- syslog-ng - lists.balabit.hu

Spoof-source option on Cygwin
by pedro castro 27 Sep '11

27 Sep '11

Hi we have Windows 2003 and Windows 2008 with cygwin. We receive events from several devices on syslog-ng server and redirect them to other systems. I want to use spoof-source option but i see that i need to compile syslog-ng from source. I have tried it but it fails in make. Does anyone have any idea? Regards

2 4

Re: [syslog-ng] syslog-ng Digest, Vol 77, Issue 34
by Luis Pugoy 27 Sep '11

27 Sep '11

> > Message: 1 > Date: Mon, 26 Sep 2011 18:07:00 +0800 > From: Luis Pugoy <lpugoy(a)insynchq.com> > Subject: Re: [syslog-ng] How to send tracebacks through syslog-ng? > (Jakub Jankowski) > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <CA+WGxEhGFX7V9C+71BgcU1TZsb21+FbzX5GdCZ=ZLPEDJ4fYFg(a)mail.gmail.com > > > Content-Type: text/plain; charset="iso-8859-1" > > On Sun, Sep 25, 2011 at 1:57 AM, Luis Pugoy <lpugoy(a)insynchq.com> wrote: > > > Message: 4 > >> Date: Sat, 24 Sep 2011 09:31:34 +0200 (CEST) > >> From: Jakub Jankowski <shasta(a)toxcorp.com> > >> Subject: Re: [syslog-ng] How to send tracebacks through syslog-ng? > >> To: Syslog-ng users' and developers' mailing list > >> <syslog-ng(a)lists.balabit.hu> > >> Message-ID: <alpine.LNX.2.00.1109240928240.15891(a)bluzg.slackware.pl> > >> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > >> > >> On 2011-09-24, Luis Pugoy wrote: > >> > >> > rewrite r_rewrite_subst { subst("a*", "?", value("MESSAGE") > >> type("pcre") > >> > flags("utf8" "global")); }; > >> > > >> > I thought that it would replace 0 or more occurrences of 'a' with a > >> question > >> > mark. However, when the input is 'a', the output becomes 'a?'. It just > >> > appends a question mark at the end. 'aa' also becomes 'aa?'. What is > >> weirder > >> > still is that even if the input does not contain 'a', the question > mark > >> is > >> > still appended. So '1' becomes '1?'. > >> > >> Well, does "1" match /a*/ ? :) > >> It doesn't make any difference if that's /a*/, /b*/ or /.*/ - this kind > of > >> regexp matches everything, even an empty string. > >> > >> HTH > >> > >> -- > >> Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ > >> GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D > > > > > > Hello Jakub. > > > > Thanks for the reply. You're right in that "1" matches /a*/, but wouldn't > > the resulting replacement be "?" instead of "1?" ? Also, if I just use > /a/ > > and use "a" as input, it does not seem to match. The text is still > outputted > > as "a". > > > > I don't know the policy regarding bumping threads here, but I'd like to > bump > this. Can anyone confirm the results I'm getting? Is there also something > wrong with my understanding of pcre? I'm sorry if this is not allowed. > I was able to solve my initial problem. The "\p{Zl}" must be changed to "\\p}{Zl}".

1 0

[PATCH] correlation: explicit context timeout action
by Balint Kovacs 23 Sep '11

23 Sep '11

Hi, I'm trying to use patterndb correlation to find matching firewall connection startup and ending log messages and emit a consolidated message. I found that with high-volume load, the memory usage of syslog-ng climbs rapidly and it would be beneficial to be able to kick already ended events from the memory. Please find a patch below (against 3.4) that does this, I thought the easy place for the user would be the <action> part of the ending rule, this way it can even be specified when the context should be ended. Balint From: Balint Kovacs <blint(a)balabit.hu> Date: Wed, 21 Sep 2011 11:46:30 +0200 Subject: [PATCH] correlation: add action to explicitly end context If there is a message that can be associated with the end of a context, the below action can explicitly end it, reducing the memory footprint. Example: <action> <end-context /> </action> Signed-off-by: Balint Kovacs <blint(a)balabit.hu> --- modules/dbparser/patterndb-int.h | 3 ++- modules/dbparser/patterndb.c | 22 ++++++++++++++++++++++ 2 files changed, 24 insertions(+), 1 deletions(-) diff --git a/modules/dbparser/patterndb-int.h b/modules/dbparser/patterndb-int.h index 0434847..eff77e6 100644 --- a/modules/dbparser/patterndb-int.h +++ b/modules/dbparser/patterndb-int.h @@ -115,7 +115,8 @@ enum enum { RAC_NONE, - RAC_MESSAGE + RAC_MESSAGE, + RAC_EXPIRE }; /* a rule may contain one or more actions to be performed */ diff --git a/modules/dbparser/patterndb.c b/modules/dbparser/patterndb.c index 343ef6d..72e97e0 100644 --- a/modules/dbparser/patterndb.c +++ b/modules/dbparser/patterndb.c @@ -577,6 +577,18 @@ pdb_rule_run_actions(PDBRule *self, gint trigger, PatternDB *db, PDBContext *con emit(genmsg, TRUE, emit_data); log_msg_unref(genmsg); break; + case RAC_EXPIRE: + if (context) + { + msg_debug("Expiring patterndb correllation context as directed by action", + evt_tag_str("last_rule", context->rule->rule_id), + evt_tag_long("remaining_context_count", g_hash_table_size(context->db->state)), + NULL); + g_hash_table_remove(context->db->state, &context->key); + timer_wheel_del_timer(db->timer_wheel, context->timer); + pdb_context_unref(context); + } + break; default: g_assert_not_reached(); break; @@ -921,6 +933,16 @@ pdb_loader_start_element(GMarkupParseContext *context, const gchar *element_name state->current_action->content_type = RAC_MESSAGE; state->current_message = &state->current_action->content.message; } + else if (strcmp(element_name, "end-context") == 0) + { + if (!state->in_action) + { + *error = g_error_new(1, 0, "Unexpected <end-context> element, it must be inside an action"); + return; + } + state->current_action->content_type = RAC_EXPIRE; + state->current_message = &state->current_action->content.message; + } } void -- 1.7.0.4

1 2

Re: [syslog-ng] Is it possible to replace a string with a new line using rewrite?
by Luis Pugoy 22 Sep '11

22 Sep '11

> > > Message: 4 > Date: Wed, 21 Sep 2011 21:20:44 +0200 > From: Gergely Nagy <algernon(a)balabit.hu> > Subject: Re: [syslog-ng] Is it possible to replace a string with a new > line using rewrite? > To: syslog-ng(a)lists.balabit.hu > Message-ID: <87pqitr9bn.fsf(a)luthien.mhp> > Content-Type: text/plain > > Luis Pugoy <lpugoy(a)insynchq.com> writes: > > > I am trying to replace a string with a newline using rewrite. Is it > > possible? Thanks. > > rewrite r_nl { > subst("<insert regexp here>", > "\n", value("MSG")); > }; > > Or, if you want to replace the whole MSG with a newline: > > rewrite r_nlmsg { set("\n", value("MSG")); }; > > -- > |8] > > Thanks. I was using single quotes ('\n') so it wasn't working for me before. I didn't realize that there's a distinction between single and double quotes in syslog-ng.

1 0

Is it possible to replace a string with a new line using rewrite?
by Luis Pugoy 21 Sep '11

21 Sep '11

Hello, I am trying to replace a string with a newline using rewrite. Is it possible? Thanks.

2 1

syslog-ng 3.3.0beta2 chroot
by Dave Haywood 21 Sep '11

21 Sep '11

Hi, I have compiled syslog-ng 3.3.0beta2 under RHEL AS 4.8 (don't ask) and am having a possible chroot() issue. syslog-ng is running chroot as a non-root user. All the build libraries etc (there were a lot to get this to run under RHEL 4.8) are under /usr/local. I already run syslog-ng 2.0.9 under RHEL AS 4.9. I am seeing differences between the 2.0.9 and 3.3.0b2 releases. The differences with 3.3.0b2 are: 1) daemon seems to switch user *before* binding the network interfaces. This means I can't bind to TCP/UDP ports < 1024. 2) daemon chroot()s before loading the syslog-ng.conf file. This means I have to mount the config dir under the chroot() dir. So, my questions are: 1) Is the behaviour I describe in 3.3.30b2 intentional or could this be a problem with my environment? 2) Why has the behaviour changed in this way? 3) If the daemon were to: read the config file bind the network interfaces as root *before* dropping privelege and doing the chroot() couldn't a lot of the chroot() hastle (below) be avoided? I have 3.3.0b2 running chroot() but only by: mount -o bind /lib /chrootdir/lib mount -o bind /usr/local /chrootdir/usr/local mount -o bind /dev /chrootdir/dev changing the syslog-ng.conf TCP/UDP listen ports to be > 1024 Regards, Dave.

