- syslog-ng - lists.balabit.hu

syslog-ng and sqlsyslogd
by John Jason Brzozowski 05 Jul '04

05 Jul '04

Hello, I recently setup syslog-ng to use sqlsyslogd to insert syslog information into a MySQL database. After some testing I found that the some extra data is being added to each record only when called by syslog-ng. Each record in the database has <###> where ### is some random number. Has anyone seen this? Thanks, John

3 3

Help with sorting by host
by phusion 05 Jul '04

05 Jul '04

Hi, I can't figure out why the following won't work. My server config file is at the bottom. I'm trying to get it to log service logs locally on the server to the directory /var/log/ (multiple files) like normal, and also to the directory /storage/logs/$YEAR/$MONTH/$DAY/$HOST/ (multiple files), so all the service logs for each host will go into that specific host directory like host1 or host2. Also, named and sshd log messages to syslog-ng. I'm not sure what the problem is. Let me know what you think. Thanks. # CONFIG FILE # Options # options { long_hostnames(off); sync(0); }; # Sources # source local { unix-dgram("/var/run/log"); internal(); file("/dev/klog"); }; source network { tcp(port(514) max-connections(10) keep-alive(yes)); }; # Destinations # destination localhost { file("/var/log/all.log"); }; destination hosts { file("/storage/logs/$YEAR/$MONTH/$DAY/$HOST" owner(root) group(wheel) perm(0600) dir_perm(0700) create_dirs(yes)); }; # Filters # filter d_named { match("named[\[0-9]+\]"); }; filter d_sshd { match("sshd[\[0-9]+\]") and match("Server listening") or match("Connection from") or match("(Accepted|Failed) password") or match("Connection closed") or match("Closing connection"); }; filter h_host1 { host("host1"); }; filter h_host2 { host("host2"); }; # Logs # log { source(local); destination(localhost); }; log { source(local); filter(h_host1); filter(d_named); filter(d_sshd); destination(hosts); }; log { source(remote); filter(h_host2); filter(d_sshd); destination(hosts); }; __________________________________ Do you Yahoo!? Yahoo! Mail is new and improved - Check it out! http://promotions.yahoo.com/new_mail

1 0

garbled kernel messages
by Balazs Scheidler 04 Jul '04

04 Jul '04

Hi, I discovered a problem recently and I wanted to let you know about it. The Linux kernel may drop bytes from its ringbuffer which causes a garbled message to reach the logs. For example, I enabled logging on my notebook for all loopback traffic, and used ping -f to generate a lot of messages. To avoid syslog-ng's complexity in the picture, I simply used "cat" to read kernel messages: # cat /proc/kmsg > kmsg ## generated about 40000 packets # grep -v '^<4>IN=lo OU' kmsg RC=127.0.0.1 DST=127.0.0.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=15957 DF PROTO=ICMP TYPE=8 CODE=0 ID=21848 SEQ=21822 IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=11274 DF PROTO=ICMP TYPE=8 CODE=0 ID=22104 SEQ=2604 As you can see both messages missed the syslog header (the string <4>), but messages might be garbled in different ways, in general the linux kernel shifts the ring buffer whenever it is full, without flow control. I also checked the the cat process with "strace" to confirm that the kernel itself returns garbled messages. A workaround is to increase the kernel ring buffer size which is possible using a compile time option in recent kernels, but it is also possible to change by patching the value of LOG_BUF_LEN in the beginning kernel/printk.c to a greater value (must be power of two) However this will not necessarily fix the problem, the kernel can always "outperform" its userspace, e.g. it can generate way more messages than a userspace program can handle. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

error when installing libol on HP UX
by Albert Collazo 03 Jul '04

03 Jul '04

Hi, i'm new to this...and when i hit the "make" command for libol i get the following error: (Bundled) cc: "format.c", line 306: error 1549: Modifiable lvalue required for a ssignment operator. do you know why? and what is the work around? i have libol-0.3.13. thanks!! al _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

2 1

Antw: [syslog-ng]error when installing libol on HP UX
by Stephan Hendl 03 Jul '04

