- syslog-ng - lists.balabit.hu

Monitoring a syslogd file?
by Jeremiah Rothschild 11 Jan '06

11 Jan '06

Hi all, I have completely replaced syslogd with syslog-ng on my main system and it is great! Thank you much for all the work that has gone into it. I am a very grateful user and wanted to give praise where due! However, I do have another system with lesser needs that I am unsure how to correctly configure. I'm hoping someone here may be able to provide me with some insight. What I'm wanting to do is set up syslog-ng to monitor one of the files that syslogd is writing. Specifically, I have a custom application that is writing to /var/log/messages and I'd like syslog-ng to monitor that file for events generated by the application then have them re-wrote to a different log file. I have read the reference manual, and tried messing around with the file() driver, but don't seem to be getting anywhere. Additionally, I searched the last six months of the mailing list archive but saw no related threads. Any helps is greatly appreciated. Thanks again! jeremiah

2 1

Strange ... IP Address instead of the machine name ....
by fredzy padzy 10 Jan '06

10 Jan '06

Hello everyone, I'm centralizing the logs of ten servers in on central one, thanks to syslog-ng, and some syslogd on the servers (which are different OS, like AIX, Solaris, HP UX ...). I use php-syslog as a web interface, and it works great =) But i've noticed that my php-syslog has got one problem : In the 'server' comboBox, i can see some IP address and just a few name, which aren't DNS ones. I'm not sure where my central server has found thoses names ( maybe in the packets send by the clients) but i've checked the file /etc/hosts of this central server. I've written down there the ip addresses (of the comboBox) followed by a 'tab' and then, the name that i want to be displayed .... But nothing to do ... i desn't work like that. So maybe someone can help me :) thanks a lot :=)

3 2

append write mode
by Fiorenzi Alessandro 10 Jan '06

10 Jan '06

Is there any way to configure syslog-ng to write log in append mode like have chttr +a on the file ? with file system permission cannot get the same result. this should be interest for forensics because of integrity of the file. Thanks very much Alessandro Fiorenzi

1 0

Php-syslog-ng : Strange ... IP address instead of the machine name ...
by fridzy padzy 10 Jan '06

10 Jan '06

Hello everyone, I'm centralizing the logs of ten servers in on central one, thanks to syslog-ng, and some syslogd on the servers (which are different OS, like AIX, Solaris, HP UX ...). I use php-syslog as a web interface, and it works great =) But i've noticed that my php-syslog has got one problem : In the 'server' comboBox, i can see some IP address and just a few name, which aren't DNS ones. I'm not sure where my central server has found thoses names ( maybe in the packets send by the clients) but i've checked the file /etc/hosts of this central server. I've written down there the ip addresses (of the comboBox) followed by a 'tab' and then, the name that i want to be displayed .... But nothing to do ... i doesn't work like that. So maybe someone can help me :) thanks a lot :=) _________________________________________________________________ Tout savoir sur la sécurité de vos enfants sur Internet ! http://go.msn.fr/10-channel/80-security/protection/default.asp

1 0

Re: syslog-ng Digest, Vol 9, Issue 8
by dwarnock＠harbrook.net 09 Jan '06

09 Jan '06

I am on holiday from Tuesday 3rd January returning on Monday 9th January. If your query is urgent please contact the office on +44 (0) 1423 508060 or email Neil Harvey at nharvey(a)harbrook.net Regards David Warnock

1 0

Re: syslog-ng Digest, Vol 9, Issue 7
by dwarnock＠harbrook.net 08 Jan '06

08 Jan '06

I am on holiday from Tuesday 3rd January returning on Monday 9th January. If your query is urgent please contact the office on +44 (0) 1423 508060 or email Neil Harvey at nharvey(a)harbrook.net Regards David Warnock

1 0

Re: syslog-ng Digest, Vol 9, Issue 6
by dwarnock＠harbrook.net 07 Jan '06

07 Jan '06

I am on holiday from Tuesday 3rd January returning on Monday 9th January. If your query is urgent please contact the office on +44 (0) 1423 508060 or email Neil Harvey at nharvey(a)harbrook.net Regards David Warnock

