- syslog-ng - lists.balabit.hu

syslog network loging problem
by jscheibe＠css.tayloru.edu 10 May '01

10 May '01

1 0

RE: [syslog-ng]filter() call bug fix
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 08 May '01

08 May '01

I guess it would depend on how important this change is to everyone and if it is the only fix/enhancement in the next prospective version. For me this change alone is not that significant so you could hold off if you wanted. Regards, Drew -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, May 08, 2001 10:30 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]filter() call bug fix On Fri, May 04, 2001 at 05:21:56PM -0500, Jon Marks wrote: > Hi, > > I've uncovered a small bug in the filter() call within filter definitions. > Attached is a patch to filters.c against the current stable release > (1.4.11) to fix the bug. Thanks for the fix. This slipped my attention before releasing 1.5.6 so it doesn't contain this fix. I applied to both of my 1.4.x and 1.5.x trees. I don't know whether to release a new versions though. What do you people think? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Syslog-ng v1.4.11, libol 0.2.21, Slackware Linux 7.1, Not Logging
by Jon Todaro 08 May '01

08 May '01

I am trying to get syslog-ng running. I am using the stock syslog-ng.conf.RedHat config file, and syslog-ng starts, but will not autocreate the files, and it also wont log at all. If I run syslog-ng in -d mode. This is some of the output it shows me when I telnet in from another client. [root@bone:/root] syslog-ng -d io.c: listening on fd 3 io.c: listening on fd 4 syslog-ng version 1.4.11 starting io.c: Preparing fd 5 for reading io.c: Preparing fd 6 for reading Read EOF on fd 5. Marking fd 5 for closing. Closing fd 5. io.c: Preparing fd 5 for reading Read EOF on fd 5. Marking fd 5 for closing. Closing fd 5. Read EOF on fd 6. Marking fd 6 for closing. Closing fd 6. io.c: Preparing fd 5 for reading Any help would be greatly appreciated. Note.. libol was configured with no ./configure options specified. And syslog-ng was configured with only -sysconf -sbindir -bindir and -prefix specified. And I have moved the config file all together to make sure it was in the correct place, and when I did, it would not start. Help, I have used earlier versions of this daemon before, just fine. Jon Todaro

2 5

filter() call bug fix
by Jon Marks 08 May '01

08 May '01

Hi, I've uncovered a small bug in the filter() call within filter definitions. Attached is a patch to filters.c against the current stable release (1.4.11) to fix the bug. The following is a description of the problem. Take the following bit of configuration code for illustration: ############################ source local { unix-dgram("/dev/log"); udp(); internal(); }; filter f_test { host("myhost"); }; filter f_test2 { program("something"); }; filter f_test3 { filter("f_test"); }; # <-- ERROR occurs because of this destination d_test { file("/what/ever"); log { source(local); filter(f_test3); destination(d_test); }; ############################ When filters are defined in the configuration file, they're added to a list. If they contain a call to another filter (as in f_test3), the actual filter to which they refer is resolved the first time the former's evaluated against a log message. (So you can refer to a filter in the config file before you define it). The filter call resolution procedure traverses the list, comparing the name of each filter to the name its looking for. The problem is just a little mixup in the logic used to detect when the right filter is found. Here's the code responsible, from filters.c/do_filter_call(): if (!self->call_rule) { struct log_filter *p = rule->prev_filter; while (p && p->name->length != self->name->length && memcmp(p->name->data, self->name->data, self->name->lengt h)) { p = p->prev_filter; } ... } In the while() loop, the previous filter is meant to be chosen until the right one is found. But the condition logic says, "Try the next filter while 1) there IS a next filter AND 2) the filter's name length is different AND 3) the filter's name's contents don't match what we're looking for." But what happens when the length of the present filter doesn't match, but the contents *DO*? This can happen since the code only compares the as many bytes as the target name has. This condition would stop the loop, and choose the wrong filter (as p would be left pointing to the unmatching filter). This (and the other lookup phase, not shown) is fixed by the attached patch, by changing the logic as follows: if (!self->call_rule) { struct log_filter *p = rule->prev_filter; while (p && (p->name->length != self->name->length || memcmp(p->name->data, self->name->data, self->name->length)) ) { p = p->prev_filter; } ... } This should guarantee that the loop ends on p only when p is either NULL, or when it points to a filter with a name of matching length AND matching contents (thank DeMorgan for this explanation of that code). Otherwise, in the configuration snippet above, the filter() call in f_test3 resolves to "f_test2" in the lookup procedure, when "f_test" is the desired referent. That's because, as it traverses the list backwards from itself, it encounters f_test2 first (which is defined AFTER f_test). And f_test2 has unmatching length (good for advancing p) but matching contents up the the length of the string "f_test" which is what's being sought. Thanks. -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign

2 1

RE: [syslog-ng]Filter oddity
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 08 May '01

08 May '01

Chris, You are missing the "and" between authpriv and not. Regards, Drew -----Original Message----- From: Chris Wall [mailto:cwall@interaccess.com] Sent: Monday, May 07, 2001 10:50 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Filter oddity Apologies if this has been covered... I'm trying to fine tune my filtering in syslog-ng combined with some features of 2.4.x iptables/netfilter and portsentry What want to do is log information coming from the log rule in iptables to a specific file without it falling over into my other logs. The default syslog-ng.conf came with this filter: filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; And I've added this filter: filter f_iptables { level(info) and match(portsentry); }; What I would like to do is use a "not" in the first filter - i.e. filter f_filter2 { level(info) or facility(mail) or facility(authpriv) not match(portsentry); }; however, I get a parse error. I'm using 1.4.11... if I understand the docs right, this ought to be okay, but I'm sure I'm missing something. Any help would be appreciated. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Filter oddity
by Chris Wall 07 May '01

07 May '01

Apologies if this has been covered... I'm trying to fine tune my filtering in syslog-ng combined with some features of 2.4.x iptables/netfilter and portsentry What want to do is log information coming from the log rule in iptables to a specific file without it falling over into my other logs. The default syslog-ng.conf came with this filter: filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; And I've added this filter: filter f_iptables { level(info) and match(portsentry); }; What I would like to do is use a "not" in the first filter - i.e. filter f_filter2 { level(info) or facility(mail) or facility(authpriv) not match(portsentry); }; however, I get a parse error. I'm using 1.4.11... if I understand the docs right, this ought to be okay, but I'm sure I'm missing something. Any help would be appreciated.

1 0

Solaris8-x86: Missing symbol when linking syslog-ng 1.4.11
by Sander 06 May '01

06 May '01

Hi, I'm trying to compile syslog-ng 1.4.11 on Solaris8-x86 with gcc-2.95.3 and get the following linker error: gcc -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 Has anyone had this problem before? What library should this symbol be in? I've compiled it succesfully before on Solaris8-sparc with no problems whatsoever. Thanks in advance, Sander de Boer

4 5

Syslog.conf translator
by Jon Marks 06 May '01

06 May '01

Hi, In order to make the transition to syslog-ng easier for people, I thought it might be useful to have an automated translation from the old syslog.conf to a working syslog-ng.conf. I came up with an awk script which works OK for me. I was targeting Solaris and AIX specifically, but off-hand, RedHat linux syslogd looks the same and I presume other UNIX variants' do, too. Try it, it could work ;) In particular, there are three things to look out for if you're interested in porting this to another UNIX platform: 1) Change the local log device if necessary, from /dev/log to whatever it's supposed to be. 2) Change the device type (i.e. the syslog-ng.conf directive) for the local log device. The script checks 'uname' for SunOS and AIX and sets an appropriate variable; just add to that detection mechanism. A variable would do nicely for the log device, too, but they've got the same name in AIX and Solaris so I didn't worry about it. (I'm not using the "door" device). 3) The script is an awk script, but its invoked by ksh. It's easy to rearrange it so that it's invoked directly as awk, but for what I plan to do with it, I didn't need that. In either case, ksh won't be available on many linux distros, I think, so just change the shell to bash or something. (In this case, I hope the shell you pick is lenient about newlines within a quoted command line argument!) Hope this is useful! -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign

