January 2007 - syslog-ng - lists.balabit.hu

Forwarding + Spoofing = Errors & Dropped Packets?
by Ivey, Chris 10 Jan '07

10 Jan '07

We are having a REALLY weird issue with syslog-ng that I need to request some assistance with resolving. It has to do with forwarding and spoofing. If I go into syslog-ng.conf and enable forwarding to my 3 remote servers along with spoofing, it causes issues on the server. First, the Recv-Q fills to capacity (as seen in "netstat -a | grep syslog"). Once that buffer fills, we start seeing "packet receive errors" (as seen in "netstat -su"). We have an INORDINATE amount of these errors (about 45%). Observe: [civey@logsvr2 syslog-ng]$ netstat -su Udp: 112958828 packets received 4084 packets to unknown port received. 50596174 packet receive errors 95393123 packets sent Here is kind of a tabular representation of what I have done so far, and the results: Action Results No forwarding, no spoofing Buffers stay at 0 about 99% of the time, no problems Forwarding to 1 server w/spoofing Buffers increase and stay high for a while, but do eventually get back to 0 Forwarding to 2 servers w/spoofing Buffers increase and stay high, eventually filling and causing "packet receive errors" Forwarding to 1 server, no spoofing Same as no forwarding enabled at all So far we have re-downloaded the syslog-ng source and recompiled on the server, we have re-downloaded and recompiled all the prerequisites for syslog-ng, and we have backed up all the libraries and executables on the bad server and replaced them with the libraries and executables from the good server. None of this has done any good, as we keep seeing the same issues. I am about at my wit's end here. Can someone please provide some direction on where to go from here? O/S: Fedora Core 4 RAM: 2 GB Syslog-ng: 1.6.11 Thanks in advance! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst 1120 Celebration Blvd. Celebration, FL 34747 chris.ivey(a)acs-inc.com "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes

2 1

syslog-ng-1.6.8 seg fault
by Ralf Ebeling 08 Jan '07

08 Jan '07

Hi, I've just started with syslog-ng on a box running SLES10 x64 and run into problems after modifying the configuration. With the default configuration everything runs fine, but when using the attached configuration syslog-ng stalls writing to the log files after some undefined time (syslog-ng doesn't die when running as daemon). Running 'strace syslog-ng -F' exits with a seg fault after some time. Any hints what I've done wrong? 'syslog-ng -s' doesn't complain... Ralf --- syslog-ng.conf --- options {sync(0); perm(0640); stats(3600); long_hostnames(off); use_dns(yes); dns_cache(yes); log_fifo_size(8192); log_msg_size(4096); }; source src { internal(); unix-dgram("/dev/log"); # bind runs chroot'ed unix-dgram("/var/lib/named/dev/log"); udp(ip("0.0.0.0") port(514)); }; filter f_auth { facility(auth); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_localx { facility(local0, local1, local2, local3, local4, local5, local6, local7); }; filter f_courier { facility(local3); }; filter f_nmsg { filter(f_courier) or filter(f_auth) or filter(f_localx); }; filter f_nlocal { filter(f_courier) or filter(f_auth) or filter(f_fg100); }; filter f_nwarn { filter(f_courier) or filter(f_auth) or filter(f_localx); }; filter f_iptables { facility(kern) and match("IN=") and match("OUT="); }; filter f_console { level(warn) and facility(kern) and not filter(f_iptables) or level(err) and not facility(authpriv); }; filter f_newsnotice { level(notice) and facility(news); }; filter f_newscrit { level(crit) and facility(news); }; filter f_newserr { level(err) and facility(news); }; filter f_news { facility(news); }; filter f_mailinfo { level(info) and facility(mail) and not filter(f_courier); }; filter f_mailwarn { level(warn) and facility(mail) and not filter(f_courier); }; filter f_mailerr { level(err, crit) and facility(mail) and not filter(f_courier); }; filter f_mail { facility(mail) and not filter(f_courier); }; filter f_cron { facility(cron); }; filter f_local { filter(f_localx) and not filter(f_nlocal); }; filter f_acpid { match('^\[acpid\]:'); }; filter f_netmgm { match('^NetworkManager:'); }; filter f_messages { not facility(news, mail) and not filter(f_iptables) and not filter(f_nmsg); }; filter f_warn { level(warn, err, crit) and not filter(f_iptables) and not filter(f_warn); }; filter f_alert { level(alert); }; destination console { file("/dev/tty10" group(tty) perm(0620)); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole" group(tty) perm(0400)); }; log { source(src); filter(f_console); destination(xconsole); }; destination newscrit { file("/var/log/news/news.crit" owner(news) group(news)); }; log { source(src); filter(f_newscrit); destination(newscrit); }; destination newserr { file("/var/log/news/news.err" owner(news) group(news)); }; log { source(src); filter(f_newserr); destination(newserr); }; destination newsnotice { file("/var/log/news/news.notice" owner(news) group(news)); }; log { source(src); filter(f_newsnotice); destination(newsnotice); }; destination mail { file("/var/log/mail.log" ); }; log { source(src); filter(f_mail); destination(mail); }; destination acpid { file("/var/log/acpid"); }; log { source(src); filter(f_acpid); destination(acpid); flags(final); }; destination netmgm { file("/var/log/NetworkManager"); }; log { source(src); filter(f_netmgm); destination(netmgm); flags(final); }; destination messages { file("/var/log/messages.log"); }; log { source(src); filter(f_messages); destination(messages); }; destination firewall { file("/var/log/firewall"); }; log { source(src); filter(f_iptables); destination(firewall); }; destination warn { file("/var/log/warn" fsync(yes)); }; log { source(src); filter(f_warn); destination(warn); }; destination d_courier { file("/var/log/courier.log"); }; log { source(src); filter(f_courier); destination(d_courier); }; destination d_authlog { file("/var/log/auth.log"); }; log { source(src); filter(f_auth); destination(d_authlog); }; destination d_local0 { file("/var/log/local0.log"); }; destination d_local1 { file("/var/log/local1.log"); }; destination d_local2 { file("/var/log/local2.log"); }; destination d_local3 { file("/var/log/local3.log"); }; destination d_local4 { file("/var/log/local4.log"); }; destination d_local5 { file("/var/log/local5.log"); }; destination d_local6 { file("/var/log/local6.log"); }; destination d_local7 { file("/var/log/local7.log"); }; log { source(src); filter(f_local0); destination(d_local0); }; log { source(src); filter(f_local1); destination(d_local1); }; log { source(src); filter(f_local2); destination(d_local2); }; log { source(src); filter(f_local3); destination(d_local3); }; log { source(src); filter(f_local4); destination(d_local4); }; log { source(src); filter(f_local5); destination(d_local5); }; log { source(src); filter(f_local6); destination(d_local6); }; log { source(src); filter(f_local7); destination(d_local7); }; --- syslog-ng.conf ---