2 1

Messages starting with tab not processed cleanly
by Jon Nathan 21 Sep '11

21 Sep '11

We're running into an issue where some syslog messages on our centralized syslog-ng server lack originating hostnames. These messages happen to be formatted funny - the message part starts with a tab (\0x09) character. Solaris 10 x86 everywhere, Syslog-ng 3.1.4, Eventlog 0.2.12. Client syslog: Sep 15 20:30:21 h.example.com scsi: [ID 107833 kern.warning] WARNING: /pci@7b,0/pci1022,7458@11/pci1000,3060@2/sd@0,0 (sd2): Sep 15 20:30:21 h.example.com Error for Command: read Error Level: Fatal Sep 15 20:30:21 h.example.com scsi: [ID 107833 kern.notice] Requested Block: 16065 Error Block: 16065 Sep 15 20:30:21 h.example.com scsi: [ID 107833 kern.notice] Vendor: SEAGATE Serial Number: 074093HVSX Sep 15 20:30:21 h.example.com scsi: [ID 107833 kern.notice] Sense Key: Aborted Command Sep 15 20:30:21 h.example.com scsi: [ID 107833 kern.notice] ASC: 0x8 (LUN communication time-out), ASCQ: 0x1, FRU: 0x81 This shows up in my centralized syslog-ng server as: Sep 15 20:30:21 h.example.com scsi: [ID 107833 kern.warning] WARNING: /pci@7b,0/pci1022,7458@11/pci1000,3060@2/sd@0,0 (sd2): Sep 15 20:30:21 Error for Command: read Error Level: Fatal Sep 15 20:30:21 h.example.com scsi: [ID 107833 kern.notice] Requested Block: 16065 Error Block: 16065 Sep 15 20:30:21 h.example.com scsi: [ID 107833 kern.notice] Vendor: SEAGATE Serial Number: 074093HVSX Sep 15 20:30:21 h.example.com scsi: [ID 107833 kern.notice] Sense Key: Aborted Command Sep 15 20:30:21 h.example.com scsi: [ID 107833 kern.notice] ASC: 0x8 (LUN communication time-out), ASCQ: 0x1, FRU: 0x81 Note that the 2nd line doesn't have a hostname. This is the message coming from the host (tcpdump -n -v -s 0 "port 514"): 20:30:21.454902 IP (tos 0x0, ttl 255, id 43670, offset 0, flags [DF], proto UDP (17), length 141) 10.1.1.1.59299 > 10.1.1.2.514: SYSLOG, length: 113 Facility kernel (0), Severity warning (4) Msg: Sep 15 20:30:21 scsi: [ID 107833 kern.warning] WARNING: /pci@7b,0/pci1022,7458@11/pci1000,3060@2/sd@0,0 (sd2): 20:30:21.454941 IP (tos 0x0, ttl 255, id 43671, offset 0, flags [DF], proto UDP (17), length 109) 10.1.1.1.59299 > 10.1.1.2.514: SYSLOG, length: 81 Facility kernel (0), Severity warning (4) Msg: Sep 15 20:30:21 \0x09Error for Command: read Error Level: Fatal 20:30:21.454966 IP (tos 0x0, ttl 255, id 43672, offset 0, flags [DF], proto UDP (17), length 139) 10.1.1.1.59299 > 10.1.1.2.514: SYSLOG, length: 111 Facility kernel (0), Severity notice (5) Msg: Sep 15 20:30:21 scsi: [ID 107833 kern.notice] \0x09Requested Block: 16065 Error Block: 16065 20:30:21.454986 IP (tos 0x0, ttl 255, id 43673, offset 0, flags [DF], proto UDP (17), length 148) 10.1.1.1.59299 > 10.1.1.2.514: SYSLOG, length: 120 Facility kernel (0), Severity notice (5) Msg: Sep 15 20:30:21 scsi: [ID 107833 kern.notice] \0x09Vendor: SEAGATE Serial Number: 074093HVSX 20:30:21.455010 IP (tos 0x0, ttl 255, id 43674, offset 0, flags [DF], proto UDP (17), length 104) 10.1.1.1.59299 > 10.1.1.2.514: SYSLOG, length: 76 Facility kernel (0), Severity notice (5) Msg: Sep 15 20:30:21 scsi: [ID 107833 kern.notice] \0x09Sense Key: Aborted Command 20:30:21.455031 IP (tos 0x0, ttl 255, id 43675, offset 0, flags [DF], proto UDP (17), length 137) 10.1.1.1.59299 > 10.1.1.2.514: SYSLOG, length: 109 Facility kernel (0), Severity notice (5) Msg: Sep 15 20:30:21 scsi: [ID 107833 kern.notice] \0x09ASC: 0x8 (LUN communication time-out), ASCQ: 0x1, FRU: 0x81 (Hostnames/IPs sanitized) The second message starts with a tab (\0x09) after the timestamp. This seems to throw off syslog-ng such that it won't append a hostname to the message. We do a lot of parsing that relies on the hostname being present in all messages. Any idea why this seems to break syslog-ng, or how to fix it? Our syslog-ng.conf is relatively generic. Here are the relevant parts: filter f_syslog { level(info..emerg); }; destination d_syslog { file("/syslog/logs/$YEAR/$MONTH/$DAY/syslog" flags(no-multi-line)); }; log{ source(s_sys); source(s_remote); filter(f_syslog); destination(d_syslog); }; (Sorry if this hits the list twice, I don't think my first try worked.) Thanks, -Jon

4 3

buffer logs from initramfs until syslog-ng starts
by Patrick H. 21 Sep '11

21 Sep '11

So I'm trying to find a way to buffer logs from extremely early in the boot process (from when the initramfs is still running), and then dump them to syslog-ng once it starts. Has anyone done anything similar? The only real idea that comes to mind is to use busybox's syslogd and have it use a circular buffer, then configure syslog-ng with a program source that reads the buffer and then terminates the the daemon (something like 'logread ; pkill -x syslogd &>/dev/null'), and set follow_freq to 0. Whether this will work or not, I dont know as I've never played with program sources. Also a problem I see with this is that the busybox syslogd would need to be killed before syslog-ng tries to open /dev/log and /proc/kmsg, but I'm not sure how to go about that. I do seem to recall some other utility I've ran across in my travels that is designed for this exact purpose, in that it buffers syslog messages during boot, then dumps its buffer once the main syslog daemon has started and terminates, but I cant remember what its called (and google is failing me). So does anyone have any good ideas for solving this situation?

4 4

Re: [syslog-ng] Syslog-NG error msg : out of memory
by Henry Xu 21 Sep '11

21 Sep '11

Any one can update on this? Thanks. From: Henry Xu [mailto:bxu@italkbb.com] Sent: Wednesday, September 07, 2011 13:03 To: 'syslog-ng(a)lists.balabit.hu' Subject: Syslog-NG error msg : out of memory Hi All, Today I got monitoring alarms about Syslog-NG. I checked log and found the following errors: Sep 6 21:35:35 host1 1:manager[db] [353-1] ERROR: out of memory Sep 6 21:35:35 host1 1:manager[db] [353-2] DETAIL: Failed on request of size 131071998. Sep 6 21:35:35 host1 1:manager[db] [354-1] ERROR: out of memory Sep 6 21:35:35 host1 1:manager[db] [354-2] DETAIL: Failed on request of size 131071998. Sep 6 21:35:35 host1 1:manager[db] [355-1] ERROR: out of memory Sep 6 21:35:35 host1 1:manager[db] [355-2] DETAIL: Failed on request of size 131071998. Sep 6 21:35:35 host1 1:manager[db] [356-1] ERROR: out of memory Sep 6 21:35:35 host1 1:manager[db] [356-2] DETAIL: Failed on request of size 131071998. Sep 6 21:35:35 host1 1:manager[db] [357-1] ERROR: out of memory Sep 6 21:35:35 host1 1:manager[db] [357-2] DETAIL: Failed on request of size 131071998. Is this related to the memory leak? Does someone have the same experience and whether have a way to avoid this? Thanks, Henry

3 2

program filter regex
by Matt Zagrabelny 21 Sep '11

21 Sep '11

Hi, I've looked through the OSE reference PDF and have a question about the program filter regex. I've done some experimentation and I would have thought the following to work: I'm trying to match puppet programs in syslog-ng (version 3.1) log entry: Sep 2 14:36:25 hornet puppet-agent[15008]: Finished catalog run in 0.75 seconds This filter works: filter f_puppet { program("puppet.*"); }; But this does not: filter f_puppet { program("puppet"); }; For things like grep, perl, and ruby the latter regex ("puppet") would have matched the program string "puppet-agent". Syslog-ng does not seem to behave the same way. Is there a way to get the grep/perl behavior? If not, it seems like it doesn't follow the conventions of other free software. Would anyone consider it a wishlist bug? Thanks for the info or advice! -matt zagrabelny

2 1

is there support for multi-line messages in a syslog-ng OSE release?
by mike＠lague.org 21 Sep '11

21 Sep '11

I'm using syslog-ng 3.0.5 (OSE). I've noticed that if a multi-line message is sent by an application to syslog-ng via a unix-stream source, the first line is logged to the right destination, and the next line goes to a default destination. E.g., if a message like "Test message line 1\nTest message line 2\n" is sent, "Test message line 1" appears in the expected destination file, while "Error processing log message: Test message line 2" appears in the default destination. This limitation (which does not exist with unix-dgram sources) seems to have been reported a number of times on various lists. The feature comparison table at http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… indicates that there is no support for multi-line messages in OSE 3.2, but there is such support in PE 4.0 Yet I thought a saw a message which indicated that there might be support for multi-line messages in an OSE release? Can someone confirm this? Also, is there any way around this limitation in earlier OSE releases? Thank you, --Mike

3 3

Re: [syslog-ng] Problem sending logs to central log server..
by Patrick H. 19 Sep '11

