June 2012 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] issue with rewrite. Please help.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 29 Jun '12

29 Jun '12

Hi Balint, Thanks for the reply. I tried the below rewrite rewrite r_solaris { subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") type("pcre") flags(dont-store-matches)); }; It works for auth.info, but it does not work with local7.info or local6.info as the regex does not handle numerals in the facility field. I tried changing it as follows (i.e. added [0-9] before .)., but with this, this dumps core. Addition of any numeral in this position results in a core dump subst("\[ID [0-9]* [a-z]*[0-9]\.[a-z]*\]\ " "" value("MESSAGE") We have tried the following. logger -p local7.info "HELLO|KUAAA" --> Did not work logger -p local6.info "HELLO|KUAAA" --> Did not work logger -p auth.info "Accepted password for root" --> Worked. Thanks Hithendra -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu on behalf of ext Balint Kovacs Sent: Fri 6/15/2012 10:26 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] issue with rewrite. Please help. Hi Hithendra, I came across this problem just recently, I guess that you want to handle Solaris logs with the standard Unix analysis ruleset, but the these tags are in the way. The only difference is, that I moved the tag to the end of the message (as patterndb does prefix matching, these don't bother my patterns but are still there). My rewrite rule is the following: rewrite r_solaris { #move the solaris header to the end of the message #to work with linux patterndb subst("(\[ID [0-9]* [a-z]*\.[a-z]*\])\ " "" value("MESSAGE") type("pcre") flags(store-matches)); subst("$" " $1" value("MESSAGE") type("pcre")); }; If you don't want to move it (backreferencing is quite slow and resource-intensive), you could just use this untested version: rewrite r_solaris { subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") type("pcre") flags(dont-store-matches)); }; HTH, Balint On 06/15/2012 05:39 AM, Balla, Hithendra (EXT-Other - IN/Bangalore) wrote: > > Hi all, > > We have the followinglog > > 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6*[ID 800047 > auth.info]*Accepted publickey for xyz > > We wanted to replace*[ID 800047 auth.info]*with*empty > string*(i.e."")and print the following > > 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 Accepted publickey for xyz > > So we have used the below re-write with subst. But this is not > workingin*syslog-ng 3.4.0alpha2*. > > rewrite rw_msg{*subst*("\\[.*\\]", "", value("MESSAGE"));}; > > Can somebody help out here? > > Thanks > > Hithendra > > > > ________________________________________________________________________ ______ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq >

2 1

Re: [syslog-ng] Include doesn't work
by Jakub Prokeš 29 Jun '12

29 Jun '12

Hi! > Include files are only snippets and not full configs, so as such they can not have the @version line in them. I removed version info from snippet, but syntax error is still here. [root@logger:~]# syslog-ng -s -d Adding include file; filename='001-sample.conf' Starting to read include file; filename='/etc/syslog-ng/syslog-ng.conf.d/001-sample.conf', depth='1' syntax error in /etc/syslog-ng/syslog-ng.conf.d/001-sample.conf at line 7. At line 7 start this section: destitation d_messages_sample { file("/home/sample/var/$HOST/messages/$YEAR$MONTH$DAY.log"); }; Is there some kind of list available directives in sniplets? Regards, -- Jakub Prokes Senior Linux Administrator m: podpora(a)superhosting.cz w: www.superhosting.cz | www.datacamp.sk [CZ]: +420 296 826 296 | Na Safrance 33, Praha 10 - Vinohrady [SK]: +421 (2) 2025 6256 | Bozeny Nemcovej 8, Bratislava

4 4

[Bug 181] New: Daemon stops reading from unix-dgram source following charset decoding error
by bugzilla＠bugzilla.balabit.com 29 Jun '12

29 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=181 Summary: Daemon stops reading from unix-dgram source following charset decoding error Product: syslog-ng Version: 3.3.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=674099 OS/Version: Linux Status: ASSIGNED Severity: blocker Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: bug Estimated Hours: 0.0 As explained in the Debian bug report (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=674099) when we have an unix-dgram() source with encoding set, and we send invalid data there, no further messages will be processed. It's easy to reproduce, and only seems to happen with unix-dgram (tcp at least does not exhibit this problem). I'm not quite sure yet why this happens - the source is kept open, just doesn't seem to be handled at all. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[Bug 159] New: on signal HUP program destinations are not closed
by bugzilla＠bugzilla.balabit.com 26 Jun '12

26 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=159 Summary: on signal HUP program destinations are not closed Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 In previous versions of syslog-ng, when a HUP signal was sent to syslog-ng it would close all of its destinations and reopen them. In version 3.3.4 (perhaps earlier ones) the destination to programs is not closed, but a new one is opened. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 12

