- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Upper case $HOST
by Pallagi Zoltán 09 Nov '09

09 Nov '09

Tim Boyer írta: > Pallagi Zoltán wrote: >> Hi, >> >> Tim Boyer írta: > >>> Balazs - >>> >>> Looks like I spoke too soon. Something odd is happening. >>> >>> I put the option into the conf file: >>> >>> @version: 3.0 >>> # >>> # global options >>> # >>> >>> options { >>> normalize_hostnames(yes); >>> use_fqdn(no); >>> use_dns(yes); >>> dns_cache(yes); >>> keep_hostname(yes); >>> long_hostnames(off); >>> create_dirs(yes); >>> } >>> >>> > > <snip> > >> You should not use "keep_hostname" in the part of global options >> because this one will block rewriting of the hostname (see syslog-ng >> admin guide: >> http://www.balabit.hu/dl/html/syslog-ng-v3.0-guide-admin-en.html/ch08s09.ht…) >> > > Pallagi - > > Of course - that makes perfect sense; I'm asking it to do two > contradictory actions. Thanks very much... Anyway, I think this is also a problem so I'v just opened a bugzilla ticket: https://bugzilla.balabit.com/show_bug.cgi?id=60 > >

1 0

Upper case $HOST
by Tim Boyer 09 Nov '09

09 Nov '09

I'm running syslog-ng 3.03 on a RHEL5 system, sending logs to various files like so: # global log files destination deservers { file("/var/log/$HOST.log" owner(root) group(hobbit) perm(0640)); }; It's working fine on the Linux boxes. But I'm using Adiscon's EventLog on my Windows machines, and the $HOST name on them are coming up in all caps. [root@buran log]# ls -la /var/log/*.log ... -rw-r----- 1 root hobbit 282 Nov 4 14:37 /var/log/KANTECH.log -rw-r----- 1 root hobbit 535181 Nov 4 14:24 /var/log/PLCDATA.log Where's this $HOST macro get its data from? The DNS entry is lower case; the full computer name on the Windows box is lower case. I don't see where the upper is coming from, unless it's one of those weird Windows-to-Unix translation things. Not a big deal, but a bit of an annoyance. Thanks for any help. -- Tim Boyer Denman Tire Corporation

5 6

Macro question
by Michael J. Bauer 06 Nov '09

06 Nov '09

I am running syslog-ng 3.0.4 on RHEL 5.4. I have a log message that appears in my logfiles as Oct 28 16:41:22 juniper-router {wan-service-set}[FWNAT]: ASP_NAT_RULE_MATCH: proto 6 (TCP) application: any, ge-0/0/3.2:10.3.13.153:49818 -> 66.249.80.148:80, Match NAT rule-set: , rule: nat-outgoing, term: dynamic-nat There are no carriage returns in that entry; any that appear are artifacts of some mail server or client along the way. I want any log entry containing the string FWNAT to go into a separate file. match(FWNAT) on the filter does just that, but syslog-ng complains that I'm not using value() for efficiency. However, it's not at all clear which macro, if any, actually contains the string FWNAT. I can tell you five that don't: APPLICATION EVENT_SOURCE MESSAGE MSG PROGRAM What macro contains FWNAT? And where can I get a definitive list of macros and specifics on how the value in each is set for each line? The documentation is insufficiently detailed on this subject. Thanks, MJB

3 4

$HOST macro and relay host
by Jason Barrett 06 Nov '09

06 Nov '09

Hi all, I'm relaying log messages from one syslog-ng server to another. At the final stop, the only way I can get the $HOST macro to work is if I enable dns resolution on server 1. Is this by design? Here are the relevant configs: ---------------------------------------------------------------------- syslog-ng server 1 (relays to server 2): chain_hostnames(yes); keep_hostname(yes); use_dns(no); source s_udp { udp(port(514)); }; destination df_udpback { udp("192.168.1.157" port(514)); }; log { source(s_udp); destination(df_udpback); }; ---------------------------------------------------------------------- syslog-ng server 2: chain_hostnames(yes); keep_hostname(yes); use_dns(yes); source s_udp { udp(port(514)); }; destination df_udp { file("/var/log/ics/$HOST/$YEAR/$MONTH/$DAY"); }; log { source(s_udp); destination(df_udp); }; ---------------------------------------------------------------------- Sample log message on server 2: Oct 30 09:35:03 10.12.24.46/10.12.24.46 %ASA-5-111005: 10.28.22.55 end configuration: OK 10.12.24.46 is the correct IP address of the originating host, and $HOST resolves to this IP address. I would prefer $HOST to resolve to the hostname as it exists in the /etc/hosts file. Thanks!

3 6

Re: [syslog-ng] Pharmacy Online Sale 84% OFF!
by VIAGRA Inc. 05 Nov '09

05 Nov '09

New from WebMD: Dear syslog-ng(a)lists.balabit.hu!. Sign-up today! You are subscribed as syslog-ng(a)lists.balabit.hu. View and manage your WebMD newsletter preferences. Subscribe to more newsletters. Change/update your email address. WebMD Privacy Policy WebMD Office of Privacy 1175 Peachtree Street, Suite 2400, Atlanta, GA 30361 © 2009 WebMD, LLC. All rights reserved.

