- syslog-ng - lists.balabit.hu

Filter for currupt syslog-messages?
by Meinecke, Sebastian 24 Apr '03

24 Apr '03

Hello everyone, I´ve set up a Linux box with syslog-ng 1.5.24 running. It is configured, that it puts all syslog-messages from other Unix hosts in the network via the "template" function as a SQL-Statement into a pipe. This pipe is read by a mysql-Client that writes everything into the MySQL-database. Everything works fine, until I try to stress the system using a tool, that sends corrupt syslog-messages to the Syslog-ng-Server. The result is, that these "corrupt" messages are not written into the database (that´s OK; I don´t want them there...). But the problem is that syslog-messages arriving a little time before or after the corrupt ones will also not be put into the database, because the fragments of the corrupt SQL-statements that are built out of the corrupt messages also damage the "good ones". So my question: Is there any possibility to filter messages that are corrupt or don´t match RFC 3164 via the "filter"-function of syslog-ng? Or does anybody of you know a different solution? Much thanks in advance, Sebastian Meinecke

2 1

logrotate
by Mark Ultor 24 Apr '03

24 Apr '03

Hi all, I'm just wondering why I have to restart syslog-ng after logrotate ? If I can do echo -n > /var/log/messages and everything works fine then why logrotate can not do it ? I believe that if I restart syslog-ng there is potential risk of loosing one line of logs, when syslog-ng is down. I assume it is better not to restart it then. Am I thinking correct or not ? Thank you. M.

1 0

extra escape sequences
by SUGIMURA Takashi 杉村貴士 24 Apr '03

24 Apr '03

Hello all developers, I've been using your syslog-ng for including our software package of log management system. I'm trying its version 1.6.0rc1 and libol-0.3.9, and I'll also try the newest version later. I found that syslog-ng can not handle some characters well when the syslog-ng receives logs by tcp. I tested this problem only by tcp, but I think that other sources might cause this problem. I send the log message by tcp the follows: ----- 192.168.254.111 - - [22/Apr/2003:14:30:30 +0900] "GET /~sugimura/ HTTP/1.0" 200 3448 "-" "-" ----- You know, this log was created by apache. When syslog-ng receives this log, it writes down with extra escape sequences as the follows: ----- 192.168.254.111 - - [22/Apr/2003:14:30:30 +0900] \"GET /~sugimura/ HTTP/1.0\" 200 3448 \"-\" \"-\" ----- I think syslog-ng can not handle these kind of characters which defined by C language strings, which are ', ", \, and so on. Would you please check and fix this problem? Thanks in advance, --- SUGIMURA Takashi <sugimura(a)infoscience.co.jp>

2 2

Performance Tests
by Jack Krolen 23 Apr '03

23 Apr '03

I downloaded and installed syslog-ng.1.5.26 and then I read some problems with performance. Now say I use syslog-ng on my logging server. And all my production servers use syslogd. Now am I to understand that since syslogd uses UDP that there is going to be a considerable loss in message transfer ? Second of all since syslog-ng seems to have some problems is syslogd more reliable for this ? _________________________________________________________________ Add photos to your messages with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

2 1

Bug in syslog-ng or stunnel?
by neonman＠7of1.mine.nu 23 Apr '03

23 Apr '03

Hello everyone, ive just set up a syslog-ng remote logging server that logs through stunnel with theese rules: destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY/$FACILITY" owner(root) group(wheel) perm(0600) dir_perm(0700) create_dirs(yes)); }; source recieved { tcp(ip("127.0.0.1") port(515) keep-alive(yes)); }; log { source(recieved); destination(hosts); }; The logging works, but the logs is put into "/var/log/hosts/---/$FACILITY", _NOT_ into "/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY/$FACILITY" Am i doing something wrong? I just upgraded both stunnel and syslog-ng to the lastest version, before that everything worked fine, but now its fucked up.. thanks / neon

