October 2004 - syslog-ng - lists.balabit.hu

FW: Filtering host IP addresses
by Chris Vaughan 15 Oct '04

15 Oct '04

I figured this out, creating an extra filter for these hosts, using boolean expressions and variables. -----Original Message----- From: Chris Vaughan Sent: Friday, 15 October 2004 3:15 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: Filtering host IP addresses Greetings, I have recently set up syslog-ng on a host to record logs from the cisco switches deployed around the office I work in. I have set the switches to be filtered by IP address, which has created a problem. One pod of switches in a low numbered vlan has management addresses, 10.x.xxx.11 to 14. I have found that the log files for these switches are being tainted by logs from switches with addresses ending with such octets as 121, in the log for switch 10.x.xxx.12 or 143 in the log for switch 10.x.xxx.14. How do I stop events from the switches with the three digit end octets entering data into the logs for these four switches, .11 to .14? *************************************************************** This message is intended for the addressee named and may contain confidential information. If you are not the intended recipient, please delete it and notify the sender. Views expressed in this message are those of the individual sender, and are not necessarily the views of the Department of Lands. This email message has been swept by MIMEsweeper for the presence of computer viruses. ***************************************************************

1 0

Filtering host IP addresses
by Chris Vaughan 15 Oct '04

15 Oct '04

Greetings, I have recently set up syslog-ng on a host to record logs from the cisco switches deployed around the office I work in. I have set the switches to be filtered by IP address, which has created a problem. One pod of switches in a low numbered vlan has management addresses, 10.x.xxx.11 to 14. I have found that the log files for these switches are being tainted by logs from switches with addresses ending with such octets as 121, in the log for switch 10.x.xxx.12 or 143 in the log for switch 10.x.xxx.14. How do I stop events from the switches with the three digit end octets entering data into the logs for these four switches, .11 to .14? *************************************************************** This message is intended for the addressee named and may contain confidential information. If you are not the intended recipient, please delete it and notify the sender. Views expressed in this message are those of the individual sender, and are not necessarily the views of the Department of Lands. This email message has been swept by MIMEsweeper for the presence of computer viruses. ***************************************************************

1 0

Snort and Syslog-ng
by Walt Rich 14 Oct '04

14 Oct '04

I need to create a source for snort using syslog-ng. I'm trying to get all snort alerts logged to one specific file, and only want to see the snort alerts and not any others. Any assistance is appreciated. Thanks! ________________________________ | Walt Rich | Sr. Network Engineer | Parago, Inc. | 972.538.7253 | walt.rich(a)parago.com |

