October 2007 - syslog-ng - lists.balabit.hu

13 Apr '08

Hi, What packages does it need to compile syslog-ng? Is it the same package when to make RPM? (bison, flex, gcc-c++, pkgconfig, glib2-devel, libevtlog-devel) (It needs only libc to compile eventlog, doesn't it?) And if it's not necessary to connect database, does it need to install libdbi8? Thanks hiro _________________________________________________________________ 【MSNビデオ】超貴重！驚きの大物対談が実現。作家村上龍が話題のあの人に迫る http://video.msn.co.jp/rvr/default.htm

4 14

AIX startup
by Brian Loe 27 Mar '08

27 Mar '08

Okay, my syslog-ng instance died at some point last night and because I don't have it setup properly for respawning... Can anyone running syslog-ng on AIX 5.* give me some tips for this? I'm feeding pipes so i have to start instances of SEC as soon as I start syslog-ng - but the SEC scripts appear to "close" so if they're configured to respawn I'll have 2000 instances of them in an hour.

7 21

incorrect firewall logs with syslogng-2.0.0 [security error?]
by Jacek Kalinski 12 Mar '08

12 Mar '08

Hello, After upgradeing from syslogng-1.6.11 to 2.0.0 I've got a strange messages in /var/log/messages file: Nov 29 08:14:05 denise WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 11:10:19 denise PT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 16:42:16 denise W=0 RES=0x00 RST URGP=0 Nov 29 21:37:15 denise 116 ID=34901 DF PROTO=TCP SPT=3584 DPT=80 WINDOW=65535 RES=0x00 ACK FIN URGP=0 These are truncated iptables logs. Because in firewall.log file are simmilar entries to truncated one, I think full file should be: Nov 29 11:10:19 denise firewallp=INVALID:1 a=DROP IN=eth1 OUT= MAC=00:30:4f:36:2b:dc:00:04:9a:2c:7f:20:08:00 SRC=193.41.230.81 DST=xxx.xxx.xxx.x LEN=576 TOS=0x00 PREC=0x00 TTL=117 ID=3495 PROTO=TCP SPT=443 DPT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 (xxx.xxx.xxx.x is a real server IP address - one 'x' is one digit) Config file with interesting lines: options { dir_perm(0700); perm(0600); chain_hostnames(no); stats(1200); keep_hostname(yes); dir_owner(root); dir_group(root); owner(root); group(root); }; source local { unix-stream("/dev/log" max_connections(300)); file("/proc/kmsg"); # udp(ip(0.0.0.0) port(514)); internal(); }; # ..... # authpriv.none;cron.none;mail.none;news.none -/var/log/messages filter f_2 { not facility(news); }; filter f_3 { not facility(local5); }; filter f_4 { not facility(local6); }; filter f_5 { not facility(authpriv); }; filter f_6 { not facility(cron); }; filter f_7 { not facility(mail); }; filter f_notlocal7 { not facility(local7); }; filter f_notfirewall { not match("firewallp="); }; destination d_2 { file("/var/log/messages" create_dirs(yes)); }; log { source(local); filter(f_2); filter(f_4); filter(f_5); filter(f_6); filter(f_7); filter(f_notimapd); filter(f_notpopa3d); filter(f_notnamed); filter(f_notfirewall); destination(d_2); }; #..... # firewallp.* -/var/log/firewall.log filter f_16 { level(warning) and match("firewallp="); }; destination d_12 { file("/var/log/firewall.log" create_dirs(yes)); }; log { source(local); filter(f_16); destination(d_12); }; #..... Do you know where could be an error? It is a production server so I can't debug syslog-ng on this machine (sorry). NOTE: the only truncated lines I can find are iptables (AFAIR they are logged by /proc/kmesg) entries. All other lines are complete. And it is probably a critical error in security. PS: simple statistics line from syslog-ng: Nov 30 00:00:06 denise syslog-ng[32682]: Log statistics; dropped='pipe(/dev/tty12)=0', processed='center(queued)=758289', processed='center(received)=369020', processed='destination(d_maillogimapd)=4245', processed='destination(d_5)=1', processed='destination(d_4)=0', processed='destination(d_3)=14259', processed='destination(d_2)=14259', processed='destination(d_13)=0', processed='destination(d_1)=6000', processed='destination(d_12)=6000', processed='destination(d_11)=369020', processed='destination(d_10)=36', processed='destination(d_8)=0', processed='destination(d_maillogpopa3d)=103224', processed='destination(d_7)=241245', processed='destination(d_6)=0', processed='source(local)=369020' I think you see that it could be a little hard to debug (with so many messages parsed by syslog-ng) ;) Jacek

3 6

Can TAG field be terminated by space?
by Tsurusawa Takeshi 31 Dec '07

31 Dec '07

Hi, I'm using syslog-ng-2.0.5 and trying to store syslog messages into a DB table with a TAG field column. But when TAG fileld is terminated with space character(' ') in syslog message, syslog-ng parser returns as TAG field not only TAG field but also some extra strings end with a colon(':') in CONTENT field. For example, if MSG part is "program abc: message...", syslog-ng returns "program abc" as a TAG field. According to the section 4.1.3 of RFC3164, a space character can also terminate a TAG field. The TAG is a string of ABNF alphanumeric characters that MUST NOT exceed 32 characters. Any non-alphanumeric character will terminate the TAG field and will be assumed to be the starting character of the CONTENT field. Most commonly, the first character of the CONTENT field that signifies the conclusion of the TAG field has been seen to be the left square bracket character ("["), a colon character (":"), or a space character. Is it possible to change this behavior of syslog-ng? Thanks in advance. -- Tsurusawa Takeshi <tsuru(a)grid.nii.ac.jp>

