May 2005 - syslog-ng - lists.balabit.hu

RE: [syslog-ng] Syslog-ng 1.9.4 configure question
by Hokhold, Mark 24 May '05

24 May '05

Thanks Jerry, I'll get it a shot. Just another newbie. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Jerry Bell Sent: Tuesday, May 24, 2005 11:35 AM To: Syslog-ng users' and developers' mailing list Cc: 'syslog-ng(a)lists.balabit.hu' Subject: Re: [syslog-ng] Syslog-ng 1.9.4 configure question eventlog is a separate distribution that you need to compile and install. You can find it here: http://www.balabit.com/downloads/syslog-ng/1.9/src/ alongside the source for syslog-ng 1.9 > I checked my system and eventlog.pc doesn't exist on my > system, > so therefore I don't have this package installed. > Jerry http://www.syslog.org _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng] Syslog-ng 1.9.4 configure question
by Jerry Bell 24 May '05

24 May '05

eventlog is a separate distribution that you need to compile and install. You can find it here: http://www.balabit.com/downloads/syslog-ng/1.9/src/ alongside the source for syslog-ng 1.9 > I checked my system and eventlog.pc doesn't exist on my > system, > so therefore I don't have this package installed. > Jerry http://www.syslog.org

1 0

Syslog-ng 1.9.4 configure question
by Hokhold, Mark 24 May '05

24 May '05

Syslog-ng Users, I'm currently trying to configure syslog-ng 1.9.4 on my Sunblade 100 (Solaris 9) as a test. I've loaded and installed Stunnel-4.10 and openssl-0.9.7g so far, but when I configure syslog-ng, I get the following: # ./configure ..... ... checking GLIB CFLAGS... -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include checking GLIB_LIBS... -lglib-2.0 checking for eventlog... Package eventlog was not found in the pkg-config search path Perhaps you should add the directory containing `eventlog.pc` To the PKG_CONFIG_PATH environment variable No package 'eventlog' found Configure: error: Library requirements (eventlog) not met;....... I checked my system and eventlog.pc doesn't exist on my system, so therefore I don't have this package installed. Where can I find them? Thanks in advance, Mark

