July 2003 - syslog-ng - lists.balabit.hu

How to filter XDMCP messages ?
by Gerard Breiner 12 Jan '04

12 Jan '04

Hello, I wonder how to configure syslog-ng to filtering the messages emitted by gdm_xdmcp. this type of messages pollutes my files of logs. Here is messages i don't want : "gdm[3798]: gdm_xdmcp_handle_query: Opcode 1 from ". Best regards Gerard Gerard Breiner Institut d'Astrophysique Spatiale Orsay Campus France

4 5

Syslog-ng on NetBSD
by Axel Gerster 28 Aug '03

28 Aug '03

Hello, I got some compile errors on syslog-ng on NetBSD. Does anyone know how to fix it? ---snap---- root@blah:/tmp/syslog-ng-1.6.0rc3# gmake Making all in src gmake[1]: Entering directory `/tmp/syslog-ng-1.6.0rc3/src' gmake all-recursive gmake[2]: Entering directory `/tmp/syslog-ng-1.6.0rc3/src' Making all in . gmake[3]: Entering directory `/tmp/syslog-ng-1.6.0rc3/src' gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c cfg-lex.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c affile.c In file included from /usr/include/arpa/inet.h:65, from affile.c:77: /usr/include/sys/param.h:222: warning: `MIN' redefined /usr/pkg/include/libol/objtypes.h:82: warning: this is the location of the previous definition /usr/include/sys/param.h:223: warning: `MAX' redefined /usr/pkg/include/libol/objtypes.h:86: warning: this is the location of the previous definition gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afsocket.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afunix.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afinet.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afinter.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afuser.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c:37: stropts.h: No such file or directory afstreams.c:38: sys/strlog.h: No such file or directory gmake[3]: *** [afstreams.o] Error 1 gmake[3]: Leaving directory `/tmp/syslog-ng-1.6.0rc3/src' gmake[2]: *** [all-recursive] Error 1 gmake[2]: Leaving directory `/tmp/syslog-ng-1.6.0rc3/src' gmake[1]: *** [all-recursive-am] Error 2 gmake[1]: Leaving directory `/tmp/syslog-ng-1.6.0rc3/src' gmake: *** [all-recursive] Error 1 --snip--- Thx very much. Axel

2 1

Log TCP
by Darrell 28 Aug '03

28 Aug '03

I'm new to Linux and we've decided to setup syslog-ng 1.4.17 on Redhat 8 at work. I'm trying to centralize the logs using TCP for all of our Cisco routers, Nortel firewalls and switches. I need to know what lines to enter and where to enter them in my syslog-ng.conf file. Any help would be greatly appreciated. ----------------------------------- Darrell IT Support

2 1

RE: [syslog-ng]syslog-ng&logrotate
by Hamilton, Andrew 13 Aug '03

13 Aug '03

When you rotate the logs you have to send syslog-ng a SIGHUP to make it look at your new file. If you are using Linux if you look in /etc/logrotate.d there is a file called syslog, make sure it is picking up the correct pid file so that it is HUPing the right process on log rotation. Regards, Drew -----Original Message----- From: yannick.haguenier(a)tuxfamily.org [mailto:yannick.haguenier@tuxfamily.org] Sent: Thursday, July 10, 2003 7:03 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng&logrotate Hy, i have squid + syslog-ng 1.0.6.rc1 Syslog-ng look squid/access.log, and write log file (with date format) on a remote server (tcp). On squid there is a logrotate at 6 am. My pb : before the log rotate, all is good. After logrotate, syslog-ng don't write in the remote file. The last line appear in this file was create at 6am. The process run on the both server, and i have no error. If i run syslog-ng restart, syslog-ng write the ligne in remote file . the next error appear after the next logrotate. Does anyone know why this is happening? thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

resolve IP addresses
by Madhvi Gokool 12 Aug '03

12 Aug '03

> Hello > Can syslog-ng resolve IP addresses using the /etc/hosts file? We do not have > an internal dns at the moment. Currently , the filenames that are created > are the IP addresses of the routers that are pushing their syslog onto the > syslog server. > > Regards > Madhvi >

