August 2007 - syslog-ng - lists.balabit.hu

AIX startup
by Brian Loe 27 Mar '08

27 Mar '08

Okay, my syslog-ng instance died at some point last night and because I don't have it setup properly for respawning... Can anyone running syslog-ng on AIX 5.* give me some tips for this? I'm feeding pipes so i have to start instances of SEC as soon as I start syslog-ng - but the SEC scripts appear to "close" so if they're configured to respawn I'll have 2000 instances of them in an hour.

7 21

incorrect firewall logs with syslogng-2.0.0 [security error?]
by Jacek Kalinski 12 Mar '08

12 Mar '08

Hello, After upgradeing from syslogng-1.6.11 to 2.0.0 I've got a strange messages in /var/log/messages file: Nov 29 08:14:05 denise WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 11:10:19 denise PT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 16:42:16 denise W=0 RES=0x00 RST URGP=0 Nov 29 21:37:15 denise 116 ID=34901 DF PROTO=TCP SPT=3584 DPT=80 WINDOW=65535 RES=0x00 ACK FIN URGP=0 These are truncated iptables logs. Because in firewall.log file are simmilar entries to truncated one, I think full file should be: Nov 29 11:10:19 denise firewallp=INVALID:1 a=DROP IN=eth1 OUT= MAC=00:30:4f:36:2b:dc:00:04:9a:2c:7f:20:08:00 SRC=193.41.230.81 DST=xxx.xxx.xxx.x LEN=576 TOS=0x00 PREC=0x00 TTL=117 ID=3495 PROTO=TCP SPT=443 DPT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 (xxx.xxx.xxx.x is a real server IP address - one 'x' is one digit) Config file with interesting lines: options { dir_perm(0700); perm(0600); chain_hostnames(no); stats(1200); keep_hostname(yes); dir_owner(root); dir_group(root); owner(root); group(root); }; source local { unix-stream("/dev/log" max_connections(300)); file("/proc/kmsg"); # udp(ip(0.0.0.0) port(514)); internal(); }; # ..... # authpriv.none;cron.none;mail.none;news.none -/var/log/messages filter f_2 { not facility(news); }; filter f_3 { not facility(local5); }; filter f_4 { not facility(local6); }; filter f_5 { not facility(authpriv); }; filter f_6 { not facility(cron); }; filter f_7 { not facility(mail); }; filter f_notlocal7 { not facility(local7); }; filter f_notfirewall { not match("firewallp="); }; destination d_2 { file("/var/log/messages" create_dirs(yes)); }; log { source(local); filter(f_2); filter(f_4); filter(f_5); filter(f_6); filter(f_7); filter(f_notimapd); filter(f_notpopa3d); filter(f_notnamed); filter(f_notfirewall); destination(d_2); }; #..... # firewallp.* -/var/log/firewall.log filter f_16 { level(warning) and match("firewallp="); }; destination d_12 { file("/var/log/firewall.log" create_dirs(yes)); }; log { source(local); filter(f_16); destination(d_12); }; #..... Do you know where could be an error? It is a production server so I can't debug syslog-ng on this machine (sorry). NOTE: the only truncated lines I can find are iptables (AFAIR they are logged by /proc/kmesg) entries. All other lines are complete. And it is probably a critical error in security. PS: simple statistics line from syslog-ng: Nov 30 00:00:06 denise syslog-ng[32682]: Log statistics; dropped='pipe(/dev/tty12)=0', processed='center(queued)=758289', processed='center(received)=369020', processed='destination(d_maillogimapd)=4245', processed='destination(d_5)=1', processed='destination(d_4)=0', processed='destination(d_3)=14259', processed='destination(d_2)=14259', processed='destination(d_13)=0', processed='destination(d_1)=6000', processed='destination(d_12)=6000', processed='destination(d_11)=369020', processed='destination(d_10)=36', processed='destination(d_8)=0', processed='destination(d_maillogpopa3d)=103224', processed='destination(d_7)=241245', processed='destination(d_6)=0', processed='source(local)=369020' I think you see that it could be a little hard to debug (with so many messages parsed by syslog-ng) ;) Jacek

3 6

syslog-ng 2.0.3 is released
by Balazs Scheidler 14 Nov '07

14 Nov '07

Dear syslog-ng users, I've uploaded syslog-ng 2.0.3, the latest stable release in the syslog-ng 2.0 branch to our webserver. The list of changes is summarized below. The source is available at the usual places at http://www.balabit.com/products/syslog-ng/ 2.0.3 Mon, 26 Mar 2007 14:10:00 +0200 Bugfixes: * Fixed a possible segmentation fault in the usertty() destination driver when it was referenced on a log path with disabled flow-control. * Fixed various usertty() functionality problems. * Removed the 1024 byte limitation of internally generated messages. * Clarified the text of various internal messages, consistency updates for message severities. * Increased the minimum value for log_fifo_size to 1000 elements. * HP-UX portability fixes. * Some minor documentation fixes. Features: * Added spoof-source support for IPv4 & IPv6 to match 1.6.x functionality. * Added support for remembering the last posistion of file sources across restarts. * Added tcp-wrapper support. * Added support for more than 9 regexp matches. -- Bazsi

