- syslog-ng - lists.balabit.hu

error "Cannot assign requested address"
by Matthew Bassili 27 Nov '03

27 Nov '03

List members, I am trying to setup syslog-ng (Red Hat9, syslog build 1.6.0rc4) with the following syslog-ng.conf file: ############################################################### # First, set some global options # options { keep_hostname(yes); long_hostnames(off); sync(0); log_fifo_size(1024); log_msg_size(8192); }; ############################################################### # # source local { unix-dgram("/dev/log"); internal(); pipe("/proc/kmsg" log_prefix("kernel: ")); }; #source nocpix # { udp(ip("172.31.30.2") port(514)); # }; source nocpix-out { udp(ip("147.76.127.44") port(514)); }; #source mb2-pix # { udp(ip("172.18.1.6") port(514)); # }; source other { udp(); }; # # ############################################################### # # destination local { file("/var/log/syslog-ng/local/local.$YEAR.$MONTH.$DAY"); }; destination other { file("/var/log/syslog-ng/other/other.$YEAR.$MONTH.$DAY"); }; destination nocpix { file("/var/log/syslog-ng/nocpix/nocpix.$YEAR.$MONTH.$DAY"); }; #destination mb2 { file("/var/log/syslog-ng/mb2/mb2.$YEAR.$MONTH.$DAY"); }; # # ############################################################### # # filter f_auth { facility(auth, authpriv); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { facility(daemon, kern, user); }; filter f_news { facility(news); }; filter f_spooler { facility(uucp,news) and level(crit); }; filter f_syslog { not facility(auth, authpriv) and not facility(mail); }; filter f_user { facility(user); }; # # ############################################################### # # log { source(local); destination(local);}; #log { source(nocpix); destination(nocpix);}; log { source(nocpix-out); destination(nocpix);}; #log { source(mb2-pix); destination(mb2);}; log { source(other); destination(other);}; & I get the following error message on startup: "Starting syslog-ng: io.c: bind_inet_socket() bind failed 147.76.127.44:514 Cannot assign requested address" When I comment out the line " source nocpix-out { udp(ip("147.76.127.44") port(514)); };" Everything works fine using udp();, but I really want to separate the sources so I can direct the log files to a different directory. Any help would be GREATLY appreciated. Matthew Bassili Senior Network Engineer NEC Business Solutions P/L 649 Springvale Rd Mulgarve, 3170 AUSTRALIA e-mail: matthew.bassili(a)nec.com.au

1 0

UDP Template
by Gianpiero Porchia 26 Nov '03

26 Nov '03

Hi, I would like to do log relaying, using syslog-ng. But I need to change the log format. The problem is that the "template" directive is not available for the udp destination (even for the tcp destination). Could you suggest me some work around to do that? Thanks in advance. - gian P.S I've thought on a work around, but it doesn't work fine. Hence the "template" directive is available for the pipes, I've used a pipe destination to send the logs. Then, I'm using the same pipe, as source, and I'm relaying the logs from it, to another log server. But syslog-ng thinks that the logs are coming from the server, and I get the following (ie, it uses the standard log format, after the pipe): Message Before the pipe -------------------- [X.Y.Z.K] ufs: [ID 213553 kern.notice] NOTICE: realloccg /u00: file system full Message After the pipe --------------------- Sep 25 18:12:11 Figth_cluB_01 [X.Y.Z.K] ufs: [ID 213553 kern.notice] NOTICE: realloccg /u00: file system full I'm using this configuration: # CONF ############################################# source s_net { udp(); }; source s_pipe_per_NI { pipe(/var/chroot/syslog-ng/dev/pipe_per_NI); }; destination relay_to_NI { udp("A.B.C.D" ); }; destination d_pipe_per_NI { pipe("/dev/pipe_per_NI" template("[$HOST] $MSG\n") ); }; log { source(s_net); destination(d_pipe_per_NI); # Here, I can apply the template }; log { source(s_pipe_per_NI); destination(relay_to_NI); # Here, syslog-ng applies the standard log format :( }; # END CONF ############################################# _____ Ing. Gianpiero Porchia Security Engineer ATS - Advanced Telecom Systems Designing, Testing, Managing Network Quality Via Salgari, 17 - 41100 Modena - ITALY Tel +39 059 821332 Fax +39 059 821492 Cel +39 335 330413 E-mail: gianpiero.porchia(a)atsweb.it messenger.msn.com: http://messenger.msn.com/, gianpiero.porchia(a)atsweb.it Web site: http://www.atsweb.it PGP Key ID: 0xCAE064A4 (pgpkeys.mit.edu:11371) Fingerprint: 080D AD88 C18A FCA3 91BC 0DF2 F05F 7489 CAE0 64A4

