- syslog-ng - lists.balabit.hu

Re: [syslog-ng]syslog-ng, mysql and web interface for queries
by Michael Earls 13 Oct '02

13 Oct '02

Its listed in the FAQ http://www.campin.net/syslog-ng/faq.html >>> volker_apelt(a)yahoo.de 10/13/02 10:19 AM >>> Some time ago some one posted an article on a web interface for queries to a MySQL database feed by syslog-ng. I tried to find this article in my email archive, but as it seems I've missed it. Do you now where to find this web interface and the software around it? Thank you, Volker -- Volker Apelt volker_apelt .@. yahoo.de (remove the dots, please) Dipl. Chem. +49 6172 31126 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng, mysql and web interface for queries
by Volker Apelt 13 Oct '02

13 Oct '02

Some time ago some one posted an article on a web interface for queries to a MySQL database feed by syslog-ng. I tried to find this article in my email archive, but as it seems I've missed it. Do you now where to find this web interface and the software around it? Thank you, Volker -- Volker Apelt volker_apelt .@. yahoo.de (remove the dots, please) Dipl. Chem. +49 6172 31126

1 0

template keyword for non-file destinations
by David Parker 11 Oct '02

11 Oct '02

Hi list, I am attempting to use templated output directly to a program's stdin instead of relying on a pipe and seperately starting a proxy process to monitor the pipe. For the curious, I'm using libdbi (http://libdbi.sourceforge.net) to write a tiny C wrapper that feeds its standard input into the database. I also saw a similar post at http://lists.balabit.hu/pipermail/syslog-ng/2002-September/003841.html "template() and template_escape() extension for all destination drivers" Is this or a similar patch likely to be included in an upcoming release? Thanks, David -- David Parker <dparker(a)novacoast.com> Lead Developer, Novacoast NovaGuardian http://www.novacoast.com

1 0

Foreground patch for syslog-ng 1.4.16
by Rolf Petter Halle 11 Oct '02

11 Oct '02

Hi! In order to run syslog-ng under supervise control (http://cr.yp.to/daemontools.html) I've added support to start it in the foreground. Hopefully, this patch (or similar functionality) can be added to the source. Rolf Petter Halle

1 0

logging with $HOST and no $HOST
by JR Mayberry 11 Oct '02

11 Oct '02

When I do an lsof on my syslog-ng server I will see entries like (i'm setup with : file(/log/$HOST/$MONTH-$DAY-$YEAR); ) "/log -- 13" (13 because its 1pm now) "/log -- 10-11-2002/13" So, I'm obviously losing logs, I need to know how I can fix this and get these logs (even if it's to a "dump all poorly malformed log packets to a single file" solution) syslog-ng 1.5.15 thanks. __________________________________________________ Do you Yahoo!? Faith Hill - Exclusive Performances, Videos & More http://faith.yahoo.com

1 0

Re: syslog-ng and libol path
by Balazs Scheidler 11 Oct '02

11 Oct '02

On Fri, Oct 11, 2002 at 11:49:12AM +0200, Steve Alberty wrote: > Hi, > > i'm using your excellent syslog-ng application and have to try update > from verson 1.5.17 to 1.5.21. > > The Problem is, in the current version (1.5.21) the configure script can > not recognize an alternative path to libol. > > eg. > > ./configure --prefix=/usr/local/syslog-ng/1.5.21 > --with-libol=/usr/local/libol/0.3.3/bin > > break-up with: > 'libol-config not found in the specified location' > > I think something is wrong in configure.in, because it test if > libol-config is in the given directory is found, but if I specify the > directory to /usr/local/libol/0.3.3/bin, then building breaks with: > > gcc -DHAVE_CONFIG_H -I. -I/usr/src/syslog-ng-1.5.21/src -I. -g -O2 > -Wall -I/usr/src/libol-0.3.3/src -D_GNU_SOURCE -c main.c > In file included from main.c:26: > syslog-ng.h:31: objects.h: file not found --with-libol option is needed if you didn't install libol itself. If you did, simply set your path prior to running configure: PATH=/usr/local/libol/0.3.3/bin:$PATH ./configure --prefix=... Otherwise do not install libol, and use the configure switch: ./configure --with-libol=../libol-0.3.3 --prefix=... -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Security: syslog-ng 1.4.x and 1.5.x is vulnerable to buffer overflow
by Balazs Scheidler 11 Oct '02

11 Oct '02

Hi, I'm writing this mail to announce that syslog-ng 1.4.x and 1.5.x are both vulnerable to a buffer overflow. Exploiting the bug needs a site specific exploit to be written, as the way the buffer is overwritten depends on the local configuration file. The buffer overflow can be triggered when templated output files or filename templates are used. Everybody is urged to upgrade to 1.4.16 or 1.5.21, these are available at the usual place, http://www.balabit.hu/en/downloads/syslog-ng/downloads/ The bug was found be me, so possibly nobody else knows the details. Of course diffing the new version with the previous one unveils the problem. Bugtraq announcement will be sent out soon. Debian package has been released and accepted (though mirrors need time to get the new one) ps: sigh, this was my first BoF :( -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

5 25

Version 1.5.21
by Jerome Peducasse 11 Oct '02

11 Oct '02

Hello, With syslog-ng 1.5.21 (libol 0.3.4), I can't use udp or tcp destination. Example: # cat ./syslog-ng.conf #Minimal configuration file source s_sys { unix-dgram("/dev/log"); internal(); }; destination d_alllog { file("/var/log/all.log" template_escape(off) owner(root) group(sys) perm(0640)); }; destination d_loghost { udp("loghost" port(514)); }; log { source(s_sys); destination(d_alllog); destination(d_loghost); }; # /usr/local/sbin/syslog-ng.1.5.21 -V syslog-ng 1.5.21 # /usr/local/sbin/syslog-ng.1.5.21 -f ./syslog-ng.conf Error creating AF_INET socket (Succès) Error initializing configuration, exiting. # ps auxw | grep -c [s]yslog 0 # /usr/local/sbin/syslog-ng.1.5.18 -V syslog-ng 1.5.18 # /usr/local/sbin/syslog-ng.1.5.18 -f ./syslog-ng.conf # ps auxw | grep [s]yslog root 12680 0.0 0.6 1484 776 ? S 16:28 0:00 /usr/local/sbin/syslog-ng.1.5.18 -f ./syslog-ng.conf # strace /usr/local/sbin/syslog-ng.1.5.21 -f ./syslog-ng.conf .... .... pipe([3, 4]) = 0 fork() = 12727 close(4) = 0 read(3, Error creating AF_INET socket (Succès) Error initializing configuration, exiting. "\1", 1) = 1 --- SIGCHLD (Le processus `enfant' a terminé.) --- _exit(1) = ? Could you help me please? My OS is Linux -- Jerome Peducasse Wanadoo Portails - Sophia Antipolis

