- syslog-ng - lists.balabit.hu

Windows event logs vs syslog format
by Jerry Riedel 15 Oct '10

15 Oct '10

I have the latest syslog-ng on an Opensuse 11.2 acting as a syslog server and it is working well except for one thing - the Windows event logs that are being sent with the Datagram Syslog Agent contain a space that causes issues. Initially, all of these were going into /var/log/messages until I added the keep_hostname(yes) argument. After doing that, it now puts the Windows logs into the appropriate folder under /var/log/hosts/ but it still puts a copy into the /var/log/messages file. I would like to have that log only contain log messages from Opensuse. Is there a configuration setting I am missing, or is this caused by the fact that the syslog agent does not correct the eventlog message so that it adheres to the standard syslog message format? If the latter, does anyone know of an open source/free agent that does this? An example of one of the problematic messages is: Oct 6 11:02:08 cli-fs-1 security[success] 576 NT AUTHORITY\SYSTEM Special privileges assigned to new logon: User Name:CLI-FS-1$ Domain:(obscured) Logon ID:(0x0,0x11331C8) Thanks, Jerry Riedel

4 12

request for smtp/imap/pop3 server log samples
by Peter Czanik 14 Oct '10

14 Oct '10

Hello, As you can see from my last few e-mails, I started to work on patterns for mail related (smtp/imap/pop3) servers. For now I'm only concentrating on login/login failure/logout events. There are many related servers, so it is a lot of work to install/configure/collect logs from them, even from the most important ones. So I'd like to ask for some help here, with an offer, which is beneficial also for you. Here is my offer: - you send me log samples for the following situations from your mail related servers: successful login, logout, invalid password, invalid username) - I create patterns, discuss here when I run into troubles - I push the results into the git tree, so patterns will be available for you and the syslog-ng community - you have patterns you can use immediately with your software (vs. patterns for software I find interesting :-) ) - you see how your log samples turn into patterns If you send the log samples to the list, please make sure, that confidential information is replaced. If you send them directly to me, I can also do it for you, but obviously it's better when sensitive information never leaves your network. Please use the method I showed at http://czanik.blogs.balabit.com/2010/10/pattern-writing-tips-and-tricks/ to collect your logs. If you don't want to read those few paragraphs, here is the most important part, a short syslog-ng.conf snippet: filter f_myprogi { program('pure-ftpd'); }; destination d_myprogi { file('/var/log/myprogi'); }; log { source(src); filter(f_myprogi); destination(d_myprogi); }; As other way messages are scattered among many log files, and difficult to see which messages cover which event. Thanks for your help! Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

uw-imapd patterns
by Peter Czanik 13 Oct '10

13 Oct '10

Hello, Attached you can find UW-imapd samples and patterns. Please test it and let me know, if you have any login/logout related log message left as "Unknown". Known problem: login failures generate the same name value pairs twice. These patterns were created on Ubuntu 10.04 LTS. I'd be very interested to know, if using them on other distributions or UNIX variants makes a difference. -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

ip vs hostname
by Peter Czanik 13 Oct '10

13 Oct '10

Hello, We have a single entry in the SCHEMAS to store login/logout sources: usracct.device. Often only IP address appears in the logs, but sometimes both hostname and IP address. I tend to use IP address in this case, as that's something stable network wide, while a hostname could have only local relevance (/etc/hosts or a local DNS server). What do you think? Is IP enough, or we should also find a way to store hostnames? Is there any situation, when hostnames matter? Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

