May 2007 - syslog-ng - lists.balabit.hu

AIX startup
by Brian Loe 27 Mar '08

27 Mar '08

Okay, my syslog-ng instance died at some point last night and because I don't have it setup properly for respawning... Can anyone running syslog-ng on AIX 5.* give me some tips for this? I'm feeding pipes so i have to start instances of SEC as soon as I start syslog-ng - but the SEC scripts appear to "close" so if they're configured to respawn I'll have 2000 instances of them in an hour.

7 21

incorrect firewall logs with syslogng-2.0.0 [security error?]
by Jacek Kalinski 12 Mar '08

12 Mar '08

Hello, After upgradeing from syslogng-1.6.11 to 2.0.0 I've got a strange messages in /var/log/messages file: Nov 29 08:14:05 denise WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 11:10:19 denise PT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 16:42:16 denise W=0 RES=0x00 RST URGP=0 Nov 29 21:37:15 denise 116 ID=34901 DF PROTO=TCP SPT=3584 DPT=80 WINDOW=65535 RES=0x00 ACK FIN URGP=0 These are truncated iptables logs. Because in firewall.log file are simmilar entries to truncated one, I think full file should be: Nov 29 11:10:19 denise firewallp=INVALID:1 a=DROP IN=eth1 OUT= MAC=00:30:4f:36:2b:dc:00:04:9a:2c:7f:20:08:00 SRC=193.41.230.81 DST=xxx.xxx.xxx.x LEN=576 TOS=0x00 PREC=0x00 TTL=117 ID=3495 PROTO=TCP SPT=443 DPT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 (xxx.xxx.xxx.x is a real server IP address - one 'x' is one digit) Config file with interesting lines: options { dir_perm(0700); perm(0600); chain_hostnames(no); stats(1200); keep_hostname(yes); dir_owner(root); dir_group(root); owner(root); group(root); }; source local { unix-stream("/dev/log" max_connections(300)); file("/proc/kmsg"); # udp(ip(0.0.0.0) port(514)); internal(); }; # ..... # authpriv.none;cron.none;mail.none;news.none -/var/log/messages filter f_2 { not facility(news); }; filter f_3 { not facility(local5); }; filter f_4 { not facility(local6); }; filter f_5 { not facility(authpriv); }; filter f_6 { not facility(cron); }; filter f_7 { not facility(mail); }; filter f_notlocal7 { not facility(local7); }; filter f_notfirewall { not match("firewallp="); }; destination d_2 { file("/var/log/messages" create_dirs(yes)); }; log { source(local); filter(f_2); filter(f_4); filter(f_5); filter(f_6); filter(f_7); filter(f_notimapd); filter(f_notpopa3d); filter(f_notnamed); filter(f_notfirewall); destination(d_2); }; #..... # firewallp.* -/var/log/firewall.log filter f_16 { level(warning) and match("firewallp="); }; destination d_12 { file("/var/log/firewall.log" create_dirs(yes)); }; log { source(local); filter(f_16); destination(d_12); }; #..... Do you know where could be an error? It is a production server so I can't debug syslog-ng on this machine (sorry). NOTE: the only truncated lines I can find are iptables (AFAIR they are logged by /proc/kmesg) entries. All other lines are complete. And it is probably a critical error in security. PS: simple statistics line from syslog-ng: Nov 30 00:00:06 denise syslog-ng[32682]: Log statistics; dropped='pipe(/dev/tty12)=0', processed='center(queued)=758289', processed='center(received)=369020', processed='destination(d_maillogimapd)=4245', processed='destination(d_5)=1', processed='destination(d_4)=0', processed='destination(d_3)=14259', processed='destination(d_2)=14259', processed='destination(d_13)=0', processed='destination(d_1)=6000', processed='destination(d_12)=6000', processed='destination(d_11)=369020', processed='destination(d_10)=36', processed='destination(d_8)=0', processed='destination(d_maillogpopa3d)=103224', processed='destination(d_7)=241245', processed='destination(d_6)=0', processed='source(local)=369020' I think you see that it could be a little hard to debug (with so many messages parsed by syslog-ng) ;) Jacek

