June 2003 - syslog-ng - lists.balabit.hu

How to filter XDMCP messages ?
by Gerard Breiner 12 Jan '04

12 Jan '04

Hello, I wonder how to configure syslog-ng to filtering the messages emitted by gdm_xdmcp. this type of messages pollutes my files of logs. Here is messages i don't want : "gdm[3798]: gdm_xdmcp_handle_query: Opcode 1 from ". Best regards Gerard Gerard Breiner Institut d'Astrophysique Spatiale Orsay Campus France

4 5

Syslog-ng on NetBSD
by Axel Gerster 28 Aug '03

28 Aug '03

Hello, I got some compile errors on syslog-ng on NetBSD. Does anyone know how to fix it? ---snap---- root@blah:/tmp/syslog-ng-1.6.0rc3# gmake Making all in src gmake[1]: Entering directory `/tmp/syslog-ng-1.6.0rc3/src' gmake all-recursive gmake[2]: Entering directory `/tmp/syslog-ng-1.6.0rc3/src' Making all in . gmake[3]: Entering directory `/tmp/syslog-ng-1.6.0rc3/src' gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c cfg-lex.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c affile.c In file included from /usr/include/arpa/inet.h:65, from affile.c:77: /usr/include/sys/param.h:222: warning: `MIN' redefined /usr/pkg/include/libol/objtypes.h:82: warning: this is the location of the previous definition /usr/include/sys/param.h:223: warning: `MAX' redefined /usr/pkg/include/libol/objtypes.h:86: warning: this is the location of the previous definition gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afsocket.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afunix.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afinet.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afinter.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afuser.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c:37: stropts.h: No such file or directory afstreams.c:38: sys/strlog.h: No such file or directory gmake[3]: *** [afstreams.o] Error 1 gmake[3]: Leaving directory `/tmp/syslog-ng-1.6.0rc3/src' gmake[2]: *** [all-recursive] Error 1 gmake[2]: Leaving directory `/tmp/syslog-ng-1.6.0rc3/src' gmake[1]: *** [all-recursive-am] Error 2 gmake[1]: Leaving directory `/tmp/syslog-ng-1.6.0rc3/src' gmake: *** [all-recursive] Error 1 --snip--- Thx very much. Axel

2 1

resolve IP addresses
by Madhvi Gokool 12 Aug '03

12 Aug '03

> Hello > Can syslog-ng resolve IP addresses using the /etc/hosts file? We do not have > an internal dns at the moment. Currently , the filenames that are created > are the IP addresses of the routers that are pushing their syslog onto the > syslog server. > > Regards > Madhvi >

3 2

syslog-ng misinterpreting messages from Enterasys Routers.
by Ted_Rule＠flextech.co.uk 30 Jul '03