1 0

Named Log Entries in the Config File
by Kenneth Kassing 06 Jan '06

06 Jan '06

Hello, I am writing a program to make updates tho the syslog-ng configuration file. To allow for easily adding and removing log entries, I updated the parser gramer to allow a name field in the log entry. The name is optional, so old log files will still work. This name is not used by syslog-ng in any way. Example: Both log entries below are valid with my grammar update. log { source(s_all); filter(f_syslog); destination(df_syslog); }; log l_syslog { source(s_all); filter(f_syslog); destination(df_syslog); }; A patch generated with the following command is attached: "diff -uprN src/cfg-grammar.y.org src/cfg-grammar.y > ~/cfg-grammar.y.diff" --- src/cfg-grammar.y.org 2006-01-04 11:04:19.000000000 -0500 +++ src/cfg-grammar.y 2006-01-04 11:06:08.000000000 -0500 @@ -113,6 +113,8 @@ LogTemplate *last_template; %type <ptr> source_stmt %type <ptr> dest_stmt %type <ptr> log_stmt +%type <ptr> log_stmt_name +%type <ptr> log_stmt_noname %type <ptr> options_stmt %type <ptr> template_stmt @@ -202,7 +204,16 @@ dest_stmt ; log_stmt - : '{' log_items log_flags '}' { $$ = log_connection_new($2, $3); } + : log_stmt_noname { $$ = $1; } + | log_stmt_name { $$ = $1; } + ; + +log_stmt_name + : string '{' log_items log_flags '}' { $$ = make_log_connection($3, $4); } + ; + +log_stmt_noname + : '{' log_items log_flags '}' { $$ = make_log_connection($2, $3); } ; options_stmt

3 4

Re: syslog-ng Digest, Vol 9, Issue 5
by dwarnock＠harbrook.net 06 Jan '06

06 Jan '06

I am on holiday from Tuesday 3rd January returning on Monday 9th January. If your query is urgent please contact the office on +44 (0) 1423 508060 or email Neil Harvey at nharvey(a)harbrook.net Regards David Warnock

1 0

phpsyslogng-2.8 configuration Problem
by anil saka 05 Jan '06

05 Jan '06

Hi , I am having problem in configuring syslog-ng : once i edit the dbset.sql with my password under "PW_HERE" and update the same password in config.php. I started the syslog-ng daemon . when i try to login the GUI .. it says : Fatal error: Call to undefined function: sha1() in /var/www/html/includes/common_funcs.php on line 26 can sombody help in in getting this done.. FYI : I am using : phpsyslogng-2.8 mysql 4.0.25 PHP-4.1.2-2.2 Regards, Anil

1 0

Re: syslog-ng Digest, Vol 9, Issue 4
by dwarnock＠harbrook.net 05 Jan '06

05 Jan '06

I am on holiday from Tuesday 3rd January returning on Monday 9th January. If your query is urgent please contact the office on +44 (0) 1423 508060 or email Neil Harvey at nharvey(a)harbrook.net Regards David Warnock

