February 2004 - syslog-ng - lists.balabit.hu

Is my default location broken?
by Madziarczyk, Jonathan 19 Feb '04

19 Feb '04

I just migrated to a new box for syslog-ng and I'm trying to get the "default" location to work for messages that don't meet any of my rules yet. I've sent multiple syslog messages to the box but they don't seem to be showing up. Any ideas? I do know that the "rules" messages are working so udp is binding. Thanks, JonM options { dir_perm(0755); perm(0644); chain_hostnames(no); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); dns_cache (yes); create_dirs (yes); keep_hostname(yes); }; source local { unix-dgram("/dev/log"); internal(); }; source s_udpmessages { udp(ip(0.0.0.0) port(514)); }; destination unsorted { file("/logs/unsorted.log" perm(0777)); }; log { source(s_udpmessages); destination(unsorted); flags(final, fallback); };

2 1

Re: [syslog-ng]Cisco CSS Logging
by Gary.Metelitsa＠us.hsbc.Com 18 Feb '04

18 Feb '04

Here are some syslog message examples and a snoop I ran: CSS syslog-ng message: 2004.02.18 17:32:05 7 local7 info 7264 NETMAN-6: CLMcmd: sho run service ,gmetelitsa@local Router syslog-ng message: 2004.02.18 17:37:07 NYPRRT10 local7 info 1354469: SLOT 1:Feb 18 17:37:05.268 EST: %SEC-6-IPACCESSLOGP: list 112 denied tcp 127.0.0.1(80) -> 205.241.15.99 When I snoop the line I get this: I didn't include the IP header and UDP header as I don't think its pertinent. CSS syslog payload message: SYSLOG: "<190>FEB 18 11:04:23 7/1 7187 NETMAN-6: CLMcmd: show run own" Router payload message: SYSLOG: "<190>1341226: SLOT 1:Feb 18 11:12:43.016 EST: %SEC-6-IPACCES" The payload does not contain the source IP address for either the CSS or for a router, however, syslog-ng gets the source address/hostname of the router but not the CSS. Also, I see that the message payload structure is quite different between a router and CSS. Nate Campi <nate(a)campin.net>@lists.balabit.hu on 18 Feb 2004 15:04 Please respond to syslog-ng(a)lists.balabit.hu Sent by: syslog-ng-admin(a)lists.balabit.hu To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Cisco CSS Logging **************************************************************************** This message originated from the Internet. Its originator may or may not be who they claim to be and the information contained in the message and any attachments may or may not be accurate. **************************************************************************** On Wed, Feb 18, 2004 at 01:21:19PM -0500, Gary.Metelitsa(a)us.hsbc.Com wrote: > I'm running syslog-ng 1.6.0rc.1 It is not able to pick up the IP address > coming from a Cisco Content Switch (formerly Arrowpoint) generated syslog > message. All other routers and switches have their ip address. Regular > syslog picks up the IP address field. Has anyone come across this? Gary, Please supply a log example, I'm not sure what you mean. -- Nate IMHO one should have to pass a test on DNS before publishing a CNAME. ;) - Greg White _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ************************************************************************ This E-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return E-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. ************************************************************************

2 1

Cisco CSS Logging
by Gary.Metelitsa＠us.hsbc.Com 18 Feb '04

18 Feb '04

I'm running syslog-ng 1.6.0rc.1 It is not able to pick up the IP address coming from a Cisco Content Switch (formerly Arrowpoint) generated syslog message. All other routers and switches have their ip address. Regular syslog picks up the IP address field. Has anyone come across this? Thanks, Gary ************************************************************************ This E-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return E-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. ************************************************************************

