July 2010 - syslog-ng - lists.balabit.hu

[Bug 88] New: rewrite FACILITY does not work.
by bugzilla＠bugzilla.balabit.com 01 Jul '10

01 Jul '10

https://bugzilla.balabit.com/show_bug.cgi?id=88 Summary: rewrite FACILITY does not work. Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Windows Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: alex-pub.balabit(a)reflexion.net Type of the Report: --- Estimated Hours: 0.0 Here is the fragment of my syslog-ng.conf file that demonstrates the problem source remote_sys { tcp( ip( "0.0.0.0" ) port( 514 ) max-connections( 1152 ) ); udp( ip( "0.0.0.0" ) port( 514 ) ); }; destination d_remote_consolidated_log { file( "/var/log/remote/$FACILITY/$FACILITY.log" create_dirs( yes ) perm( 0644 ) dir_perm( 0755 ) template( "$R_ISODATE $HOST -$LEVEL- $PROGRAM[$PID]: $MSGONLY\n" ) frac_digits( 6 ) template_escape( no ) ); }; filter f_apache { facility( local1 ); }; rewrite r_rewrite_apache_facility { set("apache" value("FACILITY")); }; log { source( remote_sys ); filter( f_apache ); rewrite( r_rewrite_apache_facility ); destination( d_remote_consolidated_log ); flags( final ); }; If I issue the following command from the host connected to this syslog-ng server: $ echo this is apache log test | logger -t apache-test -p local1.info Then the output is sent to "/var/log/remote/local1/local1.log" instead of expected "/var/log/remote/apache/apache.log". Also, if I include $FACILITY into the destination template it prints "local1" If I run syslog-ng with -d flag I see this in output: >>Rewrite expression evaluation result; value='FACILITY', new_value='apache' Below is a full log for this test >>Incoming log entry; line='<142>Jun 22 17:36:11 host-1 apache-test: this is a test 2' >>Filter rule evaluation begins; filter_rule='f_filter1' >>Filter node evaluation result; filter_result='not-match', filter_type='facility' >>Filter rule evaluation result; filter_result='not-match', filter_rule='f_filter1' >>Filter rule evaluation begins; filter_rule='f_filter2' >>Filter node evaluation result; filter_result='not-match', filter_type='facility' >>Filter rule evaluation result; filter_result='not-match', filter_rule='f_filter2' >>Filter rule evaluation begins; filter_rule='f_apache' >>Filter node evaluation result; filter_result='match', filter_type='facility' >>Filter rule evaluation result; filter_result='match', filter_rule='f_apache' >>Rewrite expression evaluation result; value='FACILITY', new_value='apache' So this makes me believe that rewrite does happen, but the value is not picked up later. BTW, the documentation for `set` command says that there should be a comma between "apache" and value, but other samples do not put it there. I've tried it both ways to no avail. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 9

spoof-source performance issues
by Martin Holste 01 Jul '10

01 Jul '10

I'm finding that with a destination of udp("10.x.x.x", port(514) spoof_source(yes)) about half of messages get lost when going from one syslog-ng host to another at a high message rate (> 3k/sec). This is on 3.1 OSE and the hosts are on the same subnet and switch, so there shouldn't be any network devices interfering. Has anyone else had this same issue? My hunch is that it's either a performance issue with the way the libnet (I'm using 1.1.2.1 on SuSE 10.2) API is implemented or it's an issue within the libnet API. Has anyone else noticed performance problems when using spoof_source?

5 12

[Bug 91] New: Cisco ASA log parsing issues
by bugzilla＠bugzilla.balabit.com 01 Jul '10

01 Jul '10

https://bugzilla.balabit.com/show_bug.cgi?id=91 Summary: Cisco ASA log parsing issues Product: syslog-ng Version: 3.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jon(a)jonjames.net Type of the Report: bug Estimated Hours: 0.0 Orignal LOG as seen my TCPDUMP 16:42:08.734684 IP 172.16.32.157.syslog > 172.16.32.172.syslog: SYSLOG local4.notice, length: 95 E..{.......^.. ... ......g<.<165>Jul 01 2010 00:32:59: %ASA-5-111001: Begin configuration: 172.16.16.154 writing to memory After being relayed as seen my TCPDUMP 16:42:59.208826 IP 172.16.32.172.33753 > 172.16.32.225.syslog: SYSLOG local4.notice, length: 120 E...a.@.@.?... ... ........?<165>1 2010-07-01T00:33:50-04:00 172.16.32.157 %ASA-5-111001 - - - Begin configuration: 172.16.16.154 writing to memory As you can see, syslog-ng appears to be messing with the datestamp and therefore the RSA envision device I'm relaying to does not recognize the log as being from a cisco asa. Is there a way to update the log parser in syslog to resolve this issue ? syslog-ng.conf (parts) @version: 3.0 options { time_sleep(30); time_reap(30); mark_freq(30); dns_cache(yes); use_fqdn(no); keep_hostname(yes); chain_hostnames(no); use_dns(no); dns_cache_size(250000); dns_cache_expire(300); dns_cache_expire_failed(300); stats_freq(3600); log_msg_size(10000); }; source s_extranet { udp(ip("172.16.32.172") port(514)); }; log { source(s_extranet); destination(d_syslog_udp); }; destination d_syslog_udp { syslog("172.16.32.225" transport("udp") port(514)); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 3