file ("/var/log/news/news.err"); }; destination newsnotice { file ("/var/log/news/news.notice"); }; destination debug { file ("/var/log/debug"); }; destination messages { file ("/var/log/messages"); }; destination console_all { file("/dev/tty12"); }; destination iptables { file("/var/log/iptables.log"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_iptables { match("Alert!"); }; log { source (src); filter (f_authpriv); destination (authlog); }; log { source (src); filter (f_syslog); destination (syslog); }; log { source (src); filter (f_cron); destination (cron); }; log { source (src); filter (f_daemon); destination (daemon); }; log { source (src); filter (f_kern); destination (kern); }; log { source (src); filter (f_lpr); destination (lpr); }; log { source (src); filter (f_mail); destination (mail); }; log { source (src); filter (f_user); destination (user); }; log { source (src); filter (f_uucp); destination (uucp); }; log { source (src); filter (f_mail); filter (f_info); destination (mailinfo); }; log { source (src); filter (f_mail); filter (f_warn); destination (mailwarn); }; log { source (src); filter (f_mail); filter (f_err); destination (mailerr); }; log { source (src); filter (f_news); filter (f_crit); destination (newscrit); }; log { source (src); filter (f_news); filter (f_err); destination (newserr); }; log { source (src); filter (f_news); filter (f_notice); destination (newsnotice); }; log { source (src); filter (f_debug); destination (debug); }; log { source (src); filter (f_messages); destination (messages); }; log { source (src); filter (f_emergency); destination (console_all); }; log { source (src); filter (f_iptables); destination (iptables); }; -- Don't Fear The Penguins They Will Free Your Computer.

2 1

Problem with Match()
by Dan Edwards 18 Apr '03

18 Apr '03

When attempting to use the match(".asx") in my filter it is returning anything with "asx". I only need to return those lines with the period before the asx, hence a file extension. For some reason syslog-ng seems to ignore my specification of the . before the asx. I have tried searching with ..asx and \.asx and /.asx but doesn't seem to work no matter what I do. Any suggestions? Dan Edwards Network Specialist A. Duda & Sons, Inc.

2 1

syslog-ng: contrib file patch
by Jose Pedro Oliveira 18 Apr '03

18 Apr '03

Balazs Scheidler, Attached to this message is a patch that corrects the syslog-ng configuration file for Red Hat systems available in the contrib directory. It also creates two new files in the contrib directory: 1 - syslog-ng.sysconfig.RedHat (file to be copied to /etc/sysconfig/syslog-ng) 2 - syslog-ng.logrotate.RedHat (file to be copied to /etc/logrotate.d/syslog-ng) Regards, jpo -- José Pedro Oliveira mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo diff -ruN syslog-ng-1.6.0rc2+20030418manual-original/contrib/syslog-ng.conf.RedHat syslog-ng-1.6.0rc2+20030418manual-modified/contrib/syslog-ng.conf.RedHat --- syslog-ng-1.6.0rc2+20030418manual-original/contrib/syslog-ng.conf.RedHat Thu Aug 22 15:05:39 2002 +++ syslog-ng-1.6.0rc2+20030418manual-modified/contrib/syslog-ng.conf.RedHat Fri Apr 18 19:48:52 2003 @@ -15,6 +15,11 @@ # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 22 Aug 2002 # - use the log_prefix option as per Balazs Scheidler's email # +# Updated by Jose Pedro Oliveira (<jpo(a)di.uminho.pt>) - 05 Apr 2003 +# - corrected filters f_filter2 and f_filter6 +# these filters were only logging messages from one priority +# level and not messages with priorities greater or equal +# options { sync (0); time_reopen (10); @@ -38,14 +43,13 @@ destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; -filter f_filter2 { level(info) and - not (facility(mail) - or facility(authpriv) or facility(cron)); }; +filter f_filter2 { level(info..emerg) and + not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or - (facility(news) and level(crit)); }; + (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; diff -ruN syslog-ng-1.6.0rc2+20030418manual-original/contrib/syslog-ng.logrotate.RedHat syslog-ng-1.6.0rc2+20030418manual-modified/contrib/syslog-ng.logrotate.RedHat --- syslog-ng-1.6.0rc2+20030418manual-original/contrib/syslog-ng.logrotate.RedHat Thu Jan 1 01:00:00 1970 +++ syslog-ng-1.6.0rc2+20030418manual-modified/contrib/syslog-ng.logrotate.RedHat Fri Apr 18 19:48:52 2003 @@ -0,0 +1,6 @@ +/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron { + sharedscripts + postrotate + /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true + endscript +} diff -ruN syslog-ng-1.6.0rc2+20030418manual-original/contrib/syslog-ng.sysconfig.RedHat syslog-ng-1.6.0rc2+20030418manual-modified/contrib/syslog-ng.sysconfig.RedHat --- syslog-ng-1.6.0rc2+20030418manual-original/contrib/syslog-ng.sysconfig.RedHat Thu Jan 1 01:00:00 1970 +++ syslog-ng-1.6.0rc2+20030418manual-modified/contrib/syslog-ng.sysconfig.RedHat Fri Apr 18 19:48:52 2003 @@ -0,0 +1,15 @@ +#---------------------------------------------------------------------- +# Options +#---------------------------------------------------------------------- +# -C - <chroot-dir> +# -d - Set "debug mode". Prints out various messages to aid in +# debugging and stops it from becoming a daemon. To activate +# debugging in the yacc parser, either use this option twice or +# combine with -v. +# -p - <filename> Write the current PID information to the specified +# file. +# -v - Enable verbose mode. Process will not become a daemon. Prints +# out fewer messages, compared to -d. +# -V - Print the version number. +#---------------------------------------------------------------------- +SYSLOGNG_OPTIONS=""