30 Jul '03

Having finally bitten the bullet and installed syslog-ng ( libol-0.3.6 / syslog-ng-1.5.24 ), I've only come across one problem... syslog messages from our Enterasys Routers are being corrupted. All Unix and Cisco messages appear Ok. As an example, these raw packets from an SSR and a Cisco: tcpdump -s 512 -x -e -l -n udp and port 514 and host fttv-gps-core-ssrA | tcpdumpascii.pl tcpdump: listening on eth0 10:29:54.111864 0:e0:63:93:25:bf 0:50:8b:f3:93:46 ip 100: 192.168.32.11.4739 > 172.17.12.6.syslog: udp 58 4500 0056 73a2 0000 3f11 6f2a c0a8 200b E..Vs...?.o*.. . ac11 0c06 1283 0202 0042 b5ba 3c31 3838 .........B..<188 3e4a 616e 2032 3320 3130 3a32 393a 3533 >Jan 23 10:29:53 2025 434f 4e53 2d57 2d42 4144 5041 5353 %CONS-W-BADPASS 5744 2c20 696e 636f 7272 6563 7420 7061 WD, incorrect pa 7373 776f 7264 ssword 1 packets received by filter 0 packets dropped by kernel tcpdump -s 512 -x -e -l -n udp and port 514 and host gps-enterprise-cisco-e0 | tcpdumpascii.pl tcpdump: listening on eth0 10:30:44.037939 0:10:7b:80:f:fb 0:50:8b:f3:93:46 ip 138: 172.17.8.76.8800 > 172.17.12.6.syslog: udp 96 4500 007c 29b5 0000 ff11 2547 ac11 084c E..|).....%G...L ac11 0c06 2260 0202 0068 187a 3c31 3839 ...."`...h.z<189 3e31 3036 3737 3a20 4a61 6e20 3233 2031 >10677: Jan 23 1 303a 3330 3a34 3320 474d 543a 2025 5359 0:30:43 GMT: %SY 532d 352d 434f 4e46 4947 5f49 3a20 436f S-5-CONFIG_I: Co 6e66 6967 7572 6564 2066 726f 6d20 636f nfigured from co 6e73 6f6c 6520 6279 2076 7479 3020 2831 nsole by vty0 (1 3732 2e31 372e 3132 2e37 3229 72.17.12.72) Result in this in the log: Jan 23 10:29:53 %CONS-W-BADPASSWD, incorrect password Jan 23 10:30:44 gps-enterprise-cisco-e0 10677: Jan 23 10:30:43 GMT: %SYS-5-CONFIG_I: Configured from console by vty0 (172.17.12.72) It looks as if syslog-ng is assuming %CONS-W-BADPASSWD is a hostname....and the Cisco message picks up a hostname via DNS, which is NOT included in the packet. I note the version 1.5.25 has a bad_hostname() option. Is it possible that this may be used to alleviate this issue, or is some other workround needed? I'm guessing "keep_hostname(no)" might fix it, but would that potentially lead to other problems? Is there a summary of the algorithm which syslog-ng uses to determine whether the message contains a hostname? Current Options settings laid out below. ............... # Global Options Settings options { chain_hostnames(no); keep_hostname (yes); use_dns (yes); use_fqdn (no); long_hostnames (off); dns_cache(yes); dns_cache_size(100); dns_cache_expire(600); dns_cache_expire_failed(120); create_dirs (no); dir_owner(root); dir_group(root); dir_perm(0755); owner(root); group(root); perm(0600); stats(120); sync(10); time_reopen (10); time_reap(20); use_time_recvd(no); log_fifo_size (1000); log_msg_size (1024); gc_idle_threshold(100); ### default 100 gc_busy_threshold(3000); ### default 3000 }; ............... Thanks, Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

3 2

Strange behaviour with kernel log
by Zumeo 30 Jun '03

30 Jun '03

Hi, I've downloaded latest syslog-ng and installed it on my box (Mandrake 9.0). Here is my syslog-ng.conf : ---8<--- ### Options ### options { dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname(yes); }; ### Sources ### source local { unix-stream("/dev/log"); pipe("/proc/kmsg" log_prefix("kernel: ")); udp(ip(127.0.0.1) port(514)); internal(); }; ### Destinations ### destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination user { file("/var/log/user.log"); }; destination mail { file("/var/log/mail/log"); }; destination mailinfo { file("/var/log/mail/info"); }; destination mailwarn { file("/var/log/mail/warnings"); }; destination mailerr { file("/var/log/mail/err"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination boot { file("/var/log/boot.log"); }; destination explanations { file("/var/log/explanations"); }; ### Filters ### filter f_auth { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_user { facility(user); }; filter f_mail { facility(mail); }; filter f_debug { not facility(auth, authpriv, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail); }; filter f_info { level(info); }; filter f_warn { level(warn); }; filter f_err { level(err); }; filter f_boot { facility(local7); }; filter f_explanations { facility(local1); }; ### Logs ### log { source(local); filter(f_auth); destination(authlog); }; log { source(local); filter(f_syslog); destination(syslog); }; log { source(local); filter(f_cron); destination(cron); }; log { source(local); filter(f_daemon); destination(daemon); }; log { source(local); filter(f_kern); destination(kern); }; log { source(local); filter(f_user); destination(user); }; log { source(local); filter(f_mail); destination(mail); }; log { source(local); filter(f_mail); filter(f_info); destination mailinfo); }; log { source(local); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(local); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(local); filter(f_debug); destination(debug); }; log { source(local); filter(f_messages); destination(messages); }; log { source(local); filter(f_boot); destination(boot); }; log { source(local); filter(f_explanations); destination(explanations); }; --->8--- To try my syslog-ng.conf, I used logger : # logger -p kern.info "test kern.info 1" Then I checked kern.log and saw nothing. The "test kern.info 1" was in user.log ! Can someone explain me this strange behaviour ? --zumeo ________________________________________________________________________ This letter has been delivered unencrypted. We'd like to remind you that the full protection of e-mail correspondence is provided by S-mail encryption mechanisms if only both, Sender and Recipient use S-mail. Register at S-mail.com: http://www.s-mail.com

