October 2004 - syslog-ng - lists.balabit.hu

FAQ-seeding: chroot jail procedure for Syslog-ng
by Michael D. (Mick) Bauer 24 Jan '05

24 Jan '05

Hi, all. In researching/writing the Syslog-ng coverage for the new edition of my book, I've encountered a total lack of published info, anywhere, on how to create a Syslog-ng chroot jail. So in the interests of seeding the FAQ (or at least Google), here's a procedure that works for me. Naturally, anyone should feel free to correct anything I've gotten wrong! Any and all feedback is appreciated. ************************************************ How To Create A Chroot Jail For Syslog-ng 1.6x ************************************************ 1. su to root if you're not root already 2. Create an unprivileged group-account for syslog-ng, e.g., by adding the following line to /etc/group: syslogng:x:77: 3. Create an unprivileged system account for syslog-ng, e.g., via the following command: useradd -d /var/syslog-ng-jail -g syslogng -r syslogng (Note that in Linux, the "-r" flag tells useradd that this will be a system account, causing useradd to automatically set the account's shell to /bin/false and to choose an appropriately low value for its UID.) 4. Create the jail: mkdir -p /var/syslog-ng-jail/var/log (Our actual changed root will be /var/syslog-ng-jail, but we may as well create the var/log subdirectory at the same time) 5. At this point the whole jail should be owned by root:root, which is cool so long as the changed-root-directory itself (/var/syslog-ng-jail) is "other-executable," e.g., rwxr-xr-x. But syslog-ng *will* need to create/write files in the jail's var/log subdirectory, so we need to tweak the latter's group-ownership and -permissions, like so: chgrp syslogng /var/syslog-ng-jail/var/log chmod g+wx /var/syslog-ng-jail/var/log 6. That's it! We may now start syslog-ng like this: syslog-ng -C /var/syslog-ng-jail -u syslogng -g syslogng The syslog-ng process will still read its config from /etc/syslog-ng/syslog-ng.conf (not /var/syslog-ng-jail/etc/...), but immediately after that it will chroot itself to the specified jail. Note, however, that the paths you specify in syslog-ng.conf "file()" statements should all be relative to the changed root. E.g., use file("/var/log/messages"), *not* file("/var/syslog-ng-jail/var/log/messages"). Any path you specify in syslog-ng.conf will end up with "/var/syslog-ng-jail" prepended to it. Naturally, there's nothing to stop you from dropping the "var/log/" subdirectory altogether, and simply specify, e.g., file("/messages") as a destination (resulting in things being written to /var/syslog-ng-jail/messages, a less unwieldy path). ******* So far I haven't noticed that anything else needs to be added to the chroot jail (e.g., stuff from /dev or /etc), but if anyone knows differently please speak up! Regards, Mick P.S. Baszi, you really ought to add "-u" & "-g" to the syslog-ng manpage. After all, running anything in a chroot jail as root is futile, no? :-) P.P.S. BTW, 1.6x rocks! /-------------------------------------------------\ | Michael D. (Mick) Bauer | | Security Editor, Linux Journal | | Dir. of Value-Subtracted Svcs., Wiremonkeys.org | \-------------------------------------------------/

6 12

What facility do the 'STATS' messages come in on?
by Ben Nelson 18 Jan '05

18 Jan '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am able to see my internal() STATS messages only by sending all messages (unfiltered) to a single file. I'm not sure which of my filters may be dropping them. So, which syslog facility do those messages happen under? Thanks, - --Ben -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBY1Ld3cL8qXKvzcwRAg3eAJ0a/Vxz810kkCqXzizKTag9Yb05zACg1r/X rZpVs4HsMSAlO3Xygs80JYI= =PKRl -----END PGP SIGNATURE-----

4 3

Problems with Netscreen log entries
by Paul Mindeman 06 Jan '05

06 Jan '05

Running sylog-ng 1.6.4 on Solaris 9 Log entries from my UNIX devices log fine. Log entries from my Netscreen devices seem to be missing the end of line terminator, as the entries run together in the log file. The default syslog daemon was able to handle these entries fine. Any ideas on how to fix this? The options in the syslog-ng.conf file are: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; Thanks -- Paul Mindeman BTInet Systems Administrator 701-355-5587 mindeman(a)btinet.net

3 2

installing syslog-ng
by Majumdar, Anamitra 30 Oct '04

30 Oct '04

Hello, I am trying to install syslog-ng on a Solaris 8 box. I am able to configure Libol and syslog-ng. When I am trying to run make I am receiving the following error for syslog-ng $ make Making all in src make all-recursive Making all in . source='main.c' object='main.o' libtool=no \ depfile='.deps/main.Po' tmpdepfile='.deps/main.TPo' \ depmode=none /bin/bash /export/home/amajumda/syslog-ng-1.6.5/depcomp \ cc -DHAVE_CONFIG_H -I. -I/export/home/amajumda/syslog-ng-1.6.5/src -I. -g -Wall -I/export/home/amajumda/libol-0.3.14/src -D_GNU_SOURCE -c `test -f 'main.c' || echo '/export/home/amajumda/syslog-ng-1.6.5/src/'`main.c cc: illegal option -Wall *** Error code 1 make: Fatal error: Command failed for target `main.o' Current working directory /export/home/amajumda/syslog-ng-1.6.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /export/home/amajumda/syslog-ng-1.6.5/src *** Error code 1 make: Fatal error: Command failed for target `all' Current working directory /export/home/amajumda/syslog-ng-1.6.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' I am receiving a similar error while trying to install libol-0.3.14 $ make Making all in utils Making all in src make all-am source='format.c' object='format.lo' libtool=yes \ depfile='.deps/format.Plo' tmpdepfile='.deps/format.TPlo' \ depmode=none /bin/bash /export/home/amajumda/libol-0.3.14/depcomp \ /bin/bash ../libtool --mode=compile cc -DHAVE_CONFIG_H -I. -I/export/home/amajumda/libol-0.3.14/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -g -Wall -O2 -c -o format.lo `test -f 'format.c' || echo '/export/home/amajumda/libol-0.3.14/src/'`format.c cc -DHAVE_CONFIG_H -I. -I/export/home/amajumda/libol-0.3.14/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -g -Wall -O2 -c format.c -KPIC -DPIC -o .libs/format.o cc: illegal option -Wall *** Error code 1 make: Fatal error: Command failed for target `format.lo' Current working directory /export/home/amajumda/libol-0.3.14/src *** Error code 1 make: Fatal error: Command failed for target `all' Current working directory /export/home/amajumda/libol-0.3.14/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Can you help with a solution of overcoming this problem. Thanks Anamitra X4696

