May 2004 - syslog-ng - lists.balabit.hu

TCP Connection Dropouts
by Philip Webster 18 May '04

18 May '04

Hello, I'm wondering about the resilience of syslog-ng to TCP connection dropouts. I've tested what happens when there is no connection available - syslog-ng buffers the output and continues to write to local files, ie. it doesn't block. But what happens if the TCP connection fails halfway through? So, for example, the three-way handshake has been completed, but there is no response after the first data packet is sent because the remote host (or router, switch, ISP ...) has stopped responding. I can't really test this, so does anyone know how syslog-ng handles it? Thanks Phil

2 2

Not Logging
by Asif Iqbal 17 May '04

17 May '04

Hi All I am using this as my conf file for my syslog-ng 1.6.3 w/ libol-0.3.13 to gather logs from cisco. But it is not logging. I am running it on Solaris 9. Notice I can get the log on local7 that points to /var/log/cisco IF I use Solaris's syslogd options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (yes); create_dirs (no); dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname (yes); }; source net { udp (ip(1.2.0.94) port(514)); }; # local7.crit;local7.warn;local7.info;local7.debug /var/log/cisco filter f_cisco { facility(local7) and level(debug...emerg); }; destination d_cisco { file("/var/log/cisco" create_dirs(yes)); }; log { source(net); filter(f_cisco); destination(d_cisco); }; My snoop/tcpdump gets the SYSLOG pkts fine. Any idea why is it not writng the log with syslog-ng but ONLY with syslogd? I never run both daemons at the same time Thanks for the help/suggestion -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu There's no place like 127.0.0.1

2 1

Where to get latest version og syslog-ng?
by me 17 May '04

17 May '04

Hi, I have problems compiling syslog-ng-1.9.1. As it looks like, the problem was/is known. My question is where to get the very latest version of syslog-ng? Thanks, /me old message of this mailinglist: -------------------------------- On Sun, Feb 16, 2003 at 08:54:17AM -0500, mclinden(a)informed.net wrote: > Greetings! > > The file src/fdread.h seems to be missing from the latest tarball of > syslog-ng-1.9.1 Please try the daily snapshots at http://www.balabit.com/downloads/syslog-ng/1.9/src-snapshot/ -- Bazsi -- "Sie haben neue Mails!" - Die GMX Toolbar informiert Sie beim Surfen! Jetzt aktivieren unter http://www.gmx.net/info

2 6

RE: [syslog-ng]TCP Connection Dropouts
by Rule, Ted 17 May '04

17 May '04

We had a Disaster Recovery test recently where I specifically tested this exact scenario, as I couldn't be sure that syslog-ng wouldn't block to local Unix Domain connections. The routed link between the central syslog-ng host and the local syslog-ng client was dropped to see what effect it would have - for both syslog-ng and all other applications. The only effect seemed to be that the client machine created an error message every time_reopen() seconds detailing how many messages had been lost due to the broken connection. To slightly reduce the number of errors caused by error messages, I specifically adjusted the client machine's configuration to avoid it sending any messages generated by syslog-ng itself up to the remote host. Ted > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Philip Webster > Sent: Monday May 17 2004 05:06 > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]TCP Connection Dropouts > > > Hello, > > I'm wondering about the resilience of syslog-ng to TCP > connection dropouts. > I've tested what happens when there is no connection > available - syslog-ng > buffers the output and continues to write to local files, ie. > it doesn't block. > > But what happens if the TCP connection fails halfway through? > So, for > example, the three-way handshake has been completed, but > there is no response > after the first data packet is sent because the remote host > (or router, > switch, ISP ...) has stopped responding. I can't really test > this, so does > anyone know how syslog-ng handles it? > > Thanks > Phil > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Issue with syslog-ng and process-names with spaces
by Jason Haar 17 May '04

17 May '04

Hi there I don't know if this is a bug with syslog-ng-1.6.4 or NTsyslog (which generated the syslog record), but we have a problem with records generated by some NT applications showing up "corrupted" within syslog-ng. Namely it thinks the hostname is the process name. However, looking with a sniffer shows what is really going on: NTSyslog records generally look like: <(facility tag)>May 17 14:22:22 security[success] blah blah and syslog-ng records that as timestamp PTR-record security[success] blah blah However, what if the process name has spaces in it? It looks like <(facility tag)>May 17 14:22:22 trend user alert micro scanmail for microsoft \ exchange[warning]: (msg) syslog-ng records that as timestamp trend user alert micro scanmail... I think syslog-ng is looking at the first word as the process name, and if it doesn't "look like a process name", then it assumes it must be the hostname? Config is: options { use_dns(yes); use_fqdn(yes); dns_cache(no); time_reopen(10); keep_hostname(no); use_time_recvd(yes); log_fifo_size(100); mark(0); stats(0); sync(5); }; Does that sound correct, and is there something I can do to stop it? Thanks -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

