March 2004 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]regex and priority(local7) question
by Rule, Ted 02 Mar '04

02 Mar '04

This config snippet works for me .... my PIXies are set to log via TCP1468 rather than UDP/514. Real IP Addresses replaced with fakes. As with your situation, I have other network gear running on local7 as well. Syslog-ng's wonderful filtration allows for a nice separation of all the classes of switch/router/firewall/VPN-bricks. Ted ...... source local { unix_stream("/dev/log" max-connections(200) keep-alive(yes) ); # UDP listeners for Internal syslog-ng interconnections udp(ip(127.0.0.1) port(514)); udp(ip(1.2.3.4) port(514)); }; source pixtcp { tcp(ip(1.2.3.4) port(1468) max-connections(10) keep-alive(yes)); }; filter f_local7 { facility(local7) and level(debug..emerg); }; filter f_pixmsg { match("%PIX"); }; filter f_misclocal7 { filter(f_local7) and not filter(f_pixmsg); }; destination d_local7 { file("/var/log/local7.debug" sync(0) ); }; destination d_pixlog { file("/var/log/pixlog.debug" sync(0) ); }; log { source(pixtcp); filter(f_local7); filter(f_pixmsg); destination(d_pixlog); }; log { source(local); filter(f_misclocal7); destination(d_local7); }; ...... > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of cdowns > Sent: Monday 01 March 2004 17:11 > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]regex and priority(local7) question > > > Good Morning, > Im new to the list and have a couple questions. > > I have a PIX firewalls logging on local7.info, how can I > match this > correctly ? I also have switches logging on local7.info but I > need this > one pix removed and placed into its own destination. > > Where can i get a list of the regex syntax used in > syslog-ng ? like > perl / awk / grep etc.. . > > Here is what I currently have: > > ------ Snip ------- > ## Regex > filter f_fw01 { > host("x.x.x.x") and match("PIX"); > }; > filter f_fw02 { > host("x.x.x.x") and match("PIX"); > }; > filter f_fw03 { > host("x.x.x.x") and match("PIX"); > }; > filter f_fw04 { > host("x.x.x.x") and match("PIX"); > }; > > #!!! not working yet.. . > filter f_pix{ > facility(local7) and match("%PIX*"); > }; > > filter f_iss { > match("issDaemon"); > }; > filter f_snmp { > match("ucd-snmp"); > }; > > ## everything else incoming > filter f_local7 { facility(local7); }; > > > ----- snip ------ > > TIA. > > ~!>D > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

2 1

Issue while logging to messages file
by Paul Jasa 02 Mar '04

02 Mar '04

Good morning! I am testing syslog-ng to find an alternative to syslog. So far, so good, the instructions have been great and I got it to work. However, I have one issue I can't seem to fix nor find literature which addresses it. I discovered that when the /var/log/messages file gets switched to messages.1 (then messages.2 and so forth), syslog-ng keeps logging to the new file name messages.1 instead of messages as I defined it in the conf file. I was hoping someone might know why does syslog-ng do this, and how can it be fixed? Thanks in advance for any info. Best regards to all, Paul ====================================== Paul Jasa Network Engineer ====================================== The information contained in this e-mail and any attached documents may be privileged, confidential and protected from disclosure. If you are not the intended recipient you may not read, copy, distribute or use this information. If you have received this communication in error, please notify the sender immediately by replying to this message and then delete it from your system.

2 1

Log prefix under Solaris
by Loic Minier 02 Mar '04

02 Mar '04

Hey again, All log messages that syslog-ng reads from sun-streams("/dev/log" door("/etc/.syslog_door")); are prefixed with the following string: "[ID 702911 local3.alert] " If I understand correctly, it seems that any program using the standard syslog interface under Solaris will see there messages prefixed with an ID and the facility they used. This is despite any formatting option I can tell, this is simply the content of $MSG. This, however, doesn't happen with UDP messages. I wonder if there's a way to remove this part, either at on syslog-ng side or in the calls to the syslog interface of Solaris? Regards, -- Loïc Minier <lool(a)dooz.org>