1 0

Match/Message/Macros
by R King 03 Nov '09

03 Nov '09

I have updated Syslog-NG to 3 and am trying to figure out: "WARNING: the match() filter without the use of the value() option is deprecated and hinders performance, please update your configuration;" I have one filter that isn't working and I have tried several different ways to fix it. The logs are Windows DHCP logs passed from EPILOG: Nov 3 11:37:55 snsudc02 DHCPLOG[0]: 11,11/03/09,11:37:54,Renew,172.31.0.213,Ashley-PC.nsu.edu,001B9E2A18E9, Nov 3 11:37:55 snsudc02 DHCPLOG[0]: 11,11/03/09,11:37:55,Renew,172.16.0.191,donovan-dcda8cf.,000B7D0993DF, My filter originally was: filter f_dhcp { match("DHCPLOG"); }; I've tried all these without success: filter f_dhcp { message("DHCPLOG"); }; filter f_dhcp { program("DHCPLOG"); }; filter f_dhcp { match("DHCPLOG" flags("ignore-case") value("$PROGRAM")); }; filter f_dhcp { match("0" value("$PID")); }; Any help would be greatly appreciated.

2 2

Re: [syslog-ng] syslog-ng3 with SQL on FreeBSD
by Pal Tamas 03 Nov '09

03 Nov '09

On Wed, Oct 28, 2009 at 12:00:01PM +0100, syslog-ng-request(a)lists.balabit.hu wrote: > Date: Tue, 27 Oct 2009 16:27:31 -0400 > From: "Michael W. Lucas" <mwlucas(a)blackhelicopters.org> > Subject: [syslog-ng] syslog-ng3 with SQL on FreeBSD > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <20091027202731.GA82885(a)bewilderbeast.blackhelicopters.org> > Content-Type: text/plain; charset=us-ascii > > Hi, > > I'm working on getting syslog-ng 3.0.3 to support SQL on FreeBSD, and > hopefully get it added to the FreeBSD package or port. It looks like > something isn't quite right in the configure script, however. > > I have libdbi 0.8.3 installed, but "./configure --enable-sql=yes" > still reports: > > checking for LIBDBI... gnome-config: not found > no Did you installed pkg-config from ports? If not, please install it and re-run configure with the PKG_CONFIG_PATH set to /usr/local/lib/pkgconfig (this is where libdbi installed the dbi.pc config file) > checking for dbi_initialize in -ldbi... no This step will be skipped if library detection using pkg-config detection works. If not, please set include and library detection paths in CFLAGS and LDFLAGS variables before running configure. Ex: CFLAGS="-I/usr/local/include" LDFLAGS="-L/usr/local/lib" ./configure ... Please note this only works in posix shells (bash, /bin/sh), in csh you have to set the variables before running configure. > > I've reviewed /usr/local/include/dbi/dbi.h, and dbi_initialize is in > there. > > Can anyone suggest a fix? If both of these fail, please send in part of config.log from the checking LIBDBI messages to the following text: ## ---------------------- ## ## Running config.status. ## ## ---------------------- ## Regards, -- Pal Tamas/Folti folti(a)balabit.hu

3 5

problem with matching IP address and \d regex operand
by Phil.Newlon＠wendysarbys.com 03 Nov '09

03 Nov '09

I am using this regular expression with Kiwi Syslog to distribute messages to several destinations based on the last number of the third octet (0-4 goes one place, 5-9 goes another). "10\.\d+\.\d*[0-4]\." This doesn't work with syslog-ng, of course, but based on my research of the archives, this should do the same thing because I've escaped the "\d" match("10\.\\d+\.\\d*[0-4]\.") Nope, I get nothing. I've shortened it to just match("10\.\\d+") and still get no matching messages. This sort of works, but gives some unexpected results: match("10\.[0-9]+\.[0-9]*[0-4]\.") The match("10\.[0-9]+\.[0-9]*[0-4]\.") statement resulted in 'true' on this log message. I didn't expect a match on 10.87.48.4 from it because of the '8' as the last number of the third octet not matching '0-4' Oct 29 16:31:20 10.87.48.4 Kiwi_Syslog_Daemon Oct 29 16:31:20 10.87.48.4 MSWinEventLog 0 Security 71000 Thu Oct 29 16:31:17 2009 538 Security pos User Success Audit POS0408748 Logon/Logoff User Logoff: User Name: pos Domain: POS0408748 Logon ID: (0x0,0x4ACB69) Logon Type: 3 42921033 So, I have two questions..... What's wrong with this: match("10\.\\d+\.\\d*[0-4]\.") And why did this match("10\.[0-9]+\.[0-9]*[0-4]\.") match this Oct 29 16:31:20 10.87.48.4 Kiwi_Syslog_Daemon Oct 29 16:31:20 10.87.48.4 MSWinEventLog 0 Security 71000 Thu Oct 29 16:31:17 2009 538 Security pos User Success Audit POS0408748 Logon/Logoff User Logoff: User Name: pos Domain: POS0408748 Logon ID: (0x0,0x4ACB69) Logon Type: 3 42921033 Thanks! Phil Notice: This e-mail message and its attachments are the property of Wendy's/Arby's Group Inc. or one of its subsidiaries and may contain confidential or legally privileged information intended solely for the use of the addressee(s). If you are not an intended recipient, then any use, copying or distribution of this message or its attachments is strictly prohibited. If you received this message in error, please notify the sender and delete this message entirely from your system.

