December 2009 - syslog-ng - lists.balabit.hu

3.03 filtering problem
by Tim Boyer 16 Dec '09

16 Dec '09

OK, I assume that this is something stupid I'm doing - but I've started at the config file for a week, and I'll be darned if I can see it. I've got a fairly vanilla setup, and I'm trying to send dhcpd, snort, etc to separate filters, while at the same time keeping one file with all of the error messages. Like so: # # log sources # source server { file("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; destination dserver_all { file("/var/log/${HOST}.log" owner(root) group(hobbit) perm(0640)); }; destination dserver_cfengine { file("/var/log/cfengine.log"); }; destination dserver_snort { file("/var/log/snort.log"); }; destination dserver_dhcpd { file("/var/log/dhcpd.log"); }; ... filter fserver_snort { program("snort"); }; filter fserver_dhcpd { program("dhcpd"); }; filter fserver_cfengine { program("cfengine"); }; ... log { source(server); destination(dserver_all); }; log { source(server); filter(fserver_snort); destination(dserver_snort); flags(final); }; log { source(server); filter(fserver_cfengine); destination(dserver_cfengine); flags(final); }; log { source(server); filter(fserver_dhcpd); destination(dserver_dhcpd); flags(final); }; The 'log everything' is working fine. Some of the filtered logs are working fine, like the cfengine log: [root@saratoga log]# ls -la /var/log/cfengine.log -rw------- 1 root root 181006 Dec 14 11:15 /var/log/cfengine.log The dhcpd log is empty: [root@saratoga log]# ls -la /var/log/dhcpd.log -rw------- 1 root root 0 Dec 13 02:42 /var/log/dhcpd.log even though there are entries in the combined log that clearly should have hit the dhcpd log: [root@saratoga log]# tail /var/log/saratoga.log Dec 14 11:25:07 saratoga dhcpd: Copyright 2004-2006 Internet Systems Consortium. Dec 14 11:25:07 saratoga dhcpd: All rights reserved. Dec 14 11:25:07 saratoga dhcpd: For info, please visit http://www.isc.org/sw/dhcp/ Dec 14 11:25:07 saratoga dhcpd: Wrote 22 leases to leases file. Dec 14 11:25:07 saratoga dhcpd: Listening on LPF/eth3/00:0e:0c:6d:64:cf/192.168.3/24 What in the world am I missing? Thanks much, -- tim -- -- Tim Boyer Denman Tire Corporation

1 1

3.1 Beta 1 memory leak?
by Martin Holste 16 Dec '09

16 Dec '09

I'm trying the new 3.1 beta 1 build, and even with log_fifo_size(0), syslog-ng consumes all available memory until the kernel out-of-memory manager kills it. At first I thought this had something to do with UDP forwarding to a destination, but even with that disabled, the uncontrolled consumption occurs. I reconfigured with the most basic configuration to just dump everything to /dev/null, and though the leak is slower, the leak continues. Compiled with: Glibc-2.20.3 PCRE 7.9 syslog-ng 3.1beta1 Installer-Version: 3.1beta1 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#3412dce0235e8d65bc3bebedffe8ff6bed02f45b Compile-Date: Dec 11 2009 11:36:51 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on Configuration: @version: 3.0 options { ts_format(iso); stats_level(1); stats_freq(30); keep_hostname(no); chain_hostnames(yes); create_dirs(yes); }; source s_tcp { tcp(ip(0.0.0.0) port(514)); }; source s_udp { udp(ip(0.0.0.0) port(514)); }; destination d_null { file("/dev/null"); }; log { source(s_udp); source(s_tcp); destination(d_null); };

2 2

syslog-ng OSE 3.0.4 coredumps when use "internal()" in s_local
by nova club 15 Dec '09

