July 2009 - syslog-ng - lists.balabit.hu

SEC and syslog-ng - stop the SEC process
by Clayton Dukes 12 Jul '09

12 Jul '09

Hi, Not sure if I should ask this here or in the SEC forum... Does anyone know how to stop an sec process that's called from syslog-ng? i.e: when I issue an /etc/init.d/syslog-ng stop I still have the following running: root 28202 1 1 12:34 pts/1 00:00:00 /usr/bin/perl -w ... root 28207 28202 0 12:34 pts/1 00:00:00 sh -c /usr/bin/tail -F /tmp/sec.log ... root 28208 28207 0 12:34 pts/1 00:00:00 /usr/bin/tail -F /tmp/sec.log root 28209 28202 0 12:34 pts/1 00:00:00 sh -c /usr/bin/tail -F /tmp/sec_reactive.log... root 28210 28209 0 12:34 pts/1 00:00:00 /usr/bin/tail -F... Here's my syslog-ng config: destination d_sec { program("/www/svn/php-syslog-ng/scripts/sec/sec.pl -input=\"-\" -conf=/www/svn/php-syslog-ng/scripts/sec/001_proactive.conf -conf=/www/svn/php-syslog-ng/scripts/sec/002_reactive.conf -log=/var/log/php-syslog-ng/sec_run.log -intevents" template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n") ); }; # Tell syslog-ng to log to our new destination log { source(s_all); destination(d_sec); }; -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

2 3

Perl: Sys::Syslog - replace hostname (host rewrite rule?)
by Clayton Dukes 12 Jul '09

12 Jul '09

Hi folks, I'm trying to write a syslog "replay" script (in perl) and was wondering if there's a way to replace the source hostname so that it logs that host to syslog instead of my local machine's hostname. For example, the logit sub below logs (to /var/log/syslog): Jul 12 12:53:53 cdukes-lnx ./logreplay.pl[29476]: %CSM_SLB-6-RSERVERSTATE: Module 9 server state changed: SLB-NETMGT: TCP health probe re-activated server 10.13.164.13:0 in serverfarm 'ACC-FNET-AE' The original message is: Jun 19 05:11:57 ecdcsrvr2-6.some.domain 5476: Jun 19 05:11:56: %CSM_SLB-6-RSERVERSTATE: Module 9 server state changed: SLB-NETMGT: TCP health probe re-activated server 10.13.164.13:0 in serverfarm 'ACC-FNET-AE' So I want it to log the originating host as "ecdcsrvr2-6.some.domain" Additionally, if possible, I'd like to be able to log the original datetime field (but not as important as the hostname). Does anyone know if I could maybe accomplish this through a syslog-ng rule? sub logit { my ($priority, $message) = @_; setlogsock('unix'); # $prog is assumed to be a global. Also log the PID # and to Console if there's a problem. Use facility 'local7' since these are (presumably) Cisco messages. openlog($0, 'pid,cons', 'local7'); syslog($priority, $message); closelog(); return 1; } -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

1 0

syslog-ng-3.0.3 for x86_64?
by John Patrick Carroll 11 Jul '09

11 Jul '09

My question involves the availability of a x86_64 version of syslog-ng 3.0.3 for Red Hat/CentOS. According to the info on the first link below, it is available, but at the actual download site at the second link below, only a version for amd64 is available. Any ideas where I can get a version for Intel (x86_64)? I have had issues in the past with running amd64 binaries on an Intel 64-bit system, so I am reluctant to try to install the amd64 version on an Intel 64-bit system. Is the x86 version there 64 bit capable, i.e. does it use the 64-bit libraries by default, and fall back to 32-bit libraries only if 64-bit libraries are not available? http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… thanks, John John Patrick Carroll | Senior Systems Administrator GovDelivery, Inc. 408 St. Peter St, Ste 600 | St Paul, MN 55102-1147 651.757.4124 or 866.276.5583 ext. 124 Resources Website: www.govdelivery.com<http://www.govdelivery.com> Blog: www.reachthepublic.com<http://www.reachthepublic.com> Twitter: www.twitter.com/govdelivery<http://www.twitter.com/govdelivery>

2 1

Syslog-ng beginners guide
by Cosmin Neagu 10 Jul '09

10 Jul '09

Hello everybody, Sorry for bothering you with a beginners question. I have a cacti implementation in my network and a want to integrate it with syslog-ng. I have mostly cisco routers, all configured to sent syslog messages to two linux boxes (Ubuntu 9.04 and FedoraCore 10) where i have installed syslog-ng. I'm not able to find where the logs are kept, so this drives me crazy. Do you know any site or resource where i can find some beginners guide about using syslog-ng with cisco routers? I mean, a guide for someone who never used syslog-ng before. Thanks. -- Cosmin Neagu NOC Team Leader Str. I. G. Duca nr 36 Otopeni, Judetul Ilfov, 075100 Romania Tel: 021 303 3159 / 0732 669 193 www.omnilogic.ro