2 4

Stability of 1.5 tree
by Chris Sibbitt 04 May '01

04 May '01

Just a basic question. How stable is the 1.5 tree compared to the 1.4? I've been using 1.4 for quite awhile, and it seems to hold up well for my purposes, however I'd like the additional functionality that is in 1.5.6. Has anyone been using the latest 1.5 builds in production? What, if any, problems have been experienced? Chris Sibbitt JetNet Internetworking Services Inc. Providing Secure Internet Communications Phone 613-271-6220x228 FAX 613-271-6229 Email csibbitt(a)jetnet.ca Web www.jetnet.ca <http://www.jetnet.ca/>

1 0

syslog-ng 1.5.6 released
by Balazs Scheidler 04 May '01

04 May '01

Hi, I released syslog-ng 1.5.6 with the following enhancements: News for the 1.5.6 release Fri, 4 May 2001 14:38:31 +0200 * added explicit chown/chmoding of files/directories for easier permission management * added the possibility to use sync() on TCP destinations * syslog-ng now outputs connection properties when a connection is broken * added special message parsing used by AIX (last message repeated & Message forwarded from) It can be found at the usual places: http://www.balabit.hu/en/products/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Re: [syslog-ng]Directory permissions/ownership
by John_Delisle＠ceridian.ca 03 May '01

03 May '01

I've been waiting for such a feature for quite a while!! I know it would be very useful here, we want some logs owned by nobody for use with our httpd. Thanks! John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 |--------+--------------------------------> | | Chris Sibbitt | | | <CSibbitt(a)jetnet.ca> | | | Sent by: | | | syslog-ng-admin(a)lists.| | | balabit.hu | | | | | | | | | 2001/05/03 09:40 AM | | | Please respond to | | | syslog-ng | | | | |--------+--------------------------------> >-----------------------------------------------------------------------------------------------------------| | | | To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> | | cc: | | Subject: [syslog-ng]Directory permissions/ownership | >-----------------------------------------------------------------------------------------------------------| After much frustration, I decided to simply add a umask(000) to the beginning of main() in order to alleviate troubles I've been having with the perm() and dir_perm() configuration directives. One thing, though, that I think is needed in the config that doesn't currently exist is dir_user() and dir_group() directives to control the ownership of created directories. Would anyone else find this useful? Chris Sibbitt JetNet Internetworking Services Inc. Providing Secure Internet Communications Phone 613-271-6220x228 FAX 613-271-6229 Email csibbitt(a)jetnet.ca Web www.jetnet.ca ********************************************************************** This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege. If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this is e-mail is strictly prohibited. If you have received this e-mail in error please notify the sender immediately. **********************************************************************

1 0

Directory permissions/ownership
by Chris Sibbitt 03 May '01

03 May '01

After much frustration, I decided to simply add a umask(000) to the beginning of main() in order to alleviate troubles I've been having with the perm() and dir_perm() configuration directives. One thing, though, that I think is needed in the config that doesn't currently exist is dir_user() and dir_group() directives to control the ownership of created directories. Would anyone else find this useful? Chris Sibbitt JetNet Internetworking Services Inc. Providing Secure Internet Communications Phone 613-271-6220x228 FAX 613-271-6229 Email csibbitt(a)jetnet.ca Web www.jetnet.ca <http://www.jetnet.ca/>

1 0

$PROGRAM
by Saku Ytti 03 May '01

03 May '01

I'd like to use destination all with $PROGRAM, but rather than creating PROGRAM like it's reported, I'd like to use filename as it is after last '/'. ie. /usr/sbin/cron would be just cron. Also some other magic could be done to check it's sanity. I'm just checking if there is already a patch, so that I wouldn't need to revinvent the wheel. -- ytti