1 0

STILL MANGLED MESSAGES! Please Help!
by harald schmidt 11 Oct '02

11 Oct '02

Hi, Syslog-ng 1.5.21 still produces mangled messages into pipes! This happens ca. 10 times a day. Here an example what syslog-ng writes in the pipe: INSERT INTO all_messages_200210 (host, facility, priority, tag, date, time, program, msg) VALUES ( 'clc', 'daemon', 'debug', '1f', '2002-10-10', '11:24:56', 'nrpe', 'nrpe[15656]: Host is asking for command \'check_total_procs\' to be rINSERT INTO all_messages_200210 (host, facility, priority, tag, date, time, program, msg) VALUES ( 'clc', 'daemon', 'debug', '1f', '2002-10-10', '11:24:57', 'nrpe', 'nrpe[15656]: Return Code: 0, Output: OK - 67 processes running' ); the 3rd line should look like this: '2002-10-10', '11:24:56', 'nrpe', 'nrpe[15656]: Host is asking for command \'check_total_procs\' to be run...' ); But syslog-ng doesn't finish that line. Here another example: INSERT INTO all_messages_200210 (host, facility, priority, tag, date, time, program, msg) VALUES ( 'clc', 'daemon', 'debug', '1f', '2002-10-10', '01:26:52', 'nrpe', 'nrpe[15INSERT INTO all_messages_200210 (host, facility, priority, tag, date, time, program, msg) VALUES ( 'clc', 'daemon', 'debug', '1f', '2002-10-10', '01:26:52', 'nrpe', 'nrpe[15387]: Return Code: 1, Output: 2 users currently logged in' ); Here is my syslog-ng.conf: # # Syslog-ng example configuration for for Debian GNU/Linux # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # # 1.options options { long_hostnames(off); use_fqdn(yes); sync(0); log_fifo_size (500); gc_busy_threshold(768); use_time_recvd(1); }; # 2.sources source s_kernel { pipe("/proc/kmsg"); internal(); }; source s_stream { unix-stream("/dev/log"); internal(); }; source sn_udp { udp(); }; # 3.destinations destination df_all_messages { file("/var/log/all_messages-$YEAR$MONTH$DAY"); }; destination dq_mysql_all_messages { pipe("/var/pipes/mysql.fifo" template("INSERT INTO all_messages_$YEAR$MONTH (host, facility, priority, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; # 4.Log log { source(s_stream); source(s_kernel); source(sn_udp); destination(df_all_messages); }; log { source(s_stream); source(s_kernel); source(sn_udp); destination(dq_mysql_all_messages); }; And here the Script that reads from the pipe (I'm starting a new database every month): #!/bin/sh datum=$(date +%Y%m) if [ -e /var/pipes/mysql.fifo ]; then while [ -e /var/pipes/mysql.fifo ] do /usr/local/mysql/bin/mysql -vvT syslog_$datum < /var/pipes/mysql.fifo done else mkfifo /var/pipes/mysql.fifo fi My system: # uname -a Linux clc 2.4.10-4GB #1 Tue Sep 25 12:33:54 GMT 2001 i686 unknown Could anyone PLEASE help me? thanks Harald -- Holen Sie sich den Turbo fürs Internet: T-DSL! http://bonus.gmx.net/?gid=46842444&prid=11

3 2

FW: [bugtraq] syslog-ng buffer overflow
by Nicholas Berry 10 Oct '02

10 Oct '02

Baszi, Have you (or your group) been notified about this? How valid is the solution given? Will this issue be addressed in the next 1.5 release? Thanks, Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. nberry(a)ragingwire.com -----Original Message----- From: Holtzl Peter [mailto:holtzl.peter@balabit.hu] Sent: Thursday, October 10, 2002 5:44 AM To: bugtraq(a)securityfocus.com Subject: syslog-ng buffer overflow ---------------------------------------------------------------------------- PACKAGE : syslog-ng VERSION : -1.4.15 (stable) and -1.5.20 (development) SUMMARY : buffer overflow TYPE : remote exploit VULNERABLE: : exploitable (not in default configuration) ZORP-OS SPECIFIC : No ZSA-AUTHOR : Balazs Scheidler <balazs.scheidler(a)balabit.com> ZSA-ID : ZSA-2002-014 DATE: : 2002-10-03 15:00 ---------------------------------------------------------------------------- BACKGROUND: Syslog-NG is a portable syslog implementation. Its highlights include regexp based log selection, TCP transport and more. For more information: http://www.balabit.hu/en/downloads/syslog-ng/ Zorp OS is a Debian GNU/Linux based operating system hardened for running Zorp Professional modular application level firewall suite. Its core framework allows the administrator to finetune proxy decisions (with its built-in script language), and fully analyze complex protocols including SSL embedded protocols. For more information: http://www.balabit.hu/en/products/ZorpPro/ DESCRIPTION: To make it easier to specify message destinations, syslog-ng supports macros in destination filenames as the following log snippet shows: destination d_messages_by_host { file("/var/log/$HOST/messages"); }; The same syntax is used when specifying the contents of destination files: destination d_special_messages { file("/var/log/messages" template("$ISODATE $HOST $MSG\n")); }; The problem lies in the way macro expansion handles constant characters. (ie everything other than macro references). As syslog-ng expands macros it usesa buffer, and a variable called 'left', which contains the number of characters available in the buffer. When a constant character is appended, this variable is not decremented, thus when expanding macros incorrect bounds checking is performed. IMPACT: If templated filenames or templated output is used, it is possible to overflow a buffer. The number of bytes exceeding the allocated buffer depends on the exact template being used. It is believed that this overflow can be exploited, given enough constant characters are present in the template string. SOLUTION: Upgrade syslog-ng to 1.5.21 (devel) or 1.4.16 (stable) or apply the following patch: diff -u -r1.52 -r1.53 --- affile.c 21 Aug 2002 14:03:50 -0000 1.52 +++ affile.c 27 Sep 2002 09:11:33 -0000 1.53 @@ -859,7 +859,7 @@ { "SOURCEIP", M_SOURCE_IP } }; char format[cfg->log_msg_size + 1], *format_ptr = format; - int left = sizeof(format); + int left = sizeof(format) - 1; int i, j; i = 0; @@ -888,6 +888,7 @@ *format_ptr = template->data[i]; format_ptr++; i++; + left--; } } *format_ptr = 0; REFERENCES: 1. http://www.balabit.hu/static/zsa/ZSA-2002-014-en.txt 3. http://www.balabit.hu/en/downloads/syslog-ng/ 3. http://www.balabit.hu/en/products/ZorpPro/ Höltzl Péter BalaBit IT Kft | Tel: +36 1 371-0540 | GnuPG Fingerprint: holtzl.peter(a)balabit.hu | Mobil: +36 20 366-9667 | DB30 5E5B 8777 C06F 5A1F http://www.balabit.hu/ | Fax: +36 1 208-0875 | 4586 CEAF 9678 4A89 CFD6

