April 2003 - syslog-ng - lists.balabit.hu

Re: [syslog-ng]logrotate question (not working with syslog-ng)...
by Ted_Rule＠flextech.co.uk 10 Apr '03

10 Apr '03

It's perfectly possible to use logrotate on RedHat with syslog-ng... here's my logrotate.conf stripped of irrelevant detail: $ cat /etc/logrotate.d/syslog-ng /var/log/secure { } /var/log/maillog { } /var/log/spooler { } ........ /var/log/messages { ....... postrotate /etc/rc.d/init.d/syslog-ng reconfig ....... endscript } $ And the corresponding tweaks to init script to allow for a reconfig option, plus some extra features relating preventing syslog-ng restart when the config is broken, emulating klogd, and handling syslog-ng startup prior to named an ipchains only central logging server with dns hostname lookup enabled.. $ cat /etc/rc.d/init.d/syslog-ng #!/bin/sh # # syslog-ng Starts syslog-ng # # chkconfig: 2345 30 99 # description: Syslog-ng is the facility by which many daemons use to log \ # messages to various system log files. It is a good idea to always \ # run syslog-ng. ################################################################################ # Source function library. if [ -d /etc/init.d ]; then . /etc/init.d/functions else . /etc/rc.d/init.d/functions fi . /etc/sysconfig/network if [ ${NETWORKING} = "no" ] then exit 0 fi # General security measures.. umask 077 ulimit -c 0 INIT_PROG="/usr/local/sbin/syslog-ng" # Full path to daemon INIT_CONF="/etc/syslog-ng/syslog-ng.conf" # Full path to config INIT_OPTS="" PRINTKLEVEL=2 # Get per-service config overrides if [ -f /etc/sysconfig/syslog-ng ]; then . /etc/sysconfig/syslog-ng fi [ -x $INIT_PROG ] || exit 1 [ -s $INIT_CONF ] || exit 1 INIT_NAME=`basename "$INIT_PROG"` # Correct the setting of raw printk kernel logging to mimic klogd behaviour printkset() { currentprintk=`awk '{print $1}' /proc/sys/kernel/printk` if [ ${PRINTKLEVEL} -ne ${currentprintk} ]; then action "Setting kernel console default printk to ${PRINTKLEVEL}" dmesg -n ${PRINTKLEVEL} fi } validconfig() { $INIT_PROG -s -f $INIT_CONF RETVAL=$? echo -n "Syslog-ng configuration check" [ $RETVAL -ne 0 ] && failure "Syslog-ng configuration check" && echo && exit 1 [ $RETVAL -eq 0 ] && success "Syslog-ng configuration check" && echo } findsyslogchain () { rulenum=`ipchains -L input --line-numbers | awk '{print $1,$2,$3,$5,$9}' | grep "DENY udp anywhere syslog" | awk '{print $1}' | sort -rn` if [ "$rulenum" = "" ]; then rulenum=0 fi #Chain input (policy ACCEPT): #num target prot opt source destination ports #1 DENY udp ------ anywhere anywhere any -> syslog } isdnsrunning () { if [ -n "`/sbin/pidof named`" ]; then dnsrunning=1 else dnsrunning=0 fi } RETVAL=0 # See how we were called. case "$1" in start) validconfig printkset isdnsrunning [ $dnsrunning -ne 1 ] && $0 local echo -n "Starting $INIT_NAME: " daemon --check $INIT_PROG "$INIT_PROG -f $INIT_CONF $INIT_OPTS" RETVAL=$? echo [ $dnsrunning -eq 1 ] && $0 remote [ $RETVAL -eq 0 ] && touch "/var/lock/subsys/${INIT_NAME}" # Warn sendmail that syslog has restarted /etc/rc.d/init.d/sendmail reconfig ;; stop) echo -n "Shutting down $INIT_NAME: " killproc $INIT_PROG RETVAL=$? echo [ $RETVAL -eq 0 ] && rm -f "/var/lock/subsys/${INIT_NAME}" ;; status) status $INIT_PROG #status klogd RETVAL=$? ;; reconfig) validconfig printkset isdnsrunning [ $dnsrunning -ne 1 ] && $0 local echo -n "Re-HUPing $INIT_NAME daemon" killproc $INIT_PROG -HUP RETVAL=$? echo [ $dnsrunning -eq 1 ] && $0 remote ;; restart|reload) $0 stop $0 start RETVAL=$? ;; local) findsyslogchain if [ "$rulenum" = "0" ]; then action "Disabling remote syslogging" ipchains -I input 1 -i eth+ --proto udp --dport syslog -j DENY RETVAL=$? fi ;; remote) findsyslogchain if [ "$rulenum" != "0" ]; then for rule in `echo $rulenum` do action "Enabling remote syslogging - remove ipchains rule $rule" ipchains -D input ${rule} RETVAL=$? done fi ;; validate) validconfig ;; printkset) printkset RETVAL=$? ;; *) echo "Usage: syslog {start|stop|status|reconfig|restartlocal|remote|validate|printkset}" exit 1 esac exit $RETVAL $ ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

