October 2006 - syslog-ng - lists.balabit.hu

Re: question regarding program name logs
by G.W. Haywood 09 Oct '06

09 Oct '06

Hi there, On Sun, 8 Oct 2006 Balazs Scheidler wrote: > > I would really like to release 2.0.0. But if your findings indeed > > turn out to be a bug in syslog-ng that'd prevent me from doing so. > > So helping me to track this down in a timely manner would be > > appreciated. Thanks. > > An important question relating this: Does anyone else experience the > same problem? For the avoidance of doubt, I'm still using 2.0.rc1 with your patch of 04 Sep 2006 12:18:46 but I'm only using local logging. Most of my log messages are from sendmail and a number of sendmail milters, and it's quite common for them to produce a few thousand log messages per second although messages at that rate would be written direct to a file - just a small subset of them is piped to a script for storage in our database. I haven't noticed any problem with missing messages. If this were a problem for us I'd have expected someone here to have noticed by now, although we haven't looked for the issue specifically. -- 73, Ged.

2 1

program() doesn't restart if it dies
by Hari Sekhon 09 Oct '06

09 Oct '06

I have an email alert script written in python to send me security alerts depending on criteria I have defined. I was working on something else and wanted to clean up so I did a pkill -9 python without remembering that I'm on the syslog server. Of course this killed the alert script, which I noticed didn't restart and syslog-ng kept running without it. So I tested it by creating a condition to generate a log and therefore an alert and I didn't get the email. Not very good. Syslog-ng didn't restart the script defined in program() in syslog-ng.conf, even when it had more input for it, which has gotten me thinking, what happens if the script really dies or is accidentally killed? Syslog-ng must have just dropped the output on the floor or something. The only way I can see to restart it is to restart syslog-ng itself. What is the best way to make this more resilient? I'm currently thinking a cron job to test for the python script and then restart the server if it is not found. Anybody got anything better? -h -- Hari Sekhon

3 4

Re: bug report
by G.W. Haywood 07 Oct '06

07 Oct '06

Hi there, On Sat, 7 Oct 2006 Balazs Scheidler wrote: > > > using the "flow-control" flag, like this: > > > > > > log { source(src); destination(dst); flags(flow-control); }; > > > > Hmmm. I knew I'd seen that syntax somewhere. But where...? :) > > Probably in the 2.0 reference manual: Blast. I was looking in the man pages. Would you like a patch? :) -- 73, Ged.

3 2

RE: [syslog-ng] Re: question regarding program name logs
by Justin Randall 07 Oct '06

07 Oct '06

Sorry I pasted the wrong "log" statement, here it is: log { source(src_udp); source(src_tcp); filter(fltr_PROGRAM); destination(dst_ PROGRAM); flags(final, flow-control); }; -----Original Message----- From: Justin Randall Sent: Wednesday, September 27, 2006 10:07 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Re: question regarding program name logs Hi and thanks for the response. This is actually relating to UDP logging. I have devices sending Syslog messages via UDP to a central Syslog-NG server. Usually the devices log messages to Syslog-NG via UDP in bursts (about 20-25 message within a couple seconds). The source, filter, destination, log statements for the handling are as follows: source src_udp { udp( ip(IPADDRESS) port(PORT) ); }; filter fltr_PROGRAM { program("PROGRAM") or match("PROGRAM"); }; destination dst_PROGRAM { file( "/var/log/PROGRAM/messages" owner(root) group(tomcat) perm(0640) ); }; log { source(src_udp); source(src_tcp); destination(dst_remote_system); flags(final, flow-control); }; What ends up happening when a host falls into this flow, the first log message is missed. The format of the bursts of messages are exactly the same. This did not happen in 2.0rc2, I have downgraded and verified this. Let me know if there's any other info I can provide that would help out. Regards, Justin. -----Original Message----- From: G.W. Haywood [mailto:ged@jubileegroup.co.uk] Sent: Wednesday, September 27, 2006 7:42 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Re: question regarding program name logs Hi there, On Wed, 27 Sep 2006 Justin Randall wrote: > Can anyone confirm if the patch that was to fix this issue was included > in 2.0rc3? Yes, it was. Note that it only affects logging via UDP. -- 73, Ged. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 2

Re: [syslog-ng] bug report
by G.W. Haywood 07 Oct '06

07 Oct '06

Hi there, On Fri, 6 Oct 2006 Balazs Scheidler wrote: > Syslog-ng 2.0.x ... can stop reading input messages if the output > queues are full. This can be enabled on a per-log-statement basis, > using the "flow-control" flag, like this: > > log { source(src); destination(dst); flags(flow-control); }; Hmmm. I knew I'd seen that syntax somewhere. But where...? :) 73, Ged.