2 1

Erreur configuration file
by Laurent Mesuré 09 Oct '02

09 Oct '02

Hi, i ve used the HOWTO from Ben Russo to install syslog-ng on a Mandrake Linux box. I ve already have a PostgreSQL running on this box. I 've build both libol and syslog-ng without any problem. I ve made all steps specified in the HOWTO. But when i launch my /etc/init.d/syslog-ng i go the following error: Starting syslog-ng: parse error at 37 Parse error reading configuration file, exiting. And in the configuration file at line 37 i have the following lines: destination d_msgs { file("/var/log/messages" template("$FULLDATE $HOST $FACILITY.$PRIORITY $MSG\n")); }; What happened? regards -- Laurent Mesuri Steria Group http://www.steria.com SAF/DAF Boulogne Billancourt France Tel: +33.1.46.20.65.57 Fax: +33.1.46.20.65.65 Mob: +33.6.82.68.15.22

3 3

Re: Solved: Re: troubles with postfix and syslog-ng 1.5.21: lost log lines
by Balazs Scheidler 09 Oct '02

09 Oct '02

Hi, Thanks for finding this out. Ccing to the syslog-ng list. postfix is chrooted, and thus cannot reopen log connections from the chrooted jail. if one runs postfix it is advisably to fetch logs from /var/spool/postfix/dev/log It's not syslog-ng specific though. Nate could you add this to the FAQ? On Wed, Oct 09, 2002 at 03:05:07PM +0200, Dr. Peter Bieringer wrote: > > > --On Dienstag, 8. Oktober 2002 15:48 +0200 Balazs Scheidler > <bazsi(a)balabit.hu> wrote: > > >> 2) after restarting syslog-ng, postfix/nqmgr do no longer log > >> > >> That's very strange, I don't find a solution until now. Do you have > >> hints? > > > > this is a libc issue IMHO, libc doesn't immediately reopen log connections > > if sending a message fails. as you restart syslog-ng the connections to > > the previous instance of syslog-ng are lost. > > Looks like through a magic mechanism, logging works on startup also by the > chrooted-postfix process. To reestablish the log on syslog-ng restart, the > log socket has to be connected again: > > > -- syslog-ng.conf 8 Oct 2002 12:13:53 -0000 1.9 > +++ syslog-ng.conf 9 Oct 2002 12:54:56 -0000 > @@ -13,6 +13,7 @@ > > source s_local { internal(); > unix-stream("/dev/log" keep-alive(yes) > max-connections(100)); > + unix-stream("/var/spool/postfix/dev/log" keep-alive(yes) > max-connections(100)); > file("/proc/kmsg"); > }; > > > Perhaps an entry for a FAQ. Also the one with the too few log connect > limits. > > Peter > -- > Dr. Peter Bieringer Phone: +49-8102-895190 > AERAsec Network Services and Security GmbH Fax: +49-8102-895199 > Wagenberger Straße 1 Mobile: +49-174-9015046 > D-85662 Hohenbrunn mailto:pbieringer@aerasec.de > Germany Internet: http://www.aerasec.de > PGP/GPG: http://www.aerasec.de/wir/publickeys/PeterBieringer.asc > -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

apache logs, again
by Andreas Hasenack 08 Oct '02

08 Oct '02

Ok, I'm using the tail | logger thing and it sort of works. But there is a problem: date/time. I get entries like this in mysql: (long line below, sorry) 714 machine local4 info 2001-12-31 00:00:00 apache: 127.0.0.1 - - [07/Oct/2002:17:43:41 -0300] "POST /syslog/results.php HTTP/1.1" 200 700 Of course, only the date/time of the entry itself (msg field) is correct. Logger doesn't seem to add date/time info to the logs it sends. Any clever way around this? Is this a logger bug?

2 3

getting a build error on Solaris8,
by Todd S. Ness 08 Oct '02

08 Oct '02

here is the output from my make command: I see that res_init is defined in resolve.h on my system in /usr/include/resolve.h, I don't know where to look for yywrap problem. Thanks Todd. make Making all in src make all-recursive Making all in . gcc -g -O2 -Wall -I/opt/a/src/syslog-ng/SunOS5.8/libol-0.3.3/src -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor /opt/a/src/syslog-ng/SunOS5.8/libol-0.3.3/src/.libs/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file res_init main.o yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /opt/a/src/syslog-ng/SunOS5.8/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /opt/a/src/syslog-ng/SunOS5.8/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /opt/a/src/syslog-ng/SunOS5.8/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' -- ToddNess - EDS/StorageTek Infrastructure Specialist 303-661-5854 Better to keep quiet and be thought wise than to speak up and remove all doubt.

2 2

How can I get logs without date,time hostname and facility ?
by alexch 07 Oct '02

07 Oct '02

ok I have correct this line in my syslog-ng.conf destination hosts { file("/var/log/hosts/$HOST/$FACILITY/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" template("$MSG\n") owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; and now log looks like this squid: 1033739673.117 10818 192.168.1.29 TCP_REFRESH_MISS/200 19595 GET http://lists.balabit.hu/pipermail/syslog-ng/ - DIRECT/62.80.73.147 text/html squid: 1033739687.778 3124 192.168.1.29 TCP_MISS/200 180 GET http://216.239.33.102/search? - DIRECT/216.239.33.102 text/html I need exclude word "squid" from logs, it need for SQRMGLOG. It doesn't work correctly with this log How ????????? Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628

2 1

Apologies
by Brett Dubroy 07 Oct '02

07 Oct '02

Hello, It's been brought to my attention that I inadvertently posted a "I'm going home sick" type message to the mailing list; If anyone on the list is in Ottawa, I highly recommend *not* catching the latest round of the flu ;-) TTYL & Apologies Brett --- Brett Dubroy Jetnet Internetworking Services Email : bdubroy(a)jetnet.ca Phone : (613) 237-5995 x 227 This communication contains confidential information intended solely for the use of the individual/s and/or entity or entities to whom it was intended to be addressed. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this transmission is prohibited. If you have received this communication in error, please contact the sender immediately, delete the communication from your system and do not disclose its contents to any third party or use its contents. Any opinions expressed are solely those of the author and do not necessarily represent those of JETNET Internetworking Services Inc. unless otherwise specifically stated.

