- syslog-ng - lists.balabit.hu

Lost CR-LF ?
by Hypo 10 Jan '03

10 Jan '03

Hi all, I' have a question regarding syslog-ng. I'm using last development version and I tried to stress test it using a message generator ( Kiwi ). I configured syslog-ng to accept remote messages via both UDP and TCP. Then I start sending lot messages like 100msg/s burst and 500msg/s burst. In UDP mode I just lost some messages, but I expected that. In TCP mode there's a strange behaviour. What happened is that when I use TCP and send a lot ( 100/sec and more ) msg a time , syslog-ng will 'forgot' a carriage return between each line, and put all them on a single line. I cannot understand why. This will not happen when i send less messages for second. Any clue ? Amodiovalerio Verde

2 1

source unix-dgram - Unsupported address family
by Carlos Velasco 10 Jan '03

10 Jan '03

Hi, I have successfully compiled libol-0.3.6 and syslog-ng-1.5.24 All works ok, messages are logged. However, when I use source unix-dgram for /dev/log, I see these messages in the syslog logs Jan 9 17:07:26 syslog:err syslog-ng: syslog-ng[179]: io.c: sockaddr2info(): Unsupported address family 64000 (addrlen=256). Jan 9 17:07:36 syslog:err syslog-ng: syslog-ng[179]: io.c: sockaddr2info(): Unsupported address family 64000 (addrlen=256). Jan 9 17:07:36 syslog:err syslog-ng: syslog-ng[179]: io.c: sockaddr2info(): Unsupported address family 64000 (addrlen=256). Jan 9 17:07:37 syslog:notice syslog-ng: syslog-ng[179]: syslog-ng version 1.5.24 going down Jan 9 17:00:29 syslog:notice syslog-ng: syslog-ng[4220]: syslog-ng version 1.5.24 starting Jan 9 17:00:30 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 35703 (addrlen=256). Jan 9 17:00:30 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 62912 (addrlen=256). Jan 9 17:00:31 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 62912 (addrlen=256). Jan 9 17:00:31 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 62912 (addrlen=256). Jan 9 17:00:31 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 62912 (addrlen=256). Jan 9 17:01:44 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 62912 (addrlen=256). As you can see, numbers change when I stop and start syslog-ng. Also, if I use unix-stream, it works, but I'm using klogd 1.4.1 and need dgram. My system is: Linux 2.4.20 glibc 2.3.1 Any suggestions? Regards, Carlos Velasco

1 2

[syslog-ng 1.4.17] configuration error
by Arno Luppold 10 Jan '03

10 Jan '03

Hi! I'm trying to set up syslog-ng, but it fails at startup. I'm using this configuration (excerpt): filter f_news { facility(news); }; filter f_mail { facility(mail); }; filter f_local { facility(local0, local1, local2, local3, local4, local5, local6, local7); }; filter f_firewall { match("SuSE-FW"); }; filter f_messages { not filter(f_firewall) not filter(f_mail) not filter(f_news); }; # that's normally at the same line as f_messages When I try to run syslog-ng I get this error message: parse error at 25 Parse error reading configuration file, exiting. At line 25 there's the f_message filter. If I use filter f_message { not filter(f_firewall); }; it's working fine. But as soon as I add another "not" I get the error posted above. Can anyone tell me where's my mistake, please? :-) Arno

2 2

postfix requiring syslog?
by netsec novice 09 Jan '03

09 Jan '03

I am using SuSE 8.1 to build a cental syslog server and have installed syslog-ng. I need to run postfix in order to send alerts. Now that I have disabled syslog and enabled/installed syslog-ng, postfix no longer starts on its own at boot. When I attempt to start it manually, it responds that syslog is required to be running to start postfix.. do I want to start syslog? If I say yes then postfix starts fine but I don't really want to be running syslog AND syslog-ng do I? Linux is new to me so I apologize for my ignorance. Is there a simple work-around to tell postfix to use syslog-ng rather than syslog? I guess I don't understand where this dependency comes from. Any help is appreciated. N _________________________________________________________________ MSN 8 helps eliminate e-mail viruses. Get 2 months FREE* http://join.msn.com/?page=features/virus

3 2

v1.5.23 crashes
by Joerg Sommer 09 Jan '03

09 Jan '03

Hi, I don't know since when and what I did before, but my syslog-ng crashes. I the core dump I saw, it prints a message "io.c: sockaddr2info(): Unsupported address family %i.\n" where %i is 27749. But the value of %i changes with every crash. The crashes occures in line 1032 of the file io.c. But the error is before. The addr parameter in do_read_line (sources.c:61) is a invalid value for an address family. I couldn't find the piont, where the incorrect address family is set. Is this a known bug? Bye, Joerg.