8 20

can't include externel file into syslog-ng.conf
by gatfi sami 08 Jul '09

08 Jul '09

Hi i am using syslog-ng 2.0.9-27.22 when i try to include an externel file into /etc/syslog-ng/syslog-conf options { long_hostnames(off); sync(0); perm(0640); stats(3600); #check_hostname(no); keep_hostname(yes); chain_hostnames(no); }; # # 'src' is our main source definition. you can add # more sources driver definitions to it, or define # your own sources, i.e.: # #source my_src { .... }; # source src { # # include internal syslog-ng messages # note: the internal() soure is required! # internal(); # # the default log socket for local logging: # unix-dgram("/dev/log"); }; *include "/opt/topnet/etc/client.conf";* ligne 52 But unfortunatly i have an error tarting syslog servicessyntax error at 52 > startproc: exit status of parent of /sbin/syslog-ng: 1 So how can i include an externel file into syslog-ng.conf ? need help around here gys i cant avoid including the file thks

2 1

about mysql log
by Jacopo Cappelli 08 Jul '09

08 Jul '09

Hi, it's possible to personalize mysql logging? actually i have $HOST,$FACILITY,$PRIORITY,$LEVEL,$TAG,$YEAR-$MONT-$DAY, $HOUR:$MIN:$SEC; $PROGRAM,$MSG i want to decompose $MGS in sub-level field because in $MSG i have a email-id and i use it to make web research. Thanks, Jacopo -- Linux, Windows Xp ed MS-DOS (anche conosciuti come il Bello, il Brutto ed il Cattivo). -- Matt Welsh

2 5

Forwarded messages modified by syslog-ng
by srainville＠videotron.ca 08 Jul '09

08 Jul '09

2 1

Must Restart syslog-ng to send email
by Reaky Rok 07 Jul '09

07 Jul '09

Dear friends I have a small problem with my syslog-ng server, I use a configuration to filter mail from log file and forwerd it to perl script to send it, the configuration like the following: ===================================================== source sme {file (/var/log/syslog-ng/servers/172.31.250.68/local7.log); }; destination maillog { program ("/usr/local/bin/syslog-mail-perl" ); }; log {source(sme); destination(maillog); }; ===================================================== And the perl script like the following: +++++++++++++++++++++++++++++++++++= #!/usr/bin/perl -n # thanks to Brian Dowling for an example with security in mind. $TO = 'reaky(a)domain.com'; $FROM = $TO; s/^//; open(MAIL, "|/usr/sbin/sendmail -t"); print MAIL "EOT"; To: $TO From: $FROM Subject: SME Log Alert: $_ $_ EOT close(MAIL); +++++++++++++++++++++++++++++++++++++++ It worked very fine when I send to root user in the machine, But when I tried to send to outside I found that I must restart syslog every time to send the mails to sendmail, In another word it buffer the emails tell I restart syslog-ng then It forwerd it to send mail and can see it in the mail log. Do you have any idea for that ? Thanks _________________________________________________________________ Windows Live™: Keep your life in sync. Check it out! http://windowslive.com/explore?ocid=TXT_TAGLM_WL_t1_allup_explore_012009

2 3

Send a specific log by email
by Reaky Rok 06 Jul '09

06 Jul '09

Hi friends I have syslog-ng installed in RHEL5 server, I make it as CEntral log for all servers in my network, Filtered by IP Now What I want to do is make it send to me an email for a specific log for one of my server, In other word when any log sent from this IP (192.168.1.1 ) For example to send me email with this new log value to myemail(a)mydomain.com The following is the part of configuration for my syslog-ng.conf that related with remote servers. ============================================= source s_remote { tcp(ip(0.0.0.0) port(514)); udp(ip(0.0.0.0) port(514)); }; destination d_separatedbyhosts { file("/var/log/syslog-ng/servers/$HOST/$FACILITY.log" owner("root") group("root") perm(0640) dir_perm(0750) create_dirs(yes)); }; log { source(s_remote); destination(d_separatedbyhosts); }; =============================================== Thanks Best Regards Reaky _________________________________________________________________ Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy! http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx…

4 15

Question about reopening sockets
by Zoltan HERPAI 06 Jul '09

06 Jul '09

Hi all, I'm writing a small script that would be fed with data via pipe by syslog-ng 2.0.9. The script itself is responsible for creating the socket into which syslog-ng would be writing to. I'm looking for an option within syslog-ng that would allow for reopening the socket in case the script dies, quits, or it gets removed for some reason (like an epic admin fail). I did some testing, and as per that, checking with lsof, syslog-ng opens the socket only on the first time it would be writing to that destination, which is good. After the socket gets removed, it shows up as... syslog-ng 31666 root 17u FIFO 253,2 24624 /tmp/pw.sock (deleted) ... in lsof, and the deleted flag does not go away after the socket gets recreated (f.e. the script is restarted), and a test message is sent into the given destination. Is there a config option available for reopening sockets? Thanks, Zoltan HERPAI

3 4