1 0

internal logging problem
by Carlos Velasco 04 Oct '02

04 Oct '02

Hi, I have tried syslog-ng versions 1.5.18 and 1.5.21 with the same problem. My system is: > uname -a Linux atlas 2.4.19 #1 Tue Aug 6 01:59:40 CEST 2002 i586 unknown syslog-ng.conf: source src { internal(); }; destination syslog { file("/var/log/syslog.log"); }; log { source(src); destination(syslog); }; I can't see any internal messages in /var/log/syslog.log file tcp, udp and unix-streams works fine, only problem is with internal. Any help would be apreciated. Regards, Carlos Velasco

2 7

RE: [syslog-ng]How can I get logs without date,time hostname and facility ?
by Hamilton, Andrew 04 Oct '02

04 Oct '02

It means that you want to define your own logfile format. To do this you use the template function. $MESSAGE is a MACRO that is defined inside syslog-ng and returns only the message portion of the log entry which is what you said you were looking for. -----Original Message----- From: alexch [mailto:alexch@gc.lviv.ua] Sent: Friday, October 04, 2002 8:22 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]How can I get logs without date,time hostname and facility ? What does it mean ???? template("$MESSAGE\n"); Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

How can I get logs without date,time hostname and facility ?
by alexch 04 Oct '02

04 Oct '02

What does it mean ???? template("$MESSAGE\n"); Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628

1 0

RE: [syslog-ng]How can I get logs without date,time hostname and facility ?
by Hamilton, Andrew 04 Oct '02

04 Oct '02

Alex, Try use the template function to in your destination file definition. I haven't used this so I'm not 100% sure of the syntax but you can try the destination. You might have to tweak it a bit to get it right. destination hosts { file("/var/log/hosts/$HOST/$FACILITY/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(src); destination(hosts); template("$MESSAGE\n"); }; Regards, Drew -----Original Message----- From: alexch [mailto:alexch@gc.lviv.ua] Sent: Friday, October 04, 2002 7:53 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]How can I get logs without date,time hostname and facility ? Ok I have done that my squid's access.log works via syslog-ng. That's nice. I get log given below -------------cut----------------- Oct 4 14:34:48 gw squid: 1033731288.219 1234 192.168.1.29 TCP_MISS/000 0 GET http://www.sans.org/infosecFAQ/sec_solaris.htm - NONE/- - Oct 4 14:34:48 gw squid: 1033731288.755 1764 192.168.1.29 TCP_MISS/200 192 GET http://216.239.33.102/search? - DIRECT/216.239.33.102 text/html -------------cut----------------- but I want to get log without "Oct 4 14:34:48 gw squid:" (date,time hostname and facility) How can I do it??? my syslog-ng.conf ------begin------------- options { keep_hostname(no); long_hostnames(off); sync(0); }; # source src { unix-dgram("/var/run/log"); # udp(); internal(); file("/dev/klog"); udp(ip("192.168.1.7") port(514)); destination hosts { file("/var/log/hosts/$HOST/$FACILITY/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(src); destination(hosts); }; -----end------ Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

How can I get logs without date,time hostname and facility ?
by alexch 04 Oct '02

04 Oct '02

Ok I have done that my squid's access.log works via syslog-ng. That's nice. I get log given below -------------cut----------------- Oct 4 14:34:48 gw squid: 1033731288.219 1234 192.168.1.29 TCP_MISS/000 0 GET http://www.sans.org/infosecFAQ/sec_solaris.htm - NONE/- - Oct 4 14:34:48 gw squid: 1033731288.755 1764 192.168.1.29 TCP_MISS/200 192 GET http://216.239.33.102/search? - DIRECT/216.239.33.102 text/html -------------cut----------------- but I want to get log without "Oct 4 14:34:48 gw squid:" (date,time hostname and facility) How can I do it??? my syslog-ng.conf ------begin------------- options { keep_hostname(no); long_hostnames(off); sync(0); }; # source src { unix-dgram("/var/run/log"); # udp(); internal(); file("/dev/klog"); udp(ip("192.168.1.7") port(514)); destination hosts { file("/var/log/hosts/$HOST/$FACILITY/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(src); destination(hosts); }; -----end------ Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628

1 0

Re: Bug #161915
by Balazs Scheidler 04 Oct '02

04 Oct '02

On Thu, Oct 03, 2002 at 04:09:27PM -0700, Brian Thomas wrote: > On Thu, Oct 03, 2002 at 12:54:41PM +0200, Balazs Scheidler wrote: > > Hi, > > > > Thanks for the information you provided. > > > > The problem is that the programs do not send \n at the end of line while > > syslog-ng expects one for STREAM oriented sources. (such as unix-stream), > > This seems like a bug in the packages like cron, I would think. If using > a stream source I'd think the daemon would be expected to provide > \n's? libc should do that. there's nothing saying that syslog() calls should be made with a string terminated with NLs. > > > > > Earlier versions of syslog-ng took a message as a full message in the > > following cases: > > 1) either NL or NUL was found in the incoming stream > > 2) after a single read and the source is datagram oriented (UDP or unix-dgram) > > 3) after the incoming buffer is full (specified via log_msg_size()) > > > > For stream oriented sources either 1) or 3) must be true. The strace you > > sent me indicates that some programs do not terminate their messages by > > '\n'. > > > > Checking out the libc sources shows that libc automatically terminates > > messages by NL if LOG_PERROR is set, and also adds a \0 at the end of the > > line if STREAM sockets are used. So both syslog-ng and libc behaviour seems > > to be correct. Something must be wrong anyway as the strace didn't show > > terminating NUL characters. > > > > I assumed that you are using unix-stream sources, but this assumption > > should be true as syslog-ng issues read() instead of recvfrom(). > > I should have provided my syslog-ng.conf. Here's the sources line: > > source src { unix-dgram("/dev/log"); internal(); file("/proc/kmsg" > log_prefix("kernel: ")); udp(); }; > > So no, I'm not using streams, I'm using sockets. And this is > interesting, because this was the default .conf that was installed, and > from looking at the man page I'd think that should be > unix-socket("/dev/log"), right? hmm... unix-dgram sources should call recvfrom and not read. I verified this and they do indeed use recvfrom. (I've just found a bug in the kernel, it returns bogus sockaddrs from recvfrom on SOCK_DGRAM sockets) I workaround in libol is now available at the end of this message. I've also attached the kernel patch that should fix the problem. > > As syslog-ng reads no terminating NUL characters, I think this should be a > > libc issue. stream sockets should always have line terminations, as it is > > not guaranteed by the kernel that a single write will be read by single read > > calls. > > > > I don't know where to submit this bug, to the libc people, or to the cron > > people? > > Assuming that my confusion about unix-dgram vs. unix-stream is just me > being confused, and that I'm using streams even when I specify > unix-dgram, than I would think this is a cron issue. It seems like > they're being sloppy in their logging. can you check lsof -p <syslogng pid> just to see what fd 3 is ? If it is really a unix-dgram socket, it should not be read by read() syslog-ng should have used recvfrom() instead. On my testbox it correctly used recvfrom. PS: please Cc syslog-ng(a)lists.balabit.hu in followups. Kernel patch, which fixes the unix domain socket issue (against 2.4.18): --- af_unix.c~ Mon Feb 25 20:38:16 2002 +++ af_unix.c Fri Oct 4 09:46:26 2002 @@ -1392,6 +1392,9 @@ sk->protinfo.af_unix.addr->name, sk->protinfo.af_unix.addr->len); } + else { + ((struct sockaddr *) msg->msg_name)->sa_family = AF_UNIX; + } } static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg, int size, Libol patch, which works around the problem above: diff -u -r1.28 io.c --- io.c 16 Sep 2002 08:23:22 -0000 1.28 +++ io.c 4 Oct 2002 08:53:41 -0000 @@ -368,7 +368,16 @@ } for (;;) { - int res = recvfrom(closure->fd, buffer, length, 0, (struct sockaddr *) addr, (socklen_t *) addrlen); + int res; + + res = recvfrom(closure->fd, buffer, length, 0, (struct sockaddr *) addr, (socklen_t *) addrlen); + + if (*addrlen == 2) { + /* HACK: this is a workaround of a Linux 2.2 & 2.4 bug, + * it doesn't return anything sensible in sockaddr buf + */ + ((struct sockaddr *) addr)->sa_family = AF_UNIX; + } if (res == 0) { /* on SOCK_DGRAM protocols 0 returned bytes doesn't mean anything */ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