3 2

Enterasys SSR syslog message date format patch fix
by Rule, Ted 31 Jul '03

31 Jul '03

As previously posted, my old v 1.5 syslog-ng daemon had a little problem with SSR syslog messages which incorrectly use "MMM 0D" format instead of "MMM D" format for days 1 to 9 of each month, against RFC3164's strictures, and unlike all other hosts and routers I've come across. As a fix, I first upgraded to 1.6.0rc3 latest snapshot, manually forced one of the SSR's into "tomorrow", and thereby forced a syslog message of the wrong format to be issued as per below: Jul 31 16:54:35 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (exit ) executed Jul 31 16:55:46 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (system show date ) executed Aug 01 01:01:01 fttv-e7D-ssr-sl1 %SYS-I-DATE_CHANGE, The system's date has been changed to: 2003-08-01 01:01:01 Aug 01 01:01:07 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (system show date ) executed Aug 01 01:01:33 fttv-e7D-ssr-sl1 %CONFIG-W-NOTSAVED, Changes made to the running system are not saved to Startup Aug 01 01:01:36 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (guest). Aug 01 01:01:36 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (logout ) executed Which goes to prove that even v1.6 code still 'fails' to auto-correct the broken date-stamp. The patch fix below corrects the problem in src/log.c - simply patch log.c and touch log.c.x and remake the syslog-ng binary. [user@host syslog-ng]$ pwd /usr/src/patches/syslog-ng [user@host syslog-ng]$ diff -u log.c-1.6.0rc3.orig log.c-1.6.0rc3.patched --- log.c-1.6.0rc3.orig Tue Jul 29 09:36:59 2003 +++ log.c-1.6.0rc3.patched Tue Jul 29 10:05:44 2003 @@ -108,6 +108,22 @@ src[9] == ':' && src[12] == ':') { /* Expected buffer format: MMM DD HH:MM:SS ... */ + /* Catcher for violation of RFC3164 para 4.1.2: + "If the day of the month is less than 10, then it MUST + be represented as a space and then the number. + For example, the 7th day of August would be represented + as "Aug 7", with two spaces between the "g" and + the "7"." + + Enterasys Expedition Routers are known to violate + this clause. + + Ted_Rule(a)flextech.co.uk: 29/07/2003 */ + if ( src[4] == '0' && isdigit(src[5]) && + isdigit(src[7]) && isdigit(src[8]) ) { + src[4] = ' '; + } + /* Just read the buffer data into a textual datestamp. */ lm->date = c_format_cstring("%s", 15, src); [user@host syslog-ng]$ Which resulted in the correct format messages appearing in the actual syslog files, after which time, I flipped the router back to "today" and re-enabled NTP. Jul 31 16:54:35 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (enabled). Jul 31 16:54:35 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (exit ) executed Jul 31 16:55:46 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (system show date ) executed Aug 01 01:01:01 fttv-e7D-ssr-sl1 %SYS-I-DATE_CHANGE, The system's date has been changed to: 2003-08-01 01:01:01 Aug 01 01:01:07 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (system show date ) executed Aug 01 01:01:33 fttv-e7D-ssr-sl1 %CONFIG-W-NOTSAVED, Changes made to the running system are not saved to Startup Aug 01 01:01:36 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (guest). Aug 01 01:01:36 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (logout ) executed Aug 1 01:10:22 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (guest). Aug 1 01:10:22 fttv-e7D-ssr-sl1 %TELNETD-A-LOGIN, Telnet user login Aug 1 01:10:24 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (enabled). Aug 1 01:10:24 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (en ) executed Jul 31 17:08:00 fttv-e7D-ssr-sl1 %SYS-I-DATE_CHANGE, The system's date has been changed to: 2003-07-31 17:08:00 Jul 31 17:08:05 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (system show date ) executed Jul 31 17:08:23 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (guest). Jul 31 17:08:23 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (logout ) executed I believe the reason that the date parsing of the original message fails to auto-correct the problem is that the write of msg->date to msg->line in src/affile.c/do_handle_dest__writer() uses the original 15 byte raw date string, rather than rebuild a date string on the fly from the tm struct which is parsed by log.c: static void do_handle_dest_writer(struct log_handler *c, struct log_info *msg) { CAST(affile_dest_writer, self, c); if (self->dest) { struct ol_string *msg_line; if (self->owner->template_output) { msg_line = expand_macros( self->owner->cfg, self->owner->template_output, self->owner->template_escape, msg); } else { msg_line = c_format("%S %S %S\n", msg->date, msg->host, msg->msg); } A_WRITE_STRING(&self->dest->buffer->super, msg_line); if (self->reap) io_callout_set_timeout(self->reap, self->time_reap); } log_info_free(msg); } Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Remote log receive
by MiikaT 30 Jul '03