19 Sep '11

Seriously, dont remove the mailing list from the recipients. Others may catch things I miss, or I might be gone for a while, but someone else is around. That filter you have only logs warning through emerg, while by default logger uses notice, which is below warning. -Patrick Sent: Mon Sep 19 2011 15:26:05 GMT-0600 (MST) From: rek2 <rek2gnulinux(a)gmail.com> To: Patrick H. <syslogng(a)feystorm.net> Subject: Re: [syslog-ng] Problem sending logs to central log server.. > ops! I forgot to uncoment that as well sorry.. so basically do I have > everything else ok? > the thing is also that after I migrated to syslog-ng in the BSD things > are not logging to their place > in /var/log either Im getting most of the stuff on the /var/log/syslog > even tho as you can see in my other emails the default config already > define the destinations for auth etc... > > 2011/9/19 Patrick H. <syslogng(a)feystorm.net > <mailto:syslogng@feystorm.net>> > > Dont forget to leave the mailing list on the list of recips :-) > > Anyway, its still commented out in your log {} block. If the log > block has no source, it wont log anything. > > log { > # source(src_eventdb); > filter(f_at_least_warn); > # filter(f_syslog); > destination(d_eventdb); > }; > > > -Patrick > > > > Sent: Mon Sep 19 2011 14:43:08 GMT-0600 (MST) > > From: rek2 <rek2gnulinux(a)gmail.com> <mailto:rek2gnulinux@gmail.com> > To: Patrick H. <syslogng(a)feystorm.net> <mailto:syslogng@feystorm.net> > Subject: Re: [syslog-ng] Problem sending logs to central log server.. >> Hi Patrick, thanks for your reply, yes you right sorry I did the >> copy and paste before I uncomented some lines since Im testing >> here and there.. >> >> this is how I have it now.. the last part: >> >> #syslog-ng2mysql destinations >> >> source src_eventdb { >> unix-stream("/dev/log"); >> udp(ip(0.0.0.0) port(514)); >> }; >> >> destination d_eventdb { >> pipe( >> "/usr/local/icinga/var/rw/syslog-ng.pipe", >> >> template("$HOST\t$SOURCEIP\t$PRI\t$YEAR-$MONTH-$DAY\t$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n") >> template_escape(no) >> ); >> }; >> >> filter f_at_least_warn { >> # level(warn..emerg); >> # level(notice..emerg); >> level(info, notice, warn, crit, err, debug); >> }; >> >> log { >> # source(src_eventdb); >> filter(f_at_least_warn); >> # filter(f_syslog); >> destination(d_eventdb); >> }; >> >> #log { >> # source(src_eventdb); >> # filter(f_auth); >> # destination(d_eventdb); >> #}; >> >> >> 2011/9/19 Patrick H. <syslogng(a)feystorm.net >> <mailto:syslogng@feystorm.net>> >> >> In your server config, the only listener you have on udp port >> 514 is defined in src_eventdb, and all src_eventdb entries >> are commented out. >> >> -Patrick >> >> >> Sent: Mon Sep 19 2011 11:40:15 GMT-0600 (MST) >> From: rek2 <rek2gnulinux(a)gmail.com> >> <mailto:rek2gnulinux@gmail.com> >> To: syslog-ng(a)lists.balabit.hu >> <mailto:syslog-ng@lists.balabit.hu> >> Subject: [syslog-ng] Problem sending logs to central log >> server.. >>> Hello, I'm trying to sent all my logs from one openbsd >>> server with syslog-ng to a linux ubuntu central log server >>> also with syslog-ng of course but only the syslog-ng logs >>> are been logged.. >>> also when I do a "logger test" for example it gets log >>> locally but not remotely to the log server... >>> here are my configs: >>> >>> for the log server is basically the defaul of ubuntu with my >>> addtions at the end.. you will see >>> some commented is me trying to fix this issue. >>> >>> >>> cat syslog-ng/syslog-ng.conf >>> # >>> # Configuration file for syslog-ng under Debian >>> # >>> # attempts at reproducing default syslog behavior >>> >>> # the standard syslog levels are (in descending order of >>> priority): >>> # emerg alert crit err warning notice info debug >>> # the aliases "error", "panic", and "warn" are deprecated >>> # the "none" priority found in the original syslogd >>> configuration is >>> # only used in internal messages created by syslogd >>> >>> >>> ###### >>> # options >>> >>> options { >>> # disable the chained hostname format in logs >>> # (default is enabled) >>> chain_hostnames(0); >>> >>> # the time to wait before a died connection is >>> re-established >>> # (default is 60) >>> time_reopen(10); >>> >>> # the time to wait before an idle destination file >>> is closed >>> # (default is 60) >>> time_reap(360); >>> >>> # the number of lines buffered before written to file >>> # you might want to increase this if your disk isn't >>> catching with >>> # all the log messages you get or if you want less >>> disk activity >>> # (say on a laptop) >>> # (default is 0) >>> #sync(0); >>> >>> # the number of lines fitting in the output queue >>> log_fifo_size(2048); >>> >>> # enable or disable directory creation for >>> destination files >>> create_dirs(yes); >>> >>> # default owner, group, and permissions for log files >>> # (defaults are 0, 0, 0600) >>> #owner(root); >>> group(adm); >>> perm(0640); >>> >>> # default owner, group, and permissions for created >>> directories >>> # (defaults are 0, 0, 0700) >>> #dir_owner(root); >>> #dir_group(root); >>> dir_perm(0755); >>> >>> # enable or disable DNS usage >>> # syslog-ng blocks on DNS queries, so enabling DNS >>> may lead to >>> # a Denial of Service attack >>> # (default is yes) >>> use_dns(yes); >>> >>> # maximum length of message in bytes >>> # this is only limited by the program listening on >>> the /dev/log Unix >>> # socket, glibc can handle arbitrary length log >>> messages, but -- for >>> # example -- syslogd accepts only 1024 bytes >>> # (default is 2048) >>> #log_msg_size(2048); >>> >>> #Disable statistic log messages. >>> stats_freq(0); >>> >>> # Some program send log messages through a private >>> implementation. >>> # and sometimes that implementation is bad. If this >>> happen syslog-ng >>> # may recognise the program name as hostname. Whit >>> this option >>> # we tell the syslog-ng that if a hostname match >>> this regexp than that >>> # is not a real hostname. >>> bad_hostname("^gconfd$"); >>> keep_hostname (yes); >>> >>> }; >>> >>> >>> ###### >>> # sources >>> >>> # all known message sources >>> source s_all { >>> # message generated by Syslog-NG >>> internal(); >>> # standard Linux log source (this is the default >>> place for the syslog() >>> # function to send logs to) >>> unix-stream("/dev/log"); >>> # messages from the kernel >>> file("/proc/kmsg" log_prefix("kernel: ")); >>> # use the following line if you want to receive >>> remote UDP logging messages >>> # (this is equivalent to the "-r" syslogd flag) >>> # udp(); >>> }; >>> >>> >>> ###### >>> # destinations >>> >>> # some standard log files >>> destination df_auth { file("/var/log/auth.log"); }; >>> destination df_syslog { file("/var/log/syslog"); }; >>> destination df_cron { file("/var/log/cron.log"); }; >>> destination df_daemon { file("/var/log/daemon.log"); }; >>> destination df_kern { file("/var/log/kern.log"); }; >>> destination df_lpr { file("/var/log/lpr.log"); }; >>> destination df_mail { file("/var/log/mail.log"); }; >>> destination df_user { file("/var/log/user.log"); }; >>> destination df_uucp { file("/var/log/uucp.log"); }; >>> >>> # these files are meant for the mail system log files >>> # and provide re-usable destinations for {mail,cron,...}.info, >>> # {mail,cron,...}.notice, etc. >>> destination df_facility_dot_info { >>> file("/var/log/$FACILITY.info"); }; >>> destination df_facility_dot_notice { >>> file("/var/log/$FACILITY.notice"); }; >>> destination df_facility_dot_warn { >>> file("/var/log/$FACILITY.warn"); }; >>> destination df_facility_dot_err { >>> file("/var/log/$FACILITY.err"); }; >>> destination df_facility_dot_crit { >>> file("/var/log/$FACILITY.crit"); }; >>> >>> # these files are meant for the news system, and are kept >>> separated >>> # because they should be owned by "news" instead of "root" >>> destination df_news_dot_notice { >>> file("/var/log/news/news.notice" owner("news")); }; >>> destination df_news_dot_err { file("/var/log/news/news.err" >>> owner("news")); }; >>> destination df_news_dot_crit { >>> file("/var/log/news/news.crit" owner("news")); }; >>> >>> # some more classical and useful files found in standard >>> syslog configurations >>> destination df_debug { file("/var/log/debug"); }; >>> destination df_messages { file("/var/log/messages"); }; >>> >>> # pipes >>> # a console to view log messages under X >>> destination dp_xconsole { pipe("/dev/xconsole"); }; >>> >>> # consoles >>> # this will send messages to everyone logged in >>> destination du_all { usertty("*"); }; >>> >>> >>> ###### >>> # filters >>> >>> # all messages from the auth and authpriv facilities >>> filter f_auth { facility(auth, authpriv); }; >>> >>> # all messages except from the auth and authpriv facilities >>> filter f_syslog { not facility(auth, authpriv); }; >>> >>> # respectively: messages from the cron, daemon, kern, lpr, >>> mail, news, user, >>> # and uucp facilities >>> filter f_cron { facility(cron); }; >>> filter f_daemon { facility(daemon); }; >>> filter f_kern { facility(kern); }; >>> filter f_lpr { facility(lpr); }; >>> filter f_mail { facility(mail); }; >>> filter f_news { facility(news); }; >>> filter f_user { facility(user); }; >>> filter f_uucp { facility(uucp); }; >>> >>> # some filters to select messages of priority greater or >>> equal to info, warn, >>> # and err >>> # (equivalents of syslogd's *.info, *.warn, and *.err) >>> filter f_at_least_info { level(info..emerg); }; >>> filter f_at_least_notice { level(notice..emerg); }; >>> filter f_at_least_warn { level(warn..emerg); }; >>> filter f_at_least_err { level(err..emerg); }; >>> filter f_at_least_crit { level(crit..emerg); }; >>> >>> # all messages of priority debug not coming from the auth, >>> authpriv, news, and >>> # mail facilities >>> filter f_debug { level(debug) and not facility(auth, >>> authpriv, news, mail); }; >>> >>> # all messages of info, notice, or warn priority not coming >>> form the auth, >>> # authpriv, cron, daemon, mail, and news facilities >>> filter f_messages { >>> level(info,notice,warn) >>> and not >>> facility(auth,authpriv,cron,daemon,mail,news); >>> }; >>> >>> # messages with priority emerg >>> filter f_emerg { level(emerg); }; >>> >>> # complex filter for messages usually sent to the xconsole >>> filter f_xconsole { >>> facility(daemon,mail) >>> or level(debug,info,notice,warn) >>> or (facility(news) >>> and level(crit,err,notice)); >>> }; >>> >>> >>> ###### >>> # logs >>> # order matters if you use "flags(final);" to mark the end >>> of processing in a >>> # "log" statement >>> >>> # these rules provide the same behavior as the commented >>> original syslogd rules >>> >>> # auth,authpriv.