- syslog-ng - lists.balabit.hu

Behavior when followed files are renamed
by Joe Shaw 30 Dec '08

30 Dec '08

Hi, I couldn't find this anywhere in the online docs. What's the behavior of syslog-ng OSE when a file which is being followed with follow_freq() is renamed? Thanks, Joe P.S. From a git checkout of 3.0, doc/reference doesn't exist... is it gone, or does it get pulled from somewhere else when a tarball is built?

4 7

Problem compiling syslog-ng with enable-spoof-source on AIX 5.2
by CentralRegion IPAdmin 20 Dec '08

20 Dec '08

Hi, I'm trying to compile syslog-ng.2.1.3 after configuring with --enable-spoof-source. libnet is a prereq as I have learned, but I can't find any hint how to install libnet. Latest version of libnet is "0.10.11: released 18/02/2003" and it seems there is no mailinglist available. The code comes with some makefile templates such as "beos.mak, djgpp.mak, freebsd.mak, linux.mak, mingw.mak, rsxntdj.mak", but none of them works with AIX I have used "GNU Make 3.81" and "gcc version 3.3.2" to compile libnet. All are failing. Do you have any ideas how to get it done? Thank You! Werner

3 3

Performance issues
by farouk.s.khawaja＠jpmorgan.com 18 Dec '08

18 Dec '08

I'm finding that my Syslog-NG 2.0.9 OSE is not able to send more than 19 msgs/sec. I've tried setups with/without flow control, but keep coming up with similar performance results. I'm using the 'file' driver to read the data from application log files. I supposed I could use a named pipe, but I rather not create a new tool to write data to the pipe and create other bottlnecks and buffering issues. The application logs I want to follow writes at a pace of ~130msgs/sec during peak usage with average message size of ~410bytes. My destination log location is on NFS. I've verified that it's not the network or NFS that's causing the issues. I whipped up a simple perl script that made a socket connection from the source host to the destination host where syslog-ng was listening. I was able to pump 48320 messages to that remote syslog port that was configured to write the data to a NFS partition. That's ~3200 msgs/sec. So I also know that the destination syslog-ng is working fine. My guess is that the problem lies with the file driver. I'd like to get syslog-ng to be the tool I use to consolidate logs across N number of hosts instead of writing some bootleg code of my own to which I will forever be a slave to maintain. Any assistance you can provide would be appreciated. Source syslog-ng.conf ########################################################## # G L O B A L O P T I O N S ########################################################## options { use_dns (no); use_fqdn (no); create_dirs (yes); log_fifo_size(2100); time_sleep (10); }; ########################################################## # Template ########################################################## template t_clog { template("$MSG\n"); template_escape(no); }; ########################################################## # Sources ########################################################## # ## default source for logging syslog messages source s_internal { internal(); }; # ## source s_ldsol01_file { file("/tmp/ldsol01-clog.log" follow_freq(10) flags(no-parse) log_fetch_limit(1000) log_iw_size(2000) ); }; ########################################################## # Destinations ########################################################## # ## default destination for logging syslog messages destination d_syslog_file { file("/home/csh_apps/twataprd/Logs/SYSLOG-NG/syslog-ng.log"); }; # ## eqny-cshweb2 destination d_ldsol01_tcp { tcp( "10.3.22.43" port(20534) ); }; destination d_ldsol01rej_tcp { tcp("10.3.22.43" port(20535)); }; ########################################################## # logs ########################################################## log { source( s_internal ); destination ( d_syslog_file ); }; log { source( s_ldsol01_file ); destination( d_ldsol01_tcp ); flags(flow-control); }; Generally, this communication is for informational purposes only and it is not intended as an offer or solicitation for the purchase or sale of any financial instrument or as an official confirmation of any transaction. In the event you are receiving the offering materials attached below related to your interest in hedge funds or private equity, this communication may be intended as an offer or solicitation for the purchase or sale of such fund(s). All market prices, data and other information are not warranted as to completeness or accuracy and are subject to change without notice. Any comments or statements made herein do not necessarily reflect those of JPMorgan Chase & Co., its subsidiaries and affiliates. This transmission may contain information that is privileged, confidential, legally privileged, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. Although this transmission and any attachments are believed to be free of any virus or other defect that might affect any computer system into which it is received and opened, it is the responsibility of the recipient to ensure that it is virus free and no responsibility is accepted by JPMorgan Chase & Co., its subsidiaries and affiliates, as applicable, for any loss or damage arising in any way from its use. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you. Please refer to http://www.jpmorgan.com/pages/disclosures for disclosures relating to UK legal entities.

