- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Program Filters
by Metal Gear 27 May '05

27 May '05

Still there are no compilation errors now but i m not having any logs of ftp and ssh when i remove filters then i get the bunch of logs. Setting the filters for facility(auth, authpriv) is working but it gives only the users who are successfully connected theu ssh or ftp. I m sending my syslog-ng.conf using filters but i m not getting the logs of it. source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; source stunnel {tcp(ip("127.0.0.1 <http://127.0.0.1>") port(514) keep-alive(yes));}; filter f_ftp {program(".*ftp*.");}; filter f_ssh {program(".*ssh*.");}; log {source(src); filter(f_syslog); filter(f_ftp); filter(f_ssh); destination(dest2);}; log {source(stunnel); filter(f_syslog); filter(f_ftp); filter(f_ssh); destination(dest2);}; Thanks

2 1

Get "warning: ignoring #pragma" warnings when compiling libol-0.3.16 on HP-UX
by Jenny-Lou Sequeira 27 May '05

27 May '05

If I just run #./configure CC=gcc CFLAGS="-v #make It compiles fine. Looking at the log from make the include path is: . /usr/local/include /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include /usr/include However, if I restrict the "Include" path to the following ./configure CC=gcc CFLAGS="-v -nostdinc -O2" CPPFLAGS="-I/usr/local/include -I/usr/local/lib/gc/ia64-hphpux11.23/3.4.3/include -I/usr/include" "make" spews out warnings like: /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include/stdlib.h:30: warning: ignorin g #pragma builtin_milli abs /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include/stdlib.h:31: warning: ignorin g #pragma extern abs /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include/stdlib.h:65: warning: ignorin g #pragma builtin_milli div /usr/include/sys/signal.h:174: warning: ignoring #pragma extern signal /usr/include/sys/signal.h:191: warning: ignoring #pragma extern kill /usr/include/sys/signal.h:192: warning: ignoring #pragma extern sigismember /usr/include/sys/signal.h:193: warning: ignoring #pragma extern sigpending Thanks, Jenny-Lou

1 0

SV: [syslog-ng] syslog-ng 1.6.8 has been released
by kenneth.gullberg＠foreningssparbanken.se 26 May '05

26 May '05

Hi, Here is a small suggestion for the INSTALL file in the next release for unexperienced admin's: Solaris 10 ---------- For successful compilation on Solaris 10 you need to use --enable-full-dynamic when you run configure. // Kenneth -----Ursprungligt meddelande----- Från: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] För Balazs Scheidler Skickat: den 26 maj 2005 10:46 Till: syslog-ng(a)lists.balabit.hu Kopia: syslog-ng-announce(a)lists.balabit.hu Ämne: [syslog-ng] syslog-ng 1.6.8 has been released Hi, I have released syslog-ng 1.6.8 containing some configure tweaks, a 64bit compatibility fix and a use_fqdn() fix when getting local hostnames. The NEWS entry is below: News for the 1.6.8 release Thu, 26 May 2005 10:24:33 +0200 * Some configure tweaking to detect proper ld options dynamically on Linux, Solaris and HP-UX. Other platforms might still have problems with static linking. * Some minor manpage fixes. * Use use_fqdn() option when determining local hostname instead of directly using the possibly short hostname returned by gethostname(). * Fixed a 64 bit compatibility issue when resolving hostnames. The release can be found at the usual place: http://www.balabit.com/products/syslog-ng/upgrades.bbq -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng 1.6.8 has been released
by Balazs Scheidler 26 May '05

26 May '05

Hi, I have released syslog-ng 1.6.8 containing some configure tweaks, a 64bit compatibility fix and a use_fqdn() fix when getting local hostnames. The NEWS entry is below: News for the 1.6.8 release Thu, 26 May 2005 10:24:33 +0200 * Some configure tweaking to detect proper ld options dynamically on Linux, Solaris and HP-UX. Other platforms might still have problems with static linking. * Some minor manpage fixes. * Use use_fqdn() option when determining local hostname instead of directly using the possibly short hostname returned by gethostname(). * Fixed a 64 bit compatibility issue when resolving hostnames. The release can be found at the usual place: http://www.balabit.com/products/syslog-ng/upgrades.bbq -- Bazsi

1 0

host$
by Speedy Sweedy 26 May '05

26 May '05

I am new to this list and new to syslog-ng so please forgive me if this question has been asked before. I looked through the archive but didn't come across anything that helped me. I have syslog-ng working on my FC3 box with SELinux set at its highest setting(wow that was fun!) but it logs the IP address of the remote host instead of the hostname. I can't seem to get it to log anything different than the IP address of the box sending the log. Here is my options in syslog-ng.conf: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; what am I doing wrong? Regards, The Speedster _________________________________________________________________ MSN® Calendar keeps you organized and takes the effort out of scheduling get-togethers. http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*.

