July 2003 - syslog-ng - lists.balabit.hu

syslog-ng
by Shetkar, Ravishankar 28 Jul '03

28 Jul '03

Hi All, I am working on a log centralization project in a Solaris environment and my initial search led me to syslog-ng. It seems like syslog-ng is a good product which is recommended by a lot of people. . If you are running syslog-ng in a Solaris environment (especially Solaris 8/9) I would very much be interested hearing about your experiences. I would really be interested in positive comments from someone who is successfully employing syslog-ng. I noticed there are frequent releases of syslog-ng. How easy/difficult/time consuming is it to upgrade an operational environment? It will be grate if some one give me a sample syslog-ng.conf files on syslog server and clients.And some hits about how to use and configure mysql with syslog-ng. thanks Ravi

1 0

syslog-ng under Solaris 5.6
by Martynas Buozis 24 Jul '03

24 Jul '03

Hello I have syslog-ng 1.6.0rc3 compiled with gcc 2.95.2. Every time I stop/start syslog-ng or send HUP to daemon I get logged by syslog-ng (but not with native for OS syslogd) same old messages (kernel facility) that comes since last system boot. Same messages I see when issue dmesg command. This is an example for first lines that comes out in logged messaged file : Jul 24 19:18:45 local@dev cpu0: SUNW,UltraSPARC-II (upaid 0 impl 0x11 ver 0x20 clock 296 MHz) Jul 24 19:18:45 local@dev cpu1: SUNW,UltraSPARC-II (upaid 1 impl 0x11 ver 0x20 clock 296 MHz) Jul 24 19:18:45 local@dev SunOS Release 5.6 Version Generic_105181-33 [UNIX(R) System V Release 4.0] Jul 24 19:18:45 local@dev Copyright (c) 1983-1997, Sun Microsystems, Inc. Jul 24 19:18:45 local@dev mem = 1048576K (0x40000000) Jul 24 19:18:45 local@dev avail mem = 1039056896 This behavious is same on all Solaris 5.6 machines, while no problems with Solaris 7 and 8 (same binary). Does anyone know how to get rid of these messages after HUP ? Thank you for any tips according this matter. With best regards Martynas

4 4

Forwarding unchanged Syslog messages
by Harrie.van.Arragon＠steinmuehlen-brot.de 24 Jul '03

24 Jul '03

Is it possible to forward syslogmessages without modifing the Host and the messages. I thought "keep_hostname(yes)" would solve the problem, but it didn't. Normaly i use version 1.5.15 shipped with debian, but I tryed 1.5.26 too. I don't konw if its important, but our syslogserver has a load of 100% the whole day (not from syslog-ng). I tryed the following config: options { use_fqdn(yes); sync(0); use_dns(yes); chain_hostnames(yes); keep_hostname(yes); }; source net { tcp(); udp();}; destination pc1 { udp(192.168.1.1);}; destination pc2 { udp(192.168.1.2);}; destination pc3 { udp(192.168.1.3);}; log { source(net); destination(pc1);}; log { source(net); destination(pc2);}; log { source(net); destination(pc3);}; bye Harrie

1 0

fopen fails under load on Solaris, HUP doesn't work
by Ryan Moon 23 Jul '03

23 Jul '03

Hi all, I'm running version 1.6.0rc3 of syslog-ng on Solaris 2.6 and I have a problem where a HUP signal is not correctly processed due to limitations in the Solaris stdio library. I've traced this down to the use of fopen in make_syslog_config() in cfgfile.c. When the server is under load (several hundred TCP connections from clients), the HUP is not processed because fopen() does not work when it receives a file descriptor from open() above 255. The fopen() fails and the rest of the actions to be performed on a HUP are skipped. I see that the fopen is used because of the fread and fwrite calls in cfg-lex.c. Is there any way that lex/flex could be configured to use read/write instead of fread/fwrite, and the call to fopen in cfgfile.c replaced with open? I really don't want to restart syslog-ng every time I need to rotate logs, as the overhead is too high. I'd much rather just HUP so that I can keep the client TCP connections alive via the keep-alive option. Thank you, Ryan Moon rmoon(a)gocougs.wsu.edu

1 0

UDP Source removal
by Tom Oele 22 Jul '03

22 Jul '03

First off, thanks for the syslog-ng effort. :-) Setting up a "middle-man" syslog forwarder for multiple IDS devices. The issue I'm having is that I need to keep the originating device IP through this forwarder. The original message is old syslog to syslog-ng then off again to a correlation host with a syslogd listener. The correlation host needs those messages in their original form instead of with the middle mans IP attached. IDS1(syslog)----->Middle Host(syslog-ng)------>Correlation(syslogd -r) ^ | IDS2(syslog)--------- So the correlation host obviously is taking the UDP source from the middle man and appending it to the beginning of the message. Have tried using keep_hostname() with no avail. Current options are the following: options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(yes); chain_hostnames(no); }; Am I missing something here? Ideas? Thnx, T -- Neohapsis, Inc. Thomas Oele - Network Security Consultant 414.289.0966 Milwaukee 773.394.8310 Chicago www.Neohapsis.com