2 2

RE: [syslog-ng]$HOST directories
by Hamilton, Andrew 22 Apr '03

22 Apr '03

I probably should have just said a current snapshot. Drew -----Original Message----- From: Jeremy Jones [mailto:jeremy@samnjack.com] Sent: Tuesday, April 22, 2003 4:09 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]$HOST directories Hello all yalls, I've been beating my head against a wall for a couple hours here, but have yet to figure out how to get syslog-ng to create my $HOST directories, or to even use them when I create them manually. When a remote host sends it's syslog messages, they just end up in /var/log/netlog/whatever.log. There's no indication anywhere else in my logs about improper permissions or anything of that sort. I'm trying to use version 1.6.0rc2 and libol-0.3.10. If it's at all interesting, "uname -a" tells me: Linux <my-secret-hostname> 2.4.20 #1 Wed Mar 26 11:34:49 MST 2003 i686 unknown I've gone round and round with all the various dns/hostname related options, to no avail. Anyone have any Great Ideas? Here's some snippets from my syslog-ng.conf file: options { sync(0); time_reopen(10); log_fifo_size(100); keep_hostname (yes); dns_cache (yes); long_hostnames (yes); use_dns (yes); use_fqdn (yes); chain_hostnames (no); create_dirs (yes); owner (root); group (root); stats (600); perm (0660); dir_owner (root); dir_group (root); dir_perm (0770); use_time_recvd (yes); }; <snip> source net { tcp(); udp(); }; destination net_authlog { file("/var/log/netlog/$HOST/auth.log"); }; destination net_userlog { file("/var/log/netlog/$HOST/user.log"); }; destination net_bootlog { file("/var/log/netlog/$HOST/boot.log"); }; destination net_errorlog { file("/var/log/netlog/$HOST/errors.log"); }; destination net_cronlog { file("/var/log/netlog/$HOST/cron.log"); }; destination net_kernlog { file("/var/log/netlog/$HOST/kern.log"); }; destination net_maillog { file("/var/log/netlog/$HOST/mail.log"); }; destination net_messages { file("/var/log/netlog/$HOST/messages"); }; destination net_daemonlog { file("/var/log/netlog/$HOST/daemon.log"); }; destination net_wwwacclog { file("/var/log/netlog/data/www/LOGS/$YEAR/$MONTH/www.access.log.$YEAR.$MONTH .$DAY");}; destination net_wwwerrlog { file("/var/log/netlog/data/www/LOGS/$YEAR/$MONTH/www.errors.log.$YEAR.$MONTH .$DAY");}; log { source(net); filter(f_authpriv); destination(net_authlog); }; log { source(net); filter(f_user); destination(net_userlog); }; log { source(net); filter(f_boot); destination(net_bootlog); }; log { source(net); filter(f_err); destination(net_errorlog); }; log { source(net); filter(f_cron); destination(net_cronlog); }; log { source(net); filter(f_kern); destination(net_kernlog); }; log { source(net); filter(f_mail); destination(net_maillog); }; log { source(net); filter(f_daemon); destination(net_daemonlog); }; log { source(net); filter(f_messages); destination(net_messages); }; log { source(net); filter(f_www); filter(f_info); destination(net_wwwacclog); }; log { source(net); filter(f_www); filter(f_err); destination(net_wwwerrlog); }; Thanks a million Jeremy <please send inspectors to my country... i think we may have weapons of mass destruciton> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]$HOST directories
by Hamilton, Andrew 22 Apr '03

22 Apr '03

With 1.6.0rc2 you have to have a snapshot beyond 4/18. Do that and it works great. Regards, Drew -----Original Message----- From: Jeremy Jones [mailto:jeremy@samnjack.com] Sent: Tuesday, April 22, 2003 4:09 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]$HOST directories Hello all yalls, I've been beating my head against a wall for a couple hours here, but have yet to figure out how to get syslog-ng to create my $HOST directories, or to even use them when I create them manually. When a remote host sends it's syslog messages, they just end up in /var/log/netlog/whatever.log. There's no indication anywhere else in my logs about improper permissions or anything of that sort. I'm trying to use version 1.6.0rc2 and libol-0.3.10. If it's at all interesting, "uname -a" tells me: Linux <my-secret-hostname> 2.4.20 #1 Wed Mar 26 11:34:49 MST 2003 i686 unknown I've gone round and round with all the various dns/hostname related options, to no avail. Anyone have any Great Ideas? Here's some snippets from my syslog-ng.conf file: options { sync(0); time_reopen(10); log_fifo_size(100); keep_hostname (yes); dns_cache (yes); long_hostnames (yes); use_dns (yes); use_fqdn (yes); chain_hostnames (no); create_dirs (yes); owner (root); group (root); stats (600); perm (0660); dir_owner (root); dir_group (root); dir_perm (0770); use_time_recvd (yes); }; <snip> source net { tcp(); udp(); }; destination net_authlog { file("/var/log/netlog/$HOST/auth.log"); }; destination net_userlog { file("/var/log/netlog/$HOST/user.log"); }; destination net_bootlog { file("/var/log/netlog/$HOST/boot.log"); }; destination net_errorlog { file("/var/log/netlog/$HOST/errors.log"); }; destination net_cronlog { file("/var/log/netlog/$HOST/cron.log"); }; destination net_kernlog { file("/var/log/netlog/$HOST/kern.log"); }; destination net_maillog { file("/var/log/netlog/$HOST/mail.log"); }; destination net_messages { file("/var/log/netlog/$HOST/messages"); }; destination net_daemonlog { file("/var/log/netlog/$HOST/daemon.log"); }; destination net_wwwacclog { file("/var/log/netlog/data/www/LOGS/$YEAR/$MONTH/www.access.log.$YEAR.$MONTH .$DAY");}; destination net_wwwerrlog { file("/var/log/netlog/data/www/LOGS/$YEAR/$MONTH/www.errors.log.$YEAR.$MONTH .$DAY");}; log { source(net); filter(f_authpriv); destination(net_authlog); }; log { source(net); filter(f_user); destination(net_userlog); }; log { source(net); filter(f_boot); destination(net_bootlog); }; log { source(net); filter(f_err); destination(net_errorlog); }; log { source(net); filter(f_cron); destination(net_cronlog); }; log { source(net); filter(f_kern); destination(net_kernlog); }; log { source(net); filter(f_mail); destination(net_maillog); }; log { source(net); filter(f_daemon); destination(net_daemonlog); }; log { source(net); filter(f_messages); destination(net_messages); }; log { source(net); filter(f_www); filter(f_info); destination(net_wwwacclog); }; log { source(net); filter(f_www); filter(f_err); destination(net_wwwerrlog); }; Thanks a million Jeremy <please send inspectors to my country... i think we may have weapons of mass destruciton> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