3 4

RE: [syslog-ng] host$
by SOLIS, ALEX 25 May '05

25 May '05

My syslog-ng setup will resolve to hostnames as long as the /etc/resolv.conf or /etc/hosts entries are valid. If you ping the hosts logging to your box by IP does it resolve to the hostname? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Speedy Sweedy Sent: Wednesday, May 25, 2005 12:34 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] host$ >Most likely, you have a borked syslog-ng.te that doesn't allow the >syslog-ng >process to read /etc/nsswitch.conf or similar, breaking DNS lookups. I used an RPM to install syslog-ng - could I get away with downloading the source, compile it and replace the syslog-ng bin? > >Grep through your logs and find any avc entries that reference syslog-ng. > >(And BTW - FC4 is about to escape, I'd *strongly* recommend upgrading to it >if you're doing any SELinux work - the policy definitions have been worked >on a *lot*. If you can't upgrade, at least get the updated SELinux RPMs >(they >should work OK on the FC3 kernel)). Yeah, I've read about FC4 being much better for syslog-ng. I'm about ready to start over using the FC4 test3 iso's but didn't know what happens once fc4 is released as far as installing the new released version. _________________________________________________________________ Don't just Search. Find! http://search.sympatico.msn.ca/default.aspx The new MSN Search! Check it out! _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

1 0

Netscreen fw logs not piped in mysql
by Christian Janssen 25 May '05

25 May '05

Hi, I'm close to give up and have following problem: * Netscreen Firewalls (Screen OS 5.1r3 & 4.1) * Syslog-ng [&php-syslog-ng] My System is Debian sarge, syslog-ng 1.6.5 a) Unix syslog entries are stored correctly in mysql database (and textfile) all seems fine ! b) Netscreen syslog infos are logged as expected in txt file (see attach) c) [PROBLEM] but logging in mysql are not working, got following message from my pipe script ERROR at line 1: Unknown command '\"'. ERROR at line 1: Unknown command '\"'. ERROR at line 1: Unknown command '\"'. Maybe a truncating problem ? Seems related to following questions, but unfortunately never found a solution https://lists.balabit.hu/pipermail/syslog-ng/2004-November/006678.html http://www.experts-exchange.com/Security/Unix_Security/Q_21077259.html http://www.netscreenforum.com/viewtopic.php?t=1209&highlight=syslogng I followed mostly these instructions: http://gentoo-wiki.com/HOWTO_setup_PHP-Syslog-NG Hope somebody can help me and have an idea or solution. Many thanks in advance Cheers Christian ---------------------------------------------------- e.g. syslog Apr 25 14:08:38 172.29.8.2 co-gw: NetScreen device_id=co-gw system-notification-00257(traffic): start_time="2005-04-25 13:08:37" duration=0 policy_id=320001 service=udp/port:1985 proto=17 src zone=Null dst zone=self action=Deny sent=0 rcvd=48 src=195.122.33.7 dst=224.0.0.2 src_ Apr 25 14:08:38 196.35.45.2 co-gw: NetScreen device_id=co-gw system-notification-00257(traffic): start_time="2005-04-25 13:08:37" duration=0 policy_id=320001 service=proto:88/port:0 proto=88 src zone=Null dst zone=self action=Deny sent=0 rcvd=60 src=172.30.7.1 dst=224.0.0.10 ---------------------------------------------------- or e.g. sep. file via filter destination firewalls { file("/var/log/netscreen"); }; filter f_firewalls { facility(local7); }; log { source(s_all); filter(f_firewalls); destination(firewalls); }; Apr 25 17:45:06 172.29.5.163 ns5gt: NetScreen device_id=ns5gt [Root]system-information-00524: SNMP request from an unknown SNMP community at 172.29.5.146:32862 has been received. (2005-04-25 17:57:41) ----------------------------------------------------

