December 2011 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] Log only one host
by tokie＠tiscali.it 13 Dec '11

13 Dec '11

As you can see the device gives a valid syslog header. Destination of Firewall in fw.log: # tailf fw.log Dec 13 13:58:47 192.168.1.254/192. 168.1.254 Fw-Vigor2955: 149:13:59.970 lan->wan @S:R=13:1 p 192.168.1.8,19679 -> 82.200.234.214,33244 PR UDP len 20 131 Destination of Access Point .241 in ap241.log: # tailf ap241.log Dec 13 13:58:47 192.168.1.254/192.168.1.254 Fw-Vigor2955: 149:13:59.770 lan- >wan @S:R=13:1 p 192.168.1.8,19679 -> 94.244.30.85,63708 PR UDP len 20 131 It writes the same thing!! My configuration is the following: source udp { udp(); }; destination d_fw { file("/**/**/fw.log" create_dirs(yes) fsync(yes)); }; filter f_fw { netmask ("192.168.1.254/32"); ##try to log one host }; log { source(udp); destination(d_fw); filter(f_fw); }; Therefore, how I do?? Thanks Tokie E' nata indoona: chiama, videochiama e messaggia Gratis. Scarica indoona per iPhone, Android e PC: http://www.indoona.com/

2 1

R: syslog-ng Digest, Vol 80, Issue 18
by tokie＠tiscali.it 13 Dec '11

13 Dec '11

As you can see the device gives a valid syslog header. Destination of Firewall in fw.log: # tailf fw.log Dec 13 13:58:47 192.168.1.254/192. 168.1.254 Fw-Vigor2955: 149:13:59.970 lan->wan @S:R=13:1 p 192.168.1.8,19679 -> 82.200.234.214,33244 PR UDP len 20 131 Destination of Access Point .241 in ap241.log: # tailf ap241.log Dec 13 13:58:47 192.168.1.254/192.168.1.254 Fw-Vigor2955: 149:13:59.770 lan- >wan @S:R=13:1 p 192.168.1.8,19679 -> 94.244.30.85,63708 PR UDP len 20 131 It writes the same thing!! My configuration is the following: source udp { udp(); }; destination d_fw { file("/**/**/fw.log" create_dirs(yes) fsync(yes)); }; filter f_fw { netmask ("192.168.1.254/32"); ## try for only host }; log { source(udp); destination(d_fw); filter(f_fw); }; Therefore, how can I do?? Thanks Tokie ------------------------------ Date: Mon, 12 Dec 2011 19: 10:30 -0500 From: Jim <jrhendri(a)maine.rr.com> Subject: Re: [syslog-ng] Log only one host To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1323735030.16055.1. camel@ubuntu> Content-Type: text/plain; charset="UTF-8" Couple things to note: - not all syslogs give a valid syslog header (e.g. <date> <time> <host> <program>:<message>) - name resolution costs cycles (may not be an issue) - know the difference between $HOST (parsed from the syslog header) and $HOST_FROM (the origin of the packet) Enjoy! On Mon, 2011-12-12 at 12:05 +0100, Thomas Wollner wrote: > Hello, > > to separate the destination logfiles for each host, use the following > > destination d_file_foreach_host { > file("/var/log/$FULLHOST.log"); > } > > > log { > source(s_all); > destination (d_file_foreach_host), > }; > > hope it helps, > regards, > > Tom > > > > Zitat von "tokie(a)tiscali.it" <tokie(a)tiscali.it>: > > >> Try using the netmask filter. > > > >> filter f_host_a_b_c_d { > >> netmask > > ("a.b.c.d/32"); > >> }; > > > > Tks for reply, > > I tried but don't work! > > More > > specific: > > I wish that all devicies in my network, logging into a > > specific file on syslog server. > > > > Now all files log all devicies!! > > I > > have the same result in different > > file(100.log, 101.log, and so on) > > > > > > Must I use iptables's match?? How?? > > > > tks > > Tokie > > > > p.s.: > > netmask ("a.b.c. > > > > d/32") or netmask("a.b.c.d/255.255.255.255") ??? E' nata indoona: chiama, videochiama e messaggia Gratis. Scarica indoona per iPhone, Android e PC: http://www.indoona.com/

