- syslog-ng - lists.balabit.hu

Newbie
by ajc80＠o2.co.uk 29 Jan '06

29 Jan '06

Hello, I'm a newbie to syslog-ng, I have followed the instructions and used and altered the necessary examples to suit my directory structures, so my syslog messages are dumped in to mysql database. I'm using: syslog-ng-1.6.8 libol-0.3.16 mysql 3.23.58 When starting syslog-ng I get the following messages: # /etc/init.d/syslog-ng start Starting MySQL pipe... Starting syslog-ng... Warning: No source refers to internal messages, they'll go to /dev/null unresolved reference: inputs Error initializing configuration, exiting. The "No source refers to internal messages...." message I understand. The "unresolved reference: inputs" I don't and can't seem to find anything in the archives. I've included the syslog-ng.conf file and the mysql.pipe file below. Any help would be appreciated. Thanks, Adrian. ************ /etc/init.d/mysql.pipe *********** #!/bin/sh # # Script to create a named pipe so syslog-ng messages # can be sent to a MySQL database # if [ -p /var/run/mysql.pipe ]; then mysql -u xxxxxxx --password=xxxxxxx logs < /var/run/mysql.pipe & else mkfifo /var/run/mysql.pipe mysql -u xxxxxx --password=xxxxxx logs < /var/run/mysql.pipe & fi ************ /etc/syslog-ng/syslog-ng.conf *********** ##################################################################### # syslog-ng central log host configuration file # # installed: 29/01/2006 13:18 # ##################################################################### # General options options { check_hostname(yes); keep_hostname(yes); chain_hostnames(no); }; # Other important general options # use_fqdn(yes); # sync(0); # keep_hostname(yes); # chain_hostnames(no); # create_dirs(yes); ##################################################################### # Define syslog input stream # This is specific to Solaris 9 # source inputs { internal(); # sun-streams("/dev/log" door("/var/run/syslog_door")); # tcp(max_connections(1000)); }; # For newer versions of Linux (Debian GNU/Linux woody, # and RedHat Linux post 7.0) # source stdlog { unix-dgram("/dev/log"); }; ##################################################################### # Define filters # Level Filters filter f_emerg { level (emerg); }; filter f_alert { level (alert .. emerg); }; filter f_crit { level (crit .. emerg); }; filter f_err { level (err .. emerg); }; filter f_warning { level (warning .. emerg); }; filter f_notice { level (notice .. emerg); }; # Facility Filters filter f_kern { facility (kern); }; filter f_user { facility (user); }; filter f_mail { facility (mail); }; filter f_daemon { facility (daemon); }; filter f_auth { facility (auth); }; filter f_syslog { facility (syslog); }; filter f_lpr { facility (lpr); }; filter f_news { facility (news); }; filter f_uucp { facility (uucp); }; filter f_cron { facility (cron); }; filter f_local0 { facility (local0); }; filter f_local1 { facility (local1); }; filter f_local2 { facility (local2); }; filter f_local3 { facility (local3); }; filter f_local4 { facility (local4); }; filter f_local5 { facility (local5); }; filter f_local6 { facility (local6); }; filter f_local7 { facility (local7); }; # syslog-ng stats filter filter f_n_stats { not match("STATS: dropped 0"); }; # syslog-ng "connect from filter filter f_n_connected { not match("AF_INET client connected from"); }; ##################################################################### # Define where the logs can be stored # Log log files destination logpile { file("/var/log/syslog-ng/$HOST/$YEAR/$MONTH/$FACILITY.$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) create_dirs(yes) dir_perm(0700)); }; # Console log destination console { file("/dev/sysmsg"); }; # Linux Console # destination console { file("/dev/console"); }; # MySQL Database destination d_mysql { pipe("/var/run/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; ##################################################################### # Define logging # Local log log { source(inputs); filter(f_n_stats); filter(f_notice); filter(f_n_connected); destination(logpile); }; # Console log { source(inputs); filter(f_n_stats); filter(f_err); filter(f_n_connected); destination(console); }; # MySQL Database log { source(inputs); filter(f_n_stats); filter(f_notice); filter(f_n_connected); destination(d_mysql); }; ________________________________________ For a wide range of mobile phones,free upgrades,accessories and tariffs plus special deals when you buy online,visit www.o2.co.uk/shop <http://www.o2.co.uk/shop>