15 Dec '09

Hi there, I am a new user of syslog-ng. Thanks for your time and attention in advance. The problem is syslog-ng coredumps when use "internal()" in "source", however it will work fine without "internal()". The conf file is like: ===>BEGIN @version:3.0 options { dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname(yes); }; # Default local source. source local { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; ... filter f_hecxd { program("hecxd"); }; ... log { source(local); filter(f_hecxd); destination(d_hecxd); }; ==>END The options used for building syslog-ng is: CFLAGS='-Wl,-Bdynamic -liconv -Wl,-Bstatic' --enable-static-linking \ --enable-debug \ --enable-ssl --enable-ipv6=no --enable-tcp-wrapper=no \ --with-pidfile-dir="/var/run/" The platform is: FREEBSD 6.4-RELEASE-p6 i386 I got a very big core dump file (>500M), by backtracing that file, I can see the problem is "g_malloc0" for some reason failed to allocate memory, while syslog-ng did not check the return value and tried to use the "0x0" pointer in a "strlen()" call later. Here is a part of trace information: #0 0x080a2d8d in strlen () No symbol table info available. #1 0x0804e7fe in log_msg_new_internal (prio=43, msg=0x0, flags=6) at logmsg.c:1971 buf = (gchar *) 0x0 self = (LogMessage *) 0x8159000 #2 0x080492b1 in msg_send_internal_message (prio=43, msg=0x0) at messages.c:128 context = (MsgContext *) 0x81893a0 m = (LogMessage *) 0x7 #3 0x0804954c in msg_log_func (log_domain=0x81186ea "GLib", log_flags=6, msg=0x0, user_data=0x0) at messages.c:187 pri = 43 #4 0x08084906 in IA__g_logv (log_domain=0x81186ea "GLib", log_level=G_LOG_LEVEL_ERROR, format=0x811cbac "%s: failed to allocate %u bytes", args1=0xbfbfe6cc "3�\021\bl") at gmessages.c:519 msg = (gchar *) 0x0 was_fatal = 0 was_recursion = 0 i = 2 #5 0x08084ae4 in IA__g_log (log_domain=0x81186ea "GLib", log_level=G_LOG_LEVEL_ERROR, format=0x811cbac "%s: failed to allocate %u bytes") at gmessages.c:569 No locals. #6 0x08084239 in IA__g_malloc0 (n_bytes=108) at gmem.c:155 mem = 0x0 #7 0x0804e5ef in log_msg_new ( msg=0x8a82180 "<47> syslog-ng[3277]: Filter node evaluation result; filter_result='not-match', filter_type='level'\n", length=100, saddr=0x0, flags=6, bad_hostname=0x0, assume_timezone=-1, default_pri=47) at logmsg.c:1873 self = (LogMessage *) 0x810ba1b #8 0x0804e80a in log_msg_new_internal (prio=47, msg=0x817f500 "Filter node evaluation result; filter_result='not-match', filter_type='level'", flags=6) at logmsg.c:1971 buf = (gchar *) 0x8a82180 "<47> syslog-ng[3277]: Filter node evaluation result; filter_result='not-match', filter_type='level'\n" self = (LogMessage *) 0x8159000 #9 0x080492b1 in msg_send_internal_message (prio=47, msg=0x817f500 "Filter node evaluation result; filter_result='not-match', filter_type='level'") at messages.c:128 context = (MsgContext *) 0x81893a0 m = (LogMessage *) 0x8182030 If you need the completed coredump file, just let me know and tell me where to put it :) Any help is much appreciated. Thanks a lot. Shen _________________________________________________________________ Windows Live: Make it easier for your friends to see what you’re up to on Facebook. http://go.microsoft.com/?linkid=9691816

2 4

Re: [syslog-ng] Syslog-NG 3.0.5 incorrectly parsing messages without program names
by Larry Low 15 Dec '09

15 Dec '09

> In the past I used the MSG macro to get the full syslog message. Now > MSG is broken into MSG and MSGHDR. > > If a message comes in without a program name such as "exiting on signal > 15" or "last message repeated 20 times", syslog-ng incorrectly takes > the first word as the program name. Trying to rebuild it with > $MSGHDR$MSG causes an erroneous : to be placed on these messages since > $MSGHDR is filled in with "exiting" and "last". I found a previous post and tried adding store-legacy-msghdr. The problem now is that MSGHDR still includes the first word such as "exiting" and "last" but no colon but on messages like "kernel : Kernel logging (proc) stopped.", "kernel: " is put in MSGHDR but then also placed in MSG and MSGONLY. > > --- > Larry Lo

