October 2005 - syslog-ng - lists.balabit.hu

SV: [syslog-ng] Architecture Question'
by kenneth.gullberg＠foreningssparbanken.se 04 Oct '05

04 Oct '05

im afraid that the only answer you are going to get is: Depends on what kind of traffic you expect to be seeing.. 7000 machines logging 1 message every minute is nothing but if you are expected to receive 1 message / second / server then you need a different setup.. You need to be more specific! -----Ursprungligt meddelande----- Från: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] För CIKALA Frederic ROSI/DOSI Skickat: den 4 oktober 2005 09:34 Till: syslog-ng(a)lists.balabit.hu Ämne: [syslog-ng] Architecture Question' Hello everyone' I'm new to this mailing list and i do not know syslogNG yet Actually, i have to prepare a server that will centralize a lot of logs, from about 7000 other servers. I've read that syslogNG is a great tool that can do a lot of interresting things. Therefore, i chose this application for my project but i do not know if it needs big ressources to be launched ... In fact, i'm wondering about the hardware i'll have to buy in order to make this project Maybe someone of this list has got a greater opinion about what i'll have to buy for example "at least a 3gHz cpu, with 2 gig of ram ..." It could be usefull', thank you ^^ *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

1 0

RE: [syslog-ng] Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 04 Oct '05

04 Oct '05

> Exactly. Here is the full code which seems to work around > those issues > rather nicely (you're in for a good treat reading the comment block > almost at the end of the code): > > http://svn.apache.org/viewcvs.cgi/apr/apr/trunk/time/unix/time.c?view=mark up Can you say "Jump thru hoops"? > I wonder if this should be implemented in syslog-ng as well? I hope so! But that's easy for me to say, looking in from the outside. ;-) > Bazsi is > in Sevilla > enjoying the sun and giving interesting speeches at the > present time ;). Sounds well deserved! I hope that it's an enjoyable trip! > Could you grep for this tm_gmtoff and altzone as follows, > please (maybe > it's defined as __tm_gmtoff)? > > find /usr/ -type f -name "*.h" -exec grep "tm_gmtoff" /dev/null {} \; These hits: /usr/local/lib/perl5/5.8.7/sun4-solaris/CORE/config.h: * the struct tm has a tm_gmtoff field. /usr/local/lib/perl5/5.8.7/sun4-solaris/CORE/uconfig.h: * the struct tm has a tm_gmtoff field. > find /usr/ -type f -name "*.h" -exec grep "altzone" /dev/null {} \; These hits: /usr/include/time.h:extern long altzone; /usr/include/time.h:extern long timezone, altzone; Thanks for the help Roberto. You have a great week. Marvin

2 1

Architecture Question'
by CIKALA Frederic ROSI/DOSI 04 Oct '05

04 Oct '05

Hello everyone' I'm new to this mailing list and i do not know syslogNG yet Actually, i have to prepare a server that will centralize a lot of logs, from about 7000 other servers. I've read that syslogNG is a great tool that can do a lot of interresting things. Therefore, i chose this application for my project but i do not know if it needs big ressources to be launched ... In fact, i'm wondering about the hardware i'll have to buy in order to make this project Maybe someone of this list has got a greater opinion about what i'll have to buy for example "at least a 3gHz cpu, with 2 gig of ram ..." It could be usefull', thank you ^^ *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

