September 2007 - syslog-ng - lists.balabit.hu

AIX startup
by Brian Loe 27 Mar '08

27 Mar '08

Okay, my syslog-ng instance died at some point last night and because I don't have it setup properly for respawning... Can anyone running syslog-ng on AIX 5.* give me some tips for this? I'm feeding pipes so i have to start instances of SEC as soon as I start syslog-ng - but the SEC scripts appear to "close" so if they're configured to respawn I'll have 2000 instances of them in an hour.

7 21

incorrect firewall logs with syslogng-2.0.0 [security error?]
by Jacek Kalinski 12 Mar '08

12 Mar '08

Hello, After upgradeing from syslogng-1.6.11 to 2.0.0 I've got a strange messages in /var/log/messages file: Nov 29 08:14:05 denise WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 11:10:19 denise PT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 16:42:16 denise W=0 RES=0x00 RST URGP=0 Nov 29 21:37:15 denise 116 ID=34901 DF PROTO=TCP SPT=3584 DPT=80 WINDOW=65535 RES=0x00 ACK FIN URGP=0 These are truncated iptables logs. Because in firewall.log file are simmilar entries to truncated one, I think full file should be: Nov 29 11:10:19 denise firewallp=INVALID:1 a=DROP IN=eth1 OUT= MAC=00:30:4f:36:2b:dc:00:04:9a:2c:7f:20:08:00 SRC=193.41.230.81 DST=xxx.xxx.xxx.x LEN=576 TOS=0x00 PREC=0x00 TTL=117 ID=3495 PROTO=TCP SPT=443 DPT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 (xxx.xxx.xxx.x is a real server IP address - one 'x' is one digit) Config file with interesting lines: options { dir_perm(0700); perm(0600); chain_hostnames(no); stats(1200); keep_hostname(yes); dir_owner(root); dir_group(root); owner(root); group(root); }; source local { unix-stream("/dev/log" max_connections(300)); file("/proc/kmsg"); # udp(ip(0.0.0.0) port(514)); internal(); }; # ..... # authpriv.none;cron.none;mail.none;news.none -/var/log/messages filter f_2 { not facility(news); }; filter f_3 { not facility(local5); }; filter f_4 { not facility(local6); }; filter f_5 { not facility(authpriv); }; filter f_6 { not facility(cron); }; filter f_7 { not facility(mail); }; filter f_notlocal7 { not facility(local7); }; filter f_notfirewall { not match("firewallp="); }; destination d_2 { file("/var/log/messages" create_dirs(yes)); }; log { source(local); filter(f_2); filter(f_4); filter(f_5); filter(f_6); filter(f_7); filter(f_notimapd); filter(f_notpopa3d); filter(f_notnamed); filter(f_notfirewall); destination(d_2); }; #..... # firewallp.* -/var/log/firewall.log filter f_16 { level(warning) and match("firewallp="); }; destination d_12 { file("/var/log/firewall.log" create_dirs(yes)); }; log { source(local); filter(f_16); destination(d_12); }; #..... Do you know where could be an error? It is a production server so I can't debug syslog-ng on this machine (sorry). NOTE: the only truncated lines I can find are iptables (AFAIR they are logged by /proc/kmesg) entries. All other lines are complete. And it is probably a critical error in security. PS: simple statistics line from syslog-ng: Nov 30 00:00:06 denise syslog-ng[32682]: Log statistics; dropped='pipe(/dev/tty12)=0', processed='center(queued)=758289', processed='center(received)=369020', processed='destination(d_maillogimapd)=4245', processed='destination(d_5)=1', processed='destination(d_4)=0', processed='destination(d_3)=14259', processed='destination(d_2)=14259', processed='destination(d_13)=0', processed='destination(d_1)=6000', processed='destination(d_12)=6000', processed='destination(d_11)=369020', processed='destination(d_10)=36', processed='destination(d_8)=0', processed='destination(d_maillogpopa3d)=103224', processed='destination(d_7)=241245', processed='destination(d_6)=0', processed='source(local)=369020' I think you see that it could be a little hard to debug (with so many messages parsed by syslog-ng) ;) Jacek

3 6

syslog-ng 2.0.3 is released
by Balazs Scheidler 14 Nov '07

14 Nov '07

Dear syslog-ng users, I've uploaded syslog-ng 2.0.3, the latest stable release in the syslog-ng 2.0 branch to our webserver. The list of changes is summarized below. The source is available at the usual places at http://www.balabit.com/products/syslog-ng/ 2.0.3 Mon, 26 Mar 2007 14:10:00 +0200 Bugfixes: * Fixed a possible segmentation fault in the usertty() destination driver when it was referenced on a log path with disabled flow-control. * Fixed various usertty() functionality problems. * Removed the 1024 byte limitation of internally generated messages. * Clarified the text of various internal messages, consistency updates for message severities. * Increased the minimum value for log_fifo_size to 1000 elements. * HP-UX portability fixes. * Some minor documentation fixes. Features: * Added spoof-source support for IPv4 & IPv6 to match 1.6.x functionality. * Added support for remembering the last posistion of file sources across restarts. * Added tcp-wrapper support. * Added support for more than 9 regexp matches. -- Bazsi