2 7

Re: [syslog-ng] syntax error in config-file
by Pallagi Zoltán 15 Dec '09

15 Dec '09

andip írta: > Hi, > > You're right i got the syslog filter, but not destination. i changed that to > _syslog, and as i started syslog-ng again, i got syntax-errors on different > lines. i fixed the lines one after the other (see comments in config file in > original mail). the last error that i could not get past was on line 35, > which is the first filter-line in my config-file. > double quote is missing from filter: - filter aplog { host (10.20.); }; + filter aplog { host ("10.20."); }; > so since syslog-ng exited with syntax-error, and it reports it being line 35, > i felt sure it had to do with that line, though ofc i can be wrong as i'm an > amateur. i am ofc aware there are/might be errors further down in the > config-file. > i'd very much like to be certain though, before i re-install version 3.0.4 > again. > > could you please confirm for me that you're aware of this before i try out > your suggested solution? > There is my solution, it worked for me: @@ -28,8 +28,7 @@ destination ipflog { file ("/var/log/ipflog"); }; destination imaplog { file ("/var/log/imaplog"); }; destination console { file ("/dev/console"); }; -destination syslog { file ("/var/log/syslog"); }; ### changed -to _syslog +destination _syslog { file ("/var/log/syslog"); }; ### changedto _syslog destination komm { file ("/var/log/fwlogs/kommunikasjon-context.log"); }; destination asa { file ("/var/log/fwlogs/asa.log"); }; @@ -47,8 +46,7 @@ destination wifi { file ("/var/log/fwlogs/wifi-context.log"); }; destination aplog { file ("/var/log/aplog/aplog.txt"); }; -filter aplog { host (10.20.); }; ### this line caused the -syntax error (line 35) +filter aplog { host ("10.20."); }; filter gje { host (10.8.30.28); }; filter nes { host (10.8.30.20); }; filter ull { host (10.8.30.36); }; @@ -75,7 +73,7 @@ filter mail { facility (mail); }; filter daemon { facility (daemon); }; filter auth { facility (auth); }; -filter syslog { facility (syslog); }; +filter _syslog { facility (syslog); }; filter lpr { facility (lpr); }; filter news { facility (news); }; filter uucp { facility (uucp); }; @@ -103,7 +101,7 @@ log { source (sys); filter (mail); destination (maillog); }; #log { source (sys); filter (local0); destination (ipflog); }; #log { source (sys); filter (local1); destination (imaplog); }; -log { source (sys); filter (syslog); destination (syslog); }; +log { source (sys); filter (_syslog); destination (_syslog); }; log { source (sys); filter (emerg); filter (user_none); destination (console); }; log { source (sys); filter (mesg); filter (user_none); and of course you also have to check the warnings after starting. If everything is all right put "@version: 3.0" line on the top of your config. > cheers > andip > > ----- Original Message ----- > From: Pallagi Zoltán <pzolee(a)balabit.hu> > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu>, andip(a)syndig.com > Sent: Tue, 15 Dec 2009 10:43:10 +0100 > Subject: Re: [syslog-ng] syntax error in config-file > > >> Hi, >> >> In syslog-ng 3.0, "syslog" became a reserved word and you have a >> destination and a filter called "syslog" in your config. >> Please rename them and it will work >> >> andip írta: >> >>> Hi folks, >>> >>> I just tried updating syslog-ng to version 3.0.4, from 2.1.4. i use the >>> gentoo linux-distro, and the new version came into "stable" gentoo a few >>> >> days >> >>> ago. >>> >>> I'm no syslog-ng expert, but i use it to log quite a few things, so my >>> config-file it not default. >>> I've read a bit in the admin-guide, but did not find any reason to my >>> problem. >>> >>> i've tried converting my 2.1.4 config-file to the new 3.0.4 version, with >>> > > >> no >> >>> success. this is parts of my old config-file. ### are comments made to >>> reflect changes i made for v2 -> v3 conversion >>> >>> > ---------------------------------------------------------------------------- > >>> options { >>> chain_hostnames(off); ### changed this to "no" >>> sync(0); ### changed this to "flush_lines" >>> time_sleep(20); >>> log_fifo_size (2048); >>> create_dirs (yes); >>> perm (0640); >>> dir_perm (0750); >>> stats(43200); ### changed this to "stats_freq" >>> owner (syslogger); >>> group (syslogger); >>> perm (0664); >>> }; >>> >>> source sys { >>> unix-stream("/dev/log" max-connections(256)); >>> internal(); >>> file("/proc/kmsg"); >>> }; >>> >>> source net { udp(); }; >>> >>> destination clients { file ("/var/log/fwlogs/netclients/$HOST"); }; >>> destination console_all { file ("/dev/tty12"); }; >>> destination authlog { file ("/var/log/authlog"); }; >>> destination messages { file ("/var/log/messages"); }; >>> destination maillog { file ("/var/log/maillog"); }; >>> destination ipflog { file ("/var/log/ipflog"); }; >>> destination imaplog { file ("/var/log/imaplog"); }; >>> destination console { file ("/dev/console"); }; >>> destination syslog { file ("/var/log/syslog"); }; ### changed >>> >> to _syslog >> >>> >>> >>> destination komm { file ("/var/log/fwlogs/kommunikasjon-context.log"); >>> > > >>> }; >>> destination asa { file ("/var/log/fwlogs/asa.log"); }; >>> destination edb { file ("/var/log/fwlogs/edb-pix.log"); }; >>> destination gje { file ("/var/log/fwlogs/gjerdrum.log"); }; >>> destination nes { file ("/var/log/fwlogs/nes.log"); }; >>> destination ull { file ("/var/log/fwlogs/ullensaker.log"); }; >>> destination hur { file ("/var/log/fwlogs/hurdal.log"); }; >>> destination eid { file ("/var/log/fwlogs/eidsvoll.log"); }; >>> destination nan { file ("/var/log/fwlogs/nannestad.log"); }; >>> destination datas { file ("/var/log/fwlogs/datasenter-context.log"); }; >>> > > >>> destination mgmt { file ("/var/log/fwlogs/management-context.log"); }; >>> > > >>> destination wifi { file ("/var/log/fwlogs/wifi-context.log"); }; >>> destination aplog { file ("/var/log/aplog/aplog.txt"); }; >>> >>> filter aplog { host (10.20.); }; ### this line caused >>> > the > >>> syntax error (line 35) >>> filter gje { host (10.8.30.28); }; >>> filter nes { host (10.8.30.20); }; >>> filter ull { host (10.8.30.36); }; >>> filter hur { host (10.8.30.12); }; >>> filter eid { host (10.8.30.44); }; >>> filter nan { host (10.8.30.52); }; >>> filter datas { host (10.8.0.1); }; >>> filter mgmt { host (10.8.30.60); }; >>> filter wifi { host (10.8.30.92); }; >>> filter asa { host (ASA-R111); }; >>> filter komm { host (10.8.30.76); }; >>> filter edb { host (edb-pix); }; >>> >>> filter emerg { level (emerg); }; >>> filter alert { level (alert .. emerg); }; >>> filter crit { level (crit .. emerg); }; >>> filter err { level (err .. emerg); }; >>> filter warning { level (warning .. emerg); }; >>> filter notice { level (notice .. emerg); }; >>> filter info { level (info .. emerg); }; >>> filter debug { level (debug .. emerg); }; >>> filter kern { facility (kern); }; >>> filter user { facility (user); }; >>> filter mail { facility (mail); }; >>> filter daemon { facility (daemon); }; >>> filter auth { facility (auth); }; >>> filter syslog { facility (syslog); }; >>> filter lpr { facility (lpr); }; >>> filter news { facility (news); }; >>> filter uucp { facility (uucp); }; >>> filter cron { facility (cron); }; >>> #filter local0 { facility (local0); }; >>> #filter local1 { facility (local1); }; >>> #filter local2 { facility (local2); }; >>> #filter local3 { facility (local3); }; >>> #filter local4 { facility (local4); }; >>> #filter local5 { facility (local5); }; >>> #filter local6 { facility (local6); }; >>> #filter local7 { facility (local7); }; >>> filter user_none { not facility (user); }; >>> filter kern_debug { filter (kern) and filter (debug); }; >>> filter daemon_notice { filter (daemon) and filter (notice); }; >>> filter mail_crit { filter (mail) and filter (crit); }; >>> filter mesg { filter (kern_debug) or >>> filter (daemon_notice) or >>> filter (mail_crit); }; >>> filter authinfo { filter (auth) or program (sudo); }; >>> >>> log { source (sys); destination(messages); }; >>> log { source (sys); destination(console_all); }; >>> log { source (sys); filter (authinfo); destination (authlog); }; >>> log { source (sys); filter (mail); destination (maillog); }; >>> #log { source (sys); filter (local0); destination (ipflog); }; >>> #log { source (sys); filter (local1); destination (imaplog); }; >>> log { source (sys); filter (syslog); destination (syslog); }; >>> log { source (sys); filter (emerg); filter (user_none); >>> destination (console); }; >>> log { source (sys); filter (mesg); filter (user_none); >>> destination (messages); }; >>> >>> log { source (net); destination (clients); }; >>> log { source (net); filter (komm); destination (komm); }; >>> log { source (net); filter (asa); destination (asa); }; >>> log { source (net); filter (mgmt); destination (mgmt); }; >>> log { source (net); filter (wifi); destination (wifi); }; >>> log { source (net); filter (datas); destination (datas); }; >>> log { source (net); filter (wifi); destination (wifi); }; >>> log { source (net); filter (gje); destination (gje); }; >>> log { source (net); filter (nan); destination (nan); }; >>> log { source (net); filter (ull); destination (ull); }; >>> log { source (net); filter (hur); destination (hur); }; >>> log { source (net); filter (eid); destination (eid); }; >>> log { source (net); filter (nes); destination (nes); }; >>> log { source (net); filter (edb); destination (edb); }; >>> log { source (net); filter (aplog); destination (aplog); }; >>> #log { source (net); filter (komm); destination (komm); }; >>> ---------------------------------------------------------------------- >>> This is the error i got : >>> >>> syntax error in /etc/syslog-ng/syslog-ng.conf at line 35. >>> >>> syslog-ng documentation: >>> http://www.balabit.com/support/documentation/?product=syslog-ng >>> mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> > > >>> >>> * Configuration error. Please fix your configfile >>> (/etc/syslog-ng/syslog-ng.conf) >>> >>> It is not a very big deal at the moment, as i've reverted back to version >>> > > >>> 2.1.4, but i'd like to keep my system current, and somewhat up to date. >>> >> this >> >>> server's main function is as a syslogger for a few firewalls though, so i >>> > > >>> cannot leave it unable to log for long. >>> >>> hope someone can help. >>> >>> cheers >>> andip >>> >>> > _____________________________________________________________________________ > > >> _ >> >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation: >>> >> http://www.balabit.com/support/documentation/?product=syslog-ng >> >>> FAQ: http://www.campin.net/syslog-ng/faq.html >>> >>> >>> >>>

