- syslog-ng - lists.balabit.hu

do_recv() problem with 1.4.9
by Alex Howansky 23 Nov '00

23 Nov '00

Hello, I just upgraded from 1.4.8 to 1.4.9. I compiled with the default options and I'm using the same configuration file as I did with 1.4.8. The only thing that has changed is the syslog-ng binary itself. When I started 1.4.9, it wasn't logging normal events. I have the "internal" messages logging to a separate file, so I checked that. In the few minutes that had passed since I started the daemon, the file had filled up to 250 meg with continuous repetitions of this message: Nov 22 12:43:30 flogm syslog-ng[27074]: io.c: do_recv(): Zero length read was requested. Any ideas? -- Alex Howansky Wankwood Associates http://www.wankwood.com/

2 2

Solaris Question
by Jesse Keefe 23 Nov '00

23 Nov '00

I had a question about when support for Solaris 8 will be available for syslog-ng? Thanks, Jesse Keefe Analyst Convergys IMG Cincinnati Oh 513-723-3689

2 1

"message-only" logging
by Andrew Fort 23 Nov '00

23 Nov '00

Is there a way to configure syslog-ng, using the file() output driver, to write JUST the message (no timestamp) to the output? Thanks, -- andrew fort

1 0

RE: [syslog-ng]config questions
by Andrew Fort 23 Nov '00

23 Nov '00

> I also vaguely remember someone mentioning a way of outputting all > the log messages that don't get caught by any filter rules to a file. > Anyone know what I'm talking about? It's basically to check that I'm > not missing anything important with my current config. yep, there is a predefined filter named "DEFAULT" which should do what you're after.

2 1

config questions
by MagerValp 23 Nov '00

23 Nov '00

With the sync parameter i can set how many lines are buffered before logs are written to disk, but is it possible to have this buffer flushed after a certain time period? Running with sync(0) eats up too much I/O-performance. I also vaguely remember someone mentioning a way of outputting all the log messages that don't get caught by any filter rules to a file. Anyone know what I'm talking about? It's basically to check that I'm not missing anything important with my current config. Another problem is a bug in Solaris 7 that causes a lot of messages like this to show up in the logs: Nov 9 19:24:08 src@enterprise top[7530]: ypbind client: can't get rdev Nov 9 19:24:37 src@enterprise top[7535]: ypbind client: can't get rdev Nov 9 19:24:42 src@enterprise top[7537]: ypbind client: can't get rdev Nov 9 19:24:46 src@enterprise top[7539]: ypbind client: can't get rdev Nov 10 05:40:00 src@enterprise ypcat[11591]: ypbind client: can't get rdev Nov 10 05:40:00 src@enterprise ypcat[11591]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise yppush[11595]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise ypxfr[11596]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise ypxfr[11596]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise ypcat[11605]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise ypcat[11605]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise yppush[11609]: ypbind client: can't get rdev There's a fix but it requires a reboot and that won't happen for a while on the log server. Is there a way of filtering out these messages? I guess putting and not match("client: can't get rdev") in all the filter rules should work, but I'm looking for a more elegant solution. Thanks, -- ___ . . . . . + . . o _|___|_ + . + . + . . Per Olofsson, konstnär o-o . . . o + MagerValp(a)cling.gu.se - + + . http://www.cling.gu.se/~cl3polof/

1 0

problem with syslog-ng 1.4.9
by Marko Veelma 22 Nov '00

22 Nov '00

Hi, after upgrade from 1.4.5 to 1.4.9: Nov 16 00:04:11 backup syslog-ng[6797]: syslog-ng version 1.4.5 starting Nov 22 23:09:11 backup syslog-ng[27598]: syslog-ng version 1.4.9 starting Nov 22 23:10:00 backup syslog-ng[27598]: io.c: do_recv(): Zero length read was requested. Nov 22 23:10:00 backup syslog-ng[27598]: io.c: do_recv(): Zero length read was requested. Nov 22 23:10:00 backup syslog-ng[27598]: io.c: do_recv(): Zero length read was requested. [--- 160588 lines deleted ---] Nov 22 23:10:21 backup syslog-ng[27598]: io.c: do_recv(): Zero length read was requested. Nov 22 23:10:21 backup syslog-ng[27598]: io.c: do_recv(): Zero length read was requested. Nov 22 23:10:21 backup syslog-ng[27598]: io.c: do_recv(): Zero length read was requested. Nov 22 23:10:31 backup syslog-ng[27864]: syslog-ng version 1.4.5 starting It generates 160594 lines of this error within 21 sec. Environment: SuSE Linux 7.0, kernel 2.2.16 (SuSE default), i686, shlibs 2.1.3-134 --- Cougar

