March 2006 - syslog-ng - lists.balabit.hu

filtering logs from a file?
by Steven Matkoski 06 Mar '06

06 Mar '06

Hi, I am using syslog-ng 1.6.5-2.2 on a Debian box in a chroot environment. I have a default configuration except for gathering log messages from a few routers, a pix, and vpn concentrator. I have the logs going into the files I want, but the logs are also going into files I don't want. I currently have all the routers logging into a routers/ directory and the pix and vpn logging into a security/ directory, but the pix and vpn are also logging into the router directory which I would like to stop. I have tried a bunch of different filters but nothing seems to work. Any help appreciated. My configuration: # router syslog source s_syslogd { udp(ip(0.0.0.0) port(514)); }; # router syslog destination d_router { file("/var/log/routers/$HOST"); }; destination d_security { file("/var/log/security/$HOST"); }; # router syslog filter f_router { not host(/<vpn ip>/) or not host(/<pix ip>/); }; filter f_security { host(<vpn ip>) or host(<pix ip>); }; # router.* #log { source(s_syslogd); filter(f_router); destination(d_router); }; log { source(s_syslogd); destination(d_router); }; # firewall, vpn concentrtor log { source(s_syslogd); filter(f_security); destination(d_security); }; thanks. -s.

1 0

how can I change the priority/facility of a log entry?
by Dave Augustus 02 Mar '06

02 Mar '06

Hello All, I have spent hours looking for this. Is there a way, using syslog-ng to re-write an incoming log entry's priority/facility. We have some windows boxen that we are logging but the log entries need a little massaging. Any ideas would be helpful. TIA -- Dave Augustus <davea(a)support.kcm.org>

2 1

Syslog-ng 1.6.9 just stops...
by Andreoli, Tony A. USNUNK NAVAIR B1490, R215 01 Mar '06

01 Mar '06

I'm using 1.6.9 (upgraded from 1.6.6 because I was seeing the same problem). I have it running on 8 different servers at different locations, some are SMP, some aren't. On these hosts, we have anywhere from 2 to 14 devices logging to the servers, some via 514/tcp, others via 514/udp. All of the loggers typically sit with a load average < 1 (usually not even registering), and a cpu idle of 99%. 7 of these remote loggers also log to our local machine, but only 5 lines every 2 minutes (for stats). What I've noticed (and I've seen this on all of them at one time or another), is that syslog-ng just stops. ps shows it running, but the log file (/logs/messages) never changes. If I tcpdump on the interface that it's listening on, I see traffic, and it seems that the act of tcpdumping causes the log file to start to grow again, then a little while later, it may stop again. It's sporadic though, on one of my systems, it hasn't done it in over 2 months, on another, it's done it 3 times today. I've pulled out my last hair and still haven't come any closer to a solution. I've recompiled the source, loaded 3 different versions, etc. The only thing common is that all of these systems are running RHEL3. Any help would be greatly appreciated. Thanks, Tony

4 3

RE: [syslog-ng] Syslog-ng 1.6.9 just stops...
by Andreoli, Tony A. USNUNK NAVAIR B1490, R215 01 Mar '06

01 Mar '06

Thanks for the reply. Yes, I do have it running, but the problem is more frequent than nightly. My logrotate script gets run every night at midnight, yet syslog-ng has stopped running 5 times today (in the last 6 hours) on one of my systems. Thanks, Tony _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of David Anderson Sent: Wednesday, March 01, 2006 12:19 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 1.6.9 just stops... R215, Wednesday, March 1, 2006, 3:01:47 PM, you wrote: > I'm using 1.6.9 (upgraded from 1.6.6 because I was seeing the same problem). I have it running on 8 different servers at different locations, some are SMP, some aren't. On these hosts, we have anywhere from 2 to 14 devices logging to the servers, some via 514/tcp, others via 514/udp. All of the loggers typically sit with a load average < 1 (usually not even registering), and a cpu idle of 99%. 7 of these remote loggers also log to our local machine, but only 5 lines every 2 minutes (for stats). What I've noticed (and I've seen this on all of them at one time or another), is that syslog-ng just stops. ps shows it running, but the log file (/logs/messages) never changes. If I tcpdump on the interface that it's listening on, I see traffic, and it seems that the act of tcpdumping causes the log file to start to grow again, then a little while later, it may stop again. It's sporadic though, on one of my systems, it hasn't done it in over 2 months, on another, it's done it 3 times today. I've pulled out my last hair and still haven't come any closer to a solution. I've recompiled the source, loaded 3 different versions, etc. The only thing common is that all of these systems are running RHEL3. Any help would be greatly appreciated. Thanks, Tony You haven't got Logrotate running, have you? I found that unless I restarted syslog-ng in the rotate scripts, then nothing further was logged. -- Best regards, David mailto:dma@pern.co.uk

1 0

Reverse DNS
by Jesper Markenstam 01 Mar '06

01 Mar '06

Hello, I am sure this topic has been beaten to death, but I cannot find answers anywhere. Apologies if I have missed something - here we go: I run syslog-ng 1.6.4 on Sol 9 Sparc (sunfreeware distribution). It works fine, except I want syslog-ng to resolve IP's to hostnames, and create directories using the resolved name rather than IP (long term, I will look at MySQL, but I would still have to get either DNS or keep_hostname to work). I installed bind 9.2.3 on the log server and setup a reverse zone authoritative for in-addr.arpa., but it still doesn't work. At this time, I prefer to use reverse DNS rather than hostname. I was not able to create_dirs based on keep_hostname(yes) either. dig works, and returns NOERROR when I run dig -x 1.2.3.4 @127.0.0.1 for example. The reverse zone is fully populated with all hosts that will be logging syslog-ng. nsswitch.conf: hosts: dns files ipnodes: dns files everything else is files only. resolv.conf: nameserver 127.0.0.1 syslog-ng.conf: # Options options { use_fqdn(no); use_dns(yes); dns_cache(yes); sync(5); keep_hostname(no); chain_hostnames(no); create_dirs(yes); # bad! perm(0644); dir_perm(0755); use_time_recvd(yes); }; # Sources source s_udp { udp(); }; # logging to console destination l_console { file ("/dev/console"); }; # logging of cisco's via udp to individual files and to one file destination r_cisco { file( "/remote/$HOST/$HOST-$YEAR$MONTH.LOG" ); file( "/r emote/all/alldevices.log" ); }; # Remote sources log { source (s_udp); destination (r_cisco); }; Kind regards Jesper Jesper Markenstam IS&T Systems Analyst REUTERS.KNOW.NOW. www.reuters.com <http://www.reuters.com/> To find out more about Reuters visit www.about.reuters.com Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Reuters Ltd.

2 1