2 1

Crosscompile Syslog-ng
by Kenneth Kassing 27 Jan '06

27 Jan '06

I am crosscompileing syslog-ng to to a powerpc, and had to make a few changes to make it compile properly. If anyone is interested I have included these two patch files here. First I updated configure.in to allow you to specify a path to libfl.a (it should also work with libl.a, but I have not tested this). The configure tests already included does not find the lex libraries for me (I do not have them installed. Instead I am just building flex as compile time dependency.) Second, the configure script was explicitly running configure and make from the script. I did not like configure calling make, and it was not using any of my configure arguements for libol. As a result libol was built for my build machine instead of the target device. The syslog-ng configure script will now now call configure for libol (with all the supplied options), and will not run make. When make is run from the syslog-ng directory it will also run make for libol. -Ken --- Makefile.am.org 2006-01-24 17:18:51.000000000 -0500 +++ Makefile.am 2006-01-24 22:26:21.000000000 -0500 @@ -1,4 +1,4 @@ -SUBDIRS = src doc contrib +SUBDIRS = $(LIBOL_DIR) src doc contrib EXTRA_DIST = PORTS syslog-ng.spec syslog-ng.spec.in syslog-ng.spec.bb syslog-ng.spec.bb.in README.spoof dist.conf dist.conf.in --- configure.in.org 2006-01-24 11:56:15.000000000 -0500 +++ configure.in 2006-01-25 11:19:34.000000000 -0500 @@ -56,6 +56,11 @@ AC_ARG_WITH(libnet, [ --with-libnet=path use path to libnet-config script], , [with_libnet=""]) + +AC_ARG_WITH(lex, + AC_HELP_STRING([--with-lexlib=path],[use an uninstalled copy of lex]), + [with_lex=`cd $with_lex; pwd`], + [with_lex=""]) AC_ARG_ENABLE(sun-streams, [ --enable-sun-streams enable Sun STREAMS support even if not detected]) @@ -85,8 +90,8 @@ sysconfdir="${sysconfdir}/syslog-ng" AM_SANITY_CHECK dnl Checks for programs. -AC_PROG_CC -AM_PROG_CC_STDC +#AC_PROG_CC +#AM_PROG_CC_STDC AC_PROG_YACC AM_PROG_LEX AC_PROG_MAKE_SET @@ -355,15 +360,33 @@ else AC_MSG_RESULT([no clues, linking everything dynamically, please send appropriate ld arguments to syslog-ng(a)lists.balabit.hu] fi -AC_MSG_CHECKING(libol version >= $LIBOL_REQ_MAJOR.$LIBOL_REQ_MINOR.$LIBOL_REQ_PATCH) +if test "$with_lex" != ""; then + AC_MSG_CHECKING(for uninstalled version of lex in $with_lex) + if test -f "$with_lex/libfl.a"; then + LEXLIB="$with_lex/libfl.a" + AC_MSG_RESULT($LEXLIB) + elif test -f "$with_lex/libl.a"; then + LEXLIB="$with_lex/libl.a" + AC_MSG_RESULT($LEXLIB) + else + AC_ERROR(no) + fi +fi + +AC_MSG_CHECKING(for libol) if test "$with_libol" = ""; then if test ! -x "`which libol-config`" ; then bundled_libol_dir="`find $srcdir/libol-* -maxdepth 0 -type d 2>/dev/null`" if test -n "$bundled_libol_dir"; then - test -d $bundled_libol_dir || mkdir $bundled_libol_dir - (cd $bundled_libol_dir; ./configure && make) + test -d $bundled_libol_dir || mkdir $bundled_libol_dir with_libol=$bundled_libol_dir + AC_MSG_RESULT(Configuration required) + + # Remove the single quotes from the configure args, and pass them to + # configure for libol + ac_configure_str=`echo $ac_configure_args | sed -e "s/'//g"` + (cd $bundled_libol_dir; ./configure $ac_configure_str) else AC_ERROR(Bundled libol not found) fi @@ -372,9 +395,12 @@ if test "$with_libol" = ""; then LIBOL_CFLAGS=`libol-config --cflags` LIBOL_LIBS=`libol-config --static-libs` MAKE_CLASS="make_class" + AC_MSG_RESULT(ok) fi fi +AC_MSG_CHECKING(libol version >= $LIBOL_REQ_MAJOR.$LIBOL_REQ_MINOR.$LIBOL_REQ_PATCH) + if test "$with_libol" != ""; then if test ! -x $with_libol/libol-config; then AC_ERROR(libol-config not found in the specified location) @@ -386,7 +412,6 @@ if test "$with_libol" != ""; then MAKE_CLASS="$with_libol/utils/make_class" fi - LIBOL_VERSION=[`echo $LIBOL_VERSION | cut -d '+' -f 1`] LIBOL_MAJOR=[`echo $LIBOL_VERSION | cut -d '.' -f 1`] LIBOL_MINOR=[`echo $LIBOL_VERSION | cut -d '.' -f 2`]

