June 2004 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]php-syslog-ng Error
by Benjamin.Zoeller＠salt-solutions.de 14 Jun '04

14 Jun '04

Hello Ben, this is the wrong maillinglist. You´ll get help here. http://lists.sourceforge.net/lists/listinfo/php-syslog-ng-support <http://lists.sourceforge.net/lists/listinfo/php-syslog-ng-support> Solution: It is very easy you must edit your db_fns.php Look for this line and change the values -> mysql_pconnect("<servername>", "<username>", "<password>"); HTH Benjamin -----Original Message----- From: Ben Whittaker [mailto:ben_whittaker@yahoo.com] Sent: Samstag, 12. Juni 2004 21:42 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]php-syslog-ng Error I am getting a error when trying to view the syslog data with php-syslog-ng-2.5.1 Parse error: parse error in /srv/www/htdocs/includes/db_fns.php on line 5 Fatal error: Call to undefined function: db_connect_syslog() in /srv/www/htdocs/index.php on line 9 _____ Do you Yahoo!? Friends. Fun. Try the <http://messenger.yahoo.com/> all-new Yahoo! Messenger

1 0

php-syslog-ng Error
by Ben Whittaker 12 Jun '04

12 Jun '04

I am getting a error when trying to view the syslog data with php-syslog-ng-2.5.1 Parse error: parse error in /srv/www/htdocs/includes/db_fns.php on line 5 Fatal error: Call to undefined function: db_connect_syslog() in /srv/www/htdocs/index.php on line 9 --------------------------------- Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger

1 0

Cisco Pix configuration
by Ben Whittaker 12 Jun '04

12 Jun '04

How do I setup syslog-ng for cisco pix. I have added the following lines to my config # PIX source network { udp () ; tcp (); }; destination pixlog { file("/var/log/pix.log"); }; filter f_pix { facility(local4); }; but I am not getting any logging to this new syslog server. __________________________________ Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger. http://messenger.yahoo.com/

3 7

config option to make syslog-ng bind only to a certain IP address?
by Bill Moran 10 Jun '04

10 Jun '04

This is my first post to this list. Is there a config or command-line option to make syslog-ng only bind to a certain IP address? I have a machine with multiple IPs, and I'd like to have syslog-ng only listening on the primary IP. In the future, I may want multiple instances of syslog-ng listening on different IPs with different configs. -- Bill Moran Potential Technologies http://www.potentialtech.com

