September 2005 - syslog-ng - lists.balabit.hu

Pix problem
by Damien Michau 28 Dec '05

28 Dec '05

Hi All ! I have some probleme ta log my pix's log into my syslog-ng server . i have mounted a Syslog-ng server to store my pix's log . But there is nothing in my pix.log i'have put this lines in my syslog-ng.conf source pix { udp(ip(10.60.10.111) port());}; destination pix { file("/var/log/pix.log"); }; log { source(pix);destination(pix); }; Have you one idea ? Thx Damien Michau Paris

4 5

How does regex work with HOST definitions?
by Jason Haar 17 Oct '05

17 Oct '05

Hi there I have a subset of syslog-ng hosts that use a specific DNS formatted naming convention that I wish to ensure all their data is caught by a particular syslog-ng filter. I have filter f_process_Test { host("^...\-..\-ids\-[0-9]+\...\.our\.net$") and not host("abc-xy-ids-02\.our\.net"); }; i.e. I want abc-12-ids-01.aa.our.net and xyz-12-ids-01.aa.our.net to be caught by this filter, but abc-xy-ids-02\.our\.net not to be. I could explicitly name them all I suppose - but there are 12+ of them and they are growing in number. A regex would be much more efficient. Anyway, it doesn't work. That filter never triggers. I know the hostnames are correct as I have a general catch-all rule that logs to filenames containing the hostname - and those hostnames show up in there. Can anyone explain what I've got wrong? REGEX works fine in my "match" calls... This is syslog-ng-1.6.7-2 under CentOS4.1 Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

6 9

bugreport for 1.9.5 on solaris
by Nate Campi 13 Oct '05

13 Oct '05

I built 1.9.5 and eventlog-0.2.3+20050116+1856 on Solaris 8. It wouldn't start with command line arguments like "--pidfile=/foo/syslog-ng.pid", I had to change it to "-p /foo/syslog-ng.pid". The usage message it spits out claims that the --long syntax is supported. The other thing is that "bad_hostname()" isn't implemented in 1.9.5, but I'm sure you already knew that. The 2.0 reference guide lists this as a supported option though. Just FYI. -- Nate NT is the only OS that has caused me to beat a piece of hardware to death with my bare hands.

8 16

Syslog 1.6.8 compile error
by Rohald van Baars 06 Oct '05

06 Oct '05

Hi, can someone please help me to get the compile right. OS: RHEL ES 3 update 4 The ./configure went well no errrors. But the make did not go so well: Error message(s) : >> snip gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afpr gram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lnsl -lresolv / sr/local/lib/libol.a -lnsl -Wl,-Bstatic -Wl,-Bdynamic cfg-lex.o(.text+0x45f): In function `yylex': /root/rpm/syslog-ng/syslog-ng-1.6.8/src/cfg-lex.c:1123: undefined reference to yywrap' cfg-lex.o(.text+0xb33): In function `input': /root/rpm/syslog-ng/syslog-ng-1.6.8/src/cfg-lex.c:1450: undefined reference to yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make: *** [all-recursive] Error 1 << snap Can someone plz explain what went wrong? Rohald van Baars Digitenne B.V. The netherlands WWW: www.digitenne.nl ############################################################################ Attention: The information contained in this message and or attachments is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any system and destroy all copies. ############################################################################

4 3

Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 03 Oct '05

03 Oct '05

Balazs... I didn't know if you'd seen this (original) thread (I won't repeat all of it here, but did repeat Peter's suggested fix below). I applied this fix, and it did resolve my problems, as it did Peter's. I looked at the latest snapshot, and didn't see this particular change applied, so I figured that I'd ask whether this is something that should be applied(?) Or... Possibly... It's resolved through some other means, or worse (for me) maybe it implies that I've got something else misconfigured, that is actually the root cause of my (and maybe Peter's) problem. If there's any information that you need from me, I'd be happy to supply it. Thanks for your good work and efforts! Marvin -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of pnahas(a)mrv.com Sent: Friday, September 30, 2005 2:27 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Ver 1.9.5 problems with facility/level filtering I too have experienced this problem and decided to investigate the source code. Unless I'm missing something, it appears that 1.9.5 simply does not set the correct variable internally, regardless of configuration. The following patch solved the problem for me: --- /home/pnahas/syslog-ng-1.9.5/src/filter.c 2005-01-05 06:40:50.000000000 -0500 +++ filter.c 2005-09-30 16:23:29.000000000 -0400 @@ -162,6 +162,7 @@ { FilterPri *self = g_new0(FilterPri, 1); + self->valid = facilities; self->super.eval = filter_facility_eval; return &self->super; } @@ -180,6 +181,7 @@ { FilterPri *self = g_new0(FilterPri, 1); + self->valid = levels; self->super.eval = filter_level_eval; return &self->super; } Hope that helps! -Peter Nahas