3 8

Re: [syslog-ng] Compiling on HP/UX 11.11
by C Wells 18 Oct '07

18 Oct '07

> > I will try and remove it and reinstall. Are there > any > other workarounds if I can't make flex work ? > > Thanks Well I tried to compile flex from scratch, but that was a disaster. So I removed Flex and reinstalled and the configure completed without error. Then I tried make and got this gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -lfl -L/usr/local/lib -lglib-2.0 -lintl -liconv -L/usr/local/lib -levtlog -lnet /usr/ccs/bin/ld: Unsatisfied symbols: linenum (first referenced in libsyslog-ng.a(cfg-grammar.o)) (data) lookup_parse_flag (first referenced in libsyslog-ng.a(cfg-grammar.o)) (code) strtoll (first referenced in libsyslog-ng.a(affile.o)) (code) yylex (first referenced in libsyslog-ng.a(cfg-grammar.o)) (code) lex_init (first referenced in libsyslog-ng.a(cfg.o)) (code) collect2: ld returned 1 exit status Any ideas of what to try next ?? THanks ____________________________________________________________________________________ Tonight's top picks. What will you watch tonight? Preview the hottest shows on Yahoo! TV. http://tv.yahoo.com/

4 5

Syslog-ng acting in relay mode
by James B Horwath 10 Oct '07

10 Oct '07

I was testing syslog-ng compiled with spoof_source compiled in. This was the premium version used in evaluation mode. When I use the spoof_source option to relay log data, syslog-ng will not allow me to write data locally. Is this the case whenever syslog-ng is using spoof_source acting a relay. Is it possible to write the data locally on the relay host? Please advise, Jim ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

6 7

Syslog-ng 1.6.11 from HP porting center
by Uwe Martin 28 Sep '07

28 Sep '07

Hello, I installed the syslog_ng-1.6.11-hppa-11.11.depot.gz from HP porting center on a HP 9000/800/rp3440 "HP-UX xyz B.11.11 U 9000/800 189374938 unlimited-user license". After starting /usr/local/bin/syslog-ng -v -s, I got the following error : Segmentation fault (core dumped). Anybody an idea what is wrong on the installtion? kind regards Uwe MArtin Festo AG & Co. KG Uwe Martin Abteilung IN-O Network-Operation Obere Kaiserstraße 303 D - 66386 St. Ingbert Tel: ++49 (0) 6894-591-6323 Fax: ++49 (0) 6894-591-6326 http://www.festo.com Der Inhalt dieses E-Mails ist ausschliesslich fuer den bezeichneten Adressaten bestimmt. Jede Form der Kenntnisnahme, Veroeffentlichung, Vervielfaeltigung oder Weitergabe des Inhalts dieses E-Mails durch unberechtigte Dritte ist unzulaessig. Wir bitten Sie, sich mit dem Absender des E-Mails in Verbindung zu setzen, falls Sie nicht der Adressat dieses E-Mails sind und das Material von Ihrem Computer zu loeschen. This e-mail and any attachments are confidential and intended solely for the addressee. The perusal, publication, copying or dissemination of the contents of this e-mail by unauthorised third parties is prohibited. If you are not the intended recipient of this e-mail, please delete it and immediately notify the sender. Rechtsform: Kommanditgesellschaft Sitz: Esslingen a.N. Registergericht Stuttgart HRA 211583 Umsatzsteuerident-Nummer: DE 145339206 Persoenlich haftende Gesellschafterin:Festo Aktiengesellschaft Sitz: Stuttgart Registergericht Stuttgart HRB 18535 Vorstand: Dr. Ekkehard Gericke, Lothar Kempf, Dipl.-Ing. Rudi Menrad Dr. Thomas Rubbe Dr. Eberhard Veit (Sprecher) Dr. Ulrich Walker Aufsichtsratsvorsitzender: Dr. Wilfried Stoll