1 0

RE: [syslog-ng]Solaris Question
by Ohrberg, Mick 22 Nov '00

22 Nov '00

I am currently running syslog-ng on several Solaris8 boxes with absolutely no problem. > -----Original Message----- > From: Jesse Keefe [mailto:jkeefe@convergys.com] > Sent: Wednesday, November 22, 2000 11:07 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Solaris Question > > > I had a question about when support for Solaris 8 will be available > for syslog-ng? > > > Thanks, > > Jesse Keefe > Analyst > Convergys IMG > Cincinnati Oh > > 513-723-3689 > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

remote DoS in syslog-ng
by Balazs Scheidler 22 Nov '00

22 Nov '00

Here's the security advisory I'm about to send to bugtraq. Everyone is urged to upgrade. BalaBit security advisory Advisory ID: BB-2000/01 Package: syslog-ng Versions affected: versions prior to and including 1.4.8 Problem type: remote DoS attack 1) Background syslog-ng is a portable syslog implementation. Its highlights include regexp based log selection, TCP transport and more. For more information: http://www.balabit.hu/products/syslog-ng/ 2) Problem description When syslog-ng parses log messages a variable named "left" is used to store the remaining length of the log message. The priority part in the message should look like this: <6> When the line ends without the closing '>' this "left" variable becomes -1 due a to a bug. The remaining part of the message parsing routine checks if there's any characters left using the condition: left != 0, since -1 is not 0, this condition evaluates to true. Syslog-ng versions after 1.4.7 filters out \r and \n characters from log messages and replaces them with spaces to avoid cluttering logfiles. Due to a problem in the parsing of log messages, this character change may access unaccessible memory region. This causes a segmentation fault. So sending a "<6", terminated with a newline to one of the input channels causes a SIGSEGV. Prior to 1.4.7, this character change was not implemented, so mounting a DoS attack is not so trivial, but is still possible. (it's left to the reader as an exercise) It is believed that no other exploitation is possible. 3) Impact Sending a carefully crafted syslog packet may cause syslog-ng to exit with a Segmentation Fault. 4) Solution Upgrade syslog-ng to 1.4.9, which is a security upgrade, and changes nothing compared to 1.4.8 or apply this patch: diff -urN syslog-ng-1.4.8/src/log.c syslog-ng-1.4.9/src/log.c --- syslog-ng-1.4.8/src/log.c Tue Oct 10 15:05:52 2000 +++ syslog-ng-1.4.9/src/log.c Wed Nov 22 16:45:11 2000 @@ -67,8 +67,10 @@ left--; } lm->pri = pri; - src++; - left--; + if (left) { + src++; + left--; + } } else { lm->pri = LOG_USER | LOG_NOTICE; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

dmesg
by B. Weldon 20 Nov '00

20 Nov '00

I have syslog-ng ver 1.4.0.rc3 w/ libol 0.2.16 running on Solaris 2.6. The problem I am having is when I roll the syslog file and HUP syslog, upon syslog-ng's restart, it dump's me an output from dmesg which is very annoying to the network monitoring system's output... Is there a way to get ride of this functionality without building elaborate filters to catch all the dmesg stuff? I don't want the dmesg stuff at all. Thanks...