03 Jul '04

Using the newest gcc (3.2.? I think) available from the hp porting centre it worked for me. With the hpux ansi c compiler I had trouble. Alternatively on monday I can send a binary distribution of libol-0.3.13 for hpux 11.0 to you if you want... Please let me know. Stephan Dr. Stephan Hendl Systemmanagement ----------------------------------- Landesbetrieb für Datenverarbeitung und Statistik Land Brandenburg Adresse: 14467 Potsdam, Dortustr. 46 Telefon: +49-(0)331 39-471 Fax: +49-(0)331 27548-1187 Mobil: +49-(0)160 90 645 893 EMail: Stephan.Hendl(a)lds.brandenburg.de Internet: http://www.lds-bb.de >>> nme2nme(a)hotmail.com 03.07.2004 00:52:35 >>> Hi, i'm new to this...and when i hit the "make" command for libol i get the following error: (Bundled) cc: "format.c", line 306: error 1549: Modifiable lvalue required for a ssignment operator. do you know why? and what is the work around? i have libol-0.3.13. thanks!! al _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar * get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Backup Logfiles to specific folder of a remote machine
by amy wong 02 Jul '04

02 Jul '04

Hi all, I have recently setup a central syslog-ng server to receives log from cisco router and other server. I am intend to store a backup copy of this log files in a specific folder of a remote machine. Would anyone show me how can I do that? thanks amy

1 0

Backup Logfiles to specific folder of a remote machine
by amy wong 02 Jul '04

02 Jul '04

Hi all, I have recently setup a central syslog-ng server to receives log from cisco router and other server. I am intend to store a backup copy of this log files in a specific folder of a remote machine. Would anyone show me how can I do that? thanks, amy

1 0

Re: [syslog-ng]problem on HPUX with s_tcp snd d_tcp
by Stephan Hendl 02 Jul '04

02 Jul '04

I've just upgraded all version to 1.6.4 and the problem is the same. After a kill -HUP on the hpux-server the clients are going into CLOSE_WAIT state where the server is in the FIN_WAIT_2 state client: tcp 1 0 <client>:55682 <server>:10514 CLOSE_WAIT server tcp 0 0 <server>.10514 <client>.55682 FIN_WAIT_2 After a 'service syslog-ng restart' on all clients they open a new connection to the server and the connection will be established as I expect. I hope that helps.. Stephan

2 1

Re: [syslog-ng]Can't get pipe working
by Stephan Hendl 02 Jul '04

02 Jul '04

Hi Clayton, wie use ist in slyghtly other way and it writes several gigabytes per dy in our mysql database. 1) the syslog-ng configuration destination d_ToSysLogDB { pipe("/tmp/syslog.pipe" owner("root") group("root") perm(0640) template("insert into syslog(host,facility,priority,level,tag,date,time,progra m,msg) values ('$HOST','$FACILITY', '$PRIORITY', '$LEVEL', '$TAG','$YEAR-$MONTH- $DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(loghost); destination(d_ToSysLogDB); }; 2) there is a script running that takes the data from the pipe and writes them into the databse #!/bin/bash # if [ -e /tmp/syslog.pipe ]; then while [ -e /tmp/syslog.pipe ] do mysql -u syslog --password=<password> syslog -h syslog < /tmp/syslog.pipe done else mkfifo /tmp/syslog.pipe while [ -e /tmp/syslog.pipe ] do mysql -u syslog --password=<password> -h syslog < /tmp/syslog.pipe done fi 3) Keep in mind that a tail -f on a pipe will take all data out of the pipe and you cannot write them into a database. Stephan Dr. Stephan Hendl Systemmanagement ----------------------------------- Landesbetrieb für Datenverarbeitung und Statistik Land Brandenburg Adresse: 14467 Potsdam, Dortustr. 46 Telefon: +49-(0)331 39-471 Fax: +49-(0)331 27548-1187 Mobil: +49-(0)160 90 645 893 EMail: Stephan.Hendl(a)lds.brandenburg.de Internet: http://www.lds-bb.de >>> cdukes(a)cdukes.com 01.07.2004 20:02:57 >>> Hi all, I seem to be having trouble getting a mysql pipe working and thought I would enlist your help. Here's my config: options { use_fqdn(no); keep_hostname(yes); use_dns(no); long_hostnames(off); sync(0); log_fifo_size(1000); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; ############################ # Set up Sources ############################ source src { unix-dgram("/dev/log"); internal(); }; source net { udp(); }; source s_jffnms { unix-dgram("/dev/log"); internal(); udp(); }; # MySQL Logs destination d_jffnms { pipe("/tmp/mysql.pipe" template("INSERT INTO syslog (date, date_logged, host, message) VALUES ('$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', NOW, '$FULLHOST', '$MSG');\n") template-escape(yes)); }; destination jffnms_processing { program ("mysql -u jffnms -pjffnms jffnms < /tmp/mysql.pipe"); }; log { source (s_jffnms); #filter (f_jffnms); #if you use it destination (d_jffnms); }; # End When I restart syslog-ng and tail -f /tmp/mysql.pipe nothing comes in (nor are there any database inserts happening). When I do a tcpdump, I do see the event coming into my server, but it seems as though syslog-ng is just dropping the packet...? Regards, Clayton Dukes CCNA, CCDA, CCNP, CCDP Sr. Network Engineer E Solutions Corp. http://www.esnet.com 813.301.2620 (o) 813.545.7373 (c) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Syslog-Mysql-error ( ATTN: Asif Iqbal)
by Venkata Phani Kiran Achanta 01 Jul '04

