April 2003 - syslog-ng - lists.balabit.hu

Problem with options
by TIM MOORE 03 Apr '03

03 Apr '03

I have tried two options in the config file that don't seem to work properly. I have many devices logging to this box creating a file for each day. When one month is up, I hope that they will begin to write over the previous months file. Here is how I was attempting to do this: First I have tried to set the log_fifo_size to 12288 lines. According to the extended sample syslog-ng conf file this setting will set the number of lines for the output file. However, I have many files that are way over this line amount. Does this option work? However, an even better solution seemed to set the remove_if_older option to say 172800 (2 days). This way when it comes back around to the first day of the month (01) then it would see that this file is older than 2 days and wack it and start with a new "01" file. Any ideas how to get this to work with syslog-ng. I have a fix for it, but would rather not leave it to external scripts to fix the problem. Any suggestions? Tim

1 0

syslog-ng sample config
by Nica Smith 03 Apr '03

03 Apr '03

hello people.. its me again. can anyone give me a samplg syslog-conf so that i'll have a better idea of how it is confgure? what ill be needing is to log all the telnet sessions from our 3com Total Control Ras. please.... please.. thanks. - nica _____________________________________________________________ Get 25MB, POP3, Spam Filtering with LYCOS MAIL PLUS for $19.95/year. http://login.mail.lycos.com/brandPage.shtml?pageId=plus&ref=lmtplus

2 1

Malformed Messages FRom syslogd
by Keith Resar 03 Apr '03

03 Apr '03

I'm running a syslog-ng process which is receiving messages from Solaris 6, 7, and 8 machines generated by the native Solaris syslogd, some of which originate from routers and other networking infrastructure. Occasionally I get radically malformed messages, which syslog-ng places in the wrong locations. The file destination writes these messages to $HOST/$PRIORITY, etc., but these varibales consist of this munged data. Unfortunately, this forces me to manually clean out and remove the directory structure the messages created. Any ideas on how to prevent this from happening in the first place? I'm also concerned that a maliciously formed syslog packet could cause syslog-ng to inadvertedly overwrite system files. For example, if the file destination was: /var/log/$HOST/$PROCESS And the expansion was: $HOST = "../../etc" $PROCESS = "passwd"; This system file could be overwritten. Any comments or information on internal syslog-ng checks to reassure me from worrying about this? Thanks, Keith Resar. --

2 1

How about a "passive" syslog server?
by Jason Haar 03 Apr '03

03 Apr '03

Hi there I'm wanting to put up a syslog server that runs on an IDS. As such the "sniffed" interfaces don't have (or want) IP addresses. So what I need is a syslog server that can sniff syslog packets as they come across the interfaces in promiscous mode. There is a product called passlogd that supposedly does this - but it has always crashed on startup for me. However I was wondering if this could be a feature request for syslog-ng. Linux's netfilter has the REDIRECT rulesets which could be used to do this as well. I mean, right now we use REDIRECT so that our Squid proxy server can act as a transparent proxy server, so what about syslog-ng? As Squid requires you to enable it - I suppose syslog-ng would still need to be altered to support that option too? Anyone else tried to do this? The security advantage is that you could enable syslog in your DMZes, point them at a non-existant IP address, and your IDS could pick up those messages as they flow pass it. Any server compromise leads the hackers to believe there is a syslog server - but it's down... -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 1

assigning host ip to syslog
by Nica Smith 03 Apr '03

03 Apr '03

hi all, i dont know if this has been asked, but can somebody tell me on how to assign an ip of a host to log to a central remote syslog server? thanks for the help - nica _____________________________________________________________ Get 25MB, POP3, Spam Filtering with LYCOS MAIL PLUS for $19.95/year. http://login.mail.lycos.com/brandPage.shtml?pageId=plus&ref=lmtplus

1 0

RE: [syslog-ng]Can't find syslog-ng
by Nica Smith 03 Apr '03

03 Apr '03

thanks... ill try that. ;) -- On Tue, 1 Apr 2003 10:08:45 Paul Mansmann wrote: >I assume you mean Red Hat Linux 8 here. On Red Hat Linux 8, this directory and file will be created in the /usr/local/etc >directory. The easiest way to work around this little quirk is to create the directory /etc/syslog-ng and then make a link for >syslog-ng.conf within that directory to the one under /usr/local/etc/syslog-ng. That way you don't spend an hour and a half editing >the file under /etc/syslog-ng and pulling half your hair trying to figure out why it's not working right before remembering your >editing the .conf file in the wrong location. Voice of experience here. :) > >Hope this helps... >Paul > >-----Original Message----- >From: Nica Smith [mailto:wanderlust27@lycos.com] >Sent: Monday, March 31, 2003 6:06 PM >To: syslog-ng(a)lists.balabit.hu >Subject: [syslog-ng]Can't find syslog-ng > > >hi, > >i just installed syslog-ng in linux 8. instructions said that i should see the file syslog-ng.conf in folder >/etc/syslog-ng/syslog-ng.conf, but when i type locate syslog-ng, it is in my installation folder as well as my syslog-ng. did i >installed it correctly? sorry, im just new with this. > >thanks, > >- wander > > >_____________________________________________________________ >Get 25MB, POP3, Spam Filtering with LYCOS MAIL PLUS for $19.95/year. >http://login.mail.lycos.com/brandPage.shtml?pageId=plus&ref=lmtplus >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _____________________________________________________________ Get 25MB, POP3, Spam Filtering with LYCOS MAIL PLUS for $19.95/year. http://login.mail.lycos.com/brandPage.shtml?pageId=plus&ref=lmtplus