2 1

netmask() and syslog-ng 1.6.0rc3
by Rick Shank 22 Jul '03

22 Jul '03

Hello, I saw a post showing the netmask() function for filters. I'm trying to do a filter such as: filter f_company { host("company-firewall") or host("company-ids") or netmask("10.128.53.0/24") or netmask("10.128.54.0/24") or netmask("10.128.55.0/24") or netmask("10.128.56.0/24") or netmask("10.128.57.0/24") or netmask("10.128.58.0/24");}; This doesn't seem to work. What am I doing wrong? I'm using the netmasks because the server can't get DNS for those hosts (internal Windows 2000 hosts using EvntSLog). Thanks, ~rick shank

1 0

Destiniation program question
by Aaron Jackson 22 Jul '03

22 Jul '03

I am trying to get syslog-ng 1.6.0rc3 to run a program as soon as it receives a message that matches a specific string, but I am having a few problems. My syslog-ng.conf file has the following set up: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_udp { udp(); }; source s_tcp { tcp(); }; destination d_prog { program("/path/to/program.pl" template("$HOST,$MSG\n")); }; filter f_fetch { level(notice) and match("MATHC_STRING"); }; log {source(s_sys); source(s_udp); source(s_tcp); filter(f_fetch); destination(d_prog); }; My first question is an easy one. My perl program has the form: while ($line=<>) { ... } Is this correct? When syslog-ng forks my perl script, can I assum that STDIN is always open or should my script have a form like so? while (1) { $line=<>; ... } My second question has to do with when the perl script is run. It looks like syslog-ng waits for either several log messages or gets a SIGTERM (or similar) before it runs the program. I would like for this to happen in real time. The only option I see that might change the timimg of when the program is run is log_fifo_size. But since I have to use a production system that collects over 20K log messages/day for development (yes, this is bad), I would like to know if I'm on the right track before I change anything. Any info would be helpful. Thanks. Aaron

1 0

Re: [syslog-ng]List of Valid Source Addresess
by Daniel.N.Sferas＠us.hsbc.Com 21 Jul '03

21 Jul '03

Bazsi, I am interested in filtering based on the sender's IP address. My preferred method would be to read a file containing the list of valid source IP addresses, automagically generated by our management system. The file could contain up to 6,000 entries. Dan syslog-ng-request@lists.balabit.hu@lists.balabit.hu on 18 Jul 2003 08:31 Please respond to syslog-ng(a)lists.balabit.hu Sent by: syslog-ng-admin(a)lists.balabit.hu To: syslog-ng(a)lists.balabit.hu Message: 1 To: syslog-ng(a)lists.balabit.hu From: Daniel.N.Sferas(a)us.hsbc.Com Date: Thu, 10 Jul 2003 06:13:55 -0400 Subject: [syslog-ng]List of Valid Source Addresess Reply-To: syslog-ng(a)lists.balabit.hu Greetings, I would like to be able to validate that incoming syslog messages from the network are from "Well known" sources. Is there a way for syslog-ng to parse the source address against a flat file of IP addresses or patterns? I hesitate to use a match string in the syslog-ng.conf file as the filter would be very large. I am using 1.6.0rc3. Thanks in advance for any tips. Dan Sferas ************************************************************************ This E-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return E-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. ************************************************************************ --__--__-- Message: 2 Date: Thu, 10 Jul 2003 13:01:07 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]List of Valid Source Addresess Reply-To: syslog-ng(a)lists.balabit.hu On Thu, Jul 10, 2003 at 06:13:55AM -0400, Daniel.N.Sferas(a)us.hsbc.Com wrote: > Greetings, > > I would like to be able to validate that incoming syslog messages from the > network are from "Well known" sources. Is there a way for syslog-ng to > parse the source address against a flat file of IP addresses or patterns? > I hesitate to use a match string in the syslog-ng.conf file as the filter > would be very large. do you want to filter based on sender IP address, or the hostname part? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 ************************************************************************ This E-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return E-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. ************************************************************************

2 1

is flags(fallback) b0rken in 1.6.0rc3?
by Asher Yanich 18 Jul '03

18 Jul '03

Hi, I finally went ahead and upgraded my syslog-ng from 1.5.7 to 1.6.0r3. Previously, I used filter(DEFAULT) to catch all logs that had not matched anything else. I updated my config, to log { source(src); destination(d_default); flags(fallback); }; I however do not recieve anything to this destination, so it seems that fallback is broken? Can someone verify that this is the current state of syslog-ng? Thanks, -asher Asher Yanich Systems & Network Support Group Florida International University School of Computer Science "I've never had problems with 'extra time'. As far as I know, 'extra time' as a concept is right up there with Santa Claus and the Tooth Fairy." -Linus Torvalds

1 1

Running two syslog-ng on Solaris 8 ?
by Georg Oppenberg 18 Jul '03

18 Jul '03

Hi, I'm trying to run two syslog-ng on a Solaris 8 box: One is a replacement of the original syslogd, the other one is running in a chrooted environment and configured to log to into file inside the chroot jail. Inside the chroot jail I have made a /dev/log with 'mknod /dev/log -c 21 5'. I'm using the streams server with doors. The corresponding statement in syslog-ng.conf is: source local { sun-streams ("/dev/log" door("/var/run/syslog_door")); internal(); }; /etc/.syslog_door is soft-linked to /var/run/syslog_door. I would like to separate the logs of the chroot environment from the logs of the server. This is not working, though. Log entries generated either on the machine or in the chroot environment are logged in two files. I think this is caused by the log driver, which is responsible for passing messages between applications and syslog daemons. Do I try the impossible or does anybody have configured a similar setup sucessfully? Please respond also directly to me, as I'm not subscribed to the list, yet. Cheers Georg

1 0