1 1

syslog-ng 1.6.x on OpenBSD on sparc64
by Bostjan Golob 25 May '05

25 May '05

It appears that syslog-ng has an issue on OpenBSD/sparc64, as it does not determine the hostname of the remote system, making all messages appear to be from the syslog-ng server. The bug appears to be well hidden in sources.c. In line 98, the call to do_recv (as seen in gdb backtrace) is made, which requires a socklen_t* parameter. The catch is in line 88, where salen is declared as size_t and then cast to socklen_t; on sparc64, size_t is 64bit and socklen_t is 32bit and that causes the salen variable to always contain 0, causing the known bug. If you change line 88 to socklen_t salen = sizeof(sabuf), the host name of the sending host is determined correctly and written in the logfiles. That also explains why syslog-ng works correctly on OpenBSD/i386, but not on sparc64. Bostjan Golob IT department, Gimnazija Bezigrad, Ljubljana, SI

2 1

Error while making on Mac OS X Tiger
by Tristan Natsirt 25 May '05

25 May '05

I've got libol 0.3.16, glib 2.0.7, and i'm trying to configure and make syslog-ng-1.6.7 and I recieve the following errors: ./configure make [...] gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lresolv /usr/local/lib/libol.a -Wl,-Bstatic -lfl -lwrap -Wl,-Bdynamic ld: unknown flag: -Bstatic make[3]: *** [syslog-ng] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all] Error 2 make: *** [all-recursive] Error 1 any help at all would be much obliged. Thanks, Adam.

3 2

syslog-ng on Trusted Solaris
by Charles D Smith 24 May '05

24 May '05

I have been running syslog-ng on Solaris for the past few months. I would also like to try to run it on Trusted Solaris. Has any consideration been given to supporting syslog-ng on Trusted Solaris? Also if anyone has experimented with syslog-ng on Trusted Solaris, I would be interested in hearing about your experience. Thanks, Charles

1 0

Syslog-ng 1.9.4 configure/compile question
by Hokhold, Mark 24 May '05

24 May '05

Syslog-ng Users, I'm currently trying to configure syslog-ng 1.9.4 on my Sunblade 100 (Solaris 9) as a test. I've loaded and compiled the following software: Stunnel-4.10 openssl-0.9.7g eventlog-0.1.2 All three packages compiled cleanly. The "eventlog" compiled successfully, but no eventlog.pc was produced when completed and I still receive the following output compiling syslog-ng: # ./configure ..... ... checking GLIB CFLAGS... -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include checking GLIB_LIBS... -lglib-2.0 checking for eventlog... Package eventlog was not found in the pkg-config search path Perhaps you should add the directory containing `eventlog.pc` To the PKG_CONFIG_PATH environment variable No package 'eventlog' found Configure: error: Library requirements (eventlog) not met;....... ########################################################################### MORE INFO: I've been loading all packages under /usr/local, so by default everything will get placed within the /usr/local directory tree. I've tried NOT setting up the PKG_CONFIG and PKG_CONFIG_PATH variables -using the default. And I've also tried setting different values, all with the same results. Mark

1 0

RE: [syslog-ng] Syslog-ng 1.9.4 configure question
by Hokhold, Mark 24 May '05

24 May '05

Thanks Jerry, I'll get it a shot. Just another newbie. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Jerry Bell Sent: Tuesday, May 24, 2005 11:35 AM To: Syslog-ng users' and developers' mailing list Cc: 'syslog-ng(a)lists.balabit.hu' Subject: Re: [syslog-ng] Syslog-ng 1.9.4 configure question eventlog is a separate distribution that you need to compile and install. You can find it here: http://www.balabit.com/downloads/syslog-ng/1.9/src/ alongside the source for syslog-ng 1.9 > I checked my system and eventlog.pc doesn't exist on my > system, > so therefore I don't have this package installed. > Jerry http://www.syslog.org _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng] Syslog-ng 1.9.4 configure question
by Jerry Bell 24 May '05

24 May '05

eventlog is a separate distribution that you need to compile and install. You can find it here: http://www.balabit.com/downloads/syslog-ng/1.9/src/ alongside the source for syslog-ng 1.9 > I checked my system and eventlog.pc doesn't exist on my > system, > so therefore I don't have this package installed. > Jerry http://www.syslog.org

1 0

Syslog-ng 1.9.4 configure question
by Hokhold, Mark 24 May '05

24 May '05

Syslog-ng Users, I'm currently trying to configure syslog-ng 1.9.4 on my Sunblade 100 (Solaris 9) as a test. I've loaded and installed Stunnel-4.10 and openssl-0.9.7g so far, but when I configure syslog-ng, I get the following: # ./configure ..... ... checking GLIB CFLAGS... -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include checking GLIB_LIBS... -lglib-2.0 checking for eventlog... Package eventlog was not found in the pkg-config search path Perhaps you should add the directory containing `eventlog.pc` To the PKG_CONFIG_PATH environment variable No package 'eventlog' found Configure: error: Library requirements (eventlog) not met;....... I checked my system and eventlog.pc doesn't exist on my system, so therefore I don't have this package installed. Where can I find them? Thanks in advance, Mark