30 Jul '03

Hi, I'm new to syslog-ng and was wondering if following scenario is possible with it. I'm sending log from remote device to syslog-ng with these facilities: local0.info local1.info local2.info Can I make all logs go into one separate log file based on the source ip, or all three log facilities to different files also based on the source ip? I tried to implement the sample configurations, with no luck so far. -MiikaT ------------------------------------------------- This mail sent through IMP: http://horde.org/imp/

2 2

RE: [syslog-ng]syslog-ng misinterpreting messages from Enterasys Routers.
by Rule, Ted 30 Jul '03

30 Jul '03

Dunno if you wanted to know, but I'll answer it anyway. My simple fix was to change this: options { chain_hostnames(no); keep_hostname (yes); to this: options { chain_hostnames(no); check_hostname(yes); # Added to fix SSR decode bug keep_hostname (yes); # Changed from yes to try and fix SSR decode bug # now changed back following use of check_hostname... in the Global Options settings... the default check_hostname code hard-wired in the source were sufficient to avoid the problem of misinterpretation, even on my old v1.5.24 code at the time. i.e. this bit of code was effectively enabled, causing it to skip over the %CONS-W-BADPASSWD string by dint of it not being deemed a valid hostname character: while (left && *src != ' ' && *src != ':' && *src != '[') { if (lm->flags & LF_CHECK_HOSTNAME && !((*src >= 'A' && *src <= 'Z') || (*src >= 'a' && *src <= 'z') || (*src >= '0' && *src <= '9') || *src == '-' || *src == '_' || *src == '.' || *src == ':' || *src == '@' || *src == '/')) { break; } src++; left--; } Ted -----Original Message----- From: "Urmas Jagomann" <urmas(a)eyp.ee>@FLEXTECH Sent: Wednesday 30 July 2003 10:06 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng misinterpreting messages from Enterasys Routers. Lugupidamisega, Urmas Jagomann 6655424 ----- Original Message ----- From: <Ted_Rule(a)flextech.co.uk> To: <syslog-ng(a)lists.balabit.hu> Sent: Thursday, January 23, 2003 2:21 PM Subject: [syslog-ng]syslog-ng misinterpreting messages from Enterasys Routers. > > > Having finally bitten the bullet and installed syslog-ng ( libol-0.3.6 / > syslog-ng-1.5.24 ), > I've only come across one problem... syslog messages from our Enterasys Routers > are being > corrupted. All Unix and Cisco messages appear Ok. > > As an example, these raw packets from an SSR and a Cisco: > > tcpdump -s 512 -x -e -l -n udp and port 514 and host fttv-gps-core-ssrA | > tcpdumpascii.pl > tcpdump: listening on eth0 > 10:29:54.111864 0:e0:63:93:25:bf 0:50:8b:f3:93:46 ip 100: 192.168.32.11.4739 > > 172.17.12.6.syslog: udp 58 > 4500 0056 73a2 0000 3f11 6f2a c0a8 200b E..Vs...?.o*.. . > ac11 0c06 1283 0202 0042 b5ba 3c31 3838 .........B..