June 2009 - syslog-ng - lists.balabit.hu

Syslog-ng beginners guide
by Cosmin Neagu 10 Jul '09

10 Jul '09

Hello everybody, Sorry for bothering you with a beginners question. I have a cacti implementation in my network and a want to integrate it with syslog-ng. I have mostly cisco routers, all configured to sent syslog messages to two linux boxes (Ubuntu 9.04 and FedoraCore 10) where i have installed syslog-ng. I'm not able to find where the logs are kept, so this drives me crazy. Do you know any site or resource where i can find some beginners guide about using syslog-ng with cisco routers? I mean, a guide for someone who never used syslog-ng before. Thanks. -- Cosmin Neagu NOC Team Leader Str. I. G. Duca nr 36 Otopeni, Judetul Ilfov, 075100 Romania Tel: 021 303 3159 / 0732 669 193 www.omnilogic.ro

8 20

Send a specific log by email
by Reaky Rok 06 Jul '09

06 Jul '09

Hi friends I have syslog-ng installed in RHEL5 server, I make it as CEntral log for all servers in my network, Filtered by IP Now What I want to do is make it send to me an email for a specific log for one of my server, In other word when any log sent from this IP (192.168.1.1 ) For example to send me email with this new log value to myemail(a)mydomain.com The following is the part of configuration for my syslog-ng.conf that related with remote servers. ============================================= source s_remote { tcp(ip(0.0.0.0) port(514)); udp(ip(0.0.0.0) port(514)); }; destination d_separatedbyhosts { file("/var/log/syslog-ng/servers/$HOST/$FACILITY.log" owner("root") group("root") perm(0640) dir_perm(0750) create_dirs(yes)); }; log { source(s_remote); destination(d_separatedbyhosts); }; =============================================== Thanks Best Regards Reaky _________________________________________________________________ Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy! http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx…

4 15

Unable to set PRIORITY and LEVEL in rewrite
by Siem Korteweg 06 Jul '09

06 Jul '09

Hi, with the central logging of syslog in place, I moved on to the file /var/log/httpd/ssl_error_log to explore the syslog-ng (3.0.2-1 OSE on CentOS 5.3) capabilities with logfiles from other applications. The contents of this file are rather straightforward: [Wed Jun 24 12:14:49 2009] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Wed Jun 24 12:14:49 2009] [error] [client 192.168.3.178] PHP Notice: Undefined offset: 2 I want to skip the date/time (assuming there is no delay before syslog-ng processes the data) and to set the PRIORITY and LEVEL attributes to "warning" and "err". The following config file (included in the main config) should do the job. source s_http_ssl_error { file ( "/var/log/httpd/ssl_error_log" flags(no-parse) follow_freq(1) ); }; # Split the message. parser p_http_ssl_error { csv-parser( columns( "HTTP.TIMESTAMP", "HTTP.SEVERITY", "HTTP.MSG" # Match the remainder of the message (greedy). ) delimiters( " " ) flags( greedy, escape-double-char, strip-whitespace ) quote-pairs( '""[]' ) ); }; filter f_http_ssl_error_warn{ match( "warn" value( "HTTP.SEVERITY" ) ); }; rewrite r_http_ssl_error_warn{ set( "warning" value( "LEVEL" ) ); set( "warning" value( "PRIORITY" ) ); }; filter f_http_ssl_error_error{ match( "error" value( "HTTP.SEVERITY" ) ); }; rewrite r_http_ssl_error_error{ set( "err" value( "LEVEL" ) ); set( "err" value( "PRIORITY" ) ); }; # Eliminate the severity as soon as PRIORITY and LEVEL are set! # Set the attribute program to "http_ssl_error". template t_http_ssl_error{ template( "http_ssl_error ${HTTP.SEVERITY} ${HTTP.MSG}\n" ); }; # Send the message to the regular syslog in order to transfer it to the syslog-ng collector. destination d_http_ssl_error{ unix-dgram( "/dev/log" template( t_http_ssl_error ) ); }; # Handle the warnings. log { source( s_http_ssl_error ); parser( p_http_ssl_error ); filter( f_http_ssl_error_warn ); rewrite( r_http_ssl_error_warn ); destination( d_http_ssl_error ); flags( final ); }; # Handle the errors. log { source( s_http_ssl_error ); parser( p_http_ssl_error ); filter( f_http_ssl_error_error ); rewrite( r_http_ssl_error_error ); destination( d_http_ssl_error ); flags( final ); }; # Handle the other messages. log { source( s_http_ssl_error ); parser( p_http_ssl_error ); destination( d_http_ssl_error ); }; Inserting [warn], [error] and [other] lines in the logfile, results in the proper number of syslog-ng messages with the desired MSG-contents. However, the priority and level attributes are unchanged ("notice"). What is wrong? kind regards, Siem Korteweg

2 5

Syslog-ng on Ubuntu and OEL
by Andy Kannberg 06 Jul '09

06 Jul '09

Hi, In our environment we are thinking of using syslog-ng for logging purposes. We use Ubuntu 8.04 and OEL 5.3 Ubuntu 8.04 has a version of syslog-ng in it's repository. However, that is version 2.09, which I cannot find on the site of Balabit, only version 2.010 OEL has no syslog-ng in it's default repo's. I would like to use one version, to prevent compatibility-issues and to keep the environment as clean as possible. I saw that there are binary packages available for Debian and RedHat. However, as said, I would like to keep the environment as clean as possible. So if possible, no individual package installed outside of the package manager. Does anyone know if there are repositories available where I can get a recent version of syslog-ng for Ubuntu as well as OEL ?? cheers, Andy