3 8

Syslog-ng 1.6.11 from HP porting center
by Uwe Martin 28 Sep '07

28 Sep '07

Hello, I installed the syslog_ng-1.6.11-hppa-11.11.depot.gz from HP porting center on a HP 9000/800/rp3440 "HP-UX xyz B.11.11 U 9000/800 189374938 unlimited-user license". After starting /usr/local/bin/syslog-ng -v -s, I got the following error : Segmentation fault (core dumped). Anybody an idea what is wrong on the installtion? kind regards Uwe MArtin Festo AG & Co. KG Uwe Martin Abteilung IN-O Network-Operation Obere Kaiserstraße 303 D - 66386 St. Ingbert Tel: ++49 (0) 6894-591-6323 Fax: ++49 (0) 6894-591-6326 http://www.festo.com Der Inhalt dieses E-Mails ist ausschliesslich fuer den bezeichneten Adressaten bestimmt. Jede Form der Kenntnisnahme, Veroeffentlichung, Vervielfaeltigung oder Weitergabe des Inhalts dieses E-Mails durch unberechtigte Dritte ist unzulaessig. Wir bitten Sie, sich mit dem Absender des E-Mails in Verbindung zu setzen, falls Sie nicht der Adressat dieses E-Mails sind und das Material von Ihrem Computer zu loeschen. This e-mail and any attachments are confidential and intended solely for the addressee. The perusal, publication, copying or dissemination of the contents of this e-mail by unauthorised third parties is prohibited. If you are not the intended recipient of this e-mail, please delete it and immediately notify the sender. Rechtsform: Kommanditgesellschaft Sitz: Esslingen a.N. Registergericht Stuttgart HRA 211583 Umsatzsteuerident-Nummer: DE 145339206 Persoenlich haftende Gesellschafterin:Festo Aktiengesellschaft Sitz: Stuttgart Registergericht Stuttgart HRB 18535 Vorstand: Dr. Ekkehard Gericke, Lothar Kempf, Dipl.-Ing. Rudi Menrad Dr. Thomas Rubbe Dr. Eberhard Veit (Sprecher) Dr. Ulrich Walker Aufsichtsratsvorsitzender: Dr. Wilfried Stoll

2 1

Re: [syslog-ng] Assistance compiling 1.6.12
by tim.brown＠juno.com 28 Sep '07

28 Sep '07

That would be ideal if I could locate a version of glib >= 2.2 for Solaris 9 on sparc, based on the following: checking for GLIB... Requested 'glib-2.0 >= 2.2' but version of GLib is 2.0.7 no configure: error: Cannot find GLib library version >= 2.2: is pkg-config in path? Thanks -- Carson Gaspar <carson(a)taltos.org> wrote: Carson Gaspar wrote: > Andrej Ricnik-Bay wrote: >> On 6/26/07, tim.brown(a)juno.com <tim.brown(a)juno.com> wrote: > >>> I've scanned the net for references to "-lxnet" on Solaris and could >>> only determine that is a library routine particular to Linux. I could >>> not find how to provide this on a Solaris platform. >> >> No, it's not. It's part of SUNWcslx and I've never seen it on any >> Linux machine :} > > Why is syslog-ng trying to link in the XTI library? Something is wrong, > here... Ah, libol's autoconf code adds in libxnet even though it isn't needed. I'm not sure what the code is _trying_ to do, but it's doing it wrong. On the plus side, I don't see references to xnet in the 2.0.4 syslog-ng, nor in the 0.2.5 eventlog. So my advice is to skip the old code and use the shiny new stuff. -- Carson _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _____________________________________________________________ Save on Tax Preparation Services. Click here. http://track.juno.com/s/lc?u=http://tagline.untd.us/fc/Ioyw6iigAEckp8Ap1pqX…

3 2

IP forwarding
by James B Horwath 14 Sep '07

14 Sep '07

Is it possible to forward only certain IP ranges in syslog-ng when it is running in server mode? If I have 10.10.10.0\24 10.10.20.0\24 10.20.10.0\0 and I want to forward 10.20.10.0\0 and 10.10.10.0\24 and nothing else is this possible. Regards, Jim ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

4 3

forwarding to server
by Chris Harner 06 Sep '07

06 Sep '07

Hello everyone! I have a Cacti Server with the Haloe plugin installed. I can get my Windows boxes to talk to the Haloe plugin (syslogs). I have two old servers (running SLES 9 I think) with syslogd installed, reporting in just fine! Here is my issue - I can't figure out how to pipe or forward the data from the box to the syslogs server (Cacti). For those of you who do not know, Cacti is a network monitoring tool/RRDtool front end with a ton of available plugins. Haloe is a centralized syslog server. Thanks! -- Chris Harner [] Server Engineer [] Arnold Transportation Services