1 0

Re: syslog-ng Digest, Vol 1, Issue 1253
by M.Balajee 24 May '05

24 May '05

Hi, You can edit /etc/syslog-ng.conf file to avoid this. Edit this file so that you will not be seeing the messages on the console. On Tue, 24 May 2005 syslog-ng-request(a)lists.balabit.hu wrote : >Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > >To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng >or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > >You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of syslog-ng digest..." > > >Today's Topics: > > 1. Re: No line break every so often (Balazs Scheidler) > 2. how to avoid logging to consoles? (iv) > 3. Re: how to avoid logging to consoles? (Balazs Scheidler) > 4. Re: how to avoid logging to consoles? (Jesse Molina) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Mon, 23 May 2005 12:59:04 +0200 > From: Balazs Scheidler <bazsi(a)balabit.hu> >Subject: Re: [syslog-ng] No line break every so often >To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> >Message-ID: <1116845944.23550.11.camel(a)bzorp.balabit> >Content-Type: text/plain > >On Fri, 2005-05-20 at 12:14 -0700, Mike Tremaine wrote: > > On Fri, 2005-05-20 at 04:49, Balazs Scheidler wrote: > > > Luckly it is... Attached is a trimmed down trace file with a few > > examples of the problem [about 200lines let me know if more would be > > useful...] > > > > To my [uneducated] eye it looks like sendmail is the problem but like I > > said sometimes it does it right sometime it doesn't. > > > > Example: > > > > read(16, "<20>May 20 07:48:02 sendmail[16668]: j4KEkWOv016668: collect: > > premature EOM: unexpected close", 2048) = 93 > > > > Notice no \0 or \n > > > > Then the next read > > > > read(16, "<21>May 20 07:48:02 sendmail[16668]: j4KEkWOv016668: collect: > > unexpected close on connection from [61.43.165.161], > > sender=<Hager(a)indiatimes.com>\0<22>May 20 07:48:02 sendmail[16668]: > > j4KEkWOv016668: from=<Hager(a)indiatimes.com>, size=0, class=0, nrcpts=1, > > proto=SMTP, daemon=MTA, relay=[61.43.165.161]\0", 1955) = 300 > > > > > > A null terminator > > That leads to the output > > > > write(22, "2005-05-20 07:48:02 quasar mail.warning sendmail[16668]: > > j4KEkWOv016668: collect: premature EOM: unexpected close<21>May 20 > > 07:48:02 sendmail[16668]: j4KEkWOv016668: collect: unexpected close on > > connection from [61.43.165.161], > > sender=<Hager(a)indiatimes.com>\n2005-05-20 07:48:02 quasar mail.info > > sendmail[16668]: j4KEkWOv016668: from=<Hager(a)indiatimes.com>, size=0, > > class=0, nrcpts=1, proto=SMTP, daemon=MTA, relay=[61.43.165.161]\n", > > 430) = 430 > > . > > > > So the null was caught and turned into \n but the line before it runs > > together. With some weird <21> [and more often <22> see trace file]. > >Hm. Sendmail really seems to be the culprit, it is only hidden by >sysklogd using unix-dgram() sockets in which case the syslog daemon does >not care whether the message was NL or \0 terminated or not. > >The manpage for syslogd, mentions: > >... "A trailing newline is added when needed." > >This does not seem to be true. After judging the source it seems to be >adding the NL character only if LOG_PERROR is specified to openlog() >which clearly isn't the case for sendmail. > >I'd say this is a libc bug which you can work around by avoiding using >unix-stream and sticking to unix-dgram instead. (a solution which I >myself do not like). > >-- >Bazsi > > > >------------------------------ > >Message: 2 >Date: Mon, 23 May 2005 17:15:34 +0200 > From: iv <iv(a)zabuchy.net> >Subject: [syslog-ng] how to avoid logging to consoles? >To: syslog-ng(a)lists.balabit.hu >Message-ID: <4291F396.8040307(a)zabuchy.net> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >hi all >i'm trying to configure syslog-ng for logging events from firewall >everything works fine, except one thing: all messages appear on all my >consoles >how can i avoid that? it makes impossible working with the console, logs >appear even while editing files >and situation does't change when i comment out all "log" entries in the >syslog-ng.conf file >please, any ideas:) > >my syslog-ng.conf: > >options { > use_fqdn(yes); > use_dns(no); > chain_hostnames(yes); > use_time_recvd(no); ># sync(10); > > perm(0640); > owner("root"); > group("root"); > create_dirs(yes); > dir_perm(0750); > dir_owner("root"); > dir_group("root"); >}; > > > >source syslog { > unix-stream("/dev/log"); >}; > >source kernel { > file("/proc/kmsg"); >}; > >source syslog-ng { > internal(); >}; > > > >destination firewall { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/firewall"); >}; > >destination kernel { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/kernel"); >}; > >destination invalid { > file("/spool/unknown/$YEAR/$MONTH/$DAY/invalid"); >}; > >destination postfix { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/postfix"); >}; > >destination cron { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/cron"); >}; > >destination generic { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM"); >}; > >destination syslog-ng { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/syslog-ng"); >}; > >destination misc { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/misc"); >}; > > >## kernel >filter firewall { > match("IN=") and match("OUT=") and match("PROTO="); >}; > >filter notfirewall { > not match("IN=") and not match("OUT=") and not match("PROTO="); >}; > >log { > source(kernel); > filter(firewall); > destination(firewall); >}; > >log { > source(kernel); > filter(notfirewall); > destination(kernel); >}; > > >## internal >log { > source(syslog-ng); > destination(syslog-ng); >}; > > >## syslog >filter invalid { > not host("^syslog@[a-z]+$"); >}; > >filter