May 2007 - syslog-ng - lists.balabit.hu

undefined reference to `libnet_init'
by Tim Boyer 25 May '07

25 May '07

I'm doing my first install on a RHEL5 virtual machine. I've successfully installed syslog-ng on RHEL3, 4, and 5 before, and have a fairly detailed idea of what I need to do - install libnet; whoops, need eventlog first; install that, install syslog-ng-2.0.3. It worked fine on the xen host. On the xen client, I get: gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/lib64 -lglib-2.0 -L/usr/local/lib -levtlog -lwrap -Wl,-Bdynamic libsyslog-ng.a(afinet.o): In function `afinet_dd_construct_ipv6_packet': /usr/src/syslog-ng-2.0.3/src/afinet.c:420: undefined reference to `libnet_clear_packet' /usr/src/syslog-ng-2.0.3/src/afinet.c:422: undefined reference to `libnet_build_udp' /usr/src/syslog-ng-2.0.3/src/afinet.c:436: undefined reference to `libnet_toggle_checksum' /usr/src/syslog-ng-2.0.3/src/afinet.c:438: undefined reference to `libnet_build_ipv6' libsyslog-ng.a(afinet.o): In function `afinet_dd_queue': /usr/src/syslog-ng-2.0.3/src/afinet.c:487: undefined reference to `libnet_write' libsyslog-ng.a(afinet.o): In function `afinet_dd_construct_ipv4_packet': /usr/src/syslog-ng-2.0.3/src/afinet.c:358: undefined reference to `libnet_clear_packet' /usr/src/syslog-ng-2.0.3/src/afinet.c:360: undefined reference to `libnet_build_udp' /usr/src/syslog-ng-2.0.3/src/afinet.c:371: undefined reference to `libnet_build_ipv4' libsyslog-ng.a(afinet.o): In function `afinet_dd_queue': /usr/src/syslog-ng-2.0.3/src/afinet.c:499: undefined reference to `libnet_geterror' libsyslog-ng.a(afinet.o): In function `afinet_dd_init': /usr/src/syslog-ng-2.0.3/src/afinet.c:332: undefined reference to `libnet_init' I've got no idea where to start looking for these - can anyone tell me what I'm missing? Thanks much, -- Tim Boyer Director IT and Engineering Projects Denman Tire Corporation

2 6

Limit filesize
by janth＠moldung.no 25 May '07

25 May '07

Hello, Is it possible to limit the size of each logfile when using the destinatin shown under? destination dst { file("/syslog/logs/$R_YEAR/$R_MONTH/$R_DAY/$HOST" ); }; I.e. destination dst { file("/syslog/logs/$R_YEAR/$R_MONTH/$R_DAY/$HOST" maxsize(5g) ); }; That way no single host could log more than 5g, and if /syslog/logs is a single filesystem, the risk of loosing logs from other hosts is minimized if a hoss logging too much or trying to ddos syslog-ng-loghost. Of course syslog-ng should log internally if the limit is reached and logging for host is stopped. -- Jan Thomas Moldung

3 2

logging from Cisco
by Grigoreva, Yelena 24 May '07

24 May '07

Hallo, I have enabled Cisco logging to my host SUSE 10.2. From the Wireshark tool I can see that I become the syslog messages and then I try to find them somewhere in /var/log/.... but w/t success. ;( Where are the syslog messages logged from external HW? I have set in my sysconf SYSLOGD_PARAMS="-rx -m 0" to enable external logging, but all the same-no effect.I have created local0, cisco files: I am not sure what file name should I give? where must it be specified? I will be grateful for any tip :) warm regards Yelena

7 11

Syslog-ng remove logs
by lukasz_bryl＠o2.pl 23 May '07

23 May '07

Can anybody tell me the thing: Is it possible in syslog-ng to remove set logs? If so, please explain me how to do that. Thanks in advance. LukB

