August 2005 - syslog-ng - lists.balabit.hu

missing logs when forwarded from one syslog-ng to another syslog-ng
by Arnold Wang 09 Aug '05

09 Aug '05

I have two syslog-ng servers configured, one in the DMZ for devices outside firewall send logs to and another one in the LAN. The logs send to the DMZ one will be forwarded to the LAN one, at least that's my original idea. However, it seems very unstable on the forwarding. Some of the logs appeared in the DMZ one were not shown up in the LAN one. For example, I just did a test from two routers outside the firewall and there were two logs generated in DMZ log server: [root@rcarhlp01 qwestdia1]# tail -1 qwestdia1.log Aug 9 13:30:25 qwestdia1 128: *Apr 28 06:56:48: %SYS-5-CONFIG_I: Configured from console by vty0 (204.146.209.151) [root@rcarhlp01 qwestdia1]# tail -1 ../qwestdia2/qwestdia2.log Aug 9 13:30:59 qwestdia2 46: *Apr 28 06:57:24: %SYS-5-CONFIG_I: Configured from console by vty0 (204.146.209.151) However, I only saw one in the LAN log server: [root@rcarhlp02 qwestdia1]# tail -1 qwestdia1.log Aug 8 16:18:39 qwestdia1 127: *Apr 27 09:35:42: %SYS-5-CONFIG_I: Configured from console by vty0 (204.146.209.248) ** This is still the one from last night ** [root@rcarhlp02 qwestdia1]# tail -1 ../qwestdia2/qwestdia2.log Aug 9 13:30:59 qwestdia2 46: *Apr 28 06:57:24: %SYS-5-CONFIG_I: Configured from console by vty0 (204.146.209.151) My configurations on both machines are like the following: ---- Configuration for LAN server -------- [root@rcarhlp02 syslog-ng]# more syslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_slng { internal(); }; source s_tcp { tcp(port (5140) tcp-keep-alive(yes)); }; source s_udp { udp(port (514)); }; destination d_slng { file("/var/syslog-ng/syslog-ng.log"); }; destination d_file { file("/var/syslog-ng/HOSTS/$HOST/$HOST.log" owner (root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; destination d_mysql { pipe("/var/syslog-ng/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(s_slng); destination(d_slng); }; log { source(s_tcp); source(s_udp); destination(d_file); destination (d_mysql); }; #log { source(s_tcp); destination(d_mysql); }; #log { source(s_udp); destination(d_file); }; #log { source(s_udp); destination(d_mysql); }; # vim: syntax=syslog-ng [root@rcarhlp02 syslog-ng]# ----- Configuration for DMZ server --------- [root@rcarhlp01 syslog-ng]# more syslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_udp { udp(port(514)); }; source s_slng { internal(); }; destination d_slng { file("/var/syslog-ng/syslog-ng.log"); }; destination d_local { file("/var/syslog-ng/HOSTS/$HOST/$HOST.log" owner (root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; destination d_remote { tcp("10.17.2.146" port(5140) tcp-keep-alive (yes)); }; log { source(s_udp); destination(d_local); destination(d_remote); }; #log { source(s_udp); destination(d_remote); }; log { source(s_slng); destination(d_slng); }; # vim: syntax=syslog-ng [root@rcarhlp01 syslog-ng]#

1 0

streams log driver on AIX
by Michael Mannsberger 09 Aug '05

09 Aug '05

What streams log driver is syslog using on AIX besides /dev/log?

1 0

'make fails' @ conflicting types for 'affile_dd_set_file_perm'
by OpenMacNews 08 Aug '05

