October 2009 - syslog-ng - lists.balabit.hu

MySQL Pipe for Syslog-NG not working
by Patrick Smith 29 Oct '09

29 Oct '09

Hi, I realize this is a syslog-ng users list but I know many of you are using/developing php-syslog-ng/logzilla as well so I thought I'd post the question here. I did a fresh install of syslog-ng on 3 servers, all running installed via rpm, but on one server the mysql pipe isn't working successfully. 2 servers are 64-bit RHEL4, syslog-ng-3.0.4-1.el4 (rpm), remote MySQL community server (mysql pipe works) 1 is 64-bit RHEL5, syslog-ng-3.0.4-1.el5 (rpm), local RedHat MySQL server (mysql pipe is not inserting messages) The pipe is taken direct from the php-syslog-ng wiki installation guide: destination d_mysql { program("/var/www/logzilla/scripts/db_insert.pl" template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t $HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n") ); }; destination d_localfiles { file("/var/log/syslog-ng/$HOST/$PROGRAM-$YEAR-$MONTH-$DAY.log"); }; log { source(s_remote); filter(f_allsystem); destination(d_mysql); }; log { source(s_remote); filter(f_allsystem); destination(d_localfiles); }; I have the same syslog-ng.conf file on all 3 hosts. Everything seems to be working normally, the logs just aren't making it into the RHEL5 mysql db. - Syslog messages are being received and written to local files. - Test access to mysql syslog DB as syslogadmin and sysloguser works fine. Correct passwds are in config file. - Test run of DBGen.pl works normally and the log messages are searchable in the logzilla UI. - No error messages in syslog-ng.log, mysqld.log, or logzilla logs. Any ideas as to how to further troubleshoot would be appreciated. IMPORTANT NOTICE THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer. Learn more about Payment Processing's services at www.paypros.com.

3 5

Solaris10 install Syslogng3.0.4 License clarification
by Zeek Anow 21 Oct '09

21 Oct '09

My goal is to install the server and client free version of syslog-ng.3.0.4 on Solaris 10 servers. I read the syslog-ng 3.0 Admin Guide (dated Aug 19, 2009) and the install instructions in the solaris10_install.txt file. My confusion is the constant reference to the Premium Edition for files and licensing. Do I have the wrong documentation or did I download the wrong product? I downloaded syslogng-3.0.4-sol10-sparc-local.gz package from SunFreeware. I filled out the request form on your website that is supposed to be reviewed and the license info returned to me. Again, this is for the Premium Edition. There wasn't anything mentioned about the free version. Hope I'm not confusing you, but I'm lost:)) Thanks!!

2 2

Fwd: Seg fault with include file contains an error
by anthony lineham 20 Oct '09

20 Oct '09

Hi, I sent this patch to the list last month, but haven't had any feedback yet. Does anyone have any comments (aside from my poor spelling and grammar)? Am I way off track with this fix or is it ok? Looking forward to your comments. best regards, Anthony >>> On 9/14/2009 at 4:50 PM, in message <4ADD7D39.7D71.00E6.0(a)alliedtelesis.co.nz>, anthony lineham wrote: > Hi Bazsi, > > I've been investigating a seg fault that occurs when using an include > statement in the config file. The error > occurs when one of the included files contains an syntax error. The first > time syslog-ng is restarted with the bad > config, the error is detected and restart is aborted. However, if a second > HUP is sent a seg fault occurs. > > I had a bit of trouble tracking down the cause and I'm still not entirely > sure of the mechanism that leads to the > crash but I found a couple of apparent problems, which when corrected > prevent it. > > 1. There is a global variable "include_depth" which normally gets > decremented back to zero after successful > parsing of included config files. However, if an error is detected it stays > at its current value and subsequent > restarts increment from that point. This doesn't cause the crash, but given > enough restarts would lead to > overrun or exhaustion of the "include_stack" array. > > 2. In the case of unsuccessful config parsing certain bits of memory are > dealloced but their pointers that not > reset. This seems to be what was causing the seg fault but I've found it a > bit hard to pin down. > > 3. There was an off-by-1 error in the included config deinit loop. > > The following patch fixes the problem, but may not necessarily be the best > way to do it - particularly issue 1. > > Regards, > Anthony > > --- syslog-ng_3.0.1-63-g41f77f5-old/src/cfg-lex.l 2009-09-14 > 16:02:09.000000000 +1200 > +++ syslog-ng_3.0.1-63-g41f77f5/src/cfg-lex.l 2009-09-14 > 16:15:30.000000000 +1200 > @@ -626,17 +626,24 @@ > { > gint i; > > - for (i = 0; i < include_depth; i++) > + for (i = 0; i <= include_depth; i++) > { > CfgIncludeLevel *level = &include_stack[i]; > > if (level->current_file) > - g_free(level->current_file); > + { > + g_free(level->current_file); > + level->current_file = NULL; > + } > > g_slist_foreach(level->files, (GFunc) g_free, NULL); > g_slist_free(level->files); > level->files = NULL; > if (level->yybuf) > - yy_delete_buffer(level->yybuf); > + { > + yy_delete_buffer(level->yybuf); > + level->yybuf = NULL; > + } > } > + include_depth = 0; > } >

