June 2003 - syslog-ng - lists.balabit.hu

Log monitoring
by netsec novice 09 Jun '03

09 Jun '03

I am looking for a tool that would allow me to perform an action(send e-mail) when a particular event meets a threshhold. I have my IDS tuned to the point where I have a good sense of how many alerts I receive in an hour. I know I can send an alert based on matching a particular alert but what I would really like to do is send notification based on whether I receive more than 10 alerts in less than an hour. I hope my intention is clear here... I know there are products out there such as Swatch or logwatch but I haven't seen anything that alerts on thresholds rather than pattern matching only. My idea here is to set up something that watches my logs continuously and if I get more than 10 alerts within an hour or less during any part of the day - I would be paged. I am not a Perl guru so any help I can get in getting started is appreciated. My guess is that someone has already invented the wheel - I just don't know where it is. Thanks for any guidance... Nicole _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

2 1

RE: [syslog-ng]Log monitoring
by Hamilton, Andrew 09 Jun '03

09 Jun '03

This is really out of the scope of the syslog process so you'd probably want an external package. You can look at Big Brother. http://www.bb4.com. It is a very useful monitoring tool. And will monitor all kinds of things. It would be fairly simple to have it do this. Regards, Drew -----Original Message----- From: netsec novice [mailto:netsec9@hotmail.com] Sent: Monday, June 09, 2003 1:42 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Log monitoring I am looking for a tool that would allow me to perform an action(send e-mail) when a particular event meets a threshhold. I have my IDS tuned to the point where I have a good sense of how many alerts I receive in an hour. I know I can send an alert based on matching a particular alert but what I would really like to do is send notification based on whether I receive more than 10 alerts in less than an hour. I hope my intention is clear here... I know there are products out there such as Swatch or logwatch but I haven't seen anything that alerts on thresholds rather than pattern matching only. My idea here is to set up something that watches my logs continuously and if I get more than 10 alerts within an hour or less during any part of the day - I would be paged. I am not a Perl guru so any help I can get in getting started is appreciated. My guess is that someone has already invented the wheel - I just don't know where it is. Thanks for any guidance... Nicole _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]log file permission
by Moxey, Joel, CND Tech Dev, VF UK 09 Jun '03

09 Jun '03

Check out your UMASK. Rgds, J -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 09 June 2003 6:37 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]log file permission What version are you using? Is this a global option or a per file option? Regards, Drew -----Original Message----- From: Moktar KONE [mailto:moktar@mtds.com] Sent: Monday, June 09, 2003 1:20 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]log file permission dear all, I am using syslog-ng and I want my log file be created with this permission : rwx-rwx-rwx ; I added this line in the options : perm(777); but my file is not created with the expected permission. any idea? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]log file permission
by Hamilton, Andrew 09 Jun '03

09 Jun '03

What version are you using? Is this a global option or a per file option? Regards, Drew -----Original Message----- From: Moktar KONE [mailto:moktar@mtds.com] Sent: Monday, June 09, 2003 1:20 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]log file permission dear all, I am using syslog-ng and I want my log file be created with this permission : rwx-rwx-rwx ; I added this line in the options : perm(777); but my file is not created with the expected permission. any idea? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

log file permission
by Moktar KONE 09 Jun '03

09 Jun '03

dear all, I am using syslog-ng and I want my log file be created with this permission : rwx-rwx-rwx ; I added this line in the options : perm(777); but my file is not created with the expected permission. any idea?

1 0

Reciving data from non RFC compliant devices
by Michael Boman 08 Jun '03

08 Jun '03

I just got another syslog-generating machine to monitor, and it seems it doesn't follow the syslog RFC as it sends out messages with ^I (tabs). I was thinking about hacking syslog-ng in such way it will enforce RFC compliance of the "message" part for the data. Basically I am thinking about replacing char <= 31 and char >= 127 with a space. Question: - Any reason why _not_ to do this? - Which function is the best place to hack the code in? Best regards Michael Boman -- Michael Boman Security Architect, SecureCiRT Pte Ltd http://www.securecirt.com

1 0

RE: [syslog-ng]What means "dropped" ?
by Loubet Jean-Michel 08 Jun '03

08 Jun '03

I've only got one syslog client host for my bench (solaris 6), and one collector with syslog-ng 1.6.0rc3 (solaris 6). Here are my global properties if you need them : keep_hostname(yes); long_hostnames(no); log_fifo_size(8192); log_msg_size (2048); sync(1024); use_time_recvd(yes); use_dns(no); use_fqdn(no); dns_cache(no); stats (4); JM Loubet > > I'll give you more informations : > > Here are my bench's results : > > 20000 msgs sent > 19873 msgs written (after kill -HUP) > > and my logs : > > [...] > STATS: dropped 0 > STATS: dropped 64 > STATS: dropped 1994 > STATS: dropped 2002 > STATS: dropped 1871 > STATS: dropped 1994 > STATS: dropped 1998 > STATS: dropped 1744 > STATS: dropped 71 > STATS: dropped 0 > [...] each destination may drop messages, and this is an aggregated result. (e.g. if you have 5 destinations, a single message may be counted 5 times, provided all destinations were full)

2 1

filter match()
by Amodiovalerio Verde 06 Jun '03

06 Jun '03

Hi all, during some extensive test on syslog-ng, I found something that really make me difficult to implement some filters. I need to match same EXACT messages, and so I used something like match("^MATCHTHIS$") in a filter statement... but I find that the match will consider the message starting from the program name... Is there any way to match JUST the message part without the program one ??? ( the program() just work on the program part of the message, so i expected that match() will work on the other one... ) Thanks in advance Amodiovalerio Verde amodiovalerio.verde(a)ags-it.com amover(a)libero.it

4 4

syslog-ng and syslogd
by Bossi, Scott 06 Jun '03

06 Jun '03

Hi, I'm new to syslog-ng. Is there a way for syslog-ng and syslogd to co-exist? Our servers are managed by another group, and they don't support syslog-ng. Can you pipe all syslogd messages to syslog-ng?

2 1

RE: [syslog-ng]What means "dropped" ?
by Loubet Jean-Michel 06 Jun '03

06 Jun '03

>On Fri, Jun 06, 2003 at 03:36:44PM +0200, Loubet Jean-Michel wrote: >> Hi, >> >> I don't really understand what means "dropped" in stats. I've done benchs >> and I didn't found any correlation between really dropped messages and the >> number in dropped stats. > >DROPPED is the number of messages dropped by syslog-ng itself. It does not >count messages dropped due to full socket buffers (as they are dropped by >the kernel and not syslog-ng) I'll give you more informations : Here are my bench's results : 20000 msgs sent 19873 msgs written (after kill -HUP) and my logs : [...] STATS: dropped 0 STATS: dropped 64 STATS: dropped 1994 STATS: dropped 2002 STATS: dropped 1871 STATS: dropped 1994 STATS: dropped 1998 STATS: dropped 1744 STATS: dropped 71 STATS: dropped 0 [...] That's why I said I didn't found any correlation between the 2 results ... Any idea ? Thanks, JM Loubet

2 1