4 6

Seg fault with include file contains an error
by anthony lineham 03 Nov '09

03 Nov '09

Hi Bazsi, I've been investigating a seg fault that occurs when using an include statement in the config file. The error occurs when one of the included files contains an syntax error. The first time syslog-ng is restarted with the bad config, the error is detected and restart is aborted. However, if a second HUP is sent a seg fault occurs. I had a bit of trouble tracking down the cause and I'm still not entirely sure of the mechanism that leads to the crash but I found a couple of apparent problems, which when corrected prevent it. 1. There is a global variable "include_depth" which normally gets decremented back to zero after successful parsing of included config files. However, if an error is detected it stays at its current value and subsequent restarts increment from that point. This doesn't cause the crash, but given enough restarts would lead to overrun or exhaustion of the "include_stack" array. 2. In the case of unsuccessful config parsing certain bits of memory are dealloced but their pointers that not reset. This seems to be what was causing the seg fault but I've found it a bit hard to pin down. 3. There was an off-by-1 error in the included config deinit loop. The following patch fixes the problem, but may not necessarily be the best way to do it - particularly issue 1. Regards, Anthony --- syslog-ng_3.0.1-63-g41f77f5-old/src/cfg-lex.l 2009-09-14 16:02:09.000000000 +1200 +++ syslog-ng_3.0.1-63-g41f77f5/src/cfg-lex.l 2009-09-14 16:15:30.000000000 +1200 @@ -626,17 +626,24 @@ { gint i; - for (i = 0; i < include_depth; i++) + for (i = 0; i <= include_depth; i++) { CfgIncludeLevel *level = &include_stack[i]; if (level->current_file) - g_free(level->current_file); + { + g_free(level->current_file); + level->current_file = NULL; + } g_slist_foreach(level->files, (GFunc) g_free, NULL); g_slist_free(level->files); level->files = NULL; if (level->yybuf) - yy_delete_buffer(level->yybuf); + { + yy_delete_buffer(level->yybuf); + level->yybuf = NULL; + } } + include_depth = 0; }

2 1

first post - newbie question
by Christopher Barry 03 Nov '09

03 Nov '09

Hi All, Looking for good config example that: sets up syslog-ng as the central log server catching standard remote syslog hosts logs, placing them in hostname dirs, with all of the remotes hosts logfiles intact in the hostname dirs. Creating 'date' dirs above the hostname dirs would be sweet too. I've been googling around, but can't really find what I'm after. Did see this, which is essentially what I want, but it seemed to be left unanswered. http://www.syslog.org/forum/syslog-ng/individual-files/ Thanks for any pointers to docs/samples you can give me. Cheers, -C

3 4

syslog-ng3 with SQL on FreeBSD
by Michael W. Lucas 03 Nov '09

03 Nov '09

Hi, I'm working on getting syslog-ng 3.0.3 to support SQL on FreeBSD, and hopefully get it added to the FreeBSD package or port. It looks like something isn't quite right in the configure script, however. I have libdbi 0.8.3 installed, but "./configure --enable-sql=yes" still reports: checking for LIBDBI... gnome-config: not found no checking for dbi_initialize in -ldbi... no I've reviewed /usr/local/include/dbi/dbi.h, and dbi_initialize is in there. Can anyone suggest a fix? Thanks, ==ml -- Michael W. Lucas mwlucas(a)BlackHelicopters.org http://www.MichaelWLucas.com/ Latest book: Cisco Routers for the Desperate, 2nd Edition http://www.CiscoRoutersForTheDesperate.com/

2 1

can two destinations refer to the same file?
by Jason Haar 03 Nov '09

03 Nov '09

Hi there I'm wanting to configure syslog-ng so that I have two different filters that are associated with two different destinations - which have the same filename - but different templates. The issue I have is that we have a range of syslog clients, which may or may not have trustworthy clocks. So I default to ignoring their timestamps and use the syslog servers clock, except for the hosts I know to also use NTP. What I want to confirm is that syslog-ng will happily open /var/log/messages ONCE and will parse the following the way I intend? ie #clocks on unix systems (which are named 'blah-unix-number') are always configured correctly filter f_goodclock { host("-unix-") }; #can't trust everything else filter f_badclock { not host("-unix-") }; destination d_badclock_messages { file("/var/log/messages" template("$R_ISODATE $HOST $FACILITY $PRIORITY $MSG\n") }; destination d_goodclock_messages { file("/var/log/messages" template("$S_ISODATE $HOST $FACILITY $PRIORITY $MSG\n") }; log { ... filter(f_badclock); destination(d_badclock_messages);}; log { ... filter(f_goodclock); destination(d_goodclock_messages);}; Should that work as I hope? Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