1 0

RE: [syslog-ng]Pix problem
by SOLIS, ALEX 05 Jan '06

05 Jan '06

If you don't have too many assets to log from, I found that filtering by facility proved an effective logging method. 1. Setup your pix to send all its logs via a certain facility. For example local0. The pix command will look something like "logging facility 16". (note: Facilities have a corresponding ID in PIX IOS. Local0 starts at 16 and increments all the way to local7 which is 23.) 2. Setup the PIX to send its logs via UDP to the loghost server. Assuming Your loghost is on the inside of your PIX the command will look something like this: "logging host inside x.x.x.x". Be careful if you plan to use TCP for logging as the PIX will not allow communication between its interfaces if your syslog server fails! 3. Now modify the syslog-ng.conf file on you loghost with the appropriate destination, filter, and log statements. For example, to capture the PIX logs and send them to a private file we would have: destination pix { file("/var/log/pix"); }; filter f_pix { facility(local0); }; log { source(src); filter(f_pix); destination(pix); }; restart syslog-ng and you should be in business. If you don't see enough information (or too much) play with the PIX's logging levels. There are 7 of them with 7 being the most verbose. Hope that helps. Alex -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Andrew Meyer Sent: Tuesday, December 27, 2005 9:55 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng]Pix problem OK.....is there a way to log/define all 8 logging facilities in syslog-ng this is all new to me, and i'm following a debian tutorial. So any other info you can give me would be awsome. Thank you, Andrew --- Asher Yanich <ayanic01(a)cs.fiu.edu> wrote: > You will not want to setup TCP syslog from the PIX. > Even though the > PIX can connect and log via TCP to syslog, any error > will cause the > PIX to stop logging to syslog. > > Here are docs for setting up logging to syslog for > pix OS 7.0. I > believe the syntaz is the same for 5.x and 6.x but a > quick google > search should provide you with what you need. > > -asher > > > On 12/27/05, Andrew Meyer <andrewm659(a)yahoo.com> > wrote: > > How do I setup a PIX with syslog-ng? what are the > > values I can use? Do I need to specify the IP > addy of > > the PIX? What about the protocol I want to > capture, > > what if i want to capture UDP and TCP? How would > I > > set it up if i wanted all the data from my PIX to > go > > the syslog-ng server? > > > > Thank you, > > Andrew Meyer > > andrewm659(a)yahoo.com > > > > --- Damien Michau <d.michau(a)ag.com> wrote: > > > > > this is the server actual ip > > > ----- Original Message ----- > > > From: "Bill Nash" <billn(a)billn.net> > > > To: <syslog-ng(a)lists.balabit.hu> > > > Sent: Tuesday, May 10, 2005 7:20 PM > > > Subject: Re: [syslog-ng]Pix problem > > > > > > > > > > On Tue, 10 May 2005, Damien Michau wrote: > > > > > > > >> Hi All ! > > > >> I have some probleme ta log my pix's log into > my > > > syslog-ng server . > > > >> i have mounted a Syslog-ng server to store my > > > pix's log . But there is > > > >> nothing in my pix.log > > > >> i'have put this lines in my syslog-ng.conf > > > >> > > > >> > > > >> source pix { udp(ip(10.60.10.111) port());}; > > > >> destination pix { > file("/var/log/pix.log"); > > > }; > > > >> log { source(pix);destination(pix); }; > > > >> > > > > > > > > Your source declaration shouldn't be the IP of > > > your pix, it should be the > > > > IP on your syslog server you wish your udp > socket > > > to listen on. In most > > > > cases, this should just be 0.0.0.0 or your > servers > > > actual IP. > > > > > > > > - billn > > > > > _______________________________________________ > > > > syslog-ng maillist - > syslog-ng(a)lists.balabit.hu > > > > > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > Frequently asked questions at > > > http://www.campin.net/syslog-ng/faq.html > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > syslog-ng maillist - > syslog-ng(a)lists.balabit.hu > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at > > > http://www.campin.net/syslog-ng/faq.html > > > > > > > > > > > > I'm worth a million in prizes > > With my torture film > > Drive a GTO > > Wear a uniform > > On a government loan. > > > > > > > > __________________________________________ > > Yahoo! DSL ï¿½ Something to write home about. > > Just $16.99/mo. or less. > > dsl.yahoo.com > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > I'm worth a million in prizes With my torture film Drive a GTO Wear a uniform On a government loan. __________________________________ Yahoo! for Good - Make a difference this year. http://brand.yahoo.com/cybergivingweek2005/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