2 1

Licensing of 3.0.2 OSE ?
by Fegan, Joe 15 Dec '09

15 Dec '09

Hi all - A licensing question about syslog-ng was sent to me privately recently and I thought it would be best to forward it to this list for comments. > We have been using syslog-ng-1.6.2 in our product for quite a few years now. > We received a case recently on syslog-ng which prompted us to get the newer > version of syslog-ng. We took the syslog-ng_3.0.2 open source edition and > replaced the older one with this. > > We see that the licensing has changed from GPL to BalaBit Proprietary License > since syslog-ng version 3.0.1. The license remains GPL till syslog-ng version > 2.1.4. > > My question here is, can we build the newer open source syslog-ng which has > the Balabit propriety license and distribute it to our customers as part of > our product? I replied that the COPYING file in the 3.0.2 tarball says GPL, so I don't understand the question. The person's reply was: > Joe, > > I missed out on mentioning that part to you. > The COPYING is GPL. But in the spec file we see the following. > > # > # Specfile used by BalaBit internally. > # > Summary: Next generation system logging daemon > Name: syslog-ng > Version: 3.0.1 > Release: 1 > License: BalaBit Proprietary License > > And this is seen when you do rpm -qi : > > [root@n10 ~]# rpm -qi syslog-ng-xx-3.0.2-1 > Name : syslog-ng-xx Relocations: (not relocatable) > Version : 3.0.2 Vendor: Balabit IT Ltd. > Release : 1 Build Date: Mon 07 Dec 2009 06:40:22 PM IST > Install Date: Thu 10 Dec 2009 02:01:43 PM IST Build Host: builder.mycompany.com > Group : System Environment/Daemons Source RPM: syslog-ng-xx-3.0.2-1.src.rpm > Size : 554028 License: BalaBit Proprietary License > Signature : (none) > Packager : Tamas Pal <folti(a)balabit.com> > URL : http://www.balabit.com > Summary : Next generation system logging daemon > Description : > Syslog-ng is a next generation system logger daemon which provides more > capabilities and it has a more flexible configuration then the traditional > syslog daemon.

