September 2007 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] Compiling on HP/UX 11.11
by C Wells 13 Sep '07

13 Sep '07

This glib listed below worked fine (thanks), but then it asked for eventlog version >= 0.2, which I found at balabit and installed and then it asked for libnet, for which I found the binary, so finally the configure worked. Make asked for flex, which I had renamed because it made configure die. I put flex back and it passed that point but dies on this gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -L/usr/local/lib -lglib-2.0 -lintl -liconv -L/usr/local/lib -levtlog -lnet /usr/ccs/bin/ld: Unsatisfied symbols: linenum (first referenced in libsyslog-ng.a(cfg-grammar.o)) (data) lookup_parse_flag (first referenced in libsyslog-ng.a(cfg-grammar.o)) (code) strtoll (first referenced in libsyslog-ng.a(affile.o)) (code) yylex (first referenced in libsyslog-ng.a(cfg-grammar.o)) (code) lex_init (first referenced in libsyslog-ng.a(cfg.o)) (code) collect2: ld returned 1 exit status Do I need another copy of ld ? Am I closer or further away ? Thanks ============================================== IIRC there's a glib 2.12.x package on the Utah site, which should be fine. http://hpux.connect.org.uk/hppd/hpux/Gtk/Development/glib2-2.12.13/ We have binaries for HP-UX (PA-RISC), but it is a service that we offer for an annual fee. ____________________________________________________________________________________ Need a vacation? Get great deals to amazing places on Yahoo! Travel. http://travel.yahoo.com/

2 1

Re: [syslog-ng] syslog-ng Digest, Vol 28, Issue 21
by Wilson Lai 12 Sep '07

12 Sep '07

Dear all, What happen if the log message is not a standard syslog message? Thanks. Regards, Wilson Lai System Engineer IT Dept., SJM Office ( : (853)2978585 Mobile ( : (853)66506709 Email +: : wilsonlai(a)macausjm.com -----Original Message----- From: syslog-ng-request(a)lists.balabit.hu [mailto:syslog-ng-request@lists.balabit.hu] Sent: Friday, August 17, 2007 3:45 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 28, Issue 21 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. new syslog-ng white paper published (Balazs Scheidler) 2. Buffer Overflow : Insufficient buffer space for retrieving STREAMS log message; res='2' ( Nicolas de Marqu? - Fromentin ) 3. REGEX rewrites on packet body possible? (Eli Stair) 4. Re: Buffer Overflow : Insufficient buffer space for retrieving STREAMS log message; res='2' (Russell Fulton) 5. Re: Logging Third party application logs to Syslog-NG (Wilson Lai) 6. Re: Buffer Overflow : Insufficient buffer space for retrieving STREAMS log message; res='2' (Balazs Scheidler) 7. Re: REGEX rewrites on packet body possible? (Balazs Scheidler) 8. Re: Logging Third party application logs to Syslog-NG (Balazs Scheidler) ---------------------------------------------------------------------- Message: 1 Date: Thu, 16 Aug 2007 16:58:31 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: [syslog-ng] new syslog-ng white paper published To: syslog-ng(a)lists.balabit.hu Message-ID: <1187276311.7565.52.camel(a)bzorp.balabit> Content-Type: text/plain Dear all, We have published a new, syslog-ng related white paper on our website titled: "Distributed syslog architectures with syslog-ng" It basically contains the various deployment scenarios, their pros and cons we've encountered in our experience. It does contain information on syslog-ng Premium Edition, but still we tried to concentrate on the technical content, and some of it equally applies to syslog-ng OSE. We'd appreciate feedback at documentation(a)balabit.com. Thanks. -- Bazsi ------------------------------ Message: 2 Date: Thu, 16 Aug 2007 18:40:03 +0200 From: " Nicolas de Marqu? - Fromentin " <nicolas.demarque(a)gmail.com> Subject: [syslog-ng] Buffer Overflow : Insufficient buffer space for retrieving STREAMS log message; res='2' To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Message-ID: <b778b3cc0708160940y50d0dfb4yc84f86dffa4efc6a(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hello, During a big flow from a local server to a central server, we have a "buffer overflow" on the local server. After this message, syslog-ng is crash and don't be capable to send any messages. The local server is a solaris 10 product, the central linux a redhat EL4. Do you know a rule to stop this problem Best regard, Nicolas

3 2

Frances Wand/Poughkeepsie/IBM is out of the office.
by Frances Wand 10 Sep '07

10 Sep '07

I will be out of the office starting 09/10/2007 and will not return until 09/17/2007. Please contact Suzanne Mahoney/Boulder/IBM@IBMUS for DataPower project questions, and Murugesan Natarajan/India/IBM@IBMIN for any AWStats questions. Please call my cell phone listed in blue page for urgent issues. Thank you!

