November 2010 - syslog-ng - lists.balabit.hu

Determining when logging is quiescent
by Ben Tisdall 06 Nov '10

06 Nov '10

Hi all, I'm setting up logging from ec2 instances that will get destroyed when they've finished their work. Most of the log sources use the file driver. Assuming the application has itself finished writing logs, is there any way of determining, from the client end, when syslog-ng has finished reading all of them? Regards, Ben Tisdall Photobox

2 2

login.pdb reworked
by Peter Czanik 05 Nov '10

05 Nov '10

Hello, Attached is a new version of login.pdb (called login2.pdb). It has patterns for many console/terminal/telnet login/logout events. This version should generate one set of name value pairs for each event, and only one. If you use console/login/telnet for logins, plese give it a try and let me know, how it works for you. I found, that there are some slight variations among messages even between different Ubuntu versions, so I'd like to see, how these patterns work on a larger set of Linux distributions, UNIX revisions. Thank you for your help, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

4 6

Can't get program destination to work
by Chuck 05 Nov '10

05 Nov '10

I am running 3.0.4 on a solaris 10 host. I am trying to send critical and emergency events via smtp. I have the following syntax: destination r_smtp { program ("/usr/local/sbin/syslog-ng-mailer.sh $HOST" template("<$PRI>$DATE $HOST $MSG\n.\n"); ); }; It doesn't like this syntax, however this is exactly what the documentation shows. I have also tried the following thinking the documentation might be wrong: destination r_smtp { program ("/usr/local/sbin/syslog-ng-mailer.sh $HOST"); template("<$PRI>$DATE $HOST $MSG\n.\n"); }; destination r_smtp { program ("/usr/local/sbin/syslog-ng-mailer.sh" template("<$PRI>$DATE $HOST $MSG\n.\n"); ); }; destination r_smtp { program ("/usr/local/sbin/syslog-ng-mailer.sh"); template("<$PRI>$DATE $HOST $MSG\n.\n"); }; Has anyone done this or know how to send alerts via smtp? Thanks, CC

4 7

Thoughts on patterndb syntax
by Lars Kellogg-Stedman 05 Nov '10

05 Nov '10

I've been playing with 3.2beta1 recently and getting my feet wet with the patterndb support, which I haven't had a chance to work with before. I have a few thoughts regarding the patterndb rule syntax, mostly targeted at making things a little bit easier to work with. - Rule IDs Is there any particular reason why unique IDs were selected as rule identifiers? They're not particularly meaningful to people, and they're hard to talk about. It's much easier to say, "we're suddently seeing lots of matches for ssh-accept-connection" than it is to say, "we're suddenly seeing lots of matches for 4dd5a329-da83-4876-a431-ddcb59c2858c". With the current version of syslog-ng it looks like it's possible to use arbitrary identifiers in place of UUIDs, and that's what I'm doing for my local rulesets. This even makes classification metadata more useful, because .classifier.rule_id=ssh-accept-connection is immediately meaningful, while a UUID is useless unless I go grepping around the database. - Whitespace Log messages tend to be long, which makes them unwieldy in a number of situations. It would be nice if instead of this: <pattern>...some very long log message that makes my life difficult and my patterns hard to read ...</pattern> I could do this: <pattern collapse_whitespace="yes">...some very long log message that has been conveniently wrapped to that it's easier to edit, email, and otherwise work with.</pattern> Specifically, enabling "collapse_whitespace" would transform any sequence of whitespace to a single " ". As proposed here this would be a completely backwords-compatible change because the default behavior would remain the same. - Reusable patterns We use Cisco firewall modules on our network. When these devices log a connection-related message, the source and destination address look something like this: ircs:3610:67.186.94.126/41004 That's: interface:vlan:ip/port Which becomes: @ESTRING:fwsm.src_if::@@NUMBER:fwsm.src_vlan@:@IPv4:fwsm.src_ip@/@NUMBER:fwsm.src_port@ When this occurs throughout the ruleset, and multiple times within a single message, it really lowers the readability of the rules. I wish there was a way to modularize this so that I could create custom types, something like this: <type name="FWSM_ADDRSPEC"> @ESTRING:iface::@@NUMBER:vlan@:@IPv4:ip@/@NUMBER:fwsm.port@ </type> And then do this: <pattern>Accepted src @FWSM_ADDRSPEC:fwsm.src:@ dst @FWSM_ADDRSPEC:fwsm.dst:@</pattern> And get this: fwsm.src.iface fwsm.src.ip fwsm.src.port Etc. Anyway, that's all for now.

5 12

Statistics -- how do I turn them off?
by Liam Kirsher 03 Nov '10

03 Nov '10

My log file is filling up with statistics messages from syslog-ng (v. 3.1.2) , one message every 10 minutes. I tried turning it off by putting stats_freq(0) in the options clause, and restarted the syslog-ng daemon but that seems to have no effect. There must be something obvious I'm missing. -- Liam Kirsher PGP: http://liam.numenet.com/pgp/

3 3

Re: [syslog-ng] Statistics -- how do I turn them off?
by sasanka.sahu＠wipro.com 02 Nov '10

02 Nov '10

Hi Anis, Thanks for giving me INFO. Actually I want to deploy on solaris 10 OS . This is the release verion, bash-3.00# cat /etc/release Solaris 10 10/09 s10s_u8wos_08a SPARC Copyright 2009 Sun Microsystems, Inc. All Rights Reserved. Use is subject to license terms. Assembled 16 September 2009 Am not getting this package "syslog-NG" for solaris OS. Regds, Sasanka -----Original Message----- From: Anisur Rehman(IT) [mailto:Rehman@bankmuscat.com] Sent: Tuesday, November 02, 2010 4:39 PM To: Sasanka Sekhar Sahu (WI01 - Enterprise Services) Subject: RE: [syslog-ng] Statistics -- how do I turn them off? Dear sasanka I will recommend to use RHEL 5 .5 with MYSQL database with frontend Php-Syslog-ng. I am using this combination and it is working fine. If you like to test this option let me know. However you can use HPUX option there is inbuilt syslog-NG available with HPUX version v3. Thanks Anis 0968-99826412 -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of sasanka.sahu(a)wipro.com Sent: Tuesday, November 02, 2010 2:55 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Statistics -- how do I turn them off? Hi Anybody can tell am using Solaris OS v 10 . Like to install php-syslog-ng GUI tools . where should I get the same as well as provide me some documentation for the same. Sasanka -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Sandor Geller Sent: Tuesday, November 02, 2010 4:12 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Statistics -- how do I turn them off? I'm filtering statistical messages based on the internal source and the following regexp: filter f_internal_statistics { match("^syslog-ng\[[[:digit:]]+\]: STATS") or match ("^syslog-ng\[[[:digit:]]+\]: Log statistics"); }; (for 3.x only the latter match is needed) 600 seconds is the default setting, the timer gets activated only when stats_freq > 0 so stats_freq(0) should turn off the generation of statistical messages completely. Are the logs generated on the same host or are you processing remote logs as well? On Sat, Oct 30, 2010 at 10:17 PM, Liam Kirsher <liamk(a)numenet.com> wrote: > My log file is filling up with statistics messages from syslog-ng (v. > 3.1.2) , one message every 10 minutes. > I tried turning it off by putting stats_freq(0) in the options clause, > and restarted the syslog-ng daemon but that seems to have no effect. > There must be something obvious I'm missing. > > -- > Liam Kirsher > PGP: http://liam.numenet.com/pgp/ > > ________________________________________________________________________ ______ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > > ________________________________________________________________________ ______ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com ________________________________________________________________________ ______ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0