June 2003 - syslog-ng - lists.balabit.hu

Syslog-ng, MySql and Checkpoint Firewall-1 NG
by Robin Brown 06 Jun '03

06 Jun '03

Anyone sending their Checkpoint logs to a central syslog server running syslog-ng and logging to a MySql database? I may have to do this in the near future and was wondering if it's possible and what if any problems I can expect to encounter. Thanks! -Robin

2 2

What means "dropped" ?
by Loubet Jean-Michel 06 Jun '03

06 Jun '03

Hi, I don't really understand what means "dropped" in stats. I've done benchs and I didn't found any correlation between really dropped messages and the number in dropped stats. Thanks for your answer, JM Loubet

2 1

Re: [syslog-ng]Help with host filter for 10.10.10.0/26
by Henning Markussen 06 Jun '03

06 Jun '03

Yes it is the sender ... and it works .. - Henning Balazs Scheidler <bazsi(a)balabit.hu> Sent by: syslog-ng-admin(a)lists.balabit.hu 06-06-03 12:19 Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: Subject: Re: [syslog-ng]Help with host filter for 10.10.10.0/26 On Fri, Jun 06, 2003 at 10:26:46AM +0200, Henning Markussen wrote: > Hi ! > > Can someone help me with a filter that matches 10.10.10.0/26 ? is 10.10.10.0/26 the sender of the log message itself, or it is included in the message as the 'host' field? if it is the sender you can use the netmask() filter: filter f_xx { netmask("10.10.10.0/26"); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Help with host filter for 10.10.10.0/26
by Henning Markussen 06 Jun '03

06 Jun '03

Hi ! Can someone help me with a filter that matches 10.10.10.0/26 ? - Henning

2 1

libtool ar not found
by Steven Welters 05 Jun '03

05 Jun '03

Hi, I want to install syslog-ng on my Solaris 7 system. I have gcc 3.2.3, GNU make 3.80, GNUflex, bison. I run into problems with compiling the libol (have tried 0.3.10, 3.9, 3.8, 3.6, 3.5). ./configure seems to work, however, make stops with these error messages: ../libtool: ar: not found make[1]: *** [libol.la] Error 1 make[1]: Leaving directory `/tmp/libol-0.3.5/src' make: *** [all-recursive] Error 1 I have searched the internet but no references to this problem found. Does anyone have a clue? Best regards & thanks in advance, Steven ---"Virtual" means never knowing where your next byte is coming from.---

3 2

tcp wrappers, syslog-ng and solaris 9
by Tivon Luker 05 Jun '03

05 Jun '03

Hello. I am attempting to get tcp wrappers to work with syslog-ng-1.6.0rc3 compiled under solaris 9. syslog-ng seems to ignore hosts.allow and hosts.deny. When compiling ,configure says it finds everything and I compiled with --enable-tcp-wrapper. Has anyone been successful in getting this to work? _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

2 1

syslog-ng macro
by Michael Earls 05 Jun '03

05 Jun '03

What is the best way to apply filters to this macro. Let say I want to log messages to a different file for a given IP address. Should I add this type of statement before the destination d_mysql. # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # source src { unix-dgram("/dev/log"); internal(); }; source net { udp(); }; # # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # # source src { unix-dgram("/dev/log"); internal(); udp(); }; ## Log syslog-ng to mysql database ## destination d_mysql { file("/syslog/data/fulllog.$YEAR.$MONTH.$DAY.$HOUR.$MIN.$SEC" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; Thanks, michael Michael Earls Systems Analyst, Information Services Cincinnati Children's Hospital Medical Center Phone: 513-636-5882 Pager: Michael.Earls(a)skytel.com PGP Info: KeyID 0x5EB59708 Fingerprint 108B A1D8 76F5 08A8 501A F28C 86F4 4BC5 5EB5 9708