6 11

Syslog message reformat
by Michael Gehrmann 04 Jan '06

04 Jan '06

Hi All, I have a vendor who has implemented their syslog message with a year in the date field e.g. Apr 15 10:06:19 2005 The vendor believes this to be a correct interpretation of the RFC (it's wrong if you read the next two paragraphs in the RFC) and will not change their software. Has anyone got any ideas on how I can kill the year field so I can use standard reporting/filtering tools? -- Michael Gehrmann Security Administrator Education Qld Facilities Management Office Ph. (07) 322 22889 Fax. 07 322 22868 -------------------------------------------------------- This email and associated attachments may contain confidential and privileged CITEC information that is provided solely for the use of the intended addressee. Views and opinions expressed in this email are those of the individual sender and are not necessarily the views and opinions of CITEC unless the sender expressly states that such views and opinions are those of CITEC. The privilege and confidentiality associated with this email and attachments will not be waived, lost or rescinded by reason of mistaken delivery. Should you receive this email by mistake, please notify the sender by return email then delete the email from your computer system. You must not use, copy, modify, print, or distribute the email or the information and attachments contained within same to any third party. CITEC does not accept any liability in respect of viruses or computer problems experienced by the recipient through access gained to this email and its attachments. -------------------------------------------------------- ________________________________________________________________________ This email has been scanned for viruses by the CITEC Email Anti-Virus service powered by MessageLabs. For more information on a proactive email anti-virus service working around the clock, around the globe, visit www.citec.com.au ________________________________________________________________________

2 1

Re: syslog-ng Digest, Vol 9, Issue 3
by dwarnock＠harbrook.net 04 Jan '06

04 Jan '06

I am on holiday from Tuesday 3rd January returning on Monday 9th January. If your query is urgent please contact the office on +44 (0) 1423 508060 or email Neil Harvey at nharvey(a)harbrook.net Regards David Warnock

1 0

SSL encapsulation for TCP transport?
by Bill Nash 03 Jan '06

03 Jan '06

Is it planned? I'm lookin around, and see previous mention of it, but nothing concrete. Yes, I know you can just tunnel the session, but I'd prefer native transport. - billn

3 2

Re: syslog-ng Digest, Vol 9, Issue 1
by dwarnock＠harbrook.net 03 Jan '06

03 Jan '06

I am on holiday from Tuesday 3rd January returning on Monday 9th January. If your query is urgent please contact the office on +44 (0) 1423 508060 or email Neil Harvey at nharvey(a)harbrook.net Regards David Warnock

1 0

rhost field
by ken.schweiker＠faa.gov 29 Dec '05

29 Dec '05

I am using syslog-ng for the first time. The initial setup is complete and appears to be working ok. However in my test environment, I am logging from a redhat desktop using syslog to a suse syslog-ng server. The output, after I deliberately input an incorrect password on my workstation doing a 'su', gets reported to the syslog-ng server as ....... Dec 23 17:50:12 suselog/suselog su(pam_unix)[13205]: authentication failure; logname=syss555 uid=500 euid=0 tty=pts/4 ruser=syss555 rhost= user=root How do I get it to display in the log the host(IP) the message came from? Thanks.

4 11

FC4 as Syslog-NG Server (to MySql)
by Vadim Pushkin 28 Dec '05

28 Dec '05

Hello; I am trying to get syslog-ng running as a centralized server, with data going to a mysql db. So far I've: 1. Installed mysql and have sucessfully created a db named syslogng. (confirmed with a show databases; and show tables;) 2. I have created a FIFO file as /tmp/mysql.pipe. 3. Am running mysql in the following manner: mysql -u username --password=userpassword syslogng </tmp/mysql.pipe I do not think that I've properly configured my syslog-ng.conf file to redirect all output to the DB. The FAQ, which has been very nice to me thus far, is somewhat confusing as to how to properly create the .conf file for usage this way. All test writes never appear within my DB, confirmed by running "mysql> select * from logs;". Ultimately, my goal is to log syslog data from routers, switches, Solaris/Sparc, Linux machines to this machine. The machine is within a trusted environment. Any help would be much appreciated, and I apologize in advance if I've misread the obvious somewhere... Vadim Anatoly Pushkin -- The Ukranian Stallion --