3 3

Re: [syslog-ng] syntax error in config-file
by andip 15 Dec '09

15 Dec '09

Hi, You're right i got the syslog filter, but not destination. i changed that to _syslog, and as i started syslog-ng again, i got syntax-errors on different lines. i fixed the lines one after the other (see comments in config file in original mail). the last error that i could not get past was on line 35, which is the first filter-line in my config-file. so since syslog-ng exited with syntax-error, and it reports it being line 35, i felt sure it had to do with that line, though ofc i can be wrong as i'm an amateur. i am ofc aware there are/might be errors further down in the config-file. i'd very much like to be certain though, before i re-install version 3.0.4 again. could you please confirm for me that you're aware of this before i try out your suggested solution? cheers andip ----- Original Message ----- From: Pallagi Zoltán <pzolee(a)balabit.hu> To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu>, andip(a)syndig.com Sent: Tue, 15 Dec 2009 10:43:10 +0100 Subject: Re: [syslog-ng] syntax error in config-file > Hi, > > In syslog-ng 3.0, "syslog" became a reserved word and you have a > destination and a filter called "syslog" in your config. > Please rename them and it will work > > andip írta: > > Hi folks, > > > > I just tried updating syslog-ng to version 3.0.4, from 2.1.4. i use the > > gentoo linux-distro, and the new version came into "stable" gentoo a few > days > > ago. > > > > I'm no syslog-ng expert, but i use it to log quite a few things, so my > > config-file it not default. > > I've read a bit in the admin-guide, but did not find any reason to my > > problem. > > > > i've tried converting my 2.1.4 config-file to the new 3.0.4 version, with > no > > success. this is parts of my old config-file. ### are comments made to > > reflect changes i made for v2 -> v3 conversion > > > ---------------------------------------------------------------------------- > > options { > > chain_hostnames(off); ### changed this to "no" > > sync(0); ### changed this to "flush_lines" > > time_sleep(20); > > log_fifo_size (2048); > > create_dirs (yes); > > perm (0640); > > dir_perm (0750); > > stats(43200); ### changed this to "stats_freq" > > owner (syslogger); > > group (syslogger); > > perm (0664); > > }; > > > > source sys { > > unix-stream("/dev/log" max-connections(256)); > > internal(); > > file("/proc/kmsg"); > > }; > > > > source net { udp(); }; > > > > destination clients { file ("/var/log/fwlogs/netclients/$HOST"); }; > > destination console_all { file ("/dev/tty12"); }; > > destination authlog { file ("/var/log/authlog"); }; > > destination messages { file ("/var/log/messages"); }; > > destination maillog { file ("/var/log/maillog"); }; > > destination ipflog { file ("/var/log/ipflog"); }; > > destination imaplog { file ("/var/log/imaplog"); }; > > destination console { file ("/dev/console"); }; > > destination syslog { file ("/var/log/syslog"); }; ### changed > to _syslog > > > > > destination komm { file ("/var/log/fwlogs/kommunikasjon-context.log"); > > > }; > > destination asa { file ("/var/log/fwlogs/asa.log"); }; > > destination edb { file ("/var/log/fwlogs/edb-pix.log"); }; > > destination gje { file ("/var/log/fwlogs/gjerdrum.log"); }; > > destination nes { file ("/var/log/fwlogs/nes.log"); }; > > destination ull { file ("/var/log/fwlogs/ullensaker.log"); }; > > destination hur { file ("/var/log/fwlogs/hurdal.log"); }; > > destination eid { file ("/var/log/fwlogs/eidsvoll.log"); }; > > destination nan { file ("/var/log/fwlogs/nannestad.log"); }; > > destination datas { file ("/var/log/fwlogs/datasenter-context.log"); }; > > > > > destination mgmt { file ("/var/log/fwlogs/management-context.log"); }; > > > > > destination wifi { file ("/var/log/fwlogs/wifi-context.log"); }; > > destination aplog { file ("/var/log/aplog/aplog.txt"); }; > > > > filter aplog { host (10.20.); }; ### this line caused the > > syntax error (line 35) > > filter gje { host (10.8.30.28); }; > > filter nes { host (10.8.30.20); }; > > filter ull { host (10.8.30.36); }; > > filter hur { host (10.8.30.12); }; > > filter eid { host (10.8.30.44); }; > > filter