1 0

Syslog-ng with Ipsec or with Stunnel?
by Mounib Khanafer 27 Jan '06

27 Jan '06

Hi all, I hope if someone can help me with this. I'm researching syslog-ng and colllecting as much info as posiible bout it. I want to know which does perform better when working with syslog-ng: IPsec or Stunnel? Please note that I use Solaris 8 and 9 worksations. Thanks a lot. Best Regards, Mounib -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Heigl Florian - Munich-MR - external Sent: Friday, January 27, 2006 11:43 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] chroot or configuration issue when directories getcreated as 'root'? Hi list, I'm stumbling over what is hopefully just a configuration issue... syslog-ng 'seems' to drop privileges and run as user syslogng, but creates new directories as root and will fail to write new logfiles inside them. I'm afraid this is related to still having port 514 open... Funny thing: The files in those directories will use the specified permissions :) I was starting syslog-ng with the following parameters: /opt/syslog-ng/sbin/syslog-ng --pidfile=/var/run/syslog-ng.pid --chroot=/var/opt/syslog-ng --user=syslogng --group=syslogng # Log file options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (yes); create_dirs (yes); # leave this to 'no', see http://www.campin.net/syslog-ng/faq.html#bad_filenames keep_hostname (no); }; # Source - only listen on UDP, don't read /dev/log source s_udp { udp(); }; # [ I cut filters section out ] # testing external input now destination logip { file("/logs/remote/$HOST_FROM/$YEAR$MONTH/$FACILITY$YEAR$MONTH$DAY" owner(syslogng) group(syslogng) perm(0600) dir_perm(0700) create_dirs(yes) template("$DATE $FULLHOST $PROGRAM $TAG [$FACILITY.$LEVEL] $MESSAGE\n") ); }; log { source(s_udp); destination(logip); }; # EOF Currently I'm running it as root and am thinking about using a portforward 514->10514 so I don't require any root privileges. Alternatively I could try out Balabit's restrict, which seems to be better at dropping root privileges, but unfortunately I have no clue how it works, and am not sure if it will work on HP-UX :) Can You try to make me understand where the problem is hiding? Configuration? Port Number? Bug? User? Thanks a lot of Your time! Florian -- I'll save You the signature :) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

chroot or configuration issue when directories get created as 'root'?
by Heigl Florian - Munich-MR - external 27 Jan '06

27 Jan '06

Hi list, I'm stumbling over what is hopefully just a configuration issue... syslog-ng 'seems' to drop privileges and run as user syslogng, but creates new directories as root and will fail to write new logfiles inside them. I'm afraid this is related to still having port 514 open... Funny thing: The files in those directories will use the specified permissions :) I was starting syslog-ng with the following parameters: /opt/syslog-ng/sbin/syslog-ng --pidfile=/var/run/syslog-ng.pid --chroot=/var/opt/syslog-ng --user=syslogng --group=syslogng # Log file options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (yes); create_dirs (yes); # leave this to 'no', see http://www.campin.net/syslog-ng/faq.html#bad_filenames keep_hostname (no); }; # Source - only listen on UDP, don't read /dev/log source s_udp { udp(); }; # [ I cut filters section out ] # testing external input now destination logip { file("/logs/remote/$HOST_FROM/$YEAR$MONTH/$FACILITY$YEAR$MONTH$DAY" owner(syslogng) group(syslogng) perm(0600) dir_perm(0700) create_dirs(yes) template("$DATE $FULLHOST $PROGRAM $TAG [$FACILITY.$LEVEL] $MESSAGE\n") ); }; log { source(s_udp); destination(logip); }; # EOF Currently I'm running it as root and am thinking about using a portforward 514->10514 so I don't require any root privileges. Alternatively I could try out Balabit's restrict, which seems to be better at dropping root privileges, but unfortunately I have no clue how it works, and am not sure if it will work on HP-UX :) Can You try to make me understand where the problem is hiding? Configuration? Port Number? Bug? User? Thanks a lot of Your time! Florian -- I'll save You the signature :)

1 0

Syslog-ng & pipe question
by syslogyk 26 Jan '06

26 Jan '06

Hi! Could you please help me with this question? I have the following strings in my syslog-ng.conf: source src { internal(); unix-dgram("/dev/log"); unix-dgram("/var/lib/named/dev/log"); }; ... skipped ... filter f_debug { level(debug); }; destination d_yuri { pipe("/dev/yuri_pipe"); }; log { source(src); filter(f_debug); destination(d_yuri); }; With this configuration, I execute the following commands in the first console: mkfifo /dev/yuri_pipe cat /dev/yuri_pipe On the other console I generate an event (for instance, "logger blablabla"). And cat /dev/yuri_pipe on the first console outputs nothing. What's wrong in my syslog-ng.conf? Can I get events in my pipe? Thank you in advance, Yuri P.S. Sorry, if you receive this message twice.

3 3

RE: [syslog-ng] Xserve sending to Syslog-NG
by William Bell 26 Jan '06

26 Jan '06

Yes the syslog feed off the xserve is most likely UDP based and it will just continue to stream syslog messages to the unresponsive destination. There may or may not be a way to setup a backup syslog server in the Xserve admin functions. WilliamB -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Ken Garland Sent: Wednesday, January 25, 2006 2:30 PM To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] Xserve sending to Syslog-NG I have a question regarding setting up an Xserve to send to our central log server. If the Syslog-NG server goes down, will the Xserve continuously retry to send the logs until the Syslog-NG server is available? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

4 3

Xserve sending to Syslog-NG
by Ken Garland 25 Jan '06

25 Jan '06

I have a question regarding setting up an Xserve to send to our central log server. If the Syslog-NG server goes down, will the Xserve continuously retry to send the logs until the Syslog-NG server is available?

