June 2007 - syslog-ng - lists.balabit.hu

AIX startup
by Brian Loe 27 Mar '08

27 Mar '08

Okay, my syslog-ng instance died at some point last night and because I don't have it setup properly for respawning... Can anyone running syslog-ng on AIX 5.* give me some tips for this? I'm feeding pipes so i have to start instances of SEC as soon as I start syslog-ng - but the SEC scripts appear to "close" so if they're configured to respawn I'll have 2000 instances of them in an hour.

7 21

incorrect firewall logs with syslogng-2.0.0 [security error?]
by Jacek Kalinski 12 Mar '08

12 Mar '08

Hello, After upgradeing from syslogng-1.6.11 to 2.0.0 I've got a strange messages in /var/log/messages file: Nov 29 08:14:05 denise WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 11:10:19 denise PT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 16:42:16 denise W=0 RES=0x00 RST URGP=0 Nov 29 21:37:15 denise 116 ID=34901 DF PROTO=TCP SPT=3584 DPT=80 WINDOW=65535 RES=0x00 ACK FIN URGP=0 These are truncated iptables logs. Because in firewall.log file are simmilar entries to truncated one, I think full file should be: Nov 29 11:10:19 denise firewallp=INVALID:1 a=DROP IN=eth1 OUT= MAC=00:30:4f:36:2b:dc:00:04:9a:2c:7f:20:08:00 SRC=193.41.230.81 DST=xxx.xxx.xxx.x LEN=576 TOS=0x00 PREC=0x00 TTL=117 ID=3495 PROTO=TCP SPT=443 DPT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 (xxx.xxx.xxx.x is a real server IP address - one 'x' is one digit) Config file with interesting lines: options { dir_perm(0700); perm(0600); chain_hostnames(no); stats(1200); keep_hostname(yes); dir_owner(root); dir_group(root); owner(root); group(root); }; source local { unix-stream("/dev/log" max_connections(300)); file("/proc/kmsg"); # udp(ip(0.0.0.0) port(514)); internal(); }; # ..... # authpriv.none;cron.none;mail.none;news.none -/var/log/messages filter f_2 { not facility(news); }; filter f_3 { not facility(local5); }; filter f_4 { not facility(local6); }; filter f_5 { not facility(authpriv); }; filter f_6 { not facility(cron); }; filter f_7 { not facility(mail); }; filter f_notlocal7 { not facility(local7); }; filter f_notfirewall { not match("firewallp="); }; destination d_2 { file("/var/log/messages" create_dirs(yes)); }; log { source(local); filter(f_2); filter(f_4); filter(f_5); filter(f_6); filter(f_7); filter(f_notimapd); filter(f_notpopa3d); filter(f_notnamed); filter(f_notfirewall); destination(d_2); }; #..... # firewallp.* -/var/log/firewall.log filter f_16 { level(warning) and match("firewallp="); }; destination d_12 { file("/var/log/firewall.log" create_dirs(yes)); }; log { source(local); filter(f_16); destination(d_12); }; #..... Do you know where could be an error? It is a production server so I can't debug syslog-ng on this machine (sorry). NOTE: the only truncated lines I can find are iptables (AFAIR they are logged by /proc/kmesg) entries. All other lines are complete. And it is probably a critical error in security. PS: simple statistics line from syslog-ng: Nov 30 00:00:06 denise syslog-ng[32682]: Log statistics; dropped='pipe(/dev/tty12)=0', processed='center(queued)=758289', processed='center(received)=369020', processed='destination(d_maillogimapd)=4245', processed='destination(d_5)=1', processed='destination(d_4)=0', processed='destination(d_3)=14259', processed='destination(d_2)=14259', processed='destination(d_13)=0', processed='destination(d_1)=6000', processed='destination(d_12)=6000', processed='destination(d_11)=369020', processed='destination(d_10)=36', processed='destination(d_8)=0', processed='destination(d_maillogpopa3d)=103224', processed='destination(d_7)=241245', processed='destination(d_6)=0', processed='source(local)=369020' I think you see that it could be a little hard to debug (with so many messages parsed by syslog-ng) ;) Jacek

