August 2005 - syslog-ng - lists.balabit.hu

How to make syslog to write to a new file every 10 mins
by Hermann Tse 04 Aug '05

04 Aug '05

Hi, I can make it to write to a new file every hour by the following destination firewall {file ("var/log/firewall/firewall_$YEAR_$MONTH_$DAY_$HOUR")} but how I can make it to write to a new file every 5 minutes or 10 minutes? Thanks __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

FW: Mark from 1.9.4 to 1.9.5
by Edward Brookhouse 04 Aug '05

04 Aug '05

I was mistaken - the - MARK - is back - My only option left is to hack the source and remove the function and the reference to it - Anyone have any other suggestions for getting rid of the Mark ??? Is there a compile time option to turn this off??? Even stranger is that the source declares: cfg.c: self->mark_freq = 1200; /* 20 minutes */ but I am seeing a mark once an hour TIA EB _____ From: Edward Brookhouse [mailto:ebroo@healthydirections.com] Sent: Wednesday, August 03, 2005 9:58 AM To: 'Syslog-ng users' and developers' mailing list' Subject: Mark from 1.9.4 to 1.9.5 Hi all, Using 1.9.4 I experienced the -Mark-being inserted although no mark() option was specified in the config - I just upgraded to the 1.9.5 source and the behavior of mark seems to be back to normal - Just FYI E

3 3

RE: [syslog-ng] FW: Mark from 1.9.4 to 1.9.5
by Frans Stekelenburg 04 Aug '05

04 Aug '05

Are you absolutly sure it isn't a setting somewhere in /etc? You may set the interval to anything you like on Debian by editing /etc/init.d/sysklogd. This sets it to 60 minutes: SYSLOGD="-m 60" (Then restart the syslog daemon: # /etc/init.d/sysklogd restart ) On Red Hat and derivatives, edit /etc/sysconfig/syslog : SYSLOGD_OPTIONS="-m 60" Must come from somewhere, right? ;-) ________________________________ From: Edward Brookhouse [mailto:ebroo@healthydirections.com] Sent: woensdag 3 augustus 2005 18:56 To: 'Syslog-ng users' and developers' mailing list' Subject: [syslog-ng] FW: Mark from 1.9.4 to 1.9.5 I was mistaken - the - MARK - is back - My only option left is to hack the source and remove the function and the reference to it - Anyone have any other suggestions for getting rid of the Mark ??? Is there a compile time option to turn this off??? Even stranger is that the source declares: cfg.c: self->mark_freq = 1200; /* 20 minutes */ but I am seeing a mark once an hour TIA EB ________________________________ From: Edward Brookhouse [mailto:ebroo@healthydirections.com] Sent: Wednesday, August 03, 2005 9:58 AM To: 'Syslog-ng users' and developers' mailing list' Subject: Mark from 1.9.4 to 1.9.5 Hi all, Using 1.9.4 I experienced the -Mark-being inserted although no mark() option was specified in the config - I just upgraded to the 1.9.5 source and the behavior of mark seems to be back to normal - Just FYI E