keeping socket open
by Adam Steffes 03 Oct '02

03 Oct '02

Is it possible to make syslog-ng keep a socket open? A developer has some perl code that passes a message to syslog-ng, which opens a socket, sends the message along, then closes the socket. Data that he attempts to write to the same socket isn't written because syslog-ng has already closed the socket. Any help is appreciated. -Adam

1 0

NEW SOLUTION MYSQL INSERT
by _/CaT\_ 03 Oct '02

03 Oct '02

Hi *, It is the code of a system which inserts syslog events into a Mysql DB whith best performances in a more secure and stable way. All the scripts are written in Perl, PAM(DBI,Sys::Syslog) and PERL are required. 1) Inserdb.pl v.1.1 it's the daemon that verify and inserts the data. 2) Allow_ip_table_db.pl v.1.1 This wizard inserts Authorized Ips that are allowed to write on DB (It's important for ddos problems) 3) Load_ip_allows.txt the conf file that inserts authorized Ips 4) Make_facility_level.sql creates tables facility and level 5) syslog_db_insert starts the service under RH 7.3 6) syslog-ng option ------------------------------------------------------------------------ ------------------------------------------------------------ (1) ######################################################################## ############ #!/usr/bin/perl # # SYSLOG_DB_INSERT # inserdb.pl # v.1.1 # # Script to implement INSERT INTO DB MYSQL # # description: Utility for insert syslog events # # by _/CaT\_: # Script Author: # GDM & _/CaT\_ cat_roger22(a)hotmail.com ######################################################################## ############# $|=1; use DBI; #use strict; use Sys::Syslog; use POSIX qw(strftime); sub log_syslog($$); sub warn_log_exit($$); sub error_log_exit($$); &log_syslog('info'," Start $0 - Syslog-ng "); $ENV{'DBI_DSN'}='xxxxxxx'; $ENV{'DBI_USER'}='xxxxxx'; $ENV{'DBI_PASS'}='xxxxxx'; $ENV{'DBI_TABLE_SYSLOG'}='xxxxx'; $ENV{'DBI_PIPE_SYSLOG'}='/path/xxxxx.pipe'; $ENV{'ERR_MSG'}='/path/err_DB_msg.log'; my $DB_SB='mysql'; ### ### Debug mode = 1 ### my $DEBUG = 0; my $test_dsn = $ENV{'DBI_DSN'} || die "DSN not set\n"; my $test_user = $ENV{'DBI_USER'} || die "User not set\n"; my $test_password = $ENV{'DBI_PASS'} || die "Password not set\n"; my $table = $ENV{'DBI_TABLE_SYSLOG'} || die "Table not set\n"; my $pipe = $ENV{'DBI_PIPE_SYSLOG'} || die "Pipe file not set\n"; my $errmsg = $ENV{'ERR_MSG'} || die "File ERR_MSG not set\n"; my $DATA_SOURCE='dbi:mysql:'.$test_dsn.';mysql_compression=1'; my $dbh; my $sth; my $riga; ### normal-signals ### These are the signals which a program might normally expect to encounter and which by default cause it to ### terminate. They are HUP, INT, PIPE and TERM. ### ### error-signals ### These signals usually indicate a serious problem with the Perl interpreter or with your script. They are ### ABRT, BUS, EMT, FPE, ILL, QUIT, SEGV, SYS and TRAP. ### ### old-interface-signals ### These are the signals which were trapped by default by the old sigtrap interface, they are ABRT, BUS, EMT, ### FPE, ILL, PIPE, QUIT, SEGV, SYS, TERM, and TRAP. If no signals or signals lists are passed to sigtrap, ### this list is used. ### local $SIG{HUP} = sub { &error_log_exit('SIGHUP',"Eseguito un kill -1") }; local $SIG{INT} = sub { &error_log_exit('SIGINT',"Eseguito un kill -2") }; local $SIG{QUIT} = sub { &error_log_exit('SIGQUIT',"Eseguito un kill -3") }; local $SIG{TRAP} = sub { &error_log_exit('SIGTRAP',"Eseguito un kill -5") }; local $SIG{KILL} = sub { &error_log_exit('SIGKILL',"Eseguito un kill -9") }; local $SIG{ABRT} = sub { &error_log_exit('SIGABRT',"Eseguito un kill -6") }; local $SIG{BUS} = sub { &error_log_exit('SIGBUS',"Eseguito un kill -7") }; local $SIG{FPE} = sub { &error_log_exit('SIGFPE',"Eseguito un kill -8") }; local $SIG{SEGV} = sub { &error_log_exit('SIGSEGV',"Eseguito un kill -11") }; local $SIG{PIPE} = sub { &error_log_exit('SIGPIPE',"Eseguito un kill -13") }; local $SIG{ALRM} = sub { &error_log_exit('SIGALRM',"Eseguito un kill -14") }; local $SIG{TERM} = sub { &error_log_exit('SIGTERM',"Eseguito un kill -15") }; local $SIG{CHLD} = sub { &error_log_exit('SIGCHLD',"Eseguito un kill -17") }; local $SIG{STOP} = sub { &error_log_exit('SIGSTOP',"Eseguito un kill -19") }; local $SIG{SYS} = sub { &error_log_exit('SIGSYS',"Eseguito un kill -31") }; $dbh = DBI->connect( $DATA_SOURCE, $test_user, $test_password, { RaiseError => 1, PrintError => 2, AutoCommit =>1 } ) or &error_log_exit('DB CONNECT',"$DBI::errstr"); &log_syslog('info','Connect to DB...Start'); ##################################################### ### Load table facility ##################################################### my $exe; my $sth; my $id; my $query; my $facility; my %facility; my $priority; my $level; my %level; $query='SELECT * FROM facility'; $sth=$dbh->prepare($query) || &error_log_exit("$query",$dbh->errstr); $exe=$sth->execute() || &error_log_exit('EXEC',$dbh->errstr); eval { while(($id,$facility) = $sth->fetchrow_array) { $facility{$id}=$facility; print STDOUT "FACILITY: $id -> $facility\n" if $DEBUG ge 1; } }; &error_log_exit('FETCH',$dbh->errstr) if $@; #################################################### ### Load table level ################################################### $query='SELECT * FROM level'; $sth=$dbh->prepare($query) || &error_log_exit("$query",$dbh->errstr); $exe=$sth->execute() || &error_log_exit('EXEC',$dbh->errstr); eval { while(($priority,$level) = $sth->fetchrow_array) { $level{$priority}=$level; print STDOUT "LEVEL: ".$priority.' -> '.$level."