June 2004 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]memory-based ringbuffer
by tc1＠mydot.org 04 Jun '04

04 Jun '04

> > I was just thinking if you have any plans to implement > > something along > > the lines of a memory-based ringbuffer into Syslog-NG. To > > me it sounds > > like a useful feature. > > ... > > interesting idea, though the feature is primarily meant for diskless > clients where no local storage exists. what is the point for > central log > servers? (where syslog-ng is primarily used) Well, the point being that you could use syslog-ng also for the diskless clients. That way all the fancy, less traditional, "non-standard" syslog-ng features can be used also client-side - such as forwarding over TCP (+ stunnel) and extensive support for filtering. Thoralf

1 0

RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 04 Jun '04

04 Jun '04

Hi again, here is an tcpdump with parameter -s 255 thx to jozsef 13:24:30.357952 000.000.000.000.syslog-ng > 000.000.000.000.syslog-ng: udp 83 0x0000 4500 006f d16e 0000 3e11 938c 0000 0000 E..o.n..>....... 0x0010 0000 0000 0202 0202 005b 902c 3c31 3430 .........[.,<140 0x0020 3e41 4343 543a 204c 4f47 494e 2046 4149 >ACCT:.LOGIN.FAI 0x0030 4c45 4420 6173 2079 6164 2066 726f 6d20 LED.as.yad.from. 0x0040 5445 4c4e 4554 2031 302e 3139 392e 322e TELNET.10.199.2. 0x0050 3635 2061 7420 4672 6920 4a75 6e20 2034 65.at.Fri.Jun..4 0x0060 2031 323a 3234 3a32 3820 3230 3034 00 .12:24:28.2004. @John thx for your hint, but I think it`s to late now. I simply forgot to hide this in the hex part. @all Hope somebody can tell me why I get ^@ at each line. Thx Benjamin John Kristoff wrote: > On Fri, 4 Jun 2004 10:52:11 +0200 > Benjamin.Zoeller(a)salt-solutions.de wrote: > >> 10:49:09.668790 .syslog-ng > .syslog-ng: udp 85 >> 0x0000 4500 0071 cfed 0000 3e11 950b 0ac6 00fd >> E..q....>....... 0x0010 0ac7 00fa 0202 0202 005d 1cd7 3c31 3430 >> .........]..<140 > > If you're going to go through the trouble of hiding IPs, you should > mask the hex portion as well. Though your use of 10/8 offers you > some privacy already I suppose. > > John

3 2

memory-based ringbuffer
by tc1＠mydot.org 04 Jun '04

04 Jun '04

Hi, I was just thinking if you have any plans to implement something along the lines of a memory-based ringbuffer into Syslog-NG. To me it sounds like a useful feature. Here the reference to the functionality in BSD: http://www.openbsd.org/cgi-bin/man.cgi?query=syslogc&sektion=8 One alternative possibility that I am aware of would be to use this kernel module: http://www.circlemud.org/~jelson/software/emlog/ But I still think that from a manageability point of view it might be easier to have this functionality in the syslog daemon. Having it there also reduces the number of copying around the same information. Thoralf

