March 2009 - syslog-ng - lists.balabit.hu

source file wildcard problems
by Dan Gunter 27 Mar '09

27 Mar '09

Hi, I am having trouble getting the new file wildcard option to work. I am testing it with the following very simple file-to-file configuration: @version: 3.0 options { time_sleep(500); # polling interval, in ms (make this once per second) use_fqdn(yes); # use fully qualified domain names ts_format(iso); # use ISO8601 timestamps # for normal load flush_lines (10); # number of lines to buffer before writing to disk flush_timeout (1000); # 1 second timeout log_fifo_size(100); stats_freq(3600); # number of seconds between syslog-ng internal stats events; these are useful # for ensuring syslog-ng is not getting overloaded }; # Debugging source syslog_ng { internal(); }; destination debug_dest { file("/u/dang/local/var/log/syslog-ng- internal.log" perm(0644) ); }; log { source(syslog_ng); destination(debug_dest); }; # Other source simple_src { file("/u/dang/local/var/log/myfile.log" follow_freq(1) flags(no-parse) program_override("my_log ") ); }; source test_src { file ("/u/dang/local/var/log/test*.log" follow_freq(1) flags(no-parse) program_override("test_log ") ); }; destination test_dest { file ("/u/dang/local/var/log/collected.log" perm(0644) ); }; log { source(simple_src); destination(test_dest); }; log { source(test_src); destination(test_dest); }; The behavior I am seeing is that anything appended to the static file "myfile.log" shows up in "collected.log" a second later. But new files of the pattern "test-1.log", etc. are never forwarded, and if there are existing files of this name at startup they are ignored. The internal log says: 2009-03-25T10:02:20-07:00 host.org syslog-ng[29624]: Follow-mode file source not found, deferring open; filename='/u/dang/local/var/log/ test*.log' 2009-03-25T10:02:20-07:00 host.org syslog-ng[29626]: syslog-ng starting up; version='3.0.1' My syslog-ng version is: -bash-3.1$ syslog-ng -V syslog-ng 3.0.1 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng- ose--mainline--3.0#master#93a342dae3a2b0cb15811d0c34ea7f58b3fba14e Compile-Date: Mar 25 2009 09:08:54 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: off Any help or tips would be appreciated. Thanks, -Dan

4 5

Re: [syslog-ng] Constant syslog-ng startup message
by chris packham 27 Mar '09

27 Mar '09

On Thu, 2009-03-26 at 15:56 -0400, srainville(a)videotron.ca wrote: > syslog-ng keeps logging the following message. I installed it using > the HEAD RPM for Linux RHEL4. Is there a problem with the startup, or > just a message that can be ignored? > > Mar 26 15:30:16 testserver syslog-ng[22090]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:18 testserver syslog-ng[22092]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:20 testserver syslog-ng[22094]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:21 testserver syslog-ng[22095]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:22 testserver syslog-ng[22097]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:23 testserver syslog-ng[22098]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:24 testserver syslog-ng[22099]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:25 testserver syslog-ng[22100]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:26 testserver syslog-ng[22101]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:28 testserver syslog-ng[22103]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:29 testserver syslog-ng[22104]: syslog-ng starting up; > version='3.0.1+binpkg4' That looks like either multiple instances of syslog-ng are being started or its being stopped and started multiple times ('ps | grep syslog-ng' should tell you which). Either way it's probably not good. At best its adding unnecessary system load, at worst its losing messages. Does RHEL4 use upstart or some other special init system that tries to keep things running if they exit? You may see this kind of thing if there was an error in your config file which would cause syslog-ng to exit only to be re-started by init.

