- syslog-ng - lists.balabit.hu

log_disk_fifo_size() option
by Lucky Y 07 Apr '08

07 Apr '08

Hi, In which version of syslog-ng is this feature implemented ? Regards, Lucky

2 1

syslog-ng 2.0 release preparations
by Balazs Scheidler 07 Apr '08

07 Apr '08

Hi, I've forward ported some bugfixes from syslog-ng OSE 2.1 to 2.0. I've tried to backport only the critical and less intrusive ones. The changes are below: Balazs Scheidler (10): backported apphook framework as it is needed for a Solaris specific change Fixed door initialization on Solaris fixed possible segfault for non-existing optional source files Added Solaris 10 specific svc manager files fixed solaris packaging. Binary statically linked on Solaris 8/9, dynamically on 10. ported to FreeBSD fixed compilation problem on AIX 5.2 fixed compilation issue on freebsd, include stat.h in misc.c Fixed svc method script permissions and added an export to LD_LIBRARY_PATH added LD_LIBRARY_PATH to the svc manager method script The most problematic change is the apphook backport to fix Solaris door initialization, and any possible problems that would result in the portability fixes. You can get the latest release via git (git.balabit.hu) or by fetching tomorrow's snapshot. -- Bazsi

1 0

Read logs from file and send them to another host
by Jaime Ventura 04 Apr '08

04 Apr '08

Hello. I need to read logs from file and send them to another host. Thats pretty easy with syslog-ng. On the target host, i need to save them on a specific file. That is done by using the filters. And here's the problem, which filter to use? I mean, how can I specify a priority (local7, for instance) on the source host, in order to filter it on the destination? Thanks Jaime

1 0

2.0.9 Solaris 10 x86 compilation error: loggen/yylex issue
by Marvin.Nipper＠Stream.com 04 Apr '08

04 Apr '08

I see in the archives that someone else, in a prior version, had encountered the problem of not being able to get a good compile on Solaris 10, but I never saw any resolution to that issue. I'm having the same problem now with 2.0.9. The last request (from bazsi, in the email of Wed Mar 12 11:08:36 CET 2008) was to check the cfg-lex.c file, to ensure that it was not zero length. I checked mine, and it is 56023 in size (slightly larger than the one used with my successful 2.0.5 compilation). In short, I guess I'm just looking for some input/guidance as to what may not be "quite right" in 2.0.9, that would make it no longer compile on my server (where 2.0.5 obviously did compile). Any and all help appreciated! Obviously, I'll gladly feed you any files or information that would assist in problem solving. Below, is the portion of the make output at the point where things fall apart. As further input, I'm using libnet (for source-spoofing) and obviously using the most current EventLog (that hasn't changed since my 2.0.5 compilation). I'm using the glib components delivered with Solaris 10 (again, as was done in 2.0.5). THANKS for your input and help! Portion of the make that failed....... gcc -g -O2 -Wall -o loggen loggen.o -lpthread -lresolv -lnsl -lrt -lsocket -ldoor -lfl -lglib-2.0 -L/usr/local/lib -levtlog -lsocket -lnsl -lnet Undefined first referenced symbol in file yylex /usr/sfw/lib/gcc/i386-pc-solaris2.10/3.4.3/../../../libfl.so ld: fatal: Symbol referencing errors. No output written to loggen collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `loggen' Current working directory /var/opt/packages/syslog-ng-2.0.9/tests/loggen *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='unit functional loggen'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /var/opt/packages/syslog-ng-2.0.9/tests *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src tests doc contrib solbuild tgzbuild'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /var/opt/packages/syslog-ng-2.0.9 *** Error code 1 make: Fatal error: Command failed for target `all' Marvin Nipper Director of Security Stream mailto:marvin.nipper@stream.com PGP Key ID: 0x8EE28551 (DSS/DH) 8C5D 403A D107 0A95 672B B637 BCF1 919A 8EE2 8551

1 0

io.c: bind_inet_socket() bind failed Address already in use
by Lucky Y 04 Apr '08

04 Apr '08

> >We use syslog-ng 1.6.12 in RHEL4. > >As part of our system testing we restart syslog-ng 150 times in a loop > >along with other services in the server. > > > >syslog-ng fails to come up 3/4 times with the error : > >"io.c: bind_inet_socket() bind failed 192.168.128.1:601 >> Address already in use". >How do you restart syslog-ng? It takes some time to close sources/ >destinations and there is a chance that the new syslog-ng instance >tries to bind to the same address the not-yet-stopped instance >still uses. SIGKILL will be sent to the process, and then syslog-ng will be started again. Some example messages seen in the syslog during the restart are: INFO Process PID = 7216 is killed, signal SIGKILL sent successfully, path = /opt/bin/syslog-ng -F -p /var/run/master-syslog-ng.pid -f /etc/syslog-ng.conf. io.c: do_write: write() failed (errno 32), Broken pipe syslog-ng[6242]: pkt_buffer::do_flush(): Error flushing data syslog-ng[6242]: Connection broken to AF_INET(Server:601), reopening in 5 seconds INFO Process, PID = 7216, is signaled, signal number = 9, path = /opt/bin/syslog-ng -F -p /var/run/master-syslog-ng.pid -f /etc/syslog-ng.conf INFO Send start process command, process name: /MasterSyslogDaemon INFO A process started, pid:30573, process:/opt/bin/syslog-ng -F -p /var/run/master-syslog-ng.pid -f /etc/syslog-ng.conf INFO Process, PID = 30573, exit abnormally, exit code = 2, path = /bin/syslog-ng -F -p /var/run/master-syslog-ng.pid -f /etc/syslog-ng.conf INFO Reporting termination of process /MasterSyslogDaemon INFO Termination of process MasterSyslogDaemon reported io.c: bind_inet_socket() bind failed 192.168.128.1:601 Address already in use

