September 2007 - syslog-ng - lists.balabit.hu

(no subject)
by hi ro 27 Sep '07

27 Sep '07

Hi, I have a client node and a server node which has two Network Interface Card(NIC A, NIC B). Syslog message sender is installed in the client node. Syslog-ng(version2.0.5) and eventlog(version0.2.5) are installed in the server node. I can't understand following situation. [situation] 1. Change status NIC A and B UP by ifup command 2. Start syslog-ng service 3. Change status NIC A DOWN by ifdown command 4. Syslog-ng service can receive message to NIC A. ※ situation (Syslog-ng service can also receive message to NIC B.) 5. Change status NIC B DOWN by ifdown command 6. Syslog-ng service can't receive message to NIC A and B. Under the situation(4), I expected that syslog-ng service can't receive message to NIC A and can receive message to NIC B. The OS of the server node is Red Hat Enterprice Linux Version4 update4 x86. Thanks hiro _________________________________________________________________ MSNミュージックとEMI Artistsが共同開催するオーディション SCHOOL OF SCHOOL http://music.jp.msn.com/

2 1

Re: [syslog-ng] Compiling on HP/UX 11.11
by C Wells 26 Sep '07

26 Sep '07

On 9/14/07, Balazs Scheidler <bazsi(a)balabit.hu> wrote: > On Thu, 2007-09-13 at 11:16 -0700, C Wells wrote: > > > What's the error message of configure that you get > > if you have flex installed and not renamed? > > > > 'checking lex output file root... configure: error: > > cannot find output from flex; giving up' > > I guess I can try a newer flex maybe, not sure > > The config.log file might have more details. The error basically says > that the output for flex was not found. > > Are you sure it is using flex and not the system installed lex? Again, > the config.log file has more details. > > The flex/lex commands generate their output as a fixed named file > (usually lex.yy.c) and the makefiles cannot find this file. > > Try running the flex command line by hand and check whether the file > gets generated. > > -- > Bazsi configure:3535: found /usr/local/bin/flex configure:3546: result: flex configure:3583: flex conftest.l flex: fatal internal error, exec failed flex: error writing output file lex.yy.c configure:3586: $? = 1 configure:3588: checking lex output file root configure:3599: error: cannot find output from flex; giving up So I modified configure to copy out a conftest.l since it cleans it up. Then I tried running flex -d -o pleasework conftest.l and get the same result, can not find output. What should I try next ? Thanks ____________________________________________________________________________________ Building a website is a piece of cake. Yahoo! Small Business gives you all the tools to get online. http://smallbusiness.yahoo.com/webhosting

2 1

Supported Platform
by hi ro 26 Sep '07

26 Sep '07

Hi, Is Redhat Enterprise Linux Version4 EM64T (Update5) supported ?Tell me anyone, please. Thanks hiro _________________________________________________________________ メッセンジャーの疑問を解決！リニューアルしたメッセンジャーページ http://messenger.live.jp/

1 0

Is there a max value limit about the A which is in the command "ulimit -n A"
by liuruihong 26 Sep '07

26 Sep '07

Is there a max value limit about the A which is in the command "ulimit -n A",and how can I know the max value? Thanks!

1 0

who knows the mechanism of syslog-ng writing log fies?
by liuruihong 25 Sep '07

25 Sep '07

If syslog-ng writes logs to many files,How does syslog-ng write the log files? do all the logfiles keep opening and being writted in when logs come from remote? or a certern log file will be closed if there are no log comes during a certain time?

2 2

Filtering using SO_PEERCRED
by Simon Arlott 24 Sep '07

24 Sep '07

I've attached a patch that uses SO_PEERCRED to find the PID/UID/GID of the application using syslog. I wanted to be able to prevent users faking messages but at the same time not lose some of sshd's messages that are sent from a non-privileged process. The next step would be to send users' other messages to /home/$FROM_USER/syslog which would be owned by them - but owner(....) is only evaluated at startup... Sample config: filter f_sshd { uid(0) and program("sshd"); }; filter f_sshdu { not uid(0) and program("sshd") and pid(); }; #pid() checks PID in message is correct destination sshd { file("/var/log/sshd.$YEAR$MONTH" template("$DAY $HOUR:$MIN:$SEC $MSG\n") template-escape(no)); }; log { source(local); filter(f_sshd); destination(sshd); }; destination usshd { file("/var/log/sshd.$YEAR$MONTH" template("$DAY $HOUR:$MIN:$SEC $PROGRAM[$PID]: ($FROM_USER) $MSGONLY\n") template-escape(no)); }; log { source(local); filter(f_sshdu); destination(usshd); }; * Allows log messages from sshd as root and from sshd as a user to be distinguished * Further processing of the log can be assured of the authenticity of the message * No need to restrict access to /dev/log and lose otherwise useful logging Sample log: sshd[30955]: Connection from 0.0.0.0 port 0 sshd[30955]: Failed none for nobody from 0.0.0.0 port 0 ssh2 sshd[30955]: (nobody) Found matching DSA key: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 sshd[30955]: (nobody) Found matching DSA key: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 sshd[30955]: Accepted publickey for nobody from 0.0.0.0 port 0 ssh2 sshd[30957]: (nobody) Connection closed by 0.0.0.0 sshd[30957]: (nobody) Closing connection to 0.0.0.0 -- Simon Arlott