$HOST directories
by Jeremy Jones 22 Apr '03

22 Apr '03

Hello all yalls, I've been beating my head against a wall for a couple hours here, but have yet to figure out how to get syslog-ng to create my $HOST directories, or to even use them when I create them manually. When a remote host sends it's syslog messages, they just end up in /var/log/netlog/whatever.log. There's no indication anywhere else in my logs about improper permissions or anything of that sort. I'm trying to use version 1.6.0rc2 and libol-0.3.10. If it's at all interesting, "uname -a" tells me: Linux <my-secret-hostname> 2.4.20 #1 Wed Mar 26 11:34:49 MST 2003 i686 unknown I've gone round and round with all the various dns/hostname related options, to no avail. Anyone have any Great Ideas? Here's some snippets from my syslog-ng.conf file: options { sync(0); time_reopen(10); log_fifo_size(100); keep_hostname (yes); dns_cache (yes); long_hostnames (yes); use_dns (yes); use_fqdn (yes); chain_hostnames (no); create_dirs (yes); owner (root); group (root); stats (600); perm (0660); dir_owner (root); dir_group (root); dir_perm (0770); use_time_recvd (yes); }; <snip> source net { tcp(); udp(); }; destination net_authlog { file("/var/log/netlog/$HOST/auth.log"); }; destination net_userlog { file("/var/log/netlog/$HOST/user.log"); }; destination net_bootlog { file("/var/log/netlog/$HOST/boot.log"); }; destination net_errorlog { file("/var/log/netlog/$HOST/errors.log"); }; destination net_cronlog { file("/var/log/netlog/$HOST/cron.log"); }; destination net_kernlog { file("/var/log/netlog/$HOST/kern.log"); }; destination net_maillog { file("/var/log/netlog/$HOST/mail.log"); }; destination net_messages { file("/var/log/netlog/$HOST/messages"); }; destination net_daemonlog { file("/var/log/netlog/$HOST/daemon.log"); }; destination net_wwwacclog { file("/var/log/netlog/data/www/LOGS/$YEAR/$MONTH/www.access.log.$YEAR.$MONTH.$DAY");}; destination net_wwwerrlog { file("/var/log/netlog/data/www/LOGS/$YEAR/$MONTH/www.errors.log.$YEAR.$MONTH.$DAY");}; log { source(net); filter(f_authpriv); destination(net_authlog); }; log { source(net); filter(f_user); destination(net_userlog); }; log { source(net); filter(f_boot); destination(net_bootlog); }; log { source(net); filter(f_err); destination(net_errorlog); }; log { source(net); filter(f_cron); destination(net_cronlog); }; log { source(net); filter(f_kern); destination(net_kernlog); }; log { source(net); filter(f_mail); destination(net_maillog); }; log { source(net); filter(f_daemon); destination(net_daemonlog); }; log { source(net); filter(f_messages); destination(net_messages); }; log { source(net); filter(f_www); filter(f_info); destination(net_wwwacclog); }; log { source(net); filter(f_www); filter(f_err); destination(net_wwwerrlog); }; Thanks a million Jeremy <please send inspectors to my country... i think we may have weapons of mass destruciton>

1 0

1.6rc2 build problem
by Aaron Jackson 22 Apr '03

22 Apr '03

I just got finished building 1.6rc2 on a Solaris 8 system with gcc 3.2.2. The problem I ran into was that the build stopped with the following error: Undefined first referenced symbol in file yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /export/home/jackson/syslog-ng-1.6.0rc2/src As it turns out, I just installed gcc3.2.2 on /usr/local. The problem is that the freeware packages Sun distributes with Solaris install on /opt/sfw. Therefore the gcc just I installed does not look in /opt/swf/lib by default. I just edited LDFLAGS (-L/opt/sfw) LIBS (-lfl) in src/Makefile and everything compiled file. Looking into config.cache I see that configure couldn't find libfl (ac_cv_lib_fl_yywrap=${ac_cv_lib_fl_yywrap='no'}). It would seem that if libfl is required in order to build syslog-ng, that either the build process should stop if it is not found, or you should be able to give it as an option to configure. Of course, this is only a problem if flex is not installed in gcc's default search path. This is a minor nit, but I thought I would mention it. Aaron

2 1

10x
by nikola somlev 22 Apr '03

22 Apr '03

Hi, I had the "non-working macro" problem with 1.6.rc2. Then I searched the list atchive and found the solution, proposed by Dan Edwards - upgrade to 4/18 snapshot. I seems to work fine now. 10x __________________________________________________ Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo http://search.yahoo.com