1 0

syslog-ng problem
by Pavel Urban 14 Oct '04

14 Oct '04

Hello, we are having a problem with syslog-ng ver. 1.6.2. On one RedHat Linux ES 3, I've seen that it sends SYN, receives ACK and immediately sends RST. Anybody seen this behaviour? 20:26:34.610520 192.168.30.28.5140 > 192.168.30.162.5140: S 1768598228:1768598228(0) win 5840 <mss 1460,sackOK,timestamp 885631 0,nop,wscale 0> (DF) 20:26:34.610660 192.168.30.162.5140 > 192.168.30.28.5140: . ack 1 win 62928 <nop,nop,timestamp 1022214670 497333> (DF) 20:26:34.610711 192.168.30.28.5140 > 192.168.30.162.5140: R 611445588:611445588(0) win 0 (DF) 20:27:22.610006 192.168.30.28.5140 > 192.168.30.162.5140: S 1768598228:1768598228(0) win 5840 <mss 1460,sackOK,timestamp 890431 0,nop,wscale 0> (DF) 20:27:22.610152 192.168.30.162.5140 > 192.168.30.28.5140: . ack 1 win 62928 <nop,nop,timestamp 1022239252 497333> (DF) 20:27:22.610195 192.168.30.28.5140 > 192.168.30.162.5140: R 611445588:611445588(0) win 0 (DF) When I try eg telnet, it works just fine. 20:30:56.617785 192.168.30.28.32908 > 192.168.30.162.5140: S 2089428237:2089428237(0) win 5840 <mss 1460,sackOK,timestamp 911833 0,nop,wscale 0> (DF) [tos 0x10] 20:30:56.617995 192.168.30.162.5140 > 192.168.30.28.32908: S 1997864569:1997864569(0) ack 2089428238 win 5792 <mss 1380,sackOK,timestamp 1022348859 911833,nop,wscale 0> (DF) 20:30:56.618051 192.168.30.28.32908 > 192.168.30.162.5140: . ack 1 win 5840 <nop,nop,timestamp 911833 1022348859> (DF) [tos 0x10] 20:31:01.079466 192.168.30.28.32908 > 192.168.30.162.5140: F 1:1(0) ack 1 win 5840 <nop,nop,timestamp 912279 1022348859> (DF) [tos 0x10] 20:31:01.079677 192.168.30.162.5140 > 192.168.30.28.32908: F 1:1(0) ack 2 win 5792 <nop,nop,timestamp 1022351145 912279> (DF) 20:31:01.079717 192.168.30.28.32908 > 192.168.30.162.5140: . ack 2 win 5840 <nop,nop,timestamp 912279 1022351145> (DF) [tos 0x10] -- *********************************************************************** Pavel Urban (pavel.urban(a)imaginet.cz) IOL system disaster Internet OnLine, owned by Cesky Telecom, a.s. (www.ct.cz) *********************************************************************** Vegetables should not operate electronic equipment. Computer Stupidities, http://rinkworks.com/stupid/ ***********************************************************************

1 2

Re: Problem with syslog-ng and door
by jesse.keefe＠convergys.com 14 Oct '04

14 Oct '04

Actually, We've found out that part of the problem involves our console server solution. When an etherlite hangs, it causes the console with syslog-ng to hang. If we clear the port on the etherlite, the problem resolves. The native syslogd doesn't have this problem. Any thoughts? Jesse Keefe Sr Analyst, Open Systems Convergys Corp 513-723-3689

2 1

line end
by Thomas Richter 14 Oct '04

14 Oct '04

Hi, syslog-ng seem to have a problem to log lines ending with 0x0d ^M \n isdnlog makes his entries this way. The result was very strange lines ... wkr Thomas Richter -- dss1://49.431.801306 Wot're we going to do tonight, Brain ? gsm://49.179.5192431 The same thing we do every night, Pinky . icq://124849926 Try to TAKE OVER THE WORLD ! mailto:richter@thomas-richter.de http://www.thomas-richter.de