3 3

Re: [syslog-ng] How to configure mail alerts
by ccie 6862 30 Jun '09

30 Jun '09

I had looked at this page several times, and I didn't realize the perl script on the page referenced by "Use this perl script to strip off the..." was the same as what was in the configuration file. It is working. Thank you very much. --- On Tue, 6/30/09, Siem Korteweg <Siem.Korteweg(a)qnh.nl> wrote: > From: Siem Korteweg <Siem.Korteweg(a)qnh.nl> > Subject: Re: [syslog-ng] How to configure mail alerts > To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> > Date: Tuesday, June 30, 2009, 12:37 AM > Have a look at: http://www.campin.net/newlogcheck.html > > regards, > > Siem Korteweg > > -----Oorspronkelijk bericht----- > Van: syslog-ng-bounces(a)lists.balabit.hu > namens ccie 6862 > Verzonden: ma 29-6-2009 22:25 > Aan: syslog-ng(a)lists.balabit.hu > Onderwerp: [syslog-ng] How to configure mail alerts > > > This is a pretty basic question, but I'm stumped as to what > to install to get > email alerts. The configuration is simple, but in the > sample configs I've run > across, I've seen something similar to the following: > > destination mail-alert-perl { > program("/usr/local/bin/syslog-mail-perl"); }; > > I've installed perl-Parse-Syslog-1.10-1.el4.rf.noarch.rpm > and > perl-Parse-Syslog-Mail-0.14-1.el4.rf.noarch.rpm, but > nothing remotely close > has been installed. Can someone please point me in the > right direction? > > Thanks > > > > _____________________________________________________________________________ > _ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > > > > -----Inline Attachment Follows----- > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > >

1 0

How to configure mail alerts
by ccie 6862 30 Jun '09

30 Jun '09

This is a pretty basic question, but I'm stumped as to what to install to get email alerts. The configuration is simple, but in the sample configs I've run across, I've seen something similar to the following: destination mail-alert-perl { program("/usr/local/bin/syslog-mail-perl"); }; I've installed perl-Parse-Syslog-1.10-1.el4.rf.noarch.rpm and perl-Parse-Syslog-Mail-0.14-1.el4.rf.noarch.rpm, but nothing remotely close has been installed. Can someone please point me in the right direction? Thanks

2 1

change msg text before db inserting
by Henk van Lingen 30 Jun '09

30 Jun '09

Hi, Is is possible to change the message text before it is inserted into a database? I have syslog-ng-3.0.2 running and it does insert the messages directly into a PostgreSQL database, using the new sql(type(pgsql) destination feature. The problem is I have lots of cisco firewall loggings, and in the database I have of gin index for doing full text searching. For this index, the database decomposes the message into tokens. I want to be able to search on IP-numbers. However, in lines like world/123.456.192.46(0) -> some-fwsm/123.456.221.121(0) this won't work because the tokens are world/123.456.192.46 and /123.456.192.46, not 123.456.192.46. To solve the prob it would be nice if there is a way to replace the slashes with spaces before the message goes to the database. Regards, -- Henk van Lingen, (o- -+ Netwerk & Telefonie, ICT Service Center /\ | Universiteit Utrecht, Jenalaan 18a, kamer 1.40 v_/_ http://henk.vanlingen.net/ http://www.tuxtown.net/netiquette/

3 2

Talk on syslog-ng a the 10th Libre Software Meeting
by ILLES, Marton 26 Jun '09

26 Jun '09

Hi, For those of you interested, I will be giving a talk at the 10th Libre Software Meeting at Nantes, France. The talk will be in English and I try to focus on syslog-ng 3.0 and the db-parser feature. http://2009.rmll.info/Syslog-ng-3-a-step-towards-log.html?lang=en If you gonna be there at the conference and want to meet to discuss something syslog-ng related stuff or anything else, just drop me line. cheers, Marton -- Key fingerprint = F78C 25CA 5F88 6FAF EA21 779D 3279 9F9E 1155 670D

1 0

Inconsistent Command Line Arguments
by Leonid Chaichenets 24 Jun '09

24 Jun '09

Hello List, there seems to be a problem with the command line parameter list of syslog-ng (tested for ver. 3.0.2): from what I understand from the source code command line parameters are defined in gprocess.c (g_process_option_entries[]) and in main.c (syslogng_options[]). Only the latter are described by syslog-ng --help (but both of them are usable). Furthermore, the short version of '--chroot' should be '-C', according to the syslog-ng administration guide (The syslog-ng manual pages -> syslog-ng), but '-C' is defined in gprocess.c as "Set default capability set". According to gprocess.c the correct short version for '--chroot' would be '-R', but it collides and is overridden by the short version of the same name from main.c (there it means "persist-file"). IMHO this is a security relevant bug: one might think syslog-ng is running chrooted while it actually has root powers. PS: This also applies to the git-versions syslog-ng-3.0.git and syslog-ng-3.1.git. -- Best Regards, Leonid Chaichenets.

2 2

apache
by john.li＠fifasci.com.ph 24 Jun '09

24 Jun '09

Hello, How do i enable send apache logs on syslog-ng client? Im using centos5 the default location of logs are /var/log/httpd/access_log and /var/log/httpd/error_log? any ideas. tnx Here's my syslog-ng client configuration source log002 { unix-stream("/dev/log" max_connections(1000)); internal(); }; destination splunk {udp("x.x.x.x" port(514));}; log { source(log002); destination(splunk); };

3 3