3 3

Constant syslog-ng startup message
by srainville＠videotron.ca 26 Mar '09

26 Mar '09

1 0

Syslog-ng and tcpd
by Liam Kirsher 25 Mar '09

25 Mar '09

Hi -- I'm noticing lot's of these in the /var/log/messages file: > Mar 24 15:16:07 domU-12-31-39-00-09-F2 syslog-ng[25138]: warning: > /etc/hosts.allow, line 17: host name/name mismatch: > ec2-67-202-53-122.compute-1.amazonaws.com != > domU-12-31-35-00-04-A1.z-2.compute-1.internal > Mar 24 15:16:07 domU-12-31-39-00-09-F2 syslog-ng[25138]: Syslog > connection rejected by tcpd; from='AF_INET(67.202.53.122:48703)' > Mar 24 15:16:17 domU-12-31-39-00-09-F2 syslog-ng[25138]: Syslog > connection accepted; fd='22', client='AF_INET(67.202.53.122:48187)', > local='AF_INET(0.0.0.0:5000)' Apparently, access is being denied, as it should be. It's just a little disconcerting to see the "connection accepted" message after it has been rejected. > telnet this.domain.com 5000 > Trying 171.122.232.186... > Connected to this.domain.com. > Escape character is '^]'. > Connection closed by foreign host. Is this the expected behavior? Is there some way to prevent all these messages from showing up in the log file? Liam -- Liam Kirsher PGP: http://liam.numenet.com/pgp/

3 2

Syntax error due to include files in syslog-ng.conf
by Ritesh Sood 25 Mar '09

25 Mar '09

Hi all, I've built syslog-ng V 3.0.1 from the released source and have the following at the top of syslog-ng.conf ----- @version:3.0 include "/etc/syslog-ng/options.inc"; include "/etc/syslog-ng/src-dest-defs.inc"; include "/etc/syslog-ng/filter-defs.inc"; include "/etc/syslog-ng/common-log-defs.inc"; ------ syntax checking as # syslog-ng -s returns with syntax error at line 3. Here are the relevant portion from the syslog-ng-admin-guide.pdf ----- Every syslog-ng configuration file must begin with a line containing the version infor mation of syslog-ng. For syslog- ng version 3.0, this line looks like: @version:3.0 . . . The syslog-ng application supports including external files in its configuration file, so parts of its configuration can be managed separately. To include the contents of a file in the syslog- ng configuration, use the following syntax include "filename"; This imports the entire file into the configuration of syslog-ng, at the location of the include statement. If you specify a directory, syslog-ng will try to include every file in alphabetic order. When including configuration files, consider the following points: ---- The config file works okay if I copy-paste the corresponding files in place of the include statements so the included files themselves are syntactically correct. So I don't see where I'm making an error. I hope there isn't a bug in the source. I'm not counting out that possibility since there was a bug in the released source for which I had to obtain a patch from the git repo: https://lists.balabit.hu/pipermail/syslog-ng/2009-January/012400.html Help much appreciated ! Ritesh

2 2

[Bug 40] New: Cisco ASA format is not understood
by bugzilla＠bugzilla.balabit.com 23 Mar '09

23 Mar '09

https://bugzilla.balabit.com/show_bug.cgi?id=40 Summary: Cisco ASA format is not understood Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vincent.panel(a)telindus.be Type of the Report: --- Estimated Hours: 0.0 Syslog-ng receives messages like this from Cisco ASA devices : <PRI>MM DD YYYY HH:mm:ss HOSTNAME %MSGID: CONTENT "YYYY" part is not conform to BSD-style syslog timestamp : it shouldn't exist. Unfortunately, it can't be changed on the ASA side. Syslog-ng does not see any header in this message and think "MM" is the process sending the message, hence adds ":" behind it. Additionnaly, syslog-ng prepends its own header which leads to a total mess in the destination syslog... On the other hand, syslog-ng also receives messages from another Cisco device (FWSM) like this : <PRI>MM DD YYYY HH:mm:ss %MSGID: CONTENT Note the hostname is not specified. And this format is well understood by syslog-ng (no prepended header, no ":" after the month) ! I've also read here : http://www.balabit.com/dl/html/syslog-ng-v3.0-guide-admin-en.html/ch02s17.h… syslog-ng should be able to understand "PIX extended format" but I can't find anywhere in the documentation nor on the internet what it refers to... So would it be possible to make sure the first format is well understood by syslog-ng ? Regards, Vincent Panel -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

binary packages success/failure reports
by Balazs Scheidler 23 Mar '09

23 Mar '09

Hi, I'd be eager to hear any success/failure reports with the binary installation packages I've posted about last week. I'd really like to do a release of syslog-ng 3.0.2, but since I want to do that together with the binary packages and I don't want to be ashamed for the binary packages, I'd really be interested in some field testing. Thanks in advance. -- Bazsi