2 1

RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 04 Jun '04

04 Jun '04

Hi Balazs, it is very curios. The some tcpdumps gives me not all characters. Perhaps this is the problem??? Here some new ones: 10:49:09.668790 .syslog-ng > .syslog-ng: udp 85 0x0000 4500 0071 cfed 0000 3e11 950b 0ac6 00fd E..q....>....... 0x0010 0ac7 00fa 0202 0202 005d 1cd7 3c31 3430 .........]..<140 0x0020 3e41 4343 543a 204c 4f47 494e 2046 4149 >ACCT:.LOGIN.FAI 0x0030 4c45 4420 6173 2061 646d 696e 2066 726f LED.as.admin.fro 0x0040 6d20 5445 4c4e 4554 2031 302e 3139 392e m.TELNET.10.199. 0x0050 322e 2. 10:49:27.116598 .syslog-ng > .syslog-ng: udp 82 0x0000 4500 006e cff6 0000 3e11 9505 0ac6 00fd E..n....>....... 0x0010 0ac7 00fa 0202 0202 005a 0e93 3c31 3430 .........Z..<140 0x0020 3e41 4343 543a 204c 4f47 494e 2046 4149 >ACCT:.LOGIN.FAI 0x0030 4c45 4420 6173 2031 3220 6672 6f6d 2054 LED.as.12.from.T 0x0040 454c 4e45 5420 3130 2e31 3939 2e32 2e36 ELNET.10.199.2.6 0x0050 3520 5. 10:52:18.644121 .syslog-ng > .syslog-ng: udp 84 0x0000 4500 0070 d007 0000 3e11 94f2 0ac6 00fd E..p....>....... 0x0010 0ac7 00fa 0202 0202 005c 6ef8 3c31 3430 .........\n.<140 0x0020 3e41 4343 543a 204c 4f47 494e 2046 4149 >ACCT:.LOGIN.FAI 0x0030 4c45 4420 6173 2061 7364 6620 6672 6f6d LED.as.asdf.from 0x0040 2054 454c 4e45 5420 3130 2e31 3939 2e32 .TELNET.10.199.2 0x0050 2e36 .6 10:52:21.290085 .syslog-ng > .syslog-ng: udp 85 0x0000 4500 0071 d015 0000 3e11 94e3 0ac6 00fd E..q....>....... 0x0010 0ac7 00fa 0202 0202 005d 3f3a 3c31 3430 .........]?:<140 0x0020 3e41 4343 543a 204c 4f47 494e 2046 4149 >ACCT:.LOGIN.FAI 0x0030 4c45 4420 6173 2077 7433 3435 2066 726f LED.as.wt345.fro 0x0040 6d20 5445 4c4e 4554 2031 302e 3139 392e m.TELNET.10.199. 0x0050 322e 2. Balazs Scheidler wrote: > 2004-06-03, cs keltezéssel 15:57-kor > Benjamin.Zoeller(a)salt-solutions.de ezt írta: >> Loic Minier wrote: >>> Benjamin.Zoeller(a)salt-solutions.de - Thu, Jun 03, 2004: >>> >>>>> The problem is that I can't see the log line itself, thus I am >>>>> unable here my log: >>> >>> I think you should send the content of the network packets >>> (containing the log lines). This is achieved with tcpdump -X or >>> -XX under Linux, check man tcpdump if you're running something >>> else. >> >> ah, ok. >> Now I understand here an login attempt. >> >> 15:58:19.707437 XX.XXX.X.XXX.syslog-ng > XXX.XXX.XX.syslog-ng: udp 85 >> 0x0000 4500 0071 ca25 0000 3e11 9ad3 0ac6 00fd >> E..q.%..>....... 0x0010 0ac7 00fa 0202 0202 005d 04d1 3c31 3430 >> .........]..<140 0x0020 3e41 4343 543a 204c 4f47 494e 2046 4149 >> >ACCT:.LOGIN.FAI 0x0030 4c45 4420 6173 2061 646d 696e 2066 726f >> LED.as.admin.fro 0x0040 6d20 5445 4c4e 4554 2031 302e 3139 392e >> m.TELNET.10.199. 0x0050 322e >> 2. > > I'm afraid but this is not a complete packet. tcpdump says it is 85 > bytes long, but it is 82 only, and as it seems the line itself is not > complete either (the last IP address is terminated after the third > number) > > I sent the same message to my local syslog-ng process but there was no > NUL character appended.

3 2

syslog-ng kerdes
by SZOKOVACS Robert 04 Jun '04

04 Jun '04

Hello, hogyan lehet a syslog-ng-t ravenni, hogy a sok egymast koveto egyforma uzeneteket osszegroupolja es csak annyit mondjon, hogy 'repeated n times'? Tudja ezt egyaltalan? koszi Szo

3 4

RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 04 Jun '04

04 Jun '04

Loic Minier wrote: > Benjamin.Zoeller(a)salt-solutions.de - Thu, Jun 03, 2004: > >>> The problem is that I can't see the log line itself, thus I am >>> unable here my log: > > I think you should send the content of the network packets > (containing the log lines). This is achieved with tcpdump -X or -XX > under Linux, check man tcpdump if you're running something else. ah, ok. Now I understand here an login attempt. 15:58:19.707437 XX.XXX.X.XXX.syslog-ng > XXX.XXX.XX.syslog-ng: udp 85 0x0000 4500 0071 ca25 0000 3e11 9ad3 0ac6 00fd E..q.%..>....... 0x0010 0ac7 00fa 0202 0202 005d 04d1 3c31 3430 .........]..<140 0x0020 3e41 4343 543a 204c 4f47 494e 2046 4149 >ACCT:.LOGIN.FAI 0x0030 4c45 4420 6173 2061 646d 696e 2066 726f LED.as.admin.fro 0x0040 6d20 5445 4c4e 4554 2031 302e 3139 392e m.TELNET.10.199. 0x0050 322e 2.