1 0

Re: syslog-ng Digest, Vol 1, Issue 1253
by M.Balajee 24 May '05

24 May '05

Hi, You can edit /etc/syslog-ng.conf file to avoid this. Edit this file so that you will not be seeing the messages on the console. On Tue, 24 May 2005 syslog-ng-request(a)lists.balabit.hu wrote : >Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > >To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng >or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > >You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of syslog-ng digest..." > > >Today's Topics: > > 1. Re: No line break every so often (Balazs Scheidler) > 2. how to avoid logging to consoles? (iv) > 3. Re: how to avoid logging to consoles? (Balazs Scheidler) > 4. Re: how to avoid logging to consoles? (Jesse Molina) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Mon, 23 May 2005 12:59:04 +0200 > From: Balazs Scheidler <bazsi(a)balabit.hu> >Subject: Re: [syslog-ng] No line break every so often >To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> >Message-ID: <1116845944.23550.11.camel(a)bzorp.balabit> >Content-Type: text/plain > >On Fri, 2005-05-20 at 12:14 -0700, Mike Tremaine wrote: > > On Fri, 2005-05-20 at 04:49, Balazs Scheidler wrote: > > > Luckly it is... Attached is a trimmed down trace file with a few > > examples of the problem [about 200lines let me know if more would be > > useful...] > > > > To my [uneducated] eye it looks like sendmail is the problem but like I > > said sometimes it does it right sometime it doesn't. > > > > Example: > > > > read(16, "<20>May 20 07:48:02 sendmail[16668]: j4KEkWOv016668: collect: > > premature EOM: unexpected close", 2048) = 93 > > > > Notice no \0 or \n > > > > Then the next read > > > > read(16, "<21>May 20 07:48:02 sendmail[16668]: j4KEkWOv016668: collect: > > unexpected close on connection from [61.43.165.161], > > sender=<Hager(a)indiatimes.com>\0<22>May 20 07:48:02 sendmail[16668]: > > j4KEkWOv016668: from=<Hager(a)indiatimes.com>, size=0, class=0, nrcpts=1, > > proto=SMTP, daemon=MTA, relay=[61.43.165.161]\0", 1955) = 300 > > > > > > A null terminator > > That leads to the output > > > > write(22, "2005-05-20 07:48:02 quasar mail.warning sendmail[16668]: > > j4KEkWOv016668: collect: premature EOM: unexpected close<21>May 20 > > 07:48:02 sendmail[16668]: j4KEkWOv016668: collect: unexpected close on > > connection from [61.43.165.161], > > sender=<Hager(a)indiatimes.com>\n2005-05-20 07:48:02 quasar mail.info > > sendmail[16668]: j4KEkWOv016668: from=<Hager(a)indiatimes.com>, size=0, > > class=0, nrcpts=1, proto=SMTP, daemon=MTA, relay=[61.43.165.161]\n", > > 430) = 430 > > . > > > > So the null was caught and turned into \n but the line before it runs > > together. With some weird <21> [and more often <22> see trace file]. > >Hm. Sendmail really seems to be the culprit, it is only hidden by >sysklogd using unix-dgram() sockets in which case the syslog daemon does >not care whether the message was NL or \0 terminated or not. > >The manpage for syslogd, mentions: > >... "A trailing newline is added when needed." > >This does not seem to be true. After judging the source it seems to be >adding the NL character only if LOG_PERROR is specified to openlog() >which clearly isn't the case for sendmail. > >I'd say this is a libc bug which you can work around by avoiding using >unix-stream and sticking to unix-dgram instead. (a solution which I >myself do not like). > >-- >Bazsi > > > >------------------------------ > >Message: 2 >Date: Mon, 23 May 2005 17:15:34 +0200 > From: iv <iv(a)zabuchy.net> >Subject: [syslog-ng] how to avoid logging to consoles? >To: syslog-ng(a)lists.balabit.hu >Message-ID: <4291F396.8040307(a)zabuchy.net> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >hi all >i'm trying to configure syslog-ng for logging events from firewall >everything works fine, except one thing: all messages appear on all my >consoles >how can i avoid that? it makes impossible working with the console, logs >appear even while editing files >and situation does't change when i comment out all "log" entries in the >syslog-ng.conf file >please, any ideas:) > >my syslog-ng.conf: > >options { > use_fqdn(yes); > use_dns(no); > chain_hostnames(yes); > use_time_recvd(no); ># sync(10); > > perm(0640); > owner("root"); > group("root"); > create_dirs(yes); > dir_perm(0750); > dir_owner("root"); > dir_group("root"); >}; > > > >source syslog { > unix-stream("/dev/log"); >}; > >source kernel { > file("/proc/kmsg"); >}; > >source syslog-ng { > internal(); >}; > > > >destination firewall { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/firewall"); >}; > >destination kernel { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/kernel"); >}; > >destination invalid { > file("/spool/unknown/$YEAR/$MONTH/$DAY/invalid"); >}; > >destination postfix { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/postfix"); >}; > >destination cron { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/cron"); >}; > >destination generic { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM"); >}; > >destination syslog-ng { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/syslog-ng"); >}; > >destination misc { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/misc"); >}; > > >## kernel >filter firewall { > match("IN=") and match("OUT=") and match("PROTO="); >}; > >filter notfirewall { > not match("IN=") and not match("OUT=") and not match("PROTO="); >}; > >log { > source(kernel); > filter(firewall); > destination(firewall); >}; > >log { > source(kernel); > filter(notfirewall); > destination(kernel); >}; > > >## internal >log { > source(syslog-ng); > destination(syslog-ng); >}; > > >## syslog >filter invalid { > not host("^syslog@[a-z]+$"); >}; > >filter