September 2004 - syslog-ng - lists.balabit.hu

FAQ-seeding: chroot jail procedure for Syslog-ng
by Michael D. (Mick) Bauer 24 Jan '05

24 Jan '05

Hi, all. In researching/writing the Syslog-ng coverage for the new edition of my book, I've encountered a total lack of published info, anywhere, on how to create a Syslog-ng chroot jail. So in the interests of seeding the FAQ (or at least Google), here's a procedure that works for me. Naturally, anyone should feel free to correct anything I've gotten wrong! Any and all feedback is appreciated. ************************************************ How To Create A Chroot Jail For Syslog-ng 1.6x ************************************************ 1. su to root if you're not root already 2. Create an unprivileged group-account for syslog-ng, e.g., by adding the following line to /etc/group: syslogng:x:77: 3. Create an unprivileged system account for syslog-ng, e.g., via the following command: useradd -d /var/syslog-ng-jail -g syslogng -r syslogng (Note that in Linux, the "-r" flag tells useradd that this will be a system account, causing useradd to automatically set the account's shell to /bin/false and to choose an appropriately low value for its UID.) 4. Create the jail: mkdir -p /var/syslog-ng-jail/var/log (Our actual changed root will be /var/syslog-ng-jail, but we may as well create the var/log subdirectory at the same time) 5. At this point the whole jail should be owned by root:root, which is cool so long as the changed-root-directory itself (/var/syslog-ng-jail) is "other-executable," e.g., rwxr-xr-x. But syslog-ng *will* need to create/write files in the jail's var/log subdirectory, so we need to tweak the latter's group-ownership and -permissions, like so: chgrp syslogng /var/syslog-ng-jail/var/log chmod g+wx /var/syslog-ng-jail/var/log 6. That's it! We may now start syslog-ng like this: syslog-ng -C /var/syslog-ng-jail -u syslogng -g syslogng The syslog-ng process will still read its config from /etc/syslog-ng/syslog-ng.conf (not /var/syslog-ng-jail/etc/...), but immediately after that it will chroot itself to the specified jail. Note, however, that the paths you specify in syslog-ng.conf "file()" statements should all be relative to the changed root. E.g., use file("/var/log/messages"), *not* file("/var/syslog-ng-jail/var/log/messages"). Any path you specify in syslog-ng.conf will end up with "/var/syslog-ng-jail" prepended to it. Naturally, there's nothing to stop you from dropping the "var/log/" subdirectory altogether, and simply specify, e.g., file("/messages") as a destination (resulting in things being written to /var/syslog-ng-jail/messages, a less unwieldy path). ******* So far I haven't noticed that anything else needs to be added to the chroot jail (e.g., stuff from /dev or /etc), but if anyone knows differently please speak up! Regards, Mick P.S. Baszi, you really ought to add "-u" & "-g" to the syslog-ng manpage. After all, running anything in a chroot jail as root is futile, no? :-) P.P.S. BTW, 1.6x rocks! /-------------------------------------------------\ | Michael D. (Mick) Bauer | | Security Editor, Linux Journal | | Dir. of Value-Subtracted Svcs., Wiremonkeys.org | \-------------------------------------------------/

6 12

Problems with Netscreen log entries
by Paul Mindeman 06 Jan '05

06 Jan '05

Running sylog-ng 1.6.4 on Solaris 9 Log entries from my UNIX devices log fine. Log entries from my Netscreen devices seem to be missing the end of line terminator, as the entries run together in the log file. The default syslog daemon was able to handle these entries fine. Any ideas on how to fix this? The options in the syslog-ng.conf file are: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; Thanks -- Paul Mindeman BTInet Systems Administrator 701-355-5587 mindeman(a)btinet.net

