- syslog-ng - lists.balabit.hu

Re: [syslog-ng] re-inserting syslog messages for testing
by Ed Ravin 31 Jan '05

31 Jan '05

On Tue, Jan 18, 2005 at 11:29:07AM -0500, Ed Ravin wrote: > I've written a perl script that takes as input a file with syslog > I use this for test environments, especially when I'm testing things > results when parsed by logsurfer. > > My tool does two things logger doesn't - (1) it trims off the existing > timestamps from the input before logging it, and more interestingly, (2) > can parse those timestamps and replay the log messages at the same rate > that they were originally logged. Or you can tell it to "time warp" > and play the messages back 2x 3x, 1/5x as fast, etc. This is why it's > good for testing logsurfer files, since you can test whether your > timeouts work. > > I have to spruce it up slightly (get rid of the XXX comments :-) before > I release it, will do so Real Soon. OK, here it is, as an attachment. With perldoc documentation, too. One possible bug not mentioned in the doc is that sleeping between messages to simulate the original delivery times seems to be getting rounded to the nearest second, a problem I thought using Time::HiRes would fix, but could conceivably be limited to my local environment. If anyone uses this, please let me know what you think. It's still in the beta stage, but since it's only a tool for testing rather than production, that should be sufficient for most purposes :-) -- Ed

2 3

Re: [syslog-ng]Entries being logged to /var/log/messages aswellas/var/log/HOSTS//$MONTH/$DAY/$HOS
by Fred Turner 29 Jan '05

29 Jan '05

Works great! Thanks... >>> Bill Nash <billn(a)billn.net> 1/29/2005 2:01:52 PM >>> On Sat, 29 Jan 2005, Fred Turner wrote: > Here is my source.. How would I go about doing that? Sorry I'm still pretty new with syslog0ng (3 hrs)... > No worries =) > > > > source src { > unix-stream("/dev/log"); > internal(); > udp(); > tcp(port(5140) keep-alive(yes)); > > Grab the udp and tcp entries, and create a new source. source src { unix-stream("/dev/log"); internal; }; source remote_hosts { tcp(port(5140) keep-alive(yes); udp()); log { source(remotes_hosts); destination(std); } Changing just the 'src' source, and adding the other two entries, will keep your existing config working as I described, local logging from your loghost processes to /var/log/messages where you'd expect them, and all your remote hosts logging to your 'dst' directory structure. Make sense? =) - billn >>>> Bill Nash <billn(a)billn.net> 1/29/2005 1:46:15 PM >>> > > Syslog will log to multiple destinations if you set them. As below, you > have multiple facilities still logging to messages. > > Does your 'src' source include your network ports, for receiving data from > remote hosts? If it does, separate it to a new source and pair it with > your 'std' destination, exclusively. This will keep your local logs > separate from your remote logs. > > - billn > > On Sat, 29 Jan 2005, Fred Turner wrote: > >> Sure, it's as follows. >> >> destination debug { file("/var/log/debug"); }; >> destination messages { file("/var/log/messages"); }; >> >> >> log { source(src); filter(f_daemon); destination(messages); }; >> log { source(src); filter(f_kern); destination(messages); }; >> log { source(src); filter(f_lpr); destination(lpr); }; >> log { source(src); filter(f_mail); destination(mail); }; >> log { source(src); filter(f_user); destination(messages); }; >> log { source(src); filter(f_uucp); destination(uucp); }; >> log { source(src); filter(f_mail); destination(maillog); }; >> log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; >> log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; >> log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; >> log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; >> log { source(src); filter(f_news); filter(f_err); destination(newserr); }; >> log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; >> log { source(src); filter(f_messages); destination(messages); }; >> log { source(src); filter(f_emergency); destination(console); }; >> >> >> >> >>>>> Bill Nash <billn(a)billn.net> 1/29/2005 1:15:26 PM >>> >> >> Can you include your log directive? Chances are, that's the culprit. >> >> - billn >> >> >> On Sat, 29 Jan 2005, Fred Turner wrote: >> >>> Hi, I'm new to syslog-ng and have configured it to be a loghost for many different firewall appliances. So I setup an automatic sorting entry as per the faq as follows: >>> >>> destination std { >>> file("/var/log/HOSTS/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY" >>> owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) >>> ); >>> >>> >>> Which works prefect The only problem is that it's also putting them in the /var/log/messages log. >>> >>> How Can I stop the behavior as it's creating a huge /var/log/messages log. >>> >>> >>> Thanks >>> >>> >>> ================================================================== >>> >>> NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. >>> Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. >>> >>> >>> _______________________________________________ >>> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >>> https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >>> >>> >> _______________________________________________ >> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >> https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >> >> >> >> ================================================================== >> >> NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. >> Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. >> >> >> _______________________________________________ >> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >> https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >> >> > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > ================================================================== > > NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. > Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.huhs that it's also putting them in the https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ================================================================== NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.