1 0

syslog-ng: doc/sgml/syslog-ng.sgml patch
by Jose Pedro Oliveira 18 Apr '03

18 Apr '03

Balazs Scheidler, Attached to this message is a small patch to correct the caption of a table in the main documentation file. Patch against the latest snapshot. Regards, jpo -- José Pedro Oliveira mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo

1 0

libol: specfile patch
by Jose Pedro Oliveira 18 Apr '03

18 Apr '03

Balazs Scheidler, Attached to this message is a patch to the file libol.spec.in included in the latest snapshot. Changelog: * A file wasn't being packaged - /usr/bin/make_class This missing file broke the building process in RH9 systems, but it caused no problems in previous releases (7.3, and 8.0). Regards, jpo -- José Pedro Oliveira mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo diff -ru libol-0.3.10+20030418manual-original/libol.spec.in libol-0.3.10+20030418manual-modified/libol.spec.in --- libol-0.3.10+20030418manual-original/libol.spec.in Thu Apr 10 15:55:26 2003 +++ libol-0.3.10+20030418manual-modified/libol.spec.in Fri Apr 18 19:36:42 2003 @@ -44,6 +44,7 @@ %files %defattr(-,root,root) %doc ChangeLog +%{_bindir}/make_class %{_bindir}/libol-config %{_libdir}/libol.so %{_libdir}/libol.so.0 @@ -57,6 +58,9 @@ %changelog +* Tue Apr 15 2003 Jose Pedro Oliveira <jpo(a)di.uminho.pt> +- included missing file: /usr/bin/make_class (caused problems in RH9) + * Thu Apr 10 2003 Jose Pedro Oliveira <jpo(a)di.uminho.pt> - specfile reformated - replaced hard coded values by RPM macros

1 0

RE: [syslog-ng]Issue with Macros & 1.6.0rc2
by Dan Edwards 18 Apr '03

18 Apr '03

Apparently it was an issue with the stable rc2 release. I upgraded to the latest snapshot today "syslog-ng-1.6.0rc2+20030418manual.tar.gz" and it works great. Dan Edwards Network Specialist A. Duda & Sons, Inc. -----Original Message----- From: Peter Österberg [mailto:Peter_Osterberg@home.se] Sent: Friday, April 18, 2003 3:42 AM To: dme(a)duda.com Subject: Re: [syslog-ng]Issue with Macros & 1.6.0rc2 You describe the same problem as the one I wrote about yesterday. Please let me know if you come up with something. Thanks in advance Sincerely Peter At 18:02 2003-04-17 -0400, you wrote: >I am having some strange problems that I can not seem to resolve with >syslog-ng and macro use. I am sure it is simple and I am just over >looking it. When I try and use the $YEAR, $MONTH, $DAY, $FACILITY, $LEVEL >and several other macros nothing is outputted. Example: > >destination d_cisco { file("/var/log/cisco-$YEAR.$MONTH.$DAY.log"); } > >The file that it creates is: > >/var/log/cisco-&log > >This holds true for usage of template command in the file call. If I >format it with those macros a blank space is all that is entered. If I >put a \non the end of the last macro it erases all the output for the line >and makes the entire line blank. Example: > >destination d_cisco { file("/var/log/cisco.log" template($YEAR-$MONTH-$DAY >$LEVEL $MSG\n)); } > >The output is > > > >If I do not put the \n on the end only the MSG macro will output. Any >input is greatly appreciated. > >Debian 3.0r1 >Syslog-ng-1.6.0rc2 >Libol-0.3.9 > >Dan Edwards > >Network Specialist > >A. Duda & Sons, Inc.