1 0

Best way to keep up with security alerts for syslog-ng?
by Cary, Kim 25 Jan '06

25 Jan '06

I was checking on securityfocus website & they have no vulns listed for syslog-ng for the versions we use. What is the best way to be alerted should there be a security advisory for the product?

2 1

Syslog-ng 1.9.8 unable to resolve hostnames
by Laurent CARON 25 Jan '06

25 Jan '06

Hi, I upgraded syslog-ng to the latest debian build (1.9.8). In /etc/syslog-ng/syslog-ng.conf i have this line to redirect logs to a particular host. log { source(s_all); filter(f_attncr); destination(buckrogers.lan); }; Unfortunately my logs are hitting 2Gb in only a few mins. Why? It seems according to Szalay Attila that this build is unable to resolve hostnames properly. It is a new feature, a bug, a misunderstanding on my side...? Thanks Laurent

2 1

Problem installing syslog-ng
by Hubert Edward kIYIMBA 25 Jan '06

25 Jan '06

I am having problems installing syslog-ng1.9.8. The ./configure works fine. However the make gives an error. Below is the log. I am using redhat 9. Please advise [root@localhost syslog-ng-1.9.8+20060117]# make make all-recursive make[1]: Entering directory `/home/hkiyimba/syslog-ng-1.9.8+20060117' Making all in src make[2]: Entering directory `/home/hkiyimba/syslog-ng-1.9.8+20060117/src' gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog libsyslog-ng.a(filter.o)(.text+0x1f8): In function `filter_facility__eval': /home/hkiyimba/syslog-ng-1.9.8+20060117/src/filter.c:142: undefined reference to `G_UNLIKELY' libsyslog-ng.a(filter.o)(.text+0x242):/home/hkiyimba/syslog-ng-1.9.8+20060117/src/filter.c:157: undefined reference to `G_LIKELY' libsyslog-ng.a(filter.o)(.text+0x303): In function `filter_level__eval': /home/hkiyimba/syslog-ng-1.9.8+20060117/src/filter.c:202: undefined reference to `G_LIKELY' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/home/hkiyimba/syslog-ng-1.9.8+20060117/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/hkiyimba/syslog-ng-1.9.8+20060117' make: *** [all] Error 2 [root@localhost syslog-ng-1.9.8+20060117]# --------------------------------- Bring words and photos together (easily) with PhotoMail - it's free and works with Yahoo! Mail.

2 1

syslog-ng performance question
by Daniel Chojecki 23 Jan '06

23 Jan '06

Hi ! I have to set up central logging server for approx. 80 machines using syslog-ng with SQL DB (MySQL or PostgreSQL or Oracle db system). It is a homogeneous system so i will have to log traffic from syslog-ng-friendly servers. I will use syslog and syslog-ng for unix clients and Snare Agent or NTsyslog for windows clients. I want to use unix DB server. I want to log "normal" and sometimes debug informations. I need to choose hardware for DB server and DB server. Thanks for your help ! ps. questions are desirable :-) -- greetz Daniel