1 0

[PATCH] chroot and drop root priviledges
by Tommi Virtanen 02 May '01

02 May '01

# This is for the Debian bug tracking system, see http://bugs.debian.org/94898 forwarded 94898 syslog-ng(a)lists.balabit.hu thanks Here's a patch to implement -C, -u and -g command line options, for chrooting, changing uid and gid, respectively. My syslog-ng is happily chrooted into /var/log/syslog-ng, and runs as syslogng:syslogng. Notes: - it still needs write access to the logs; I just chowned the tree to syslogng - it binds to /dev/log etc before chroot/userid switch, so it still works; however, if you change sources and try to reload config, it probably won't have access to open the new sources. - if you store the config outside the chroot, reload won't work. - I had to change the child->parent notify mechanism, as the old kill(getppid(), SIGTERM) trick didn't work after the uid switch. Now it has a pipe open to parent, parent waits on read(). I took the opportunity to make it signal success to the parent by writing a nil byte; parent changes exit value based on whether it saw the nil or not. diff -Naur syslog-ng-1.5.4.original/src/main.c syslog-ng-1.5.4/src/main.c --- syslog-ng-1.5.4.original/src/main.c Wed Nov 29 13:21:31 2000 +++ syslog-ng-1.5.4/src/main.c Sun Apr 22 21:36:14 2001 @@ -38,6 +38,8 @@ #include <errno.h> #include <string.h> #include <getopt.h> +#include <pwd.h> +#include <grp.h> #include "main.c.x" @@ -186,13 +188,29 @@ return 0; } +#define READ 0 +#define WRITE 1 void go_background() { pid_t pid; - + int pipefd[2]; + char buf; + + if (pipe(pipefd) < 0) { + werror("Cannot pipe(), (%z)\n", strerror(errno)); + exit(1); + } pid = fork(); if (pid == 0) { - int fd = open(pidfilename, O_CREAT | O_WRONLY | O_NOCTTY | O_TRUNC, 0600); + int fd; + if (pipefd[WRITE]!=1) { + if (dup2(pipefd[WRITE], 1) < 0) { + werror("Cannot set pipe as stdout, (%z)\n", strerror(errno)); + exit(1); + } + (void) close(pipefd[WRITE]); + } + fd = open(pidfilename, O_CREAT | O_WRONLY | O_NOCTTY | O_TRUNC, 0600); if (fd != -1) { struct ol_string *pid_s = c_format("%i\n", getpid()); write(fd, pid_s->data, pid_s->length); @@ -205,10 +223,13 @@ werror("Cannot fork(), (%z)\n", strerror(errno)); exit(1); } - signal(SIGTERM, sig_term); - while (sigtermrecvd == 0) - pause(); - exit(0); + + if (read(pipefd[READ], &buf, 1) == 1 + && buf=='\0') { + exit(0); + } else { + exit(1); + } } void usage(void) @@ -221,6 +242,9 @@ " -f <fname>, --cfgfile=<fname> Set config file name, default=" PATH_SYSLOG_NG_CONF "\n" " -V, --version Display version number (" PACKAGE " " VERSION ")\n" " -p <fname>, --pidfile=<fname> Set pid file name, default=" PATH_PIDFILE "\n" + " -C <dir>, --chroot=<dir> Chroot to directory\n" + " -u <user>, --user=<user> Switch to user\n" + " -g <group>, --group=<group> Switch to group\n" #ifdef YYDEBUG " -y, --yydebug Turn on yacc debug messages\n" #endif @@ -233,10 +257,45 @@ extern int yydebug; #endif +void nametouidgid(const char* user, uid_t *uid, gid_t *gid) +{ + struct passwd* pw; + pw = getpwnam(user); + + if (pw) { + *uid=pw->pw_uid; + if (gid) + *gid=pw->pw_gid; + } +} + +void nametogid(const char* group, gid_t *gid) +{ + struct group* gr; + gr = getgrnam(group); + + if (gr) { + *gid=gr->gr_gid; + } +} + +int dropprivileges(uid_t uid, gid_t gid) +{ + if ( setgid(gid) != 0 || setuid(uid) != 0 ) { + return -1; + } else { + return 0; + } +} + + int main(int argc, char **argv) { int do_fork = 1; int opt; + char *chrootdir = NULL; + uid_t uid = 0; + gid_t gid = 0; NEW(syslog_backend, backend); struct option syslog_ng_options[] = { @@ -246,6 +305,9 @@ { "verbose", no_argument, NULL, 'v' }, { "help", no_argument, NULL, 'h' }, { "version", no_argument, NULL, 'V' }, + { "chroot", required_argument, NULL, 'C' }, + { "user", required_argument, NULL, 'u' }, + { "group", required_argument, NULL, 'g' }, #ifdef YYDEBUG { "yydebug", no_argument, NULL, 'y' }, #endif @@ -257,7 +319,7 @@ gc_idle_threshold = 100; gc_busy_threshold = 3000; - while ((opt = getopt_long(argc, argv, "f:p:dvhyV", syslog_ng_options, NULL)) != -1) { + while ((opt = getopt_long(argc, argv, "f:p:dvhC:u:yV", syslog_ng_options, NULL)) != -1) { switch (opt) { case 'f': strncpy(cfgfilename, optarg, sizeof(cfgfilename)); @@ -265,6 +327,21 @@ case 'p': strncpy(pidfilename, optarg, sizeof(pidfilename)); break; + case 'C': + if (!optarg[0]) + usage(); + chrootdir = optarg; + break; + case 'u': + nametouidgid(optarg, &uid, gid ? NULL : &gid); + if (uid == 0 || gid == 0) + usage(); + break; + case 'g': + nametogid(optarg, &gid); + if (gid == 0) + usage(); + break; case 'd': debug_flag++; break; @@ -286,6 +363,8 @@ } } + if (uid == 0 && gid != 0) + werror("Cannot use -g without -u"); init_backend(&backend->super); backend->configuration = make_syslog_config(cfgfilename, &backend->super); @@ -301,17 +380,28 @@ } if (!CONFIG_INIT(backend->configuration, NULL)) { werror("Error initializing configuration, exiting.\n"); - if (do_fork) kill(getppid(), SIGTERM); return 2; } + if (chrootdir) { + if (chroot(chrootdir) < 0) { + werror("Error chrooting, exiting.\n"); + return 3; + } + } + if (uid) { + if (dropprivileges(uid, gid) < 0) { + werror("Error in setuid/setgid, exiting.\n"); + return 4; + } + } if (do_fork) { set_error_internal(); close(0); - close(1); close(2); setsid(); - kill(getppid(), SIGTERM); + write(1, "", 1); + close(1); } notice("syslog-ng version %z starting\n", VERSION); return main_loop(backend); -- tv@{{hq.yok.utu,havoc,gaeshido}.fi,{debian,wanderer}.org,stonesoft.com} unix, linux, debian, networks, security, | First snow, then silence. kernel, TCP/IP, C, perl, free software, | This thousand dollar screen dies mail, www, sw devel, unix admin, hacks. | so beautifully.