1 0

RE: [Fwd: RE: [syslog-ng]Odd problem]
by Hamilton, Andrew Mr. 20 Nov '00

20 Nov '00

Sometimes I lose messages. Usually our analysts get things rerouted fairly swiftly so for the most part I don't lose too much, but in a network as large as ours it is impossible to get every message anyway. We usually have multiple routes to most of our regions. I realize that in life sometimes there are things that you can't do anything about. This is one of them. There are way too many devices for me to keep track of EVERY message from ALL of them. I do my best to get what they send and that is all I can do. syslog-ng is considerably better at helping me do that than syslogd. Regards Drew > -----Original Message----- > From: Przemek Bak [SMTP:przemolicc@poczta.fm] > Sent: Monday, November 20, 2000 11:59 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [Fwd: RE: [syslog-ng]Odd problem] > > ----- Forwarded message from "Hamilton, Andrew Mr." > <HamiltonA(a)hq.5sigcmd.army.mil> ----- > > > From: "Hamilton, Andrew Mr." <HamiltonA(a)hq.5sigcmd.army.mil> > > To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> > > Subject: RE: [syslog-ng]Odd problem > > Date: Fri, 17 Nov 2000 12:31:40 +0100 > > > > Actually yes. I use syslog-ng to log from about 1500 sources. Most of > it > > is not real intense, but I get around 5 gigabytes per day. I use every > > facility. Some of the facilities are used for more than one program. > Which > > before syslog-ng wasn't possible to do. The granularity I get from > syslog-ng > > is considerably better than syslogd and my life is much simpler for it. > > Because of our security processes the logging from the routers used to > go > > three places, our security people, our sysadmins, and our management > tools. > > The router was sending every message three times. Now they go to our > > central system and the logs that need to go to the security people are > > forwarded to them and the same with our management tools, with the > correct > > host name. And the traffic is much less over the WAN. Which was the > goal > > of the exercise. I would say for us that syslog-ng has been very > > successful. > > How do you manage when part of the net is down ? For example, > router is sending messages to your central logging host, > but the messages go through another router which is down for a while. > > > przemol > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

[Fwd: RE: [syslog-ng]Odd problem]
by Przemek Bak 20 Nov '00

20 Nov '00

----- Forwarded message from "Hamilton, Andrew Mr." <HamiltonA(a)hq.5sigcmd.army.mil> ----- > From: "Hamilton, Andrew Mr." <HamiltonA(a)hq.5sigcmd.army.mil> > To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> > Subject: RE: [syslog-ng]Odd problem > Date: Fri, 17 Nov 2000 12:31:40 +0100 > > Actually yes. I use syslog-ng to log from about 1500 sources. Most of it > is not real intense, but I get around 5 gigabytes per day. I use every > facility. Some of the facilities are used for more than one program. Which > before syslog-ng wasn't possible to do. The granularity I get from syslog-ng > is considerably better than syslogd and my life is much simpler for it. > Because of our security processes the logging from the routers used to go > three places, our security people, our sysadmins, and our management tools. > The router was sending every message three times. Now they go to our > central system and the logs that need to go to the security people are > forwarded to them and the same with our management tools, with the correct > host name. And the traffic is much less over the WAN. Which was the goal > of the exercise. I would say for us that syslog-ng has been very > successful. How do you manage when part of the net is down ? For example, router is sending messages to your central logging host, but the messages go through another router which is down for a while. przemol

1 0

RE: [syslog-ng]Odd problem
by Hamilton, Andrew Mr. 17 Nov '00

17 Nov '00

Actually yes. I use syslog-ng to log from about 1500 sources. Most of it is not real intense, but I get around 5 gigabytes per day. I use every facility. Some of the facilities are used for more than one program. Which before syslog-ng wasn't possible to do. The granularity I get from syslog-ng is considerably better than syslogd and my life is much simpler for it. Because of our security processes the logging from the routers used to go three places, our security people, our sysadmins, and our management tools. The router was sending every message three times. Now they go to our central system and the logs that need to go to the security people are forwarded to them and the same with our management tools, with the correct host name. And the traffic is much less over the WAN. Which was the goal of the exercise. I would say for us that syslog-ng has been very successful. Thanks > -----Original Message----- > From: Balazs Scheidler [SMTP:bazsi@balabit.hu] > Sent: Friday, November 17, 2000 11:52 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Odd problem > > > hostname, gw1, ts1, etc. This is insufficient since we have over 1100 > > routers to maintain. There are many gw1's and gw2's, etc. As soon as I > > turned on use_fqdn and started getting the domain name added on, which > is > > sufficient to identify the source, all is great from my perspective. > > I'd be interested if syslog-ng is used to collect all logs from these > routers. If yes, I think we found a great success story :) > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Odd problem
by Hamilton, Andrew Mr. 17 Nov '00