2 1

RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems
by David Aldrich 26 Nov '03

26 Nov '03

Hi José > A couple of months ago I placed online SRPMS > of libol and syslog-ng. They build without problems > in Red Hat 7.3, 8.0, and 9.0. The configuration > file included is similar to the one RH includes > with Syslog. > > http://gsd.di.uminho.pt/jpo/software/RPMS/ Thank you for this information. David

1 0

RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems
by David Aldrich 26 Nov '03

26 Nov '03

Hi Andrew Thank you very much for your reply. I will give it a try. David > -----Original Message----- > From: Hamilton Andrew [mailto:Andrew.Hamilton@afccc.af.mil] > Sent: Wednesday, November 26, 2003 2:39 PM > To: syslog-ng(a)lists.balabit.hu > Subject: RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems > > > #set up your source: > > source net { udp(); } # default port all interfaces > #or > source net { udp(ip("10.10.10.10") port(514)); };# specific > interface and specific port > > #any sort of filter or none: > > filter f_local7 { facility(local7); }; > > #a destination > > destination d_net { file("/var/log/netmessages" perm(644)); > }; # perm is an option, you can leave it off. #or > destination d_macro_net { > file("/var/log/net/$HOST/$YEAR/$MONTH/$DAY/$FACILITY.log" > create_dirs(yes) perm(600)); } #macros > > #and a log line > > log { source(net); destination(d_macro_net); }; # everything > from the port is logged to the macro determined file log { > source(net); filter(f_local7); destination(d_net); }; # only > local7 messages logged > > That shows you a couple of different options as well as some > defaults. This really just scratches the surface of what > syslog-ng is capable of... > > -----Original Message----- > From: David Aldrich [mailto:david.aldrich@t-modus.nec.co.uk] > Sent: Wednesday, November 26, 2003 9:22 AM > To: 'syslog-ng(a)lists.balabit.hu' > Subject: RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems > > > Hi > > > I in no way meant to sound condescending and apologize if it > > came across that way. It was interesting as I was trying to > > imagine situations in which that could happen to you, thus > > trying to help. > > Thanks for your help - I wasn't offended at all! > > I want to experiment with syslog-ng's ability to log messages > received on the UDP port. For now, I want to continue to use > syslogd to log all other messages - so as not to disturb the > system. Please could you or anyone else briefly explain how > to make a simple .conf file to log UDP messages with syslog-ng? > > David > > > Telecom MODUS is an ISO9001/TickIT approved Company. > LRQA Certificate of Approval reference 0965133 > ************************************************************ > THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL > TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS > PRIVATE AND/OR PROPRIETARY. If the reader of this message is > not the intended recipient, or the employee or agent > responsible for delivering the message to the intended > recipient, you are hereby notified that any dissemination, > distribution or copying of this communication is strictly > prohibited. If you have received this communication in error, > please forward the whole message to admin(a)t-modus.nec.co.uk > Company Registration No.3493954 Telephone Number +44 (0) 1372 > 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk > ************************************************************ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/sysl> og-ng > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/sysl> og-ng > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html >

2 1

RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems
by Hamilton Andrew 26 Nov '03