2 5

patch: add socket(SO_RCVBUF) option
by Dmitry Karasik 14 Oct '04

14 Oct '04

Hello, I'm playing with syslog-ng under high IO loads, and while doing so I found that increasing UDP receive buffer helps ( not surprisingly though ) a lot. Here, I have a feature request, to add such an option to the config file. Below I included a patch that adds such an option to the set of udp() command sub-options. While I realize that this function is very much useful also outside of udp, I though that to complement the setsockopt setup() properly I have also to add support for SO_SNDBUF, and support not only for source() but also for destination() drivers, etc etc, and this would clearly make an overkill patch. Probably you can think of something more elegant. -- Sincerely, Dmitry Karasik --- catpipe Systems ApS *BSD solutions, consulting, development www.catpipe.net +45 7021 0050 diff -ruN syslog-ng-1.6.5/src/afinet.c syslog-ng-1.6.5.patched/src/afinet.c --- syslog-ng-1.6.5/src/afinet.c Thu Aug 5 13:35:12 2004 +++ syslog-ng-1.6.5.patched/src/afinet.c Tue Oct 12 13:37:49 2004 @@ -221,6 +221,13 @@ l->flags = set_flags(l->flags, AFINET_TCP_KEEPALIVE_MASK, AFINET_TCP_KEEPALIVE_SHIFT, v); } +void afinet_src_set_so_rcvbuf(struct log_source_driver *c, UINT32 v) +{ + CAST_SUBTYPE(afsocket_source, l, c); + + l->so_rcvbuf = v; +} + static int do_open_afinet_connection(struct afsocket_source *c, struct io_fd *client, @@ -333,6 +340,13 @@ struct io_fd *client = make_io_fd(cfg->backend, fd, NULL); int res; + if ( self-> super.so_rcvbuf > 0) { + if ( setsockopt( client-> super.fd, SOL_SOCKET, SO_RCVBUF, &self-> super.so_rcvbuf, sizeof(self-> super.so_rcvbuf)) < 0) { + notice("Error setsockopt(SO_RCVBUF,%i):%s\n", self-> super.so_rcvbuf, strerror(errno)); + return ST_FAIL | ST_QUIT; + } + } + self->super.num_connections = 1; conn = make_afinet_source_connection(client, NULL, &self->super, self->super.super.super.next); res = LOG_HANDLER_INIT(conn, cfg, NULL); @@ -391,6 +405,7 @@ self->super.flags = flags; self->super.connections = make_object_queue(); self->super.max_connections = 10; + self->super.so_rcvbuf = 0; return &self->super.super; } diff -ruN syslog-ng-1.6.5/src/afsocket.h syslog-ng-1.6.5.patched/src/afsocket.h --- syslog-ng-1.6.5/src/afsocket.h Thu May 6 10:57:52 2004 +++ syslog-ng-1.6.5.patched/src/afsocket.h Tue Oct 12 13:21:09 2004 @@ -90,6 +90,7 @@ (super log_source_driver) (vars (flags simple UINT32) + (so_rcvbuf simple UINT32) (bind_addr object address_info) (max_connections simple UINT32) (num_connections simple UINT32) @@ -135,6 +136,7 @@ void afinet_src_set_mac(struct log_source_driver *c, UINT32 v); void afinet_src_set_encrypt(struct log_source_driver *c, UINT32 v); void afinet_src_set_tcp_keepalive(struct log_source_driver *c, UINT32 v); +void afinet_src_set_so_rcvbuf(struct log_source_driver *c, UINT32 value); void afinet_dest_set_localip(struct log_dest_driver *c, const char *ip); void afinet_dest_set_localport(struct log_dest_driver *c, UINT32 port, const char *service,const char *proto); diff -ruN syslog-ng-1.6.5/src/afsocket.h.x syslog-ng-1.6.5.patched/src/afsocket.h.x --- syslog-ng-1.6.5/src/afsocket.h.x Thu May 6 11:02:39 2004 +++ syslog-ng-1.6.5.patched/src/afsocket.h.x Tue Oct 12 13:32:00 2004 @@ -37,6 +37,7 @@ struct address_info *bind_addr; UINT32 max_connections; UINT32 num_connections; + int so_rcvbuf; struct object_queue *connections; int (*(open_connection))(struct afsocket_source *self, struct io_fd *, struct address_info *a); }; diff -ruN syslog-ng-1.6.5/src/cfg-grammar.y syslog-ng-1.6.5.patched/src/cfg-grammar.y --- syslog-ng-1.6.5/src/cfg-grammar.y Thu May 6 10:57:52 2004 +++ syslog-ng-1.6.5.patched/src/cfg-grammar.y Tue Oct 12 13:17:10 2004 @@ -82,7 +82,7 @@ %token KW_GC_IDLE_THRESHOLD KW_CREATE_DIRS KW_SANITIZE_FILENAMES %token KW_DIR_OWNER KW_DIR_GROUP KW_DIR_PERM KW_TEMPLATE KW_TEMPLATE_ESCAPE %token KW_OWNER KW_GROUP KW_PERM KW_KEEP_ALIVE KW_TCP_KEEP_ALIVE KW_MAX_CONNECTIONS -%token KW_LOCALIP KW_IP KW_LOCALPORT KW_PORT KW_DESTPORT +%token KW_LOCALIP KW_IP KW_LOCALPORT KW_PORT KW_DESTPORT KW_SO_RCVBUF %token KW_COMPRESS KW_MAC KW_AUTH KW_ENCRYPT %token KW_DNS_CACHE KW_DNS_CACHE_SIZE %token KW_DNS_CACHE_EXPIRE KW_DNS_CACHE_EXPIRE_FAILED @@ -299,6 +299,7 @@ : source_afinet_option | KW_LOCALPORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3 ,"udp"); free($3); } | KW_PORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "udp"); free($3); } + | KW_SO_RCVBUF '(' NUMBER ')' { afinet_src_set_so_rcvbuf( last_source_driver, $3); } ; source_afinet_option diff -ruN syslog-ng-1.6.5/src/cfg-lex.l syslog-ng-1.6.5.patched/src/cfg-lex.l --- syslog-ng-1.6.5/src/cfg-lex.l Thu Aug 5 13:35:12 2004 +++ syslog-ng-1.6.5.patched/src/cfg-lex.l Tue Oct 12 13:23:32 2004 @@ -108,6 +108,7 @@ { "pad_size", KW_PAD_SIZE }, { "spoof_source", KW_SPOOF_SOURCE }, { "spoof-source", KW_SPOOF_SOURCE }, + { "so_rcvbuf", KW_SO_RCVBUF }, /* source or destination items */ { "file", KW_FILE },