1 0

Re: [syslog-ng]Iptables logging
by Ted_Rule＠flextech.co.uk 22 Apr '03

22 Apr '03

Better still, you can use iptables' log-prefix option to make it easier for syslog-ng to regex match iptables entries. Something like: iptables -t filter -N droplog iptables -t filter -A droplog -j LOG --log-prefix "iptables: warning: DROP: " --log-level warning iptables -t filter -A droplog -j DROP And then in syslog-ng.conf: filter iptables { match("^iptables: "); }; or similar should work I believe. This assumes fine grained total control over all the syslogging iptables entities of course - if you're just capturing logs from Smoothwall or some other embedded Linux product you may not be quite so lucky. Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

RE: [syslog-ng]permission denied on syslog-ng
by Nica Smith 22 Apr '03

22 Apr '03

this is wat i received after running sh -x /etc/init.d/syslog-ng start [root@netengeng root]# sh -x /etc/init.d/syslog-ng start + INIT_PROG=syslog-ng + . /etc/rc.d/init.d/functions ++ TEXTDOMAIN=initscripts ++ TEXTDOMAINDIR=/etc/locale ++ umask 022 ++ PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin ++ export PATH ++ '[' -z '' ']' ++ COLUMNS=80 ++ '[' -z '' ']' +++ /sbin/consoletype ++ CONSOLETYPE=pty ++ '[' -f /etc/sysconfig/i18n -a -z '' ']' ++ . /etc/sysconfig/i18n +++ LANG=en_US.UTF-8 +++ SUPPORTED=en_US.UTF-8:en_US:en +++ SYSFONT=latarcyrheb-sun16 ++ '[' pty '!=' pty ']' ++ export LANG ++ '[' -z '' ']' ++ '[' -f /etc/sysconfig/init ']' ++ . /etc/sysconfig/init +++ BOOTUP=color +++ RES_COL=60 +++ MOVE_TO_COL=echo -en \033[60G +++ SETCOLOR_SUCCESS=echo -en \033[0;32m +++ SETCOLOR_FAILURE=echo -en \033[0;31m +++ SETCOLOR_WARNING=echo -en \033[0;33m +++ SETCOLOR_NORMAL=echo -en \033[0;39m +++ LOGLEVEL=3 +++ PROMPT=yes ++ '[' pty = serial ']' ++ '[' color '!=' verbose ']' ++ INITLOG_ARGS=-q + SYSLOGNG_PATH=:/usr/local/sbin + PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin:/usr/local/sbin + export PATH + '[' -f /etc/sysconfig/syslog-ng ']' + SYSLOGNG_OPTIONS= + RETVAL=0 + umask 077 + ulimit -c 0 + start + echo -n 'Starting syslog-ng: ' Starting syslog-ng: + daemon syslog-ng + local gotbase= force= + local base= user= nice= bg= pid= + nicelevel=0 + '[' syslog-ng '!=' syslog-ng ']' + '[' -z '' ']' + base=syslog-ng + '[' -f /var/run/syslog-ng.pid ']' + '[' -n '' -a -z '' ']' + ulimit -S -c 0 + '[' color = verbose -a -z '' ']' + '[' -z '' ']' + initlog -q -c syslog-ng + '[' 0 -eq 0 ']' + success 'syslog-ng startup' + '[' -z '' ']' + initlog -q -n /etc/init.d/syslog-ng -s 'syslog-ng startup' -e 1 + '[' color '!=' verbose -a -z '' ']' + echo_success + '[' color = color ']' + echo -en '\033[60G' + echo -n '[ ' [ + '[' color = color ']' + echo -en '\033[0;32m' + echo -n OK OK+ '[' color = color ']' + echo -en '\033[0;39m' + echo -n ' ]' ]+ echo -ne '\r' + return 0 + return 0 + RETVAL=0 + echo + '[' 0 -eq 0 ']' + touch /var/lock/subsys/syslog-ng + return 0 + exit 0 when i tried to do /etc/init.d/syslog-ng start, i received this error message.. [root@netengeng root]# /etc/init.d/syslog-ng start -bash: /etc/init.d/syslog-ng: Permission denied [root@netengeng ~]# /etc/init.d/syslog-ng start /etc/init.d/syslog-ng: Permission denied. thank you. - wander. -- On Tue, 15 Apr 2003 13:57:29 Clausing, James A (Jim), SOLCM wrote: > > As root run > ># sh -x /etc/init.d/syslog-ng start > > This will show the script executing. Respond back to the list >and let us know where in the script the error is being generated (the >last few lines with '+' in front of them). Then also give us the >complete error message. We don't have enough info to troubleshoot this. > >-----Original Message----- >From: Nica Smith [mailto:wanderlust27@lycos.com] >Sent: Tuesday, April 15, 2003 04:30 >To: syslog-ng(a)lists.balabit.hu >Subject: [syslog-ng]permission denied on syslog-ng > > >my syslog-ng.conf is located at >usr/local/etc/syslog-ng/syslog-ng.conf > >then i copied init.d.RedHat-7.3 /etc/init.d (from contrib) to >/etc/init.d/syslog-ng > >when i do /etc/init.d/syslog-ng start, i received an error "permission >denied". > >what did i miss? need ur help. tnx. > > >- wander > > >____________________________________________________________ >Get advanced SPAM filtering on Webmail or POP Mail ... Get Lycos Mail! >http://login.mail.lycos.com/r/referral?aid=27005 >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > ____________________________________________________________ Get advanced SPAM filtering on Webmail or POP Mail ... Get Lycos Mail! http://login.mail.lycos.com/r/referral?aid=27005

