July 2007 - syslog-ng - lists.balabit.hu

AIX startup
by Brian Loe 27 Mar '08

27 Mar '08

Okay, my syslog-ng instance died at some point last night and because I don't have it setup properly for respawning... Can anyone running syslog-ng on AIX 5.* give me some tips for this? I'm feeding pipes so i have to start instances of SEC as soon as I start syslog-ng - but the SEC scripts appear to "close" so if they're configured to respawn I'll have 2000 instances of them in an hour.

7 21

incorrect firewall logs with syslogng-2.0.0 [security error?]
by Jacek Kalinski 12 Mar '08

12 Mar '08

Hello, After upgradeing from syslogng-1.6.11 to 2.0.0 I've got a strange messages in /var/log/messages file: Nov 29 08:14:05 denise WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 11:10:19 denise PT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 16:42:16 denise W=0 RES=0x00 RST URGP=0 Nov 29 21:37:15 denise 116 ID=34901 DF PROTO=TCP SPT=3584 DPT=80 WINDOW=65535 RES=0x00 ACK FIN URGP=0 These are truncated iptables logs. Because in firewall.log file are simmilar entries to truncated one, I think full file should be: Nov 29 11:10:19 denise firewallp=INVALID:1 a=DROP IN=eth1 OUT= MAC=00:30:4f:36:2b:dc:00:04:9a:2c:7f:20:08:00 SRC=193.41.230.81 DST=xxx.xxx.xxx.x LEN=576 TOS=0x00 PREC=0x00 TTL=117 ID=3495 PROTO=TCP SPT=443 DPT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 (xxx.xxx.xxx.x is a real server IP address - one 'x' is one digit) Config file with interesting lines: options { dir_perm(0700); perm(0600); chain_hostnames(no); stats(1200); keep_hostname(yes); dir_owner(root); dir_group(root); owner(root); group(root); }; source local { unix-stream("/dev/log" max_connections(300)); file("/proc/kmsg"); # udp(ip(0.0.0.0) port(514)); internal(); }; # ..... # authpriv.none;cron.none;mail.none;news.none -/var/log/messages filter f_2 { not facility(news); }; filter f_3 { not facility(local5); }; filter f_4 { not facility(local6); }; filter f_5 { not facility(authpriv); }; filter f_6 { not facility(cron); }; filter f_7 { not facility(mail); }; filter f_notlocal7 { not facility(local7); }; filter f_notfirewall { not match("firewallp="); }; destination d_2 { file("/var/log/messages" create_dirs(yes)); }; log { source(local); filter(f_2); filter(f_4); filter(f_5); filter(f_6); filter(f_7); filter(f_notimapd); filter(f_notpopa3d); filter(f_notnamed); filter(f_notfirewall); destination(d_2); }; #..... # firewallp.* -/var/log/firewall.log filter f_16 { level(warning) and match("firewallp="); }; destination d_12 { file("/var/log/firewall.log" create_dirs(yes)); }; log { source(local); filter(f_16); destination(d_12); }; #..... Do you know where could be an error? It is a production server so I can't debug syslog-ng on this machine (sorry). NOTE: the only truncated lines I can find are iptables (AFAIR they are logged by /proc/kmesg) entries. All other lines are complete. And it is probably a critical error in security. PS: simple statistics line from syslog-ng: Nov 30 00:00:06 denise syslog-ng[32682]: Log statistics; dropped='pipe(/dev/tty12)=0', processed='center(queued)=758289', processed='center(received)=369020', processed='destination(d_maillogimapd)=4245', processed='destination(d_5)=1', processed='destination(d_4)=0', processed='destination(d_3)=14259', processed='destination(d_2)=14259', processed='destination(d_13)=0', processed='destination(d_1)=6000', processed='destination(d_12)=6000', processed='destination(d_11)=369020', processed='destination(d_10)=36', processed='destination(d_8)=0', processed='destination(d_maillogpopa3d)=103224', processed='destination(d_7)=241245', processed='destination(d_6)=0', processed='source(local)=369020' I think you see that it could be a little hard to debug (with so many messages parsed by syslog-ng) ;) Jacek

3 6

syslog-ng 2.0.3 is released
by Balazs Scheidler 14 Nov '07

14 Nov '07

Dear syslog-ng users, I've uploaded syslog-ng 2.0.3, the latest stable release in the syslog-ng 2.0 branch to our webserver. The list of changes is summarized below. The source is available at the usual places at http://www.balabit.com/products/syslog-ng/ 2.0.3 Mon, 26 Mar 2007 14:10:00 +0200 Bugfixes: * Fixed a possible segmentation fault in the usertty() destination driver when it was referenced on a log path with disabled flow-control. * Fixed various usertty() functionality problems. * Removed the 1024 byte limitation of internally generated messages. * Clarified the text of various internal messages, consistency updates for message severities. * Increased the minimum value for log_fifo_size to 1000 elements. * HP-UX portability fixes. * Some minor documentation fixes. Features: * Added spoof-source support for IPv4 & IPv6 to match 1.6.x functionality. * Added support for remembering the last posistion of file sources across restarts. * Added tcp-wrapper support. * Added support for more than 9 regexp matches. -- Bazsi