01 Jul '04

Greetings all, Everything was going well until I got this error while loading the Mysql tables.... DBD::mysql::db do failed: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '192.168.254.250', 'auth', 'notice', 'notice', '25', '2004-07-01 at ./db-loader.pl line 19, <FH> line 1. And my line 1 in mysql.pipe looks like this INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '192.168.254.250', 'auth', 'notice', 'notice', '25', '2004-07-01', '15:26:28', 'DNS_NS25','DNS_NS25: NetScreen device_id=DNS_NS25 [No Name]system-notification-00257(traffic): start_time=\"2004-07-01 15:30:26\" duration=2 policy_id=0 service=dns proto=17 src zone=Trust dst zone=Untrust action=Permit sent=99 rcvd=274 src=192.168.254.2 dst=63.209.70.231 src_port=1116 dst_port=53 src-xlated ip=12.28.143.203 port=1116 Any ideas....let me know if you need more info to get me out of this error. Thanks in advance. I have searched thru the archives and found Mr.Asif Iqbal had a similar problem but unfortunately he did not find an answer in this list. Hey Asif, If you are still subscribing to this list and see this message please respond ASAP explaining how you worked around this problem. Thanks much, Venkata Achanta --Open source Rocks.........

1 0

Can't get pipe working
by Clayton Dukes 01 Jul '04

01 Jul '04

Hi all, I seem to be having trouble getting a mysql pipe working and thought I would enlist your help. Here's my config: options { use_fqdn(no); keep_hostname(yes); use_dns(no); long_hostnames(off); sync(0); log_fifo_size(1000); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; ############################ # Set up Sources ############################ source src { unix-dgram("/dev/log"); internal(); }; source net { udp(); }; source s_jffnms { unix-dgram("/dev/log"); internal(); udp(); }; # MySQL Logs destination d_jffnms { pipe("/tmp/mysql.pipe" template("INSERT INTO syslog (date, date_logged, host, message) VALUES ('$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', NOW, '$FULLHOST', '$MSG');\n") template-escape(yes)); }; destination jffnms_processing { program ("mysql -u jffnms -pjffnms jffnms < /tmp/mysql.pipe"); }; log { source (s_jffnms); #filter (f_jffnms); #if you use it destination (d_jffnms); }; # End When I restart syslog-ng and tail -f /tmp/mysql.pipe nothing comes in (nor are there any database inserts happening). When I do a tcpdump, I do see the event coming into my server, but it seems as though syslog-ng is just dropping the packet...? Regards, Clayton Dukes CCNA, CCDA, CCNP, CCDP Sr. Network Engineer E Solutions Corp. http://www.esnet.com 813.301.2620 (o) 813.545.7373 (c)

