February 2004 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]syslog duplicate entries
by Dylan Bouterse 24 Feb '04

24 Feb '04

Should I be able to remove all of the destination lines following std and still get the localhost's log information to it's host directory based on the "destination std" line? Dylan -----Original Message----- From: Hamilton Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Tuesday, February 24, 2004 12:33 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog duplicate entries Look at your filter, f_syslog, destination d_syslog, and your log line that includes d_syslog. Your filter f_syslog includes everything except facilities auth, and authpriv. If you are confident that you don't need your syslog line you can comment that out as well to keep you from getting duplicates in you /var/log/syslog file. Regards, Drew -----Original Message----- From: Dylan (FHMS) [ mailto:dhbouterse@fhmsi.com <mailto:dhbouterse@fhmsi.com> ] Sent: Tuesday, February 24, 2004 12:25 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog duplicate entries I have my syslog-ng setup so that external syslog hosts are creating their own dir and log file (see conf file below). One problem I'm having is that all of the hosts' logs are being written to /var/log/syslog as well...creating a 6Gig file or larger per week. Can someone please point out what I can change with my conf file to eliminate the duplicate entries? Thank you! Dylan ############################################# ### syslog-ng.conf file ############################################# options { check_hostname(yes); chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; # # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { # file("/var/log/HOSTS/$YEAR/$HOST/$MONTH/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(nagios) group(nagios) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/var/log/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/var/log/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/var/log/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/var/log/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/var/log/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/var/log/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/var/log/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/var/log/uucp.log" owner("root") group("adm") perm(0640)); }; # This files are the log come from the mail subsystem. # destination mailinfo { file("/var/log/mail.info" owner("root") group("adm") perm(0640)); }; destination mailwarn { file("/var/log/mail.warn" owner("root") group("adm") perm(0640)); }; destination mailerr { file("/var/log/mail.err" owner("root") group("adm") perm(0640)); }; # Logging for INN news system # destination newscrit { file("/var/log/news/news.crit" owner("root") group("adm") perm(0640)); }; destination newserr { file("/var/log/news/news.err" owner("root") group("adm") perm(0640)); }; destination newsnotice { file("/var/log/news/news.notice" owner("root") group("adm") perm(0640)); }; # Some `catch-all' logfiles. # #destination debug { file("/var/log/debug" owner("root") group("adm") #perm(0640)); }; #destination messages { file("/var/log/messages" owner("root") group("adm") #perm(0640)); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination xconsole { pipe("/dev/xconsole"); }; destination ppp { file("/var/log/ppp.log" owner("root") group("adm") perm(0640)); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter ppp { facility(local2); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; #log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; #log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_cnews); destination(console_all); }; #log { source(src); filter(f_cother); destination(console_all); }; ####log { source(src); filter(f_cnews); destination(xconsole); }; ###log { source(src); filter(f_cother); destination(xconsole); }; log { source(src); filter(ppp); destination(ppp); }; log { source(src); destination(std); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

