- syslog-ng - lists.balabit.hu

syslog-ng throttling and event reporter
by Russell Adams 07 Jul '03

07 Jul '03

I'm using Event Reporter on my Windows servers to forward their event log to my syslog-ng server. Recently, I've switched all of my Linux syslog clients to use TCP to speak to the syslog-ng server, without any problems. I've just enabled TCP on Event Reporter, and its behaving rather unusually. I'm seeing 30+ open TCP connections from the one Windows host I've enabled TCP on, and am experiencing messages that I'm frequently hitting my max connections value of 100 open connections. Is anyone running a similar configuration and seen similar problems? I suspect that Event Reporter is using one connection per message, as silly as that sounds. Its wild to contemplate it leaving those connections open. If its not a known problem, I'll break out a sniffer to see whats going on. Russell

1 0

Performance
by omar Brihi 03 Jul '03

03 Jul '03

Hello I would like to know how many TCP connections per seconds, the syslog-ng can handle simulteanously? Did anybody can tell me from his experience? how many equipments, bandwidth taken, Mbytes? regards omar ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com

1 0

last message repeated?
by Chuck Berg 02 Jul '03

02 Jul '03

Is there a particular reason why syslog-ng doesn't generate "last message repeated x times" messages? It's very unfortunate to have the disk on my log server fill up because of one machine flooding the logs. For example, Solaris will send one "WARNING: /tmp: File system full, swap space limit exceeded" message for every write() that fails for that reason. It's easy to get tens of thousands of these per second.

1 0

SEC and SYSLOG-NG
by Sawall, Christopher L 01 Jul '03

01 Jul '03

I'm trying to use SEC now, instead of SWATCH. Any progress on getting things up on your website? If I manually run against a log file, it works great, but I'm trying to integrate it into syslog-ng. I saw a post where you showed the following: ####################################### destination d_sec { program("/usr/local/sbin/sec.pl -input=\"-\" -conf=/usr/local/etc/sec.conf >/var/log/sec.err 2>&1"); }; # send all logs to sec log { source(src); filter(f_not_brightmail); destination(d_sec); }; ####################################### I made up my own filter to include all facilities so as to watch for everything. But I'm not getting it to work, it never reports back. If I do a "ps -ef", I can see that syslog-ng did start up the SEC process... but no luck. Any help would be appreciated. Thanks, Chris ******************************* The information contained in this message may be privileged and/or confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. Note that any views or opinions presented in this message are solely those of the author and do not necessarily represent those of Ameren. All emails are subject to monitoring and archival. Finally, the recipient should check this message and any attachments for the presence of viruses. Ameren accepts no liability for any damage caused by any virus transmitted by this email. If you have received this in error, please notify the sender immediately by replying to the message and deleting the material from any computer. Ameren Corporation *******************************