2 1

Fwd: [syslog-ng] syslog-ng not logging
by catenate 03 Oct '05

03 Oct '05

Frowarding to the list, wish gmail used the reply-to header. :( ---------- Forwarded message ---------- From: catenate <infosec(a)gmail.com> Date: Sep 29, 2005 7:54 PM Subject: Re: [syslog-ng] syslog-ng not logging To: fico gid <ficohertz(a)gmail.com> On 9/29/05, fico gid <ficohertz(a)gmail.com> wrote: > > Hi Again, > > Below is the whole syslog-ng.conf file . Yes, it is not separating as > in /host/somehost/year/month/day .. > > <SNIP> > > Let me know if you need more info, Thanks Fico, This has to be the first time I've ever seen someone completely omit an options{}; block. Now I know that syslog-ng will gladly use defaults for all the options if/when you leave that out. Anyways, I'm still not completely clear on how exactly your installation is logging. Are you saying that you have logs going to /var/log/kern.log and the other NON-MACRO destinations, or are you saying that your macro filenames in /var/log/hosts/HOST/YEAR/... are being logged but incorrectly, like /var/log/hosts/YEAR/... ? Please be specific. I did a syntax check on your config file, and it looks fine to me. What version are you using?

3 3

syslog-ng 1.6.8 and dns cache issue
by Ketan Vankawala 02 Oct '05

02 Oct '05

I have currently installed Syslog-ng ver 1.6.8. Here is a snippet of my syslog-ng config file.So accordingly when a syslog message comes in, depending on the ip address, it does a lookup in /etc/hosts, creates an appropriate host name folder and forwards the message there. If the hostname does not exists, it creates a folder named with the ip address. Here is my question: 1) How often does syslog-ng refreshes its dns /hosts cache? Because I have run into issues that even after the /etc/hosts file is updated syslog still keeps logging to the folder created with the ip address. If I restart syslog-ng service it immediately starts forwarding the messages correctly to hostname folder. 2) How can I reduce the dns cache timeout, so it checks /etc/hosts more frequently for any changes? Thanks in advance. Ketan destination hostslocal { file("/var/log/HOSTS/$HOST/$YEAR-$MONTH-$DAY.log" owner(root) group(xxx) perm(0740) dir_perm(0740) create_dirs(yes) template("$R_DATE $FULLHOST $MONTH $S_DAY $S_YEAR $S_HOUR:$S_MIN:$S_SEC: $MESSAGE\n") template-escape(no)); }; log { source(src); destination(hostslocal); };