1 0

io.c: bind_inet_socket() bind failed Address already in use
by Lucky Y 04 Apr '08

04 Apr '08

Hi, We use syslog-ng 1.6.12 in RHEL4. As part of our system testing we restart syslog-ng 150 times in a loop along with other services in the server. syslog-ng fails to come up 3/4 times with the error : "io.c: bind_inet_socket() bind failed 192.168.128.1:601 Address already in use". Is this a known problem in syslog-ng 1.6.12 ? Or is it a configuration problem ? Part of the syslog-ng.conf : # Options ######################################################## options { log_fifo_size(15000); stats(86400); time_reopen(5); log_msg_size(65536); }; # Source definitions ############################################## source src { tcp(ip("Server") port(601) keep-alive(yes) max-connections(100)); udp(ip("Server") port(514)); unix-stream("/dev/master_log"); internal(); };

2 1

changing the location of the disk buffer for log_disk_fifo_size()
by Lucky Y 03 Apr '08

03 Apr '08

On Thu, 2008-04-03 at 12:16 +0300, Lucky Y wrote: > >Hi, > > > >Is there anyway to change the location of the disk buffer for > >log_disk_fifo_size() ? > > > >It buffers the messages in /var/lib/syslog-ng/ by default in Linux, > >but in our system this directory will not exist. >Not currently, however I plan to add functionality that will cause >syslog-ng to use the same directory as specified by the --persist-file >switch. >Would that be ok for you? It will be very useful if we can specify the directory to store the buffered messages itself. _Lucky

1 0

Unable to run several syslog-ng instances using file source driver file position persistence
by Andreas Kurz 01 Apr '08

01 Apr '08

Hello! I am using syslog-ng 2.0.8 (and tested 2.0.9 to see if it includes the feature...) and found out that there is still no cmdline option to define the path/name of the "syslog-ng.persist" file (like for the pid/conf file). So it is not possible to easy run several Instances of syslog-ng using the file source driver on the same machine and store the file positions beyond syslog-ng restarts ... e.g. in a cluster environment .... or did I miss a hidden config option? There was already a discussion about this some months ago. Is there a special reason, why this feature is not integrated in syslog-ng or is there only too less demand for such a feature? Regards, Andreas

2 3

Re: [syslog-ng] TAG-Macro
by JUNG, Christian 31 Mar '08

31 Mar '08

Hi, the signed CLA is on the way. And here's a summary of the patch in GNU ChangeLog format: ---8<--- 2008-03-27 Christian Jung <christian.jung(a)saarstahl.com> * macros.c: added support for BSD-style facility/priority tag. A BSD-style tag consists of a digit encoding the priority (0-7) and a letter (A-X) encoding the facility. The new macro is called 'BSDTAG'. * syslog-names.c: added struct sl_bsdtag_facilities. ---8<--- bye Chris > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of > Balazs Scheidler > Sent: Thursday, March 27, 2008 1:55 PM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] TAG-Macro > > > Thanks for your contribution. Could you please submit a signed > "Contributory License Agreement" via FAX to us, as described here: > > http://www.balabit.com/network-security/syslog-ng/opensource-l > ogging-system/contribution/ > > Thanks in advance, and sorry for the legal hassles. > > > On Thu, 2008-03-27 at 13:49 +0100, JUNG, Christian wrote: > > > -----Original Message----- > > > From: syslog-ng-bounces(a)lists.balabit.hu > > > [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of > > > Balazs Scheidler > > > Sent: Tuesday, March 18, 2008 12:46 PM > > > To: Syslog-ng users' and developers' mailing list > > > Subject: Re: [syslog-ng] TAG-Macro > > > > > > Something like BSDTAG? > > > > > > > Attached is a patch to the 2.0.9 source tree of syslog-ng > which implements the "BSDTAG" macro. > > > > > > bye > > Chris > > > ______________________________________________________________ > ________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > -- Bazsi ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1

AIX startup
by Brian Loe 27 Mar '08

27 Mar '08

Okay, my syslog-ng instance died at some point last night and because I don't have it setup properly for respawning... Can anyone running syslog-ng on AIX 5.* give me some tips for this? I'm feeding pipes so i have to start instances of SEC as soon as I start syslog-ng - but the SEC scripts appear to "close" so if they're configured to respawn I'll have 2000 instances of them in an hour.