3 2

Ronald Jones is out of the office.
by Ronald Jones 18 Dec '08

18 Dec '08

I will be out of the office starting 12/18/2008 and will not return until 12/29/2008. I will respond to your message when I return. ----------------------------------------- ________________________________________________________ DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

1 0

include file syntax
by Balazs Scheidler 11 Dec '08

11 Dec '08

Hi, This is a repost of my blog bost at http://bazsi.blogs.balabit.com/, if you have an opinion about the subject please either reply to this e-mail, or post a comment on my blog. ---- I'm about to implement configuration file includes, and although the implementation is quite straightforward, the syntax to be used is something to give a thought or two. Currently the syslog-ng configuration file consists of statements, each with the following basic format: stmt [] { ... }; The "id" gives a unique identifier of the statement, and the braces enclose the contents. Currently only the ID part is optional, the braces are always there. To make the include statement consistent with that, it'd have to look something like: include { "filename" }; Obviously I don't like this too much, as it is way different from all other applications permitting the use of include statements. What about this: include "filename"; E.g. use the ID part the name of the file to be included. I like this better. A third option might be the use of 'pragma' directives, currently only used to specify the file format compatibility in the case of syslog-ng 3.0: @version: 3.0 This'd mean that include statements would look like this: @include: filename The problem with this last option is that pragmas are currently only processed at the beginning of the configuration file. So that code should also be generalized. I think I'd go with the second option, that's not completely inconsistent, but still the most intuitive to use. What do you think? -- Bazsi

3 3

Need help to send logs to a different server
by Swapna 11 Dec '08

11 Dec '08

Hi, We have syslog-ng configuration as follows: - There are 50 clients communicating to one log server - The log server is kept in secured place where nobody have access - All the logs of 50 clients are coming to the log server and the logs are kept as follow /var/log/syslog-ng/<client host>/extended.log We want all the log of each client to relay into a seperate server live. Means the current log file of each host will go to the new server simultaneously as it is going to the central log server. We can configure a second log server like the existing one. But our requirement is, that all the logs will be received from the central log server not from the client hosts. Any help is really appreciated. Thanks

5 8

[Bug 25] New: 3.03 MSI package bails out on server 2008
by bugzilla＠bugzilla.balabit.com 11 Dec '08

11 Dec '08

https://bugzilla.balabit.com/show_bug.cgi?id=25 Summary: 3.03 MSI package bails out on server 2008 Product: syslog-ng Version: unspecified Platform: PC OS/Version: Windows Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erik.linder(a)riksgalden.se Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=5) --> (https://bugzilla.balabit.com/attachment.cgi?id=5) MSI-install log I cannot make the 3.03 MSI to install on server 2008. I have tried several servers, both DC's and domain members. Same result every time. See attached MSI-logfile. This is stopping our rollout completely. Best regards, ./Erik -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

newbie
by McGranahan, Jamen 10 Dec '08

10 Dec '08

Ok, I guess I'm just too used to the Windows environment that I'm having a hard time adjusting to command line interfaces. Here's the deal: I need to get syslog-ng running on my server. I think I have it installed, downloading the file from sunfreeware.com, putting the file in the /var/spool/pkg directory (file = syslogng-2.0.9-sol10-sparc-local.gz). I then used the pkgadd -d command to install it, which seemed to be fine. But where do I go from here? Has it started or do I need to manually start it? I'm also looking for a syslog-ng.conf file in order to modify it - I'm using this to push log data to another server, and according to the central logging program we are using, I need to modify this file like this: options { use_fqdn(yes); log_fifo_size(8192); }; source local { file("/var/log/messages"); udp(ip(127.0.0.1) port(514)); internal(); }; filter notdebug { level(info...emerg); } destination loghost { tcp("name.of.yoursplunkserver" port (9514)); }; log { source(local); filter(notdebug); destination(loghost); }; Any advice/or guidance is greatly appreciated. I know the more I use these Unix boxes, the more I'll learn... Jamen McGranahan Systems Services Librarian Vanderbilt University 419 21st Avenue South Nashville, TN 37240

2 1

checking configuration file syntax
by Pavel Shaydo 10 Dec '08

10 Dec '08

Hello all! I'm trying to automate configuration file syntax checking and can't figure out how I can do it. According to manual -s option should perform syntax checking. I'm trying following: syslog-ng -s -f file-to-check It always exits with zero status and never outputs anything, regardless of correct configuration file or it contains errors. Is there something I missed? I tested it on 2.0.9 and on premium edition 2.1.11a. -- Best regards, Pavel Shaydo