26 Nov '03

#set up your source: source net { udp(); } # default port all interfaces #or source net { udp(ip("10.10.10.10") port(514)); };# specific interface and specific port #any sort of filter or none: filter f_local7 { facility(local7); }; #a destination destination d_net { file("/var/log/netmessages" perm(644)); }; # perm is an option, you can leave it off. #or destination d_macro_net { file("/var/log/net/$HOST/$YEAR/$MONTH/$DAY/$FACILITY.log" create_dirs(yes) perm(600)); } #macros #and a log line log { source(net); destination(d_macro_net); }; # everything from the port is logged to the macro determined file log { source(net); filter(f_local7); destination(d_net); }; # only local7 messages logged That shows you a couple of different options as well as some defaults. This really just scratches the surface of what syslog-ng is capable of... -----Original Message----- From: David Aldrich [mailto:david.aldrich@t-modus.nec.co.uk] Sent: Wednesday, November 26, 2003 9:22 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems Hi > I in no way meant to sound condescending and apologize if it > came across that way. It was interesting as I was trying to > imagine situations in which that could happen to you, thus > trying to help. Thanks for your help - I wasn't offended at all! I want to experiment with syslog-ng's ability to log messages received on the UDP port. For now, I want to continue to use syslogd to log all other messages - so as not to disturb the system. Please could you or anyone else briefly explain how to make a simple .conf file to log UDP messages with syslog-ng? David Telecom MODUS is an ISO9001/TickIT approved Company. LRQA Certificate of Approval reference 0965133 ************************************************************ THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS PRIVATE AND/OR PROPRIETARY. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please forward the whole message to admin(a)t-modus.nec.co.uk Company Registration No.3493954 Telephone Number +44 (0) 1372 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk ************************************************************ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

compiling syslog-ng on AIX...
by Aaron Botsis 26 Nov '03

26 Nov '03

I'm having quite a significant amount of trouble compiling syslog-ng on aix. I'm using aix 5.1ML3 with gnupro toolchain. Normally, I wouldn't ask such a silly question on a mailing list, but I'm getting quite strange compiler errors such as: main.c: In function `setup_signals': main.c:122: `SA_ONESHOT' undeclared (first use in this function) main.c:122: (Each undeclared identifier is reported only once which leads me to believe nobody has ever attempted a port, yet I'm seeing mailing list entries that suggest otherwise (from like 2002) -- can anyone offer some tips on what toolchain (xlc, gnu, etc) they used, and which version of the supporting libraries were used also? tia! Aaron

1 1

RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems
by David Aldrich 26 Nov '03

26 Nov '03

Hi > I in no way meant to sound condescending and apologize if it > came across that way. It was interesting as I was trying to > imagine situations in which that could happen to you, thus > trying to help. Thanks for your help - I wasn't offended at all! I want to experiment with syslog-ng's ability to log messages received on the UDP port. For now, I want to continue to use syslogd to log all other messages - so as not to disturb the system. Please could you or anyone else briefly explain how to make a simple .conf file to log UDP messages with syslog-ng? David Telecom MODUS is an ISO9001/TickIT approved Company. LRQA Certificate of Approval reference 0965133 ************************************************************ THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS PRIVATE AND/OR PROPRIETARY. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please forward the whole message to admin(a)t-modus.nec.co.uk Company Registration No.3493954 Telephone Number +44 (0) 1372 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk ************************************************************

1 0

RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems
by Hamilton Andrew 26 Nov '03