1 0

Re: [syslog-ng] syslog-ng using ssl
by Hahusseau, Thomas 23 Mar '09

23 Mar '09

Hi, Maybe you should try to launch syslog-ng with debug & verbose options to see error. I had some seg fault with ssl and syslog-ng and it's now fixed thanks to a patch posted on this mailing list. Bye Thomas -----Message d'origine----- De : syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] De la part de Luigi Augello Envoyé : dimanche 22 mars 2009 17:53 À : Syslog-ng users' and developers' mailing list; syslog-ng-bounces(a)lists.balabit.hu Objet : [syslog-ng] syslog-ng using ssl Hello I try to use ssl ad I have the follow scenario: One server (192.168.1.2) with this syslog.ng.conf ########################################### @version:3.0 source s_sk{file("/var/log/messages");}; source s_ssl{ tcp(ip("0.0.0.0") port (1999) tls(key_file("/root/Scaricati/certificati/privkey.pem") cert_file("/root/Scaricati/certificati/cacert.pem")));}; destination d_file{file("/var/log/syslog-ng.log");}; log{source(s_sk);destination(d_file);}; log{source(s_ssl);destination(d_file);}; One client (192.168.1.3) with this syslog.ng.conf ################################################### @version:3.0 source s_sk{file("/var/log/messages");}; destination d_file{file("/var/log/syslog-ng.log");}; destination d_ssl{tcp("192.168.1.2" port (1999) tls(ca_dir("/root/software/ca/")));}; log{source(s_sk);destination(d_file);}; log{source(s_sk);destination(d_ssl);}; I haven't a CA certificate and I use a self-signed certificate created by these instructions opennsl genrsa -out privkey.pem opennsl req -new -x509 -key prixkey.pem -out cacert.pem -days 1095 I follow step by step the instructions on "The syslog-ng Administrators guide " page 58 and so on and I copied the cacert.pem generated in the server in the client and I use ln -s .... When I try to start the server it starts. Though the client doesn't give me any errors it doesn't start. I suppose the certificate may crate some problems. tanks for help Luigi ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng using ssl
by Luigi Augello 22 Mar '09

22 Mar '09

Hello I try to use ssl ad I have the follow scenario: One server (192.168.1.2) with this syslog.ng.conf ########################################### @version:3.0 source s_sk{file("/var/log/messages");}; source s_ssl{ tcp(ip("0.0.0.0") port (1999) tls(key_file("/root/Scaricati/certificati/privkey.pem") cert_file("/root/Scaricati/certificati/cacert.pem")));}; destination d_file{file("/var/log/syslog-ng.log");}; log{source(s_sk);destination(d_file);}; log{source(s_ssl);destination(d_file);}; One client (192.168.1.3) with this syslog.ng.conf ################################################### @version:3.0 source s_sk{file("/var/log/messages");}; destination d_file{file("/var/log/syslog-ng.log");}; destination d_ssl{tcp("192.168.1.2" port (1999) tls(ca_dir("/root/software/ca/")));}; log{source(s_sk);destination(d_file);}; log{source(s_sk);destination(d_ssl);}; I haven't a CA certificate and I use a self-signed certificate created by these instructions opennsl genrsa -out privkey.pem opennsl req -new -x509 -key prixkey.pem -out cacert.pem -days 1095 I follow step by step the instructions on "The syslog-ng Administrators guide " page 58 and so on and I copied the cacert.pem generated in the server in the client and I use ln -s .... When I try to start the server it starts. Though the client doesn't give me any errors it doesn't start. I suppose the certificate may crate some problems. tanks for help Luigi

1 0

no_multi_line - have cake, eat too
by Ross Andrus 22 Mar '09

22 Mar '09

Hi, Thanks for the great tool! I really enjoy the power and flexibility of syslog-ng, and I wanted to send along a local modification I've made to the 3.0.1 release. My situation is that I'd like to have *both* the traditional behavior in which newlines are replaced with spaces, and also the new no_multi_line feature. Basically, developers want to see the stack traces, operations wants simple scanning and analysis. So, I created a new template macro named "ONELINE" that is a variant of the MSGONLY macro, but it makes a local copy of the buffer and performs the newline replacement on it, then sends it off. I didn't put any time into thinking about performance, so I won't be surprised to here there's a better way or etc, but it works well enough so far. Regards Ross Andrus

2 1