08 Aug '05

hi, moving (finally) to bldg syslog-ng 1.9-snapshot on OSX 10.4.2 prereqs of glib 2.7.7 & eventlog-snapshot are built/installed. syslog-ng-1.9-snapshot fails on 'make' @: ... if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/bind9/include -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT affile.o -MD -MP -MF ".deps/affile.Tpo" -c -o affile.o affile.c; \ then mv -f ".deps/affile.Tpo" ".deps/affile.Po"; else rm -f ".deps/affile.Tpo"; exit 1; fi affile.c:305: error: conflicting types for 'affile_dd_set_file_perm' affile.c:305: note: an argument type that has a default promotion can't match an empty parameter name list declaration affile.h:75: error: previous declaration of 'affile_dd_set_file_perm' was here affile.c:329: error: conflicting types for 'affile_dd_set_dir_perm' affile.c:329: note: an argument type that has a default promotion can't match an empty parameter name list declaration affile.h:78: error: previous declaration of 'affile_dd_set_dir_perm' was here affile.c: In function 'affile_dd_init': affile.c:422: warning: comparison is always false due to limited range of data type affile.c:428: warning: comparison is always false due to limited range of data type make[2]: *** [affile.o] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 % checking the declarations for 'affile_dd_set_file_perm' ... % grep affile_dd_set_file_perm `grep -rln affile_dd_set_file_perm .` ./src/affile.c:affile_dd_set_file_perm(LogPipe *s, mode_t file_perm) ./src/affile.h:void affile_dd_set_file_perm(); ./src/cfg-grammar.c: { affile_dd_set_file_perm(last_driver, yyvsp[-1].num); } ./src/cfg-grammar.c: { affile_dd_set_file_perm(last_driver, yyvsp[-1].num); } ./src/cfg-grammar.y: | KW_PERM '(' NUMBER ')' { affile_dd_set_file_perm(last_driver, $3); } ./src/cfg-grammar.y: | KW_PERM '(' NUMBER ')' { affile_dd_set_file_perm(last_driver, $3); } it's not immediately clear which is the conflict. ideas? richard

2 3

eventlog snap missing AUTHORS
by OpenMacNews 07 Aug '05

07 Aug '05

hi, the eventlog snapshot src tree is missing "AUTHORS" which causes "autoreconf -i -f" to complain/choke ... a simple % touch AUTHORS fixes the prob, so you might wish to add it to the distro ... cheers, richard

1 0

messages when I restart syslog-ng
by Thierry B 07 Aug '05

07 Aug '05

Hello, When I restart syslog-ng, he tells me that: debian:/home/thierry# /etc/init.d/syslog-ng restart CONSOLE_LOG_LEVEL is of unaccepted value. KERNEL_RINGBUF_SIZE is of unaccepted value. Thanks :-) Bye

2 1

exemple for logging with a regexp
by Thierry B 07 Aug '05

07 Aug '05

Hello, I'd like to ask you a queqtion about syslog-ng. I'd like to log for example, all mails from postfix in mail.log and for example all mails from courier imap to /var/log/imapd. I already manage to do that with syslog using facility like that: local0.* -/var/log/imapd.log mail.* -/var/log/mail.log But I'd like to add a regexp, so he didn't log all things. For example, for postfix, I'd like to add a blank line each time he find a line called "disconnect" or "removed". Is it possible to do that easyly with syslog-ng? Or I can also do that with my actual syslog? Because if I pass to syslog-ng instead of syslog, I'd like to keep my syslog config, except for those logs, that I want to filter with regexp. Thanks :-)

1 0

RE: [syslog-ng] syslog-ng- filter() problem
by Kelly Pow 05 Aug '05

05 Aug '05

HI, Am currently using Syslog-ng to collect snmptraps. My problem is that I amcurrently receiving traps from three different networks and I have to filter them out. I am receiving traps from 64.251.65.224/255.255.255.240 66.163.79.0/255.255.255.128 204.209.214.0/255.255.254.0 Where I want traps from 64.251.65.224/255.255.255.240 and 66.163.79.0/255.255.255.128 to be stored in one file While traps from 204.209.214.0/255.255.254.0 in another. Currently this is what my syslog-ng.conf looks like And I am receiving nothing :-( I am very frustrated with this. Please help. Thank you. options { long_hostnames(yes); keep_hostname(yes); use_fqdn(on); create_dirs(yes); owner(nmadmin); group(users); perm(0755); dir_owner(nmadmin); dir_group(users); dir_perm(0755); sync(0); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #for SNMPTRAP destination ipbb_lab_traps { file("/store/ipbb_lab/traps/$YEAR-$MONTH-$DAY"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; #filter snmptrap filter f_testA { level(warn)and netmask(64.251.65.224/255.255.255.240); }; filter f_testB { level(warn)and netmask(66.163.79.0/255.255.255.128); }; log { source(src); filter(f_testA); destination(ipbb_traps); }; log { source(src); filter(f_testB); destination(ipbb_traps); }; filter f_test2 { level(warn)and netmask(204.209.214.0/255.255.254.0); }; log { source(src); filter (f_test2); destination(ipbb_lab_traps); }; Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca> _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Frans Stekelenburg Sent: Wednesday, August 03, 2005 5:27 AM To: Syslog-ng users' and developers' mailing list; ebroo(a)healthydirections.com Subject: RE: [syslog-ng] syslog-ng- filter() problem try making another filter first with the three filters and 'or' statements. Sounds like your config creates an and-and-and situation for you, leading in nothing beeing logged. I think I came across this situation on one of the helpful pages around (google), but unfortunatly don't remember where, so I can't refer you to it. regards, frans _____ From: Kelly Pow [mailto:kelly.pow@sjrb.ca] Sent: dinsdag 2 augustus 2005 18:55 To: Syslog-ng users' and developers' mailing list; ebroo(a)healthydirections.com Subject: RE: [syslog-ng] syslog-ng- filter() problem Hi, I am collecting traps and syslog data Yes they are being sent to the right place. Yes the destinations exist and the permissions are correct I am running Gentoo And syslog-ng version- 1.6.5-r2 The problem is: log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; if I only have : log { source(src); filter(f_snmptrap); destination(ipbb_traps); }; or log { source(src); filter(f_ipbb1); destination(ipbb_traps); }; but when I add more filters it give me nothing Why? Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca> _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Edward Brookhouse Sent: Friday, July 29, 2005 5:08 AM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] syslog-ng- filter() problem Are you collecting traps or syslog data ? Tcpdump is your friend - are the syslog speakers speaking to the right place ? Is anything else being logged on the box from other sources? Does the destination exist and permissions correct What os ? Which versions of syslog-ng _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Kelly Pow Sent: Thursday, July 28, 2005 5:55 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng- filter() problem Hi, I am trying to collect traps from these two networks. 66.163.79.0/255.255.255.128 and 64.251.65.224/255.255.255.240 I don't understand why when I do this it doesn't collect anything Any ideas/.?? ---------------------------------------------------------------------------- --------------------------- source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #filter snmptrap filter f_snmptrap { level(warn); }; #testing filters for the different networks filter f_ipbb1 {netmask("66.163.79.0/255.255.255.128"); }; filter f_ipbb2 {netmask("64.251.65.224/255.255.255.240"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; ---------------------------------------------------------------------------- ------------------------------- Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca>