syslog-ng and regex
by Micha Holzmann 10 Apr '03

10 Apr '03

Hello, i am very new at syslog-ng and at its list. I am running two Debian GNU/Linux boxes. One as a DSL Router and the other as my workstation. Today i have installed syslog-ng via apt-get (1.5.15-1.1). I tried to setup remote logging. I want my router/firewall logging additional to my workstation. On the router i have the following entries in syslog-ng.conf Hostname of router = xenia >--- cut here ---- destination loghost {udp("192.168.1.1" port(514));}; log { source(src); destination(loghost); }; >--- cut here ---- Hostname of workstation = kaliba On my workstation i have in syslog-ng.conf: >--- cut here ---- destination rlogging { file("/var/log/syslog-ng/$HOST/syslog.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; filter f_xenia { match("xenia"); }; log { source(src); filter(f_xenia); destination(rlogging); }; >--- cut here ---- I am not sure if this setup is correct. May you can give me some advices. If it is necessary to have my configs, please tell me, i will post them afterwards. Now i have a seceond question, on my workstation runs a cron job which looks for new antivir definition file or new program version (binary file). I tried to put the syslog entries in a separate file. Can i use regex in the match()? May like this: match("antivir\[[0-9]+\]") to catch antivir[19129] >--- cut here ---- destination antivir { file("/var/log/antivir.log"); }; filter f_antivir { match("kaliba antivir"); }; log { source(src); filter(f_antivir); destination(antivir); }; >--- cut here ---- But the logfile entries does not arrive in /var/log/antivir.log. Did i anything wrong? Best regards, Micha Holzmann -- My software never has bugs. It just develops random features.

6 14

Syslog-ng conf file options not working!!!!
by TIM MOORE 10 Apr '03

10 Apr '03

Here is what I am trying to do. We have all of our network monitoring devices logging to a central linux syslog-ng server. The files write to the log server as the day of the week (eg. 01, 02, 03). I am trying to make sure that when the month rolls over and starts writing to file 01 that they old file is blown away. I don't need logs older than one month. I can't seem to get syslog-ng to handle this on its own. I have tried two options from syslog-ng that are given in the extended sample syslog-ng conf files from the website. Neither have worked the way they said they should. First, I tried limiting the number of lines that can be written to a file. I set the log_fifo_size to (12288). The sample config says that this setting is for the number of lines that can be written to the log files. However, I have some log files that are over 1,000,000 lines. So, unless I misunderstood this option it isn't working. Second, I tried to set the option remove_if_older to (172800) or 2 days. The expanded sample config says that this option checks a file to see whether or not it is older than the number of seconds specified. If it is older then it removes the existing file and writes to a new file with the same name. This option would work perfectly, if it worked! When I put it in the config file, it barfs when trying to load syslog-ng and says it is an error. Any ideas on how to do this (without writing a script to blank out each days file at midnight). Attached is a copy of our conf file. Thanks, Tim # Syslog-ng configuration for for ODJFS-NOC Syslog # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # options { #remove_if_older(172800); use_fqdn(yes); use_dns(yes); dns_cache(yes); keep_hostname(yes); long_hostnames(off); use_time_recvd(yes); #log_fifo_size=number of lines logged log_fifo_size(12288); sync(0); }; ###################################### #Source Section #source for local data source src { pipe("/proc/kmsg" log_prefix("kernel: ")); unix-stream("/dev/log"); internal(); }; #source for network devices source net { udp(); }; ##################################### #Destination Section #Standard destination destination std { file("/var/log/$HOST/$FACILITY/$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; #Forward Destination destination noc-web { udp("10.3.8.100" port(514)); }; ##################################### #log for src log { source(src); destination(std); }; #log for net log { source(net); destination(std); }; ########END OF FILE########

2 1

Include functionality - is there a way to do it?
by Klun, Jim 10 Apr '03

10 Apr '03

Here is a snippet from I question I received today: Quote: I am currently researching the following, but wanted to run it by you to make sure you weren't already aware of a solution: Does syslog-ng support 'include' type statements in the config file to make the config modular? Here is the problem. The new syslog-ng server runs on a production Solaris 8 box and portions of the syslog-ng.conf file (not the device filters) are not the same as their linux counterparts running on xxxx and yyyyy. An easy way to maintain sync on the phos and Solaris syslog-ng configs would be to simply sync the config file as a whole. For example, we might make changes on phos, then scp the file to the production Solaris box. If the config file were modular, we could break it into 2 pieces/files, 1 specific to Solaris or Linux, and 1 for all of the device filters. ? Close quote I know of no include function in syslog-ng. Is there one?

