- syslog-ng - lists.balabit.hu

Forwarding unchanged Syslog messages
by Harrie.van.Arragon＠steinmuehlen-brot.de 24 Jul '03

24 Jul '03

Is it possible to forward syslogmessages without modifing the Host and the messages. I thought "keep_hostname(yes)" would solve the problem, but it didn't. Normaly i use version 1.5.15 shipped with debian, but I tryed 1.5.26 too. I don't konw if its important, but our syslogserver has a load of 100% the whole day (not from syslog-ng). I tryed the following config: options { use_fqdn(yes); sync(0); use_dns(yes); chain_hostnames(yes); keep_hostname(yes); }; source net { tcp(); udp();}; destination pc1 { udp(192.168.1.1);}; destination pc2 { udp(192.168.1.2);}; destination pc3 { udp(192.168.1.3);}; log { source(net); destination(pc1);}; log { source(net); destination(pc2);}; log { source(net); destination(pc3);}; bye Harrie

1 0

fopen fails under load on Solaris, HUP doesn't work
by Ryan Moon 23 Jul '03

23 Jul '03

Hi all, I'm running version 1.6.0rc3 of syslog-ng on Solaris 2.6 and I have a problem where a HUP signal is not correctly processed due to limitations in the Solaris stdio library. I've traced this down to the use of fopen in make_syslog_config() in cfgfile.c. When the server is under load (several hundred TCP connections from clients), the HUP is not processed because fopen() does not work when it receives a file descriptor from open() above 255. The fopen() fails and the rest of the actions to be performed on a HUP are skipped. I see that the fopen is used because of the fread and fwrite calls in cfg-lex.c. Is there any way that lex/flex could be configured to use read/write instead of fread/fwrite, and the call to fopen in cfgfile.c replaced with open? I really don't want to restart syslog-ng every time I need to rotate logs, as the overhead is too high. I'd much rather just HUP so that I can keep the client TCP connections alive via the keep-alive option. Thank you, Ryan Moon rmoon(a)gocougs.wsu.edu

1 0

UDP Source removal
by Tom Oele 22 Jul '03

22 Jul '03

First off, thanks for the syslog-ng effort. :-) Setting up a "middle-man" syslog forwarder for multiple IDS devices. The issue I'm having is that I need to keep the originating device IP through this forwarder. The original message is old syslog to syslog-ng then off again to a correlation host with a syslogd listener. The correlation host needs those messages in their original form instead of with the middle mans IP attached. IDS1(syslog)----->Middle Host(syslog-ng)------>Correlation(syslogd -r) ^ | IDS2(syslog)--------- So the correlation host obviously is taking the UDP source from the middle man and appending it to the beginning of the message. Have tried using keep_hostname() with no avail. Current options are the following: options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(yes); chain_hostnames(no); }; Am I missing something here? Ideas? Thnx, T -- Neohapsis, Inc. Thomas Oele - Network Security Consultant 414.289.0966 Milwaukee 773.394.8310 Chicago www.Neohapsis.com

2 1

netmask() and syslog-ng 1.6.0rc3
by Rick Shank 22 Jul '03

22 Jul '03

Hello, I saw a post showing the netmask() function for filters. I'm trying to do a filter such as: filter f_company { host("company-firewall") or host("company-ids") or netmask("10.128.53.0/24") or netmask("10.128.54.0/24") or netmask("10.128.55.0/24") or netmask("10.128.56.0/24") or netmask("10.128.57.0/24") or netmask("10.128.58.0/24");}; This doesn't seem to work. What am I doing wrong? I'm using the netmasks because the server can't get DNS for those hosts (internal Windows 2000 hosts using EvntSLog). Thanks, ~rick shank

1 0

Destiniation program question
by Aaron Jackson 22 Jul '03

22 Jul '03

I am trying to get syslog-ng 1.6.0rc3 to run a program as soon as it receives a message that matches a specific string, but I am having a few problems. My syslog-ng.conf file has the following set up: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_udp { udp(); }; source s_tcp { tcp(); }; destination d_prog { program("/path/to/program.pl" template("$HOST,$MSG\n")); }; filter f_fetch { level(notice) and match("MATHC_STRING"); }; log {source(s_sys); source(s_udp); source(s_tcp); filter(f_fetch); destination(d_prog); }; My first question is an easy one. My perl program has the form: while ($line=<>) { ... } Is this correct? When syslog-ng forks my perl script, can I assum that STDIN is always open or should my script have a form like so? while (1) { $line=<>; ... } My second question has to do with when the perl script is run. It looks like syslog-ng waits for either several log messages or gets a SIGTERM (or similar) before it runs the program. I would like for this to happen in real time. The only option I see that might change the timimg of when the program is run is log_fifo_size. But since I have to use a production system that collects over 20K log messages/day for development (yes, this is bad), I would like to know if I'm on the right track before I change anything. Any info would be helpful. Thanks. Aaron