2 2

RE: [syslog-ng] Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 01 Oct '05

01 Oct '05

>>On Mon, Sep 26, 2005 at 12:30:23PM -0600, Marvin.Nipper(a)Stream.com wrote: >> >> So. I'm looking for any input as to what might be a potential root >> problem. Obviously, there are a whole set of different pre-req components >> for the 1.9.5 world. I'm not sure if I'm dealing with some compatibility >> problem amongst the component versions that I've selected(?), or if the >> problem lies elsewhere. > >There's no obvious cause going by your description, but maybe if we saw >your config we'd notice something. Please post your complete config >file, if you don't mind. > >Thanks. >-- >Nate Here's my current configuration: options { dir_perm(0755); perm(0600); chain_hostnames(no); keep_hostname(yes); log_fifo_size(1000); }; # Catch everything coming from other sysloggers source any_udp { udp(); }; # Pipe used by SEC (Simple Event Correlation) destination SEC {pipe("/tmp/sec"); }; # Various segregated logging files destination routers_log { file("/var/adm/log/routers.log" create_dirs(yes)); }; destination ravlin_log { file("/var/adm/log/ravlin.log" create_dirs(yes)); }; destination windows_log { file("/var/adm/log/windows.log" create_dirs(yes)); }; destination catch-all_log { file("/var/adm/log/catch-all.log" create_dirs(yes)); }; destination test { file("/var/adm/log/test.log" create_dirs(yes)); }; # Some place to dump noise destination dev_null { file("/dev/null" ); }; ######## Logging commands ############# # Send a copy of everything to SEC #log { source(any_udp); destination(SEC); }; # syslog.info /var/adm/log/windows.log filter f_4 { facility(syslog) and level(info..emerg); }; log { source(any_udp); filter(f_4); destination(windows_log); flags(final); }; # local5.debug /var/adm/log/routers.log filter f_1 { facility(local5) and level(debug..emerg); }; log { source(any_udp); filter(f_1); destination(routers_log); flags(final); }; # Kill SonicWall Noise first filter SonicWallNoise { match("id=firewall") and filter(SonicWallMsgs); }; filter SonicWallMsgs { match("m=97") or match("m=98") or match("m=537"); }; log { source(any_udp); filter(SonicWallNoise); destination(dev_null); flags(fina l); }; # local0.debug /var/adm/log/ravlin.log filter f_3 { facility(local0) and level(debug..emerg); }; log { source(any_udp); filter(f_3); destination(ravlin_log); flags(final); }; # (catch all) /var/adm/log/catch-all.log log { source(any_udp); destination(catch-all_log); flags(final); }; Again, this configuration works just fine with my 1.6.8 compilation. Output is properly distributed to all of the listed files. With my 1.9.5 compilation, the final (unfiltered) file gets everything. In short, I know that the inbound syslog packets are fine (i.e. that they have the correct facility/level information), or 1.6.8 would be broken as well. THANKS for any and all help! Marvin

3 2

RE: [syslog-ng] Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 30 Sep '05

30 Sep '05

>I too have experienced this problem and decided to investigate the >source code. Unless I'm missing something, it appears that 1.9.5 simply >does not set the correct variable internally, regardless of >configuration. The following patch solved the problem for me > >............ > >Hope that helps! > >-Peter Nahas I won't be able to give it a go to test it until next week, BUT I wanted to fire off a quick message and thank you for your QUICK response and help. I'm betting that if it worked for you, it will solve my problem as well. THANKS AGAIN for your help! Marvin

1 0

Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 30 Sep '05

30 Sep '05

Sorry (in advance) if this is a dimwitted question.. I've slurped down and compiled these components on my Solaris 8 system: pkg-config-0.19; glib-2.8.1; eventlog-0.2.3+20050116+1856; and finally the non-snapshot flavor of syslog-ng 1.9.5. Everything appears to have compiled OK, and I am able to load and execute syslog-ng, and it actually operates, albeit not exactly right (which is the driver for this email). I have a 1.6.8 version of syslog-ng that "eats" my (fairly simple) config file, and sorts thru the incoming syslog traffic, filtering it to one of three primary target files, based upon facility/level combinations. These log statements all use a flags-final setting. There is one final (fourth) log statement that feeds a catch-all file, with anything not distributed to the first three files. When using the 1.6.8 executable, these four files accumulate data, as anticipated (i.e. everything works just fine). However, when I attempt to utilize the new 1.9.5 executable (on the same system), nothing is fed to the first three files. The only file getting any input is the final, catch-all file. Essentially, the only difference between the catch-all statement, and the filtered statements, is the existence of the filters on those statements, which reference filters similar to this: filter f_1 { facility(local5) and level(debug..emerg); }; It's not clear to me why the filtering activity is failing. Again, those filters are fine in a 1.6.8 setting. So. I'm looking for any input as to what might be a potential root problem. Obviously, there are a whole set of different pre-req components for the 1.9.5 world. I'm not sure if I'm dealing with some compatibility problem amongst the component versions that I've selected(?), or if the problem lies elsewhere. Thanks for any and all input and suggestions. > Marvin Nipper Director of Security Stream > mailto:marvin.nipper@stream.com > PGP Key ID: 0xD3EB5CE5 (RSA); 0x8EE28551 (DSS/DH) >

2 1