June 2006 - syslog-ng - lists.balabit.hu

global option dir_group() didn't take effect
by Wolfram Schlich 23 Jun '06

23 Jun '06

Syslog-NG (1.9.11) was configured with the global option dir_group(adm), but directories it created were root:root. Anyone else experiencing this? -- Regards, Wolfram Schlich <wschlich(a)gentoo.org> Gentoo Linux * http://dev.gentoo.org/~wschlich/

2 3

suppress repeated messages feature in 2.0 ?
by stucky 23 Jun '06

23 Jun '06

Balzi Sorry if this is redundant. I thought I read something about it but I can't find it anymore so I thought I ask again. It's a very simple question. Will syslog-ng-2.0 include the 'suppress repeated messages' feature that syslogd has ? That's the one thing I really miss since it causes email floods (5000 and more at one time). I know there is stuff like SEC and I am trying to look into it. However, I like the mechanism I have in place right now except it has no threshold feature. I honestly believe that this should be accomplished by the log daemon itself rather than a parser. Just something similar to syslogd where it prints a certain burst of 5 or 10 messages of the same kind that then adds one line saying "previous message repeated 1000 times" etc.. I know with SEC I can say if this message shows up x times within a certain window then alert me. However that's not really what I want. I want a logparser that says if one source logs the same message 1000 times in a row then alert me once and skip the other messages... Well I'm sure everyone knows what I'm talking about. Is anyone using SEC in conjunction with syslog-ng to achieve exactly that ? -- stucky

1 0

RE: [syslog-ng] Losing TAG information
by SOLIS, ALEX 22 Jun '06

22 Jun '06

I appreciate your sympathy but it does not help me with my TAG problem. :) Anyone else have any idea how to stop syslog-ng from purging the TAG information from an AIX syslogd message. I have successfully sniffed syslog traffic between the AIX servers and my LOGHOST. The TAG (Process Name info) is definitely intact on the wire. This confirms that syslog-ng is simply parsing the log message and removing the TAG info. I did some more tests on the Linux LOGHOST using the logger utility and I found that syslog-ng does not like spaces after the TAG information. For example: 1) Logger -p syslog.info -t "TEST_TAG" "TEST_MESSAGE" Generates the log: Jun 19 08:42:38 loghost TEST_TAG: TEST_MESSAGE 2) Logger -p syslog.info -t "TEST_TAG " "TEST_MESSAGE" Generates the log: Jun 19 08:44:08 loghost : TEST_MESSAGE Example two lost the TAG information because of the space after TEST_TAG. I have considered the possibility that the messages being sent from the AIX box do not conform to syslog formatting standards and therefore syslog-ng discards the field. But I would like to know if there is anything that can be done to stop this behavior. Thanks for all responses, even sympathetic ones. :) Alex -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Tuesday, June 13, 2006 9:09 PM To: SOLIS, ALEX Subject: Re: [syslog-ng] Losing TAG information On Tue, 13 Jun 2006 10:07:33 CDT, "SOLIS, ALEX" said: (off-list reply) > I have about 20 or so AIX 4.3 servers that are sending syslog messages > to a Linux desktop running syslog-ng 1.6.5. You have my condolences. IBM dropped support for even AIX 4.3.3 several years ago - hopefully you're not having problems keeping the software running and secure... -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Tuesday, June 13, 2006 9:09 PM To: SOLIS, ALEX Subject: Re: [syslog-ng] Losing TAG information On Tue, 13 Jun 2006 10:07:33 CDT, "SOLIS, ALEX" said: (off-list reply) > I have about 20 or so AIX 4.3 servers that are sending syslog messages > to a Linux desktop running syslog-ng 1.6.5. You have my condolences. IBM dropped support for even AIX 4.3.3 several years ago - hopefully you're not having problems keeping the software running and secure... This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

3 5

unattended-gui 0.3 released -> module syslog-ng
by Mario Gzuk 22 Jun '06

22 Jun '06

Hi, with the module syslog-ng you can manage several syslog-ng servers wich are logging into several databases and tables. Search is possible over all servers as a timeline or per table. Main content of this release: Support automatic installations of the following operating systems: * Windows Xp * Windows 2003 * SuSE Linux 10.1 * Red Hat Enterprise Linux 4 * Fedora Core 5 * CentOS 4.3 * Whit Box Enterprise Linux 4 * Scientific Linux 4.3 * Aurox 11.1 New modules: * php-ssh * usersettings * dhcp-ldap * samhain * syslog-ng * ldap-manager * cron Please have a look at the documentation: http://unattended.technikz.de/index.php/Documentation If there is something missing or if you need help feel free to use the forum here: http://sourceforge.net/forum/?group_id=127437 or the mailing list: http://sourceforge.net/mail/?group_id=127437 greetings mario gzuk