postfix { > host("^syslog@[a-z]+$") > and program("^postfix/"); >}; > >filter cron { > host("^syslog@[a-z]+$") > and program("^(/USR/SBIN/CRON|/usr/sbin/cron)$"); >}; > >filter generic { > host("^syslog@[a-z]+$") > and program("^([a-z][a-z._-]*)$"); >}; > >log { > source(syslog); > filter(invalid); > destination(invalid); >}; > >log { > source(syslog); > filter(postfix); > destination(postfix); >}; > >log { > source(syslog); > filter(cron); > destination(cron); >}; > >log { > source(syslog); > filter(generic); > destination(generic); >}; > >log { > source(syslog); > destination(misc); > flags(fallback); >}; > >i'm running linux debian 2.6.11.8 testing > >thanks in advance, >iv > > >------------------------------ > >Message: 3 >Date: Mon, 23 May 2005 18:08:35 +0200 > From: Balazs Scheidler <bazsi(a)balabit.hu> >Subject: Re: [syslog-ng] how to avoid logging to consoles? >To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> >Message-ID: <1116864515.19621.7.camel(a)bzorp.balabit> >Content-Type: text/plain > >On Mon, 2005-05-23 at 17:15 +0200, iv wrote: > > hi all > > i'm trying to configure syslog-ng for logging events from firewall > > everything works fine, except one thing: all messages appear on all my > > consoles > > how can i avoid that? it makes impossible working with the console, logs > > appear even while editing files > > and situation does't change when i comment out all "log" entries in the > > syslog-ng.conf file > > please, any ideas:) > >short answer: "dmesg -n1" > >long answer: syslog-ng does not change kernel logging parameters on its >own, which is performed automatically by klogd. but you can do the same >using dmesg. > >-- >Bazsi > > > >------------------------------ > >Message: 4 >Date: Mon, 23 May 2005 10:40:13 -0700 > From: Jesse Molina <jesse(a)opendreams.net> >Subject: Re: [syslog-ng] how to avoid logging to consoles? >To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> >Message-ID: <20050523174013.GA18331@shoebox> >Content-Type: text/plain; charset=us-ascii > > >Hi > >man dmesg > >Use the -n arg, which will do what you want. > >You will probably need to add this to a startup script. Use update-rc.d >for that, or make yourself a .deb if you must. > > > >On Mon, May 23, 2005 at 05:15:34PM +0200, iv wrote: > > hi all > > i'm trying to configure syslog-ng for logging events from firewall > > everything works fine, except one thing: all messages appear on all my > > consoles > > how can i avoid that? it makes impossible working with the console, logs > > appear even while editing files > > and situation does't change when i comment out all "log" entries in the > > syslog-ng.conf file > > please, any ideas:) > > > > my syslog-ng.conf: > > > > options { > > use_fqdn(yes); > > use_dns(no); > > chain_hostnames(yes); > > use_time_recvd(no); > > # sync(10); > > > > perm(0640); > > owner("root"); > > group("root"); > > create_dirs(yes); > > dir_perm(0750); > > dir_owner("root"); > > dir_group("root"); > > }; > > > > > > > > source syslog { > > unix-stream("/dev/log"); > > }; > > > > source kernel { > > file("/proc/kmsg"); > > }; > > > > source syslog-ng { > > internal(); > > }; > > > > > > > > destination firewall { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/firewall"); > > }; > > > > destination kernel { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/kernel"); > > }; > > > > destination invalid { > > file("/spool/unknown/$YEAR/$MONTH/$DAY/invalid"); > > }; > > > > destination postfix { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/postfix"); > > }; > > > > destination cron { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/cron"); > > }; > > > > destination generic { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM"); > > }; > > > > destination syslog-ng { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/syslog-ng"); > > }; > > > > destination misc { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/misc"); > > }; > > > > > > ## kernel > > filter firewall { > > match("IN=") and match("OUT=") and match("PROTO="); > > }; > > > > filter notfirewall { > > not match("IN=") and not match("OUT=") and not match("PROTO="); > > }; > > > > log { > > source(kernel); > > filter(firewall); > > destination(firewall); > > }; > > > > log { > > source(kernel); > > filter(notfirewall); > > destination(kernel); > > }; > > > > > > ## internal > > log { > > source(syslog-ng); > > destination(syslog-ng); > > }; > > > > > > ## syslog > > filter invalid { > > not host("^syslog@[a-z]+$"); > > }; > > > > filter postfix { > > host("^syslog@[a-z]+$") > > and program("^postfix/"); > > }; > > > > filter cron { > > host("^syslog@[a-z]+$") > > and program("^(/USR/SBIN/CRON|/usr/sbin/cron)$"); > > }; > > > > filter generic { > > host("^syslog@[a-z]+$") > > and program("^([a-z][a-z._-]*)$"); > > }; > > > > log { > > source(syslog); > > filter(invalid); > > destination(invalid); > > }; > > > > log { > > source(syslog); > > filter(postfix); > > destination(postfix); > > }; > > > > log { > > source(syslog); > > filter(cron); > > destination(cron); > > }; > > > > log { > > source(syslog); > > filter(generic); > > destination(generic); > > }; > > > > log { > > source(syslog); > > destination(misc); > > flags(fallback); > > }; > > > > i'm running linux debian 2.6.11.8 testing > > > > thanks in advance, > > iv > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > >-- ># Jesse Molina ># Mail = jesse(a)opendreams.net ># Page = page-jesse(a)opendreams.net ># Cell = 1.602.323.7608 ># Web = http://www.opendreams.net/jesse/ > > > > >------------------------------ > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng > > >End of syslog-ng Digest, Vol 1, Issue 1253 >****************************************** Muggalla Balajee,

