- syslog-ng - lists.balabit.hu

syslog-ng blanks in Servicename
by Unger, Christian 06 May '03

06 May '03

Hi, i log many informations via NT-Syslog to syslog-ng. Windows 2000 have some services with a blank in the Servicename. ex: NTDS ISAM the log entry from syslog-ng seams as following: Apr 15 15:42:33 ntds isam[info] 700 NTDS (268) Online defragmentation is beginning a full pass on database 'C:\WINNT\NTDS\ntds.dit'. NTDS ist NOT my hostname, thats the problem! I think thats the problem is in RFC. But i don't read it. ( no time :[ ) is there a easy escape? or will the next version of syslog-ng have a escape? Thanks for help Christian Unger

2 1

Re: Oops. I broke it. :(
by Brad Stockdale 06 May '03

06 May '03

Oops... I upgraded my syslog-ng from 1.4 train to 1.6 train, and it doesnt like my old configuration file... It seems to be choking on the following line: [root@internal syslog-ng-1.6.0rc3]# /usr/local/sbin/syslog-ng -f /etc/syslog-ng.conf unresolved reference: DEFAULT Error initializing configuration, exiting. Here's my config: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; source s_net { udp(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; destination d_udph { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/$FACILITY.log" create_dirs(yes)); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_net); filter(DEFAULT); destination(d_udph); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; log { source(s_sys); filter(DEFAULT); destination(d_mesg); }; It seems to dislike this line (I guess): log { source(s_net); filter(DEFAULT); destination(d_udph); }; Is there no more a default filter? Or am I just being stupid and cannot see a simple error? Thanks, Brad

2 1

Re: Ooo! I fixed it!
by Brad Stockdale 06 May '03

06 May '03

I guess RTFM is the quote of the day. I found reference to the DEFAULT idea being removed in preference to the flags(catchall)... It seems to be working fine. Thanks, Brad

1 0

Re: Log analysis
by Brad Stockdale 06 May '03

06 May '03

Hello all, I've been using syslog-ng for about a year now on a centralized logging server. It works great! But now I have 9 gigabytes of past logs... haha... In any case, I am trying to find a good way to analyze the daily logs... Sort of condense them like LogSentry/LogWatch does, but via a web interface... Can anyone out there recommend a good log analysis package? I started to try out lire, but part way through the setup I figured out that it might be a pain to try to get lire to understand the log rotations, etc... I rotate logs daily with the following directory structure: /var/log/$IPADDRESS/$4DIGITYEAR/$2DIGITMONTH/$2DIGITDAY/facilitypriority.log lire expects the logs to be in /var/log/ and use the normal rotation of putting a number at the end of the filename... Any thoughts? Thanks, Brad

1 0

Few general questions.
by Dawid Szymański 06 May '03

06 May '03

Hello, I'd like to get answers for few questions.. 1. Which version of syslogd-ng I should call stable? Its really complicated when I can read in docs that 1.4 is stable on web page that 1.6 is etc etc.. 2. Does any of syslogd-ng versions support encrypted connections over udp/tcp? 3. When/Are you going to support encrypted connections? Impatient ;) -- Kind regards, Dawid Szymanski

2 2

RE: [syslog-ng]Few general questions.
by Hamilton, Andrew 06 May '03

06 May '03

1. Well, I use 1.6 and it is very stable, just get the latest snapshot. There was a release that had a macro bug but it has since been remedied. I have been using 1.6 for the last several months without issue. 2. Currently syslog-ng doesn't support native encrypted sessions. You would have to use an add-on to get that functionality. 3. The encryption support is planned in v2.0. That is still in alpha and may not even be implemented in the series yet. Bazsi would have more details on whether that is available in that line or not. You can tap your foot and sigh with impatience all you want but Bazsi has lots on his plate and the improvements come has he has time. You'll just have to learn a little patience. Syslog-ng still beats the heck out of old syslogd. Regards, Drew -----Original Message----- From: Dawid Szymanski [mailto:dawszy@axit.pl] Sent: Tuesday, May 06, 2003 9:44 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Few general questions. Hello, I'd like to get answers for few questions.. 1. Which version of syslogd-ng I should call stable? Its really complicated when I can read in docs that 1.4 is stable on web page that 1.6 is etc etc.. 2. Does any of syslogd-ng versions support encrypted connections over udp/tcp? 3. When/Are you going to support encrypted connections? Impatient ;) -- Kind regards, Dawid Szymanski _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Sorting data from msg field into correct columns?
by Michael.Semling＠swisscom.com 06 May '03

