November 2006 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] sysutils/syslog-ng/files/syslong-ng.sh.in patch
by Valdis.Kletnieks＠vt.edu 06 Nov '06

06 Nov '06

On Mon, 06 Nov 2006 09:21:43 EST, "Brian A. Seklecki" said: > Yep. I sent about 75 messages the other night well under the influence > of a *LOT* of alcohol. >:} Ahh. That explains the jpeg of you and the llamas. :)

1 0

sysutils/syslog-ng/files/syslong-ng.sh.in patch
by Brian A. Seklecki 06 Nov '06

06 Nov '06

This is a nice little patch we use to purge out /dev/klog after /etc/rc.d/dmesg and before /usr/local/etc/rc.d/syslog-ng.sh. It's useful for shops that translate user.info facility/priority syslog messages into SMS/E-Mail via a log{} mechanism (i.e., hardware error messages from the kernel, like some flunky in the NOC plugging a keyboard into your system). It lets you avoid 200 lines of boot messages in log(9) making their way into your log{} mechanism or into your pager. We want to feed it upstream because we think others will find it useful. ~BAS $ diff -u /usr/ports/sysutils/syslog-ng/files/syslog-ng.sh.in syslog-ng.sh.in --- /usr/ports/sysutils/syslog-ng/files/syslog-ng.sh.in Wed Mar 29 16:20:19 2006 +++ syslog-ng.sh.in Fri Nov 3 20:32:59 2006 @@ -14,6 +14,8 @@ #syslog_ng_enable="YES" # +syslog_ng_purgeklog=${syslog_ng_purgeklig-"NO"} + . %%RC_SUBR%% name=syslog_ng @@ -23,6 +25,11 @@ required_files=%%PREFIX%%/etc/syslog-ng/syslog-ng.conf pidfile=/var/run/syslog.pid extra_commands=reload + +if checkyesno syslog_ng_purgeklog; then + start_precmd="echo \"Purging klog(9)\" && sysctl -w kern.msgbuf_clear=1 $start_precmd"; +fi + stop_postcmd=stop_postcmd load_rc_config $name ---- l8* -lava (Brian A. Seklecki - Pittsburgh, PA, USA) http://www.spiritual-machines.org/ "...from back in the heady days when "helpdesk" meant nothing, "diskquota" meant everything, and lives could be bought and sold for a couple of pages of laser printout - and frequently were."

2 1

syslog-ng 2.0.0 released
by Balazs Scheidler 03 Nov '06

03 Nov '06

Hi, I'm proud to announce that the first stable version in the 2.0.x series, with a version number of 2.0.0 has been released and uploaded to our website. Those following the 1.9.x and 2.0rcX releases should not expect much changes between 2.0rc4 and 2.0.0, a few fixes here and there. >From now on, syslog-ng 1.6.x is strictly in maintenance mode, my efforts on syslog-ng will concentrate on the 2.0.x branch. The list of user-visible changes in 2.0.0 since 2.0rc4: 2.0.0 Sat, 28 Oct 2006 17:32:50 +0200 Bugfixes: * Fixed some compilation warnings when using gcc4 * Fixed a problem in restarting program destinations, that could cause several instance of the program to run. * Fixed a UNIX domain socket format issue that sometimes caused a memory dump to be displayed in place of the socket name. * Fixed a bug in handling broken destination connections. Other changes: * Documentation updates. -- Bazsi

1 0

Re: logs written twice
by G.W. Haywood 03 Nov '06

03 Nov '06

Hi there, Damn. Too much of a hurry, missed the subject line the first time. On Wed, 1 Nov 2006 Nick Baronian wrote: > 2. logs written twice (Nick Baronian) > I setup a syslog-ng server to get logs from various boxes and devices. > I think I am a little confused about the correct way to set this up. > I am seeing a lot of logs getting written twice. > Is there a way I can duplicate the name schema the remote box is using I don't know exactly what you mean by that, and I do't think I'd know the answer if I did. :) > [snip] > filter pump_renewal { not program("pumpd") or not level(info,debug); }; > filter imap_debug { not program("imapd") or not level(info,debug); }; > filter ipop3_debug { not program("ipop3d") or not level(info,debug); }; > filter sshd_debug { not program("sshd") or not level(debug); }; > filter f_attack_alert { match("attackalert"); }; > filter f_ssh_login_attempt { > program("sshd.*") > and match("(Failed|Accepted)") > and not match("Accepted (hostbased|publickey) for > (root|zoneaxfr) from (10.4.3.1)"); }; > [snip] If I understand what you're trying to so, I don't think you're approaching this the right way at all. Think of a filter as being like a sieve. You keep what's filtered because you want it, you don't throw it away by 'filter'ing it out. Your filter 'sshd_debug' isn't being referenced at all, so it won't give you any output. If I wanted to see ssh debug messages (assuming that the ssh daemon was logging anything at the DEBUG level) then the filter I would use would be something like filter f_sshd_debug { program("sshd") and level(debug); }; log { source(src); filter(f_sshd_debug); destination(whatever); }; The problem with using 'or' is that not program("sshd") or not level(debug) will give you stuff that ISN'T sshd if it also ISN'T debug. Check out deMorgan's theorem on the Web. If I've got the wrong end of the stick here, a flame to my personal email address is in order but one to the list isn't. :) -- 73, Ged.