1 0

Re: [syslog-ng] RE: Removal of forwarder hostname ??
by krishna y 23 Jan '06

23 Jan '06

Hi Mike, Thanks for ur reply. It's working now with the option spoof_source It requires libnet also to use this option while compilation. Installed libnet and used the following: ./configure --with-libnet=path_of_libnet-conf --enable-spoof-source Thanks for ur help, Krishna Y On Mon, 23 Jan 2006 Michael Gehrmann wrote : >Hi, > >What you are looking for is a compiled option: --enable-spoof-source > >You can then enable it in your syslog-ng.conf using the option per destination e.g. destination syslogbox { udp("X.X.X.X" port(514) spoof_source(yes)); }; > >Regards >Mike > >Message: 1 >Date: 21 Jan 2006 14:36:50 -0000 > From: "krishna y" <krish_bvrm(a)rediffmail.com> >Subject: [syslog-ng] Removal of forwarder hostname ?? >To: syslog-ng(a)lists.balabit.hu >Message-ID: <20060121143650.19410.qmail(a)webmail8.rediffmail.com> >Content-Type: text/plain; charset="iso-8859-1" > > >Hi, > >I have configured the Syslog-ng in HPUX and forwarding the messages to Ciscoworks The original message to Syslog-NG is as following: > >Jan 20 12:44:32 SYSNG.it.net CiscoDev01 7366: Jan 20 12:44:31.526 GMT: %SYS-5-CONFIG_I: Configured from 192.168.100.10 by snmp > >While forwarding to other syslog server, Syslog-NG is adding it's own host name to the message and sending as below: > >Jan 20 12:44:32 SYSNG.it.net CiscoDev01 7366: Jan 20 12:44:31.526 GMT: %SYS-5-CONFIG_I: Configured from 192.168.100.10 by snmp > >(Note:SYSNG.it.net = HostName of Syslog-ng server, CiscoDev01=Device hostName) > >The final syslog Server(Ciscoworks) is not treating the message is as from the CiscoDev01.There's no use of running script in Ciscoworks box to remove the entry of SYSNG.it.net. It has to be done before receiving the message > >How to avoid this at Syslog-NG level? Tried the following options, but no luck: keep_hostname(yes); chain_hostnames(no); long_hostnames(no); > >Please let me know the procedure not to append the hostname of the Syslog-NG to the message. > > >Thanks in advance, >Krishna Y > >-------------------------------------------------------- > >This email and associated attachments may contain confidential and privileged CITEC information that is provided solely for the use of the intended addressee. Views and opinions expressed in this email are those of the individual sender and are not necessarily the views and opinions of CITEC unless the sender expressly states that such views and opinions are those of CITEC. The privilege and confidentiality associated with this email and attachments will not be waived, lost or rescinded by reason of mistaken delivery. Should you receive this email by mistake, please notify the sender by return email then delete the email from your computer system. You must not use, copy, modify, print, or distribute the email or the information and attachments contained within same to any third party. CITEC does not accept any liability in respect of viruses or computer problems experienced by the recipient through access gained to this email and its attachments. >-------------------------------------------------------- > >________________________________________________________________________ >This email has been scanned for viruses by the CITEC Email Anti-Virus service powered by MessageLabs. For more information on a proactive email anti-virus service working around the clock, around the globe, visit www.citec.com.au >________________________________________________________________________ >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >

1 0

Removal of forwarder hostname ??
by krishna y 23 Jan '06

23 Jan '06

Hi, I have configured the Syslog-ng in HPUX and forwarding the messages to Ciscoworks The original message to Syslog-NG is as following: Jan 20 12:44:32 SYSNG.it.net CiscoDev01 7366: Jan 20 12:44:31.526 GMT: %SYS-5-CONFIG_I: Configured from 192.168.100.10 by snmp While forwarding to other syslog server, Syslog-NG is adding it's own host name to the message and sending as below: Jan 20 12:44:32 SYSNG.it.net CiscoDev01 7366: Jan 20 12:44:31.526 GMT: %SYS-5-CONFIG_I: Configured from 192.168.100.10 by snmp (Note:SYSNG.it.net = HostName of Syslog-ng server, CiscoDev01=Device hostName) The final syslog Server(Ciscoworks) is not treating the message is as from the CiscoDev01.There's no use of running script in Ciscoworks box to remove the entry of SYSNG.it.net. It has to be done before receiving the message How to avoid this at Syslog-NG level? Tried the following options, but no luck: keep_hostname(yes); chain_hostnames(no); long_hostnames(no); Please let me know the procedure not to append the hostname of the Syslog-NG to the message. Thanks in advance, Krishna Y

2 1

RE: Removal of forwarder hostname ??
by Michael Gehrmann 22 Jan '06

22 Jan '06

Hi, What you are looking for is a compiled option: --enable-spoof-source You can then enable it in your syslog-ng.conf using the option per destination e.g. destination syslogbox { udp("X.X.X.X" port(514) spoof_source(yes)); }; Regards Mike Message: 1 Date: 21 Jan 2006 14:36:50 -0000 From: "krishna y" <krish_bvrm(a)rediffmail.com> Subject: [syslog-ng] Removal of forwarder hostname ?? To: syslog-ng(a)lists.balabit.hu Message-ID: <20060121143650.19410.qmail(a)webmail8.rediffmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi, I have configured the Syslog-ng in HPUX and forwarding the messages to Ciscoworks The original message to Syslog-NG is as following: Jan 20 12:44:32 SYSNG.it.net CiscoDev01 7366: Jan 20 12:44:31.526 GMT: %SYS-5-CONFIG_I: Configured from 192.168.100.10 by snmp While forwarding to other syslog server, Syslog-NG is adding it's own host name to the message and sending as below: Jan 20 12:44:32 SYSNG.it.net CiscoDev01 7366: Jan 20 12:44:31.526 GMT: %SYS-5-CONFIG_I: Configured from 192.168.100.10 by snmp (Note:SYSNG.it.net = HostName of Syslog-ng server, CiscoDev01=Device hostName) The final syslog Server(Ciscoworks) is not treating the message is as from the CiscoDev01.There's no use of running script in Ciscoworks box to remove the entry of SYSNG.it.net. It has to be done before receiving the message How to avoid this at Syslog-NG level? Tried the following options, but no luck: keep_hostname(yes); chain_hostnames(no); long_hostnames(no); Please let me know the procedure not to append the hostname of the Syslog-NG to the message. Thanks in advance, Krishna Y -------------------------------------------------------- This email and associated attachments may contain confidential and privileged CITEC information that is provided solely for the use of the intended addressee. Views and opinions expressed in this email are those of the individual sender and are not necessarily the views and opinions of CITEC unless the sender expressly states that such views and opinions are those of CITEC. The privilege and confidentiality associated with this email and attachments will not be waived, lost or rescinded by reason of mistaken delivery. Should you receive this email by mistake, please notify the sender by return email then delete the email from your computer system. You must not use, copy, modify, print, or distribute the email or the information and attachments contained within same to any third party. CITEC does not accept any liability in respect of viruses or computer problems experienced by the recipient through access gained to this email and its attachments. -------------------------------------------------------- ________________________________________________________________________ This email has been scanned for viruses by the CITEC Email Anti-Virus service powered by MessageLabs. For more information on a proactive email anti-virus service working around the clock, around the globe, visit www.citec.com.au ________________________________________________________________________