<188 > 3e4a 616e 2032 3320 3130 3a32 393a 3533 >Jan 23 10:29:53 > 2025 434f 4e53 2d57 2d42 4144 5041 5353 %CONS-W-BADPASS > 5744 2c20 696e 636f 7272 6563 7420 7061 WD, incorrect pa > 7373 776f 7264 ssword > > 1 packets received by filter > 0 packets dropped by kernel > > tcpdump -s 512 -x -e -l -n udp and port 514 and host gps-enterprise-cisco-e0 | > tcpdumpascii.pl > tcpdump: listening on eth0 > 10:30:44.037939 0:10:7b:80:f:fb 0:50:8b:f3:93:46 ip 138: 172.17.8.76.8800 > > 172.17.12.6.syslog: udp 96 > 4500 007c 29b5 0000 ff11 2547 ac11 084c E..|).....%G...L > ac11 0c06 2260 0202 0068 187a 3c31 3839 ...."`...h.z<189 > 3e31 3036 3737 3a20 4a61 6e20 3233 2031 >10677: Jan 23 1 > 303a 3330 3a34 3320 474d 543a 2025 5359 0:30:43 GMT: %SY > 532d 352d 434f 4e46 4947 5f49 3a20 436f S-5-CONFIG_I: Co > 6e66 6967 7572 6564 2066 726f 6d20 636f nfigured from co > 6e73 6f6c 6520 6279 2076 7479 3020 2831 nsole by vty0 (1 > 3732 2e31 372e 3132 2e37 3229 72.17.12.72) > > > Result in this in the log: > > Jan 23 10:29:53 %CONS-W-BADPASSWD, incorrect password > Jan 23 10:30:44 gps-enterprise-cisco-e0 10677: Jan 23 10:30:43 GMT: > %SYS-5-CONFIG_I: Configured from console by vty0 (172.17.12.72) > > > It looks as if syslog-ng is assuming %CONS-W-BADPASSWD is a hostname....and the > Cisco message picks up a hostname via DNS, which > is NOT included in the packet. > > > I note the version 1.5.25 has a bad_hostname() option. Is it possible that this > may be used to alleviate this issue, or is some other workround > needed? I'm guessing "keep_hostname(no)" might fix it, but would that > potentially lead to other problems? Is there a summary of the algorithm > which syslog-ng uses to determine whether the message contains a hostname? > > > > Current Options settings laid out below. > > > ............... > > # Global Options Settings > options { > chain_hostnames(no); > keep_hostname (yes); > use_dns (yes); > use_fqdn (no); > long_hostnames (off); > dns_cache(yes); > dns_cache_size(100); > dns_cache_expire(600); > dns_cache_expire_failed(120); > > create_dirs (no); > dir_owner(root); > dir_group(root); > dir_perm(0755); > owner(root); > group(root); > perm(0600); > > stats(120); > > sync(10); > time_reopen (10); > time_reap(20); > > use_time_recvd(no); > > log_fifo_size (1000); > log_msg_size (1024); > > gc_idle_threshold(100); ### default 100 > gc_busy_threshold(3000); ### default 3000 > }; > > ............... > > > Thanks, > > > Ted > > > > > > > > > > ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

syslog-ng misinterpreting messages from Enterasys Routers.
by Ted_Rule＠flextech.co.uk 30 Jul '03