2 1

Lost information now with 1.6.0rc2
by Wayne Sweatt 21 Apr '03

21 Apr '03

Dear Balabit, New Problem today: >:>(( I am no longer getting any information, such as $FULLHOST, $FACILITY,$MONTH, etc when using templates that worked fine with 1.6.0rc1. Now my $HOST = "-", and the other values are null. It is logging, but to the newly created "-" directory ( I was previously logging to $HOST/$MONTH-$YEAR) I could not download 1.6.0rc1 now - it has been removed from the Balabit site, so I installed 1.5.26, and now the information is being parsed just fine, again. What is the change in rc2 that clobbered the values returned from the templates? Can you fix this please? Can I get rc1 again? Sorry, but I'm getting very wary of this product, as it does not seem to have been tested under Solaris 8. Is this true? Here's the OS and software configurations of note: Solaris 8, with latest recommended patch cluster. Libol 0.3.9 Wayne Sweatt UNIX System Administrator Comforce Technical Services LANL SCC Team

2 1

Re: [syslog-ng]Solaris 8 configure errors with libol version & tcp_wrappers
by Wayne Sweatt 21 Apr '03

21 Apr '03

Dear Balasz, I have upgraded to the most current relase - 1.6.0rc2, and the problems with detecting the libol version were resolved. Thank you. I still have the problem of getting syslog-ng to compile with tcp_wrappers/libwrap though. I would like to get a response on this problem so I can move on with further testing of syslog-ng. Part of the draw to this product was it's ability to compile with libwrap. Support issues: I am reposting my previous post, since I could not find out what the method was for replying to posts and I did not get an email reponse - I had to go to the archive to view the response that was posted by Balasz. What is the mechanism for responding to posts? Can you please help me resolve this issue? I need to know if this can be resolved before I abandon this "open" code and move on to a more supported product. I am also interested if we can purchase support to increase the level of support for syslog-ng. Here is the original post of the tcp_wrappers problem (see #2-4 below): > I had previously installed syslog-ng .1.6.0rc1 on RH8 Linux just fine. > Now I have to get it running on a Solaris 8/Sun Blade 100. > Here's the OS and software configurations of note: > > Solaris 8, with latest recommended patch cluster. > Tcp_Wrappers 7.6 > libol 0.3.9 > > GNU software: > gcc 3.2.2 > flex 2.5.4a > bison 1.875 > autoconf 2.57 > automake 1.7.2 > make 3.80 > glib 1.2.10 > > The problems are all related to "errors" within the configure file: > ( I am using the command: "./configure --enable-tcp-wrapper") 1. (Resolved libol issue) > 2. It didn't find libwrap.h. I relocated it to /usr/local/include and > /usr/include, and then it found it. > 3. It returns: "checking for hosts_access in -lwrap. no" Beats me - > it's in there just like it's been for years - by default. > Wrappers are working just fine for everything else. I also compiled > wrappers with "STYLE = -DPROCESS_OPTIONS" > 4. It returns "checking whether to enable TCP wrapper support. no" > > Subsequently, I do not compile with lwrap. UNIX System Administrator Comforce Technical Services LANL SCC Team