1 0

Strange behaviour with kernel log
by Zumeo 30 Jun '03

30 Jun '03

Hi, I've downloaded latest syslog-ng and installed it on my box (Mandrake 9.0). Here is my syslog-ng.conf : ---8<--- ### Options ### options { dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname(yes); }; ### Sources ### source local { unix-stream("/dev/log"); pipe("/proc/kmsg" log_prefix("kernel: ")); udp(ip(127.0.0.1) port(514)); internal(); }; ### Destinations ### destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination user { file("/var/log/user.log"); }; destination mail { file("/var/log/mail/log"); }; destination mailinfo { file("/var/log/mail/info"); }; destination mailwarn { file("/var/log/mail/warnings"); }; destination mailerr { file("/var/log/mail/err"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination boot { file("/var/log/boot.log"); }; destination explanations { file("/var/log/explanations"); }; ### Filters ### filter f_auth { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_user { facility(user); }; filter f_mail { facility(mail); }; filter f_debug { not facility(auth, authpriv, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail); }; filter f_info { level(info); }; filter f_warn { level(warn); }; filter f_err { level(err); }; filter f_boot { facility(local7); }; filter f_explanations { facility(local1); }; ### Logs ### log { source(local); filter(f_auth); destination(authlog); }; log { source(local); filter(f_syslog); destination(syslog); }; log { source(local); filter(f_cron); destination(cron); }; log { source(local); filter(f_daemon); destination(daemon); }; log { source(local); filter(f_kern); destination(kern); }; log { source(local); filter(f_user); destination(user); }; log { source(local); filter(f_mail); destination(mail); }; log { source(local); filter(f_mail); filter(f_info); destination mailinfo); }; log { source(local); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(local); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(local); filter(f_debug); destination(debug); }; log { source(local); filter(f_messages); destination(messages); }; log { source(local); filter(f_boot); destination(boot); }; log { source(local); filter(f_explanations); destination(explanations); }; --->8--- To try my syslog-ng.conf, I used logger : # logger -p kern.info "test kern.info 1" Then I checked kern.log and saw nothing. The "test kern.info 1" was in user.log ! Can someone explain me this strange behaviour ? --zumeo ________________________________________________________________________ This letter has been delivered unencrypted. We'd like to remind you that the full protection of e-mail correspondence is provided by S-mail encryption mechanisms if only both, Sender and Recipient use S-mail. Register at S-mail.com: http://www.s-mail.com

4 3

Error message: No source refers to internal messages,
by R Saroukhanian 30 Jun '03

