February 2013 - syslog-ng - lists.balabit.hu

sending faile based logs to syslog
by a bv 25 Feb '13

25 Feb '13

Hi, I have a box runing syslog-ng and mysql and php based gui which gets logs squid etc boxes. and i have file based squid logs. Can i send these logs in to the syslog-ng (box) like a real time event and get the database record it? Regards

1 0

syslog-ng 3.3.7 coredump on solaris 10 Opteron
by Rakesh Rajasekharan 23 Feb '13

23 Feb '13

I have compiled the syslog-ng 3.3.7 on solaris in mixed-linking mode . But syslog-ng is not logging anything.. upon debugging i found that it gets core dump.. I have compiled ivykis and have tried using the --with-ivykis=system option as well. # /opt/soe/local/syslog-ng-3.3.7/sbin/syslog-ng -Fvde the last few lines of the above command are... Trying to open module; module='afstreams', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libafstreams.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='sun-streams' Finishing include; content='source confgen system', depth='1' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.3.7' iv_fd_port_poll: got error 95[Socket operation on non-socket] Abort(coredump). any suggestions please..

2 2

syslog-ng selinux context Centos 5.9 (RHEL5)
by Stuart Green 21 Feb '13

21 Feb '13

Hi, I'm having some trouble with selinux blocking syslog-ng from creating directories type=1400 audit(1361437595.431:297527809): avc: denied { create } for pid=2835 comm="syslog-ng" name="21" scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:syslogd_var_run_t:s0 tclass=dir printk: 512913 messages suppressed. There is a line which seems to define this context in: /etc/selinux/targeted/contexts/files/file_contexts /var/log/syslog-ng(/.*)? system_u:object_r:syslogd_var_run_t:s0 If I manually change the context to var_log_t as per: /var/log/.* system_u:object_r:var_log_t:s0 then it creates the directory successfully. I believe the policy configuration is standard and undoctored so believe there could be a problem with it? Does anyone have a similar environment or some knowledge on this? greets -Stu

2 1

get Forbidden on online syslog-ng Documentation
by Stefan Sabolowitsch 19 Feb '13

19 Feb '13

Hi all, is can not actually access on this URL: https://code.seas.harvard.edu/seas-academic-computing/syslog-ng-patterndb/t… Yesterday it's was successful Any idea ? thx Stefan

1 0

syslog-ng daemon does not start up on HPUX ia64
by Rakesh Rajasekharan 19 Feb '13

19 Feb '13

I have successfully compiled the syslog-ng but upon starting .. syslog-ng daemon does not show up in the ps command. Running it in the debug mode.... i get the below error while i try to open a new putty terminal.. # /opt/soe/local/syslog-ng-3.3.7/sbin/syslog-ng -Fvde nanosleep() is not accurate enough to introduce minor stalls on the reader side, multi-threaded performance may be affected; Trying to open module; module='affile', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libaffile.so' Trying to open module; module='afprog', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libafprog.so' Trying to open module; module='afsocket', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libafsocket.so' Trying to open module; module='afuser', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libafuser.so' Trying to open module; module='basicfuncs', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libbasicfuncs.so' Trying to open module; module='csvparser', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libcsvparser.so' Trying to open module; module='dbparser', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libdbparser.so' Trying to open module; module='syslogformat', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libsyslogformat.so' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.3.7' Incoming log entry; line='<38>Feb 19 15:53:20 sshd[29953]: SSH: Server;Ltype: Kex;Remote: 20.201.140.200-62779;Enc: aes256-cbc;MAC: hmac-sha1;Comp: none' ** ** ERROR:(logsource.c:286):log_source_queue: assertion failed: (old_window_size > 0) Abort(coredump) Any suggestions on this please....

1 0

syslog 3.3.7 ivykis library error... HPUX 11.23 ia64
by Rakesh Rajasekharan 19 Feb '13

19 Feb '13

I have compiled the syslog-ng 3.3.7 on HPUX ia64 machine using dynamic linking option... but, while trying to run the binary i get the below error, # /opt/soe/local/syslog-ng-3.3.7/sbin/syslog-ng /usr/lib/hpux32/dld.so: Unable to find library 'libivykis.so.3'. Killed I have even tried --with-ivykis=system in the configure... but the error does not disappear. # ldd /opt/soe/local/syslog-ng-3.3.7/sbin/syslog-ng libpthread.so.1 => /usr/lib/hpux32/libpthread.so.1 libcl.so.1 => /usr/lib/hpux32/libcl.so.1 libc.so.1 => /usr/lib/hpux32/libc.so.1 libIO77.so.1 => /usr/lib/hpux32/libIO77.so.1 libunwind.so.1 => /usr/lib/hpux32/libunwind.so.1 libdl.so.1 => /usr/lib/hpux32/libdl.so.1 libuca.so.1 => /usr/lib/hpux32/libuca.so.1 Any suggestions on this please... Thanks, Rakesh.