2 1

RE: [syslog-ng]how to pull M$ eventlogger events to syslog-ng server ?
by Hall J D (ISeLS) 14 Oct '04

14 Oct '04

> From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Phani Achanta > Sent: 14 October 2004 07:47 > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]how to pull M$ eventlogger events to > syslog-ng server ? > > Hi all, > > I have been looking for a non-commercial tool/utility that can > acts like a bridge between Windows NT event logger and syslog-ng > deamon. i.e is there a way to make all the windows servers to log the > events to a unix/linux syslog server > deamon. > > I have googled enough but disappointed to find that there are > only some commercial s/w which have to be installed on the windowz > boxes which will log > them to unix servers but all of these are commercial products. Am i > missing anything from the open source world. > Take a look at http://sourceforge.net/projects/ntsyslog/ we use it on our windows boxes to log to syslog-ng. Works great. Jonathan > --Venkata Achanta

3 2

how to pull M$ eventlogger events to syslog-ng server ?
by Phani Achanta 14 Oct '04

14 Oct '04

Hi all, I have been looking for a non-commercial tool/utility that can acts like a bridge between Windows NT event logger and syslog-ng deamon. i.e is there a way to make all the windows servers to log the events to a unix/linux syslog server deamon. I have googled enough but disappointed to find that there are only some commercial s/w which have to be installed on the windowz boxes which will log them to unix servers but all of these are commercial products. Am i missing anything from the open source world. I want to ask you all if there is any freeware tool that can do this with out having to do much changes to the windows machine (i.e installing lot of other s/w ) I dont want to reinvent the wheel,so please let me know if you are aware of any tool that does this. if there is nothing else, i am planning to do this 1)use win32::EventLog from CPAN and write a perl deamon that watches for new events and 2) pushes them to a mysql DB on *nix server / converted into the syslog-ng format and logged by the syslog-ng server I want some input/suggestions on this if there is no freeware available. I am also looking for collbarators for making this contribution to the open source happen ASAP. I know windows event logger is not built/designed the way syslog is designed. but i think this would be a invaluable gift to sys admins and network admins who are maintaining heterogenous OSs in their facility Feel free to correct me if i am missing somethings here. Thanks in advance for all the future informative replies i will be getting for this e-mail, --Venkata Achanta

1 0

Syslog-ng conf file
by Sp0ng3b0b 13 Oct '04

13 Oct '04

Can someone post their syslog-ng.conf file? I just got it installed and need a little help with the conf file. I would like to see some examples. I will be logging from network devices (cisco), sun and linux servers, snort, and other devices. Thanks.

2 1