2 2

RE: [syslog-ng]Cisco Pix configuration
by "Pedroche, Raúl" 10 Jun '04

10 Jun '04

There is a catch with Cisco SecurePIX logging facility statement. The number you have to pass as a parameter is not the number of the "local" facility, but the low level facility number. local4 is 20, and is the default. Facility 4 is auth. See http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_refer ence_chapter09186a00801727a9.html#wp1028090 <http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_refe rence_chapter09186a00801727a9.html#wp1028090> -----Original Message----- From: Ben Whittaker [mailto:ben_whittaker@yahoo.com] Sent: Thursday, June 10, 2004 2:04 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Cisco Pix configuration Still do not have it worked out. Please help Pix logging on logging timestamp logging trap notifications logging facility 4 logging queue 1024 logging host inside 10.1.1.18 test:/etc/syslog-ng # more syslog-ng.conf # # /etc/syslog-ng/syslog-ng.conf # # Automatically generated by SuSEconfig on Wed Jun 9 19:16:34 EDT 2004. # # PLEASE DO NOT EDIT THIS FILE! # # you can modify /etc/syslog-ng/syslog-ng.conf.in instead # # # File format description can be found in syslog-ng.conf(5). # options { long_hostnames(off); sync(0); }; # # 'src' is our main source definition. you can add # more sources driver definitions to it, or define # your own sources, i.e.: # #source my_src { .... }; source src { # # include internal syslog-ng messages # note: the internal() soure is required! # internal(); # # the following line will be replaced by the # socket list generated by SuSEconfig using # variables from /etc/sysconfig/syslog: # unix-dgram("/dev/log"); # # uncomment to process log messages from network: # #udp(ip("0.0.0.0") port(514)); }; # # filter definitions # filter f_console { level(warn) and facility(kern) or level(err) and not facility(authpriv); }; filter f_newsnotice { level(notice) and facility(news); }; filter f_newscrit { level(crit) and facility(news); }; filter f_newserr { level(err) and facility(news); }; filter f_news { facility(news); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_warn { level(warn, err, crit); }; filter f_alert ; { level(alert); }; filter f_messages { not facility(news, mail); }; filter f_local { facility(local0, local1, local2, local3, local4, local5, local6, local7); }; filter f_iptables { facility(kern) and match("IN=") and match("OUT="); }; # # print most on tty10 and on the xconsole pipe # destination console { file("/dev/tty10"); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole"); }; log { source(src); filter(f_console); destination(xconsole); }; # enable this, if you want that root is informed # immediately, e.g. of logins #destination root { usertty("root"); }; #log { source(src); filter(f_alert); destination(root); }; # # these files are rotated and examined by "news.daily" # destination newscrit { file("/var/log/news/news.crit"); }; log { source(src); filter(f_newscrit); destination(newscrit); }; destination newserr { file("/var/log/news/news.err"); }; log { source(src); filter(f_newserr); destination(newserr); }; destination newsnotice { file("/var/log/news/news.notice"); }; log { source(src); filter(f_newsnotice); destination(newserr); }; # # enable this, if you want to keep all news messages # in one file #destination news { file("/var/log/news.all"); }; #log { source(src); filter(f_news); destination(news); }; # # all email-messages in one file # destination mail { file("/var/log/mail"); }; log { source(src); filter(f_mail); destination(mail); }; # # all cron-messages in one file # #destination cron { file("/var/log/cron"); }; #log { source(src); filter(f_cron); destination(cron); }; # # Some boot scripts require local7 # destination localmessages { file("/var/log/localmessages"); }; log { source(src); filter(f_local); destination(localmessages); }; # # all messages except the facilities news and mail # destination messages { file("/var/log/messages"); }; log { source(src); filter(f_messages); destination(messages); }; # # enable this, if you want all iptables messages # in one file # #destination firewall { file("/var/log/firewall"); }; #log { source(src); filter(f_iptables); destination(firewall); }; # # Warnings in one file # destination warn { file("/var/log/warn"); }; log { source(src); filter(f_warn); destination(warn); }; # # enable this, if you want to keep all messages in one file #destination allmessages { file("/var/log/allmessages"); }; #log { source(src); destination(allmessages); }; # PIX source network { udp () ; tcp (); }; log{source(network);filter(f_pix);destination(pixlog);}; destination pixlog { file("/var/log/pix.log"); }; filter f_pix { facility(local4); }; test:/etc/syslog-ng # Bill Nash <billn(a)billn.net> wrote: What about your log directives? log { source(network); destination(pixlog); flags(final); }; - billn On Wed, 9 Jun 2004, Ben Whittaker wrote: > Yes, Pix was logging to Kiwi > > Bill Nash wrote: > Stupid question, but: > Did you configure your PIX to export logs to your log server? > > If it behaves like IOS, it's something as simple as: > logging > > - billn > > On Wed, 9 Jun 2004, Ben Whittaker wrote: > > > How do I setup syslog-ng for cisco pix. > > > > I have added the following lines to my config > > > > # PIX > > source network { udp () ; tcp (); }; > > > > destination pixlog { file("/var/log/pix.log"); }; > > > > filter f_pix { facility(local4); }; > > > > > > > > but I am not getting any logging to this new syslog server. > > > > > > > > > > __________________________________ > > Do you Yahoo!? > > Friends. Fun. Try the all-new Yahoo! Messenger. > > http://messenger.yahoo.com/ > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > --------------------------------- > Do you Yahoo!? > Friends . Fun. Try the all-new Yahoo! Messenger _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _____ Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! <http://messenger.yahoo.com/> Messenger ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