1 0

Re: [syslog-ng] Problem with hostnames!
by mrgenius 05 Aug '05

05 Aug '05

phewww.. Its been over a month i am trying different things ..but its not giving me desired result... i have even switched my os from mandrake to RHEL 4 .. still no sucess. i am again explaining my issue.. i've syslog-ng-1.6.8-1 running on RHEL 4 AS. This Server is on public IP 202.163.x.x . And Its receving Logs from Different Devices on network. (basically i run own isp). In Order to give friendly name to IPs of devices what i have done is to enter hostnames against IPs in /etc/hosts file. So as a result of it.. All logs i get gets name of my desire. however Problem arises when i enabled syslog on certain devices which have Prive IP of 192.168.x.x I entered hostnames in /etc/hosts for these private Ips as i did in case of public iP hosts .. but what i am getting in database is not the names of these Hosts.. instead i am getting PRIVATE IPs. I tried running local DNS on machine and make even reserve zones.. still result remained same.. then i entered these hosts names in my ISP's DNS .. but even then same result.. Can Some one tell me Why this is happening?? why in the world syslog-ng is not giving hostnames to PRIVATE IPs. Please help me out :( On 7/15/05, Edward Brookhouse <ebroo(a)healthydirections.com> wrote: > > About the last thing I can think of would be to run syslog-ng in a debug > window (or attach to it with gdb) and see exactly which system calls are > made when an entry arrives. This will tell you which function is being used > to do name resolution – > > So just to make sure I understand whats happening – no matter how hosts > file or use_dns is set you have hosts that are not being resolved? > > > Oh – did you check reverse dns ? > > ------------------------------ > > *From:* mrgenius [mailto:mrgenius420@gmail.com] > *Sent:* Friday, July 15, 2005 3:01 AM > *To:* Edward Brookhouse > *Cc:* Syslog-ng users' and developers' mailing list > *Subject:* Re: [syslog-ng] Problem with hostnames! > > Well if set use_dns(off) then it stops reading /etc/hosts file and start > storing hosts as IP addresses. > > I am using Mandrake 10.1 Official...... > > In nsswitch.conf i have tried by giving DNS, file and file,dns both > combination.. but it doesn't make any difference... its still neither > picking private Ips from /etc/hosts nor from local cache dns server. > > > > On 7/14/05, *Edward Brookhouse* <*ebroo(a)healthydirections.com*<ebroo(a)healthydirections.com>> > wrote: > > What happens if you set use_dns (off); does your hosts file get read then? > What OS is this? How is the system nsswitch.conf setup for resolution? > > Also maybe double check your resolv.conf what is the domain listing and > search order listed in there? > > ------------------------------ > > *From:* *syslog-ng-bounces(a)lists.balabit.hu*<syslog-ng-bounces(a)lists.balabit.hu>[mailto: > *syslog-ng-bounces(a)lists.balabit.hu* <syslog-ng-bounces(a)lists.balabit.hu>] > *On Behalf Of *mrgenius > *Sent:* Thursday, July 14, 2005 12:53 AM > *To:* Ken Garland > *Cc:* Syslog-ng users' and developers' mailing list > *Subject:* Re: [syslog-ng] Problem with hostnames! > > Yes here is the portion of my syslog-ng.cong > > ##################################### > > options { sync (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames (yes); > use_dns (yes); > use_fqdn (yes); > create_dirs (no); > keep_hostname (no); > }; > > source sys { unix-stream ("/dev/log"); internal(); }; > source net { > udp(ip(* 0.0.0.0* <http://0.0.0.0/>) port(514) ); > }; > > > destination d_mysql { > pipe("/tmp/mysql.pipe" > template("INSERT INTO logs > (host, facility, priority, level, tag, datetime, program, msg) > VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', > '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', > '$PROGRAM', '$MSG' );\n") template-escape(yes)); > }; > log { source(net); destination(d_mysql); > > ############################################## > > But if you say that syslog-ng first queries DNS Server ... then why it > is resolving names for all public Ips which i defined in /etc/hosts and > those public Ips have no entries in my defined DNS Servers. > > i am quite confused how this thing is actually working?? > > Regards, > > -Geni > > > > On 7/14/05, *Ken Garland* <* ken.garland(a)rotech.com*<ken.garland(a)rotech.com>> > wrote: > > paste the relevant parts of your .conf file. > > mrgenius wrote: > > > > > Hi All! > > > > I am using Syslog-ng with php-syslog-ng. to give names of my choices > > to different hosts IP what i did was to define hostnames against each > > IP of host in /etc/hosts file. > > > > It was working fine with Public IP adresses.. But I have some hosts on > > local network too with 192.168 IPs . The pRoblem i am now facing is > > that its not storing logs with HOSTNAMES of private IPs. Where as its > > working fine and giving names of Public IPs. > > > > For example In My /etc/hosts file i have these 2 entries > > > > *202.164.1.1* <http://202.164.1.1/> <* http://202.164.1.1*<http://202.164.1.1/>> > broadband-router > > *192.168.77.1* <http://192.168.77.1/> <* http://192.168.77.1*<http://192.168.77.1/>> > primary-router > > > > For 1st entry Logs in database will come with name broadband-router, > > which is what i want > > For 2nd Entry Logs in database will come with name *192.168.77.1*<http://192.168.77.1/> > > <* http://192.168.77.1* <http://192.168.77.1/>>, which is what i Don't > want > > > > > > Any body has any idea?? any thing to do in configuration of syslog-ng?? > > > > Regards, > > > > -Geni > > > >------------------------------------------------------------------------ > > > >_______________________________________________ > >syslog-ng maillist - *syslog-ng(a)lists.balabit.hu*<syslog-ng(a)lists.balabit.hu> > *** * > >*https://lists.balabit.hu/mailman/listinfo/syslog-ng*<https://lists.balabit.hu/mailman/listinfo/syslog-ng> > >Frequently asked questions at *http://www.campin.net/syslog-ng/faq.html*<http://www.campin.net/syslog-ng/faq.html> > > > > > > > >

1 0

strange problem when use "_" in the destination log file name
by Arnold Wang 05 Aug '05

05 Aug '05

Hi, I'm running into a strange problem with syslog-ng 1.6.8 on RHEL 4. In my configuration file, I have the following local log file defined: destination d_file { file("/var/syslog- ng/HOSTS/$HOST/$YEAR/$MONTH/$HOST_$MONTH$DAY.log" owner(root) group (root) perm(0600) dir_perm(0700) create_dirs(yes)); }; However, the log file generated by the syslog-ng for today is named "0803.log", which is different than "hostname_0803.log" as I expected. I tried using escape "\" so it looks like "$HOST\_$MONTH$DAY.log" and it didn't help at all. This problem actually doesn't bother me that much. I changed "_" to "-" or ".", it worked. I'm just curious about this.

4 9

Spoof-source issue
by Jose Gerardo Amaya Giron 05 Aug '05

05 Aug '05

Hello all. I'm using the spoof source feature to centralize my logs to a server. I was hoping that the server will receive the IP message with the source IP address from the source(spoofed of course), but it get it as the source address the syslog-ng server and the spoofed IP address in the message content. Is there a way I can generate the message not with the original source IP as a description, but to have it actually as the IP message. Thanks in advance Gerardo Amaya ---------------------------------------------------------------- Servicio de correo - Universidad Galileo - Guatemala

2 1