July 2009 - syslog-ng - lists.balabit.hu

problem configuring syslog-ng with TLS
by Mohsen Alimomeni 21 Jul '09

21 Jul '09

Hi everyone, I want to configure syslog-ng with TLS, but there are problems in client connecting to server. This is the error in client side: { Jul 16 17:04:10 momeni syslog-ng[31084]: syslog-ng starting up; version='3.0.3' Jul 16 17:04:10 momeni syslog-ng[31084]: Syslog connection established; fd='7', server='AF_INET(192.168.13.39:1999)', local='AF_INET(0.0.0.0:0)' Jul 16 17:04:10 momeni syslog-ng[31084]: Certificate validation failed; subject='emailAddress=momeni(a)amnafzar.com, CN=momeni, ..to the end! ', error='invalid CA certificate', depth='1' Jul 16 17:04:10 momeni syslog-ng[31084]: SSL error while writing stream; tls_error='SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed' Jul 16 17:04:10 momeni syslog-ng[31084]: I/O error occurred while writing; fd='7', error='Broken pipe (32)' Jul 16 17:04:10 momeni syslog-ng[31084]: Syslog connection broken; fd='7', server='AF_INET(192.168.13.39:1999)', time_reopen='60' } To make sure my certificates are valid I run two commands: On server: openssl s_server -CApath CA/ -CAfile CA/cacert.pem -cert Client/clientcert.pem -key Client/clientkeye em -accept 8080 On client: openssl s_client -connect 192.168.13.39:8080 The result on the client is the server certificate and the last line is: { Verify return code: 19 (self signed certificate in certificate chain) } The client and server are both syslog-ng_3.0.2 (and 3.0.3) in ubuntu. These are the steps I configured the client and server: I used the script CA.sh to genereate X.509 certificates. I created a cacert using the command: CA.sh -newca created the ca files :cacert.pem, .. created a request: CA.sh -newreq rename the files created to syslog_cert.pem and syslog_ket.pem signed it with the ca: CA.sh -sign Then I copied the cacert.pem file to client and created it's hash as explained in syslog-ng documentation. configuration files: Client config: *destination d_tlsserver { tcp("192.168.13.39" port(1999) tls(ca_dir("/opt/syslog-ng/certs") peer_verify(required-trusted) )); };* Server config: *source rezvani_tls { tcp(ip(0.0.0.0) port(1999) max-connections(300) tls(key_file("/opt/certs/newcerts/syslogs_key.pem") cert_file("/opt/certs/newcerts/syslogs_cert.pem") peer_verify(optional-untrusted) )); }; * -- __ \ /_\\_-//_ Mohsen Alimomeni

4 5

build problem on FreeBSD 7.2
by ko 18 Jul '09

18 Jul '09

Hi all, I'm trying to build v3.0.3 from source (with sql support) on a fresh install of FreBSD 7.2, and I have the following error when I lauch the make : "afsql.c:36:21: error: dbi/dbi.h: No such file or directory" I think I miss a library, something nedded for database support but I don't know what ? Could anymone help me ? Thanks a lot. Karl.

3 2

syslog-ng premium "$HOST" issue
by Arya, Manish Kumar 17 Jul '09

17 Jul '09

Hi, I am using syslog-ng opensource version 1.6.5 on central syslog server. which is receiving logs from 4 collectors and some individual hosts. To evaluate syslog-ng premium I got 30 day license of "syslog-ng-premium-edition 3.0.2a" and installed it on a new box. and forward events coming on central syslog server to this new box using a file template template("'$HOST'|'$FACILITY'|'$PRIORITY'|'$PROGRAM'|'$MONTH $DAY$ $YEAR $HOUR:$MIN:$SEC'|'$MSGONLY'\n")); but here in $HOST I am getting name of central syslog server instead of actual host. While in ver 1.6.5 it appears correct using same template on events coming from 4 collectors. is there version incompatibility or some bug in ver 3.0.2a Regards, -Manish