30 Jun '03

Hi again! Thank you Nate and Bob for responding. I made changes which both of you pointed out. However, my error message persists. That is I am still getting " No source refers to internal messages, they will go to /dev/null unresolved reference:src Error initializing configuration, exiting." error message Now, after the recommended changes, my syslog-ng.conf file looks like this: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> options {sync(0); }; source src { udp(10.101.54.2) port(514); internal(); }; destination telnet_d {file ("/var/log/telnetlog"); } ; log {source (src); destination (telnet_d); }; >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Specifically, - "internal();" was referenced in the syslog-ng.conf file - telnet_d was properly referenced in both destination and log... - just in case I changed source src_udp to source src...and change log to look like "log {source (src); destination (telnet_d); };"....this is because I am getting " unresolved reference:src" in the error message.. After, I made changes in the syslog-ng.conf AND rebooted the box (blame my Windows mentality) I ran syslog-ng manually from /etc and AGAIN the same error message popped up. Since, I have followed the editing recommendations from Nate Campi and Bob Lister and I am still getting the same error message I am forced to think out of the box now. Here are possible problem areas 1. SYSLOG-NG.CONF SYNTAX 2. SOMETHING WITH MY FREE BSD SET UP 3. Here is another problem area...the way I created telnetlog file in my /var/log folder is by way of running "vi telnetlog" and then exiting vi by way of "ESC...:wq!...." . This created the telnetlog file in /var/log which I CAN observe by way of l"s". The doubts I have is whether syslog-ng is able to write into thus created telnetlog file...does syslog-ng like the format of thus created telnetlog? Because, I am very new to FreeBSD I cannot be more specific in hypothesizing what is wrong with my FreeBSD...however... I managed at a certain point to pick up logs from my NT box...some entries related to the Telnet service start and stop showed up in one of my log files. At that point I had an assistance....from another person....not any more. Since then we terminated SYSLOG service entirely....and also made some changes to the ORIGINAL syslog-ng-conf file that came with the syslog-ng installation. Do you have any pointers...clues? Which other factors may be causing this error message? Here is round up of my setup: SYSLOG-NG release 1.6.0 r3 FreeBSD 4.8 box telnetlog created using vi syslog-ng is in /etc syslog-ng.conf is in /etc My original posting is below. I would greatly appreciate your suggestions. Regards, Ruben Saroukhanian MY ORIGINAL POSTING IN SYSLOG-NG MAILING LIST.... > Hello folks, >=20 > Could somebody help me with this error message I am getting when = trying to run SYSLOG-NG? >=20 > Error message: > No source refers to internal messages, they will go to /dev/null > unresolved reference:src > Error initializing configuration, exiting. >=20 > Here is my setup. >=20 > I installed syslog-ng version 1.6.0 r3 on my FreeBSD 4.8 box. >=20 > The overall plan is to collect log messages sent to by NTSyslog from a = Windows 2000 box to SYSLOG-NG on the FreeBSD 4.8 box. > For a test I have been starting and stopping a telnet service on my = Windows 2000 box to pick up these events in the telnetlog file which I = created on my FreeBSD computer. >=20 > Both syslog-ng and syslog-ng.conf file are located in /etc of the = FreeBSD box. >=20 > I am logged in as root. >=20 > syslog.conf file looks like this: >=20 > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > options {sync(0); }; >=20 > source src_udp {udp(10.101.54.2) port(514); }; >=20 > destination telnet_d {file ("/var/log/telnetlog"); } ; >=20 > log {source (src_udp); destination (telnet_t); }; >=20 > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >=20 >=20 > I run syslog-ng manually from inside /etc and get the error message = listed above. >=20 > Does the error message I am getting relate to syntax of the = syslog-ng.conf or something else? >=20 > Should I add a filter entry ...inside log statement argument? for it = to lool like >>>>>> log {source (src_udp); filter (DEFAUILT); = destination (telnet_t); }; ??? >=20 > I am looking forward to hearing from you. >=20 > Please send a copy of your response to rex(a)piva.net. >=20 > Thank you, >=20 > Ruben Saroukhanian --__--__-- Message: 8 Date: Thu, 19 Jun 2003 22:34:13 +0100 From: Robert Lister <robl(a)linx.net> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Need help...with SYSLOG-NG Reply-To: syslog-ng(a)lists.balabit.hu > > > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > > options {sync(0); }; > > > > source src_udp {udp(10.101.54.2) port(514); }; > > > > destination telnet_d {file ("/var/log/telnetlog"); } ; ----------------^^^^^^^^ > > log {source (src_udp); destination (telnet_t); }; -----------------------------------------^^^^^^^^ ... maybe it relates to that? Fix that and see what it does. Rob -- Robert Lister - London Internet Exchange - http://www.linx.net/ - tel: +44 (0)20 7645 3510 - RL786-RIPE --__--__-- Message: 9 Date: Thu, 19 Jun 2003 16:54:32 -0700 From: Nate Campi <nate(a)campin.net> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Need help...with SYSLOG-NG Reply-To: syslog-ng(a)lists.balabit.hu On Thu, Jun 19, 2003 at 05:14:55PM -0400, R Saroukhanian wrote: > > > > Error message: > > No source refers to internal messages, they will go to /dev/null > > unresolved reference:src > > Error initializing configuration, exiting. <DEFANGED_snip> > > syslog.conf file looks like this: > > > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > > options {sync(0); }; > > > > source src_udp {udp(10.101.54.2) port(514); }; > > You'll need to declare the "internal" source too. See the FAQ and the links to example syslog-ng.conf files. -- Nate Campi http://www.campin.net --__--__-- Message: 10 Date: Thu, 19 Jun 2003 16:58:15 -0700 From: Nate Campi <nate(a)campin.net> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Need help...with SYSLOG-NG Reply-To: syslog-ng(a)lists.balabit.hu On Thu, Jun 19, 2003 at 05:14:55PM -0400, R Saroukhanian wrote: > > Hello folks, > > > > Could somebody help me with this error message I am getting when trying to run SYSLOG-NG? > > > > Error message: > > No source refers to internal messages, they will go to /dev/null > > unresolved reference:src > > Error initializing configuration, exiting. > > > > Here is my setup. > > > > I installed syslog-ng version 1.6.0 r3 on my FreeBSD 4.8 box. > > > > The overall plan is to collect log messages sent to by NTSyslog from a Windows 2000 box to SYSLOG-NG on the FreeBSD 4.8 box. > > For a test I have been starting and stopping a telnet service on my Windows 2000 box to pick up these events in the telnetlog file which I created on my FreeBSD computer. > > > > Both syslog-ng and syslog-ng.conf file are located in /etc of the FreeBSD box. > > > > I am logged in as root. > > > > syslog.conf file looks like this: > > > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > > options {sync(0); }; > > > > source src_udp {udp(10.101.54.2) port(514); }; > > > > destination telnet_d {file ("/var/log/telnetlog"); } ; > > > > log {source (src_udp); destination (telnet_t); }; > > > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> I didn't address the error that makes syslog-ng exit, how lame of me :( Here's what I think you want out of syslog-ng: #################################################### options { sync(0); }; source src_udp { udp(10.101.54.2) port(514); internal; }; destination telnet_d { file ("/var/log/telnetlog"); } ; log { source (src); destination (telnet_d); }; #################################################### I fixed the differing destination name, and make your source name consistent, and added the internal source. This should at least get your basic setup working. Sorry I didn't pay more attention the first time. -- Nate Campi http://www.campin.net --__--__-- Message: 11 Date: Thu, 19 Jun 2003 17:00:56 -0700 From: Nate Campi <nate(a)campin.net> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Need help...with SYSLOG-NG Reply-To: syslog-ng(a)lists.balabit.hu On Thu, Jun 19, 2003 at 04:58:15PM -0700, Nate Campi wrote: > > source src_udp { > udp(10.101.54.2) port(514); > internal; > }; Arg, make that "internal();" I promise not to reply to myself again on this thread, no matter how bad my next mistake is ;) -- Nate Campi http://www.campin.net --__--__-- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng End of syslog-ng Digest