06 May '03

Hi list, I can be more specific. I have in a DMZ proxies, routers and firewalls. Theses report into a syslog server in the DMZ. I want to have the messages in one central place so I send them to my central syslog server with a MYSQL DB. There they arrive but they look like following example. a.a.a.a = Where it comes from originally (at least what I think ;-)) b.b.b.b = NAME of the syslog server A router message | a.a.a.a | syslog5 | info | info | ae | 2003-05-06 | 04:21:38 | b.b.b.b | b.b.b.b : [ID 72119 syslog5.info] 04:21:36 drop rgw2 >eth0 reason: ACL: Ingress filter dropped packet ; src: a.b.c.d; s_port: 933; dst: f.g.h.i; d_port: 514; | 1015510 | A firewall message | c.c.c.c | syslog5 | info | info | ae | 2003-05-06 | 04:21:38 | b.b.b.b | b.b.b.b: [ID 72119 syslog5.info] 04:21:37 drop fwgw >eth1 product: SmartDefense; TCP sequence validator: dropped packet with invalid ACK number; attack: Bad TCP sequence; src: i.j.k.l; s_port: 80; dst: m.n.o.p; service: shell; proto: tcp; | 1015511 | So I would like to have the machine name as rgw2 or fwgw on the hosts or facility's place. Maybe the word 'drop' as level so I can create an index for fast search. Ideal would be, if I could do a search in the $MSG and then filter the entry and putting parts of the $MSG into different variabls e.g. $HOST etc. I guess this could already be done with a regexp search in the $MSG field then assigning the different variables. But I guess I have to hardcode all cases and I'd just like to take something like $MSG.$1, $MSG.$2 etc. This allowed me to do some kind of "message normalisation". Maybe that's impossible for some reasons (speed). Regards, Michael -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Montag, 5. Mai 2003 14:39 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Sorting data from msg field into correct columns? On Mon, May 05, 2003 at 10:55:07AM +0200, Michael.Semling(a)swisscom.com wrote: > Hi all! > > As I have now added hardware to report into a central syslog but I have > to uses a relay. (Another SYSLOG-NG) > Now I get messages containing > > Host: IP/Name of the relay > Facility, Priority, Level, tag, date, time and program is just all info > from the relay. > > In the msg I have all the data as the original host, time, msg. etc. > > Is there any way to "grep/sed/awk" the data out of the msg field and > sort them into the right columns? > > Is there an example for such a filter? Can you be more specific, can you perhaps provide examples (what you would expect and what happens in reality) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Sorting data from msg field into correct columns?
by Michael.Semling＠swisscom.com 05 May '03

05 May '03

Hi all! As I have now added hardware to report into a central syslog but I have to uses a relay. (Another SYSLOG-NG) Now I get messages containing Host: IP/Name of the relay Facility, Priority, Level, tag, date, time and program is just all info from the relay. In the msg I have all the data as the original host, time, msg. etc. Is there any way to "grep/sed/awk" the data out of the msg field and sort them into the right columns? Is there an example for such a filter? Any help is appreciated. Regards, Michael -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Freitag, 2. Mai 2003 14:00 To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Simple question, MySQL & Log file Just add an additional log line or additional destination. log { source(src); destination(dmysql); destination(maillog); }; or log { source(src); destination(dmysql); }; log { source(src); destination(maillog); }; Regards, Drew -----Original Message----- From: Bas Koot [mailto:bask@tiscali.nl] Sent: Thursday, May 01, 2003 5:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Simple question, MySQL & Log file Hi everybody! First of all, i like Syslog-NG ! But i have 1 (simple i think) question about it. For my postfix i need to use the /var/log/maillog file (for the pop-before-smtp feature) but at this moment everything is putted into the MySQL database. Somebody knows how to get the mail data in the database AND into the log file? My current config: # sources source src { unix-stream("/dev/log"); internal(); }; source kernsrc { file("/proc/kmsg"); }; # destinations destination dmysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host,facility,priority,level,tag, timestamp,program,msg) VALUES ('$HOST','$FACILITY', '$PRIORITY','$LEVEL','$TAG','$UNIXTIME','$PROGRAM', '$MSG');\n") template-escape(yes)); }; destination maillog { file("/var/log/maillog"); }; # logs log { source(src); destination(dmysql); }; log { source(kernsrc); destination(dmysql); }; Thanks! Greetings, Bas Koot.