RE: [syslog-ng]syslog duplicate entries
by Hamilton Andrew 24 Feb '04

24 Feb '04

Look at your filter, f_syslog, destination d_syslog, and your log line that includes d_syslog. Your filter f_syslog includes everything except facilities auth, and authpriv. If you are confident that you don't need your syslog line you can comment that out as well to keep you from getting duplicates in you /var/log/syslog file. Regards, Drew -----Original Message----- From: Dylan (FHMS) [mailto:dhbouterse@fhmsi.com] Sent: Tuesday, February 24, 2004 12:25 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog duplicate entries I have my syslog-ng setup so that external syslog hosts are creating their own dir and log file (see conf file below). One problem I'm having is that all of the hosts' logs are being written to /var/log/syslog as well...creating a 6Gig file or larger per week. Can someone please point out what I can change with my conf file to eliminate the duplicate entries? Thank you! Dylan ############################################# ### syslog-ng.conf file ############################################# options { check_hostname(yes); chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; # # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { # file("/var/log/HOSTS/$YEAR/$HOST/$MONTH/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(nagios) group(nagios) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/var/log/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/var/log/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/var/log/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/var/log/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/var/log/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/var/log/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/var/log/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/var/log/uucp.log" owner("root") group("adm") perm(0640)); }; # This files are the log come from the mail subsystem. # destination mailinfo { file("/var/log/mail.info" owner("root") group("adm") perm(0640)); }; destination mailwarn { file("/var/log/mail.warn" owner("root") group("adm") perm(0640)); }; destination mailerr { file("/var/log/mail.err" owner("root") group("adm") perm(0640)); }; # Logging for INN news system # destination newscrit { file("/var/log/news/news.crit" owner("root") group("adm") perm(0640)); }; destination newserr { file("/var/log/news/news.err" owner("root") group("adm") perm(0640)); }; destination newsnotice { file("/var/log/news/news.notice" owner("root") group("adm") perm(0640)); }; # Some `catch-all' logfiles. # #destination debug { file("/var/log/debug" owner("root") group("adm") #perm(0640)); }; #destination messages { file("/var/log/messages" owner("root") group("adm") #perm(0640)); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination xconsole { pipe("/dev/xconsole"); }; destination ppp { file("/var/log/ppp.log" owner("root") group("adm") perm(0640)); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter ppp { facility(local2); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; #log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; #log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_cnews); destination(console_all); }; #log { source(src); filter(f_cother); destination(console_all); }; ####log { source(src); filter(f_cnews); destination(xconsole); }; ###log { source(src); filter(f_cother); destination(xconsole); }; log { source(src); filter(ppp); destination(ppp); }; log { source(src); destination(std); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog duplicate entries
by Dylan (FHMS) 24 Feb '04

24 Feb '04

I have my syslog-ng setup so that external syslog hosts are creating their own dir and log file (see conf file below). One problem I'm having is that all of the hosts' logs are being written to /var/log/syslog as well...creating a 6Gig file or larger per week. Can someone please point out what I can change with my conf file to eliminate the duplicate entries? Thank you! Dylan ############################################# ### syslog-ng.conf file ############################################# options { check_hostname(yes); chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; # # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { # file("/var/log/HOSTS/$YEAR/$HOST/$MONTH/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(nagios) group(nagios) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/var/log/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/var/log/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/var/log/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/var/log/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/var/log/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/var/log/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/var/log/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/var/log/uucp.log" owner("root") group("adm") perm(0640)); }; # This files are the log come from the mail subsystem. # destination mailinfo { file("/var/log/mail.info" owner("root") group("adm") perm(0640)); }; destination mailwarn { file("/var/log/mail.warn" owner("root") group("adm") perm(0640)); }; destination mailerr { file("/var/log/mail.err" owner("root") group("adm") perm(0640)); }; # Logging for INN news system # destination newscrit { file("/var/log/news/news.crit" owner("root") group("adm") perm(0640)); }; destination newserr { file("/var/log/news/news.err" owner("root") group("adm") perm(0640)); }; destination newsnotice { file("/var/log/news/news.notice" owner("root") group("adm") perm(0640)); }; # Some `catch-all' logfiles. # #destination debug { file("/var/log/debug" owner("root") group("adm") #perm(0640)); }; #destination messages { file("/var/log/messages" owner("root") group("adm") #perm(0640)); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination xconsole { pipe("/dev/xconsole"); }; destination ppp { file("/var/log/ppp.log" owner("root") group("adm") perm(0640)); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter ppp { facility(local2); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; #log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; #log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_cnews); destination(console_all); }; #log { source(src); filter(f_cother); destination(console_all); }; ####log { source(src); filter(f_cnews); destination(xconsole); }; ###log { source(src); filter(f_cother); destination(xconsole); }; log { source(src); filter(ppp); destination(ppp); }; log { source(src); destination(std); };