2 1

RE: [syslog-ng]sending mail
by Michael.Semling＠swisscom.com 08 Jan '03

08 Jan '03

Hi N! If you really need an SMTP server running, I can highly recommend postfix. Otherwise, set up the mailhost correctly and use the mailx programm. e.g. for an empty message mailx -v -s test_email John.Doe(a)mailinglist.net </dev/null -v to see all the messages. But maybe I misunderstood your question and you just want to read the mails? Generally the mails are stored under /var/mail/<user>, you can easily read them be entering the command "mail" You'll see the mail list. Just type the number and you have the content. Regards, Michael -----Original Message----- From: netsec novice [mailto:netsec9@hotmail.com] Sent: Dienstag, 7. Januar 2003 22:03 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]sending mail I am a linux newbie - sorry. I already have an SMTP server on my network. Can I use mail from within syslog-ng to send messages to my account for alerting purposes without configuring a full blown mail server on my linux box? I don't know if there is a default SMTP client on linux (SuSE 8.1) or how to configure it. any help is appreciated N _____ The new MSN 8 is here: Try it free* for 2 months <http://g.msn.com/8HMEEN/2018> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]sending mail
by Hamilton, Andrew 08 Jan '03

08 Jan '03

You don't need a mail server running to SEND mail. Most, if not all, UNIX flavors come with some form of mail client, most of which are based upon some version of sendmail. However, you will need to send it to a mail SERVER. You'll have to check for a mail client, since I don't use SuSE I can't tell you where one will be, I have used several other flavors of Linux and they have all had the "mail" client. You could set up your mail program inside your syslog-ng.conf the same as you would to any other program by using the "program" key word in a destination. The message from syslog-ng is then passed to the program as an argument I believe. If you are using syslog-ng version 1.5.x, you can also use templates to format the message passed to the program. Or you can write a small program that parses the message sent to it from syslog-ng and then use that program to intelligently send mail. I think that is the best option since then you can control what you send and how you send it as opposed to trying to make syslog-ng do it. If you have a busy syslog-ng host, that could slow it down and you don't want that. Regards, Drew -----Original Message----- From: netsec novice [mailto:netsec9@hotmail.com] Sent: Tuesday, January 07, 2003 4:03 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]sending mail I am a linux newbie - sorry. I already have an SMTP server on my network. Can I use mail from within syslog-ng to send messages to my account for alerting purposes without configuring a full blown mail server on my linux box? I don't know if there is a default SMTP client on linux (SuSE 8.1) or how to configure it. any help is appreciated N _____ The new MSN 8 is here: Try it free* for <http://g.msn.com/8HMEEN/2018> 2 months _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

caching/tcp fault tolerant syslog?
by Aleksandr Koltsoff 08 Jan '03

08 Jan '03

hello (pls cc the replies, I'm not on the list) I have the following scenario: about 20 linux boxes in separate geographical areas, connected via WAN links which I don't completely trust. what I would like is this: run syslog-ng on each box, they should not write to files, but instead they should send all their messages over to a central log server so far so good :-) in the event of tcp-breakage (when the client boxes cannot reach the server via tcp, maybe with some keepalive "pings"), the syslogd should firstly start collating the log messages into memory (size settable by user), after that to disk (or directly to disk, if memory cache size is 0)). after some retries, cached log entries should be flushed to central server once connection is established. I went trough the archives (not all of them, but some) and seems that some ppl could use this functionality as well. basically I think couple of options, write my own syslogd or start hacking on syslog-ng, or, write a fault transparent buffering program that would implement all this and stick with stock syslog-ng that would always feed this program. any ideas on this? Aleksandr Koltsoff

1 0

sending mail
by netsec novice 07 Jan '03

07 Jan '03

1 0

Re: [syslog-ng]replacing part of prog name with hostname
by Noam Meltzer 07 Jan '03

