August 2004 - syslog-ng - lists.balabit.hu

not match()
by markzero＠logik.ath.cx 16 Aug '04

16 Aug '04

# $Xanthus: syslog-ng.conf,v 1.1 2004/07/27 02:56:44 markzero Exp $ # syslog-ng config # options { long_hostnames(off); create_dirs(yes); owner(_syslogng); group(_syslogng); perm(0600); dir_owner(_syslogng); dir_group(_syslogng); dir_perm(0700); use_dns(no); sync(0); }; source src { unix-dgram("/dev/log" owner("_syslogng") group("_syslogng") perm(0600)); internal(); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination mail { file("/var/log/mail.log"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; #destination console { usertty("root"); }; #destination console_all { file("/dev/tty12"); }; #destination loghost { udp("loghost" port(999)); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_no_stats { not match("STATS: dropped 0"); }; log { source(src); filter(f_authpriv); filter(f_no_stats); destination(authlog); }; log { source(src); filter(f_syslog); filter(f_no_stats); destination(syslog); }; log { source(src); filter(f_cron); filter(f_no_stats); destination(cron); }; log { source(src); filter(f_daemon); filter(f_no_stats); destination(daemon); }; log { source(src); filter(f_kern); filter(f_no_stats); destination(kern); }; log { source(src); filter(f_lpr); filter(f_no_stats); destination(lpr); }; log { source(src); filter(f_mail); filter(f_no_stats); destination(mail); }; log { source(src); filter(f_user); filter(f_no_stats); destination(user); }; log { source(src); filter(f_uucp); filter(f_no_stats); destination(uucp); }; log { source(src); filter(f_mail); filter(f_no_stats); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_no_stats); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_no_stats); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_no_stats); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_no_stats); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_no_stats); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); filter(f_no_stats); destination(debug); }; log { source(src); filter(f_messages); filter(f_no_stats); destination(messages); }; #log { source(src); filter(f_emergency); filter(f_no_stats); destination(console); }; #log { source(src); destination(console_all); }; Now, let me draw your attention to this line: not match("STATS: dropped 0"); For some reason, I repeatedly get this popping up on the command line: bash-2.05b# STATS: dropped 0 ..when either logged in as root or using su. This doesn't seem to make sense to me, not only is the filter not apparently working,but the lines to log to roots tty are commented out! Anyone had a similar problem? I checked the list archives first, and found a few vague examples of this, but nothing quite the same... mark

2 2

Question
by Jim Gifford 16 Aug '04

16 Aug '04

I have always wondered about this. Why are the libol and syslog-ng separate packages? To me it seems that they should be one package since they depend on each other. -- ---- Jim Gifford maillist(a)jg555.com

2 1

syslog-ng & stunnel, the saga continues
by markzero＠logik.ath.cx 14 Aug '04

14 Aug '04

I'm trying to use stunnel to wrap syslog-ng in SSL. The only problem is that all the documentation for stunnel presumes you're using Red Hat. I'm using OpenBSD. This means I have to generate the certificates myself, and I'm confused here. For a decent level of security, as I understand it, the server needs a certificate, signed by a CA (in this case, as it's for internal networking, the CA is me). What does the client need? I basically created a CA, created a public key and signed it to create the server certificate, what do I need to do for the clients? (I would prefer it if they all had the same certificate, to preserve my sanity). If I hear the phrase "on red hat, go to /usr/share/ssl/certs" one more time, somebody is going to find themselves eating several poorly generated certificates. :) cheers mark

2 2

chroot/syslog-ng/Solaris8
by Roy G Davis 14 Aug '04

14 Aug '04

does anyone have experience using syslog-ng with chroot-ed applications on Solaris 8? specifically, i am running ssh/sftp chroot-ed (with sftp logging patch) and i get no logging. i know it is something about /dev/log etc in the chroot environment but cant find exact info. THX

2 1

Syslog Relay Question
by Stevo 13 Aug '04

13 Aug '04

Hi Team, I currently use Syslog-NG to receive all my router syslog messages. Is there a way I can forward these messages on to another syslog server as well?? Stevo

2 1

Logging to a specific destination
by Anoop Rajendra 12 Aug '04

12 Aug '04

I need to log all messages from iptables, ipmasq to a particular file (say iptables.log) and to that only and nothing else. Is there a way to specifically define this, ie say that messages from this daemon should go nowhere else? i've tried - # IPMasq Messages destination ipmasq { file("/var/log/iptables.log" owner("root") group("adm") perm(0640)); }; filter f_iptables( match("iptables"); ); filter fn_iptables( not match("iptables"); ); log { source(src); filter(f_authpriv); filter(fn_iptab); destination(authlog); }; log { source(src); filter(f_syslog); filter(fn_iptab); destination(syslog); }; log { source(src); filter(f_daemon); filter(fn_iptab); destination(daemon); }; log { source(src); filter(f_kern); filter(fn_iptab); destination(kern); }; log { source(src); filter(f_lpr); filter(fn_iptab); destination(lpr); }; log { source(src); filter(f_mail); filter(fn_iptab); destination(mail); }; log { source(src); filter(f_user); filter(fn_iptab); destination(user); }; log { source(src); filter(f_uucp); filter(fn_iptab); destination(uucp); }; log { source(src); filter(f_iptab); destination(ipmasq); }; Yet all the IPMasq messages are passed top both iptables.log and /var/log/messages. All IPMasq messages are prefixed with the string "iptables" using --log-prefix iptables What am I doing wrong? Thanks, Anoop /// ________________________________________________ Everybody has something to conceal. -- Humphrey Bogart

2 1

Logging to a specific destination
by Anoop Rajendra 12 Aug '04

12 Aug '04

I need to log all messages from iptables, ipmasq to a particular file (say iptables.log) and to that only and nothing else. Is there a way to specifically define this, ie say that messages from this daemon should go nowhere else? Thanks, Anoop /// ________________________________________________ To be is to program.

2 1

RE: [syslog-ng] Re: leak in spoof_source support
by G. C. 10 Aug '04

10 Aug '04

Ok, we tried it and... it works! Process is running smoothly with 780k stable memory occupation. Thanks a lot, I want to do some more testing but I'm quite confident the fix is working. Peter. __________________________________________________ Can you check if this one works for you? Index: src/afinet.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/afinet.c,v retrieving revision 1.25.4.6 diff -u -r1.25.4.6 afinet.c --- src/afinet.c 5 Aug 2004 11:35:12 -0000 1.25.4.6 +++ src/afinet.c 6 Aug 2004 18:15:32 -0000 @@ -653,6 +653,7 @@ if (libnet_write(self->lnet_ctx) < 0) { werror("Error sending raw frame, error: %z", libnet_geterror(self->lnet_ctx)); } + ol_string_free(msg_line); } else { fallback_socket: -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _________________________________________________________________ MSN 8 with e-mail virus protection service: 2 months FREE* http://join.msn.com/?page=features/virus

1 0

(no subject)
by Bazsi 09 Aug '04

09 Aug '04

1 0

$TEMPLATE available with unix-stream
by Loic SPINDLER 09 Aug '04

09 Aug '04

Unix stream users : I'd need to have syslog messages catched by the syslog-ng and forwarded to local daemon using unix-stream. Moreover, as I collect different facilities and level I'd like to ask syslog-ng to add to each line forwarded the $FACILITY to the beginning of the line. Is this now possible ? loic

2 1