August 2004 - syslog-ng - lists.balabit.hu

program driver only works once
by David Schwendinger 06 Aug '04

06 Aug '04

All, I have a program driver setup in the syslog-ng.conf file to execute a perl script which sends an email with fixed content based on a syslog message. This first time I run syslog-ng with the program driver, syslog-ng and the script appear in a "ps -ef" listing as mentioned in the syslog-ng docs.: "NOTE: the program is executed once at startup, and kept running until SIGHUP or exit. The reason is to prevent starting up a large number of programs for messages, which would imply an easy DoS." The first time the conditions are met to send the email it works but the script which was listed with syslog-ng in a "ps-ef" no longer appears in a "ps -ef" and I can not seem to get it to start again. "service syslog-ng restart" or "stop" then "start" does not work. Reboot does not work. How can I get this script ready to send another alert after it has been triggered? The following are pertinent lines from the syslog-ng.conf file. source s_sys { unix-stream("/dev/log"); internal(); }; destination d_mail-me { program("/etc/syslog-ng/test-mail.script"); }; filter f_filter9 { match("for user"); }; log { source(s_sys); filter(f_filter9); destination(d_mail-me); }; thanks, David

1 0

leak in spoof_source support
by Balazs Scheidler 06 Aug '04

06 Aug '04

>Researching the problem we found out that it seems to be related to >the >"address spoofing" options. Enabling this option, under heavy traffic (which >means always, in our case) we experience this memory leak problem. >Disabling the address spoofing option, everything runs smoothly with only >about 720k memory occupation. > >The problem is "we need this option"... And this is getting critical, can >anyone hep? >Thanks, Hmm.. I possible forgot to free something in that path. I'll check it out for you. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 1

possibly missed mail
by Balazs Scheidler 06 Aug '04

06 Aug '04

hi, sorry, I haven't noticed our list manager put me to nomail mode. I quickly grepped through the last couple of mails in the archive, but if you think I missed something, please resend. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Newbie Filter question (Solaris)
by Kenneth Gullberg 06 Aug '04

06 Aug '04

Hi, Im new to syslogng and want to replace the normal syslogd in solaris with -ng because of the filters. I run postfix on 2 loadbalanced machines and i want to get rid of the healthchecks log entries. I setup a conf file that looks like this: options { long_hostnames(off); # doesn't actually help on Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(1); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(2048); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); }; ############################################################### source src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; ############################################################### destination alteon { file("/var/log/alteon"); }; destination notalteon { file("/var/log/notalteon"); }; destination ipf { file("/var/log/ipf.log"); }; ############################################################### filter f_mail { facility(mail); }; filter f_not_mail { not facility(mail); }; filter f_ipf { facility(local0); }; filter f_alteon { match("10.155.68.2") or match("10.155.68.3"); }; filter f_notalteon { not match("10.155.68.2") or not match("10.155.68.3"); }; ############################################################### log { source(src); filter(f_alteon); destination(alteon); }; log { source(src); filter(f_notalteon); destination(notalteon); }; log { source(src); filter(f_ipf); destination(ipf); }; According to this i should log everything that contains 10.155.68.2 or .3 to /var/log/alteon and if it doesnt contain .2 or .3 to /var/log/notalteon and it will also send the ip filter logs to its own log (which works). It seems that f_alteon och f_ipf works. But f_notalteon logs both stuff that does contain .2 and .3 and stuff that doesnt contain .2 and .3 What have i missed? // Kenneth

2 1

Problems compiling
by Nathaniel Hall 06 Aug '04

06 Aug '04

I am trying to install Syslog-NG on RH AS 3 Update 2. I have downloaded the syslog-ng gzips along with libol v 0.3.13. I ran configure, make, and install alright, but when I go to configure Syslog-ng, I get the following error. configure: error: Required libol version not found, make sure that your libol version is in the 0.3.x branch Any ideas? ~~~~~~~~~~~~~~~~~~~~~~~~~~ Nathaniel Hall Intrusion Detection and Firewall Technician Ozarks Technical Community College -- Office of Computer Networking halln(a)otc.edu 417-799-0552

