- syslog-ng - lists.balabit.hu

spams
by Balazs Scheidler 27 Nov '07

27 Nov '07

Hi, We've had a minor spam issue, but I supposedly fixed it, so no more spam messages should be posted here. -- Bazsi

1 0

Confirm bre1tling 0rder 2980038
by Priscilla Shipman 27 Nov '07

27 Nov '07

Hello, We have brand new model of r0lex yachtmaster II from 2008 for only $229. 15% off only in November. V1sit us n0w at: http://www.spokkilee.com/

1 0

syslog-ng's enigmatic logging behavior ?
by Eiji Inatsu 27 Nov '07

27 Nov '07

Hello, I encoutered a problem about message filtering or macro or ???. I want to fix this problem. please help me. [env] # uname -a SunOS hogehoge 5.10 Generic_125100-07 sun4u sparc SUNW,Sun-Fire-V245 # syslog-ng -V syslog-ng 2.0.2 [conf] # cat syslog-ng options {create_dirs(yes); use_fqdn(yes); dir_owner(syslog-ng); dir_perm(0750); owner(syslog-ng); perm(0740); sync(0);}; ... source s_net { udp(ip(2.2.2.2) port(514)); }; ... log { source(s_net); filter(f_fw_1); destination(d_fw_1); flags(final); }; ... filter f_fw_all { host("DC_"); }; filter f_fw_1 { filter(f_fw_all) and host("ifw1"); }; ... destination d_fw_1 { file("/opt/syslog/log/DC_fw/$HOST/$HOST.log.$YEAR$MONTH$DAY-$HOUR" dir_group(fw-log) group(fw-log)); }; ... ... destination d_debug_all { file("/opt/syslog/log/debug/$HOST/$HOST.log.$YEAR$MONTH$DAY-$HOUR" dir_group(all-log) group(all-log)); }; ... log { source(s_net); destination(d_debug_all); flags(final);}; # grep -v ^# syslog-ng.conf | wc -l 532 # grep DC_fw /etc/inet/hosts 1.1.1.1 DC_ifw1 [problem] A message is loged to d_fw_1 and a message is loged to d_debug_all. The filename of a message loged to d_fw_1 is DC_ifw120071127-12 and the filename of a message loged d_debug_all is 1.1.1.1. I think all messages should only be loged to d_fw_1, but doesn't. I want to know what should I do to fix to my problem. thanks. --- // mailto: le.petit.planet(a)gmail.com

1 0

November 70% OFF
by Arlene＠Viagra.com 26 Nov '07

26 Nov '07

1 0

syslog-ng bugzilla
by Balazs Scheidler 26 Nov '07

26 Nov '07

Hi, We have created a public bugzilla installation in order to make syslog-ng bugtracking easier. The address is: http://bugzilla.balabit.com/ >From now on, please file syslog-ng related problems there. I've also set up an automatic bugzilla->mailing list gateway, so any changes to the bugzilla will be posted to this mailing list. -- Bazsi

1 0

IPv6 Link local address use with syslog-ng
by Philip Bellino 22 Nov '07

22 Nov '07

Hello, Running syslog-ng-2.0.5 on a Linux host 2.6.22.9. syslog-ng.conf entry as follows: source s_all { tcp6(ip(2001:470:1f00:1288:220:abff:febe:4dac) port(1468)); }; When syslog-ng is started, the Global address (2001:470:1f00:1288:220:abff:febe:4dac) binds and connects fine. If I have the Link Local Address configured below: source s_all { tcp6(ip(fe80::220:abff:febe:4dac) port(1468)); }; And start syslog-ng, it either errors on the bind or the connect(g_connect in gsockaddr.c) with an errno of 22 (Invalid Argument). Looking at the code shows that there is no use of the sockaddr_in6 "sin6_scope_id", which is required to be set when using Link Local addresses since they need to use the interface number (sin6_scope_id). Has anyone run into this issue? If so, is there a workaround or a code patch for this? Thanks, Phil Bellino Phil Bellino Software Engineer MRV Communications, Inc. 295 Foster Street Littleton, MA. 01460 Phone: 978-952-4807 Fax: 978-952-5444 Email: pbellino(a)mrv.com <http://www.mrv.com/>