7 21

Unpredictable log output when message has many newlines
by Jean-Baptiste Quenot 26 Mar '08

26 Mar '08

Hi there, Thanks for the great syslog-ng program, it rocks. I have a step-by-step recipe below that yields unpredictable results in the syslog output, and this worries me a bit as in my company we have similar messages sent to syslog by PHP's print_r() function. The example is simplified to a message that consists of 40 occurences of an incrementing number, with a newline separating each number. Let's call it syslog_overflow.txt: ------------------------------------------------------------------------ 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 ------------------------------------------------------------------------ Now let's send this message repeatedly using a simple Perl script. Let's call it syslog_overflow.pl: ------------------------------------------------------------------------ #!/usr/bin/perl use Sys::Syslog qw( :DEFAULT setlogsock ); setlogsock('unix'); # First argument is program name, used for passing vhost openlog(@ARGV[0], 'cons,pid', 'user'); $log = `cat syslog_overflow.txt`; while (1) { syslog('notice', $log); } closelog ------------------------------------------------------------------------ Run this script, and watch the syslog output, while filtering out the expected message, where newlines are converted to spaces: tail -f /var/log/syslog | grep -v ': 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39' You will notice unpredictable results like this: ------------------------------------------------------------------------ Mar 16 16:17:42 dockee jbq[12563]: 0 Mar 16 16:17:42 dockee 1 Mar 16 16:17:42 dockee 2 Mar 16 16:17:42 dockee 3 Mar 16 16:17:42 dockee 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 Mar 16 16:17:42 dockee jbq[12563]: 0 Mar 16 16:17:42 dockee 1 Mar 16 16:17:42 dockee 2 Mar 16 16:17:42 dockee 3 Mar 16 16:17:42 dockee 4 Mar 16 16:17:42 dockee 5 Mar 16 16:17:42 dockee 6 Mar 16 16:17:42 dockee 7 Mar 16 16:17:42 dockee 8 Mar 16 16:17:42 dockee 9 Mar 16 16:17:42 dockee 10 Mar 16 16:17:42 dockee 11 Mar 16 16:17:42 dockee 12 Mar 16 16:17:42 dockee 13 Mar 16 16:17:42 dockee 14 Mar 16 16:17:42 dockee 15 Mar 16 16:17:42 dockee 16 Mar 16 16:17:42 dockee 17 Mar 16 16:17:42 dockee 18 ------------------------------------------------------------------------ I could reproduce this behaviour easily on various hosts, with syslog-ng 2.0.0 up to 2.0.8 from a fresh git checkout. However, this problem does not appear with the legacy syslog daemon. I'd be glad to provide more details if necessary. I tried to fiddle with the various options: log_fetch_limit, log_msg_size, with no luck. I also activated the various debugging features and had a look at logreader.c, but couldn't find anything obvious. The only noteworthy debugging output I could get is the one below, which means the bogus lines are already present on the logreader side: ------------------------------------------------------------------------ Incoming log entry; line='<13>Mar 16 16:33:36 jbq[12638]: 0' Incoming log entry; line='1' Incoming log entry; line='2' Incoming log entry; line='3' Incoming log entry; line='4\x0a5\x0a6\x0a7\x0a8\x0a9\x0a10\x0a11\x0a12\x0a13\x0a14\x0a15\x0a16\x0a17\x0a18\x0a19\x0a20\x0a21\x0a22\x0a23\x0a24\x0a25\x0a26\x0a27\x0a28\x0a29\x0a30\x0a31\x0a32\x0a33\x0a34\x0a35\x0a36\x0a37\x0a38\x0a39\x0a' ------------------------------------------------------------------------ Thanks in advance for your help, -- Jean-Baptiste Quenot http://caraldi.com/jbq/blog/

3 10

Timezone question
by Frank Wilkinson 25 Mar '08

25 Mar '08

Hi, I run syslog-ng 2.0 on RH el4. the local time zone here is CDT My template is: destination d_localhost { file("/logs/local_host/$FACILITY-$YEAR-$MONTH-$DAY.log" template("$DATE $HOST $MSG [recv-frm:$SOURCEIP $R_ISODATE $S_ISODATE $TZ dte:$R_DATE $FACILITY.$LEVEL] \n"); }; The log data is: Mar 25 15:01:01 sopher crond[31974]: (root) CMD (run-parts /etc/cron.hourly) [recv-frm:127.0.0.1 2008-03-25T15:01:01+05:00 2008-03-25T15:01:01+05:00 -05:00 dte:Mar 25 15:01:01 cron.info] Why do I have +05:00 in the ISODATES : $R_ISODATE: 2008-03-25T15:01:01+05:00 $S_ISODATE: 2008-03-25T15:01:01+05:00 When TZ is right? $TZ: -05:00 -frank-

2 1

syslog-ng 2.0.9 has been released
by devel＠balabit.hu 25 Mar '08

25 Mar '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.9 SUMMARY : new stable release DATE : Mar 25, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.9) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.9 Sun, 23 Mar 2008 21:36:47 +0100 Bugfixes: * Fixed handling more than 256 destinations by changing the reference counter type of LogMessages to a 16 bit value. * Fixed a possible SIGABRT crash if the hosts file passed to dns-cache-hosts() had multiple entries with the same IP address. * Fixed a possible crash during startup if "-g" was specified without using "-u". BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

1 0

Configuring syslog-ng clients to log to a regular syslogd central log server
by Malcolm Heath 23 Mar '08

23 Mar '08

Hello, My company is planning on deploying syslog-ng as the default syslog daemon on our client images. However, we have a requirement that these machines log to a central log server owned by another group, running the regular syslog daemon. While there are plans in the works to move these central log servers to syslog-ng, our deployment timelines do not line up, so I need to figure out a way to have the syslog-ng clients send logs to the central hosts, without having to upgrade them. As near as I can tell, this should be no problem, using a destination driver of the udp() type on the clients. This assumes that the message sent will be in a format that the syslogd can understand. Could someone here confirm this for me? Thanks. Malcolm

