March 2007 - syslog-ng - lists.balabit.hu

AIX startup
by Brian Loe 27 Mar '08

27 Mar '08

Okay, my syslog-ng instance died at some point last night and because I don't have it setup properly for respawning... Can anyone running syslog-ng on AIX 5.* give me some tips for this? I'm feeding pipes so i have to start instances of SEC as soon as I start syslog-ng - but the SEC scripts appear to "close" so if they're configured to respawn I'll have 2000 instances of them in an hour.

7 21

incorrect firewall logs with syslogng-2.0.0 [security error?]
by Jacek Kalinski 12 Mar '08

12 Mar '08

Hello, After upgradeing from syslogng-1.6.11 to 2.0.0 I've got a strange messages in /var/log/messages file: Nov 29 08:14:05 denise WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 11:10:19 denise PT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 16:42:16 denise W=0 RES=0x00 RST URGP=0 Nov 29 21:37:15 denise 116 ID=34901 DF PROTO=TCP SPT=3584 DPT=80 WINDOW=65535 RES=0x00 ACK FIN URGP=0 These are truncated iptables logs. Because in firewall.log file are simmilar entries to truncated one, I think full file should be: Nov 29 11:10:19 denise firewallp=INVALID:1 a=DROP IN=eth1 OUT= MAC=00:30:4f:36:2b:dc:00:04:9a:2c:7f:20:08:00 SRC=193.41.230.81 DST=xxx.xxx.xxx.x LEN=576 TOS=0x00 PREC=0x00 TTL=117 ID=3495 PROTO=TCP SPT=443 DPT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 (xxx.xxx.xxx.x is a real server IP address - one 'x' is one digit) Config file with interesting lines: options { dir_perm(0700); perm(0600); chain_hostnames(no); stats(1200); keep_hostname(yes); dir_owner(root); dir_group(root); owner(root); group(root); }; source local { unix-stream("/dev/log" max_connections(300)); file("/proc/kmsg"); # udp(ip(0.0.0.0) port(514)); internal(); }; # ..... # authpriv.none;cron.none;mail.none;news.none -/var/log/messages filter f_2 { not facility(news); }; filter f_3 { not facility(local5); }; filter f_4 { not facility(local6); }; filter f_5 { not facility(authpriv); }; filter f_6 { not facility(cron); }; filter f_7 { not facility(mail); }; filter f_notlocal7 { not facility(local7); }; filter f_notfirewall { not match("firewallp="); }; destination d_2 { file("/var/log/messages" create_dirs(yes)); }; log { source(local); filter(f_2); filter(f_4); filter(f_5); filter(f_6); filter(f_7); filter(f_notimapd); filter(f_notpopa3d); filter(f_notnamed); filter(f_notfirewall); destination(d_2); }; #..... # firewallp.* -/var/log/firewall.log filter f_16 { level(warning) and match("firewallp="); }; destination d_12 { file("/var/log/firewall.log" create_dirs(yes)); }; log { source(local); filter(f_16); destination(d_12); }; #..... Do you know where could be an error? It is a production server so I can't debug syslog-ng on this machine (sorry). NOTE: the only truncated lines I can find are iptables (AFAIR they are logged by /proc/kmesg) entries. All other lines are complete. And it is probably a critical error in security. PS: simple statistics line from syslog-ng: Nov 30 00:00:06 denise syslog-ng[32682]: Log statistics; dropped='pipe(/dev/tty12)=0', processed='center(queued)=758289', processed='center(received)=369020', processed='destination(d_maillogimapd)=4245', processed='destination(d_5)=1', processed='destination(d_4)=0', processed='destination(d_3)=14259', processed='destination(d_2)=14259', processed='destination(d_13)=0', processed='destination(d_1)=6000', processed='destination(d_12)=6000', processed='destination(d_11)=369020', processed='destination(d_10)=36', processed='destination(d_8)=0', processed='destination(d_maillogpopa3d)=103224', processed='destination(d_7)=241245', processed='destination(d_6)=0', processed='source(local)=369020' I think you see that it could be a little hard to debug (with so many messages parsed by syslog-ng) ;) Jacek