1 0

Re: [syslog-ng]Entries being logged to /var/log/messages as wellas/var/log/HOSTS//$MONTH/$DAY/$HOS
by Fred Turner 29 Jan '05

29 Jan '05

Here is my source.. How would I go about doing that? Sorry I'm still pretty new with syslog0ng (3 hrs)... source src { unix-stream("/dev/log"); internal(); udp(); tcp(port(5140) keep-alive(yes)); >>> Bill Nash <billn(a)billn.net> 1/29/2005 1:46:15 PM >>> Syslog will log to multiple destinations if you set them. As below, you have multiple facilities still logging to messages. Does your 'src' source include your network ports, for receiving data from remote hosts? If it does, separate it to a new source and pair it with your 'std' destination, exclusively. This will keep your local logs separate from your remote logs. - billn On Sat, 29 Jan 2005, Fred Turner wrote: > Sure, it's as follows. > > destination debug { file("/var/log/debug"); }; > destination messages { file("/var/log/messages"); }; > > > log { source(src); filter(f_daemon); destination(messages); }; > log { source(src); filter(f_kern); destination(messages); }; > log { source(src); filter(f_lpr); destination(lpr); }; > log { source(src); filter(f_mail); destination(mail); }; > log { source(src); filter(f_user); destination(messages); }; > log { source(src); filter(f_uucp); destination(uucp); }; > log { source(src); filter(f_mail); destination(maillog); }; > log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; > log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; > log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; > log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; > log { source(src); filter(f_news); filter(f_err); destination(newserr); }; > log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; > log { source(src); filter(f_messages); destination(messages); }; > log { source(src); filter(f_emergency); destination(console); }; > > > > >>>> Bill Nash <billn(a)billn.net> 1/29/2005 1:15:26 PM >>> > > Can you include your log directive? Chances are, that's the culprit. > > - billn > > > On Sat, 29 Jan 2005, Fred Turner wrote: > >> Hi, I'm new to syslog-ng and have configured it to be a loghost for many different firewall appliances. So I setup an automatic sorting entry as per the faq as follows: >> >> destination std { >> file("/var/log/HOSTS/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY" >> owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) >> ); >> >> >> Which works prefect The only problem is that it's also putting them in the /var/log/messages log. >> >> How Can I stop the behavior as it's creating a huge /var/log/messages log. >> >> >> Thanks >> >> >> ================================================================== >> >> NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. >> Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. >> >> >> _______________________________________________ >> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >> https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >> >> > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > ================================================================== > > NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. > Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ================================================================== NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.

2 1

Re: [syslog-ng]Entries being logged to /var/log/messages as wellas /var/log/HOSTS//$MONTH/$DAY/$HOS
by Fred Turner 29 Jan '05

29 Jan '05

Sure, it's as follows. destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; log { source(src); filter(f_daemon); destination(messages); }; log { source(src); filter(f_kern); destination(messages); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(messages); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); destination(maillog); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; >>> Bill Nash <billn(a)billn.net> 1/29/2005 1:15:26 PM >>> Can you include your log directive? Chances are, that's the culprit. - billn On Sat, 29 Jan 2005, Fred Turner wrote: > Hi, I'm new to syslog-ng and have configured it to be a loghost for many different firewall appliances. So I setup an automatic sorting entry as per the faq as follows: > > destination std { > file("/var/log/HOSTS/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY" > owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) > ); > > > Which works prefect The only problem is that it's also putting them in the /var/log/messages log. > > How Can I stop the behavior as it's creating a huge /var/log/messages log. > > > Thanks > > > ================================================================== > > NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. > Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ================================================================== NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.

2 1

Entries being logged to /var/log/messages as well as /var/log/HOSTS//$MONTH/$DAY/$HOST-$YEAR-$MONTH
by Fred Turner 29 Jan '05

29 Jan '05

Hi, I'm new to syslog-ng and have configured it to be a loghost for many different firewall appliances. So I setup an automatic sorting entry as per the faq as follows: destination std { file("/var/log/HOSTS/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); Which works prefect The only problem is that it's also putting them in the /var/log/messages log. How Can I stop the behavior as it's creating a huge /var/log/messages log. Thanks ================================================================== NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.