1 0

Escaping problem using pipe to send to databases
by strerror 22 Jan '06

22 Jan '06

heya, I've currently got a problem that I'd have thought other people have run into but all my googling / searching hasn't come up with anything. I'm currently sending my logs to a mysql database (but I believe the problem is generic to any db) with, what seems to be the normal configuration, eg: destination db { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; The logging all works fine in normal situations. The problem I have is that I have some unusual applications, like OpenCA (www.openca.org) that do weird logging, in the case of OpenCA, dumping xml type logs into syslog. The result of this is that it seems to completely break the pipe as mysql immediately complains that the syntax is not valid sql and the pipe effectively dies. Whats particularly frustrating is that the pipe invoking script is still up and running, so its not like I can easily write a quick script to check for the condition to restart it. I've noticed that this problem can also occur with the odd hostname for my dns server as well. In short, as far as I can see, anyone who is dumping syslogs into a db using pipe would be vulnerable to someone using "logger" to dump a nastily formatted message and then having their pipe collapse. I realise that you can send the syslog to an external program (I rewrote parts of sqlsyslogd.c before using the above syslog-ng.conf) and have it sanitise the input before injecting it into the db, but as documented, there are reasons, mainly performance, as to why you'd want to avoid that mechanism. So my question to the list, is there a nice, elegant way of avoiding badly written applications / malicious users, injecting broken looking entries and causing the pipe to die? ttia, -- strerror http://www.disciplina.net Fingerprint: B6A5 CD59 E6E7 5E71 D387 937A A4EF 4495 5865 0E8F

1 0

duplicate stats counter?
by Paul Krizak 20 Jan '06

20 Jan '06

I've been getting a constant stream of these messages in my syslog-ng log, as much as 70MB worth per day: Jan 19 13:43:39 i-dl385 syslog-ng[25668]: Duplicate stats counter; counter='file(/var/log/logs/$R_YEAR/$R_MONTH/$R_DAY/$HOST-messages.log)' Jan 19 13:43:40 i-dl385 syslog-ng[25668]: Duplicate stats counter; counter='file(/var/log/logs/$R_YEAR/$R_MONTH/$R_DAY/$HOST-messages.log)' Jan 19 13:43:40 i-dl385 syslog-ng[25668]: Duplicate stats counter; counter='file(/var/log/logs/$R_YEAR/$R_MONTH/$R_DAY/$HOST-messages.log)' What does this mean? Are stats getting collected properly? Is there a bug in the stats stuff? Turning on debugging doesn't yield any more useful information... I'm using syslog-ng 1.9.8. The relevant portion of syslog-ng.conf looks like this: source s_external_syslog { udp(port(514)); }; source s_internal_syslog { unix-dgram("/dev/log"); file("/proc/kmsg" log_prefix("kernel:")); }; template t_human_readable { template("$R_FULLDATE $HOST $FACILITY.$PRIORITY $MESSAGE\n"); template-escape(no); }; destination d_host_messages { file( "/var/log/logs/$R_YEAR/$R_MONTH/$R_DAY/$HOST-messages.log" template(t_human_readable) create_dirs(yes) owner(root) group(root) perm(0644) dir_perm(0755) ); }; destination d_big_messages { file ( "/var/log/logs/messages.log" template(t_human_readable) owner(root) group(root) perm(0644) ); }; log { source(s_external_syslog); source(s_internal_syslog); destination(d_big_messages); destination(d_host_messages); }; -- Paul Krizak 5900 E. Ben White Blvd. MS 625 Advanced Micro Devices Austin, TX 78741 Linux/Unix Systems Engineering Phone: (512) 602-8775 Microprocessor Solutions Sector

