July 2004 - syslog-ng - lists.balabit.hu

[Q]Syslog-ng 1.6.4 compile help
by Martin Raines (mraines) 16 Jul '04

16 Jul '04

Team, I have Solaris 8 and syslog-ng 1.6.4 and libol 3.13 I would appreciate some clear intructions on how to get them compliled on my system please. I have them installed OK using pkgadd but cannot find any info about getting them compliled. Many thanks Martin

1 0

RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers
by Amaral, Angelo 16 Jul '04

16 Jul '04

My name is Angelo, And I have equal problem of Joe Geek I compile the syslog-ng with support tcpwrappers. I put in hosts.deny my filter and log come in. Thanks. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Joe Geek Sent: quinta-feira, 15 de julho de 2004 18:41 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers I've got syslog-ng v 1.6.4 compiled with tcp_wrapper support and tried to block a particular ipaddress in hosts.deny Does the syslog-ng daemon have to be started from inetd for this to work? Does syslog-ng use tcp_wrappers for UDP traffic also? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers
by Rule, Ted 16 Jul '04

16 Jul '04

In /etc/hosts.allow you need something like this listing all the permitted clients and denying anything else. syslog-ng: 172.22.2.13: allow syslog-ng: 172.18.112.3: allow syslog-ng: ALL: deny It doesn't need any inetd configuration. I don't believe it works for UDP, but I wouldn't lockout UDP syslog traffic that way anyway; better to block it at the layer beneath with ipchains/iptables/ipfilter or similar. For extra resilience where a firewall separates the syslog-ng client and server, I added some TCP Keepalive code to ensure a relatively quiet syslog-ng TCP stream is always kept alive in the face of Firewall-1/iptables idling out the connection, but it's not essential, and it may even have been included in later releases anyway. Ted $ diff -u afinet.c-1.6.0rc3.orig afinet.c-1.6.0rc3.patched --- afinet.c-1.6.0rc3.orig Sat Feb 28 11:42:50 2004 +++ afinet.c-1.6.0rc3.patched Sat Feb 28 11:42:50 2004 @@ -28,6 +28,8 @@ #include "cfgfile.h" #include "pkt_buffer.h" +#include <sys/socket.h> +#include <sys/types.h> #include <errno.h> #include <string.h> #include <assert.h> @@ -217,8 +219,13 @@ CAST(afinet_source, self, c); struct afsocket_source_connection *conn; UINT32 res; + int socklen,sockval; + + socklen=sizeof(sockval); + if ( ( getsockopt(client->super.fd, SOL_SOCKET, SO_TYPE, &sockval, &socklen) == 0 ) && + ( sockval == SOCK_STREAM ) ) { #if ENABLE_TCP_WRAPPER - { + { struct request_info req; request_init(&req, RQ_DAEMON, "syslog-ng", RQ_FILE, client->super.fd, 0); @@ -230,9 +237,19 @@ close_fd(&client->super, 0); return ST_OK | ST_GOON; } + } +#endif + +#ifdef SO_KEEPALIVE + sockval=1; socklen=sizeof(sockval); + if ( setsockopt(client->super.fd, SOL_SOCKET, SO_KEEPALIVE, &sockval, socklen) < 0 ) { + notice("setsockopt SO_KEEPALIVE failure during do_open_afinet_connection()"); + } else { + notice("setsockopt SO_KEEPALIVE Ok in do_open_afinet_connection()"); } - #endif + } + if (c->num_connections >= c->max_connections) { CAST(inet_address_info, inet_addr, client_addr); @@ -250,8 +267,6 @@ } return res; } - - } static int @@ -488,6 +503,17 @@ if (self->conn_fd) { return ST_OK | ST_GOON; +#ifdef SO_KEEPALIVE + if ( (self->super.flags & 0x0003) == AFSOCKET_STREAM ) { + int sockval=1; + + if ( setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &sockval, sizeof(sockval)) < 0 ) { + notice("setsockopt SO_KEEPALIVE failure during do_init_afinet_dest()"); + } else { + notice("setsockopt SO_KEEPALIVE Ok in do_init_afinet_dest()"); + } + } +#endif } else { io_callout(self->cfg->backend, $ Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

syslog-ng 1.6.4 and tcp_wrappers
by Joe Geek 15 Jul '04

15 Jul '04

I've got syslog-ng v 1.6.4 compiled with tcp_wrapper support and tried to block a particular ipaddress in hosts.deny Does the syslog-ng daemon have to be started from inetd for this to work? Does syslog-ng use tcp_wrappers for UDP traffic also?

