August 2007 - syslog-ng - lists.balabit.hu

HPUX binary core dump
by Blurry 30 Aug '07

30 Aug '07

How can I figure out why syslog-ng is core dumping ? I have HPUX 11i 11.11 and I downloaded the 11.11 depot and it just says Memory Fault and renders a core dump. I had to load FLEX as a prereq. Thanks

2 3

More syslog-ng woes
by mailing list 29 Aug '07

29 Aug '07

I keep getting the below error and syslog-ng would not starts. Error in configuration, unresolved destination reference; filter='loghost' I have "log { source(loghost); };" in my log entries section, and I thought this would define "loghost" variable? Additionally, if I comment out the below section, then syslog-ng would starts and no error. log { source(src); filter(f_not_mail); filter(f_not_brightmail); destination(loghost); }; Is the above filter important/needed for syslog-ng? I'm thinking the "f_not_brightmail" is something specific if you're using brightmail, but then it would not address the "destination(loghost);" which reference loghost variable. I'm running syslog-ng 2.0.4 on Solaris 10 SPARC, and I'm referencing: http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/bk01-toc.html ...but not seeing anything referencing source(loghost); configuration. I was able to comprehend that syslog-ng.conf breaks into four parts, by referencing http://linux.cudeso.be/linuxdoc/syslog-ng.php but I'm still learning the syntax from the admin's guide above. Thanks. ____________________________________________________________________________________ Be a better Globetrotter. Get better travel answers from someone who knows. Yahoo! Answers - Check it out. http://answers.yahoo.com/dir/?link=list&sid=396545469

1 0

Re: [syslog-ng] Lost packets; UDP Checksum (chksum) errors; forwarding - source spoofing; libnet bug
by Marvin.Nipper＠Stream.com 29 Aug '07

29 Aug '07

OK... I'll spare you the more gory details. My environment is all Solaris. A Sparc-based Solaris 8 system (that I'm trying to replace), and an Intel-based Solaris 10 system (running under VMware) that is intended to be the replacement). Although we were doing forwarding in other places, this was the first time that I was able to get some reasonable statistical reporting, between two servers that were initially supposed to be getting the same data (via the forwarding). The short story is that the receiving system "seemed" to be getting a fraction of the packets, and because the environment is slightly more complex (e.g. the VMware piece) I kept ass-u-me-ing that my original problem was not related to syslog-ng, but simply to something else going wrong. When I finally did start capturing packets with snoop, and more importantly, finally moved onto using Wireshark to look at those captures, that's when I realized that all of the forwarded packets WERE, in fact, making it to the second system, but that Solaris was tossing most of them out because their (UDP header) checksum was wrong. When I finally figured that out, I had suspected libnet might be the culprit, and after doing a bit more googling, I finally found someone else complaining about the checksum issue (albeit not in regard to using libnet with syslog-ng), and posting a suggested fix that they claimed solved the problem. Now that I know what I'm looking for, I think that Mike may have addressed the problem in his 1.1.3 Beta, but every time that ever I've tried to compile that version (on several different systems), I get a bazillion compile errors, so I've never used anything other than 1.1.2.1. The short description of the problem is that it's an "odd byte issue". The checksum process is done against 2-byte chunks of data, and if the amount of data being checksum'd is an odd number, then the code was not handling that last byte properly. So... The packets with even-numbered data volumes (in my case, about 1/3 of my forwarded packets) came through just fine, but everything else looks like a corrupted packet (to the receiving OS) and gets tossed in the bin. For your reference, here's where I lucked into the discussion: http://www.securityfocus.com/archive/89/384197/30/90/threaded I had to modify his suggested fix slightly, but this is what is now documented in my own "how to build syslog-ng" documentation: --------------------------------------- >From the libnet package directory, one needs to edit the checksum module, i.e.: vi src/libnet_checksum.c Then, you will need to locate this section of code: libnet_in_cksum(u_int16_t *addr, int len) { int sum; sum = 0; while (len > 1) { sum += *addr++; len -= 2; } if (len == 1) { sum += *(u_int16_t *)addr; } return (sum); } Now, replace that section with the following (and save/quit from the editor): libnet_in_cksum(u_int16_t *addr, int len) { int sum; u_int16_t last_byte; sum = 0; last_byte = 0; while (len > 1) { sum += *addr++; len -= 2; } if (len == 1) { *(u_int8_t*)&last_byte = *(u_int8_t*)addr; sum += last_byte; } return (sum); } -------------------------------------- Obviously, there are only a couple of lines of code modified in there, but for my purposes, it was simpler to just replace the section. I am NOT a C programmer (although I used to program in a lot of other older languages!). I can't speak to whether this is the "best" solution, or not (in terms of efficiency or coding techniques). BUT, bottom line... Once I made this change, it appears that I'm no longer receiving any packet loss at all. The sample captures that I've done, and then loaded into Wireshark, are showing no checksum errors. Whether you use this coding solution, or work up one of your own, the bottom line is that 1.1.2.1 absolutely needs to be modified, in order to make source-spoofed forwarding work as intended. Let me know if you have any questions about the above information. I'll do my best to provide answers. I'd be remiss if I didn't also take this opportunity to say THANKS for all of your syslog-ng efforts. It's a fine product. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of bazsi(a)balabit.hu Sent: Wednesday, August 29, 2007 7:06 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Lost packets; UDP Checksum (chksum) errors; forwarding - source spoofing; libnet bug On Wed, 2007-08-29 at 06:58 -0600, Marvin.Nipper(a)Stream.com wrote: > OK. I've only posted here a couple of times, but I've googled this > list (for help) extensively in the past. Before I waste everyone's > time, I just wanted to find out if I'm the only one who "didn't > already know" that there's a nasty bug in libnet-1.1.2.1, such that > anybody doing source-spoofed forwarding of UDP-based syslog packets > will likely end up losing large volumes of packets in the process (in > my case a 2/3 loss of packets). > > Again. I thought that I had searched the mailing list archives > properly, and that I didn't see a mention of this issue (as I've been > fighting my way through figuring this out, over a multi-week period), > BUT, as this would seem to impact a lot of syslog-ng users, I keep > thinking that I've just missed something, and everyone else already > knows about this. Before I waste time writing a detailed message on > the topic, I figured that I'd ask first. I would appreciate if you could write about this. I don't know about anything related. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Lost packets; UDP Checksum (chksum) errors; forwarding - source spoofing; libnet bug
by Marvin.Nipper＠Stream.com 29 Aug '07