proftpd, blog
by Peter Czanik 12 Oct '10

12 Oct '10

Hello, Attached is a pre version of proftpd login/logout/failure events and the samples I used. As usual, new application, new problems. The first problem is, that out of box proftpd uses its own log files instead of syslog. This poses a couple of problems: * it resembles syslog logs, but looking closer it is not * it does not have all the logs So for collecting logs I commented out the SystemLog line, so syslog is used, and also enabled anonymous ftp. I could not find a perfect message suitable for 'logout'. There are two related lines: proftpd[6848]: ubuntu (::ffff:192.168.2.179[::ffff:192.168.2.179]) - FTP session closed. But this is used any time a TCP/IP connection is closed, even when there was no actual login. And even if there was a login, it has no user information... proftpd: pam_unix(proftpd:session): session closed for user czanik This one has the user name, but no information at all about the session or IP address. What do you think? Could any of these be useful for creating name - value pairs? Also: if I discard some messages, like opening/closing a session, is it enough if I handle it with one rule (omitting checking the end of message) or it should be handled with two separate messages? And finally some self marketing, hoping that it might be useful some someone: please check my blog (URL in my signature), I have already have two blog posts about pattern writing. Please comment on them here on the mailing list, as if you find something problematic, it should be discussed, and without an additional blog comment login... Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 4

[Bug 52] CAP_DAC_OVERRIDE is missing when capabilities are enabled, unable to write to files created with the owner() option.
by bugzilla＠bugzilla.balabit.com 11 Oct '10

11 Oct '10

https://bugzilla.balabit.com/show_bug.cgi?id=52 Zbigniew Krzystolik <zbyniu(a)pld-linux.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |zbyniu(a)pld-linux.org --- Comment #2 from Zbigniew Krzystolik <zbyniu(a)pld-linux.org> 2010-10-11 15:03:30 --- > CAP_DAC_OVERRIDE is missing and necessary to open files not owned by root. Yes, to open for writing/appending. I created patch fixing such problems. - missing CAP_DAC_OVERRIDE, now owner(), group(), perms() works even if no DAC access is granted - create_dirs works also for dirs with none permissions - dir_owner(), dir_group(), dir_perms() are set as expected (added CAP_CHOWN, CAP_FOWNER) All changes tested, also reloads with -HUP. Now you can run syslog-ng as common user not root and all should work properly! :-) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 52] CAP_DAC_OVERRIDE is missing when capabilities are enabled, unable to write to files created with the owner() option.
by bugzilla＠bugzilla.balabit.com 11 Oct '10

11 Oct '10

https://bugzilla.balabit.com/show_bug.cgi?id=52 --- Comment #1 from Zbigniew Krzystolik <zbyniu(a)pld-linux.org> 2010-10-11 15:01:25 --- Created an attachment (id=24) --> (https://bugzilla.balabit.com/attachment.cgi?id=24) fixes for settings like owner(), group(), perm() and analogous dir_* -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

syslog-ng OSE 3.2 administrator guide draft
by Fekete Robert 08 Oct '10

08 Oct '10

Hi, For a couple of days now I have been working on the administrator guide for the upcoming syslog-ng Open Source Edition 3.2. So far, mostly I have taken the original 3.1 guide apart, and restructured it so that - hopefully - it is easier to use and find relevant information. The structure of the guide is now feature-based, after a brief theoretical introduction about how syslog-ng works and a not-yet-finished quickstart part the chapters focus on the different features, and all information related to a feature is available in the chapter - concepts, configuration, and options reference. Some of the new features of 3.2 are already documented, for example, global variables, the pacct() and system() drivers, and using code blocks. Of course, there are many things to do: the configuration syntax sections are under construction and need cleanup, SCLs and modules should be documented (though some of that will probably go to a developer doc or wiki), and some new features (correlation, patternize, an update on the patterndb project, ...) are missing as well. It is still an early draft, but if you have some time, please take a look and comment on the new structure - any feedback is welcome. The draft is available at http://people.balabit.hu/frobert/syslog-ng-ose-v3.2-guide-admin-en-draft.pdf Regards, Robert

1 0

login
by Peter Czanik 07 Oct '10

07 Oct '10

Hello, Attached is my list of sample log lines for console and telnet logins. I checked it with the login.pdb from http://git.balabit.hu/?p=bazsi/syslog-ng-patterndb.git;a=blob;f=access/logi… and ran into some troubles. ( pdbtool match -p login.pdb -f ~/login.samples )The generic problem is, that many lines appear as "Unknown". Some more specific problems: - root telnet access failure was not found - root/user logins are not matched - invalid user on console generates multiple name value pairs It seems to me, that telnet and console logins generate mostly similar log lines, but not the same. For "invalid user" we should probably create name value pairs only for the line which appears in both cases: pam_unix(login:auth): authentication failure;[...] Or would we miss failure events if we don't create name value pairs for: FAILED LOGIN (@NUMBER::@) on @QSTRING::'@ FOR 'UNKNOWN', Authentication failure Looking at my log samples, in the accepted login lines the only difference is, that I don't have "LOGIN" before "(uid=0)" in the login related lines. There is either nothing or a user name. Changing it to: @ESTRING::(@uid=0) did me the trick, and 'pdbtools test --validate login.pdb' still ran without errors. Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