1 0

RE: [syslog-ng] Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 03 Oct '05

03 Oct '05

> I didn't check but most probably he added the > localtime(&when) call in > get_local_timezone_ofs() to extract the seconds you are away > from UTC, > including DST handling. Unfortunately I do not understand enough of > timezone handling to be much of a help here. Time is too a difficult > subject for me to understand, so I'm glad it works most of > the time :). > ............................... > > Hmm, the "correct" file I see has shown up in Solaris 10 ;) > with the libbc: > > http://cvs.opensolaris.org/source/xref/usr/src/lib/libbc/inc/i > nclude/time.h > > Tomorrow I'll have access again to a Solaris 8 machine where > I could try > compiling the source. Bazsi seems to be very busy these days, > so we just > have to wait for a bit ... > > Regards, > Roberto Nibali, ratz Well this is depressing.... I'm googling this, and found this: http://archive.apache.org/gnats/7902 I get the distinct impression that tm_getoff doesn't exist on Solaris 8 (although it appears that Sun finally added it later on, as it's obviously there in 10). I guess the Apache guys produced a Solaris-specific chunk of code to work around that shortcoming (and that's what the web page is discussing). If anyone has any clues as to how one might add the "later" (more capable) time functionality on Solaris 8, I'd obviously love to hear it, or it looks like I'm dead in the water for using the future version of syslog-ng at this point. (i.e. a possible patch, or external component, that has this extended capability.) Thanks! Marvin

2 1

unsubscribe
by Brown, Donna Jeanne 03 Oct '05

03 Oct '05

Please unsubscribe me from this list. Donna Brown (djbrown(a)sandia.gov)

1 0

Re: [syslog-ng] match text within message
by Roberto Nibali 03 Oct '05

03 Oct '05

> Thanks Roberto, > I am trying to do exactly what you presumed. Ok. >>So you write: >> >>match PIX and not A and not B >> >>> Any suggestions? >> >>filter f_pix { >> match("PIX") and match("987.65.4.[34]"); >>}; > > > So, in order to exclude ip address 987.65.4.3 and ip address 987.65.4.4 > would the sytax be as follows? Well, I'm a bit unsure about your use of the term "ip address", since the noted dotted decimals are not valid ip addresses. > filter f_pix { > match("PIX") and not match("987.65.4.[34]"); > }; I would say so. > Thanks again!!! Tell us if it works and if not, we're more than happy to help you out further. Don't forget to cc the list since other people might want to know this as well and could potentially help you out better then I can. Best regards, Roberto Nibali, ratz -- ------------------------------------------------------------- addr://Kasinostrasse 30, CH-5001 Aarau tel://++41 62 823 9355 http://www.terreactive.com fax://++41 62 823 9356 ------------------------------------------------------------- terreActive AG Wir sichern Ihren Erfolg -------------------------------------------------------------

1 0

Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 03 Oct '05

03 Oct '05

Balazs... I didn't know if you'd seen this (original) thread (I won't repeat all of it here, but did repeat Peter's suggested fix below). I applied this fix, and it did resolve my problems, as it did Peter's. I looked at the latest snapshot, and didn't see this particular change applied, so I figured that I'd ask whether this is something that should be applied(?) Or... Possibly... It's resolved through some other means, or worse (for me) maybe it implies that I've got something else misconfigured, that is actually the root cause of my (and maybe Peter's) problem. If there's any information that you need from me, I'd be happy to supply it. Thanks for your good work and efforts! Marvin -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of pnahas(a)mrv.com Sent: Friday, September 30, 2005 2:27 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Ver 1.9.5 problems with facility/level filtering I too have experienced this problem and decided to investigate the source code. Unless I'm missing something, it appears that 1.9.5 simply does not set the correct variable internally, regardless of configuration. The following patch solved the problem for me: --- /home/pnahas/syslog-ng-1.9.5/src/filter.c 2005-01-05 06:40:50.000000000 -0500 +++ filter.c 2005-09-30 16:23:29.000000000 -0400 @@ -162,6 +162,7 @@ { FilterPri *self = g_new0(FilterPri, 1); + self->valid = facilities; self->super.eval = filter_facility_eval; return &self->super; } @@ -180,6 +181,7 @@ { FilterPri *self = g_new0(FilterPri, 1); + self->valid = levels; self->super.eval = filter_level_eval; return &self->super; } Hope that helps! -Peter Nahas