1 0

Re: [syslog-ng]List of Valid Source Addresess
by Daniel.N.Sferas＠us.hsbc.Com 21 Jul '03

21 Jul '03

Bazsi, I am interested in filtering based on the sender's IP address. My preferred method would be to read a file containing the list of valid source IP addresses, automagically generated by our management system. The file could contain up to 6,000 entries. Dan syslog-ng-request@lists.balabit.hu@lists.balabit.hu on 18 Jul 2003 08:31 Please respond to syslog-ng(a)lists.balabit.hu Sent by: syslog-ng-admin(a)lists.balabit.hu To: syslog-ng(a)lists.balabit.hu Message: 1 To: syslog-ng(a)lists.balabit.hu From: Daniel.N.Sferas(a)us.hsbc.Com Date: Thu, 10 Jul 2003 06:13:55 -0400 Subject: [syslog-ng]List of Valid Source Addresess Reply-To: syslog-ng(a)lists.balabit.hu Greetings, I would like to be able to validate that incoming syslog messages from the network are from "Well known" sources. Is there a way for syslog-ng to parse the source address against a flat file of IP addresses or patterns? I hesitate to use a match string in the syslog-ng.conf file as the filter would be very large. I am using 1.6.0rc3. Thanks in advance for any tips. Dan Sferas ************************************************************************ This E-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return E-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. ************************************************************************ --__--__-- Message: 2 Date: Thu, 10 Jul 2003 13:01:07 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]List of Valid Source Addresess Reply-To: syslog-ng(a)lists.balabit.hu On Thu, Jul 10, 2003 at 06:13:55AM -0400, Daniel.N.Sferas(a)us.hsbc.Com wrote: > Greetings, > > I would like to be able to validate that incoming syslog messages from the > network are from "Well known" sources. Is there a way for syslog-ng to > parse the source address against a flat file of IP addresses or patterns? > I hesitate to use a match string in the syslog-ng.conf file as the filter > would be very large. do you want to filter based on sender IP address, or the hostname part? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 ************************************************************************ This E-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return E-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. ************************************************************************

2 1

is flags(fallback) b0rken in 1.6.0rc3?
by Asher Yanich 18 Jul '03

18 Jul '03

Hi, I finally went ahead and upgraded my syslog-ng from 1.5.7 to 1.6.0r3. Previously, I used filter(DEFAULT) to catch all logs that had not matched anything else. I updated my config, to log { source(src); destination(d_default); flags(fallback); }; I however do not recieve anything to this destination, so it seems that fallback is broken? Can someone verify that this is the current state of syslog-ng? Thanks, -asher Asher Yanich Systems & Network Support Group Florida International University School of Computer Science "I've never had problems with 'extra time'. As far as I know, 'extra time' as a concept is right up there with Santa Claus and the Tooth Fairy." -Linus Torvalds

1 1

Running two syslog-ng on Solaris 8 ?
by Georg Oppenberg 18 Jul '03

18 Jul '03

Hi, I'm trying to run two syslog-ng on a Solaris 8 box: One is a replacement of the original syslogd, the other one is running in a chrooted environment and configured to log to into file inside the chroot jail. Inside the chroot jail I have made a /dev/log with 'mknod /dev/log -c 21 5'. I'm using the streams server with doors. The corresponding statement in syslog-ng.conf is: source local { sun-streams ("/dev/log" door("/var/run/syslog_door")); internal(); }; /etc/.syslog_door is soft-linked to /var/run/syslog_door. I would like to separate the logs of the chroot environment from the logs of the server. This is not working, though. Log entries generated either on the machine or in the chroot environment are logged in two files. I think this is caused by the log driver, which is responsible for passing messages between applications and syslog daemons. Do I try the impossible or does anybody have configured a similar setup sucessfully? Please respond also directly to me, as I'm not subscribed to the list, yet. Cheers Georg

1 0

RE: [syslog-ng]Syslog-ng Logging message three times?
by Hamilton, Andrew 18 Jul '03

18 Jul '03

What does your config look like? Especially the log lines. Are you logging three times to the same file? Please post your config so we can take a look at it. Regards, Drew -----Original Message----- From: markallen(a)micron.com [mailto:markallen@micron.com] Sent: Friday, July 18, 2003 9:32 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Syslog-ng Logging message three times? I'm running syslog-ng version 1.6 and I notice that any message that is logged to syslog-ng is logged three times versus once. I can do logger command and log to it and three message pop into the file system. Is this normal? Is it a bug? How do I fix it? Thanks -Mark _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Syslog-ng Logging message three times?
by markallen＠micron.com 18 Jul '03