2 1

Bug in unix_stream/dgram() dest drivers 1.6.0rc4
by Andreas Schulze 18 Feb '04

18 Feb '04

Hi Bazi, it seems I've found a bug in the unix_stream/unix_dgram destination drivers. The problem is, that running sysng with something like destination d_stream { unix-stream("/tmp/stream_sock"); }; or destination d_dgram { unix-dgram("/tmp/dgram_sock"); }; it doesn't create the socket in the file system, so the connect() fails. Seems that bind_unix_socket() is never called. The appended trace shows, that there isn't a bind() between so_socket() = 4 and connect(4) As far as I know, bind() must be called before connect() to create the socket in the local filesys. It should be removed via unlink() after all work is done. Feedback or a hot-fix is very wellcome. Thanks a lot --Andreas Debug message: > syslog-ng -d -v > io.c: connecting using fd 4 > connecting fd 4, unixaddr: /tmp/dgram_sock > Error connecting to AF_UNIX(/tmp/dgram_sock): Bad file number > Error initializing configuration, exiting. Strace: > 18128: so_socket(1, 1, 0, "", 1) = 4 > 18128: fcntl(4, F_GETFL, 0x00000000) = 2 > 18128: fstat64(4, 0xFFBEF348) = 0 > 18128: getsockopt(4, 65535, 8192, 0xFFBEF448, 0xFFBEF440, 0) = 0 > 18128: fstat64(4, 0xFFBEF348) = 0 > 18128: getsockopt(4, 65535, 8192, 0xFFBEF448, 0xFFBEF444, 0) = 0 > 18128: setsockopt(4, 65535, 8192, 0xFFBEF448, 4, 0) = 0 > 18128: fcntl(4, F_SETFL, 0x00000082) = 0 > 18128: fcntl(4, F_SETFD, 0x00000001) = 0 > io.c: connecting using fd 4 > 18128: write(2, " i o . c : c o n n e c".., 28) = 28 > connecting fd 4, unixaddr: /tmp/dgram_sock > 18128: write(2, " c o n n e c t i n g f".., 47) = 47 > 18128: connect(4, 0xFFBEF4A8, 110, 1) Err#2 ENOENT > 18128: close(4) = 0 > 18128: close(4) Err#9 EBADF > Error connecting to AF_UNIX(/tmp/dgram_sock): Bad file number > 18128: write(2, " E r r o r c o n n e c".., 66) = 66 > Error initializing configuration, exiting. > 18128: write(2, " E r r o r i n i t i a".., 43) = 43 > 18128: llseek(0, 0, SEEK_CUR) = 41406 > 18128: lwp_mutex_wakeup(0xFF3E7CB0) = 0 > 18128: lwp_mutex_lock(0xFF3E7CB0) = 0 > 18128: lwp_sigredirect(0, SIGWAITING, 0x00000000) Err#22 EINVAL > 18128: _exit(2) -- Best regards --Andreas Schulze [phone: +49.5246.80.1275, fax: +49.5246.80.2275] | I believe, it was Dennis Ritchie who said something like: | "C is rarely the best language for a given task, | but it's often the second-best". | The implication being that: "[...]" | http://www.ioccc.org/1990/dds.c

3 5

delimiters
by Dylan Bouterse 17 Feb '04

17 Feb '04

Is there a way to insert a delimiter into the incoming message between major fields, preferably on a per host basis? Dylan

1 0

host() filter not working properly
by Salim Pathan 17 Feb '04

17 Feb '04

hi , host() filter do not differentiate between logs coming from "31.1.4.5" and "31.1.4.51"...i'm using use_dns(NO).... any help? regds, salim --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.581 / Virus Database: 368 - Release Date: 2/9/2004