3 6

syslog-ng 2.0.3 is released
by Balazs Scheidler 14 Nov '07

14 Nov '07

Dear syslog-ng users, I've uploaded syslog-ng 2.0.3, the latest stable release in the syslog-ng 2.0 branch to our webserver. The list of changes is summarized below. The source is available at the usual places at http://www.balabit.com/products/syslog-ng/ 2.0.3 Mon, 26 Mar 2007 14:10:00 +0200 Bugfixes: * Fixed a possible segmentation fault in the usertty() destination driver when it was referenced on a log path with disabled flow-control. * Fixed various usertty() functionality problems. * Removed the 1024 byte limitation of internally generated messages. * Clarified the text of various internal messages, consistency updates for message severities. * Increased the minimum value for log_fifo_size to 1000 elements. * HP-UX portability fixes. * Some minor documentation fixes. Features: * Added spoof-source support for IPv4 & IPv6 to match 1.6.x functionality. * Added support for remembering the last posistion of file sources across restarts. * Added tcp-wrapper support. * Added support for more than 9 regexp matches. -- Bazsi

3 8

Download location change
by Balazs Scheidler 26 Jul '07

26 Jul '07

Dear syslog-ng users, The download location for syslog-ng sources is being changed due to internal web reorganization. In the future, syslog-ng sources will be available from: http://www.balabit.com/products/syslog-ng/sources/ instead of the old download location. The location of the upgrade summary page will not be changed, and will remain: http://www.balabit.com/products/syslog-ng/opensource/upgrades/ Sorry, for the possible inconvinience. -- Balazs Scheidler <bazsi(a)balabit.hu>

5 14

2.0.4 compilation issues
by Douglas J Hunley 04 Jun '07

04 Jun '07

I'm trying to compile 2.0.4 using: ./configure --prefix=/usr --sysconfdir=/etc --enable-dynamic-linking and right away, it fails telling me that libnet-config isn't found. Which is correct, I don't have it installed. There wasn't anything in the tarball that told me I needed to. A 'grep -ri libnet *' shows a bunch of check in the configure and this ChangeLog entry: ChangeLog: * configure.in: added --with-libnet and --enable-spoof-source Is there a reason this dependency isn't documented inside the tarball, or am I missing some file/reference somewhere? Moving on, I went and downloaded the latest libnet, only to find out that the latest doesn't include libnet-config (it's deprecated). So now I have to downgrade my libnet. Moving on again, the compile fails: if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -DLIBNET_LIL_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O3 -march=k8 -mmmx -msse -msse2 -m3dnow -pipe -fomit-frame-pointer -Wall -g -MT cfg-grammar.o -MD -MP -MF ".deps/cfg-grammar.Tpo" \ -c -o cfg-grammar.o `test -f 'cfg-grammar.c' || echo './'`cfg-grammar.c; \ then mv -f ".deps/cfg-grammar.Tpo" ".deps/cfg-grammar.Po"; \ else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before 'libnet_t' afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to 'int' in declaration of 'AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y: In function 'yyparse': /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:590: error: syntax error before ')' token /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:623: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/home/doug/syslog-ng-2.0.4/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/doug/syslog-ng-2.0.4' make: *** [all] Error 2 And there I'm stuck. On a whim, I 'upgrade' my libnet and it suddenly compiles w/o issue.. I think the libnet dependency needs to be re-examined -- Douglas J Hunley (doug at hunley.homeip.net) - Linux User #174778 http://doug.hunley.homeip.net I think, therefore, I am ... not related to you.

2 2

Logging loop
by bryanh＠giraffe-data.com 01 Jun '07

01 Jun '07

My syslog-ng got into an infinite loop when it didn't have permission to write to a file destination. It tried to log to that same destination the fact that it failed to log. Is there a recommended way to configure syslog-ng to avoid this? Maybe I could route messages from Syslog itself to some relatively reliable destination or just turn them off? If not, what would be a good enhancement to the program to avoid loops? I had the problem with syslog-ng 2.0.2. -- Bryan Henderson San Jose, California

4 5

Distributed syslog architecture
by Raghu (Lists) 30 May '07

30 May '07

Hi all, I am working on a project to build distributed syslog-ing system for a very lager enterprise with offices all across the globe. Below are the main objectives: 1. Support for primarily network devices, like ciscos, netscreens, junipers etc 2. Minimum or no loss of messages when network fails 3. Central storage of all syslog messages Could you please give me your ideas or point me to any documentation that deals with such designs? Thank you!

