June 2006 - syslog-ng - lists.balabit.hu

Future releases
by Anders.Backlund＠vattenfall.com 20 Jun '06

20 Jun '06

I was looking at the syslog-ng roadmap on the balabit webpage. I am aware of that you might not have made a final decision on the subject, but I am still curious For version 2.2 you state that you will have support for the BEEP protocol. By that do you mean RFC 3195? Do you have any plans for the upcoming syslog RFC (syslog-new, syslog-sign, syslog-tls)? Anders Backlund

1 0

RE: [syslog-ng] Losing TAG information
by SOLIS, ALEX 20 Jun '06

20 Jun '06

That is interesting. Thinking it is a version problem, I upgraded syslog-ng on another machine to 1.6.9. I attempted the same test below and got the same results. A space in the tag causes the TAG information to disappear. I am curious Evan, what are your syslog-ng options? I guess now it could be my LOGHOST environment. I am running syslog-ng 1.6.9 on a gentoo linux box running kernel 2.6-15. Here is another example of what this box does: # logger -t "alex" funny # logger -t "alex " funny Results: Jun 19 11:53:04 src@lookout alex: funny Jun 19 11:53:30 src@lookout : funny These results are on a totally separate box running a new version of syslog-ng. Since it worked in Evan's example below, syslog-ng might not be the one to blame. But what other factors could cause me to lose the TAG information of a local syslog message other than the process accepting, parsing, and storing the message itself; syslog-ng? Alex -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Rempel Sent: Monday, June 19, 2006 12:50 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Losing TAG information In an AIX 5.2 machine % logger -t evan funny % logger -t "evan " funny results in Jun 19 10:47:17 casa.comp.uvic.ca casa: evan: funny Jun 19 10:47:25 casa.comp.uvic.ca casa: evan : funny In AIX 4.3.3 % logger -t evan funny % logger -t "evan " funny results in Jun 19 10:48:57 casual.uvic.ca casual: evan: funny Jun 19 10:49:03 casual.uvic.ca casual: evan : funny So, it would appear that the 1.6.8 syslog-ng does not suffer from the symptoms you describe. Evan. SOLIS, ALEX wrote: > Thank you for your reply Evan. > > So, if you attempt what I did in bullet two in the previous post below > do you get different results? If you do, then maybe I should consider > upgrading my version of syslog-ng. Thanks again. > > > Alex > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Rempel > Sent: Monday, June 19, 2006 10:38 AM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] Losing TAG information > > All I can really add is that we have a mix ov AIX 4.3.3 through 5.3 that > are logging to a linux syslog-ng 1.6.8 machine > and we are not experiencing the symptoms that you describe. I have a > couple of applications where the tag ends up being > "syslog" when it should be something else, but that is quite a bit > different than removing it entirely. > > Evan. > > SOLIS, ALEX wrote: >> I appreciate your sympathy but it does not help me with my TAG > problem. >> :) >> >> Anyone else have any idea how to stop syslog-ng from purging the TAG >> information from an AIX syslogd message. I have successfully sniffed >> syslog traffic between the AIX servers and my LOGHOST. The TAG > (Process >> Name info) is definitely intact on the wire. This confirms that >> syslog-ng is simply parsing the log message and removing the TAG info. >> >> I did some more tests on the Linux LOGHOST using the logger utility > and >> I found that syslog-ng does not like spaces after the TAG information. >> For example: >> >> 1) Logger -p syslog.info -t "TEST_TAG" "TEST_MESSAGE" >> >> Generates the log: >> >> Jun 19 08:42:38 loghost TEST_TAG: TEST_MESSAGE >> >> >> 2) Logger -p syslog.info -t "TEST_TAG " "TEST_MESSAGE" >> >> Generates the log: >> >> Jun 19 08:44:08 loghost : TEST_MESSAGE >> >> Example two lost the TAG information because of the space after >> TEST_TAG. I have considered the possibility that the messages being >> sent from the AIX box do not conform to syslog formatting standards > and >> therefore syslog-ng discards the field. But I would like to know if >> there is anything that can be done to stop this behavior. >> >> Thanks for all responses, even sympathetic ones. :) >> >> Alex >> >> >> -----Original Message----- >> From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] >> Sent: Tuesday, June 13, 2006 9:09 PM >> To: SOLIS, ALEX >> Subject: Re: [syslog-ng] Losing TAG information >> >> On Tue, 13 Jun 2006 10:07:33 CDT, "SOLIS, ALEX" said: >> >> (off-list reply) >> >>> I have about 20 or so AIX 4.3 servers that are sending syslog > messages >>> to a Linux desktop running syslog-ng 1.6.5. >> You have my condolences. IBM dropped support for even AIX 4.3.3 > several >> years ago - hopefully you're not having problems keeping the software >> running and secure... >> -----Original Message----- >> From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] >> Sent: Tuesday, June 13, 2006 9:09 PM >> To: SOLIS, ALEX >> Subject: Re: [syslog-ng] Losing TAG information >> >> On Tue, 13 Jun 2006 10:07:33 CDT, "SOLIS, ALEX" said: >> >> (off-list reply) >> >>> I have about 20 or so AIX 4.3 servers that are sending syslog > messages >>> to a Linux desktop running syslog-ng 1.6.5. >> You have my condolences. IBM dropped support for even AIX 4.3.3 > several >> years ago - hopefully you're not having problems keeping the software >> running and secure... >> >> This e-mail contains Omaha Public Power District's confidential and > proprietary information and is for use only by the intended recipient. > Unless explicitly stated otherwise, this e-mail is not a contract offer, > amendment, nor acceptance. If you are not the intended recipient you > are notified that disclosing, copying, distributing or taking any action > in reliance on the contents of this information is strictly prohibited. >> _______________________________________________ >> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >> https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >> >> > > -- Evan Rempel erempel(a)uvic.ca Senior Programmer Analyst 250.721.7691 Computing Services University of Victoria _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

