January 2010 - syslog-ng - lists.balabit.hu

problem with server
by Rory Toma 23 Jan '10

23 Jan '10

I am using syslog-ng-3.0.4-1.rhel on a CentOS-5.4 system. I am using tls, and have a setup as below. Here is what happens. It logs fine. However, if I reboot my client that is sending logs, it no longer works until I restart the syslog-ng server. What do I need to do here? @version: 3.0 options { flush_lines (3); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); dir_perm (0755); keep_hostname (yes); ts_format("iso"); }; source telo { tcp( port(80) tls( key_file("/export/tls/key.pem") cert_file("/export/tls/cert.pem") peer_verify(optional-untrusted)) ); }; # Myx destinations destination myx_dest_0000 { file("/logs/myx_008161000/$R_YEAR$R_MONTH$R_DAY/$HOS T-$R_YEAR$R_MONTH$R_DAY.log" owner(root) group(root) perm(0644) template("$YEAR- $MONTH-$DAY $HOUR:$MIN:$SEC $MSG\n") template_escape(no)); }; filter myx_filter_0000 { host("myx_001861000[0-9A-F]\{3\}$"); }; log { source(telo); filter(myx_filter_0000); destination(myx_dest_0000); };

2 6

Re: [syslog-ng] Messages dropped...
by Terry Slattery 22 Jan '10

22 Jan '10

> I started to notice that I was dropping udp packets... I'm seeing the same thing on a Centos 5.3 based system. I suspect something in the kernel or its interface to user space. My other syslog-ng systems are not dropping messages. -tcs -- Terry Slattery CCIE# 1026

1 0

Log all msgs but a specific filter
by PAUL WILLIAMSON 21 Jan '10

21 Jan '10

I need to log all messages except for a specific filter. I have the filter defined and these messages are getting logged to a separate file. However, I have one "main" log file where I do all my other processing. How can I include that filter in my destination so that it drops those specific messages from getting logged? Thanks, Paul ************************************ This email may contain privileged and/or confidential information that is intended solely for the use of the addressee. If you are not the intended recipient or entity, you are strictly prohibited from disclosing, copying, distributing or using any of the information contained in the transmission. If you received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. This communication may contain nonpublic personal information about consumers subject to the restrictions of the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. You may not directly or indirectly reuse or disclose such information for any purpose other than to provide the services for which you are receiving the information. There are risks associated with the use of electronic transmission. The sender of this information does not control the method of transmittal or service providers and assumes no duty or obligation for the security, receipt, or third party interception of this transmission. ************************************

3 2

question about pattern database version 1
by Guillaume Rousse 20 Jan '10

20 Jan '10

Hello list. The pattern database format 1 seems to force a mandatory program pattern, wich doesn't exists for some messages, suchas kernel oops and memory exhaustion issues: Jan 19 15:18:24 localhost Call Trace: Jan 19 15:18:24 localhost ntpd invoked oom-killer: gfp_mask=0x1201d2, order=0, oomkilladj=0 It seems to be corrected in version 2: rulesets can be defined without program pattern where these act as a fail-back rule sets if no program pattern is matching or when message does not have program part I guess that means I'm can't do anything to catch those problems as long as syslog-ng 3.1 OSE is released, right ? -- BOFH excuse #330: quantum decoherence

2 1

filtering messages by context
by Guillaume Rousse 20 Jan '10

20 Jan '10

Hello list. We use hardware-based SLB for our critical services (ldap, radius, dns, ...). It means we have probes testing our services every X seconds, polluting our logs. It's quite easy to catch those traces when they consist of a single message, as for our kerberos servers Jan 20 11:17:02 avron1 kdc[477]: connection closed before end of data after 0 bytes from IPv4:10.202.11.254 to tcp/0 Jan 20 11:17:04 avron1 kdc[477]: connection closed before end of data after 0 bytes from IPv4:10.202.11.254 to tcp/0 Jan 20 11:17:06 avron1 kdc[477]: connection closed before end of data after 0 bytes from IPv4:10.202.11.254 to tcp/0 This simple setup is enough to drop them: destination d_drop { } filter f_slb_kerberos_probe { message("connection closed before end of data"); }; log { source(s_sys); filter(f_kerberos); filter(f_slb_kerberos_probe); destination(d_drop); flags(final); }; However, when those traces actually consist of two messages, as in our LDAP servers, it's a bit more difficult: Jan 20 11:23:04 avron1 slapd[13802]: conn=68089 fd=51 ACCEPT from IP=10.202.11.254:39428 (IP=10.202.11.8:389) Jan 20 11:23:04 avron1 slapd[13802]: conn=68089 fd=51 closed (connection lost) Jan 20 11:23:06 avron1 slapd[13802]: conn=68090 fd=51 ACCEPT from IP=10.202.11.254:39434 (IP=10.202.11.8:389) Jan 20 11:23:06 avron1 slapd[13802]: conn=68090 fd=51 closed (connection lost) I can filter out the first message, using the probe IP adress as criteria, but not the second one: filter f_slb_ldap_probe { message("ACCEPT from IP=10.202.11.254"); }; log { source(s_sys); filter(f_ldap); filter(f_slb_ldap_probe); destination(d_drop); flags(final); }; is there any way to catch the connection id in the first message (68090), so as to filter out any following one refering to the same connection ? -- BOFH excuse #152: My pony-tail hit the on/off switch on the power strip.