3 6

syslog-ng 2.0.3 is released
by Balazs Scheidler 14 Nov '07

14 Nov '07

Dear syslog-ng users, I've uploaded syslog-ng 2.0.3, the latest stable release in the syslog-ng 2.0 branch to our webserver. The list of changes is summarized below. The source is available at the usual places at http://www.balabit.com/products/syslog-ng/ 2.0.3 Mon, 26 Mar 2007 14:10:00 +0200 Bugfixes: * Fixed a possible segmentation fault in the usertty() destination driver when it was referenced on a log path with disabled flow-control. * Fixed various usertty() functionality problems. * Removed the 1024 byte limitation of internally generated messages. * Clarified the text of various internal messages, consistency updates for message severities. * Increased the minimum value for log_fifo_size to 1000 elements. * HP-UX portability fixes. * Some minor documentation fixes. Features: * Added spoof-source support for IPv4 & IPv6 to match 1.6.x functionality. * Added support for remembering the last posistion of file sources across restarts. * Added tcp-wrapper support. * Added support for more than 9 regexp matches. -- Bazsi

3 8

Download location change
by Balazs Scheidler 26 Jul '07

26 Jul '07

Dear syslog-ng users, The download location for syslog-ng sources is being changed due to internal web reorganization. In the future, syslog-ng sources will be available from: http://www.balabit.com/products/syslog-ng/sources/ instead of the old download location. The location of the upgrade summary page will not be changed, and will remain: http://www.balabit.com/products/syslog-ng/opensource/upgrades/ Sorry, for the possible inconvinience. -- Balazs Scheidler <bazsi(a)balabit.hu>

5 14

Timestamp inconsistency
by Tim Boyer 04 Jul '07

04 Jul '07

I'm running 2.0.0, and the docs say that The sender can specify the timezone of the messages. If the incoming message includes a timezone it is associated with the message. Otherwise, the local timezone is assumed. I'm not specifying any timezone, but I'm seeing a bunch of messages stamped UTC mixed in with EDT, which makes the log a bit... weird: Jun 24 21:38:01 tolstoy.denmantire.com sshd[7949]: Connection closed by 192.168 Jun 24 17:40:01 tolstoy.denmantire.com crond[7987]: (root) CMD (/usr/lib/sa/sa1 Jun 24 21:43:01 tolstoy.denmantire.com sshd[7994]: Connection closed by 192.168 Jun 24 17:44:34 tolstoy.denmantire.com syslog-ng[11618]: Log statistics; droppe Jun 24 21:48:02 tolstoy.denmantire.com sshd[8036]: Connection closed by 192.168 Jun 24 17:50:01 tolstoy.denmantire.com crond[8082]: (root) CMD (/usr/lib/sa/sa1 Jun 24 21:53:03 tolstoy.denmantire.com sshd[8107]: Connection closed by 192.168 So just to test, I did this: TZ="UTC+23:56" logger "Look I'm logging from yesterday" and sure enough, it logged it as yesterday. So I tried to explicitly set the time zones: options { send_time_zone(-04:00); recv_time_zone(-04:00); destination dtolstoy_all { file("/var/log/tolstoy.log" owner(root) group(hobbit) perm(0640) time_zone(-04:00)); Restarted syslog-ng, and: Jun 24 17:09:00 tolstoy.denmantire.com syslog-ng: syslog-ng startup succeeded Jun 23 21:13:09 tolstoy.denmantire.com tim: Look I'm logging from yesterday I don't understand why it's not logging as local time without me having to do anything. And I _really_ don't understand why the explicit instructions don't work. Pounters in the the right direction appreciated... -- Tim Boyer Director Information Systems and Engineering Projects Denman Tire Corporation tim(a)denmantire.com