Testing log paths
by Ryan Owen 19 Jun '06

19 Jun '06

I'm looking for a way to test a syslog-ng configuration to see if a given message (generated by the local machine) will be logged. This is for automated policy compliance measurement. For example, I need a program or script to be able to tell me if all authpriv messages with priority debug or higher are logged somewhere. With the old syslog stuff, the config file was easy enough to parse that a program could fairly easily determine this. Syslog-ng's extremely flexible configuration mechanism is somewhat more difficult, though. My current thinking is to take the lex/yacc grammar from the source and use it to write a program that could accept a message and return where it would be logged, if at all. This is still a pretty complex task, though, so I was hoping that perhaps there would be a simpler way. I'm not allowed to generate bogus log entries, or else I'd try spoofing a message of whatever facility/priority/etc that I needed to test for. Does anyone know of a better way to accomplish this? Thanks in advance for the help! -Ryan

3 3

Mac OS X 10.4 start config file
by Jacco Rens 19 Jun '06

19 Jun '06

Hi List members, I Just installed syslog-ng on a Mac OS X 10.4.6 machine trough darwinports, but I'm having trouble with the initial config. With the config I have now, syslog-ng uses 100% cpu time, for unknown reasons to me yet. syslog-ng 1.6.8 What I have now in the config, comes from here: http://sial.org/howto/ logging/syslog-ng/ options { dir_perm(0755); perm(0644); create_dirs(yes); use_fqdn(yes); log_fifo_size(4096); stats(3600); }; source local { unix-dgram("/var/run/syslog"); udp(ip(127.0.0.1) port(514)); internal(); }; source s_kernel { file("/dev/klog" log_prefix("kernel: ")); }; destination everything { file("/var/log/archive/$R_YEAR/$R_MONTH/$R_YEAR-$R_MONTH-$R_DAY" template("$ISODATE <$FACILITY.$PRIORITY> $HOST $MSG\n") template_escape(no) ); }; log { source(local); source(s_kernel); destination(everything); }; filter emerg { level(emerg); }; destination users { usertty("*"); }; log { source(local); filter(emerg); destination(users); }; What I basicly want, is the same as syslogd uses on an default Mac OS X install, and from there I'll try to set it more like I need. Thanks for your time.. - jacco