1 0

Logs from Nauticus
by Delphine D 10 Sep '07

10 Sep '07

Hello, Is there someone here having some knowledge of how to send logs from Nauticus (Sun Secure Application Switch Manager N2120) to syslog-ng ? I receive the logs on the centralized logs server but without any information about the source of the logs (no IP, no hostname). In other words : Sep 7 14:03:29 2007 v0 AAA [0/100e8] [ERROR]: User authentication failure, user: 'test', host: 1.2.3.4, application: httpLogin, method: TACACS(serviceNotAvailable) serviceNotAvailable instead of : Sep 7 14:03:29 2007/nauticus.ourdomain.be v0 AAA [0/100e8] [ERROR]: User authentication failure, user: 'test', host: 1.2.3.4, application: httpLogin, method: TACACS(serviceNotAvailable) serviceNotAvailable Is there a paramater to change in the N2120 ? Thank you very much. _________________________________________________________________ A la recherche d'un ami d'enfance ? Peut-être est-il dans la liste d'amis de vos amis ! http://spaces.live.com/default.aspx?page=Ed01&ss=True

2 4

Re: [syslog-ng] syslog-ng Digest, Vol 29, Issue 7
by Wilson Lai 10 Sep '07

10 Sep '07

Dear Nate, As your words, there will be no solution to standardize the log format! Thanks for your reply! Regards, Wilson Lai System Engineer IT Dept., SJM Office ( : (853)2978585 Mobile ( : (853)66506709 Email +: : wilsonlai(a)macausjm.com -----Original Message----- From: syslog-ng-request(a)lists.balabit.hu [mailto:syslog-ng-request@lists.balabit.hu] Sent: Saturday, September 08, 2007 6:00 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 29, Issue 7 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Logs from Nauticus (Delphine D) 2. Re: Hostname instead of FQDN in logs (Nate Campi) 3. Re: syslog-ng Digest, Vol 28, Issue 21 (Nate Campi) 4. Re: Logs from Nauticus (Nate Campi) 5. Re: Logs from Nauticus (Delphine D) 6. Re: Logs from Nauticus (Nate Campi) 7. Re: How to "drop" a message, effectively skipping further processing and not logging it? (Eli Stair) ---------------------------------------------------------------------- Message: 1 Date: Fri, 07 Sep 2007 15:18:27 +0200 From: "Delphine D" <delphined_1300(a)hotmail.com> Subject: [syslog-ng] Logs from Nauticus To: syslog-ng(a)lists.balabit.hu Message-ID: <BLU106-F41DCA93C3393AA7FA06E78E1C50(a)phx.gbl> Content-Type: text/plain; charset=iso-8859-1; format=flowed Hello, Is there someone here having some knowledge of how to send logs from Nauticus (Sun Secure Application Switch Manager N2120) to syslog-ng ? I receive the logs on the centralized logs server but without any information about the source of the logs (no IP, no hostname). In other words : Sep 7 14:03:29 2007 v0 AAA [0/100e8] [ERROR]: User authentication failure, user: 'test', host: 1.2.3.4, application: httpLogin, method: TACACS(serviceNotAvailable) serviceNotAvailable instead of : Sep 7 14:03:29 2007/nauticus.ourdomain.be v0 AAA [0/100e8] [ERROR]: User authentication failure, user: 'test', host: 1.2.3.4, application: httpLogin, method: TACACS(serviceNotAvailable) serviceNotAvailable Is there a paramater to change in the N2120 ? Thank you very much. _________________________________________________________________ A la recherche d'un ami d'enfance ? Peut-?tre est-il dans la liste d'amis de vos amis ! http://spaces.live.com/default.aspx?page=Ed01&ss=True ------------------------------ Message: 2 Date: Fri, 7 Sep 2007 07:24:03 -0700 From: Nate Campi <nate(a)campin.net> Subject: Re: [syslog-ng] Hostname instead of FQDN in logs To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <20070907142403.GB6166(a)campin.net> Content-Type: text/plain; charset=us-ascii On Fri, Sep 07, 2007 at 10:53:54AM +0200, Delphine D wrote: > > The others also return the hostname and not the FQDN (Ex : 'server2' and not > 'server2.ourdomain.be') but they are using syslog instead of syslog-ng... > That's the only difference... Then it's because this host sends the hostname in the syslog message (syslog-ng always has a full and complete syslog message on the wire), but the boxes using syslogd don't actually send a hostname. A message on your central syslog-ng server from a Linux box running syslogd will be written to disk something like: Sep 7 07:16:20 hostname in.qpopper[7736]: connect from 12.12.12.12 ...but on the wire it looks like this: <13>in.qpopper[7736]: connect from 12.12.12.12 ...and syslog-ng has to put in the rest of the info. This means that syslog-ng on the central box is putting in the FQDN for you. syslog-ng on the client is putting in a full message, including the short hostname, and the central syslog-ng is keeping it. See http://www.campin.net/syslog-ng/syslog.html#missing_parts for more on this. See http://www.campin.net/syslog-ng/faq.html#hostname to figure out the hostname options you want on your central syslog-ng server. Probably "keep_hostname(no)", plus "use_fqdn(yes);" to get the FQDN. HTH, -- Nate Like medieval peasants, computer manufacturers and millions of users are locked in a seemingly eternal