September 2003 - syslog-ng - lists.balabit.hu

UDP Template
by Gianpiero Porchia 26 Sep '03

26 Sep '03

Hi, I would like to do log relaying, using syslog-ng. But I need to change the log format. The problem is that the "template" directive is not available for the udp destination (even for the tcp destination). Could you suggest me some work around to do that? Thanks in advance. - gian P.S I've thought on a work around, but it doesn't work fine. Hence the "template" directive is available for the pipes, I've used a pipe destination to send the logs. Then, I'm using the same pipe, as source, and I'm relaying the logs from it, to another log server. But syslog-ng thinks that the logs are coming from the server, and I get the following (ie, it uses the standard log format, after the pipe): Message Before the pipe -------------------- [X.Y.Z.K] ufs: [ID 213553 kern.notice] NOTICE: realloccg /u00: file system full Message After the pipe --------------------- Sep 25 18:12:11 Figth_cluB_01 [X.Y.Z.K] ufs: [ID 213553 kern.notice] NOTICE: realloccg /u00: file system full I'm using this configuration: # CONF ############################################# source s_net { udp(); }; source s_pipe_per_NI { pipe(/var/chroot/syslog-ng/dev/pipe_per_NI); }; destination relay_to_NI { udp("A.B.C.D" ); }; destination d_pipe_per_NI { pipe("/dev/pipe_per_NI" template("[$HOST] $MSG\n") ); }; log { source(s_net); destination(d_pipe_per_NI); # Here, I can apply the template }; log { source(s_pipe_per_NI); destination(relay_to_NI); # Here, syslog-ng applies the standard log format :( }; # END CONF ############################################# _____ Ing. Gianpiero Porchia Security Engineer ATS - Advanced Telecom Systems Designing, Testing, Managing Network Quality Via Salgari, 17 - 41100 Modena - ITALY Tel +39 059 821332 Fax +39 059 821492 Cel +39 335 330413 E-mail: gianpiero.porchia(a)atsweb.it messenger.msn.com: http://messenger.msn.com/, gianpiero.porchia(a)atsweb.it Web site: http://www.atsweb.it PGP Key ID: 0xCAE064A4 (pgpkeys.mit.edu:11371) Fingerprint: 080D AD88 C18A FCA3 91BC 0DF2 F05F 7489 CAE0 64A4

2 1

help: syslog-ng config to consolidate logs
by Daniel Flick 26 Sep '03

26 Sep '03

Based on several net searches, I am running the following syslog-ng config in an attempt to consolidate Cisco PIX logs (23 of them) to a RH 9 server. Syslog-ng appears to be working and is in the running process list. I am very new to syslog-ng so I have no idea how to check into this in more detail. Is there a service log file or configuration validator? I have read the docs but I seem to be missing something that will help to piece this all together. I was expecting the following results: Syslog-ng to listen on UDP 514 for syslog messages. Incoming messages get filtered on host IP and a new directory is created for each host with a filename consisting of the month and day followed by pix.log. I previously had all my PIX firewalls logging to local 7 on HPUX using syslog without a problem (albeit to the same file). I have made no changes to the pix save the change in IP address to the new server. I have turned off RH 9's syslog service and am still getting logs from the server so I believe that syslog-ng is working but no directories are created for the firewalls. I have verified that the server is listening on UDP 514 and no firewall is currently being run on the server. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source net { udp(); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination d_csco { file("/var/log/$HOST/$MONTH.$DAY.pix.log"); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(net); filter(f_filter7); destination(d_csco); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; Thanks for any help you may provide. Also, is there a search-able list archive out there? I downloaded 14MB html file but it was much less than useful. Thanks, Daniel Flick DFMCO dflick(a)dfmco.com

1 0

Omot STATS dropped 0
by Florian Lindner 25 Sep '03

25 Sep '03

Hello, can I omit these messages somehow? I think they are useful if there are any drops, but there are always 0. Sep 25 21:50:47 s_sys@bastet syslog-ng[420]: STATS: dropped 0 Thx, Florian

1 0

Central log server rotate problem
by Tobias 25 Sep '03

25 Sep '03

I'm trying to set up a central logserver with syslog-ng, and so far that is working great. Next thing to do is to rotate the log-files using newsyslog. This is where i run into problems. The syslog-ng.conf is in a sense "general", since a good filtering configuration on the server can be used for several machines. New machines can start logging remotely without changing the log server configuration. The problem is that the newsyslog.conf requires configurations of the following type: /var/log/pflog 600 3 250 * ZB /var/run/pflogd.pid My log files reside in directories like these: drwxrwx--- 2 root wheel 512 Sep 25 14:18 guardian drwxrwx--- 2 root wheel 512 Sep 25 13:00 logger where the directories are named after the hosts. The guardian directory looks like: -rw-rw---- 1 root wheel 479 Sep 25 14:00 cron.log -rw-rw---- 1 root wheel 3359 Sep 25 14:18 daemon.log -rw-rw---- 1 root wheel 851 Sep 25 14:12 messages -rw-rw---- 1 root wheel 1776 Sep 25 13:40 pflog.log -rw-rw---- 1 root wheel 187 Sep 25 14:18 secure.log How do you tell newsyslog that all files should be rotated without specifying the directorynames? Do you use a script of some kind or what? According to the documentation a filename must be entered on each row in the newsyslog.conf. Thanks in advance Tobias Persson

1 0

syslog-ng vs. msyslog
by Christoph.Eckart＠COMPUTACENTER.COM 25 Sep '03

25 Sep '03

Hello everybody, I am currently working on setting up a centralized monitoring server.I have been testing syslog-ng and msyslog simultaneously on two servers. I am unable to see much of a difference between their capabilities.Is their some advantage which syslog-ng has over the other available syslog versions? I am sure the experience of other users on the forum can help me decide better. Thanks Christoph Eckart