2 1

RE: [syslog-ng] logging statistics
by SOLIS, ALEX 19 Jun '06

19 Jun '06

This is probably a dumb and out of place question but I would really like to be sure. How do you pronounce Bazsi's name. Is it Ba-zee, Ba-see, or Baz-eye? Or am I completely off. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Sandor Geller Sent: Monday, June 19, 2006 10:40 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] logging statistics Wolfram Schlich wrote: >> This behaviour is going to be changed in the future, there was a >> discussion about the possible solutions already. The current proposal is >> to create a separate logfile which will be simply appended, so the >> statistic information (and maybe other internal messages) won't be >> handled as the other logs. > > Can you point me at the corresponding message(s)? > A URL from http://news.gmane.org/gmane.comp.syslog-ng would be nice :-) There aren't written messages. The conversion took place between Bazsi and myself and the decision is up to Bazsi as he is the syslog-ng developer. I'm sure that he will make his comments about this topic when he returns from vacation. -- Sandor Geller wildy(a)balabit.hu _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

RE: [syslog-ng] Losing TAG information
by SOLIS, ALEX 19 Jun '06

19 Jun '06

Thank you for your reply Evan. So, if you attempt what I did in bullet two in the previous post below do you get different results? If you do, then maybe I should consider upgrading my version of syslog-ng. Thanks again. Alex -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Rempel Sent: Monday, June 19, 2006 10:38 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Losing TAG information All I can really add is that we have a mix ov AIX 4.3.3 through 5.3 that are logging to a linux syslog-ng 1.6.8 machine and we are not experiencing the symptoms that you describe. I have a couple of applications where the tag ends up being "syslog" when it should be something else, but that is quite a bit different than removing it entirely. Evan. SOLIS, ALEX wrote: > I appreciate your sympathy but it does not help me with my TAG problem. > :) > > Anyone else have any idea how to stop syslog-ng from purging the TAG > information from an AIX syslogd message. I have successfully sniffed > syslog traffic between the AIX servers and my LOGHOST. The TAG (Process > Name info) is definitely intact on the wire. This confirms that > syslog-ng is simply parsing the log message and removing the TAG info. > > I did some more tests on the Linux LOGHOST using the logger utility and > I found that syslog-ng does not like spaces after the TAG information. > For example: > > 1) Logger -p syslog.info -t "TEST_TAG" "TEST_MESSAGE" > > Generates the log: > > Jun 19 08:42:38 loghost TEST_TAG: TEST_MESSAGE > > > 2) Logger -p syslog.info -t "TEST_TAG " "TEST_MESSAGE" > > Generates the log: > > Jun 19 08:44:08 loghost : TEST_MESSAGE > > Example two lost the TAG information because of the space after > TEST_TAG. I have considered the possibility that the messages being > sent from the AIX box do not conform to syslog formatting standards and > therefore syslog-ng discards the field. But I would like to know if > there is anything that can be done to stop this behavior. > > Thanks for all responses, even sympathetic ones. :) > > Alex > > > -----Original Message----- > From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > Sent: Tuesday, June 13, 2006 9:09 PM > To: SOLIS, ALEX > Subject: Re: [syslog-ng] Losing TAG information > > On Tue, 13 Jun 2006 10:07:33 CDT, "SOLIS, ALEX" said: > > (off-list reply) > >> I have about 20 or so AIX 4.3 servers that are sending syslog messages >> to a Linux desktop running syslog-ng 1.6.5. > > You have my condolences. IBM dropped support for even AIX 4.3.3 several > years ago - hopefully you're not having problems keeping the software > running and secure... > -----Original Message----- > From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > Sent: Tuesday, June 13, 2006 9:09 PM > To: SOLIS, ALEX > Subject: Re: [syslog-ng] Losing TAG information > > On Tue, 13 Jun 2006 10:07:33 CDT, "SOLIS, ALEX" said: > > (off-list reply) > >> I have about 20 or so AIX 4.3 servers that are sending syslog messages >> to a Linux desktop running syslog-ng 1.6.5. > > You have my condolences. IBM dropped support for even AIX 4.3.3 several > years ago - hopefully you're not having problems keeping the software > running and secure... > > This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > -- Evan Rempel erempel(a)uvic.ca Senior Programmer Analyst 250.721.7691 Computing Services University of Victoria _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