3 3

syslog-ng uses 100% cpu when i use program() destination driver
by Scott McGillivray 10 Dec '08

10 Dec '08

Hi all, I have installed syslog-ng via apt-get on an Ubuntu 8.10 server. I have added the below to the configuration file: template t_smtp { template_escape(no); template("NOOP HELO localhost MAIL From: admin(a)example.com RCPT To: scott(a)example.com DATA From: admin(a)example.com To: scott(a)example.com Subject: Syslog msg from $HOST - [$FACILITY:$PRIORITY] $PROGRAM $S_DATE [$FACILITY:$PRIORITY] $MSG . QUIT "); }; log { source(s_all); filter(f_at_least_notice); destination(d_logfile); }; destination d_logfile { program("sendmail -bs > /var/log/syslog-email.log 2>&1" template(t_smtp)); }; For some reason with the above config after a message hits d_logfile the CPU usage jumps to 100% and stays there until syslog-ng is stopped. It's like some file it uses during the process gets locked and the thing jams up waiting forever. The only way to solve the problem is remove the program() entry and replace it with file("/var/log/temp.log" template(t_smtp)); in which case it works fine. To test the program()destination I created a php script that just slept for 10 seconds <?php sleep(10); ?> And called it in d_logfile { } with program("/usr/bin/php /tmp/sleep-test.php") And sure enough the cpu jumped to 100% and stayed there until syslog-ng was stopped. Can anyone see a program with my above config or suggest why syslog-ng can't cope when the program() doesn't return immediately? Thanks Scott ********************************************************************************** Disclaimer The information and attached documentation in this e-mail is intended for the use of the addressee only and is confidential. If you are not the intended recipient please delete it and notify us immediately by telephoning or e-mailing the sender. Please note that without Codemasters’ prior written consent any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. Attachments to this e-mail may contain software viruses. You are advised to take all reasonable precautions to minimise this risk and to carry out a virus check on any documents before they are opened. Any offer contained in this communication is subject to Codemasters’ standard terms & conditions and must be signed by both parties. Except as expressly provided otherwise all information and attached documentation in this e-mail is subject to contract and Codemasters’ board approval. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Codemasters. This footnote also confirms that this email message has been swept by SurfControl for the presence of computer viruses. **********************************************************************************

2 2

running syslog-ng and syslogd concurrently?
by Matt Camuto 28 Nov '08

28 Nov '08

Hi There - I am new to this group so I thank you in advance for any help. We are in the process of evaluating syslog-ng for a replacement for normal syslogd. However it is desired for a few months to have syslog-ng and syslogd running on the same box with syslog-ng simply not handling the normal 'syslog traffic' (udp/514). We currently have a 30 day eval license to test out syslog-ng. We are using a sun t1000 box as an fyi. When we install syslog-ng the install script informs us that syslogd will be removed as a service?!?! Has anybody ever run syslogd (in either agent or server mode) on the same machine with syslogd running. Any guidance there would be highly appreciated. We are not in the position to do a hard cross over to syslog-ng for our production environment. Thanks in advance. Matt

5 6

syslog-ng 2.1.3 has been released
by devel＠balabit.hu 26 Nov '08

26 Nov '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.1.3 SUMMARY : new stable release DATE : Nov 26, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.1.3) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: NOTE: this release fixes a security problem CVE-2008-5110, see the changelog below for more details. Bugfixes: * Fixed chroot() support to change into the chrooted directory after chroot is invoked. This fixes the security problem CVE-2008-5110. NOTE: this vulnerability is not exploitable on its own, it only makes breaking out of the jail somewhat easier. Please also NOTE that, even with this patch applied, it is still possible to break out of the jail if syslog-ng is running as root. * Fixed the code to resolve usernames, 2.1.2 had a regression which caused all username lookups to fail. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.1 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.1 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.1 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.1 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.1 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/