1 0

how to avoid logging to consoles?
by iv 23 May '05

23 May '05

hi all i'm trying to configure syslog-ng for logging events from firewall everything works fine, except one thing: all messages appear on all my consoles how can i avoid that? it makes impossible working with the console, logs appear even while editing files and situation does't change when i comment out all "log" entries in the syslog-ng.conf file please, any ideas:) my syslog-ng.conf: options { use_fqdn(yes); use_dns(no); chain_hostnames(yes); use_time_recvd(no); # sync(10); perm(0640); owner("root"); group("root"); create_dirs(yes); dir_perm(0750); dir_owner("root"); dir_group("root"); }; source syslog { unix-stream("/dev/log"); }; source kernel { file("/proc/kmsg"); }; source syslog-ng { internal(); }; destination firewall { file("/spool/$HOST/$YEAR/$MONTH/$DAY/firewall"); }; destination kernel { file("/spool/$HOST/$YEAR/$MONTH/$DAY/kernel"); }; destination invalid { file("/spool/unknown/$YEAR/$MONTH/$DAY/invalid"); }; destination postfix { file("/spool/$HOST/$YEAR/$MONTH/$DAY/postfix"); }; destination cron { file("/spool/$HOST/$YEAR/$MONTH/$DAY/cron"); }; destination generic { file("/spool/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM"); }; destination syslog-ng { file("/spool/$HOST/$YEAR/$MONTH/$DAY/syslog-ng"); }; destination misc { file("/spool/$HOST/$YEAR/$MONTH/$DAY/misc"); }; ## kernel filter firewall { match("IN=") and match("OUT=") and match("PROTO="); }; filter notfirewall { not match("IN=") and not match("OUT=") and not match("PROTO="); }; log { source(kernel); filter(firewall); destination(firewall); }; log { source(kernel); filter(notfirewall); destination(kernel); }; ## internal log { source(syslog-ng); destination(syslog-ng); }; ## syslog filter invalid { not host("^syslog@[a-z]+$"); }; filter postfix { host("^syslog@[a-z]+$") and program("^postfix/"); }; filter cron { host("^syslog@[a-z]+$") and program("^(/USR/SBIN/CRON|/usr/sbin/cron)$"); }; filter generic { host("^syslog@[a-z]+$") and program("^([a-z][a-z._-]*)$"); }; log { source(syslog); filter(invalid); destination(invalid); }; log { source(syslog); filter(postfix); destination(postfix); }; log { source(syslog); filter(cron); destination(cron); }; log { source(syslog); filter(generic); destination(generic); }; log { source(syslog); destination(misc); flags(fallback); }; i'm running linux debian 2.6.11.8 testing thanks in advance, iv

