July 2014 - syslog-ng - lists.balabit.hu

syslog problem
by Riyas Ahamed 09 Jul '14

09 Jul '14

Hi, I have configured syslog-ng but I cannot able to see logs of network devices in syslog-ng server. Please help me to sort-out the problem. Regards, N.B.Riaz Ahmed http://www.csscorp.com/common/email-disclaimer.php

4 4

Recommended version
by James Lay 08 Jul '14

08 Jul '14

All, As I'm working with it here, what's the recommended version folks are running? Currently I'm on 3.3.11, and I figure I might as well upgrade..thanks for any pointers/tips. James

2 3

[Bug 280] New: Memory leak in value-pairs.c
by bugzilla＠bugzilla.balabit.com 08 Jul '14

08 Jul '14

https://bugzilla.balabit.com/show_bug.cgi?id=280 Summary: Memory leak in value-pairs.c Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sgounaro(a)optonline.net Type of the Report: bug Estimated Hours: 0.0 Hi , it looks like vp_walker_name_value_split_add_name_token has a memory leak in g_strndup call. Running syslog-ng with a lot of messages coming in about ~800 per sec , starts with 139m of memory and ends up with 9gig of memory in a day being used. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

Properly forwarding syslog messages
by James Lay 07 Jul '14

07 Jul '14

Hey all, So I've looked around and I'm just not sure what the best method is for forwarding syslog messages. I have a current setup that is working well. I'd like to try and get all the messages forward to another machine using standard udp 514. I'd like the messages to appear as if they are coming from the originating machine, not the syslog server. I did see a couple sites that say I have to compile with spoofing. Can anyone point me to some resources to do this? Thank you. James

2 3

Optional Parser Type Match
by Michael Starks 07 Jul '14

07 Jul '14

Can a parser type be made to optionally match? For example, given the message of 'DROP IN=vlan2 OUT= MAC=48:5b:39:e8:44:c5:00:1d:5a:1c:37:b9:08:00:45:00:00:28 SRC=1.2.3.4 DST=172.16.0.1 LEN=40 TOS=0x00 PREC=0x00 TTL=45 ID=61318 PROTO=TCP SPT=443 DPT=45872 SEQ=1548679084 ACK=0 WINDOW=0 RES=0x00 RST URGP' OUT= may or may not be defined. I would like to match it if it exists with a parser and maybe just set it to nul if it doesn't exist. Similarly, in this message: 'DROP IN=vlan2 OUT= MAC=48:5b:39:e8:44:c5:00:1d:5a:1c:37:b9:08:00:45:00:00:28 SRC=1.2.3.4 DST=172.16.0.2 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=3265 DF PROTO=TCP SPT=443 DPT=44616 SEQ=880418731 ACK=0 WINDOW=0 RES=0x00 RST UR' the DF field sometimes exists and sometimes doesn't. Whenever I define something like 'DROP IN=@ESTRING:s1: @OUT=@ESTRING:s0: @' the OUT= string doesn't match if there is no value.

2 2

No PatternDB Matches
by Michael Starks 02 Jul '14

02 Jul '14

x-posted from ELSA mailing list; no replies there so please excuse the noise. I am trying to add an additional ASA log message that is unclassified in ELSA. To make a long story short, *nothing" seems to be matching with pdbtool. Here is the line I am trying to work with: Jun 23 00:00:05 192.168.1.4 %ASA-3-106100: access-list INOUT denied tcp inside/1.2.3.4(64576) -> outside/5.6.7.8(80) hit-cnt 1 first hit [0x59bca63e, 0x620e5b55] Putting that aside for the moment since I can't get it to work, I went straight to the syslog-ng docs (https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-gui…) and used the example. I created /etc/elsa/patterns.d/test.xml with this content: <patterndb version='4' pub_date='2010-10-17'> <ruleset name='ssh' id='123456678'> <pattern>ssh</pattern> <rules> <rule provider='me' id='182437592347598' class='system'> <patterns> <pattern>Accepted @QSTRING:SSH.AUTH_METHOD: @ for@QSTRING:SSH_USERNAME: @from\ @QSTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ ssh2</pattern> </patterns> </rule> </rules> </ruleset> </patterndb> I then tested with this line: /usr/local/syslog-ng/bin/pdbtool match -p /etc/elsa/patterns.d/test.xml -M "Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2" The result is this: MESSAGE=Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2 .classifier.class=unknown Details are: [root@hostname elsa]# /usr/local/syslog-ng-3.2.4/sbin/syslog-ng -V syslog-ng 3.2.4 Installer-Version: 3.2.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6 Compile-Date: May 23 2012 09:58:14 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on Enable-Pacct: off [root@hostname elsa]# cat /etc/redhat-release Oracle Linux Server release 6.5 Thank you in advance.

2 3