4 4

syslog-ng 2.0.10 has been released
by devel＠balabit.hu 26 Nov '08

26 Nov '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.10 SUMMARY : new stable release DATE : Nov 26, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.10) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: NOTE: this release fixes a security problem CVE-2008-5110, see the changelog below for more details. Bugfixes: * Fixed Solaris door support, the door portion of sun-streams() sources did not work in previous releases, as the door specific thread was lost through the fork() call used to background syslog-ng. * Fixed a possible segfault if non-existing, optional source files are present in the configuration. * Fixed the internal representation of "facility" values, earlier an 8 bit value was used for both the priority and facility values, and although systems do not define facilities in this range, the LOG_FACMASK macro defines two additional bits. The type of this field was changed to 16 bits. * Fixed a possible 100% CPU usage case on HP-UX. HP-UX may return POLLERR on its own without the other flags set, this was not properly handled by syslog-ng, causing it to spin on the CPU. * Fixed chroot() support to change into the chrooted directory after chroot is invoked. This fixes the security problem CVE-2008-5110. NOTE: this vulnerability is not exploitable on its own, it only makes breaking out of the jail somewhat easier. Please also NOTE that, even with this patch applied, it is still possible to break out of the jail if syslog-ng is running as root. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

1 0

2 Issues - Resolving User and corrupt forwarding
by Robert Kong 22 Nov '08

22 Nov '08

Syslog-ng Version 3.0+20081121 is not resolving the user when using the option "owner(0)" or "owner(root)". The following error message is displayed: Error resolving user; user='root' or Error resolving user; user='0' Going through the archives I found a posting stating a similar problem. I am wondering if the incorrect patch was also applied to version 3.0? After a little debugging I noticed that in resolve_user the conditional check "if (*user) return FALSE" looks to be the culprit. When comparing resolve_user to resolve_group I notice that under resolve_group the conditional is "if (!*group) return FALSE". Negating the conditional in resolve_user seems to correct the problem. Though I am not sure if would be the correct thing to do. The second issue that I am having is with forwarding of incoming syslog messages to a secondary server running a native syslogd daemon. If I leave the original syslog message un-touched destination D_ONE { udp("10.10.10.10" port(514)); }; log { source(S_ALL); destination(D_ONE); }; The remote server receives and processes the syslog msg correctly. However, if I attempt to use a template the forwarded syslog msg become corrupted. destination D_ONE { udp("10.10.10.10" port(514) template("$DATE $HOST $MSGHDR$MSGONLY")); }; log { source(S_ALL); destination(D_ONE); }; What seems to be occurring is the PRI portion of the syslog msg becomes malformed when using the template. Is this the proper behavior or am I doing something wrong? Thanks Bob

1 0

logwriter.c:241: error: LogWriterWatch has no member named - Red Hat 5.x 32BIT
by Saunders, Shawn 21 Nov '08

21 Nov '08

Can someone shed some light here? I am hoping to get to try the “parser” options, but need to successfully compile first. It appears to be dying at something in the eventlog On Red Hat - 2.6.18-92.1.18.el5 #1 SMP Wed Nov 5 09:00:13 EST 2008 i686 athlon i386 GNU/Linux I have eventlog installed: eventlog-0.2.9+20081116.tar.gz ./configure --enable-ssl=no --enable-dynamic-linking --enable-linux-caps syslog-ng Open Source Edition 3.0+20081116 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -I/usr/kerberos/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : prefix : /usr/local Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : yes SSL support : no SQL support : no Linux capability support : yes PCRE support : yes Env wrapper support : no A make gets me here: logwriter.c: In function â€˜log_writer_fd_dispatchâ€™: logwriter.c:241: error: â€˜LogWriterWatchâ€™ has no member named â€˜fdâ€™ make[2]: *** [logwriter.o] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-3.0+20081116/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/src/syslog-ng-3.0+20081116' make: *** [all] Error 2 snippet of logwriter.c lines 239-245 239 else if (self->pollfd.revents & (G_IO_ERR)) 240 { 241 msg_error("POLLERR occurred while idle", 242 evt_tag_int("fd", self->fd->fd), 243 NULL); 244 log_writer_broken(self->writer, NC_WRITE_ERROR); 245 } Thank you, Shawn Saunders UNIX Systems Administrator 818.953.2649 WMG, Digital Properties "UNIX is user-friendly ... it's just selective about who its friends are!!"