2 1

PIX 2 MySQL
by Cary, Kim 29 Oct '04

29 Oct '04

I just got logging going with syslog-ng in the last couple weeks (first client is our PIX 520). We can have up to 20Gb/day from our PIX. When compressed, the logs are up to 2Gb/day. We do want a record of all sessions for forensics & troubleshooting (already saved us hours of time) but the log format is quite verbose. Because of that verbosity, I was thinking of writing just key fields to a MySQL database as you suggest. However, I don't want to get into a situation where the only reporting is whatever report script I have time to write... If Joseph or someone else has a suggestion for fields to insert into the db and a reporting package to use, I'd appreciate it. Kim Cary InfraSec Admin Pepperdine University On Oct 29, 2004, at 5:43 AM, syslog-ng-request(a)lists.balabit.hu wrote: >> server. The central server is currently piping the information to a >> Mysql >> database. Each incoming device writes to its own table in the >> database. A >> modification to this we would like to accomplish is to key various >> pieces >> of information stored in the "message" field. >> >> For example, syslog messages sent from the mail servers will contain >> the >> sender, recipient, delivery status in the "message" field. Our >> thought is >> to key these pieces of information for quick lookup. Some of the >> systems >> (Cisco Pix) are sending up to 5G of information a day. Another reason >> to >> key the information.

3 2

Re:
by DTrammell 29 Oct '04

29 Oct '04

1 0

Re: Syslog-ng reply script for centralized syslog data
by LEROY ISAAC 29 Oct '04

29 Oct '04

Thanks a lot for both of your suggestions. It is an assumption that QOS will be on the network link, but this still doesn't account for a continually backed up host trying to send data. We are planning to utilize TCP as the transport. I figured TCP, QOS, and adjustments in the size of the log_fifo_size (num - The number of lines fitting to the output queue) might solve the issue. It is my understanding that the log_fifo_size, which does not have flow control, can be used to buffer data bound for destinations (either local disk or remote). I might be wrong in this understanding. I need the replay script to feed into the syslog data stream on the central syslog-ng server, since the central syslog-ng server feeds other applications. LeRoy

2 1

parsing the message field
by Joseph Deck 29 Oct '04

29 Oct '04

All, We have installed syslog-ng on our unix systems pointing them, some network devices, and some Windows systems events to a central syslog-ng server. The central server is currently piping the information to a Mysql database. Each incoming device writes to its own table in the database. A modification to this we would like to accomplish is to key various pieces of information stored in the "message" field. For example, syslog messages sent from the mail servers will contain the sender, recipient, delivery status in the "message" field. Our thought is to key these pieces of information for quick lookup. Some of the systems (Cisco Pix) are sending up to 5G of information a day. Another reason to key the information. Our current thought is to send the output of syslog-ng to a Perl script which will parse the message field based upon the source. The Perl script would then write it to the database. Is there a better approach? Any suggestions would be appreciated. Joseph G. Deck Director of Computing Services Wittenberg University Phone: (937) 525-3800 Fax: (937) 327-7372

2 1

Re: Syslog-ng reply script for centralized syslog data
by LEROY ISAAC 28 Oct '04

28 Oct '04

Thanks a lot for both of your suggestions. It is an assumption that QOS will be on the network link, but this still doesn't account for a continually backed up host trying to send data. We are planning to utilize TCP as the transport. I figured TCP, QOS, and adjustments in the size of the log_fifo_size (num - The number of lines fitting to the output queue) might solve the issue. It is my understanding that the log_fifo_size, which does not have flow control, can be used to buffer data bound for destinations (either local disk or remote). I might be wrong in this understanding. I need the replay script to feed into the syslog data stream on the central syslog-ng server, since the central syslog-ng server feeds other applications. LeRoy

1 0

Syslog-ng replay script for centralized syslog data
by LEROY ISAAC 28 Oct '04

28 Oct '04

I have a need to retrieve syslog data from various remote nodes, and the smallest network link to the remote nodes is 19K. The syslog traffic for the link cannot exceed 9K. I plan to setup a configuration which generates new log files every 10 minutes. These files are then compressed, zipped, and transfered to a centralized loghost. The files are then unzipped, uncompressed, and the data is inserted into the syslog-ng data stream on the central syslog-ng host. Is there a script or utility which will accomplish this task? If not, then does any one have any suggestions on products which may accomplish this same task. LeRoy Isaac --- DTrinh71(a)aol.com wrote: > OK. Thanks. > > So, what does Ray want? Suggestions? > > David >

3 6