07 Jan '03

I thing you confused it a little... According to my last message (and a similar thread I created recently) The problem with the hostname resolving of Solaris is fixed with using: keep_hostname(no) But, I would really like to understand what's going on in there. Is my assumption correct? Noam --- On Thu 01/02, Balazs Scheidler wrote:From: Balazs Scheidler [mailto: bazsi(a)balabit.hu]To: syslog-ng(a)lists.balabit.huDate: Thu, 2 Jan 2003 10:43:45 +0100Subject: Re: [syslog-ng]replacing part of prog name with hostnameOn Tue, Dec 31, 2002 at 02:05:34PM -0800, Nate Campi wrote:> I have syslog-ng 1.5.24 on solaris 8, reading from /etc/.syslog_door and> I have a log entry like this:> > Dec 31 13:48:15 larry 6.0[8704]: [ID 702911 local0.warning] [0] Can't> stat file in FlushFile [news/PointCast]: No such file or directory> > ...but the program name was sent from the app was: "ctlds 6.0[8704]:"> and syslog-ng replaced the first part of the messed up program name with> the host's name. > > In the next version, can syslog-ng "learn" that it don't get a hostname> from solaris ever and that the entire text coming in is actually the log> message? I'm losing information this way. I wonder how many other apps> split up the program name and lose data - most people would never know> as end users.the problem is ctlds sends a space in the program name tag, thus syslog-nginterprets 'ctlds' as hostname and '6.0' as program name. askeep_hostname() is set to no it rewrites originating host name.Try setting keep_hostname() to yes, it will not touch the hostname then.-- BazsiPGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

4 10

syslog -> syslog-ng
by Billy 06 Jan '03

06 Jan '03

If I install syslog-ng as a log server can I have the original syslog mechinisam from all of my other boxes send to the syslog-ng server? Will it map the same, are there any modifications I need to make to the other syslog conf? Will I need to install syslog-ng on all boxes? Thanks, Bill

2 1

replacing part of prog name with hostname
by Nate Campi 06 Jan '03

06 Jan '03

I have syslog-ng 1.5.24 on solaris 8, reading from /etc/.syslog_door and I have a log entry like this: Dec 31 13:48:15 larry 6.0[8704]: [ID 702911 local0.warning] [0] Can't stat file in FlushFile [news/PointCast]: No such file or directory ...but the program name was sent from the app was: "ctlds 6.0[8704]:" and syslog-ng replaced the first part of the messed up program name with the host's name. In the next version, can syslog-ng "learn" that it don't get a hostname from solaris ever and that the entire text coming in is actually the log message? I'm losing information this way. I wonder how many other apps split up the program name and lose data - most people would never know as end users. -- Nate Campi http://www.campin.net An Emacs reference mug is what I want. It would hold ten gallons of coffee. -- Steve VanDevender And, no doubt, have a lid that could only be removed with an obscure finger combination requiring both hands. (Ctrl-Alt-Meta-X gimme-the-damn-coffee) -- William Beegle

5 14

Over zealous syslog-ng problem
by Aaron Jackson 06 Jan '03

06 Jan '03

My Setup: I have syslog-ng running on several Solaris 8 machines. Each machine writes log messages to their local disks and also forwards the messages to a central log server via a UPD connection, also a Solaris 8 machine. The central log server stores everything into a mysql database via a perl script I wrote. My Problem: I am running the UNIX version of Cisco Secure on one of the Solaris boxes. A couple of times it has blown up. When this happens, it generates millions of log messages in a very short period. The problem is that syslog-ng logs most of these messages (I also get the mangled message problem during these heavy loads). The most recent episode generated 1,930,974 messages that made it into the mysql database and 49,573 mangled messages on the central log server, but 16,040,886 messages were written to disk on the local machine (see below). My Questions: Is there any way to throttle syslog-ng, or make syslog-ng not accept all log messages when an app goes crazy? I want to log some of these messages, so I know when to restart the service, but I don't want all 16 million. Also, it seems that around 15 million log messages didn't make it to my central server. Where were they lost? Is this a problem with the UDP transport? Aaron # cat local0.log | grep -c 'ERROR - error on accept' 16040886 jackson@auth:/tmp {5} cat sql_errors | grep -c 'INSERT INTO' 49573 mysql> delete from logs where host='acs' and facility='local0' and priority='err' and msg like '%ERROR - error on accept%'; Query OK, 1943387 rows affected (1 hour 40.16 sec)

5 10

RE: [syslog-ng]replacing part of prog name with hostname
by Noam Meltzer 04 Jan '03