2 1

IPv6 support
by Timothy Brown 27 Jun '03

27 Jun '03

Does syslog-ng support communication via IPv6? If not, will it support this in the future, or has someone written a patch? Thanks. Best regards, Tim --

1 0

Re: syslog-ng
by Michael Earls 27 Jun '03

27 Jun '03

This works, Thanks, Michael >>> bazsi(a)balabit.hu 06/27/03 05:41AM >>> On Wed, Jun 25, 2003 at 06:36:38PM -0400, Michael Earls wrote: > syslog-ng > > Is there a way to have syslog-ng write two files, ex > > > destination mailx > { > file("/var/log/mailx/mail.log" owner("root") group("adm") > perm(0640)); > file("/var/log/mailx/remote-mail.log" owner("root") > group("adm") perm(0640)); > }; > > log { source(net); destination(mailx); > } > > I am looking at having a file for mailgraph to use to create stats, > then my other file will be logged into mysql. this is definitely possible. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: syslog-ng
by Balazs Scheidler 27 Jun '03

27 Jun '03

On Wed, Jun 25, 2003 at 06:36:38PM -0400, Michael Earls wrote: > syslog-ng > > Is there a way to have syslog-ng write two files, ex > > > destination mailx > { > file("/var/log/mailx/mail.log" owner("root") group("adm") > perm(0640)); > file("/var/log/mailx/remote-mail.log" owner("root") > group("adm") perm(0640)); > }; > > log { source(net); destination(mailx); > } > > I am looking at having a file for mailgraph to use to create stats, > then my other file will be logged into mysql. this is definitely possible. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RegExp filters / match ?
by Brian Ipsen 25 Jun '03