FW: Syslog-NG with Mysql DB
by Anisur Rehman(IT) 07 Oct '10

07 Oct '10

From: Anisur Rehman(IT) Sent: Thursday, October 07, 2010 1:20 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: Syslog-NG with Mysql DB Hi, I have configured SyslogNG 3.x with mysql and php syslog ng as frontend. It seems everything fine except web URL is not showing Message part. Can you help in this? I can see in database as below mysql> select count(*) from mylog; +----------+ | count(*) | +----------+ | 82 | +----------+ 1 row in set (0.00 sec) Thanks Anisur Rehman CBS-SAS IT Department Bank Muscat S.A.O.G. P.O. Box 134, Ruwi P.C. 112, Sultanate of Oman GSM. +968-99826412 rehman(a)bankmuscat.com

1 0

wu-ftpd
by Peter Czanik 07 Oct '10

07 Oct '10

Hello, I covered the three major ftpd implementations (proftpd/pureftpd/vuftpd) with login/logout/failure patterns, and as I used wu-ftpd for a long time, I also wanted to create a pattern for that one. No luck, I can't get it running, there are no messages in the logs and strace does not reveal anything :-( So, I'd like to ask, if anybody uses wu-ftpd here? Some logs or even better, patterns, would be very helpful. My latest blogs have some hints, how I collect logs and create rules ( http://czanik.blogs.balabit.com/2010/10/pattern-writing-tips-and-tricks/ and http://czanik.blogs.balabit.com/2010/10/pattern-writing-tips-and-tricks-ii/ ). For ftp I collected logs for the following situations: - anonymous ftp login - root login (actually a failure...) - invalid username - valid user, invalid password - valid user, successful login Anyone could help? Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

error in syslog-ng 3.2alpha2: missing m4 macros directory
by Guillaume Rousse 06 Oct '10

06 Oct '10

Hello. configure.in has this macro: AC_CONFIG_MACRO_DIR([m4]) However, the m4 directory doesn't exist. As a consequence, running 'autoreconf' fails immediatly. I guess it's just missing, as previous release had it. -- BOFH excuse #312: incompatible bit-registration operators