2 1

How to _not_ resolve hostnames?
by Michael Boman 04 May '03

04 May '03

I'd like syslog-ng NOT resolve hostnames, i want $HOST to be the ip address and nothing else. How would I go about configure it like that? Best regards Michael Boman -- Michael Boman Security Architect, SecureCiRT Pte Ltd http://www.securecirt.com

2 2

RE: [syslog-ng]Simple question, MySQL & Log file
by Hamilton, Andrew 02 May '03

02 May '03

Just add an additional log line or additional destination. log { source(src); destination(dmysql); destination(maillog); }; or log { source(src); destination(dmysql); }; log { source(src); destination(maillog); }; Regards, Drew -----Original Message----- From: Bas Koot [mailto:bask@tiscali.nl] Sent: Thursday, May 01, 2003 5:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Simple question, MySQL & Log file Hi everybody! First of all, i like Syslog-NG ! But i have 1 (simple i think) question about it. For my postfix i need to use the /var/log/maillog file (for the pop-before-smtp feature) but at this moment everything is putted into the MySQL database. Somebody knows how to get the mail data in the database AND into the log file? My current config: # sources source src { unix-stream("/dev/log"); internal(); }; source kernsrc { file("/proc/kmsg"); }; # destinations destination dmysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host,facility,priority,level,tag, timestamp,program,msg) VALUES ('$HOST','$FACILITY', '$PRIORITY','$LEVEL','$TAG','$UNIXTIME','$PROGRAM', '$MSG');\n") template-escape(yes)); }; destination maillog { file("/var/log/maillog"); }; # logs log { source(src); destination(dmysql); }; log { source(kernsrc); destination(dmysql); }; Thanks! Greetings, Bas Koot.

1 0

Simple question, MySQL & Log file
by Bas Koot 01 May '03

01 May '03

Hi everybody! First of all, i like Syslog-NG ! But i have 1 (simple i think) question about it. For my postfix i need to use the /var/log/maillog file (for the pop-before-smtp feature) but at this moment everything is putted into the MySQL database. Somebody knows how to get the mail data in the database AND into the log file? My current config: # sources source src { unix-stream("/dev/log"); internal(); }; source kernsrc { file("/proc/kmsg"); }; # destinations destination dmysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host,facility,priority,level,tag, timestamp,program,msg) VALUES ('$HOST','$FACILITY', '$PRIORITY','$LEVEL','$TAG','$UNIXTIME','$PROGRAM', '$MSG');\n") template-escape(yes)); }; destination maillog { file("/var/log/maillog"); }; # logs log { source(src); destination(dmysql); }; log { source(kernsrc); destination(dmysql); }; Thanks! Greetings, Bas Koot.

1 0

using flags in log statements
by nate 01 May '03

01 May '03

how would I set a flag, such as "final" in a log statement? I read on this sample config that it can be done but I don't see any examples: http://www.campin.net/syslog-ng/expanded-syslog-ng.conf I tried just putting final; and that didn't work and tried flag(final); that didn't work either. for some reason the mime setup seems to be broken on www.balabit.com when I try to access the documentation it sends me the file with type application/octet-stream which phoenix then prompts to download, I can save it to disk and view it but it's only the table of contents.. not sure if the online docs talk about it or not, the manpage for syslog-ng.conf does not mention flags(freebsd 4.8) thanks nate

1 0

RE: [syslog-ng]FQDN in the destination - FIXED
by Glasser, Rob 01 May '03

01 May '03

Figured it out. Problem was two fold. First problem, the host I was testing with was in my /etc/hosts file with a shortname first, and my nsswitch.conf file was looking there first. Second problem, I had chrooted the environment. When I chrooted the environment all name resolution failed, all I got was IP addresses. After I removed that option I got the short name again, as soon as I commented out the shortname entry in /etc/hosts I got the FQDN. Thanks everyone for their help.