3 3

HOST macro using relay
by Jason Barrett 03 Nov '09

03 Nov '09

Hi all, I'm relaying log messages from one syslog-ng server to another. At the final stop, the only way I can get the $HOST macro to work is if I enable dns resolution on server 1 (I'd like to avoid this). Is this by design? Here are the relevant configs: ---------------------------------------------------------------------- syslog-ng server 1 (relays to server 2): chain_hostnames(yes); keep_hostname(yes); use_dns(no); source s_udp { udp(port(514)); }; destination df_udpback { udp("192.168.1.157" port(514)); }; log { source(s_udp); destination(df_udpback); }; ---------------------------------------------------------------------- syslog-ng server 2: chain_hostnames(yes); keep_hostname(yes); use_dns(yes); source s_udp { udp(port(514)); }; destination df_udp { file("/var/log/ics/$HOST/$YEAR/$MONTH/$DAY"); }; log { source(s_udp); destination(df_udp); }; ---------------------------------------------------------------------- Sample log message on server 2: Oct 30 09:35:03 10.12.24.46/10.12.24.46 %ASA-5-111005: 10.28.22.55 end configuration: OK 10.12.24.46 is the correct IP address of the originating host, and $HOST resolves to this IP address. I would prefer $HOST to resolve to the hostname as it exists in the /etc/hosts file. Thanks!

1 0

Re: [syslog-ng] Re : flags(final)
by Michael J. Bauer 03 Nov '09

03 Nov '09

I've upgraded from syslog-ng 2.1.4 to 3.0.4, in case flags(final) was somehow broken in that version. The upgrade has made no difference: flags(final) still appears to have no effect. I am attempting to shunt all entries containing FWNAT into a separate file (network-address-translation), and keep them out of the default destination (default). The configuration, below, writes the entries to both, despite the presence of flags(final) in a prior log{} statement. My understanding based on reading the documentation and various sample configurations is that flags(final) in one log{} statement should preclude the log entry in question from going to any subsequent log{} statement. Am I misunderstanding how flags(final) works, or should I submit a bug report? If I'm misunderstanding, please let me know if there is a way to get the behavior I'm describing. Thanks, MJB My syslog-ng 3-ified configuration: @version:3.0 options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" program_override("kernel")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination d_network_address_translation { file("/var/log/network-address-translation" flush_lines(10) flush_timeout(1000)); }; destination d_default { file("/var/log/default" flush_lines(10) flush_timeout(1000)); }; filter f_network_address_translation { host("hlgn-crtr-01-service") and priority(info) and facility(local2) and match("FWNAT"); }; log { source(s_sys); filter(f_network_address_translation); destination(d_network_address_translation); flags(final); }; log { source(s_sys); destination(d_default); }; Michael J. Bauer wrote: > That flags(final) is in fact part of the log{} line. The destination() > is also part of the log{} line, and appears on a line of its own because > of line wrap. The log{} line is, in one line (and hoping to avoid wrap): > > log { source(s_sys); filter(f_network_address_translation); > destination(d_network_address_translation); flags(final); }; > > The terminating }; is after flags(final);. Neither of the real > destination{} lines contain flags(final). > > MJB > > srainville(a)videotron.ca wrote: > >> The flags(final) goes at the end of the log statement, not the >> destination. >> >> Cheers, >> >> Steve >> ----- Message d'origine ----- >> De: "Michael J. Bauer" <mjbauer(a)eecs.tufts.edu> >> Date: Jeudi, 24 Septembre 2009, 23:00 >> Objet: [syslog-ng] flags(final) >> À: syslog-ng(a)lists.balabit.hu >> >> >>> I think I am misunderstanding what flags(final) is supposed to >>> do. I'm >>> running syslog-ng 2.1.4 on RHEL 5.4 (Tikanga). >>> >>> I have a fairly simple syslog-ng configuration, which I've >>> attached >>> below. I'm trying to pick off individual groups of log >>> entries and put >>> them in their own individual files. I want to ensure that >>> each gets >>> logged exactly once, so I'm using flags(final). I also >>> have a catch-all >>> at the end in case I've missed something, but the ultimate goal >>> is to >>> have that file present, but empty. >>> >>> However, with this configuration, the log entries that appear in >>> d_network_address_translation (/var/log/network-address- >>> translation) >>> also appear in d_default (/var/log/default) despite the presence >>> of >>> flags(final) on an earlier log() line. Should it work this >>> way? If so, >>> what can I do to get the desired behavior? >>> >>> Thanks, >>> MJB >>> >>> options { >>> sync (0); >>> time_reopen (10); >>> log_fifo_size (1000); >>> long_hostnames (off); >>> use_fqdn (no); >>> create_dirs (no); >>> keep_hostname (yes); >>> }; >>> >>> source s_sys { >>> file ("/proc/kmsg" >>> log_prefix("kernel: ")); >>> unix-stream ("/dev/log"); >>> internal(); >>> udp(ip(0.0.0.0) port(514)); >>> }; >>> >>> destination >>> d_network_address_translation { >>> file("/var/log/network-address-translation"); }; >>> destination >>> d_default { file("/var/log/default"); }; >>> >>> filter f_network_address_translation { host("router-service- >>> interface") and >>> priority(info) and >>> facility(local2) and >>> match("FWNAT"); }; >>> >>> log { source(s_sys); >>> filter(f_network_address_translation); >>> >>> destination(d_network_address_translation); flags(final); }; >>> log { source(s_sys); >>> destination(d_default); }; >>> >>> >>> >> ______________________________________________________________________________ >> >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation: >>> http://www.balabit.com/support/documentation/?product=syslog-ng >>> FAQ: http://www.campin.net/syslog-ng/faq.html >>> >>> >> ------------------------------------------------------------------------ >> >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.campin.net/syslog-ng/faq.html >> >> >> > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > >

2 1

syslon-ng temote logging
by Vasiliy G Tolstov 02 Nov '09

02 Nov '09

Hello. I have some trouble - all my mail logs send to local syslog-ng on server, that put it into file /var/log/maillog and send to remote logger by udp, then remote logging server dies, local syslog-ng buffers logs some time, after that - system has very big lavg. Is that possible to drops some logs if the destination server not available? -- Vasiliy G Tolstov <v.tolstov(a)selfip.ru> Selfip.Ru

2 1

Syslog-NG interpreting Cisco message 'count' number as $Program
by Patrick Smith 30 Oct '09

30 Oct '09

Hi all, wondering if anyone is familiar with this issue. Have several Cisco switches logging to a syslog-ng server. The syslog-ng server creates a new file for every message as it is interpreting the 'count' item added by the switch as the $program. My configs as follows to demonstrate what I mean: Syslog-ng.conf: destination d_all { file("/var/log/syslog-ng/$HOST/$PROGRAM-$YEAR-$MONTH-$DAY.log"); }; * This has always worked for me before and creates logs for each host with the program prefixed (e.g. snmp-date..., ssl_access_log-date...) But for Cisco switches it writes a new logfile for every message, with the Cisco message number (i.e. log count #) prepended. E.g., for a 6509 switch: -rw-r--r-- 1 syslog-ng wheel 165 Oct 21 11:51 1655156-2009-10-21.log -rw-r--r-- 1 syslog-ng wheel 168 Oct 21 11:51 1655157-2009-10-21.log -rw-r--r-- 1 syslog-ng wheel 147 Oct 21 11:51 1655158-2009-10-21.log -rw-r--r-- 1 syslog-ng wheel 150 Oct 21 11:51 1655159-2009-10-21.log -rw-r--r-- 1 syslog-ng wheel 154 Oct 21 11:52 1655160-2009-10-21.log * where 16551xx is the count of the log message on the switch And each of those files contains one log message, e.g. syslog-ng # cat 1655156-2009-10-21.log Oct 21 11:51:15 6509switch1 1655156: Oct 21 18:51:14.922: %LINK-5-CHANGED: Interface GigabitEthernet3/35, changed state to administratively down For reference the logging on the switches are set as: 6509s: service timestamps log datetime msec logging buffered 20000 debugging logging rate-limit 1000 log-adjacency-changes logging <syslog host IP> logging synchronous 2960s: service timestamps log uptime logging buffered 20000 logging <syslog host IP> logging synchronous I'm thinking I could have a separate destination statement to properly deal with these but I'm wondering if there's any other steps I can take to mitigate it. I have several Cisco firewalls logging to syslog-ng and they do not have the same issue. Thanks for any help. IMPORTANT NOTICE THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer. Learn more about Payment Processing's services at www.paypros.com.

3 10

MySQL Pipe for Syslog-NG not working
by Patrick Smith 29 Oct '09

29 Oct '09

Hi, I realize this is a syslog-ng users list but I know many of you are using/developing php-syslog-ng/logzilla as well so I thought I'd post the question here. I did a fresh install of syslog-ng on 3 servers, all running installed via rpm, but on one server the mysql pipe isn't working successfully. 2 servers are 64-bit RHEL4, syslog-ng-3.0.4-1.el4 (rpm), remote MySQL community server (mysql pipe works) 1 is 64-bit RHEL5, syslog-ng-3.0.4-1.el5 (rpm), local RedHat MySQL server (mysql pipe is not inserting messages) The pipe is taken direct from the php-syslog-ng wiki installation guide: destination d_mysql { program("/var/www/logzilla/scripts/db_insert.pl" template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t $HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n") ); }; destination d_localfiles { file("/var/log/syslog-ng/$HOST/$PROGRAM-$YEAR-$MONTH-$DAY.log"); }; log { source(s_remote); filter(f_allsystem); destination(d_mysql); }; log { source(s_remote); filter(f_allsystem); destination(d_localfiles); }; I have the same syslog-ng.conf file on all 3 hosts. Everything seems to be working normally, the logs just aren't making it into the RHEL5 mysql db. - Syslog messages are being received and written to local files. - Test access to mysql syslog DB as syslogadmin and sysloguser works fine. Correct passwds are in config file. - Test run of DBGen.pl works normally and the log messages are searchable in the logzilla UI. - No error messages in syslog-ng.log, mysqld.log, or logzilla logs. Any ideas as to how to further troubleshoot would be appreciated. IMPORTANT NOTICE THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer. Learn more about Payment Processing's services at www.paypros.com.