26 Nov '03

You can actually build libol in your home directory and pass --with-libol=~/libol-0.3.xx and not have to install it. Welcome to Linux... I in no way meant to sound condescending and apologize if it came across that way. It was interesting as I was trying to imagine situations in which that could happen to you, thus trying to help. Drew -----Original Message----- From: David Aldrich [mailto:david.aldrich@t-modus.nec.co.uk] Sent: Wednesday, November 26, 2003 9:10 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems Hi > Interesting, I've never had to build it as root on my RH > Linux boxes. I had to install it as root but that is to be > expected... Ok, I think the point is that it is necessary to install libol as root before building syslog-ng. I am quite new to Linux and followed the syslog-ng instruction: ./configure && make && make install explicity. i.e. I did it all on one line, as root. Sorry, if I missed the obvious. David Telecom MODUS is an ISO9001/TickIT approved Company. LRQA Certificate of Approval reference 0965133 ************************************************************ THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS PRIVATE AND/OR PROPRIETARY. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please forward the whole message to admin(a)t-modus.nec.co.uk Company Registration No.3493954 Telephone Number +44 (0) 1372 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk ************************************************************ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems
by David Aldrich 26 Nov '03

26 Nov '03

Hi > Interesting, I've never had to build it as root on my RH > Linux boxes. I had to install it as root but that is to be > expected... Ok, I think the point is that it is necessary to install libol as root before building syslog-ng. I am quite new to Linux and followed the syslog-ng instruction: ./configure && make && make install explicity. i.e. I did it all on one line, as root. Sorry, if I missed the obvious. David Telecom MODUS is an ISO9001/TickIT approved Company. LRQA Certificate of Approval reference 0965133 ************************************************************ THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS PRIVATE AND/OR PROPRIETARY. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please forward the whole message to admin(a)t-modus.nec.co.uk Company Registration No.3493954 Telephone Number +44 (0) 1372 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk ************************************************************

1 0

RE: [syslog-ng]problem with syslog-ng
by Hamilton Andrew 26 Nov '03

26 Nov '03

try configuring with --enable-sun-streams --enable-sun-door and see if that helps. It usually detects it but I guess for some reason it didn't on your machine. -----Original Message----- From: Suchun Wu [mailto:swu@isc.bmo.com] Sent: Monday, September 08, 2003 5:11 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]problem with syslog-ng I'm trying to use syslog-ng-1.6.0rc3 on Solaris8. The compilation and installation passed. But when I run the start-up script, I got the following: sun-door support is not compiled in, door=/etc/.syslog_door Error initializing configuration, exiting. Any help is appreciated Suchun

1 0

RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems
by Hamilton Andrew 26 Nov '03

26 Nov '03

Interesting, I've never had to build it as root on my RH Linux boxes. I had to install it as root but that is to be expected... -----Original Message----- From: David Aldrich [mailto:david.aldrich@t-modus.nec.co.uk] Sent: Wednesday, November 26, 2003 4:45 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems Hi I have now built syslog-ng 1.6.0rc4 successfully. The key was to build it as root. Perhaps this should be made clear in the installation procedure? Best wishes David Telecom MODUS is an ISO9001/TickIT approved Company. LRQA Certificate of Approval reference 0965133 ************************************************************ THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS PRIVATE AND/OR PROPRIETARY. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please forward the whole message to admin(a)t-modus.nec.co.uk Company Registration No.3493954 Telephone Number +44 (0) 1372 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk ************************************************************ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

/dev/log is not a socket error on startup
by Tony Karakashian 26 Nov '03

26 Nov '03

Howdy. Doing some updates to my Linux box today when I noticed I still hadn't gotten around to setting up log rotation. It was then that I've noticed syslog-ng wasn't running. I tried to start it manually, but get the following: io.c: bind_unix_socket(): /dev/log not a socket Error initializing configuration, exiting. I just upgraded to latest libol (0.3.11) and syslog-ng (1.6.rc4) today, same results. Any ideas? Thanks -T

2 2

RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems
by David Aldrich 26 Nov '03

26 Nov '03

Hi I have now built syslog-ng 1.6.0rc4 successfully. The key was to build it as root. Perhaps this should be made clear in the installation procedure? Best wishes David Telecom MODUS is an ISO9001/TickIT approved Company. LRQA Certificate of Approval reference 0965133 ************************************************************ THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS PRIVATE AND/OR PROPRIETARY. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please forward the whole message to admin(a)t-modus.nec.co.uk Company Registration No.3493954 Telephone Number +44 (0) 1372 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk ************************************************************

