May 2003 - syslog-ng - lists.balabit.hu

How to filter XDMCP messages ?
by Gerard Breiner 12 Jan '04

12 Jan '04

Hello, I wonder how to configure syslog-ng to filtering the messages emitted by gdm_xdmcp. this type of messages pollutes my files of logs. Here is messages i don't want : "gdm[3798]: gdm_xdmcp_handle_query: Opcode 1 from ". Best regards Gerard Gerard Breiner Institut d'Astrophysique Spatiale Orsay Campus France

4 5

syslog-ng misinterpreting messages from Enterasys Routers.
by Ted_Rule＠flextech.co.uk 30 Jul '03

30 Jul '03

Having finally bitten the bullet and installed syslog-ng ( libol-0.3.6 / syslog-ng-1.5.24 ), I've only come across one problem... syslog messages from our Enterasys Routers are being corrupted. All Unix and Cisco messages appear Ok. As an example, these raw packets from an SSR and a Cisco: tcpdump -s 512 -x -e -l -n udp and port 514 and host fttv-gps-core-ssrA | tcpdumpascii.pl tcpdump: listening on eth0 10:29:54.111864 0:e0:63:93:25:bf 0:50:8b:f3:93:46 ip 100: 192.168.32.11.4739 > 172.17.12.6.syslog: udp 58 4500 0056 73a2 0000 3f11 6f2a c0a8 200b E..Vs...?.o*.. . ac11 0c06 1283 0202 0042 b5ba 3c31 3838 .........B..<188 3e4a 616e 2032 3320 3130 3a32 393a 3533 >Jan 23 10:29:53 2025 434f 4e53 2d57 2d42 4144 5041 5353 %CONS-W-BADPASS 5744 2c20 696e 636f 7272 6563 7420 7061 WD, incorrect pa 7373 776f 7264 ssword 1 packets received by filter 0 packets dropped by kernel tcpdump -s 512 -x -e -l -n udp and port 514 and host gps-enterprise-cisco-e0 | tcpdumpascii.pl tcpdump: listening on eth0 10:30:44.037939 0:10:7b:80:f:fb 0:50:8b:f3:93:46 ip 138: 172.17.8.76.8800 > 172.17.12.6.syslog: udp 96 4500 007c 29b5 0000 ff11 2547 ac11 084c E..|).....%G...L ac11 0c06 2260 0202 0068 187a 3c31 3839 ...."`...h.z<189 3e31 3036 3737 3a20 4a61 6e20 3233 2031 >10677: Jan 23 1 303a 3330 3a34 3320 474d 543a 2025 5359 0:30:43 GMT: %SY 532d 352d 434f 4e46 4947 5f49 3a20 436f S-5-CONFIG_I: Co 6e66 6967 7572 6564 2066 726f 6d20 636f nfigured from co 6e73 6f6c 6520 6279 2076 7479 3020 2831 nsole by vty0 (1 3732 2e31 372e 3132 2e37 3229 72.17.12.72) Result in this in the log: Jan 23 10:29:53 %CONS-W-BADPASSWD, incorrect password Jan 23 10:30:44 gps-enterprise-cisco-e0 10677: Jan 23 10:30:43 GMT: %SYS-5-CONFIG_I: Configured from console by vty0 (172.17.12.72) It looks as if syslog-ng is assuming %CONS-W-BADPASSWD is a hostname....and the Cisco message picks up a hostname via DNS, which is NOT included in the packet. I note the version 1.5.25 has a bad_hostname() option. Is it possible that this may be used to alleviate this issue, or is some other workround needed? I'm guessing "keep_hostname(no)" might fix it, but would that potentially lead to other problems? Is there a summary of the algorithm which syslog-ng uses to determine whether the message contains a hostname? Current Options settings laid out below. ............... # Global Options Settings options { chain_hostnames(no); keep_hostname (yes); use_dns (yes); use_fqdn (no); long_hostnames (off); dns_cache(yes); dns_cache_size(100); dns_cache_expire(600); dns_cache_expire_failed(120); create_dirs (no); dir_owner(root); dir_group(root); dir_perm(0755); owner(root); group(root); perm(0600); stats(120); sync(10); time_reopen (10); time_reap(20); use_time_recvd(no); log_fifo_size (1000); log_msg_size (1024); gc_idle_threshold(100); ### default 100 gc_busy_threshold(3000); ### default 3000 }; ............... Thanks, Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

