November 2007 - syslog-ng - lists.balabit.hu

Is there any problems when network config is changed?
by hi ro 16 Nov '07

16 Nov '07

Hi, Is there any problems when following occurs? [Precondition] Syslog-ng starts with a config about A-ADDRESS(IP ADDRESS). [Question] 1. Down NIC(A-ADDRESS) with ifdown. → Is there any problems? 2. Change IP-ADDRES from A to B. → Is there any problems? 3. UP NIC(B-ADDRESS) with ifup → Is there any problems? I know that syslog-ng can't start after 3. Thankshiro _________________________________________________________________ 広告表示なし！アカウント有効期限なし！Hotmail Plus のお申し込みはこちら http://get.live.com/mail/options

1 0

About lost of messages after syslog-ng stop
by Frank Abel Cancio Bello 14 Nov '07

14 Nov '07

Hi all! What can I do to avoid that when I stop my syslog-ng client and apache server still logging to its files not lost all those messages? I mean, in the time that the syslog-ng client was not running, the apache continue working and logging data, but when I start the syslog client it don't send to the syslog-ng server the messages that apache logging when it was stopped. Here is part of what I think relevant of my configuration file: # apache message source source s_apache { # Apache2 access log source. file("/var/log/apache2/access.log" log_prefix("apache_access: ") follow_freq(1) flags(no-parse) ); # Apache2 access log source. file("/var/log/apache2/error.log" log_prefix("apache_error: ") follow_freq(1) flags(no-parse) ); }; # central log server destination d_tcp { tcp("10.8.2.227" port(514)); }; # apache logs to central server. log { source(s_apache); destination(d_tcp); flags(flow-control); }; All work fine, just worry about the lost of messages in case that the communication with syslog-ng server fail. I know that Premium Edition have the log_disk_fifo_size(), but that is the only way of do this? Nobody have a workaround for this so necessary feature using the Open Source Edition? Salute Frank Abel __________________________________________ Participe en Universidad 2008. 11 al 15 de febrero del 2008. Palacio de las Convenciones, Ciudad de la Habana, Cuba http://www.universidad2008.cu

2 3

syslog-ng 2.0.3 is released
by Balazs Scheidler 14 Nov '07

14 Nov '07

Dear syslog-ng users, I've uploaded syslog-ng 2.0.3, the latest stable release in the syslog-ng 2.0 branch to our webserver. The list of changes is summarized below. The source is available at the usual places at http://www.balabit.com/products/syslog-ng/ 2.0.3 Mon, 26 Mar 2007 14:10:00 +0200 Bugfixes: * Fixed a possible segmentation fault in the usertty() destination driver when it was referenced on a log path with disabled flow-control. * Fixed various usertty() functionality problems. * Removed the 1024 byte limitation of internally generated messages. * Clarified the text of various internal messages, consistency updates for message severities. * Increased the minimum value for log_fifo_size to 1000 elements. * HP-UX portability fixes. * Some minor documentation fixes. Features: * Added spoof-source support for IPv4 & IPv6 to match 1.6.x functionality. * Added support for remembering the last posistion of file sources across restarts. * Added tcp-wrapper support. * Added support for more than 9 regexp matches. -- Bazsi

3 8

Re: [syslog-ng] Redirect syslog-ng to ttyS0
by kjell.danielsen＠hjemme.no 14 Nov '07