2 1

Re: [syslog-ng] loop caused by syslog-ng filter
by JUNG, Christian 20 Mar '08

20 Mar '08

Hi Adam, syslog-ng does the right thing :-). It starts the program/script once and pipes on STDIN every log-message which matches the filter. If your script is started, it will call mail and pipe "Alert, priority 1" to its STDIN and then exits. syslog-ng sees this and restarts it (version 2.0 or higher behave that way, see <http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/ch09s02.html#r…>). For you purpose this would be better: ---8<--- #!/bin/bash while read LINE; do cat <<-EOF | mail -s "High Priority Snort Alert" Sub-Zero(a)xxx.de Alert, Priority 1 $LINE EOF done ---8<--- bye Chris > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of Adam Richter > Sent: Thursday, March 20, 2008 9:23 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] loop caused by syslog-ng filter > > > Hi! > > First off, sorry for my poor english! > I have a problem with a loop caused by syslog-ng v. 2.0.8. I > have set up Snort as an IDS System. Snort writes its messages > in unified-format to /var/log/snort/snort.alert and > /var/log/snort/snort.log. There are two Barnyard processes > which read the unified files and convert it to messages that > syslog and MySQL understand. Syslog-ng writes the messages > to /var/log/auth.log. All this is working fine. Now, I want > to set up a filter for Priority 1 alerts. This alert should > be send to the Administrator. > > I used following filter for syslog-ng: > > source src {unix-stream("/dev/log"); internal();}; > destination email{program("/usr/local/bin/alert_mail.sh");}; > filter high {match("[Priority: 1]");}; > log {source(src);filter(high); destination(email);}; > > > The alert_mail.sh: > > #!/bin/sh > cat << EOF | mail -s "High Priority Snort Alert" Sub-Zero(a)xxx.de > Alert, Priority 1 > EOF > > > Then I use Nessus to cause some alerts with Priority 1. I can > see 4 alerts with the Priority 1 with BASE and in /var/log/auth.log. > > Syslog-ng recognises the alert with Priority 1 and activates > the script /usr/local/bin/alert_mail.sh > > All this is working, but the script is restarted by syslog-ng > again an again. > > Extract from /var/log/messages: > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > status='0' > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination > program; cmdline='/usr/local/bin/alert_mail.sh ' > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Closing log writer > fd; fd='11' > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > status='0' > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination > program; cmdline='/usr/local/bin/alert_mail.sh ' > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > status='0' > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination > program; cmdline='/usr/local/bin/alert_mail.sh ' > … > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > status='256' > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Starting > destination program; cmdline='/usr/local/bin/alert_mail.sh ' > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > status='256' > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Starting > destination program; cmdline='/usr/local/bin/alert_mail.sh ' > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program > exited, restarting; > > … > > > I get thousands of mails per minute till I stop syslog-ng. > > Output of /var/log/auth.log(so y see that syslog-ng writes > snort/barnyard messages correctly to auth.log): > > Mar 19 13:56:54 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > x86 NOOP [Classification: Executable code was detected] > [Priority: 1] {UDP} 172.25.1.152:4758 -> 172.28.100.10:137 > Mar 19 13:57:13 src@Sensor1 barnyard: [1:1446:8] SMTP vrfy > root [Classification: Attempted Information Leak] [Priority: > 2] {TCP} 172.25.1.152:1085 -> 172.28.100.10:25 > Mar 19 13:57:13 src@Sensor1 barnyard: [1:660:11] SMTP expn > root [Classification: Attempted Information Leak] [Priority: > 2] {TCP} 172.25.1.152:1085 -> 172.28.100.10:25 > Mar 19 13:57:22 src@Sensor1 barnyard: [1:12626:2] Snort Alert > [1:12626:0] [Classification: Decode of an RPC Query] > [Priority: 2] {UDP} 172.25.1.152:1146 -> 172.28.100.10:111 > Mar 19 13:57:22 src@Sensor1 barnyard: [1:585:9] RPC portmap > sadmind request UDP [Classification: Decode of an RPC Query] > [Priority: 2] {UDP} 172.25.1.152:1146 -> 172.28.100.10:111 > Mar 19 13:57:24 src@Sensor1 barnyard: [1:566:6] POLICY > PCAnywhere server response [Classification: Misc activity] > [Priority: 3] {UDP} 172.25.1.152:1155 -> 172.28.100.10:5632 > Mar 19 15:11:27 src@Sensor1 barnyard: [122:1:0] portscan: TCP > Portscan [Classification: Unknown] [Priority: 3] {PROTO255} > 172.25.1.152 -> 172.28.100.10 > Mar 19 15:11:58 src@Sensor1 barnyard: [1:1420:13] SNMP trap > tcp [Classification: Attempted Information Leak] [Priority: > 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:162 > Mar 19 15:11:58 src@Sensor1 barnyard: [1:1418:13] SNMP > request tcp [Classification: Attempted Information Leak] > [Priority: 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:161 > Mar 19 15:12:05 src@Sensor1 barnyard: [1:1421:13] SNMP > AgentX/tcp request [Classification: Attempted Information > Leak] [Priority: 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:705 > Mar 19 15:12:16 src@Sensor1 barnyard: [122:1:0] portscan: TCP > Portscan [Classification: Unknown] [Priority: 3] {PROTO255} > 172.25.1.152 -> 172.28.100.10 > Mar 19 15:12:19 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > x86 NOOP [Classification: Executable code was detected] > [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 > Mar 19 15:12:20 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > x86 NOOP [Classification: Executable code was detected] > [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 > Mar 19 15:12:22 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > x86 NOOP [Classification: Executable code was detected] > [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 > > > I think it has something in common with this topic: > > https://lists.balabit.hu/pipermail/syslog-ng/2006-October/009454.html > > Thanks in advance! > > Sub-Zero > > > -- > GMX startet ShortView.de. Hier findest Du Leute mit Deinen Interessen! > Jetzt dabei sein: http://www.shortview.de/?mc=sv_ext_mf@gmx > ______________________________________________________________ > ________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1