3 2

Re: syslog-ng 1.6.4 packages for Solaris
by Balazs Scheidler 15 May '04

15 May '04

Thanks, I'm sure Solaris packages of syslog-ng will be useful. I'm also Cc-ing the syslog-ng mailing list where more people are listening. On Sat, May 15, 2004 at 03:48:01AM -0400, Steven M. Christensen wrote: > Greetings -- > > I had a number of requests for pre-compiled versions of > syslog-ng for Solaris systems from the users of my > sunfreeware.com site. > > I have added these packages for all the levels of Solaris > I support to that site. I hope this is of use to your > efforts. > > Regards, > > Steve Christensen >

1 0

RE: [syslog-ng]cisco host not being resolved
by Badat, Qassim, ALABS 14 May '04

14 May '04

I resolved it, the problem was due to DNS and missing reverse entries for these hosts. Guess what, it was the logs in the syslog-ng that led to its own resolution !!! _____ From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Badat, Qassim, ALABS Sent: Friday, May 14, 2004 11:58 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]cisco host not being resolved Hi, I am new to syslog-ng so excuse my ignorance. I have installed syslog-ng 1.6.2 on Solaris 8. I am getting the logs but the host names are not being resolved. . Strangely logs from another vendor's does have the names resolved by syslog-ng. Any idea whats causing the problem for cisco ? My syslog-ng.conf file: options { long_hostnames(off); sync(0); }; source sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source net { udp(); }; destination network { file("/var/log/syslog-ng"); }; log { source(net); destination(network); }; log { source(sys); destination(network); }; Regards, QB

3 2

RE: [syslog-ng]cisco host not being resolved
by Dmitri Smirnov 14 May '04

14 May '04

I think you can use use_dns(no) option to disable DNS resolution by syslog-ng Dmitri -----Original Message----- From: Badat, Qassim, ALABS [mailto:qbadat@att.com] Sent: Friday, May 14, 2004 3:05 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]cisco host not being resolved Nothing to do with syslog-ng. It's the DNS, there should exist both the A -record and the PTR for the host. That is you should be able to resolve NAME-to-IP and also IP-to-NAME.

1 0

RE: [syslog-ng]cisco host not being resolved
by Badat, Qassim, ALABS 14 May '04

14 May '04

Nothing to do with syslog-ng. It's the DNS, there should exist both the A -record and the PTR for the host. That is you should be able to resolve NAME-to-IP and also IP-to-NAME. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Asif Iqbal Sent: Friday, May 14, 2004 5:34 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]cisco host not being resolved Badat, Qassim, ALABS wrote: > I resolved it, the problem was due to DNS and missing reverse entries > for these hosts. Guess what, it was the logs in the syslog-ng that led > to its own resolution !!! Would you care to share the diff of the not working and working syslog.conf? I am having the same problem Thanks > > > > _____ > > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Badat, Qassim, > ALABS > Sent: Friday, May 14, 2004 11:58 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]cisco host not being resolved > > > > Hi, > > > > I am new to syslog-ng so excuse my ignorance. I have installed > syslog-ng 1.6.2 on Solaris 8. I am getting the logs but the host names > are not being resolved. . Strangely logs from another vendor's does > have the names resolved by syslog-ng. Any idea whats causing the > problem for cisco ? > > > > > > My syslog-ng.conf file: > > > > options { long_hostnames(off); sync(0); }; > > source sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); > internal(); }; > > source net { udp(); }; > > > > destination network { file("/var/log/syslog-ng"); }; > > > > log { source(net); destination(network); }; > > log { source(sys); destination(network); }; > > > > > > > > Regards, > > QB > -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu There's no place like 127.0.0.1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

IRC channel: #syslog-ng on FreeNode
by Andrew J Caines 14 May '04

14 May '04

Folks, Having failed to find an existing one, I've set up an IRC channel #thttpd on the FreeNode IRC network`[1], where I'm AJ_Z0 and AJC_Z0 (at home and work, respectively). It's registered with ChanServ. Please feel free to drop in to say hello, as well as share questions, answers and ideas about syslog-ng. If no-one responds straight away, don't feel slighted since not everyone is actively participating in the channel all the time. Hang around and someone will respond. In case you're not familiar with Internet Relay Chat (IRC), it's an old but very much alive collection of distributed networks, wherein your IRC client connects to any node and you join any of the channels (chat groups) and chat with everyone else in that channel on the network. It's a bit like some of the instant messenger groups, but without the proprietary protocols, poor client platform support, etc. For the record, I'm not involved with syslog-ng, except as a (fairly new) user. ----8<---- [1] irc.freenode.org - See http://freenode.org/ -Andrew- -- _______________________________________________________________________ | -Andrew J. Caines- Unix Systems Engineer A.J.Caines(a)halplant.com | | "They that can give up essential liberty to obtain a little temporary | | safety deserve neither liberty nor safety" - Benjamin Franklin, 1759 |

1 0