2 3

syslog-ng OSE 3.1 changes pushed
by Balazs Scheidler 16 Jul '09

16 Jul '09

Hi, I'm posting here to let you know that I've pushed the following patches to the 3.1 repository: a4d7533d9c826dcf405d94aa6644587feacf9e96 [patterndb] fixed parser node first char match handling 9e7a729f6b450c7ef5bf0b22943771f040fd110e [patterndb] Consider the value of the parameter when checking if two parser nodes are equal 73fe61c0dccd0453cb18d41e3bdca54a2525fba1 [patterndb] use strcmp instead of prefix match when looking up parser name 8c9e4099477866829b9de8dbdbcca97806856f00 [patterndb] added FLOAT radix parser ae1b7fd8f386c141056247264ccd06da78614136 On error r_insert_node displays more information about the node that caused the problem in logpatterns.c for rules, the rule_id is di 6be05a55fcfd55b4efa106e5c507ad3fad9cbdbc [patterndb] adapted db_parser configuration loader to new syntax with rulesets b0869709f98566d39b5b3d8bd793cdf12ccc1996 [patterndb] db_parser NUMBER parser now handles hexadecimal numbers in 0xXXXXX form 60dc446418bcb9e41436d5ab287f66a604172a6f [unit tests] white space cleanup 32e346803c04c8454ae7f9313ebf5f9fdac83553 [patterndb] added IPv6 and IPvANY parsers to db_parser a2b156f67a4cb7c5ee9438864c6d93870e668ac1 fixed a memory leak around parser match storing, check for parser node name length 53c07dc8bba32dab918d6ab782e0e1dfc6b210ff fixed a memory leak in db-parser() dynamic value handling 1c31f647245df4e6f8773d49c04ca32deb9d9bfc added testcase for real log radix parsing This contains a couple of patterndb bugfixes, some new parsers and the support for the v2 patterndb format. This code currently only supports v2, I'm going to publish a script that converts v1 to v2 automatically. Otherwise this also means that from now it is possible to use the syslog-ng Store Box patterns compiled by BalaBit directly from syslog-ng OSE: http://www.balabit.com/downloads/files/patterndb/1.0-20081117/patterndb/ If anyone asks, I'm willing to create an "alpha" release from the current state of affairs. The alpha sign only means that we still haven't reached all goals for 3.1 (as per the syslog-ng roadmap published on the website). I don't expect to have stability problems with the above changes, those are mostly trivial and have associated automatic testcases. -- Bazsi

1 0

db-parser
by Jacopo Cappelli 16 Jul '09

16 Jul '09

I can't understand how work db-parser, i want to parse a string: m-56767-1333854 79.127.28.54 <mfdesigner(a)diggitgraphics.com> MessageScore is now 30, after adding 30 (Suspicious HELO - contains IP: '[79.127.28.54]') I wanto to have m-56767-1333854 on $ID_MESSAGE and 79.127.28.54 <mfdesigner(a)diggitgraphics.com> MessageScore is now 30, after adding 30 (Suspicious HELO - contains IP: '[79.127.28.54]') on $MSG i try with: <patterndb> <ruleset name='assp'> <pattern>assp</pattern> <rules> <rule provider='balabit' id='1' class='system'> <patterns> <pattern>@QSTRING:id_message: @ @QSTRING:msg@</pattern> </patterns> </rule> </rules> </ruleset> </patterndb> But i have the field on db empty. I read link about db-parser usage but i can't resolve... Thanks, Jacopo -- Linux, Windows Xp ed MS-DOS (anche conosciuti come il Bello, il Brutto ed il Cattivo). -- Matt Welsh

4 9

Syslog-ng with --enable-spoof-source, does it work for anyone?
by Scott Ware 16 Jul '09

16 Jul '09

I have been trying to figure out why I can't seem to get this option to work? Everything complies ok, but in the syslog-ng.conf file, when I have the spoof_source(yes) option, my syslog messages don't get forwarded on to my destination. But if I remove the spoof_source(yes) option, then they do. I just want to know if anyone has had this option work for them before. Thanks!

1 0

Another beginners problem
by Andy Kannberg 16 Jul '09

16 Jul '09

Hi folks, I'm new to syslog-ng. I'm trying to get it running on a bunch of Ubuntu 8.04 LTS and OEL 5.3 systems. For a start, I'm trying to get it working on 2 Ubuntu 8.04 LTS boxes. What I want is that all logging of all systems is sent to a central loghost. Systems do not need to keep a local logfile. So, I've shamelesly copied over a (as said working) config from another thread a few days ago on this list. The client part works, at least, the reload goed ok. However, on the server, the reload fails, giving no kind of warning or message whatsoever to hint where the problem lies. The configuration is as follows (With thanks to Siem Korteweg, from whom I copied the config over). Client & server: source s_internal { internal(); }; destination d_syslogng_log { file("/var/log/syslog-ng.log"); }; source s_local { unix-dgram("/dev/log"); file("/proc/kmsg" program_override("kernel:")); }; destination d_remote { tcp("10.0.13.152" port(514) ) ; }; destination d_local { file("/var/log/messages"); }; log { source( s_internal ); destination( d_remote ); }; log { source( s_internal ); destination( d_syslogng_log ); }; log { source( s_local ); destination( d_remote ); }; log { source( s_local ); destination( d_local ); }; On the central loghost, adittional lines are added: source s_network { tcp (ip("10.0.13.152") port(514)); }; destination d_network { file("/var/log/syslog-ng/hosts/$HOST_FROM/$R_YEAR/$R_MONTH/$R_YEAR-$R_MONTH-$R_DAY" create_dirs(yes)); }; log { source( s_network ); destination( d_network ); }; But, as said, a reload fails. Can someone help me out a little ? Oh, I am running syslog-ng 3.03, installed from the .deb package available on the website of Balabit. cheers and thanks in advance. Andy