2 1

syslog-ng issue
by anushri kannu 06 Oct '10

06 Oct '10

Hi Every one, I am new to concept of syslog-ng configuration. Already syslog-ng configured in linux server We have 6 syslog-ng server 4 location syslog-ng server receives logs from all the syslog client .. working fine 1 centralized syslog-ng (server receives log from 4 locations ....... working fine 1 we have tcim syslog-ng server receives logs from centralized syslog-ng server... it was working before for both solaris and linux . Now suddenly not collecting logs only for linux. No changes were made. Centalized syslog-ng configuration file options { log_fifo_size(8192); create_dirs(yes); group(sysgrp); dir_group(sysgrp); dir_perm(0750); perm(0440); chain_hostnames(no); keep_hostname(yes); stats(3600); use_fqdn(yes); use_time_recvd(yes); }; Standard filters # Level Filters filter f_emerg { level (emerg); }; filter f_alert { level (alert .. emerg); }; filter f_crit { level (crit .. emerg); }; filter f_err { level (err .. emerg); }; filter f_warning { level (warning .. emerg); }; filter f_notice { level (notice .. emerg); }; filter f_info { level (info .. emerg); }; filter f_debug { level (debug .. emerg); }; # Facility Filters filter f_kern { facility (kern); }; filter f_user { facility (user); }; filter f_mail { facility (mail); }; filter f_daemon { facility (daemon); }; filter f_auth { facility (auth); }; filter f_authpriv { facility (authpriv); }; filter f_syslog { facility (syslog); }; filter f_lpr { facility (lpr); }; filter f_news { facility (news); }; filter f_uucp { facility (uucp); }; filter f_os_unix { not program(EvntSLog) and not program(NetScreen) and not match ("NetScreen device_id") and not match ("%AAA-") and not match ("%AUTH-") and not match ("%AUTHPRIV-") and not match ("%CALLHOME-") and not match ("%CDP-") and not match ("%EARL-") and not match ("%FILESYS-") and not match ("%IMAGE_DNLD-SLOT") and not match ("%IP-") and not match ("%KERN-") and not match ("%LICMGR-") and not match ("%LINEPROTO-") and not match ("%LINK-") and not match ("%MCAST-") and not match ("%MODULE-") and not match ("%OSPF-") and not match ("%PLATFORM-") and not match ("%PRUNING-") and not match ("%PORT-") and not match ("%SPANTREE-") and not match ("%SYS-") and not match ("%UDLD-") and not match ("%VSHD-") source s_local { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(5149) max-connections(333)); internal(); pipe("/proc/kmsg"); }; destination dl_hosts-unix { file("/var/log/syslog-ng/hosts-unix/$HOST/$YEAR/$MONTH/$DAY/$FACILITY.$LEVEL"); }; log { source(s_local); filter(f_os_unix); ###not filter(f_os_switch); destination(dl_hosts-unix); }; destination dl_tcim { udp("10.230.148.18" port(514) template("<$PRI> $DATE $HOST $MESSAGE\r\n")); }; log { source(s_local); destination(dl_tcim); }; tcim server configurarion file. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); # use_dns (no); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source src { udp(); tcp(port(514) keep-alive(yes)); filter f_lnx_hosts { host("amex") or host("green") or host("sa") or host("yellow") or host("urinf01") or etc..; .. .. . }; destination d_lnx { file("/var/log/tcim/$HOST/syslog-$YEAR-$MONTH-$DAY.log" template("<$PRI>$DATE $HOST $MSG\n") create_dirs(yes) owner(svc-tcim) group(users) perm(0660) dir_owner(svc-tcim) dir_group(users) dir_perm(0770) ); }; log { source(src); filter(f_lnx_hosts); destination(d_lnx); }; I did try below command in TCIM server to check the comunication between centralized syslog-ng serer and tcim server tcpdump -nn -tp -port 514.. IP 10.180.40.83.59535 > 10.230.148.18.514: UDP, length 375 IP 10.180.40.83.59535 > 10.230.148.18.514: UDP, length 193 IP 10.180.40.83.59535 > 10.230.148.18.514: UDP, length 638 IP 10.180.40.83.59535 > 10.230.148.18.514: UDP, length 638 1740 packets captured 1740 packets received by filter 0 packets dropped by kernel Packets are getting from centralised log server. Do not know where the mistake is. Please help to resolve this issue.

2 2

syslog-ng3 host_override() issue and proposed fix.
by Nat Baldwin 05 Oct '10

05 Oct '10

Hi there, While trying to do something fairly specific with syslog-ng3, I ran into an error with an easy fix. I'm running syslog-ng3 3.1.1_1 on FreeBSD, installed from ports with SSL enabled and everything else default. What I was trying to do was to use the host_override() function on a unix-dgram() source. Time and again it was acting like the program_override() function instead; altering the program entry and not the host entry in the log. When I went and looked at the source code, I noticed this in logsource.c: 145 if (self->options->program_override) 146 { 147 if (self->options->program_override_len < 0) 148 self->options->program_override_len = strlen(self->options->program_override); 149 log_msg_set_value(msg, LM_V_PROGRAM, self->options->program_override, self->options->program_override_len); 150 } 151 if (self->options->host_override) 152 { 153 if (self->options->host_override_len < 0) 154 self->options->host_override_len = strlen(self->options->host_override); 155 log_msg_set_value(msg, LM_V_PROGRAM, self->options->host_override, self-> options->host_override_len); 156 } Taking a not-so-wild guess, I changed line 155 to read: log_msg_set_value(msg, LM_V_HOST,self->options->host_override, self-> options->host_override_len); (changing LM_V_PROGRAM to LM_V_HOST) and that fixed my problem. Is this something that can be fixed, or should I be bringing this issue to someone in particular's attention? thanks, -- Nat Baldwin Unix Systems Administrator Network Infrastructure, RSSP-IT UC Berkeley ----- End forwarded message ----- -- Nat Baldwin Unix Systems Administrator Network Infrastructure, RSSP-IT UC Berkeley