04 Jan '03

This sounds like a nice idea, but I think that if you use such a mechanism you should also state how to find the missing field, if you don't mention it. Also, you should think a lot of how to describe you regexp to support multi-platforms environment. Noam --- On Sat 01/04, Borzenkov Andrey wrote:From: Borzenkov Andrey [mailto: Andrey.Borzenkov(a)siemens.com]To: syslog-ng(a)lists.balabit.huDate: Sat, 4 Jan 2003 14:55:51 +0300Subject: RE: [syslog-ng]replacing part of prog name with hostname> > On Thu, Jan 02, 2003 at 10:43:45AM +0100, Balazs Scheidler wrote:> >> > the problem is ctlds sends a space in the program name tag, thus syslog-> ng> > interprets 'ctlds' as hostname and '6.0' as program name. as> > keep_hostname() is set to no it rewrites originating host name.> >> > Try setting keep_hostname() to yes, it will not touch the hostname then.> > Right but "ctlds" isn't the hostname, larry is. My logs are wrong either> way - I either lose half my program name or get the wrong hostname.> Either way I lose.> > Arg, I actually wrote my own syslog daemon to relay and rewrite all> these last year. The only way to fix this with syslog-ng would be to add> a feature like> > options {> bad_hostnames("ctlds","last");> };> > When syslog-ng sees either of these:> > Jan 2 15:06:47 ctlds 6.0[11718]: [0] Request error (500): Template> processing error> Jan 2 15:06:47 last message repeated 123 times> > It knows to actually shift the message over one place to the right and> stick the value of the $FULLHOST_FROM macro in there. Even if I tried> templating out the message on my own syslog-ng will still think that> "ctlds" or "last" isn't part of the message and it'll get lost.Better is to implement source templates. This way you can precisely describeinput line, so if you know your source never appends host name, you justomit this from template. Something likesource s_stream { unix-stream("/dev/log" max-connections(10)); template(DATEPROG[PID]:... );}; Cheers-andrey_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

Re: [syslog-ng]replacing part of prog name with hostname
by Noam Meltzer 04 Jan '03

04 Jan '03

Such a feature must support netgroups, though, because otherwise when you have hunderds of servers in your network, you'll have a problem. Noam --- On Fri 01/03, Nate Campi wrote:From: Nate Campi [mailto: nate(a)campin.net]To: syslog-ng(a)lists.balabit.huDate: Fri, 3 Jan 2003 12:28:57 -0800Subject: Re: [syslog-ng]replacing part of prog name with hostnameOn Fri, Jan 03, 2003 at 03:21:25PM -0500, Ed Ravin wrote:> Nate Campi writes:> > > > On Fri, Jan 03, 2003 at 10:48:51AM +0100, Balazs Scheidler wrote:> > > > > > The solution is to fix the sender program, no better workaround exists in> > > syslog-ng.> > > > I tried that. I spent months trying to explain it to their developers. I> > almost got one of them to understand, at which point he said they don't> > really care.> > How about a feature in syslog-ng like this:> > add_hostname(host1, host2, host3 [, ...])> > Which would cause syslog-ng to insert a hostname or IP number for all> packets received from the hosts requested. That would cover packets> from Solaris hosts received via UDP - the add_hostname() option should> also be available on individual syslog sources, so you could correct> messages received from the local host via the syslog door or whatever> that funky thing is Solaris uses.Exactly what I suggested, except I called mine "bad_hostnames". I thinkthis feature could work.-- Nate Campi http://www.campin.net "What a good thing Adam had. When he said a good thing, he knew nobody had said it before." - Samuel Clemens_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

Re: [syslog-ng]replacing part of prog name with hostname
by Noam Meltzer 04 Jan '03