3 8

Syslog-ng 1.6.11 from HP porting center
by Uwe Martin 28 Sep '07

28 Sep '07

Hello, I installed the syslog_ng-1.6.11-hppa-11.11.depot.gz from HP porting center on a HP 9000/800/rp3440 "HP-UX xyz B.11.11 U 9000/800 189374938 unlimited-user license". After starting /usr/local/bin/syslog-ng -v -s, I got the following error : Segmentation fault (core dumped). Anybody an idea what is wrong on the installtion? kind regards Uwe MArtin Festo AG & Co. KG Uwe Martin Abteilung IN-O Network-Operation Obere Kaiserstraße 303 D - 66386 St. Ingbert Tel: ++49 (0) 6894-591-6323 Fax: ++49 (0) 6894-591-6326 http://www.festo.com Der Inhalt dieses E-Mails ist ausschliesslich fuer den bezeichneten Adressaten bestimmt. Jede Form der Kenntnisnahme, Veroeffentlichung, Vervielfaeltigung oder Weitergabe des Inhalts dieses E-Mails durch unberechtigte Dritte ist unzulaessig. Wir bitten Sie, sich mit dem Absender des E-Mails in Verbindung zu setzen, falls Sie nicht der Adressat dieses E-Mails sind und das Material von Ihrem Computer zu loeschen. This e-mail and any attachments are confidential and intended solely for the addressee. The perusal, publication, copying or dissemination of the contents of this e-mail by unauthorised third parties is prohibited. If you are not the intended recipient of this e-mail, please delete it and immediately notify the sender. Rechtsform: Kommanditgesellschaft Sitz: Esslingen a.N. Registergericht Stuttgart HRA 211583 Umsatzsteuerident-Nummer: DE 145339206 Persoenlich haftende Gesellschafterin:Festo Aktiengesellschaft Sitz: Stuttgart Registergericht Stuttgart HRB 18535 Vorstand: Dr. Ekkehard Gericke, Lothar Kempf, Dipl.-Ing. Rudi Menrad Dr. Thomas Rubbe Dr. Eberhard Veit (Sprecher) Dr. Ulrich Walker Aufsichtsratsvorsitzender: Dr. Wilfried Stoll

2 1

Re: [syslog-ng] Assistance compiling 1.6.12
by tim.brown＠juno.com 28 Sep '07

28 Sep '07

That would be ideal if I could locate a version of glib >= 2.2 for Solaris 9 on sparc, based on the following: checking for GLIB... Requested 'glib-2.0 >= 2.2' but version of GLib is 2.0.7 no configure: error: Cannot find GLib library version >= 2.2: is pkg-config in path? Thanks -- Carson Gaspar <carson(a)taltos.org> wrote: Carson Gaspar wrote: > Andrej Ricnik-Bay wrote: >> On 6/26/07, tim.brown(a)juno.com <tim.brown(a)juno.com> wrote: > >>> I've scanned the net for references to "-lxnet" on Solaris and could >>> only determine that is a library routine particular to Linux. I could >>> not find how to provide this on a Solaris platform. >> >> No, it's not. It's part of SUNWcslx and I've never seen it on any >> Linux machine :} > > Why is syslog-ng trying to link in the XTI library? Something is wrong, > here... Ah, libol's autoconf code adds in libxnet even though it isn't needed. I'm not sure what the code is _trying_ to do, but it's doing it wrong. On the plus side, I don't see references to xnet in the 2.0.4 syslog-ng, nor in the 0.2.5 eventlog. So my advice is to skip the old code and use the shiny new stuff. -- Carson _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _____________________________________________________________ Save on Tax Preparation Services. Click here. http://track.juno.com/s/lc?u=http://tagline.untd.us/fc/Ioyw6iigAEckp8Ap1pqX…