25 Jun '03

Hi! I'm trying to mask out snmptrap from different hosts.... I've created: filter f_snmptrapd_test { program(snmptrapd) and match("snmptrapd\[[0-9]{1,5}\]: (192.168.0.230|192.168.0.231|192.168.1.230|192.168.1.231|192.168.1.232): "); }; The question is just the match() statement.... Is snmptrapd included for usage with match (since snmptrapd is the program) ? If not, how much of the message below is the string used for the regular expression with match() ? Jun 25 11:26:56 sigma snmptrapd[16138]: 192.168.1.230: Enterprise Specific Trap (1) Uptime: 121 days, 21:32:17.60, OLD-CISCO-TS-MIB::tslineSesType.1.1 = INTEGER: telnet(5), RFC1213-MIB::tcpConnState.192.168.1.230.23.192.168.1.178.43819 = INTEGER: synReceived(4), OLD-CISCO-TCP-MIB::loctcpConnElapsed.192.168.1.230.23.192.168.1.178.43819 = Wrong Type (should be Timeticks): INTEGER: 1150, OLD-CISCO-TCP-MIB::loctcpConnInBytes.192.168.1.230.23.192.168.1.178.43819 = INTEGER: 110, OLD-CISCO-TCP-MIB::loctcpConnOutBytes.192.168.1.230.23.192.168.1.178.43819 = INTEGER: 420, OLD-CISCO-TS-MIB::tsLineUser.1 = "" Or how do I mask traps from specific hosts into a seperate logfile ? Regards, /Brian

1 0

mailgraph
by Michael Earls 24 Jun '03

24 Jun '03

syslog-ng I am running mailgraph script and i was told that i need to patch my perl:syslog in order for mailgraph to view syslog-ng log files. http://mail.python.org/pipermail/mailman-developers/2001-November/010072.ht… --post about perl:syslog http://people.ee.ethz.ch/~dws/software/mailgraph/ — mailgraph Does anyknow know about this? thanks, michael

1 0

Description of the TCP protocol?
by Rich Salz 23 Jun '03

23 Jun '03

I want to implement my own client that can use a TCP link to syslog-ng. Is the protocol defined anywhere? /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html XML Security Overview http://www.datapower.com/xmldev/xmlsecurity.html

2 3

Filter on hosts ?
by Brian Ipsen 23 Jun '03

23 Jun '03

Hi! I'm trying to get syslog-ng to filter out traps from certain hosts... In my syslog-ng.conf I have: destination d_snmptrapd { file("/var/log/snmptrapd"); }; destination d_snmptrapd_network { file("/var/log/snmptrapd.network"); }; filter f_snmptrapd { program(snmptrapd) and not host("192.168.0.230|192.168.1.230|192.168.0.231"); }; filter f_snmptrapd_network { program(snmptrapd) and host("192.168.0.230|192.168.1.230|192.168.0.231"); }; log { source(s_sys); filter(f_snmptrapd); destination(d_snmptrapd); }; log { source(s_sys); filter(f_snmptrapd_network); destination(d_snmptrapd_network); }; But traps from 192.168.0.230 still ends up in /var/log/snmptrapd - and nothing is written to /var/log/snmptrapd.network Am I completely wrong regarding my regular expresisons (I'm no expert in that field) ?? Regards /Brian

1 0

Re: [syslog-ng] Problem with large logfiles, Solved
by Vuorilehto Saska 23 Jun '03

23 Jun '03

Hi all and thanks! Problem with large files is solved. Upgrading to syslog-ng version 1.6.x did the trick for me. Thanks for everyone who answered! ******* Saska

1 0

Filter on hosts ?
by Brian Ipsen 20 Jun '03

20 Jun '03

Hi! I'm trying to get syslog-ng to filter out traps from certain hosts... In my syslog-ng.conf I have: destination d_snmptrapd { file("/var/log/snmptrapd"); }; destination d_snmptrapd_network { file("/var/log/snmptrapd.network"); }; filter f_snmptrapd { program(snmptrapd) and not host("192.168.0.230|192.168.1.230|192.168.0.231"); }; filter f_snmptrapd_network { program(snmptrapd) and host("192.168.0.230|192.168.1.230|192.168.0.231"); }; log { source(s_sys); filter(f_snmptrapd); destination(d_snmptrapd); }; log { source(s_sys); filter(f_snmptrapd_network); destination(d_snmptrapd_network); }; But traps from 192.168.0.230 still ends up in /var/log/snmptrapd - and nothing is written to /var/log/snmptrapd.network Am I completely wrong regarding my regular expresisons (I'm no expert in that field) ?? Regards /Brian