postfix { > host("^syslog@[a-z]+$") > and program("^postfix/"); >}; > >filter cron { > host("^syslog@[a-z]+$") > and program("^(/USR/SBIN/CRON|/usr/sbin/cron)$"); >}; > >filter generic { > host("^syslog@[a-z]+$") > and program("^([a-z][a-z._-]*)$"); >}; > >log { > source(syslog); > filter(invalid); > destination(invalid); >}; > >log { > source(syslog); > filter(postfix); > destination(postfix); >}; > >log { > source(syslog); > filter(cron); > destination(cron); >}; > >log { > source(syslog); > filter(generic); > destination(generic); >}; > >log { > source(syslog); > destination(misc); > flags(fallback); >}; > >i'm running linux debian 2.6.11.8 testing > >thanks in advance, >iv > > >------------------------------ > >Message: 3 >Date: Mon, 23 May 2005 18:08:35 +0200 > From: Balazs Scheidler <bazsi(a)balabit.hu> >Subject: Re: [syslog-ng] how to avoid logging to consoles? >To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> >Message-ID: <1116864515.19621.7.camel(a)bzorp.balabit> >Content-Type: text/plain > >On Mon, 2005-05-23 at 17:15 +0200, iv wrote: > > hi all > > i'm trying to configure syslog-ng for logging events from firewall > > everything works fine, except one thing: all messages appear on all my > > consoles > > how can i avoid that? it makes impossible working with the console, logs > > appear even while editing files > > and situation does't change when i comment out all "log" entries in the > > syslog-ng.conf file > > please, any ideas:) > >short answer: "dmesg -n1" > >long answer: syslog-ng does not change kernel logging parameters on its >own, which is performed automatically by klogd. but you can do the same >using dmesg. > >-- >Bazsi > > > >------------------------------ > >Message: 4 >Date: Mon, 23 May 2005 10:40:13 -0700 > From: Jesse Molina <jesse(a)opendreams.net> >Subject: Re: [syslog-ng] how to avoid logging to consoles? >To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> >Message-ID: <20050523174013.GA18331@shoebox> >Content-Type: text/plain; charset=us-ascii > > >Hi > >man dmesg > >Use the -n arg, which will do what you want. > >You will probably need to add this to a startup script. Use update-rc.d >for that, or make yourself a .deb if you must. > > > >On Mon, May 23, 2005 at 05:15:34PM +0200, iv wrote: > > hi all > > i'm trying to configure syslog-ng for logging events from firewall > > everything works fine, except one thing: all messages appear on all my > > consoles > > how can i avoid that? it makes impossible working with the console, logs > > appear even while editing files > > and situation does't change when i comment out all "log" entries in the > > syslog-ng.conf file > > please, any ideas:) > > > > my syslog-ng.conf: > > > > options { > > use_fqdn(yes); > > use_dns(no); > > chain_hostnames(yes); > > use_time_recvd(no); > > # sync(10); > > > > perm(0640); > > owner("root"); > > group("root"); > > create_dirs(yes); > > dir_perm(0750); > > dir_owner("root"); > > dir_group("root"); > > }; > > > > > > > > source syslog { > > unix-stream("/dev/log"); > > }; > > > > source kernel { > > file("/proc/kmsg"); > > }; > > > > source syslog-ng { > > internal(); > > }; > > > > > > > > destination firewall { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/firewall"); > > }; > > > > destination kernel { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/kernel"); > > }; > > > > destination invalid { > > file("/spool/unknown/$YEAR/$MONTH/$DAY/invalid"); > > }; > > > > destination postfix { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/postfix"); > > }; > > > > destination cron { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/cron"); > > }; > > > > destination generic { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM"); > > }; > > > > destination syslog-ng { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/syslog-ng"); > > }; > > > > destination misc { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/misc"); > > }; > > > > > > ## kernel > > filter firewall { > > match("IN=") and match("OUT=") and match("PROTO="); > > }; > > > > filter notfirewall { > > not match("IN=") and not match("OUT=") and not match("PROTO="); > > }; > > > > log { > > source(kernel); > > filter(firewall); > > destination(firewall); > > }; > > > > log { > > source(kernel); > > filter(notfirewall); > > destination(kernel); > > }; > > > > > > ## internal > > log { > > source(syslog-ng); > > destination(syslog-ng); > > }; > > > > > > ## syslog > > filter invalid { > > not host("^syslog@[a-z]+$"); > > }; > > > > filter postfix { > > host("^syslog@[a-z]+$") > > and program("^postfix/"); > > }; > > > > filter cron { > > host("^syslog@[a-z]+$") > > and program("^(/USR/SBIN/CRON|/usr/sbin/cron)$"); > > }; > > > > filter generic { > > host("^syslog@[a-z]+$") > > and program("^([a-z][a-z._-]*)$"); > > }; > > > > log { > > source(syslog); > > filter(invalid); > > destination(invalid); > > }; > > > > log { > > source(syslog); > > filter(postfix); > > destination(postfix); > > }; > > > > log { > > source(syslog); > > filter(cron); > > destination(cron); > > }; > > > > log { > > source(syslog); > > filter(generic); > > destination(generic); > > }; > > > > log { > > source(syslog); > > destination(misc); > > flags(fallback); > > }; > > > > i'm running linux debian 2.6.11.8 testing > > > > thanks in advance, > > iv > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > >-- ># Jesse Molina ># Mail = jesse(a)opendreams.net ># Page = page-jesse(a)opendreams.net ># Cell = 1.602.323.7608 ># Web = http://www.opendreams.net/jesse/ > > > > >------------------------------ > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng > > >End of syslog-ng Digest, Vol 1, Issue 1253 >****************************************** Muggalla Balajee,