3 6

syslog-ng 2.0.3 is released
by Balazs Scheidler 14 Nov '07

14 Nov '07

Dear syslog-ng users, I've uploaded syslog-ng 2.0.3, the latest stable release in the syslog-ng 2.0 branch to our webserver. The list of changes is summarized below. The source is available at the usual places at http://www.balabit.com/products/syslog-ng/ 2.0.3 Mon, 26 Mar 2007 14:10:00 +0200 Bugfixes: * Fixed a possible segmentation fault in the usertty() destination driver when it was referenced on a log path with disabled flow-control. * Fixed various usertty() functionality problems. * Removed the 1024 byte limitation of internally generated messages. * Clarified the text of various internal messages, consistency updates for message severities. * Increased the minimum value for log_fifo_size to 1000 elements. * HP-UX portability fixes. * Some minor documentation fixes. Features: * Added spoof-source support for IPv4 & IPv6 to match 1.6.x functionality. * Added support for remembering the last posistion of file sources across restarts. * Added tcp-wrapper support. * Added support for more than 9 regexp matches. -- Bazsi

3 8

Compressing syslog traffic across a WAN?
by K K 09 Apr '07

09 Apr '07

Has anybody found a good way to take a high-volume stream of UDP syslog packets, aggregate and compress the packets, and then recreate them, with the original source IPs, at the other end of a WAN circuit? Looks like Riverbed cannot optimize UDP syslog?. Encapsulating the packets in an IPSEC tunnel with compression would make the packets smaller, but not reduce the packets-per-second. Tolstoy Version: I have a number of 'appliance' hosts on the west coast which generate high volumes of syslog events, which I need to forward to an 'appliance' log analysis server (EIQ) in the midwest. The version of EIQ we're stuck with only supports UDP, and uses the source IP of the packet to decide which host the event occurred on -- it cannot take the embedded hostname in the packet and use that. What we're doing right now is configuring all the west coast appliances send their syslog events to a syslog-ng server locally on the same network, which then filters out the junk events and uses spoof-source to forward these UDP packets across the slow WAN circuit to the EIQ appliances in the Midwest: Source \ Source --UDP-- syslog-ng --UDP-over-WAN-- EIQ Source / I could consider sending these events via TCP syslog to a syslog-ng server in the Midwest, and that would then send a copy of the packets via UDP to EIQ, but in this approach, I gather that we wouldn't be able to use spoof-source to regenerate the UDP packet with the original source IP? Thanks, Kevin

3 3

Disconnected access/tailing real files/web interface
by J Bridge 06 Apr '07

06 Apr '07

Hello. I would like to centralise logs from many different hosts into one place. It's possible that the network connectivity between the log server and the hosts is not reliable. Therefore: 1. Can I get syslog-ng to send new log entries once it can see the central log server again? I would also like to centralise logs from non-syslog programs such as some big database apps. 2. Can syslog-ng work similarly to tail -f logging to the central server? And finally (but least importantly).. 3. Does anyone know a good web interface for viewing or searching the files from a web interface? The logs must remain as files, not be put in a mysql database. Thanks, jbj

2 2

Localport() & localip() cause syntax error in 2.0.2
by simonst＠wellsfargo.com 04 Apr '07

04 Apr '07

Localip() and localport() parms still causing a syntax error, after straightening out semicolons (thanks to Evan Rempel). # syslog-ng -V syslog-ng 2.0.2 # cat -n syslog-ng.test #Show syslog-ng.test without localip() & localport() 1 options { long_hostnames(off); sync(0); }; 2 source src { unix-stream("/dev/log"); internal(); }; 3 source kernsrc { file("/proc/kmsg"); }; 4 destination logger { tcp("10.11.12.13" port(5678) template("$UNIXTIME $HOST $MESSAGE\n") ); }; 5 log { source(src); source(kernsrc); destination(logger); }; # syslog-ng -dFsf syslog-ng.test # No syntax error without localip() & localport() # cat -n syslog-ng.test #Add localip() & localport() to syslog-ng.test 1 options { long_hostnames(off); sync(0); }; 2 source src { unix-stream("/dev/log"); internal(); }; 3 source kernsrc { file("/proc/kmsg"); }; 4 destination logger { tcp("10.11.12.13" port(5678) localip(10.9.8.7) localport(5678) template("$UNIXTIME $HOST $MESSAGE\n") ); }; 5 log { source(src); source(kernsrc); destination(logger); }; # syslog-ng -dFsf syslog-ng.test syntax error at 4 # SYNTAX ERROR with localip() & localport()

3 6

./configure: line 6998: --defines: command not found
by Mr. James W. Laferriere 30 Mar '07