14 Nov '07

Hei. Her is a new trace. Regards Kjell time(NULL) = 1195026575 poll([{fd=13, events=0}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 100) = 0 poll([{fd=13, events=0}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 11, 3448000) = 1 recvfrom(3, "<165>Nov 14 07:49:40 AL[3581]: A"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\2\200\356E\1\200\0\371\1\200\320\21\2\200"}, [0]) = 187 time(NULL) = 1195026580 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026580 time(NULL) = 1195026580 poll([{fd=13, events=POLLOUT, revents=POLLOUT}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 100) = 3 write(13, "Nov 14 07:49:40 lim1 AL[3581]: A"..., 188) = 188 write(10, "Nov 14 07:49:40 lim1 AL[3581]: A"..., 188) = 188 write(4, "Nov 14 07:49:40 lim1 AL[3581]: A"..., 188) = 188 time(NULL) = 1195026580 poll([{fd=13, events=0}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 100) = 0 poll([{fd=13, events=0}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 11, 3443000) = 1 recvfrom(3, "<165>Nov 14 07:49:44 AL[3581]: A"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\2\200\356E\1\200\0\371\1\200\320\21\2\200"}, [0]) = 56 time(NULL) = 1195026584 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026584 time(NULL) = 1195026584 poll([{fd=13, events=POLLOUT, revents=POLLOUT}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 100) = 3 write(13, "Nov 14 07:49:44 lim1 AL[3581]: A"..., 57) = 57 write(10, "Nov 14 07:49:44 lim1 AL[3581]: A"..., 57) = 57 write(4, "Nov 14 07:49:44 lim1 AL[3581]: A"..., 57) = 57 time(NULL) = 1195026584 poll([{fd=13, events=0}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 100) = 0 poll([{fd=13, events=0, revents=POLLERR|POLLHUP}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 3439000) = 1 time(NULL) = 1195026596 close(13) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 3427000) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 155 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 156) = 156 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 156) = 156 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 165 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 3 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 166) = 166 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 166) = 166 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 51 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 52) = 52 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 52) = 52 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 61 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 3 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 62) = 62 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 62) = 62 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 126 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 127) = 127 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 127) = 127 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 136 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 3 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 137) = 137 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 137) = 137 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 51 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 52) = 52 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 52) = 52 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 61 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 3 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 62) = 62 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 62) = 62 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 148 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 149) = 149 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 149) = 149 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 158 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 159) = 159 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 159) = 159 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 3423000) = 1 recvfrom(3, "<165>Nov 14 07:50:05 AL[3581]: A"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 210 time(NULL) = 1195026605 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026605 time(NULL) = 1195026605 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:05 lim1 AL[3581]: A"..., 211) = 211 write(4, "Nov 14 07:50:05 lim1 AL[3581]: A"..., 211) = 211 time(NULL) = 1195026605 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 3418000) = 1 recvfrom(3, "<165>Nov 14 07:50:09 AL[3581]: A"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 56 time(NULL) = 1195026609 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026609 time(NULL) = 1195026609 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:09 lim1 AL[3581]: A"..., 57) = 57 write(4, "Nov 14 07:50:09 lim1 AL[3581]: A"..., 57) = 57 time(NULL) = 1195026609 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 0 poll( <unfinished ...>

1 0

pull logs from remote hosts with syslog-ng?
by Jon Sabo 14 Nov '07

14 Nov '07

Is it possible to use syslog-ng to pull logs from a remote host? If you had a network where only inbound sessions were allowed but nothing was allowed to initiate a connection back, could you have a central syslog-ng server that went out and initiated connections/sessions to remote hosts and pulled back logs? Thanks, Jonathan

2 5

Syslog-ng-2.05 Segmentation Fault
by Daniel Szmandiuk 13 Nov '07

13 Nov '07

Syslog-ng experiences a segmentation fault whenever a message is processed: <stop syslogd first> # syslog-ng -d -d -v -F -e syslog-ng starting up; version='2.0.5' Incoming log entry; line='<28>Nov 9 10:11:24 xinetd[12285]: Exiting...' Filter rule evaluation begins; filter_rule='f_emerg' Filter node evaluation result; filter_result='not-match', filter_type='level' Filter rule evaluation result; filter_result='not-match', filter_rule='f_emerg' Filter rule evaluation begins; filter_rule='f_secure' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_secure' Filter rule evaluation begins; filter_rule='f_cron' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_cron' Filter rule evaluation begins; filter_rule='f_spooler' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter node evaluation result; filter_result='not-match', filter_type='AND' Filter rule evaluation result; filter_result='not-match', filter_rule='f_spooler' Filter rule evaluation begins; filter_rule='f_local7' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_local7' Filter rule evaluation begins; filter_rule='f_messages' Filter node evaluation result; filter_result='match', filter_type='level' Filter rule evaluation result; filter_result='match', filter_rule='f_messages' Initializing destination file writer; template='/var/log/messages', filename='/var/log/messages' Segmentation fault Platform is VMware Guest running RHEL5 x86_64. I used the following steps to build from source: Download eventlog-0.2.5 source ./configure --prefix=/usr --sysconfdir=/etc make make install export PKG_CONFIG_PATH="/usr/lib/pkgconfig" Download syslog-ng-2.0.5 source. ./configure --sysconfdir=/etc make make install I've basically used the supplied config file for Redhat in contrib folder. I'm uncommented the relevant lines in order to use syslog-ng in place of syslogd. Syslog-ng runs OK but as soon as it tries to process a syslog message, it dies with a segmentation fault. Any ideas anyone? Daniel This email and any attachments transmitted with it are confidential and may contain legally privileged information. If you are not the intended recipient you are prohibited from disclosing, copying or using the information contained in it. If you have received this email in error, please notify the sender immediately by return email and then delete all copies of this transmission together with any attachments. It is the addressee's/recipient's duty to virus scan and otherwise test the email before loading it onto any computer system. IMC Communications does not accept liability in connection with any computer virus, data corruption, delay, interruption, unauthorised access or unauthorised amendment in relation to this email. For information about our privacy policy, visit the IMC Communications website at www.imc.net.au This email has been checked by IMC's SMTP gateway. -&-