* /var/log/auth.log >>> log { >>> source(s_all); >>> filter(f_auth); >>> destination(df_auth); >>> }; >>> >>> # *.*;auth,authpriv.none -/var/log/syslog >>> log { >>> source(s_all); >>> filter(f_syslog); >>> destination(df_syslog); >>> }; >>> >>> # this is commented out in the default syslog.conf >>> # cron.* /var/log/cron.log >>> #log { >>> # source(s_all); >>> # filter(f_cron); >>> # destination(df_cron); >>> #}; >>> >>> # daemon.* -/var/log/daemon.log >>> log { >>> source(s_all); >>> filter(f_daemon); >>> destination(df_daemon); >>> }; >>> >>> # kern.* -/var/log/kern.log >>> log { >>> source(s_all); >>> filter(f_kern); >>> destination(df_kern); >>> }; >>> >>> # lpr.* -/var/log/lpr.log >>> log { >>> source(s_all); >>> filter(f_lpr); >>> destination(df_lpr); >>> }; >>> >>> # mail.* -/var/log/mail.log >>> log { >>> source(s_all); >>> filter(f_mail); >>> destination(df_mail); >>> }; >>> >>> # user.* -/var/log/user.log >>> log { >>> source(s_all); >>> filter(f_user); >>> destination(df_user); >>> }; >>> >>> # uucp.* /var/log/uucp.log >>> log { >>> source(s_all); >>> filter(f_uucp); >>> destination(df_uucp); >>> }; >>> >>> # mail.info <http://mail.info> >>> -/var/log/mail.info <http://mail.info> >>> log { >>> source(s_all); >>> filter(f_mail); >>> filter(f_at_least_info); >>> destination(df_facility_dot_info); >>> }; >>> >>> # mail.warn -/var/log/mail.warn >>> log { >>> source(s_all); >>> filter(f_mail); >>> filter(f_at_least_warn); >>> destination(df_facility_dot_warn); >>> }; >>> >>> # mail.err /var/log/mail.err >>> log { >>> source(s_all); >>> filter(f_mail); >>> filter(f_at_least_err); >>> destination(df_facility_dot_err); >>> }; >>> >>> # news.crit /var/log/news/news.crit >>> log { >>> source(s_all); >>> filter(f_news); >>> filter(f_at_least_crit); >>> destination(df_news_dot_crit); >>> }; >>> >>> # news.err /var/log/news/news.err >>> log { >>> source(s_all); >>> filter(f_news); >>> filter(f_at_least_err); >>> destination(df_news_dot_err); >>> }; >>> >>> # news.notice /var/log/news/news.notice >>> log { >>> source(s_all); >>> filter(f_news); >>> filter(f_at_least_notice); >>> destination(df_news_dot_notice); >>> }; >>> >>> >>> # *.=debug;\ >>> # auth,authpriv.none;\ >>> # news.none;mail.none -/var/log/debug >>> log { >>> source(s_all); >>> filter(f_debug); >>> destination(df_debug); >>> }; >>> >>> >>> # *.=info;*.=notice;*.=warn;\ >>> # auth,authpriv.none;\ >>> # cron,daemon.none;\ >>> # mail,news.none -/var/log/messages >>> log { >>> source(s_all); >>> filter(f_messages); >>> destination(d_eventdb); >>> }; >>> >>> # *.emerg * >>> log { >>> source(s_all); >>> filter(f_emerg); >>> destination(du_all); >>> }; >>> >>> >>> # daemon.*;mail.*;\ >>> # news.crit;news.err;news.notice;\ >>> # *.=debug;*.=info;\ >>> # *.=notice;*.=warn |/dev/xconsole >>> log { >>> source(s_all); >>> filter(f_xconsole); >>> destination(dp_xconsole); >>> }; >>> #syslog-ng2mysql destinations >>> >>> source src_eventdb { >>> unix-stream("/dev/log"); >>> udp(ip(0.0.0.0) port(514)); >>> }; >>> >>> destination d_eventdb { >>> pipe( >>> "/usr/local/icinga/var/rw/syslog-ng.pipe", >>> >>> template("$HOST\t$SOURCEIP\t$PRI\t$YEAR-$MONTH-$DAY\t$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n") >>> template_escape(no) >>> ); >>> }; >>> >>> filter f_at_least_warn { >>> # level(warn..emerg); >>> level(notice..emerg); >>> }; >>> >>> log { >>> # source(src_eventdb); >>> filter(f_at_least_warn); >>> # filter(f_syslog); >>> destination(d_eventdb); >>> }; >>> >>> #log { >>> # source(src_eventdb); >>> # filter(f_auth); >>> # destination(d_eventdb); >>> #}; >>> >>> >>> >>> HERE FOR THE BSD/CLIENT SIDE: same here is the default with >>> openbsd syslog-ng install >>> with my additions at the end. >>> >>> cat /etc/syslog-ng.conf >>> # >>> # Syslog-ng example configuration for for Debian GNU/Linux >>> # >>> # Copyright (c) 1999 anonymous >>> # Copyright (c) 1999 Balazs Scheidler >>> # $Id: syslog-ng.conf.sample,v 1.3 2003/05/20 08:57:27 asd Exp $ >>> # >>> # Syslog-ng configuration file, compatible with default >>> Debian syslogd >>> # installation. >>> # >>> >>> options { long_hostnames(off); sync(0); keep_hostname(yes); >>> use_dns(yes); stats (3600); }; >>> >>> #source src { unix-stream("/dev/log"); internal(); }; >>> source src { unix-dgram("/dev/log"); internal(); }; >>> source net { udp(); }; >>> >>> destination authlog { file("/var/log/auth.log"); }; >>> destination syslog { file("/var/log/syslog"); }; >>> destination cron { file("/var/log/cron.log"); }; >>> destination daemon { file("/var/log/daemon.log"); }; >>> destination kern { file("/var/log/kern.log"); }; >>> destination lpr { file("/var/log/lpr.log"); }; >>> destination user { file("/var/log/user.log"); }; >>> destination uucp { file("/var/log/uucp.log"); }; >>> destination ppp { file("/var/log/ppp.log"); }; >>> destination mail { file("/var/log/mail.log"); }; >>> >>> destination mailinfo { file("/var/log/mail.info >>> <http://mail.info>"); }; >>> destination mailwarn { file("/var/log/mail.warn"); }; >>> destination mailerr { file("/var/log/mail.err"); }; >>> >>> destination newscrit { file("/var/log/news/news.crit"); }; >>> destination newserr { file("/var/log/news/news.err"); }; >>> destination newsnotice { file("/var/log/news/news.notice"); }; >>> >>> destination debug { file("/var/log/debug"); }; >>> destination messages { file("/var/log/messages"); }; >>> destination console { usertty("root"); }; >>> destination console_all { file("/dev/tty12"); }; >>> #destination loghost { udp("loghost" port(999)); }; >>> >>> >>> destination xconsole { pipe("/dev/xconsole"); }; >>> >>> >>> #ssh filter >>> filter f_sshderr { match('^sshd\[[0-9]+\]: error:'); }; >>> filter f_sshd { match('^sshd\[[0-9]+\]:'); }; >>> # >>> filter f_auth { facility(auth); }; >>> filter f_authpriv { facility(auth, authpriv); }; >>> filter f_syslog { not facility(authpriv, mail); }; >>> filter f_cron { facility(cron); }; >>> filter f_daemon { facility(daemon); }; >>> filter f_kern { facility(kern); }; >>> filter f_lpr { facility(lpr); }; >>> filter f_mail { facility(mail); }; >>> filter f_user { facility(user); }; >>> filter f_uucp { facility(cron); }; >>> filter f_ppp { facility(local2); }; >>> filter f_news { facility(news); }; >>> filter f_debug { not facility(auth, authpriv, news, mail); }; >>> filter f_messages { level(info..warn) >>> and not facility(auth, authpriv, mail, news); }; >>> filter f_emergency { level(emerg); }; >>> >>> filter f_info { level(info); }; >>> filter f_notice { level(notice); }; >>> filter f_warn { level(warn); }; >>> filter f_crit { level(crit); }; >>> filter f_err { level(err); }; >>> >>> log { source(src); filter(f_authpriv); destination(authlog); }; >>> log { source(src); filter(f_syslog); destination(syslog); }; >>> log { source(src); filter(f_cron); destination(cron); }; >>> log { source(src); filter(f_daemon); destination(daemon); }; >>> log { source(src); filter(f_kern); destination(kern); }; >>> log { source(src); filter(f_lpr); destination(lpr); }; >>> log { source(src); filter(f_mail); destination(mail); }; >>> log { source(src); filter(f_user); destination(user); }; >>> log { source(src); filter(f_uucp); destination(uucp); }; >>> log { source(src); filter(f_mail); filter(f_info); >>> destination(mailinfo); }; >>> log { source(src); filter(f_mail); filter(f_warn); >>> destination(mailwarn); }; >>> log { source(src); filter(f_mail); filter(f_err); >>> destination(mailerr); }; >>> log { source(src); filter(f_news); filter(f_crit); >>> destination(newscrit); }; >>> log { source(src); filter(f_news); filter(f_err); >>> destination(newserr); }; >>> log { source(src); filter(f_news); filter(f_notice); >>> destination(newsnotice); }; >>> log { source(src); filter(f_debug); destination(debug); }; >>> log { source(src); filter(f_messages); destination(messages); }; >>> log { source(src); filter(f_emergency); destination(console); }; >>> log { source(src); filter(f_ppp); destination(ppp); }; >>> log { source(src); destination(console_all); }; >>> >>> #sent to our central log server running eventdb >>> destination loghost { udp("192.168.xxx.xxx" port(514)); }; >>> log { source(src); filter(f_info); destination(loghost); }; >>> log { source(src); filter(f_syslog); destination(loghost); }; >>> log { source(src); filter(f_authpriv); destination(loghost); }; >>> log { source(src); filter(f_user); destination(loghost); }; >>> log { source(src); filter(f_emergency); destination(loghost); }; >>> log { source(src); filter(f_sshd); destination(loghost); }; >>> log { source(src); filter(f_sshderr); destination(loghost); }; >>> log { source(src); filter(f_kern); destination(loghost); }; >>> >>> >>> ______________________________________________________________________________ >>> Member info:https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation:http://www.balabit.com/support/documentation/?product=syslog-… >>> FAQ:http://www.balabit.com/wiki/syslog-ng-faq >>> >> >