3 2

filter match()
by Amodiovalerio Verde 06 Jun '03

06 Jun '03

Hi all, during some extensive test on syslog-ng, I found something that really make me difficult to implement some filters. I need to match same EXACT messages, and so I used something like match("^MATCHTHIS$") in a filter statement... but I find that the match will consider the message starting from the program name... Is there any way to match JUST the message part without the program one ??? ( the program() just work on the program part of the message, so i expected that match() will work on the other one... ) Thanks in advance Amodiovalerio Verde amodiovalerio.verde(a)ags-it.com amover(a)libero.it

4 4

libtool ar not found
by Steven Welters 05 Jun '03

05 Jun '03

Hi, I want to install syslog-ng on my Solaris 7 system. I have gcc 3.2.3, GNU make 3.80, GNUflex, bison. I run into problems with compiling the libol (have tried 0.3.10, 3.9, 3.8, 3.6, 3.5). ./configure seems to work, however, make stops with these error messages: ../libtool: ar: not found make[1]: *** [libol.la] Error 1 make[1]: Leaving directory `/tmp/libol-0.3.5/src' make: *** [all-recursive] Error 1 I have searched the internet but no references to this problem found. Does anyone have a clue? Best regards & thanks in advance, Steven ---"Virtual" means never knowing where your next byte is coming from.---

3 2

tcp wrappers, syslog-ng and solaris 9
by Tivon Luker 05 Jun '03

05 Jun '03

Hello. I am attempting to get tcp wrappers to work with syslog-ng-1.6.0rc3 compiled under solaris 9. syslog-ng seems to ignore hosts.allow and hosts.deny. When compiling ,configure says it finds everything and I compiled with --enable-tcp-wrapper. Has anyone been successful in getting this to work? _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

2 1

Rotate my logs files
by Moktar KONE 02 Jun '03

02 Jun '03

Hi , I am testing syslog-ng and I want to know how can I rotate my logs file . To logs messages I have a directory for many hosts, for each host, logs are classified by facilities, I have a new log file each day for each facility. so the name of my logs files changes according to the date. how can rotate the old log files? the logs of 2days ago? 3days ago? thanks this is the section that logs my files : destination hosts { file("/var/log/HOSTS/$HOST/$FACILITY/$FACILITY_$YEAR_$MONTH_$DAY" create_dirs(yes)); };

5 4

syslog-ng and Linux kernel 2.4.20
by Balazs Scheidler 29 May '03

29 May '03

hi, this message is to inform you that syslog-ng might crash on kernels 2.4.20 due to a kernel bug. It causes syslog-ng to crash every few days. the problem is that recvfrom() returns without touching either the sockaddr length or the socket address. If the memory area contains a seemingly valid AF_INET address (because of a previous invocation), then sockaddr2address_info memcpy()s socklen (which is 256 in our case) amount of memory to a sockaddr_in. I've now added a workaround, and an assert statement to catch these cases. Patch is included below, but grabbing the latest libol snapshot should also help. A workaround is attached: diff -u -r1.36 -r1.37 --- io.c 30 Apr 2003 08:08:50 -0000 1.36 +++ io.c 22 May 2003 16:56:59 -0000 1.37 @@ -1,6 +1,6 @@ /* io.c * - * $Id: io.c,v 1.36 2003/04/30 08:08:50 bazsi Exp $ */ + * $Id: io.c,v 1.37 2003/05/22 16:56:59 bazsi Exp $ */ /* lsh, an implementation of the ssh protocol * @@ -373,9 +373,13 @@ for (;;) { int res; + /* This is another workaround for Linux kernel bugs */ + + ((struct sockaddr *) addr)->sa_family = 0; + res = recvfrom(closure->fd, buffer, length, 0, (struct sockaddr *) addr, (socklen_t *) addrlen); - if (*addrlen == 2) { + if (*addrlen == 2 || (*addrlen >= 2 && ((struct sockaddr *) addr)->sa_family == 0)) { /* HACK: this is a workaround of a Linux 2.2 & 2.4 bug, * it doesn't return anything sensible in sockaddr buf */ @@ -1013,6 +1017,7 @@ struct sockaddr_in *in = (struct sockaddr_in *) addr; UINT32 ip, port; + assert(addr_len == sizeof(struct sockaddr_in)); ip = ntohl(in->sin_addr.s_addr); port = ntohs(in->sin_port); a = make_inet_address(c_format_cstring("%i.%i.%i.%i", -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