04 Jan '03

--- On Fri 01/03, Balazs Scheidler wrote:From: Balazs Scheidler [mailto: bazsi(a)balabit.hu]To: syslog-ng(a)lists.balabit.huDate: Fri, 3 Jan 2003 12:13:20 +0100Subject: Re: [syslog-ng]replacing part of prog name with hostnameOn Fri, Jan 03, 2003 at 05:03:03AM -0500, Noam Meltzer wrote:> I won't expect Sun to change their native syslogd. Their syslogd is> working good in its native environment, and its "harmonic" with other> native syslogd is evry good. For me it doesn't seem like a bug. Just> another mechanism. It is not Solaris's syslogd that has the bug. It's ctld which sends bogusdata in its messages.> And many other Solaris' internal mechanisms, like a warning that "/var/adm/utmp exists", and then in another line "for more information refer to the manpage of utmp". and when you have problems with you hd, you get bad warnings then, and when the lpr complains about printing, it also send a two line logs. This is just a different method of sending the logs. Solaris counts on you that you will reverse resolve the originating machine, and not to interpeter the data line you get. I can send you reports of my sniffing to show you that this is not a bug in syslogd of solaris, if you would like me to. (even though i'm sure you have a reachable solaris machine, and already done it yourself) Solaris' syslogd recognize the hostname by doing> reverse-resolution for each packet. And I don't think it's such a bad> idea. The current mechanism of syslog-ng is trying to run some regexp on> the data string (If I understood you correctly). I believe that the> Solaris mechanism is more secure because that way you know for sure that> the originating IP is who it claims to be. (Yes, you can always hijack> (hope i spelled this correct) an IP in the network, but I guess that in> that case you have other trouble). In syslog-ng mechanism, some1 can> inject you fake logs. (I don't know what good it can give an attacker...> but I'm sure that some criminal mind can find what to do with this).in keep_hostname(no) state, syslog-ng does not trust the host name in anyway. but this interacts badly with ctld. You still haven't answered about my security-question. Noam _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

syslog server config question
by Mark Schipper 04 Jan '03

04 Jan '03

syslog-ng seems to work quite well for sorting logs by facility and/or priority to the nth degree....but I'm struggling to do something that one would expect to be fairly simple (perhaps it is, and I'm even more simple...). I'm trying to setup a syslog server that sorts input by hostname and throws that input into /var/log/HOSTS/$hostname file. It's strictly for a backup copy of each system log for audit puposes in case a host is compromised, but I'd prefer to have each host have its own file. Easier to find stuff that way. I was expecting to setup the syslog servers syslog.conf file (not using syslog-ng) to pipe to a shell or perl script that did the parsing, but everything I ran across looked like it was aimed at intrusion detection. A quick search convinced me that syslog-ng was my best bet so I compiled and replaced syslogd with syslog-ng, but it is still logging my client logs to /var/log/messages (yes, I killed syslogd first), even though I setup the following at the end of the syslog-ng.conf file: # automatic host sorting (usually used on a loghost) # destination std { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$HOST_$YEAR_$MONTH_$D AY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # log it log { source(src); destination(std); }; I obviously need to spend some more time on this, but perhaps someone has a quick suggestion or knows of a better way to do what I'm looking for. In the meantime I'll read 'til my eyes bleed....... I'm not on the list, so please reply to mschipper(a)lightsurf.com Thanks.

2 1

log checking
by Peter Straka 03 Jan '03

03 Jan '03

Hi What about log-checking? I tried logcheck,logscanner,logsurger,logwatch,swatch, but every-one is only like better grep. Which is the best log checker? I expect somethink on statistical base - somethink like http analyze. I have centralized loghost with directory structure: log/HOSTS/<IPadr>/facility.<YYMMDD>.log How to setup logchecker to control all logs? Use the PIPE? What are you thinking about? Is somewhere else discussion about that? by peter ________ Pocitacove hry? http://hry.sme.sk

1 0

chatt for linux
by Peter Straka 03 Jan '03

03 Jan '03

Hi I use syslog-ng on linux platform and I in crontab I use chattr to change log files (imutable and appendable) I think it would be goot idea to have implemented option attr() {like perm()}. And for acl somethinf like acl option. Would be this posible in future version? by peter ________ Pocitacove hry? http://hry.sme.sk

1 0

�ؼ��&�Կ��
by �� 03 Jan '03

03 Jan '03

特价新书75折！自考教材、辅导、试卷：一律8折，深圳市提供送货上门服务！深圳网络书店祝您新年愉快！点击进入深圳网络书店：　http://www.szbookshop.com ----------------------------------------------------------------------- 使用极星邮件群发，无须通过邮件服务器，直达对方邮箱，速度绝对一流！下载网址：http://love2net.51.net/，更多免费的超酷软件等你来下…… ---------------------------------------------------- INFORMATION This message has been sent using a trial-run version of the TSmtpRelayServer Delphi Component. ----------------------------------------------------

1 0

Re: [syslog-ng]replacing part of prog name with hostname
by Noam Meltzer 03 Jan '03