1 0

Filter on hosts ?
by Brian Ipsen 20 Jun '03

20 Jun '03

Hi! I'm trying to get syslog-ng to filter out traps from certain hosts... In my syslog-ng.conf I have: destination d_snmptrapd { file("/var/log/snmptrapd"); }; destination d_snmptrapd_network { file("/var/log/snmptrapd.network"); }; filter f_snmptrapd { program(snmptrapd) and not host("192.168.0.230|192.168.1.230|192.168.0.231"); }; filter f_snmptrapd_network { program(snmptrapd) and host("192.168.0.230|192.168.1.230|192.168.0.231"); }; log { source(s_sys); filter(f_snmptrapd); destination(d_snmptrapd); }; log { source(s_sys); filter(f_snmptrapd_network); destination(d_snmptrapd_network); }; But traps from 192.168.0.230 still ends up in /var/log/snmptrapd - and nothing is written to /var/log/snmptrapd.network Am I completely wrong regarding my regular expresisons (I'm no expert in that field) ?? Regards /Brian

1 0

RE: [syslog-ng]Recording relay instance
by Hamilton, Andrew 20 Jun '03

20 Jun '03

Probably the closest thing to that right now is chain_hostnames(on) as a global option. You don't get what you really want but you get something like: 20 June 2003 12:00:00 relay/host program:..... as a hostname you get both the host it came through and the host it originated from. There isn't a macro defined for relay but you could probably hack the code for chain_hostnames to give you a relay. The only trouble would be figuring it out if you have more than one relay. -----Original Message----- From: Michael Boman [mailto:michael.boman@securecirt.com] Sent: Friday, June 20, 2003 6:58 AM To: Syslog-NG ML Subject: [syslog-ng]Recording relay instance Hi, I have some "problems" with syslog-ng. I have it deployed in several networks, and some of these networks are sharing the same IP address range and sometimes even the same IP address for certain hosts. This means that I can't truly say that 192.168.51.4 is either the db server in network A or the web server in network B. I'd like to have a $RELAY macro so I can save the logs as /LOGS/$RELAY/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$YEAR_$MONTH_$DAY Where $RELAY is where the message came from (so with direct connections it would be the same as $HOST, but with a syslog-ng in relay mode you get the address/name of the relay host). Basically a "received from" field. Is this functionality planned, or does it already exist (checked out the documentation but didn't see anything there). Best regards Michael Boman -- Michael Boman Security Architect, SecureCiRT Pte Ltd http://www.securecirt.com

2 1

Recording relay instance
by Michael Boman 20 Jun '03

20 Jun '03

Hi, I have some "problems" with syslog-ng. I have it deployed in several networks, and some of these networks are sharing the same IP address range and sometimes even the same IP address for certain hosts. This means that I can't truly say that 192.168.51.4 is either the db server in network A or the web server in network B. I'd like to have a $RELAY macro so I can save the logs as /LOGS/$RELAY/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$YEAR_$MONTH_$DAY Where $RELAY is where the message came from (so with direct connections it would be the same as $HOST, but with a syslog-ng in relay mode you get the address/name of the relay host). Basically a "received from" field. Is this functionality planned, or does it already exist (checked out the documentation but didn't see anything there). Best regards Michael Boman -- Michael Boman Security Architect, SecureCiRT Pte Ltd http://www.securecirt.com