1 0

Question about remote logging
by Michael Boman 18 Apr '03

18 Apr '03

Hi, I am wondering if syslog-ng handles network interuptions.. Basicly if I have a syslog-ng installation in a remote office that logs to a central syslog-ng server at the main office, and for some reason the remote office disapears from the face of the earth (internet), does syslog-ng cache the syslog messages it recives so that when the internet connectivity appears again it will send the messages it recived during the down peroid? What if syslog-ng dies for any reason (power failure etc..) during that period, does it store the logmessages it has in cache on disk so when it comes back up it can start feeding the main server with the logs? Best regards Michael Boman -- Michael Boman Security Architect, SecureCiRT Pte Ltd http://www.securecirt.com

2 2

RE: [syslog-ng]Syslog-ng and MySQL
by Hamilton, Andrew 18 Apr '03

18 Apr '03

This is a permissions problem with mysql. It uses a couple of different things to authenticate a user. The user, the host and the password. Make sure you have root@(ipaddr) in the user table. That is not the same as root@localhost, or root@hostname. You can also have a user with a "%" as the host entry which will allow a user from any host to login. NOT RECOMMENDED FOR THE ROOT ACCOUNT. Regards, Drew -----Original Message----- From: Madziarczyk, Jonathan [mailto:than@cityofevanston.org] Sent: Monday, March 24, 2003 11:57 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Syslog-ng and MySQL So I'm trying to log to a MySQL database with Syslog-ng. I followed the directions on "campin.net" and everything looks good. However when I try to look at the data, I get the message "[MySQL][ODBC 3.51 Driver] Access Denied for user: 'root@(IPAddr)' (Using password: YES). I'm using the odbc driver on a pc to look at the server. Is this a MySQL permissions problem or is there something else I should be looking at? If it is, what do I need to add to let this work? Thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Solaris 8 configure errors with libol version & tcp_wrappers
by Wayne Sweatt 18 Apr '03

18 Apr '03

Dear Balabit, I had previously installed syslog-ng .1.6.0rc1 on RH8 Linux just fine. Now I have to get it running on a Solaris 8/Sun Blade 100. Here's the OS and software configurations of note: Solaris 8, with latest recommended patch cluster. Tcp_Wrappers 7.6 libol 0.3.9 GNU software: gcc 3.2.2 flex 2.5.4a bison 1.875 autoconf 2.57 automake 1.7.2 make 3.80 glib 1.2.10 The problems are all related to "errors" within the configure file: ( I am using the command: "./configure --enable-tcp-wrapper") 1. It checks for a libol version of => 0.3.9 and returns "no", when in fact, it is 0.3.9 I can simply comment out the checks in configure, and bypass this problem. Then. 2. It didn't find libwrap.h. I relocated it to /usr/local/include and /usr/include, and then it found it. 3. It returns: "checking for hosts_access in -lwrap. no" Beats me - it's in there just like it's been for years - by default. Wrappers are working just fine for everything else. I also compiled wrappers with "STYLE = -DPROCESS_OPTIONS" 4. It returns "checking whether to enable TCP wrapper support. no" Subsequently, I do not compile with lwrap. Please advise how to fix these problems. The config.log is clean. No errors. Thanks Wayne Sweatt UNIX System Administrator Comforce Technical Services LANL SCC Team

2 1

Re: [syslog-ng] permission denied on syslog-ng
by Michael Redinger 18 Apr '03

18 Apr '03

Same here with 1.6.0rc2 (I'm using FACILITY). This works fine in 1.6.0rc1. Michael > Hi there > > I've problems with macros. I've tried a few different config files now and > macros don't seem to work in any of them. > > Here's a short sample: > > source src { unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) > port(514)); }; > > destination d_mysql { > pipe("/tmp/mysql.pipe" > template("$HOST\n") > ); > }; > > destination console { usertty("root" template("HELLO $HOST\n")); }; > > log { source(src); destination(d_mysql); destination(console); }; > > > Since I don't get anything in my mysql server at the moment I run this to > check the fifo 'cat < /tmp/mysql.pipe' > All that I get is the linefeed from \n > > And on my console I only get HELLO \n > > The macros don't seem to expand not just $HOST. > > I run syslog-ng 1.6.0rc2 on a Slackware 9.0 box. > > Thank you! > > /peter -- Michael Redinger Zentraler Informatikdienst (Computer Centre) Universitaet Innsbruck Technikerstrasse 13 Tel.: ++43 512 507 2335 6020 Innsbruck Fax.: ++43 512 507 2944 Austria Mail: Michael.Redinger(a)uibk.ac.at

2 1