17 Nov '00

I wish I could retract this since the solution was simple. But since I posted it I guess I should at least qualify this. This turned out to be not a problem with the syslog at all. It was a problem with the person looking at the logs who claimed there was a problem and at first glance I thought it was a problem. After doing more digging I found that the routers actually send the their log messages exactly as they appear in the log file. The three letter region specification on the front turns out to be an alias that the network analysts were using. Since I mostly do internal logging I didn't have use_fqdn turned on and the only thing they were seeing was the hostname, gw1, ts1, etc. This is insufficient since we have over 1100 routers to maintain. There are many gw1's and gw2's, etc. As soon as I turned on use_fqdn and started getting the domain name added on, which is sufficient to identify the source, all is great from my perspective. Thanks for your time and sorry to bother everyone. Drew > -----Original Message----- > From: Hamilton, Andrew Mr. [SMTP:HamiltonA@hq.5sigcmd.army.mil] > Sent: Wednesday, November 15, 2000 3:06 PM > To: 'syslog-ng(a)lists.balabit.hu' > Subject: [syslog-ng]Odd problem > > I am getting something very strange in my syslogs. This doesn't happen > for > every host but it appears that most of the hostnames are getting the front > truncated. Here is a sample of the logfile and my config file. I am > running syslog-ng 1.4.7. > > Nov 15 13:57:03 gw1.hanau.army.mil 172593: Nov 15 13:57:18: > %SEC-6-IPACCESSLOGP: list 196 permitted tcp 140.156.30.6(48879) -> > 192.73.27.115(33658), 725 packets > Nov 15 13:57:03 gw7.mannheim.army.mil 93065: Nov 15 13:57:18: > %LANCE-5-LATECOLL: Unit 0, late collision error > Nov 15 13:57:03 bggw.heidelberg.army.mil 3078332: Nov 15 13:57:18: > %SEC-6-IPACCESSLOGP: list 191 denied tcp 64.4.16.24(80) -> > 147.37.199.194(1509), 1 packet > Nov 15 13:57:03 bggw.ansbach.army.mil 437279: Nov 15 13:57:18: > %SEC-6-IPACCESSLOGP: list 193 denied udp 136.218.199.6(1704) -> > 169.254.102.246(1112), 1 packet > Nov 15 13:57:03 BGGW-ETHER0-1.STUTTGART.ARMY.MIL 1236689: 6w6d: > %SEC-6-IPACCESSLOGP: list 192 permitted tcp 199.211.200.34(1488) -> > 136.221.21.11(80), 6 packets > > The hostname should have hnu-gw1.hanau.army.mil in the first one and > likewise for the rest. There is some 3 letter representation of the > region > on the front of the hostname. Here is my config, partly anyway. > > options { long_hostnames(yes); use_fqdn(yes); chain_hostnames(no); > sync(0); > keep_hostname(yes); create_dirs(yes); }; > source src { sun-streams("/dev/log" door("/etc/.syslog_door")); > internal(); > udp(); }; > > destination d_cisco { file("/logs/cisco/ciscologs"); }; > > destination d_reno { udp("host.mydomain.mil"); }; > > filter f_cisco { facility(local7) }; > > log { source(src); filter(f_cisco); destination(d_cisco); > destination(d_host); }; > > Seems to actually function fine but is truncating the front part. > > Any ideas? > > Regards, > Drew > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Odd problem
by Hamilton, Andrew Mr. 15 Nov '00