3 2

/proc/kmsg and chrooted syslog-ng
by Michael D. (Mick) Bauer 01 Oct '04

01 Oct '04

One more ignorance-betraying question about Syslog-ng chroot-jails: what should one do about /proc/kmsg? Maybe "touch /var/logjail/proc/kmsg; ln -s /var/logjail/proc/kmsg /proc/kmsg"? And do I take it that, per another recent posting, one should similarly create a new dev/log in the jail and link to it from /dev/log? I'd like to post a revised Syslog-ng chroot jail procedure later this week. Thanks to the two of you who've replied so far! Mick /-------------------------------------------------\ | Michael D. (Mick) Bauer | | Security Editor, Linux Journal | | Dir. of Value-Subtracted Svcs., Wiremonkeys.org | \-------------------------------------------------/

3 2

Loghost can't see its own syslogs
by Doug Hanks 30 Sep '04

30 Sep '04

Hello, I have an interesting problem. I have a loghost with the servername of FFLOGSVR. Everything works wonderfully except that FFLOGSVR isn't logging its own logs. When I perform the command "logger FFLOGSVR" I do not see entry in my syslog. I have attached my syslog-ng.conf for review. Thank you in advance, -- - Doug Hanks = dhanks(at)gmail(dot)com # Syslog-ng (new generation) configuration file # syslog.conf by Doug Hanks 9/25/04 # Global options options { time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs(yes); dns_cache(yes); keep_hostname(yes); }; # Define where the logs come from - udp and /dev/log only source gateway { unix-stream("/dev/log"); internal(); udp(port(514)); }; # Define some filters so we can break down the logs by facility filter f_auth { facility(auth); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; # LogWatch filter f_logwatch { match("su") or match("ssh") or match("sudo"); }; # SU filter f_su_0 { match("su: from [a-zA-Z0-9]+ to") or # AIX match("'su [a-zA-Z0-9]+' succeeded for") or # Solaris match(": su : \+"); # HPUX }; filter f_su_1 { match("su: BAD SU from") or # AIX match("'su [a-zA-Z0-9]+' failed for") or # Solaris match(": su : \-"); # HPUX }; # SSH filter f_ssh_0 { match("Accepted [a-zA-Z0-9]+ for") or # AIX, Solaris, and HPUX match("[a-zA-Z0-9]+ authentication for user [a-zA-Z0-9]+ accepted"); # SAP }; filter f_ssh_1 { match("Failed [a-zA-Z0-9]+ for") or # AIX, Solaris, and HPUX match("[a-zA-Z0-9]+ authentication for user [a-zA-Z0-9]+ failed"); # SAP }; # SUDO filter f_sudo_0 { match("sudo:"); }; filter f_sudo_1 { match("sudo:") and ( match("command not allowed") or match("user NOT in sudoers") ); }; # Define containers where you want to stuff the logs destination localhost { file("/usr/logs/syslog/messages.all"); }; destination loghost { file("/usr/logs/HOSTS/$HOST/messages" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # Program template for alerts destination fifo_alert { program("/usr/local/sbin/email-syslog-alert" template("$HOST:$PROGRAM:$MSG\n") template-escape(yes) ); }; # SU log destination su_0 { file("/usr/logs/syslog/messages.su0"); }; destination su_1 { file("/usr/logs/syslog/messages.su1"); }; # SSH logs destination ssh_0 { file("/usr/logs/syslog/messages.ssh0"); }; destination ssh_1 { file("/usr/logs/syslog/messages.ssh1"); }; # SUDO logs destination sudo_0 { file("/usr/logs/syslog/messages.sudo0"); }; destination sudo_1 { file("/usr/logs/syslog/messages.sudo1"); }; # LogWatch destination logwatch { file("/usr/logs/syslog/logwatch.log"); }; # Regular syslogs destination authlog { file("/usr/logs/syslog/messages.auth"); }; destination cron { file("/usr/logs/syslog/messages.cron"); }; destination daemon { file("/usr/logs/syslog/messages.daemon"); }; destination kern { file("/usr/logs/syslog/messages.kern"); }; destination lpr { file("/usr/logs/syslog/messages.lpr"); }; destination user { file("/usr/logs/syslog/messages.user"); }; destination mail { file("/usr/logs/syslog/messages.mail"); }; destination debug { file("/usr/logs/syslog/messages.debug"); }; destination messages { file("/usr/logs/syslog/messages"); }; destination console { file("/dev/console"); }; # Bring the sources, filters (if any) together and shove it in a log (read destination) log { source(gateway); destination(localhost); }; log { source(gateway); destination(loghost); }; # FIFO alert log { source(gateway); filter(f_su_1); destination(fifo_alert); }; log { source(gateway); filter(f_ssh_1); destination(fifo_alert); }; log { source(gateway); filter(f_sudo_1); destination(fifo_alert); }; # Log SU to roots log { source(gateway); filter(f_su_0); destination(su_0); }; log { source(gateway); filter(f_su_1); destination(su_1); }; # Log SSH stuff log { source(gateway); filter(f_ssh_0); destination(ssh_0); }; log { source(gateway); filter(f_ssh_1); destination(ssh_1); }; # Log SUDO stuff log { source(gateway); filter(f_sudo_0); destination(sudo_0); }; log { source(gateway); filter(f_sudo_1); destination(sudo_1); }; # A master log of SSH, SUDO and SU for LogWatch log { source(gateway); filter(f_logwatch); destination(logwatch); }; # Break down the logs further log { source(gateway); filter(f_auth); destination(authlog); }; log { source(gateway); filter(f_cron); destination(cron); }; log { source(gateway); filter(f_daemon); destination(daemon); }; log { source(gateway); filter(f_kern); destination(kern); }; log { source(gateway); filter(f_mail); destination(mail); }; log { source(gateway); filter(f_user); destination(user); }; log { source(gateway); filter(f_debug); destination(debug); }; log { source(gateway); filter(f_messages); destination(messages); }; log { source(gateway); filter(f_emergency); destination(console); };

