November 2014 - syslog-ng - lists.balabit.hu

Create Pattern-DB rules
by Justin Kala 20 Oct '15

20 Oct '15

Hello I am trying to create Pattern-DB for the following Authorization messages coming from O/S. Can you help on creating a matching rule . Note: I do not have PATTERN-DB parser utility.I am going to create the db-parser.xml manually and put this rules inside the file. 2014-09-28T14:12:44-04:00 abcdef01-app/abcdef01-app sshd[11019]: [ID 800047 auth.notice] Failed password for root from 100.200.255.01 port 54438 ssh2 2014-09-28T14:03:46-04:00 abcdef01-app/abcdef01-app sshd[27420]: [ID 800047 auth.notice] Failed publickey for root from 100.200.255.02 port 59219 ssh2 2014-09-28T14:08:28-04:00 abcdef01-app/abcdef01-app sshd[3954]: [ID 800047 auth.notice] Failed keyboard-interactive for root from 100.200.255.03 port 65410 ssh2 2014-09-28T14:10:11-04:00 abcdef01-app/abcdef01-app sshd[5222]: [ID 293258 auth.error] libsldap: Status: 49 Mesg: openConnection: simple bind failed - Invalid credentials Thanks & Regards Kaladhar

4 16

Upcoming changes in unofficial packaging
by Gergely Nagy 23 Feb '15

23 Feb '15

Hi! I started packaging syslog-ng 3.6.1 for Debian and Ubuntu, to provide binaries at the usual[0] location. In the process, I intend to simplify and clean up the packaging considerably. This also means dropping support for a few older platforms. [0]: http://asylum.madhouse-project.org/projects/debian/ So beginning with 3.6.1, powerpc is going to be dropped, along with Debian Squeeze, and anything prior to Ubuntu Trusty (14.04) (mind you, I may need to add back Precise (12.04), for Travis CI). Furthermore, for Debian Wheezy, one will likely need to use the Debian backports repository[1] along with mine. [1]: http://backports.debian.org/Instructions/ I expect packages to be ready in a few days. -- |8]

3 4

I want to forward Windows server 2008 R2 logs to Linux syslog-ng.
by Jason Long 24 Dec '14

24 Dec '14

Hello all. I have a Windows Box that want to forward all Even logs to my Linux box. I install Snare on Windows(172.30.10.19) and configure it to forward logs to Linux and my Linux box receive it properly. When I use " tcpdump udp "port 514" ", Tcpdump show me that Snare sending Logs to Linux but Syslog-ng can't write it to log files :(. I paste my syslog-ng configure : options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" program_override("kernel: ")); unix-stream ("/dev/log"); internal(); #udp(ip(0.0.0.0) port(514)); }; #source s_net { #udp (ip(172.30.10.19) port(514)); #}; source s_net { udp(); }; filter f_openwrt { host("172.30.10.19");}; destination df_openwrt { file("/var/log/winlog/win.log"); }; log { source ( s_net ); filter( f_openwrt ); destination ( df_openwrt ); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/kern"); }; destination d_mlal { usertty("*"); }; filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; #log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; # vim:ft=syslog-ng:ai:si:ts=4:sw=4:et: Can you tell me how can I solve this problem? Cheers.

5 8

How can I have Persian and Arabic names in Syslog?
by Jason Long 26 Nov '14

26 Nov '14

Hello Folks.How are you?I installed a Syslog agent on Windows server and some of directories on Windows server are Persian. In Linux box I installed Logstash,Syslog-ng and Kibana but when my Linux receive Logs from Windows server the name shown as "????". How can I solve it? Cheers.

1 0

Re: [syslog-ng] Remote tags
by Nikolay P 25 Nov '14

25 Nov '14

Thank you, Sascha for sharing your example of config. That is exactly how I set it up after Fabian's answer. I used .SDATA.meta(a)11111.tags to store my tags and on the server they were seen as a string of comma separated values, so to match particular ones I used filters like this filter f_example { match( "example" value( ".SDATA.meta(a)11111.tags" ) ); } Later I realized that I am trying to invent my own wheel because what I was trying to achieve is to separate logs generated by system programs from the logs generated by userland programs. Now I am filtering them based on facility. But I am still using .SDATA.meta. On every computer I set this rewrite r_is_computer { set( "true" value( ".SDATA.meta(a)11111.is_computer" ) ); }; In this way on server end I can easily distinguish logs generated by computers from logs generated by different network equipment and I do not have to use IP based filtering. Nikolay. ----- Original Message ----- From: "Sascha Lucas" <Sascha.Lucas(a)gisa.de> To: syslog-ng(a)lists.balabit.hu Sent: Tuesday, November 25, 2014 2:34:00 AM GMT -05:00 US/Canada Eastern Subject: Re: [syslog-ng] Remote tags Hi Nikolay, > Could anyone here advice me if it is possible to set a tags() on a log > entry on one machine, send this log message to a remote syslog-ng and > use this tags() in a filter on the remote machine? As Fabien pointed out, it is possible. I'm doing something similar using rfc5424 protocol: The first thing I do is rewriting the log to append local scoped macro data into the sdata structure (here I'm using $SOURCEIP, where you want $tags). When I read rfc5424 I remember, that there are custom data-structures where you can store your tags (I decided to abuse .SDATA.origin.ip for my purpose): rewrite r_sdata { set("$SOURCEIP" value(".SDATA.origin.ip")); }; The second thing is to use the syslog-driver (capable of sending and receiving rfc5424): destination d_logserver { syslog("X.X.X.X" transport("udp")); }; And finely the log line log { source(s_network); source(src); rewrite(r_sdata); destination(d_logserver); }; On the server I have a source capable of rfc5424: source s_network { syslog( transport("udp") flags(validate-utf8) so-rcvbuf(2097152)); }; The transferred Information is directly available on the server in the macro ${.SDATA.origin.ip}. Your tags may be a bit special, because multiple tags would be transferred as a comma separated string. Matching on a single tag would probably mean to rewrite the log again. This time with something like set("${.SDATA.your.structure}. " value("tags"));. HTH, Sascha. Aufsichtsratsvorsitzender: Herbert Vogel Geschäftsführung: Michael Krüger Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