1 0

Don't log process PID or timestamp
by Martin Stabenfeldt 23 May '07

23 May '07

Hi, I'm running syslog-ng on my log-server. I don't want it to include the PID, timestamp or hostname in the log it captures. Is it possible to strip this on the server-side, or must this be done on the client that sends the syslog messages? use Net::Syslog; my $s=new Net::Syslog(Facility=>'local1',Priority=>'info',SyslogHost=>'loghost.com'); $s->send('see this in syslog',Priority=>'info'); Generates: May 16 10:15:06 webserver apache-syslogger.pl[14490]: see this in syslog I only want to see "see this in syslog". All advice is highly appreciated! :) -- Martin Stabenfeldt

1 0

RE: [syslog-ng] ArcSight Server As Destination?
by Ivey, Chris 22 May '07

22 May '07

As I was discussing this issue with a colleague this AM, the question arose as to whether or not the restamping of messages from syslog-ng can be turned on and off for selected destinations, or if that was a global option. Anyone know? Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Tom Le Sent: Friday, May 18, 2007 12:09 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] ArcSight Server As Destination? Arcsight requires a specific format, but that is not say it is incompatible with syslog forwarding. They just need to give you the config options that they support for a forwarded syslog message. On 5/18/07, Ivey, Chris <Chris.ivey(a)acs-inc.com> wrote: > Many thanks to those of you who responded to this question already. I have > decided to "raise the B.S. flag" with ArcSight on this one. The more I talk > to the person here who is acting as the middle-man between myself and > ArcSight, the more I think that ArcSight has an issue on their side. I will > more than likely be re-posting after talking directly to ArcSight next week. > Thanks all! > > Chris Ivey > > Affiliated Computer Services > Enterprise Management Integration Services > Infrastructure Management Senior Analyst > > chris.ivey(a)acs-inc.com > > "I have not failed, I have simply found 10,000 ways which do not work!" -- > Thomas Edison > "When you find yourself in a hole, the best thing to do is stop digging!" -- > Nick Stokes > "I reject your reality, and substitute my own!" -- Adam Savage > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler > Sent: Thursday, May 17, 2007 3:45 PM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] ArcSight Server As Destination? > > On Thu, 2007-05-17 at 08:38 -0700, Evan Rempel wrote: > > Balazs Scheidler wrote: > > > Syslog-ng forwards messages in the same > > > format as it receives it, it does not prepend headers, only replaces > > > values if it is configured to do so. > > > > Really? My experience is one where syslong-ng receives a syslog message > that does NOT > > contain a timestamp, and syslog-ng forwards it with a timestamp because > the receiver > > portion of syslog-ng has added a timestamp. > > I meant that syslog messages are forwarded as syslog messages. If your > incoming messages lack a header, then those are not syslog messages. > > You can remove outgoing headers by using a custom template and not > adding the $DATE and $HOST portions. > > You can also prevent syslog-ng to try to parse a message as syslog > message by using the flags(no-parse) option for the source. > > -- > Bazsi > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

syslog-ng 2.0.4 has been released
by Balazs Scheidler 19 May '07

19 May '07

Dear syslog-ng users, A new stable version of syslog-ng has been released. The list of user-visible changes are summarized below. For more information, visit our just-updated website at http://www.balabit.com/products/syslog-ng/ 2.0.4 Mon, 14 May 2007 11:47:48 +0200 IMPORTANT NOTES: * This version of syslog-ng fixes a bug in enforcing the max-connections() limit for various stream-like sources (unix-stream and tcp). Previously this limit was not enforced, thus production environments may use an inadequate value. Validate your max-connection() settings before upgrading and check your logs for rejected connections. Bugfixes: * Fixed configuration parsing of the localport() and port() parameters. * Fixed template_escape() for non-ASCII characters. * Fixed facility() filter evaluation problems. * Fixed a possible segmentation fault during shutdown, when pending messages were still present in the destination queue of a flow-controlled destination. * Fixed sign of timezone when parsed from the configuration file. * Fixed counting the number of established connections, the value used when comparing against the max-connections() parameter. Features: * Added support for rotated source files. * Added support for perl-like regexp flags to make it possible to specify case-insensitive regular expressions. -- Bazsi