4 3

Error message: No source refers to internal messages,
by R Saroukhanian 30 Jun '03

30 Jun '03

Hi again! Thank you Nate and Bob for responding. I made changes which both of you pointed out. However, my error message persists. That is I am still getting " No source refers to internal messages, they will go to /dev/null unresolved reference:src Error initializing configuration, exiting." error message Now, after the recommended changes, my syslog-ng.conf file looks like this: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> options {sync(0); }; source src { udp(10.101.54.2) port(514); internal(); }; destination telnet_d {file ("/var/log/telnetlog"); } ; log {source (src); destination (telnet_d); }; >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Specifically, - "internal();" was referenced in the syslog-ng.conf file - telnet_d was properly referenced in both destination and log... - just in case I changed source src_udp to source src...and change log to look like "log {source (src); destination (telnet_d); };"....this is because I am getting " unresolved reference:src" in the error message.. After, I made changes in the syslog-ng.conf AND rebooted the box (blame my Windows mentality) I ran syslog-ng manually from /etc and AGAIN the same error message popped up. Since, I have followed the editing recommendations from Nate Campi and Bob Lister and I am still getting the same error message I am forced to think out of the box now. Here are possible problem areas 1. SYSLOG-NG.CONF SYNTAX 2. SOMETHING WITH MY FREE BSD SET UP 3. Here is another problem area...the way I created telnetlog file in my /var/log folder is by way of running "vi telnetlog" and then exiting vi by way of "ESC...:wq!...." . This created the telnetlog file in /var/log which I CAN observe by way of l"s". The doubts I have is whether syslog-ng is able to write into thus created telnetlog file...does syslog-ng like the format of thus created telnetlog? Because, I am very new to FreeBSD I cannot be more specific in hypothesizing what is wrong with my FreeBSD...however... I managed at a certain point to pick up logs from my NT box...some entries related to the Telnet service start and stop showed up in one of my log files. At that point I had an assistance....from another person....not any more. Since then we terminated SYSLOG service entirely....and also made some changes to the ORIGINAL syslog-ng-conf file that came with the syslog-ng installation. Do you have any pointers...clues? Which other factors may be causing this error message? Here is round up of my setup: SYSLOG-NG release 1.6.0 r3 FreeBSD 4.8 box telnetlog created using vi syslog-ng is in /etc syslog-ng.conf is in /etc My original posting is below. I would greatly appreciate your suggestions. Regards, Ruben Saroukhanian MY ORIGINAL POSTING IN SYSLOG-NG MAILING LIST.... > Hello folks, >=20 > Could somebody help me with this error message I am getting when = trying to run SYSLOG-NG? >=20 > Error message: > No source refers to internal messages, they will go to /dev/null > unresolved reference:src > Error initializing configuration, exiting. >=20 > Here is my setup. >=20 > I installed syslog-ng version 1.6.0 r3 on my FreeBSD 4.8 box. >=20 > The overall plan is to collect log messages sent to by NTSyslog from a = Windows 2000 box to SYSLOG-NG on the FreeBSD 4.8 box. > For a test I have been starting and stopping a telnet service on my = Windows 2000 box to pick up these events in the telnetlog file which I = created on my FreeBSD computer. >=20 > Both syslog-ng and syslog-ng.conf file are located in /etc of the = FreeBSD box. >=20 > I am logged in as root. >=20 > syslog.conf file looks like this: >=20 > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > options {sync(0); }; >=20 > source src_udp {udp(10.101.54.2) port(514); }; >=20 > destination telnet_d {file ("/var/log/telnetlog"); } ; >=20 > log {source (src_udp); destination (telnet_t); }; >=20 > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >=20 >=20 > I run syslog-ng manually from inside /etc and get the error message = listed above. >=20 > Does the error message I am getting relate to syntax of the = syslog-ng.conf or something else? >=20 > Should I add a filter entry ...inside log statement argument? for it = to lool like >>>>>> log {source (src_udp); filter (DEFAUILT); = destination (telnet_t); }; ??? >=20 > I am looking forward to hearing from you. >=20 > Please send a copy of your response to rex(a)piva.net. >=20 > Thank you, >=20 > Ruben Saroukhanian --__--__-- Message: 8 Date: Thu, 19 Jun 2003 22:34:13 +0100 From: Robert Lister <robl(a)linx.net> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Need help...with SYSLOG-NG Reply-To: syslog-ng(a)lists.balabit.hu > > > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > > options {sync(0); }; > > > > source src_udp {udp(10.101.54.2) port(514); }; > > > > destination telnet_d {file ("/var/log/telnetlog"); } ; ----------------^^^^^^^^ > > log {source (src_udp); destination (telnet_t); }; -----------------------------------------^^^^^^^^ ... maybe it relates to that? Fix that and see what it does. Rob -- Robert Lister - London Internet Exchange - http://www.linx.net/ - tel: +44 (0)20 7645 3510 - RL786-RIPE --__--__-- Message: 9 Date: Thu, 19 Jun 2003 16:54:32 -0700 From: Nate Campi <nate(a)campin.net> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Need help...with SYSLOG-NG Reply-To: syslog-ng(a)lists.balabit.hu On Thu, Jun 19, 2003 at 05:14:55PM -0400, R Saroukhanian wrote: > > > > Error message: > > No source refers to internal messages, they will go to /dev/null > > unresolved reference:src > > Error initializing configuration, exiting. <DEFANGED_snip> > > syslog.conf file looks like this: > > > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > > options {sync(0); }; > > > > source src_udp {udp(10.101.54.2) port(514); }; > > You'll need to declare the "internal" source too. See the FAQ and the links to example syslog-ng.conf files. -- Nate Campi http://www.campin.net --__--__-- Message: 10 Date: Thu, 19 Jun 2003 16:58:15 -0700 From: Nate Campi <nate(a)campin.net> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Need help...with SYSLOG-NG Reply-To: syslog-ng(a)lists.balabit.hu On Thu, Jun 19, 2003 at 05:14:55PM -0400, R Saroukhanian wrote: > > Hello folks, > > > > Could somebody help me with this error message I am getting when trying to run SYSLOG-NG? > > > > Error message: > > No source refers to internal messages, they will go to /dev/null > > unresolved reference:src > > Error initializing configuration, exiting. > > > > Here is my setup. > > > > I installed syslog-ng version 1.6.0 r3 on my FreeBSD 4.8 box. > > > > The overall plan is to collect log messages sent to by NTSyslog from a Windows 2000 box to SYSLOG-NG on the FreeBSD 4.8 box. > > For a test I have been starting and stopping a telnet service on my Windows 2000 box to pick up these events in the telnetlog file which I created on my FreeBSD computer. > > > > Both syslog-ng and syslog-ng.conf file are located in /etc of the FreeBSD box. > > > > I am logged in as root. > > > > syslog.conf file looks like this: > > > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > > options {sync(0); }; > > > > source src_udp {udp(10.101.54.2) port(514); }; > > > > destination telnet_d {file ("/var/log/telnetlog"); } ; > > > > log {source (src_udp); destination (telnet_t); }; > > > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> I didn't address the error that makes syslog-ng exit, how lame of me :( Here's what I think you want out of syslog-ng: #################################################### options { sync(0); }; source src_udp { udp(10.101.54.2) port(514); internal; }; destination telnet_d { file ("/var/log/telnetlog"); } ; log { source (src); destination (telnet_d); }; #################################################### I fixed the differing destination name, and make your source name consistent, and added the internal source. This should at least get your basic setup working. Sorry I didn't pay more attention the first time. -- Nate Campi http://www.campin.net --__--__-- Message: 11 Date: Thu, 19 Jun 2003 17:00:56 -0700 From: Nate Campi <nate(a)campin.net> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Need help...with SYSLOG-NG Reply-To: syslog-ng(a)lists.balabit.hu On Thu, Jun 19, 2003 at 04:58:15PM -0700, Nate Campi wrote: > > source src_udp { > udp(10.101.54.2) port(514); > internal; > }; Arg, make that "internal();" I promise not to reply to myself again on this thread, no matter how bad my next mistake is ;) -- Nate Campi http://www.campin.net --__--__-- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng End of syslog-ng Digest