18 Jul '03

I'm running syslog-ng version 1.6 and I notice that any message that is logged to syslog-ng is logged three times versus once. I can do logger command and log to it and three message pop into the file system. Is this normal? Is it a bug? How do I fix it? Thanks -Mark

1 0

Config error
by TIM MOORE 18 Jul '03

18 Jul '03

I just loaded Syslog-ng 1.6.0rc3 on a SuSE 8.2 linux box. I have successfully been running version 1.6.0rc1 on another LFS box for months. I took my config from the box running 1.6.0rc1 and put it on the new box. I get an error on the options. Did something change in the format or something with the options? I didn't see anything in the documentation that said formating or options changed. The daemon does run, but kicks out this for error: syslog1:~ # /etc/init.d/syslog-ng start /etc/init.d/syslog-ng: /etc/syslog-ng/syslog-ng.conf: line 12: syntax error near unexpected token `(' /etc/init.d/syslog-ng: /etc/syslog-ng/syslog-ng.conf: line 12: `options { long_hostnames(off); use_fqdn(yes); use_dns(yes); dns_cache(yes); keep_hostname(yes); use_time_recvd(yes); sync(0); };' Starting Syslog-ng done Everything looks right to me and it works fine on another box running 1.6.0rc1. Can anyone see the problem? I must be missing something little. Thanks, --------------------------------------- Tim Moore DNS/Linux/Cisco Admin ODJFS

1 0

Syslog-ng in a windowed shell
by will＠villa442.freeserve.co.uk 14 Jul '03

14 Jul '03

Is it posssible to have syslog-ng to output log data to a windowed shell rather than a main terminal. I'm currently running Debian v3 with KDE, & can get it to output ok to fullscreen terminal screens e.g. tty8 and root, but not windowed in the KDE environment. If so what should the config line be for this. Thanks in Advance. Will __________________________________________________________________________ Join Freeserve http://www.freeserve.com/time/ Winner of the 2003 Internet Service Providers' Association awards for Best Unmetered ISP and Best Consumer Application.

2 1

Year off the first of the month
by Keith Olmstead 14 Jul '03

14 Jul '03

Hello, Something strange is happening. At the first of the month I have logs that create a dir for 2002, one year ago and log breafly for 2002. It seems to be happening at the first of the month and only last breafly. Does anyone know why this is happening? Thanks, Keith

4 3

Log TCP
by Darrell Boyd 12 Jul '03

12 Jul '03

1 0

RE: [syslog-ng]Dropped messages and UDP buffer sizes
by Clemson, Chris 11 Jul '03

11 Jul '03

> On Thu, Jul 10, 2003 at 09:39:18AM +0100, Clemson, Chris wrote: > > Hello! > > We are trying to use syslog-ng to log messages from several servers. > > We get quite a few "dropped" messages from syslog-ng saying > between 70 and > > 290 are being dropped each time. > > According to the list, it sounds like we need to increase > out UDP receive > > buffer size. > > If syslog-ng reports dropped messages in itself, increasing > UDP receive > buffer will not help, as syslog-ng itself has already pulled > the message. ah, i see. > Message drops within syslog-ng might happen because one or more of the > destinations process messages slower than the sources. If you > only have file > destinations then increasing log_fifo_size() might help. it seems, after a bit more fiddling around, that it is a problem when logging to mysql (i didn't realise we were still logging to it). when we stop logging to mysql, 0 lines are dropped. is there anything we can do to buffer logging to mysql? thanks, chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

2 1

RE: [syslog-ng]syslog-ng - AIX 5.x.x
by Gehring, Andrew x66132 10 Jul '03

10 Jul '03

I've successfully compiled it on 5.2 using gcc 3.3 Problems? Andrew _ This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

1 0

syslog-ng - AIX 5.x.x
by sey mor 10 Jul '03

10 Jul '03

Has anyone run across any problems on AIX 5.x.x? syslog-ng(a)lists.balabit.hu _________________________________________________________________ Tired of spam? Get advanced junk mail protection with MSN 8. http://join.msn.com/?page=features/junkmail

1 0

syslog-ng&logrotate
by yannick.haguenier＠tuxfamily.org 10 Jul '03

10 Jul '03

Hy, i have squid + syslog-ng 1.0.6.rc1 Syslog-ng look squid/access.log, and write log file (with date format) on a remote server (tcp). On squid there is a logrotate at 6 am. My pb : before the log rotate, all is good. After logrotate, syslog-ng don't write in the remote file. The last line appear in this file was create at 6am. The process run on the both server, and i have no error. If i run syslog-ng restart, syslog-ng write the ligne in remote file . the next error appear after the next logrotate. Does anyone know why this is happening? thanks