1 0

Preserving syslogd formatting
by Kenneth Gray 26 Nov '03

26 Nov '03

Howdy, I'm using syslog-ng for the first time. I have several scripts that break because the output from the log files created by syslog-ng does not have the hostname bracketed as it does in syslogd. Is there any option to emulate the syslogd formatting? Example: syslog-ng Oct 3 06:29:13 10.11.27.1/10.11.27.1 1164: syslogd Oct 1 22:48:41 [10.11.27.1.218.94] 2354:

2 1

syslog-ng to mysql
by Ali, Tahir 26 Nov '03

26 Nov '03

Hey, I'am running syslog-ng Version: 1.5.15-1. I pipe all the syslog messages to a mysql database. Every thing works fine, but some times it stop logging to the database. I run mysql Version: 3.23.49-8. When i restart syslog-ng it work fine again. It can work fine for weeks. Have any else experience the same problem ? Regards Tahir

2 1

OpenBSD named pipe
by Bobby Johnson 26 Nov '03

26 Nov '03

I'm new to the list, hope this hasn't been covered before. I'm having some problems with syslog-ng, a named pipe and a shell script. I've created a destination in syslog-ng.conf that points to a pipe. In short the shell script looks like this. while read -r line; do sort input and output to file done < named.pipe Almost no matter what I do the script will sit outside the while loop not reading anything as things are input into the pipe. If i echo "anything" > named.pipe the shell script will run through all or most(not absolutly sure on this) of the input and then exit. I have this same setup on a FreeBSD computer and it works great, moved it to OpenBSD and it doesn't. If I do a tail -f on the pipe while my script is running then exit the tail the script works properly. I have tried a few different versions of syslog-ng and libol currently I have 1.6.0rc4 and 0.3.11. I have tried bourne, bash and ksh. Please help. Bobby Johnson Plexus Computer Services www.plexuscomp.com

2 3

Membership?
by David Aldrich 25 Nov '03

25 Nov '03

Hi How can I become a member of this list? (A post I sent yesterday is awaiting approval by the moderator.) Best regards David Telecom MODUS is an ISO9001/TickIT approved Company. LRQA Certificate of Approval reference 0965133 ************************************************************ THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS PRIVATE AND/OR PROPRIETARY. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please forward the whole message to admin(a)t-modus.nec.co.uk Company Registration No.3493954 Telephone Number +44 (0) 1372 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk ************************************************************

1 0

Use_dns(no)
by Jay Davis 25 Nov '03

25 Nov '03

I seem to still be getting hostnames in my messages with this turned on. Am I missing something? I need messages to retain their IP addresses and not get translated to a hostname. I need to get the IP for other information then have an application convert the name. Thanks!!! Please reply to jay_davis(a)fanniemae.com as well as the listserv. Thanks!!!!