4 12

TMI: spam-like messages every 30 sec?
by Kim Cary 22 Nov '07

22 Nov '07

Hi folks, Every 30 seconds I get one of these messages in my syslog file, on behalf of syslog-ng, for each and every file destination (I have about 50): Reaping unused destination files; template='/var/log/blah/$YEAR/ $MONTH/$HOST/maillog' Now this happens even for very heavily used log destinations, including the firewall, which is getting a few hundred hits a minute. Basically, this is filling up my /var partition every couple days and I'd like to stop it. I haven't found the config to use to turn this log message OFF, and I would like to know why even the busiest logs are getting tagged as 'unused'. Can someone give me some clues here? Much appreciation, KC

2 1

Tuning help?
by Cole Tuininga 21 Nov '07

21 Nov '07

I have a FreeBSD 5.4 system running syslog-ng 2.0.5 - there's no load on it. If I run the following perl code: ** Begin Code ** use Sys::Syslog qw(:DEFAULT setlogsock); # start some logging setlogsock 'unix'; openlog('task', 'pid', 'daemon'); syslog 'info', 'starting'; $txt = 'blah'; for (1..8) { syslog 'debug', $_. ' len('. length($txt) . ') '. $txt; $txt = "$txt $txt"; } for (1..100) { syslog 'debug', $_. ' len('. length($txt) . ') '. $txt; $txt = "$txt bleargh"; } ** End Code ** I seem to be dropping a random message or two during the second loop. I've tried tuning the syslog-ng conf file several different ways without luck. The relevant pieces of the current iteration of the conf file are: options { long_hostnames(off); flush_lines(1); time_reopen(10); time_reap(600); log_fifo_size(4096); }; source src { unix-dgram("/var/run/log" log_msg_size(65536) log_fetch_limit(5)); unix-dgram("/var/run/logpriv" perm(0600) log_msg_size(65536) log_fetch_limit(5)); udp(log_msg_size(65536) log_fetch_limit(5)); internal(); file("/dev/klog" log_msg_size(65536) log_fetch_limit(5)); }; destination task_log { file( "/var/log/task.log" perm(0664) ); }; filter f_task{ program("task"); }; log {source(src); filter(f_task); destination(task_log); flags(flow-control);}; Anybody have any ideas why I'm dropping random lines? Thanks in advance... -- Cole Tuininga http://www.tuininga.org/

