May 2005 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]RE: Recommended windows event logger products to work with syslog-ng
by SOLIS, ALEX 03 May '05

03 May '05

I don't think you did anything wrong. When I installed my ntsyslog, it worked fine. You might want to try ntsyslog in debug mode. You can do this by running ntsyslog -debug at the command line. This will show what is being sent over the wire on your console. If your time-stamps are missing during the debug output then ntsyslog might be parsing incorrectly. If they show in the debug output but are missing at the syslog-ng server, then maybe the syslog-ng config should be looked at. There are patches available at the sourceforge project site. I believe one of them is specifically designed to fix "incomplete messages"; Its worth a try if you are out of ideas but like I said before, I did not experience missing timestamps when I deployed. In my experience with NTsyslog, most messages fit in the message buffer ntsyslog sets aside for transmission. I believe the buffer size is set around 1024 so it should accommodate most WinNT eventlog messages. Good luck troubleshooting! Alex -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Shane Presley Sent: Monday, May 02, 2005 8:41 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]RE: Recommended windows event logger products to work with syslog-ng I installed nt-syslog (http://ntsyslog.sorceforge.net) but it seems the messages coming from it do not contain the date/time field? Is that just somethind I did wrong? Also, in general, with these EventLog -> Syslog products, do they capture the entire event log message? For example the sometimes verbose "Description" field? Thanks Shane On 4/21/05, SOLIS, ALEX <asolis(a)oppd.com> wrote: > > I use nt-syslog (http://ntsyslog.sorceforge.net) It seems to work fine although I too get corrupt event logs on the windows boxes every now and then. I am not 100 percent convinced that it is caused by nt-syslog but it seems to be a posibility. > > Alex _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

RE: [syslog-ng]Issues with HP-UX
by Stephen Tanner 03 May '05

03 May '05

This does not work. Syslog-ng still does not log anything. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Stephan Hendl Sent: Tuesday, May 03, 2005 7:59 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Issues with HP-UX your source should look the following source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; the pad_size ist very important. BTW, it is included in the doku as well as in the faq I think. regards Stephan >>> stanner(a)leeclerk.org 05/02/05 9:23 >>> I have recently started using syslog-ng so that I can use stunnel to log to a central loghost. I have gotten syslog-ng working on a linux box, and everything works fine, but my HP-UX boxes won't even log locally, much less log to a loghost. Below, I have included the syslog-ng.conf for one of the hosts. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= options { use_fqdn(no); keep_hostname(no); use_dns(no); long_hostnames(off); sync(3); log_fifo_size(300); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # source src { unix-dgram("/dev/log.un"); internal(); }; # After that set destinations. # First some standard logfile # destination lpr { file("/var/adm/lpr.log"); }; destination mail { file("/var/adm/mail.log"); }; # Some `catch-all' logfiles. # destination syslog { file("/var/adm/syslog/syslog.log"); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { level(info .. warn)and not facility(auth, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; ############################################################### log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_messages); destination(syslog); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); destination(messages); }; ############################################################### ## set up logging to a loghost forwarded from localhost via stunnel destination loghost {tcp("127.0.0.1" port(514));}; # send everything to loghost, too log { source(src); destination(loghost); }; ############################################################### _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng 1.6.7 on solaris10
by kenneth.gullberg＠foreningssparbanken.se 03 May '05

03 May '05

Im having some compilation issues with Solaris 10: bash-3.00# ./configure --disable-tcp-wrapper --disable-spoof-source -- snip-- checking for TCP wrapper library... -lwrap checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking for pthread_create in -lpthread... yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... no checking libol version >= 0.3.14... ok configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating src/tests/Makefile config.status: creating doc/Makefile config.status: creating doc/sgml/Makefile config.status: creating contrib/Makefile config.status: creating syslog-ng.spec config.status: creating src/config.h config.status: executing depfiles commands bash-3.00# which make /usr/ccs/bin/make gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lpthread -lnsl -lsocket -ldoor -lresolv /usr/local/lib/libol.a -lsocket -lnsl -lxnet -Wl,-Bstatic -ll -lwrap -Wl,-Bdynamic ld: fatal: library -ll: not found ld: fatal: library -lwrap: not found ld: fatal: File processing errors. No output written to syslog-ng if i change where -ll and -lwrap is located on the line to: bash-3.00# gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lpthread -lnsl -lsocket -ldoor -lresolv -ll -lwrap /usr/local/lib/libol.a -lsocket -lnsl -lxnet -Wl,-Bstatic -Wl,-Bdynamic I instead get: Undefined first referenced symbol in file deny_severity /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/../../../libwrap.so allow_severity /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/../../../libwrap.so ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status I got around that with editing config.h and changed the TCP wrapper lib line to: #undef ENABLE_TCP_WRAPPER and fiddled around in the src/tests Makefile and .c file Perhaps something missing in the configure scripts?