4 5

[Fwd: Re: iptables logging in a separate logfile works not properly]
by Ralf Heidenreich 14 Jul '09

14 Jul '09

Hello, if I use the final flag, postfix loggs to /var/log/messages, not to /var/log/maillog. What I am doing wrong? regards ralf Here my config: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; destination iptables { file("/var/log/firewall.log"); }; filter iptables { match("INPUT:"); }; log { source(s_sys); filter(iptables); destination(iptables);flags(final); }; #log { source(s_sys); filter(iptables); destination(iptables); }; filter noiptables { not match("INPUT:"); }; log { source(s_sys); filter(noiptables); destination(d_kern); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/messages"); }; destination d_mlal { usertty("*"); }; # direct iptables logs into /var/log/firewall.log filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; #log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; Ralf Heidenreich schrieb: > Hello, > > can you give me an example, how to use the final flag? > thanks in advance. > > regards > Ralf > > Szalay Attila schrieb: >> Hi, >> >> On Fri, 2009-05-29 at 14:15 +0200, Ralf Heidenreich wrote: >>> Hello, >>> >>> I have the following line in iptables: >>> iptables -A INPUT -j LOG --log-prefix "INPUT: " >>> In syslog-ng (/etc/syslog-ng/syslog-ng.conf) I have the following config: >> [...] >>> filter iptables { match("INPUT:"); }; >>> log { source(s_sys); filter(iptables); destination(iptables); }; >> [...] >>> filter f_default { level(info..emerg) and >>> not (facility(mail) >>> or facility(authpriv) >>> or facility(cron)); }; >> [...] >>> log { source(s_sys); filter(f_default); destination(d_mesg); }; >> syslog-ng do not stop the evaluation when a destination is found. And >> because of this and because the second log statement is matching to the >> line the syslog-ng store it to the message too. >> >> If you want to order the syslog-ng to stop you can use the final >> directive. >> >> >> >> ------------------------------------------------------------------------ >> >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.campin.net/syslog-ng/faq.html >> > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

1 1

Missing hosts
by Christopher Bland 14 Jul '09

14 Jul '09

Hi guys, I have a problem that needs guru magic. When I first setup syslog-ng I had too many host/log entries for the system I was using to handle. I had tens of thousands of entries and each day created a 10G database table. I remedied this logging certain hosts to flat files and separating host and network equipment into different databases. I left my original catch all DB in place for comparison, to verify that all hosts were being logged properly. When I do queries I find that a number of hosts are in the catch all but not in the individual databases. Many of the missing hosts should be caught by the netmask entries but aren't. options { sync (0); time_reopen (10); log_fifo_size (10000); time_sleep(50); log_fetch_limit(100); chain_hostnames(no); long_hostnames (off); keep_hostname(no); use_dns (yes); dns_cache(yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; source s_everything { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(); }; destination d_database { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; destination d_networkdb { pipe("/tmp/mysql-network.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; destination d_hostsdb { pipe("/tmp/mysql-hosts.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; filter f_nofw { not host("fwhost"); }; filter f_hosts { netmask("10.16.5.0/255.255.255.0") or netmask("10.16.6.0/255.255.255.0") or host("hostA") or host("hostB") or host("hostC"); }; filter f_network { not host("fwhost") and ( host("host1") or host("host2") or host("host3") or netmask("10.16.57.0/255.255.255.0") or netmask("10.16.36.0/255.255.255.0") or netmask("10.16.120.0/255.255.255.0") or netmask("10.16.217.0/255.255.255.0") ); }; log { source(s_everything); filter(f_hosts); destination(d_hostsdb); }; log { source(s_everything); filter(f_network); destination(d_networkdb); }; log { source(s_everything); filter(f_nofw); destination(d_database); };

2 3

What is syslog-ng control socket?
by Subodh Nijsure 13 Jul '09

13 Jul '09

When I start syslog-ng I always get following error in the log. Jun 17 10:34:22 Node1 syslog-ng[836]: syslog-ng starting up; version='3.0.2' Jun 17 10:34:22 Node1 syslog-ng[836]: Error opening control socket, bind() faile d; socket='/home/subodh/install/syslog-ng/install//var/syslog-ng.ctl', error='N o such file or directory (2)' What is the control socket in syslog-ng? Should I be worried about this,what functionality do I loose 'cause syslog-ng is not able to create control socket? I am running version 3.0.2 on PowerPC 85xxx platform. Below is the output of syslog-ng -v syslog-ng 3.0.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#e1c8e7f086f5c5b73727cfef6d351614d87574ed Compile-Date: Jun 16 2009 16:54:10 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: off Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on /Subodh Nijsure

3 2