2 3

syslog + snare + mysql
by Eli Robinson 20 Nov '08

20 Nov '08

Hello all! I am currently running the following: Syslog-ng 2.0.5 on FC8, kernel 2.6.23.1-42, no firewall, SELinux disabled, logging to mysql 5.0.45 via a named pipe Snare 2.6.1 on Windows Server 2003 with the enable syslog header option checked The Snare clients have been running for several years and were communicating with an older version of snare. Everything logged perfectly. Unfortunately a hardware failure caused loss of the config file and old syslog server, so I do not have the configuration or version which worked. My setup notes reference a howto online, which I followed again. I use the following destination to log to mysql destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg, username) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' , '$USERNAME' );\n") template-escape(yes)); }; And also this collector script to run the actual mysql client: # #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u syslogusername --password=syslogpassword syslog < /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi I use out of the box filters and destinations to log to the messages logfile (for debugging at this point) My problem arises from the fact that for this entry in my messages file: Nov 20 16:01:14 testserver.mydomain.com FTPSvcLog 3 21:01:11 172.16.5.166 [36863]created /index.htm 226 0 I only get 'FTPsvcLog' written to the messages field in mysql. I am pretty sure its something obviously wrong but at this point I need another set of eyes. My gut feeling is the issue stems from the tabs following FTPSvcLog and the number 3. Any thoughts? Thanks in advance! Eli

1 0

facility(kern) not working? Syslog-ng 2.0.7
by Fegan, Joe 20 Nov '08

20 Nov '08

Hi, I am using 2.0.7 and it seems that facility(kern) does not match messages from "logger -p kern.info". I am trying to filter kernel messages into a file but nothing goes there. Below are details of the test. Joe. [root@node1 ~]# cat /etc/syslog-ng/syslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats_freq(2592000); mark_freq(0); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); # tcp(ip(0.0.0.0) port(514)); }; template t_withsev { template("${DATE} ${HOST} ${PRI} ${PRIORITY} ${MSG}\n"); }; destination d_klog { file("/var/log/klog"); }; destination d_mesg { file("/var/log/messages" template(t_withsev)); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_klog); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; [root@node1 ~]# logger -i -p kern.info "hello from kern" [root@node1 ~]# tail -2 /var/log/messages Nov 17 12:40:45 dizzyfive1 189 notice syslog-ng: syslog-ng startup succeeded Nov 17 12:41:40 dizzyfive1 14 info root[19336]: hello from kern [root@node1 ~]# ls -l /var/log/klog ls: /var/log/klog: No such file or directory [root@node1 ~]#

3 5

parser option in v2.1.3?
by Saunders, Shawn 20 Nov '08

20 Nov '08

Is the parser option to split and work with the $MSG or $MSGONLY variables and split and use various fields from them in the destination filename available in the 2.1.3 tree or is this only available in the 3.x tree? Thank you, Shawn Saunders UNIX Systems Administrator 818.953.2649 WMG, Digital Properties "UNIX is user-friendly ... it's just selective about who its friends are!!"

2 3

Need some help with syslog-ng configuration on firewalled environment
by Ankit Kukreja 19 Nov '08

19 Nov '08

Hi All, Need some help with syslog configuration on firewalled environment. I wanted to implement syslog-ng in firewalled environment. The setup is like: I have one Syslog-ng outside the firewall which collects logs from various components in the network. Now what I want is to pass on these logs from this syslog-ng server (outside firewall) to a syslog server inside the firewall i.e. to make the whole setup firewall friendly. One of the standard way to make anything firewall friendly is that the communications between two server should be started from the server inside the firewall. Is there a way we can do this with syslog-ng? Can someone please provide some insights, it would be really appreciated. Thanks and Regards Ankit Kukreja

2 3

v2.1.2 Open Source Version: Error resolving user; user
by Saunders, Shawn 19 Nov '08

19 Nov '08

When I start syslog-ng 2.1.2 (Opensource) I receive the following error. It worked fine with the same syslog-ng.conf file under v2.0.9 Starting syslog-ng: Error resolving user; user='root' Error resolving user; user='root' Error resolving user; user='root' Error resolving user; user='apache' Error resolving user; user='apache' Error resolving user; user='apache' These users do exist. I use them and their existence is self-explanatory. I have tried using the UID #'s for them and get basically the same errors. Any ideas? I have tried even moving these entries from the destination to the global section to no avail. Here is a sample: destination d_somelocation_logs { file ( "/content/syslog/somelocation/$YEAR/$MONTH/$DAY/$FULLHOST-$FACILITY-$YEA R-$MONTH-$DAY.log" owner(apache) group( apache ) perm ( 0600 ) dir_perm( 0755 ) create_dirs ( yes ) template ( "$MESSAGE\n" ) ); }; Am I loosing my mind? This seems pretty clear, and it always worked before. One of the reasons I upgraded was the hope of utilizing the parser function and templatizing my 507 line conf file, but until I get the basics working again without the errors, I don't know. Thank you, Shawn Saunders UNIX Systems Administrator 818.953.2649 WMG, Digital Properties "UNIX is user-friendly ... it's just selective about who its friends are!!"

