September 2006 - syslog-ng - lists.balabit.hu

Controlling Logging to Central Syslog-ng Server, DoS etc
by Hari Sekhon 06 Oct '06

06 Oct '06

Hi all, What is the best way to control logging to my central log server? I have read syslog-ng docs quite a lot when I was first setting it up but I don't recall seeing anything on access control. Doesn't this leave me open to DoS attacks etc? After all, you couldn't somebody just write a loop to send garbage to it and fill the whole machine up, not to mention drown out all other valid logs so you miss any important events (oops, I am giving away too much here?). I'm actually tempted to write an attack for this right now... So what do I do to stop some other person from doing this to me? I guess I could use iptables to make sure that only authorized ips can connect to my tcp and udp ports. Is there a better way I haven't thought of? -h -- Hari Sekhon

6 6

connecting to syslog-ng
by Torsten Curdt 06 Oct '06

06 Oct '06

Hi there! Is there a way to connect to a syslog-ng on a machine via a client to receive the events? ...as opposed to just having the syslog-ng pushing the event to another machine all the time. Basically I want only to connect to those machines running syslog-ng in certain situations. Like ssh root@machine tail -f /var/log/messages ...without the need for a ssh account cheers -- Torsten

6 12

FAQ site down - found temporary home
by catenate 06 Oct '06

06 Oct '06

The web site hosting the syslog-ng FAQ has been down for about two days now. This will continue for about another day (or more) until the telco guys come by and figure out where the line is broken. Until it's back up, I recommend using the copy that I put on Splunk Base: http://www.splunk.com/base/syslog-ng-faq Once www.campin.net is back up, I'll evaluate how much sense it makes to keep the FAQ in a wiki. So if you always wanted to update or reformat the FAQ - now is your chance while the FAQ is on one. I'll look closely at any mods made and be sure to keep the good ones. Note that the page isn't formatted very well, and none of the old links actually work. If you want anything from the old real site, google's cache is your friend: http://66.102.7.104/search?q=cache:meyHWPX8PUYJ:www.campin.net/syslog-ng/fa… Input appreciated. Nate Campi

2 1

proper procedure for filing bug reports
by Matt Zagrabelny 06 Oct '06

06 Oct '06

just curious what people do for bug reports with syslog-ng... thanks, -- Matt Zagrabelny - mzagrabe(a)d.umn.edu - (218) 726 8844 University of Minnesota Duluth Information Technology Systems & Services PGP key 1024D/84E22DA2 2005-11-07 Fingerprint: 78F9 18B3 EF58 56F5 FC85 C5CA 53E7 887F 84E2 2DA2 He is not a fool who gives up what he cannot keep to gain what he cannot lose. -Jim Elliot

2 1

problem with syslog-ng hanging on saturday after working all week
by Steven Meacham 06 Oct '06

06 Oct '06

Hi all, Need help. My syslog-ng is hanging on Saturdays. It is like the service just stops responding even though it is running. The system having the problem is just basically a syslog bridging/filtering server. I am using syslog-ng to accept syslog messages and filter for only what I need out of them, and then forwarding them on. It is basiclly setup like below: Webserver>>(udp 514)>syslog-ngfileterserver>>(udp1514)>Syslog Loghost Any help you could give to a newbie about debugging or find the issue would be great..Also any scripts to check the service and restart would be great to. Thanks Steven Meacham

4 4

EventViewer to SysLog - looking for opinions
by Tom Valdes 01 Oct '06

01 Oct '06

I recently started evaluating tools to convert Windows Event Viewer messages to SysLog and I'm looking for opinions on the different ones and what to look for. I first started with EvtSys and it worked pretty well but it left out the hostname so it was hard to make server specific swatch statements. I then tried ntsyslog which shared the same problem. I'm now trying Snare (thanks Kevin for the tip) and it looks a lot more flexible as to what type of events get sent and it sends the hostname as well. When I first installed it, it worked fine and send messages.. After fiddling with it, it stopped working correctly. I'm going to start working with it again, but I'd like to here what else people are using. The 2 things the tool should have are: be free and transmit the Hostname. thanks, tom

3 3

RE: [syslog-ng] EventViewer to SysLog - looking for opinions
by Justin Randall 29 Sep '06

29 Sep '06

* I first started with EvtSys and it worked pretty well but it left out the hostname * so it was hard to make server specific swatch statements. I then tried ntsyslog * which shared the same problem. This shouldn't be a problem for Syslog-NG because you can have it do a DNS lookup on the source IP address of a Syslog message to get the hostname, and then use the $FULLHOST_FROM macro in your 'destination' directive to log it to a file including the hostname. Here's a link that explains more regarding the macros you can use to refine log handling: http://www.balabit.com/products/syslog_ng/reference-2.0/syslog-ng.html/i ndex.html#macros If you don't have DNS in your internal network, you can simply make the IP to hostname correlation in your /etc/hosts file. I hope this helps, Justin. _____ From: Tom Valdes [mailto:tom.valdes@gmail.com] Sent: Friday, September 29, 2006 1:06 PM To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] EventViewer to SysLog - looking for opinions I recently started evaluating tools to convert Windows Event Viewer messages to SysLog and I'm looking for opinions on the different ones and what to look for. I first started with EvtSys and it worked pretty well but it left out the hostname so it was hard to make server specific swatch statements. I then tried ntsyslog which shared the same problem. I'm now trying Snare (thanks Kevin for the tip) and it looks a lot more flexible as to what type of events get sent and it sends the hostname as well. When I first installed it, it worked fine and send messages.. After fiddling with it, it stopped working correctly. I'm going to start working with it again, but I'd like to here what else people are using. The 2 things the tool should have are: be free and transmit the Hostname. thanks, tom

1 0

create_dirs(yes) doesn't actually create directories
by Ian Meyer 29 Sep '06

29 Sep '06

[root@xxxxx ~]# syslog-ng --version syslog-ng 1.6.9 global options from syslog-ng.conf: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; Here's three lines from the config, the /var/log/services directory exists, but the network dir doesn't get created. From what I understand of the reference manual.. create_dirs(yes) *should* create them, yes? I have about 30 directories, and I'd rather not create them by hand. :) Permissions on all directories above /var/log/services are correct. (rwxr-x-r-x) Any insight would be appreciated! Thanks in advance, Ian

2 1

log reporting
by Brian Loe 28 Sep '06

28 Sep '06

Anyone using scripts (like cislog) for reporting on your logs? Anyone using cislog 1.2? If so, can you help me with getting my log format to match up with what is expected? I have SEC running against pipes but wouldn't mind something like cislog to run against yesterday's logs counting and reporting on what is found. Possibly catching things my SEC rules aren't accounting for...

1 0

Syslog IP information is incorrect
by Tom Valdes 28 Sep '06

28 Sep '06

I have some machines behind a firewall VLAN of 10.0.240.0 sending logs to a Linux Syslog server on the 10.0.230.0 network. The 2 machines are 10.0.240.71 and 10.0.240.72 and the Syslog server is 10.0.230.222. They are Windows and I am using the Eventlog to Syslog utility from Purdue University ( https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys) to convert the Windows event logs to Syslog. Syslog is getting the information, however, any information from the 2 machines are coming in as 10.0.230.1. ------- Sep 28 11:37:54 10.0.230.1 Service Control ....... <---- This machine is actually 10.0.240.71 ------- Is there a way to get Syslog to read the correct IP information? or does Syslog simply not pass correct host information through a router? thanks, tom

3 3