2 1

IPv6 support
by Timothy Brown 27 Jun '03

27 Jun '03

Does syslog-ng support communication via IPv6? If not, will it support this in the future, or has someone written a patch? Thanks. Best regards, Tim --

1 0

Re: syslog-ng
by Michael Earls 27 Jun '03

27 Jun '03

This works, Thanks, Michael >>> bazsi(a)balabit.hu 06/27/03 05:41AM >>> On Wed, Jun 25, 2003 at 06:36:38PM -0400, Michael Earls wrote: > syslog-ng > > Is there a way to have syslog-ng write two files, ex > > > destination mailx > { > file("/var/log/mailx/mail.log" owner("root") group("adm") > perm(0640)); > file("/var/log/mailx/remote-mail.log" owner("root") > group("adm") perm(0640)); > }; > > log { source(net); destination(mailx); > } > > I am looking at having a file for mailgraph to use to create stats, > then my other file will be logged into mysql. this is definitely possible. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: syslog-ng
by Balazs Scheidler 27 Jun '03

27 Jun '03

On Wed, Jun 25, 2003 at 06:36:38PM -0400, Michael Earls wrote: > syslog-ng > > Is there a way to have syslog-ng write two files, ex > > > destination mailx > { > file("/var/log/mailx/mail.log" owner("root") group("adm") > perm(0640)); > file("/var/log/mailx/remote-mail.log" owner("root") > group("adm") perm(0640)); > }; > > log { source(net); destination(mailx); > } > > I am looking at having a file for mailgraph to use to create stats, > then my other file will be logged into mysql. this is definitely possible. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RegExp filters / match ?
by Brian Ipsen 25 Jun '03

25 Jun '03

Hi! I'm trying to mask out snmptrap from different hosts.... I've created: filter f_snmptrapd_test { program(snmptrapd) and match("snmptrapd\[[0-9]{1,5}\]: (192.168.0.230|192.168.0.231|192.168.1.230|192.168.1.231|192.168.1.232): "); }; The question is just the match() statement.... Is snmptrapd included for usage with match (since snmptrapd is the program) ? If not, how much of the message below is the string used for the regular expression with match() ? Jun 25 11:26:56 sigma snmptrapd[16138]: 192.168.1.230: Enterprise Specific Trap (1) Uptime: 121 days, 21:32:17.60, OLD-CISCO-TS-MIB::tslineSesType.1.1 = INTEGER: telnet(5), RFC1213-MIB::tcpConnState.192.168.1.230.23.192.168.1.178.43819 = INTEGER: synReceived(4), OLD-CISCO-TCP-MIB::loctcpConnElapsed.192.168.1.230.23.192.168.1.178.43819 = Wrong Type (should be Timeticks): INTEGER: 1150, OLD-CISCO-TCP-MIB::loctcpConnInBytes.192.168.1.230.23.192.168.1.178.43819 = INTEGER: 110, OLD-CISCO-TCP-MIB::loctcpConnOutBytes.192.168.1.230.23.192.168.1.178.43819 = INTEGER: 420, OLD-CISCO-TS-MIB::tsLineUser.1 = "" Or how do I mask traps from specific hosts into a seperate logfile ? Regards, /Brian

1 0