1 0

macro expansion in program destinations
by Nate Campi 05 Jun '03

05 Jun '03

I might be missing something obvious here, but is there a way to get macros to expand when used as arguments to external scripts? ex: ---------------- destination test-script { program("/tmp/testscript /var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$HOST_$YEAR_$MONTH_$DAY"); }; log { source(src); destination(test-script); }; ---------------- Here's /tmp/testscript: ---------------- #!/bin/sh echo $1 > /tmp/arg ---------------- # cat /tmp/arg /var/log/HOSTS///// I'd like to be able to pass these things, especially message-specific things like facility. Is there a way and I'm just not seeing it? -- Nate Campi http://www.campin.net

2 1

1 as IP
by KELLYM15＠Nationwide.com 04 Jun '03

04 Jun '03

Hello, We have the following package installed on a Sun Solaris 8 machine. The syslog output for one of our CSS boxes is being recorded under a directory number 1. The rest of the devices we log are being recorded under their regular IP address. For example, an ls of our output directory looks similar to this: (note the first directory) drwxr-xr-x 2 root root 512 Jun 4 02:11 1 drwxr-xr-x 2 root root 512 Jun 4 00:00 25.75.27.148 drwxr-xr-x 2 root root 512 Jun 4 04:04 25.75.27.149 drwxr-xr-x 2 root root 512 Jun 4 00:00 25.75.27.150 drwxr-xr-x 2 root root 512 Jun 4 04:34 25.75.27.151 Have you seen that before? Is there a configuration change on the CSS that needs to be made? Thanks, Mark Kelly =========================================================================== PKGINST: SOsyslog NAME: syslog-ng CATEGORY: application ARCH: sparc VERSION: 1.5.23 VENDOR: BalaBit IT Ltd. PSTAMP: Nationwide Security Operations INSTDATE: May 14 2003 20:20 EMAIL: syslog-ng(a)lists.balabit.hu STATUS: completely installed FILES: 25 installed pathnames 10 shared pathnames 15 directories 3 executables 1983 blocks used (approx)

1 0

RE: [syslog-ng] problem with incorrect separation of syslog messages from Cisco PIX
by Ted_Rule＠flextech.co.uk 04 Jun '03

04 Jun '03

At blooming last....and FYI. Having now upgraded our PIX to version 6.3, and enabled TCP logging on port 1468... I can see that all messages ( in raw tcpdump trace ) are newline terminated ( note the 0a HEX bytes in the packet dump ) I can also we see that the 255 byte buffer length problem has been sorted out, as I can now see these messages in full. ( They used to truncate halfway through the dest_proxy definition... ) Jun 4 10:26:05 littlepix %PIX-7-702303: sa_request, (key eng. msg.) src= 11.11.11.11, dest= 22.22.22.22, src_proxy= 11.11.110/255.255.255.0/0/0 (type=4), dest_proxy= 22.22.22.128/255.255.255.192/0/0 (type=4), protocol= ESP, transform= esp-3des esp-sha-hmac , lifedur= 1200s and 4608000kb, spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4004 Jun 4 10:26:05 littlepix %PIX-7-702303: sa_request, (key eng. msg.) src= 11.11.11.11, dest= 22.22.22.22, src_proxy= 11.11.110/255.255.255.0/0/0 (type=4), dest_proxy= 22.22.22.128/255.255.255.192/0/0 (type=4), protocol= ESP, transform= esp-3des esp-md5-hmac , lifedur= 1200s and 4608000kb, spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4004 The only problem so far is that these messages have appeared ( for some reason they didn't show up in Version 6.2 log stream but ARE listed on the syslog message listings for 6.2 ). I shall have to fancify my log filtering to suppress them.... They all correspond to regular MGMT station SNMP polling and are ignorable but are gradually filling the log... Jun 4 10:10:31 littlepix %PIX-7-710002: UDP access permitted from 33.33.33.4/943 to inside:33.33.33.15/snmp Jun 4 10:11:31 littlepix %PIX-7-710002: UDP access permitted from 33.33.33.4/9903 to inside:33.33.33.15/snmp Jun 4 10:11:42 littlepix %PIX-7-710002: UDP access permitted from 33.33.33.4/10159 to inside:33.33.33.15/snmp Whether or not any problems exist using the UDP syslog transport on the PIX under v6.3, I haven't actually tested, but I'd be fairly confident they've also been fixed.... All in all v6.3 has fixed up all my outstanding issues with PIX syslogging. Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0