2 1

syslog-ng issue collecting logs
by anushri kannu 04 Oct '10

04 Oct '10

Hi Every one... As i am new to this concept,Kindly help on this All the syslog-ng client forward logs to centralized log server-- works fine. centralized log server forward logs to tcim server -- works fine for solaris server and other network device-- >From centralized log server to tcim server -- issue ( not collecting logs for linux servers in tcim server ) Centralized log server forward all the logs to tcim server, In Tcim server 4000 devices are configured to collect logs from centralized log server, However in TCIM sever option for log_fifo_size ( 1000) defined and did not mention any variable as max_conncection. Will this affect logs fails to collect from centralized log to tcim server. Below options defined in tcim server. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); # use_dns (no); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source src { udp(); tcp(port(514) keep-alive(yes)); }; 1. If i increase the max-connection(4000 ). do we need to declare below variable like this...... (User requested me to define the below value. in tcim server.) Since i am new to this, Please advice. if i declare the below variable, will server get hangs. this is very critical server. log_fifo_size=4000000 log_iw_size=1000 max-connection(4000) Thanks in advance.

2 1

patterndb license?
by Balazs Scheidler 01 Oct '10

01 Oct '10

Hi, I was wondering what kind of license should be applied to patterndb patterns. GPL doesn't really apply as it is not software. I was thinking about Creating Commons Attribution-ShareAlike license, which: * allows redistributions of the work with proper attribution * allows changes as long as the changes are available under the same license * allows commercial usage (e.g. free even for commercial entities) Adding the "nc" e.g. non-commercial flag was considered and then dropped. We feel that most people trying to use patterndb would definitely use it in a commercial setting and we wouldn't like to limit our users to academia a private use. What do you think? -- Bazsi

3 2

QSTRING with @
by Peter Czanik 30 Sep '10

30 Sep '10

Hello, I'm trying to create a pattern, and ran into an interesting problem: I can't use @ with QSTRING as beginning character. Example: <patterns> <pattern>(?@QSTRING:usracct.device:@@)@ [INFO] Anonymous user logged in</pattern> </patterns> <examples> <example> <test_message program="pure-ftpd">(?(a)192.168.2.52) [INFO] Anonymous user logged in</test_message> <test_values> <test_value name="usracct.device">192.168.2.52</test_value> </test_values> </example> </examples> But when I test it, pdbtool says: Unknown parser type specified; type=')' Testing message program='pure-ftpd' message='(?(a)192.168.2.52) [INFO] Anonymous user logged in' Wrong match name='.classifier.rule_id', value='', expected='ef75e712-5e9e-4ca0-a614-5e1bf512286b' Wrong match name='usracct.device', value='', expected='192.168.2.52' I changed it to: <pattern>(?@@@ESTRING:usracct.device:)@ [INFO] Anonymous user logged in</pattern> Which works, but I'm still curious, if @ should work as a quotation character. Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 3

pure-ftpd patterns
by Peter Czanik 30 Sep '10

30 Sep '10

Hello, Attached are the pure-ftpd login/logout/failure patterns and the sample file I used. Some notes: - logouts, where username is "?" are not tagged, as these just mark that a TCP/IP connection is teared down - PAM messages are not tagged, as that would create duplicate messages about the same event. The variable part of them is simply discarded with an @ANYSTRING@ - anonymous login/logout events are tagged, username is set to "anonymous" from "ftp" You can check the attached pure-ftpd.pdb with the following command: cat pure-ftpd.samples | grep -v CzP | pdbtool match -p pure-ftpd.pdb -f - CzP lines are comments... Please check it on your own pure-ftpd logs to see, if I missed anything! Thanks! Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 1