1 0

Cisco Syslog with Syslog-ng
by Davis, Jay 01 Jul '04

01 Jul '04

From: amy wong amywsp(a)gmail.com Date: Tue, 29 Jun 2004 17:03:14 +0800 Subject: Cisco Log To: bazsi(a)balabit.hu Hi, I'm new in syslog-ng. Currently install syslog-ng-1.4.7. I have got the cisco router monitor, and log can be seen on /var/log/messages but not /var/log/cisco.log. My questions are do the cisco.log file will be created automatically? and would you show me the right way in setting up? source remote {tcp(); udp();}; destination d_cisco { file("/var/log/cisco.log); }; filter f_cisco_info { level(info); }; filter f_cisco_notice { level(notice); }; filter f_cisco_warn { level(warn); }; filter f_cisco_crit { level(crit); }; filter f_cisco_err { level(err); }; log { source(remote); filter(f_cisco_info); destination(d_cisco); }; log { source(remote); filter(f_cisco_notice); destination(d_cisco); }; log { source(remote); filter(f_cisco_warn); destination(d_cisco); }; log { source(remote); filter(f_cisco_crit); destination(d_cisco); }; log { source(remote); filter(f_cisco_err); destination(d_cisco); }; destination hosts { file("/var/log/HOSTS/$HOSTS/$YEAR/$MONTH/$DAY/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(remote); destination(hosts); }; +++++++++++++++++++++++++++++++ Had to cut and paste First the setup on the Cisco devices. Cisco uses facility 7 for syslog. You need to set the proper severity levels for what you plan on sending to your syslog host. Do not use debug, you will kill the router or switch possibly. YMMV. I took some snippets of our config file here. The filter just puts all levels of syslog into one file which is parsed by netcool. You will have to play around with the severities. Cisco is kind of confused (being nice) on some severities. I think you will end up adjusting and using what you think is critical than using what they think is critical. Remember that you can filter specific messages using syslog-ng i.e. LINK-5-UPDOWN. The 5 is severity. I hope this helps. # The udp and port 514 are defaults but sometimes we change them here for diagnostics. # It is easier to leave in so you don't have to dig through docs to find out how to set the port source s_udpmessages {udp(ip(<IPADDRESSOFLOCALINTERFACETOLISTENON>) port(514));}; #This is a log file for Netcool destination d_mesg { file("/var/log/ncolog"); }; filter f_filter7 { facility(local7) and level(emerg,alert,crit,err,warning,notice,info); }; log { source(s_udpmessages); filter(f_filter7); destination(d_mesg); };

2 1

Re: [syslog-ng]problem on HPUX with s_tcp snd d_tcp
by Stephan Hendl 01 Jul '04

01 Jul '04

maybe the problem is that the server side (central syslog) is hpux. Unfortunately I do not have a linux box for this purpose... With a tcpdump on the server-side you can see that even the syslog-ng daemon is down there are many tcp pakets going from the clients to the server. The clients do not recognise that the server process has died. On client side I have syslog-ng 1.6.0-rc4 where I have on the hpux server side 1.6.4. What can I do with the socket(7) option? I am not familiar with tcp/ip internals ;-((( Stephan >>> lool+syslog(a)via.ecp.fr 01.07.2004 14:52:21 >>> Stephan Hendl <Stephan.Hendl(a)lds.brandenburg.de> - Thu, Jul 01, 2004: > It seems to me that the state 'FIN_WAIT_2' doesn't allow the hpux > syslog-ng to accept data from the linux clients and this state is quite > very long. I could not reproduce this on my Linux 2.6 system: - I killed syslog-ng with SIGTERM, SIGINT, SIGKILL, and SIGHUP while a telnet connection was open to the TCP port; - I restarted syslog-ng as soon as it was dead, and telneted successfully to the same port again, and syslog-ng saw my connection. Could it be a problem on the client side? My TCP connection gets closed when I kill -HUP syslog-ng. Or could it be a socket(7) option missing on the listening TCP socket? I do a setsockopt with SO_REUSEADDR on my sockets prior to binding them, which does not seem to be in syslog-ng. -- Loïc Minier <lool(a)dooz.org> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]use_time_recvd() not working?
by Hall J D (ISeLS) 01 Jul '04