logging statistics
by Heinemann, Joerg (SBI Ruhr) 19 Jun '06

19 Jun '06

Hi, we are plannig to migrate our syslog infrastructure to syslog-ng. Is there a possibility to generate a daily logging statistics like our old kiwi syslogger? Kiwi Syslog Daemon Statistics --------------------------------------------------- 24 hour period ending on: Sun, 11 Jun 2006 00:00:03 Syslog Daemon started on: Sat, 13 May 2006 22:03:13 Syslog Daemon uptime: 28 days, 1 hour, 56 minutes --------------------------------------------------- + Messages received - Total: 129600953 + Messages received - Last 24 hours: 2556443 + Messages received - Since Midnight: 2418503 + Messages received - Last hour: 92320 + Messages received - This hour: 76835 + Messages per hour - Average: 103317 + Messages forwarded: 0 + Messages logged to disk: 4836834 + Errors - Logging to disk: 0 + Errors - Invalid priority tag: 0 + Errors - No priority tag: 0 + Errors - Oversize message: 11 Mit freundlichem Gruß / Best Regards Jörg Heinemann Services for Business IT Ruhr GmbH Communication & Network Services Operation WAN / LAN Bruchstraße 5, 45883 Gelsenkirchen, Germany Jörg Heinemann Tel.: +49 209 9456-7790 Fax: +49 209 9456-67790 joerg.heinemann(a)sbi-ruhr.de <mailto:joerg.heinemann@sbi-ruhr.de> http://www.sbi-ruhr.de <http://www.sbi-ruhr.de> Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet. This e-mail may contain confidential and/or privileged Information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

3 4

mark_freq() wrong?!
by Wolfram Schlich 18 Jun '06

18 Jun '06

I am using this in syslog-ng.conf: options { mark_freq(300); stats_freq(600); } Strangely, the MARK lines appear every 10 minutes (600s) instead of 300s. Any ideas on that? -- Wolfram Schlich

