June 2003 - syslog-ng - lists.balabit.hu

mailgraph
by Michael Earls 24 Jun '03

24 Jun '03

syslog-ng I am running mailgraph script and i was told that i need to patch my perl:syslog in order for mailgraph to view syslog-ng log files. http://mail.python.org/pipermail/mailman-developers/2001-November/010072.ht… --post about perl:syslog http://people.ee.ethz.ch/~dws/software/mailgraph/ — mailgraph Does anyknow know about this? thanks, michael

1 0

Description of the TCP protocol?
by Rich Salz 23 Jun '03

23 Jun '03

I want to implement my own client that can use a TCP link to syslog-ng. Is the protocol defined anywhere? /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html XML Security Overview http://www.datapower.com/xmldev/xmlsecurity.html

2 3

Filter on hosts ?
by Brian Ipsen 23 Jun '03

23 Jun '03

Hi! I'm trying to get syslog-ng to filter out traps from certain hosts... In my syslog-ng.conf I have: destination d_snmptrapd { file("/var/log/snmptrapd"); }; destination d_snmptrapd_network { file("/var/log/snmptrapd.network"); }; filter f_snmptrapd { program(snmptrapd) and not host("192.168.0.230|192.168.1.230|192.168.0.231"); }; filter f_snmptrapd_network { program(snmptrapd) and host("192.168.0.230|192.168.1.230|192.168.0.231"); }; log { source(s_sys); filter(f_snmptrapd); destination(d_snmptrapd); }; log { source(s_sys); filter(f_snmptrapd_network); destination(d_snmptrapd_network); }; But traps from 192.168.0.230 still ends up in /var/log/snmptrapd - and nothing is written to /var/log/snmptrapd.network Am I completely wrong regarding my regular expresisons (I'm no expert in that field) ?? Regards /Brian

1 0

Re: [syslog-ng] Problem with large logfiles, Solved
by Vuorilehto Saska 23 Jun '03

23 Jun '03

Hi all and thanks! Problem with large files is solved. Upgrading to syslog-ng version 1.6.x did the trick for me. Thanks for everyone who answered! ******* Saska

1 0

Filter on hosts ?
by Brian Ipsen 20 Jun '03

20 Jun '03

Hi! I'm trying to get syslog-ng to filter out traps from certain hosts... In my syslog-ng.conf I have: destination d_snmptrapd { file("/var/log/snmptrapd"); }; destination d_snmptrapd_network { file("/var/log/snmptrapd.network"); }; filter f_snmptrapd { program(snmptrapd) and not host("192.168.0.230|192.168.1.230|192.168.0.231"); }; filter f_snmptrapd_network { program(snmptrapd) and host("192.168.0.230|192.168.1.230|192.168.0.231"); }; log { source(s_sys); filter(f_snmptrapd); destination(d_snmptrapd); }; log { source(s_sys); filter(f_snmptrapd_network); destination(d_snmptrapd_network); }; But traps from 192.168.0.230 still ends up in /var/log/snmptrapd - and nothing is written to /var/log/snmptrapd.network Am I completely wrong regarding my regular expresisons (I'm no expert in that field) ?? Regards /Brian

1 0

Filter on hosts ?
by Brian Ipsen 20 Jun '03

20 Jun '03

Hi! I'm trying to get syslog-ng to filter out traps from certain hosts... In my syslog-ng.conf I have: destination d_snmptrapd { file("/var/log/snmptrapd"); }; destination d_snmptrapd_network { file("/var/log/snmptrapd.network"); }; filter f_snmptrapd { program(snmptrapd) and not host("192.168.0.230|192.168.1.230|192.168.0.231"); }; filter f_snmptrapd_network { program(snmptrapd) and host("192.168.0.230|192.168.1.230|192.168.0.231"); }; log { source(s_sys); filter(f_snmptrapd); destination(d_snmptrapd); }; log { source(s_sys); filter(f_snmptrapd_network); destination(d_snmptrapd_network); }; But traps from 192.168.0.230 still ends up in /var/log/snmptrapd - and nothing is written to /var/log/snmptrapd.network Am I completely wrong regarding my regular expresisons (I'm no expert in that field) ?? Regards /Brian