2 1

Duplicates
by Ed Lucero 19 Jan '06

19 Jan '06

I am getting duplicate log entries for mail.notice and mail.warning. I am also not quite clear on the garbage collecting parameters. Thanks for your help. :) Ed syslog-ng 1.6.9 The initital syslog-ng.conf file was created by the FreeBSD Port. I have modified the entries for mail to isolate mail logging. I am logging for 13 FreeBSD servers and 1 Pix Firewall The daily throughput is 7.3 million log entries per day. This will increase by 5 in the next few months as we migrate from the old mail servers to the new mail servers Below is the current configuration file. Here are the mail entries. destination maillog { file("/var/log/$HOST/maillog"); }; filter f_mail { facility(mail); }; filter f_m_info { level(info,notice,warning,debug); }; log { source(src); filter(f_mail); filter(f_m_info); destination(maillog);}; Hardware configuration ---------------------- DELL Poweredge 2850 Dual 3.0GHZ Xeon Processors 2G Memory OS on Mirrored 73G 10K Ultra320 SCSI SYSLOG on Mirrored 300G 10K Ultra320 SCSI Running FreeBSD 6 using a SMP kernel syslog-ng.conf -------------- # # This sample configuration file is essentially equilivent to the stock # FreeBSD /etc/syslog.conf file. # # # options # options { time_reopen (1); log_fifo_size (999999); use_fqdn(yes); keep_hostname (yes); create_dirs(yes); sync(0); use_dns (yes); dns_cache(yes); dns_cache_size(1000); dns_cache_expire(604800); gc_idle_threshold(600); gc_busy_threshold(500000); }; # # sources # source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); tcp(); udp(); internal(); file("/dev/klog"); }; # # destinations # destination clamav { file("/var/log/$HOST/clamav"); }; destination messages { file("/var/log/$HOST/messages"); }; destination security { file("/var/log/$HOST/security"); }; destination authlog { file("/var/log/$HOST/auth.log"); }; destination maillog { file("/var/log/$HOST/maillog"); }; destination firewall { file("/var/log/firewall/firewall"); }; destination lpd-errs { file("/var/log/$HOST/lpd-errs"); }; destination xferlog { file("/var/log/$HOST/xferlog"); }; destination cron { file("/var/log/$HOST/cron"); }; destination debuglog { file("/var/log/$HOST/debug.log"); }; destination consolelog { file("/var/log/console.log"); }; destination all { file("/var/log/all.log"); }; destination newscrit { file("/var/log/news.crit"); }; destination newserr { file("/var/log/news.err"); }; destination newsnotice { file("/var/log/news.notice"); }; destination slip { file("/var/log/slip.log"); }; destination ppp { file("/var/log/ppp.log"); }; destination console { file("/dev/console"); }; destination allusers { usertty("*"); }; #destination loghost { udp("loghost" port(514)); }; # # log facility filters # filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_not_authpriv { not facility(authpriv); }; filter f_console { facility(console); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_not_mail { not facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # # log level filters # filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info,debug); }; filter f_debug { level(debug..emerg); }; filter f_is_debug { level(debug); }; filter f_m_notice { level(notice); }; filter f_m_info { level(info,notice,warning,debug); }; # # program filters # filter f_ppp { program("ppp"); }; filter f_slip { program("startslip"); }; # # *.err;kern.warning;auth.notice;mail.crit /dev/console # log { source(src); filter(f_err); destination(console); }; log { source(src); filter(f_kern); filter(f_warning); destination(console); }; log { source(src); filter(f_auth); filter(f_notice); destination(console); }; log { source(src); filter(f_mail); filter(f_crit); destination(console); }; # # *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages # log { source(src); filter(f_notice); filter(f_not_mail); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_lpr); filter(f_info); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # # clamav # log { source(src); filter(f_local6); destination(clamav); }; # # security.* /var/log/security # log { source(src); filter(f_security); destination(security); }; # # auth.info;authpriv.info /var/log/auth.log log { source(src); filter(f_auth); filter(f_info); destination(authlog); }; log { source(src); filter(f_authpriv); filter(f_info); destination(authlog); }; # # mail.info /var/log/maillog # log { source(src); filter(f_mail); filter(f_m_info); destination(maillog); }; # # lpr.info /var/log/lpd-errs # log { source(src); filter(f_lpr); filter(f_info); destination(lpd-errs); }; # # ftp.info /var/log/xferlog # log { source(src); filter(f_ftp); filter(f_info); destination(xferlog); }; # # cron.* /var/log/cron # log { source(src); filter(f_cron); destination(cron); }; # # *.=debug /var/log/debug.log # log { source(src); filter(f_is_debug); destination(debuglog); }; # # *.emerg * # #log { source(src); filter(f_emerg); destination(allusers); }; # # uncomment this to log all writes to /dev/console to /var/log/console.log # console.info /var/log/console.log # #log { source(src); filter(f_console); filter(f_info); destination(consolelog); }; # # uncomment this to enable logging of all log messages to /var/log/all.log # touch /var/log/all.log and chmod it to mode 600 before it will work # *.* /var/log/all.log # #log { source(src); destination(all); }; # # uncomment this to enable logging to a remote loghost named loghost # *.* @loghost # #log { source(src); destination(loghost); }; # # uncomment these if you're running inn # news.crit /var/log/news/news.crit # news.err /var/log/news/news.err # news.notice /var/log/news/news.notice # #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; #log { source(src); filter(f_news); filter(f_err); destination(newserr); }; #log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; # # !startslip # *.* /var/log/slip.log # log { source(src); filter(f_slip); destination(slip); }; # # !ppp # *.* /var/log/ppp.log # log { source(src); filter(f_ppp); destination(ppp); };