Re: [syslog-ng] Forward slashes in QSTRING
by Evan Rempel 24 Jun '12

24 Jun '12

can you try this "@STRING::/@/@STRING:lastName:-._@ " This should match alphanumerics including / but followed by a / and a string of alphanumerics including -._that does not include a / and then followed by a space (I forget what your original text to match on looks like. Evan Michael Starks <syslog-ng-list(a)michaelstarks.com> wrote: On 06/19/2012 11:24 AM, Martin Holste wrote: > If you know this will be the rest of the message, you can use a > capturing @ANYSTRING:var:@ to grab everything left in the message. Thanks. I have tried @ANYSTRING@ but as I suspected it starts matching on the first / since the pattern is being read left-to-right. What ends up happening is that the entire file path is included. I still don't see a way to capture everything between the last / and the ' without knowing in advance how deep the path will be. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 2

[Bug 184] New: syslog-ng.service and systemd with journal support
by bugzilla＠bugzilla.balabit.com 22 Jun '12

22 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=184 Summary: syslog-ng.service and systemd with journal support Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: packaging AssignedTo: folti(a)balabit.hu ReportedBy: jpo(a)di.uminho.pt Type of the Report: --- Estimated Hours: 0.0 Hi, The current syslog-ng.service file shipped in the contrib directory (contrib/systemd/syslog-ng.service) will break under recent systemd versions (with journal support) as systemd-kmsg-syslogd.service has been discontinued. Offending line: ... ExecStartPre=/bin/systemctl stop systemd-kmsg-syslogd.service ... Possible solutions: 1) remove the ExecStartPre line 2) prefix the command with a dash to avoid error checking Affected syslog-ng branches: branches >= 3.3 Fedora >= 17 current status: We have eliminated the offending line from the Fedora' syslog-ng.service file. More information: Bug 833551 - don't refer to systemd-kmsg-syslogd.service anymore https://bugzilla.redhat.com/show_bug.cgi?id=833551 /jpo -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

Forward slashes in QSTRING
by Michael Starks 22 Jun '12

22 Jun '12

Is it possible to use a / as a delimiter in QSTRING? The documentation seems to permit it, but my pattern doesn't work. Here's the pattern: <pattern>Alert Level: @NUMBER:i0:@; Rule: @NUMBER:i1:@ - @ESTRING:s0:;@ Location: @QSTRING:s1:()@ @IPv4:i2:@->syscheck; Integrity checksum changed for: @QSTRING:s4:/'@</pattern> And here's the string I want to match on: Alert Level: 7; Rule: 550 - Integrity checksum changed.; Location: (agentname) 172.16.0.1->syscheck; Integrity checksum changed for: '/etc/fstab' The idea is to extract only 'fstab' (without the quotes). I have also tried 0x2f in place of / with similar results, and various attempts at escaping it have failed. Thanks.

3 5

Two or more conditions on a action
by C. L. Martinez 20 Jun '12

20 Jun '12

Hi all, Is it possible to configure two or more conditions under an action?? For example: <action trigger="match" condition=" '${first_field}@1' == 'something_1' & '${second_field}' == 'something_2' "> This action it doesn't works ... I am using syslog-ng 3.3.5 Thanks.

3 6

Include doesn't work
by Jakub Prokeš 20 Jun '12

20 Jun '12

Hi! I use syslog-ng for logging through network, but for some hosts I need special configs. I created directory /etc/syslog-ng/syslog-ng.conf.d and in there create file with config which is attached and include it in main conf file: ## include here config of clients with special options include syslog-ng.conf.d/; ## common clients log { source(s_clients); source(s_local); filter(f_std_facility); destination(d_host_facility); }; The result is syntax error in configuration: [root@logger:/etc]# syslog-ng -s -d Adding include file; filename='001-sample.conf' Starting to read include file; filename='/etc/syslog-ng/syslog-ng.conf.d/001-sample.conf', depth='1' syntax error in /etc/syslog-ng/syslog-ng.conf.d/001-sample.conf at line 1. syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng [root@logger:/etc]# syslog-ng --version syslog-ng 3.1.3 Installer-Version: 3.1.3 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#def34661b08109f8148904b860457d5747c425b3 Compile-Date: Feb 1 2011 19:11:59 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: on Enable-Pcre: on Can you help me? Regards, -- Jakub Prokes Senior Linux Administrator m: podpora(a)superhosting.cz w: www.superhosting.cz | www.datacamp.sk [CZ]: +420 296 826 296 | Na Safrance 33, Praha 10 - Vinohrady [SK]: +421 (2) 2025 6256 | Bozeny Nemcovej 8, Bratislava

2 1

cipher_suite param support ?
by Balla, Hithendra (EXT-Other - IN/Bangalore) 20 Jun '12

20 Jun '12

Hi all, Can somebody provide the following information. 1) Which version of syslog-ng provides support for cipher suite parameter, so that there is a possibility to configure the strong ciphers. 2) Does cipher suite parameter is available in 3.2 ? Thanks Hithendra

3 5