anushri kannu wants to chat
by anushri kannu 30 Sep '10

30 Sep '10

----------------------------------------------------------------------- anushri kannu wants to stay in better touch using some of Google's coolest new products. If you already have Gmail or Google Talk, visit: http://mail.google.com/mail/b-959daaa790-1679f27bf6-M3ME9jASBxIBFvbiNyV6reO… You'll need to click this link to be able to chat with anushri kannu. To get Gmail - a free email account from Google with over 2,800 megabytes of storage - and chat with anushri kannu, visit: http://mail.google.com/mail/a-959daaa790-1679f27bf6-M3ME9jASBxIBFvbiNyV6reO… Gmail offers: - Instant messaging right inside Gmail - Powerful spam protection - Built-in search for finding your messages and a helpful way of organizing emails into "conversations" - No pop-up ads or untargeted banners - just text ads and related information that are relevant to the content of your messages All this, and its yours for free. But wait, there's more! By opening a Gmail account, you also get access to Google Talk, Google's instant messaging service: http://www.google.com/talk/ Google Talk offers: - Web-based chat that you can use anywhere, without a download - A contact list that's synchronized with your Gmail account - Free, high quality PC-to-PC voice calls when you download the Google Talk client We're working hard to add new features and make improvements, so we might also ask for your comments and suggestions periodically. We appreciate your help in making our products even better! Thanks, The Google Team To learn more about Gmail and Google Talk, visit: http://mail.google.com/mail/help/about.html http://www.google.com/talk/about.html (If clicking the URLs in this message does not work, copy and paste them into the address bar of your browser).

1 0

pure-ftpd
by Peter Czanik 30 Sep '10

30 Sep '10

Hello, I installed pure-ftpd and generated some logs. Here they are. They bring up many questions what are the best practices in some situations... Anonymous login: Sep 24 13:53:05 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] New connection from 192.168.2.142 Sep 24 13:53:08 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] Anonymous user logged in Sep 24 13:53:11 linux-6y8u pure-ftpd: (ftp(a)192.168.2.142) [INFO] Logout. Successful user login: Sep 24 13:54:15 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] New connection from 192.168.2.142 Sep 24 13:54:19 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] czanik is now logged in Sep 24 13:54:21 linux-6y8u pure-ftpd: (czanik(a)192.168.2.142) [INFO] Logout. Denied root login: Sep 24 13:54:22 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] New connection from 192.168.2.142 Sep 24 13:54:24 linux-6y8u pure-ftpd: pam_listfile(pure-ftpd:auth): Refused user root for service pure-ftpd Sep 24 13:54:27 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [WARNING] Authentication failed for user [root] Sep 24 13:54:30 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] Logout. Wrong user password: Sep 24 13:57:43 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] New connection from 192.168.2.142 Sep 24 13:57:51 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [WARNING] Authentication failed for user [czanik] Sep 24 13:57:52 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] Logout. Invalid user name: Sep 24 13:57:53 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] New connection from 192.168.2.142 Sep 24 13:57:55 linux-6y8u pure-ftpd: gkr-pam: error looking up user information for: asdf Sep 24 13:58:00 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [WARNING] Authentication failed for user [asdf] Sep 24 13:58:03 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] Logout. Questions: - many times there is just a question mark instead of the username. Should it still be stored in a variable (useracct.username) or only for the Logout lines, where it actually might get a useful value? - the "New connection" line has the same info (the IP address) twice. How should it be handled? - how should Anonymous login be handled? @QSTRING:useracct.username: @ vs. <value name="usracct.username">Anonymous</value> -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