1 0

Changing permissions on /dev/sysmsg
by Loic Minier 02 Mar '04

02 Mar '04

Hey, While this doesn't cause any noticeable disfunction, I keep getting a message from syslog-ng which says: syslog-ng[14172]: Changing permissions on special file /dev/sysmsg I understand this is the consequence of the owner/group/perm options of the following block: destination df_dev_sysmsg { file("/dev/sysmsg" perm(0777) owner(root) group(other) template("$DATE $HOST $MSG\n")); }; On Solaris 8, /dev/sysmsg is a symlink t othe real sysmsg device, here's an output of ls -l /dev/sysmsg: lrwxrwxrwx 1 root other 33 Dec 17 2002 /dev/sysmsg -> ../devices/pseudo/sysmsg@0:sysmsg And here is ls -l /devices/pseudo/sysmsg\@0\:sysmsg: crwxrwxrwx 1 root other 97, 0 Mar 2 11:26 /devices/pseudo/sysmsg@0:sysmsg As you see, the permissions of /dev/sysmsg and of /devices/pseudo/sysmsg@0:sysmsg match the mask I set, and I wonder how can I can tell syslog-ng not to touch the permission of this "file". Thanks for any hint, Regards, -- Loïc Minier <lool(a)dooz.org>

1 0

Current stable syslog-ng + libol
by Loic Minier 01 Mar '04

01 Mar '04

Hey, (Thank you for syslog-ng.) I'd like to build the current stable version of syslog-ng, I've seen syslog-ng-1.4.17 on the balabit's website (following the "stable" link) and built with libol-0.2.24 (following INSTALL's instructions). However, Freshmeat has 1.5 as stable and 1.9 as dev, Debian has 1.5 as stable, 1.6 in testing and unstable, ... What versions are considered "stable"? I particularly need template() which doesn't fit in the conf -- neither does log_msg_size() -- right now. While we're at it, what is the appropriate version of libol for this syslog-ng? Regards, -- Loïc Minier <lool(a)dooz.org>

2 3

regex and priority(local7) question
by cdowns 01 Mar '04

01 Mar '04

Good Morning, Im new to the list and have a couple questions. I have a PIX firewalls logging on local7.info, how can I match this correctly ? I also have switches logging on local7.info but I need this one pix removed and placed into its own destination. Where can i get a list of the regex syntax used in syslog-ng ? like perl / awk / grep etc.. . Here is what I currently have: ------ Snip ------- ## Regex filter f_fw01 { host("x.x.x.x") and match("PIX"); }; filter f_fw02 { host("x.x.x.x") and match("PIX"); }; filter f_fw03 { host("x.x.x.x") and match("PIX"); }; filter f_fw04 { host("x.x.x.x") and match("PIX"); }; #!!! not working yet.. . filter f_pix{ facility(local7) and match("%PIX*"); }; filter f_iss { match("issDaemon"); }; filter f_snmp { match("ucd-snmp"); }; ## everything else incoming filter f_local7 { facility(local7); }; ----- snip ------ TIA. ~!>D

1 0

Re:[syslog-ng]file() versus pipe() for kernel logging
by Amodiovalerio Verde 01 Mar '04

01 Mar '04

It seems the only difference between file() and pipe() is the way files are opened. file() open files in read only , while pipe() open them in read-write. There's also defined a source and a destination fifo() that is just another name for pipe(). Amodiovalerio [Hypo] Verde ---------- Initial Header ----------- From : syslog-ng-admin(a)lists.balabit.hu To : syslog-ng(a)lists.balabit.hu Cc : Date : Sun, 29 Feb 2004 12:11:34 +1100 Subject : [syslog-ng]file() versus pipe() for kernel logging > I was just wondering if anyone could explain the differences between pip() > and file() when used as kernel log sources. > > For example the documentation suggests you would use the following statement > to collect kernel logs: > > source s_file { file("/proc/kmsg"); }; > > Most examples of syslog-ng.conf files I have seen have the following > statement: > > source s_pipe { pipe("/proc/kmsg"); }; > > Is there any difference between the two? Is one better than the other? > > Any help much appreciated. > > Thanks > > James Turnbull > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

1 0