January 2006 - syslog-ng - lists.balabit.hu

phpsyslogng-2.8 configuration Problem
by anil saka 05 Jan '06

05 Jan '06

Hi , I am having problem in configuring syslog-ng : once i edit the dbset.sql with my password under "PW_HERE" and update the same password in config.php. I started the syslog-ng daemon . when i try to login the GUI .. it says : Fatal error: Call to undefined function: sha1() in /var/www/html/includes/common_funcs.php on line 26 can sombody help in in getting this done.. FYI : I am using : phpsyslogng-2.8 mysql 4.0.25 PHP-4.1.2-2.2 Regards, Anil

1 0

Re: syslog-ng Digest, Vol 9, Issue 4
by dwarnock＠harbrook.net 05 Jan '06

05 Jan '06

I am on holiday from Tuesday 3rd January returning on Monday 9th January. If your query is urgent please contact the office on +44 (0) 1423 508060 or email Neil Harvey at nharvey(a)harbrook.net Regards David Warnock

1 0

RE: [syslog-ng]Pix problem
by SOLIS, ALEX 05 Jan '06

05 Jan '06

If you don't have too many assets to log from, I found that filtering by facility proved an effective logging method. 1. Setup your pix to send all its logs via a certain facility. For example local0. The pix command will look something like "logging facility 16". (note: Facilities have a corresponding ID in PIX IOS. Local0 starts at 16 and increments all the way to local7 which is 23.) 2. Setup the PIX to send its logs via UDP to the loghost server. Assuming Your loghost is on the inside of your PIX the command will look something like this: "logging host inside x.x.x.x". Be careful if you plan to use TCP for logging as the PIX will not allow communication between its interfaces if your syslog server fails! 3. Now modify the syslog-ng.conf file on you loghost with the appropriate destination, filter, and log statements. For example, to capture the PIX logs and send them to a private file we would have: destination pix { file("/var/log/pix"); }; filter f_pix { facility(local0); }; log { source(src); filter(f_pix); destination(pix); }; restart syslog-ng and you should be in business. If you don't see enough information (or too much) play with the PIX's logging levels. There are 7 of them with 7 being the most verbose. Hope that helps. Alex -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Andrew Meyer Sent: Tuesday, December 27, 2005 9:55 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng]Pix problem OK.....is there a way to log/define all 8 logging facilities in syslog-ng this is all new to me, and i'm following a debian tutorial. So any other info you can give me would be awsome. Thank you, Andrew --- Asher Yanich <ayanic01(a)cs.fiu.edu> wrote: > You will not want to setup TCP syslog from the PIX. > Even though the > PIX can connect and log via TCP to syslog, any error > will cause the > PIX to stop logging to syslog. > > Here are docs for setting up logging to syslog for > pix OS 7.0. I > believe the syntaz is the same for 5.x and 6.x but a > quick google > search should provide you with what you need. > > -asher > > > On 12/27/05, Andrew Meyer <andrewm659(a)yahoo.com> > wrote: > > How do I setup a PIX with syslog-ng? what are the > > values I can use? Do I need to specify the IP > addy of > > the PIX? What about the protocol I want to > capture, > > what if i want to capture UDP and TCP? How would > I > > set it up if i wanted all the data from my PIX to > go > > the syslog-ng server? > > > > Thank you, > > Andrew Meyer > > andrewm659(a)yahoo.com > > > > --- Damien Michau <d.michau(a)ag.com> wrote: > > > > > this is the server actual ip > > > ----- Original Message ----- > > > From: "Bill Nash" <billn(a)billn.net> > > > To: <syslog-ng(a)lists.balabit.hu> > > > Sent: Tuesday, May 10, 2005 7:20 PM > > > Subject: Re: [syslog-ng]Pix problem > > > > > > > > > > On Tue, 10 May 2005, Damien Michau wrote: > > > > > > > >> Hi All ! > > > >> I have some probleme ta log my pix's log into > my > > > syslog-ng server . > > > >> i have mounted a Syslog-ng server to store my > > > pix's log . But there is > > > >> nothing in my pix.log > > > >> i'have put this lines in my syslog-ng.conf > > > >> > > > >> > > > >> source pix { udp(ip(10.60.10.111) port());}; > > > >> destination pix { > file("/var/log/pix.log"); > > > }; > > > >> log { source(pix);destination(pix); }; > > > >> > > > > > > > > Your source declaration shouldn't be the IP of > > > your pix, it should be the > > > > IP on your syslog server you wish your udp > socket > > > to listen on. In most > > > > cases, this should just be 0.0.0.0 or your > servers > > > actual IP. > > > > > > > > - billn > > > > > _______________________________________________ > > > > syslog-ng maillist - > syslog-ng(a)lists.balabit.hu > > > > > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > Frequently asked questions at > > > http://www.campin.net/syslog-ng/faq.html > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > syslog-ng maillist - > syslog-ng(a)lists.balabit.hu > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at > > > http://www.campin.net/syslog-ng/faq.html > > > > > > > > > > > > I'm worth a million in prizes > > With my torture film > > Drive a GTO > > Wear a uniform > > On a government loan. > > > > > > > > __________________________________________ > > Yahoo! DSL ï¿½ Something to write home about. > > Just $16.99/mo. or less. > > dsl.yahoo.com > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > I'm worth a million in prizes With my torture film Drive a GTO Wear a uniform On a government loan. __________________________________ Yahoo! for Good - Make a difference this year. http://brand.yahoo.com/cybergivingweek2005/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