2 2

syslog-ng-2.0.5: err "Duplicate stats counter"
by Alberto Avi 21 Nov '07

21 Nov '07

Hi everyone, I'm trying to configure a few templated logs on Linux boxes to a remote syslog-ng server (available through stunnel connection). All is working fine in the remote syslog-ng server: I can see all the data I expected and I can manage them happly. There is only a small issue on the client side: the syslog-ng don't send "stats" and "mark" messages. When I start the deamon I have this error: [root@usftpl201 sbin]# ./syslog-ng -d -v -F Duplicate stats counter; counter='tcp(AF_INET(127.0.0.1:61514))' This is my syslog-ng configuration on client side: # general options options { mark_freq(1); stats_freq(2); time_reopen(5); time_reap(300); flush_lines(1); flush_timeout(5000); log_fifo_size(3); normalize_hostnames(yes); keep_hostname(yes); use_fqdn(no); owner(root); group(root); perm(0600); dir_owner(root); dir_group(root); dir_perm(0600); log_msg_size(8192); }; # define sources source s_system { file("/var/log/messages" follow_freq(1)); file("/var/log/secure" follow_freq(1)); file("/var/log/cron" follow_freq(1)); file("/var/log/up2date" follow_freq(1)); file("/var/log/osad" follow_freq(1)); }; source s_proftpd { file("/var/log/proftpd/auth.log" follow_freq(1) flags(no-parse)); file("/var/log/proftpd/access.log" follow_freq(1) flags(no-parse)); }; # define filters filter f_system { not match("logger"); }; filter f_proftpd { not match("FTP Time"); }; # define templates template t_system { template("$DATE $HOST TYPE: MSG-SYSTEM MSG: $MSG\n"); }; template t_proftpd { template("$DATE $HOST TYPE: MSG-PROFTPD MSG: $MSG\n"); }; # define destinatios destination d_system { tcp("127.0.0.1" port(61514) template(t_system)); }; destination d_proftpd { tcp("127.0.0.1" port(61514) template(t_proftpd)); }; # define logs log { source(s_system); filter(f_system); destination(d_system); }; log { source(s_proftpd); filter(f_proftpd); destination(d_proftpd); }; This is my configuration on central syslog-ng server: options { time_reopen(15); time_reap(600); flush_lines(4); flush_timeout(6000); log_fifo_size(1); chain_hostnames(yes); normalize_hostnames(on); create_dirs(yes); chain_hostnames(yes); long_hostnames(no); keep_hostname(yes); use_fqdn(no); use_dns(no); owner(root); group(root); dir_owner(root); dir_group(root); dir_perm(0600); log_msg_size(8192); }; # define sources source s_tcp { tcp(ip(127.0.0.1) port(60514) max-connections(512) tcp-keep-alive(yes)); }; # define filters filter f_system { match("MSG-SYSTEM"); }; filter f_proftpd { match("MSG-PROFTPD"); }; # define templates template t_system { template("RECDATE: $R_YEAR/$R_MONTH/$R_DAY $R_HOUR:$R_MIN:$R_SEC SYSLOG: ussysl310 RHOST: $HOST RDATE: $S_YEAR/$S_MONTH/$S_DAY $S_HOUR:$S_MIN:$S_SEC $MS G\n"); template_escape(no); }; template t_proftpd { template("RECDATE: $R_YEAR/$R_MONTH/$R_DAY $R_HOUR:$R_MIN:$R_SEC SYSLOG: ussysl310 RHOST: $HOST RDATE: $S_YEAR/$S_MONTH/$S_DAY $S_HOUR:$S_MIN:$S_SEC $MS G\n"); template_escape(no); }; # define destinations destination d_system { file("/var/data/syslog-ng/linux-hosts/$YEAR/$MONTH/$DAY/$HOST/$HOST-$DAY$MONTH$YEAR-system.log" template(t_system)); }; destination d_proftpd { file("/var/data/syslog-ng/linux-hosts/$YEAR/$MONTH/$DAY/$HOST/$HOST-$DAY$MONTH$YEAR-proftpd.log" template(t_proftpd)); }; # define logs log { source(s_tcp); filter(f_system); destination(d_system);}; log { source(s_tcp); filter(f_proftpd); destination(d_proftpd); } Any suggestions are appreciated. Alberto.

2 2

Syslog-NG 2.0.5 on OpenBSD 4.2
by Brian A. Seklecki 21 Nov '07

21 Nov '07

http://people.collaborativefusion.com/~seklecki/openbsd42_port_syslog-ng205… # pkg_info | egrep -i "syslog|event" eventlog-0.2.5 eventlog syslog-ng library syslog-ng-2.0.5 syslogd replacement # syslog-ng -V syslog-ng 2.0.5 # uname -a OpenBSD build-openbsd-i386-42 4.2 GENERIC#375 i386 Pkgsrc is next but I have to catch a bus. ~BAS # tar tzvf /usr/ports/packages/i386/all/eventlog-0.2.5.tgz -r--r--r-- 1 root wheel 698 Nov 20 13:56 +CONTENTS -r--r--r-- 1 root wheel 149 Nov 20 13:56 +DESC -rwxr-xr-x 1 root bin 56325 Nov 20 13:52 lib/libevtlog.so.0.0 -r--r--r-- 1 root bin 6602 Nov 20 13:52 include/eventlog/evtlog.h -r--r--r-- 1 root bin 2168 Nov 20 13:52 include/eventlog/evtmaps.h -rw-r--r-- 1 root bin 90848 Nov 20 13:52 lib/libevtlog.a -rwxr-xr-x 1 root bin 811 Nov 20 13:52 lib/libevtlog.la -r--r--r-- 1 root bin 237 Nov 20 13:52 lib/pkgconfig/eventlog.pc # tar tzvf /usr/ports/packages/i386/all/syslog-ng-2.0.5.tgz -r--r--r-- 1 root wheel 528 Nov 20 14:23 +CONTENTS -r--r--r-- 1 root wheel 568 Nov 20 14:23 +DESC -r--r--r-- 1 root bin 5899 Nov 20 14:23 man/man5/syslog-ng.conf.5 -r--r--r-- 1 root bin 3268 Nov 20 14:23 man/man8/syslog-ng.8 -r-xr-xr-x 1 root bin 1215516 Nov 20 14:23 sbin/syslog-ng