2 2

RE: [syslog-ng]Corrupted messages in log
by Dmitri Smirnov 28 Sep '04

28 Sep '04

Thanks a lot, It fixed the problem! Dmitri -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, September 27, 2004 1:30 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Corrupted messages in log Hi, I've found the problem, this is syslog-ng 1.6.3 specific, you should upgrade to at least 1.6.4, or apply the patch in the mailing list archive around 2004 May.

1 0

RE: [syslog-ng]Corrupted messages in log
by Dmitri Smirnov 27 Sep '04

27 Sep '04

An example of corrupted message (one line in syslog file instead of six): Sep 27 02:01:09 loghost local1.err MSWTRS [5572]: [ user.error] Error: 256 Couldn't get W3SVC11/ex040926.log from XXX Sep 27 02:01:11 loghost local1.err MSWTRS [5572]: [ user.error] Error: 256 Couldn't get W3SVC15/ex040926.log from XXX Sep 27 02:01:15 loghost local1.err MSWTRS [5572]: [ user.error] Error: 256 Couldn't get W3SVC20/ex040926.log from XXX Sep 27 02:01:15 loghost local1.err MSWTRS [5572]: [ user.error] Error: 256 Couldn't get W3SVC22/ex040926.log from XXX Sep 27 02:01:30 loghost local1.err MSWTRS [5572]: [ user.error] Error: 256 Couldn't get W3SVC7/ex040926.log from XXX Sep 27 02:02:00 REMOTEHOST/REMOTEHOST user.warning loader: [ID 702911 user.warning] Autoload has been locked for over an hour I just realized that I haven't seen two messages from remote hosts contatenated. It only happens with messages generated on loghost (server where syslog-ng is installed) and messages from remote hosts (sun-stream() plus udp()). Platform is Solaris 8 with 117350-06. Dmitri -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, September 27, 2004 3:24 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Corrupted messages in log On Sun, 2004-09-26 at 23:44, Dmitri Smirnov wrote: > Thanks, Loic, > > some important parts of config, skipping filters: > > # > source local { sun-streams("/dev/log"); internal(); udp(); }; > > options { > use_fqdn(yes); > use_dns(yes); > dns_cache(yes); > keep_hostname(yes); > chain_hostnames(no); > bad_hostname("^5.*"); > sync(0); > stats(0); > log_fifo_size(1024); > log_msg_size(2048); > use_time_recvd(yes); > dns_cache_expire(36000); > dns_cache_expire_failed(3600); > dns_cache_size(10000); > > }; > > > destination syslog { file("/var/log/syslog" owner(root) group(other) > perm(0644) template("$DATE $FULLHOST $FACILITY.$PRIORITY $MESSAGE\n") > template_escape(no)); }; > > log { source(local); filter(filter1_not); filter(filter2_not); > filter(filter3_not); filter(filter4_not); filter(filter5_not); > destination(syslog); }; In what way are messages corrupted? You said they are concatenated, but could you post an example? It would also be important to check which syslog-ng parts are used, e.g. the message path as it is received from the network. (udp source, sun-stream source) It would also be useful to verify whether it was mangled on the syslog-ng host itself, or it was already mangled before. BTW: it is known that certain kernel messages on Linux might get corrupted, because of the kernel ring-buffer overflow, increasing the ring buffer size can be used to mitigate (but not solve) the problem. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Missing remote logs
by fRANz 27 Sep '04