3 5

Solaris10 install Syslogng3.0.4 License clarification
by Zeek Anow 21 Oct '09

21 Oct '09

My goal is to install the server and client free version of syslog-ng.3.0.4 on Solaris 10 servers. I read the syslog-ng 3.0 Admin Guide (dated Aug 19, 2009) and the install instructions in the solaris10_install.txt file. My confusion is the constant reference to the Premium Edition for files and licensing. Do I have the wrong documentation or did I download the wrong product? I downloaded syslogng-3.0.4-sol10-sparc-local.gz package from SunFreeware. I filled out the request form on your website that is supposed to be reviewed and the license info returned to me. Again, this is for the Premium Edition. There wasn't anything mentioned about the free version. Hope I'm not confusing you, but I'm lost:)) Thanks!!

2 2

Fwd: Seg fault with include file contains an error
by anthony lineham 20 Oct '09

20 Oct '09

Hi, I sent this patch to the list last month, but haven't had any feedback yet. Does anyone have any comments (aside from my poor spelling and grammar)? Am I way off track with this fix or is it ok? Looking forward to your comments. best regards, Anthony >>> On 9/14/2009 at 4:50 PM, in message <4ADD7D39.7D71.00E6.0(a)alliedtelesis.co.nz>, anthony lineham wrote: > Hi Bazsi, > > I've been investigating a seg fault that occurs when using an include > statement in the config file. The error > occurs when one of the included files contains an syntax error. The first > time syslog-ng is restarted with the bad > config, the error is detected and restart is aborted. However, if a second > HUP is sent a seg fault occurs. > > I had a bit of trouble tracking down the cause and I'm still not entirely > sure of the mechanism that leads to the > crash but I found a couple of apparent problems, which when corrected > prevent it. > > 1. There is a global variable "include_depth" which normally gets > decremented back to zero after successful > parsing of included config files. However, if an error is detected it stays > at its current value and subsequent > restarts increment from that point. This doesn't cause the crash, but given > enough restarts would lead to > overrun or exhaustion of the "include_stack" array. > > 2. In the case of unsuccessful config parsing certain bits of memory are > dealloced but their pointers that not > reset. This seems to be what was causing the seg fault but I've found it a > bit hard to pin down. > > 3. There was an off-by-1 error in the included config deinit loop. > > The following patch fixes the problem, but may not necessarily be the best > way to do it - particularly issue 1. > > Regards, > Anthony > > --- syslog-ng_3.0.1-63-g41f77f5-old/src/cfg-lex.l 2009-09-14 > 16:02:09.000000000 +1200 > +++ syslog-ng_3.0.1-63-g41f77f5/src/cfg-lex.l 2009-09-14 > 16:15:30.000000000 +1200 > @@ -626,17 +626,24 @@ > { > gint i; > > - for (i = 0; i < include_depth; i++) > + for (i = 0; i <= include_depth; i++) > { > CfgIncludeLevel *level = &include_stack[i]; > > if (level->current_file) > - g_free(level->current_file); > + { > + g_free(level->current_file); > + level->current_file = NULL; > + } > > g_slist_foreach(level->files, (GFunc) g_free, NULL); > g_slist_free(level->files); > level->files = NULL; > if (level->yybuf) > - yy_delete_buffer(level->yybuf); > + { > + yy_delete_buffer(level->yybuf); > + level->yybuf = NULL; > + } > } > + include_depth = 0; > } >

2 2

Default SQL Server Informations / Global Constants?
by Jean F. Mousinho 20 Oct '09

20 Oct '09

Hello, Is there a way of defining a default hostname, username, password, etc for the sql destination? or I've to duplicate this information for every destination defined? If not, is there a way of defining some global constants and use them later? Thanks for your time. Jean F. mousinho

4 3

Syslog-ng SRC IP filter doesn't appear to work
by Matty 20 Oct '09

20 Oct '09

Howdy, I am using syslog-ng 3.0.4, and am encountering a bizarre issue where a small percentage of messages don't match the following filter: filter f_hosts { (host("192.168.1.2") or host("192.168.1.3") or host("192.168.1.4")); }; log { source(network); filter(f_hosts); destination(d_messages); flags(final); }; log { source(network); destination(d_catchall); }; When the hosts 192.168.1.[2-4] send messages to our syslog-ng server, 99% of the time they are routed to the d_messages destination. But in a few rare cases, messages similar to the following don't match and are send to the d_catchall destination: Text data: Syslog message: KERN.INFO: Oct 19 14:54:55 \t<STK T10000B > Raw data: <6>Oct 19 14:54:55 <STK T10000B > I verified the SRC IP address for the message in question is correct, and I also ran syslog-ng with the -d -e and -F options to watch message processing. For some reason syslog-ng doesn't match against the filter listed above, which is quite bizarre. I also tried enabling the 'no-parse' flag, but that doesn't appear to help either. Has anyone experienced this issue? Any thoughts on how to debug this issue further? Thanks, - Ryan