nan { host (10.8.30.52); }; > > filter datas { host (10.8.0.1); }; > > filter mgmt { host (10.8.30.60); }; > > filter wifi { host (10.8.30.92); }; > > filter asa { host (ASA-R111); }; > > filter komm { host (10.8.30.76); }; > > filter edb { host (edb-pix); }; > > > > filter emerg { level (emerg); }; > > filter alert { level (alert .. emerg); }; > > filter crit { level (crit .. emerg); }; > > filter err { level (err .. emerg); }; > > filter warning { level (warning .. emerg); }; > > filter notice { level (notice .. emerg); }; > > filter info { level (info .. emerg); }; > > filter debug { level (debug .. emerg); }; > > filter kern { facility (kern); }; > > filter user { facility (user); }; > > filter mail { facility (mail); }; > > filter daemon { facility (daemon); }; > > filter auth { facility (auth); }; > > filter syslog { facility (syslog); }; > > filter lpr { facility (lpr); }; > > filter news { facility (news); }; > > filter uucp { facility (uucp); }; > > filter cron { facility (cron); }; > > #filter local0 { facility (local0); }; > > #filter local1 { facility (local1); }; > > #filter local2 { facility (local2); }; > > #filter local3 { facility (local3); }; > > #filter local4 { facility (local4); }; > > #filter local5 { facility (local5); }; > > #filter local6 { facility (local6); }; > > #filter local7 { facility (local7); }; > > filter user_none { not facility (user); }; > > filter kern_debug { filter (kern) and filter (debug); }; > > filter daemon_notice { filter (daemon) and filter (notice); }; > > filter mail_crit { filter (mail) and filter (crit); }; > > filter mesg { filter (kern_debug) or > > filter (daemon_notice) or > > filter (mail_crit); }; > > filter authinfo { filter (auth) or program (sudo); }; > > > > log { source (sys); destination(messages); }; > > log { source (sys); destination(console_all); }; > > log { source (sys); filter (authinfo); destination (authlog); }; > > log { source (sys); filter (mail); destination (maillog); }; > > #log { source (sys); filter (local0); destination (ipflog); }; > > #log { source (sys); filter (local1); destination (imaplog); }; > > log { source (sys); filter (syslog); destination (syslog); }; > > log { source (sys); filter (emerg); filter (user_none); > > destination (console); }; > > log { source (sys); filter (mesg); filter (user_none); > > destination (messages); }; > > > > log { source (net); destination (clients); }; > > log { source (net); filter (komm); destination (komm); }; > > log { source (net); filter (asa); destination (asa); }; > > log { source (net); filter (mgmt); destination (mgmt); }; > > log { source (net); filter (wifi); destination (wifi); }; > > log { source (net); filter (datas); destination (datas); }; > > log { source (net); filter (wifi); destination (wifi); }; > > log { source (net); filter (gje); destination (gje); }; > > log { source (net); filter (nan); destination (nan); }; > > log { source (net); filter (ull); destination (ull); }; > > log { source (net); filter (hur); destination (hur); }; > > log { source (net); filter (eid); destination (eid); }; > > log { source (net); filter (nes); destination (nes); }; > > log { source (net); filter (edb); destination (edb); }; > > log { source (net); filter (aplog); destination (aplog); }; > > #log { source (net); filter (komm); destination (komm); }; > > ---------------------------------------------------------------------- > > This is the error i got : > > > > syntax error in /etc/syslog-ng/syslog-ng.conf at line 35. > > > > syslog-ng documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > > * Configuration error. Please fix your configfile > > (/etc/syslog-ng/syslog-ng.conf) > > > > It is not a very big deal at the moment, as i've reverted back to version > > 2.1.4, but i'd like to keep my system current, and somewhat up to date. > this > > server's main function is as a syslogger for a few firewalls though, so i > > cannot leave it unable to log for long. > > > > hope someone can help. > > > > cheers > > andip > > > _____________________________________________________________________________ > _ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.campin.net/syslog-ng/faq.html > > > > > >