lease with their evil landlord, who comes around every two years to collect billions of dollars of taxes in return for mediocre services. --Mark Harris, Electronics Times ------------------------------ Message: 3 Date: Fri, 7 Sep 2007 07:26:12 -0700 From: Nate Campi <nate(a)campin.net> Subject: Re: [syslog-ng] syslog-ng Digest, Vol 28, Issue 21 To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <20070907142612.GC6166(a)campin.net> Content-Type: text/plain; charset=us-ascii On Fri, Sep 07, 2007 at 05:26:02PM +0800, Wilson Lai wrote: > Dear all, > What happen if the log message is not a standard syslog message? > Thanks. If a Cisco switch sends a message like this: 2005 Aug 23 03:04:05 UTC +00:00 %PAGP-5-PORTFROMSTP:Port 4/16 left bridge port 4/16 ...it'll be written to disk like this: Aug 23 03:04:05 switch.company.com 2005 Aug 23 03:04:05 UTC +00:00 %PAGP-5-PORTFROMSTP:Port 4/16 left bridge port 4/16 syslog servers put in a proper syslog formatted header. The behavior is documented here: http://www.faqs.org/rfcs/rfc3164.html It's not syslog-ng specific behavior. -- Nate "The IBM compatible sector has not yet recognized that 95% of computer usage is devoted to experimenting with different fonts and character styles in documents." - Reiner, Ron ------------------------------ Message: 4 Date: Fri, 7 Sep 2007 07:35:54 -0700 From: Nate Campi <nate(a)campin.net> Subject: Re: [syslog-ng] Logs from Nauticus To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <20070907143554.GD6166(a)campin.net> Content-Type: text/plain; charset=us-ascii On Fri, Sep 07, 2007 at 03:18:27PM +0200, Delphine D wrote: > > I receive the logs on the centralized logs server but without any > information about the source of the logs (no IP, no hostname). > > In other words : > > Sep 7 14:03:29 2007 v0 AAA [0/100e8] [ERROR]: User authentication failure, > user: 'test', host: 1.2.3.4, application: httpLogin, method: > TACACS(serviceNotAvailable) serviceNotAvailable > > instead of : > > Sep 7 14:03:29 2007/nauticus.ourdomain.be v0 AAA [0/100e8] [ERROR]: User > authentication failure, user: 'test', host: 1.2.3.4, application: httpLogin, > method: TACACS(serviceNotAvailable) serviceNotAvailable > > Is there a paramater to change in the N2120 ? Those aren't standard syslog messages, and it's possible that paired with how Solaris sends a header but not a hostname, syslog-ng could be getting confused about this. You should send your "options" part of your syslog-ng.conf, and read http://www.campin.net/syslog-ng/syslog.html to see if it helps you understand what the messages look like on the wire and how syslog-ng makes it's best guesses about what the fields mean. Something similar is the reason for the "bad_hostname" option, but that's for when program names look like hostnames. You have a header section that looks like a hostname, but I'm not sure if you have a keep_hostname(no) that's stripping out your hostname from that weird header section that looks like syslog-ng's "chain_hostnames". So send your options to the list, try setting keep_hostname(yes), or see if you can force a normal syslog format on the client side. What they're sending is wrong in a new way that isn't worked around in syslog-ng (AFAIK). -- Nate "Reader, suppose you were an idiot. And suppose you were a member of Congress. But I repeat myself." - Samuel Clemens ------------------------------ Message: 5 Date: Fri, 07 Sep 2007 16:47:31 +0200 From: "Delphine D" <delphined_1300(a)hotmail.com> Subject: Re: [syslog-ng] Logs from Nauticus To: syslog-ng(a)lists.balabit.hu Message-ID: <BLU106-F26C91524EFE7580500E939E1C50(a)phx.gbl> Content-Type: text/plain; charset=iso-8859-1; format=flowed >On Fri, Sep 07, 2007 at 03:18:27PM +0200, Delphine D wrote: > > > > I receive the logs on the centralized logs server but without any > > information about the source of the logs (no IP, no hostname). > > > > In other words : > > > > Sep 7 14:03:29 2007 v0 AAA [0/100e8] [ERROR]: User authentication >failure, > > user: 'test', host: 1.2.3.4, application: httpLogin, method: > > TACACS(serviceNotAvailable) serviceNotAvailable > > > > instead of : > > > > Sep 7 14:03:29 2007/nauticus.ourdomain.be v0 AAA [0/100e8] [ERROR]: >User > > authentication failure, user: 'test', host: 1.2.3.4, application: >httpLogin, > > method: TACACS(serviceNotAvailable) serviceNotAvailable > > > > Is there a paramater to change in the N2120 ? > >Those aren't standard syslog messages, and it's possible that paired >with how Solaris sends a header but not a hostname, syslog-ng could be >getting confused about this. You should send your "options" part of your >syslog-ng.conf, and read http://www.campin.net/syslog-ng/syslog.html to >see if it helps you understand what the messages look like on the wire >and how syslog-ng makes it's best guesses about what the fields mean. > >Something similar is the reason for the "bad_hostname" option, but >that's for when program names look like hostnames. You have a header >section that looks like a