3 3

Re: logs written twice
by G.W. Haywood 02 Nov '06

02 Nov '06

Hi there, On Thu, 2 Nov 2006 Nick Baronian wrote: > > > Is there a way I can duplicate the name schema the remote box is using > > > > I don't know exactly what you mean by that, and I do't think I'd know > > the answer if I did. :) > > What I mean is if I have two boxes I want to log to this syslog-ng > server, one is an old Unix box that is logging *.info;mail.none > locally to /var/adm/syslog/syslog.log and the other is a RH Linux box > that logs *.info;mail.none locally to /var/log/messages is there a way > the remote syslog-ng server can be configured to write the > *.info;mail.none for the Linux box to a messages file and for logs it > receives from the Unix box to a syslog.log file? That should be no problem at all, but I think you're going to have to knuckle down and read the documentation. You'd tell the two boxes to log to the logging server and create a few rules on the logging server which log to different places depending on which of the two boxes sent the log message. If I were doing it, I'd have the two boxes decide what to log and the logging server decide only where (which file) to log it in. Otherwise you might create a lot of network traffic which contained information that would be discarded by the logging server. You seem to attach some significance to the names of these logfiles. Is there a reason for that? -- 73, Ged.

2 1

RE: [syslog-ng] help- Problem with TCP Based CentralizedLogServer using Syslog-ng
by Padmanabhan, Rajeesh (GE Healthcare) 02 Nov '06

02 Nov '06

Thanks Nate. I had set the max connections to 1000 already. Still it was same issue. Now I set so_rcvbuf(500) in tcp source( Basically increased the recive buffer size). After that its not crashing that frequently. It takes 1 or 2 days to crash. Please help. -Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Nathan Campi Sent: Tuesday, October 31, 2006 11:43 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] help- Problem with TCP Based CentralizedLogServer using Syslog-ng Check the logs from syslog-ng on the central server. Could be that you need to increase the max connections to your tcp source or increase an OS limit like open file descriptors. -- Nate Campi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng] Re: logs written twice
by Nick Baronian 01 Nov '06

01 Nov '06

Thanks again Len. So I guess the standard conf (in the examples dir) logs a lot of the same stuff to multiple files, ie. messages file and syslog file. Why do this when the syslog statement catches everything the messages catches? It isn't that big of a division of types of events so I guess that was confusing me. If I understand this right in the example file snippet- filter f_syslog { not facility(authpriv, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; The messages will only log "info, notice and warning and everything but auth, authpriv, mail and news" but the syslog will log "all levels and everything but authpriv and mail"? Is that correct, if you don't specify the level, what does it default to? -Nick On 11/1/06, Leonard Mills <Leonard_Mills(a)corpnet.sel.sony.com> wrote: > Yes, you've got it exactly correct. Processing of the > incoming packet will end when a final flag is encountered. > Things that are desired in multiple places shouldn't be > allowed encounter the final flag (maybe things like > auth.crit should appear in more than one place). > > Len

1 0

Re: [syslog-ng] Re: logs written twice
by Nick Baronian 01 Nov '06

01 Nov '06

Thanks Len, I am not sure I fully understand what final does. The site states "This flag means that the processing of log statements ends here. Note that this does not necessarily mean that matching messages will be stored only once, as there can be matching log statements processed prior the current one." Does this mean that anything below my syslog log line would not get anything, so basically like everything below doesn't exist or is commented out? -Nick On 11/1/06, Leonard Mills <Leonard_Mills(a)corpnet.sel.sony.com> wrote: > Nick wrote: > > >If I don't want the the same messages logged to both files I would > >need to remove one of the two filters, right? > > you could add the controls to your log entries, something > like: > > log { source(src); filter(f_syslog); destination(syslog); flags(final); }; > > That would keep the messages out of messages :-). > > Len > >

1 0

Re: syslog-ng Digest, Vol 19, Issue 1
by G.W. Haywood 01 Nov '06

01 Nov '06

Hi there, On Wed, 1 Nov 2006 Nick Baronian wrote: > 2. logs written twice (Nick Baronian) > I setup a syslog-ng server to get logs from various boxes and devices. > I think I am a little confused about the correct way to set this up. > I am seeing a lot of logs getting written twice. > Is there a way I can duplicate the name schema the remote box is using I don't know exactly what you mean by that, and I do't think I'd know the answer if I did. :) > [snip] > filter pump_renewal { not program("pumpd") or not level(info,debug); }; > filter imap_debug { not program("imapd") or not level(info,debug); }; > filter ipop3_debug { not program("ipop3d") or not level(info,debug); }; > filter sshd_debug { not program("sshd") or not level(debug); }; > filter f_attack_alert { match("attackalert"); }; > filter f_ssh_login_attempt { > program("sshd.*") > and match("(Failed|Accepted)") > and not match("Accepted (hostbased|publickey) for > (root|zoneaxfr) from (10.4.3.1)"); }; > [snip] If I understand what you're trying to so, I don't think you're approaching this the right way at all. Think of a filter as being like a sieve. You keep what's filtered because you want it, you don't throw it away by 'filter'ing it out. Your filter 'sshd_debug' isn't being referenced at all, so it won't give you any output. If I wanted to see ssh debug messages (assuming that the ssh daemon was logging anything at the DEBUG level) then the filter I would use would be something like filter f_sshd_debug { program("sshd") and level(debug); }; log { source(src); filter(f_sshd_debug); destination(whatever); }; The problem with using 'or' is that not program("sshd") or not level(debug) will give you stuff that ISN'T sshd if it also ISN'T debug. Check out deMorgan's theorem on the Web. If I've got the wrong end of the stick here, a flame to my personal email address is in order but one to the list isn't. :) -- 73, Ged.

1 0