2 1

Remove double timestamping
by Marty Sørensen 20 Jan '10

20 Jan '10

Hello .... New user to syslog-ng but still hoping someone can help me with a small config example Im forwarding syslog from my syslog-ng but when it arrives it has double timestamps/hostname: -- Jan 19 11:02:58 cut-hostname 10.229.5.2 32176: Jan 19 11:02:57: %SFF8472-5-THRESHOLD_VIOLATION -- I have addet this info my config: options { use_time_recvd(yes); keep_hostname(no); } also included: destination udp_forward { udp("<my ip>"); }; template fjern { template("$MSGONLY\n"); }; destination cisco_cupe { file("/var/log/cisco_cupe" template("fjern")); }; log { source(s_all); filter(local5); destination(cisco_cupe); destination(udp_forward); }; Cheers Martin

3 5

md5sum or sha1sum files not found .
by Mr. James W. Laferriere 19 Jan '10

19 Jan '10

Hello All , When going to ... http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.0.4/… I am not finding either a md5sum or sha1sum (or greater) file for the contents . Is this due to decission not to or a oversight ? Tia , JimL -- +------------------------------------------------------------------+ | James W. Laferriere | System Techniques | Give me VMS | | Network&System Engineer | 3237 Holden Road | Give me Linux | | babydr(a)baby-dragons.com | Fairbanks, AK. 99709 | only on AXP | +------------------------------------------------------------------+

5 15

Dear Syslog-Ng, If you can't find in google, try JUSTDIAL.COM
by Vadiraj 18 Jan '10

18 Jan '10

Dear Syslog-Ng,I strongly recommend this website www.justdial.com. It's a world class local search service & I've always found anything I've ever wanted.You can find info on any company, product, or service in over 240 cities in India.You can also call them up 24x7, on phone (69999999), a local call in 240 Indian cities.Ask for anything, you'll get the info on the phone and/or by SMS within 30 secs, and this service is at no cost!For a change, it's an original Indian idea and an Indian company with world class service, and with a vision to spread all over the world.Be a proud Indian and forward this to every Indian you know.Best Wishes,VadirajClick Here to unsubscribe.

1 0

Odd problem after upgrading from 2.1 to 3
by Jerry Bell 17 Jan '10

17 Jan '10

This config worked in syslog-ng 2.1 source NET {udp(port(514)); tcp(port(5140) keep-alive(yes));}; destination A { file("/var/log/A"); }; destination B { file("/var/log/B"); }; filter A { host ("A");}; filter A { host ("A");}; log { source(NET); destination(A); filter(A); }; log { source(NET); destination(B); filter(B); }; worked as expected that is log messages coming from host A went to /var/log/A file and log messages coming from host B went to /var/log/B. The two hostnames are resolved locally in /etc/hosts After upgrading to 3.0.x all the messages duplicated in both files so that messages coming from A are written in /var/log/A AND /var/log/B and vice-versa. Any idea why it does not work in 3? Thank you, Jerry

2 2

Broken TCP connection
by James Pirman 14 Jan '10

14 Jan '10

I am currently having an issue with syslog-ng 3.0.4 where my TCP connection between my client and server is lost throughout the day. By looking at the pcap file from tcpdump I can tell that the TCP connection reset was initiated by the syslog-ng server. The only information that was initially in the log file regarding this disconnection was the following 2 lines: <45>1 2010-01-05T10:29:32.323-06:00 server-db-01 syslog-ng 29213 - [meta sequenceId="2733719"] notice Syslog connection closed; fd='9', client='AF_INET(192.168.27.218:46326)', local='AF_INET(192.168.27.198:20514)' and <46>1 2010-01-05T10:29:32.323-06:00 server-db-01 syslog-ng 29213 - [meta sequenceId="2733720"] info Closing log transport fd; fd='9' In order to get more information, I set the following flags in init.d: "-v -d -t". This did not give me any more information about the TCP disconnect, however I did notice that a lot of my normal messages were preceeded by the following text: <47>1 2010-01-05T10:29:32.323-06:00 server-db-01 syslog-ng 29213 - [meta sequenceId="2733718"] debug Incoming log entry; line= A normal log message then follows the '=' sign. A decent percentage of my messages are preceeded by this throughout the day, but just before the disconnect it appears that all of my messages from server-db-01 are preceeded by the debug line. Any ideas as to what could be going on? I have included my config file below if that helps. Any assistance would be greatly appreciated. -Jim @version: 3.0 #Default configuration file for syslog-ng. # # For a description of syslog-ng configuration file directives, please read # the syslog-ng Administrator's guide at: # # http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/bk01-toc.html # options { keep_hostname(yes); keep_timestamp(yes); frac_digits(3); }; source all { internal(); syslog(ip("192.168.27.198") port(20514) transport("tcp") log_fetch_limit(100)); }; destination allclientsfile { file("/data/local/Logs/server-$YEAR-$MONTH-$DAY.log" flags(syslog-protocol) flush_timeout(100) create_dirs(yes) dir_owner(jpirman) dir_group(jpirman) owner(jpirman) group(jpirman) template("$PRIORITY $MESSAGE") ); }; destination msgserver { udp("127.0.0.1" port(20515) flush_timeout(100) template("$ISODATE $PROGRAM $PRIORITY $MESSAGE\n")); }; log { source(all); destination(allclientsfile); destination(msgserver);}; _________________________________________________________________ Hotmail: Powerful Free email with security by Microsoft. http://clk.atdmt.com/GBL/go/171222986/direct/01/

3 8