2 1

Need help...with SYSLOG-NG
by R Saroukhanian 20 Jun '03

20 Jun '03

> Hello folks, > > Could somebody help me with this error message I am getting when trying to run SYSLOG-NG? > > Error message: > No source refers to internal messages, they will go to /dev/null > unresolved reference:src > Error initializing configuration, exiting. > > Here is my setup. > > I installed syslog-ng version 1.6.0 r3 on my FreeBSD 4.8 box. > > The overall plan is to collect log messages sent to by NTSyslog from a Windows 2000 box to SYSLOG-NG on the FreeBSD 4.8 box. > For a test I have been starting and stopping a telnet service on my Windows 2000 box to pick up these events in the telnetlog file which I created on my FreeBSD computer. > > Both syslog-ng and syslog-ng.conf file are located in /etc of the FreeBSD box. > > I am logged in as root. > > syslog.conf file looks like this: > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > options {sync(0); }; > > source src_udp {udp(10.101.54.2) port(514); }; > > destination telnet_d {file ("/var/log/telnetlog"); } ; > > log {source (src_udp); destination (telnet_t); }; > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > > > I run syslog-ng manually from inside /etc and get the error message listed above. > > Does the error message I am getting relate to syntax of the syslog-ng.conf or something else? > > Should I add a filter entry ...inside log statement argument? for it to lool like >>>>>> log {source (src_udp); filter (DEFAUILT); destination (telnet_t); }; ??? > > I am looking forward to hearing from you. > > Please send a copy of your response to rex(a)piva.net. > > Thank you, > > Ruben Saroukhanian

3 4

Need help...with SYSLOG-NG
by R Saroukhanian 19 Jun '03

19 Jun '03

Hello folks, Could somebody help me with this error message I am getting when trying to run SYSLOG-NG? Error message: No source refers to internal messages, they will go to /dev/null unresolved reference:src Error initializing configuration, exiting. Here is my setup. I installed syslog-ng version 1.6.0 r3 on my FreeBSD 4.8 box. The overall plan is to collect log messages sent to by NTSyslog from a Windows 2000 box to SYSLOG-NG on the FreeBSD 4.8 box. For a test I have been starting and stopping a telnet service on my Windows 2000 box to pick up these events in the telnetlog file which I created on my FreeBSD computer. Both syslog-ng and syslog-ng.conf file are located in /etc of the FreeBSD box. I am logged in as root. syslog.conf file looks like this: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> options {sync(0); }; source src_udp {udp(10.101.54.2) port(514); }; destination telnet_d {file ("/var/log/telnetlog"); } ; log {source (src_udp); destination (telnet_t); }; >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> I run syslog-ng manually from inside /etc and get the error message listed above. Does the error message I am getting relate to syntax of the syslog-ng.conf or something else? Should I add a filter entry ...inside log statement argument? for it to lool like >>>>>> log {source (src_udp); filter (DEFAUILT); destination (telnet_t); }; ??? I am looking forward to hearing from you. Please send a copy of your response to rex(a)piva.net. Thank you, Ruben Saroukhanian

1 0

RE: [syslog-ng]Problem using Flags
by Naman Latif 17 Jun '03

17 Jun '03

Ok. I am using 1.4.17 so probably that is the reason. Regards \\ Naman > -----Original Message----- > From: Achim Gsell [mailto:achim@cybercity.ch] > Sent: Monday, June 16, 2003 11:33 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Problem using Flags > > > On Tuesday 17 June 2003 01:26, Naman Latif wrote: > > > I am trying to use the Flags (Final) option in the log statement. > > However syslog-ng comes up with a parse error. Am I missing > something > > here ? > > > > log { source(s_udp); filter(f_pixpermit); destination(pixpermit); > > flags(final); }; > > Mmh. I think the log definition is OK and "flags(final)" > should work. I use > the flags(final) option in most log definitions. What version > of syslog-ng do > you use? The flags(final) option was introduced in an early > 1.5 version. > > Achim > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/sysl> og-ng > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > >

1 0

Problem with large logfiles
by Vuorilehto Saska 17 Jun '03

17 Jun '03

Hi all, I'm quite new to this list so forgive me if this has been discussed before... Problem is that every time our logfiles grow larger than 2gb (2147483647 to be exact) syslog-ng dies and doesn't start until that specific logfile is renamed... Syslog-ng is version 1.4.16 running on a RedHat 7.3 machine and yes, we have ext3 filesystem in use, which should support files over that. At least we can merge those logfiles to one big file anyway... Any suggestions are welcome... ******* Saska