2 1

RE: [syslog-ng]Syslog messages are getting combined...
by Scott, Joshua 02 May '01

02 May '01

Here are a few lines from syslog that are combined... Apr 26 13:46:20 dnsserver OK" proto=ht<27>named[10268]: check_hints: no A records for nccnt01.jacobs.com class 1 in hints Apr 26 13:46:20 dnsserver 0 OK" proto<29>named[10268]: check_root: 1 root servers after query to root server < min Apr 26 13:57:40 dnsserver - Bryan, TX\\\"<p<29>named[9492]: starting (/etc/named.conf). named 8.2.3-REL After the time and the hostname there is some extra data that comes from my firewalls syslog messages. Then comes named and it's data. -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, April 27, 2001 1:59 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Syslog messages are getting combined... On Thu, Apr 26, 2001 at 01:47:17PM -0400, Scott, Joshua wrote: > Has anyone ever had an issue where sometimes you get the information from > one syslog message combined with another syslog message? Every one in a > while I get some of my firewall syslog messages combined with messages from > my DNS servers. This causes my scripts to fail since there is invalid data > in the log message. Can anyone shed some light for me? Thank you very > much! Could you send me some examples. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Does syslog-ng have a message character limit?
by Brian Leveille 02 May '01

02 May '01

I have a device sending syslog messages that are getting truncated to 250 characters. Anyone else seen this with syslog-ng? Brian Leveille ------------------- Senior Internetworking Engineer DefendNet Solutions, Inc. http://www.defendnet.com