2 2

Missing Log Entries under Load
by Tim Burress 06 Aug '04

06 Aug '04

Hello! Apparently this is sort of a FAQ, but despite wading through many Google searches, I haven't really found a good explanation or set of suggestions, so I thought I would post the question and then duck. We're running: syslog-ng 1.6.4 iptables v1.2.11-20040621 Linux 2.4.26 with iptables rules set up to log incoming connections. What we see is that, when we do a very fast port scan, the logs are very incomplete. For instance, in a scan of 440 ports, only about 210 entries appear in the logs. We also get a small number of corrupted log entries in our default messages file, where leading characters of the message appear to have been lost. We have our log sources set up as: source src { internal(); file("/proc/kmsg"); unix-stream ("/dev/log" max-connections(200)); unix-stream ("/var/log/snort/dev/log" max-connections(30)); }; Could someone explain, or point me to an explanation of, why these problems occur? It seems likely that the message corruption problem is due to wrap-around of the kernel message ring buffer. I suppose the missing messages could also be caused by that, however doubling the size of the buffer and rebuilding the kernel didn't seem to have any effect. And then, are there any suggestions for ways to tune the system so that a greater proportion of messages can be logged? We've tried tweaking the syslog-ng FIFO size and garbage collection parameters, but these, too, seemed to have little effect, at least in isolation. Any suggestions greatly appreciated! Thanks! Tim __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - 100MB free storage! http://promotions.yahoo.com/new_mail

1 0

Normalizing syslogs from FreeBSD and Solaris machines
by Ken McKittrick 05 Aug '04

05 Aug '04

Hello I can't seem to get syslog outputs from Postfix running on Solaris and FreeBSD servers to look the same. FreeBSD - Aug 5 11:14:43 69.67.254.17 postfix/smtp[80999]: 9FAA9EB760: to=<adams4(a)usadatanet.net>, relay=127.0.0.1[127.0.0.1], delay=1, status=sent (250 2.6.0 Ok, id=81995-01, from MTA: 250 Ok: queued as E16ECEB7CD) This corresponds to $DATE $HOST $MESSAGE, yes the postfix/smtp[80999] which would be $PROGRAM is actually part of the $MESSAGE. Solaris - Aug 5 11:16:06 69.67.254.10 postfix/smtp[10111]: [ID 197553 mail.info] B3391B26D: to=<taptoes(a)usadatanet.net>, relay=127.0.0.1[127.0.0.1], delay=2, status=sent (250 2.6.0 Ok, id=11585-10, from MTA: 250 Ok: queued as 9190DAE91) This corresponds to $DATE $PROGRAM $MESSAGE. Which is closer to what I would expect. My main problem is that Solaris stuffs the ID and facility.priority into the message itself. I've tried logging with defined message formats and that doesn't seem to help. So how can I gracefully removed the [ID xxxxxx Facility.Priority] from the message in the Solaris log lines? Thanks Ken McKittrick ISP Engineer USADatanet

2 3

syslog-ng 1.6.5 and libol 0.3.14
by Balazs Scheidler 05 Aug '04

05 Aug '04

hi, I have prepared a new syslog-ng release, found at the usual locations, http://www.balabit.hu/downloads/syslog-ng/ The summary of user-visible changes: News for the 1.6.5 release Thu, 05 Aug 2004 13:50:11 +0200 * cleaned up libol and syslog-ng compilation warnings and made configure.in/Makefile.am files autoconf2.50 compliant * fixed a BSD specific compilation problem * check if the UDP datagram ends in a NL or NUL character and strip that away if present -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

MORE: Syslog-ng unusual memory occupation
by G. C. 04 Aug '04

04 Aug '04

Researching the problem we found out that it seems to be related to the "address spoofing" options. Enabling this option, under heavy traffic (which means always, in our case) we experience this memory leak problem. Disabling the address spoofing option, everything runs smoothly with only about 720k memory occupation. The problem is "we need this option"... And this is getting critical, can anyone hep? Thanks, P. __________________________________ Hi, I'm using syslog-ng (1.6.4) on a RedHat Linux AS 3.0 and I'm experiencing a heavy memory occupation. Untill yesterday syslog-ng was using 1GB RAM, today I added 1 GB more and now it is using it too plus some swap (total 2.8 GB used. And it is growing...). I use this server for collecting logs from several hundreds network devices. The traffic collected is around 1GB/day and I save it to a text log file which is created and rotated daily. I cannot understand the reason, I tried to play with the garbage collection and fifo options but accomplished nothing. Any experience of such a behavior? Thanks in advance for your help, Peter. _________________________________________________________________ Add photos to your messages with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

1 0

Syslog-ng unusual memory occupation
by G. C. 02 Aug '04

02 Aug '04

Hi, I'm using syslog-ng (1.6.4) on a RedHat Linux AS 3.0 and I'm experiencing a heavy memory occupation. Untill yesterday syslog-ng was using 1GB RAM, today I added 1 GB more and now it is using it too plus some swap (total 2.8 GB used. And it is growing...). I use this server for collecting logs from several hundreds network devices. The traffic collected is around 1GB/day and I save it to a text log file which is created and rotated daily. I cannot understand the reason, I tried to play with the garbage collection and fifo options but accomplished nothing. Any experience of such a behavior? Thanks in advance for your help, Peter. _________________________________________________________________ The new MSN 8: smart spam protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0