03 Jan '03

I won't expect Sun to change their native syslogd. Their syslogd is working good in its native environment, and its "harmonic" with other native syslogd is evry good. For me it doesn't seem like a bug. Just another mechanism. Solaris' syslogd recognize the hostname by doing reverse-resolution for each packet. And I don't think it's such a bad idea. The current mechanism of syslog-ng is trying to run some regexp on the data string (If I understood you correctly). I believe that the Solaris mechanism is more secure because that way you know for sure that the originating IP is who it claims to be. (Yes, you can always hijack (hope i spelled this correct) an IP in the network, but I guess that in that case you have other trouble). In syslog-ng mechanism, some1 can inject you fake logs. (I don't know what good it can give an attacker... but I'm sure that some criminal mind can find what to do with this). Noam --- On Fri 01/03, Balazs Scheidler wrote:From: Balazs Scheidler [mailto: bazsi(a)balabit.hu]To: syslog-ng(a)lists.balabit.huDate: Fri, 3 Jan 2003 10:48:51 +0100Subject: Re: [syslog-ng]replacing part of prog name with hostnameOn Thu, Jan 02, 2003 at 03:28:49PM -0500, Noam Meltzer wrote:> I thing you confused it a little...> According to my last message (and a similar thread I created recently)> The problem with the hostname resolving of Solaris is fixed with using:> > keep_hostname(no)> > But, I would really like to understand what's going on in there.> Is my assumption correct?No. syslog-ng parses the incoming message, but the format of messages is_very_ vague. Depending on the sender the message itself can have many form.The problem here was the sender program contains a space, and Solarissyslogd does not add originating hostname to its local messages (unless itrelays the message) Thus it is not possible to decide whether the messagereceived contains 'hostname' & 'program' or a single 'program' but with aspace in it.keep_hostname() is not a solution, just a workaround, so syslog-ng itselfdoes not rewrite the hostname. The filter expression host('^hostname$')would still use the part before the space (e.g. the program name).The solution is to fix the sender program, no better workaround exists insyslog-ng.Nate, the problem does not apply to local messages only, it happens to caseswhen Solaris sends these messages via UDP. It is not a solution to simplyassume that there is no hostname for local messages-- BazsiPGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1

RE: [syslog-ng]Syslog and Checkpoint-NG
by Nicholas Berry 02 Jan '03

02 Jan '03

We haven't upgraded to NG yet, but pre-NG works fine. When we start testing NG, I can let you know what results we get. Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. nberry(a)ragingwire.com -----Original Message----- From: Jason Howell [mailto:jason.howell@triadbeemers.org] Sent: Sunday, December 29, 2002 10:06 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Syslog and Checkpoint-NG Has anyone heard of any problems getting Checkpoint-NG to syslog to a remote server? I am running CP-NG on RH7.3 and I can get it to syslog local but it won't send the logs to a remote server. J

1 0

Re: [syslog-ng](no subject)(solaris hostnames wrongly discovered)
by Noam Meltzer 02 Jan '03

02 Jan '03

Here's the solution: There's a parameter you can set in the configuration of the logserver itslef: keep_hostname() it should be set to: "NO" Some info about it: In order to understand things better, i sniffed the syslog network traffic, to see what i can learn about the problem. The main differences between syslog-ng and Solaris native syslog are: 1. It seems that syslog-ng terminates a single line of data with "\n" Like Balazs said). Native Solaris syslog terminates the line with nothing. 2. Syslog-ng adds in the beginning of the data line, the hostname which originated the log. Solaris' native doesn't do that, and counts on the log-server to reverse-resolve the originating IP, and get the host name. Now (and this is only my assumption, i haven't got into syslog-ng sources), when there's an host which sends two seperate packets of syslog data, which follows each other instantly, syslog-ng reverse resolve the first packet, and gets the hostname correctly. After that, it's supposed to cache the hostname from the earlier packet (according to the default value of keep_hostname(yes) ), and according to that to know the 2nd packet originating host. But, something goes wrong. Instead, syslog-ng tries to run some regexp or something of the kind of the data packet itself, and because there's no hostname written in the data, it finds some other word and decides that "THIS IS THE HOSTNAME!!!" (weepee!). setting "keep_hostname(no)" as I suggested overcomes this bug. (Or some other bug. The last paragraph is only my assumption what's going on inthere) Have a pleasent new year, Noam --- On Tue 12/31, Balazs Scheidler wrote:From: Balazs Scheidler [mailto: bazsi(a)balabit.hu]To: syslog-ng(a)lists.balabit.huDate: Tue, 31 Dec 2002 09:07:46 +0100Subject: Re: [syslog-ng](no subject)On Mon, Dec 30, 2002 at 05:32:09PM -0500, Noam Meltzer wrote:> > I did a little experiment and tried sending logs from one native solaris syslog to another. It worked just fine (except the fact i can't into hostnames...)> I looked at the big log "/var/adm/messages" (of two hosts) and saw that the "bad" logs, were logged by the native logger just fine, with stating the originating host as it should be in the beginning of the line.> > I tried simulating this using the command "logger" with no sucess.> > I suspect that sends the data of each packet, not to lines as> syslog-ng expects and this cause its mechanism to fail recognizing the> originating host succesfully.> > Did any1 encountered this problem? How did you solve it? syslog-ng terminates messages at '\n' even in UDP packets unless you areusing a recent version of syslog-ng.-- BazsiPGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