loop caused by syslog-ng filter
by Adam Richter 20 Mar '08

20 Mar '08

Hi! First off, sorry for my poor english! I have a problem with a loop caused by syslog-ng v. 2.0.8. I have set up Snort as an IDS System. Snort writes its messages in unified-format to /var/log/snort/snort.alert and /var/log/snort/snort.log. There are two Barnyard processes which read the unified files and convert it to messages that syslog and MySQL understand. Syslog-ng writes the messages to /var/log/auth.log. All this is working fine. Now, I want to set up a filter for Priority 1 alerts. This alert should be send to the Administrator. I used following filter for syslog-ng: source src {unix-stream("/dev/log"); internal();}; destination email{program("/usr/local/bin/alert_mail.sh");}; filter high {match("[Priority: 1]");}; log {source(src);filter(high); destination(email);}; The alert_mail.sh: #!/bin/sh cat << EOF | mail -s "High Priority Snort Alert" Sub-Zero(a)xxx.de Alert, Priority 1 EOF Then I use Nessus to cause some alerts with Priority 1. I can see 4 alerts with the Priority 1 with BASE and in /var/log/auth.log. Syslog-ng recognises the alert with Priority 1 and activates the script /usr/local/bin/alert_mail.sh All this is working, but the script is restarted by syslog-ng again an again. Extract from /var/log/messages: Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', status='0' Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination program; cmdline='/usr/local/bin/alert_mail.sh ' Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Closing log writer fd; fd='11' Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', status='0' Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination program; cmdline='/usr/local/bin/alert_mail.sh ' Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', status='0' Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination program; cmdline='/usr/local/bin/alert_mail.sh ' … Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', status='256' Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Starting destination program; cmdline='/usr/local/bin/alert_mail.sh ' Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', status='256' Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Starting destination program; cmdline='/usr/local/bin/alert_mail.sh ' Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program exited, restarting; … I get thousands of mails per minute till I stop syslog-ng. Output of /var/log/auth.log(so y see that syslog-ng writes snort/barnyard messages correctly to auth.log): Mar 19 13:56:54 src@Sensor1 barnyard: [1:1394:8] SHELLCODE x86 NOOP [Classification: Executable code was detected] [Priority: 1] {UDP} 172.25.1.152:4758 -> 172.28.100.10:137 Mar 19 13:57:13 src@Sensor1 barnyard: [1:1446:8] SMTP vrfy root [Classification: Attempted Information Leak] [Priority: 2] {TCP} 172.25.1.152:1085 -> 172.28.100.10:25 Mar 19 13:57:13 src@Sensor1 barnyard: [1:660:11] SMTP expn root [Classification: Attempted Information Leak] [Priority: 2] {TCP} 172.25.1.152:1085 -> 172.28.100.10:25 Mar 19 13:57:22 src@Sensor1 barnyard: [1:12626:2] Snort Alert [1:12626:0] [Classification: Decode of an RPC Query] [Priority: 2] {UDP} 172.25.1.152:1146 -> 172.28.100.10:111 Mar 19 13:57:22 src@Sensor1 barnyard: [1:585:9] RPC portmap sadmind request UDP [Classification: Decode of an RPC Query] [Priority: 2] {UDP} 172.25.1.152:1146 -> 172.28.100.10:111 Mar 19 13:57:24 src@Sensor1 barnyard: [1:566:6] POLICY PCAnywhere server response [Classification: Misc activity] [Priority: 3] {UDP} 172.25.1.152:1155 -> 172.28.100.10:5632 Mar 19 15:11:27 src@Sensor1 barnyard: [122:1:0] portscan: TCP Portscan [Classification: Unknown] [Priority: 3] {PROTO255} 172.25.1.152 -> 172.28.100.10 Mar 19 15:11:58 src@Sensor1 barnyard: [1:1420:13] SNMP trap tcp [Classification: Attempted Information Leak] [Priority: 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:162 Mar 19 15:11:58 src@Sensor1 barnyard: [1:1418:13] SNMP request tcp [Classification: Attempted Information Leak] [Priority: 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:161 Mar 19 15:12:05 src@Sensor1 barnyard: [1:1421:13] SNMP AgentX/tcp request [Classification: Attempted Information Leak] [Priority: 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:705 Mar 19 15:12:16 src@Sensor1 barnyard: [122:1:0] portscan: TCP Portscan [Classification: Unknown] [Priority: 3] {PROTO255} 172.25.1.152 -> 172.28.100.10 Mar 19 15:12:19 src@Sensor1 barnyard: [1:1394:8] SHELLCODE x86 NOOP [Classification: Executable code was detected] [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 Mar 19 15:12:20 src@Sensor1 barnyard: [1:1394:8] SHELLCODE x86 NOOP [Classification: Executable code was detected] [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 Mar 19 15:12:22 src@Sensor1 barnyard: [1:1394:8] SHELLCODE x86 NOOP [Classification: Executable code was detected] [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 I think it has something in common with this topic: https://lists.balabit.hu/pipermail/syslog-ng/2006-October/009454.html Thanks in advance! Sub-Zero -- GMX startet ShortView.de. Hier findest Du Leute mit Deinen Interessen! Jetzt dabei sein: http://www.shortview.de/?mc=sv_ext_mf@gmx