1 0

RE: [syslog-ng]FQDN in the destination
by Glasser, Rob 30 Apr '03

30 Apr '03

I tried that order and it didn't work. I guess I left out some important information before. This is on solaris8, accepting traffic inbound over udp from stock solaris syslogd entries, I don't know if that hoses things up or not. Also I'm running syslog-ng-1.6.0rc3+20030429. In fact, I think the DNS piece is completely hosed, because when I tell it to use dns I start getting $HOST variables set to IP addresses. The only way I can get the shortname back is to turn off all the functions to try and get the hostname and just keep the name sent over with the syslog message. I've tested this from another system running syslog-ng-1.6.0rc3+20030429 sending via UDP and it has the same symptoms, though it at least gets the short name. -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Wednesday, April 30, 2003 3:05 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]FQDN in the destination On Wed, Apr 30, 2003 at 02:24:32PM -0700, Glasser, Rob wrote: > I'm trying to use the fully qualified domain name in my directory naming > structure in a destination function. Here is what I have: I do this: use_fqdn(yes); keep_hostname(yes); use_dns(yes); long_hostnames(off); then.. destination hosts { file( "/var/log/HOSTS/$HOST/$FACILITY/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$D AY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) template("$DATE $FULLHOST $MESSAGE [$FACILITY.$LEVEL]\n") template_escape(no) ); }; log { source(src); destination(hosts); }; Works for me with 1.5.26 on debian woody. -- Nate Campi http://www.campin.net _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

1.6.0rc1 / SunOS 5.8 (Solaris 8) - entries not logged with IP address
by Brian C. Hill 30 Apr '03

30 Apr '03

I am still trying to solve this problem. I have verirified from debugging that there is some disconnect in the values salen and addrlen and between A_RECV(read, closure->max_log_line - closure->pos, closure-> buffer + closure->pos, (abstract_addr *) &sabuf, &salen); in syslog-ng-1.6rc0/src/sources.c and res = recvfrom(closure->fd, buffer, length, 0, (struct sockaddr *) addr, (socklen_t *) addrlen); in libol-0.3.9/src/io.c. salen is set to 256 before and after the A_RECV() is called, but addrlen is set to 0 and sockaddr seems to point to nothing in before recvfrom() is called. As a result recvfrom() simply doesn't record the address information of the sending host. This is on SunOS-5.8-sparc in 64-bit mode with gcc 3.2.1 compiling 64-bit binaries. Anyway, the result is that syslog-ng is unable to record the address of the sending host and winds up prepending all logged messages with it's own hostname, rather than the sending host's. With all of the casting and and abstraction involved in the code, I am not sure what to try next. Any suggestions? Is this a 64-bit problem? Brian

2 6

FQDN in the destination
by Glasser, Rob 30 Apr '03

30 Apr '03

I'm trying to use the fully qualified domain name in my directory naming structure in a destination function. Here is what I have: options { dns_cache(yes); (tried without) chain_hostnames(no); (tried yes as well) keep_hostname(yes); (tried no as well) long_hostnames(off); (tried on) use_dns(yes); (tried without) use_fqdn(yes); }; Then in the destination I've tried: destination network_log { file("/var/log/syslog-ng/$HOST/$FACILITY.$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; and destination network_log { file("/var/log/syslog-ng/$FULLHOST/$FACILITY.$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; Neither seems to create a directory with the fqdn, I always end up with the short name. Am I missing something or does this just not work? Thanks Rob

3 2

Trying to compile with SUN's cc compiler.
by Jay Davis 30 Apr '03

30 Apr '03

Here is the results after running make. I had to change this in the configure file: if test $enable_debug = "yes"; then CFLAGS="-Wall -g" else # CFLAGS="-Wall -O2" CFLAGS="-w -fast" fi -fast is optimzed. -w is supress warnings. The offending line in objbase.h is: #ifdef DEBUG_ALLOC struct ol_string_header { int magic; /* For a sentinel value */ }; #else /* !DEBUG_ALLOC */ struct ol_string_header {}; <--------------Line 67. #endif /* !DEBUG_ALLOC */ My C is a little old. I'll have to crack out my very old Kernigan book. Can you create a null pointer to a struct like that? Is this a picky compiler and should ignore it? I was able to get this compiled using. gcc. I HAVE to get this compiled with the SUN compiler. Yes I am brave. Making all in utils sed -e "s,_SCSH_,," make_class.in >make_class chmod +x make_class Making all in src /bin/sh ../libtool --mode=compile cc -DHAVE_CONFIG_H -I. -I/export/epm/syslog-ng/libol-0.3.9/src -I. -D_GNU_SOURCE -w -fast -c format.c rm -f .libs/format.lo cc -DHAVE_CONFIG_H -I. -I/export/epm/syslog-ng/libol-0.3.9/src -I. -D_GNU_SOURCE -w -fast -c format.c -KPIC -DPIC -o format.o cc: Warning: -xarch=native has been explicitly specified, or implicitly specified by a macro option, -xarch=native on this architecture implies -xarch=v8plusa which generates code that does not run on pre-UltraSPARC processors "./objbase.h", line 67: syntax error before or at: } "./objbase.h", line 73: incomplete struct/union/enum ol_string_header: header "./objbase.h", line 81: cannot recover from previous errors cc: acomp failed for format.c *** Error code 1 make: Fatal error: Command failed for target `format.lo' Current working directory /export/epm/syslog-ng/libol-0.3.9/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' -- Jay Davis Cell: 443-253-0469

