January 2005 - syslog-ng - lists.balabit.hu

syslog-ng 1.6.5/1.9.3: syslog-ng.conf and syslog-ng(8) manpage
by José Pedro Oliveira 25 Jan '05

25 Jan '05

Balazs, Two more notes about syslog-ng 1.6.x/1.9.x: 1) The default location of the configuration file has changed syslog-ng 1.6.5 -> /etc/syslog-ng/syslog-ng.conf syslog-ng 1.9.3 -> /etc/syslog-ng.conf See also: https://lists.balabit.hu/pipermail/syslog-ng/2005-January/006919.html 2) the syslog-ng manpage needs a major revision Several syslog-ng command line short options aren't listed (-e, -F, -g, -s, -u), the chroot option appears only in the Synopsis and none of the long options is documented. Below is the help page outputed by syslog-ng 1.6.5 and 1.9.3. See also: http://www.campin.net/syslog-ng/chroot-jail.html (First P.S.) ================================================== === /sbin/syslog-ng -h ================================================== -------------------------------------------------- --- syslog-ng 1.6.5 -------------------------------------------------- Usage: syslog-ng [options] Accept and manage system log messages Options: -s, --syntax-only Only read and parse config file -d, --debug Turn on debugging messages -v, --verbose Be a bit more verbose -F, --foreground Don't fork into background -f <fname>, --cfgfile=<fname> Set config file name, default=/etc/syslog-ng/syslog-ng.conf -V, --version Display version number (syslog-ng 1.6.5) -p <fname>, --pidfile=<fname> Set pid file name, default=/var/run/syslog-ng.pid -C <dir>, --chroot=<dir> Chroot to directory -u <user>, --user=<user> Switch to user -g <group>, --group=<group> Switch to group -------------------------------------------------- -------------------------------------------------- --- syslog-ng 1.9.3 -------------------------------------------------- Usage: syslog-ng [options] Accept and manage system log messages Options: -s, --syntax-only Only read and parse config file -d, --debug Turn on debugging messages -v, --verbose Be a bit more verbose -e, --stderr Log internal messages to stderr -F, --foreground Don't fork into background -f <fname>, --cfgfile=<fname> Set config file name, default=/etc/syslog-ng.conf -V, --version Display version number (syslog-ng 1.9.3) -p <fname>, --pidfile=<fname> Set pid file name, default=/var/run/syslog-ng.pid -C <dir>, --chroot=<dir> Chroot to directory -u <user>, --user=<user> Switch to user -g <group>, --group=<group> Switch to group -------------------------------------------------- Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

1 0

FAQ-seeding: chroot jail procedure for Syslog-ng
by Michael D. (Mick) Bauer 24 Jan '05

24 Jan '05

Hi, all. In researching/writing the Syslog-ng coverage for the new edition of my book, I've encountered a total lack of published info, anywhere, on how to create a Syslog-ng chroot jail. So in the interests of seeding the FAQ (or at least Google), here's a procedure that works for me. Naturally, anyone should feel free to correct anything I've gotten wrong! Any and all feedback is appreciated. ************************************************ How To Create A Chroot Jail For Syslog-ng 1.6x ************************************************ 1. su to root if you're not root already 2. Create an unprivileged group-account for syslog-ng, e.g., by adding the following line to /etc/group: syslogng:x:77: 3. Create an unprivileged system account for syslog-ng, e.g., via the following command: useradd -d /var/syslog-ng-jail -g syslogng -r syslogng (Note that in Linux, the "-r" flag tells useradd that this will be a system account, causing useradd to automatically set the account's shell to /bin/false and to choose an appropriately low value for its UID.) 4. Create the jail: mkdir -p /var/syslog-ng-jail/var/log (Our actual changed root will be /var/syslog-ng-jail, but we may as well create the var/log subdirectory at the same time) 5. At this point the whole jail should be owned by root:root, which is cool so long as the changed-root-directory itself (/var/syslog-ng-jail) is "other-executable," e.g., rwxr-xr-x. But syslog-ng *will* need to create/write files in the jail's var/log subdirectory, so we need to tweak the latter's group-ownership and -permissions, like so: chgrp syslogng /var/syslog-ng-jail/var/log chmod g+wx /var/syslog-ng-jail/var/log 6. That's it! We may now start syslog-ng like this: syslog-ng -C /var/syslog-ng-jail -u syslogng -g syslogng The syslog-ng process will still read its config from /etc/syslog-ng/syslog-ng.conf (not /var/syslog-ng-jail/etc/...), but immediately after that it will chroot itself to the specified jail. Note, however, that the paths you specify in syslog-ng.conf "file()" statements should all be relative to the changed root. E.g., use file("/var/log/messages"), *not* file("/var/syslog-ng-jail/var/log/messages"). Any path you specify in syslog-ng.conf will end up with "/var/syslog-ng-jail" prepended to it. Naturally, there's nothing to stop you from dropping the "var/log/" subdirectory altogether, and simply specify, e.g., file("/messages") as a destination (resulting in things being written to /var/syslog-ng-jail/messages, a less unwieldy path). ******* So far I haven't noticed that anything else needs to be added to the chroot jail (e.g., stuff from /dev or /etc), but if anyone knows differently please speak up! Regards, Mick P.S. Baszi, you really ought to add "-u" & "-g" to the syslog-ng manpage. After all, running anything in a chroot jail as root is futile, no? :-) P.P.S. BTW, 1.6x rocks! /-------------------------------------------------\ | Michael D. (Mick) Bauer | | Security Editor, Linux Journal | | Dir. of Value-Subtracted Svcs., Wiremonkeys.org | \-------------------------------------------------/