27 Sep '04

I've a syslogd that send his log remotly over a vpn tunnel to an openbsd3.4 with syslog-ng(port syslog-ng-1.5.24.tgz). I see a new log on syslogd, I see the packet go into vpn tunnel but syslog-ng not log it immediately, indeed, I not receive all logs, someone only. Can I miss something in syslog-ng config?! This is my syslog-ng.conf I'd like a realtime remote logging: I necessarily transport between 2 syslog-ng in tcp instead udp?! Thank you very much, fRANz # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # options { long_hostnames(off); sync(0); }; source src { unix-stream("/dev/log"); internal(); }; source net { udp(ip(172.16.13.3)); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination mail { file("/var/log/mail.log"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; destination xconsole { pipe("/dev/xconsole"); }; destination sshd { file("/var/log/secure"); }; destination gate-1 { file("/var/log/gate-1"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; #filter f_ppp { facility(ppp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_sshd { program(sshd); }; filter f_gate-1 { host("172.16.13.254"); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_ppp); destination(ppp); }; log { source(src); destination(console_all); }; log { source(src); filter(f_sshd); destination(sshd); }; log { source(net); filter(f_gate-1); destination(gate-1); }; #

1 0

RE: [syslog-ng]Corrupted messages in log
by Dmitri Smirnov 27 Sep '04

27 Sep '04

Thanks, Loic, some important parts of config, skipping filters: # source local { sun-streams("/dev/log"); internal(); udp(); }; options { use_fqdn(yes); use_dns(yes); dns_cache(yes); keep_hostname(yes); chain_hostnames(no); bad_hostname("^5.*"); sync(0); stats(0); log_fifo_size(1024); log_msg_size(2048); use_time_recvd(yes); dns_cache_expire(36000); dns_cache_expire_failed(3600); dns_cache_size(10000); }; destination syslog { file("/var/log/syslog" owner(root) group(other) perm(0644) template("$DATE $FULLHOST $FACILITY.$PRIORITY $MESSAGE\n") template_escape(no)); }; log { source(local); filter(filter1_not); filter(filter2_not); filter(filter3_not); filter(filter4_not); filter(filter5_not); destination(syslog); }; Dmitri -----Original Message----- From: Loïc Minier [mailto:lool+syslog@via.ecp.fr] Sent: Wednesday, September 22, 2004 3:19 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Corrupted messages in log Dmitri Smirnov <Dmitri.Smirnov(a)fusepoint.com> - Tue, Sep 21, 2004: > syslog-ng 1.6.3, Solaris 8 with latest patches. > Destination to file using templates, network and local sources, > multiple filters. > Started to receive multiple syslog messages from different hosts > concatenated in one big syslog message .. Post your configuration, did you use unix-stream or unix-dgram in your sources? or sun-streams? -- Loïc Minier <lool(a)dooz.org> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Which signal does reload sends ?
by Ali EL MOUSSAWI 24 Sep '04