01 Jul '04

Thanks to Michael pointing me at the mail archive I now understand that use_time_recvd() only applies to macros used in filename expansion and logformat templates. So to get the behaviour I was expecting, that use_time_recvd(yes) would effect the "default" template, I need to define a template for my destination. Would template("$DATE $HOST $MSG\n") cover it? While looking through the mail archives I saw mention of many other macros, R_DATE, S_DATE etc., which don't appear in the documentation. Do these still exist and if so what do they do? Are they left out of the documentation for a reason? Thanks again, Jonathan -----Original Message----- From: Trapp, Michael [mailto:michael.trapp@sap.com] Sent: 30 June 2004 16:04 To: Hall J D (ISeLS) Cc: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]use_time_recvd() not working? hi jonathan, have a look at https://lists.balabit.hu/pipermail/syslog-ng/2002-September/003874.html regards michael -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Hall J D (ISeLS) Sent: Mittwoch, 30. Juni 2004 16:53 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]use_time_recvd() not working? Hello all, I've recently installed Syslog-ng 1.6.2 on a FreeBSD 4.9 to act as my new collector and I can't get the use_time_recvd() option to work properly. No matter if I specify use_time_recvd(yes) or use_time_recvd(no) the messages, from a Cisco PIX firewall, are still getting recorded with the time from the message and not the local time. Is this a know issue, or am I doing something really silly? Below are the relevant bits from my config Thanks, Jonathan options { long_hostnames(off); sync(0); use_time_recvd(yes); create_dirs(yes); dir_perm(0750); }; source net { udp(ip(193.63.147.98) port(514)); tcp(ip(193.63.147.98) port(1740) keep-alive(yes)); }; destination fwall { file("/var/log/firewalls/$HOST.$YEAR.$MONTH.$DAY.log" perm(0640)); }; filter f_pixmsg { match("%PIX"); }; filter f_local0 { facility(local0); }; log { source(net); filter(f_local0); filter(f_pixmsg); destination(fwall); };

1 0

problem on HPUX with s_tcp snd d_tcp
by Stephan Hendl 01 Jul '04

01 Jul '04

Hi all, I have an central syslog host on hpux 11.0 running syslog-ng-1.6.2 for five linux systems (pns[3-7]). The linux systems send syslog data via tcp to port 10514 on the hpux system (pns1). The hpux system listen on that port, gets the data and put them into a file called 'cic.log' as well as to localhost Port 10514, where a ssh-tunnel is listening. The normal behaviour is like root@pns1:/> netstat -a | grep 10514 tcp 0 0 localhost.49297 localhost.10514 TIME_WAIT tcp 0 0 pns1.10514 *.* LISTEN tcp 0 0 localhost.10514 *.* LISTEN tcp 98 0 localhost.10514 localhost.49153 ESTABLISHED tcp 0 0 pns1.10514 pns3.55228 ESTABLISHED tcp 98 0 pns1.10514 pns4.16048 ESTABLISHED tcp 0 0 pns1.10514 pns5.55717 ESTABLISHED tcp 0 0 pns1.10514 pns6.32356 ESTABLISHED tcp 0 0 pns1.10514 pns7.49633 ESTABLISHED tcp 0 98 localhost.49153 localhost.10514 ESTABLISHED root@pns1:/> After a 'kill -HUP $PID' due to confoguration changes of the syslog-ng process on the hpux box the syslog-ng doesn't get anymore data via tcp (the file cic.log as well as the stream to the tunnel are empty). The netstat output is like root@pns1:/var/adm/syslog> netstat -a | grep 514 tcp 0 0 localhost.49618 localhost.10514 TIME_WAIT tcp 0 0 localhost.49587 localhost.10514 TIME_WAIT tcp 0 0 localhost.49619 localhost.10514 ESTABLISHED tcp 0 0 pns1.10514 pns3.55228 FIN_WAIT_2 tcp 0 0 pns1.10514 pns4.16048 FIN_WAIT_2 tcp 0 0 pns1.10514 pns5.55717 FIN_WAIT_2 tcp 0 0 pns1.10514 pns6.32356 FIN_WAIT_2 tcp 0 0 pns1.10514 pns7.49633 FIN_WAIT_2 tcp 0 0 localhost.10514 *.* LISTEN tcp 0 0 pns1.10514 *.* LISTEN tcp 0 0 localhost.10514 localhost.49619 ESTABLISHED root@pns1:/var/adm/syslog> It seems to me that the state 'FIN_WAIT_2' doesn't allow the hpux syslog-ng to accept data from the linux clients and this state is quite very long. Then I inserted the prameter 'keep-alive(no)' into the configuration file of the hpux box but it doesn't help. The only thing that helps is a 'service syslog-ng restart' on every linux client. But that cannot be done autimatically ;-(( and is not the preferred way. Maybe there are some problems in the tcp/ip code of syslog-ng running on hpux? Thanks for helping me! regards Stephan