1 0

Iptables logging
by Jonathan Galand 20 Apr '03

20 Apr '03

Hi all, i would like to have some iptables logs but only in a specific file ( /var/log/iptables.log in my config ). how can I do that ?? here's my config : options { long_hostnames(off); sync(0); stats(43200); }; source src { unix-stream("/dev/log"); file("/proc/kmsg"); internal(); }; destination authlog { file ("/var/log/auth.log"); }; destination syslog { file ("/var/log/syslog"); }; destination cron { file ("/var/log/cron.log"); }; destination daemon { file ("/var/log/daemon.log"); }; destination kern { file ("/var/log/kern.log"); }; destination lpr { file ("/var/log/lpr.log"); }; destination user { file ("/var/log/user.log"); }; destination uucp { file ("/var/log/uucp.log"); }; destination ppp { file ("/var/log/ppp.log"); }; destination mail { file ("/var/log/mail.log"); }; destination mailinfo { file ("/var/log/mail.info"); }; destination mailwarn { file ("/var/log/mail.warn"); }; destination mailerr { file ("/var/log/mail.err"); }; destination newscrit { file ("/var/log/news/news.crit"); }; destination newserr { file ("/var/log/news/news.err"); }; destination newsnotice { file ("/var/log/news/news.notice"); }; destination debug { file ("/var/log/debug"); }; destination messages { file ("/var/log/messages"); }; destination console_all { file("/dev/tty12"); }; destination iptables { file("/var/log/iptables.log"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_iptables { match("Alert!"); }; log { source (src); filter (f_authpriv); destination (authlog); }; log { source (src); filter (f_syslog); destination (syslog); }; log { source (src); filter (f_cron); destination (cron); }; log { source (src); filter (f_daemon); destination (daemon); }; log { source (src); filter (f_kern); destination (kern); }; log { source (src); filter (f_lpr); destination (lpr); }; log { source (src); filter (f_mail); destination (mail); }; log { source (src); filter (f_user); destination (user); }; log { source (src); filter (f_uucp); destination (uucp); }; log { source (src); filter (f_mail); filter (f_info); destination (mailinfo); }; log { source (src); filter (f_mail); filter (f_warn); destination (mailwarn); }; log { source (src); filter (f_mail); filter (f_err); destination (mailerr); }; log { source (src); filter (f_news); filter (f_crit); destination (newscrit); }; log { source (src); filter (f_news); filter (f_err); destination (newserr); }; log { source (src); filter (f_news); filter (f_notice); destination (newsnotice); }; log { source (src); filter (f_debug); destination (debug); }; log { source (src); filter (f_messages); destination (messages); }; log { source (src); filter (f_emergency); destination (console_all); }; log { source (src); filter (f_iptables); destination (iptables); }; -- Don't Fear The Penguins They Will Free Your Computer.

2 1

Problem with Match()
by Dan Edwards 18 Apr '03

18 Apr '03

When attempting to use the match(".asx") in my filter it is returning anything with "asx". I only need to return those lines with the period before the asx, hence a file extension. For some reason syslog-ng seems to ignore my specification of the . before the asx. I have tried searching with ..asx and \.asx and /.asx but doesn't seem to work no matter what I do. Any suggestions? Dan Edwards Network Specialist A. Duda & Sons, Inc.

2 1

syslog-ng: contrib file patch
by Jose Pedro Oliveira 18 Apr '03

18 Apr '03

Balazs Scheidler, Attached to this message is a patch that corrects the syslog-ng configuration file for Red Hat systems available in the contrib directory. It also creates two new files in the contrib directory: 1 - syslog-ng.sysconfig.RedHat (file to be copied to /etc/sysconfig/syslog-ng) 2 - syslog-ng.logrotate.RedHat (file to be copied to /etc/logrotate.d/syslog-ng) Regards, jpo -- José Pedro Oliveira mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo diff -ruN syslog-ng-1.6.0rc2+20030418manual-original/contrib/syslog-ng.conf.RedHat syslog-ng-1.6.0rc2+20030418manual-modified/contrib/syslog-ng.conf.RedHat --- syslog-ng-1.6.0rc2+20030418manual-original/contrib/syslog-ng.conf.RedHat Thu Aug 22 15:05:39 2002 +++ syslog-ng-1.6.0rc2+20030418manual-modified/contrib/syslog-ng.conf.RedHat Fri Apr 18 19:48:52 2003 @@ -15,6 +15,11 @@ # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 22 Aug 2002 # - use the log_prefix option as per Balazs Scheidler's email # +# Updated by Jose Pedro Oliveira (<jpo(a)di.uminho.pt>) - 05 Apr 2003 +# - corrected filters f_filter2 and f_filter6 +# these filters were only logging messages from one priority +# level and not messages with priorities greater or equal +# options { sync (0); time_reopen (10); @@ -38,14 +43,13 @@ destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; -filter f_filter2 { level(info) and - not (facility(mail) - or facility(authpriv) or facility(cron)); }; +filter f_filter2 { level(info..emerg) and + not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or - (facility(news) and level(crit)); }; + (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; diff -ruN syslog-ng-1.6.0rc2+20030418manual-original/contrib/syslog-ng.logrotate.RedHat syslog-ng-1.6.0rc2+20030418manual-modified/contrib/syslog-ng.logrotate.RedHat --- syslog-ng-1.6.0rc2+20030418manual-original/contrib/syslog-ng.logrotate.RedHat Thu Jan 1 01:00:00 1970 +++ syslog-ng-1.6.0rc2+20030418manual-modified/contrib/syslog-ng.logrotate.RedHat Fri Apr 18 19:48:52 2003 @@ -0,0 +1,6 @@ +/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron { + sharedscripts + postrotate + /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true + endscript +} diff -ruN syslog-ng-1.6.0rc2+20030418manual-original/contrib/syslog-ng.sysconfig.RedHat syslog-ng-1.6.0rc2+20030418manual-modified/contrib/syslog-ng.sysconfig.RedHat --- syslog-ng-1.6.0rc2+20030418manual-original/contrib/syslog-ng.sysconfig.RedHat Thu Jan 1 01:00:00 1970 +++ syslog-ng-1.6.0rc2+20030418manual-modified/contrib/syslog-ng.sysconfig.RedHat Fri Apr 18 19:48:52 2003 @@ -0,0 +1,15 @@ +#---------------------------------------------------------------------- +# Options +#---------------------------------------------------------------------- +# -C - <chroot-dir> +# -d - Set "debug mode". Prints out various messages to aid in +# debugging and stops it from becoming a daemon. To activate +# debugging in the yacc parser, either use this option twice or +# combine with -v. +# -p - <filename> Write the current PID information to the specified +# file. +# -v - Enable verbose mode. Process will not become a daemon. Prints +# out fewer messages, compared to -d. +# -V - Print the version number. +#---------------------------------------------------------------------- +SYSLOGNG_OPTIONS=""