1 0

Patch for open source syslog-ng-2.0.5
by Philip Bellino 19 Nov '07

19 Nov '07

The following attached patch is being submitted against the open source syslog-ng-2.0.5. * src/afsocket.c (afsocket_dd_format_stats_name): Using IPv6 for a destination of tcp6 or udp6: There was no case statement for AF_INET6 and as a result, "driver_name" was never filled in with either tcp6 or udp6. The subsequent routine (g_snprintf) that used "driver_name" caused a segmentation fault. This is now fixed. <<syslog-ng-Changelog.doc>> <<afsocket.diff>> Phil Bellino Software Engineer MRV Communications, Inc. 295 Foster Street Littleton, MA. 01460 Phone: 978-952-4807 Fax: 978-952-5444 Email: pbellino(a)mrv.com <http://www.mrv.com/>

2 1

about unix-dgram
by hi ro 19 Nov '07

19 Nov '07

Hi, Can I use "unix-dgram" as a destination config over RedHatLinux(RHEL ES version4 update5). I want to do following. 1. syslog-ng server receive syslog-message. 2. syslog-ng server write the message to a fifo pipe. (I want to config destination using unix-dgram.) 3. client-ap read the message from the fifo pipe. (I think client-ap can read messages one by one using unix-dgram.) Thanks hiro _________________________________________________________________ Hotmail限定　Windows Live x Lost Odysseyプレゼントキャンペーン　12月21日まで http://go.windowslive.jp/

2 3

Is there any problems when network config is changed?
by hi ro 16 Nov '07

16 Nov '07

Hi, Is there any problems when following occurs? [Precondition] Syslog-ng starts with a config about A-ADDRESS(IP ADDRESS). [Question] 1. Down NIC(A-ADDRESS) with ifdown. → Is there any problems? 2. Change IP-ADDRES from A to B. → Is there any problems? 3. UP NIC(B-ADDRESS) with ifup → Is there any problems? I know that syslog-ng can't start after 3. Thankshiro _________________________________________________________________ 今話題になってる出来事や有名人をランキングで毎週発表「MSN 気になる言葉」 http://keyword.jp.msn.com/default.aspx

2 3

Is there any problems when network config is changed?
by hi ro 16 Nov '07

16 Nov '07

Hi, Is there any problems when following occurs? [Precondition] Syslog-ng starts with a config about A-ADDRESS(IP ADDRESS). [Question] 1. Down NIC(A-ADDRESS) with ifdown. → Is there any problems? 2. Change IP-ADDRES from A to B. → Is there any problems? 3. UP NIC(B-ADDRESS) with ifup → Is there any problems? I know that syslog-ng can't start after 3. Thankshiro _________________________________________________________________ 【MSNビデオ】超貴重！驚きの大物対談が実現。作家村上龍が話題のあの人に迫る http://video.msn.co.jp/rvr/default.htm

1 0

Is there any problems when network config is changed?
by hi ro 16 Nov '07

16 Nov '07

Hi, Is there any problems when following occurs? [Precondition] Syslog-ng starts with a config about A-ADDRESS(IP ADDRESS). [Question] 1. Down NIC(A-ADDRESS) with ifdown. → Is there any problems? 2. Change IP-ADDRES from A to B. → Is there any problems? 3. UP NIC(B-ADDRESS) with ifup → Is there any problems? I know that syslog-ng can't start after 3. Thankshiro _________________________________________________________________ 広告表示なし！アカウント有効期限なし！Hotmail Plus のお申し込みはこちら http://get.live.com/mail/options

1 0

About lost of messages after syslog-ng stop
by Frank Abel Cancio Bello 14 Nov '07

14 Nov '07

Hi all! What can I do to avoid that when I stop my syslog-ng client and apache server still logging to its files not lost all those messages? I mean, in the time that the syslog-ng client was not running, the apache continue working and logging data, but when I start the syslog client it don't send to the syslog-ng server the messages that apache logging when it was stopped. Here is part of what I think relevant of my configuration file: # apache message source source s_apache { # Apache2 access log source. file("/var/log/apache2/access.log" log_prefix("apache_access: ") follow_freq(1) flags(no-parse) ); # Apache2 access log source. file("/var/log/apache2/error.log" log_prefix("apache_error: ") follow_freq(1) flags(no-parse) ); }; # central log server destination d_tcp { tcp("10.8.2.227" port(514)); }; # apache logs to central server. log { source(s_apache); destination(d_tcp); flags(flow-control); }; All work fine, just worry about the lost of messages in case that the communication with syslog-ng server fail. I know that Premium Edition have the log_disk_fifo_size(), but that is the only way of do this? Nobody have a workaround for this so necessary feature using the Open Source Edition? Salute Frank Abel __________________________________________ Participe en Universidad 2008. 11 al 15 de febrero del 2008. Palacio de las Convenciones, Ciudad de la Habana, Cuba http://www.universidad2008.cu