1 0

Re: [syslog-ng] syslog to java
by JUNG, Christian 18 Mar '08

18 Mar '08

Hi Andrea, in my opinion the best way would be to use the "program" destination. There you could call a java-application which reads the log from standard input and puts the messages in the java-based log system: destination java_log_system { program("/path/to/java-connector" template("<$PRI>$DATE $HOST $MSG\n")); }; log { source(src); destination(java_log_system); }; With named pipes you've got the problem, that they won't block after the first read anymore (that's the way they behave under Linux). So your app would use a lot of CPU-cycles for nothing. syslog-ng will restart your app if it receives a HUP signal. bye Chris -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of Andrea Shore Sent: Tuesday, March 18, 2008 3:21 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog to java Hi, I've seen a lot of information on the web for logging from Log4j to syslog. I have a requirement to do the opposite; redirect syslog logs to a Java-based logging system. Does anyone have any ideas about how this could most effectively be accomplished? A production quality solution is required. Is a Java process reading from a named piped the best way to go about this? Thanks a lot for your help, Andrea

3 2

syslog to java
by Andrea Shore 18 Mar '08

18 Mar '08

Hi, I've seen a lot of information on the web for logging from Log4j to syslog. I have a requirement to do the opposite; redirect syslog logs to a Java-based logging system. Does anyone have any ideas about how this could most effectively be accomplished? A production quality solution is required. Is a Java process reading from a named piped the best way to go about this? Thanks a lot for your help, Andrea

1 0

TAG-Macro
by JUNG, Christian 18 Mar '08

18 Mar '08

Hello, we've been using the old BSD-implementation of syslogd on linux for quite a while and want to migrate to Syslog NG now. We've got the problem, that the priority/facility-encoding of the $TAG macro isn't the same as running syslogd with option -S. Here an excerpt of syslogd's man-page: ---8<--- The priority/facility code takes the form of a priority number followed by a letter that indicates the facility. The priority number can range from 0 to 7. The facility letter can range from 'A' to 'Y', where 'A' corresponds to facility number zero (LOG_KERN), 'B' corresponds to facility 1 (LOG_USER), etc. See /usr/include/sys/syslog.h for a list of priority and LOG_xxx codes. Example: Jun 27 19:22:20 5Q:silence test[1966]: testing The above message contains a priority/facility code of '5Q', which breaks down to a priority of 5 (LOG_NOTICE) and a facility of 16 (LOG_LOCAL0). ---8<--- I'd like to add this functionality to syslog-ng because this encoding is more suitable for log-analysis etc. as the hexadecimal format. Should I use a different macro-name (if yes: which?) or should I modify the TAG part in macro.c? bye Chris -- phone: +49 6898/10-4987 web : www.saarstahl.de mail : Hofstattstraße 106a D 66333 Voelklingen

2 1

Troubleshooting local5.* output
by Sean Carolan 17 Mar '08

17 Mar '08

I am trying to troubleshoot some syslog servers that are not properly sending local5.* logs to a remote syslog-ng server. The syslog-ng server is behaving as it should, and I am able to do this from remote hosts: $ logger -p local5.info "My test message here" This message is correctly written to the local log and remote syslog-ng server. The filters on the syslog-ng box work correctly and the entry is made in the right file for the host. But there is one file on the client, /var/log/mylogfile.log that is being filled up by a running java process. Messages that are written to this file are *not* being sent to the remote server. I ran tcpdump and verified that there are no network packets accompanying these log entries. So, maybe someone can help me. How do I find out how this java process is writing to the log file, and why are messages not being forwarded to the remote host? lsof shows that the only process that has the /var/log/mylogfile.log open is the syslog daemon. Here are some configuration files if it helps: SERVER: /etc/syslog-ng/syslog-ng.conf (excerpt below) options { log_fifo_size(8192); # garden gnomes shouldn't log (Gnome has a buggy log implementation) # needs to be set on client systems, too... bad_hostname("gconfd"); use_time_recvd(no); group(logs); create_dirs(yes); dir_group(logs); dir_perm(0750); perm(0640); chain_hostnames(no); keep_hostname(yes); stats(3600); use_fqdn(yes); }; source syslog { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(5149) max-connections(300)); internal(); }; destination mylogfile.log { file(/var/log/syslog-ng/$HOST/mylogfile.log); }; destination boot.log { file(/var/log/syslog-ng/$HOST/boot.log); }; filter f_local7 { facility(local7); }; filter f_local5 { facility(local5); }; log { source(syslog); filter(f_local7); destination(boot.log); }; log { source(syslog); filter(f_local5); destination(mylogfile.log); }; CLIENT /etc/syslog.conf excerpt *.* @syslogngbox local7.* /var/log/boot.log local5.* /var/log/mylogfile.log