A few questions
by Keith Olmstead 29 May '03

29 May '03

Hello, I have been messing with syslog-ng for awhile now. and I have it working on a central log server that I am working on, and now I have a few questions. 1. Is it better to do the filtering on the remote log server or the syslog server? I would think sending all logs to the syslog server would create uneeded traffic. 2. I am logging using the following variables, but it seems that the log is only getting logged as message_$date in the dir. Why is this? /$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH_$DAY" TIA, Keith Olmstead

1 0

Can some servers only be allowed to chained?
by Jason Haar 25 May '03

25 May '03

I have a central syslog server. destination d_messages { template("$R_ISODATE $HOST $FACILITY $PRIORITY $MSG\n") ... I also have some DMZes and complex firewall configs that make it not practical (or secure) to open up incoming connections from all the syslog clients back to the server. So instead, each of these "complex" areas has a syslog server in it that all the others in that subnet talk to via UDP. That one syslog server then talks to the central server via TCP - leading to one server with all syslog records. This all works fine, but I have to "chain_hostnames(yes)" for that to work. What I want is the UDP source on the central server to be that it does the PTR thing to figure out what $HOST is - i.e. "chain_hostnames(no)". For TCP only, "chain_hostnames(yes)". Then I can use netfilter to limit who can TCP to the server, etc. Can that be done? Thanks -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 6

tcp wrapper support on FreeBSD 5.0
by Mike Thomas 22 May '03

22 May '03

Hello, I recently discovered the wonders and joys of syslog-ng, and have been attempting to get tcp wrapper support to work, and unfortunately, to no avail. What I am experiencing is simply it is not working, I wish I could provide a more descriptive and detailed 'error', but it just simply won't block denied hosts. Here's the relevent output from ./configure, etc. ./configure --prefix=/usr --enable-tcp-wrapper checking for tcpd.h... yes checking for TCP wrapper library... -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... yes As you can see, tcp wrapper support was sucessfully compiled in. I did not have any issues/warnings/errors while compiling. Everything looked good on that end. Here's the relevant entries from /etc/hosts.allow (I don't use hosts.deny, all my entries are in hosts.allow, both deny and allow) syslog-ng: draco.cems.umn.edu, centaurus.cems.umn.edu, lupus.cems.umn.edu, cygnus.cems.umn.edu, orion.cems.umn.edu, gemini.cems.umn.edu, crux.cems.umn.edu, mozart.cems.umn.edu, : ALLOW syslogng: draco.cems.umn.edu, centaurus.cems.umn.edu, lupus.cems.umn.edu, cygnus.cems.umn.edu, orion.cems.umn.edu, gemini.cems.umn.edu, crux.cems.umn.edu, mozart.cems.umn.edu : ALLOW #deny *EVERYTHING* else ALL : ALL : DENY I've used tcpdmatch to verify that the rules are being examined and caught in the right fashion and, they are. Here's the output of tcpdmatch for instance: loki:root(~/syslog-ng/syslog-ng-1.6.0rc3)# tcpdmatch syslog-ng oberlin.cems.umn.edu warning: syslog-ng: no such process name in /etc/inetd.conf client: hostname oberlin.cems.umn.edu client: address 134.84.165.104 server: process syslog-ng matched: /etc/hosts.allow line 25 option: DENY access: denied Line 25 is the ALL: ALL : DENY loki:root(~/syslog-ng/syslog-ng-1.6.0rc3)# tcpdmatch syslog-ng mozart.cems.umn.edu warning: syslog-ng: no such process name in /etc/inetd.conf client: hostname mozart.cems.umn.edu client: address 134.84.164.249 server: process syslog-ng matched: /etc/hosts.allow line 20 option: ALLOW access: granted Line 20 is the syslog-ng: etc... line I have also used strace and truss on the syslog-ng binary and discovered that it is sucessfully making a call to the libwrap library, but it doesn't read hosts.allow/hosts.deny (I'm not sure if its supposed to or not). As far as how I have syslog-ng setup, I have it running on the default udp port, 514, bound to a specific ip which is not the main ip of the machine, but setup as a virtual interface, in linux it would be known as eth0:0, BSD just regards it as a second ip. Syslog-ng itself functions perfectly, accepting remote connections and the whole nine yards, it just simply refuses to work with tcp wrappers. Thanks in advance for your help, --Mike

2 2