1 0

missing flex?
by Christoph.Eckart＠COMPUTACENTER.COM 17 Feb '04

17 Feb '04

hi, i'm trying to install syslog-ng1.6.2 with libol0.3.13. libol works fine - my problem is syslog-ng. i get the error below after 'make'. i thought flex was missing but after installing flex i got the same error. i read in the syslog-ng archive about a similar problem and someone wrote that the problem ist the line "LEXLIB" in the "src/Makefile" which should be set to "-lfl" but i don't know what i have to change the line to. my line looks like: "LEX = /usr/local/src/syslog-ng/missing flex" any suggestions? "./configure" loading cache ./config.cache checking for a BSD compatible install... (cached) /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... (cached) yes checking for working aclocal-1.4... missing checking for working autoconf... missing checking for working automake-1.4... missing checking for working autoheader... missing checking for working makeinfo... missing checking whether build environment is sane... yes checking for gcc... (cached) gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ANSI C... (cached) none needed checking for bison... (cached) bison -y checking how to run the C preprocessor... (cached) gcc -E checking for flex... (cached) /usr/local/src/syslog-ng/missing flex checking for flex... (cached) /usr/local/src/syslog-ng/missing flex checking for yywrap in -ll... (cached) no checking lex output file root... (cached) lex.yy checking whether yytext is a pointer... (cached) no checking whether make sets ${MAKE}... (cached) yes checking for ANSI C header files... (cached) yes checking for malloc.h... (cached) yes checking for unistd.h... (cached) yes checking for door.h... (cached) no checking for stropts.h... (cached) yes checking for sys/strlog.h... (cached) no checking for stdarg.h... (cached) yes checking for sys/klog.h... (cached) yes checking for arpa/nameser.h... (cached) yes checking for tcpd.h... (cached) yes checking for working const... (cached) yes checking whether time.h and sys/time.h may both be included... (cached) yes checking for modern utmp... (cached) yes checking whether to compile klogctl... yes checking size of short... (cached) 2 checking size of int... (cached) 4 checking size of long... (cached) 4 checking for I_CONSLOG... (cached) no checking for O_LARGEFILE... (cached) yes checking for res_init in <resolv.h>... (cached) yes checking for working alloca.h... (cached) yes checking for alloca... (cached) yes checking for vprintf... (cached) yes checking for res_init in -lresolv... (cached) no checking for __res_init in -lresolv... (cached) yes checking for door_create in -ldoor... (cached) no checking for socket in -lsocket... (cached) no checking for gethostbyname in -lnsl... (cached) yes checking for select... (cached) yes checking for snprintf... (cached) yes checking for vsnprintf... (cached) yes checking for strerror... (cached) yes checking for inet_aton... (cached) yes checking for strncpy... (cached) yes checking for getutent... (cached) yes checking for getopt_long... (cached) yes checking for strcasecmp... (cached) yes checking for strptime... (cached) yes checking for TCP wrapper library... (cached) -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking libol version >= 0.3.13... ok creating ./config.status creating Makefile creating src/Makefile creating src/tests/Makefile creating doc/Makefile creating doc/sgml/Makefile creating contrib/Makefile creating syslog-ng.spec creating src/config.h src/config.h is unchanged "make" Making all in src make[1]: Entering directory `/usr/local/src/syslog-ng/src' make all-recursive make[2]: Entering directory `/usr/local/src/syslog-ng/src' Making all in . make[3]: Entering directory `/usr/local/src/syslog-ng/src' gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lnsl -lresolv /usr/local/lib/libol.a -lnsl cfg-lex.o(.text+0x3ba): In function `yylex': /usr/local/src/syslog-ng/src/lex.yy.c:1054: undefined reference to `yywrap' cfg-lex.o(.text+0xa07): In function `input': /usr/local/src/syslog-ng/src/lex.yy.c:1403: undefined reference to `yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng/src' make: *** [all-recursive] Error 1 Best regards Christoph Eckart