\n" if $DEBUG ge 1; } }; &error_log_exit('FETCH',$dbh->errstr) if $@; #################################################### ### Load tables hosts ################################################### if ( $DEBUG ge 1 ) { my @tables; my $val; @tables = map{ $_ =~ s/^.*\.//; $_ } $dbh->tables(); foreach $val (@tables) { print STDOUT "TABLE: $val\n"; } } #################################################### ### Core Function ################################################### open(FF,"$pipe") || &error_log_exit('PIPE_ERROR_1',"Error on read pipe $pipe; $!"); while($riga=<FF>) { my $date; my $host; my $facility; my $level; my $tag; my $program; my @msg=(); my $val; my $time; ### ### CHECK SINTAX ### Syntax ### |<|$YEAR/$MONTH/$DAY $HOUR:$MIN:$SEC $HOST $FACILITY $LEVEL $TAG $PROGRAM $MSG|>| ### chomp($riga); print STDOUT "BEFORE:$riga\n" if $DEBUG ge 1; if ( $riga =~ /^\|\<\|(.+)\|\>\|$/) { $riga=$1; if ( $riga =~ /\|\>\|\|\<\|/ ) { &warn_log_exit("SYNTAX_ERROR_1",$riga); ### ### Decomenntando no recupera piu le possibili righe.. ### #next; $riga=~ s/^(.+)\|\>\|\|\<\|.+$/$1/; } } else { &warn_log_exit("SYNTAX_ERROR_2",$riga); next; } ($date,$time,$host,$facility,$level,$tag,$program,@msg)=split(/\ /,$riga); ### ### forza la variabile program al primo campo del message togliendo il pid ### if ( $program !~ /\w/ ) { $program=$msg[0]; $program=~s/(.+)\[.+/$1/; } ### ### Create string (Pattern Substitution) - Conversione facility e level in numero ### foreach $val (keys %facility) { if ( $facility eq $facility{$val} ) { $facility=$val; } } foreach $val (keys %level) { if ( $level eq $level{$val} ) { $level=$val; } } print STDOUT "NEXT:$date $time $host $facility $level $tag $program @msg\n" if $DEBUG ge 1; ### ### CHECK TABLES ### | ### if exists -> INSERT INTO ... ### else -> Scrive su file my $sth=""; my $exe=""; my $query=""; ### ### IMPORTANTE!!! ### Conversione IP in INDICE TABELLA ### my $index=$host; $index=~s/\./_/g; # converte ip in id $query="SELECT id FROM main_allow_syslog WHERE id = \'$index\' AND state = 1"; $sth=$dbh->prepare($query) || &warn_log_exit('PREPARE',"$query $dbh->errstr"); $exe=$sth->execute() || &warn_log_exit('EXEC',$dbh->errstr); my $numrows=$sth->rows; print STDOUT "stato= $exe - righe=$numrows\n" if $DEBUG ge 1; if ($numrows eq 1) { ### ### Inserisce nel DB ### ### +----------+--------------+------+-----+---------------------+-------+ ### | Field | Type | Null | Key | Default | Extra | ### +----------+--------------+------+-----+---------------------+-------+ ### | date | datetime | | | 0000-00-00 00:00:00 | | ### | facility | int(2) | | | 0 | | ### | level | int(2) | | | 0 | | ### | tag | varchar(4) | | | | | ### | program | varchar(64) | | | | | ### | msg | varchar(255) | | | | | ### +----------+--------------+------+-----+---------------------+-------+ ### $query="INSERT INTO $index(date,facility,level,tag,program,msg) VALUES (\'$date $time\',\'$facility\',\'$level\',\'$tag\',\'$program\',\'@msg\')"; $dbh->do($query) || &warn_log_exit('INSERT_FAILED_1',$query); print STDOUT "INSERT SUCCESS on $index: $query\n" if $DEBUG ge 1; } else { &warn_log_exit('INSERT_FAILED_2',"QUERY=\"$query\": RIGA=\"$riga\""); } } close(FF); $dbh->disconnect() or &error_log_exit('DB_CLOSE',"$DBI::errstr"); log_syslog('info','Session to DB closed...'); ################################################# ### ### SUB ### ################################################# sub log_syslog($$) { my ($tipo,$mess)=@_; openlog($0, 'cons,pid', 'user'); syslog($tipo,$mess); closelog(); }; sub warn_log_exit($$) { local ($in,$err)=@_; local $tme; $time=strftime("%Y/%m/%d %H:%M:%S",localtime); print STDOUT "$time WARN:$in:$err\n" if $DEBUG ge 1; open(ERRMSG,">>$errmsg") || die "Error on WRITE on $errmsg: $!\n"; print ERRMSG "$time WARN:$in:$err \n"; close(ERRMSG); }; sub error_log_exit($$) { local ($in,$err)=@_; local $tme; $time=strftime("%Y/%m/%d %H:%M:%S",localtime); print STDOUT "$time ERROR:$in:$err\n" if $DEBUG ge 1; open(ERRMSG,">>$errmsg") || die "Error on WRITE on $errmsg: $!\n"; print ERRMSG "$time ERROR:$in:$err \n"; close(ERRMSG); exit 1; }; ######################################################################## ############# #EOF ######################################################################## ############# (2) ######################################################################## ############ #!/usr/bin/perl # # SYSLOG_DB_INSERT # allow_ip_table_db.pl # v.1.1 # # Script to implement ALLOW TO INSERT INTO DB MYSQL # # description: Wizard for allow IP to write into DB # # by _/CaT\_: # Script Author: # GDM & _/CaT\_ cat_roger22(a)hotmail.com ######################################################################## ############## $|=1; use DBI; #use strict; use Sys::Syslog; use POSIX qw(strftime); sub log_syslog($$); sub warn_log_exit($$); sub error_log_exit($$); &log_syslog('info',"|--------- Start $0 ---------|"); $ENV{'DBI_DSN'}='xxxxxx'; $ENV{'DBI_USER'}='xxxxx'; $ENV{'DBI_PASS'}='xxxxx'; $ENV{'DBI_TABLE_SYSLOG'}='xxx'; $ENV{'ERR_MSG'}='/path/err_DB_msg.log'; my $DB_SB='mysql'; ### ### Debug mode = 1 ### my $DEBUG = 1; my $test_dsn = $ENV{'DBI_DSN'} || die "DSN not set\n"; my $test_user = $ENV{'DBI_USER'} || die "User not set\n"; my $test_password = $ENV{'DBI_PASS'} || die "Password not set\n"; my $table = $ENV{'DBI_TABLE_SYSLOG'} || die "Table not set\n"; my $errmsg = $ENV{'ERR_MSG'} || die "File ERR_MSG not set\n"; ############################################### ### ### IMPORTANT!!! ### File load IP allowed to write into DB ### ############################################### my $file_in='/path/xxxxxxxx.txt'; my $DATA_SOURCE='dbi:mysql:'.