5 12

error sending raw frame
by James B Horwath 31 Aug '07

31 Aug '07

I recently upgraded to syslog-ng 2.0.4 running on a Red Hat AS release 4. I have the following on the system: eventlog-0.2.5-1.i386.rpm eventlog-devel-0.2.5-1.i386.rpm libnet-devel-1.1.2.1-6.i386.rpm syslog-ng-2.0.4-1.i386.rpm When I fire up syslog-ng I receive a large number of the following: Aug 30 14:36:07:2007 syslogger1 syslog-ng[31079]: Error sending raw frame; error=\'libnet_write_raw_ipv4(): -1 bytes written (Message too long)\\x0a\' Aug 30 14:36:07:2007 syslogger1 syslog-ng[31079]: Error sending raw frame; error=\'libnet_write_raw_ipv4(): -1 bytes written (Message too long)\\x0a\' Aug 30 14:36:07:2007 syslogger1 syslog-ng[31079]: Error sending raw frame; error=\'libnet_write_raw_ipv4(): -1 bytes written (Message too long)\\x0a\' I am trying to forward packets onto another log product, so I have spoof_source(yes) specified. What is the remedy for this error, am I loosing data? Please advise, Jim ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

2 1

Client forwarding to server
by mailing list 30 Aug '07

30 Aug '07

My syslog-ng is now running. However, I cannot get the client to forward its messages to the server. To be certain, I have disabled my firewall, on both the client and server side, but still get the below errors in /var/adm/messages. The client is logging normally in /var/adm/messages. Aug 29 14:54:33 client1 syslog-ng[18639]: Connection failed; error='Connection refused (146)', time_reopen='10' Aug 29 14:54:43 client1 syslog-ng[18639]: Connection failed; error='Connection refused (146)', time_reopen='10' Aug 29 14:54:53 client1 syslog-ng[18639]: Connection failed; error='Connection refused (146)', time_reopen='10' Aug 29 14:54:59 client1 syslog-ng[18639]: Log statistics; dropped='tcp(AF_INET(w.x.y.z:5140))=0', processed='center(queued)=8844', processed='center(received)=4424', processed='destination(messages)=4420', processed='destination(loghost)=4420', processed='destination(syslog)=4', processed='source(src)=4424' Aug 29 14:55:03 client1 syslog-ng[18639]: Connection failed; error='Connection refused (146)', time_reopen='10' I have "destination loghost { tcp("w.x.y.z" port(5140)); };" in my syslog-ng.conf on the client1. Here's my complete syslog-ng.conf file on the client1 side. options { long_hostnames(off); log_msg_size(8192); sync(1); log_fifo_size(2048); bad_hostname("^(ctld.|cmd|tmd|last)$"); time_reopen(10); }; source src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; destination syslog { file("/var/log/syslog"); }; destination messages { file("/var/adm/messages"); }; destination loghost { tcp("w.x.y.z" port(5140)); }; filter f_mail { facility(mail); }; filter f_not_mail { not facility(mail); }; log { source(src); filter(f_mail); destination(syslog); }; log { source(src); filter(f_not_mail); destination(messages); }; Any help/pointer is greatly appreciated. Thank you. ____________________________________________________________________________________ Building a website is a piece of cake. Yahoo! Small Business gives you all the tools to get online. http://smallbusiness.yahoo.com/webhosting

4 6

disk full memory leak
by Alexander Clouter 30 Aug '07

30 Aug '07

Hi, I hope I did not miss the memo but I think I have stumbled on a memory leak; due to my own poor administration :) When a partition fills up and syslog-ng cannot write out log files to, it seems to start soaking up memory. Looking in the output from 'top' you can see the resident memory size ('RES') creeping up and not being released. It seems to be at the rate of logging messages themselves. I'm guessing this bug has not been seen mainly as whilst syslog-ng soaks up memory unattended Linux will kill it once it soaks up all the available RAM; probably people would just assume "ahhhh syslog-ng gracefully died when it could not write out to the disk", I know I would :) It is easy to reproduce, I did it by creating a small partition of about 10MB and letting it fill up (you can hurry it along by dd'ing 8MB's worth of /dev/zero to the partition as a file). Then whilst running top you can see the memory creeping up the moment the partition fills. I found that after a day of "max'ed out partition time" syslog-ng got as high as 512MB of resident memory! I am pretty sure it is not configuration file related but if you would like a copy do ask and I will send it 'offline'. I'm running the regular 2.0.5 tarball from the website with the Debian related package patches applied from 2.0.0-1[1]. If this bug is fixed at least I will be able to lvextend/xfs_growfs a partition to 'gracefully' recover....maybe syslog-ng could flush this data polling regularly to see if it can write the data at a later time? Cheers Alex [1] http://ftp.debian.org/debian/pool/main/s/syslog-ng/syslog-ng_2.0.0-1.diff.gz

1 0