3 2

-HUP to 1.4.11 doesn't close file descriptors?
by Adrian Chung 01 May '01

01 May '01

Hi all, I'm noticing some strange behaviour with syslog-ng 1.4.11 and libol 0.2.21. I've got named running in a chroot'd environment, with it's own /var/named/dev/log. Syslog-ng is configured to use both /dev/log and /var/named/dev/log as unix-stream sources, with output going to /var/daemon.log. When I logrotate the /var/log/daemon.log file, logging from named completely stops. It doesn't appear anywhere. Even after sending HUP signals to both named and syslog-ng. The only way that logging resumes is if I completely kill and restart syslog-ng. Seems like syslog-ng isn't flushing it's file handles? -- Adrian Chung - adrian(a)enfusion-group.com http://www.enfusion-group.com/~adrian 1:23pm up 75 days, 19:21 - [rogue.enfusion-group.com]

2 1

Future plans and ideas for syslog-ng...
by Nick DeClario 30 Apr '01

30 Apr '01

Hey guys, I was wondering what ideas and improvements are in the works for syslog-ng? Any thoughts or plans for including encryption in a future release? Regards, -Nick

1 0

syslog for proxy
by Cafferata Cristiano 27 Apr '01

27 Apr '01

hi, i'm looking for a program for nt platform able to receive syslogs from a proxy server .... it's the first time that i talk about syslog and it's the first time that i have to use it ..... please help me... thanks a lot and sorry for my english . bye * * * * * * * * * * * * * * * Cristiano Cafferata CC4191-RIPE ESPLIT Spa Servizio Tecnico Cristiano.Cafferata(a)esplit.it Via SS Giacomo e Filippo 19/6 16122 - Genova - Italy Phone +39 010881825 Fax +39 010 882743 * * * * * * * * * * * * * * *

1 0

Syslog messages are getting combined...
by Scott, Joshua 27 Apr '01

27 Apr '01

Has anyone ever had an issue where sometimes you get the information from one syslog message combined with another syslog message? Every one in a while I get some of my firewall syslog messages combined with messages from my DNS servers. This causes my scripts to fail since there is invalid data in the log message. Can anyone shed some light for me? Thank you very much! Joshua Scott Jacobs Engineering

3 2

Secure syslog-ng.
by Scott A. McIntyre 27 Apr '01

27 Apr '01

Hi, I was looking for a way to have a secured form of syslog-ng and the most obvious way that came up (without playing IPSEC games) was to use SSH with remote port forwarding. After mucking about with the configurations for an hour (apparently, destination and source descriptors take different syntax for specifying a network connection -- annoyingly undocumented) I got things working more or less as I'd like...however, I did notice that after a few messages sent through this way OpenSSH would die (the main daemon itself, not the one doing the port forwarding). I know this may seem unrelated and the version of OpenSSH (2.3.0p1) wasn't the most up to date (now upgraded) but this was repeatable behaviour. Has anyone else tried such a setup and noticed anything curious about how things interact? Any other solutions for a secured implementation of syslog-ng would also be appreciated. I think that this method will serve me well, after I get the configurations all tweaked and tuned to operate properly. Regards, Scott

2 1

RE: [syslog-ng]Syslog messages are getting combined...
by Andrew Fort 27 Apr '01

27 Apr '01

There was a bug in syslog-ng in one of the 1.4.x releases that caused this to happen. I dont have this prob any longer with 1.5.3, and from memory it was fixed in 1.4.10 (check the CHANGELOG perhaps?) -afort >Hi Joshua, > >I installed the lastest version of syslog-ng on our central >loghost last days. >I have the same problem. Our firewall logs get meshed with the >Catalyst Logs >etc. >Well... I havent figured out the error yet, but I think there >may be a problem >when u use same filters for different sources (What we do.. >cos the Cisco IOS >Msg'es are all the same :-) >We do a first a hostcheck [ host("hostname") ] and then a >contentcheck [ >match("<cisco-msg'es>") ]. >If this all doesnt match the stuff goes into the DEFAULT log file. > >Gotta investigate it tomorrow :) > >Bye > >"Scott, Joshua" wrote: > >> Has anyone ever had an issue where sometimes you get the >information from >> one syslog message combined with another syslog message? >Every one in a >> while I get some of my firewall syslog messages combined >with messages from >> my DNS servers. This causes my scripts to fail since there >is invalid data >> in the log message. Can anyone shed some light for me? >Thank you very >> much! >> >> Joshua Scott >> Jacobs Engineering

1 0

Re: [syslog-ng]Linefeed in incoming messages
by Michael.Garvin＠carolinabroadband.com 26 Apr '01