2 1

logger-ng
by Ben Russo 30 Jun '04

30 Jun '04

Many of us are familiar with "logger" that sends syslog messages... I use it all the time when writing scripts. What about a "logger-ng" that has more features? Such as being able to send syslog messages via TCP/UDP to specified port numbers instead of just to the localhost. For example: logger-ng -d 10.10.10.10:5514 [-t|-u] -p local3.warn This is a message I want to send to the syslog daemon listening on port 5514 at the IP address 10.10.10.10 In addition to specifying UDP/TCP and a destination IP address, some other features I can think of are: tailing a log file listening on a named pipe taking standard input to send logs -Ben.

1 0

RE: [syslog-ng]use_time_recvd() not working?
by Trapp, Michael 30 Jun '04

30 Jun '04

hi jonathan, have a look at https://lists.balabit.hu/pipermail/syslog-ng/2002-September/003874.html <https://lists.balabit.hu/pipermail/syslog-ng/2002-September/003874.html> regards michael -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Hall J D (ISeLS) Sent: Mittwoch, 30. Juni 2004 16:53 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]use_time_recvd() not working? Hello all, I've recently installed Syslog-ng 1.6.2 on a FreeBSD 4.9 to act as my new collector and I can't get the use_time_recvd() option to work properly. No matter if I specify use_time_recvd(yes) or use_time_recvd(no) the messages, from a Cisco PIX firewall, are still getting recorded with the time from the message and not the local time. Is this a know issue, or am I doing something really silly? Below are the relevant bits from my config Thanks, Jonathan options { long_hostnames(off); sync(0); use_time_recvd(yes); create_dirs(yes); dir_perm(0750); }; source net { udp(ip(193.63.147.98) port(514)); tcp(ip(193.63.147.98) port(1740) keep-alive(yes)); }; destination fwall { file("/var/log/firewalls/$HOST.$YEAR.$MONTH.$DAY.log" perm(0640)); }; filter f_pixmsg { match("%PIX"); }; filter f_local0 { facility(local0); }; log { source(net); filter(f_local0); filter(f_pixmsg); destination(fwall); };

1 0

RE: [syslog-ng]use_time_recvd() not working?
by Schernau, Ed 30 Jun '04

30 Jun '04

Last I knew, this only worked IF you logged via a template. -----Original Message----- From: Hall J D (ISeLS) [mailto:jdhall@glam.ac.uk] Sent: Wednesday, June 30, 2004 10:53 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]use_time_recvd() not working? Hello all, I've recently installed Syslog-ng 1.6.2 on a FreeBSD 4.9 to act as my new collector and I can't get the use_time_recvd() option to work properly. No matter if I specify use_time_recvd(yes) or use_time_recvd(no) the messages, from a Cisco PIX firewall, are still getting recorded with the time from the message and not the local time. Is this a know issue, or am I doing something really silly? Below are the relevant bits from my config Thanks, Jonathan options { long_hostnames(off); sync(0); use_time_recvd(yes); create_dirs(yes); dir_perm(0750); }; source net { udp(ip(193.63.147.98) port(514)); tcp(ip(193.63.147.98) port(1740) keep-alive(yes)); }; destination fwall { file("/var/log/firewalls/$HOST.$YEAR.$MONTH.$DAY.log" perm(0640)); }; filter f_pixmsg { match("%PIX"); }; filter f_local0 { facility(local0); }; log { source(net); filter(f_local0); filter(f_pixmsg); destination(fwall); }; ----------------------------------------- Use of email is inherently insecure. Confidential information, including account information, and personally identifiable information, should not be transmitted via email, or email attachment. In no event shall Citizens or any of its affiliates accept any responsibility for the loss, use or misuse of any information including confidential information, which is sent to Citizens or its affiliates via email, or email attachment. Citizens does not guarantee the accuracy of any email or email attachment, that an email will be received by Citizens or that Citizens will respond to any email. This email message is confidential and/or privileged. It is to be used by the intended recipient only. Use of the information contained in this email by anyone other than the intended recipient is strictly prohibited. If you have received this message in error, please notify the sender immediately and promptly destroy any record of this email.