1 0

Syslog-NG and STunnel
by Wolfram Schlich 22 Jun '06

22 Jun '06

I'm currently trying out this setup: - logserver at home, connected via ADSL with a fixed IPv4 subnet - IP address: 192.168.0.1 - syslog-ng listening on 127.0.0.1:514 TCP - stunnel listening on 192.168.0.1:514 TCP and connecting to 127.0.0.1:514 TCP - logclient at a remote datacenter - IP address: 172.16.0.1 - syslog-ng delivering to 127.0.0.1:514 TCP - stunnel listening on 127.0.0.1:514 TCP and connecting to 192.168.0.1:514 TCP Here are the STunnel configs: --8<--[ stunnel.conf on logserver (excluding cert/key stuff) ]--8<-- [syslog-ng] client = no accept = 192.168.0.1:514 local = 127.0.0.1 connect = 127.0.0.1:514 --8<-- --8<--[ stunnel.conf on logclient (excluding cert/key stuff) ]--8<-- [syslog-ng] client = yes accept = 127.0.0.1:514 local = 172.16.0.1 connect = 192.168.0.1:514 --8<-- This works fine so far, logs are sent over the encrypted tunnel without problems. Except one situation: the STunnel or Syslog-NG itself on the logserver goes down. Then this happens on the logclient: --8<-- syslog-ng[30119]: EOF occurred while idle; fd='33' --8<-- There are *lots* of those messages, like 20 per second. Is it possible to prevent Syslog-NG of creating such messages? -- Wolfram Schlich

2 3

priority and facility gone when using template for remote logging
by Wolfram Schlich 22 Jun '06

22 Jun '06

On the logserver the priority.facility of all incoming log messages was "user.notice" instead of the original value. I used this on the logclient: template t_remote_s { template("${DATE} ${HOST} ${MSG}\n"); template_escape(no); }; destination d_remote { udp("syslog.mydomain.tld" port(514) template(t_remote_s)); }; log { source(s_local); source(s_kernel); destination(d_remote); }; When *not* using a template for the remote destination, everything works as expected, priority.facility is back with good values. Any idea why this happens? -- Wolfram Schlich

3 4

global option chain_hostnames() not explained
by Wolfram Schlich 21 Jun '06

21 Jun '06

Unfortunately the documentation leaves it unclear what exactly chain_hostnames() does. I just guess it does something like creating a chained hostname in the form "host1/host2/host3". What about use_fqdn() in that case? Will it be "host1.example.com/host2.example.com/host3.example.com"? Am I right when I think that use_fqdn() does only take effect for the hostname where syslog-ng is currently running on? Let's say use_fqdn() is on on host1 and host3 and off on host2. I guess it would look like this then: "host1.example.com/host2/host3.example.com" Can somebody clear it up? :-) -- Wolfram Schlich

2 1

Syslog-NG (1.9) documentation issues (lots of...)
by Wolfram Schlich 20 Jun '06

20 Jun '06

Referencing the current 2.0 online manual: http://www.balabit.com/products/syslog_ng/reference-2.0/syslog-ng.html/ - Table 3.13 - TZOFFSET: documented as '-0700', is effectively '-07:00'. - DATE: description is missing. Looks like "Jun 13 15:58:00". - FULLDATE: -"-. Looks like "2006 Jun 13 15:56:57". - ISODATE: -"-. Looks like "2006-06-13T15:56:51+02:00". - UNIXTIME: -"-. Standard UNIX timestamp. - FULLHOST, HOST_FROM, FULLHOST_FROM, SOURCEIP: -"- - 3.2: - fsync(), timezone() and ts_format() are undocumented (obviously, the ts_format() part just needs to be copied from 3.5) - 3.2.2.5 usertty(): - documented to support template(), but... ...this works (of course it does): destination d_admintty { usertty("root"); }; ...this makes 'syslog-ng -s' complain about a syntax error: destination d_admintty { usertty("root" template(t_admintty)); }; - 3.5 Options: - sync() and sync_freq() are marked as obsolete with flush_lines() as the successor, unfortunately flush_lines() itself is not documented in 3.5 (only in 3.2 with a reference to the global default which is just not present). - flush_timeout() is not documented in 3.5 (only in 3.2, just like flush_lines()) Yet more to come (no time right now :-() -- Regards, Wolfram Schlich <wschlich(a)gentoo.org> Gentoo Linux * http://dev.gentoo.org/~wschlich/

3 5

Re: [syslog-ng] plain stupid?
by Jacco Rens 20 Jun '06

20 Jun '06

On 20-jun-2006, at 21:37, Leonard Mills wrote: > Jacco wrote: > >> source s_1 { udp(ip(192.168.1.2) port(514)); >> source s_2 { udp(ip(192.168.2.2) port(514)); > > Those lines have mismatched {(...)} pairs. Plain stupid thus ;-) Thanks for all replies! - jacco

1 0

plain stupid?
by Jacco Rens 20 Jun '06

20 Jun '06

Hi list, I'm trying out syslog-ng for only an hour now, and got it logging all udp traffic to one file fine, but now I think I'm doing stupid, althoug this seemed logical to me: options { use_fqdn(yes); use_dns(yes); dns_cache(yes); keep_hostname(yes); long_hostnames(on); sync(1); log_fifo_size(1024); create_dirs(yes); }; source s_1 { udp(ip(192.168.1.2) port(514)); source s_2 { udp(ip(192.168.2.2) port(514)); destination d_1 { file("/var/log/1.log"); }; destination d_2 { file("/var/log/2.log"); }; log { source(s_1); destination(d_1); }; log { source(s_2); destination(d_2); }; It poops an error: ] mini:/var/log root# syntax error at 14 Parse error reading configuration file, exiting. (line 14) Thanks for your insight. - jacco

3 2