January 2008 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] Date and Host in Syslog Format Need Swapping
by infosec＠gmail.com 18 Jan '08

18 Jan '08

According to basic syslog message formatting rules the hostname in that message *is* indeed "2008", unfortunately. Either use bad_hostnames("2008") or set keep_hostnames() to no or false (or whatever the negative is) and use DNS to get the hostnames. To understand why "2008" is the hostname read the page called something like "about syslog" linked off the syslog-ng FAQ. -----Original Message----- From: <wiskbroom(a)hotmail.com> Subj: [syslog-ng] Date and Host in Syslog Format Need Swapping Date: Wed Jan 16, 2008 12:46 pm Size: 440 bytes To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Hello: I have an appliance that I've configured to send logs to syslog, but it is sending to a file named 2008.log instead of $FULLHOST.log None of the other logs that I am getting contain the year, but for some reason, this one is. Below is a sample of the log itself. Jan 16 15:31:06 2008 [192.168.100.1] Is it possible to ignore the YEAR and make output go to $FULLHOST.log ? Thank you, .vp --- attachment noname 1.txt ---

6 14

[Bug 16] New: program destination driver no longer sends TAG to STDIN in 2. 0.6
by bugzilla＠bugzilla.balabit.com 17 Jan '08

17 Jan '08

https://bugzilla.balabit.com/show_bug.cgi?id=16 Summary: program destination driver no longer sends TAG to STDIN in 2.0.6 Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: llarian(a)llarian.net Type of the Report: --- Estimated Hours: 0.0 After an upgrade from 1.6.11 to 2.0.6, it appears that the program destination driver no longer sends the priority/facility tag to stdout, despite the docs saying it transfers using the wire protocol of syslog. The following is the output of a perl script that does nothing but log stdin: Jan 15 15:46:57 192.168.105.10/206.208.46.253 10054: Jan 15 15:46:55.948 PST: %SYS-5-CONFIG_I: Configured from console by dylanv on vty0 (192.168.113.34) 1.6.11 prefixes this with the correct <45> output. Is this expected behavior and is there a way to get it to send the raw syslog packet to the program destination? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

Excessive Log Statistics
by Baxter, Scott 14 Jan '08

14 Jan '08

I apologize for this spam in advance as this may have been addressed in the past. How can I suppress the following frequent logging: syslog-ng[28465]: Log statistics; dropped='tcp(AF_INET(10.101.205.188:10514))=0', processed='center(queued)=179', processed='center(received)=44', processed='destination(d_auth)=0', processed='destination(d_cron)=42', processed='destination(d_mlal)=0', processed='destination(remote)=9', processed='destination(d_mlop)=0', processed='destination(d_mesg)=86', processed='destination(d_mlrt)=0', processed='destination(d_cons)=0', processed='destination(d_mail)=42', processed='source(s_sys)=44' Charles Schwab|T E C H N O L O G Y I N N O V A T I O N _____________________________________ Scott W Baxter Sr. Staff Phone: (602) 977-4565 UNIX Certification and Engineering Cell: 602-793-3909 Charles Schwab & Co., Inc. Phoenix Data Center 4750A E Francisco Dr. 01-435 Phoenix, Arizona 85044 scott.baxter(a)schwab.com Member:SIPC ________________________________________________ All email sent to this address will be received by the Charles Schwab & Co., Inc. corporate email system and is subject to archival and review by someone other than the recipient.

3 2

Re: [syslog-ng] Upgrade from 1.6.11 to 2.0.7: Gotchas?
by Ivey, Chris 14 Jan '08

14 Jan '08

Thanks, Bazsi! I was wondering if there is anything documented on the upgrade path, or if there is anything documented on the downgrade if the upgrade is not successful. I like to have documents to fall back on, when I try to do something for the first time. :o) Thanks!!! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Sunday, January 13, 2008 3:10 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Upgrade from 1.6.11 to 2.0.7: Gotchas? On Fri, 2008-01-11 at 08:03 -0600, Ivey, Chris wrote: > Folks, > I need to upgrade my syslog-ng from 1.6.11 to 2.0.7 since we > now are using devices with high resolution timestamps. As I inherited > these machines, and had not worked with syslog-ng prior to getting > them, I was wondering if anyone could let me know if there were any > gotchas for the upgrade. Can I upgrade in place? Do I need to make > backups of any files? Things of this nature. Thanks, all! > You can upgrade in place, the 2.0 version is upward compatible with 1.6.x, however as it is a complete rewrite, I'd suggest you to run the configuration file on a 2.0 first to see if it parses ok. Once the configuration file is processed by the new version then most probably it will work well. You can upgrade in place as if you encounter problems you can always go back to 1.6.x without pain. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

syslog-ng roadmap for 2.1 & 2.2
by Balazs Scheidler 13 Jan '08

13 Jan '08

Hi, I have published some details about our plans on syslog-ng 2.1 and 2.2 on my blog, please read this port for more details: http://bazsi.blogspot.com/2008/01/syslog-ng-roadmap-21-22.html As described there I'm going to open two syslog-ng OSE branches at about the same time: syslog-ng OSE 2.1: * destined to get the PE features that we decided to be open-sourced: SQL destination * no real development process as most changes are already released in the Premium Edition * once released, 2.0 is becoming a strict maintenance branch, nothing but bugfixes syslog-ng OSE 2.2: * developed in parallel with the PE version * the new features that we planned in the PE and we decided to open-source right from the start will be released in this branch, these are: * support for the new IETF syslog protocol * sequence numbering of messages * message parsing/rewriting I hope to get syslog-ng 2.1 out of the door real soon now, the git repository is already opened: http://git.balabit.hu/?p=bazsi/syslog-ng-2.1.git;a=summary I'm going to put together a "beta" release of syslog-ng OSE 2.1 in the nearfuture. I'm expecting syslog-ng 2.2 to be opened in the coming weeks, our plans are to release syslog-ng PE 2.2 in Q1-Q2 2008. -- Bazsi