1 0

use_time_recvd() not working?
by Hall J D (ISeLS) 30 Jun '04

30 Jun '04

Hello all, I've recently installed Syslog-ng 1.6.2 on a FreeBSD 4.9 to act as my new collector and I can't get the use_time_recvd() option to work properly. No matter if I specify use_time_recvd(yes) or use_time_recvd(no) the messages, from a Cisco PIX firewall, are still getting recorded with the time from the message and not the local time. Is this a know issue, or am I doing something really silly? Below are the relevant bits from my config Thanks, Jonathan options { long_hostnames(off); sync(0); use_time_recvd(yes); create_dirs(yes); dir_perm(0750); }; source net { udp(ip(193.63.147.98) port(514)); tcp(ip(193.63.147.98) port(1740) keep-alive(yes)); }; destination fwall { file("/var/log/firewalls/$HOST.$YEAR.$MONTH.$DAY.log" perm(0640)); }; filter f_pixmsg { match("%PIX"); }; filter f_local0 { facility(local0); }; log { source(net); filter(f_local0); filter(f_pixmsg); destination(fwall); };

1 0

Messages coming in messages.0
by Tandon,Nidhi 30 Jun '04

30 Jun '04

Hi I am using syslog-ng.After certain time my messages start coming in file /var/adm/messages.0 instead of messages.From where can I set the maximum size of file.What is the default size?? Thanks & Regards Nidhi

1 0

Cisco Log
by amy wong 30 Jun '04

30 Jun '04

---------- Forwarded message ---------- From: amy wong <amywsp(a)gmail.com> Date: Tue, 29 Jun 2004 17:03:14 +0800 Subject: Cisco Log To: bazsi(a)balabit.hu Hi, I'm new in syslog-ng. Currently install syslog-ng-1.4.7. I have got the cisco router monitor, and log can be seen on /var/log/messages but not /var/log/cisco.log. My questions are do the cisco.log file will be created automatically? and would you show me the right way in setting up? source remote {tcp(); udp();}; destination d_cisco { file("/var/log/cisco.log); }; filter f_cisco_info { level(info); }; filter f_cisco_notice { level(notice); }; filter f_cisco_warn { level(warn); }; filter f_cisco_crit { level(crit); }; filter f_cisco_err { level(err); }; log { source(remote); filter(f_cisco_info); destination(d_cisco); }; log { source(remote); filter(f_cisco_notice); destination(d_cisco); }; log { source(remote); filter(f_cisco_warn); destination(d_cisco); }; log { source(remote); filter(f_cisco_crit); destination(d_cisco); }; log { source(remote); filter(f_cisco_err); destination(d_cisco); }; destination hosts { file("/var/log/HOSTS/$HOSTS/$YEAR/$MONTH/$DAY/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(remote); destination(hosts); }; thanks amy

2 1

Re: [syslog-ng]dest. tcp and dest. pipe on HPUX
by Stephan Hendl 28 Jun '04

28 Jun '04

the pipe was already created but it dosn't work. It seems that the local syslog data goes into the pipe but the data received via tcp not ;-((( but that is not always true. Mostly data weren't written into the pipe but it works with file. With version 1.6.2 I have the same problem. Stephan Maybe there is a patch ftom HPUX necessary? >>> bazsi(a)balabit.hu 26.06.2004 09:48:57 >>> 2004-06-22, k keltezéssel 15:47-kor Stephan Hendl ezt írta: > Hi, > > I use the syslog-ng-1.6.0rc4 on HPUX 11 and try to send the syslog data > to a tcp-destination (is a ssh tunnel to a central syslog-server) as > well as to a pipe. Unfortunately the syslog-ng creates the pipe but logs > only to the tcp destination and _not_ to the pipe as well. > > Do you have any ideas? syslog-ng won't create the pipe for you but expects to find it there, so you must create it using mkfifo first. I've quickly tested pipe destinations on my local machines and it seems to work. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