1 0

syslog-ng NOT Reading source file, which grows. HELP!
by alex 15 Jul '04

15 Jul '04

Hello, I have compiled syslog-ng (latest ver syslog-ng 1.6.4) on AIX 5.1 and have configured the client to send sudo logs to the centrilized server. The Network part is working fine, and I know my binary compiled OK. In addition to sudo activity logging I was going to send logs, produced by the other daemon--sudoscriptd--which logs all root shell activities to some predefined file on the same server (for testing) and later I will send it too. In my case: var/log/sudoscript. I was going to centrilized this one as well, but for now I can't figured out why syslog-ng is NOT READING from the source file. Also, I was trying: source sudo_scr {pipe("/var/log/sudoscript"); }; - with no success. PLEASE HELP! ##HERE IS MY syslon-ng.conf#### #cat syslog-ng.conf options { sync (0); mark (10); time_reopen (10); log_fifo_size (2000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source sys { unix-dgram("/dev/log" ); internal(); }; #STANDARD staff. This works. source sudo_scr {file("/var/log/sudoscript"); }; # THIS IS FILE WHICH GROWS as sudoscript writes to it. #syslog-ng CAN"T READ from it. destination internal_1 { file("/var/log/sudologs/sudolog"); }; #THIS IS TEMP. DESTINATION FILE (EMPTY?) destination host01 { tcp(1.5.7.15 port(514)); }; #THIS IS WORKING PART TOO filter f_sudo { facility(local2); }; log { source(sudo_scr); destination(internal_1); }; # THIS IS NOT WORKING PART log { source(sys); filter(f_sudo); destination(host01); }; # THIS PART IS WORKING

2 1

difference between 1.6.4 & 1.7.0 branches?
by OpenMacNews 15 Jul '04

15 Jul '04

hi, can someone clarify the difference between the 1.6.4 & 1.7.0 branches? the 1.7.0 branch doesn't seem to have been touched for awhile, but the 1.6.4 branch seems current ... syslog-ng-1.6.4+20040710.tar.gz 07/10/2004 syslog-ng-1.7.0+20040514.tar.gz 05/14/2004 i'm building on OSX 10.3.4, and have read others have used 1.7.0 .... is there a reason? which branch is 'best'? thanks! richard

2 1

RE: [syslog-ng]syslog-ng on Sol8 - newbie questions
by jbrunke＠ctsgi.com 14 Jul '04

14 Jul '04

For whatever reason, my syslogd probe IS configured to listen on the UDP port by default... I confirmed this by stopping syslogd, starting syslog-ng and then trying to restart syslogd. Syslogd would not start because it could not hook to port 514... Creating the /etc/default/syslogd was the answer. There is also a "-t" option for syslogd that may also do the same thing. As for your other suggestion. I was unable to get syslogd to forward anything to @localhost. It would complain at startup it was undefined (it is not). When I put @theactualhostname, no compaints on startup, but that didn't seem to do it either. So I went back and took the @theactualhostname definition out of syslogd.conf (making syslogd.conf "stock") and put the sun-streams src back in syslog-ng. That seems to have done the trick. Both syslogd and syslog-ng "see" local system messages and take appropriate action(s). So I guess there is no issue with syslog & syslog-ng "sharing" the /dev/log stream. Can someone confirm I won't run into problems with this config? So now I believe I have the best of both worlds... The SA can have his syslog.conf file and whatever files he wants to do there. All remote syslog traffic is received and managed by syslog-ng. The SA never liked the fact that forwarded syslog messages "gummed up" /var/adm/messages anyway... ;-) Thanks, Jim Brunke ------------------------------------------------------------------------------- - From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng- admin(a)lists.balabit.hu] On Behalf Of Pedroche, Raúl Sent: Wednesday, July 14, 2004 3:52 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]syslog-ng on Sol8 - newbie questions The idea would be configuring syslogd to not to listen on UDP and send messages to it, while syslog-ng listens on UDP socket and does not read from /dev/log. You can add a line "LOG_FROM_REMOTE=NO" to /etc/default/syslogd (but it should not be necessary, as Solaris syslogd does not listen on UDP port by default) and add a line to /etc/syslog.conf alike to whatever.whatever,*.somethingelse @localhost Then create (and use) an UDP source in syslog-ng.conf and NOT a source of type sun-streams. -----Original Message----- From: jbrunke(a)ctsgi.com [mailto:jbrunke@ctsgi.com] Sent: Tuesday, July 13, 2004 10:18 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng on Sol8 - newbie questions I'm running Solaris 8. I would like to setup syslog-ng and syslogd to operate together. Reading the faq, it says: Q: I'm new to syslog-ng. Is there a way for syslog-ng and syslogd to co- exist?... A: Yes, syslog-ng can accept messages from stock syslogd using the udp() source. Can anyone give me more specifics on how to setup the source for this setup? We've got syslogs forwarded from our network gear to this box so I want to make sure syslog-ng can get those forwarded messages from syslogd. Also, can anyone give a suggested filter setup for the following syslog.conf entry: local7.notice;*.err;kern.debug;daemon.notice;mail.none /var/log/error.log Thanks, Jim _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