1 0

Log only one host
by tokie＠tiscali.it 13 Dec '11

13 Dec '11

> Try using the netmask filter. > filter f_host_a_b_c_d { > netmask ("a.b.c.d/32"); > }; Tks for reply, I tried but don't work! More specific: I wish that all devicies in my network, logging into a specific file on syslog server. Now all files log all devicies!! I have the same result in different file(100.log, 101.log, and so on) Must I use iptables's match?? How?? tks Tokie p.s.: netmask("a.b.c. d/32") or netmask("a.b.c.d/255.255.255.255") ??? ----Messaggio originale---- Da: syslog-ng-request(a)lists.balabit.hu Data: 10/12/2011 12.00 A: <syslog-ng(a)lists.balabit.hu> Ogg: syslog-ng Digest, Vol 80, Issue 15 Send syslog-ng mailing list submissions to syslog-ng@lists. balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request@lists. balabit.hu You can reach the person managing the list at syslog-ng- owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: syslog-ng 3.3.3 repeatedly writes same message to local file when forwarding enabled (Dave Haywood) 2. Re: Log only one host (tokie(a)tiscali.it) 3. Re: Log to syslog file, filter from fifo (Balazs Scheidler) 4. [Bug 146] pdbtool match does not display tags (bugzilla(a)bugzilla.balabit.com) ---------------------------------------------------------------------- Message: 1 Date: Fri, 09 Dec 2011 11:22:24 +0000 From: Dave Haywood <tla(a)oak.selfip.net> Subject: Re: [syslog-ng] syslog-ng 3.3.3 repeatedly writes same message to local file when forwarding enabled To: Syslog-ng users' and developers' mailing list <syslog-ng@lists. balabit.hu> Cc: Sandor Geller <Sandor.Geller(a)morganstanley.com> Message- ID: <4EE1EF70.1060001(a)oak.selfip.net> Content-Type: text/plain; charset=ISO-8859-1 On 09/12/2011 09:53, Sandor Geller wrote: > Sounds like messages sent to 192.168.0.7 are feeded back to syslog-ng > so there is a logging loop. Is this address local? When not then there > is a chance that the packet filter rule isn't correct. Thanks! You were right, the issue was with the iptables rule. I was trying to capture traffic from localhost to port 514 and redirect it to 1514 using NAT table OUTPUT. I use this for testing every facility / severity combination during install. But I didn't specify a destination host (of the local IP address); I only specified the port. This meant and traffic forwarded to a remote host is redirected by iptables back to the localhost, causing a loop. Thanks for the help :) > > On Fri, Dec 9, 2011 at 10:34 AM, Dave Haywood <tla(a)oak.selfip. net> wrote: >> Hi, >> >> I have a problem with syslog-ng 3.3.3. When I have forwarding enabled to a remote syslog server (via UDP) syslog-ng repeatedly writes the same message(s) to the log file and only stops when the disk is full. Using tcpdump on the remote server, I don't see any data arrive from the syslog-ng server so forwarding is not working either. >> >> When I remove the forwarding part of the config file the local file is written correctly (ie once). If I remove the local file part from the config file and only enable the forwarding, I see syslog- ng take all the CPU time. I never see any syslog messages arrive at the remote syslog server. >> >> I tried: >> 1) disabling IPv6 - no change >> 2) running outside the chroot jail - no change >> 3) running as userid root - no change >> >> Does anyone have any idea what would cause this? Debug info below. >> >> The environment is: >> >> RedHat AS 4.8 (linux 2.6.9-89.ELsmp) on vmware ESXi 4.1.0 >> >> All required software built and installed in /usr/local/ : >> >> eventlog_0.2.12.tar.gz >> gettext-0.18.1.1.tar.gz >> glib-2.29.90.tar.bz2 >> libdbi-0.8.4.tar.gz >> libdbi-drivers-0.8.3. tar.gz >> libffi-3.0.9.tar.gz >> libnet-0.10.11.tar.gz >> pkg-config- 0.26.tar.gz >> Python-2.7.2.tar.bz2 >> zlib-1.2.5.tar.bz2 >> syslog- ng_3.3.3.tar.gz >> >> syslog-ng is running chroot() in directory /data as user E' nata indoona: chiama, videochiama e messaggia Gratis. Scarica indoona per iPhone, Android e PC: http://www.indoona.com/