libol, make_class, scsh
by bryanh＠giraffe-data.com 26 Jun '04

26 Jun '04

I'm trying to figure out how the build with libol works. I've read the few pages about it on the web site and the README file. I have libol-0.3.13 and syslog-ng-1.5.26. My first question: The syslog-ng make files appear to expect 'make_class' to be installed in my PATH or in a libol directory I specify. But a 'make install' of libol does not install make_class anywhere. The 'make' of libol does generate utils/make_class, though. Shouldn't 'make install' install it? A related question: 'configure' of syslog-ng finds libol by invoking libol-config from the PATH. But 'make install' of libol did not install libol-config. It did create libol-config and when I inserted it in my PATH, syslog-ng configure worked fine. Next topic: libol 'configure' does not find scsh on my system. I'll fix that later, but the problem is that it reacts to this by creating a 'make_class' with a null string for the scsh path. This is very unfriendly. Wouldn't it be better to generate it with some default path (maybe /usr/bin/scsh)? Then the error message when you try to run it would make it clear that the problem is a missing scsh. -- Bryan Henderson Phone 408-621-2000 San Jose, California

2 1

Central syslog with relays configuration
by SPINDLER Loïc TRANSPAC 26 Jun '04

26 Jun '04

I am on designing a central log system in order to "concentrate" gigabytes (~12 daily) of logs from 3 delocalized platforms. Quickly here is how it works. I have 3 sites on which approximately 100 hosts push syslog messages to local relay over udp. My 3 relays just forward over tcp the syslog messages to a centralhost using syslog-ng. On my concentrator (centralhost) I receive and store those messages using syslog-ng. I have the configuration running in a lab with no problem. But what happens in case the concentrator fails (f.o. hardware pb) : Will the relays keep the messages somewhere ? can this be set up someway ? At this time I did not success in programming a fifo to have the messages written in case the network forward could not be done. Anybody did ? thanks, loïc spindler

2 1

dest. tcp and dest. pipe on HPUX
by Stephan Hendl 26 Jun '04

26 Jun '04

Hi, I use the syslog-ng-1.6.0rc4 on HPUX 11 and try to send the syslog data to a tcp-destination (is a ssh tunnel to a central syslog-server) as well as to a pipe. Unfortunately the syslog-ng creates the pipe but logs only to the tcp destination and _not_ to the pipe as well. Do you have any ideas? Stephan -------------------------------- # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (20000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; source s_pns1_tcp { tcp(ip(194.76.232.136) port(10514) max-connections(20)); }; destination d_syslog_tcp { tcp("localhost" port(10514)); }; destination d_cic { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template( "$DATE $HOST $PRIORITY [$FACILITY] $MESSAGE\n") template-escape(yes)); }; destination d_syslog { file("/var/adm/syslog/syslog.log" owner("root") group("sys") perm(0644)); }; destination d_console { file("/dev/console"); }; destination d_root { usertty("root"); }; destination d_all { usertty("*"); }; destination d_auth { file("/var/adm/syslog/auth"); }; destination d_user { file("/var/adm/syslog/user/log.$YEAR$MONTH$DAY"); }; destination d_mailerr { file("/var/adm/syslog/mailerr/log.$YEAR$MONTH$DAY"); }; destination d_mail { file("/var/adm/syslog/mail/log.$YEAR$MONTH$DAY" owner("root") group("mailadm") perm(0440)); }; filter f_syslog { not facility(mail); }; filter f_auth { (not facility(mail) and level(alert)) or (facility(auth) and level(warning)); }; filter f_filter1 { not facility(mail) and level(alert); }; filter f_filter2 { level(emerg); }; filter f_filter3 { facility(user) and level(info); }; filter f_mailerr { facility(mail) and not level(info); }; filter f_mail { facility(mail); }; log { source(s_pns1_tcp); destination(d_syslog_tcp); }; log { source(s_sys); destination(d_syslog_tcp); }; log { source(s_pns1_tcp); destination(d_cic); }; log { source(s_sys); destination(d_cic); }; log { source(s_sys); filter(f_syslog); destination(d_syslog); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_filter1); destination(d_console); destination(d_root); }; log { source(s_sys); filter(f_filter2); destination(d_all); }; log { source(s_sys); filter(f_filter3); destination(d_user); }; log { source(s_sys); filter(f_mailerr); destination(d_mailerr); }; log { source(s_sys); filter(f_mail); destination(d_mail); };

2 1