1 0

sending snmptraps w/ snmptrap
by MGruber＠metzler.com 23 Sep '03

23 Sep '03

Hi! I am trying to send an snmptrap if a critical or error-Message occures. I found some scripts in the net which told me to use destination traps {program("/usr/local/sbin/sendtrap.sh"); }; with following script #!/bin/sh while read line; do snmptrap .... done It has the problem that I can not manipulate the snmptrap statement, I tried further: destination d_send_trap { pipe("/tmp/snmptrap.pipe" template("snmptrap ..... '$HOST' '$FACILITY' '$PRIORITY' ... '$MSG'\n") template-escape(yes)); now I have the trouble how I get the statement from the pipe into execution. Does anyone have something in this kind working ? Thanks in advance Matthias Gruber ------------------------------------------------------------------------------------ Dipl.-Inform. Matthias Gruber MCNE(mult.), MCSE, CIP, IT-Project+ Bankhaus B. Metzler seel. Sohn & Co. KGaA ++ Informationssysteme/Systemtechnik ++ Tel.: +49 69 2104 4330 Fax: +49 69 2104 4040 Große Gallusstr. 18 60311 Frankfurt MGruber(a)Metzler.com

2 1

Annie Chaiyakul/it/idecpharm/US is out of the office.
by Annie Chaiyakul 23 Sep '03

23 Sep '03

I will be out of the office starting 09/22/2003 and will not return until 09/26/2003. I will out of office until 09/26/03. For immediate issues, please contact the IT help desk and for urgent UNIX specific needs, please contact Emily Yau. Thank you.

1 0

Dropping UDP logs - need ideas
by Wayne Sweatt 22 Sep '03

22 Sep '03

OK. I figured it out: Im stupid. The Kiwi SyslogGen was set for random on the priority, and I was not logging .debug level logging. (info..emerg) So, as far I've experienced, Solaris * only really needs to have the udp receive high water mark raised to 64k: ndd -set /dev/udp udp_recv_hiwat 65536 All is well. -Wayne

1 0

Dropping UDP logs - need ideas
by Wayne Sweatt 22 Sep '03

22 Sep '03

Syslog-ng'ers, I have a Solaris 8 Syslog-ng logger in production which runs and tests out fine. Now, I've built another Sparc/Solaris 8 system on an Ultra 10 and I am dropping UDP logs at about a 5-15% rate. I am testing just as before with Kiwi's Syslog generator. When I send a burst of 100 logs, I see the loss of logs. I had this problem with the first server, but I simply maxed out the udp_recv_hiwat to 65536, and all was well, even with 500 log bursts. This new server has been configured the same way. The only difference is the hardware. I even tried the previous version of Syslog-ng used - no help. Here's what I have: Latest Syslog-ng, compiled with sun-door, and tcp-wrappers 400Mhz UltraSparcII CPU 500M memory 2 x 72G SCSI drives (10k rpm) 10/100M ether interface running at 100fdx Here's the sad part: I tested with the old syslogd, and it logged only 73% of the UDP logs. (Had one entry, plus a "repeated 72 times" line) So it looks like a system problem, just not sure where it is. I tried upping the sync(), and it didn't seem to help either. I have the /var partition on it's own 10K SCSI drive, so I doubt it's a disk I/O issue - iostat looks ok too. I tries turning the use_dns() on/off too. It doesn't even log with it off, I guess because I have the dns_cache on which must conflict.(?) I have plenty of memory and swap. Actually I've ge the system JASS'ed out, so I'm not running much of anything process-wise, except Syslog-ng. Any debugging suggestions? Oh, yeah. I've upped the log_fifo_size, and - no help. Using TCP is not option now, so that won't be a solution for me. Help! While I wait for replies, I'll think I'll count bytes seen on the interface by netstat... or snoop... Thanks gang. Wayne Sweatt Sr. UNIX System Administrator Comforce Technical Services LANL SCC Team

2 1

Information Request - GLPed
by Rui Teixeira 22 Sep '03

22 Sep '03

It appears that Syslog-ng is really what i'm looking for. With Syslog-ng i do not need to change the code of the services (pop3, ssh, etc) so that they can generate to the syslog facility the log in XML format. If i can make a template in Syslog-ng, my work is simplified and inforced in quality. My question now is in the GPLed licensing. For what i know this kind of licensing makes me possible to change the code (even if i don't need) and distribute it freely (even if my intentions are only to make an academic work). For this i only need to state that the code was changed and offer no warraty, right??. So the bottom line is that i can use freely the code of Syslog-ng to the academic work? (and it appears that i only need to make the template). (i have no ideas at least for now to make the final program commercial) Thanks again for your help RR >You would not need to modify the source, as you can use a template to >format the log messages in xml or in any other syntax (sql, html, ...) >However, if you look at the source, you can see that it is GPLed. > >Rui Teixeira wrote: >> This is just a quick example of the possibilities of crossing the >> information in a quick and easy way. >> >> The main reason for me to write to this list is my interest in using >> Syslog-ng to generate (if possible) my XML format and to send the data >> to a secure machine where the infrormation will be kept. >> >> My biggest questions are: >> - can i change the syslog-ng code >> to a academic work >> - does the team behind syslog-ng >> intend to make a simmilar system in a near future >> - and if is it viable to use >> Syslog-ng to write my XML standard and send it to a secure machine >> >> Thanks in advance >> >> Rui Teixeira

2 1