1 0

RE: Syslog-ng not logging anything from Solaris host
by Shah, Maunir 18 Jun '06

18 Jun '06

telnet uses tcp, whereas syslogd uses udp by default, so the traffic might still be blocked by a firewall. Regarding your response for telnet, we had tcp and udp protocol enabled for syslog-ng when we tested to make sure firewall is not blocking it. But, since default solaris syslog uses udp I took out tcp to test and no logging whatsoever. When I run a snoop on syslog-ng server I don't even see any kind of packets coming in when I run logger -p on the test host. Does anyone know if my syslog.conf file on the test box is right or wrong? Maybe that's what is causing it to not send anything. Thanks Maunir Shah ________________________________ From: Shah, Maunir Sent: Friday, June 16, 2006 11:37 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: Syslog-ng not logging anything from Solaris host I'm running syslog-ng 1.6.11 on Solaris 10 zone, and so far I'm able to see logs being created locally but I'm not seeing any kind of logging from other Solaris host. For my syslog-ng server I made sure that I'm using udp and for source its door. I've two test servers running Solaris 8 and 10 that I'm testing from and have changed syslog.conf to reflect the changes and point all my logs to go to syslog-ng. It's not the firewall that is blocking it as we are able to telnet to port 514 and whatever you type in the cmd prompt it records it on the syslog-ng server. I know I'm missing something in the config file but not sure what I'm doing wrong. My syslog-ng.conf file source s_dgram { sun-streams ("/dev/log" door("/etc/.syslog_door")); }; source s_internal { internal(); }; #source s_kernel # { pipe("/proc/kmsg" log_prefix("kernel: ")); }; #source s_tcp # { tcp(ip(10.1.100.84)port(514) keep-alive(yes) max_connections(100)); }; source s_udp { udp(); }; Solaris 8 box syslog.conf file #ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */ # # Copyright (c) 1991-1998 by Sun Microsystems, Inc. # All rights reserved. # # syslog configuration file. # # This file is processed by m4 so be careful to quote (`') names # that match m4 reserved words. Also, within ifdef's, arguments # containing commas must be quoted. # *.* @loghost Maunir Shah 630-285-5875 - desk 630-550-6266 - cell ******************************* IMPORTANT MESSAGE ****************************** This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you. ********************************************************************************

2 1

RE: Syslog-ng not logging anything from Solaris host
by Shah, Maunir 16 Jun '06

16 Jun '06

I guess I wasn't patient enough to try on one of our production boxes that does generate messages. I see the messages coming in now. But thanks for all the help. Maunir Shah ________________________________ From: Shah, Maunir Sent: Friday, June 16, 2006 2:47 PM To: Shah, Maunir; 'syslog-ng(a)lists.balabit.hu' Subject: RE: Syslog-ng not logging anything from Solaris host telnet uses tcp, whereas syslogd uses udp by default, so the traffic might still be blocked by a firewall. Regarding your response for telnet, we had tcp and udp protocol enabled for syslog-ng when we tested to make sure firewall is not blocking it. But, since default solaris syslog uses udp I took out tcp to test and no logging whatsoever. When I run a snoop on syslog-ng server I don't even see any kind of packets coming in when I run logger -p on the test host. Does anyone know if my syslog.conf file on the test box is right or wrong? Maybe that's what is causing it to not send anything. Thanks Maunir Shah ________________________________ From: Shah, Maunir Sent: Friday, June 16, 2006 11:37 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: Syslog-ng not logging anything from Solaris host I'm running syslog-ng 1.6.11 on Solaris 10 zone, and so far I'm able to see logs being created locally but I'm not seeing any kind of logging from other Solaris host. For my syslog-ng server I made sure that I'm using udp and for source its door. I've two test servers running Solaris 8 and 10 that I'm testing from and have changed syslog.conf to reflect the changes and point all my logs to go to syslog-ng. It's not the firewall that is blocking it as we are able to telnet to port 514 and whatever you type in the cmd prompt it records it on the syslog-ng server. I know I'm missing something in the config file but not sure what I'm doing wrong. My syslog-ng.conf file source s_dgram { sun-streams ("/dev/log" door("/etc/.syslog_door")); }; source s_internal { internal(); }; #source s_kernel # { pipe("/proc/kmsg" log_prefix("kernel: ")); }; #source s_tcp # { tcp(ip(10.1.100.84)port(514) keep-alive(yes) max_connections(100)); }; source s_udp { udp(); }; Solaris 8 box syslog.conf file #ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */ # # Copyright (c) 1991-1998 by Sun Microsystems, Inc. # All rights reserved. # # syslog configuration file. # # This file is processed by m4 so be careful to quote (`') names # that match m4 reserved words. Also, within ifdef's, arguments # containing commas must be quoted. # *.* @loghost Maunir Shah 630-285-5875 - desk 630-550-6266 - cell ******************************* IMPORTANT MESSAGE ****************************** This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you. ********************************************************************************

1 0