1 0

RE: [syslog-ng]syslog-ng on Sol8 - newbie questions
by "Pedroche, Raúl" 14 Jul '04

14 Jul '04

The idea would be configuring syslogd to not to listen on UDP and send messages to it, while syslog-ng listens on UDP socket and does not read from /dev/log. You can add a line "LOG_FROM_REMOTE=NO" to /etc/default/syslogd (but it should not be necessary, as Solaris syslogd does not listen on UDP port by default) and add a line to /etc/syslog.conf alike to whatever.whatever,*.somethingelse @localhost Then create (and use) an UDP source in syslog-ng.conf and NOT a source of type sun-streams. -----Original Message----- From: jbrunke(a)ctsgi.com [mailto:jbrunke@ctsgi.com] Sent: Tuesday, July 13, 2004 10:18 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng on Sol8 - newbie questions I'm running Solaris 8. I would like to setup syslog-ng and syslogd to operate together. Reading the faq, it says: Q: I'm new to syslog-ng. Is there a way for syslog-ng and syslogd to co- exist?... A: Yes, syslog-ng can accept messages from stock syslogd using the udp() source. Can anyone give me more specifics on how to setup the source for this setup? We've got syslogs forwarded from our network gear to this box so I want to make sure syslog-ng can get those forwarded messages from syslogd. Also, can anyone give a suggested filter setup for the following syslog.conf entry: local7.notice;*.err;kern.debug;daemon.notice;mail.none /var/log/error.log Thanks, Jim _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

1 0

syslog-ng on Sol8 - newbie questions
by jbrunke＠ctsgi.com 13 Jul '04

13 Jul '04

I'm running Solaris 8. I would like to setup syslog-ng and syslogd to operate together. Reading the faq, it says: Q: I'm new to syslog-ng. Is there a way for syslog-ng and syslogd to co- exist?... A: Yes, syslog-ng can accept messages from stock syslogd using the udp() source. Can anyone give me more specifics on how to setup the source for this setup? We've got syslogs forwarded from our network gear to this box so I want to make sure syslog-ng can get those forwarded messages from syslogd. Also, can anyone give a suggested filter setup for the following syslog.conf entry: local7.notice;*.err;kern.debug;daemon.notice;mail.none /var/log/error.log Thanks, Jim

1 0

syslog-ng conf confusion
by Chet Harvey 13 Jul '04

13 Jul '04

Hi all, I am trying to change a box from syslog to syslog-ng but I cant quite get the syntax down. I was hoping someone could steer me in the right direction. Here is my current syslog.conf: local0.* %/var/log/filter.log local7.* %/var/log/dhcpd.log *.notice;kern.debug;lpr.info;mail.crit;news.err;local0.none;local7.none %/var/log/system.log security.* %/var/log/system.log auth.info;authpriv.info;daemon.info %/var/log/system.log *.emerg * This is how I did my syslog-ng.conf: # # This sample configuration file is essentially equilivent to the stock # FreeBSD /etc/syslog.conf file. # # # options options { long_hostnames(off); sync(0); }; source src { unix-stream("/var/run/log"); pipe("/dev/klog"); internal(); }; destination dest { file("/var/log/filter.log"); }; destination stunnel { tcp("127.0.0.1" port(514)); }; log { source(src);destination(dest); }; log { source(src);destination(stunnel); }; # # destinations # destination messages { file("/var/log/system.log"); }; destination firewall { file("/var/log/filter.log"); }; destination dhcp { file("/var/log/dhcp.log"); }; # log facility filters # filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_console { facility(console); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # # log level filters # filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info..emerg); }; filter f_debug { level(debug..emerg); }; # # *.err;kern.debug;auth.notice;mail.crit /dev/console # # # *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages # log { source(src); filter(f_notice); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # # security.* /var/log/security # log { source(src); filter(f_security); destination(messages); }; ## firewall specific log { source(src); filter(f_local0); destination(firewall); }; log { source(src); filter(f_local7); destination(dhcp); }; Hopelessly lost......thanks for any insight/education... -- Chet

1 0