December 2004 - syslog-ng - lists.balabit.hu

FAQ-seeding: chroot jail procedure for Syslog-ng
by Michael D. (Mick) Bauer 24 Jan '05

24 Jan '05

Hi, all. In researching/writing the Syslog-ng coverage for the new edition of my book, I've encountered a total lack of published info, anywhere, on how to create a Syslog-ng chroot jail. So in the interests of seeding the FAQ (or at least Google), here's a procedure that works for me. Naturally, anyone should feel free to correct anything I've gotten wrong! Any and all feedback is appreciated. ************************************************ How To Create A Chroot Jail For Syslog-ng 1.6x ************************************************ 1. su to root if you're not root already 2. Create an unprivileged group-account for syslog-ng, e.g., by adding the following line to /etc/group: syslogng:x:77: 3. Create an unprivileged system account for syslog-ng, e.g., via the following command: useradd -d /var/syslog-ng-jail -g syslogng -r syslogng (Note that in Linux, the "-r" flag tells useradd that this will be a system account, causing useradd to automatically set the account's shell to /bin/false and to choose an appropriately low value for its UID.) 4. Create the jail: mkdir -p /var/syslog-ng-jail/var/log (Our actual changed root will be /var/syslog-ng-jail, but we may as well create the var/log subdirectory at the same time) 5. At this point the whole jail should be owned by root:root, which is cool so long as the changed-root-directory itself (/var/syslog-ng-jail) is "other-executable," e.g., rwxr-xr-x. But syslog-ng *will* need to create/write files in the jail's var/log subdirectory, so we need to tweak the latter's group-ownership and -permissions, like so: chgrp syslogng /var/syslog-ng-jail/var/log chmod g+wx /var/syslog-ng-jail/var/log 6. That's it! We may now start syslog-ng like this: syslog-ng -C /var/syslog-ng-jail -u syslogng -g syslogng The syslog-ng process will still read its config from /etc/syslog-ng/syslog-ng.conf (not /var/syslog-ng-jail/etc/...), but immediately after that it will chroot itself to the specified jail. Note, however, that the paths you specify in syslog-ng.conf "file()" statements should all be relative to the changed root. E.g., use file("/var/log/messages"), *not* file("/var/syslog-ng-jail/var/log/messages"). Any path you specify in syslog-ng.conf will end up with "/var/syslog-ng-jail" prepended to it. Naturally, there's nothing to stop you from dropping the "var/log/" subdirectory altogether, and simply specify, e.g., file("/messages") as a destination (resulting in things being written to /var/syslog-ng-jail/messages, a less unwieldy path). ******* So far I haven't noticed that anything else needs to be added to the chroot jail (e.g., stuff from /dev or /etc), but if anyone knows differently please speak up! Regards, Mick P.S. Baszi, you really ought to add "-u" & "-g" to the syslog-ng manpage. After all, running anything in a chroot jail as root is futile, no? :-) P.P.S. BTW, 1.6x rocks! /-------------------------------------------------\ | Michael D. (Mick) Bauer | | Security Editor, Linux Journal | | Dir. of Value-Subtracted Svcs., Wiremonkeys.org | \-------------------------------------------------/

6 12

re-inserting syslog messages for testing
by Ed Ravin 18 Jan '05

18 Jan '05

I've written a perl script that takes as input a file with syslog messages in it, and re-sends them into syslog on the current host. I use this for test environments, especially when I'm testing things with logsurfer and have a known logfile that should generate certain results when parsed by logsurfer. Are there any other tools that do this? If not, I'll release mine after cleaning it up a bit, but there's no point in adding more cruft to the world if Someone Else has done a better job. -- Ed

2 2

What facility do the 'STATS' messages come in on?
by Ben Nelson 18 Jan '05

18 Jan '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am able to see my internal() STATS messages only by sending all messages (unfiltered) to a single file. I'm not sure which of my filters may be dropping them. So, which syslog facility do those messages happen under? Thanks, - --Ben -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBY1Ld3cL8qXKvzcwRAg3eAJ0a/Vxz810kkCqXzizKTag9Yb05zACg1r/X rZpVs4HsMSAlO3Xygs80JYI= =PKRl -----END PGP SIGNATURE-----

