December 2004 - syslog-ng - lists.balabit.hu

Christmas
by Jay Guerette 19 Dec '04

19 Dec '04

Although 10 days too late, I was thinking: "What can Mikulás bring Balázs for Christmas?" After all, giving us syslog-ng and 5 years of support on this list deserves *something*. Then it hit me; "I'll buy a syslog-ng support contract!" I'm reasonably sure I can get my company to go for it; so how can I get prices on the various support packs available?

3 5

iptables syslog-ng logs way to big
by garvald＠bluemail.ch 19 Dec '04

19 Dec '04

hi there bit of a problem with too many logs being generated and i'm not sure what to do. I'm using a iptables firewall setup like this: $IPTABLES -t filter -N ACCEPTLOG $IPTABLES -t filter -A ACCEPTLOG -j LOG --log-prefix "iptables:" --log-level\ debug $IPTABLES -t filter -A ACCEPTLOG -j ACCEPT the firewall is also a masquerading NAT gateway for about 50 clients. I want to record all traffic flowing through the gateway, so along with the firewall rules stated above i have this in my syslog-ng.conf : destination iptables { file("/var/log/iptables"); }; filter iptables { match("^iptables:"); }; log { source(src); filter(iptables); destination(iptables); }; all very nice, except for the fact that within 24 hours the log grew to 500MB's, which is a little too big. Of course i've configured logrotate to g-zip the file every day which greatly reduces the size, but i'd much prefer to have smaller logs but with the necessary information still there. Here's an example from one client just for a simple request to port 445: Dec 17 11:33:18 iptables:IN=eth1 OUT=eth0 SRC=192.168.1.220 DST=213.220.xxx.xxx LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=974 DF PROTO=TCP SPT=32900 DPT=445 WINDOW=10136 RES=0x00 ACK URGP=0 this entry is repeated 10 times per second !! i've tried different log levels in my firewall but it doesnt seem to change anything. Would be grateful for any help. cheers, garvald

4 3

-v and -p parameters not working as advertised
by syslogng＠sanitarium.net 16 Dec '04

16 Dec '04

Excerpts from man syslog-ng: -p <filename> Write the current PID information to the specified file. -v Enable verbose mode. Process will not become a daemon. Prints out fewer messages, compared to -d. Despite what that says, syslog-ng forks into the background when -v is used. Also, when -d is used to force syslog-ng to run in the foreground it does not create a pid file even when -p is used. I need the pidfile to be created even when running in the foreground. I am running syslog-ng with: syslog-ng -d -p /var/run/syslog-ng.pid -- Kevin

1 0

repost: line truncation with spamd
by scott 15 Dec '04

15 Dec '04

Is anyone looking into this issue? To refresh your memory, all five of these entries appear on the same line: 2004-12-09T01:09:35+1000 chloe spamd[704]: connection from localhost [127.0.0.1] at port 40811 2004-12-09T01:09:35+1000 chloe spamd[13558]: info: setuid to slittle succeeded 2004-12-09T01:09:35+1000 chloe spamd[13558]: processing message <35089309.09501@cbuki@getherbalnow.info> for slittle:1000. 2004-12-09T01:09:36+1000 chloe spamd[13558]: identified spam (20.8/5.0) for slittle:1000 in 0.8 seconds, 1475 bytes. 2004-12-09T01:09:36+1000 chloe qmail: 1102514976.416174 new msg 12808775

3 4

[PATCH] syslog-ng-1.6.5+20041206 fixes missing facility/priority in afinet.c
by Roberto Nibali 15 Dec '04

15 Dec '04

Hello, Somehow we either forgot this piece or it dropped out of the CVS again ;). The inlined patch fixes a missing facility/priority addition for template expansion over the network in afinet.c The goal is to be able to send the node name in each syslog message in order to distinguish the two systems: unfortunately when using templates in destination files, the facility/priority is lost. This fixes it I hope: --- syslog-ng-1.6.5+20041206/src/afinet.c 2004-08-05 13:35:12.000000000 +0200 +++ syslog-ng-1.6.5+20041206-fixed/src/afinet.c 2004-12-08 20:44:15.000000000 +0100 @@ -595,7 +595,8 @@ struct ol_string *msg_line; if (self->template_output) { - msg_line = c_format("%fS", + msg_line = c_format("<%i>%fS", + msg->pri, expand_macros( self->cfg, self->template_output, I'm under the distinct impression that something like that has already been addressed in the past. Maybe it was a copy'n'paste error or so ... Take care, Roberto Nibali, ratz -- ------------------------------------------------------------- addr://Rathausgasse 31, CH-5001 Aarau tel://++41 62 823 9355 http://www.terreactive.com fax://++41 62 823 9356 ------------------------------------------------------------- terreActive AG Wir sichern Ihren Erfolg -------------------------------------------------------------

2 9

Using logger with syslog-ng
by Vaibhav Goel 15 Dec '04

15 Dec '04

Hi all, I am new syslog-ng user. I am trying to figure out how to get a loghost going and taking baby steps with the documentation available :-) I got syslog-ng configured on a Linux server as such: source s_test { tcp(ip(0.0.0.0) port(514)); }; destination d_test { file("/var/log/test.log"); }; log { source(s_test); destination(d_test); }; I can connect to localhost on 514 fine: telnet localhost 514 Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. So it appears that syslog-ng is at least running fine. I would like to use logger to send a test log message to syslog-ng. I googled and looked at the FAQ and docs but cannot find a way. Can anyone help or point me to a relevant document I could read? :-) Thanks!