1 0

syslog-ng: doc/sgml/syslog-ng.sgml patch
by Jose Pedro Oliveira 18 Apr '03

18 Apr '03

Balazs Scheidler, Attached to this message is a small patch to correct the caption of a table in the main documentation file. Patch against the latest snapshot. Regards, jpo -- José Pedro Oliveira mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo

1 0

libol: specfile patch
by Jose Pedro Oliveira 18 Apr '03

18 Apr '03

Balazs Scheidler, Attached to this message is a patch to the file libol.spec.in included in the latest snapshot. Changelog: * A file wasn't being packaged - /usr/bin/make_class This missing file broke the building process in RH9 systems, but it caused no problems in previous releases (7.3, and 8.0). Regards, jpo -- José Pedro Oliveira mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo diff -ru libol-0.3.10+20030418manual-original/libol.spec.in libol-0.3.10+20030418manual-modified/libol.spec.in --- libol-0.3.10+20030418manual-original/libol.spec.in Thu Apr 10 15:55:26 2003 +++ libol-0.3.10+20030418manual-modified/libol.spec.in Fri Apr 18 19:36:42 2003 @@ -44,6 +44,7 @@ %files %defattr(-,root,root) %doc ChangeLog +%{_bindir}/make_class %{_bindir}/libol-config %{_libdir}/libol.so %{_libdir}/libol.so.0 @@ -57,6 +58,9 @@ %changelog +* Tue Apr 15 2003 Jose Pedro Oliveira <jpo(a)di.uminho.pt> +- included missing file: /usr/bin/make_class (caused problems in RH9) + * Thu Apr 10 2003 Jose Pedro Oliveira <jpo(a)di.uminho.pt> - specfile reformated - replaced hard coded values by RPM macros

1 0

RE: [syslog-ng]Issue with Macros & 1.6.0rc2
by Dan Edwards 18 Apr '03

18 Apr '03

Apparently it was an issue with the stable rc2 release. I upgraded to the latest snapshot today "syslog-ng-1.6.0rc2+20030418manual.tar.gz" and it works great. Dan Edwards Network Specialist A. Duda & Sons, Inc. -----Original Message----- From: Peter Österberg [mailto:Peter_Osterberg@home.se] Sent: Friday, April 18, 2003 3:42 AM To: dme(a)duda.com Subject: Re: [syslog-ng]Issue with Macros & 1.6.0rc2 You describe the same problem as the one I wrote about yesterday. Please let me know if you come up with something. Thanks in advance Sincerely Peter At 18:02 2003-04-17 -0400, you wrote: >I am having some strange problems that I can not seem to resolve with >syslog-ng and macro use. I am sure it is simple and I am just over >looking it. When I try and use the $YEAR, $MONTH, $DAY, $FACILITY, $LEVEL >and several other macros nothing is outputted. Example: > >destination d_cisco { file("/var/log/cisco-$YEAR.$MONTH.$DAY.log"); } > >The file that it creates is: > >/var/log/cisco-&log > >This holds true for usage of template command in the file call. If I >format it with those macros a blank space is all that is entered. If I >put a \non the end of the last macro it erases all the output for the line >and makes the entire line blank. Example: > >destination d_cisco { file("/var/log/cisco.log" template($YEAR-$MONTH-$DAY >$LEVEL $MSG\n)); } > >The output is > > > >If I do not put the \n on the end only the MSG macro will output. Any >input is greatly appreciated. > >Debian 3.0r1 >Syslog-ng-1.6.0rc2 >Libol-0.3.9 > >Dan Edwards > >Network Specialist > >A. Duda & Sons, Inc.