4 3

Problems with Netscreen log entries
by Paul Mindeman 06 Jan '05

06 Jan '05

Running sylog-ng 1.6.4 on Solaris 9 Log entries from my UNIX devices log fine. Log entries from my Netscreen devices seem to be missing the end of line terminator, as the entries run together in the log file. The default syslog daemon was able to handle these entries fine. Any ideas on how to fix this? The options in the syslog-ng.conf file are: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; Thanks -- Paul Mindeman BTInet Systems Administrator 701-355-5587 mindeman(a)btinet.net

3 2

syslog-ng stopped working yesterday
by Gorm J. Siiger 31 Dec '04

31 Dec '04

Hi, I have a wierd problem, yesterday around 14:00 CET syslog-ng just stops working. The daemon runs, but allmost nothing is writtes to the logs. I have used syslog-ng for some years now, and it never let me down. When running syslog-ng -dv the last things it tell me is: Objects alive: 203, garbage collected: 1 AF_INET client connected from 80.63.205.142, port 3630 io.c: Preparing fd 14 for reading And then it stops logging, but seeing with tcpdump that i receive tons of syslog, and even local logging with "logger" doesn't work. Installing a new syslog-ng on another machine does the same, which confuses me. Any good ideas ? -- Med venlig hilsen / Best regards Gorm J. Siiger - mail: gjs(a)sonnit.dk ------------------------------------ SonnIT, Sonnerupvej 83B, 4682 Tureby Tel. 70274777 - http://www.sonnit.dk

4 5

RE: [syslog-ng]Problem with TCP connection not timing out
by ARGEXT-HIDALGO, FRANCISCO 30 Dec '04

30 Dec '04

You´re right, I was confusing tcp-keep-alive option with keep-alive, since tcp-keep-alive didn't work in my syslog-1.6.2 I thought you meant the keep-alive option. I compiled the last version and now the option works and my problem is solved, thank you very much. Francisco -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Balazs Scheidler Sent: Martes, 28 de Diciembre de 2004 03:17 p.m. To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Problem with TCP connection not timing out On Tue, 2004-12-28 at 10:35 -0300, ARGEXT-HIDALGO, FRANCISCO wrote: > Thanks for the response, I'll test it now, but the documentation says that > this is the default behaviour, so I'm not sure if this will change anything. > On the other hand, shouldn't the OS drop these connections?, some of them > have days there, and this monday, there where almost 40 dead connections > that where "ESTABLISHED". > I'm sorry but no, the OS does not reap these connections. Some application layer timeout could solve the issue, though at the same time it might also cause other problems like message drops. Where did you read that it was default? <row> <entry>tcp-keep-alive()</entry> <entry>yes or no</entry> <entry> Available for tcp() only, and specifies whether to enable TCP keep alive messages using the SO_KEEPALIVE socket option. </entry> <entry>no</entry> </row> Nevertheless looking at the source it seems not to be enabled by default. But if you tell me a reference I'll fix the documentation. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

testing from a remote server
by Michael Gargiullo 29 Dec '04

29 Dec '04

I have syslog-ng running, and it logs everything from the server it runs on. How can I test to make sure it logs from remote sources. I'm kind of new to syslog-ng. My server listens to UDP 514, and allows it through the firewall. I have 2 devices I really want to have log to it. A Cisco Aironet 1100, and a symantec firewall device we use on our back up connection. How can I test to make sure syslog-ng is capturing what I'd like it to. -Mike

1 1

Syslog-ng/libol: broken snapshots creation
by José Pedro Oliveira 29 Dec '04

29 Dec '04

Hi, The last syslog-ng (and libol) snapshot listed in the http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot/ is from 2004-12-06. Could someone correct the problem and, maybe, delete libol-0.3.13 and syslog-ng-1.6.4 snapshots? Thanks in advance, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

1 0

RE: [syslog-ng]Problem with TCP connection not timing out
by ARGEXT-HIDALGO, FRANCISCO 28 Dec '04