2 1

RE: [syslog-ng]Problem with built in variables in syslog-ng
by Glasser, Rob 30 Apr '03

30 Apr '03

Thank you Dan and Achim, upgrading to the rc3 fixed the problem. I guess my test box was still running an older version than rc2, and when I installed the package with rc2 it hosed everything. Rob Glasser desk (425)288-2562; cell (206)915-4327 rob.glasser(a)attws.com / 2069154327(a)mobile.att.net -----Original Message----- From: Dan Edwards [mailto:dme@duda.com] Sent: Tuesday, April 29, 2003 5:32 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Problem with built in variables in syslog-ng I had this problem with RC2, never looked at why just found that snapshot from 4/18 fixed it, surprised it returned in another final build. Dan Edwards Network Specialist A. Duda & Sons, Inc. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Achim Gsell Sent: Tuesday, April 29, 2003 8:18 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Problem with built in variables in syslog-ng On Wednesday 30 April 2003 01:28, Glasser, Rob wrote: > I'm banging my head here and can't figure out for the life of me what > happened. I had everything working, and after packaging up the binaries > into a solaris package and reinstalling via package to test the package, > some of the built in variables do not work. For example I have this > destination statement: > > destination network_log { > file("/var/log/syslog-ng/$HOST/$FACILITY.$YEAR$MONTH$DAY" > owner(root) group(root) perm(0600) dir_perm(0700) > create_dirs(yes) > ); > }; > > Before it worked correctly, I'd end up with a log entry like > /var/log/syslog-ng/hostabc/auth.20030429 > Now I get: /var/log/syslog-ng/.29 This is a known bug in version 1.6.0rc2, update to version 1.6.0rc3. Achim _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Problem with built in variables in syslog-ng
by Glasser, Rob 30 Apr '03

30 Apr '03

I'm banging my head here and can't figure out for the life of me what happened. I had everything working, and after packaging up the binaries into a solaris package and reinstalling via package to test the package, some of the built in variables do not work. For example I have this destination statement: destination network_log { file("/var/log/syslog-ng/$HOST/$FACILITY.$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; Before it worked correctly, I'd end up with a log entry like /var/log/syslog-ng/hostabc/auth.20030429 Now I get: /var/log/syslog-ng/.29 Only the $DAY variable appears to be working, all of the others are resolving to null. When I truss the process I see it trying to access the file like: open("/var/log/syslog-ng//.29", O_WRONLY|O_APPEND|O_NONBLOCK|O_CREAT|O_NOCTTY|O_LARGEFILE, 0600) = 7 I've compared the binaries built when I compilied vs what I have in the package and I don't see any changes. Any input anyone has would be greatly appreciated. BTW I'm running syslog-ng 1.6.0rc2 compiled and installed on Solaris 8 Sparc, Ultra 2 to be exact. Thank you Rob

3 2

Filter question.
by Jay Davis 29 Apr '03

29 Apr '03

If I set up a filter to allow messages from a wide spectrum of systems. (whole subnets) can I block a particular host that is a potential flood device. i.e. allow 10.1.20.* but block 10.1.20.36? -- Jay Davis Cell: 443-253-0469

2 1

1.6.0rc3 released
by Balazs Scheidler 29 Apr '03

29 Apr '03

Hi, I have released 1.6.0rc3 which should resolve the macro issue in 1.6.0rc2 I still have a backlog of applying patches, I hope to get them integrated by the final 1.6.0 version. Here is the NEWS entry: News for the 1.6.0rc3 release Fri, 25 Apr 2003 08:56:57 +0200 * fixed TCP wrapper detection for Solaris * fixed macro expansion which had a bug in 1.6.0rc2 -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 2

