- syslog-ng - lists.balabit.hu

Log monitoring
by netsec novice 09 Jun '03

09 Jun '03

I am looking for a tool that would allow me to perform an action(send e-mail) when a particular event meets a threshhold. I have my IDS tuned to the point where I have a good sense of how many alerts I receive in an hour. I know I can send an alert based on matching a particular alert but what I would really like to do is send notification based on whether I receive more than 10 alerts in less than an hour. I hope my intention is clear here... I know there are products out there such as Swatch or logwatch but I haven't seen anything that alerts on thresholds rather than pattern matching only. My idea here is to set up something that watches my logs continuously and if I get more than 10 alerts within an hour or less during any part of the day - I would be paged. I am not a Perl guru so any help I can get in getting started is appreciated. My guess is that someone has already invented the wheel - I just don't know where it is. Thanks for any guidance... Nicole _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

2 1

RE: [syslog-ng]Log monitoring
by Hamilton, Andrew 09 Jun '03

09 Jun '03

This is really out of the scope of the syslog process so you'd probably want an external package. You can look at Big Brother. http://www.bb4.com. It is a very useful monitoring tool. And will monitor all kinds of things. It would be fairly simple to have it do this. Regards, Drew -----Original Message----- From: netsec novice [mailto:netsec9@hotmail.com] Sent: Monday, June 09, 2003 1:42 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Log monitoring I am looking for a tool that would allow me to perform an action(send e-mail) when a particular event meets a threshhold. I have my IDS tuned to the point where I have a good sense of how many alerts I receive in an hour. I know I can send an alert based on matching a particular alert but what I would really like to do is send notification based on whether I receive more than 10 alerts in less than an hour. I hope my intention is clear here... I know there are products out there such as Swatch or logwatch but I haven't seen anything that alerts on thresholds rather than pattern matching only. My idea here is to set up something that watches my logs continuously and if I get more than 10 alerts within an hour or less during any part of the day - I would be paged. I am not a Perl guru so any help I can get in getting started is appreciated. My guess is that someone has already invented the wheel - I just don't know where it is. Thanks for any guidance... Nicole _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]log file permission
by Moxey, Joel, CND Tech Dev, VF UK 09 Jun '03

09 Jun '03

Check out your UMASK. Rgds, J -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 09 June 2003 6:37 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]log file permission What version are you using? Is this a global option or a per file option? Regards, Drew -----Original Message----- From: Moktar KONE [mailto:moktar@mtds.com] Sent: Monday, June 09, 2003 1:20 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]log file permission dear all, I am using syslog-ng and I want my log file be created with this permission : rwx-rwx-rwx ; I added this line in the options : perm(777); but my file is not created with the expected permission. any idea? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]log file permission
by Hamilton, Andrew 09 Jun '03

09 Jun '03

What version are you using? Is this a global option or a per file option? Regards, Drew -----Original Message----- From: Moktar KONE [mailto:moktar@mtds.com] Sent: Monday, June 09, 2003 1:20 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]log file permission dear all, I am using syslog-ng and I want my log file be created with this permission : rwx-rwx-rwx ; I added this line in the options : perm(777); but my file is not created with the expected permission. any idea? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

log file permission
by Moktar KONE 09 Jun '03

09 Jun '03

dear all, I am using syslog-ng and I want my log file be created with this permission : rwx-rwx-rwx ; I added this line in the options : perm(777); but my file is not created with the expected permission. any idea?