1 0

Upgrade from 1.6.11 to 2.0.7: Gotchas?
by Ivey, Chris 13 Jan '08

13 Jan '08

Folks, I need to upgrade my syslog-ng from 1.6.11 to 2.0.7 since we now are using devices with high resolution timestamps. As I inherited these machines, and had not worked with syslog-ng prior to getting them, I was wondering if anyone could let me know if there were any gotchas for the upgrade. Can I upgrade in place? Do I need to make backups of any files? Things of this nature. Thanks, all! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

2 1

Re: [syslog-ng] SEC and syslog
by infosec＠gmail.com 11 Jan '08

11 Jan '08

I use the program destination because I log to files by date and sometimes a host system with a bad date screws things up. With program I'll see every message once and only once, see it right away and not have to worry about the pipe. I could see going with a pipe if you wanted to be able to restart syslog regularly (like if you had a mem leak or something), but program() is quick, reliable and easy. -----Original Message----- From: "Solis, Alex $EMC$" <axsolis(a)cps-ems.com> Subj: [syslog-ng] SEC and syslog Date: Thu Jan 10, 2008 8:30 am Size: 873 bytes To: <syslog-ng(a)lists.balabit.hu> I have been using syslog-ng and logdog.pl (http://caspian.dotconf.net/menu/Software/LogDog/) for quite some time but now want to move to SEC because of its thresholding and suppression features. I noticed that SEC can monitor files and does not necessarily need a FIFO pipe. I also noticed that syslog-ng can send logs directly to a program using the program() feature. My question is which is the best way to implement the syslog-ng to SEC conduit? Should I create a pipe and ask SEC to monitor that because its efficient? Should I simply ask SEC to monitor syslog-ng's destination file even though files are rotated every night? Or should I use syslog-ng's program() feature to send messages to SEC. I guess all will work but which is the best option. Thanks for any insight. Alex --- attachment noname 1.html --- --- message truncated ---

3 2

SEC and syslog
by Solis, Alex (EMC) 10 Jan '08

10 Jan '08

I have been using syslog-ng and logdog.pl (http://caspian.dotconf.net/menu/Software/LogDog/) for quite some time but now want to move to SEC because of its thresholding and suppression features. I noticed that SEC can monitor files and does not necessarily need a FIFO pipe. I also noticed that syslog-ng can send logs directly to a program using the program() feature. My question is which is the best way to implement the syslog-ng to SEC conduit? Should I create a pipe and ask SEC to monitor that because its efficient? Should I simply ask SEC to monitor syslog-ng's destination file even though files are rotated every night? Or should I use syslog-ng's program() feature to send messages to SEC. I guess all will work but which is the best option. Thanks for any insight. Alex

1 0

make fails with syslog-ng 2.0.6 --enable-source-spoof
by David Rice 08 Jan '08

08 Jan '08

I'm having problems with the make when installing syslog-ng 2.0.6 on Solaris 10 x86 The error is the following *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /tmp/syslog- ng-2.0.6/src *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src tests doc contrib solbuild tgzbuild'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /tmp/syslog-ng-2.0.6 *** Error code 1 make: Fatal error: Command failed for target `all' I'm using the following for the config script ./configure --enable-spoof-source --enable-dynamic-linking CC=gcc LDFLAGS=-L/usr/local/lib I need the -enable-spoof-source to pass to another syslog device upstream. Thanks in advance for the help

2 4

syslog-ng 2.0.7 has been released
by devel＠balabit.hu 08 Jan '08

08 Jan '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.7 SUMMARY : new stable release DATE : Jan 8, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.7) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.7 Thu, 03 Jan 2008 07:01:59 +0100 Bugfixes: * Fixed UNIX domain socket destinations on Solaris. * Fixed flow-control behaviour for follow-mode source files. * Added the "mark" keyword to be an alias of "mark_freq" for compatibility with syslog-ng 1.6. * Fixed message loss in destination files during configuration reloads if syslog-ng is heavily loaded. * Fixed a possible segmentation fault in the dns-cache-host() file parsing code for improperly formatted host files. * Fixed possible "Insufficient buffer space" errors in the STREAMS driver. * Fixed the starvation of the timer used to reap unused destination files, which could cause some files never to be closed under heavy load. * Fixed ISO timestamp parsing for timestamps that have no timezone information or have a too long fraction of a second portion. * Added a workaround for possible deadlocks on /proc/kmsg and user terminals. * Fixed program name parsing that caused problems for TAG values that include the '/' character. This problem was introduced by 2.0.6. Other changes: * The fsync() option was implemented. * Added support for file sources that do not exist at startup. * Added support the "--persist-file" configuration option. * Added support for timestamps used by some LinkSys routers. * Added loggen tool to generate syslog messages at the specified rate. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

1 0