2 3

Re: [syslog-ng]How can I stop syslog-ng by command
by 童永昇 15 Dec '04

15 Dec '04

In FreeBSD ,you may can use /usr/local/etc/rc.d/syslog-ng.sh \ [start|stop] -----Original message----- From:wei<wei00(a)126.com> To:syslog-ng<syslog-ng(a)lists.balabit.hu> Date: Mon, 13 Dec 2004 17:56:51 +0800 Subject: [syslog-ng]How can I stop syslog-ng by command Hello everyone: I have a simple question to ask you. Could you tell me a command to stop/start my syslog-ng server? In my Syslog-ng 1.6.5, I can’t use “syslog-ng stop” to stop my syslog-ng. I can only use kill, but I don’t think it is a good idea. Thx!! _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3

How can I stop syslog-ng by command
by wei 13 Dec '04

13 Dec '04

Hello everyone: I have a simple question to ask you. Could you tell me a command to stop/start my syslog-ng server? In my Syslog-ng 1.6.5, I can't use "syslog-ng stop" to stop my syslog-ng. I can only use kill, but I don't think it is a good idea. Thx!!

2 1

Syslog-NG / sqlsyslogd Date Issues
by Ronnie Clark 13 Dec '04

13 Dec '04

Hello all, I am using syslog-ng on a FreeBSD 5.3 STABLE platform with the sqlsyslogd template to log syslog messages to a MySQL 4.0.22 database. I noticed that when the date rolled from Nov 30 to Dec 1, that the actual messages were no longer being recorded. So I verified that the messages were being captured in the text files, and they were. Now, that the date is the 10th (2 full digits), messages are again being logged into the database. Is this a bug? Anyone else seen this type of behavior? I am pretty sure that it is not the OS causing the issue, since I have another syslog-ng server running on FreeBSD 4.x STABLE and saw the exact same errors on that as well. Any help is greatly appreciated. Thanks, Ron Clark __________________________________ Do you Yahoo!? Read only the mail you want - Yahoo! Mail SpamGuard. http://promotions.yahoo.com/new_mail

2 2

A remote logging problem..
by 童永昇 13 Dec '04

13 Dec '04

hi ... I am a newbie in syslog-ng I meet some problems in configure syslog-ng I have three machine, A is inside NAT, B is NAT server, C is loghost outside NAT B forward log message from A to C. A's syslog-ng.conf setting options { long_hostnames(off); sync(0); }; source src {unix-dgram("/var/run/log");udp();internal();file("/dev/klog");}; destination loghost{udp("B" port(514));}; log{ source(src);destination(loghost);}; B's syslog-ng.conf setting options { chain_hostnames(yes); keep_hostname(no); long_hostnames(off); sync(0); use_dns(yes); use_fqdn(yes); }; source src { unix-dgram("/var/run/log"); internal(); file("/dev/klog"); }; source fwd {udp( ip(10.1.1.254) port(514));}; destination loghost { udp("C" port(514)); }; log { source(src);source(fwd); destination(loghost); }; C's syslog-ng.conf setting options { chain_hostnames(yes); keep_hostname(no); create_dirs(yes); long_hostnames(off); sync(0); use_dns(yes); use_fqdn(yes); }; source src { unix-dgram("/var/run/log"); udp(); internal(); file("/dev/klog"); }; destination all { file("/var/log/all.log"); }; log { source(src); destination(all); }; three machine all are FreeBSD machine A FreeBSD is 5.3 B is FreeBSD 4.11 C is FreeBSD 4.10 syslog-ng version are the same(syslog-ng 1.6.5) the FAQ say's that.. keep_hostname(yes) keep_hostname(no) chain_hostname(yes) server server/server2 chain_hostname(no) server server2 i have see that FAQ,but i can not produce the log record like scr@host1/host2 when the root login at A machine,syslog-ng record this action,but... A ==> Dec 13 20:42:36 A login: ROOT LOGIN (root) ON ttyv0 B ==> Dec 13 20:42:36 10.1.1.11 login: login on ttyv0 as root Dec 13 20:42:36 10.1.1.11 login: ROOT LOGIN (root) ON ttyv0 Dec 13 20:42:36 10.1.1.11 login: ROOT LOGIN (root) ON ttyv0 C ==> Dec 13 20:42:36 B login: login on ttyv0 as root Dec 13 20:42:36 B login: ROOT LOGIN (root) ON ttyv0 Dec 13 20:42:36 C login: ROOT LOGIN (root) ON ttyv0 Dec 13 20:42:36 B login: ROOT LOGIN (root) ON ttyv0 (B、C is his hostname) it seems quiet strange. Can someone hlep me? thanks a lot (sorry for my poor English ^^")

1 0