February 2008 - syslog-ng - lists.balabit.hu

[Bug 12] New: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=87927
by bugzilla＠bugzilla.balabit.com 08 Feb '08

08 Feb '08

https://bugzilla.balabit.com/show_bug.cgi?id=12 Summary: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=87927 Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=87927 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I'd like to be able to include a log source within another log source, e.g.: source local { internal(); unix-stream("/dev/log"); }; source all { source("local"); udp(ip(1.2.3.4) port(514)); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

New 2.0.8 abort with use_dns(persist_only);
by Marc Wiatrowski 08 Feb '08

08 Feb '08

I had been running 2.0.7 fine. When I install and start the new 2.0.8 version I get the following error and fails to actually start if I use the the options use_dns(persist_only); and dns_cache_hosts(/etc/hosts); Syslog connection established; from='AF_INET(0.0.0.0:0)', to='AF_INET(192.168.176.3:514)' syslog-ng starting up; version='2.0.8' Incoming log entry; line='<134>id=firewall sn=00XXXXXXXX time="2008-02-05 08:34:52" fw=1.1.1.1 pri=6 c=1024 m=98 n=133049021 src=192.168.184.83:25753:HomePort proto=icmp/8 rcvd=52 \x0d\x0a' file dnscache.c: line 100 (dns_cache_key_hash): should not be reached Abort With the use_dns(no); option it runs fine. bug? thanks, marc

2 3

syslog-ng doesn't log anything with local configuration
by Uwe Galle 08 Feb '08

08 Feb '08

Hi, I am using openSUSE 10.3 with syslog-ng 1.6.12-33 with the following configuration file: # source s_file { internal(); }; destination d_file { file("/home/uga/Daten/system/system.msg"); }; log { source(s_file); destination(d_file); }; You see, it's really simple. ls -l displays for the file: -rw-rw-rw- 1 root root 0 2008-02-07 22:03 system.msg So system.msg is writable for all. But nothing is logged to the file, even after restart. The FAQ mentions a similar case (http://www.campin.net/syslog-ng/faq.html#dupe_sources) but the problem here are clearly duplicate sources in the directives. This is not the case here. Any ideas are very welcome. Thanks

3 3

syslog-ng & rewrite
by Balazs Scheidler 08 Feb '08

08 Feb '08

Hi, I've written a long blog post about my intentions regarding the rewriting functionality in syslog-ng. If you were interested in the anonimizing patches, be sure to check out. Also, the URL of my blog has changed, the old one redirects to the new one, but please update your bookmarks. The new address is: http://bazsi.blogs.balabit.com/ The RSS feed has not changed. -- Bazsi