2 3

Re: [syslog-ng] Problem sending logs to central log server..
by Patrick H. 19 Sep '11

19 Sep '11

Dont forget to leave the mailing list on the list of recips :-) Anyway, its still commented out in your log {} block. If the log block has no source, it wont log anything. log { # source(src_eventdb); filter(f_at_least_warn); # filter(f_syslog); destination(d_eventdb); }; -Patrick Sent: Mon Sep 19 2011 14:43:08 GMT-0600 (MST) From: rek2 <rek2gnulinux(a)gmail.com> To: Patrick H. <syslogng(a)feystorm.net> Subject: Re: [syslog-ng] Problem sending logs to central log server.. > Hi Patrick, thanks for your reply, yes you right sorry I did the copy > and paste before I uncomented some lines since Im testing here and > there.. > > this is how I have it now.. the last part: > > #syslog-ng2mysql destinations > > source src_eventdb { > unix-stream("/dev/log"); > udp(ip(0.0.0.0) port(514)); > }; > > destination d_eventdb { > pipe( > "/usr/local/icinga/var/rw/syslog-ng.pipe", > > template("$HOST\t$SOURCEIP\t$PRI\t$YEAR-$MONTH-$DAY\t$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n") > template_escape(no) > ); > }; > > filter f_at_least_warn { > # level(warn..emerg); > # level(notice..emerg); > level(info, notice, warn, crit, err, debug); > }; > > log { > # source(src_eventdb); > filter(f_at_least_warn); > # filter(f_syslog); > destination(d_eventdb); > }; > > #log { > # source(src_eventdb); > # filter(f_auth); > # destination(d_eventdb); > #}; > > > 2011/9/19 Patrick H. <syslogng(a)feystorm.net > <mailto:syslogng@feystorm.net>> > > In your server config, the only listener you have on udp port 514 > is defined in src_eventdb, and all src_eventdb entries are > commented out. > > -Patrick > > > Sent: Mon Sep 19 2011 11:40:15 GMT-0600 (MST) > From: rek2 <rek2gnulinux(a)gmail.com> <mailto:rek2gnulinux@gmail.com> > To: syslog-ng(a)lists.balabit.hu <mailto:syslog-ng@lists.balabit.hu> > Subject: [syslog-ng] Problem sending logs to central log server.. >> Hello, I'm trying to sent all my logs from one openbsd server >> with syslog-ng to a linux ubuntu central log server also with >> syslog-ng of course but only the syslog-ng logs are been logged.. >> also when I do a "logger test" for example it gets log locally >> but not remotely to the log server... >> here are my configs: >> >> for the log server is basically the defaul of ubuntu with my >> addtions at the end.. you will see >> some commented is me trying to fix this issue. >> >> >> cat syslog-ng/syslog-ng.conf >> # >> # Configuration file for syslog-ng under Debian >> # >> # attempts at reproducing default syslog behavior >> >> # the standard syslog levels are (in descending order of priority): >> # emerg alert crit err warning notice info debug >> # the aliases "error", "panic", and "warn" are deprecated >> # the "none" priority found in the original syslogd configuration is >> # only used in internal messages created by syslogd >> >> >> ###### >> # options >> >> options { >> # disable the chained hostname format in logs >> # (default is enabled) >> chain_hostnames(0); >> >> # the time to wait before a died connection is re-established >> # (default is 60) >> time_reopen(10); >> >> # the time to wait before an idle destination file is closed >> # (default is 60) >> time_reap(360); >> >> # the number of lines buffered before written to file >> # you might want to increase this if your disk isn't >> catching with >> # all the log messages you get or if you want less disk >> activity >> # (say on a laptop) >> # (default is 0) >> #sync(0); >> >> # the number of lines fitting in the output queue >> log_fifo_size(2048); >> >> # enable or disable directory creation for destination files >> create_dirs(yes); >> >> # default owner, group, and permissions for log files >> # (defaults are 0, 0, 0600) >> #owner(root); >> group(adm); >> perm(0640); >> >> # default owner, group, and permissions for created >> directories >> # (defaults are 0, 0, 0700) >> #dir_owner(root); >> #dir_group(root); >> dir_perm(0755); >> >> # enable or disable DNS usage >> # syslog-ng blocks on DNS queries, so enabling DNS may >> lead to >> # a Denial of Service attack >> # (default is yes) >> use_dns(yes); >> >> # maximum length of message in bytes >> # this is only limited by the program listening on the >> /dev/log Unix >> # socket, glibc can handle arbitrary length log messages, >> but -- for >> # example -- syslogd accepts only 1024 bytes >> # (default is 2048) >> #log_msg_size(2048); >> >> #Disable statistic log messages. >> stats_freq(0); >> >> # Some program send log messages through a private >> implementation. >> # and sometimes that implementation is bad. If this >> happen syslog-ng >> # may recognise the program name as hostname. Whit this >> option >> # we tell the syslog-ng that if a hostname match this >> regexp than that >> # is not a real hostname. >> bad_hostname("^gconfd$"); >> keep_hostname (yes); >> >> }; >> >> >> ###### >> # sources >> >> # all known message sources >> source s_all { >> # message generated by Syslog-NG >> internal(); >> # standard Linux log source (this is the default place >> for the syslog() >> # function to send logs to) >> unix-stream("/dev/log"); >> # messages from the kernel >> file("/proc/kmsg" log_prefix("kernel: ")); >> # use the following line if you want to receive remote >> UDP logging messages >> # (this is equivalent to the "-r" syslogd flag) >> # udp(); >> }; >> >> >> ###### >> # destinations >> >> # some standard log files >> destination df_auth { file("/var/log/auth.log"); }; >> destination df_syslog { file("/var/log/syslog"); }; >> destination df_cron { file("/var/log/cron.log"); }; >> destination df_daemon { file("/var/log/daemon.log"); }; >> destination df_kern { file("/var/log/kern.log"); }; >> destination df_lpr { file("/var/log/lpr.log"); }; >> destination df_mail { file("/var/log/mail.log"); }; >> destination df_user { file("/var/log/user.log"); }; >> destination df_uucp { file("/var/log/uucp.log"); }; >> >> # these files are meant for the mail system log files >> # and provide re-usable destinations for {mail,cron,...}.info, >> # {mail,cron,...}.notice, etc. >> destination df_facility_dot_info { >> file("/var/log/$FACILITY.info"); }; >> destination df_facility_dot_notice { >> file("/var/log/$FACILITY.notice"); }; >> destination df_facility_dot_warn { >> file("/var/log/$FACILITY.warn"); }; >> destination df_facility_dot_err { file("/var/log/$FACILITY.err"); }; >> destination df_facility_dot_crit { >> file("/var/log/$FACILITY.crit"); }; >> >> # these files are meant for the news system, and are kept separated >> # because they should be owned by "news" instead of "root" >> destination df_news_dot_notice { file("/var/log/news/news.notice" >> owner("news")); }; >> destination df_news_dot_err { file("/var/log/news/news.err" >> owner("news")); }; >> destination df_news_dot_crit { file("/var/log/news/news.crit" >> owner("news")); }; >> >> # some more classical and useful files found in standard syslog >> configurations >> destination df_debug { file("/var/log/debug"); }; >> destination df_messages { file("/var/log/messages"); }; >> >> # pipes >> # a console to view log messages under X >> destination dp_xconsole { pipe("/dev/xconsole"); }; >> >> # consoles >> # this will send messages to everyone logged in >> destination du_all { usertty("*"); }; >> >> >> ###### >> # filters >> >> # all messages from the auth and authpriv facilities >> filter f_auth { facility(auth, authpriv); }; >> >> # all messages except from the auth and authpriv facilities >> filter f_syslog { not facility(auth, authpriv); }; >> >> # respectively: messages from the cron, daemon, kern, lpr, mail, >> news, user, >> # and uucp facilities >> filter f_cron { facility(cron); }; >> filter f_daemon { facility(daemon); }; >> filter f_kern { facility(kern); }; >> filter f_lpr { facility(lpr); }; >> filter f_mail { facility(mail); }; >> filter f_news { facility(news); }; >> filter f_user { facility(user); }; >> filter f_uucp { facility(uucp); }; >> >> # some filters to select messages of priority greater or equal to >> info, warn, >> # and err >> # (equivalents of syslogd's *.info, *.warn, and *.err) >> filter f_at_least_info { level(info..emerg); }; >> filter f_at_least_notice { level(notice..emerg); }; >> filter f_at_least_warn { level(warn..emerg); }; >> filter f_at_least_err { level(err..emerg); }; >> filter f_at_least_crit { level(crit..emerg); }; >> >> # all messages of priority debug not coming from the auth, >> authpriv, news, and >> # mail facilities >> filter f_debug { level(debug) and not facility(auth, authpriv, >> news, mail); }; >> >> # all messages of info, notice, or warn priority not coming form >> the auth, >> # authpriv, cron, daemon, mail, and news facilities >> filter f_messages { >> level(info,notice,warn) >> and not facility(auth,authpriv,cron,daemon,mail,news); >> }; >> >> # messages with priority emerg >> filter f_emerg { level(emerg); }; >> >> # complex filter for messages usually sent to the xconsole >> filter f_xconsole { >> facility(daemon,mail) >> or level(debug,info,notice,warn) >> or (facility(news) >> and level(crit,err,notice)); >> }; >> >> >> ###### >> # logs >> # order matters if you use "flags(final);" to mark the end of >> processing in a >> # "log" statement >> >> # these rules provide the same behavior as the commented original >> syslogd rules >> >> # auth,authpriv.