2 1

errors on HPUX 11.0 (syslog-ng-1.6.rc4)
by Stephan Hendl 25 Nov '03

25 Nov '03

Hi all, I get the following errors on HPUX11 using syslog-ng-1.6.rc4 What does "...unparseable log message: " mean and how can I solve the problem? My /etc/syslog-ng.conf ion enclosed. Thanks Stephan ------------------ -- root@tc1:/var/adm/syslog> cat messages [2003/11/25 13:29:24] tc1 notice [syslog] syslog-ng[1057]: syslog-ng version 1.6.0rc4 starting [2003/11/25 13:29:25] tc1 notice [daemon] prngd[1083]: prngd 0.9.12 (05 March 2001) started up for user root [2003/11/25 13:29:25] tc1 notice [daemon] prngd[1083]: have 7 out of 60 filedescriptors open Y!åC=>e^a01 01:00:00] tc1 err [syslog] unparseable log message: \"<¿vz?á²ÝªšRª9P3_}£šzL;œ óE2÷ãäáCÆ9J®Sr# ej3\'žpâAßyŽ,YåÄò±Ãs SÒÖqÞyÒâIšüÍ 4¿DåªR [2003/11/25 13:29:28] tc1 info [auth] sshd[1118]: Server listening on 0.0.0.0 port 22. [2003/11/25 13:29:28] tc1 emerg [kern] [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1240]: Setting STREAMS-HEAD high water value to 65536. [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: nfsd do_one mpctl succeeded: ncpus = 1. [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: nfsd do_one pmap 2 [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: nfsd do_one pmap 3 [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: nfsd do_one bind 0 [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: Return from t_optmgmt(XTI_DISTRIBUTE) 0 [1970/01/01 01:00:00] tc1 err [syslog] unparseable log message: \"<h@\" [1970/01/01 01:00:00] tc1 err [syslog] unparseable log message: \"<h@\" [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1247]: nfsd 0 1 sock 4 [1970/01/01 01:00:00] tc1 err [syslog] unparseable log message: \"<h@\" [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1248]: nfsd 0 2 sock 4 [1970/01/01 01:00:00] tc1 err [syslog] unparseable log message: \"<h@\" [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: nfsd 0 3 sock 4 [1970/01/01 01:00:00] tc1 err [syslog] unparseable log message: \"<h@\" [2003/11/25 13:30:02] tc1 info [auth] sshd[1408]: Accepted publickey for hendl from 10.128.11.71 port 37605 ssh2 ------------------------ root@tc1:/var/adm/syslog> cat /etc/syslog-ng.conf # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe("/dev/log"); internal(); }; destination d_syslog { file("/var/adm/syslog/messages" owner("root") group("root") perm(0644) template( "[$YEAR/$MONTH/$DAY $HOUR:$MIN:$SEC] $HOST $PRIORITY [$FACILITY] $MESSAGE\n")); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/adm/syslog/syslog.log"); }; destination d_mail { file("/var/adm/syslog/mail.log"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(mail) and level(debug); }; filter f_filter2 { level(debug) or level(info) or level(alert) or level(emerg); }; filter f_filter3 { level(alert); }; filter f_filter4 { level(emerg); }; filter f_syslog { not (facility(mail) or facility(user)); }; log { source(s_sys); filter(f_filter1); destination(d_mail); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_cons); destination(d_mlrt); }; log { source(s_sys); filter(f_filter4); destination(d_mlal); }; log { source(s_sys); filter(f_syslog); destination(d_syslog); }; root@tc1:/var/adm/syslog> Stephan Hendl <Stephan.Hendl(a)lds.brandenburg.de>

2 1

syslog-ng 1.6.0rc4 build problems
by David Aldrich 24 Nov '03

24 Nov '03

Hi I am trying to compile syslog-ng 1.6.0rc4 under Redhat Linux. The make is failing because some header files appear to be missing. Please see the make output below. Can you suggest what is wrong please? Best regards David bash-2.05$ pwd /home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4 bash-2.05$ bash-2.05$ make Making all in src make[1]: Entering directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' make all-recursive make[2]: Entering directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' Making all in . make[3]: Entering directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' gcc -DHAVE_CONFIG_H -I. -I/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src -I. -g -O2 -Wall -D_GNU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33:18: list.h: No such file or directory main.c:29:20: format.h: No such file or directory main.c:30:20: werror.h: No such file or directory main.c:31:19: queue.h: No such file or directory main.c:32:24: pkt_buffer.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' make: *** [all-recursive] Error 1 bash-2.05$ bash-2.05$ cd src bash-2.05$ bash-2.05$ ls affile.c afremctrl.h afuser.h cfg-lex.l getopt.h Makefile.in strptime.h affile.c.x afsocket.c center.c config.h log.c nscache.c syslog-names.c affile.h afsocket.c.x center.c.x config.h.in log.h nscache.h syslog-names.h afinet.c afsocket.h center.h destinations.c log.h.x snprintf.c syslog-ng.h afinet.c.x afsocket.h.x center.h.x destinations.h macros.c sources.c tests afinter.c afstreams.c cfgfile.c destinations.h.x macros-gperf.c sources.c.x utils.c afinter.h afstreams.c.x cfgfile.h filters.c macros.gprf sources.h utils.h afprogram.c afstreams.h cfgfile.h.x filters.c.x macros.h sources.h.x afprogram.c.x afunix.c cfg-grammar.c filters.h main.c stamp-h afprogram.h afunix.c.x cfg-grammar.h filters.h.x main.c.x stamp-h.in afremctrl.c afuser.c cfg-grammar.y getopt1.c Makefile strcasecmp.c afremctrl.c.x afuser.c.x cfg-lex.c getopt.c Makefile.am strptime.c bash-2.05$ Telecom MODUS is an ISO9001/TickIT approved Company. LRQA Certificate of Approval reference 0965133 ************************************************************ THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS PRIVATE AND/OR PROPRIETARY. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please forward the whole message to admin(a)t-modus.nec.co.uk Company Registration No.3493954 Telephone Number +44 (0) 1372 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk ************************************************************