1 0

tcp_keepalive and tcp_wrapper patch
by Rule, Ted 24 Feb '04

24 Feb '04

As part of preparing to glue a pair of syslog-ng servers together via a TCP connection, I've made some slight tweaks to the afinet.c code on my running system. This is all for a 1.6.0rc3 code version. Because I can't find any reference to the option elsewhere in the libol or syslog-ng code, I've forced the SO_KEEPALIVE socket on for both sender and receiver in a TCP connection. The issue here is mainly where the client mysteriously disappears, and the server seemingly never bothers to close down the half-open socket. Forcing the SO_KEEPALIVE flag on the socket should, I believe, tidy this up in the worst case scenario. I know that the socket can remain half-open, because I've seen TCP connections from a PIX in ESTABLISHED state, even when the PIX only has one live connection to the syslog-ng server. The other tweak is to enforce tcp_wrapper operation on TCP connections only. This may be redundant code, but I honestly can't follow the source sufficiently to know whether the tcp_wrapper code is called for a udp connection. Since logging the fault condition for a udp connection uses up almost as many resources as actually processing the packet, and performing the tcp_wrapper call is overkill for every successful udp connection, it seemed not worth the bother to call the wrapper code for udp connections and only enforce TCP lockdowns. It's also probably possible to avoid the getsockopt() call by determining socket type from client->super somehow, but I wasn't sure exactly how to do this. Patch diff below. Comments welcome. Ted $ sudo diff -u afinet.c-1.6.0rc3.orig afinet.c-1.6.0rc3.patched --- afinet.c-1.6.0rc3.orig Tue Feb 24 09:20:01 2004 +++ afinet.c-1.6.0rc3.patched Tue Feb 24 10:10:09 2004 @@ -28,6 +28,8 @@ #include "cfgfile.h" #include "pkt_buffer.h" +#include <sys/socket.h> +#include <sys/types.h> #include <errno.h> #include <string.h> #include <assert.h> @@ -217,8 +219,13 @@ CAST(afinet_source, self, c); struct afsocket_source_connection *conn; UINT32 res; + int socklen,sockval; + + socklen=sizeof(sockval); + if ( ( getsockopt(client->super.fd, SOL_SOCKET, SO_TYPE, &sockval, &socklen) == 0 ) && + ( sockval == SOCK_STREAM ) ) { #if ENABLE_TCP_WRAPPER - { + { struct request_info req; request_init(&req, RQ_DAEMON, "syslog-ng", RQ_FILE, client->super.fd, 0); @@ -230,9 +237,19 @@ close_fd(&client->super, 0); return ST_OK | ST_GOON; } + } +#endif + +#ifdef SO_KEEPALIVE + sockval=1; socklen=sizeof(sockval); + if ( setsockopt(client->super.fd, SOL_SOCKET, SO_KEEPALIVE, &sockval, socklen) < 0 ) { + notice("setsockopt SO_KEEPALIVE failure during do_open_afinet_connection()"); + } else { + notice("setsockopt SO_KEEPALIVE Ok in do_open_afinet_connection()"); } - #endif + } + if (c->num_connections >= c->max_connections) { CAST(inet_address_info, inet_addr, client_addr); @@ -250,8 +267,6 @@ } return res; } - - } static int @@ -488,6 +503,17 @@ if (self->conn_fd) { return ST_OK | ST_GOON; +#ifdef SO_KEEPALIVE + if ( (self->super.flags & 0x0003) == AFSOCKET_STREAM ) { + int sockval=1; + + if ( setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &sockval, sizeof(sockval)) < 0 ) { + notice("setsockopt SO_KEEPALIVE failure during do_init_afinet_dest()"); + } else { + notice("setsockopt SO_KEEPALIVE Ok in do_init_afinet_dest()"); + } + } +#endif } else { io_callout(self->cfg->backend, $ ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