1 0

syntax error
by Matthias Kerk 08 Jan '07

08 Jan '07

Hello, I try the version 2.0.1. So far I used the version 2.0.0rc3 with following config example: --------- destination console { file("/dev/tty10" group(tty) perm(0620)); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole" group(tty) perm(0400)); }; log { source(src); filter(f_console); destination(xconsole); }; --------- The version 2.0.1 (and 2.0.0) says 'syntax error at ...' If I delete the options from file and pipe, then work syslog ng. see here: --------- destination console { file("/dev/tty10"); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole"); }; log { source(src); filter(f_console); destination(xconsole); }; --------- In the reference manual are however permitted the option. Thanks for your help, Matthias

3 3

Error compiling syslog-ng 2.0.1 on Solaris, Bug in dnscache.c
by Thomas Blank 08 Jan '07

08 Jan '07

I tried to compile syslog-ng 2.0.1 on a Solaris 10-machine, but gcc exits with an error: [...] dnscache.c: In function `dns_cache_key_hash': dnscache.c:82: error: structure has no member named `s6_addr32' dnscache.c:82: error: structure has no member named `s6_addr32' dnscache.c:82: error: structure has no member named `s6_addr32' dnscache.c:82: error: structure has no member named `s6_addr32' make[2]: *** [dnscache.o] Error 1 [...] So I took a look at line 80 in dnsache.c: return (0x80000000 | (e->addr.ip6.s6_addr32[0] ^ e->addr.ip6.s6_addr32[2] ^ e->addr.ip6.s6_addr32[3] ^ e->addr.ip6.s6_addr32[4])); e is a _DNSCacheKey: struct _DNSCacheKey { gint family; union { struct in_addr ip; struct in6_addr ip6; } addr; }; in6_addr comes from /usr/include/netinet/in.h: struct in6_addr { union { #ifdef _KERNEL uint32_t _S6_u32[4]; /* IPv6 address */ uint8_t _S6_u8[16]; /* IPv6 address */ #else uint8_t _S6_u8[16]; /* IPv6 address */ uint32_t _S6_u32[4]; /* IPv6 address */ #endif uint32_t __S6_align; /* Align on 32 bit boundary */ } _S6_un; }; #define s6_addr _S6_un._S6_u8 #ifdef _KERNEL #define s6_addr8 _S6_un._S6_u8 #define s6_addr32 _S6_un._S6_u32 #endif As we are not compiling Kernel-Modules, macro _KERNEL is not defined, so gcc cannot find the member s6_addr32. So I had to modify dnscache.c: tb@host:~/src/syslog-ng-2.0.1 $ vi +80 src/dnscache.c #define s6_addr32 _S6_un._S6_u32 static guint dns_cache_key_hash(DNSCacheKey *e) { if (e->family == AF_INET) return ntohl(e->addr.ip.s_addr); else return (0x80000000 | (e->addr.ip6.s6_addr32[0] ^ e->addr.ip6.s6_addr32[1] ^ e->addr.ip6.s6_addr32[2] ^ e->addr.ip6.s6_addr32[3])); } Among this, s6_addr32 is defined as an array with 4 elements, but you are requesting elements 0, 2, 3 and 4 - this will produce a core dump! I corrected this. The problem with the missing macro exists on Solaris 8 and 9 also, this is fine on Linux. A patch would be fine!