15 Nov '00

I am getting something very strange in my syslogs. This doesn't happen for every host but it appears that most of the hostnames are getting the front truncated. Here is a sample of the logfile and my config file. I am running syslog-ng 1.4.7. Nov 15 13:57:03 gw1.hanau.army.mil 172593: Nov 15 13:57:18: %SEC-6-IPACCESSLOGP: list 196 permitted tcp 140.156.30.6(48879) -> 192.73.27.115(33658), 725 packets Nov 15 13:57:03 gw7.mannheim.army.mil 93065: Nov 15 13:57:18: %LANCE-5-LATECOLL: Unit 0, late collision error Nov 15 13:57:03 bggw.heidelberg.army.mil 3078332: Nov 15 13:57:18: %SEC-6-IPACCESSLOGP: list 191 denied tcp 64.4.16.24(80) -> 147.37.199.194(1509), 1 packet Nov 15 13:57:03 bggw.ansbach.army.mil 437279: Nov 15 13:57:18: %SEC-6-IPACCESSLOGP: list 193 denied udp 136.218.199.6(1704) -> 169.254.102.246(1112), 1 packet Nov 15 13:57:03 BGGW-ETHER0-1.STUTTGART.ARMY.MIL 1236689: 6w6d: %SEC-6-IPACCESSLOGP: list 192 permitted tcp 199.211.200.34(1488) -> 136.221.21.11(80), 6 packets The hostname should have hnu-gw1.hanau.army.mil in the first one and likewise for the rest. There is some 3 letter representation of the region on the front of the hostname. Here is my config, partly anyway. options { long_hostnames(yes); use_fqdn(yes); chain_hostnames(no); sync(0); keep_hostname(yes); create_dirs(yes); }; source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; destination d_cisco { file("/logs/cisco/ciscologs"); }; destination d_reno { udp("host.mydomain.mil"); }; filter f_cisco { facility(local7) }; log { source(src); filter(f_cisco); destination(d_cisco); destination(d_host); }; Seems to actually function fine but is truncating the front part. Any ideas? Regards, Drew

1 0

Question about program()
by Hyunmoo Rhee 15 Nov '00

15 Nov '00

I installed syslog-ng-1.4.8 yesterday. but program() wasn't operate. why it doesn't operate? my syslog-ng.conf is here. =====================================START======================== options { use_dns(no); }; source router_src { udp(port(514)); }; destination router_total_log { file("/root/logfile/router_total_log"); program(/root/sample.sh); }; destination deny_tcp_all_log { file("/root/logfile/deny_tcp_all_log"); }; destination deny_udp_all_log { file("/root/logfile/deny_udp_all_log"); }; filter deny_tcp_all { match("tcp"); }; filter deny_udp_all { match("udp"); }; log { source(router_src); destination(router_total_log); }; log { source(router_src); filter(deny_tcp_all); destination(deny_tcp_all_log); }; log { source(router_src); filter(deny_udp_all); }; =================================END====================== sample.sh is simple script. (echo asdf >> /root/sample.txt) but doesn't operate. shell script permission is 755. .....

2 1

RE: [syslog-ng]Question about program()
by Hamilton, Andrew Mr. 15 Nov '00

15 Nov '00

In your destination statement for router_total_log you actually have two destinations, while I haven't actually seen in the docs that this isn't possible, it is probably not a good practice. Set up two destinations, one for the file and one for the program, then in your log statement give it two destination statements. That works for me, so no reason to think it won't for you. Regards Drew > -----Original Message----- > From: Hyunmoo Rhee [SMTP:rossi@dreamwiz.com] > Sent: Wednesday, November 15, 2000 8:45 AM > To: syslog-ng > Subject: [syslog-ng]Question about program() > > I installed syslog-ng-1.4.8 yesterday. but program() wasn't operate. why > it doesn't operate? > my syslog-ng.conf is here. > =====================================START======================== > options { use_dns(no); }; > > source router_src { > udp(port(514)); > }; > > destination router_total_log { > file("/root/logfile/router_total_log"); > program(/root/sample.sh); > }; > > destination deny_tcp_all_log { > file("/root/logfile/deny_tcp_all_log"); > }; > > destination deny_udp_all_log { > file("/root/logfile/deny_udp_all_log"); > }; > > filter deny_tcp_all { > match("tcp"); > }; > > filter deny_udp_all { > match("udp"); > }; > > log { > source(router_src); > destination(router_total_log); > }; > > log { > source(router_src); > filter(deny_tcp_all); > destination(deny_tcp_all_log); > }; > > log { > source(router_src); > filter(deny_udp_all); > }; > =================================END====================== > > sample.sh is simple script. (echo asdf >> /root/sample.txt) > but doesn't operate. shell script permission is 755. > ..... > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