2 1

file written in the wrong place
by Paolo Supino 28 Dec '05

28 Dec '05

Hi I've installed syslog-ng 1.6.8 on a Linux FC4 system to act as a centeralized logging server. For a while everything was fine, until I tried to add another statement to one of the filters. After the addition syslog-ng started writing the destination files in the wrong places, writing the same file in 2 locations and ignoring messages sent from certain origins. Here are the relevant parts of my syslog-ng.conf: # Global options options { sync (0); time_reopen (1); log_fifo_size (999999); long_hostnames (yes); use_dns (yes); dns_cache(yes); dns_cache_size(1000); dns_cache_expire(604800); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); }; # source source s_net { udp(ip("192.168.1.100") port(514)); }; # destinations destination d_switch { file("/var/log/company/switches/$HOST.log" perm(0644)); }; destination d_edge { file("/var/log/company/edge_devices/$HOST.log" perm(0644)); }; destination d_fw { file("/var/log/company/firewalls/$HOST.log" perm(0644)); }; destination d_router { file("/var/log/company/routers/$HOST.log" perm(0644)); }; # filters filter f_edge { host("edge*") or host("10.10.*"); }; filter f_router { host("3600-primary") or host("backbone-3550") or host("secondary-3550"); }; filter f_switch { host("sw*") or host("backbone-5510") or host(pp8600*); }; filter f_fw { host("fw*"); }; # wrap everything up log { source(s_net); filter(f_switch); destination(d_switch); }; log { source(s_net); filter(f_router); destination(d_router); }; log { source(s_net); filter(f_edge); destination(d_edge); }; log { source(s_net); filter(f_fw); destination(d_fw); }; # end of configuration file when I run the command `find /var/log/company -type f -print` I get the following output: ./firewalls/fw-backup.log ./firewalls/edge-location1.log ./firewalls/fwmgmt.log ./edge_devices/edge-location2.log ./edge_devices/edge-location3.log ./edge_devices/edge-location4.log ./edge_devices/edge-location5.log ./edge_devices/edge-location6.log ./edge_devices/edge-location7.log ./edge_devices/edge-location8.log ./edge_devices/edge-location9.log ./edge_devices/edge-location1.log ./edge_devices/edge-location10.log ./edge_devices/edge-location11.log ./switches/edge-location3.log ./switches/fw-backup.log ./switches/edge-location6.log ./switches/edge-location7.log ./switches/edge-location11.log ./switches/edge-location12.log I tried to upgrade syslog-ng to 1.6.9 but it didn't resolve the problems. Any idea on why this happnes and how to fix this will be greatly appriciated. TIA Paolo PS - the systems sending the syslog messages are nortel switches, Checkpoint firewalls and edge devices. __________________________________ Yahoo! for Good - Make a difference this year. http://brand.yahoo.com/cybergivingweek2005/

4 22

backup syslog mysql database
by nikolay.nenchev＠rbb-sofia.raiffeisen.at 28 Dec '05

28 Dec '05

Dear list, I am using syslog-ng from some time and it is one realiable and easy for configuration software. But I have notice 2 issues in my configuration, which i have not solved yet. I'm using: # syslog-ng -V syslog-ng 1.6.5 on debian 3.1, uname -a: Linux logsrv 2.4.27-2-386. 1.I'm logging to mysql 4.0 db with pipe. The pipe is locate in /tmp/mysql.pipe. But it is not starting with system startup.I have tried to use script for initial startup script like: ################################################################## #!/bin/bash if [ -e /tmp/mysql.pipe ] then while [ -e /tmp/mysql.pipe ] do mysql -u loguser --password=XXXX syslog < /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi ################################################################## I have read somewhere that the pipe must be located in somewhere else and stuff like this but did not find a solution. Also what should be the order of starting syslog-ng, mysql and mysql.pipe? So if you have experience such a problem can you guide me through it? 2. and second issue is how to backup this mysql db (i know that it is a little bit of topic). Because the syslog db is nearly 5GB and like to extract and compress it. have try with mysqlhotcopy but it is locking database for time of cp db to another place which last time was around 10 minutes. Thanks in advance, Nikolay Nenchev