2 1

Streams error in messages and debug mode
by Fahey Owens 04 Jun '04

04 Jun '04

I'm receiving the following error "do_stream_read: STREAMS device gave too long line" when I start syslog-ng -d -v. My config file is below, thanks in advance options { use_fqdn(yes); keep_hostname(yes); use_dns(no); long_hostnames(off); sync(0); log_fifo_size(1000); }; # # local and network sources # # + will accept udp/tcp connections on port 514 from any host # + keepalive option is for tcp only and will keep connection open # when the SIGHUP signal is seen # source local { sun-streams("/dev/log" max-connections(10) door("/etc/.syslog_doo r")); internal(); }; source network { udp(); tcp(0.0.0.0) port(514); }; # # standard destinations for local standard system messages # destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination kern { file("/var/log/kern.log"); }; destination maillog { file("/var/log/maillog"); }; --------------------------------- Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger

2 1

syslog-ng
by Michael Earls 03 Jun '04

03 Jun '04

I want to add filting based on certain domain names to create a new file for each domain name. I want to use the sql template below to create the files. # This files are the log come from the mail subsystem. # destination mail { file("/var/log/data/maillog.$YEAR.$MONTH.$DAY.$HOUR.$MIN.$SEC" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; Can someone help me out with the configuration? Thanks, michael Michael Earls Systems Analyst, Information Services Cincinnati Children's Hospital Medical Center Phone: 513-636-5882 Phone: 1-800-344-2462 Pager: 513-303-8311

1 0

RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 03 Jun '04

03 Jun '04

Balazs Scheidler wrote: > 2004-06-03, cs keltezéssel 13:12-kor > Benjamin.Zoeller(a)salt-solutions.de ezt írta: >> Hi Bazsi, >> hier the tcpdump: >> 13:13:19.293263 xxx.xxx.xxx.xx.514 > xx.xxx.x.xxx.514: udp 72 (ttl >> 28, id 41895, len 100) 13:13:19.327089 xxx.xxx.xxx.xx.514 > >> xx.xxx.x.xxx.514: [udp sum ok] udp 42 (ttl 28, id 41896, len 70) >> 13:13:21.819284 xxx.xxx.xxx.xx.514 > xx.xxx.x.xxx.514: udp 57 (ttl >> 28, id 41897, len 85) 13:13:21.945776 xxx.xxx.xxx.xx.514 > >> xx.xxx.x.xxx.514: [udp sum ok] udp 48 (ttl 28, id 41898, len 76) >> >> At the moment I am using version 1.5.26 which also works correctly. > > The problem is that I can't see the log line itself, thus I am unable > to determine why syslog-ng adds that '^@' character. > > Are you sure you were using 1.6.4 ? 1.6.0rc4 contained support for > parsing PIX timestamps and it added this additional NUL character when > PIX or PIX like stamps were received, but this was fixed in 1.6.1 Hi, here my Changelog: 2004-05-14 Balazs Scheidler <bazsi(a)bzorp.balabit> * configure.in: bumped version number to 1.6.4 here my log: May 27 10:16:25 XX.XXX.X.XXX PPP: XXX : outgoing connection established^@ May 27 10:16:25 XX.XXX.X.XXX SNMP: sent TRAP(linkUp,0) 112 bytes to XX.XXX.XXX.XXX Port 162^@ May 27 10:16:26 XX.XXX.X.XXX SNMP: sent TRAP(linkUp,0) 112 bytes to XX.XXX.XXX.XXX Port 162^@ May 27 10:19:42 XX.XXX.X.XXX PPP: XXX : outgoing connection closed, duration 197 sec, 104450 bytes received, 9237 bytes sent, 3 charging units, 0 charging amounts^@ I compiled with --enable-debug is this a problem? Our routers are from bintec. Modelname is BIANCA/BRICK.

2 1

RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 03 Jun '04

03 Jun '04

Hi Bazsi, hier the tcpdump: 13:13:19.293263 xxx.xxx.xxx.xx.514 > xx.xxx.x.xxx.514: udp 72 (ttl 28, id 41895, len 100) 13:13:19.327089 xxx.xxx.xxx.xx.514 > xx.xxx.x.xxx.514: [udp sum ok] udp 42 (ttl 28, id 41896, len 70) 13:13:21.819284 xxx.xxx.xxx.xx.514 > xx.xxx.x.xxx.514: udp 57 (ttl 28, id 41897, len 85) 13:13:21.945776 xxx.xxx.xxx.xx.514 > xx.xxx.x.xxx.514: [udp sum ok] udp 48 (ttl 28, id 41898, len 76) At the moment I am using version 1.5.26 which also works correctly. Greetings Benjamin Balazs Scheidler wrote: > 2004-05-28, p keltezéssel 13:35-kor Benjamin.Zoeller(a)salt-solutions.de > ezt írta: >> Hi, >> I have a problem with syslogs from my bintec routers. >> The logs all have ^@ at the end of each line. >> This problem appears since I am using syslog-ng 1.6.4. >> Bevor I used the version 1.4.x., there were no problems. >> Please help. > > can you give me a tcpdump of the traffic (a single line is enough) ?

2 1