September 2003 - syslog-ng - lists.balabit.hu

How to filter XDMCP messages ?
by Gerard Breiner 12 Jan '04

12 Jan '04

Hello, I wonder how to configure syslog-ng to filtering the messages emitted by gdm_xdmcp. this type of messages pollutes my files of logs. Here is messages i don't want : "gdm[3798]: gdm_xdmcp_handle_query: Opcode 1 from ". Best regards Gerard Gerard Breiner Institut d'Astrophysique Spatiale Orsay Campus France

4 5

UDP Template
by Gianpiero Porchia 26 Nov '03

26 Nov '03

Hi, I would like to do log relaying, using syslog-ng. But I need to change the log format. The problem is that the "template" directive is not available for the udp destination (even for the tcp destination). Could you suggest me some work around to do that? Thanks in advance. - gian P.S I've thought on a work around, but it doesn't work fine. Hence the "template" directive is available for the pipes, I've used a pipe destination to send the logs. Then, I'm using the same pipe, as source, and I'm relaying the logs from it, to another log server. But syslog-ng thinks that the logs are coming from the server, and I get the following (ie, it uses the standard log format, after the pipe): Message Before the pipe -------------------- [X.Y.Z.K] ufs: [ID 213553 kern.notice] NOTICE: realloccg /u00: file system full Message After the pipe --------------------- Sep 25 18:12:11 Figth_cluB_01 [X.Y.Z.K] ufs: [ID 213553 kern.notice] NOTICE: realloccg /u00: file system full I'm using this configuration: # CONF ############################################# source s_net { udp(); }; source s_pipe_per_NI { pipe(/var/chroot/syslog-ng/dev/pipe_per_NI); }; destination relay_to_NI { udp("A.B.C.D" ); }; destination d_pipe_per_NI { pipe("/dev/pipe_per_NI" template("[$HOST] $MSG\n") ); }; log { source(s_net); destination(d_pipe_per_NI); # Here, I can apply the template }; log { source(s_pipe_per_NI); destination(relay_to_NI); # Here, syslog-ng applies the standard log format :( }; # END CONF ############################################# _____ Ing. Gianpiero Porchia Security Engineer ATS - Advanced Telecom Systems Designing, Testing, Managing Network Quality Via Salgari, 17 - 41100 Modena - ITALY Tel +39 059 821332 Fax +39 059 821492 Cel +39 335 330413 E-mail: gianpiero.porchia(a)atsweb.it messenger.msn.com: http://messenger.msn.com/, gianpiero.porchia(a)atsweb.it Web site: http://www.atsweb.it PGP Key ID: 0xCAE064A4 (pgpkeys.mit.edu:11371) Fingerprint: 080D AD88 C18A FCA3 91BC 0DF2 F05F 7489 CAE0 64A4

2 1

syslog-ng to mysql
by Ali, Tahir 26 Nov '03

26 Nov '03

Hey, I'am running syslog-ng Version: 1.5.15-1. I pipe all the syslog messages to a mysql database. Every thing works fine, but some times it stop logging to the database. I run mysql Version: 3.23.49-8. When i restart syslog-ng it work fine again. It can work fine for weeks. Have any else experience the same problem ? Regards Tahir

2 1

bug report: interlaced messages
by Thomas Morin 03 Oct '03

03 Oct '03

Hi, I've just run into a problem I had already seen during my tests for the previous bug report I sent : I see pieces of logs that appear in the middle of other messages. Example: $ grep 'Sep 22 06:17:0' messages Sep 22 06:17:01 ker0009901 )<38>Sep 22 06:17:01 cron(pam_unix)[1173]: session closed for user mail We see, in the middle of a message, the beginning of a syslog header ( "<..>" ) and the message that follows does not belong to the 'messages' destination, and we see that it is actually missing from the 'auth.log' file : $ grep 'Sep 22 06:17:0' auth.log Sep 22 06:17:01 ker0009901 cron(pam_unix)[1173]: session opened for user mail by (uid=0) Sep 22 06:17:01 ker0009901 cron(pam_unix)[1174]: session opened for user root by (uid=0) Sep 22 06:17:02 ker0009901 cron(pam_unix)[1174]: session closed for user root (no "session closed" for user mail) This kind of problem might be a security issue if it can be triggered easily. I'm no expert here, but this looks a bit similar to the other bug I've just reported, since the same thing (interlaced messages) is happening when syslog-ng receives UDP syslog messages not NULL terminated of which size exceeds log_msg_size. Regards, -Thomas PS: this is syslog-ng 1.6.0, version 1.6.0rc1+20030310 (debian package), running on Linux 2.6.0-test5 -- == Thomas Morin == Ingénieur Consultant Atlantide - www.ago.fr - thomas.morin(a)ago.fr == PGP Id:8CEA233D Key FP:503BF6CFD3AE8719377B832A02FB94E08CEA233D --