2 1

match text within message
by Antonio Brown 03 Oct '05

03 Oct '05

Below are a couple of message samples: "Message: %PIX-51-100908: Teardown UDP connection 30292827 for THEFORCEVPN: 123.45.678.91/3130 to inside:987.65.4.3/53 duration.......etc.." "Message: %PIX-51-070605: Teardown UDP connection 26252423 for ISSTRONGVPN: 111.21.314.15/3130 to inside:987.65.4.4/53 <http://210.65.4.4/53>duration.......etc.." I am trying to match 987.65.4.3 or 987.65.4.3/53 and 987.65.4.4<http://210.65.4.4>. Here is my syntax: filter f_pix { match(PIX) and not match("987.65.4.3") and not match(" 987.65.4.4 <http://210.65.4.4>"); }; Any suggestions? Thank You for your assistance! >match() matches the message part only, which does not include the >hostname part in the message header. If you actually copied a sample >message it would be easier to help out, and you have a much better >chance to receive messages on the syslog-ng mailing list. Lots of >helpful folks there, I'm sometimes unable to respond for days. :) > >-- > Bazsi >> Hello! >> >> I am trying to filter an IP by using match in the syslog-ng.conf file. >> Below (in bold) is a portion of the thread that sort of describes my problem. >> However the IP address that I am attempting to match is not the sender. >> >>It is actually located within the message. >> >> I am using the following syntax: >> >> filter f_pix { match(PIX) and not match("xxx\.xx\.x\.x"); }; >> >> Did not work. I've attempted many other variations and still no go. >> >> >> again the address that I am attempting to match is not the sender. It is located >> within the message.

2 1

Fwd: [syslog-ng] syslog-ng not logging
by catenate 03 Oct '05

03 Oct '05

Frowarding to the list, wish gmail used the reply-to header. :( ---------- Forwarded message ---------- From: catenate <infosec(a)gmail.com> Date: Sep 29, 2005 7:54 PM Subject: Re: [syslog-ng] syslog-ng not logging To: fico gid <ficohertz(a)gmail.com> On 9/29/05, fico gid <ficohertz(a)gmail.com> wrote: > > Hi Again, > > Below is the whole syslog-ng.conf file . Yes, it is not separating as > in /host/somehost/year/month/day .. > > <SNIP> > > Let me know if you need more info, Thanks Fico, This has to be the first time I've ever seen someone completely omit an options{}; block. Now I know that syslog-ng will gladly use defaults for all the options if/when you leave that out. Anyways, I'm still not completely clear on how exactly your installation is logging. Are you saying that you have logs going to /var/log/kern.log and the other NON-MACRO destinations, or are you saying that your macro filenames in /var/log/hosts/HOST/YEAR/... are being logged but incorrectly, like /var/log/hosts/YEAR/... ? Please be specific. I did a syntax check on your config file, and it looks fine to me. What version are you using?

3 3

syslog-ng 1.6.8 and dns cache issue
by Ketan Vankawala 02 Oct '05

02 Oct '05

I have currently installed Syslog-ng ver 1.6.8. Here is a snippet of my syslog-ng config file.So accordingly when a syslog message comes in, depending on the ip address, it does a lookup in /etc/hosts, creates an appropriate host name folder and forwards the message there. If the hostname does not exists, it creates a folder named with the ip address. Here is my question: 1) How often does syslog-ng refreshes its dns /hosts cache? Because I have run into issues that even after the /etc/hosts file is updated syslog still keeps logging to the folder created with the ip address. If I restart syslog-ng service it immediately starts forwarding the messages correctly to hostname folder. 2) How can I reduce the dns cache timeout, so it checks /etc/hosts more frequently for any changes? Thanks in advance. Ketan destination hostslocal { file("/var/log/HOSTS/$HOST/$YEAR-$MONTH-$DAY.log" owner(root) group(xxx) perm(0740) dir_perm(0740) create_dirs(yes) template("$R_DATE $FULLHOST $MONTH $S_DAY $S_YEAR $S_HOUR:$S_MIN:$S_SEC: $MESSAGE\n") template-escape(no)); }; log { source(src); destination(hostslocal); };

2 2