2 1

TLS problem
by Carlo Balbo 20 Oct '09

20 Oct '09

Hi All, I have a problem from source tls... no logs are writing, no errors in logs file of syslog-ng . I hope that you have some ideas... :-) Follow the scenario : Server ----------------------------- syslog-ng log file : 2009-10-14T11:43:54+02:00 s_local@zpvm0306-1515 syslog-ng[14171]: Syslog connection accepted; fd='25', client='AF_INET(10.1.1.57:10865)', local='AF_INET(10.1.1.55:1999)' 2009-10-14T11:44:05+02:00 s_local@zpvm0306-1515 syslog-ng[14171]: Reaping unused destination files; template='/var/log/HOSTS/$HOST/encrypt-$PROGRAM-$YEAR-$MONTH.log' 2009-10-14T11:44:05+02:00 s_local@zpvm0306-1515 syslog-ng[14171]: Reaping unused destination files; template='/var/log/HOSTS/$HOST/$R_YEAR-$R_MONTH-$PROGRAM.log' syslog-ng.conf : source s_tcp_tls { tcp( ip(10.1.1.55) port(1999) tls( key_file("/opt/syslog-ng/etc/key.d/syslog-ng.key") cert_file("/opt/syslog-ng/etc/cert.d/syslo-ng.cert") peer_verify(optional-untrusted) ) ); }; destination zlog { file("/var/log/HOSTS/$HOST/$R_YEAR-$R_MONTH-$PROGRAM.log" template("$ISODATE\t[<$FACILITY.$PRIORITY>]\t$HOST\t$PROGRAM\t$MSGHDR $MSG\n") template_escape(no) ); }; log { source(s_tcp_tls); destination(zlog); }; -------------------------------------- Client ---------------------------- source s_local { unix-stream("/dev/log"); internal(); }; destination tls_syslog_destination { tcp("10.1.1.55" port(1999) tls( ca_dir("/opt/syslog-ng/etc/cert.d") ) ); }; log { source(s_local); destination(tls_syslog_destination); }; Oct 14 11:46:02 zpvm0306-1630 syslog-ng[30713]: Syslog connection established; fd='16', server='AF_INET(10.1.1.55:1999)', local='AF_INET( 0.0.0.0:0)' Oct 14 11:46:02 zpvm0306-1630 syslog-ng[30713]: Syslog connection broken; fd='16', server='AF_INET(10.1.1.55:1999)', time_reopen='60' Oct 14 11:46:02 zpvm0306-1630 syslog-ng[30713]: Closing log transport fd; fd='16' ------------------------------------- syslog-ng.key and syslog-ng.cert from syslog-ng.pem -----BEGIN RSA PRIVATE KEY----- MIICXAIBAAKBgQCmf/eIUSTa6jyPiqOfWnofHmVkYRHx+QG9Obml1g3oX6YQEecl UwpFtpaZQHNGbZoCiM3TNr8/rj92yT/i1X4HAuqVrnZ9ra4GD2SQ4/C06Xe5d2+L AlurTwVN9+4Zu73LpvCsfhJZgcros9A10Iq25TvYLu9pBchBLjnY1d2kewIDAQAB AoGAdCQhc8o+biIkenBX8Gl5dEmMqnd3wBVVHDyu/joRW32U5fLHDOce7EAQTviB MKh1XL027dVrlK0kgeSiFsWbcYKJdSLsY7J5osEPFAu9ZjaaXtE1hbQpAlZswLvE n12x6jbZSlVGBTfb6TsLWcgJ5QY2BAcntGZjz3ryffoE/BECQQDSIXBWX3OVuR6i +aFphzy5Hc+IUCsaPYQcSntnLLHa+W3W75sWMLTEjFZGXWQwtj8Ixk+4Ce650yLw B5CbnAYzAkEAythYir5ttKEPkixbGSrBntndJW8oNjXN6pR6ofklhGrV52oh7Y+A UW23lrvAyfAArArDiAcsxV+lYDRwQ5pQmQJADxAql2Z8SK1ejtxKP+Bb8AE9EU59 6IGkaMrGEd1YWpQq1Y+TlIGlU7mjraOgPQWzexOMP2sm29dQ19gS+7SxlQJAJwuD 55kGNvm1rJZbJroDMReQqO7/l4e9zkSsYlc58IY8DGJyi27O7V2oNByJ3JUVHAiq YJm49XkWtTEC1xByKQJBAKRiGABOrJwaOLOgMXreTykY7aX2uho+0gtOKewXoj42 3SwNLyW9rM0IK5lBKOyYyYZ6jn3bN9bYHE4jIjxiMfU= -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIDpzCCAxCgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBmjELMAkGA1UEBhMCSVQx DjAMBgNVBAgTBU1pbGFuMQ4wDAYDVQQHEwVNaWxhbjEUMBIGA1UEChMLWmVyb3Bp dSBTcEExHTAbBgNVBAsMFFJlc2VhcmNoJkRldmVsb3BtZW50MRMwEQYDVQQDEwp6 ZXJvcGl1Lml0MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QHplcm9waXUuaXQwHhcN MDkxMDExMTA1NTQwWhcNMTAxMDExMTA1NTQwWjCBmjELMAkGA1UEBhMCSVQxDjAM BgNVBAgTBU1pbGFuMQ4wDAYDVQQHEwVNaWxhbjEUMBIGA1UEChMLWmVyb3BpdSBT cEExHTAbBgNVBAsMFFJlc2VhcmNoJkRldmVsb3BtZW50MRMwEQYDVQQDEwp6ZXJv cGl1Lml0MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QHplcm9waXUuaXQwgZ8wDQYJ KoZIhvcNAQEBBQADgY0AMIGJAoGBAKZ/94hRJNrqPI+Ko59aeh8eZWRhEfH5Ab05 uaXWDehfphAR5yVTCkW2lplAc0ZtmgKIzdM2vz+uP3bJP+LVfgcC6pWudn2trgYP ZJDj8LTpd7l3b4sCW6tPBU337hm7vcum8Kx+ElmByuiz0DXQirblO9gu72kFyEEu OdjV3aR7AgMBAAGjgfowgfcwHQYDVR0OBBYEFGxV+r7bTgQw7qQFq+NOM2ZKswh/ MIHHBgNVHSMEgb8wgbyAFGxV+r7bTgQw7qQFq+NOM2ZKswh/oYGgpIGdMIGaMQsw CQYDVQQGEwJJVDEOMAwGA1UECBMFTWlsYW4xDjAMBgNVBAcTBU1pbGFuMRQwEgYD VQQKEwtaZXJvcGl1IFNwQTEdMBsGA1UECwwUUmVzZWFyY2gmRGV2ZWxvcG1lbnQx EzARBgNVBAMTCnplcm9waXUuaXQxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRAemVy b3BpdS5pdIIBADAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAEND4ifb Ntd7JJKVa6FDNS5ouLdfQq5sk+uwI9OyDuD2SUdfMuhpF2PZQFxSlI2esOcTwHro tx9FBiNeZkFElPZ82vPjgchGjcgIFfUYHwWH+8lfVXEsmOub0r9xBPZNZ5/mzEXQ 7mpgGYO3aSCzqOPpz0OFBF5cBrpYSzwenaYl -----END CERTIFICATE----- -- /* Carlo http://oblab.com */