4 5

compiling syslog-ng 2.0.4
by Folkert van Heusden 30 May '07

30 May '07

Hi, I'm trying to compile syslog-ng 2.0.4 but fail to. It gives the following errors: if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -DLIBNET_LIL_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -march=pentium4 -fprefetch-loop-arrays -Wall -g -MT cfg-grammar.o -MD -MP -MF ".deps/cfg-grammar.Tpo" \ -c -o cfg-grammar.o `test -f 'cfg-grammar.c' || echo './'`cfg-grammar.c; \ then mv -f ".deps/cfg-grammar.Tpo" ".deps/cfg-grammar.Po"; \ else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:590: error: syntax error before ')' token /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:623: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/usr/src/syslog-ng-2.0.4/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/src/syslog-ng-2.0.4' make: *** [all] Error 2 What could be the cause? And how do I fix this? Folkert van Heusden -- MultiTail is a versatile tool for watching logfiles and output of commands. Filtering, coloring, merging, diff-view, etc. http://www.vanheusden.com/multitail/ ---------------------------------------------------------------------- Phone: +31-6-41278122, PGP-key: 1F28D8AE, www.vanheusden.com

3 5

[PATCH] Added SElinux module for running syslog-ng on RHEL5.
by Jan-Frode Myklebust 26 May '07

26 May '07

Here's a small patch adding a small SElinux module that makes it possible to run syslog-ng on RHEL5 with SElinux in default enforcing mode. --- contrib/rhel-packaging/syslog_ng.te | 20 ++++++++++++++++++++ contrib/rhel-packaging/syslog_ng.te.README | 14 ++++++++++++++ 2 files changed, 34 insertions(+), 0 deletions(-) create mode 100644 contrib/rhel-packaging/syslog_ng.te create mode 100644 contrib/rhel-packaging/syslog_ng.te.README diff --git a/contrib/rhel-packaging/syslog_ng.te b/contrib/rhel-packaging/syslog_ng.te new file mode 100644 index 0000000..449756c --- /dev/null +++ b/contrib/rhel-packaging/syslog_ng.te @@ -0,0 +1,20 @@ +module syslog_ng 1.0; + +require { + class sock_file { getattr unlink }; + class tcp_socket { create bind setopt name_bind node_bind listen }; + class dir { write add_name }; + class file { create write getattr read }; + type device_t; + type syslogd_t; + type rsh_port_t; + type inaddr_any_node_t; + type var_t; +}; + +allow syslogd_t device_t:sock_file { getattr unlink }; +allow syslogd_t rsh_port_t:tcp_socket name_bind; +allow syslogd_t inaddr_any_node_t:tcp_socket node_bind; +allow syslogd_t self:tcp_socket { create listen bind setopt }; +allow syslogd_t var_t:dir { write add_name }; +allow syslogd_t var_t:file { create write getattr read }; diff --git a/contrib/rhel-packaging/syslog_ng.te.README b/contrib/rhel-packaging/syslog_ng.te.README new file mode 100644 index 0000000..df316a1 --- /dev/null +++ b/contrib/rhel-packaging/syslog_ng.te.README @@ -0,0 +1,14 @@ +"syslog_ng.te" is the necessary selinux module to allow syslog-ng +running on RHEL5 (with selinux in default enforcing mode). It's +necessary for up for letting the syslogd_t domain access /proc/kmsg, +listen on 514/tcp and write /var/syslog-ng.persist. + +To build and load it, execute: + + checkmodule -M -m -o syslog_ng.mod syslog_ng.te + semodule_package -o syslog_ng.pp -m syslog_ng.mod + semodule -i ./syslog_ng.pp + +The module can be removed from the system by executing: + + semodule --remove=syslog_ng -- 1.5.1

2 5

Re: Distributed syslog architecture
by G.W. Haywood 26 May '07

26 May '07

Hi there, On Sat, 26 May 2007 Balazs Scheidler wrote: > On Fri, 2007-05-25 at 01:25 -0700, Tom Le wrote: > > > There are commercial tools you can consider as well but cost is very > > high for this type of distributed architecture (several hundred > > thousand dollars USD) > > > > Can you elaborate on these tools? I would be interested even in private, > if you think it is too off-topic here. FWIW I do't think this is off-topic. :) -- 73, Ged.

1 0