2 3

Still - "Assertion `i == nfds' failed."
by Dennis Skinner 30 Sep '03

30 Sep '03

Still looking for help with this. What other information can I provide? It has been running for a week inside a screen in debug mode, but I would really like to get it working properly. Still getting this error: syslog-ng: io.c:270: io_iter: Assertion `i == nfds' failed. syslog-ng version 1.6.0rc3 libol 0.3.10 RedHat 9 I only have 3 sources: internal and 2 udp sources (no /proc/kmsg or /dev/log). It runs fine for a short while and then dies with the above error. Sometimes it runs for a minute or so and sometimes for 15-20 mins without a problem before it dies (logging properly from the various servers while it runs). I had setup the local syslogd to pass its messages to syslog-ng via udp. I stopped syslogd (and klogd) and getting same problem. Tried running both using chroot option and not, same thing. Seems to run forever in debug mode. I can see it does garbage collection every now and then. > So you have three sources and a single file destination? Or you also log to > remote hosts uding TCP or UDP? No, I have 2 destinations....other servers are sending logs here. source s_local { internal(); }; source s_int1_udp { udp(ip("10.0.1.123") port(514)); }; source s_int2_udp { udp(ip("192.168.1.123") port(514)); }; destination d_sort_program_host { file("/export/syslog-ng/var/log/$HOST/$PROGRAM.$MONTH$DAY$YEAR" group("logs") perm(0640) create_dirs(yes) dir_perm(0750) ); }; destination d_sort_host { file("/export/syslog-ng/var/log/$HOST/$MONTH$DAY$YEAR" group("logs") perm(0640) create_dirs(yes) dir_perm(0750) ); }; log { source(s_local); source(s_int1_udp); destination(d_sort_program_host); }; log { source(s_int2_udp); destination(d_sort_host); }; -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

2 1

Can I run multiple Syslog-ng instances on different ports?
by Wayne Sweatt 29 Sep '03

29 Sep '03

I was interested in running 2-3 instances of Syslog-ng on a single system, with a single interface. I would use different port numbers for each, of course. The reason was to separate logs from different client OS types. We have a different team that supports Mac OS X, for example, and would like to keep a separate directory tree of logs for those systems. The syslog-ng.conf file would be pushed out to the different *NIX Oses with Cfengine, and then Syslog-ng could keep the logs separate and then could be parsed those logs with my scripts and email the appropriate admins. Is the running 2-3 concurrent instances ok? Wayne Sweatt Sr. UNIX System Administrator Comforce Technical Services LANL SCC Team

2 1

Destination program: Syslog-ng stops writing to program
by K Resar 29 Sep '03

29 Sep '03

I've setup syslog-ng to output its messages to a destination program. However, when the server gets heavily loaded [1] either syslog-ng stops writing messages to the program's STDIN or the program stops reading these messages. Has anyone else experienced this behavior? If this appears to be a known problem that cannot be resolved, a solution for me would be to output all messages received with some sort of a destination file driver, but keeping the PRI portion of the syslog message intact. Does this functionality currently exist? Keith. 1: Or perhaps just for the fun of it too -- this has happened at times when I would not expect the log server to be getting too many messages. --

1 0

RE: [syslog-ng]permissions being changed for certain devices
by Clemson, Chris 29 Sep '03

29 Sep '03

> > everytime i restart syslog-ng i have to chmod the /dev/null > file or squid > > goes nuts and spawns off loads of its own processes, which > eventually hangs > > the machine. > > > > all 3 files are referenced in /etc/syslog-ng.conf as destinations. > > if syslog-ng has access to the files (i chmod /dev/null to > 666), why should > > it change the permissions to block other programs? > > > > i am running this on SuSE 8.0. > > use perm(-1) for those files. ah, thank you! however, http://www.balabit.com/products/syslog_ng/reference/x354.html doesn't actually explain how to use them. for example, if i had a line: destination null { file("/dev/null"); }; where would i put the perm(-1) option? wherever i stick it, it seems to complain! thanks! chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

permissions being changed for certain devices
by Clemson, Chris 29 Sep '03

29 Sep '03

ever since i upgraded to syslog-ng 1.6.0rc3 from 1.4.14, when syslog-ng is restarted something wierd happens. I get 3 error messages: Sep 29 11:56:47 proxy syslog-ng[1614]: Changing permissions on special file /dev/xconsole Sep 29 11:56:47 proxy syslog-ng[1614]: Changing permissions on special file /dev/tty10 Sep 29 11:56:47 proxy syslog-ng[1614]: Changing permissions on special file /dev/null in particular, it changes /dev/null to rw access for root only. q1: why does it do this? and q2: how to i stop it? everytime i restart syslog-ng i have to chmod the /dev/null file or squid goes nuts and spawns off loads of its own processes, which eventually hangs the machine. all 3 files are referenced in /etc/syslog-ng.conf as destinations. if syslog-ng has access to the files (i chmod /dev/null to 666), why should it change the permissions to block other programs? i am running this on SuSE 8.0. thank you! chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

2 1

recall issue on coosbay server
by Wang, Zhenyu Z 27 Sep '03

27 Sep '03

Hi, I've asked the question about some strange result when running syslog-ng-1.6.0rc3 on coosbay server. Syslog-ng couldn't create log files, but generate wild files in current work directory. --sample config file- # Simple syslog-ng.conf file. options {use_fqdn(no);sync(0);}; source s_sys { unix-stream("/dev/log"); internal(); }; destination d_security { file("/usr/local/var/log/security" create_dirs(yes)); }; destination d_messages { file("/usr/local/var/log/messages" create_dirs(yes)); }; destination d_console { usertty("root"); }; filter f_authpriv { facility(auth, authpriv); }; filter f_messages { level(info .. emerg) and not facility(auth, authpriv); }; filter f_emergency { level(emerg); }; log { source(s_sys); filter(f_authpriv); destination(d_security); }; log { source(s_sys); filter(f_messages); destination(d_messages); }; log { source(s_sys); filter(f_emergency); destination(d_console); }; --end- [root@power sbin]#./syslog-ng [root@power sbin]# ls ? stunnel syslog-ng ... [root@power sbin]# cat ? Sep 27 13:53:56 s_sys@power syslog-ng[28098]: syslog-ng version 1.6.0rc3 starting Sep 27 13:53:56 s_sys@power syslog-ng[28098]: syslog-ng version 1.6.0rc3 starting Any idea on why this file is created but normal log files fail to be exist? Thanks zhen

1 0