hostname, but I'm not sure if you have a >keep_hostname(no) that's stripping out your hostname from that weird >header section that looks like syslog-ng's "chain_hostnames". > >So send your options to the list, try setting keep_hostname(yes), or see >if you can force a normal syslog format on the client side. What they're >sending is wrong in a new way that isn't worked around in syslog-ng >(AFAIK). Thank you Nate for your help. Here is the syslog-ng.conf from my logs server : options { create_dirs(yes); dir_perm(0705); dir_owner(root); perm(0600); owner(root); sync(0); check_hostname(no); use_fqdn(yes); use_dns(yes); dns_cache(yes); dns_cache_expire(604800); dns_cache_size(400); stats(60); keep_hostname(yes); chain_hostnames(yes); }; I'm not sure that we've the ability to change something in the Nauticus. There is no Syslog or Syslog-ng running on it. There is no configuration files like in "normal" servers (Linux, Solaris,...). There is only a parameters section in the GUI, where you have to configure : - SysLog Host --> IP of the logs server - Syslog Port --> 514 - Filter --> defaultSyslog (by default) - Facility --> local0, local1,.... or local7 But I don't find anything about hostname. The strangest thing is that it was working fine a few weeks ago but it has suddenly stopped working :-( Thanks. _________________________________________________________________ Saviez-vous que Windows Live Messenger est disponible d?s maintenant sur votre GSM ? http://get.live.com/messenger/mobile ------------------------------ Message: 6 Date: Fri, 7 Sep 2007 08:59:05 -0700 From: Nate Campi <nate(a)campin.net> Subject: Re: [syslog-ng] Logs from Nauticus To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <20070907155905.GF6166(a)campin.net> Content-Type: text/plain; charset=us-ascii On Fri, Sep 07, 2007 at 04:47:31PM +0200, Delphine D wrote: > > Thank you Nate for your help. > > Here is the syslog-ng.conf from my logs server : > > options { create_dirs(yes); <snip> > chain_hostnames(yes); > }; Try chain_hostnames(no). No matter what, you're dealing with a bad format that's close enough to a good one to make syslog-ng guess incorrectly. This isn't the fault of syslog-ng, just a result of the imperfect world we live in. > I'm not sure that we've the ability to change something in the Nauticus. > There is no Syslog or Syslog-ng running on it. There is no configuration > files like in "normal" servers (Linux, Solaris,...). > > There is only a parameters section in the GUI, where you have to configure : > > - SysLog Host --> IP of the logs server > - Syslog Port --> 514 > - Filter --> defaultSyslog (by default) > - Facility --> local0, local1,.... or local7 Any other options? Any other Filter options, specifically? I've actually run perl-based syslog proxy code I wrote to work around really crappy syslog formats. The bad_hostname option came as a result of me bitching about the bad formats loudly enough and long enough. :) ISTR that syslog-ng 2.0 now has some rewriting ability. I haven't been paying much attention to that branch, you should probably read up on it. Possible that it's only in the dev branch - like I said I haven't been paying much attention. > But I don't find anything about hostname. > > The strangest thing is that it was working fine a few weeks ago but it has > suddenly stopped working :-( Somebody changed either the syslog-ng server or your client. Maybe not even configs, but version upgrade on the client perhaps. -- Nate An Emacs reference mug is what I want. It would hold ten gallons of coffee. -- Steve VanDevender And, no doubt, have a lid that could only be removed with an obscure finger combination requiring both hands. (Ctrl-Alt-Meta-X gimme-the-damn-coffee) -- William Beegle ------------------------------ Message: 7 Date: Fri, 07 Sep 2007 14:39:26 -0700 From: Eli Stair <estair(a)ilm.com> Subject: Re: [syslog-ng] How to "drop" a message, effectively skipping further processing and not logging it? To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <46E1C50E.9060405(a)ilm.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Geller, Sandor (IT) wrote: > Hello, > > > Is there any way other than this to keep a message from being > > sent to another > > host or a file? If not, is there any way to tell syslog-ng > > NOT to modify the > > state of a file, just to send data TO it? That, or an > > internal "drop" > > stop-processing built-in destination would be extremely useful. > > Simply remove all destinations from the log section and use > flags(final) will do the trick. > Don't I feel daft... I recall trying that a couple years ago, but had errors I don't seem to have resolved before deciding to just write to /dev/null. I must've botched the syntax and thought that you HAD to have a destination in a log line! Thanks for the suggestion. Cheers, /eli ------------------------------ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng End of syslog-ng Digest, Vol 29, Issue 7 ****************************************