3 6

Patch for open source syslog-ng-2.0.5
by Philip Bellino 19 Nov '07

19 Nov '07

The following attached patch is being submitted against the open source syslog-ng-2.0.5. * src/afsocket.c (afsocket_dd_format_stats_name): Using IPv6 for a destination of tcp6 or udp6: There was no case statement for AF_INET6 and as a result, "driver_name" was never filled in with either tcp6 or udp6. The subsequent routine (g_snprintf) that used "driver_name" caused a segmentation fault. This is now fixed. <<syslog-ng-Changelog.doc>> <<afsocket.diff>> Phil Bellino Software Engineer MRV Communications, Inc. 295 Foster Street Littleton, MA. 01460 Phone: 978-952-4807 Fax: 978-952-5444 Email: pbellino(a)mrv.com <http://www.mrv.com/>

2 1

syslog-ng 2.0.3 is released
by Balazs Scheidler 14 Nov '07

14 Nov '07

Dear syslog-ng users, I've uploaded syslog-ng 2.0.3, the latest stable release in the syslog-ng 2.0 branch to our webserver. The list of changes is summarized below. The source is available at the usual places at http://www.balabit.com/products/syslog-ng/ 2.0.3 Mon, 26 Mar 2007 14:10:00 +0200 Bugfixes: * Fixed a possible segmentation fault in the usertty() destination driver when it was referenced on a log path with disabled flow-control. * Fixed various usertty() functionality problems. * Removed the 1024 byte limitation of internally generated messages. * Clarified the text of various internal messages, consistency updates for message severities. * Increased the minimum value for log_fifo_size to 1000 elements. * HP-UX portability fixes. * Some minor documentation fixes. Features: * Added spoof-source support for IPv4 & IPv6 to match 1.6.x functionality. * Added support for remembering the last posistion of file sources across restarts. * Added tcp-wrapper support. * Added support for more than 9 regexp matches. -- Bazsi

3 8

syslog-ng relay pre-pends headers
by Mike Fratto 08 Nov '07

08 Nov '07

I know this has been asked alot, but I haven't found a working answer (after much failed googling and reading the admin guide). I am using syslog-ng 2.0.5 on Fedora 7. I am trying to relay syslog messages. Syslog messages sent to syslog-ng in the format: "priority datestamp host message" are being relayed as "priority "datestamp of syslog-ng" "hostname of syslog-ng" "datestamp orig" "hostname original" message" I have chain_hostnames(no) defined and I restarted syslog-ng (the options stanza is below) but still the headers are pre-pended. Any advice? # Options options { chain_hostnames(no); keep_hostname(yes); use_time_recvd(no); };

2 4

Connection broke using remote syslog-ng clients
by LESOUEF Emmanuel 05 Nov '07

05 Nov '07

Hello, I'm getting this kind of logs (facility syslog) on my central syslog-ng server : Oct 31 12:08:10 lxnetmgmt syslog-ng[8698]: EOF occurred while idle; fd='6' Oct 31 12:08:10 lxnetmgmt syslog-ng[8698]: Connection broken; time_reopen='10' Oct 31 12:08:20 lxnetmgmt syslog-ng[8698]: Connection failed; error='Connection refused (111)', time_reopen='10' It occurs after restarting the central syslog-ng server. These messages come from remote hosts sending their logs via tcp to the central syslog-ng server. Any idea ? Thanks for your help. -- Emmanuel Lesouef DSI | CRBN t : 0231069671 m : e.lesouef(a)crbn.fr

3 2

Patch submission
by Philip Bellino 03 Nov '07

03 Nov '07

Hello, Could someone provide me with directions on how to submit a patch to the open source 2.0.5 syslog-ng? Thanks, Phil Bellino Phil Bellino Software Engineer MRV Communications, Inc. 295 Foster Street Littleton, MA. 01460 Phone: 978-952-4807 Fax: 978-952-5444 Email: pbellino(a)mrv.com <http://www.mrv.com/>

2 3

timezone issues
by Campbell Simpson 03 Nov '07

03 Nov '07

Hi I'm having problems using the timezone() function on my source drivers. My syslog-ng server is set up to receive syslog messages from the network. The servers sending to it are set to GMT+0 and the timezone information is not sent in the syslog messages. I would like to be able to do a conversion on the received time stamp and write the time to a fifo buffer in localtime on the syslog box. I'm running syslog-ng 2.0.5 on Redhat Enterprise. My config looks like: options { sync (20); stats_freq (60); dns_cache (yes); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (persist_only); dns_cache_hosts(/etc/hosts); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_net { udp(port(514) time_zone(+00:00)); }; destination splunk1 { pipe("/var/data/syslog.fifo" template("$DATE $TZ - $R_TZ - $S_TZ $HOST $MSG\n")); }; destination splunk2 { pipe("/var/data/syslog2.fifo"); }; destination aaatransact { file("/var/data/aaatransact.log"); }; destination aaaprocess { file("/var/data/aaaprocess.log"); }; log { source(s_net); filter(f_local4); destination(splunk1); }; log { source(s_net); filter(f_local4); destination(aaatransact); }; log { source(s_net); filter(f_local5); destination(splunk2); }; log { source(s_net); filter(f_local5); destination(aaaprocess); }; The output to /var/data/syslog.fifo however looks like: Oct 26 00:39:55 +13:00 - +13:00 - +13:00 blah blah blah It doesn't matter what I change the time_zone value to, it always gets reported as +13:00. Even setting the global recv_time_zone doesn't change anything... Anyone got any ideas? Thanks Campbell

2 1