26 Apr '01

In doing some further debugging to the hack I posted to work around the logging problems with the Cisco VPN3000 I discovered some changes that need to be made to not break TCP-based logging. Here's the updated code, with the existing prefix line for positioning: closure->pos += n; start = closure->buffer + 1; eol = closure->buffer + closure->pos - 1; while (start++ < eol) if ((start[-1] == 0x0a) && (start[0] != 0x3c)) start[-1] = ' '; Sorry about that... -- Michael Garvin mailto:mgarvin@carolinabroadband.com

1 0

RE: [syslog-ng]Cisco Logging
by Shaw, Richard W 23 Apr '01

23 Apr '01

Hi Drew I've tried your extra setting but I still get nothing about our cisco routers in the cisco.log or the sys.log files I'd setup for syslog-ng. I do however still get them via the syslogd. Is there something I'm missing out of the source bit of the code ? Regards Richard > -----Original Message----- > From: Hamilton, Andrew Mr RAYTHEON 5 SIG CMD > [SMTP:HamiltonA@hq.5sigcmd.army.mil] > Sent: Friday, 6 April 2001 4:03 pm > To: 'syslog-ng(a)lists.balabit.hu' > Subject: RE: [syslog-ng]Cisco Logging > > Richard, > > syslog-ng does a considerably better job at filtering than does syslogd. > This can cause you problems if you are not looking at it correctly. > syslogd > will log up to a priority for a facility in the syslog.conf. syslog-ng > will > log only that facility given in the syslog-ng.conf. Cisco devices log at > the info level by default. So only if you are getting something from the > Cisco devices at the debug level. If you want the same behavior as in > syslogd you need to set your filter to "priority(info..debug)". > > Regards, > Drew > > > -----Original Message----- > > From: Shaw, Richard W [SMTP:Richard.W.Shaw@team.telstra.com] > > Sent: Friday, April 06, 2001 9:50 AM > > To: 'syslog-ng(a)lists.balabit.hu' > > Subject: [syslog-ng]Cisco Logging > > > > Hi Guys > > > > I've just found syslog-ng and am testing/comparing it to our current > > syslogd > > so I can match the logging then push everything to a syslog server. > > > > My problem is that I'm getting no logs for Cisco devices, I don't even > get > > anything in the sys.log file(see below): > > > > syslogd.conf file : > > local7.debug /var/log/cisco.log > > > > syslog-ng.conf file: > > source src { > > udp(); > > tcp(); > > sun-streams("/dev/log" door("/etc/.syslog_door")); > > internal(); > > }; > > destination d_mail { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/mail.log" > > create_dirs(yes) > > ); }; > > destination d_cisco { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/cisco.log" > > create_dirs(ye > > s)); }; > > destination d_sshd { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sshd.log" > > create_dirs(yes > > )); }; > > destination d_tac { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/tacplus.log" > > create_dirs(y > > es)); }; > > > > destination d_sys { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sys.log" > > create_dirs(yes)) > > ; }; > > > > filter f_mail { facility(mail); }; > > filter f_cisco { facility(local7) and priority(debug); }; > > filter f_sshd { match("sshd"); }; > > filter f_tac { facility(local6); }; > > > > log { source(src); filter(f_mail); destination(d_mail); }; > > log { source(src); filter(f_cisco); destination(d_cisco); }; > > log { source(src); filter(f_sshd); destination(d_sshd); }; > > log { source(src); filter(f_tac); destination(d_tac); }; > > > > > > log { source(src); destination(d_sys); }; > > > > > > Thanks in advance for any help > > > > Regards > > Richard Shaw > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Syslog-ng dies with logrotate
by Simeon Johnston 20 Apr '01

20 Apr '01

We am using logrotate to rotate our logs and when I send syslog-ng the HUP signal it dies. We am using version 1.4.11. Here is the config for logrotate. /var/log/serv/VPN.log { postrotate kill -HUP `cat /var/run/syslog-ng.pid` endscript } This is the same rule we use for all the logs. I thought the HUP signal problem was fixed? Should I try the newest 1.5.x version? Would this command work better? killall -HUP syslog-ng Thank you, sim

1 0