2 1

RE: [syslog-ng] ArcSight Server As Destination?
by Ivey, Chris 18 May '07

18 May '07

Many thanks to those of you who responded to this question already. I have decided to "raise the B.S. flag" with ArcSight on this one. The more I talk to the person here who is acting as the middle-man between myself and ArcSight, the more I think that ArcSight has an issue on their side. I will more than likely be re-posting after talking directly to ArcSight next week. Thanks all! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Thursday, May 17, 2007 3:45 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] ArcSight Server As Destination? On Thu, 2007-05-17 at 08:38 -0700, Evan Rempel wrote: > Balazs Scheidler wrote: > > Syslog-ng forwards messages in the same > > format as it receives it, it does not prepend headers, only replaces > > values if it is configured to do so. > > Really? My experience is one where syslong-ng receives a syslog message that does NOT > contain a timestamp, and syslog-ng forwards it with a timestamp because the receiver > portion of syslog-ng has added a timestamp. I meant that syslog messages are forwarded as syslog messages. If your incoming messages lack a header, then those are not syslog messages. You can remove outgoing headers by using a custom template and not adding the $DATE and $HOST portions. You can also prevent syslog-ng to try to parse a message as syslog message by using the flags(no-parse) option for the source. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Duplicate Host paths for destination
by William B Carlson 17 May '07

17 May '07

Running syslog-ng 1.6.12 on Fedora 6 (2.6.20-1.2933.fc6) I'm running into a weird problem that I can't seem to figure out. When my logs from syslog-ng write out the $FULLHOST path seems to repeat itself by nesting another level. So instead of getting what I want: /var/log/syslog-ng/server.msu.edu I get: /var/log/syslog-ng/server.msu.edu/server.msu.edu Not sure what is going on here, I've included my configuration which is pretty simple. Thanks for any assistance to this, I'm sure I overlooked something so very simple. Ben Carlson options { sync (20); log_fifo_size (1000); perm (0600); dir_perm (0755); check_hostname (yes); keep_hostname (yes); use_fqdn (yes); use_dns (yes); dns_cache (yes); dns_cache_size (1000); dns_cache_expire (43200); }; source s_internal { internal(); }; source s_network { tcp(max-connections(5000)); udp(); }; destination d_internal { file( "/var/log/syslog-ng/syslog-ng.log" owner(daemon) group(bin) perm(0600) dir_perm(0755) create_dirs(yes) ); }; destination d_general { file( "/var/log/syslog-ng/$FULLHOST/$FACILITY.$YEAR-$MONTH-$DAY.log" owner(daemon) group(bin) perm(0600) dir_perm(0755) create_dirs(yes) ); }; log { source(s_internal); destination(d_internal); flags(final); }; log { source(s_network); destination(d_general); };

2 1

ArcSight Server As Destination?
by Ivey, Chris 17 May '07

17 May '07

Folks, Does anyone have any experience with using syslog-ng to forward messages along to an ArcSight server? I set it up for a support group here, but apparently they are having issues. Per ArcSight support: <quote> "I looked over the information you had uploaded already, and is actually a common issue. When syslog events are forwarded from one syslog server to another syslog server, or pipe, or file, the forwarding syslog server prepends timestamp and other information, which makes the message unusable. We require syslog message to adhere to the standard RFC syslog format for the connector to read them, and when forwarding syslog messages that is not the case and we are unable to support that configuration." </quote> Does anyone have any insight they can share with me for this issue? The group is now asking that I install their agent on my server, which I am VERY loath to do since the box is about at it's limit as it is. Thanks all! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

4 4