* /var/log/auth.log >> log { >> source(s_all); >> filter(f_auth); >> destination(df_auth); >> }; >> >> # *.*;auth,authpriv.none -/var/log/syslog >> log { >> source(s_all); >> filter(f_syslog); >> destination(df_syslog); >> }; >> >> # this is commented out in the default syslog.conf >> # cron.* /var/log/cron.log >> #log { >> # source(s_all); >> # filter(f_cron); >> # destination(df_cron); >> #}; >> >> # daemon.* -/var/log/daemon.log >> log { >> source(s_all); >> filter(f_daemon); >> destination(df_daemon); >> }; >> >> # kern.* -/var/log/kern.log >> log { >> source(s_all); >> filter(f_kern); >> destination(df_kern); >> }; >> >> # lpr.* -/var/log/lpr.log >> log { >> source(s_all); >> filter(f_lpr); >> destination(df_lpr); >> }; >> >> # mail.* -/var/log/mail.log >> log { >> source(s_all); >> filter(f_mail); >> destination(df_mail); >> }; >> >> # user.* -/var/log/user.log >> log { >> source(s_all); >> filter(f_user); >> destination(df_user); >> }; >> >> # uucp.* /var/log/uucp.log >> log { >> source(s_all); >> filter(f_uucp); >> destination(df_uucp); >> }; >> >> # mail.info <http://mail.info> >> -/var/log/mail.info <http://mail.info> >> log { >> source(s_all); >> filter(f_mail); >> filter(f_at_least_info); >> destination(df_facility_dot_info); >> }; >> >> # mail.warn -/var/log/mail.warn >> log { >> source(s_all); >> filter(f_mail); >> filter(f_at_least_warn); >> destination(df_facility_dot_warn); >> }; >> >> # mail.err /var/log/mail.err >> log { >> source(s_all); >> filter(f_mail); >> filter(f_at_least_err); >> destination(df_facility_dot_err); >> }; >> >> # news.crit /var/log/news/news.crit >> log { >> source(s_all); >> filter(f_news); >> filter(f_at_least_crit); >> destination(df_news_dot_crit); >> }; >> >> # news.err /var/log/news/news.err >> log { >> source(s_all); >> filter(f_news); >> filter(f_at_least_err); >> destination(df_news_dot_err); >> }; >> >> # news.notice /var/log/news/news.notice >> log { >> source(s_all); >> filter(f_news); >> filter(f_at_least_notice); >> destination(df_news_dot_notice); >> }; >> >> >> # *.=debug;\ >> # auth,authpriv.none;\ >> # news.none;mail.none -/var/log/debug >> log { >> source(s_all); >> filter(f_debug); >> destination(df_debug); >> }; >> >> >> # *.=info;*.=notice;*.=warn;\ >> # auth,authpriv.none;\ >> # cron,daemon.none;\ >> # mail,news.none -/var/log/messages >> log { >> source(s_all); >> filter(f_messages); >> destination(d_eventdb); >> }; >> >> # *.emerg * >> log { >> source(s_all); >> filter(f_emerg); >> destination(du_all); >> }; >> >> >> # daemon.*;mail.*;\ >> # news.crit;news.err;news.notice;\ >> # *.=debug;*.=info;\ >> # *.=notice;*.=warn |/dev/xconsole >> log { >> source(s_all); >> filter(f_xconsole); >> destination(dp_xconsole); >> }; >> #syslog-ng2mysql destinations >> >> source src_eventdb { >> unix-stream("/dev/log"); >> udp(ip(0.0.0.0) port(514)); >> }; >> >> destination d_eventdb { >> pipe( >> "/usr/local/icinga/var/rw/syslog-ng.pipe", >> >> template("$HOST\t$SOURCEIP\t$PRI\t$YEAR-$MONTH-$DAY\t$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n") >> template_escape(no) >> ); >> }; >> >> filter f_at_least_warn { >> # level(warn..emerg); >> level(notice..emerg); >> }; >> >> log { >> # source(src_eventdb); >> filter(f_at_least_warn); >> # filter(f_syslog); >> destination(d_eventdb); >> }; >> >> #log { >> # source(src_eventdb); >> # filter(f_auth); >> # destination(d_eventdb); >> #}; >> >> >> >> HERE FOR THE BSD/CLIENT SIDE: same here is the default with >> openbsd syslog-ng install >> with my additions at the end. >> >> cat /etc/syslog-ng.conf >> # >> # Syslog-ng example configuration for for Debian GNU/Linux >> # >> # Copyright (c) 1999 anonymous >> # Copyright (c) 1999 Balazs Scheidler >> # $Id: syslog-ng.conf.sample,v 1.3 2003/05/20 08:57:27 asd Exp $ >> # >> # Syslog-ng configuration file, compatible with default Debian >> syslogd >> # installation. >> # >> >> options { long_hostnames(off); sync(0); keep_hostname(yes); >> use_dns(yes); stats (3600); }; >> >> #source src { unix-stream("/dev/log"); internal(); }; >> source src { unix-dgram("/dev/log"); internal(); }; >> source net { udp(); }; >> >> destination authlog { file("/var/log/auth.log"); }; >> destination syslog { file("/var/log/syslog"); }; >> destination cron { file("/var/log/cron.log"); }; >> destination daemon { file("/var/log/daemon.log"); }; >> destination kern { file("/var/log/kern.log"); }; >> destination lpr { file("/var/log/lpr.log"); }; >> destination user { file("/var/log/user.log"); }; >> destination uucp { file("/var/log/uucp.log"); }; >> destination ppp { file("/var/log/ppp.log"); }; >> destination mail { file("/var/log/mail.log"); }; >> >> destination mailinfo { file("/var/log/mail.info >> <http://mail.info>"); }; >> destination mailwarn { file("/var/log/mail.warn"); }; >> destination mailerr { file("/var/log/mail.err"); }; >> >> destination newscrit { file("/var/log/news/news.crit"); }; >> destination newserr { file("/var/log/news/news.err"); }; >> destination newsnotice { file("/var/log/news/news.notice"); }; >> >> destination debug { file("/var/log/debug"); }; >> destination messages { file("/var/log/messages"); }; >> destination console { usertty("root"); }; >> destination console_all { file("/dev/tty12"); }; >> #destination loghost { udp("loghost" port(999)); }; >> >> >> destination xconsole { pipe("/dev/xconsole"); }; >> >> >> #ssh filter >> filter f_sshderr { match('^sshd\[[0-9]+\]: error:'); }; >> filter f_sshd { match('^sshd\[[0-9]+\]:'); }; >> # >> filter f_auth { facility(auth); }; >> filter f_authpriv { facility(auth, authpriv); }; >> filter f_syslog { not facility(authpriv, mail); }; >> filter f_cron { facility(cron); }; >> filter f_daemon { facility(daemon); }; >> filter f_kern { facility(kern); }; >> filter f_lpr { facility(lpr); }; >> filter f_mail { facility(mail); }; >> filter f_user { facility(user); }; >> filter f_uucp { facility(cron); }; >> filter f_ppp { facility(local2); }; >> filter f_news { facility(news); }; >> filter f_debug { not facility(auth, authpriv, news, mail); }; >> filter f_messages { level(info..warn) >> and not facility(auth, authpriv, mail, news); }; >> filter f_emergency { level(emerg); }; >> >> filter f_info { level(info); }; >> filter f_notice { level(notice); }; >> filter f_warn { level(warn); }; >> filter f_crit { level(crit); }; >> filter f_err { level(err); }; >> >> log { source(src); filter(f_authpriv); destination(authlog); }; >> log { source(src); filter(f_syslog); destination(syslog); }; >> log { source(src); filter(f_cron); destination(cron); }; >> log { source(src); filter(f_daemon); destination(daemon); }; >> log { source(src); filter(f_kern); destination(kern); }; >> log { source(src); filter(f_lpr); destination(lpr); }; >> log { source(src); filter(f_mail); destination(mail); }; >> log { source(src); filter(f_user); destination(user); }; >> log { source(src); filter(f_uucp); destination(uucp); }; >> log { source(src); filter(f_mail); filter(f_info); >> destination(mailinfo); }; >> log { source(src); filter(f_mail); filter(f_warn); >> destination(mailwarn); }; >> log { source(src); filter(f_mail); filter(f_err); >> destination(mailerr); }; >> log { source(src); filter(f_news); filter(f_crit); >> destination(newscrit); }; >> log { source(src); filter(f_news); filter(f_err); >> destination(newserr); }; >> log { source(src); filter(f_news); filter(f_notice); >> destination(newsnotice); }; >> log { source(src); filter(f_debug); destination(debug); }; >> log { source(src); filter(f_messages); destination(messages); }; >> log { source(src); filter(f_emergency); destination(console); }; >> log { source(src); filter(f_ppp); destination(ppp); }; >> log { source(src); destination(console_all); }; >> >> #sent to our central log server running eventdb >> destination loghost { udp("192.168.xxx.xxx" port(514)); }; >> log { source(src); filter(f_info); destination(loghost); }; >> log { source(src); filter(f_syslog); destination(loghost); }; >> log { source(src); filter(f_authpriv); destination(loghost); }; >> log { source(src); filter(f_user); destination(loghost); }; >> log { source(src); filter(f_emergency); destination(loghost); }; >> log { source(src); filter(f_sshd); destination(loghost); }; >> log { source(src); filter(f_sshderr); destination(loghost); }; >> log { source(src); filter(f_kern); destination(loghost); }; >> >> >> ______________________________________________________________________________ >> Member info:https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation:http://www.balabit.com/support/documentation/?product=syslog-… >> FAQ:http://www.balabit.com/wiki/syslog-ng-faq >> >