1 0

Reciving data from non RFC compliant devices
by Michael Boman 08 Jun '03

08 Jun '03

I just got another syslog-generating machine to monitor, and it seems it doesn't follow the syslog RFC as it sends out messages with ^I (tabs). I was thinking about hacking syslog-ng in such way it will enforce RFC compliance of the "message" part for the data. Basically I am thinking about replacing char <= 31 and char >= 127 with a space. Question: - Any reason why _not_ to do this? - Which function is the best place to hack the code in? Best regards Michael Boman -- Michael Boman Security Architect, SecureCiRT Pte Ltd http://www.securecirt.com

1 0

RE: [syslog-ng]What means "dropped" ?
by Loubet Jean-Michel 08 Jun '03

08 Jun '03

I've only got one syslog client host for my bench (solaris 6), and one collector with syslog-ng 1.6.0rc3 (solaris 6). Here are my global properties if you need them : keep_hostname(yes); long_hostnames(no); log_fifo_size(8192); log_msg_size (2048); sync(1024); use_time_recvd(yes); use_dns(no); use_fqdn(no); dns_cache(no); stats (4); JM Loubet > > I'll give you more informations : > > Here are my bench's results : > > 20000 msgs sent > 19873 msgs written (after kill -HUP) > > and my logs : > > [...] > STATS: dropped 0 > STATS: dropped 64 > STATS: dropped 1994 > STATS: dropped 2002 > STATS: dropped 1871 > STATS: dropped 1994 > STATS: dropped 1998 > STATS: dropped 1744 > STATS: dropped 71 > STATS: dropped 0 > [...] each destination may drop messages, and this is an aggregated result. (e.g. if you have 5 destinations, a single message may be counted 5 times, provided all destinations were full)

2 1

filter match()
by Amodiovalerio Verde 06 Jun '03

06 Jun '03

Hi all, during some extensive test on syslog-ng, I found something that really make me difficult to implement some filters. I need to match same EXACT messages, and so I used something like match("^MATCHTHIS$") in a filter statement... but I find that the match will consider the message starting from the program name... Is there any way to match JUST the message part without the program one ??? ( the program() just work on the program part of the message, so i expected that match() will work on the other one... ) Thanks in advance Amodiovalerio Verde amodiovalerio.verde(a)ags-it.com amover(a)libero.it

4 4

syslog-ng and syslogd
by Bossi, Scott 06 Jun '03

06 Jun '03

Hi, I'm new to syslog-ng. Is there a way for syslog-ng and syslogd to co-exist? Our servers are managed by another group, and they don't support syslog-ng. Can you pipe all syslogd messages to syslog-ng?

2 1

RE: [syslog-ng]What means "dropped" ?
by Loubet Jean-Michel 06 Jun '03

06 Jun '03

>On Fri, Jun 06, 2003 at 03:36:44PM +0200, Loubet Jean-Michel wrote: >> Hi, >> >> I don't really understand what means "dropped" in stats. I've done benchs >> and I didn't found any correlation between really dropped messages and the >> number in dropped stats. > >DROPPED is the number of messages dropped by syslog-ng itself. It does not >count messages dropped due to full socket buffers (as they are dropped by >the kernel and not syslog-ng) I'll give you more informations : Here are my bench's results : 20000 msgs sent 19873 msgs written (after kill -HUP) and my logs : [...] STATS: dropped 0 STATS: dropped 64 STATS: dropped 1994 STATS: dropped 2002 STATS: dropped 1871 STATS: dropped 1994 STATS: dropped 1998 STATS: dropped 1744 STATS: dropped 71 STATS: dropped 0 [...] That's why I said I didn't found any correlation between the 2 results ... Any idea ? Thanks, JM Loubet

2 1

Syslog-ng, MySql and Checkpoint Firewall-1 NG
by Robin Brown 06 Jun '03

06 Jun '03

Anyone sending their Checkpoint logs to a central syslog server running syslog-ng and logging to a MySql database? I may have to do this in the near future and was wondering if it's possible and what if any problems I can expect to encounter. Thanks! -Robin

2 2

What means "dropped" ?
by Loubet Jean-Michel 06 Jun '03

06 Jun '03

Hi, I don't really understand what means "dropped" in stats. I've done benchs and I didn't found any correlation between really dropped messages and the number in dropped stats. Thanks for your answer, JM Loubet

2 1

Re: [syslog-ng]Help with host filter for 10.10.10.0/26
by Henning Markussen 06 Jun '03