2 1

Problem with program() destination
by "Stefan Günther" 26 Jan '05

26 Jan '05

Hello, I'm trying to use the destination program() to forward all dhcp-related messages to a php program. The php program runs fine when I start it on the command line. My configuration in syslog-ng.conf seems to be right because when I use the "/bin/cat/" destination all dhcp messages are written to /tmp/cat.log. filter f_dhcp { facility(daemon) and match("dhcpd");}; #destination dhcpd { program("/bin/cat > /tmp/cat.log");}; destination dhcpd { program("/tmp/dhcp2.php");}; log { source(src); filter(f_dhcp); destination(dhcpd);}; /tmp/dhcp2.php: #! /usr/bin/php <?php $std=fopen("php://stdin","r"); $line = fgets($std,1024); $file=fopen("/tmp/dhcp.log","w+"); fwrite($file,$line); fclose($file); fclose($std); Can anyone give me a hint what I'm doing wrong? Thanks in advance, Stefan -- ***************************************** in-put GbR - Das Linux-Systemhaus Stefan-Michael Günther Moltkestraße 49 D-76133 Karlsruhe Tel./Fax : +49 (0)721 / 83044 - 98/93 http://www.in-put.de ***************************************** -- GMX im TV ... Die Gedanken sind frei ... Schon gesehen? Jetzt Spot online ansehen: http://www.gmx.net/de/go/tv-spot

2 7

syslog-ng 1.6.5/1.9.3: syslog-ng.conf and syslog-ng(8) manpage
by José Pedro Oliveira 25 Jan '05

25 Jan '05

Balazs, Two more notes about syslog-ng 1.6.x/1.9.x: 1) The default location of the configuration file has changed syslog-ng 1.6.5 -> /etc/syslog-ng/syslog-ng.conf syslog-ng 1.9.3 -> /etc/syslog-ng.conf See also: https://lists.balabit.hu/pipermail/syslog-ng/2005-January/006919.html 2) the syslog-ng manpage needs a major revision Several syslog-ng command line short options aren't listed (-e, -F, -g, -s, -u), the chroot option appears only in the Synopsis and none of the long options is documented. Below is the help page outputed by syslog-ng 1.6.5 and 1.9.3. See also: http://www.campin.net/syslog-ng/chroot-jail.html (First P.S.) ================================================== === /sbin/syslog-ng -h ================================================== -------------------------------------------------- --- syslog-ng 1.6.5 -------------------------------------------------- Usage: syslog-ng [options] Accept and manage system log messages Options: -s, --syntax-only Only read and parse config file -d, --debug Turn on debugging messages -v, --verbose Be a bit more verbose -F, --foreground Don't fork into background -f <fname>, --cfgfile=<fname> Set config file name, default=/etc/syslog-ng/syslog-ng.conf -V, --version Display version number (syslog-ng 1.6.5) -p <fname>, --pidfile=<fname> Set pid file name, default=/var/run/syslog-ng.pid -C <dir>, --chroot=<dir> Chroot to directory -u <user>, --user=<user> Switch to user -g <group>, --group=<group> Switch to group -------------------------------------------------- -------------------------------------------------- --- syslog-ng 1.9.3 -------------------------------------------------- Usage: syslog-ng [options] Accept and manage system log messages Options: -s, --syntax-only Only read and parse config file -d, --debug Turn on debugging messages -v, --verbose Be a bit more verbose -e, --stderr Log internal messages to stderr -F, --foreground Don't fork into background -f <fname>, --cfgfile=<fname> Set config file name, default=/etc/syslog-ng.conf -V, --version Display version number (syslog-ng 1.9.3) -p <fname>, --pidfile=<fname> Set pid file name, default=/var/run/syslog-ng.pid -C <dir>, --chroot=<dir> Chroot to directory -u <user>, --user=<user> Switch to user -g <group>, --group=<group> Switch to group -------------------------------------------------- Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

1 0

FAQ-seeding: chroot jail procedure for Syslog-ng
by Michael D. (Mick) Bauer 24 Jan '05