2 1

Re: Re: [syslog-ng]Issues with HP-UX
by jbrunke＠ctsgi.com 03 May '05

03 May '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

1 0

Re: [syslog-ng]Issues with HP-UX
by Stephan Hendl 03 May '05

03 May '05

your source should look the following source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; the pad_size ist very important. BTW, it is included in the doku as well as in the faq I think. regards Stephan >>> stanner(a)leeclerk.org 05/02/05 9:23 >>> I have recently started using syslog-ng so that I can use stunnel to log to a central loghost. I have gotten syslog-ng working on a linux box, and everything works fine, but my HP-UX boxes won't even log locally, much less log to a loghost. Below, I have included the syslog-ng.conf for one of the hosts. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= options { use_fqdn(no); keep_hostname(no); use_dns(no); long_hostnames(off); sync(3); log_fifo_size(300); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # source src { unix-dgram("/dev/log.un"); internal(); }; # After that set destinations. # First some standard logfile # destination lpr { file("/var/adm/lpr.log"); }; destination mail { file("/var/adm/mail.log"); }; # Some `catch-all' logfiles. # destination syslog { file("/var/adm/syslog/syslog.log"); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { level(info .. warn)and not facility(auth, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; ############################################################### log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_messages); destination(syslog); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); destination(messages); }; ############################################################### ## set up logging to a loghost forwarded from localhost via stunnel destination loghost {tcp("127.0.0.1" port(514));}; # send everything to loghost, too log { source(src); destination(loghost); }; ###############################################################

1 0

RE: [syslog-ng]RE: Recommended windows event logger products to work with syslog-ng
by SOLIS, ALEX 03 May '05

03 May '05

I use nt-syslog (http://ntsyslog.sorceforge.net) It seems to work fine although I too get corrupt event logs on the windows boxes every now and then. I am not 100 percent convinced that it is caused by nt-syslog but it seems to be a posibility. Alex -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu on behalf of Bill Nash Sent: Thu 4/21/2005 5:46 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]RE: Recommended windows event logger products to work with syslog-ng We're using Snare. Haven't seen any problems at all with it. It provides fairly detailed logs. - billn On Thu, 21 Apr 2005, Adams, Russell L. wrote: > We're using Event Reporter. > > Only problem we've had is a corrupt event log caused it to repeatedly > send the few hours messages nonstop. > > Russell > > On Thu, Apr 21, 2005 at 10:54:32AM +0100, Stevan Popovic wrote: >> >> Hello >> >> I have configured syslog-ng to work on my linux box. >> >> I am wondering does anyone use syslog-ng to log windows event logs. If so which products from the windows side are used? >> >> TIA >> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

Issues with HP-UX
by Stephen Tanner 02 May '05

02 May '05

I have recently started using syslog-ng so that I can use stunnel to log to a central loghost. I have gotten syslog-ng working on a linux box, and everything works fine, but my HP-UX boxes won't even log locally, much less log to a loghost. Below, I have included the syslog-ng.conf for one of the hosts. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= options { use_fqdn(no); keep_hostname(no); use_dns(no); long_hostnames(off); sync(3); log_fifo_size(300); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # source src { unix-dgram("/dev/log.un"); internal(); }; # After that set destinations. # First some standard logfile # destination lpr { file("/var/adm/lpr.log"); }; destination mail { file("/var/adm/mail.log"); }; # Some `catch-all' logfiles. # destination syslog { file("/var/adm/syslog/syslog.log"); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { level(info .. warn)and not facility(auth, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; ############################################################### log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_messages); destination(syslog); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); destination(messages); }; ############################################################### ## set up logging to a loghost forwarded from localhost via stunnel destination loghost {tcp("127.0.0.1" port(514));}; # send everything to loghost, too log { source(src); destination(loghost); }; ###############################################################

1 0

Change the facility of forwarded message using syslog-ng is it possible?
by Subodh Nijsure 02 May '05

02 May '05

Hello, I have system where lot of different machines are forwarding me messages with facility of local6 what I want to do is forward them on but change the facility to say local1 when sending it to an udp destination. Is this possible using syslog-ng. I have gone through all the log but couldn't find any of doing this, is it possible to change facility of incoming message using syslog-ng? /Subodh Nijsure

2 2

Re: [syslog-ng]Change the facility of forwarded message using syslog-ng is it possible?
by jbrunke＠ctsgi.com 02 May '05

02 May '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

2 1