2 1

Re: syslog-ng Digest, Vol 4, Issue 5
by Arnold Wang 03 Aug '05

03 Aug '05

Thanks for your help, Valdis. I run the strace and found the missing library files. My current $CHROOTDIR looks like this: ./ ./lib ./lib/libnss_dns.so.2 ./etc ./etc/ld.so.cache ./etc/resolv.conf ./etc/localtime ./etc/host.conf ./etc/hosts ./etc/syslog-ng ./etc/syslog-ng/syslog-ng.conf ./etc/nsswitch.conf ./dev ./dev/zero ./dev/null ./var ./var/log ./var/log/syslogng.log ./var/log/HOSTS I guess I'll need more files once I start logging to MYSQL, however it should be a easy task now with the help of strace and the kind people of this list, I hope. On Wed, 2005-08-03 at 12:00 +0200, syslog-ng-request(a)lists.balabit.hu wrote: > On Tue, 02 Aug 2005 15:28:01 PDT, Arnold Wang said: > > > I'm running syslog-ng in chroot mode, followed the instructions in > > http://www.campin.net/syslog-ng/chroot-jail.html. I also enabled DNS > > lookup so I can show the Cisco routers in their friendly names instead > > of IPs. The DNS lookup works fine until I enabled chroot mode. I copied > > "nsswitch.conf" and "resolv.conf" files into $CHROOTDIR/etc as well, > > just in case. > > You'll also need any shared libs your syslog-ng binary needs (use ldd to find them), > and probably stuff in $CHROOT/dev as well (dev/null and dev/zero come to mind). > > I'm probably missing something here - 'strace -f chroot $CHROOT bin/syslog-ng' will > show you if you're missing anything else... > > > BTW, the host is RHEL4 and I set SELinux to "permissive". > > 'permissive' will probably throw a whole lot of AVC messages unless you label > the contexts for the files in the chroot tree (fortunately, there's hopefully > not a lot, so hand-labelling is probably feasible). Sorry, the inability to > use 'restorecon' to label a chroot tree is a known deficiency in the current > tools... > > Fortunately, in permissive mode, each avc message is only printed once, so you'll > get spammed with a bunch of messages at startup (and probably one/two more logmsgs > for each logfile it opens). > > > Will my configuration work? If so, what should I check? Thanks in > > advance for help. > > Shared libs.. /dev entries. The strace command I gave should help find > other stuff that's missing. Good luck. ;)

1 0

Mark from 1.9.4 to 1.9.5
by Edward Brookhouse 03 Aug '05

03 Aug '05

Hi all, Using 1.9.4 I experienced the -Mark-being inserted although no mark() option was specified in the config - I just upgraded to the 1.9.5 source and the behavior of mark seems to be back to normal - Just FYI E

1 0

RE: [syslog-ng] syslog-ng- filter() problem
by Frans Stekelenburg 03 Aug '05

03 Aug '05

try making another filter first with the three filters and 'or' statements. Sounds like your config creates an and-and-and situation for you, leading in nothing beeing logged. I think I came across this situation on one of the helpful pages around (google), but unfortunatly don't remember where, so I can't refer you to it. regards, frans _____ From: Kelly Pow [mailto:kelly.pow@sjrb.ca] Sent: dinsdag 2 augustus 2005 18:55 To: Syslog-ng users' and developers' mailing list; ebroo(a)healthydirections.com Subject: RE: [syslog-ng] syslog-ng- filter() problem Hi, I am collecting traps and syslog data Yes they are being sent to the right place. Yes the destinations exist and the permissions are correct I am running Gentoo And syslog-ng version- 1.6.5-r2 The problem is: log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; if I only have : log { source(src); filter(f_snmptrap); destination(ipbb_traps); }; or log { source(src); filter(f_ipbb1); destination(ipbb_traps); }; but when I add more filters it give me nothing Why? Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Edward Brookhouse Sent: Friday, July 29, 2005 5:08 AM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] syslog-ng- filter() problem Are you collecting traps or syslog data ? Tcpdump is your friend - are the syslog speakers speaking to the right place ? Is anything else being logged on the box from other sources? Does the destination exist and permissions correct What os ? Which versions of syslog-ng _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Kelly Pow Sent: Thursday, July 28, 2005 5:55 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng- filter() problem Hi, I am trying to collect traps from these two networks. 66.163.79.0/255.255.255.128 and 64.251.65.224/255.255.255.240 I don't understand why when I do this it doesn't collect anything Any ideas/.?? ------------------------------------------------------------------------ ------------------------------- source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #filter snmptrap filter f_snmptrap { level(warn); }; #testing filters for the different networks filter f_ipbb1 {netmask("66.163.79.0/255.255.255.128"); }; filter f_ipbb2 {netmask("64.251.65.224/255.255.255.240"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; ------------------------------------------------------------------------ ----------------------------------- Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca

1 0

help on DNS issue when running syslog-ng chrooted
by Arnold Wang 03 Aug '05

03 Aug '05

Hi, I'm a newbie to the syslog-ng. I just have the application installed and configured since yesterday and I like it already. However, I'm running into a problem. I hope someone on this list has done it already and can help me out. I'm running syslog-ng in chroot mode, followed the instructions in http://www.campin.net/syslog-ng/chroot-jail.html. I also enabled DNS lookup so I can show the Cisco routers in their friendly names instead of IPs. The DNS lookup works fine until I enabled chroot mode. I copied "nsswitch.conf" and "resolv.conf" files into $CHROOTDIR/etc as well, just in case. BTW, the host is RHEL4 and I set SELinux to "permissive". Will my configuration work? If so, what should I check? Thanks in advance for help.