3 2

error while loading shared libraries
by Johnson, Chris (HP TippingPoint Roseville) 12 Dec '11

12 Dec '11

I'm getting the following error: /usr/local/sbin/syslog-ng: error while loading shared libraries: /usr/local/lib/libsyslog-ng-3.3.3.so: ELF file OS ABI invalid When I try to run syslog-ng (also occurs when I run pbdtool) pdbtool: error while loading shared libraries: /usr/local/lib/libsyslog-ng-3.3.3.so: ELF file OS ABI invalid I'm building on one box (RedHat), and running on another (not sure what flavor of Linux, might be CentOS). Any pointers to what I can set during the build phase that will allow it to run? Thanks, Chris ---------------------------------------- Christopher Johnson chris.johnson3(a)hp.com HP Software - Security Product Group ----------------------------------------

2 4

[Bug 146] New: pdbtool match does not display tags
by bugzilla＠bugzilla.balabit.com 09 Dec '11

09 Dec '11

https://bugzilla.balabit.com/show_bug.cgi?id=146 Summary: pdbtool match does not display tags Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: bug Estimated Hours: 0.0 When using the pdbtool match command the tags of a message are not displayed. % pdbtool match -M "Fri Nov 25 00:00:29.618 2011: Accepted and connected to 172.20.102.38 hermes0080 <c0n350>" -p mmfs.xml --program=mmfs MESSAGE=Fri Nov 25 00:00:29.618 2011: Accepted and connected to 172.20.102.38 hermes0080 <c0n350> PROGRAM=mmfs .classifier.class=security .classifier.rule_id=463e34dd-f946-4f25-9cd2-9c00e25eba4c .net.destination.address=172.20.102.38 .net.destination.name=hermes0080 .mmfs.node=c0n350 application=mmfs -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Log to syslog file, filter from fifo
by Lay, James 09 Dec '11

09 Dec '11

Topic says it. I think I have a pretty simple layout: log { source(s_local); filter(f_firewall); destination(d_file); destination(fifo); }; Can I change this to: log { source(s_local); destination(d_file); filter(f_firewall); destination(fifo); }; ? Will this log to file, then filter, then go to fifo? Thanks and hope this isn't a silly question...I read this from the admin guide: Log statements are processed in the order they appear in the configuration file, thus the order of log paths may influence what happens to a message, especially when using filters and log flags. So I'm hoping that is the case. Thank you. James

6 8

Re: [syslog-ng] Log only one host
by tokie＠tiscali.it 09 Dec '11

09 Dec '11

Tks for reply, I tried but don't work! More specific.. I wish that all the servers in my network, logging into a specific file of the same syslog server. Now all log all!! I have the same result in different file(100.log, 101.log, and so on) tks Tokie p.s.: netmask("a.b.c. d/32") or netmask("a.b.c.d/255.255.255.255") ??? ----------------------------------------------------------------------------------------- Hi, On Fri, Dec 9, 2011 at 10:29 AM, Tokie <tokie(a)tiscali.it> wrote: > Hi to all, > my question is very simple: > How do I to log only one a specific ip address?? > I tried filtering with the Host, Host_From, SOURCEIP, etc without any > positive result. > > What is the correct syntax? > Could you help me?? Try using the netmask filter. filter f_host_a_b_c_d { netmask("a.b.c.d/32"); }; Regards, Sandor End of syslog-ng Digest, Vol 80, Issue 14 ***************************************** E' nata indoona: chiama, videochiama e messaggia Gratis. Scarica indoona per iPhone, Android e PC: http://www.indoona.com/