RE: [syslog-ng]Filter question.
by Hamilton, Andrew 29 Apr '03

29 Apr '03

You can use tcpwrappers to do this. Compile syslog-ng with tcpwrappers turned on and in your hosts.allow file put your network address, then add your chatter box to hosts.deny. Regards, Drew -----Original Message----- From: Jay Davis [mailto:jay_davis@fanniemae.com] Sent: Monday, April 28, 2003 11:01 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Filter question. If I set up a filter to allow messages from a wide spectrum of systems. (whole subnets) can I block a particular host that is a potential flood device. i.e. allow 10.1.20.* but block 10.1.20.36? -- Jay Davis Cell: 443-253-0469 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Double timestamps cause DB issue
by Robin Brown 26 Apr '03

26 Apr '03

Hello, Running syslog-ng version 1.5.26 on Solaris 8. All is working well, except now I want to log to a MySQL database. I can also get that to work, the problem is the double time stamp in the syslog entry. When it gets put in the database the second timestamp ends up in the program field instead of the actual program. Looking thru the archives, I can find reference to the template macros, but there only appears to be one MSG macro available. Below is a sample log line: Apr 25 11:40:36 mydevice.mydomain.com Apr 25 2003 11:13:09: %PIX-4-106023: Deny tcp src inside:111.222.333.444/1343 dst outside:555.999.777.888/80 by access-group "outbound" And my database definition from syslog-ng.conf: destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date,time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG','$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; And a sample from the database: host,facility,priority,level,tag,date,time,program,msg,seq mydevice.mydomain.com,local5,warning,warning,ac,2003-04-25,10:26:14,Apr, Apr 25 2003 09:58:46: %PIX-4-106023: Deny tcp src inside:192.168.176.204/3954 dst outside:216.23.181.206/80 by access-group "outbound",1 "Apr" is put in the program field and the message plus the second timestamp is added to the msg filed. Any suggestions appreciated. Regards, Robin

3 7

Compiling with something other than GCC
by Jay Davis 25 Apr '03

25 Apr '03

Are there any issues with using something besided gcc for the build of syslog-ng. Has anyone else done this. I have had a couple of responses (sugestions) but am wondering if anyone has actually tried it.

2 1

AW: [syslog-ng]Filter for currupt syslog-messages?
by Meinecke, Sebastian 24 Apr '03

24 Apr '03

At first: thanks for your quick help! I downloaded the new Version 1.6.0rc2 of syslog-ng and installed it as usual. The problem now is, that macros don´t work. Variables like $HOST $FACILITY etc. are null, although there hadn´t been any errors during compling and installing. I´m using the config-file that properly worked under the 1.5.24-version. Destinations like destination d_mysql_pipe { pipe("/logs/mysql.pipe" template("INSERT INTO logs (host, facility, priority, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM','$MSG' );\n") template-escape(yes)); }; produce SQL-statements like INSERT INTO logs (host, facility, priority, date, time, program, msg) VALUES ( '', '', '', '--', '::', '','' ); I didn´t find any notices about changes in the config-file-syntax that could produce such stuff... or maybe I only fooled myself ;-) again: thanks in advance, Sebastian On Thu, Apr 24, 2003 at 04:18:45PM +0200, Meinecke, Sebastian wrote: > Hello everyone, > > I´ve set up a Linux box with syslog-ng 1.5.24 running. It is configured, > that it puts all syslog-messages from other Unix hosts in the network via > the "template" > function as a SQL-Statement into a pipe. This pipe is read by a mysql-Client > that writes everything into the MySQL-database. > > > Everything works fine, until I try to stress the system using a tool, that > sends corrupt syslog-messages to the Syslog-ng-Server. The result is, that > these "corrupt" messages > are not written into the database (that´s OK; I don´t want them there...). > But the problem is that syslog-messages arriving a little time before or > after the > corrupt ones will also not be put into the database, because the fragments > of the corrupt SQL-statements that are built out of the corrupt messages > also damage the "good ones". > > > So my question: Is there any possibility to filter messages that are corrupt > or don´t match RFC 3164 via the "filter"-function of syslog-ng? > Or does anybody of you know a different solution? there were some line reassembling problems in earlier 1.5.x versions. you might try to upgrade first and check whether that version also has some problems. (the latest snapshots of 1.6.0rc2 should be ok) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1