2 1

syslog-ng starting problem
by javier rojas 02 Aug '05

02 Aug '05

hello, i'm getting an error when trying to start the syslog-ng server... here's the error: [root@monitor-2 etc]# /etc/init.d/syslog-ng start Starting system logger: parse error at 16 Parse error reading configuration file, exiting. [FAILED] Starting kernel logger: [root@monitor-2 etc]# here's the syslog-ng.conf file: # # Configuration file for syslog-ng under Debian # # attempts at reproducing default syslog behavior # the standard syslog levels are (in descending order of priority): # emerg alert crit err warning notice info debug # the aliases "error", "panic", and "warn" are deprecated # the "none" priority found in the original syslogd configuration is # only used in internal messages created by syslogd ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY',---line 16 '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; ## Log on to text file ## destination hosts { file("/var/log/$HOST.$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log {source(net); destination(hosts); }; ## Log on to text file ## destination hosts { file("/var/log/messages"); }; log {source(net); destination(hosts); }; #Then comment out this line -- # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; #Then uncomment out this line -- # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. source src { unix-dgram("/dev/log"); internal(); }; source net { udp(); }; ###### # options options { # disable the chained hostname format in logs # (default is enabled) chain_hostnames(0); # the time to wait before a died connection is re-established # (default is 60) time_reopen(10); # the time to wait before an idle destination file is closed # (default is 60) time_reap(360); # the number of lines buffered before written to file # you might want to increase this if your disk isn't catching with # all the log messages you get or if you want less disk activity # (say on a laptop) # (default is 0) #sync(0); # the number of lines fitting in the output queue log_fifo_size(2048); # enable or disable directory creation for destination files create_dirs(yes); # default owner, group, and permissions for log files # (defaults are 0, 0, 0600) #owner(root); group(adm); perm(0640); # default owner, group, and permissions for created directories # (defaults are 0, 0, 0700) #dir_owner(root); #dir_group(root); dir_perm(0755); # enable or disable DNS usage # syslog-ng blocks on DNS queries, so enabling DNS may lead to # a Denial of Service attack # (default is yes) use_dns(no); # maximum length of message in bytes # this is only limited by the program listening on the /dev/log Unix # socket, glibc can handle arbitrary length log messages, but -- for # example -- syslogd accepts only 1024 bytes # (default is 2048) #log_msg_size(2048); }; ###### # sources # all known message sources source s_all { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); # use the above line if you want to receive remote UDP logging messages # (this is equivalent to the "-r" syslogd flag) # udp(); }; ###### # destinations # some standard log files destination df_auth { file("/var/log/auth.log"); }; destination df_syslog { file("/var/log/syslog"); }; destination df_cron { file("/var/log/cron.log"); }; destination df_daemon { file("/var/log/daemon.log"); }; destination df_kern { file("/var/log/kern.log"); }; destination df_lpr { file("/var/log/lpr.log"); }; destination df_mail { file("/var/log/mail.log"); }; destination df_user { file("/var/log/user.log"); }; destination df_uucp { file("/var/log/uucp.log"); }; # these files are meant for the mail system log files # and provide re-usable destinations for {mail,cron,...}.info, # {mail,cron,...}.notice, etc. destination df_facility_dot_info { file("/var/log/$FACILITY.info"); }; destination df_facility_dot_notice { file("/var/log/$FACILITY.notice"); }; destination df_facility_dot_warn { file("/var/log/$FACILITY.warn"); }; destination df_facility_dot_err { file("/var/log/$FACILITY.err"); }; destination df_facility_dot_crit { file("/var/log/$FACILITY.crit"); }; # these files are meant for the news system, and are kept separated # because they should be owned by "news" instead of "root" destination df_news_dot_notice { file("/var/log/news/news.notice" owner("news")); }; destination df_news_dot_err { file("/var/log/news/news.err" owner("news")); }; destination