8 35

particular source
by luigi augello 13 Nov '07

13 Nov '07

hello I need to use a source file as some as source src_backup { file ('/log//192.168.2.180/LOG.$S_MONTH$S_YEAR' log_prefix("Log backup: ")); }; It is possible I tried but don't work Tanks.. Regards Luigi

2 1

syslog-ng not relaying snort 2.6 events properly.
by Mike Fratto 12 Nov '07

12 Nov '07

I have been playing with macros to ensure messages are reformatted to a consistent format. I am viewing the events on the wire using tcpdump on the syslog-ng relay. The first event comes from snort. The second event is sent from syslog-ng. Note the sent message is [|syslog]. This same macro (the syslog-ng.conf file is pasted below) works with other syslog sources. Any thoughts on what the problem is? 10:39:29.810836 IP (tos 0x0, ttl 63, id 60806, offset 0, flags [DF], proto UDP (17), length 183) 192.168.14.13.syslog > 192.168.17.212.syslog: SYSLOG, length: 155 Facility local5 (21), Severity alert (1) Msg: snort[433]: [1:466:5] ICMP L3retriever Ping [Classification: Attempted Information Leak] [Priority: 2]: <eth2> {ICMP} 192.168.17.220 -> 192.168.14.44\012 10:39:29.810968 IP (tos 0x0, ttl 64, id 10591, offset 0, flags [DF], proto UDP (17), length 178) 192.168.17.212.32848 > 192.168.17.198.syslog: [|syslog] # Options options { chain_hostnames(no); keep_hostname(no); use_time_recvd(no); }; # network syslog listener source s_udp { udp(); unix-stream("/dev/log"); }; # Strip headers because syslog-ng wants to add them template strip_header { template("$MSG\n"); template_escape(no); }; #hosts that should have headers stripped filter strip_header_hosts { host("192.168.14.5")or host("example") or host("example.com") or host("mail.example.com") or host("mail") or host("192.168.14.13") or host("snort") or host("snort.example.com") ; }; destination d_test {udp("192.168.17.198"); }; destination d_strip_test {udp("192.168.17.198" template (strip_header)); }; log { source(s_udp); filter(strip_header_hosts); destination(d_strip_test); flags(final); }; log { source(s_udp); destination(d_test); flags(final); };

3 2

syslog-ng relay pre-pends headers
by Mike Fratto 08 Nov '07

08 Nov '07

I know this has been asked alot, but I haven't found a working answer (after much failed googling and reading the admin guide). I am using syslog-ng 2.0.5 on Fedora 7. I am trying to relay syslog messages. Syslog messages sent to syslog-ng in the format: "priority datestamp host message" are being relayed as "priority "datestamp of syslog-ng" "hostname of syslog-ng" "datestamp orig" "hostname original" message" I have chain_hostnames(no) defined and I restarted syslog-ng (the options stanza is below) but still the headers are pre-pended. Any advice? # Options options { chain_hostnames(no); keep_hostname(yes); use_time_recvd(no); };

2 4

Question about Syslog
by FRANCIS PROVENCHER 06 Nov '07

06 Nov '07

Hi all, I configure a central syslogger. In my syslog-ng.conf destination "servername" { file("/var/log/"servername"/$YEAR/$MONTH/$DAY/$HOST.log" owner(root) group(wheel) perm(0600) dir_perm(0700) create_dirs(yes)); }; But the syslog call/errors from "servername" is write in /var/log/messages ... What i'm making wrong? thanks for your help Francis Provencher Ministère de la Sécurité publique du Québec Direction des technologies de l'information Division de la sécurité informatique Tél: 1 418 646-3258 Courriel: Francis.provencher(a)Msp.gouv.qc.ca CEH - Certified Ethical Hackers SSCP - System Security Certified Practitionner Sec+ - Security +

4 8