2 1

Log Server Check
by Hari Sekhon 22 Sep '07

22 Sep '07

Hi, A while ago I was looking for the best way to periodically check my Syslog-NG log server with a MySQL back end, and finding no great method, I wrote my own. It's been in production where I work for a few months now, so I recently decided to have a rewrite and then release it so that others can benefit. It is actually a Nagios plugin, but it can also be run from the command line or from cron or just as a one off to find out if your new Syslog-NG/MySQL log server is full working as expected. I have just released it on Nagios Exchange (GPL of course). It can be found here: http://www.nagiosexchange.org/Check_Plugins.21.0.html?&tx_netnagext_pi1[p_v… or just search nagiosexchange.org for "logserver", it's the only hit. As mentioned, you don't need Nagios to run this (Nagios is Excellent though, so if you aren't yet running it, I recommend that you try it out - I couldn't live without it now) It is flexible enough to test a log server via either TCP or UDP on any port, and to query a MySQL database either on the same host or another host for the log to make sure it has come through the whole logserver and been stored correctly. It should be flexible enough for use with any syslog implementation using a MySQL storage back end. I wrote this originally for the typical Syslog-NG / MySQL log server combination since the joining bit between Syslog-NG and MySQL can break and it is not easily testable without sending a log and checking if it actually comes through to the back end storage. It has actually happened to me a few times that the log server stack stopped working for one reason or another... I may consider adding support for file based or Oracle back end log servers if there is demand. For support, feedback, bug reports or feature requests, you can contact me at this address, hpsekhon(AT)googlemail.com. Regards, -h -- Hari Sekhon

1 0

ArcSight (Again)
by Ivey, Chris 21 Sep '07

21 Sep '07

OK folks, this has come up (again). Seems that the ArcSight parser is not intelligent enough to handle messages coming from syslog-ng after being forwarded along. So I need some advice on how to handle this issue. First, some background... I added our ArcSight server as a syslog-ng target some time ago. The folks who use the ArcSight stuff emailed me and said that the parser for ArcSight could not handle parsing the messages coming from syslog-ng, because of the prepending of the server time to the syslog-ng message. Here is an excerpt from one of the emails from their support folks: In looking through all the information, I see that there are lot of parsing issues, all due to what look like malformed syslog messages. For example: Apr 25 22:54:24 x.x.x.x router/router 99228: Apr 25 22:54:23.474 UTC: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on GigabitEthernet1/0/1 (not full duplex), with switch FastEthernet0/1 (full duplex). This is a raw event from the export. Notice that the second timestamp forward is the actual message, which is CDP, so from a cisco switch or some layer 2 device. The actual event from the cisco device should look like as follows, which is what our parser is designed to work with: Apr 25 22:54:23.474 UTC: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on GigabitEthernet1/0/1 (not full duplex), with switch FastEthernet0/1 (full duplex). Another excerpt... I looked over the information you had uploaded already, and is actually a common issue. When syslog events are forwarded from one syslog server to another syslog server, or pipe, or file, the forwarding syslog server prepends timestamp and other information, which makes the message unusable. We require syslog message to adhere to the standard RFC syslog format for the connector to read them, and when forwarding syslog messages that is not the case and we are unable to support that configuration. So, the question is what to do about it. I apparently need to send this information on to the ArcSight server without the prepended data (the "Apr 25 22:54:24 x.x.x.x router/router 99228:" portion of the message from the first email excerpt), but I need to keep it in place for EVERY other target I am sending to. Can anyone tell me what are my options here, please? Thanks a LOT in advance!!! (Bazsi, please feel free to chime in on this one! LOL) Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

3 3

there are many udp packet receive errors
by liuruihong 21 Sep '07

21 Sep '07

Eenvironment : > under linux > 1 central log-collecting server.syslog-ng 2 client: syslog sending logs to central log-collecting server. The syslog-ng server configuration: > options { use_dns(no); create_dirs(yes);ts_format(iso); }; > source src { udp(ip(0.0.0.0) port(514)); }; > > filter f_kern { facility(kern); }; > filter f_authpriv { facility(auth,authpriv); }; > filter f_mail { facility(mail); }; > filter f_cron { facility(cron); }; > filter f_boot { facility(local7); }; > filter f_spooler { facility(uucp, news) and level(crit..emerg); }; > filter f_messages { level(info..emerg) and not facility(authpriv, cron, mail); }; > destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH"); }; > destination authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); }; > destination mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); }; > destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); }; > destination boot{ file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); }; > destination spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); }; destination messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); }; > log { source(src); filter(f_kern); destination(kern); };> > log { source(src); filter(f_authpriv); destination(authpriv); };> > log { source(src); filter(f_mail); destination(mail); };> > log { source(src); filter(f_cron); destination(cron); };> > log { source(src); filter(f_boot); destination(boot); };> > log { source(src); filter(f_spooler); destination(spooler); }; > log { source(src); filter(f_messages); destination(messages); };> QUESTION: I used the syslog-ng to collect logs from about 1000 clients,while there are many udp packets receive erros: # netstat -su # Udp: 41200545 packets received 0 packets to unknown port received. 410733273 packet receive errors 21311935 packets sent I think it means many log sending by the client are not received by syslog-ng successfully, How can I resolve this problems?

3 4

whether udp source driver can set the max_connections() option?
by liuruihong 20 Sep '07

20 Sep '07

My syslog-ng 2.0.5 This is a source define in my configuration: source src { udp(ip(0.0.0.0) port(514) max_connections(100)); }; when running syslog-ng ,there is a error : syntax error

3 2