1 0

Question about remote logging
by Michael Boman 18 Apr '03

18 Apr '03

Hi, I am wondering if syslog-ng handles network interuptions.. Basicly if I have a syslog-ng installation in a remote office that logs to a central syslog-ng server at the main office, and for some reason the remote office disapears from the face of the earth (internet), does syslog-ng cache the syslog messages it recives so that when the internet connectivity appears again it will send the messages it recived during the down peroid? What if syslog-ng dies for any reason (power failure etc..) during that period, does it store the logmessages it has in cache on disk so when it comes back up it can start feeding the main server with the logs? Best regards Michael Boman -- Michael Boman Security Architect, SecureCiRT Pte Ltd http://www.securecirt.com

2 2

RE: [syslog-ng]Syslog-ng and MySQL
by Hamilton, Andrew 18 Apr '03

18 Apr '03

This is a permissions problem with mysql. It uses a couple of different things to authenticate a user. The user, the host and the password. Make sure you have root@(ipaddr) in the user table. That is not the same as root@localhost, or root@hostname. You can also have a user with a "%" as the host entry which will allow a user from any host to login. NOT RECOMMENDED FOR THE ROOT ACCOUNT. Regards, Drew -----Original Message----- From: Madziarczyk, Jonathan [mailto:than@cityofevanston.org] Sent: Monday, March 24, 2003 11:57 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Syslog-ng and MySQL So I'm trying to log to a MySQL database with Syslog-ng. I followed the directions on "campin.net" and everything looks good. However when I try to look at the data, I get the message "[MySQL][ODBC 3.51 Driver] Access Denied for user: 'root@(IPAddr)' (Using password: YES). I'm using the odbc driver on a pc to look at the server. Is this a MySQL permissions problem or is there something else I should be looking at? If it is, what do I need to add to let this work? Thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Solaris 8 configure errors with libol version & tcp_wrappers
by Wayne Sweatt 18 Apr '03

18 Apr '03

Dear Balabit, I had previously installed syslog-ng .1.6.0rc1 on RH8 Linux just fine. Now I have to get it running on a Solaris 8/Sun Blade 100. Here's the OS and software configurations of note: Solaris 8, with latest recommended patch cluster. Tcp_Wrappers 7.6 libol 0.3.9 GNU software: gcc 3.2.2 flex 2.5.4a bison 1.875 autoconf 2.57 automake 1.7.2 make 3.80 glib 1.2.10 The problems are all related to "errors" within the configure file: ( I am using the command: "./configure --enable-tcp-wrapper") 1. It checks for a libol version of => 0.3.9 and returns "no", when in fact, it is 0.3.9 I can simply comment out the checks in configure, and bypass this problem. Then. 2. It didn't find libwrap.h. I relocated it to /usr/local/include and /usr/include, and then it found it. 3. It returns: "checking for hosts_access in -lwrap. no" Beats me - it's in there just like it's been for years - by default. Wrappers are working just fine for everything else. I also compiled wrappers with "STYLE = -DPROCESS_OPTIONS" 4. It returns "checking whether to enable TCP wrapper support. no" Subsequently, I do not compile with lwrap. Please advise how to fix these problems. The config.log is clean. No errors. Thanks Wayne Sweatt UNIX System Administrator Comforce Technical Services LANL SCC Team

2 1

Re: [syslog-ng] permission denied on syslog-ng
by Michael Redinger 18 Apr '03

18 Apr '03

Same here with 1.6.0rc2 (I'm using FACILITY). This works fine in 1.6.0rc1. Michael > Hi there > > I've problems with macros. I've tried a few different config files now and > macros don't seem to work in any of them. > > Here's a short sample: > > source src { unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) > port(514)); }; > > destination d_mysql { > pipe("/tmp/mysql.pipe" > template("$HOST\n") > ); > }; > > destination console { usertty("root" template("HELLO $HOST\n")); }; > > log { source(src); destination(d_mysql); destination(console); }; > > > Since I don't get anything in my mysql server at the moment I run this to > check the fifo 'cat < /tmp/mysql.pipe' > All that I get is the linefeed from \n > > And on my console I only get HELLO \n > > The macros don't seem to expand not just $HOST. > > I run syslog-ng 1.6.0rc2 on a Slackware 9.0 box. > > Thank you! > > /peter -- Michael Redinger Zentraler Informatikdienst (Computer Centre) Universitaet Innsbruck Technikerstrasse 13 Tel.: ++43 512 507 2335 6020 Innsbruck Fax.: ++43 512 507 2944 Austria Mail: Michael.Redinger(a)uibk.ac.at

2 1

Issue with Macros & 1.6.0rc2
by Dan Edwards 17 Apr '03

17 Apr '03

I am having some strange problems that I can not seem to resolve with syslog-ng and macro use. I am sure it is simple and I am just over looking it. When I try and use the $YEAR, $MONTH, $DAY, $FACILITY, $LEVEL and several other macros nothing is outputted. Example: destination d_cisco { file("/var/log/cisco-$YEAR.$MONTH.$DAY.log"); } The file that it creates is: "/var/log/cisco-.log" This holds true for usage of template command in the file call. If I format it with those macros a blank space is all that is entered. If I put a "\n" on the end of the last macro it erases all the output for the line and makes the entire line blank. Example: destination d_cisco { file("/var/log/cisco.log" template("$YEAR-$MONTH-$DAY $LEVEL $MSG\n")); } The output is " " If I do not put the \n on the end only the MSG macro will output. Any input is greatly appreciated. Debian 3.0r1 Syslog-ng-1.6.0rc2 Libol-0.3.9 Dan Edwards Network Specialist A. Duda & Sons, Inc.

1 0