1 0

How to "drop" a message, effectively skipping further processing and not logging it?
by Eli Stair 07 Sep '07

07 Sep '07

In the cases where there are frequent messages that are known to be trivial and not desired to be seen, I have always dumped them to a "/dev/null" rule like this below on the sender. I would really like to get rid of the modification of /dev/ file permissions, as I find it the opposite of good security to have the syslog daemon modifying files that need to be accessible for many things to work right. This also clashes with things like udev and cfengine, which exist TO properly set perms and maintain files. Is there any way other than this to keep a message from being sent to another host or a file? If not, is there any way to tell syslog-ng NOT to modify the state of a file, just to send data TO it? That, or an internal "drop" stop-processing built-in destination would be extremely useful. Existing things I've tried (/dev/null and fake localhost UDP target)and problems I'm having with them, any suggested workarounds? ( clients running syslog-ng 1.6.5 ) ### conf: destination null { file("/dev/null" owner(root) group(root) perm(0666) dir_perm(0666) create_dirs(no)); }; log { source(src); filter(f_getty_serial_err); destination(null); flags(final); }; # error: 2007-09-06T12:21:33-07:00 hostname [syslog.err] syslog-ng[9467]: Changing permissions on special file /dev/null ### This requires setting the perms correctly, since syslog-ng INSISTS for "security reasons" on modifying/setting the perms of any file it writes to.. and so I write drop rules for the "Changing permissions on special file" errors :) I've tried to work around this by logging to a localhost UDP blackhole that should avoid this, but am having issues with that: ### conf: destination net-blackhole { udp("127.0.0.1" port(666) localip(127.0.0.1)); }; log { source(src); filter(f_getty_serial_err); destination(net-blackhole); flags(final); }; # error: 2007-09-06T13:18:00-07:00 deathstar1401 [syslog.err] syslog-ng[25010]: io.c: do_write: write() failed (errno 111), Connection refused 2007-09-06T13:18:00-07:00 deathstar1401 [syslog.err] syslog-ng[25010]: Connection broken to AF_INET(127.0.0.1:666), reopening in 60 seconds ### pcap: 13:14:59.404524 IP (tos 0x0, ttl 64, id 31643, offset 0, flags [DF], length: 110) 127.0.0.1.51170 > 127.0.0.1.666: [bad udp cksum dfe5!] UDP, length: 82 13:15:59.855390 IP (tos 0x0, ttl 64, id 46755, offset 0, flags [DF], length: 110) 127.0.0.1.51230 > 127.0.0.1.666: [bad udp cksum a8e4!] UDP, length: 82 13:16:59.658501 IP (tos 0x0, ttl 64, id 61705, offset 0, flags [DF], length: 110) 127.0.0.1.51237 > 127.0.0.1.666: [bad udp cksum 9be4!] UDP, length: 82 ### It looks from the error like syslog-ng thinks it is using TCP... since UDP syslog has no connection/handshake at either the IP or application protocol level I don't know why it is having any connection errors. The packets are being successfully sent, and a netcat listen shows that they're perfect... Even an ICMP PORT UNREACHABLE shouldn't have any effect on the sending process. Any thoughts on what's going on here? Thanks, /eli