1 0

how to avoid logging to consoles?
by iv 23 May '05

23 May '05

hi all i'm trying to configure syslog-ng for logging events from firewall everything works fine, except one thing: all messages appear on all my consoles how can i avoid that? it makes impossible working with the console, logs appear even while editing files and situation does't change when i comment out all "log" entries in the syslog-ng.conf file please, any ideas:) my syslog-ng.conf: options { use_fqdn(yes); use_dns(no); chain_hostnames(yes); use_time_recvd(no); # sync(10); perm(0640); owner("root"); group("root"); create_dirs(yes); dir_perm(0750); dir_owner("root"); dir_group("root"); }; source syslog { unix-stream("/dev/log"); }; source kernel { file("/proc/kmsg"); }; source syslog-ng { internal(); }; destination firewall { file("/spool/$HOST/$YEAR/$MONTH/$DAY/firewall"); }; destination kernel { file("/spool/$HOST/$YEAR/$MONTH/$DAY/kernel"); }; destination invalid { file("/spool/unknown/$YEAR/$MONTH/$DAY/invalid"); }; destination postfix { file("/spool/$HOST/$YEAR/$MONTH/$DAY/postfix"); }; destination cron { file("/spool/$HOST/$YEAR/$MONTH/$DAY/cron"); }; destination generic { file("/spool/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM"); }; destination syslog-ng { file("/spool/$HOST/$YEAR/$MONTH/$DAY/syslog-ng"); }; destination misc { file("/spool/$HOST/$YEAR/$MONTH/$DAY/misc"); }; ## kernel filter firewall { match("IN=") and match("OUT=") and match("PROTO="); }; filter notfirewall { not match("IN=") and not match("OUT=") and not match("PROTO="); }; log { source(kernel); filter(firewall); destination(firewall); }; log { source(kernel); filter(notfirewall); destination(kernel); }; ## internal log { source(syslog-ng); destination(syslog-ng); }; ## syslog filter invalid { not host("^syslog@[a-z]+$"); }; filter postfix { host("^syslog@[a-z]+$") and program("^postfix/"); }; filter cron { host("^syslog@[a-z]+$") and program("^(/USR/SBIN/CRON|/usr/sbin/cron)$"); }; filter generic { host("^syslog@[a-z]+$") and program("^([a-z][a-z._-]*)$"); }; log { source(syslog); filter(invalid); destination(invalid); }; log { source(syslog); filter(postfix); destination(postfix); }; log { source(syslog); filter(cron); destination(cron); }; log { source(syslog); filter(generic); destination(generic); }; log { source(syslog); destination(misc); flags(fallback); }; i'm running linux debian 2.6.11.8 testing thanks in advance, iv

3 2

No line break every so often
by Mike Tremaine 23 May '05

23 May '05

I just converted a Redhat 9 machine to syslog-ng yesterday and I'm having a littel problem with 2 lines running together. Here are the specs in question. mgt@quasar ~ [1] rpm -q syslog-ng syslog-ng-1.6.7-2 mgt@quasar ~ [2] rpm -q sendmail sendmail-8.13.3-2.rhl9 mgt@quasar ~ [3] rpm -q libol libol-0.3.16-1 mgt@quasar ~ [4] uname -a Linux quasar 2.4.20-37.9.legacy #1 Mon Sep 27 19:40:23 EDT 2004 i686 i686 i386 GNU/Linux The problem I'm seeing is every so often sendmail will log like so... May 18 17:45:46 quasar sendmail[30415]: j4J0jdNg030415: from=<millie.zuniga_om(a)southtrust.com>, size=2520, class=0, nrcpts=1, msgid=<2.2.32.2004051809282400312642(a)southtrust.com>, proto=ESMTP, daemon=MTA, relay=[220.80.216.171]<22>May 18 17:45:46 sendmail[30415]: j4J0jdNg030415: Milter add: header: Received-SPF: none (quasar.stellarcore.net: 220.80.216.171 is neither permitted nor denied by domain of southtrust.com) receiver=quasar.stellarcore.net; client-ip=220.80.216.171; helo=localhost; envelope-from=millie.zuniga_om(a)southtrust.com; x-software=spfmilter 0.93 http://www.acme.com/software/spfmilter/; Notice the 22 that should be a line break between the 2 log lines. Has anyone noticed something like this? -- Mike Tremaine mgt(a)stellarcore.net http://www.stellarcore.net

