March 2007 - syslog-ng - lists.balabit.hu

Unix datagram
by Bruno Vieira 03 Mar '07

03 Mar '07

Hello fellows. I will try to be brief with my question. I am integrating a team that is developing a system where syslog will receive messages and according to some match expressions will have to send those messages to another process. So, to do this, I have tried unix-dgram. I use Linux Ubuntu and what happens is that when I reload or stop/start syslog I get CORE DUMPED. I have made some research in the documents trying to find out the reason. What I understood was that unix.dgram only works in BSD. Is this the truth? My solution so far is to use a named pipe instead of an unix datagram socket. Tell me your opinion please. Regards, Bruno.

2 3

? Message encryption
by Andy 02 Mar '07

02 Mar '07

Hello sysloggers, Forgive my ignorance and lack of mailing list experience - I failed to figure out how to dig for information in the archives, and could find nothing in the docs. Please give some links to the archive search, or to archive FAQ, if any exist. I am responsible for monitoring and audit log collection in a very sensitive project. No cleartext communication is allowed between any nodes. Log collection server will be a Solaris based cluster (Veritas or SC or homegrown failover/loadalancing method) Under certain circumstances, tunnelling the traffic may introduce more than prevent vulnerabilities, specifically, by hiding the traffic from firewals and local packet filters. Therefore, an ideal solution for syslog so far looks like numbering and encrypting/signing each individual syslog message (obviously, on the fly, to prevent local tampering), and broadcast it to the syslog subnet for stealth pickup by both nodes of the syslog cluster. Is it something that can be acieved using syslog-ng, or the effort of building the relevant extentions for syslog-ng and to a vanilla Solaris syslog is equal? Many thanks in advance for any pointers, hints and suggestions Regards, Andrei

3 2

afinet.c:: Compilation help needed on HP-UX 11i
by Shamim 02 Mar '07

02 Mar '07

afunix.c: In function 'afunix_sd_init': afunix.c:73: warning: comparison is always true due to limited range of data type if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT afinet.o -MD -MP -MF ".deps/afinet.Tpo" \ -c -o afinet.o `test -f 'afinet.c' || echo './'`afinet.c; \ then mv -f ".deps/afinet.Tpo" ".deps/afinet.Po"; \ else rm -f ".deps/afinet.Tpo"; exit 1; \ fi afinet.c: In function 'afinet_setup_socket': afinet.c:156: error: storage size of 'mreq' isn't known afinet.c:156: warning: unused variable 'mreq' *** Error exit code 1 Stop. *** Error exit code 1 Stop. *** Error exit code 1 Stop. # uname -a HP-UX wlggh010 B.11.23 U 9000/785 2006586620 unlimited-user license # Packages installed on my Machine are # swlist |grep gcc gcc 4.1.1 gcc libgcc 4.1.1 libgcc # swlist |grep glib glib 1.2.10 glib glib2 2.12.8 glib2 # --------------------------------- New Yahoo! Mail is the ultimate force in competitive emailing. Find out more at the Yahoo! Mail Championships. Plus: play games and win prizes.

2 9

Re: syslog-ng.1.6.11
by Balazs Scheidler 02 Mar '07

02 Mar '07

On Wed, 2007-02-28 at 16:43 +0000, Michael, Desiree wrote: > > > I am installing syslog-ng on Solaris 9, and have downloaded it, and > libol, from the sunfreeware site, and have run a pkgadd to install > both. On advice from my colleague, I did not follow the INSTALL > instructions in /usr/local/doc/syslogng/INSTALL, because it did look > as though it had already been compiled. Is it correct that I think I > should end up with > > > > 1) /usr/local/sbin/syslog-ng > > 2) /etc/init.d/syslog-ng > > 3) /etc/syslog-ng/syslog.conf > > > > > > BUG 1: I only have the first file in place. The others need to be > renamed and moved out of some subdirectories. Is there any reason why > the pkgadd could not move each of the files into place? (And any > others I need, as I am left only guessing what I need to do to install > it.) > > > > BUG 2: The file /usr/local/doc/syslogng/solbuild/syslog-ng.init.d, > assuming this is the one to go in /etc/init.d, contains the following > lines which I think need editing, because we don’t > have /opt/syslog-ng. > > > > DAEMON=/opt/syslog-ng/sbin/syslog-ng > > CONFFILE=/opt/syslog-ng/etc/syslog-ng/syslog-ng.conf > > > > I do not mind doing this manually, but it seems unusual nowadays to > have to do this sort of modifying, as pkgadd usually does this. This > makes me wonder if there is a reason, for example, that I have missed > something? The sunfreeware packages are not maintained by BalaBit, please contact their maintainer. OTOH our Solaris packages do not perform init script installations either, as: 1) to replace syslogd on the system, you need a script that removes the stock syslogd configuration, this can be difficult as syslogd is not a separate package on Solaris, and it is tied into the base system. 2) once you add a postinstall script, the package cannot be installed automatically, as pkgadd will request some answers by the administrator who performs the installation from its console These might be the same reasons why the sfw packages don't add the init script, however I have no information about that. -- Bazsi

1 0

MySQL syslog-ng regex
by Fat Wallet 01 Mar '07

01 Mar '07

Hi, I am having problem inserting logs into MySQL using match() that returns more than 10 arguements. destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO mydatabase (content_name) VALUES ('$10');\n") template-escape(yes)); }; filter f_filter { match ("^.*?: \"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)$"); }; log { source(s_stunnel); filter(f_filter); destination(d_mysql); }; incoming log message is as followed: "test1","test2","test3","test4","test5","test6","test7","test8","test9","testN","testN1" catting mysql.pipe: $>cat /tmp/mysql.pipe INSERT INTO mydatabase (content_name) VALUES ('test10'); So instead of 'testN', I am getting the 'test1' appends with 0 which is 'test10' Thanks for the help! ____________________________________________________________________________________ Any questions? Get answers on any topic at www.Answers.yahoo.com. Try it now.

4 4