(no subject)
by Noam Meltzer 31 Dec '02

31 Dec '02

Hi! I am using Linux running Syslog-ng as my logserver, while the logs for each host i have are sent into different directory (and in the directory, i create files for each facility.priority). My clients platforms (the servers being logged) are: 1. Linux (runnig classic syslogd... can't remember which) 2. HPUX11i (running the native syslogd) 3. Solaris7&8 The mechanism works flowlessly, except for solaris. What happens? If I have a one line log, it works just fine. Syslog-ng identifies the host it comes from, and divide the data to files according to the rules I mentioned above. When I have a longer logs which takes two lines or more, starting from the 2nd line, syslog-ng doesn't know the the message was originated from, and creates for funny like: "?DLT" "?corrupt" "?See", etc. (The ? is actually 1 character or more, which the terminal can't recognize) The word you see, is actually the first word of the actual message. If I look at the operation of the native on solaris, local messages are logged just fine. I did a little experiment and tried sending logs from one native solaris syslog to another. It worked just fine (except the fact i can't into hostnames...) I looked at the big log "/var/adm/messages" (of two hosts) and saw that the "bad" logs, were logged by the native logger just fine, with stating the originating host as it should be in the beginning of the line. I tried simulating this using the command "logger" with no sucess. I suspect that sends the data of each packet, not to lines as syslog-ng expects and this cause its mechanism to fail recognizing the originating host succesfully. Did any1 encountered this problem? How did you solve it? Noam tsnoam(a)excite.com _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

4 3

Re: Bad hostname from solaris (added a subject now)
by Noam Meltzer 31 Dec '02

31 Dec '02

Hi! It is possible to use syslog-ng on solaris, but not preferable. I don't like the idea of replacing something core from the system. I'm trying to find a solution for the solaris syslogd, not to replace it with a different product. As I said: When its one native solaris syslog sending to another, it works flowlessly. Noam >Can you replace the Solaris syslog with syslog-ng? >Aaron >On Monday, December 30, 2002, at 05:32 PM, Noam Meltzer wrote: >>Hi! >>I am using Linux running Syslog-ng as my logserver, while the logs for >>each host i have are sent into different directory (and in the directory, i create files for each facility.priority). >>My clients platforms (the servers being logged) are: >>1. Linux (runnig classic syslogd... can't remember which) >>2. HPUX11i (running the native syslogd) >>3. Solaris7&8 >>The mechanism works flowlessly, except for solaris. >>What happens? If I have a one line log, it works just fine. Syslog-ng >>identifies the host it comes from, and divide the data to files according to the rules I mentioned above. >>When I have a longer logs which takes two lines or more, starting from >>the 2nd line, syslog-ng doesn't know the the message was originated from, and creates for funny like: >>"?DLT" "?corrupt" "?See", etc. >>(The ? is actually 1 character or more, which the terminal can't recognize) >>The word you see, is actually the first word of the actual message. >>If I look at the operation of the native on solaris, local messages are logged just fine. >>I did a little experiment and tried sending logs from one native solaris syslog to another. It worked just fine (except the fact i can't into hostnames...) >>I looked at the big log "/var/adm/messages" (of two hosts) and saw that the "bad" logs, were logged by the native logger just fine, with stating the originating host as it should be in the beginning of the line. >>I tried simulating this using the command "logger" with no sucess. >>I suspect that sends the data of each packet, not to lines as syslog-ng expects and this cause its mechanism to fail recognizing the originating host succesfully. >>Did any1 encountered this problem? How did you solve it? >>Noam >>tsnoam(a)excite.com _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0