df_news_dot_crit { file("/var/log/news/news.crit" owner("news")); }; # some more classical and useful files found in standard syslog configurations destination df_debug { file("/var/log/debug"); }; destination df_messages { file("/var/log/messages"); }; # pipes # a console to view log messages under X destination dp_xconsole { pipe("/dev/xconsole"); }; # consoles # this will send messages to everyone logged in destination du_all { usertty("*"); }; ###### # filters # all messages from the auth and authpriv facilities filter f_auth { facility(auth, authpriv); }; # all messages except from the auth and authpriv facilities filter f_syslog { not facility(auth, authpriv); }; # respectively: messages from the cron, daemon, kern, lpr, mail, news, user, # and uucp facilities filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; # some filters to select messages of priority greater or equal to info, warn, # and err # (equivalents of syslogd's *.info, *.warn, and *.err) filter f_at_least_info { level(info..emerg); }; filter f_at_least_notice { level(notice..emerg); }; filter f_at_least_warn { level(warn..emerg); }; filter f_at_least_err { level(err..emerg); }; filter f_at_least_crit { level(crit..emerg); }; # all messages of priority debug not coming from the auth, authpriv, news, and # mail facilities filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; # all messages of info, notice, or warn priority not coming form the auth, # authpriv, cron, daemon, mail, and news facilities filter f_messages { level(info,notice,warn) and not facility(auth,authpriv,cron,daemon,mail,news); }; # messages with priority emerg filter f_emerg { level(emerg); }; # complex filter for messages usually sent to the xconsole filter f_xconsole { facility(daemon,mail) or level(debug,info,notice,warn) or (facility(news) and level(crit,err,notice)); }; ###### # logs # order matters if you use "flags(final);" to mark the end of processing in a # "log" statement # these rules provide the same behavior as the commented original syslogd rules # auth,authpriv.* /var/log/auth.log log { source(s_all); filter(f_auth); destination(df_auth); }; # *.*;auth,authpriv.none -/var/log/syslog log { source(s_all); filter(f_syslog); destination(df_syslog); }; # this is commented out in the default syslog.conf # cron.* /var/log/cron.log #log { # source(s_all); # filter(f_cron); # destination(df_cron); # daemon.* -/var/log/daemon.log log { source(s_all); filter(f_daemon); destination(df_daemon); }; # kern.* -/var/log/kern.log log { source(s_all); filter(f_kern); destination(df_kern); }; # lpr.* -/var/log/lpr.log log { source(s_all); filter(f_lpr); destination(df_lpr); }; # mail.* -/var/log/mail.log log { source(s_all); filter(f_mail); destination(df_mail); }; # user.* -/var/log/user.log log { source(s_all); filter(f_user); destination(df_user); }; # uucp.* /var/log/uucp.log log { source(s_all); filter(f_uucp); destination(df_uucp); }; # mail.info <http://mail.info> -/var/log/mail.info log { source(s_all); filter(f_mail); filter(f_at_least_info); destination(df_facility_dot_info); }; # mail.warn -/var/log/mail.warn log { source(s_all); filter(f_mail); filter(f_at_least_warn); destination(df_facility_dot_warn); }; # mail.err /var/log/mail.err log { source(s_all); filter(f_mail); filter(f_at_least_err); destination(df_facility_dot_err); }; # news.crit /var/log/news/news.crit log { source(s_all); filter(f_news); filter(f_at_least_crit); destination(df_news_dot_crit); }; # news.err /var/log/news/news.err log { source(s_all); filter(f_news); filter(f_at_least_err); destination(df_news_dot_err); }; # news.notice /var/log/news/news.notice log { source(s_all); filter(f_news); filter(f_at_least_notice); destination(df_news_dot_notice); }; # *.=debug;\ # auth,authpriv.none;\ # news.none;mail.none -/var/log/debug log { source(s_all); filter(f_debug); destination(df_debug); }; # *.=info;*.=notice;*.=warn;\ # auth,authpriv.none;\ # cron,daemon.none;\ # mail,news.none -/var/log/messages log { source(s_all); filter(f_messages); destination(df_messages); }; # *.emerg * log { source(s_all); filter(f_emerg); destination(du_all); }; # daemon.*;mail.*;\ # news.crit;news.err;news.notice;\ # *.=debug;*.=info;\ # *.=notice;*.=warn |/dev/xconsole log { source(s_all); filter(f_xconsole); destination(dp_xconsole); }; does anybody know why?.... thanx...!!! -- Ciao,Javier linux user #393724