1 0

Syslog-ng via TCP socket
by Lathrop_Steve＠emc.com 08 Feb '08

08 Feb '08

I don't see a similar issue in the archives and I went back to August 2006... I am trying to send a message following RFC3164 to a syslog-ng daemon reading from port 601 on a SLES-10 Linux machine. The format of the message is: <64>Feb 7 16:42:03 c4dev-lathrs1 TAG: smlSocket Test TCP syslog buffer msg The reason for me to send the message is to understand whether the message was delivered (not necessarily written to disk). When I send the message to a UDP port (514) on the machine, I can see the message just fine. When I send the exact same message to the TCP port, I see the receipt processing (via strace), but nothing shows up in the /var/log/messages file. The version of syslog-ng is 1.6.8 according to what is in /var/log/messages Any suggestions? The /etc/services file references 601 as being syslog-conn for both tcp and udp syslog-conn 601/tcp # Reliable Syslog Service syslog-conn 601/udp # Reliable Syslog Service The remote config file is: # # /etc/syslog-ng/syslog-ng.conf # # Automatically generated by SuSEconfig on Thu Feb 7 12:00:53 EST 2008. # # PLEASE DO NOT EDIT THIS FILE! # # you can modify /etc/syslog-ng/syslog-ng.conf.in instead # # # # File format description can be found in syslog-ng.conf(5) # and /usr/share/doc/packages/syslog-ng/syslog-ng.txt. # # # Global options. # options { long_hostnames(off); sync(0); perm(0640); stats(3600); }; # # 'src' is our main source definition. you can add # more sources driver definitions to it, or define # your own sources, i.e.: # #source my_src { .... }; # source src { # # include internal syslog-ng messages # note: the internal() soure is required! # internal(); # # the following line will be replaced by the # socket list generated by SuSEconfig using # variables from /etc/sysconfig/syslog: # unix-dgram("/dev/log"); # # uncomment to process log messages from network: # udp(ip("0.0.0.0") port(514)); tcp( ip("0.0.0.0") port(601) keep-alive(yes) ); }; # # Filter definitions # filter f_iptables { facility(kern) and match("IN=") and match("OUT="); }; filter f_console { level(warn) and facility(kern) and not filter(f_iptables) or level(err) and not facility(authpriv); }; filter f_newsnotice { level(notice) and facility(news); }; filter f_newscrit { level(crit) and facility(news); }; filter f_newserr { level(err) and facility(news); }; filter f_news { facility(news); }; filter f_mailinfo { level(info) and facility(mail); }; filter f_mailwarn { level(warn) and facility(mail); }; filter f_mailerr { level(err, crit) and facility(mail); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_local { facility(local0, local1, local2, local3, local4, local5, local6, local7); }; filter f_acpid { match('^\[acpid\]:'); }; filter f_netmgm { match('^NetworkManager:'); }; filter f_messages { not facility(news, mail) and not filter(f_iptables); }; filter f_warn { level(warn, err, crit) and not filter(f_iptables); }; filter f_alert { level(alert); }; filter f_smlInfoNotice { level(info...notice); }; filter f_smlFacility { filter(f_local) and facility(user) and facility(auth) and facility(authpriv); }; filter f_smlCrit { level(crit); }; # # Most warning and errors on tty10 and on the xconsole pipe: # destination console { file("/dev/tty10" group(tty) perm(0620)); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole" group(tty) perm(0400)); }; log { source(src); filter(f_console); destination(xconsole); }; # Enable this, if you want that root is informed immediately, # e.g. of logins: # #destination root { usertty("root"); }; #log { source(src); filter(f_alert); destination(root); }; # # News-messages in separate files: # destination newscrit { file("/var/log/news/news.crit" owner(news) group(news)); }; log { source(src); filter(f_newscrit); destination(newscrit); }; destination newserr { file("/var/log/news/news.err" owner(news) group(news)); }; log { source(src); filter(f_newserr); destination(newserr); }; destination newsnotice { file("/var/log/news/news.notice" owner(news) group(news)); }; log { source(src); filter(f_newsnotice); destination(newsnotice); }; # # and optionally also all in one file: # (don't forget to provide logrotation config) # #destination news { file("/var/log/news.all"); }; #log { source(src); filter(f_news); destination(news); }; # # Mail-messages in separate files: # destination mailinfo { file("/var/log/mail.info"); }; log { source(src); filter(f_mailinfo); destination(mailinfo); }; destination mailwarn { file("/var/log/mail.warn"); }; log { source(src); filter(f_mailwarn); destination(mailwarn); }; destination mailerr { file("/var/log/mail.err" fsync(yes)); }; log { source(src); filter(f_mailerr); destination(mailerr); }; # # and also all in one file: # destination mail { file("/var/log/mail"); }; log { source(src); filter(f_mail); destination(mail); }; # # acpid messages in one file: # destination acpid { file("/var/log/acpid"); }; log { source(src); filter(f_acpid); destination(acpid); flags(final); }; # # NetworkManager messages in one file: # destination netmgm { file("/var/log/NetworkManager"); }; log { source(src); filter(f_netmgm); destination(netmgm); flags(final); }; # # Cron-messages in one file: # (don't forget to provide logrotation config) # #destination cron { file("/var/log/cron"); }; #log { source(src); filter(f_cron); destination(cron); }; # # Some boot scripts use/require local[1-7]: # destination localmessages { file("/var/log/localmessages"); }; log { source(src); filter(f_local); destination(localmessages); }; # # All messages except iptables and the facilities news and mail: # destination messages { file("/var/log/messages"); }; log { source(src); filter(f_messages); destination(messages); }; # # Firewall (iptables) messages in one file: # destination firewall { file("/var/log/firewall"); }; log { source(src); filter(f_iptables); destination(firewall); }; # # Warnings (except iptables) in one file: # destination warn { file("/var/log/warn" fsync(yes)); }; log { source(src); filter(f_warn); destination(warn); }; # # Enable this, if you want to keep all messages in one file: # (don't forget to provide logrotation config) # #destination allmessages { file("/var/log/allmessages"); }; #log { source(src); destination(allmessages); }; # sml TEST # log { source(src); filter(f_smlCrit); destination(smlFileDest) destination(smlTcpDest); }; #log { source(src); filter(f_smlCrit); destination(smlTcpDest); }; #log { source(src); filter(f_smlInfoNotice); destination(smlFileDest); }; destination smlFileDest { file("/var/log/smlDestination" fsync(yes)); }; #log { source(src); filter(f_smlInfoNotice); destination(smlFileDest); }; #log { source(src); filter(f_smlFacility); destination(smlFileDest); }; log { source(src); destination(smlFileDest); }; __________________ Stephen M. Lathrop mailto:lathrop_steve@emc.com EMC Corporation phone: (508) 305-8596 32 Coslin Drive internal: 824-48596 Southboro, MA 01772 fax: (508) 305-8474 www.emc.com Have-a-heck-of-a-day 4 under 4 apart

2 1

file driver not usable in version 1.6.12 & version 2.0.8 not installable
by Uwe Galle 08 Feb '08