RE: [syslog-ng]umask settings?
by Andrew Fort 14 Nov '00

14 Nov '00

> whatever. I still > > might want to create output files with permissions appropriate to > > archive files or make them available for other legitimate users. > > I may add a chmod() call to enforce perm bits. What do others think? Perhaps a "override_umask()" boolean option (global or per destination), with the local overriding the global (so you can change the default to not interact with the umask). Of course, this requires the most code :) -- afort

2 1

umask settings?
by jon＠dumbo.pobox.com 14 Nov '00

14 Nov '00

i noticed something odd when in installed syslog-ng heres my current setup >Linux flatbox 2.4.0-test9 #4 Thu Oct 12 14:03:39 EDT 2000 i686 unknown >syslog-ng 1.4.8 (also had problem with 1.4.7) It seems that syslog-ng is ignoring perm(xxx) in favor of umask. heres the lines from syslog-ng.conf destination macrogenerateddaily { file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY" dir_perm(0755) perm(0644)); }; destination macrogeneratedhourly { file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY.$HOUR" dir_perm(0755) perm(0644)); }; now..when i start syslog-ng with umask 077, i get files generated as 0600 when i start with umask 022, i get files generated with as 0644. i though that perm and dir_perm were set while ignoring umask, this should be noted in the documentation if it uses umask as well. jon

3 3

1.4.8, Solaris and -lthread
by MagerValp 13 Nov '00

13 Nov '00

If you compile and install the latest syslog-ng under Solaris 7 it dies upon starting as it needs to be linked with -lthread to work. Sorry, didn't save the error message, but sticking -lthread in the Makefile fixed the problem. -- ___ . . . . . + . . o _|___|_ + . + . + . . Per Olofsson, konstnär o-o . . . o + MagerValp(a)cling.gu.se - + + . http://www.cling.gu.se/~cl3polof/

2 1

Filtering question
by nija＠magicaldesk.com 09 Nov '00

09 Nov '00

Hello all, I am having a problem with filtering. Here is my statement: filter noallnumbers { not program ("[0-9][0-9]*"); }; filter nostartperiod { not program ("^\." ); }; filter nostartslash { not program ("^\/" ); }; filter noparen1 { not program ("\\$" ); }; filter noparen2 { not program ("\\$" ); }; filter nocomma { not program ("\\\," ); }; filter nospace { not program ("\\\ " ); }; filter noamp { not program ("\\\@" ); }; filter goodlog { filter (noallnumbers) or filter(nostartperiod) or filter (nostartslash) or filter(noparen1) or filter (noparen2) or filter(nocomma) or filter (nospace) or filter(noamp); }; This statement does not work. If I take the top filter, noallnumbers, and use just that, the filter works. I am logging by program, so this is so I will not get error messages in the syslog-ng log. Any help? Thank you, Nija _____________________________________________________________ Global Virtual Desktop Get your free Desktop at http://www.magicaldesk.com