2 3

syslog-ng 2.0.3 is released
by Balazs Scheidler 14 Nov '07

14 Nov '07

Dear syslog-ng users, I've uploaded syslog-ng 2.0.3, the latest stable release in the syslog-ng 2.0 branch to our webserver. The list of changes is summarized below. The source is available at the usual places at http://www.balabit.com/products/syslog-ng/ 2.0.3 Mon, 26 Mar 2007 14:10:00 +0200 Bugfixes: * Fixed a possible segmentation fault in the usertty() destination driver when it was referenced on a log path with disabled flow-control. * Fixed various usertty() functionality problems. * Removed the 1024 byte limitation of internally generated messages. * Clarified the text of various internal messages, consistency updates for message severities. * Increased the minimum value for log_fifo_size to 1000 elements. * HP-UX portability fixes. * Some minor documentation fixes. Features: * Added spoof-source support for IPv4 & IPv6 to match 1.6.x functionality. * Added support for remembering the last posistion of file sources across restarts. * Added tcp-wrapper support. * Added support for more than 9 regexp matches. -- Bazsi

3 8

Re: [syslog-ng] Redirect syslog-ng to ttyS0
by kjell.danielsen＠hjemme.no 14 Nov '07

14 Nov '07

Hei. Her is a new trace. Regards Kjell time(NULL) = 1195026575 poll([{fd=13, events=0}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 100) = 0 poll([{fd=13, events=0}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 11, 3448000) = 1 recvfrom(3, "<165>Nov 14 07:49:40 AL[3581]: A"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\2\200\356E\1\200\0\371\1\200\320\21\2\200"}, [0]) = 187 time(NULL) = 1195026580 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026580 time(NULL) = 1195026580 poll([{fd=13, events=POLLOUT, revents=POLLOUT}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 100) = 3 write(13, "Nov 14 07:49:40 lim1 AL[3581]: A"..., 188) = 188 write(10, "Nov 14 07:49:40 lim1 AL[3581]: A"..., 188) = 188 write(4, "Nov 14 07:49:40 lim1 AL[3581]: A"..., 188) = 188 time(NULL) = 1195026580 poll([{fd=13, events=0}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 100) = 0 poll([{fd=13, events=0}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 11, 3443000) = 1 recvfrom(3, "<165>Nov 14 07:49:44 AL[3581]: A"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\2\200\356E\1\200\0\371\1\200\320\21\2\200"}, [0]) = 56 time(NULL) = 1195026584 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026584 time(NULL) = 1195026584 poll([{fd=13, events=POLLOUT, revents=POLLOUT}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 100) = 3 write(13, "Nov 14 07:49:44 lim1 AL[3581]: A"..., 57) = 57 write(10, "Nov 14 07:49:44 lim1 AL[3581]: A"..., 57) = 57 write(4, "Nov 14 07:49:44 lim1 AL[3581]: A"..., 57) = 57 time(NULL) = 1195026584 poll([{fd=13, events=0}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 100) = 0 poll([{fd=13, events=0, revents=POLLERR|POLLHUP}, {fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 11, 3439000) = 1 time(NULL) = 1195026596 close(13) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 3427000) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 155 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 156) = 156 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 156) = 156 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 165 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 3 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 166) = 166 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 166) = 166 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 51 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 52) = 52 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 52) = 52 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 61 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 3 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 62) = 62 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 62) = 62 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 126 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 127) = 127 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 127) = 127 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 136 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 3 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 137) = 137 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 137) = 137 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 51 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 52) = 52 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 52) = 52 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 61 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 3 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 62) = 62 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 62) = 62 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 148 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 149) = 149 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 149) = 149 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 100) = 1 recvfrom(3, "<181>Nov 14 07:50:00 mdsh[5063]:"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 158 time(NULL) = 1195026600 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026600 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 159) = 159 write(4, "Nov 14 07:50:00 lim1 mdsh[5063]:"..., 159) = 159 time(NULL) = 1195026600 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 3423000) = 1 recvfrom(3, "<165>Nov 14 07:50:05 AL[3581]: A"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 210 time(NULL) = 1195026605 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026605 time(NULL) = 1195026605 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:05 lim1 AL[3581]: A"..., 211) = 211 write(4, "Nov 14 07:50:05 lim1 AL[3581]: A"..., 211) = 211 time(NULL) = 1195026605 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 10, 3418000) = 1 recvfrom(3, "<165>Nov 14 07:50:09 AL[3581]: A"..., 2048, 0, {sa_family=AF_UNSPEC, sa_data="\200\277\'F\1\200\0\371\1\200\320\21\2\200"}, [0]) = 56 time(NULL) = 1195026609 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 time(NULL) = 1195026609 time(NULL) = 1195026609 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 2 write(10, "Nov 14 07:50:09 lim1 AL[3581]: A"..., 57) = 57 write(4, "Nov 14 07:50:09 lim1 AL[3581]: A"..., 57) = 57 time(NULL) = 1195026609 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=10, events=0}, {fd=9, events=0}, {fd=8, events=0}, {fd=7, events=0}, {fd=4, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 10, 100) = 0 poll( <unfinished ...>