1 0

Problem sending logs to central log server..
by rek2 19 Sep '11

19 Sep '11

Hello, I'm trying to sent all my logs from one openbsd server with syslog-ng to a linux ubuntu central log server also with syslog-ng of course but only the syslog-ng logs are been logged.. also when I do a "logger test" for example it gets log locally but not remotely to the log server... here are my configs: for the log server is basically the defaul of ubuntu with my addtions at the end.. you will see some commented is me trying to fix this issue. cat syslog-ng/syslog-ng.conf # # Configuration file for syslog-ng under Debian # # attempts at reproducing default syslog behavior # the standard syslog levels are (in descending order of priority): # emerg alert crit err warning notice info debug # the aliases "error", "panic", and "warn" are deprecated # the "none" priority found in the original syslogd configuration is # only used in internal messages created by syslogd ###### # options options { # disable the chained hostname format in logs # (default is enabled) chain_hostnames(0); # the time to wait before a died connection is re-established # (default is 60) time_reopen(10); # the time to wait before an idle destination file is closed # (default is 60) time_reap(360); # the number of lines buffered before written to file # you might want to increase this if your disk isn't catching with # all the log messages you get or if you want less disk activity # (say on a laptop) # (default is 0) #sync(0); # the number of lines fitting in the output queue log_fifo_size(2048); # enable or disable directory creation for destination files create_dirs(yes); # default owner, group, and permissions for log files # (defaults are 0, 0, 0600) #owner(root); group(adm); perm(0640); # default owner, group, and permissions for created directories # (defaults are 0, 0, 0700) #dir_owner(root); #dir_group(root); dir_perm(0755); # enable or disable DNS usage # syslog-ng blocks on DNS queries, so enabling DNS may lead to # a Denial of Service attack # (default is yes) use_dns(yes); # maximum length of message in bytes # this is only limited by the program listening on the /dev/log Unix # socket, glibc can handle arbitrary length log messages, but -- for # example -- syslogd accepts only 1024 bytes # (default is 2048) #log_msg_size(2048); #Disable statistic log messages. stats_freq(0); # Some program send log messages through a private implementation. # and sometimes that implementation is bad. If this happen syslog-ng # may recognise the program name as hostname. Whit this option # we tell the syslog-ng that if a hostname match this regexp than that # is not a real hostname. bad_hostname("^gconfd$"); keep_hostname (yes); }; ###### # sources # all known message sources source s_all { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); # use the following line if you want to receive remote UDP logging messages # (this is equivalent to the "-r" syslogd flag) # udp(); }; ###### # destinations # some standard log files destination df_auth { file("/var/log/auth.log"); }; destination df_syslog { file("/var/log/syslog"); }; destination df_cron { file("/var/log/cron.log"); }; destination df_daemon { file("/var/log/daemon.log"); }; destination df_kern { file("/var/log/kern.log"); }; destination df_lpr { file("/var/log/lpr.log"); }; destination df_mail { file("/var/log/mail.log"); }; destination df_user { file("/var/log/user.log"); }; destination df_uucp { file("/var/log/uucp.log"); }; # these files are meant for the mail system log files # and provide re-usable destinations for {mail,cron,...}.info, # {mail,cron,...}.notice, etc. destination df_facility_dot_info { file("/var/log/$FACILITY.info"); }; destination df_facility_dot_notice { file("/var/log/$FACILITY.notice"); }; destination df_facility_dot_warn { file("/var/log/$FACILITY.warn"); }; destination df_facility_dot_err { file("/var/log/$FACILITY.err"); }; destination df_facility_dot_crit { file("/var/log/$FACILITY.crit"); }; # these files are meant for the news system, and are kept separated # because they should be owned by "news" instead of "root" destination df_news_dot_notice { file("/var/log/news/news.notice" owner("news")); }; destination df_news_dot_err { file("/var/log/news/news.err" owner("news")); }; destination df_news_dot_crit { file("/var/log/news/news.crit" owner("news")); }; # some more classical and useful files found in standard syslog configurations destination df_debug { file("/var/log/debug"); }; destination df_messages { file("/var/log/messages"); }; # pipes # a console to view log messages under X destination dp_xconsole { pipe("/dev/xconsole"); }; # consoles # this will send messages to everyone logged in destination du_all { usertty("*"); }; ###### # filters # all messages from the auth and authpriv facilities filter f_auth { facility(auth, authpriv); }; # all messages except from the auth and authpriv facilities filter f_syslog { not facility(auth, authpriv); }; # respectively: messages from the cron, daemon, kern, lpr, mail, news, user, # and uucp facilities filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; # some filters to select messages of priority greater or equal to info, warn, # and err # (equivalents of syslogd's *.info, *.warn, and *.err) filter f_at_least_info { level(info..emerg); }; filter f_at_least_notice { level(notice..emerg); }; filter f_at_least_warn { level(warn..emerg); }; filter f_at_least_err { level(err..emerg); }; filter f_at_least_crit { level(crit..emerg); }; # all messages of priority debug not coming from the auth, authpriv, news, and # mail facilities filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; # all messages of info, notice, or warn priority not coming form the auth, # authpriv, cron, daemon, mail, and news facilities filter f_messages { level(info,notice,warn) and not facility(auth,authpriv,cron,daemon,mail,news); }; # messages with priority emerg filter f_emerg { level(emerg); }; # complex filter for messages usually sent to the xconsole filter f_xconsole { facility(daemon,mail) or level(debug,info,notice,warn) or (facility(news) and level(crit,err,notice)); }; ###### # logs # order matters if you use "flags(final);" to mark the end of processing in a # "log" statement # these rules provide the same behavior as the commented original syslogd rules # auth,authpriv.* /var/log/auth.log log { source(s_all); filter(f_auth); destination(df_auth); }; # *.*;auth,authpriv.none -/var/log/syslog log { source(s_all); filter(f_syslog); destination(df_syslog); }; # this is commented out in the default syslog.conf # cron.* /var/log/cron.log #log { # source(s_all); # filter(f_cron); # destination(df_cron); #}; # daemon.* -/var/log/daemon.log log { source(s_all); filter(f_daemon); destination(df_daemon); }; # kern.* -/var/log/kern.log log { source(s_all); filter(f_kern); destination(df_kern); }; # lpr.* -/var/log/lpr.log log { source(s_all); filter(f_lpr); destination(df_lpr); }; # mail.* -/var/log/mail.log log { source(s_all); filter(f_mail); destination(df_mail); }; # user.* -/var/log/user.log log { source(s_all); filter(f_user); destination(df_user); }; # uucp.* /var/log/uucp.log log { source(s_all); filter(f_uucp); destination(df_uucp); }; # mail.info -/var/log/mail.info log { source(s_all); filter(f_mail); filter(f_at_least_info); destination(df_facility_dot_info); }; # mail.warn -/var/log/mail.warn log { source(s_all); filter(f_mail); filter(f_at_least_warn); destination(df_facility_dot_warn); }; # mail.err /var/log/mail.err log { source(s_all); filter(f_mail); filter(f_at_least_err); destination(df_facility_dot_err); }; # news.crit /var/log/news/news.crit log { source(s_all); filter(f_news); filter(f_at_least_crit); destination(df_news_dot_crit); }; # news.err /var/log/news/news.err log { source(s_all); filter(f_news); filter(f_at_least_err); destination(df_news_dot_err); }; # news.notice /var/log/news/news.notice log { source(s_all); filter(f_news); filter(f_at_least_notice); destination(df_news_dot_notice); }; # *.=debug;\ # auth,authpriv.none;\ # news.none;mail.none -/var/log/debug log { source(s_all); filter(f_debug); destination(df_debug); }; # *.=info;*.=notice;*.=warn;\ # auth,authpriv.none;\ # cron,daemon.none;\ # mail,news.none -/var/log/messages log { source(s_all); filter(f_messages); destination(d_eventdb); }; # *.emerg * log { source(s_all); filter(f_emerg); destination(du_all); }; # daemon.*;mail.*;\ # news.crit;news.err;news.notice;\ # *.=debug;*.=info;\ # *.=notice;*.=warn |/dev/xconsole log { source(s_all); filter(f_xconsole); destination(dp_xconsole); }; #syslog-ng2mysql destinations source src_eventdb { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); }; destination d_eventdb { pipe( "/usr/local/icinga/var/rw/syslog-ng.pipe", template("$HOST\t$SOURCEIP\t$PRI\t$YEAR-$MONTH-$DAY\t$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n") template_escape(no) ); }; filter f_at_least_warn { # level(warn..emerg); level(notice..emerg); }; log { # source(src_eventdb); filter(f_at_least_warn); # filter(f_syslog); destination(d_eventdb); }; #log { # source(src_eventdb); # filter(f_auth); # destination(d_eventdb); #}; HERE FOR THE BSD/CLIENT SIDE: same here is the default with openbsd syslog-ng install with my additions at the end. cat /etc/syslog-ng.conf # # Syslog-ng example configuration for for Debian GNU/Linux # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.3 2003/05/20 08:57:27 asd Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # options { long_hostnames(off); sync(0); keep_hostname(yes); use_dns(yes); stats (3600); }; #source src { unix-stream("/dev/log"); internal(); }; source src { unix-dgram("/dev/log"); internal(); }; source net { udp(); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination ppp { file("/var/log/ppp.log"); }; destination mail { file("/var/log/mail.log"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; #destination loghost { udp("loghost" port(999)); }; destination xconsole { pipe("/dev/xconsole"); }; #ssh filter filter f_sshderr { match('^sshd\[[0-9]+\]: error:'); }; filter f_sshd { match('^sshd\[[0-9]+\]:'); }; # filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_ppp { facility(local2); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(f_ppp); destination(ppp); }; log { source(src); destination(console_all); }; #sent to our central log server running eventdb destination loghost { udp("192.168.xxx.xxx" port(514)); }; log { source(src); filter(f_info); destination(loghost); }; log { source(src); filter(f_syslog); destination(loghost); }; log { source(src); filter(f_authpriv); destination(loghost); }; log { source(src); filter(f_user); destination(loghost); }; log { source(src); filter(f_emergency); destination(loghost); }; log { source(src); filter(f_sshd); destination(loghost); }; log { source(src); filter(f_sshderr); destination(loghost); }; log { source(src); filter(f_kern); destination(loghost); };

2 1

Number of syslogs received by syslog-ng
by Jay 15 Sep '11

15 Sep '11

Hello Is there a mechanism to query the syslog-ng at regular intervals to find the number of syslogs received by it from the time it was started or number of syslogs received in the last one hour ? If it is possible to configure syslog-ng to send this information automatically at regular intervals that would help. Thank you.

2 1

Logs for patterns, patterns for logs
by Peter Czanik 15 Sep '11

15 Sep '11

Hello, I'd like to pick one topic from last weeks syslog-ng newsletter: " Logs for patterns, patterns for logs ------------------------------------ We also would like to extend our UNIX/Linux patterns. Creating logs in a "lab" environment just for pattern creation is very time consuming. It would be very helpful for us, if you could send logs in exchange for patterns. Just make sure, that there is no sensitive data left in the logs, as the result will be published to make it available for the whole syslog-ng community. I published a blog ( http://czanik.blogs.balabit.com/2010/11/log-sample-collecting-project/ ), how I collect logs for pattern creation, but of course, any logs are welcome! " Currently I'd like to extend our coverage of login/logout events, but any other logs are welcome. We already have many ftp services covered, but only the ancient uw-imap is covered from e-mail (as that's what I used in the past 15+ years :) ). If you could send logs, I'd be very happy to turn them into patterns. Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

[PATCH 0/2] More packaging tweaks
by Gergely Nagy 10 Sep '11

10 Sep '11

Two patches will follow, one to disable the "Compile Date" in syslog-ng --version's output, and another to force the tar format used for make dist to ustar. The latter is due to the included libmongo-client library having some long filenames, which hit the 99 char limit when distributed with syslog-ng. Increasing the limit to 255 bytes makes the problem disappear.