$test_dsn.';mysql_compression=1'; my $dbh; my $sth; my $riga; my $BaseTable='main_allow_syslog'; $dbh = DBI->connect($DATA_SOURCE, $test_user, $test_password, {RaiseError => 1,PrintError => 2,AutoCommit =>1}) or die "Can\'t connect: $DBI::errstr\n"; &log_syslog('info','Connect to DB...Done'); ############################################## ### Make base table ############################################## ### ### +---------+--------------+------+-----+---------------------+-------+ ### | Field | Type | Null | Key | Default | Extra | ### +---------+--------------+------+-----+---------------------+-------+ ### | id | varchar(15) | | PRI | | | ### | ip | varchar(15) | | | | | ### | name | varchar(48) | | | | | ### | state | int(1) | | | 0 | | ### | c_time | datetime | | | 0000-00-00 00:00:00 | | ### | comment | varchar(126) | YES | | NULL | | ### +---------+--------------+------+-----+---------------------+-------+ ### my @tables; my $found=0; my $query; @tables = map{ $_ =~ s/^.*\.//; $_ } $dbh->tables(); while($table=<@tables> and $found == 0 ) { if ($table eq $BaseTable) { $found=1; } } if ( $found ne 1 ) { $query="CREATE TABLE $BaseTable( id varchar(15) PRIMARY KEY NOT NULL, ip varchar(15) NOT NULL, name varchar(48) NOT NULL, state int(1) NOT NULL, c_time DATETIME NOT NULL, m_time DATETIME NOT NULL, comment varchar(126) )"; $dbh->do($query); &warn_log_exit("CREATION TABLE","$query"); } ##################################################### ### Load tables ##################################################### my $exe; my $sth; my $id; my $priority; my $riga; my $ip; my $state; my $name; my @comment=(); my $todo; open(FF,"<$file_in") || &error_log_exit("FILE READ","$!"); while($riga=<FF>) { chomp($riga); ($todo,$ip,$name,$state,@comment)=split(/\s+/,$riga); ### ### CHECK SYNTAX ### next if ( $riga =~ /^#|^$/ ) ; &error_log_exit('SYNTAX ERROR READ_1',"IP errato") if ( $ip !~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/ ) ; &error_log_exit('SYNTAX ERROR READ_2',"state errato") if ( $state !~ /0|1/ ) ; &error_log_exit('SYNTAX ERROR READ_2',"Name errato") if ($name !~ /\w/) ; ### ### NOTE!!! ### ### The coma -.- in the IP is traslate in Underscore - _ - ### $iptraslate=$ip; $iptraslate=~ s/\./_/g; ### ### make query for update $BaseTable ### $ctime=strftime("%Y/%m/%d %H:%M:%S",localtime); print STDOUT "IpTraslate -> $iptraslate date -> $ctime todo -> $todo\n" if $DEBUG ge 1; if ( $todo eq 'ADD' ) { &ADD(*BaseTable,*iptraslate,*ip,*name,*state,*ctime,*comment); } elsif ( $todo eq 'DISABLE' ) { &DISABLE(*BaseTable,*iptraslate,*ip,*ctime); } elsif ( $todo eq 'ENABLE' ) { &ENABLE(*BaseTable,*iptraslate,*ip,*ctime); } elsif ( $todo eq 'REMOVE' ) { &REMOVE(*BaseTable,*iptraslate,*ip) } } close(FF); $dbh->disconnect() or die "ERROR on close: $DBI::errstr\n"; log_syslog('info','Session to DB closed...'); ################################################# ### ### SUB ### ################################################# sub log_syslog($$) { my ($tipo,$mess)=@_; openlog($0, 'cons,pid', 'user'); syslog($tipo,$mess); closelog(); }; sub warn_log_exit($$) { my ($in,$err)=@_; print STDOUT "WARN:$in:$err\n" if $DEBUG ge 1; open(ERRMSG,">>$errmsg") || die "Error on WRITE on $errmsg: $!\n"; print ERRMSG "WARN:$in:$err \n"; close(ERRMSG); }; sub error_log_exit($$) { my ($in,$err)=@_; print STDOUT "ERROR:$in:$err\n" if $DEBUG ge 1; open(ERRMSG,">>$errmsg") || die "Error on WRITE on $errmsg: $!\n"; print ERRMSG "ERROR:$in:$err \n"; close(ERRMSG); exit 1; }; sub ADD($$$$$$) { local (*BaseTable,*iptraslate,*ip,*name,*state,*ctime,*comment)=@_; $query="INSERT INTO $BaseTable (id,ip,name,state,c_time,m_time,comment) VALUES (\'$iptraslate\',\'$ip\',\'$name\',\'$state\',\'$ctime\',\'$ctime\',\'@c omment\')"; print STDOUT "Query=$query\n"; $sth=$dbh->prepare($query) || &error_log_exit("$query",$dbh->errstr); $exe=$sth->execute() || &error_log_exit('EXEC',$dbh->errstr); ######################################################### ### Make new Table for IP ######################################################### ### ### +----------+--------------+------+-----+---------------------+-------+ ### | Field | Type | Null | Key | Default | Extra | ### +----------+--------------+------+-----+---------------------+-------+ ### | date | datetime | | | 0000-00-00 00:00:00 | | ### | facility | int(2) | | | 0 | | ### | level | int(2) | | | 0 | | ### | tag | varchar(4) | | | | | ### | program | varchar(64) | | | | | ### | msg | varchar(255) | | | | | ### +----------+--------------+------+-----+---------------------+-------+ ### $query="CREATE TABLE $iptraslate( date DATETIME NOT NULL, facility int(2) NOT NULL, level int(2) NOT NULL, tag varchar(4) NOT NULL, program varchar(64) NOT NULL, msg varchar(255) NOT NULL )"; $dbh->do($query); &warn_log_exit("CREATION TABLE $ip","$query"); }; sub DISABLE($$$$) { local (*BaseTable,*iptraslate,*ip,*ctime)=@_; $query="UPDATE $BaseTable SET state = \'0\' , m_time = \'$ctime\' WHERE id = \'$iptraslate\' AND ip = \'$ip\'"; print STDOUT "Query=$query\n"; $sth=$dbh->prepare($query) || &error_log_exit("$query",$dbh->errstr); $exe=$sth->execute() || &error_log_exit('EXEC',$dbh->errstr); }; sub ENABLE($$$$) { local (*BaseTable,*iptraslate,*ip,*ctime)=@_; $query="UPDATE $BaseTable SET state = \'1\' , m_time = \'$ctime\' WHERE id = \'$iptraslate\' AND ip = \'$ip\'"; print STDOUT "Query=$query\n"; $sth=$dbh->prepare($query) || &error_log_exit("$query",$dbh->errstr); $exe=$sth->execute() || &error_log_exit('EXEC',$dbh->errstr); }; ######################################################################## ############ #EOF ######################################################################## ############ (3) ######################################################################## ############## #### #### File