3 2

No line break every so often
by Mike Tremaine 23 May '05

23 May '05

I just converted a Redhat 9 machine to syslog-ng yesterday and I'm having a littel problem with 2 lines running together. Here are the specs in question. mgt@quasar ~ [1] rpm -q syslog-ng syslog-ng-1.6.7-2 mgt@quasar ~ [2] rpm -q sendmail sendmail-8.13.3-2.rhl9 mgt@quasar ~ [3] rpm -q libol libol-0.3.16-1 mgt@quasar ~ [4] uname -a Linux quasar 2.4.20-37.9.legacy #1 Mon Sep 27 19:40:23 EDT 2004 i686 i686 i386 GNU/Linux The problem I'm seeing is every so often sendmail will log like so... May 18 17:45:46 quasar sendmail[30415]: j4J0jdNg030415: from=<millie.zuniga_om(a)southtrust.com>, size=2520, class=0, nrcpts=1, msgid=<2.2.32.2004051809282400312642(a)southtrust.com>, proto=ESMTP, daemon=MTA, relay=[220.80.216.171]<22>May 18 17:45:46 sendmail[30415]: j4J0jdNg030415: Milter add: header: Received-SPF: none (quasar.stellarcore.net: 220.80.216.171 is neither permitted nor denied by domain of southtrust.com) receiver=quasar.stellarcore.net; client-ip=220.80.216.171; helo=localhost; envelope-from=millie.zuniga_om(a)southtrust.com; x-software=spfmilter 0.93 http://www.acme.com/software/spfmilter/; Notice the 22 that should be a line break between the 2 log lines. Has anyone noticed something like this? -- Mike Tremaine mgt(a)stellarcore.net http://www.stellarcore.net

2 6

Logs rotate and compress but still log to compressed file
by Rechtorik, Keith 21 May '05

21 May '05

I am running SUSE 9.1 and I have syslog-ng logging information from our PIX. After a rotate is done the file is compressed and rotated but syslog-ng keeps logging to the compressed file instead of the newly created file. Any help would be greatly appreciated. Here are my conifgs. If you need anymore information I will gladly send it. /etc/logrotate.d/syslog /var/log/pix/voclog { rotate 4 daily compress delaycompress postrotate # kill -HUP `cat /var/run/syslog-ng.pid` # /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null ||true /etc/init.d/syslog reload /etc/init.d/apache2 reload endscript } /etc/syslog-ng/syslog-ng.conf source src { # # include internal syslog-ng messages # note: the internal() soure is required! # unix-stream("/dev/log"); internal(); tcp(); udp(); # # the following line will be replaced by the # socket list generated by SuSEconfig using # variables from /etc/sysconfig/syslog: # #@SuSEconfig_SOCKETS@ # # # uncomment to process log messages from network: # #udp(ip("0.0.0.0") port(514)); }; # # filter definitions # filter voclog { facility(local5); }; filter vpnlog { facility(local7); }; destination voclog { file("/var/log/pix/voclog"); }; log { source(src); filter(voclog); destination(voclog); }; destination vpnlog { file("/var/log/vpnlog"); }; log { source(src); filter(vpnlog); destination(vpnlog); }; Keith Rechtorik Network Administrator Information Systems and Technology krechtorik(a)vocollect.com * CONFIDENTIAL, PRIVILEGED COMMUNICATION * This e-mail transmission is private and intended for the addressee(s) only. It may contain information that is privileged and/or confidential. If you have received this transmission in error, you are not authorized to read, copy, disclose or disseminate it in any manner. If you have received it in error, please delete it and all copies (including backup copies) that have been made, and transmit a reply message informing the sender that it was misdirected.