4 5

tcp source configuration
by drkmkzs 09 Sep '11

09 Sep '11

Hello, I'm trying to configure my syslog serveur to receive syslog message from a rsyslog client. I used something like that : *source myRemote { tcp(ip(172.25.5.1) port (69000)); }* * * Indeed, all works fine except the fact that the port i specify is never used, and it seems that a random port is chosen instead ( at least, it a tcp port ).* * Each time I change the port in configuration, another port is chosen. I checked in netstat that the port I specify is not already used, so it's another problem. Can somebody help me ? Thanks a lot :)

2 2

syslog-ng Insider - September 2011
by Peter Czanik 08 Sep '11

08 Sep '11

Dear syslog-ng users, This is the 6th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> POLL Please take a minute to answer three syslog-ng performance related questions at https://www.surveymonkey.com/s/6ZQDVH6 FEATURED NEWS Please test 3.3 git! -------------------- Version 3.3 release is just around the corner. There were many smaller fixes since the last beta release, so please check out the latest source code from git and help us to make sure the release is free from known problems! Your feedback is very valuable, especially if you could test it in real world situations with logs and configurations we could never imagine ourselves. As threading is a major new feature, which is not enabled by default, please try it by adding “threaded(yes)” to your options in syslog-ng.conf You can download it by “git clone git://git.balabit.hu/bazsi/syslog-ng-3.3” or browse sources online at http://git.balabit.hu/?p=bazsi/syslog-ng-3.3.git;a=summary Documentation is also available: http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guid… Binary packages from latest git are available: * openSUSE: http://download.opensuse.org/repositories/home:/czanik:/syslog-ng33/ * Debian: https://lists.balabit.hu/pipermail/syslog-ng/2011-August/017126.html Logs for patterns, patterns for logs ------------------------------------ We also would like to extend our UNIX/Linux patterns. Creating logs in a "lab" environment just for pattern creation is very time consuming. It would be very helpful for us, if you could send logs in exchange for patterns. Just make sure, that there is no sensitive data left in the logs, as the result will be published to make it available for the whole syslog-ng community. I published a blog ( http://czanik.blogs.balabit.com/2010/11/log-sample- <http://czanik.blogs.balabit.com/2010/11/log-sample-collecting-project/>collecting-project/ <http://czanik.blogs.balabit.com/2010/11/log-sample-collecting-project/> ), how I collect logs for pattern creation, but of course, any logs are welcome! Syslog clients for Windows -------------------------- Central logging using syslog is long part of the UNIX / Linux infrastructure. But if someone also happens to have Windows machines, it is still possible to use the proven syslog-ng servers. There are many clients available, both open and closed source, ranging from simple event forwarders to complex logging solutions. Here is a collection of them: http://czanik.blogs.balabit.com/2011/09/syslog-clients-for-windows/ OTHER SHORT NEWS * Octopussy now supports syslog-ng: http://czanik.blogs.balabit.com/2011/08/octopussy/ * We published some patterns for Windows Server 2008 (most of these should also work with other releases): http://czanik.blogs.balabit.com/2011/07/patterns-for-windows-server-2008/ WHITE PAPERS Download our latest white paper titled "Logging, the Pillar of Compliance". From this White Paper you can learn: * How can you avoid a breach of compliance, and ensure your business continuity. * What are the key IT security requirements of the most frequently applied standards, such as the ISO 27001, PCI, SOX or COBIT. * How advanced logging technology can contribute to cost-effective compliance and successful accomplishment of audits. It is available at http://www.balabit.com/compliance-and-logging *syslog-ng PE Case Study - DataPath Inc.* DataPath, founded in 1984, is a management-owned, privately held company based in Little Rock, Arkansas, that produces software solutions for administering employee benefit plans. They implemented a SYSLOG-NG AGENT FOR WINDOWS-based logging infrastructure to meet HIPAA and PCI DSS requirements in their Microsoft-based environment. It is available at http://www.balabit.com/support/documentation/PE_DataPath_en.pdf ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

Re: [syslog-ng] syslog-ng own logs
by André Larose 07 Sep '11

07 Sep '11

Thank you for your help Sandor, it is much appreciated. The documentation is there but the information on internal is so small is missed it. However I would like to point the source configuration should be like this: source s_syslogng { internal(); }; Kind regards, >>Hi, >> >>On Fri, Sep 2, 2011 at 3:46 PM, Andr? Larose <andre.larose(a)telus.com> wrote: >> >>> I only ?use syslog-ng to capture logs of my in-house applications but not the usual syslog messages, I leave that to the sysadm team. This means when syslog-ng sends messages about itself I am not be able to see them as they end up in the other syslog, ?I think?. >> >>syslog-ng never sends logs to /dev/log unless configured to do so, but >>uses the internal facility which might missing from your >>configuration. >> >>> I would like to know how I can save to file the logs generated by syslog-ng itself . >> >>using something like this >> >>source s_syslogng { >> source(internal); >>}; >> >>destination d_syslongng { >> file("/var/log/syslog-ng.log"); >>}; >> >>log { >> source(s_syslogng); >> destination(d_syslogng); >>}; >> >>will do the trick. >> >>Regards, >> >>Sandor >>

1 0

patterndb & windows
by Peter Czanik 06 Sep '11

06 Sep '11

Hello, A few weeks ago we posted a collection of patterns for Windows 2k8 (but most of it should work also with other releases). While there were many people downloading it, I received no feedback at all. So I'd like to ask, what are your experiences with it? Where could it be improved? Please leave your comments here or answer me in private (some UNIX admins tend to keep it secret, that they also deal with Windows machines :-) ), so we could make our Windows patterns more useful for you! For those, who missed the original announcement, you can read it at https://czanik.blogs.balabit.com/2011/07/patterns-for-windows-server-2008/ Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

3 4

syslog-ng own logs
by André Larose 06 Sep '11

06 Sep '11

Hello everybody, I have a simple question, I googled it but got sooooooooo many hits and found no answer so far I thought I would ask the experts. I only use syslog-ng to capture logs of my in-house applications but not the usual syslog messages, I leave that to the sysadm team. This means when syslog-ng sends messages about itself I am not be able to see them as they end up in the other syslog, "I think". I would like to know how I can save to file the logs generated by syslog-ng itself . Regards, André Larose Senior Systems Analyst TELUS Solutions en santé | avec l'expertise d'Emergis TELUS Health Solutions | backed by Emergis L'information contenue dans ce message, y compris les fichiers joints, est de nature exclusive et confidentielle, et ne doit être utilisée que par le destinataire. Ce message peut contenir des renseignements réservés, sujets aux dispositions des lois sur la confidentialité. En conservant et en utilisant les renseignements contenus dans ce message, le destinataire autorisé s'engage à protéger l'information qu'il contient contre la perte, la divulgation, le vol ou l'exposition à tout risque, en appliquant des précautions au moins égales à celles qu'il utilise pour la protection de ses propres renseignements personnels. Toute diffusion ou utilisation de l'information contenue dans ce message par une personne autre que son destinataire explicite constitue un acte non autorisé et potentiellement illicite. Si vous avez reçu ce message par erreur, veuillez nous aviser en répondant à l'expéditeur et détruire toutes les copies du message en votre possession. The information contained herein, including any attachments, is proprietary and confidential and is intended for the exclusive use of the addressee. It also may contain privileged information and/or personal information subject to privacy legislation. The authorized addressee of this information, by its retention and use, agrees to protect the information contained herein from loss, disclosure, theft or compromise with at least the same care it employs to protect its own confidential information. Any dissemination or use of this information by a person other than the intended recipient is unauthorized and may be illegal. If you have received this e-mail in error, please notify us immediately by reply e-mail and destroy this message.

2 1

OSX
by Peter Czanik 06 Sep '11

06 Sep '11

Hello, A quick question to anybody using OSX: do you see a demand for using OSX as a syslog client or central log server? Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 1

3.3 memory leaks
by Balazs Scheidler 04 Sep '11

04 Sep '11

Hi, I think I have closed the memory leaks reported on syslog-ng 3.3.0beta2, so hopefully it is now more usable now in production. All fixes pushed to the git tree. I haven't received other issues, and I saw some success reports, so we're gearing towards a final release. I'd appreciate further testing though, but if nothing major shows up, I'm going to prepare 3.3.1 in the next couple of weeks. -- Bazsi

1 0

[PATCH] str-format: Fix month name parsing in BSD timestamps
by Gergely Nagy 04 Sep '11

04 Sep '11

When parsing the month name in scan_month_abbrev(), use memcmp() in all cases to compare only the first three chars. Using strcmp() will always result in us taking the false branch on well-formed timestamps, as it will scan past the 3-char length. Signed-off-by: Gergely Nagy <algernon(a)madhouse-project.org> --- lib/str-format.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/str-format.c b/lib/str-format.c index 6c974ba..9011461 100644 --- a/lib/str-format.c +++ b/lib/str-format.c @@ -200,19 +200,19 @@ scan_month_abbrev(const gchar **buf, gint *left, gint *mon) *mon = 7; break; case 'S': - if (strcmp(*buf, "Sep") == 0) + if (memcmp(*buf, "Sep", 3) == 0) *mon = 8; break; case 'O': - if (strcmp(*buf, "Oct") == 0) + if (memcmp(*buf, "Oct", 3) == 0) *mon = 9; break; case 'N': - if (strcmp(*buf, "Nov") == 0) + if (memcmp(*buf, "Nov",3 ) == 0) *mon = 10; break; case 'D': - if (strcmp(*buf, "Dec") == 0) + if (memcmp(*buf, "Dec", 3) == 0) *mon = 11; break; default: -- 1.7.5.4

2 2