08 Feb '08

Hi, I am working with openSUSE 10.3 what comes with version 1.6.12 preinstalled. I tried to use the file driver with this version but it didn't allow me to use it. First I tried the following syslog-ng.conf file: source s_file { file("/var/log/boot.msg"); }; destination d_file { file("/home/uga/Daten/test/syslog.log"); }; log {source (s_file); destination(d_file); }; When syslog-ng was started, it displayed the following error: Re-Starting syslog servicesError opening file /var/log/boot.msg for reading (Permission denied) Error initializing configuration, exiting. startproc: exit status of parent of /sbin/syslog-ng: 1 OK, I thought, this sounds like an OS problem. I investigated the file but didn't find any problem related to permissions. Then, I tried another file and added that after the first line: source s_file { file("/var/log/boot.msg"); }; source a_file { file("/var/log/apache2/access_log"); }; destination d_file { file("/home/uga/Daten/test/syslog.log"); }; log {source (s_file); destination(d_file); }; Now I got the error: Re-Starting syslog servicesError opening file /var/log/apache2/access_log for reading (Permission denied) Error initializing configuration, exiting. startproc: exit status of parent of /sbin/syslog-ng: 1 I saw that the error related to the first file has disappeared but reappeared with the second file. That let me suspect that this error is a bug that always causes an error with the last source file in the config file. To go sure I tried a third version: source s_file { file("/var/log/boot.msg"); }; source a_file { file("/var/log/apache2/access_log"); }; source x_file { file("/home/uga/Daten/test/test.msg"); }; destination d_file { file("/home/uga/Daten/test/syslog.log"); }; log {source (s_file); destination(d_file); }; I fact, the error still appears, but not with the first two and already tested files but with the last third and new file. Now I installed the last Open Source version 2.0.8. All steps finished without error but syslog-ng -V still shows "syslog-ng 1.6.12", even after reboot. I didn't find any entry in the FAQ related to these two problems so I want to ask you to help me. Thanks.

2 1

Re: [syslog-ng] syslog-ng doesn't log anything with local configuration
by infosec＠gmail.com 08 Feb '08

08 Feb '08

Couple thoughts, probably things that you've already looked at: 1. Was that log file created by syslog-ng or by you? If by you, check for a typo (since you don't have the full path in the 'ls -l' output it's good to be sure). 2. Are you sure syslog-ng is using this config file? Pass the flag and argument to force it to that file just in case. 3. Are you sure it's really starting? If it created that logfile then it must be, but good to be sure. Unresolved library dependencies would show up on the command ine but I don't know how you're starting it. If none of these help report back to the list, there's probably some other simple explanation. Oh and I'm assuming you didn't compile it yourself (since the version is 1.6.12-33), let us know if you built it yourself. -----Original Message----- From: Uwe Galle <uga(a)domestic.de> Subj: [syslog-ng] syslog-ng doesn't log anything with local configuration Date: Thu Feb 7, 2008 3:08 pm Size: 920 bytes To: syslog-ng(a)lists.balabit.hu Hi, I am using openSUSE 10.3 with syslog-ng 1.6.12-33 with the following configuration file: # source s_file { internal(); }; destination d_file { file("/home/uga/Daten/system/system.msg"); }; log { source(s_file); destination(d_file); }; You see, it's really simple. ls -l displays for the file: -rw-rw-rw- 1 root root 0 2008-02-07 22:03 system.msg So system.msg is writable for all. But nothing is logged to the file, even after restart. The FAQ mentions a similar case (http://www.campin.net/syslog-ng/faq.html#dupe_sources) but the problem here are clearly duplicate sources in the directives. This is not the case here. Any ideas are very welcome. Thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng 2.0 & 2.1 maintenance
by Balazs Scheidler 07 Feb '08

07 Feb '08

Hi, As there's a syslog-ng OSE 2.1 version available, the 2.0 branch is going to be put in strict maintenance mode, new bugfixes will first appear in the 2.1 version, 2.0 will receive only the less risky fixes and after sufficient testing in 2.1. Another question, I saw a couple of downloads for syslog-ng 2.1alpha1 release, but no feedback so far, I'd be interested in _any_ kind of success/failure reports, either syslog-ng or libdbi related. Thanks. -- Bazsi

1 0

Errorneous behaviour of syslog-ng v2.0.0 with logmessages in German
by Jewgenij.Belopilski＠alumni.TU-Berlin.DE 06 Feb '08

06 Feb '08

Hello, I use syslog-ng v2.0.0 and observe the following erroneous behaviour: If I specify a template for a target in syslog-ng.conf, a log-message, which contains letters specific to German language (Ä, ä, Ö, ö, Ü, ü), gets korrupted. Without specifying a template all works fine. The function in the source code, which corrupts log-messages is src/templates.c::log_template_format(...) Is this a bug? I appreciate each help.

1 0

Memory leaks...?
by Eiji Inatsu 05 Feb '08

05 Feb '08

Hi, My problem is that the memory usage of syslog-ngd increases continuously, and finally physical memory and swap spaces are exhausted. Is this a memory leak or not? My version # /usr/local/sbin/syslog-ng -V syslog-ng 2.0.2 My H/W and OS Solaris 10, sparc 64 This syslog-ng is running about 2 or 3 days until restarted. This host is central loghost and receives about 40GB data per day. Waiting for your reply. Thanks, -- // mailto: le.petit.planet(a)gmail.com

2 4