3 2

syslog-ng not starting
by Rechtorik, Keith 20 May '05

20 May '05

I am attempting to install syslog-ng on SUSE Linux and having issues starting the service. Port 514 is not listening and I assume it because the syslog-ng service is not starting. Does the syslog service start the syslog-ng service? If not how do I start the service? Thanks. Keith Rechtorik Network Administrator

5 4

Shiming Yang/OCIO_CorpDataSecurity/Planning_Office/HQ_for_the_Americas/BTMNA is out of the office.
by Shiming Yang 20 May '05

20 May '05

I will be out of the office starting 05/20/2005 and will not return until 05/21/2005. I will respond to your message when I return. If there is problem about Proxy or IBM web hosting facility, please call my backup Will at 8380. ----------------------------------------- The information contained in this electronic mail message, and any and all accompanying documents, constitutes confidential information. If you are not the intended recipient of this information, any disclosure, copying, distribution, or the taking of any action in reliance on it is strictly prohibited. If you received this information in error, please notify the sender immediately and destroy this communication. Messages sent via this medium may be subject to delays and/or unauthorized alteration. Neither The Bank of Tokyo-Mitsubishi, Ltd. nor any of its affiliates shall be held liable for the contents of this message.

1 0

[PATCH] use_fqdn with gethostname() not returning fqdn
by Sven Wegener 19 May '05

19 May '05

Hi all! I came across this issue while I was setting up a central syslog-ng server that collects logs from several hosts in different domains. I wanted to use the use_fqdn option to distinguish every host in my logs better, but all I saw was just the plain hostname. Please find attached two patches, one against 1.6.7 and one against 1.9.4 that add support for fqdns. If gethostname() returns a name without dots it tries to lookup the fqdn of the host. Cheers, Sven -- Sven Wegener Gentoo Linux Developer http://www.gentoo.org/

2 4

RE: [syslog-ng] Logs rotate and compress but still log to compres sed file
by Rechtorik, Keith 18 May '05

18 May '05

I was testing things out at that point. Sorry for the confusion. Even when those lines are uncommented the logs still do not rotate. I guess I do not know how to kill the process. The syslog-ng pid never 'resets' itself when issuing the kill -HUP command. -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Tuesday, May 17, 2005 12:29 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Logs rotate and compress but still log to compressed file _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

5 4

Program Filters
by Metal Gear 16 May '05

16 May '05

Hi all, i m having too much noise in my syslog-ng logs both in mysql db and in text logs. For that i tried program filters like . filter f_auth { facility(auth); }; filter f_ftp {program(ftp);}; filter f_ssh {program(pam_unix);}; log {source(stunnel); filter(f_syslog); filter(f_auth); filter(f_ftp); filter(f_ssh); destination(d_mysql);}; what actually i want to log messages from program 'vsftp', 'wsftpd' and 'sshd' for that i tried regexp like '*ftp*', *ssh*, but its not working can someone refine the filters for just logging traffic having program 'ftp' or 'ssh' in them. Thanks

2 1

help about multiple files in syslog-ng
by Sarfraz Rustam 15 May '05

15 May '05

Hi; I want some information regarding to multiple files in syslog-ng; The scenerio is that i have 4 devices normally router and i want information of each device but with same facility (local7) and this information must be in each seperate file say router1, router2 .... so on. How i can do this; I have attached a router via console and trying to access its log but not succeeded. Plz guide me to the solution. -- Sarfraz

2 1

Subsys Dead, syslog-ng and SELinux
by Anand Shankar 13 May '05

13 May '05

I recently installed syslog-ng successfully on a FC3-SELinux enabled box. Everything is fine except that: # service syslog-ng status syslog-ng dead but subsys locked # ls --context /var/lock/subsys/syslog-ng -rw------- root root root:object_r:var_lock_t syslog-ng The root:object_r:var_lock_t should have been user_u:object_r:var_lock_t, and that is what is causing syslog-ng daemon to die. Also, the file permissions generally are 666. One easy way is to switch off SELinux for syslog-ng, but is there a better way?? Why are the permissions wrong?? ---- Anand Shankar

4 3