6 12

syslog-ng 1.9.3 released
by Balazs Scheidler 22 Jan '05

22 Jan '05

hi, I've released syslog-ng 1.9.3, a new development release from syslog-ng. The NEWS entry below summarizes the most important changes. NOTE: this is a development release and although it seems to be quite stable in my environment, it is not yet recommended for production use. For casual users the 1.6.x branch is still recommended. The release is available at the usual place: http://www.balabit.com/products/syslog-ng/upgrades.bbq Also note that build dependencies have changed since 1.6.x: syslog-ng no longer requires libol, it uses GLib and EventLog instead. EventLog is available at http://www.balabit.com/downloads/syslog-ng/1.9/src/ as it has no separate webpage yet. GLib was originally developed for the GTK+ toolkit, but is available as a separate package from www.gtk.org Feedback as always is appreciated. News for the 1.9.3 release Sat, 22 Jan 2005 01:38:07 +0100 Things are going faster these days, a mere three weeks between releases. I've been running syslog-ng 1.9.2 on my notebook, and was lucky enough to find one or two major bugs this way, but after fixing those things are looking good. I've seen _no_ crashes, though sometimes syslog-ng blocked on reading an external fd, thus causing a system deadlock. Apart from bugfixes the most important changes are that documentation is readded and somewhat even updated with the new features. It was funny rereading the sentences I wrote a couple of years earlier, fixed some embarassing grammatical mistakes. Now, back to the topic, the most important changes in this release are: * Solaris portability fixes, one of the snapshots already compiled cleanly under Solaris, even though I did not test the release itself. * Link against the libraries sitting in /usr statically. * Fixed possible deadlock on internal messages, it was a bad idea to use a pipe internally, it is now replaced with a conventional queue, and a special GSource. * Fixed another possible deadlock caused by some fds not being set to non-blocking mode. * EAGAIN and EINTR was not correctly handled in all cases, fixed those. * Readded documentation, added new macros, template statements, new flags. -- Bazsi

2 2

Syslog-ng 1.6.5 packaging: contrib files
by Jose Pedro Oliveira 22 Jan '05

22 Jan '05

Balazs, Would be possible to place the attached files in the contrib directory? Thanks in advance, jpo -- José Pedro Oliveira mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron { sharedscripts postrotate /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true endscript } #--- # Syslog-ng options: #--- # -s, --syntax-only Only read and parse config file # -d, --debug Turn on debugging messages # -v, --verbose Be a bit more verbose # -F, --foreground Don't fork into background # -f <fname>, --cfgfile=<fname> Set config file name # (default=/etc/syslog-ng/syslog-ng.conf) # -V, --version Display version number (syslog-ng 1.6.5) # -p <fname>, --pidfile=<fname> Set pid file name # (default=/var/run/syslog-ng.pid) # -C <dir>, --chroot=<dir> Chroot to directory # -u <user>, --user=<user> Switch to user # -g <group>, --group=<group> Switch to group # # See syslog-ng(8) for more details #--- SYSLOGNG_OPTIONS=""

1 0

libol - missing command.c
by mathu＠gmx.ch 21 Jan '05

21 Jan '05

hi I have some problems compiling libol 0.3.14 on a Tru64 Unix. The make command exits with the following error: [snip] creating libol.la (cd .libs && rm -f libol.la && ln -s ../libol.la libol.la) Make: Don't know how to make command.c. Stop. *** Exit 1 Stop [snap] after reading syslog-ng INSTALL file, I thought installing scsh will help. But compiling scsh results in an ugly Memory fault. But anyway, why should I need scsh to compile libol if I did not change the sources? And why is command.c missing? kind regards Mathias -- 10 GB Mailbox, 100 FreeSMS http://www.gmx.net/de/go/topmail +++ GMX - die erste Adresse f�r Mail, Message, More +++