for wizard the IP allowed to write into DB #### #### ADD -> Aggiunge tabelle #### DISABLE -> Disabilita la scrittura sulla tabella #### ENABLE -> riabilita la tabella #### #### IMPORTANT - after the insert clean the entry or comment #### #### Exaple: #### +-----------+-----------------+-----------+-----------+-----------+ #### | Func | IP | Hostname | State | Comment | #### +-----------+-----------------+-----------+-----------+-----------+ #### |ADD |192.168.69.254 |pippo |1 |honeypot | #### +-----------+-----------------+-----------+-----------+-----------+ ADD 192.168.69.254 pippo 1 honeypot #ADD 192.168.70.57 pippone 1 WS di GDM ######################################################################## ################ #EOF ######################################################################## ################ (4) ######################################################################## ############ # SQL script for load the tables: facility and level ######################################################################## ############ drop table facility; drop table level; create table facility ( id int(2), facility varchar(16) ); create table level ( priority int(2), level varchar(16) ); insert into facility(id,facility) values ('0','kern'); insert into facility(id,facility) values ('1','user'); insert into facility(id,facility) values ('2','mail'); insert into facility(id,facility) values ('3','daemon'); insert into facility(id,facility) values ('4','auth'); insert into facility(id,facility) values ('5','syslog'); insert into facility(id,facility) values ('6','lpr'); insert into facility(id,facility) values ('7','news'); insert into facility(id,facility) values ('8','uucp'); insert into facility(id,facility) values ('9','cron'); insert into facility(id,facility) values ('10','local0'); insert into facility(id,facility) values ('11','local1'); insert into facility(id,facility) values ('12','local2'); insert into facility(id,facility) values ('13','local3'); insert into facility(id,facility) values ('14','local4'); insert into facility(id,facility) values ('15','local5'); insert into facility(id,facility) values ('16','local6'); insert into facility(id,facility) values ('17','local7'); insert into level(priority,level) values ('0','emerg'); insert into level(priority,level) values ('1','alert'); insert into level(priority,level) values ('2','crit'); insert into level(priority,level) values ('3','err'); insert into level(priority,level) values ('4','warning'); insert into level(priority,level) values ('5','notice'); insert into level(priority,level) values ('6','info'); insert into level(priority,level) values ('7','debug'); insert into level(priority,level) values ('8','none'); commit; ######################################################################## ############## #EOF ######################################################################## ############## (5) ######################################################################## ######## #!/bin/bash # # Program: syslog_db_insert init script # # Description: # # chkconfig: 2345 12 88 # Description: ######################################################################## ######### ######################################################################## ######## # configuration # INIT_DB_PROG="/path/insertdb.pl" # Full path to daemon PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/script INIT_DB=`basename "$INIT_DB_PROG"` # Source Redhat function library. # . /etc/rc.d/init.d/functions [ -x $INIT_DB_PROG ] || exit 0 RETVAL=0 umask 077 ulimit -c 0 # See how we were called. case "$1" in start) echo -n "Starting $INIT_DB: " nohup $INIT_DB_PROG & RETVAL=$? echo [ $RETVAL -eq 0 ] && touch "/var/lock/subsys/${INIT_DB}" ;; stop) echo -n "Stopping $INIT_DB: " killproc $INIT_DB_PROG RETVAL=$? echo [ $RETVAL -eq 0 ] && rm -f "/var/lock/subsys/${INIT_DB}" ;; status) status $INIT_DB_PROG RETVAL=$? ;; restart|reload) $0 stop $0 start RETVAL=$? ;; *) echo "Usage: $0 {start|stop|status|restart|reload}" exit 1 esac exit $RETVAL ###################################################################### #EOF ###################################################################### (6) ######################################################################## #### #LOG TO MYSQL destination d_mysql { pipe("/dev/mysql.pipe" template("|<|$YEAR/$MONTH/$DAY $HOUR:$MIN:$SEC $HOST $FACILITY $LEVEL $TAG $PROGRAM $MSG|>|\n")); }; ######################################################################## #### Cheers _/CaT\_

1 1

Leaving early today ...
by Brett Dubroy 03 Oct '02

03 Oct '02

Well, I've managed to succumb to the bug that's been going around (and I don't mean from Bugzilla ;-) ); I'm headed home to try and sleep it off after picking up some meds to combat the effects (Yeah NyQuil & DayQuil ! :-) ) I can be reached @ home, 237-7724, if required. TTYL Brett --- Brett Dubroy Jetnet Internetworking Services Email : bdubroy(a)jetnet.ca Phone : (613) 237-5995 x 227 This communication contains confidential information intended solely for the use of the individual/s and/or entity or entities to whom it was intended to be addressed. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this transmission is prohibited. If you have received this communication in error, please contact the sender immediately, delete the communication from your system and do not disclose its contents to any third party or use its contents. Any opinions expressed are solely those of the author and do not necessarily represent those of JETNET Internetworking Services Inc. unless otherwise specifically stated.

1 0