2 1

Re: [syslog-ng] Assistance compiling 1.6.12
by tim.brown＠juno.com 28 Sep '07

28 Sep '07

That would be ideal if I could locate a version of glib >= 2.2 for Solaris 9 on sparc, based on the following: checking for GLIB... Requested 'glib-2.0 >= 2.2' but version of GLib is 2.0.7 no configure: error: Cannot find GLib library version >= 2.2: is pkg-config in path? Thanks -- Carson Gaspar <carson(a)taltos.org> wrote: Carson Gaspar wrote: > Andrej Ricnik-Bay wrote: >> On 6/26/07, tim.brown(a)juno.com <tim.brown(a)juno.com> wrote: > >>> I've scanned the net for references to "-lxnet" on Solaris and could >>> only determine that is a library routine particular to Linux. I could >>> not find how to provide this on a Solaris platform. >> >> No, it's not. It's part of SUNWcslx and I've never seen it on any >> Linux machine :} > > Why is syslog-ng trying to link in the XTI library? Something is wrong, > here... Ah, libol's autoconf code adds in libxnet even though it isn't needed. I'm not sure what the code is _trying_ to do, but it's doing it wrong. On the plus side, I don't see references to xnet in the 2.0.4 syslog-ng, nor in the 0.2.5 eventlog. So my advice is to skip the old code and use the shiny new stuff. -- Carson _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _____________________________________________________________ Save on Tax Preparation Services. Click here. http://track.juno.com/s/lc?u=http://tagline.untd.us/fc/Ioyw6iigAEckp8Ap1pqX…

3 2

ICMP port unreachable sent to one of logging hosts
by Karel Hendrych 27 Sep '07

27 Sep '07

Hi, I'm experiencing strange issue with syslog-ng 2.0.5 build on a CentOS4 machine. One of a logging hosts receives after syslog message a ICMP port unreachable message sent from machine running syslog-ng. Other hosts logging is working fine. The only difference between logging hosts and this single not logging host is a little bit faster logging rate. Aprox. 10 log records/s. Debug option did not show something interesting why the syslog's are not being accepted. There is no firewall/filtering on the log server. Here is my simple config: options { use_fqdn(no); use_dns(persist_only); dns_cache_hosts(/etc/hosts); keep_hostname(yes); long_hostnames(off); sync(1); log_fifo_size(1024); perm(0640); }; source src { udp(ip("0.0.0.0") port(514) so_rcvbuf(4194304) ); tcp(ip("0.0.0.0") port(514)); }; source self { internal(); }; destination central {file("/var/log/central/$HOST_FROM.log"); }; destination self {file("/var/log/central/syslog-ng.log"); }; log { source(src); destination(central); }; log { source(self); destination(self); }; netstat -su output: 20578970 packets to unknown port received. 464 packet receive errors 190828 packets sent Does anyone have some idea how to deal with it? -- Karel

1 0

why dose the usage of mem by syslog-ng keep growing?
by liuruihong 27 Sep '07

27 Sep '07

the configure file as follows: options { use_dns(no); create_dirs(yes);ts_format(iso); }; #options { log_fifo_size(3000); }; source src { udp(ip(0.0.0.0) port(514) ); }; filter f_kern { facility(kern); }; filter f_authpriv { facility(auth,authpriv); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_boot { facility(local7); }; filter f_spooler { facility(uucp, news) and level(crit..emerg); }; filter f_messages { level(info..emerg) and not facility(authpriv, cron, mail); }; destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH"); }; destination authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); }; destination mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); }; destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); }; destination boot { file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); }; destination spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); }; destination messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_authpriv); destination(authpriv); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_boot); destination(boot); }; log { source(src); filter(f_spooler); destination(spooler); }; log { source(src); filter(f_messages); destination(messages); }; syslog-ng receive logs from about 1000 clients ,and the usage of mem by syslog-ng keeps growing,here are a days record of the usage of mem(got by command 'ps aux'): cup %mem 0.1 29.9 0.1 30.1 0.1 30.3 0.1 30.5 0.1 30.7 0.1 30.9 0.1 31.1 0.1 31.2 0.1 31.4 0.1 31.6 0.1 31.9 0.1 32.1 0.1 32.3 0.1 32.4 0.1 32.6 0.1 32.8 0.1 33.0 0.1 33.2 0.1 33.4 0.1 33.5 0.1 33.8 0.1 33.9 0.1 34.1 0.1 34.3 0.1 34.5 0.1 34.6 0.1 34.9 0.1 35.0 0.1 35.2

5 13

Re: [syslog-ng] Compiling on HP/UX 11.11
by C Wells 27 Sep '07

27 Sep '07

> > So I modified configure to copy out a conftest.l since > > it cleans it up. Then I tried running > > flex -d -o pleasework conftest.l and get the same > > result, can not find output. What should I try next ? > > I think it must have something to do with the "fatal error" that flex is > reporting: > > "flex: fatal internal error, exec failed" > > Where did you get the flex binary from? I obtained flex from this link http://hpux.connect.org.uk/hppd/hpux/Gnu/flex-2.5.33/ I will try and remove it and reinstall. Are there any other workarounds if I can't make flex work ? Thanks ____________________________________________________________________________________ Tonight's top picks. What will you watch tonight? Preview the hottest shows on Yahoo! TV. http://tv.yahoo.com/

2 1