May 2008 - syslog-ng - lists.balabit.hu

rsyslog to syslog-ng
by Robert Shaw 22 May '08

22 May '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm having a problem with logs from rsyslog to syslog-ng can't detect facility so I can't separate applications, this is important, mostly because we have 2 instances of postgres that need to be in separate logfiles. So instead of having pgsql0 and pgsql1 files created its all dumped into syslog, so we can't differentiate between the two postgres instances. The syslog-ng instance is our central logging host, and the reason we are using rsyslog is because one of our specific applications needs it. I hope these config files help, I really need to get this sorted, if anyone could help it would be great rsyslog.conf # PostgreSQL logging stuff local0.* @loghost;RSYSLOG_TraditionalFileFormat local1.* @loghost;RSYSLOG_TraditionalFileFormat syslog-ng.conf options { chain_hostnames(no); create_dirs (yes); dir_perm(0755); keep_hostname(yes); log_fifo_size(1024); perm(0644); sync(0); time_reopen (10); use_dns(yes); use_fqdn(yes); sync(0); }; # Local logging and getting logs from remote via UDP source net { udp(); tcp(port(5140) keep-alive(yes)); }; destination net_log { file("/var/log/hosts/${HOST}/${YEAR}/${MONTH}/${DAY}/syslog"); }; destination pgnet_log0 { file("/var/log/hosts/${HOST}/${YEAR}/${MONTH}/${DAY}/pgsql0"); }; destination pgnet_log1 { file("/var/log/hosts/${HOST}/${YEAR}/${MONTH}/${DAY}/pgsql1"); }; filter f_pgsql0 { facility(local0); }; filter f_pgsql1 { facility(local1); }; log { source(net); filter(f_pgsql0); destination(pgnet_log0); }; log { source(net); filter(f_pgsql1); destination(pgnet_log1); }; log { source(net); destination(net_log); }; Cheers, Rob Shaw -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQEVAwUBSDUKu3LIVYILPVW0AQL9JAf9E28U7AQK25o9FwAd4xVb11GObxuZkusu q/IwL/+92LDB97PQ1fB9fdLUmP7MABYk+N6+kohrCJtWM+TpY5OoUBt0kE6PMBI7 Nj5GVi/IlkRMCTHrVlsNdfcciQeY2+WPlJAtFJJbwIA+kzj0O/keG6lSpFcfZ0BN Eg536qlaOLVHQIUq7N8NzjZTkLr2FkAxEMVfOKpOryDjuTcnyrdmZ5iqx7n+nY4y VPtQW1mNwTs9BRf80g/Vx+DzNdoK0MbXKTogkMSNBoNSia8tvatA7CW+45TO3ucG gwo4KtRlS5BgRS++cMgmFwkDSPiI4cNYDGrAMWwch8o2yqSyIXf8Cw== =Tfas -----END PGP SIGNATURE-----

3 2

syslog-ng with piped fifo
by Steve Bielen 21 May '08

21 May '08

greetings I have setup a syslog-ng server, which I intent to use to filter the messages from squid. Currently I filter all the messages from squid and send them to a pipe. on the other end of this pipe I have my perl script which formats the data and stores it into my postgres database. the problem is that when I try to run /tmp/pgsql.pipe > script.perl I get the error permission denied. I run that command as root, the pipe is owned by root, and the owner. and the same goes for script.perl. second question: In most tutorials I see for database usage with syslog-ng everyone used a template insert command with variables. does anyone know if such variables exist for the squid access logs ? best wishes -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

Syslog-ng DNS Problem
by zarahel＠iol.pt 20 May '08

20 May '08

Good morning to you all I need your help I´ve installed syslog-ng and it´s cacti plugin and it´s working fine, except for it´s name resolution. For some reason it resolves some names, and doesn´t resolve others. I´m able to ping my hosts by their names without any problem, and I´ve set use_dns(yes) in syslog-ng.conf I´ve done nslookup, and everything´s as it should. Does anybody have any idea why syslog-ng is resolving only some of my hosts names? Any help is very apreciated. Thkx I apreciate any help Thkx ________________________________________________________________________________ Cartão Citi: receba GRÁTIS uma máquina de café Peça aqui o seu http://www.iol.pt/correio/rodape.php?dst=0805131

2 2

log route problem
by Marcin Orlowski 18 May '08

18 May '08

Hi, I setup client with mostly default settings. To log to remote server I added (remote server listens on 514 as by default): log { destination(d_remote); flags(catchall); }; this used to work pretty ok. So now I wanted to log xferlog too. Set the source: source s_ftp_xfer { file("/var/log/proftpd/xferlog" follow_freq(2) flags(no-parse)); }; destination d_remote_515 { tcp('x.x.x.x' port(515)); }; log { source(s_ftp_xfer); destination(d_remote_515); }; Port 515 is intentional here for other reasons. On the server: source s_xferlog {tcp( ip(0.0.0.0) port(515)); }; template t_ftp { template("$MSG\n"); template_escape(no); }; destination df_ftp_xfer { ("/<PATH>/xferlog" template(t_ftp)); }; filter f_proftpd { program('^proftpd$'); }; log { source(s_xferlog); filter( f_proftpd ); destination(df_ftp_xfer); flags(final); }; My problem is that everytime xferlog entry arrives to the server it's being added to xferlog as expected, but it also goes into syslog and console. I am stuck to find out why. There's no other rule that touches s_xferlog on the server. Any hints appreciated. Marcin