1 0

RE: [syslog-ng]Recording relay instance
by Hamilton, Andrew 20 Jun '03

20 Jun '03

Probably the closest thing to that right now is chain_hostnames(on) as a global option. You don't get what you really want but you get something like: 20 June 2003 12:00:00 relay/host program:..... as a hostname you get both the host it came through and the host it originated from. There isn't a macro defined for relay but you could probably hack the code for chain_hostnames to give you a relay. The only trouble would be figuring it out if you have more than one relay. -----Original Message----- From: Michael Boman [mailto:michael.boman@securecirt.com] Sent: Friday, June 20, 2003 6:58 AM To: Syslog-NG ML Subject: [syslog-ng]Recording relay instance Hi, I have some "problems" with syslog-ng. I have it deployed in several networks, and some of these networks are sharing the same IP address range and sometimes even the same IP address for certain hosts. This means that I can't truly say that 192.168.51.4 is either the db server in network A or the web server in network B. I'd like to have a $RELAY macro so I can save the logs as /LOGS/$RELAY/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$YEAR_$MONTH_$DAY Where $RELAY is where the message came from (so with direct connections it would be the same as $HOST, but with a syslog-ng in relay mode you get the address/name of the relay host). Basically a "received from" field. Is this functionality planned, or does it already exist (checked out the documentation but didn't see anything there). Best regards Michael Boman -- Michael Boman Security Architect, SecureCiRT Pte Ltd http://www.securecirt.com

2 1

Recording relay instance
by Michael Boman 20 Jun '03

20 Jun '03

Hi, I have some "problems" with syslog-ng. I have it deployed in several networks, and some of these networks are sharing the same IP address range and sometimes even the same IP address for certain hosts. This means that I can't truly say that 192.168.51.4 is either the db server in network A or the web server in network B. I'd like to have a $RELAY macro so I can save the logs as /LOGS/$RELAY/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$YEAR_$MONTH_$DAY Where $RELAY is where the message came from (so with direct connections it would be the same as $HOST, but with a syslog-ng in relay mode you get the address/name of the relay host). Basically a "received from" field. Is this functionality planned, or does it already exist (checked out the documentation but didn't see anything there). Best regards Michael Boman -- Michael Boman Security Architect, SecureCiRT Pte Ltd http://www.securecirt.com

2 1

Need help...with SYSLOG-NG
by R Saroukhanian 20 Jun '03

20 Jun '03

> Hello folks, > > Could somebody help me with this error message I am getting when trying to run SYSLOG-NG? > > Error message: > No source refers to internal messages, they will go to /dev/null > unresolved reference:src > Error initializing configuration, exiting. > > Here is my setup. > > I installed syslog-ng version 1.6.0 r3 on my FreeBSD 4.8 box. > > The overall plan is to collect log messages sent to by NTSyslog from a Windows 2000 box to SYSLOG-NG on the FreeBSD 4.8 box. > For a test I have been starting and stopping a telnet service on my Windows 2000 box to pick up these events in the telnetlog file which I created on my FreeBSD computer. > > Both syslog-ng and syslog-ng.conf file are located in /etc of the FreeBSD box. > > I am logged in as root. > > syslog.conf file looks like this: > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > options {sync(0); }; > > source src_udp {udp(10.101.54.2) port(514); }; > > destination telnet_d {file ("/var/log/telnetlog"); } ; > > log {source (src_udp); destination (telnet_t); }; > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > > > I run syslog-ng manually from inside /etc and get the error message listed above. > > Does the error message I am getting relate to syntax of the syslog-ng.conf or something else? > > Should I add a filter entry ...inside log statement argument? for it to lool like >>>>>> log {source (src_udp); filter (DEFAUILT); destination (telnet_t); }; ??? > > I am looking forward to hearing from you. > > Please send a copy of your response to rex(a)piva.net. > > Thank you, > > Ruben Saroukhanian

3 4

Need help...with SYSLOG-NG
by R Saroukhanian 19 Jun '03

19 Jun '03

Hello folks, Could somebody help me with this error message I am getting when trying to run SYSLOG-NG? Error message: No source refers to internal messages, they will go to /dev/null unresolved reference:src Error initializing configuration, exiting. Here is my setup. I installed syslog-ng version 1.6.0 r3 on my FreeBSD 4.8 box. The overall plan is to collect log messages sent to by NTSyslog from a Windows 2000 box to SYSLOG-NG on the FreeBSD 4.8 box. For a test I have been starting and stopping a telnet service on my Windows 2000 box to pick up these events in the telnetlog file which I created on my FreeBSD computer. Both syslog-ng and syslog-ng.conf file are located in /etc of the FreeBSD box. I am logged in as root. syslog.conf file looks like this: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> options {sync(0); }; source src_udp {udp(10.101.54.2) port(514); }; destination telnet_d {file ("/var/log/telnetlog"); } ; log {source (src_udp); destination (telnet_t); }; >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> I run syslog-ng manually from inside /etc and get the error message listed above. Does the error message I am getting relate to syntax of the syslog-ng.conf or something else? Should I add a filter entry ...inside log statement argument? for it to lool like >>>>>> log {source (src_udp); filter (DEFAUILT); destination (telnet_t); }; ??? I am looking forward to hearing from you. Please send a copy of your response to rex(a)piva.net. Thank you, Ruben Saroukhanian

1 0