1 0

Sanity checking
by Carol Overes 21 Nov '03

21 Nov '03

Hi, I'm looking for a way to do some sanity checking on logs messages. My goal is to delete any logmessages which might contain malicious strings or commands like "halt". I'm thinking of using a combination of syslog-ng and logsurfer. However I haven;t have any experience with this combination. Any thoughts or tips about this matter are appreciated. Regards, Carol __________________________________ Do you Yahoo!? Free Pop-Up Blocker - Get it now http://companion.yahoo.com/

2 1

syslog-ng and security
by joop jansen 20 Nov '03

20 Nov '03

Hi, I was wondering if anyone has experience with sanity checking of syslog messages. I'm looking for a manner to filter syslog messages such as: "set passwd ....", which could start commands on a UNIX system. Also, I use a webinterface to view the syslog messages (like the vermeer.org) However I want to filter syslog messages that could exploit browser vulnerabilities. Anyone experience with this or have some good advice ? Thanks in advance for any help. Carol Overes __________________________________ Do you Yahoo!? Protect your identity with Yahoo! Mail AddressGuard http://antispam.yahoo.com/whatsnewfree

5 12

RE: [syslog-ng]Please help with logging remote machines
by Hamilton Andrew 19 Nov '03

19 Nov '03

Looks to me like you are using some flavor of linux. My process table on Redhat only has one entry for syslog-ng. I think you should probably stop the syslog-ng process via your usual startup/shutdown method to see what process it thinks it is running. Then look to see what processes are still alive. Kill those via the kill command then restart syslog-ng via your normal startup procedure. That might clear up some of your issues. Regards, Drew -----Original Message----- From: Daniel Flick [mailto:dflick@pdq.net] Sent: Wednesday, November 19, 2003 2:39 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Please help with logging remote machines On Wed, 2003-11-19 at 12:26, Balazs Scheidler wrote: > On Wed, Nov 19, 2003 at 08:53:51AM -0600, Daniel Flick wrote: > > On Tue, 2003-11-18 at 03:06, Balazs Scheidler wrote: > > > On Mon, Nov 17, 2003 at 02:56:49PM -0600, Daniel Flick wrote: > > > > I have been beating my head against a wall getting this to work but no > > > > joy. Syslog-ng is running and logging on the local system but no remote > > > > logs are being saved. Devices in question are PIX firewalls and > > > > NetCache proxies. > > > > > > Have you checked whether syslog-ng is actually receiving messages ? > > > > > > tcpdump and strace would help here. > > tcpdump shows that the firewalls are contacting the machine. > > > > I was not able to get anything of value with "strace syslog-ng" I am > > new to this tool so I may not be using it right. This is the only error > > I could find but I don't know what that means. > > > > open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or > > directory) > > check the pid of the syslog-ng process as it is running in the background, > and attach to it using strace > > strace -s 256 -o /tmp/syslog-ng.trace -p <syslog-ng pid> > > run it for a couple of seconds, to let your firewall send syslog messages. > Then grep the file /tmp/syslog-ng.trace for the string "recvfrom" > > Each received message should have a corresponding recvfrom() call. If you > can't see anything either syslog-ng is not correctly bound, or your packet > filter drops syslog traffic Interesting that I have so many syslog-ng processes. Is this normal? ps -aux | grep [s]yslog root 11118 0.0 0.0 1780 808 ? S Nov17 1:31 syslog-ng