1 0

Wrong syslog-ng behaviour for PROGRAM macro and non-root file follow
by Behal, Pavel 16 May '08

16 May '08

Dear Developers, I would like to report two wrong behaviors of syslog-ng. I have received them while running the 2.1.alpha1 version, but from the GIT repository I see, it has not been reported nor fixed yet: 1) Possible problems in destination macro $PROGRAM I use macro $PROGRAM in some destination file name templates to better identify source messages. Unfortunately, sometimes the $PROGRAM macro in syslog message is filled with file name with full path. (Like /usr/bin/xxxxx.) This leads to the situation that syslog-ng tries to write to the complete different path than expected. And depending on the "create_dirs" option, new directories can be also created. Generically we can say, there is a problem that invalid unix filename/filepath characters can be passed to syslog and create a technical or security issue. (It is not only a problem of / slash, but any special unix character like . or ~ can change the path meaning.) I do not have any "best" solution now to offer, but I would like to ask you to validate this behaviour and extended the design so it is protected against such unexpected destination path manipulation. 2) Unexpected initialization of followed file sources I run a special instance of the syslog-ng under non-root configuration. It is started as root but with a "-u syslogng" option to switch to other user. And it is used to follow some file sources to be transferred to the central log server. It works fine, but only until the log is rotated in a wrong way. Let's explain: The log file's permissions has to be changed manually always after the rotation, to be readable by other users. This is my part, but for some reason, I have had an error there and I have received this scenario: - Initial status: the log permissions are private, the syslog-ng is unable to read the log -> this is expected. - I have restarted the syslog-ng instance due some reconfiguration -> OOPS, it has found and opened the -> this is unexpected! - The log is followed successfully, even with private permissions! - But, only until it is rotated again - I expect the file handle is lost finally So from my view: When a syslog-ng with -u option starts, it first opens all logs as root and after that it switches its effective UID:GID as required. This is nice feature, but a little bit unexpected. I would like to ask you if you can again check the initialization part of syslog-ng and clean the design, so it either: - always opens every (file) source under the non-root user (more secure, but worse for me) - or always re-opens the followed (file) sources with original higher root privileges (less secure, but nice and easier for me to read private application logs) Thank you in advance. Best Regards, Pavel

3 5

DNS Cache with /etc/hosts
by Andrew Kerr 16 May '08

16 May '08

I have the following set: use_dns(persist_only); dns_cache(yes); dns_cache_hosts(/etc/hosts); After I make a change to /etc/hosts, how long until syslog-ng will pick up the change?

3 2

syslog-ng 2.0.9 memory leak
by Park Eun soo 16 May '08

16 May '08

.Bold { font-weight: bold; } .Title { font-weight: bold; font-size: 18px; color: #cc3300; } .Code { border: #8b4513 1px solid; padding-right: 5px; padding-left: 5px;color: #000066; font-family: 'Courier New' , Monospace;background-color: #ff9933; } Hi, I had some memory leaks when reload conf. with HUP signal. I find that log_reader_option 'prefix' causes memory leaks and make patch. Please check this patch is correct or not. Regards, Park

2 1

Re: [syslog-ng] Syslog-ng does not start Solaris 9
by ye boy 15 May '08

15 May '08

In case anyone else happens across this problem, I was finally able to resolve it. Generally speaking, we disable rshd during hardening. In this event, it looks like a couple fell through the cracks. Once I disabled rshd (the 'shell' lines) and did a kill -HUP on inetd, syslog-ng started right up. Original post --------------------------------------------------------------------------------------------- I have been migrating all of our Solaris 9 servers to syslog-ng. While everything is working fine on most of them, two of them are displaying the following problem: When I attempt to start syslog-ng, it fails as follows: # /etc/init.d/syslog start syslog-ng service starting. Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already in use (125)' Error initializing source driver; source='inputs' # Any idea how to resolve this? I may need a direct response, as I have not received anything from the list yet (just signed up before writing this). o0yeboy0o(a)yahoo.com Thanks, Thomas

1 0

Kevin Gorski/IS/NEU is out of the office.
by K.Gorski＠neu.edu 12 May '08

12 May '08

I will be out of the office starting 05/12/2008 and will not return until 05/27/2008. I will respond to your message when I return from vacation.

1 0

Logrotate Not Rotating All - Need Help Matching Rules
by wiskbroom＠hotmail.com 08 May '08

08 May '08

My logrotate.d/syslog-ng file contains a few entries for many different logs, see below. My syslog-ng.conf automatically creates entries for many different hosts, each with unique hostnames, depending on their purpose. The "purpose" for the hosts each have a different subdir under /var/log/Myhosts/, i.e. /var/log/Myhosts/Switches and /var/log/Myhosts/Firewalls. Logrotate does not work unless I've added each host separately under my logrotate conf, which is impossible since I dynamically create these entries via mysyslog-ng.conf . Any help greatly appreciated. .vp /var/log/Myhosts/*/*.log \ /var/log/Myhosts/Switches/*/*.log \ /var/log/Myhosts/*.log /var/log/messages \ /var/log/secure \ /var/log/maillog \ /var/log/spooler \ /var/log/boot.log \ /var/log/cron \ /var/log/mail/* { missingok weekly rotate 4 create compress copytruncate ifempty # olddir /var/log/Myhosts/Archived-Logs/ sharedscripts postrotate sharedscripts postrotate n/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true endscript

4 13