06 Jun '03

Yes it is the sender ... and it works .. - Henning Balazs Scheidler <bazsi(a)balabit.hu> Sent by: syslog-ng-admin(a)lists.balabit.hu 06-06-03 12:19 Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: Subject: Re: [syslog-ng]Help with host filter for 10.10.10.0/26 On Fri, Jun 06, 2003 at 10:26:46AM +0200, Henning Markussen wrote: > Hi ! > > Can someone help me with a filter that matches 10.10.10.0/26 ? is 10.10.10.0/26 the sender of the log message itself, or it is included in the message as the 'host' field? if it is the sender you can use the netmask() filter: filter f_xx { netmask("10.10.10.0/26"); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Help with host filter for 10.10.10.0/26
by Henning Markussen 06 Jun '03

06 Jun '03

Hi ! Can someone help me with a filter that matches 10.10.10.0/26 ? - Henning

2 1

libtool ar not found
by Steven Welters 05 Jun '03

05 Jun '03

Hi, I want to install syslog-ng on my Solaris 7 system. I have gcc 3.2.3, GNU make 3.80, GNUflex, bison. I run into problems with compiling the libol (have tried 0.3.10, 3.9, 3.8, 3.6, 3.5). ./configure seems to work, however, make stops with these error messages: ../libtool: ar: not found make[1]: *** [libol.la] Error 1 make[1]: Leaving directory `/tmp/libol-0.3.5/src' make: *** [all-recursive] Error 1 I have searched the internet but no references to this problem found. Does anyone have a clue? Best regards & thanks in advance, Steven ---"Virtual" means never knowing where your next byte is coming from.---

3 2

tcp wrappers, syslog-ng and solaris 9
by Tivon Luker 05 Jun '03

05 Jun '03

Hello. I am attempting to get tcp wrappers to work with syslog-ng-1.6.0rc3 compiled under solaris 9. syslog-ng seems to ignore hosts.allow and hosts.deny. When compiling ,configure says it finds everything and I compiled with --enable-tcp-wrapper. Has anyone been successful in getting this to work? _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

2 1

syslog-ng macro
by Michael Earls 05 Jun '03

05 Jun '03

What is the best way to apply filters to this macro. Let say I want to log messages to a different file for a given IP address. Should I add this type of statement before the destination d_mysql. # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # source src { unix-dgram("/dev/log"); internal(); }; source net { udp(); }; # # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # # source src { unix-dgram("/dev/log"); internal(); udp(); }; ## Log syslog-ng to mysql database ## destination d_mysql { file("/syslog/data/fulllog.$YEAR.$MONTH.$DAY.$HOUR.$MIN.$SEC" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; Thanks, michael Michael Earls Systems Analyst, Information Services Cincinnati Children's Hospital Medical Center Phone: 513-636-5882 Pager: Michael.Earls(a)skytel.com PGP Info: KeyID 0x5EB59708 Fingerprint 108B A1D8 76F5 08A8 501A F28C 86F4 4BC5 5EB5 9708

1 0

macro expansion in program destinations
by Nate Campi 05 Jun '03

05 Jun '03

I might be missing something obvious here, but is there a way to get macros to expand when used as arguments to external scripts? ex: ---------------- destination test-script { program("/tmp/testscript /var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$HOST_$YEAR_$MONTH_$DAY"); }; log { source(src); destination(test-script); }; ---------------- Here's /tmp/testscript: ---------------- #!/bin/sh echo $1 > /tmp/arg ---------------- # cat /tmp/arg /var/log/HOSTS///// I'd like to be able to pass these things, especially message-specific things like facility. Is there a way and I'm just not seeing it? -- Nate Campi http://www.campin.net