6 9

Constant disconnects
by Tim Boyer 03 Jul '07

03 Jul '07

I'm running 2.0.0, and have eight remote servers logging to a central server. Seven of those servers are running fine; the eighth keeps getting log messages like this: Jun 26 10:41:33 kyushu.denmantire.com syslog-ng[6829]: syslog-ng starting up; version='2.0.0' Jun 26 10:41:33 kyushu.denmantire.com syslog-ng: syslog-ng startup succeeded Jun 26 10:41:33 kyushu.denmantire.com syslog-ng[6829]: EOF occurred while idle;fd='5' Jun 26 10:41:33 kyushu.denmantire.com syslog-ng[6829]: Connection broken; time_reopen='60' My first assumption was a firewall problem, but tcpdump says that data's getting there: 10:42:49.013423 IP kyushu-vpn-cli.denmantire.com.37759 > buran.denmantire.com.5142: S 1168830611:1168830611(0) win 5840 <mss 1460,sackOK,timestamp 316509070 0,nop,wscale 2> 10:42:49.014768 IP buran.denmantire.com.5142 > kyushu-vpn-cli.denmantire.com.37759: S 845996771:845996771(0) ack 1168830612 win 5792 <mss 1460,sackOK,timestamp 39334539 316509070,nop,wscale 7> Any ideas what could be causing the connection to drop - but only on this server? Thanks much, -- Tim Boyer Director IT and Engineering Projects Denman Tire Corporation (330) 675-4249

5 11

Log messages looping back infinitely
by Christopher Cowart 02 Jul '07

02 Jul '07

Hello, I've had a recent problem where my dhcpd logs appear to be arriving and rearriving until /var fills up. My log traffic looks like this (all over udp/syslog and IPSec): ------------+ all logs +----------+ dhcpd logs +------------+ dhcp servers|---------->|log server|------------>|other server|----| ------------+ +----------+ +------------+ | ^ | | all logs except dhcpd | -------------------------------------| This configuration has been in effect and working as expected for about 11 months now. Approximately 2 weeks ago, I was reviewing my morning cronspam and discovered that /var had filled up on my log server. The dhcpd log was the obvious culprit, expanded to fill my entire log partition. I'm attaching sample entries so you can take a look if you are so inclined; I apologize for sanitizing out the data in the messages, but they're both protected data and not important to the discussion at hand. There should be *no* dhcpd log messages originating on the log server. When logging is working properly, the host field in the entries properly reflect their dhcp servers of origin. When logging becomes fubar'd, I see a lot of messages with localhost in that field, all with increasing amounts of whitespace in them. syslog-ng spins the CPU to 100% and proceeds to fill up /var with these "feedback" entries. This has happened 3 times in the past 2 weeks. It always begins at midnight. I checked my crons -- I have an hourly execution of logrotate. It is configured to rotate most of my logs (dhcpd included) once a day, which happens at midnight. It politely runs `pkill -HUP syslog-ng' after truncating the log files; this works successfully for all the other logfiles on the log server and has been working fine for dhcpd for the previous 11 months as well. The other likely candidate for trouble is the "other server" from the diagram above that logs back to the log server. I'm relatively certain that this (alone) is not the cause of the problem. I was painstakingly careful to not generate any feedback loops in its configuration. The incoming udp messages have a dedicated source, which is written to a dedicated destination. I'm having trouble piecing two and two together here. I don't think either of these things are causing the problem, but they're the only obvious culprits. Neither of them, if misconfigured, would explain why the duplicates all appear to come from the localhost. Why would the udp source on the logserver be receiving the messages it sends, but only recently and only immediately after midnight? I haven't had the chance to do a tcpdump yet to see the actual network traffic; twice now I've gotten there after /var was already full and tonight when I did finally catch it in the act, I was too concerned about stopping it to troubleshoot it. Stopping and starting syslog-ng returns my logging into a normal state of affairs. $ uname -a | FreeBSD pitfall.rescomp.berkeley.edu 6.1-RELEASE-p3 FreeBSD | 6.1-RELEASE-p3 #0: Mon Aug 21 15:42:31 PDT 2006 | root@new-pitfall.rescomp.berkeley.edu:/usr/obj/usr/src/sys/RCBSD_1 | i386 $ syslog-ng -V | syslog-ng 2.0.0 First time-stamp in fubar'd logfile: Jun 29 00:00:07 First localhost entry: Jun 29 00:02:19 (Line #256) Last time-stamp in fubar'd logfile: Jun 29 00:08:46 Number of "good" entries: 1266 Number of localhost entries: 1123083 Total number of entries: 1124349 If anyone has tips for continuing my troubleshooting process, please let me know. I'd be tempted to upgrade to 2.0.2 (it's in ports), but given the changelogs didn't mention anything about random feedback loops, I didn't figure it would help much. Thanks in advance for your time, -- Chris Cowart Lead Systems Administrator Network Infrastructure, RSSP-IT UC Berkeley