1 0

Interpretting Relayed Messages
by Keith Resar 02 Apr '03

02 Apr '03

In my current syslog setup, some messages are transferred periodically via mail to the central syslog machine, at which time they are formatted into proper syslog packets, then delivered via UDP to the syslog-ng process on the local machine. This setup works well considering the limitations of the network[1], but for the hostname field of the syslog packet, and how syslog-ng process this. The message sent to syslog-ng contains the hostname of the original machine (remote) only. After syslog-ng on the local machine (local) processes the message, the hostname field contains "remote/local". I understand why this change was made and accept it. However, the problem comes when syslog-ng filters this message by host, and the message matches for "local". When writing the message to a file destination, it is stored in the proper directory[2], so syslog-ng clearly understands that the host "remote" generated the message and it was relayed through "local". Any ideas how to avoid this? I understand that there is a configuration command which allows a message to match only one log field, but my messages must be directly both to a SWATCH process and to a file destination. I'd also prefer to rule out complex filter rules which include "remote" and exclude "local" [3]. Since $HOST expands correctly, is it possible to write a filter rule like: filter myFilter { "remote" == $HOST;}? Thanks, Keith Resar. 1: There is no way for the machine that generates the messages to connect to the central log host, unless I rig something up using stunnel, etc. I'm not interested in tackling this problem. 2: Since the message was generated by the machine "remote", $HOST expands to remote. 3: Something like: filter myFilter { host{"remote"} and !host("local"); } Assuming that this syntax is even valid. --

1 0

RE: [syslog-ng]Template configuration problem
by Jan-Peter Koopmann 01 Apr '03

01 Apr '03

Hi, > I had a problem similar to this on one of my FreeBSD servers. > There was a patch for the syslog-ng port that disabled the > template option. Make sure that you do NOT have the file > patch-cfg-lex.l in your files directory under the syslog-ng > port tree. Instead you should see patch-cfg-grammer.h (and a > couple of other valid patches) Nevertheless your hint was perfect! I have no idea why but the template keywords were indeed disabled by some kind of patch. I removed work and recompiled everything and somehow this time it worked. Maybe the port changed over night or something like that. Well anyhow... Thanks a lot! Achim: Forget my last mail. Problem appears to be solved! Regards, JP

2 1

RE: [syslog-ng]Template configuration problem
by Jan-Peter Koopmann 01 Apr '03

01 Apr '03

Hi John, thanks for the hint. > template option. Make sure that you do NOT have the file > patch-cfg-lex.l in your files directory under the syslog-ng I don't. > port tree. Instead you should see patch-cfg-grammer.h (and a > couple of other valid patches) I do. It reads --- src/cfg-grammar.h.orig Thu Mar 27 22:41:34 2003 +++ src/cfg-grammar.h Thu Mar 27 22:41:47 2003 @@ -53,7 +53,7 @@ # define KW_DIR_OWNER 296 # define KW_DIR_GROUP 297 # define KW_DIR_PERM 298 -# define KW_TEMPLATE 299 +# define KW_FILE_TEMPLATE 299 # define KW_TEMPLATE_ESCAPE 300 # define KW_OWNER 301 # define KW_GROUP 302 So this should be ok. Still doesn't work though. Regards, JP

1 0

Template configuration problem
by Jan-Peter Koopmann 01 Apr '03

01 Apr '03

Hi, I am having serious trouble with templates. This is what I have in my syslog-ng.conf destination test { file ("test" template("$ISODATE $HOST $MSG\n") template_escape(yes) ); }; I always get a parse error in the template("$ISODATE $HOST $MSG\n") line. I am running the FreeBSD port of syslog-ng version 1.6.0rc1. What is the problem? I have these options set: options { long_hostnames(on); sync(0); use_time_recvd(yes); use_dns(yes); keep_hostname(no); chain_hostnames(no); use_fqdn(yes); gc_busy_threshold(768); time_reap(12); time_reopen(10); create_dirs(yes); }; Thanks, JP

3 2