2 1

1 as IP
by KELLYM15＠Nationwide.com 04 Jun '03

04 Jun '03

Hello, We have the following package installed on a Sun Solaris 8 machine. The syslog output for one of our CSS boxes is being recorded under a directory number 1. The rest of the devices we log are being recorded under their regular IP address. For example, an ls of our output directory looks similar to this: (note the first directory) drwxr-xr-x 2 root root 512 Jun 4 02:11 1 drwxr-xr-x 2 root root 512 Jun 4 00:00 25.75.27.148 drwxr-xr-x 2 root root 512 Jun 4 04:04 25.75.27.149 drwxr-xr-x 2 root root 512 Jun 4 00:00 25.75.27.150 drwxr-xr-x 2 root root 512 Jun 4 04:34 25.75.27.151 Have you seen that before? Is there a configuration change on the CSS that needs to be made? Thanks, Mark Kelly =========================================================================== PKGINST: SOsyslog NAME: syslog-ng CATEGORY: application ARCH: sparc VERSION: 1.5.23 VENDOR: BalaBit IT Ltd. PSTAMP: Nationwide Security Operations INSTDATE: May 14 2003 20:20 EMAIL: syslog-ng(a)lists.balabit.hu STATUS: completely installed FILES: 25 installed pathnames 10 shared pathnames 15 directories 3 executables 1983 blocks used (approx)

1 0

RE: [syslog-ng] problem with incorrect separation of syslog messages from Cisco PIX
by Ted_Rule＠flextech.co.uk 04 Jun '03

04 Jun '03

At blooming last....and FYI. Having now upgraded our PIX to version 6.3, and enabled TCP logging on port 1468... I can see that all messages ( in raw tcpdump trace ) are newline terminated ( note the 0a HEX bytes in the packet dump ) I can also we see that the 255 byte buffer length problem has been sorted out, as I can now see these messages in full. ( They used to truncate halfway through the dest_proxy definition... ) Jun 4 10:26:05 littlepix %PIX-7-702303: sa_request, (key eng. msg.) src= 11.11.11.11, dest= 22.22.22.22, src_proxy= 11.11.110/255.255.255.0/0/0 (type=4), dest_proxy= 22.22.22.128/255.255.255.192/0/0 (type=4), protocol= ESP, transform= esp-3des esp-sha-hmac , lifedur= 1200s and 4608000kb, spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4004 Jun 4 10:26:05 littlepix %PIX-7-702303: sa_request, (key eng. msg.) src= 11.11.11.11, dest= 22.22.22.22, src_proxy= 11.11.110/255.255.255.0/0/0 (type=4), dest_proxy= 22.22.22.128/255.255.255.192/0/0 (type=4), protocol= ESP, transform= esp-3des esp-md5-hmac , lifedur= 1200s and 4608000kb, spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4004 The only problem so far is that these messages have appeared ( for some reason they didn't show up in Version 6.2 log stream but ARE listed on the syslog message listings for 6.2 ). I shall have to fancify my log filtering to suppress them.... They all correspond to regular MGMT station SNMP polling and are ignorable but are gradually filling the log... Jun 4 10:10:31 littlepix %PIX-7-710002: UDP access permitted from 33.33.33.4/943 to inside:33.33.33.15/snmp Jun 4 10:11:31 littlepix %PIX-7-710002: UDP access permitted from 33.33.33.4/9903 to inside:33.33.33.15/snmp Jun 4 10:11:42 littlepix %PIX-7-710002: UDP access permitted from 33.33.33.4/10159 to inside:33.33.33.15/snmp Whether or not any problems exist using the UDP syslog transport on the PIX under v6.3, I haven't actually tested, but I'd be fairly confident they've also been fixed.... All in all v6.3 has fixed up all my outstanding issues with PIX syslogging. Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