2 6

Logs rotate and compress but still log to compressed file
by Rechtorik, Keith 21 May '05

21 May '05

I am running SUSE 9.1 and I have syslog-ng logging information from our PIX. After a rotate is done the file is compressed and rotated but syslog-ng keeps logging to the compressed file instead of the newly created file. Any help would be greatly appreciated. Here are my conifgs. If you need anymore information I will gladly send it. /etc/logrotate.d/syslog /var/log/pix/voclog { rotate 4 daily compress delaycompress postrotate # kill -HUP `cat /var/run/syslog-ng.pid` # /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null ||true /etc/init.d/syslog reload /etc/init.d/apache2 reload endscript } /etc/syslog-ng/syslog-ng.conf source src { # # include internal syslog-ng messages # note: the internal() soure is required! # unix-stream("/dev/log"); internal(); tcp(); udp(); # # the following line will be replaced by the # socket list generated by SuSEconfig using # variables from /etc/sysconfig/syslog: # #@SuSEconfig_SOCKETS@ # # # uncomment to process log messages from network: # #udp(ip("0.0.0.0") port(514)); }; # # filter definitions # filter voclog { facility(local5); }; filter vpnlog { facility(local7); }; destination voclog { file("/var/log/pix/voclog"); }; log { source(src); filter(voclog); destination(voclog); }; destination vpnlog { file("/var/log/vpnlog"); }; log { source(src); filter(vpnlog); destination(vpnlog); }; Keith Rechtorik Network Administrator Information Systems and Technology krechtorik(a)vocollect.com * CONFIDENTIAL, PRIVILEGED COMMUNICATION * This e-mail transmission is private and intended for the addressee(s) only. It may contain information that is privileged and/or confidential. If you have received this transmission in error, you are not authorized to read, copy, disclose or disseminate it in any manner. If you have received it in error, please delete it and all copies (including backup copies) that have been made, and transmit a reply message informing the sender that it was misdirected.

3 2

syslog-ng not starting
by Rechtorik, Keith 20 May '05

20 May '05

I am attempting to install syslog-ng on SUSE Linux and having issues starting the service. Port 514 is not listening and I assume it because the syslog-ng service is not starting. Does the syslog service start the syslog-ng service? If not how do I start the service? Thanks. Keith Rechtorik Network Administrator

5 4

Shiming Yang/OCIO_CorpDataSecurity/Planning_Office/HQ_for_the_Americas/BTMNA is out of the office.
by Shiming Yang 20 May '05

20 May '05

I will be out of the office starting 05/20/2005 and will not return until 05/21/2005. I will respond to your message when I return. If there is problem about Proxy or IBM web hosting facility, please call my backup Will at 8380. ----------------------------------------- The information contained in this electronic mail message, and any and all accompanying documents, constitutes confidential information. If you are not the intended recipient of this information, any disclosure, copying, distribution, or the taking of any action in reliance on it is strictly prohibited. If you received this information in error, please notify the sender immediately and destroy this communication. Messages sent via this medium may be subject to delays and/or unauthorized alteration. Neither The Bank of Tokyo-Mitsubishi, Ltd. nor any of its affiliates shall be held liable for the contents of this message.

1 0

[PATCH] use_fqdn with gethostname() not returning fqdn
by Sven Wegener 19 May '05

19 May '05

Hi all! I came across this issue while I was setting up a central syslog-ng server that collects logs from several hosts in different domains. I wanted to use the use_fqdn option to distinguish every host in my logs better, but all I saw was just the plain hostname. Please find attached two patches, one against 1.6.7 and one against 1.9.4 that add support for fqdns. If gethostname() returns a name without dots it tries to lookup the fqdn of the host. Cheers, Sven -- Sven Wegener Gentoo Linux Developer http://www.gentoo.org/

2 4