3 2

syslog-ng-2.0.5 on HP-UX 11.11
by Uwe Martin 06 Aug '07

06 Aug '07

Hello, I try to compile the new version 2.0.5 on HP-UX 11.11. configure is running without erorrs. (./configure --enable-dynamic-linking) make stops with the following error : if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -DLIBNET_BIG_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -g -MT afinet.o -MD -MP -MF ".deps/afinet.Tpo" \ -c -o afinet.o `test -f 'afinet.c' || echo './'`afinet.c; \ then mv -f ".deps/afinet.Tpo" ".deps/afinet.Po"; \ else rm -f ".deps/afinet.Tpo"; exit 1; \ fi afinet.c: In function 'afinet_setup_socket': afinet.c:163: error: storage size of 'mreq' isn't known afinet.c:163: warning: unused variable 'mreq' *** Error exit code 1 How can I solve this problem ? kind regards Uwe Martin Festo AG & Co. KG Uwe Martin Abteilung IN-O Network-Operation Obere Kaiserstraße 303 D - 66386 St. Ingbert Tel: ++49 (0) 6894-591-6323 Fax: ++49 (0) 6894-591-6326 http://www.festo.com Der Inhalt dieses E-Mails ist ausschliesslich fuer den bezeichneten Adressaten bestimmt. Jede Form der Kenntnisnahme, Veroeffentlichung, Vervielfaeltigung oder Weitergabe des Inhalts dieses E-Mails durch unberechtigte Dritte ist unzulaessig. Wir bitten Sie, sich mit dem Absender des E-Mails in Verbindung zu setzen, falls Sie nicht der Adressat dieses E-Mails sind und das Material von Ihrem Computer zu loeschen. This e-mail and any attachments are confidential and intended solely for the addressee. The perusal, publication, copying or dissemination of the contents of this e-mail by unauthorised third parties is prohibited. If you are not the intended recipient of this e-mail, please delete it and immediately notify the sender. Rechtsform: Kommanditgesellschaft Sitz: Esslingen a.N. Registergericht Stuttgart HRA 211583 Umsatzsteuerident-Nummer: DE 145339206 Persoenlich haftende Gesellschafterin:Festo Aktiengesellschaft Sitz: Stuttgart Registergericht Stuttgart HRB 18535 Vorstand: Dr. Ekkehard Gericke, Lothar Kempf, Dipl.-Ing. Rudi Menrad Dr. Thomas Rubbe Dr. Eberhard Veit (Sprecher) Dr. Ulrich Walker Aufsichtsratsvorsitzender: Dr. Wilfried Stoll

7 14

$EVENT_SOURCE and $USERNAME are blank
by Gustavo Soares 01 Aug '07

01 Aug '07

Hi all! When I try to capture the EVENT_SOURCE or USERNAME variables within the template clause, these fields are logged blank in the log file. here is an excerpt of my configuration file.. destination local6 { file("/opt/logserver/log4j/$HOST/$YEAR/$MONTH/received.$DAY$MONTH$YEAR.log" template("$DATE User:$USERNAME $EVENT_SOURCE $MESSAGE\n") template_escape(yes) owner(watcher) group(other) create_dirs(yes)); }; anybody knows why this occurs? Cheers, Gustavo

2 2

[Fwd: [issue365] FreeBSD ports/111462 - syslog-ng2 default configuration file path]
by Brian A. Seklecki 31 Jul '07

31 Jul '07

FYI some 3 months later this patch has been merged back into Ports. http://www.freebsd.org/cgi/query-pr.cgi?pr=111462 ~BAS -------- Forwarded Message -------- > Reply-To: Network Operations issues/ smcafee(a)collaborativefusion.com, > wmoran(a)collaborativefusion.com > Subject: [issue365] FreeBSD ports/111462 - syslog-ng2 default > configuration file path > Date: Mon, 30 Jul 2007 14:36:07 -0000 > > Brian Seklecki <bseklecki(a)collaborativefusion.com> added the comment: > > Patch committed -- Please start ... > > --- > > Date: Sat, 28 Jul 2007 22:28:29 GMT > From: pav(a)FreeBSD.org > To: bseklecki(a)collaborativefusion.com, pav(a)FreeBSD.org, linimon(a)FreeBSD.org > Subject: Re: ports/111462: syslog-ng2 default configuration file path > > Synopsis: syslog-ng2 default configuration file path > > State-Changed-From-To: open->closed > State-Changed-By: pav > State-Changed-When: Sat Jul 28 22:20:11 UTC 2007 > State-Changed-Why: > Committed the maintainer's patch. > > http://www.freebsd.org/cgi/query-pr.cgi?pr=111462 > ____________________________________________________________

1 0

Fail to write facility local0
by Javier Terceiro 31 Jul '07

31 Jul '07

Hello, I have this config file: filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; destination df_local1 { file("/mnt/log/$R_YEAR-$R_MONTH-$R_DAY/$SOURCEIP/local.log" template("$FULLDATE <> $PROGRAM <> $MSGONLY\n") template_escape(no)); }; log { source(s_tcp); source(s_internal); source(s_udp); source(s_unix); filter(f_local0); filter(f_local1); destination(df_local1); }; When an event arrives at the system by facility local0 or local1, this one is registered in the file never. Can be some bug of syslog-ng or failure in config? some idea of so that this one failure happens? Best regards and thanks in advance. -- A greeting, Javier.

4 3

syslog-ng log rotation
by Root Administrator 27 Jul '07

27 Jul '07

Hi All PLz GIVE ME A CLUE !!! [Platform] Solaris 9 for sparc syslog-ng 2.0.4 [Plan] Syslog-ng writes logs to local file. Log rotation function is required to be implemented as in its configuration rather than using other UNIX standard logrotation. Rotation is planned to be executed in one minute interval. And, we gather five of this one minute rotated file and archive them in one file. This is the brief plan. Could anyone please give me a clue to do this !!! I appreciate the detailed clue !!!

2 1