1 0

pull logs from remote hosts with syslog-ng?
by Jon Sabo 14 Nov '07

14 Nov '07

Is it possible to use syslog-ng to pull logs from a remote host? If you had a network where only inbound sessions were allowed but nothing was allowed to initiate a connection back, could you have a central syslog-ng server that went out and initiated connections/sessions to remote hosts and pulled back logs? Thanks, Jonathan

2 5

Syslog-ng-2.05 Segmentation Fault
by Daniel Szmandiuk 13 Nov '07

13 Nov '07

Syslog-ng experiences a segmentation fault whenever a message is processed: <stop syslogd first> # syslog-ng -d -d -v -F -e syslog-ng starting up; version='2.0.5' Incoming log entry; line='<28>Nov 9 10:11:24 xinetd[12285]: Exiting...' Filter rule evaluation begins; filter_rule='f_emerg' Filter node evaluation result; filter_result='not-match', filter_type='level' Filter rule evaluation result; filter_result='not-match', filter_rule='f_emerg' Filter rule evaluation begins; filter_rule='f_secure' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_secure' Filter rule evaluation begins; filter_rule='f_cron' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_cron' Filter rule evaluation begins; filter_rule='f_spooler' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter node evaluation result; filter_result='not-match', filter_type='AND' Filter rule evaluation result; filter_result='not-match', filter_rule='f_spooler' Filter rule evaluation begins; filter_rule='f_local7' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_local7' Filter rule evaluation begins; filter_rule='f_messages' Filter node evaluation result; filter_result='match', filter_type='level' Filter rule evaluation result; filter_result='match', filter_rule='f_messages' Initializing destination file writer; template='/var/log/messages', filename='/var/log/messages' Segmentation fault Platform is VMware Guest running RHEL5 x86_64. I used the following steps to build from source: Download eventlog-0.2.5 source ./configure --prefix=/usr --sysconfdir=/etc make make install export PKG_CONFIG_PATH="/usr/lib/pkgconfig" Download syslog-ng-2.0.5 source. ./configure --sysconfdir=/etc make make install I've basically used the supplied config file for Redhat in contrib folder. I'm uncommented the relevant lines in order to use syslog-ng in place of syslogd. Syslog-ng runs OK but as soon as it tries to process a syslog message, it dies with a segmentation fault. Any ideas anyone? Daniel This email and any attachments transmitted with it are confidential and may contain legally privileged information. If you are not the intended recipient you are prohibited from disclosing, copying or using the information contained in it. If you have received this email in error, please notify the sender immediately by return email and then delete all copies of this transmission together with any attachments. It is the addressee's/recipient's duty to virus scan and otherwise test the email before loading it onto any computer system. IMC Communications does not accept liability in connection with any computer virus, data corruption, delay, interruption, unauthorised access or unauthorised amendment in relation to this email. For information about our privacy policy, visit the IMC Communications website at www.imc.net.au This email has been checked by IMC's SMTP gateway. -&-

8 35

particular source
by luigi augello 13 Nov '07

13 Nov '07

hello I need to use a source file as some as source src_backup { file ('/log//192.168.2.180/LOG.$S_MONTH$S_YEAR' log_prefix("Log backup: ")); }; It is possible I tried but don't work Tanks.. Regards Luigi