24 Jan '05

Hi, all. In researching/writing the Syslog-ng coverage for the new edition of my book, I've encountered a total lack of published info, anywhere, on how to create a Syslog-ng chroot jail. So in the interests of seeding the FAQ (or at least Google), here's a procedure that works for me. Naturally, anyone should feel free to correct anything I've gotten wrong! Any and all feedback is appreciated. ************************************************ How To Create A Chroot Jail For Syslog-ng 1.6x ************************************************ 1. su to root if you're not root already 2. Create an unprivileged group-account for syslog-ng, e.g., by adding the following line to /etc/group: syslogng:x:77: 3. Create an unprivileged system account for syslog-ng, e.g., via the following command: useradd -d /var/syslog-ng-jail -g syslogng -r syslogng (Note that in Linux, the "-r" flag tells useradd that this will be a system account, causing useradd to automatically set the account's shell to /bin/false and to choose an appropriately low value for its UID.) 4. Create the jail: mkdir -p /var/syslog-ng-jail/var/log (Our actual changed root will be /var/syslog-ng-jail, but we may as well create the var/log subdirectory at the same time) 5. At this point the whole jail should be owned by root:root, which is cool so long as the changed-root-directory itself (/var/syslog-ng-jail) is "other-executable," e.g., rwxr-xr-x. But syslog-ng *will* need to create/write files in the jail's var/log subdirectory, so we need to tweak the latter's group-ownership and -permissions, like so: chgrp syslogng /var/syslog-ng-jail/var/log chmod g+wx /var/syslog-ng-jail/var/log 6. That's it! We may now start syslog-ng like this: syslog-ng -C /var/syslog-ng-jail -u syslogng -g syslogng The syslog-ng process will still read its config from /etc/syslog-ng/syslog-ng.conf (not /var/syslog-ng-jail/etc/...), but immediately after that it will chroot itself to the specified jail. Note, however, that the paths you specify in syslog-ng.conf "file()" statements should all be relative to the changed root. E.g., use file("/var/log/messages"), *not* file("/var/syslog-ng-jail/var/log/messages"). Any path you specify in syslog-ng.conf will end up with "/var/syslog-ng-jail" prepended to it. Naturally, there's nothing to stop you from dropping the "var/log/" subdirectory altogether, and simply specify, e.g., file("/messages") as a destination (resulting in things being written to /var/syslog-ng-jail/messages, a less unwieldy path). ******* So far I haven't noticed that anything else needs to be added to the chroot jail (e.g., stuff from /dev or /etc), but if anyone knows differently please speak up! Regards, Mick P.S. Baszi, you really ought to add "-u" & "-g" to the syslog-ng manpage. After all, running anything in a chroot jail as root is futile, no? :-) P.P.S. BTW, 1.6x rocks! /-------------------------------------------------\ | Michael D. (Mick) Bauer | | Security Editor, Linux Journal | | Dir. of Value-Subtracted Svcs., Wiremonkeys.org | \-------------------------------------------------/

6 12

syslog-ng 1.9.3 released
by Balazs Scheidler 22 Jan '05

22 Jan '05

hi, I've released syslog-ng 1.9.3, a new development release from syslog-ng. The NEWS entry below summarizes the most important changes. NOTE: this is a development release and although it seems to be quite stable in my environment, it is not yet recommended for production use. For casual users the 1.6.x branch is still recommended. The release is available at the usual place: http://www.balabit.com/products/syslog-ng/upgrades.bbq Also note that build dependencies have changed since 1.6.x: syslog-ng no longer requires libol, it uses GLib and EventLog instead. EventLog is available at http://www.balabit.com/downloads/syslog-ng/1.9/src/ as it has no separate webpage yet. GLib was originally developed for the GTK+ toolkit, but is available as a separate package from www.gtk.org Feedback as always is appreciated. News for the 1.9.3 release Sat, 22 Jan 2005 01:38:07 +0100 Things are going faster these days, a mere three weeks between releases. I've been running syslog-ng 1.9.2 on my notebook, and was lucky enough to find one or two major bugs this way, but after fixing those things are looking good. I've seen _no_ crashes, though sometimes syslog-ng blocked on reading an external fd, thus causing a system deadlock. Apart from bugfixes the most important changes are that documentation is readded and somewhat even updated with the new features. It was funny rereading the sentences I wrote a couple of years earlier, fixed some embarassing grammatical mistakes. Now, back to the topic, the most important changes in this release are: * Solaris portability fixes, one of the snapshots already compiled cleanly under Solaris, even though I did not test the release itself. * Link against the libraries sitting in /usr statically. * Fixed possible deadlock on internal messages, it was a bad idea to use a pipe internally, it is now replaced with a conventional queue, and a special GSource. * Fixed another possible deadlock caused by some fds not being set to non-blocking mode. * EAGAIN and EINTR was not correctly handled in all cases, fixed those. * Readded documentation, added new macros, template statements, new flags. -- Bazsi