1 0

error messages in start syslog-ng
by Gustavo Mendes de Carvalho 19 Jan '06

19 Jan '06

Hi Jesse, Tks for the tip, but now, do you have any idea about some good value to define in both parameters ? I defined CONSOLE_LOG_LEVEL=6 (INFO level) and KERNEL_RINGBUF_SIZE=16392 is the default value. I'm concerned about second one. Is it too high or too low ? Tks in advance Gustavo

1 0

error messages in start syslog-ng
by Gustavo Mendes de Carvalho 18 Jan '06

18 Jan '06

Hi All, I made some specific configurations in my syslog-ng.conf file, and when I tried to restart syslog-ng services, I got those messages: CONSOLE_LOG_LEVEL is of unaccepted value. KERNEL_RINGBUF_SIZE is of unaccepted value. Does anybody knows or has some tip about this message ? Tks in advance Gustavo Mendes de Carvalho gmcarvalho(a)gmail.com

2 1

Reference doc for 1.6 ?
by Per Jessen 15 Jan '06

15 Jan '06

http://www.balabit.com/products/syslog_ng/reference-1.6/syslog-ng.html reference-1.6/syslog-ng.html.tar.gz This URL produces a 404 ? /Per Jessen, Zürich -- http://www.spamchek.com/ - managed anti-spam and anti-virus solution. Let us analyse your spam- and virus-threat - up to 2 months for free.

1 1

log to mysql and to logfile simultaneously
by Natxo Asenjo 15 Jan '06

15 Jan '06

hi all, After stfw and not being able to find answer to that question, I decide to ask it here: is it possible to both log to a database (mysql in my case) and to the normal logfiles at the same time? Thanks in advance for your reply, Natxo Asenjo

2 1

mysql + logfiles
by natxete＠asenjo.nl 13 Jan '06

13 Jan '06

hi, Is it possible to log both to mysql and to syslog files? Thanks in advance, -- Groeten, J.I.Asenjo

2 1

defining stats() option causes syntax error when starting syslog-ng
by def 13 Jan '06

13 Jan '06

My syslog is filled with STATS lines every 2 minutes so I decided to delay the stats every 1 hour, or 3600 seconds. I added this to my options line but it causes a syntax error in the conf. The problem also occurred in the previous 1.9 build. Slackware 10.2 # uname -a && syslog-ng -V Linux santo 2.6.14.3 #1 Wed Dec 7 22:59:32 EST 2005 i686 unknown unknown GNU/Linux syslog-ng 1.9.8 # cat /usr/local/etc/syslog-ng.conf | grep options options { stats(3600); long_hostnames(off); sync(0); }; I stop and start syslog-ng. rc.syslog is a script i found but it also happens when just executing syslog-ng by itself. root@santo:/etc/rc.d# ./rc.syslog start syslog-ng service starting. syntax error at 12 root@santo:/etc/rc.d# Now I remove the stats() option # cat /usr/local/etc/syslog-ng.conf | grep options options { long_hostnames(off); sync(0); }; root@santo:/etc/rc.d# ./rc.syslog start syslog-ng service starting. root@santo:/etc/rc.d# syslog-ng starts successfully Thanks for any help you may be able to provide -Sean

3 2

logging of auth-priv
by Peter Koinange 12 Jan '06

12 Jan '06

I have just installed syslog-ng and am logging to a mysql database. I am trying to implement a centralized syslog system. Everything is working well except for auth-priv facility. I cannot seem to get to them sent to the centralized database. When l run test with logger on the remote computer get the following error logger: unknown facility name: auth-priv. however syslog on the remove computer has the entry # The authpriv file has restricted access. authpriv.* /var/log/secure and is logging to the secure file with no problems when I add an entry for the remote compter to send the info authpriv.* @host.me.com the logs do not show up. Can someone advise me on what to I can Peter Koinange

3 5

repeat messages
by Nichols, Nancy 11 Jan '06

11 Jan '06

We recently changed our system logging code from sysklogd to syslog-ng version 1.9.6 and seem to have lost the following functionality: When consecutively logged messages are identical, instead of seeing each individual duplicate message in the logfile, we see the message "Last message repeated # times". Syslog-ng doesn't seem to support this feature though there is code in log_msg_parse() that tests for 'repeat_msg_string' (defined as "last message repeated"). Why would this test be here if syslog-ng isn't supporting these messages? If the feature is indeed supported, what do I need to do to get it to work? If not, are there plans to add it? When? Thanks Nancy Nichols

1 0