1 0

host labels with version 1.6
by Brian C. Hill 10 Apr '03

10 Apr '03

Hello, How do I make sure that syslog-ng labels an entry with the host that is came from and NOT the host that received it? None of the options, except possibly keep_hostname seem to be involved with that, and setting/unsetting that option seems to have no effect. Do I need to go back to 1.4? Thanks! Brian

2 1

RE: [syslog-ng]syslog-ng 1.6.0 insists on log files with 600 perm issions
by Hamilton, Andrew 10 Apr '03

10 Apr '03

Have you tried: destination all { file("/var/log/messages" perm(0640) ); }; This works for me on 1.6.0. Regards, Drew -----Original Message----- From: nate [mailto:syslog-ng@aphroland.org] Sent: Tuesday, April 08, 2003 4:08 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.6.0 insists on log files with 600 permissions I upgraded to freebsd 4.8 from 4.7 last week and portupgrade reported it upgraded syslog-ng from syslog-ng-1.4.17 to syslog-ng-1.6.0.r1 and libol-0.2.23 to libol-0.3.9 (libol is required by syslog-ng) and while syslog-ng is working I cannot get it to store files that are group readable. In the past this has been no problem, but now syslog-ng seems to insist upon permissions of 600. I even went sofar as to set a umask of 137, in the syslog-ng init script, which sets permissions on newly created files to 640, but that seems to have no effect, syslog-ng randomly(?) changes permissions back to 600 even after I set them to 640 myself. I have logrotate run weekly and create files that are 640: /var/log-ng/* { create 0640 root wheel notifempty errors my(a)email.address rotate 26 weekly compress delaycompress olddir /var/log-ng/archive missingok } but syslog-ng again changes it back to 600. driving me crazy :) I don't see anything in the syslog-ng manpage that can set file permissions..so I'm at a loss! I have been running syslog-ng on freebsd 4.7 with no problems since about september 2002. anyone else experience this? thanks nate _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

Filters not working (as expected)
by Harry Hoffman 10 Apr '03

10 Apr '03

Hi All, We've got a linux client running syslog-ng 1.6 sending to a linux server running syslog-ng 1.5.17 For the client I have taken the example redhat conf file and added the following to it: destination loghost { tcp("myloghost.fq.dn" port(514)); }; filter f_filter9 { level(notice); }; log { source(s_sys); filter(f_filter9); destination(loghost); }; If I use logger to test I see the message come thru: logger -p kern.notice -t WARNING "This is a KERNEL test warning" However, if I do: logger -p kern.emerg -t WARNING "This is a KERNEL test warning" Nothing comes thru. Do I need to specify multiple prioity levels? I want anything of notice or higher to be sent to the syslog server. Any help is greatly appreciated. TIA, Harry -- Harry Hoffman ITSS Systems Team Leader University of Auckland hhoffman(a)auckland.ac.nz hhoffman(a)ip-solutions.net STANDARD DISCLAIMER: ********************************************** *This universe shipped by weight, not volume.* *Some expansion may have occured in shipping.* ********************************************* ------------------------------------------------- This mail sent through IpSolutions: http://www.ip-solutions.net/

2 2

New to syslog-ng
by Annie Chaiyakul 10 Apr '03

10 Apr '03

I am trying to setup a syslog-ng server running on redhat 7.3, Can my clients still run old syslogd?

2 1

RE: [syslog-ng]New to syslog-ng
by Dennis, Richard 10 Apr '03

10 Apr '03

Yes. Your syslog-ng server will be your central syslog server. There's a good how to in a sample chapter from the Building Secure Linux Servers on www.oreilly.com --Rick -----Original Message----- From: Annie Chaiyakul [mailto:AChaiyakul@idecpharm.com] Sent: Wednesday, April 09, 2003 8:18 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]New to syslog-ng I am trying to setup a syslog-ng server running on redhat 7.3, Can my clients still run old syslogd? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------ This message is intended only for the personal and confidential use of the designated recipient(s) named above. If you are not the intended recipient of this message you are hereby notified that any review, dissemination, distribution or copying of this message is strictly prohibited. This communication is for information purposes only and should not be regarded as an offer to sell or as a solicitation of an offer to buy any financial product, an official confirmation of any transaction, or as an official statement of Lehman Brothers. Email transmission cannot be guaranteed to be secure or error-free. Therefore, we do not represent that this information is complete or accurate and it should not be relied upon as such. All information is subject to change without notice.

1 0

long IP entry in Sun syslog
by Brian C. Hill 09 Apr '03

09 Apr '03

I am still having the problem where remote messages to syslog-ng 1.6.0rc1 are labeled with the receiving host's name instead of the IP/hostname of the sending host. I have keep_hostname set to yes and use_dns set to no. I turned on Sun's syslogd to compare some things and noticed that entries that Sun's syslog cannot resolve are labeled with the IP address (10.10.5.13) and 2 additional 'octets' in brackets like this: Apr 9 14:28:34 [10.10.5.13.224.124] venue1258 PPTP-1 down: Remote clearing Is this related to the problem I am seeing with 1.6.0rc1? Is the sun streams device sending it an address it can't interpret? I figure one of those octets is the source port, but I don't know what the last one is... Brian

1 0