2 2

Default SQL Server Informations / Global Constants?
by Jean F. Mousinho 20 Oct '09

20 Oct '09

Hello, Is there a way of defining a default hostname, username, password, etc for the sql destination? or I've to duplicate this information for every destination defined? If not, is there a way of defining some global constants and use them later? Thanks for your time. Jean F. mousinho

4 3

Syslog-ng SRC IP filter doesn't appear to work
by Matty 20 Oct '09

20 Oct '09

Howdy, I am using syslog-ng 3.0.4, and am encountering a bizarre issue where a small percentage of messages don't match the following filter: filter f_hosts { (host("192.168.1.2") or host("192.168.1.3") or host("192.168.1.4")); }; log { source(network); filter(f_hosts); destination(d_messages); flags(final); }; log { source(network); destination(d_catchall); }; When the hosts 192.168.1.[2-4] send messages to our syslog-ng server, 99% of the time they are routed to the d_messages destination. But in a few rare cases, messages similar to the following don't match and are send to the d_catchall destination: Text data: Syslog message: KERN.INFO: Oct 19 14:54:55 \t<STK T10000B > Raw data: <6>Oct 19 14:54:55 <STK T10000B > I verified the SRC IP address for the message in question is correct, and I also ran syslog-ng with the -d -e and -F options to watch message processing. For some reason syslog-ng doesn't match against the filter listed above, which is quite bizarre. I also tried enabling the 'no-parse' flag, but that doesn't appear to help either. Has anyone experienced this issue? Any thoughts on how to debug this issue further? Thanks, - Ryan