2 3

Migration 1.6.x -> 2.0.x (missing bits)
by Jose Pedro Oliveira 07 Jan '07

07 Jan '07

Hi, I would like to know if there are plans to add support in syslog-ng 2.0 for the tcp_wrappers and the address spoofing features that were available in the syslog-ng 1.6.? The above features could be enabled in syslog-ng 1.6 by the following two configure options: --enable-tcp-wrapper --enable-spoof-source Thanks in advance, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

2 1

More Glib static library problems
by Thomas Upton 07 Jan '07

07 Jan '07

I just downloaded the lastest snapshot (1/5/2007) and I am getting the following error when I run configure. This is on a Solaris 9 server. checking pkg-config is at least version 0.9.0... yes checking for GLIB_CFLAGS... -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include checking for GLIB_LIBS... /usr/local/lib checking for EVTLOG_CFLAGS... -I/usr/local/include/eventlog checking for EVTLOG_LIBS... -L/usr/local/lib -levtlog checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib # find /usr -name libglib-2.0.a -ls 76667 1176 -rw-r--r-- 1 root root 1192836 Jan 5 12:33 /usr/local/lib/libglib-2.0.a As you can see, the static library exists but the configure script can't see it for some reason. Any Ideas? __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Re: why /var/log/syslog, /var/log/messages etc
by G.W. Haywood 06 Jan '07

06 Jan '07

Hi there, On Sat, 6 Jan 2007 Zoilo Gomez wrote: > I would be interested in a link to a document, explaining what is the > idea behind log-files like /var/log/syslog and /var/log/messages etc, http://www.pathname.com/fhs/ -- 73, Ged.

1 0

why /var/log/syslog, /var/log/messages etc
by Zoilo Gomez 06 Jan '07

06 Jan '07

I would be interested in a link to a document, explaining what is the idea behind log-files like /var/log/syslog and /var/log/messages etc, and why some information is often being written to 2 or more files instead of 1. And why some distros will log DHCP-messages to /var/log/daemon.log, while others will use a different log file. Of course I know that this is all up to myself to decide, but I would like to understand better what is the reasoning behind the various options. Z.

2 1

RE: [syslog-ng] why /var/log/syslog, /var/log/messages etc
by Justin Randall 05 Jan '07

05 Jan '07

The basic idea behind this is quite simple. It simple simply a preference shared amongst the developers of the distribution and its software packages. I don't think you'll find a document providing you with reason for the differences, as they are purely cosmetic, however if you read up on the logging mechanisms for a specific distribution you should be able to find or deduce information regarding that specific distro's logic in choosing its log file naming scheme. In the end as you mentioned, it is up to you how you choose you log file naming scheme. Common sense is usually a good place to start, such as avoiding logging kernel logs to a file called 'maillog.log' or 'access.log'. Hope this helps, Justin. -----Original Message----- From: Zoilo Gomez [mailto:zoilo@xs4all.nl] Sent: Friday, January 05, 2007 9:31 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] why /var/log/syslog, /var/log/messages etc I would be interested in a link to a document, explaining what is the idea behind log-files like /var/log/syslog and /var/log/messages etc, and why some information is often being written to 2 or more files instead of 1. And why some distros will log DHCP-messages to /var/log/daemon.log, while others will use a different log file. Of course I know that this is all up to myself to decide, but I would like to understand better what is the reasoning behind the various options. Z. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

error in logrotate.php
by max makli 05 Jan '07

05 Jan '07

Hi I'm new in php, so my problem when i excute logrotate.php & i have this message : Starting logrotate 2007-01-04 10:38:22PHP Warning: include_once(/var/www/phpsyslogng/includes/common_funcs.php): failed to open stream: No such file or directory in /var/www/html/phpsyslogng/scripts/logrotate.php on line 8 PHP Warning: include_once(): Failed opening '/var/www/phpsyslogng/includes/common_funcs.php' for inclusion (include_path='.:/usr/share/pear') in /var/www/html/phpsyslogng/scripts/logrotate.php on line 8 PHP Warning: include_once(/var/www/phpsyslogng/config/config.php): failed to open stream: No such file or directory in /var/www/html/phpsyslogng/scripts/logrotate.php on line 9 PHP Warning: include_once(): Failed opening '/var/www/phpsyslogng/config/config.php' for inclusion (include_path='.:/usr/share/pear') in /var/www/html/phpsyslogng/scripts/logrotate.php on line 9 PHP Fatal error: Call to undefined function db_connect_syslog() in /var/www/html/phpsyslogng/scripts/logrotate.php on line 11 I didn't what i do, my second problem i have a log in localhost but how i transfer this in my base mysql + phpsyslogng THANKS _________________________________________________________________ Découvrez le Blog heroic Fantaisy d'Eragon! http://eragon-heroic-fantasy.spaces.live.com/

2 1