1 0

splitting logs on central log host?
by Jeffrey Forman 16 Feb '04

16 Feb '04

I have just setup syslog-ng to log about 15 machines to a central log host, and i absolutely love it, but i have a question. right now i'm splitting the logs like this on the loghost destination hosts { file("/mnt/backups/logs/$HOST/$YEAR/$MONTH/$FACILITY$YEAR$MONTH" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; but that only splits the logs via facility. there are more logs being written on the client log machines, which are configured like this destination messages { file("/var/log/messages"); }; destination ssh { file("/var/log/ssh.log"); }; destination cron { file("/var/log/cron.log"); }; destination auth { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog.log"); }; destination xinetd { file("/var/log/xinetd.log"); }; destination rsync { file("/var/log/rsync.log"); }; destination cfengine { file("/var/log/cfengine.log"); }; filter f_ssh { program("sshd"); }; filter f_cron { program("cron"); }; filter f_auth { program("su") or program("sudo"); }; filter f_syslog { program("syslog-ng"); }; filter f_xinetd { program("xinetd"); }; filter f_rsync { program("rsyncd"); }; filter f_cfengine { program("cfengine"); }; filter f_messages { ...}; // with messages getting everything else log { source(src); filter(f_ssh); destination(ssh); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_auth); destination(auth); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_xinetd); destination(xinetd); }; log { source(src); filter(f_rsync); destination(rsync); }; log { source(src); filter(f_cfengine); destination(cfengine); }; log { source(src); filter(f_messages); destination(messages); }; what i would like to do is log the files as they are being logged locally on the client machines, the same way on the loghost. do i have to change the destination? how do i get the same file names, etc, that are being logged, but on the loghost? any help is greatly appreciated. -Jeffrey -- -------------------------- Jeffrey Forman Gentoo Infrastructure Team jforman(a)gentoo.org --------------------------

3 3

splitting logs on central log host?
by Jeffrey Forman 14 Feb '04

14 Feb '04

I have just setup syslog-ng to log about 15 machines to a central log host, and i absolutely love it, but i have a question. right now i'm splitting the logs like this on the loghost destination hosts { file("/mnt/backups/logs/$HOST/$YEAR/$MONTH/$FACILITY$YEAR$MONTH" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; but that only splits the logs via facility. there are more logs being written on the client log machines, which are configured like this destination messages { file("/var/log/messages"); }; destination ssh { file("/var/log/ssh.log"); }; destination cron { file("/var/log/cron.log"); }; destination auth { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog.log"); }; destination xinetd { file("/var/log/xinetd.log"); }; destination rsync { file("/var/log/rsync.log"); }; destination cfengine { file("/var/log/cfengine.log"); }; filter f_ssh { program("sshd"); }; filter f_cron { program("cron"); }; filter f_auth { program("su") or program("sudo"); }; filter f_syslog { program("syslog-ng"); }; filter f_xinetd { program("xinetd"); }; filter f_rsync { program("rsyncd"); }; filter f_cfengine { program("cfengine"); }; filter f_messages { ...}; // with messages getting everything else log { source(src); filter(f_ssh); destination(ssh); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_auth); destination(auth); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_xinetd); destination(xinetd); }; log { source(src); filter(f_rsync); destination(rsync); }; log { source(src); filter(f_cfengine); destination(cfengine); }; log { source(src); filter(f_messages); destination(messages); }; what i would like to do is log the files as they are being logged locally on the client machines, the same way on the loghost. do i have to change the destination? how do i get the same file names, etc, that are being logged, but on the loghost? any help is greatly appreciated. -Jeffrey -- -------------------------- Jeffrey Forman Gentoo Infrastructure Team jforman(a)gentoo.org --------------------------

1 0

test tool: split/forward syslog from production old-syslogd to syslog-ng?
by David Carmean 12 Feb '04

12 Feb '04

I'm trying to figure out how to configure/test a new syslog-ng system without disrupting my current old-style syslogd on a Solaris central logserver. The challenges are: preserving level/facility and perserving the originating host IP/name; thus a simple "*.debug @newserver" doesn't work. I *think* I can come up with a perl script to take nc (netcat) -l -v output, re-write the messages to contain the original hostname, and use netcat again to forward it off to the new server under development. e.g.: > sudo ./nc -l -u -p 514 -v listening on [any] 514 ... connect to [172.19.248.122] from eponymous.lab.netapp.com [172.19.248.40] 3357 <0>foofdsasdfasdf and rewrite that to <0>${timedate} 172.19.248.40 foofdsasdfasdf and ship it off. But I was wondering if anyone had already built such a tool....?

2 1