2 2

Syslog-ng 1.6.5 packaging: contrib files
by Jose Pedro Oliveira 22 Jan '05

22 Jan '05

Balazs, Would be possible to place the attached files in the contrib directory? Thanks in advance, jpo -- José Pedro Oliveira mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron { sharedscripts postrotate /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true endscript } #--- # Syslog-ng options: #--- # -s, --syntax-only Only read and parse config file # -d, --debug Turn on debugging messages # -v, --verbose Be a bit more verbose # -F, --foreground Don't fork into background # -f <fname>, --cfgfile=<fname> Set config file name # (default=/etc/syslog-ng/syslog-ng.conf) # -V, --version Display version number (syslog-ng 1.6.5) # -p <fname>, --pidfile=<fname> Set pid file name # (default=/var/run/syslog-ng.pid) # -C <dir>, --chroot=<dir> Chroot to directory # -u <user>, --user=<user> Switch to user # -g <group>, --group=<group> Switch to group # # See syslog-ng(8) for more details #--- SYSLOGNG_OPTIONS=""

1 0

libol - missing command.c
by mathu＠gmx.ch 21 Jan '05

21 Jan '05

hi I have some problems compiling libol 0.3.14 on a Tru64 Unix. The make command exits with the following error: [snip] creating libol.la (cd .libs && rm -f libol.la && ln -s ../libol.la libol.la) Make: Don't know how to make command.c. Stop. *** Exit 1 Stop [snap] after reading syslog-ng INSTALL file, I thought installing scsh will help. But compiling scsh results in an ugly Memory fault. But anyway, why should I need scsh to compile libol if I did not change the sources? And why is command.c missing? kind regards Mathias -- 10 GB Mailbox, 100 FreeSMS http://www.gmx.net/de/go/topmail +++ GMX - die erste Adresse f�r Mail, Message, More +++

1 0

Getting Logs in Triplicate
by Rhugga 20 Jan '05

20 Jan '05

I'm trying to parse cron, mail, and everything else into 3 files but getting 3 copies of each log entry. I also want copies of each log message to be placed in a subdirectory based on each hostname. (So I should have 2 copies of each log message, one in the appropriate master file and then one in the appropriate file under a directory with same name as the source host) Here is my conf: <snip> # Catch All Filter For Mail and Everything Else filter f_master_syslogs { not facility(mail) and not facility(cron); }; filter f_master_maillogs { facility(mail); }; filter f_master_cronlogs { facility(cron); }; destination master_syslogs { file("/var/log/syrrx/master_syslog", owner(root), group(root), perm(0640), dir_perm(0750), create_dirs(yes), ); }; destination master_maillogs { file("/var/log/syrrx/master_maillog", owner(root), group(root), perm(0640), dir_perm(0750), create_dirs(yes), ); }; destination master_cronlogs { file("/var/log/syrrx/master_cronlog", owner(root), group(root), perm(0640), dir_perm(0750), create_dirs(yes), ); }; destination host_logs { file("/var/log/syrrx/$HOST/syslog", owner(root), group(root), perm(0640), dir_perm(0750), create_dirs(yes), ); }; destination host_mail { file("/var/log/syrrx/$HOST/maillog", owner(root), group(root), perm(0640), dir_perm(0750), create_dirs(yes), ); } destination console { file("/dev/tty10"); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole"); }; log { source(src); filter(f_console); destination(xconsole); }; destination root { usertty("root"); }; log { source(src); filter(f_alert); destination(root); }; # Catch All log { source(src); filter(f_master_syslogs); destination(master_syslogs); }; log { source(src); filter(f_master_maillogs); destination(master_maillogs); }; log { source(src); filter(f_master_cronlogs); destination(master_cronlogs); }; # Host Based Log Files log { source(src); filter(f_file-0202); destination(host_logs); }; log { source(src); filter(f_file-0201); destination(host_logs); }; .... log { source(src); filter(f_db-0201_mail); destination(host_mail); }; log { source(src); filter(f_db-0202_mail); destination(host_mail); }; .... Currently I get 3 copies of each log in both places. (the master log and then the one under the host's subdirectory) Any ideas what I missed? ===== Chuck Carson - Sr. Systems Engineer Syrrx, Inc. - www.syrrx.com 10410 Science Center Drive San Diego, CA 92121 Work: 858.622.8528 Fax: 858.550.0526