1 0

syslog-ng 3.3.3 repeatedly writes same message to local file when forwarding enabled
by Dave Haywood 09 Dec '11

09 Dec '11

Hi, I have a problem with syslog-ng 3.3.3. When I have forwarding enabled to a remote syslog server (via UDP) syslog-ng repeatedly writes the same message(s) to the log file and only stops when the disk is full. Using tcpdump on the remote server, I don't see any data arrive from the syslog-ng server so forwarding is not working either. When I remove the forwarding part of the config file the local file is written correctly (ie once). If I remove the local file part from the config file and only enable the forwarding, I see syslog-ng take all the CPU time. I never see any syslog messages arrive at the remote syslog server. I tried: 1) disabling IPv6 - no change 2) running outside the chroot jail - no change 3) running as userid root - no change Does anyone have any idea what would cause this? Debug info below. The environment is: RedHat AS 4.8 (linux 2.6.9-89.ELsmp) on vmware ESXi 4.1.0 All required software built and installed in /usr/local/ : eventlog_0.2.12.tar.gz gettext-0.18.1.1.tar.gz glib-2.29.90.tar.bz2 libdbi-0.8.4.tar.gz libdbi-drivers-0.8.3.tar.gz libffi-3.0.9.tar.gz libnet-0.10.11.tar.gz pkg-config-0.26.tar.gz Python-2.7.2.tar.bz2 zlib-1.2.5.tar.bz2 syslog-ng_3.3.3.tar.gz syslog-ng is running chroot() in directory /data as user syslogng:sysadmins and listens on port 1514. iptables redirects any incoming port 514 traffic to 1514. The required /usr/local/ directories are mounted (-o bind) under /data. syslog-ng 3.3.3 Installer-Version: 3.3.3 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.3#master#d199a1980be6b23fe24189e86a882812288e292c Compile-Date: Dec 8 2011 17:46:40 Default-Modules: affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat,afsql Available-Modules: convertfuncs,affile,afmongodb,dummy,basicfuncs,csvparser,confgen,afsql,syslogformat,afuser,afsocket,afprog,afsocket-notls,dbparser Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-Linux-Caps: off Enable-Pcre: off Config file: @version: 3.3 source s_udp { udp(ip("0.0.0.0") port(1514)); }; destination file1 { file("/log/network.log" owner(syslogng)group(sysops) perm(0640) flags(no-multi-line)); }; destination NeDi { udp("192.168.0.7" port(514)); }; log { source(s_udp); destination(file1); }; # enabling the line below breaks logging to the file above log { source(s_udp); destination(NeDi); }; Debug: # /usr/local/sbin/syslog-ng --cfgfile=/usr/local/etc/syslog-ng.conf --chroot=/data --user=syslogng --group=sysadmins --persist-file=/log/syslog-ng.persist --foreground --process-mode=foreground --stderr --debug nanosleep() is not accurate enough to introduce minor stalls on the reader side, multi-threaded performance may be affected; Trying to open module; module='affile', filename='/usr/local/lib/syslog-ng/libaffile.so' Trying to open module; module='afprog', filename='/usr/local/lib/syslog-ng/libafprog.so' Trying to open module; module='afsocket', filename='/usr/local/lib/syslog-ng/libafsocket.so' Trying to open module; module='afuser', filename='/usr/local/lib/syslog-ng/libafuser.so' Trying to open module; module='basicfuncs', filename='/usr/local/lib/syslog-ng/libbasicfuncs.so' Trying to open module; module='csvparser', filename='/usr/local/lib/syslog-ng/libcsvparser.so' Trying to open module; module='dbparser', filename='/usr/local/lib/syslog-ng/libdbparser.so' Trying to open module; module='syslogformat', filename='/usr/local/lib/syslog-ng/libsyslogformat.so' Trying to open module; module='afsql', filename='/usr/local/lib/syslog-ng/libafsql.so' Syslog connection established; fd='8', server='AF_INET(192.168.0.7:514)', local='AF_INET(0.0.0.0:0)' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.3.3' Incoming log entry; line='<189>41609: Dec 9 2011 08:41:22.691 UTC: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (FD96:D107:BCF2::3)' Incoming log entry; line='<189>Dec 9 08:41:24 6500-1 41609: Dec 9 2011 08:41:22.691 UTC: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (FD96:D107:BCF2::3)\x0a' Incoming log entry; line='<189>Dec 9 08:41:24 localhost 41609: Dec 9 2011 08:41:22.691 UTC: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (FD96:D107:BCF2::3)\x0a' Incoming log entry; line='<189>Dec 9 08:41:24 localhost 41609: Dec 9 2011 08:41:22.691 UTC: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (FD96:D107:BCF2::3)\x0a' Incoming log entry; line='<189>Dec 9 08:41:24 localhost 41609: Dec 9 2011 08:41:22.691 UTC: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (FD96:D107:BCF2::3)\x0a' ....forever....