2 1

Static compilation
by Nicolas de Marqué - Fromentin 02 Jul '07

02 Jul '07

Hello, I have problems with compilation of syslog-ng on a solaris 5.8 : After Syslog-ng Configuration : ./configure --prefix=/tmp/local --disable-spoof-source --enable-static-linking => i have this error : checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib => but i have the correct file : ls -la /tmp/local/lib/libglib-2.0.a -rw-r--r-- 1 outils dinb 2096104 Jun 28 15:51 /tmp/local/lib/libglib-2.0.a Have you an idea about this problem? Nicolas

3 2

error compiling syslog-ng-2.0.2 and syslog-ng-2.0.4+20070626
by Serge Torop 02 Jul '07

02 Jul '07

Hello, then I compiling the syslog-ng-2.0.2 on RedHat Enterpise Linux 4 (kernel 2.6.9-42.ELsmp) I see the message: .. [skip].. rm -f libsyslog-ng.a ar cru libsyslog-ng.a misc.o utils.o messages.o syslog-names.o cfg.o cfg-lex.o cfg-grammar.o macros.o filter.o logmsg.o logpipe.o logsource.o driver.o sgroup.o dgroup.o center.o templates.o logreader.o logwriter.o affile.o afstreams.o afuser.o afprog.o af socket.o afunix.o afinet.o afinter.o children.o stats.o gsockaddr.o fdwrite.o fdread.o memtrace.o dnscache.o ranlib libsyslog-ng.a if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT main.o -MD -MP -MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo './'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -Wl,-Bdynamic libsyslog-ng.a(misc.o)(.text+0x3a9): In function `resolve_hostname': /home/tsp/syslog-ng-2.0.2/src/misc.c:185: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x6a): In function `log_stamp_format': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:110: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x2b2): In function `log_msg_ref': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:497: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x34e): In function `log_msg_unref': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:511: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0xe02): In function `log_msg_ack_block_end': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:631: undefined reference to `g_return_if_fail_warning' libsyslog-ng.a(logpipe.o)(.text+0x4f): In function `log_pipe_ref': /home/tsp/syslog-ng-2.0.2/src/logpipe.c:38: undefined reference to `g_assert_warning' libsyslog-ng.a(logpipe.o)(.text+0x9b): In function `log_pipe_unref': /home/tsp/syslog-ng-2.0.2/src/logpipe.c:47: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x7d): In function `log_endpoint_free': /home/tsp/syslog-ng-2.0.2/src/center.c:90: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x175): In function `log_connection_new': /home/tsp/syslog-ng-2.0.2/src/center.c:132: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x2a6): In function `log_template_ref': /home/tsp/syslog-ng-2.0.2/src/templates.c:169: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x30e):/home/tsp/syslog-ng-2.0.2/src/templates.c:180: more undefined references to `g_assert_warning' follow collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error code 1 make[2]: Leaving directory `/home/tsp/syslog-ng-2.0.2/src' make[1]: *** [all-recursive] Error code 1 make[1]: Leaving directory `/home/tsp/syslog-ng-2.0.2' make: *** [all] Error code 2 the same error with syslog-ng-2.0.4+20070626. Is this possible to fix or solve this problem? Thanks for advance. -- Serge P. Torop St.Petersburg, Russia

3 6

AF_INET client dropped connection
by Pol Moal 28 Jun '07

28 Jun '07

Hi, when I restart syslog-ng on a client, the loghost prints these lines: Jun 28 12:28:38 loghost syslog-ng[7068]: AF_INET client dropped connection from w.x.y.z, port 38171 Jun 28 12:28:39 loghost syslog-ng[7068]: AF_INET client connected from w.x.y.z, port 38040 Do I lose some information from the client? If yes, what can I do? thanks ps: sorry for the first post -- Pol Moal - Comité Réseau des Universités |--> http://www.cru.fr

1 0