1 0

List of Valid Source Addresess
by Daniel.N.Sferas＠us.hsbc.Com 10 Jul '03

10 Jul '03

Greetings, I would like to be able to validate that incoming syslog messages from the network are from "Well known" sources. Is there a way for syslog-ng to parse the source address against a flat file of IP addresses or patterns? I hesitate to use a match string in the syslog-ng.conf file as the filter would be very large. I am using 1.6.0rc3. Thanks in advance for any tips. Dan Sferas ************************************************************************ This E-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return E-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. ************************************************************************

2 1

The syslog-ng process dies
by Madhvi Gokool 10 Jul '03

10 Jul '03

Hello I have noticed this problem twice now- I start syslog-ng manually from a script with the following command : - syslog-ng -f /etc/syslog-ng.conf Syslog messages get logged in their respective files/directories. However, some time during the night, the syslog-ng process dies by itself - The command ps -aux |grep syslog-ng yields no process ID and the log files show nothing. Syslog-ng version is 1.5.9 Is this a bug ?? Regards Madhvi

3 5

Dropped messages and UDP buffer sizes
by Clemson, Chris 10 Jul '03

10 Jul '03

Hello! We are trying to use syslog-ng to log messages from several servers. We get quite a few "dropped" messages from syslog-ng saying between 70 and 290 are being dropped each time. According to the list, it sounds like we need to increase out UDP receive buffer size. We are running suse 8.2 on a Pentium II 266 and a SCSI HD. The machine had 64mb in it, and we increased this to 128mb which didn't help. We get around the same number of "dropped" messages. We are logging from 5 machines, and getting ~9500 messages a day and we are making it log to just /var/log/messages at the moment. The network card is a 3com 3c905b (cyclone). Watching top for memory and processor usage doesn't indicate that anything is using a lot of either. Do we need to increase the UDP receive buffer? if so, where do we find it? it sounds worryingly like a kernel recompile job! Any help would be appreciated. thanks, chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

2 1

syslog-ng and logrotate
by yannick.haguenier＠tuxfamily.org 10 Jul '03

10 Jul '03

Hy, i have squid + syslog-ng 1.0.6.rc1 Syslog-ng look squid/access.log, and write log file (with date format) on a remote server (tcp). On squid there is a logrotate at 6 am. My pb : before the log rotate, all is good. After logrotate, syslog-ng don't write in the remote file. The last line appear in this file was create at 6am. The process run on the both server, and i have no error. If i run syslog-ng restart, syslog-ng write the ligne in remote file . the next error appear after the next logrotate. Does anyone know why this is happening? thanks

1 0

RE: [syslog-ng]The syslog-ng process dies
by Michael.Semling＠swisscom.com 10 Jul '03

10 Jul '03

Hi Madhvi, I had the same experience - I updated to 1.6.0rc3 and libol 0.3.10 since then I do not have this problem anymore. Regards, Michael -----Original Message----- From: Madhvi Gokool [mailto:madhvin@yahoo.com] Sent: Donnerstag, 10. Juli 2003 08:42 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]The syslog-ng process dies Hello I have noticed this problem twice now- I start syslog-ng manually from a script with the following command : - syslog-ng -f /etc/syslog-ng.conf Syslog messages get logged in their respective files/directories. However, some time during the night, the syslog-ng process dies by itself - The command ps -aux |grep syslog-ng yields no process ID and the log files show nothing. Syslog-ng version is 1.5.9 Is this a bug ?? Regards Madhvi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Does flags(fallback) work?
by Asher Yanich 09 Jul '03

09 Jul '03

Hi, I finally went ahead and upgraded my syslog-ng from 1.5.7 to 1.6.0r3. Previously, I used filter(DEFAULT) to catch all logs that had not matched anything else. I updated my config, to log { source(src); destination(d_default); flags(fallback); }; I however do not recieve anything to this destination, so it seems that fallback is broken? Can someone verify that this is the current state of syslog-ng? Thanks, -asher Asher Yanich Systems & Network Support Group Florida International University School of Computer Science "I've never had problems with 'extra time'. As far as I know, 'extra time' as a concept is right up there with Santa Claus and the Tooth Fairy." -Linus Torvalds

1 0

Regarding Php-Syslog-NG
by Perriero, Robert A. 07 Jul '03

07 Jul '03

ok, i have everything set up, and syslog-ng is working very nicely. Problem is that the script that runs to move logs from named pipe in /tmp to the mysql server does not work from cron. It works succesfully from a putty window, but that defeats the purpose. Does anyone have a working shell script for php-syslog-ng? My OS is Solaris 9 (SPARC). If anyone has this, could you please email me as soon as possible? Thanks in advance. Sincerely, Robert Perriero PS. Please don't send me the existing MySQL script that's currently on vermeer.org as that's the one I'm using. I need an updated script, or I need advice on how to get this to work correctly.

2 1