2 1

Invalid frame header; header=''
by jnordwick 20 Oct '09

20 Oct '09

I can't seem to get syslog-ng to recongnize a syslog message. I used the example message you give in the docs, but all it says is "Invalid frame header". Here is the error message: Oct 13 14:35:55 logger-01 syslog-ng[29653]: Invalid frame header; header='' here is how I'm sending my test message: echo "<34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - ID47 - BOM'su root' failed for lonvick on /dev/pts/8" | nc logger-01 20514 Here is the config: options { flush_lines(1); }; source src { internal(); syslog(ip("192.168.27.198") port(20514) transport("tcp")); }; destination dest { file("/data/local/logs/sys.log" owner(xl) group (xl)); }; log { source(src); destination(dest); }; ------------------------------------------------------------------------------------------ This message is for the named person(s) use only. It may contain confidential proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. You must not, directly or indirectly use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. Allston Trading LLC and its subsidiaries and affiliates each reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity. ------------------------------------------------------------------------------------------

4 7

syslog-ng OSE in relay mode?
by Massimo Ianni 20 Oct '09

20 Oct '09

Hi, I'm a new syslog-ng user. I have a question about syslog-ng OSE: can an instance of this version be configuable in relay mode? Otherwise should I use syslog-ng PE? Best Regards. Massimo

2 1

Introduction to the syslog-ng developer team
by Balazs Scheidler 19 Oct '09

19 Oct '09

Dear syslog-ng users, Due to an internal reorganization in BalaBit, some additional developer time is being allocated to syslog-ng development. Until now I was the only visible figure on this mailing list, even though some other people were sometimes working on syslog-ng. I would like to change this, therefore please allow me to introduce the development team assigned to syslog-ng inside BalaBit (in abc order): András Tevesz (ghost(a)balabit.hu) András Miczki (micek(a)balabit.hu) Viktor Juhász (jviktor(a)balabit.hu) Zoltán Pallagi (pzolee(a)balabit.hu) Some of them has a long syslog-ng related history, but one of them is completely new to the project. I'm urging them to take part in the syslog-ng community, engage conversations on this mailing list or run a blog. However it is important to point out that some of you on this mailing list may have more syslog-ng related experience than what they currently do: they are primarily software engineers, not system administrators. So whenever they take part in a conversation, please bear this in mind, the opinions they have is not an official BalaBit opinion, they are just fellows whose job happens to include work on an Open Source project. -- Bazsi

1 0