4 8

Re: [syslog-ng]re-inserting syslog messages for testing
by Robert.COward＠deploymenthealth.osd.mil 18 Jan '05

18 Jan '05

I use Kiwi SyslogGen. Very good simple program. I think you can find it here: http://www.kiwisyslog.com/info_sysloggen.htm

1 0

re-inserting syslog messages for testing
by Ed Ravin 18 Jan '05

18 Jan '05

I've written a perl script that takes as input a file with syslog messages in it, and re-sends them into syslog on the current host. I use this for test environments, especially when I'm testing things with logsurfer and have a known logfile that should generate certain results when parsed by logsurfer. Are there any other tools that do this? If not, I'll release mine after cleaning it up a bit, but there's no point in adding more cruft to the world if Someone Else has done a better job. -- Ed

2 2

RE: [syslog-ng]MYSQL pipe 3
by Robert.COward＠deploymenthealth.osd.mil 18 Jan '05

18 Jan '05

Anyway i fixed the problem and also found out why its was happening: (from my post at www.screamingelectron.org) I think you are not allowed to start things in /etc/rc, and redirect cause the default starts as nobody. heres what I put in to get this thing going: su - root -c "/etc/check_syslog-ng2mysql.sh" & I know not the most secure method, but its a start. so I put the following in my /etc/rc.local file : # MYSQL if [ X"${mysql}" == X"YES" ]; then if [ -x /usr/local/bin/mysqld_safe ]; then echo -n " mysql"; /usr/local/bin/mysqld_safe --socket=/var/www/var/run/mysql/mysql.sock & sleep 10 echo -n " syslog-ng2mysql"; su - root -c "/etc/check_syslog-ng2mysql.sh" & fi fi where /etc/check_syslog-ng2mysql.sh is: #!/usr/local/bin/bash -x ps=`ps -ax | grep "\--password=x" | awk '{ print $9 }'` if [[ $ps != "" ]]; then echo "syslog-ng2mysql is alive." else if [ ! -p /tmp/mysql.pipe ]; then mkfifo /tmp/mysql.pipe kill -HUP `cat /var/run/syslog-ng.pid` fi mysql -u root --password=password syslog < /tmp/mysql.pipe & fi You can find the thread here: http://www.screamingelectron.org/forum/showthread.php?t=2029 Thanks for all your help. >What does, > ps=`ps -ax | grep "\--password=x" | awk '{ print $9 }'` >do and how do you know it is not running? >-Steve S. Just a sloppy way for checking for the mysql client connection. --- 18 January 2005 "Christianity has operated with an unmitigated arrogance and cruelty -- necessarily, since a religion ordinarily imposes on those who have discovered the true faith the spiritual duty of liberating the infidels." (James A. Baldwin, (1924-1987) --- Robert V. Coward UNIX System Administrator Computer Science Corporation

1 0

What facility do the 'STATS' messages come in on?
by Ben Nelson 18 Jan '05

18 Jan '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am able to see my internal() STATS messages only by sending all messages (unfiltered) to a single file. I'm not sure which of my filters may be dropping them. So, which syslog facility do those messages happen under? Thanks, - --Ben -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBY1Ld3cL8qXKvzcwRAg3eAJ0a/Vxz810kkCqXzizKTag9Yb05zACg1r/X rZpVs4HsMSAlO3Xygs80JYI= =PKRl -----END PGP SIGNATURE-----

4 3

php-syslog-ng
by Tales Teixeira 18 Jan '05

18 Jan '05

Dear friends, I have a problem with php-syslog-ng. When my database for a device is big and i try to view the report, it shows the message: Connection time out of 30 secs. Do you know how i fix this? Is there a way to "tunning" the php-syslog-ng? I read something about caching, but i didn't understand very well. Best regards, Tales Teixeira.