2 3

Repeated log messages?
by John Morrissey 17 Mar '08

17 Mar '08

Recently, we've noticed a few machines are filling up their log filesystems with duplicate log entries. At first, I thought this behavior was caused by running out of disk space (i.e., the machine runs out of disk and syslog-ng does some sort of buffering, and as disk space oscellates between a few hundred bytes available and completely full, syslog-ng is writing this buffered log data out to disk but never removing the log entries from its buffer), but I can't reliably reproduce it. I also noticed that sometimes this would happen when the remote syslog sub was unavailable, but I can't reliably reproduce this behavior by blocking UDP syslog traffic directed at the remote syslog hub. I'd also wonder how syslog-ng would know that UDP syslog traffic is being dropped, unless the nature of the traffic block is such that an ICMP message (host/port unreachable, etc.) is returned to the sending host. I've poked and prodded at syslog-ng, attempting to reliably reproduce this behavior, but haven't been able to. I'm not sure if either of these two events (out of disk space, loss of network access to the syslog hub) are simple coincidences or actually cause/contribute to the behavior. The odd part is that the duplicate log entries seem to be logged forever, such as if syslog-ng was in an infinite loop. Additionally, each duplicate log entry has an additional space each time it's duplicated. For example: Original log entries: Feb 12 06:28:12 rdr01 su[21942]: Successful su for nobody by root Feb 12 06:28:12 rdr01 su[21942]: + ??? root:nobody First round of duplicates, with a single trailing space: Feb 12 06:28:12 localhost su[21942]: Successful su for nobody by root Feb 12 06:28:12 localhost su[21942]: + ??? root:nobody Second round of duplicates, with two trailing spaces: Feb 12 06:28:12 localhost su[21942]: Successful su for nobody by root Feb 12 06:28:12 localhost su[21942]: + ??? root:nobody Third round of duplicates, with three trailing spaces: Feb 12 06:28:12 localhost su[21942]: Successful su for nobody by root Feb 12 06:28:12 localhost su[21942]: + ??? root:nobody [and so on] This is with syslog-ng 2.0.0-1etch1. john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

3 4

Can't compile 2.0.8 on Solaris 10
by Ralf Weber 13 Mar '08

13 Mar '08

Moin! I am having problems compiling syslog-ng under Solaris 10 both sparc and intel. The error is as follows: /usr/sfw/bin/gcc -g -O2 -Wall -o loggen loggen.o -lpthread - lresolv -lnsl -lrt -lsocket -ldoor -lfl -lglib-2.0 -L/opt/sfw/lib - levtlog Undefined first referenced symbol in file yylex /usr/sfw/lib/gcc/sparc-sun- solaris2.10/3.4.3/../../../libfl.so ld: fatal: Symbol referencing errors. No output written to loggen Now I did search the archive and there was one message of relevance: https://lists.balabit.hu/pipermail/syslog-ng/2006-February/008455.html but the problem there was an empty cfg-lex.c which isn't the case for me: rw@bh2:~/source/syslog-ng-2.0.8$ ls -l src/cfg-lex.* -rw-r--r-- 1 rw ipeng 55895 Jan 31 12:46 src/cfg-lex.c -rw-r--r-- 1 rw ipeng 8979 Dec 18 16:25 src/cfg-lex.l -rw-rw-r-- 1 rw ipeng 51404 Mar 11 13:36 src/cfg-lex.o There is however one thing strange in an earlier stage of the compile which is: if /usr/sfw/bin/gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/ glib-2.0 -I/usr/lib/glib-2.0/include -I/opt/sfw/include/eventlog - D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall - MT cfg-grammar.o -MD -MP -MF ".deps/cfg-grammar.Tpo" \ -c -o cfg-grammar.o `test -f 'cfg-grammar.c' || echo './'`cfg- grammar.c; \ then mv -f ".deps/cfg-grammar.Tpo" ".deps/cfg-grammar.Po"; \ else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg- grammar.y: In function `yyparse': /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg- grammar.y:891: warning: implicit declaration of function `strdup' However including <string.h> where this is in also didn't help. Any help on getting this compiled would be appreciated. So long -Ralf

3 7

Re: [syslog-ng] Syslog-ng 2.0.x on Fedora Core 4
by Ivey, Chris 12 Mar '08

12 Mar '08

OK, so I think I see my issue... I have the "FC8" version... how do I go about installing syslog-ng 2.0.8 on FC4 (or FC5, for that matter)? Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Ivey, Chris Sent: Wednesday, March 12, 2008 2:30 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0.x on Fedora Core 4 Hi ScottO, I got pulled away from this onto a different project, and can now move back to it again. Here is what I get when I try to use RPM to install the application: [root@tahoe ~]# rpm -ivh syslog-ng-2.0.8-1.fc8.i386.rpm warning: syslog-ng-2.0.8-1.fc8.i386.rpm: Header V3 DSA signature: NOKEY, key ID ed00d312 error: Failed dependencies: rtld(GNU_HASH) is needed by syslog-ng-2.0.8-1.fc8.i386 I checked and made sure that rtld shows up on my machine... [root@tahoe ~]# rpm -qv glibc glibc-2.4-4 Any help would be GREATLY appreciated, so that I can move forward on this effort. Thanks!!!! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO Sent: Monday, March 03, 2008 8:23 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0.x on Fedora Core 4 What's the error? On Mon, Mar 3, 2008 at 8:13 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com <mailto:Chris.ivey@acs-inc.com> > wrote: Sandor/ScottO, Thanks for the information that it works properly on old releases. If I could trouble you guys for *how* you made it work, that would be great. I did some testing using my personal Linux machine (FC5), and I could not get the application to install (could not find all the needed preliminaries). If you want to PM me for this, that would be fine, since I am sure the rest of the list does not need to be exposed to my lack of knowledge. (( For what it's worth - I inherited these machines, had nothing to do with the original setup/configuration, and now find myself as the owner/admin of an application I don't know much about. )) Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage On Mon, Mar 3, 2008 at 4:42 AM, Geller, Sandor (IT) <Sandor.Geller(a)morganstanley.com <mailto:Sandor.Geller@morganstanley.com> > wrote: Hi, > Folks, > I need to upgrade syslog-ng running on my 2 servers, > which are running Fedora Core 4. Is it possible to put 2.0.x > onto a machine running FC4? I was looking around this morning > for this information, and can't find anything that says "yay" > or "nay". Thanks! It should just work (TM). I'm using syslog-ng 2.0 on very old OS releases, all you might need is to install its requirements: eventlog, libnet, glib and optionally tcp-wrappers. Regards, Sandor -------------------------------------------------------- Agreed, fwiw, I have it working just fine on FC3. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu <mailto:syslog-ng@lists.balabit.hu> https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

