December 2005 - syslog-ng - lists.balabit.hu

syslog-ng and selinux
by Ronny Vaningh 26 Dec '05

26 Dec '05

I just installed syslog-ng 1.6.9 on a centos 4.2 machine and syslog-ng doesnt start even after setting setsebool -P use_syslogng=1 I still get the error Starting system logger: Error opening file /proc/kmsg for reading (Permission denied) However it seems that syslog-ng tries to write to /prc/kmsg instead of reading it type=AVC msg=audit(1135510199.139:26): avc: denied { write } for pid=11942 comm="syslog-ng" name="kmsg" dev=proc ino=-268435446 scontext=root:system_r:syslogd_t tcontext=system_u:object_r:proc_kmsg_t tclass=file I'm a little bit puzzled why syslog-ng tries to write to /proc/kmsg instead of just reading messages of it. I can off course change the policy to allow writing but I feel that I must be doing something wrong here Thanks Ronny

2 2

log_msg_size in syslog-ng 1.6.7
by Nitass Sutaveephamochanon 26 Dec '05

26 Dec '05

Hello All, I got a problem about log_msg_size in syslog-ng 1.6.7. How can I know which process generates too long message to the syslog-ng? 2005:12:26-12:42:07 dent syslog-ng[6083]: Message length overflow, line is split, log_msg_size=2048 Please advice too. Thanks and regards, Nitass

1 0

convert logoutput to syslog
by Mark F 24 Dec '05

24 Dec '05

We use a commercial content management system that does not log to syslog but has its own log files. I can however modify where the log files are written via a config file directive. I'm interested in writing (or acquiring) a small program to convert the proprietary log output to something more syslog-ng like and redirect the stream to syslog-ng. I could probably use the logger command to accomplish the latter but how to convert the log output to use syslog facilities is the real question. Any advice, has anyone done something like this before? Thanks, -Mark

2 1

[buffering log messages]
by Jürgen Heil 20 Dec '05

20 Dec '05

hi everybody, we are using a central log (debian sarge) server running syslog-ng. all the hosts logging to the log server are running syslog-ng as well. does anybody know wheter syslog-ng on the hosts is able to buffer log messages to the local disk in case the logging server is not available? thank you for your help! juergen

2 1

match(regex) problem
by Staszek Pitucha 20 Dec '05

20 Dec '05

Hello I've tried to setup some filters lately (v1.9.7). There's a problem with regex character ^. For example I want to filter out "Accepted password" and my home ip from sshd logs, so I setup: filter f_sshd { (program("sshd") and not ( (match("Accepted password") and match("from 123\.456\.789\.012")) or // other rules )) or not program("sshd"); }; Works ok, but I want to filter only messages starting with "Accepted password", but "^Accepted password" doesn't work. Yes - I know - don't use ^, so it's faster. Anyway - "^Accepted" should work as a match pattern and it doesn't. (it should match only the "text" part of message, am I right?) TIA

3 4

Syslog-ng shutting down
by Ed Benckert 17 Dec '05

17 Dec '05

Recently, on a semi reliable schedule, our syslog-ng has started shutting down for no apparent reason. 3 nights in a row between 8:12pm and 8:20pm it shuts down. No, it doesnt crash, we get the 'syslog-ng version 1.6.9 going down' then it terminates. Before this, we had a few other times it just shut itself down... Now we havent changed anything on the system, theres no cron job running anywhere near that time... Has anyone else expeienced this? We've be running syslog-ng for 18 months now and this just started a few weeks ago. It seems very intermittent, but then this weekend, almost like clockwork.

2 2

netmask
by Antonio Brown 15 Dec '05

15 Dec '05

Hello All, I was wondering which of the two formats below would you use when filtering using syslog-ng: filter f_pix { match(PIX) and not match(" 1.2.3.4|1.2.3.4|1.2.3.4|1.2.3.4|netmask(" 1.2.3.4/28")|netmask("1.2.3.4/20")|netmask("1.2.3.4/22")|netmask("1.2.3.4/28") ") }; or...... filter f_pix { match(PIX) and not match(1.2.3.4) and not match(1.2.3.4) and not match(1.2.3.4) and not match(1.2.3.4) and not match(netmask("1.2.3.4/28")) and not match(netmask("1.2.3.4/20")) and not match(netmask("1.2.3.4/22")) and not match(netmask("1.2.3.4/28")) }; I am currently using the latter, but it seems as if the individual ips and subnets would only be filtered if ALL is true. Would using "|", like in the first format, check for each individual ip or subnet and filter accordingly? When I say filter I mean, I would like everything except for the individual IPs and subnets specified. I am not certain that this is appropriate format for filtering subnets, please advise.... Thank You, in advance for your assistance!!!

2 2

Re:[syslog-ng] netmask
by Fred Turner 14 Dec '05

14 Dec '05

I will be away from the office from Dec 14, 2005 and will return to the office on Dec 15, 2005. Please call 905-426-4229 (BBi's IT Support Line) for any System related Issues. If you have any urgent issue that needs my attention please contact me on my cell phone. Thank you. ================================================================== NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.

1 0

DNS
by Kumaran Babu 09 Dec '05

09 Dec '05

Hi, I've planned to setup a Central Logging system using the great Syslog-NG with MySQL. All is fine but just need a couple of clarifications to optimize performance. Basically, I look at logging close to 40 Network devices which can potentially log as much 10Gigs or more of data. I want to use the DNS hostnames to be displayed when viewed in php-syslog-ng interface so I enabled DNS on syslog-ng conf file. I've changed the nsswitch.conf to look at hosts file and then dns server so that I can populate the individual device details into the hosts file so this server doesnt have to query the DNS server for the host details everytime it receives a log entry. Am I doing the right thing or is there a better way of accomplishing this? Also, planning to archive all of the logs onto files and not to simple files so that I can rotate the old logs DB every month. Again, am I doing the right thing or is there an alternate way to do this? Any suggestions and recommendations are gratefully accepted. -- Kumaran Find your IP @ www.itsyourip.com

2 2

logline corruption
by Erik Williamson 06 Dec '05

06 Dec '05

Hi All, I just 'inherited' a large syslog-ng setup that involves on average 1.5 Terabytes of data generated per day. Logs come from many hundreds of hosts, to one of 10 or more syslog-ng servers (selected via DNS round-robin). From there, it goes straight to an NFS server, without being written to a local disk. There are many destination files on the server, but it is possible that more than one logging server may be attempting to write to the same destination file at the same time. We're seeing corruption where a logline will have another spliced in the middle, parts here, parts there, etc. Not constantly, but enough to give us a headache. Stats on the NFS server show that the cpu can get maxed out, but the netwok pipe is not full. The individual logger servers show that syslog-ng is using about 10% CPU on dual 3gHz P4's I''m thinking that it's the nfs server that cannot cope with multiple sources trying to write to the same file, but would like to throw this out to the masses - do you have any hints as to how I could verify where the source of the problem is? I do realize that this setup is less-than-optimal, and will be taking steps to repair this as time goes on. Alas, I must get corruption down first... then re-architect second. Any hints or suggestions would be greatly appreciated! Thanks Very Much, Erik.

3 3