root 11994 0.0 0.0 1724 696 ? S 08:31 0:01 syslog-ng root 11999 0.0 0.0 1712 724 ? S 09:00 0:00 syslog-ng all all root 12066 0.0 0.0 1708 680 ? S 09:22 0:00 syslog-ng root 12071 0.0 0.0 1680 652 ? S 09:23 0:00 syslog-ng root 12075 0.0 0.0 1688 660 ? S 09:23 0:00 syslog-ng root 12079 0.0 0.0 1680 652 ? S 09:23 0:00 syslog-ng root 12083 0.0 0.0 1700 672 ? S 09:24 0:00 syslog-ng root 12087 0.0 0.0 1688 656 ? S 09:24 0:00 syslog-ng root 12091 0.0 0.0 1684 656 ? S 09:24 0:00 syslog-ng root 12095 0.0 0.0 1728 740 ? S 09:25 0:11 syslog-ng I attached to 11999 and a few others and could not find recvfrom anywhere. The file is rather small and I posted one here. I also tries to attach to several other syslog-ng processes with the same results. I also verified that no filters are running that may be dropping the packets. cat /tmp/syslog-ng.trace time(NULL) = 1069271394 poll([{fd=8, events=0}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 5, 100) = 0 poll([{fd=8, events=0}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 5, 31000) = 0 time(NULL) = 1069271425 poll([{fd=8, events=0}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 5, 100) = 0 poll([{fd=8, events=0}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 5, 0) = 0 getpid() = 11999 time(NULL) = 1069271425 time(NULL) = 1069271425 time(NULL) = 1069271425 poll([{fd=8, events=0}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 5, 100) = 0 poll( <unfinished ...> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Flood Protection
by Thomas Vögtle 19 Nov '03

19 Nov '03

Hello, we are using syslog-ng on our servers and we are quite satiesfied with it. But there is still one question open for me: is there any kind of flood protection like the old syslog has? One stupid program got mad and flooded our logs until the harddisk was full. I want to have the same as that: Nov 18 15:58:56 tv2 user: allwaysthesame Nov 18 15:58:56 tv2 last message repeated 137 times No way to configure this behaviour? Thanks, Thomas

3 3

RE: [syslog-ng]Flood Protection
by Rule, Ted 19 Nov '03

19 Nov '03

Surely one can code round that little problem. Instead of maintaining a history table which records the number of times the last message has been received, one records the number of times in the last N seconds that a given client's last message has been repeated. The history table, instead of being one count, and one string buffer, becomes an array indexed by clients of with each item containing a count and a buffer and a timestamp. Obviously the table would have to be size limited and probably idle-time-purged, to avoid it eating up resource. Ted > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Jason Haar > Sent: Tuesday 18 November 2003 22:10 > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Flood Protection > > > On Wed, 2003-11-19 at 04:02, Thomas Vögtle wrote: > > I want to have the same as that: > > Nov 18 15:58:56 tv2 user: allwaysthesame > > Nov 18 15:58:56 tv2 last message repeated 137 times > > > > One problem with this feature is that it can only work if the last 137 > syslog events to occur were the same event. We run a large centralized > syslog server environment, with lots of syslog clients, and > as such this > sort of limiting feature never really gets to work, as it's quite rare > for one event to occur record after record without some other client > squirting in a new record. > > Oh well... > > Cheers > > Jason Haar > Information Security Manager, Trimble Navigation Ltd. > Phone: +64 3 9635 377 Fax: +64 3 9635 417 > PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0