Re: [syslog-ng] Syslog-ng 2.0.x on Fedora Core 4
by Ivey, Chris 12 Mar '08

12 Mar '08

Hi ScottO, I got pulled away from this onto a different project, and can now move back to it again. Here is what I get when I try to use RPM to install the application: [root@tahoe ~]# rpm -ivh syslog-ng-2.0.8-1.fc8.i386.rpm warning: syslog-ng-2.0.8-1.fc8.i386.rpm: Header V3 DSA signature: NOKEY, key ID ed00d312 error: Failed dependencies: rtld(GNU_HASH) is needed by syslog-ng-2.0.8-1.fc8.i386 I checked and made sure that rtld shows up on my machine... [root@tahoe ~]# rpm -qv glibc glibc-2.4-4 Any help would be GREATLY appreciated, so that I can move forward on this effort. Thanks!!!! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO Sent: Monday, March 03, 2008 8:23 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0.x on Fedora Core 4 What's the error? On Mon, Mar 3, 2008 at 8:13 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com <mailto:Chris.ivey@acs-inc.com> > wrote: Sandor/ScottO, Thanks for the information that it works properly on old releases. If I could trouble you guys for *how* you made it work, that would be great. I did some testing using my personal Linux machine (FC5), and I could not get the application to install (could not find all the needed preliminaries). If you want to PM me for this, that would be fine, since I am sure the rest of the list does not need to be exposed to my lack of knowledge. (( For what it's worth - I inherited these machines, had nothing to do with the original setup/configuration, and now find myself as the owner/admin of an application I don't know much about. )) Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage On Mon, Mar 3, 2008 at 4:42 AM, Geller, Sandor (IT) <Sandor.Geller(a)morganstanley.com <mailto:Sandor.Geller@morganstanley.com> > wrote: Hi, > Folks, > I need to upgrade syslog-ng running on my 2 servers, > which are running Fedora Core 4. Is it possible to put 2.0.x > onto a machine running FC4? I was looking around this morning > for this information, and can't find anything that says "yay" > or "nay". Thanks! It should just work (TM). I'm using syslog-ng 2.0 on very old OS releases, all you might need is to install its requirements: eventlog, libnet, glib and optionally tcp-wrappers. Regards, Sandor -------------------------------------------------------- Agreed, fwiw, I have it working just fine on FC3. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu <mailto:syslog-ng@lists.balabit.hu> https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

Solaris 10 non-global zone & syslog-ng performance question.
by Surlow, Jim 12 Mar '08

12 Mar '08

Folks, I'm a newbie to syslog-ng. Everything is working in my environment, running 2.0.8. But, when I try to stress the server I drop messages. I'm running from another physical server: ./loggen -D -s 111 -r 2000 -I 1 <hostname> 514 ; date average rate = 1818.00 msg/sec, count=1818 Thu Mar 6 18:07:17 MST 2008 The syslog-ng server is in a Solaris 10 non-global zone; my auth.info is going to /var/adm/ssh_DAY.log. date ; tail /var/adm/ssh_06.log | awk '/runid/ {print $9}' | sort -u | xargs -i egrep {} /var/adm/ssh_06.log | wc -l Thu Mar 6 18:07:23 MST 2008 1233 So, I'm dropping packets. I've stopped syslog-ng and started standard syslog. Syslog logs all my messages to the file when using a rate of 2000/sec. As you can from above, in my syslog-ng environment I lose about a 3rd. When I use a rate of 1000/sec, it is not quite as bad, but I do drop a significant amount of messages. I've read: http://www.l3jane.net/doc/server/syslog-ng/#tuning I've toyed with log_fifo_size (using values like 1000, 5000, 10000, 50000) log_fetch_limit (using values like 100, 200, 2000) sync (using values like 20, 40, 50, 100) I have "use_dns (no)" - turning that off first. Also, I commented out all but two sources, the one filter, the one log line. source s_ip148 { udp (ip(<x>.<y>.<z>.148)); }; source s_ip248 { udp (ip(<x>.<y>.<z>.248)); }; <x>, <y>, <z> are obviously replace in our environment with the octets for the subnet. Before trying standard syslog, I was running snoop in my global zone to ensure all the UDP packets were arriving. The count always matched the count shown by loggen. Since I can see all the messages with standard syslog in this Sol 10 non-global zone, I've ruled out: * the zone being an issue. * UDP tuning for the Solaris 10 host. * The internal hard drive i/o speed from being an issue. Looking at the log messages, I'm not hitting some cap (e.g. 1233) and then not logging any more. Random gaps (both of frequency and size) are seen throughout. Can someone give me some pointers? Thanks in advance, Jim

2 2