2 2

Log only one host
by Tokie 09 Dec '11

09 Dec '11

Hi to all, my question is very simple: How do I to log only one a specific ip address?? I tried filtering with the Host, Host_From, SOURCEIP, etc without any positive result. What is the correct syntax? Could you help me?? Thanks Tokie

2 1

syslog-ng Insider - December 2011
by Peter Czanik 08 Dec '11

08 Dec '11

Dear syslog-ng users, This is the 9th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS syslog-ng 3.3.3 is released! ---------------------------- A new version of syslog-ng is released! There are no new features to announce, but most problems reported since 3.3.1 should be fixed by now! Thank you for all of those, who helped us to hunt bugs with detailed reports and many testing! The release of 3.3.3 brought many new users to the latest syslog-ng version, which helped to uncover some more bugs in advanced configurations. Until a new release arrives, please check the git tree ( git://git.balabit.hu/bazsi/syslog-ng-3.3 ) and the mailing list archives, if your problem is addressed by a patch. Sources are available at http://www.balabit.com/downloads/files?path=/syslog-ng/sources/3.3.3 Binary packages are available are available for several Linux distributions. Please check availability at http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… syslog-ng and patterns ---------------------- Patterndb is one of the most important features of syslog-ng, still not many people are using it. So we are very happy to see, that patterndb was the focus point in many recent syslog-ng mailing list threads. First of all, thanks for Evan Rempel for providing many useful ideas and feedback about patterndb on the syslog-ng mailing list. ELSA (Enterprise Log and Search Archive), which uses patterndb heavily, had some major updates recently, which make it a lot more easy to install on a couple of different systems. It is available at http://code.google.com/p/enterprise-log-search-and-archive/ We plan to use CEE (http://cee.mitre.org <http://cee.mitre.org/>) for our patterns in the long term. But even until this standard is available, please share your patterns in any form to lower the entry barrier for your fellow syslog-ng users. If you send them to the list or directly to me, I'll make them available at http://git.balabit.hu/?p=czanik/syslog-ng-patterndb.git;a=summary syslog-ng and the journal ------------------------- There’s an ongoing project to create a new logging subsystem for Linux, called the journal, by Lennart Poettering of PulseAudio & systemd fame. It is implemented as a core component of systemd, thus has a good chance to be integrated to all distributions that carry systemd. Since syslog-ng is also in the logging sphere, the logical question arises: how does this new project affect syslog-ng in the long run? For the answer, read Bazsi's blog at http://bazsi.blogs.balabit.com/2011/12/syslog-ng-and-the-journal/ OTHER SHORT NEWS * An interesting article about extracting useful information from log messages was published in Free BSD Magazine (not only for BSD users :-) ): http://www.balabit.com/support/documentation/BSD_12_2011%20-%20BalaBit_sing… where you also can read about several up-to-date topics, like "Rolling Your Own FreeBSD Kernel", "Hardening BSD with Security Levels" and so on. The whole Free BSD Magazine can be downloaded at http://bsdmag.org <http://bsdmag.org/> NEW RELEASES * syslog-ng OSE 3.3.3: http://www.balabit.com/downloads/files?path=/syslog-ng/sources/3.3.3 ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP)<czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0