1 0

RE: [syslog-ng] Mark problems
by Frans Stekelenburg 02 Aug '05

02 Aug '05

I think it is (also) something that can be turned on on a SYSLOG client (sending host) with an extra option to the syslog daemon, and in it's local syslog.conf. The fact that you don't have mark in your conf, explains perhaps why it is not filtered out;-) Regards, Frans Some info from our internal KB: Add mark.debug to the syslog.conf # Selector Action Comment mark.debug;*.debug @centrallog # 10.20.30.40 Mark Messages ------------- Make use of mark messages (time stamps). Mark messages can be turned on to make it easier to analyze the timeline of messages and to identify possible gaps within the log archives. Mark messages are generated by syslogd after a predefined time period. Other periods can be specified during the syslogd startup. To activate mark messages, the script file that starts syslogd needs to be to edited. The file "/etc/init.d/syslog" (solaris) must be edited within the "start" section. In the following example, syslogd is called to set a mark interval of 10 minutes, as follows: /usr/sbin/syslog -m 10 1>/dev/console 2>&1 If only -m is stated, the default interval is 20 minutes. > -----Original Message----- > From: Edward Brookhouse [mailto:ebroo@healthydirections.com] > Sent: dinsdag 2 augustus 2005 13:33 > To: 'Syslog-ng users' and developers' mailing list' > Subject: [syslog-ng] Mark problems > > Hi all, > > I am using Syslog-NG 1.9.4 on Fedora Core4 - and I am seeing -- > MARK - in my logs when I should not be. > > To my understanding (via google and man pages) If you put the option * > mark(n) in the options section you will get a -- MARK -- > every N times. > > I have no mark option... > > Any thoughts on how to trouble shoot? > > > My conf file has this for options > > options { > # use_fqdn(yes); > # use_dns(yes); > # dns_cache(yes); > keep_hostname(yes); > long_hostnames(off); > sync(1); > log_fifo_size(1024); > }; > > > A search for mark in the conf returns nada ... > > > TIA > > Edward > Ebrooathealthydirectionsdotcomlame > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

3 2

RE: [syslog-ng] ng to ng then to syslog
by Frans Stekelenburg 02 Aug '05

02 Aug '05

I agree with the previous poster, why indeed use another (lesser) syslog ;-) But if you insist: Try with the 'spoof_source(yes)' as option in your tcp(... <options>). I also learned that localip() can be used to force a certain local ip, but I don't think that applies to your setup. Ref: http://www.balabit.com/products/syslog_ng/reference-2.0/syslog-ng.html/i ndex.html#destinations 'luck! Frans -----Original Message----- From: Gerardo Amaya [mailto:joseg@galileo.edu] Sent: Friday, July 29, 2005 11:10 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] ng to ng then to syslog Hello all. First thanks for all the help on first issue, it was some stupid filter. I'm configured to send syslog messages from server1 to server2 both with syslog-ng. Now what I need is to pass messages from server1 to server2 via syslog-ng(already done that) and as soon as the event gets in syslog-ng of server2 to send it to syslog daemon in server2. I have also done that but the problem is that the events appear as they are coming locally and not from server1. Is there a way to change that? thanks in advance Gerardo Amaya _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3