1 0

More verisign questions
by Jimmy McDonald 15 Dec '09

15 Dec '09

Hello, Thank you very much for the information! It got me one step closer. My root CA does not have basicConstraints set, but my intermediate does. Is there any way around this issue? I have spoken with my CA (Verisign) and they cannot provide a different root CA. Any ideas? Thank you, Jimmy Sent from my iPhone... So expect typos.

2 1

syntax error in config-file
by andip 15 Dec '09

15 Dec '09

Hi folks, I just tried updating syslog-ng to version 3.0.4, from 2.1.4. i use the gentoo linux-distro, and the new version came into "stable" gentoo a few days ago. I'm no syslog-ng expert, but i use it to log quite a few things, so my config-file it not default. I've read a bit in the admin-guide, but did not find any reason to my problem. i've tried converting my 2.1.4 config-file to the new 3.0.4 version, with no success. this is parts of my old config-file. ### are comments made to reflect changes i made for v2 -> v3 conversion ---------------------------------------------------------------------------- options { chain_hostnames(off); ### changed this to "no" sync(0); ### changed this to "flush_lines" time_sleep(20); log_fifo_size (2048); create_dirs (yes); perm (0640); dir_perm (0750); stats(43200); ### changed this to "stats_freq" owner (syslogger); group (syslogger); perm (0664); }; source sys { unix-stream("/dev/log" max-connections(256)); internal(); file("/proc/kmsg"); }; source net { udp(); }; destination clients { file ("/var/log/fwlogs/netclients/$HOST"); }; destination console_all { file ("/dev/tty12"); }; destination authlog { file ("/var/log/authlog"); }; destination messages { file ("/var/log/messages"); }; destination maillog { file ("/var/log/maillog"); }; destination ipflog { file ("/var/log/ipflog"); }; destination imaplog { file ("/var/log/imaplog"); }; destination console { file ("/dev/console"); }; destination syslog { file ("/var/log/syslog"); }; ### changed to _syslog destination komm { file ("/var/log/fwlogs/kommunikasjon-context.log"); }; destination asa { file ("/var/log/fwlogs/asa.log"); }; destination edb { file ("/var/log/fwlogs/edb-pix.log"); }; destination gje { file ("/var/log/fwlogs/gjerdrum.log"); }; destination nes { file ("/var/log/fwlogs/nes.log"); }; destination ull { file ("/var/log/fwlogs/ullensaker.log"); }; destination hur { file ("/var/log/fwlogs/hurdal.log"); }; destination eid { file ("/var/log/fwlogs/eidsvoll.log"); }; destination nan { file ("/var/log/fwlogs/nannestad.log"); }; destination datas { file ("/var/log/fwlogs/datasenter-context.log"); }; destination mgmt { file ("/var/log/fwlogs/management-context.log"); }; destination wifi { file ("/var/log/fwlogs/wifi-context.log"); }; destination aplog { file ("/var/log/aplog/aplog.txt"); }; filter aplog { host (10.20.); }; ### this line caused the syntax error (line 35) filter gje { host (10.8.30.28); }; filter nes { host (10.8.30.20); }; filter ull { host (10.8.30.36); }; filter hur { host (10.8.30.12); }; filter eid { host (10.8.30.44); }; filter nan { host (10.8.30.52); }; filter datas { host (10.8.0.1); }; filter mgmt { host (10.8.30.60); }; filter wifi { host (10.8.30.92); }; filter asa { host (ASA-R111); }; filter komm { host (10.8.30.76); }; filter edb { host (edb-pix); }; filter emerg { level (emerg); }; filter alert { level (alert .. emerg); }; filter crit { level (crit .. emerg); }; filter err { level (err .. emerg); }; filter warning { level (warning .. emerg); }; filter notice { level (notice .. emerg); }; filter info { level (info .. emerg); }; filter debug { level (debug .. emerg); }; filter kern { facility (kern); }; filter user { facility (user); }; filter mail { facility (mail); }; filter daemon { facility (daemon); }; filter auth { facility (auth); }; filter syslog { facility (syslog); }; filter lpr { facility (lpr); }; filter news { facility (news); }; filter uucp { facility (uucp); }; filter cron { facility (cron); }; #filter local0 { facility (local0); }; #filter local1 { facility (local1); }; #filter local2 { facility (local2); }; #filter local3 { facility (local3); }; #filter local4 { facility (local4); }; #filter local5 { facility (local5); }; #filter local6 { facility (local6); }; #filter local7 { facility (local7); }; filter user_none { not facility (user); }; filter kern_debug { filter (kern) and filter (debug); }; filter daemon_notice { filter (daemon) and filter (notice); }; filter mail_crit { filter (mail) and filter (crit); }; filter mesg { filter (kern_debug) or filter (daemon_notice) or filter (mail_crit); }; filter authinfo { filter (auth) or program (sudo); }; log { source (sys); destination(messages); }; log { source (sys); destination(console_all); }; log { source (sys); filter (authinfo); destination (authlog); }; log { source (sys); filter (mail); destination (maillog); }; #log { source (sys); filter (local0); destination (ipflog); }; #log { source (sys); filter (local1); destination (imaplog); }; log { source (sys); filter (syslog); destination (syslog); }; log { source (sys); filter (emerg); filter (user_none); destination (console); }; log { source (sys); filter (mesg); filter (user_none); destination (messages); }; log { source (net); destination (clients); }; log { source (net); filter (komm); destination (komm); }; log { source (net); filter (asa); destination (asa); }; log { source (net); filter (mgmt); destination (mgmt); }; log { source (net); filter (wifi); destination (wifi); }; log { source (net); filter (datas); destination (datas); }; log { source (net); filter (wifi); destination (wifi); }; log { source (net); filter (gje); destination (gje); }; log { source (net); filter (nan); destination (nan); }; log { source (net); filter (ull); destination (ull); }; log { source (net); filter (hur); destination (hur); }; log { source (net); filter (eid); destination (eid); }; log { source (net); filter (nes); destination (nes); }; log { source (net); filter (edb); destination (edb); }; log { source (net); filter (aplog); destination (aplog); }; #log { source (net); filter (komm); destination (komm); }; ---------------------------------------------------------------------- This is the error i got : syntax error in /etc/syslog-ng/syslog-ng.conf at line 35. syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng * Configuration error. Please fix your configfile (/etc/syslog-ng/syslog-ng.conf) It is not a very big deal at the moment, as i've reverted back to version 2.1.4, but i'd like to keep my system current, and somewhat up to date. this server's main function is as a syslogger for a few firewalls though, so i cannot leave it unable to log for long. hope someone can help. cheers andip

2 1

multiple destinations
by Ulrich David 14 Dec '09

14 Dec '09

Hi, If I use multiple destinations like : log { source(src); filter(f_52); destination(mysql_52); destination(file_52); flags(final); }; If my first destination is down (a mysql database), does the second destination works correctly ? There is 2 fifo, one for each destinations, but are the 2 destinations working totally independantly? Regards David

2 1