30 Jul '03

Having finally bitten the bullet and installed syslog-ng ( libol-0.3.6 / syslog-ng-1.5.24 ), I've only come across one problem... syslog messages from our Enterasys Routers are being corrupted. All Unix and Cisco messages appear Ok. As an example, these raw packets from an SSR and a Cisco: tcpdump -s 512 -x -e -l -n udp and port 514 and host fttv-gps-core-ssrA | tcpdumpascii.pl tcpdump: listening on eth0 10:29:54.111864 0:e0:63:93:25:bf 0:50:8b:f3:93:46 ip 100: 192.168.32.11.4739 > 172.17.12.6.syslog: udp 58 4500 0056 73a2 0000 3f11 6f2a c0a8 200b E..Vs...?.o*.. . ac11 0c06 1283 0202 0042 b5ba 3c31 3838 .........B..<188 3e4a 616e 2032 3320 3130 3a32 393a 3533 >Jan 23 10:29:53 2025 434f 4e53 2d57 2d42 4144 5041 5353 %CONS-W-BADPASS 5744 2c20 696e 636f 7272 6563 7420 7061 WD, incorrect pa 7373 776f 7264 ssword 1 packets received by filter 0 packets dropped by kernel tcpdump -s 512 -x -e -l -n udp and port 514 and host gps-enterprise-cisco-e0 | tcpdumpascii.pl tcpdump: listening on eth0 10:30:44.037939 0:10:7b:80:f:fb 0:50:8b:f3:93:46 ip 138: 172.17.8.76.8800 > 172.17.12.6.syslog: udp 96 4500 007c 29b5 0000 ff11 2547 ac11 084c E..|).....%G...L ac11 0c06 2260 0202 0068 187a 3c31 3839 ...."`...h.z<189 3e31 3036 3737 3a20 4a61 6e20 3233 2031 >10677: Jan 23 1 303a 3330 3a34 3320 474d 543a 2025 5359 0:30:43 GMT: %SY 532d 352d 434f 4e46 4947 5f49 3a20 436f S-5-CONFIG_I: Co 6e66 6967 7572 6564 2066 726f 6d20 636f nfigured from co 6e73 6f6c 6520 6279 2076 7479 3020 2831 nsole by vty0 (1 3732 2e31 372e 3132 2e37 3229 72.17.12.72) Result in this in the log: Jan 23 10:29:53 %CONS-W-BADPASSWD, incorrect password Jan 23 10:30:44 gps-enterprise-cisco-e0 10677: Jan 23 10:30:43 GMT: %SYS-5-CONFIG_I: Configured from console by vty0 (172.17.12.72) It looks as if syslog-ng is assuming %CONS-W-BADPASSWD is a hostname....and the Cisco message picks up a hostname via DNS, which is NOT included in the packet. I note the version 1.5.25 has a bad_hostname() option. Is it possible that this may be used to alleviate this issue, or is some other workround needed? I'm guessing "keep_hostname(no)" might fix it, but would that potentially lead to other problems? Is there a summary of the algorithm which syslog-ng uses to determine whether the message contains a hostname? Current Options settings laid out below. ............... # Global Options Settings options { chain_hostnames(no); keep_hostname (yes); use_dns (yes); use_fqdn (no); long_hostnames (off); dns_cache(yes); dns_cache_size(100); dns_cache_expire(600); dns_cache_expire_failed(120); create_dirs (no); dir_owner(root); dir_group(root); dir_perm(0755); owner(root); group(root); perm(0600); stats(120); sync(10); time_reopen (10); time_reap(20); use_time_recvd(no); log_fifo_size (1000); log_msg_size (1024); gc_idle_threshold(100); ### default 100 gc_busy_threshold(3000); ### default 3000 }; ............... Thanks, Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

3 2

All messages logging to all files
by Brian Foran 29 Jul '03

29 Jul '03

Hello I am having a problem where anytime I point a new host to my Syslog-ng server, it seems to write to all logfiles located in the syslog-ng.conf file. Thanks for your response in advance. Here is my configuration file: options { sync (0); time_reopen (10); log_fifo_size (1000); check_hostname(yes); long_hostnames (off); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); }; filter f_borderpix { host("525edgepixpair") or match ("*.*.*.*"); }; destination d_borderpix { file("/var/log/logfiles/borderpix/borderpix.log"); }; log { source(s_net); destination(d_borderpix); }; filter f_stelt_hurricane { host("hurricane") or match ("*.*.*.*"); }; destination d_stelt_hurricane { file("/var/log/logfiles/stelt/hurricane.log"); }; log { source(s_net); destination(d_stelt_hurricane); }; filter f_stelt_cyclone { host("cyclone") or match ("*.*.*.*"); }; destination d_stelt_cyclone { file("/var/log/logfiles/stelt/cyclone.log"); }; log { source(s_net); destination(d_stelt_cyclone); }; Thanks, Brian

1 0