24 Sep '04

Hi all Can you please tell me what happens when syslog-ng reloads (i.e. receives HUP signal) ? I need to know what signal does it send to the destination programs, and is it a good practice to catch this signal. In fact I don't want my destination program to die at reload, or at least I want to serialize his data structures before it dies, in order to retrieve it when it goes back. On the other hand, if a message arrives from an UDP source while syslog-ng is reloading, will it be lost ? Why the keep alive option is only for tcp source ? Thanks a lot for any help Ali

3 2

blow up a flea
by bedo.sandor＠ln.matav.hu 23 Sep '04

23 Sep '04

Hi All! I and my co-workers have had a trip around "STATS: dropped N" log messages in the last few days, and I am made to share my experience with you. I'm administrating a central log collector, archiver, retriever and analyser service. Of course its heart is syslog-ng. Syslog-ng stores the incoming data in separate files for each recognized subsystems in separate directories for every host. For example you can think about subsystems like cron, postfix, sshd, sendmail, exim, apache, su and sudo, netfilter, ipchains, kernel messages, grsec or execlog for special kernels, System, Security, Application, IIS, ActiveDirectory logs by a Windows source... The analyser part of the system runs a few scripts on the files containing yesterday arrived log messages, for example eximstats, or so. I have written a syslog-ng log analyser script just for fun. One step of the analyser is to collect those evil reputed "STATS: dropped N" messages and draw a graph, that shows the rate of dropped messages based on the last days crop. It was a little bit frustrating to see that graph for a few intranet log forwarder machines, because of more than 30 million lost lines per day! First I couldent believe! "Is that value measured in bytes?? Maybe in bits?" - that was the first idea of one of my co-worker, but the answer was crushing: it is measured in log lines! There have had plenty of agonized crack at the problem: increase the buffer size (certainly this was a silly idea), verify the network interfaces, drivers, cables (the idea was good and shed light on other problemes nevertheless solved the original), plans to upgrade to gigabit ethernet, eliminate every network devices and use only cross utp cables, use more computers for the analysis diffused on the intranet, etc., etc. After all there was an answer message on this list with a little mistake. It suggested that the number in the log lines can only be from tcp destinations. That's wrong! It can arise from other destination too. For example from program(), pipe() and maybe more... and there come the propitiation: f*ckin' debug pipes!!!! We have a local practice of pipe destinations. Chroot-ed environments often have a /var/log/messages pipe inside, and the syslog-ng running in the base system sends the data quarried from the jail back to that pipe for debugging reasons. If you are acting in the jail, you can "cat" the pipe and see the related events without exiting to the base system (where the data is stored in regular files). On the log forwarder machines there are pipes for debugging the incoming tcp and udp log traffic (for example it's nice to explore and locate unknown log sources, to see that remote logging is on, or to identify dummy systems using udp protocol). Pipes seemd to be practical because they didn't eat up the disk space even so ther was a point to access the log stream if it needed. Our solution is an ugly workaround. I have written a little C code that opens a pipe with O_NONBLOCK and sends data from standard input to the pipe. Because of non-blocking io syslog-ng cannot detect the data loss. So pipe destinations are replaced to program(".../sbin/pipecat .../var/log/pipe") destinations to eliminate false scaled syslog-ng statistics. (It is a pity that program("/bin/cat > /var/log/pipe"); generates the same wrong statistic, so my pipecat seems the one and only solution. Do You have any better idea?) I'm sorry if I was boring! I think promlems, their solutions and others experiences can be of service to anybody. Let these be a lesson for all of you out there! :) -- Have a nice day! bSanyI

1 0