2 2

Hostname instead of FQDN in logs
by Delphine D 07 Sep '07

07 Sep '07

Hello, We've configured a centralized logs server (Solaris 10) in order to collect and manage all log messages coming from +/- 100 servers (Solaris, Linux,...). For an unknown reason, the logs coming from one of our server (Debian) are coming in the following format on the log server : Sep 7 10:08:37 server1 PAM_unix[6142]: authentication failure; (uid=0) -> delphine for ssh service As you can see, we only receive the hostname (server1) but not the FQDN of this server (server1.ourdomain.be). For all the other servers, we have the FQDN in the logs. Here is an example with server2.ourdomain.be (Debian) : Sep 7 10:11:01 server2.ourdomain.be/server2.ourdomain.be PAM_unix[27542]: authentication failure; (uid=0) -> delphine for ssh service The only difference between server1 and the other ones is that it uses syslog-ng instead of syslog in order to send its logs. Here are the options used in the configuration files. 1° On the log server options { create_dirs(yes); dir_perm(0705); dir_owner(root); perm(0600); owner(root); sync(0); check_hostname(no); use_fqdn(yes); use_dns(yes); dns_cache(yes); dns_cache_expire(604800); dns_cache_size(400); stats(60); keep_hostname(yes); chain_hostnames(yes); }; 2° On server1 options { use_fqdn(yes); use_dns(yes); keep_hostname(yes); chain_hostnames(no); long_hostnames(no); sync(0); }; 3° On server2 we are using syslog instead syslog-ng Any idea ? Thanks. _________________________________________________________________ Grand passioné ? Rassemblez tout ce qui vous intéresse en un seul endroit ! http://get.live.com/live/features

3 3

forwarding to server
by Chris Harner 06 Sep '07

06 Sep '07

Hello everyone! I have a Cacti Server with the Haloe plugin installed. I can get my Windows boxes to talk to the Haloe plugin (syslogs). I have two old servers (running SLES 9 I think) with syslogd installed, reporting in just fine! Here is my issue - I can't figure out how to pipe or forward the data from the box to the syslogs server (Cacti). For those of you who do not know, Cacti is a network monitoring tool/RRDtool front end with a ton of available plugins. Haloe is a centralized syslog server. Thanks! -- Chris Harner [] Server Engineer [] Arnold Transportation Services

5 12

Compiling on HP/UX 11.11
by C Wells 05 Sep '07

05 Sep '07

Is there any difference between trying to compile syslog-ng on HP/UX 11.11 and beating your head against the wall until it bleeds ? I've loaded glib, flex, and many other things it complains about. Even after loading flex, flex can't find what it needs, even after I link the lib it is looking for. So I rename flex so it won't use it, then it chokes on glib, not high enough version. No glib on the Univ of Utah site, so I try to compile and then get lost down that trail of tears. Amazing, who has done it ? May I kiss your feet. Will you accept tithing ? Seriously how can you get this to work on hp/ux (open source version). Thanks ____________________________________________________________________________________ Boardwalk for $500? In 2007? Ha! Play Monopoly Here and Now (it's updated for today's economy) at Yahoo! Games. http://get.games.yahoo.com/proddesc?gamekey=monopolyherenow

2 1

syslog-ng and OpenBSD 4.1
by mailing list 04 Sep '07

04 Sep '07

Anyone has documents and/or information on syslog-ng 2.0.x installation on an OpenBSD 4.1 system? Please forward links, text, docs, etc. I've searched the web and comes up only with OpenBSD 3.5 and older version of syslog-ng (1.5). There's a syslog-ng package for OpenBSD 4.1, but it's 1.6.8. This OpenBSD system will be a syslog-ng client, which will forward the logs to a server (Solaris). The docs at http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/bk01-toc.html deals with package installation. Is there a doc showing installation from source? or is it simply "make" and "make install" and that's it? Thank you. -- Mike ____________________________________________________________________________________ Sick sense of humor? Visit Yahoo! TV's Comedy with an Edge to see what's on, when. http://tv.yahoo.com/collections/222

1 0