1 0

Getting Logs in Triplicate
by Rhugga 20 Jan '05

20 Jan '05

I'm trying to parse cron, mail, and everything else into 3 files but getting 3 copies of each log entry. I also want copies of each log message to be placed in a subdirectory based on each hostname. (So I should have 2 copies of each log message, one in the appropriate master file and then one in the appropriate file under a directory with same name as the source host) Here is my conf: <snip> # Catch All Filter For Mail and Everything Else filter f_master_syslogs { not facility(mail) and not facility(cron); }; filter f_master_maillogs { facility(mail); }; filter f_master_cronlogs { facility(cron); }; destination master_syslogs { file("/var/log/syrrx/master_syslog", owner(root), group(root), perm(0640), dir_perm(0750), create_dirs(yes), ); }; destination master_maillogs { file("/var/log/syrrx/master_maillog", owner(root), group(root), perm(0640), dir_perm(0750), create_dirs(yes), ); }; destination master_cronlogs { file("/var/log/syrrx/master_cronlog", owner(root), group(root), perm(0640), dir_perm(0750), create_dirs(yes), ); }; destination host_logs { file("/var/log/syrrx/$HOST/syslog", owner(root), group(root), perm(0640), dir_perm(0750), create_dirs(yes), ); }; destination host_mail { file("/var/log/syrrx/$HOST/maillog", owner(root), group(root), perm(0640), dir_perm(0750), create_dirs(yes), ); } destination console { file("/dev/tty10"); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole"); }; log { source(src); filter(f_console); destination(xconsole); }; destination root { usertty("root"); }; log { source(src); filter(f_alert); destination(root); }; # Catch All log { source(src); filter(f_master_syslogs); destination(master_syslogs); }; log { source(src); filter(f_master_maillogs); destination(master_maillogs); }; log { source(src); filter(f_master_cronlogs); destination(master_cronlogs); }; # Host Based Log Files log { source(src); filter(f_file-0202); destination(host_logs); }; log { source(src); filter(f_file-0201); destination(host_logs); }; .... log { source(src); filter(f_db-0201_mail); destination(host_mail); }; log { source(src); filter(f_db-0202_mail); destination(host_mail); }; .... Currently I get 3 copies of each log in both places. (the master log and then the one under the host's subdirectory) Any ideas what I missed? ===== Chuck Carson - Sr. Systems Engineer Syrrx, Inc. - www.syrrx.com 10410 Science Center Drive San Diego, CA 92121 Work: 858.622.8528 Fax: 858.550.0526

4 8

Re: [syslog-ng]re-inserting syslog messages for testing
by Robert.COward＠deploymenthealth.osd.mil 18 Jan '05

18 Jan '05

I use Kiwi SyslogGen. Very good simple program. I think you can find it here: http://www.kiwisyslog.com/info_sysloggen.htm

1 0

re-inserting syslog messages for testing
by Ed Ravin 18 Jan '05

18 Jan '05

I've written a perl script that takes as input a file with syslog messages in it, and re-sends them into syslog on the current host. I use this for test environments, especially when I'm testing things with logsurfer and have a known logfile that should generate certain results when parsed by logsurfer. Are there any other tools that do this? If not, I'll release mine after cleaning it up a bit, but there's no point in adding more cruft to the world if Someone Else has done a better job. -- Ed

2 2

RE: [syslog-ng]MYSQL pipe 3
by Robert.COward＠deploymenthealth.osd.mil 18 Jan '05

18 Jan '05

Anyway i fixed the problem and also found out why its was happening: (from my post at www.screamingelectron.org) I think you are not allowed to start things in /etc/rc, and redirect cause the default starts as nobody. heres what I put in to get this thing going: su - root -c "/etc/check_syslog-ng2mysql.sh" & I know not the most secure method, but its a start. so I put the following in my /etc/rc.local file : # MYSQL if [ X"${mysql}" == X"YES" ]; then if [ -x /usr/local/bin/mysqld_safe ]; then echo -n " mysql"; /usr/local/bin/mysqld_safe --socket=/var/www/var/run/mysql/mysql.sock & sleep 10 echo -n " syslog-ng2mysql"; su - root -c "/etc/check_syslog-ng2mysql.sh" & fi fi where /etc/check_syslog-ng2mysql.sh is: #!/usr/local/bin/bash -x ps=`ps -ax | grep "\--password=x" | awk '{ print $9 }'` if [[ $ps != "" ]]; then echo "syslog-ng2mysql is alive." else if [ ! -p /tmp/mysql.pipe ]; then mkfifo /tmp/mysql.pipe kill -HUP `cat /var/run/syslog-ng.pid` fi mysql -u root --password=password syslog < /tmp/mysql.pipe & fi You can find the thread here: http://www.screamingelectron.org/forum/showthread.php?t=2029 Thanks for all your help. >What does, > ps=`ps -ax | grep "\--password=x" | awk '{ print $9 }'` >do and how do you know it is not running? >-Steve S. Just a sloppy way for checking for the mysql client connection. --- 18 January 2005 "Christianity has operated with an unmitigated arrogance and cruelty -- necessarily, since a religion ordinarily imposes on those who have discovered the true faith the spiritual duty of liberating the infidels." (James A. Baldwin, (1924-1987) --- Robert V. Coward UNIX System Administrator Computer Science Corporation

1 0

What facility do the 'STATS' messages come in on?
by Ben Nelson 18 Jan '05

18 Jan '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am able to see my internal() STATS messages only by sending all messages (unfiltered) to a single file. I'm not sure which of my filters may be dropping them. So, which syslog facility do those messages happen under? Thanks, - --Ben -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBY1Ld3cL8qXKvzcwRAg3eAJ0a/Vxz810kkCqXzizKTag9Yb05zACg1r/X rZpVs4HsMSAlO3Xygs80JYI= =PKRl -----END PGP SIGNATURE-----

4 3