2 2

Re: [syslog-ng] I/O error occurred while reading; fd='4',error='Operation not permitted (1)'
by Florian Grandel 19 Nov '08

19 Nov '08

Hi Bazsi, > As there are two alternatives for running syslog-ng as non-root, I would > not like to add this hack to syslog-ng: > 1) run klogd, just as before > 2) run syslog-ng 3.0, which manages its own capabilities, with > CAP_SYS_ADMIN present in the cap-set /proc/kmsg can be read. Both alternatives are not (yet) available in some Linux standard distributions (namely Debian and Ubuntu). This is not your problem, sure, just to explain the practical relevance of the workaround: 1) Before implementing my dd workaround I had already tried the klogd solution which I think would be the cleanest solution. On Debian/Ubuntu, however, syslog-ng and klogd are conflicting packages and cannot be installed alongside each other. Even worse: klogd depends on sysklogd which naturally conflicts with syslog-ng. So currently there is no way to get both installed without cleaning up this dependency mess (which probably won't be so easy). 2) As you mention yourself: maintaining CAP_SYS_ADMIN privilege is contrary to most of the rationale for dropping root privilege in the first place. It provides very powerful privileges to syslog_ng just to access /proc/kmsg which may not be acceptable to everybody. Apart from that V3.0 is not (yet) available for Ubuntu/Debian. Florian

1 0

Dynamic libs w/ 2.1.2
by Douglas E. Warner 18 Nov '08

18 Nov '08

I'm trying to compile syslog-ng 2.1.2 but getting the following error from configure: ./configure --disable-static-linking --enable-dynamic-linking [...] checking for GLIB - version >= 2.4.0... yes (version 2.16.6) checking for static GLib libraries... no checking sanity checking Glib headers... yes configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib Ideas? -Doug

4 6

Following all files in a directory tree
by Joe Shaw 18 Nov '08

18 Nov '08

Hi, I only recently got a chance to look at the syslog-ng OSE 3.0 git tree announcement and take a quick poke at the code, so please let me know if i'm off base. One thing I was hoping to see in 3.0 was the ability to specify a directory as a source and have syslog-ng serve up all of the files (possibly recursively) inside it. I think I saw something like that on a roadmap. Is that still a planned feature? Is it a PE-only feature? Thanks, Joe

2 1

syslog-ng 3.0 SSL compile fix
by Joe Shaw 18 Nov '08

18 Nov '08

Hi again, Another SSL-related compilation fix patch. If SSL is disabled, tlscontext.c should probably be empty (judging from tlscontext.h). Thanks, Joe

2 1

Re: [syslog-ng] I/O error occurred while reading; fd='4',error='Operation not permitted (1)'
by Florian Grandel 18 Nov '08

18 Nov '08

I Matt and Bazsi, as Bazsi said, the problem is less one of syslog-ng but one of permissions in the kernel. Access to /proc/kmsg is not only governed by file permissions but also by process capabilities. In this case reading from /proc/kmsg causes internal system calls that are only accessible to the superuser. There have been several kernel patches proposed ([1], [2], to give just a few examples). Kernel developers have already extensively discussed the topic [3]. The only practical solution I know of is the one implemented by Ubuntu in their klogd init script. They are using a daemonized dd process running as root that forwards messages from /proc/kmsg to the log process: kmsgpipe=/var/run/klogd/kmsg ... # create klog-writeable pid and fifo directory mkdir -p /var/run/klogd chown klog:klog /var/run/klogd mkfifo -m 700 $kmsgpipe chown klog:klog $kmsgpipe # shovel /proc/kmsg to pipe readable by klogd user start-stop-daemon --start --pidfile $kmsgpidfile --exec /bin/dd -b -m -- bs=1 if=/proc/kmsg of=$kmsgpipe # start klogd as non-root with reading from kmsgpipe start-stop-daemon --start --quiet --chuid klog --exec $binpath -- $KLOGD I think that this exact solution can be easily ported to syslog-ng. Florian [1] http://lkml.indiana.edu/hypermail/linux/kernel/9806.3/0896.html [2] http://lkml.indiana.edu/hypermail/linux/kernel/9811.1/0073.html [3] http://readlist.com/lists/vger.kernel.org/linux-kernel/55/276838.html

2 1