2 1

TLS problem
by Carlo Balbo 20 Oct '09

20 Oct '09

Hi All, I have a problem from source tls... no logs are writing, no errors in logs file of syslog-ng . I hope that you have some ideas... :-) Follow the scenario : Server ----------------------------- syslog-ng log file : 2009-10-14T11:43:54+02:00 s_local@zpvm0306-1515 syslog-ng[14171]: Syslog connection accepted; fd='25', client='AF_INET(10.1.1.57:10865)', local='AF_INET(10.1.1.55:1999)' 2009-10-14T11:44:05+02:00 s_local@zpvm0306-1515 syslog-ng[14171]: Reaping unused destination files; template='/var/log/HOSTS/$HOST/encrypt-$PROGRAM-$YEAR-$MONTH.log' 2009-10-14T11:44:05+02:00 s_local@zpvm0306-1515 syslog-ng[14171]: Reaping unused destination files; template='/var/log/HOSTS/$HOST/$R_YEAR-$R_MONTH-$PROGRAM.log' syslog-ng.conf : source s_tcp_tls { tcp( ip(10.1.1.55) port(1999) tls( key_file("/opt/syslog-ng/etc/key.d/syslog-ng.key") cert_file("/opt/syslog-ng/etc/cert.d/syslo-ng.cert") peer_verify(optional-untrusted) ) ); }; destination zlog { file("/var/log/HOSTS/$HOST/$R_YEAR-$R_MONTH-$PROGRAM.log" template("$ISODATE\t[<$FACILITY.$PRIORITY>]\t$HOST\t$PROGRAM\t$MSGHDR $MSG\n") template_escape(no) ); }; log { source(s_tcp_tls); destination(zlog); }; -------------------------------------- Client ---------------------------- source s_local { unix-stream("/dev/log"); internal(); }; destination tls_syslog_destination { tcp("10.1.1.55" port(1999) tls( ca_dir("/opt/syslog-ng/etc/cert.d") ) ); }; log { source(s_local); destination(tls_syslog_destination); }; Oct 14 11:46:02 zpvm0306-1630 syslog-ng[30713]: Syslog connection established; fd='16', server='AF_INET(10.1.1.55:1999)', local='AF_INET( 0.0.0.0:0)' Oct 14 11:46:02 zpvm0306-1630 syslog-ng[30713]: Syslog connection broken; fd='16', server='AF_INET(10.1.1.55:1999)', time_reopen='60' Oct 14 11:46:02 zpvm0306-1630 syslog-ng[30713]: Closing log transport fd; fd='16' ------------------------------------- syslog-ng.key and syslog-ng.cert from syslog-ng.pem -----BEGIN RSA PRIVATE KEY----- MIICXAIBAAKBgQCmf/eIUSTa6jyPiqOfWnofHmVkYRHx+QG9Obml1g3oX6YQEecl UwpFtpaZQHNGbZoCiM3TNr8/rj92yT/i1X4HAuqVrnZ9ra4GD2SQ4/C06Xe5d2+L AlurTwVN9+4Zu73LpvCsfhJZgcros9A10Iq25TvYLu9pBchBLjnY1d2kewIDAQAB AoGAdCQhc8o+biIkenBX8Gl5dEmMqnd3wBVVHDyu/joRW32U5fLHDOce7EAQTviB MKh1XL027dVrlK0kgeSiFsWbcYKJdSLsY7J5osEPFAu9ZjaaXtE1hbQpAlZswLvE n12x6jbZSlVGBTfb6TsLWcgJ5QY2BAcntGZjz3ryffoE/BECQQDSIXBWX3OVuR6i +aFphzy5Hc+IUCsaPYQcSntnLLHa+W3W75sWMLTEjFZGXWQwtj8Ixk+4Ce650yLw B5CbnAYzAkEAythYir5ttKEPkixbGSrBntndJW8oNjXN6pR6ofklhGrV52oh7Y+A UW23lrvAyfAArArDiAcsxV+lYDRwQ5pQmQJADxAql2Z8SK1ejtxKP+Bb8AE9EU59 6IGkaMrGEd1YWpQq1Y+TlIGlU7mjraOgPQWzexOMP2sm29dQ19gS+7SxlQJAJwuD 55kGNvm1rJZbJroDMReQqO7/l4e9zkSsYlc58IY8DGJyi27O7V2oNByJ3JUVHAiq YJm49XkWtTEC1xByKQJBAKRiGABOrJwaOLOgMXreTykY7aX2uho+0gtOKewXoj42 3SwNLyW9rM0IK5lBKOyYyYZ6jn3bN9bYHE4jIjxiMfU= -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIDpzCCAxCgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBmjELMAkGA1UEBhMCSVQx DjAMBgNVBAgTBU1pbGFuMQ4wDAYDVQQHEwVNaWxhbjEUMBIGA1UEChMLWmVyb3Bp dSBTcEExHTAbBgNVBAsMFFJlc2VhcmNoJkRldmVsb3BtZW50MRMwEQYDVQQDEwp6 ZXJvcGl1Lml0MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QHplcm9waXUuaXQwHhcN MDkxMDExMTA1NTQwWhcNMTAxMDExMTA1NTQwWjCBmjELMAkGA1UEBhMCSVQxDjAM BgNVBAgTBU1pbGFuMQ4wDAYDVQQHEwVNaWxhbjEUMBIGA1UEChMLWmVyb3BpdSBT cEExHTAbBgNVBAsMFFJlc2VhcmNoJkRldmVsb3BtZW50MRMwEQYDVQQDEwp6ZXJv cGl1Lml0MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QHplcm9waXUuaXQwgZ8wDQYJ KoZIhvcNAQEBBQADgY0AMIGJAoGBAKZ/94hRJNrqPI+Ko59aeh8eZWRhEfH5Ab05 uaXWDehfphAR5yVTCkW2lplAc0ZtmgKIzdM2vz+uP3bJP+LVfgcC6pWudn2trgYP ZJDj8LTpd7l3b4sCW6tPBU337hm7vcum8Kx+ElmByuiz0DXQirblO9gu72kFyEEu OdjV3aR7AgMBAAGjgfowgfcwHQYDVR0OBBYEFGxV+r7bTgQw7qQFq+NOM2ZKswh/ MIHHBgNVHSMEgb8wgbyAFGxV+r7bTgQw7qQFq+NOM2ZKswh/oYGgpIGdMIGaMQsw CQYDVQQGEwJJVDEOMAwGA1UECBMFTWlsYW4xDjAMBgNVBAcTBU1pbGFuMRQwEgYD VQQKEwtaZXJvcGl1IFNwQTEdMBsGA1UECwwUUmVzZWFyY2gmRGV2ZWxvcG1lbnQx EzARBgNVBAMTCnplcm9waXUuaXQxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRAemVy b3BpdS5pdIIBADAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAEND4ifb Ntd7JJKVa6FDNS5ouLdfQq5sk+uwI9OyDuD2SUdfMuhpF2PZQFxSlI2esOcTwHro tx9FBiNeZkFElPZ82vPjgchGjcgIFfUYHwWH+8lfVXEsmOub0r9xBPZNZ5/mzEXQ 7mpgGYO3aSCzqOPpz0OFBF5cBrpYSzwenaYl -----END CERTIFICATE----- -- /* Carlo http://oblab.com */