2 1

Re: question regarding program name logs
by G.W. Haywood 07 Oct '06

07 Oct '06

Hi there, On Wed, 27 Sep 2006 Justin Randall wrote: > Can anyone confirm if the patch that was to fix this issue was included > in 2.0rc3? Yes, it was. Note that it only affects logging via UDP. -- 73, Ged.

2 1

RE: [syslog-ng] Re: question regarding program name logs
by Justin Randall 07 Oct '06

07 Oct '06

After upgrading and monitoring, the logs which would previously get logged incorrectly due to the angle bracket prefixing are now not being logged at all. These logs don't come in with any peculiarity about them. The only thing if interest to note is that it is always the first log message in a group of log messages (i.e. host sends 5 Syslog messages, the first one is missed). What kind of logs, information would be helpful to diagnose? I'm currently running on 2.0rc3. Regards, Justin. -----Original Message----- From: G.W. Haywood [mailto:ged@jubileegroup.co.uk] Sent: Tuesday, September 12, 2006 6:27 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Re: question regarding program name logs Hi there, On Tue, 12 Sep 2006 Justin Randall wrote: > I am currently using Syslog-NG version 2.0rc1. > > I've noticed that sometimes when Syslog-NG is logging messages, it > prefixes something onto the program name which disrupts filters > while matching against a program name. For example, in some logs > for a program named "foo" I'll see logs in the form of "<15>foo" > which fail to be matched against a filter of 'program("foo") '. > This seems to only be noticed on logs which originate from remote > hosts. > > Could anyone provide an explanation for what is going on with this? I reported this problem a couple of weeks ago, and Balazs kindly provided a patch which fixed it. I imagine the patch is in .rc2, try upgrading. -- 73, Ged. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Controlling Logging to Central Syslog-ng Server, DoS etc
by Hari Sekhon 06 Oct '06

06 Oct '06

Hi all, What is the best way to control logging to my central log server? I have read syslog-ng docs quite a lot when I was first setting it up but I don't recall seeing anything on access control. Doesn't this leave me open to DoS attacks etc? After all, you couldn't somebody just write a loop to send garbage to it and fill the whole machine up, not to mention drown out all other valid logs so you miss any important events (oops, I am giving away too much here?). I'm actually tempted to write an attack for this right now... So what do I do to stop some other person from doing this to me? I guess I could use iptables to make sure that only authorized ips can connect to my tcp and udp ports. Is there a better way I haven't thought of? -h -- Hari Sekhon

6 6

connecting to syslog-ng
by Torsten Curdt 06 Oct '06

06 Oct '06

Hi there! Is there a way to connect to a syslog-ng on a machine via a client to receive the events? ...as opposed to just having the syslog-ng pushing the event to another machine all the time. Basically I want only to connect to those machines running syslog-ng in certain situations. Like ssh root@machine tail -f /var/log/messages ...without the need for a ssh account cheers -- Torsten

6 12

FAQ site down - found temporary home
by catenate 06 Oct '06

06 Oct '06

The web site hosting the syslog-ng FAQ has been down for about two days now. This will continue for about another day (or more) until the telco guys come by and figure out where the line is broken. Until it's back up, I recommend using the copy that I put on Splunk Base: http://www.splunk.com/base/syslog-ng-faq Once www.campin.net is back up, I'll evaluate how much sense it makes to keep the FAQ in a wiki. So if you always wanted to update or reformat the FAQ - now is your chance while the FAQ is on one. I'll look closely at any mods made and be sure to keep the good ones. Note that the page isn't formatted very well, and none of the old links actually work. If you want anything from the old real site, google's cache is your friend: http://66.102.7.104/search?q=cache:meyHWPX8PUYJ:www.campin.net/syslog-ng/fa… Input appreciated. Nate Campi

2 1