1 0

Null Filter?
by Rhugga 18 Jan '05

18 Jan '05

I want a catch-all log destination and can't seem to find out how in the documentation or examples. A log statement needs a filter paramter and a filter statement needs at least 1 parameter as well, so how can this be achived? I want a filter that catches absolutely every possbile thing. Thx, cc

3 3

syslog-ng-1.9.2+20050112+1424 doesn't compile
by Jose Pedro Oliveira 15 Jan '05

15 Jan '05

Balazs, The latest syslog-ng 1.9.2 snapshot (20050112_1424) doesn't compile because of a missing header file (logsource.h). This file doesn't exists in the tarball. Compilation error: ---------- ... logsource.c:24:23: logsource.h: No such file or directory logsource.c:29: error: syntax error before '*' token logsource.c: In function `log_source_msg_ack': logsource.c:31: error: `LogSource' undeclared (first use in this function) logsource.c:31: error: (Each undeclared identifier is reported only once logsource.c:31: error: for each function it appears in.) logsource.c:31: error: `self' undeclared (first use in this function) logsource.c:31: error: syntax error before ')' token ... ---------- Regards, jpo -- José Pedro Oliveira

1 0

trying to compile on a cobalt
by Michael Gargiullo 14 Jan '05

14 Jan '05

I've followed the dependency hell until I reached this: No package 'eventlog' found configure: error: Library requirements (eventlog) not met; consider adjusting the PKG_CONFIG_PATH environment variable if your libraries are in a nonstandard prefix so pkg-config can find them. Where can I find this? What is it a part of?

3 4

RE: [syslog-ng]Problems with Netscreen log entries
by James Masson 12 Jan '05

12 Jan '05

Hi Phil, I had exactly this problem, upgrading to 1.6.5 fixed the problem. Regards James > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Philip Webster > Sent: 06 January 2005 05:59 > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Problems with Netscreen log entries > > Bazsi, > > Balazs Scheidler wrote: > > On Mon, 2004-08-09 at 15:20, Paul Mindeman wrote: > > > >>Running sylog-ng 1.6.4 on Solaris 9 > >> > >>Log entries from my UNIX devices log fine. Log entries from my > >>Netscreen devices seem to be missing the end of line terminator, as > >>the entries run together in the log file. The default > syslog daemon > >>was able to handle these entries fine. Any ideas on how to > fix this? > >> > >>The options in the syslog-ng.conf file are: > >> > >>options { sync (0); > >> time_reopen (10); > >> log_fifo_size (1000); > >> long_hostnames (off); > >> use_dns (no); > >> use_fqdn (no); > >> create_dirs (no); > >> keep_hostname (yes); > >> }; > > > > > > Can you give me an tcpdump snippet to see how a netscreen > log message > > is formatted? Please make sure that you snap the complete > packet (-s > > option). > > > > tcpdump -xXpeni ethX port 514 and udp > > > > should do the trick. > > > > I'm seeing the same problem as listed above, but did not see > a solution posted. I've included a tcpdump listing of a > sample packet below. All packets seem to be null terminated, > but do not contain a newline. The sending device is a > Netscreen ISG2000 and the receiver is syslog-ng 1.6.3 running > on Red Hat Linux Advanced Server release 2.1AS. > > If the logs are sent from the ISG to a FreeBSD host running > standard syslog, and then forwarded from there to the > syslog-ng host, a newline is present in the logs on both servers. > > Any thoughts? > Phil > > 11:04:03.044944 IP 10.40.44.3.2148 > 10.224.8.2.syslog: UDP, > length 146 > 0x0000: 00d0 b7a8 8008 0010 db86 5e80 0800 4500 > ..........^...E. > 0x0010: 00ae 07b9 0000 4011 297a 0a28 2c03 0ae0 > ......@.)z.(,... > 0x0020: 0802 0864 0202 009a 8108 3c31 3636 3e67 > ...d......<166>g > 0x0030: 702d 6564 6765 2d66 773a 204e 6574 5363 > p-edge-fw:.NetSc > 0x0040: 7265 656e 2064 6576 6963 655f 6964 3d67 > reen.device_id=g > 0x0050: 702d 6564 6765 2d66 7720 205b 526f 6f74 > p-edge-fw..[Root > 0x0060: 5d73 7973 7465 6d2d 696e 666f 726d 6174 > ]system-informat > 0x0070: 696f 6e2d 3030 3736 373a 204c 6f63 6b20 > ion-00767:.Lock. > 0x0080: 636f 6e66 6967 7572 6174 696f 6e20 656e > configuration.en > 0x0090: 6465 6420 6279 2074 6173 6b20 7373 682d > ded.by.task.ssh- > 0x00a0: 636d 643a 3820 2832 3030 352d 3031 2d30 > cmd:8.(2005-01-0 > 0x00b0: 3420 3131 3a30 343a 3033 2900 > 4.11:04:03). > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > >

2 1

libevtlog.so.0: cannot open shared object file
by Shane Presley 11 Jan '05

11 Jan '05

When I try to start syslog-ng (on RedHat ES 3)I get this error: Starting syslog-ng /usr/local/sbin/syslog-ng: error while loading shared libraries: libevtlog.so.0: cannot open shared object file: No such file or directory [FAILED] I have compiled eventlog, and that file is... find / -name libevtlog.so /usr/local/lib/libevtlog.so Is this a path problem or something? I'm new to linux so I assume I'm missing something obvious. But I did try to google this error first and found nothing. Shane

3 3

confusing error message in syslog-ng
by Ed Ravin 11 Jan '05

11 Jan '05

I'm using syslog-ng version 1.6.5 on NetBSD 1.5.4. I added a new output file to my syslog-ng configuration and got this error message: Jan 10 16:16:17 syslogng@localhost[14437]: Cannot open file /syslog/services/filers.udp^(a)2005/01/filers.udp.2005.01.10 for writing (Permission denied) Note the ^@ NULL character in the log in the filename. This confused me no end, wondering if I had somehow corrupted my config file - as the character in that position was another / character. I spent extra time checking my config and running "od -c" looking for the null character. It turned out that /syslog/services was owned by root and syslog-ng was running as a local user, and thus didn't have permission to create a new directory there. Fixing the permissions solved the problem. So the error message was accurate, except for the corrupted filename. Where's that NULL coming from?

1 0

Re: [syslog-ng]Maillog to be split
by JulesF 10 Jan '05

10 Jan '05

Dave have tried your suggestion, but Syslog does not seem to like it. The strange this is, that the statements you have quoted are not dissimilar from the original ones already present. On 20:28:02 January 10, 2005 Dave Johnson <davejjohnson(a)gmail.com> wrote: > For more postfix information; you can check out: > http://logreport.org/doc/gen/email/postfix.php > http://www.onlamp.com/pub/a/onlamp/2004/01/22/postfix.html > > Looking at those docs; you could change the filter f_mailout and > f_mailin previously > suggest to look for match ("postfix/smtp") and match > ("postfix/smtpd") (respectively) and see what happens. > > > On Mon, 10 Jan 2005 18:32:49 +0000, JulesF <julesf(a)the4.co.uk> wrote: > > Thanks Dave. I have not got a clue where to start. I'm running > > Postfix as my MTA. How much more difficult would this be to set up > > than with Sendmail? > > > > On 18:20:20 January 10, 2005 Dave Johnson <davejjohnson(a)gmail.com> > > > wrote: Jules-- > > > > > > This is going to be mta specific. IE: depending on what your > > > running and your requirements are; its possible to have one mta > > > process accept and queue the mail; and another one that > > > send/deliver the mail. If this is the case; it maybe possible > > > for the mta to have different syslog facilities/priorities for > > > each of these processes. Again; this is going to be mta > > > specific. > > > The other option is to regex out the lines your want to be > > > separated. So for example [off the top of my head-- you can try > > > something like this (which I haven't tested:] on sendmail; only > > > logging inbound accepted messages and outbound attempts: > > > (some errors will not be picked up on these regexes): > > > > > > filter f_mailin { facility (mail); match("daemon=MTA"); }; > > > filter f_mailout { facility (mail); match("mailer=esmtp"); }; > > > destination maillogin { file ("/var/log/maillog.in" perm(0644); > > > }; destination maillogout { file ("/var/log/maillog.out" > > > perm(0644); }; log { source(local); filter(f_mailin); > > > destination(maillogin); }; log { source(local); > > > filter(f_mailout); destination(maillogout); }; > > > > > > > > > On Mon, 10 Jan 2005 17:11:07 +0000, JulesF <julesf(a)the4.co.uk> > > > > wrote: How would I go about splitting the maillog to show > > > > both inbound and outbound services in different files; what > > > > amendments need to be made to syslong-ng.conf? > > > > > > > > The current maillog entry: > > > > > > > > destination d_mail { file("/var/log/maillog"); }; > > > > > > > > Thanks. J > > > > > > > > _______________________________________________ > > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > Frequently asked questions at http://www.campin.net/syslog-ng/ > > > > faq.h > > > > tml > > > > > > > > > > > _______________________________________________ > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at http://www.campin.net/syslog-ng/faq > > > .html > > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.h > > tml > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >

1 0

Maillog to be split
by JulesF 10 Jan '05

10 Jan '05

How would I go about splitting the maillog to show both inbound and outbound services in different files; what amenedments need to be made to syslong-ng.conf? The current maillog entry: destination d_mail { file("/var/log/maillog"); }; Thanks. J

2 3