embedded newlines
by Chuck Berg 24 Feb '04

24 Feb '04

A message with an embedded newline will cause the next message to be mangled. For example: dream:~$ echo -ne '<27>test: test: foo\nfoo' | nc -u loghost 514 Produces this: Feb 17 12:38:53 dream test: foo Feb 17 12:38:54 xyzzy foo<38>Feb 17 12:38:54 sshd[18588]: Accepted publickey for nobody from 10.1.2.3 port 48651 ssh2 Where xyzzy is an innocent victim who just happened to send the next message. I see that this has been discussed on the list several times over the past few years. Is there no proper solution possible? Can't we just end the message at the end of the packet (as if it was always null/newline terminated)? It seems to me that no matter what the content of a message, it should not cause another message to be mangled.

2 1

Re:[syslog-ng]Logging not matched to filters
by Amodiovalerio Verde 24 Feb '04

24 Feb '04

Try reading http://www.balabit.com/products/syslog_ng/reference/logpath.html You can use a log statement with the fallback flag to achieve what you need. i.e. source ext { tcp(port(514) max-connections(1024)); udp(port(514));}; ...your destination statements... destination unmatched { file("/var/log/unmatched");}; ...your log statements... log { source(ext);destination(unmatched);flags(fallback);}; The last log statements will log all 'unmatched by a previous rule' to the file /var/log/unmatched. Hope it helps. Amodiovalerio [Hypo] Verde ---------- Initial Header ----------- From : syslog-ng-admin(a)lists.balabit.hu To : syslog-ng(a)lists.balabit.hu Cc : Date : Mon, 23 Feb 2004 14:27:52 +0100 Subject : [syslog-ng]Logging not matched to filters > Hi > > I have a lot of filters and they log fine. > > I was wounding if it possible to make a logging that matches the rest, > that isn't caught in a filter. > So that if syslog-ng receives a log and it doesn't match any of the > filters, it will log it into a file. > > That way i don't miss a logging from a device, it would simple be in this > separate file. > > - Henning > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

3 3

Recording Name filter
by Luigi Augello 24 Feb '04

24 Feb '04

OK I hope, at least, to help you with my suggest. I tried to debug the source, but I not know the source and I know the c language little. Is really so difficult to create a new macro? tanks Luigi

1 0

RE: [syslog-ng]host() regular expressions
by Treptow, Craig 23 Feb '04

23 Feb '04

>You can find something about regular expression (regexp) here >http://en.wikipedia.org/wiki/Regular_expression , >http://www.greenend.org.uk/rjk/2002/06/regexp.html , or just >search the web. > >The syslog-ng archive is browsable here : >https://lists.balabit.hu/pipermail/syslog-ng/ > >About your regexp, i have not tried it but probably you could write >something like ".*-fw-.*[13]$" Thanks. I got it working with: filter f_testnotify { (host(".*\-fw\-.*\-(1|3)")) and (match("denied")); }; I did find the link to browse the messages, but would rather have done an exhaustive search before posting my question. Thanks for your reply! Craig

1 0

host() regular expressions
by Treptow, Craig 23 Feb '04

23 Feb '04

Hi folks. I just started running syslog-ng in test mode while I work out some issues and experiment. The version is 1.6.2 running on Solaris 8. I'm attempting to match subsets of hostnames like this: corp1-fw-pbx-1 corp1-fw-pbx-2 indharrisburg1pa-fw-1 I've been trying to match firewalls with names ending in 1 or 3, but am having no success: filter f_testnotify { (host("/.*\-fw\-.*(1|3)")) and (match("denied")); }; The reference documentation doesn't seem to cover this in detail. If somebody could help me, or point me to some more detailed documentation, I would appreciate it. Also, are the archives to this list searchable? I haven't been able to find that either. Thanks, Craig

2 1

Rcording name filter III
by Luigi Augello 23 Feb '04

23 Feb '04

Tank fore the help I use a template to register through a pipe the macro's results into a Mysql Database. For me is sufficient the last Filter name . For the remote connections I use the TCP connections between client and server. Tanks Luigi

2 1