3 5

Syslog-ng writes log entries to 2 different logs
by Burton Simonds 29 Sep '10

29 Sep '10

I am using syslog-ng 3.1.2 and I am having a problem that I can not figure out. Our network gear sends messages to syslog-ng, and then it filters them based on device type, and name. There is one firewall, that is matching both the firewalls filter and the switches filter, and is subsequently writing to both locations. in the example below, host 1.2.3.5 is logging to both the switches log dir and the firewalls log dir even though it is only referenced in the firewalls filter. Other then the obvious possibilities, (Yes, I have confirmed that the ip address is only referenced in one filter) does anyone have any ideas on what I should look at? Thanks, Burton our filters look like this (each host filter has several addresses in it): filter f_firewalls { host(1.2.3.4) or host(1.2.3.5); }; filter f_switches {host(9.8.7.6) or host(9.8.7.5); }; destination d_firewalls {file( "/path/to/logs/fw/$YEAR/MONTH/$HOST-$YEAR$MONTH$DAY" create_dirs(yes) owner(log_owner) group(log_group) dir_perm(0775) perm(0664) ); }; destination d_switches {file( "/path/to/logs/sw/$YEAR/MONTH/$HOST-$YEAR$MONTH$DAY" create_dirs(yes) owner(log_owner) group(log_group) dir_perm(0775) perm(0664) ); }; log { source(s_network); filter(f_firewalls); destination(d_firewalls); }; log { source(s_network); filter(f_switches); destination(d_switches); }; Version info: syslog-ng 3.1.2 Installer-Version: 3.1.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca Compile-Date: Aug 3 2010 11:16:08 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: on Enable-Pcre: on

4 4

vsftpd login/login failure events
by Peter Czanik 29 Sep '10

29 Sep '10

Hello, Attached are the vsftpd login/login failure events I found. There was no trace of logout in the logs. Question: what is the correct way dealing with the last rule? It has "vsftpd" twice in it. I checked, and obviously only the last appearance counts. Is it worth to define it twice? linux-6y8u:/local/czanik/tmp/syslog-ng-patterndb/file-service # pdbtool match -D -p vsftpd.pdb -P vsftpd -M "pam_listfile(bla1:auth): Refused user root for service bla2" Pattern matching part: pam_listfile(@STRING:usracct.service=bla1@:auth): Refused user @ESTRING:usracct.username=root@for service @ANYSTRING:usracct.service=bla2@ Matching part: pam_listfile(bla1:auth): Refused user root for service bla2 Values: MESSAGE=pam_listfile(bla1:auth): Refused user root for service bla2 PROGRAM=vsftpd .classifier.class=system .classifier.rule_id=7256a6d6-c720-11df-8a1d-000c298c9ba2 usracct.username=root usracct.service=bla2 usracct.type=login usracct.sessionid= usracct.application=vsftpd secevt.verdict=REJECT Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 2

[Bug 94] New: too many "Configuration file format is too old..." messages
by bugzilla＠bugzilla.balabit.com 29 Sep '10

29 Sep '10

https://bugzilla.balabit.com/show_bug.cgi?id=94 Summary: too many "Configuration file format is too old..." messages Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: czanik(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 When using my regular 3.1 configuration, I get the following message 1000+ times on screen: " WARNING: Configuration file format is too old, please update it to use the 3.2 format as some constructs might operate inefficiently; " It should only be printed once. Changing the first line of configuration to: "@version:3.2" silents the warning messages, and everything works as expected. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

AUTO: James B Horwath/TheGuardian is out of the office. (returning 10/04/2010)
by James B Horwath 29 Sep '10

29 Sep '10

I am out of the office until 10/04/2010. I will be out of the office until October 4th and will not have access to e-mail. If there are urgent logging issues please contact Sunil Gupta at 610-807-6717. Any other issues please contact Christopher Clarke. Thanks, Jim Note: This is an automated response to your message "syslog-ng Digest, Vol 65, Issue 48" sent on 9/29/10 5:34:59. This is the only notification you will receive while this person is away. ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

1 0

one more sshd rule
by Peter Czanik 29 Sep '10

29 Sep '10

Hello, While checking my logs with pdbtool, I ran into this log message: Sep 23 13:10:03 linux-6y8u sshd[21420]: error: PAM: Authentication failure for root from 192.168.2.52 The attached rule seems to find it correctly: HOST=linux-6y8u MESSAGE=error: PAM: Authentication failure for root from 192.168.2.52 PROGRAM=sshd PID=21420 LEGACY_MSGHDR=sshd[21420]: .classifier.class=system .classifier.rule_id=55ec76e0-c709-11df-b62d-000c298c9ba2 usracct.username=root usracct.device=192.168.2.52 usracct.type=login usracct.sessionid=21420 usracct.application=sshd secevt.verdict=REJECT Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 2