29 Aug '07

OK. I've only posted here a couple of times, but I've googled this list (for help) extensively in the past. Before I waste everyone's time, I just wanted to find out if I'm the only one who "didn't already know" that there's a nasty bug in libnet-1.1.2.1, such that anybody doing source-spoofed forwarding of UDP-based syslog packets will likely end up losing large volumes of packets in the process (in my case a 2/3 loss of packets). Again. I thought that I had searched the mailing list archives properly, and that I didn't see a mention of this issue (as I've been fighting my way through figuring this out, over a multi-week period), BUT, as this would seem to impact a lot of syslog-ng users, I keep thinking that I've just missed something, and everyone else already knows about this. Before I waste time writing a detailed message on the topic, I figured that I'd ask first. Marvin Nipper Director of Security Stream mailto:marvin.nipper@stream.com PGP Key ID: 0x8EE28551 (DSS/DH) 8C5D 403A D107 0A95 672B B637 BCF1 919A 8EE2 8551

2 1

syslog-ng error
by Javier Terceiro 29 Aug '07

29 Aug '07

Hello list, my problem is the following one, syslog-ng does not write in the corresponding files according to the configuration. The configuration says that all the packages with facility mail, are written in a file, mail.log, whereas those of facility local7 in another file, according to the priority, info in $program.info.log and error in $program.error.log. Being $program the name of the program. In config of local7 I have writes in disc the following thing: template ("$FULLDATE <> $PROGRAM --$FACILITY-- <> $MSGONLY \ n") The problem is that some of the mail message with facility (among others facility's) are written like local7, when they would not have. An example is: 2007 Aug 29 06:25:58 <> cyrus --mail-- <> DBERROR: reading /var/lib/cyrus/db/skipstamp, assuming the worst: No such file or directory 2007 Aug 29 06:25:58 <> cyrus --mail-- <> IOERROR: opening /var/lib/cyrus/mailboxes.db: No such file or directory 2007 Aug 29 05:05:45 <> kernel --kern-- <> drbd0: incompatible states And the config file is: filter f_mail { facility(mail); }; destination df_mail { file("/var/log/mail.log" template("$FULLDATE <> $PROGRAM <> $MSGONLY\n") template_escape(no)); }; log { source(s_udp); filter(f_mail); destination(df_mail); filter f_local0_err { facility(local7) and level(warn) or level(err); }; destination df_local0_err { file("/var/log/$PROGRAM.error.log" template("$FULLDATE <> $PROGRAM --$FACILITY-- <> $MSGONLY\n") template_escape(no)); }; log { source(s_udp); filter(f_local0_err); destination(df_local0_err); }; Some idea of so that this happens? -- A greeting, Javier.