1 0

Pix problem
by Damien Michau 28 Dec '05

28 Dec '05

Hi All ! I have some probleme ta log my pix's log into my syslog-ng server . i have mounted a Syslog-ng server to store my pix's log . But there is nothing in my pix.log i'have put this lines in my syslog-ng.conf source pix { udp(ip(10.60.10.111) port());}; destination pix { file("/var/log/pix.log"); }; log { source(pix);destination(pix); }; Have you one idea ? Thx Damien Michau Paris

4 5

What is my incoming data
by David Anderson 26 Dec '05

26 Dec '05

Hi, I am trying to set up syslog-ng to process data from my router on port 514, but I don't know the format of the data to be able to build filters. Is there any way to collect all data on 514 to a file? My current filters, etc are: # # the draytek router # filter f_draytek { host("router") and not match("Local User") and not match("virtual\Server"); }; filter f_draytek_DSL_1 { host("router") and match("DSL"); }; filter f_draytek_DSL_2 { host("router") and match("ADSL_Status"); }; filter f_draytek_PPP { host("router") and match("PoE"); }; destination draytek { file("/var/log/draytek/draytek.log"); }; destination draytek_null { file("/dev/null"); }; destination draytek_dsl { file("/var/log/draytek/draytek_dsl.log"); }; destination draytek_ppp { file("/var/log/draytek/draytek_ppp.log"); }; log { source(src); filter(f_draytek); destination(draytek); }; log { source(src); filter(f_draytek_DSL_1); destination(draytek_dsl); }; log { source(src); filter(f_draytek_DSL_2); destination(draytek_dsl); }; log { source(src); filter(f_draytek_PPP); destination(draytek_ppp); }; The log files have no info, so I presume there is something wrong somewhere (the conf is from someone who had everything working (apart from the /dev/null). It would presumably be easier if I could see the raw data. Originally the 514 data was being blocked by the firewall, but that is now cleared. Any help would be appreciated. -- Best regards, David mailto:dma@pern.co.uk

3 2

syslog-ng and selinux
by Ronny Vaningh 26 Dec '05

26 Dec '05

I just installed syslog-ng 1.6.9 on a centos 4.2 machine and syslog-ng doesnt start even after setting setsebool -P use_syslogng=1 I still get the error Starting system logger: Error opening file /proc/kmsg for reading (Permission denied) However it seems that syslog-ng tries to write to /prc/kmsg instead of reading it type=AVC msg=audit(1135510199.139:26): avc: denied { write } for pid=11942 comm="syslog-ng" name="kmsg" dev=proc ino=-268435446 scontext=root:system_r:syslogd_t tcontext=system_u:object_r:proc_kmsg_t tclass=file I'm a little bit puzzled why syslog-ng tries to write to /proc/kmsg instead of just reading messages of it. I can off course change the policy to allow writing but I feel that I must be doing something wrong here Thanks Ronny

2 2

log_msg_size in syslog-ng 1.6.7
by Nitass Sutaveephamochanon 26 Dec '05

26 Dec '05

Hello All, I got a problem about log_msg_size in syslog-ng 1.6.7. How can I know which process generates too long message to the syslog-ng? 2005:12:26-12:42:07 dent syslog-ng[6083]: Message length overflow, line is split, log_msg_size=2048 Please advice too. Thanks and regards, Nitass

1 0

convert logoutput to syslog
by Mark F 24 Dec '05

24 Dec '05

We use a commercial content management system that does not log to syslog but has its own log files. I can however modify where the log files are written via a config file directive. I'm interested in writing (or acquiring) a small program to convert the proprietary log output to something more syslog-ng like and redirect the stream to syslog-ng. I could probably use the logger command to accomplish the latter but how to convert the log output to use syslog facilities is the real question. Any advice, has anyone done something like this before? Thanks, -Mark

2 1