2 1

syslog-ng not relaying snort 2.6 events properly.
by Mike Fratto 12 Nov '07

12 Nov '07

I have been playing with macros to ensure messages are reformatted to a consistent format. I am viewing the events on the wire using tcpdump on the syslog-ng relay. The first event comes from snort. The second event is sent from syslog-ng. Note the sent message is [|syslog]. This same macro (the syslog-ng.conf file is pasted below) works with other syslog sources. Any thoughts on what the problem is? 10:39:29.810836 IP (tos 0x0, ttl 63, id 60806, offset 0, flags [DF], proto UDP (17), length 183) 192.168.14.13.syslog > 192.168.17.212.syslog: SYSLOG, length: 155 Facility local5 (21), Severity alert (1) Msg: snort[433]: [1:466:5] ICMP L3retriever Ping [Classification: Attempted Information Leak] [Priority: 2]: <eth2> {ICMP} 192.168.17.220 -> 192.168.14.44\012 10:39:29.810968 IP (tos 0x0, ttl 64, id 10591, offset 0, flags [DF], proto UDP (17), length 178) 192.168.17.212.32848 > 192.168.17.198.syslog: [|syslog] # Options options { chain_hostnames(no); keep_hostname(no); use_time_recvd(no); }; # network syslog listener source s_udp { udp(); unix-stream("/dev/log"); }; # Strip headers because syslog-ng wants to add them template strip_header { template("$MSG\n"); template_escape(no); }; #hosts that should have headers stripped filter strip_header_hosts { host("192.168.14.5")or host("example") or host("example.com") or host("mail.example.com") or host("mail") or host("192.168.14.13") or host("snort") or host("snort.example.com") ; }; destination d_test {udp("192.168.17.198"); }; destination d_strip_test {udp("192.168.17.198" template (strip_header)); }; log { source(s_udp); filter(strip_header_hosts); destination(d_strip_test); flags(final); }; log { source(s_udp); destination(d_test); flags(final); };

3 2

syslog-ng relay pre-pends headers
by Mike Fratto 08 Nov '07

08 Nov '07

I know this has been asked alot, but I haven't found a working answer (after much failed googling and reading the admin guide). I am using syslog-ng 2.0.5 on Fedora 7. I am trying to relay syslog messages. Syslog messages sent to syslog-ng in the format: "priority datestamp host message" are being relayed as "priority "datestamp of syslog-ng" "hostname of syslog-ng" "datestamp orig" "hostname original" message" I have chain_hostnames(no) defined and I restarted syslog-ng (the options stanza is below) but still the headers are pre-pended. Any advice? # Options options { chain_hostnames(no); keep_hostname(yes); use_time_recvd(no); };

2 4

Question about Syslog
by FRANCIS PROVENCHER 06 Nov '07

06 Nov '07

Hi all, I configure a central syslogger. In my syslog-ng.conf destination "servername" { file("/var/log/"servername"/$YEAR/$MONTH/$DAY/$HOST.log" owner(root) group(wheel) perm(0600) dir_perm(0700) create_dirs(yes)); }; But the syslog call/errors from "servername" is write in /var/log/messages ... What i'm making wrong? thanks for your help Francis Provencher Ministère de la Sécurité publique du Québec Direction des technologies de l'information Division de la sécurité informatique Tél: 1 418 646-3258 Courriel: Francis.provencher(a)Msp.gouv.qc.ca CEH - Certified Ethical Hackers SSCP - System Security Certified Practitionner Sec+ - Security +

4 8

Connection broke using remote syslog-ng clients
by LESOUEF Emmanuel 05 Nov '07

05 Nov '07

Hello, I'm getting this kind of logs (facility syslog) on my central syslog-ng server : Oct 31 12:08:10 lxnetmgmt syslog-ng[8698]: EOF occurred while idle; fd='6' Oct 31 12:08:10 lxnetmgmt syslog-ng[8698]: Connection broken; time_reopen='10' Oct 31 12:08:20 lxnetmgmt syslog-ng[8698]: Connection failed; error='Connection refused (111)', time_reopen='10' It occurs after restarting the central syslog-ng server. These messages come from remote hosts sending their logs via tcp to the central syslog-ng server. Any idea ? Thanks for your help. -- Emmanuel Lesouef DSI | CRBN t : 0231069671 m : e.lesouef(a)crbn.fr

3 2