Remote tags
by Nikolay P 25 Nov '14

25 Nov '14

Hi, list. Could anyone here advice me if it is possible to set a tags() on a log entry on one machine, send this log message to a remote syslog-ng and use this tags() in a filter on the remote machine? So that on machine 1: source src { internal( tags("computer", "test") ) }; destination rem { udp("example.org" port(514)); }; log { source(src); destination(rem) }; And on machine 2 (example.org) source rem { udp(ip("0.0.0.0") port(514)); }; filter f_tag_test{ tags("test") }; destination test_dest { file("/var/log/test.log"); }; log { source(rem); filter(f_tag_test); destination(test_dest) }; So, should I be able to read tags ("computer" and "test") set by machine 1 on machine 2?

3 2

SQL escaping
by Nikolay P 24 Nov '14

24 Nov '14

Hello. My syslog-ng (version 3.4.8) logs some messages into the PostgreSQL database. I am going to setup a web page which will display those logs. I submitted log entry "alert('123')" surrounded by "script" html tags and displayed content of the database table on a web page. Javascript alerted "123" which means it is a XSS vulnerability. I am not in control of incoming log messages and they can containt anything, so I have no trust to them. Is there anything I can do from the syslog-ng side of things to close this XSS vulnerability or I have to deal with it in my Web application?

2 1

unsubscribe
by Simão Mata 20 Nov '14

20 Nov '14

unsubscribe On 20/11/14 12:00, syslog-ng-request(a)lists.balabit.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. syslog-ng 3.6.1 packages (Czanik) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 19 Nov 2014 15:23:03 +0100 > From: Czanik, P?ter <peter.czanik(a)balabit.com> > Subject: [syslog-ng] syslog-ng 3.6.1 packages > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CANcUavu8PeuFqC+u81vTc1Agf2=_Cee1+1hYoSjWv0eOR+AJtw(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hi, > Recently many people asked me in public and private about syslog-ng > 3.6.1 packages. To make my life easier, I put together a blog about > the current situation. It's available at > https://czanik.blogs.balabit.com/2014/11/syslog-ng-ose-3-6-1-packages/ > Bye, > Peter Czanik (CzP) <peter.czanik(a)balabit.com> > BalaBit IT Security / syslog-ng upstream > http://czanik.blogs.balabit.com/ > https://twitter.com/PCzanik > > > ------------------------------ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > End of syslog-ng Digest, Vol 115, Issue 11 > ****************************************** > -- <http://www.wimdu.com>*Wimdu GmbH - * Voltastraße 5, 13355 Berlin, Germany *Managing Directors -* Arne Bleckwenn, Hinrich Dreiling *Commercial Register Number -* 129773 B Berlin <http://www.facebook.com/wimdu> <http://www.twitter.com/wimdu> <http://www.google.com/+wimdu> <http://www.youtube.com/wimtubechannel> <http://www.linkedin.com/company/wimdu-gmbh>

1 0

syslog-ng 3.6.1 packages
by Czanik, Péter 19 Nov '14

19 Nov '14

Hi, Recently many people asked me in public and private about syslog-ng 3.6.1 packages. To make my life easier, I put together a blog about the current situation. It's available at https://czanik.blogs.balabit.com/2014/11/syslog-ng-ose-3-6-1-packages/ Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Re: [syslog-ng] How can I add multi server in my Syslog-ng Configuration?
by Jim Hendrick 18 Nov '14

18 Nov '14

Sorry to ask such a basic question, but are you sure the access point is *sending* logs? Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: Jason Long <hack3rcon(a)yahoo.com> Date:11/18/2014 6:27 AM (GMT-05:00) To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] How can I add multi server in my Syslog-ng Configuration? Hello all. How are you? I have a windows sever with Syslog agent installed on it and it forward all logs to my Linux box. My Syslog-NG collected it very well but I want to forward my Access point log to syslog-ng too. My Syslog-NG configuration is : # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_netsyslog { udp(ip(0.0.0.0) port(514) flags(no-hostname)); tcp(ip(0.0.0.0) port(514) flags(no-hostname)); }; destination d_netsyslog { file("/var/log/network.log" owner("root") group("root") perm(0644)); }; log { source(s_netsyslog); destination(d_netsyslog); }; as you see it collect Syslog from any IP address but why my Syslog-ng can't receive Access point log? Cheers.

2 1