2 1

RE: [syslog-ng]Cisco Pix configuration
by Madziarczyk, Jonathan 09 Jun '04

09 Jun '04

I believe you also need a log statement similar to below in your syslog-ng.conf: log{source(network);filter(f_pix);destination(pixlog);}; Also, your pix should have the following commands: logging on logging facility 4 logging trap {level...i.e. informational, debugging, etc} logging host inside {IP address of logging server} Hope this helps, Jon -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Ben Whittaker Sent: Wednesday, June 09, 2004 1:58 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Cisco Pix configuration How do I setup syslog-ng for cisco pix. I have added the following lines to my config # PIX source network { udp () ; tcp (); }; destination pixlog { file("/var/log/pix.log"); }; filter f_pix { facility(local4); }; but I am not getting any logging to this new syslog server. __________________________________ Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger. http://messenger.yahoo.com/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

relay host not reporting itself as IP
by Bill 08 Jun '04

08 Jun '04

Greetings, What options should I use in order to make a relay host report itself as it's IP and not hostname? I have a centralized server and various parsing scripts that expect ip addresses as a source, but for some reason, the actual remote syslog servers are logging it's information as its hostname, and not ip. What options, or websites should I check out to read more about the configuration options for ng? Thanks in advance,

3 2

RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 04 Jun '04

04 Jun '04

Hi, now I have it. RTFM :D I forgot to touch a new sources.c.x Many thx @all specially to Bazsi for coding. Does this fix stay in the new releases or do I have to apply the fix evertime I update my syslog-ng? regards, Benjamin michihito matsubara wrote: > Hi. > > i've been watching for this thread because of my old YAMAHA ISDN > router has same output as well as Benjamin's. > > On Fri, 4 Jun 2004 14:45:15 +0200 > Subject: RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line > Benjamin.Zoeller(a)salt-solutions.de wrote: > >> Sorry I can't compile this. Get the following error. > > Done againt syslog-ng-1.6.4+20040604 and gotya. > on Linux, gcc-3.3.2, glibc-2.3.1, libnet-1.1.1. > Now, there is no ^@ code at each end of lines. > Works very fine. > >>> Can you check if this patch works? (it fixed the problem for me) >>> >>> diff -u -r1.37.4.2 sources.c >>> --- src/sources.c 10 Mar 2004 18:43:28 -0000 1.37.4.2 >>> +++ src/sources.c 4 Jun 2004 12:28:26 -0000 >>> @@ -120,6 +120,13 @@ >>> full or we are a datagram receiver, when the >>> message is in its own packet. >>> */ >>> + if (closure->dgram) { >>> + /* strip one trailing LF or NUL character */ >>> + if (closure->pos > 0 && >>> + (closure->buffer[closure->pos - 1] == >>> '\n' || + closure->buffer[closure->pos - >>> 1] == '\0')) + closure->pos--; + >>> } do_handle_line(closure, closure->pos, >>> closure->buffer, salen ? (abstract_addr *) &sabuf : >>> NULL, salen); closure->pos = 0; return ST_OK | >>> ST_GOON; > > > Benjamin, > > looks like you missed something for the patch. > double check and try again. you can make it, too. > This patch is nothing but a clean and simple. > > regards, > mitch

2 1

Syslog Config and Cisco, Max Tnt
by Evan Himmel 04 Jun '04

04 Jun '04

I have all the hardware configured correctly. My problem is that I have separate filters setup for my MAX TNT and Cisco Gear to log into different directories. One...everything logs in both my Cisco and Modems directory and two I am no longer getting as much detail as I did with the Cisco Gear. below is my config for the Cisco Gear and TNT. #Logging for CISCO Devices destination d_cisco_devices { file("/var/log/cisco/$HOST.log"); }; # This is out destination file. Each host will get it's own log file # which is nice when you start using log checkers to email you about # things in your log file. filter f_cisco_info { level(info); }; filter f_cisco_notice { level(notice); }; filter f_cisco_warn { level(warn); }; filter f_cisco_crit { level(crit); }; filter f_cisco_err { level(err); }; filter f_cisco_debug { level(debug..emerg); }; # Sets up out filters. The thing to remember is Cisco's log at various # levels by default unlike a lot fo daemons. log { source(s_net); filter(f_cisco_info); destination(d_cisco_devices); }; log { source(s_net); filter(f_cisco_notice); destination(d_cisco_devices); }; log { source(s_net); filter(f_cisco_warn); destination(d_cisco_devices); }; log { source(s_net); filter(f_cisco_crit); destination(d_cisco_devices); }; log { source(s_net); filter(f_cisco_err); destination(d_cisco_devices); }; log { source(s_net); filter(f_cisco_debug); destination(d_cisco_devices); }; # Takes the logs our filters and passes them to our destination. Obviously # you can do some really interestng things with this, but I haven't # figured them out yet. #Logging for TNT MAX Devices destination d_modems_devices { file("/var/log/modems/$HOST.log"); }; # This is out destination file. Each host will get it's own log file # which is nice when you start using log checkers to email you about # things in your log file. filter f_modems_info { level(info); }; filter f_modems_notice { level(notice); }; filter f_modems_warn { level(warn); }; filter f_modems_crit { level(crit); }; filter f_modems_err { level(err); }; # Sets up out filters. log { source(s_net); filter(f_modems_info); destination(d_modems_devices); }; log { source(s_net); filter(f_modems_notice); destination(d_modems_devices); }; log { source(s_net); filter(f_modems_warn); destination(d_modems_devices); }; log { source(s_net); filter(f_modems_crit); destination(d_modems_devices); }; log { source(s_net); filter(f_modems_err); destination(d_modems_devices); }; # Takes the logs our filters and passes them to our destination. Obviously # you can do some really interestng things with this, but I haven't # figured them out yet. Evan Himmel Network Engineer PrimeLink, Inc. (518) 324-5465 http://www.primelink1.net