6 11

Syslog message reformat
by Michael Gehrmann 04 Jan '06

04 Jan '06

Hi All, I have a vendor who has implemented their syslog message with a year in the date field e.g. Apr 15 10:06:19 2005 The vendor believes this to be a correct interpretation of the RFC (it's wrong if you read the next two paragraphs in the RFC) and will not change their software. Has anyone got any ideas on how I can kill the year field so I can use standard reporting/filtering tools? -- Michael Gehrmann Security Administrator Education Qld Facilities Management Office Ph. (07) 322 22889 Fax. 07 322 22868 -------------------------------------------------------- This email and associated attachments may contain confidential and privileged CITEC information that is provided solely for the use of the intended addressee. Views and opinions expressed in this email are those of the individual sender and are not necessarily the views and opinions of CITEC unless the sender expressly states that such views and opinions are those of CITEC. The privilege and confidentiality associated with this email and attachments will not be waived, lost or rescinded by reason of mistaken delivery. Should you receive this email by mistake, please notify the sender by return email then delete the email from your computer system. You must not use, copy, modify, print, or distribute the email or the information and attachments contained within same to any third party. CITEC does not accept any liability in respect of viruses or computer problems experienced by the recipient through access gained to this email and its attachments. -------------------------------------------------------- ________________________________________________________________________ This email has been scanned for viruses by the CITEC Email Anti-Virus service powered by MessageLabs. For more information on a proactive email anti-virus service working around the clock, around the globe, visit www.citec.com.au ________________________________________________________________________

2 1

Re: syslog-ng Digest, Vol 9, Issue 3
by dwarnock＠harbrook.net 04 Jan '06

04 Jan '06

I am on holiday from Tuesday 3rd January returning on Monday 9th January. If your query is urgent please contact the office on +44 (0) 1423 508060 or email Neil Harvey at nharvey(a)harbrook.net Regards David Warnock

1 0

SSL encapsulation for TCP transport?
by Bill Nash 03 Jan '06

03 Jan '06

Is it planned? I'm lookin around, and see previous mention of it, but nothing concrete. Yes, I know you can just tunnel the session, but I'd prefer native transport. - billn

3 2

Re: syslog-ng Digest, Vol 9, Issue 1
by dwarnock＠harbrook.net 03 Jan '06

03 Jan '06

I am on holiday from Tuesday 3rd January returning on Monday 9th January. If your query is urgent please contact the office on +44 (0) 1423 508060 or email Neil Harvey at nharvey(a)harbrook.net Regards David Warnock

1 0