1 0

RE: [syslog-ng]Real time .conf?
by Brian Leveille 09 Nov '00

09 Nov '00

Bazsi & Matt, Thanks for your help. After strace-ing I found that the culprit was DNS. DNS lookups were blocking the daemon. Adding use_dns(no) to the global config fixed the problem. Messages are now being written to disk in real time and I am losing nothing! Now, if I want my 'pretty' directory structure and filenames do I add my remote machines to /etc/hosts or do I make my syslog-ng machine a caching name server? Will these block? Brian Leveille ------------------- Senior Internetworking Engineer DefendNet Solutions, Inc. www.defendnet.com -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, November 09, 2000 3:42 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Real time .conf? Hi, > Thanks. Somehow though, I don't think that worked. Here is my config file. > > # this file show more or less all the features of syslog-ng > > options {sync(0); create_dirs(yes);}; > > source int { unix-stream("/dev/log"); internal(); }; > source src { udp(port(514)); }; > > destination everything { > file("/NetscreenLogs/$HOST/$HOST.$MONTH-$DAY-$YEAR.log" > owner(NetscreenLogs) > group(NetscreenLogs) > perm(0777) > dir_perm(0777)); > }; > > destination internallogs { file("/var/log/messages"); }; > > > log { source(src); destination(everything); }; > log { filter(DEFAULT); destination(internallogs); }; > > > > All I am trying to do is have my remote boxes send their syslog messages to > my server, and have the server create some semblance of a directory > structure. Simple. > > But, when I watch packets with tcpdump, it seems there are A LOT more udp > port 514 packets than there are log records. My tcpdump sessions shows > hundreds of udp port 514 packets while my tail -f of my log RARELY updates. > > Am I losing data?!?!?!? I don't think so. Can you strace syslog-ng to see if it does receive those messages? strace -s 256 -p <pidofsyslog-ng> -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2

restarting syslog-ng
by Erich Reitz 09 Nov '00

09 Nov '00

Hi, When I restart syslog-ng, should I be restarting all other applications that write to the log files? I have noticed that when I restart syslog-ng (/etc/init.d/syslog restart - redhat 7) I will lose certain messages to my maillog from sendmail. If I don't restart my cron daemon, it no longer has any new messages in its log file (/var/log/cron). This is true of other apps as well. The stopping/restarting of syslog-ng is handled by redhat's "daemon syslog-ng" and "killproc syslog-ng" scripts within /etc/init.d/syslog.

3 3

RE: [syslog-ng]Real time .conf?
by Brian Leveille 09 Nov '00

09 Nov '00

Matt, Thanks. Somehow though, I don't think that worked. Here is my config file. # this file show more or less all the features of syslog-ng options {sync(0); create_dirs(yes);}; source int { unix-stream("/dev/log"); internal(); }; source src { udp(port(514)); }; destination everything { file("/NetscreenLogs/$HOST/$HOST.$MONTH-$DAY-$YEAR.log" owner(NetscreenLogs) group(NetscreenLogs) perm(0777) dir_perm(0777)); }; destination internallogs { file("/var/log/messages"); }; log { source(src); destination(everything); }; log { filter(DEFAULT); destination(internallogs); }; All I am trying to do is have my remote boxes send their syslog messages to my server, and have the server create some semblance of a directory structure. Simple. But, when I watch packets with tcpdump, it seems there are A LOT more udp port 514 packets than there are log records. My tcpdump sessions shows hundreds of udp port 514 packets while my tail -f of my log RARELY updates. Am I losing data?!?!?!? Brian Leveille ------------------- Senior Internetworking Engineer DefendNet Solutions, Inc. www.defendnet.com -----Original Message----- From: matthew.copeland(a)honeywell.com [mailto:matthew.copeland@honeywell.com] Sent: Wednesday, November 08, 2000 5:22 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: Re: [syslog-ng]Real time .conf? Add sync(0) to your config file. Matthew M. Copeland Software Engineer On Wed, 8 Nov 2000, Brian Leveille wrote: > What conf settings can I use for my syslog-ng.conf file so that messages are > written to disk the instant they are received? > > Thanks, > > Brian Leveille > ------------------- > Senior Internetworking Engineer > DefendNet Solutions, Inc. > www.defendnet.com > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Zorp
by Jay Soffian 09 Nov '00

09 Nov '00

Shawn, This might be useful for the bastion host: http://www.balabit.hu/products/zorp/ j.

1 0

Real time .conf?
by Brian Leveille 08 Nov '00

08 Nov '00

What conf settings can I use for my syslog-ng.conf file so that messages are written to disk the instant they are received? Thanks, Brian Leveille ------------------- Senior Internetworking Engineer DefendNet Solutions, Inc. www.defendnet.com

2 1