30 Mar '07

Hello All , THis one is kind of interesting . ./configure seems to have a variable that remains or becomes null . dug it out ... $ grep -n . ./configure | grep -C3 -n 6998 6267-6995: LIBNET_CONFIG=$with_libnet/libnet-config 6268-6996: fi 6269-6997: if test -x $LIBNET_CONFIG; then 6270:6998: LIBNET_CFLAGS="`$LIBNET_CONFIG --defines`" 6271-6999: LIBNET_LIBS="`$LIBNET_CONFIG --libs`" 6272-7000: { echo "$as_me:$LINENO: result: yes" >&5 6273-7001:echo "${ECHO_T}yes" >&6; } Commandling used for ./configure $ LDFLAGS="-static" PKG_CONFIG_PATH="${PKG_CONFIG_PATH}:../eventlog-0.2.5" ./configure --enable-static-linking --enable-tcp-wrapper --enable-spoof-source The output from the above . ...snip... checking for getaddrinfo... yes checking for getutent... yes checking for TCP wrapper library... checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... yes checking for LIBNET... which: no libnet-config in (/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin:/home/jlaferri/bin) ./configure: line 6998: --defines: command not found ./configure: line 6999: --libs: command not found yes checking for static GLib libraries... yes configure: creating ./config.status config.status: creating dist.conf config.status: creating Makefile config.status: creating syslog-ng.spec.bb config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating doc/docvars.xml config.status: creating contrib/Makefile config.status: creating tests/Makefile config.status: creating solbuild/Makefile config.status: creating tests/unit/Makefile config.status: creating tests/functional/Makefile config.status: creating config.h config.status: executing depfiles commands -- +-----------------------------------------------------------------+ | James W. Laferriere | System Techniques | Give me VMS | | Network Engineer | 663 Beaumont Blvd | Give me Linux | | babydr(a)baby-dragons.com | Pacifica, CA. 94044 | only on AXP | +-----------------------------------------------------------------+

1 0

60 second delay when log rotates, can this be avoided?
by Michael Toy 29 Mar '07

29 Mar '07

I have a log which is received over TCP and is being written to a local file name which changes (with syslog ng macros) once per hour. I am also sending that same stream to a program. When the log rotates, all data seems to stop flowing for exactly 60 seconds, both to the log file and to program. Is there any way to change this?

6 10

syslog-ng 1.6 and 2.0
by Pol Moal 29 Mar '07

29 Mar '07

Hi, Is it possible to use syslog-ng 1.6 for the loghost and syslog-ng 2.0 for the client? nb: client use only option that exists in 1.6. thanks -- Pol Moal - Comité Réseau des Universités |--> http://www.cru.fr

3 3

Re: [syslog-ng] problem in compiling "syslog-ng-2.0.2" on SunOS 5.9 sparc
by Root Administrator 28 Mar '07