2 4

[Bug 222] New: systemd unit file should set Restart
by bugzilla＠bugzilla.balabit.com 18 Feb '13

18 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=222 Summary: systemd unit file should set Restart Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: pdgiddie+balabit(a)gmail.com Type of the Report: enhancement Estimated Hours: 0.0 To mitigate unforeseen crashes, the systemd unit file should set Restart. This will cause systemd to relaunch the service if it crashes. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

[PATCH 0/4]: Template type hinting, request for review
by Gergely Nagy 17 Feb '13

17 Feb '13

The patches that will come soon after this one implement template type hinting support for syslog-ng. These things allow us to tell the various destination drivers what type a particular template should be casted to. One can use this to store dates in MongoDB as datetime objects, or the PID as integer, and so on and so forth. The syntax is simple: template(type("template-string")) Where 'type' can be 'boolean', 'string', 'int32', 'int64', 'datetime' or 'literal' as of this writing. Not all drivers implement all of them, of course, but they implement the relevant ones. The infrastructure makes it possible to control what should happen when a type cast does not succeed: we can either drop the message (the default), drop that particular property, or fall back to string. We can do either of these silently, or by emitting a warning first. This is configurable with a global option only at the moment, but there are plans to make it possible to override the global setting on a per-template or per-driver level. A few examples on usage: template t_json { template("$(format-json PID=int32($PID) MESSAGE DATE)\n") }; destination d_mongodb { mongodb( value-pairs(pair("PID", int32("$PID")) pair("TIMESTAMP", datetime("$R_UNIXTIME"))) ); }; I'm reasonably happy with the code, at least for now. I plan to improve upon it within the scope of 3.5, but this is at a stage that I consider very close to merge ready.

2 6

[Bug 221] New: syslog-ng 2.1.4 on rhel 5.8
by bugzilla＠bugzilla.balabit.com 15 Feb '13

15 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=221 Summary: syslog-ng 2.1.4 on rhel 5.8 Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jk_kathi1(a)yahoo.com Type of the Report: --- Estimated Hours: 0.0 Red Hat Enterprise Linux Server release 5.8 (Tikanga) Syslog-ng version : syslog-ng-2.1.4-9.el5 Library installed : libnet-1.1.5-1.el5 /etc/syslog-ng/syslog-ng.conf file settings options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; source s_file { file("/opt/CA/siteminder/log/smps.log"); }; destination d_file { file("/var/log/messages"); }; destination d_remote_q1 { udp("x.x.x.x" port(514)); }; log { source(s_sys); destination(d_file); }; log { source(s_file); destination(d_file); destination(d_remote_q1); }; Syslog-ng executes fine , able to record all the OS logs . When i start syslog-ng the first time it polls the smps.log and forwards all the entries from that file to remote server , but after that any new events getting logged does not get processed even when syslog-ng is running in the background. The issue is syslog-ng is not able to monitor the App log smps.log in real time . This happens only for the app log , normal OS events gets processes immediately Tried logging a simple mesage using logger I did try running syslog-ng in debug mode , these are the results /sbin/syslog-ng -Fedv Syslog connection established; from='AF_INET(0.0.0.0:0)', to='AF_INET(x.x.x.x:514)' Running application hooks; hook='1' syslog-ng starting up; version='2.1.4' EOF occurred while reading; fd='3' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<85>Feb 14 15:04:03 sshd[797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.58.99.83 user=admin' Initializing destination file writer; template='/var/log/messages', filename='/var/log/messages' Incoming log entry; line='<86>Feb 14 15:04:06 sshd[797]: Failed password for admin from 10.58.99.83 port 64622 ssh2' EOF occurred while reading; fd='8' Closing log reader fd; fd='8' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<86>Feb 14 15:04:16 sshd[797]: Accepted password for admin from 10.58.99.83 port 64622 ssh2' EOF occurred while reading; fd='8' Closing log reader fd; fd='8' EOF occurred while reading; fd='7' Closing log reader fd; fd='7' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<86>Feb 14 15:04:16 sshd[797]: pam_unix(sshd:session): session opened for user admin by (uid=0)' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<13>Feb 14 15:04:22 admin: Test message' EOF occurred while reading; fd='8' Closing log reader fd; fd='8' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<86>Feb 14 15:04:48 su: pam_unix(su-l:session): session opened for user root by admin(uid=500)' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<86>Feb 14 15:05:00 su: pam_unix(su-l:session): session opened for user smuser by admin(uid=0)' But i do not see any debugs messages for smps.log getting processed ( even though the file is getting updated ) Any ideas Is this is a shortcoming in syslog-ng 2.1.4 . I cannot compile the latest version of syslog-ng since there is a limitation on my production system ( cannot compile anything due to security concerns ) so i am need of a syslog-ng rpm package other than 2.1.4 that works on RHEL 5 or if i can fix the issue in the existing version Appreciate any help Thanks Kathi -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

[Bug 218] New: To include local*.* facility. level in the source of syslog-ng
by bugzilla＠bugzilla.balabit.com 14 Feb '13

14 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=218 Summary: To include local*.* facility.level in the source of syslog-ng Product: syslog-ng Version: 3.2.x Platform: Other OS/Version: Solaris Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jk_kathi1(a)yahoo.com Type of the Report: --- Estimated Hours: 0.0 We have oracle audits configured to send updates to local0.info facility.level and the existing syslog.conf ( solaris syslgod ) has a feature to include them in local6.info /var/log/syslog We are replacing syslogd with syslog-ng and need to replicate this property I have searched the syslog-ng documentation and there is not mention of including local6.info in the source section of syslog-ng.conf. I can use it in the filter section , but the source itself is not getting updated so filter option may be unused. I can source a file but the audit logs does not write to a file , they write to proprietary syslog's facility.level Is there a solution , i have hit a road block Any information , documentation of how i can include the facility.level into syslog-ng would be helpful source s_local { system(); sun-streams("/dev/log" door("/etc/.syslog_door")); }; # Filters #filter f_local6 { facility(local6); }; Do i include any other keywords apart from system in the source s_local line Thanks -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 14