2 1

Message aggregation: or, 'Last message repeated umpteen times'.
by G.W. Haywood 28 Aug '07

28 Aug '07

Hi there, On Mon, 15 Jul 2002 12:33:17 +0200 Balazs Scheidler wrote: > On Tue, Jul 09, 2002 at 07:02:19PM -0400, Kevin Welch wrote: > > I know this issue has been discussed before, but I never saw an answer other > > than 'syslog-ng doesnt do that'. > > > > Perhaps someone could provide insight as to why syslog-ng doesnt aggregate > > messages received? Is this on a feature list for future releases? > > It might be implemented once I have time, though IMHO message aggregation > makes log analysis more difficult, especially if you have multiple cascaded > log relays. Balazs, I read the manpage, Googled and grepped the source and I believe I know the answer, but I'd like to have your confirmation. Is it still the case that syslog-ng does no message aggregation? (I'm not asking because I want it. I'm asking because I _don't_ want it. :) -- 73, Ged. PS: I also found this about not aggregating messages if the output is a pipe http://lists.hellug.gr/pipermail/linux-greek-users/2007-April/068169.html

2 1

File reopen
by Szeti, Balazs 28 Aug '07

28 Aug '07

Hi! Syslog-ng reopens destination files, if I send a SIGHUP to the process, which is a common way of handling logrotates in Linux. If I don't write in to a file (idle), syslog-ng will close the file according to time_reap() value. If the file was deleted from the directory, will it create the file next time it logs to the deleted destination file? I've found, that it doesn't, can I config it somehow? (My log files are read by different users, and sometimes they delete it, so it should be recreated again.) Is it a soultion, if I send a SIGHUP to syslog-ng every minute? I was looking for a solution in the archive, but I haven't found a clear answer. Thanks, Balazs Szeti

2 1

syslog-ng unable to starts
by mailing list 26 Aug '07

26 Aug '07

syslog-ng 2.0.4, Solaris 10, attempting to replace syslogd on Solaris. I stopped syslogd before starting syslog-ng on my system and I keep getting the below error messages in /var/adm/messages: (ps -ef shows syslog-ng is running) Aug 23 14:39:52 server1 syslog-ng[7764]: Connection failed; error='Connection refused (146)' Aug 23 14:39:52 server1 syslog-ng[7764]: Initiating connection failed, reconnecting; time_reopen='10' I've edited /etc/inet/services to include port 5140 and stop/start inetd via Solaris smf (svcadm). Was there something else I need to make the port open or perhaps something in syslog-ng.conf? Additionally, I used the config file from http://www.campin.net/syslog-ng/solaris-conf.txt and only make changes to the "destination loghost" is there anything specific to Solaris 10 that I need to add/remove in the configuration file? Thank you for any pointers. Regards, -- Mike ____________________________________________________________________________________ Fussy? Opinionated? Impossible to please? Perfect. Join Yahoo!'s user panel and lay it on us. http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7

2 3

Revisiting: problem with filter behavior in 2.0.4
by aero1967＠fastmail.fm 23 Aug '07

23 Aug '07

Hello. I posted the below message on 13 July to the list, but still received no response. I'm wondering if I'm seeing a bug in syslog-ng, or there's some configuration detail I've overlooked. Balazs, could you comment on this please? Since I posted the original message, I'm seeing all kinds of messages in the "critical.log" file that shouldn't belong, according to my understanding of the filtering, e.g. messages from facility+priority combination "user.info" without the string "crit" anywhere within the message (though oddly enough in that example, the word "subscription" is present in the message, which differs from "crit" by the addition of the "p" before the "t", but I'm not sure if that's anything more than coincidence). Anyway, I'd appreciate it if someone could help me look into this. -- aero1967(a)fastmail.fm -- http://www.fastmail.fm - A no graphics, no pop-ups email service ----- Original message ----- I'm seeing some results with filtering that I don't expect / understand. I have the following statements in syslog-ng.conf (I am just giving the relevant configuration lines): source src { unix-stream("/dev/log"); internal(); file("/proc/kmsg"); }; filter kern { facility(kern); }; filter kern_critical { filter(kern) and priority(emerg .. err); }; filter critical { filter(kern_critical) or match("crit*") or priority(emerg .. crit); }; template verbose_msg_fmt { template("$FULLDATE $FACILITY.$PRIORITY $MSG\n"); template_escape(no); }; destination root_tty { usertty("root"); }; destination critical_logfile { file("/var/log/critical.log" template(verbose_msg_fmt)); }; log { source(src); filter(critical); destination(root_tty); destination(critical_logfile); }; There are no other configuration lines which reference the critical_logfile destination , and no destination has a "final" flag. Now, when I check /var/log/critical.log, I get messages from the facility.priority combination of daemon.warning that do not contain any string starting with "crit". I also get messages from daemon.err, which also shouldn't match the filter. For example: 2007 Jul 12 10:51:07 daemon.warning <message, not containing the string crit anywhere> 2007 Jul 11 20:33:57 daemon.err <message, not containing the string crit anywhere> IIRC, I was using these same lines in a syslog-ng 1.6.x installation without these kinds of results.

2 1

cisco tcp syslog weirdness/merkwuerdigkeit
by Blurry 22 Aug '07

22 Aug '07

When a certain cisco router is set to UPD syslog delivery it creates a unique message for each unique message, duh ! But when this same router is set to TCP syslog, it takes all messages and tacks them back to back until syslog-ng runs out of buffer space in one line. I kept increasing the message log size, but the real problem is that the messages would have to be parsed out of this massive long line. My router guy says he can't make the cisco router behave any differently. How do I handle this problem ? Ideas ? Thanks

3 7