28 Mar '07

> > These are the package information about GLIB. > > # pkginfo -l SUNWGlib > PKGINST: SUNWGlib > NAME: GLIB - Library of useful routines for C programming > CATEGORY: system > ARCH: sparc > VERSION: 11.9.0,REV=2002.03.02.00.35 > BASEDIR: / > VENDOR: Sun Microsystems, Inc. > DESC: GLIB - Library of useful routines for C programming > PSTAMP: sfw8120020302003551 > INSTDATE: Aug 27 2004 19:50 > HOTLINE: Please contact your local service provider > STATUS: completely installed > FILES: 33 installed pathnames > 8 shared pathnames > 11 directories > 7 executables > 779 blocks used (approx) > > # pkginfo -l SMCglib > PKGINST: SMCglib > NAME: glib > CATEGORY: application > ARCH: sparc > VERSION: 2.6.2 > BASEDIR: /usr/local > VENDOR: The GLIB Project > PSTAMP: Steve Christensen > INSTDATE: 3月 05 2007 15:50 > EMAIL: steve(a)smc.vnet.net > STATUS: completely installed > FILES: 780 installed pathnames > 8 shared pathnames > 163 directories > 17 executables > 42974 blocks used (approx) > > SUNWGlib is the pre-installed package. > SMCglib is that I did pkgadd successfully. > file is : > ftp://ftp.sunfreeware.com/pub/freeware/sparc/9/glib-2.6.2-sol9-sparc-local.… > > > -------------------------------------------------------------------------------- > > Further information about the package is as, > > # cat /usr/local/lib/pkgconfig/glib-2.0.pc > prefix=/usr/local > exec_prefix=${prefix} > libdir=${exec_prefix}/lib > includedir=${prefix}/include > > glib_genmarshal=glib-genmarshal > gobject_query=gobject-query > glib_mkenums=glib-mkenums > > Name: GLib > Description: C Utility Library > Version: 2.6.2 > Libs: -L${libdir} -lglib-2.0 -liconv > Cflags: -I${includedir}/glib-2.0 -I${libdir}/glib-2.0/include > > and, > > # export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/:/usr/lib/pkgconfig/ > # pkg-config --cflags glib-2.0 > -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include > > but, > > # ls /usr/local/lib/g* > /usr/local/lib/g*: No such file or directory > > Therefore, it seems that the installed package does NOT create the > directories > which are necessary to compile syslog-ng-2.0.2. > Further, the package does NOT create the file "glibconfig.h" which should > exist > in /usr/local/lib/glib-2.0/include. > > I simply tried to copy the file "/usr/sfw/lib/glib/include/glibconfig.h" > into > "/usr/local/lib/glib-2.0/include/" , and done make again. > Then, it passes the problem regarding "file does not exist" , although it > errors out > a lot more elsewhere since the file "glibconfig.h" belongs to the original > package. > > > -------------------------------------------------------------------------------- > > find /usr/local -name glibconfig.h -ls > returns > none > > find /usr/local -name gtypes.h -ls > returns > 135296 15 -rw-r--r-- 1 root bin 15241 Mar 1 2005 > /usr/local/include/glib-2.0/glib/gtypes.h > > > -------------------------------------------------------------------------------- > > About the missing blank space, > there IS a space before the second -I. > There was a space in the text before sending. > It was deleted somehow at the mail archive. > I do not know why,,, > > > -------------------------------------------------------------------------------- > > Questions are,,, > Q1. Is the package I have installed appropriate in order to compile > syslog-ng-2.0.2 ? > Q2. Are there any package dependencies associated with this package ? > > Please help out. > > Regards, > > George > > ------------------------------ > > Message: 4 > Date: Tue, 27 Mar 2007 03:01:06 -0400 > From: Valdis.Kletnieks(a)vt.edu > Subject: Re: [syslog-ng] problem in compiling "syslog-ng-2.0.2" on > SunOS 5.9 sparc > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: <200703270701.l2R716nZ014513(a)turing-police.cc.vt.edu> > Content-Type: text/plain; charset="us-ascii" > > On Tue, 27 Mar 2007 11:57:42 +0900, Root Administrator said: > > > > ftp://ftp.sunfreeware.com/pub/freeware/sparc/9/glib-2.6.2-sol9-sparc-local.… > > > > The package information is ; > > > > # pkginfo | grep -i glib > > application SMCglib glib > > system SUNWGlib GLIB - Library of > > useful routines for C programming > > Humor me, part one - can you get pkginfo to tell you what release(s) of > glib > this is? And is the sol9-sparc-local file referenced above actually the > one you did a successful pkgadd with? (I'm suspecting that there's > something > wrong here, as later on you look to see what the pkginfo database has in > it, and we *don't* see anything referencing /usr/local, even though: > > > gcc -DHAVE_CONFIG_H -I. -I. -I.. > > -I/usr/local/include/glib-2.0-I/usr/local/lib/glib- > > 2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 > -Wall -g > > -c `test -f 'misc.c' || echo './'`misc.c > > We see a reference to /usr/local/include, and /usr/local/lib/include. > > Also, please double-check if you had a cut-n-paste error - there's a > missing blank before the second -I. > > What does this command return: > > % pgk-config --cflags glib-2.0 > > (If this has 2 -I flags with a missing space, that's your problem). > > > In file included from /usr/local/include/glib-2.0/glib/galloca.h:30, > > from /usr/local/include/glib-2.0/glib.h:30, > > from syslog-ng.h:37, > > from misc.h:27, > > from misc.c:24: > > OK, here we've found a glib include in /usr/local/include, somehow. > > > /usr/local/include/glib-2.0/glib/gtypes.h:30: glibconfig.h: No such > file > > or directory > > but something is fishy about it. > > > # find /usr -name glibconfig.h -exec grep {} > /var/sadm/install/contents \; > > Humor me, part two: > > What does this return: > > # find /usr/local -name glibconfig.h -ls > # find /usr/local -name gtypes.h -ls > > (We skip the grep because I'm curious what's actually on the system, as > opposed to what files pgkadd *thinks* are on the system...) > >

2 1