28 Dec '04

Thanks for the response, I'll test it now, but the documentation says that this is the default behaviour, so I'm not sure if this will change anything. On the other hand, shouldn't the OS drop these connections?, some of them have days there, and this monday, there where almost 40 dead connections that where "ESTABLISHED". -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Balazs Scheidler Sent: Lunes, 27 de Diciembre de 2004 05:58 p.m. To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Problem with TCP connection not timing out On Wed, 2004-12-22 at 17:16 -0300, ARGEXT-HIDALGO, FRANCISCO wrote: > I'm really not sure what the problem is, I'm logging with a server in different countries and they send through TCP the logs to a central server. The problem I'm having is that the central server is not dropping TCP connections that no longer exist. > As an example: > > CENTRAL SERVER: > TCP > Local Address Remote Address Swind Send-Q Rwind Recv-Q State > -------------------- -------------------- ----- ------ ----- ------ ------- > CENTRAL.shell syslogA.33969 5840 0 10136 0 ESTABLISHED > CENTRAL.shell syslogB.4930 5840 0 10136 0 ESTABLISHED > CENTRAL.shell syslogC.33924 24820 0 8760 0 ESTABLISHED > CENTRAL.shell syslogC.33925 24820 0 8760 0 ESTABLISHED > CENTRAL.shell syslogD.44925 5840 0 10136 0 ESTABLISHED > CENTRAL.shell syslogE.32783 24820 0 8760 0 ESTABLISHED > CENTRAL.shell syslogC.33926 24820 0 8760 0 ESTABLISHED > CENTRAL.22 host.1624 51968 0 10136 0 ESTABLISHED > CENTRAL.shell syslogD.44934 5840 0 10136 0 ESTABLISHED > > SYSLOGC: > TCP: IPv4 > Local Address Remote Address Swind Send-Q Rwind Recv-Q State > -------------------- -------------------- ----- ------ ----- ------ ------- > syslogC.33926 CENTRAL.shell 8760 0 24820 0 ESTABLISHED > SyslogC.22 host.4663 57920 0 24616 0 ESTABLISHED > > > Notice that the active conection is the one from SyslogC port 33926, but CentralSyslog has 3 established connections (33924, 33925 and 33926), 33924 is active since some days ago, but doesn't exist in the original server. The problem is that my total connections allowed start to fill up and then I can no longer connect. > Any ideas on what could this be? Maybe there were some network outages and the connection on the client timed out, but as there are no packets for established connections without traffic this connection remained in the server's connection table. A possible solution is to enable TCP keep-alive, which periodically sends probes for established connections, and reports an error if the peer does not react to a probe, you can enable this by setting tcp-keep-alive option to yes, for example: source s_tcp { tcp(port(2000) tcp-keep-alive(yes)); }; -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

STATS: dropped 644 ?
by Matthias Keller 28 Dec '04

28 Dec '04

Hi I'm using syslog-ng for quite a while now and finally want to resolve this problem (I suppose)... I pretty much daily get a whole bunch of dropped messages... It's not always at the same times but always for several hours! I'm logging the stats hourly so usually for about 8h a day I get drops in the hundreds....? I guess this isn't normal and shouldn't be as my system isn't really busy at all... As options I'm using: options { long_hostnames(off); sync(5); # How many lines have to be queued until a disc synch is done. use 0 for immediate stats(3600); log_fifo_size(8192); log_msg_size(1024); time_reopen(10); }; Since there are a lot of apps running on the system I dont go for a 'Application X gets localZ' approach but instead I'm filtering by application name One example entry would be: filter f_dhcpd { program("dhcpd"); }; destination dhcpd { file("/var/log/dhcpd.log"); }; log { source(src); filter(f_dhcpd); destination(dhcpd); flags(final); }; I dont know if that flags(final) does some harm as I haven't seen that much in the wild but I dont want any further rule care about dhcpd-logs so I want to stop matched entries there... I have about 10 such entries... I also have a catchall in the end: destination other { file("/var/log/other"); }; log { source(src); destination(other); }; which doesn't really catch anything at all because the messages before already catches pretty much everything I can give you the whole config if you like So I'm hoping you could give me some good advices on how to track down my problem? Thanks!! Matt

2 2