2 1

Invalid frame header; header=''
by jnordwick 20 Oct '09

20 Oct '09

I can't seem to get syslog-ng to recongnize a syslog message. I used the example message you give in the docs, but all it says is "Invalid frame header". Here is the error message: Oct 13 14:35:55 logger-01 syslog-ng[29653]: Invalid frame header; header='' here is how I'm sending my test message: echo "<34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - ID47 - BOM'su root' failed for lonvick on /dev/pts/8" | nc logger-01 20514 Here is the config: options { flush_lines(1); }; source src { internal(); syslog(ip("192.168.27.198") port(20514) transport("tcp")); }; destination dest { file("/data/local/logs/sys.log" owner(xl) group (xl)); }; log { source(src); destination(dest); }; ------------------------------------------------------------------------------------------ This message is for the named person(s) use only. It may contain confidential proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. You must not, directly or indirectly use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. Allston Trading LLC and its subsidiaries and affiliates each reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity. ------------------------------------------------------------------------------------------

4 7

syslog-ng OSE in relay mode?
by Massimo Ianni 20 Oct '09

20 Oct '09

Hi, I'm a new syslog-ng user. I have a question about syslog-ng OSE: can an instance of this version be configuable in relay mode? Otherwise should I use syslog-ng PE? Best Regards. Massimo

2 1

Introduction to the syslog-ng developer team
by Balazs Scheidler 19 Oct '09

19 Oct '09

Dear syslog-ng users, Due to an internal reorganization in BalaBit, some additional developer time is being allocated to syslog-ng development. Until now I was the only visible figure on this mailing list, even though some other people were sometimes working on syslog-ng. I would like to change this, therefore please allow me to introduce the development team assigned to syslog-ng inside BalaBit (in abc order): András Tevesz (ghost(a)balabit.hu) András Miczki (micek(a)balabit.hu) Viktor Juhász (jviktor(a)balabit.hu) Zoltán Pallagi (pzolee(a)balabit.hu) Some of them has a long syslog-ng related history, but one of them is completely new to the project. I'm urging them to take part in the syslog-ng community, engage conversations on this mailing list or run a blog. However it is important to point out that some of you on this mailing list may have more syslog-ng related experience than what they currently do: they are primarily software engineers, not system administrators. So whenever they take part in a conversation, please bear this in mind, the opinions they have is not an official BalaBit opinion, they are just fellows whose job happens to include work on an Open Source project. -- Bazsi

1 0

Log all user commands
by Ian Masters 19 Oct '09

19 Oct '09

Hello I'd like to know if it's possible to log the commands of all users logged into a system using syslog-ng. I googled and looked through the man pages for syslon-ng and syslog-ng.conf but I didn't find anything useful. Thanks in advance for your help. Ian

3 2