How do I adjust logging for "foreign" facilites?
by Wayne Sweatt 03 Jun '03

03 Jun '03

I am running syslog-ng-1.6.0rc2+20030423 on Solaris 8. I see a problem with the udp logging of facilities from non-Solaris clients. For example, syslog-ng is storing the authpriv facility from Linux clients as "a" as the $FACILITY value, and cron as "9". It also sets the value of "a" for MacOS X client's netinfo facility. I can understand strange values for the "non_Solaris" facilites - authpriv and netinfo, but . the cron value is set correctly from Solaris clients while not for Linux clients. I thought these numeric Facility codes were "standard' between OSes. Any explanations? Is there a suggested way to convert these values at runtime using filters(?), or maybe there an easy way to re-compile this functionality in for Solaris? The logs are arriving and being stored just fine, it's just the $FACILITY value that I would like to translate back to it's native "name" for clean parsing reasons. Thanks, Wayne Sweatt

2 1

Help - How do I reply to a thread?
by Wayne Sweatt 02 Jun '03

02 Jun '03

How do I reply to a thread? The Web Form has no "Reply" action built in, so I'm assuming it's a Subject line format? Thanks, Wayne Sweatt Sr. UNIX System Administrator Comforce Technical Services LANL SCC Team

2 1

Losing 25% of messages using UDP
by Wayne Sweatt 02 Jun '03

02 Jun '03

I just changed my udp_recv_hiwat to 65536 (Solaris 8). It worked for me! Wayne Sweatt Sr. UNIX System Administrator Comforce Technical Services LANL SCC Team

1 0

Rotate my logs files
by Moktar KONE 02 Jun '03

02 Jun '03

Hi , I am testing syslog-ng and I want to know how can I rotate my logs file . To logs messages I have a directory for many hosts, for each host, logs are classified by facilities, I have a new log file each day for each facility. so the name of my logs files changes according to the date. how can rotate the old log files? the logs of 2days ago? 3days ago? thanks this is the section that logs my files : destination hosts { file("/var/log/HOSTS/$HOST/$FACILITY/$FACILITY_$YEAR_$MONTH_$DAY" create_dirs(yes)); };

5 4

syslog-ng and Linux kernel 2.4.20
by Balazs Scheidler 29 May '03

29 May '03

hi, this message is to inform you that syslog-ng might crash on kernels 2.4.20 due to a kernel bug. It causes syslog-ng to crash every few days. the problem is that recvfrom() returns without touching either the sockaddr length or the socket address. If the memory area contains a seemingly valid AF_INET address (because of a previous invocation), then sockaddr2address_info memcpy()s socklen (which is 256 in our case) amount of memory to a sockaddr_in. I've now added a workaround, and an assert statement to catch these cases. Patch is included below, but grabbing the latest libol snapshot should also help. A workaround is attached: diff -u -r1.36 -r1.37 --- io.c 30 Apr 2003 08:08:50 -0000 1.36 +++ io.c 22 May 2003 16:56:59 -0000 1.37 @@ -1,6 +1,6 @@ /* io.c * - * $Id: io.c,v 1.36 2003/04/30 08:08:50 bazsi Exp $ */ + * $Id: io.c,v 1.37 2003/05/22 16:56:59 bazsi Exp $ */ /* lsh, an implementation of the ssh protocol * @@ -373,9 +373,13 @@ for (;;) { int res; + /* This is another workaround for Linux kernel bugs */ + + ((struct sockaddr *) addr)->sa_family = 0; + res = recvfrom(closure->fd, buffer, length, 0, (struct sockaddr *) addr, (socklen_t *) addrlen); - if (*addrlen == 2) { + if (*addrlen == 2 || (*addrlen >= 2 && ((struct sockaddr *) addr)->sa_family == 0)) { /* HACK: this is a workaround of a Linux 2.2 & 2.4 bug, * it doesn't return anything sensible in sockaddr buf */ @@ -1013,6 +1017,7 @@ struct sockaddr_in *in = (struct sockaddr_in *) addr; UINT32 ip, port; + assert(addr_len == sizeof(struct sockaddr_in)); ip = ntohl(in->sin_addr.s_addr); port = ntohs(in->sin_port); a = make_inet_address(c_format_cstring("%i.%i.%i.%i", -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0