2 1

syslog-ng down message lost
by Szalai Ferenc 17 Jun '03

17 Jun '03

Hello, I know that there was some discussion the message lost - using syslog-ng with TCP - in this list but they wasn't clear me. The syslog-ng version is 1.6.0rc3. So the log chain is a following: client->server1->server2 The client important config lines: source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination grid_d { tcp("<ip>" port(20000)); }; filter grid_f { program(syslog-ng) or program(condor); }; log { source(s_sys); filter(grid_f); destination(grid_d); }; The server1 inportant config lines: source grid_s { tcp(ip(<ip>) port(20000) keep-alive(yes) max_connections (100)); }; destination grid_to_entry { tcp("<ip>" port(20000)); }; log { source(grid_s); destination(grid_to_entry); }; The server2 important config lines: source grid_s { tcp(ip(<ip>) port(20000) keep-alive(yes) max_connections(30)); }; destination grid_all { file("/var/log/HOSTS/$YEAR/$MONTH/$DAY/all.log" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; log { source(grid_s); destination(grid_all); }; The global options are everyvere: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (no); use_fqdn (on); create_dirs (no); keep_hostname (yes); stats(3600); }; The problem is that sometimes the syslog-ng down message is missing on server2 log file. What is the main reason of this in this case or what modification is required to solve this problem? I hope I was clear. Thank you, Ferenc

2 1

RE: [syslog-ng] Problem with large logfiles
by SmeeB 17 Jun '03

17 Jun '03

heya, try starting the syslog-ng ps with a larger inode limit. regards, ---------------------------- Benjamin Smee ISe Hosting Team - Unix Team Phone: +44-208-8965586 Email: smeeb(AT)cpw.co.uk > -----Original Message----- > From: Vuorilehto Saska [mailto:saska.vuorilehto@lannenpuhelin.fi] > Sent: 17 June 2003 14:34 > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Problem with large logfiles > > > Hi all, > > I'm quite new to this list so forgive me if this has been discussed > before... > > Problem is that every time our logfiles grow larger than 2gb > (2147483647 to > be exact) syslog-ng dies and doesn't start until that > specific logfile is > renamed... > > Syslog-ng is version 1.4.16 running on a RedHat 7.3 machine > and yes, we have > ext3 filesystem in use, which should support files over that. > At least we > can merge those logfiles to one big file anyway... > > Any suggestions are welcome... > > ******* > Saska > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > This communication together with any attachments transmitted with it ("this E-Mail") is intended only for the use of the addressee and may contain information which is privileged and confidential. If the reader of this E-Mail is not the intended recipient or the employee or agent responsible for delivering it to the intended recipient you are hereby notified that any use, dissemination, forwarding, printing or copying of this E-Mail is strictly prohibited. Addressees should check this E-mail for viruses. The Company makes no representations as regards the absence of viruses in this E-Mail. If you have received this E-Mail in error please notify our ISe Response Team immediately by telephone on +44 (0)20 8896 5828 or via e-mail at postmaster(a)cpw.co.uk Please then immediately delete, erase or otherwise destroy this E-Mail and any copies of it. Any opinions expressed in this E-Mail are those of the author and do not necessarily constitute the views of the Company. Nothing in this E-Mail shall bind the Company in any contract or obligation. For the purposes of this E-Mail "the Company" means The Carphone Warehouse Group Plc and/or any of its subsidiaries. Please feel free to visit our website: http://www.phonehouse.com The Carphone Warehouse Group Plc (Registered in England No. 3253714) North Acton Business Park, Wales Farm Road, London W3 6RS

1 0

Problem using Flags
by Naman Latif 17 Jun '03

17 Jun '03

Hi, I am trying to use the Flags (Final) option in the log statement. However syslog-ng comes up with a parse error. Am I missing something here ? log { source(s_udp); filter(f_pixpermit); destination(pixpermit); flags(final); }; Regards \\ Naman

3 2