1 0

RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 04 Jun '04

04 Jun '04

Sorry I can't compile this. Get the following error. Making all in src make[1]: Entering directory `/usr/src/syslog-ng-1.6.4/src' make all-recursive make[2]: Entering directory `/usr/src/syslog-ng-1.6.4/src' Making all in . make[3]: Entering directory `/usr/src/syslog-ng-1.6.4/src' gcc -DHAVE_CONFIG_H -I. -I/usr/src/syslog-ng-1.6.4/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c main.c make_class <sources.c >sources.c.xT /bin/sh: /usr/local/bin/make_class: \: bad interpreter: No such file or directory make[3]: *** [sources.c.x] Error 126 make[3]: Leaving directory `/usr/src/syslog-ng-1.6.4/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/syslog-ng-1.6.4/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/src/syslog-ng-1.6.4/src' make: *** [all-recursive] Error 1 Balazs Scheidler wrote: > 2004-06-04, p keltezéssel 13:34-kor Benjamin.Zoeller(a)salt-solutions.de > ezt írta: >> Hi again, >> here is an tcpdump with parameter -s 255 thx to jozsef >> >> 13:24:30.357952 000.000.000.000.syslog-ng > >> 000.000.000.000.syslog-ng: udp 83 0x0000 4500 006f d16e 0000 3e11 >> 938c 0000 0000 E..o.n..>....... 0x0010 0000 0000 0202 0202 >> 005b 902c 3c31 3430 .........[.,<140 0x0020 3e41 4343 543a >> 204c 4f47 494e 2046 4149 >ACCT:.LOGIN.FAI 0x0030 4c45 4420 >> 6173 2079 6164 2066 726f 6d20 LED.as.yad.from. 0x0040 5445 >> 4c4e 4554 2031 302e 3139 392e 322e TELNET.10.199.2. 0x0050 >> 3635 2061 7420 4672 6920 4a75 6e20 2034 65.at.Fri.Jun..4 >> 0x0060 2031 323a 3234 3a32 3820 3230 3034 00 >> .12:24:28.2004. >> >> @John >> thx for your hint, but I think it`s to late now. >> I simply forgot to hide this in the hex part. >> >> @all >> Hope somebody can tell me why I get ^@ at each line. >> > > Can you check if this patch works? (it fixed the problem for me) > > diff -u -r1.37.4.2 sources.c > --- src/sources.c 10 Mar 2004 18:43:28 -0000 1.37.4.2 > +++ src/sources.c 4 Jun 2004 12:28:26 -0000 > @@ -120,6 +120,13 @@ > full or we are a datagram receiver, when the > message is in its own packet. > */ > + if (closure->dgram) { > + /* strip one trailing LF or NUL character */ > + if (closure->pos > 0 && > + (closure->buffer[closure->pos - 1] == > '\n' || + closure->buffer[closure->pos - > 1] == '\0')) + closure->pos--; > + } > do_handle_line(closure, closure->pos, > closure->buffer, salen ? (abstract_addr *) &sabuf : > NULL, salen); closure->pos = 0; return ST_OK | > ST_GOON;

2 1