- syslog-ng - lists.balabit.hu

syslog-ng 1.1.33
by Balazs Scheidler 20 Oct '99

20 Oct '99

Hi, I've released a new version of syslog-ng. Nothing really new, just incorporated a few BSD build fixes, and reorganized the build system a bit. I'm taking part in the syslog-sec discussions initiated by the IETF. I'll try to keep syslog-ng up to date with respect with the new syslog specification. I've also updated the web page a bit: http://www.balabit.hu/products/syslog-ng -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

你有产品要在网上宣传吗？找我啊
by hello 16 Oct '99

16 Oct '99

你如果需要做广告，请你将你所要宣传的产品和对象告诉我，我会为你定制你所要的邮址，价格：30万邮址100元，送软件一套，一日内交货，我的邮箱用户名是usa123888或usa123168或usa123268或usa123368 邮箱是属于HOTMAIL.COM的请留你的邮箱地址以便联系，如果你不需要我看到我的广告，请发邮件到用户名usa123468 的hotmai。com中要求撤除你的邮箱地址。

1 0

Re: question on syslog-ng 1.1.32
by Balazs Scheidler 15 Oct '99

15 Oct '99

> Is it possible to make logs like the following: > > Oct 14 08:54:37 last/localhost message repeated 1 time > > unconditionally go through the filter of the message it is > referring to? With my current filtering, it is difficult to tell what > message this actually applies to because it gets written to a different > file than the message itself. Thanks for any help. syslog-ng currently doesn't generate such repetition messages, so it must be something that sends messages to syslog-ng, thus there's no way finding out which message it is referring to. In syslog-ng this will be implemented in the destination drivers, so these messages will go where the one they are referring to. -- Bazsi

1 0

Re: NG Syslog
by Balazs Scheidler 15 Oct '99

15 Oct '99

On Thu, Oct 14, 1999 at 04:05:10PM +0200, Kai U. Reichert wrote: > Hi! > > As I was browsing through your web-site some things were strange ? > Up to the time of Aug 29 you´ve released permanently a new version, but > the latest one is more than one month old; and the CVS-server is down ? > > Have you droped your project or will there be improvements ? > > I´m just asking, because I have need for an sophisticated syslog daemon. The project is not dropped, it's only on hold for some time while I have other things to do. 1.1.32 seemed to be quite stable at least on Linux and BSD. It's not named 1.2.0 yet, because Solaris is not fully supported, because I was unable to borrow an x86 Solaris CD. There are quite a few improvements planned in the next development cycle, for more information check the lists archives. The topic of my master's thesis is the cryptographic enhancements of syslog-ng, so it will definitely be finished until the end of the next semester. -- Bazsi

1 0

Using syslog-ng for NAS
by Naoto MATSUMOTO 12 Oct '99

12 Oct '99

Hi, all I have some question. The Balabit syslog-ng can be relaying UDP to TCP. source and destination syntax eg.) Syntax: udp <ipaddr>,<port>; Sends messages to the given host & port using UDP datagrams. Example: udp 193.6.40.37,514; Is it the best for this situation ? (1) old syslogd style [NAS]........UDP......................... .<Drop!> [NAS]........UDP.........................[Syslog]----IO->(Disk) .<Drop!> [NAS]........UDP......................... NAS: Network Access Server (2) using syslog-ng <Buffered?+Relay!> vvvvvvvvv [NAS]........UDP..[Syslog-ng]______TCP___ . \ [NAS]........UDP. [Syslog-ng]--IO->(Disk) ______ ___/ [NAS]........UDP..[Syslog-ng] TCP ^^^^^^^^^ <Buffered?+Relay!> It's correct? I want to understand that cause of dropping UDP on syslog. (the cause is the UDP stack on kernel(OS)?) Regards, ----- IRI [Internet Research Institute,Inc.] Naoto MATSUMOTO <not(a)iri.co.jp>

2 2

Re: syslog-ng question
by Balazs Scheidler 11 Oct '99

11 Oct '99

On Wed, Oct 06, 1999 at 10:48:38PM -0400, Peter Choynowski wrote: > > I am just starting to look at syslog-ng, and after reading the > documentation, I suspect it will not be able to do what I am after :( I > am trying to setup a log host for a large network, and want to have > messages from each host placed in different directory e.g. for host duey > the directory might be: > > /var/log/duey > > and all the messages from duey would go into files under there. The > problem is that I have a large number of hosts, and having to specify each > host with host("xxx") is not practical ( hosts are added all the time, and > it would be too much effort to add it each time ). > > I guess my question has to do with ability of having macros that would be > defined for each log line ie. lets say %h would get set to host, %ip to > ip, %f to facility, ... - this way the destination could be written using > the macros e.g. > > log { source(...); > filter(facility(auth)); > destination(file("/var/log/%h/%f.log)); ... } This is a planned feature. A lot of people have asked for this. > > If you can think of doing the above ( even if I have to do a simple hack > to the source let me know if it is possible and not too difficult ). it's quite difficult, since you have to keep a cache of recently opened files, and close them automatically after a time interval. > The other question I have has to do with syslog-ng resist message flood > type attacks - can you deal with that, and is there a way to alert admins > using sendmail of a possible attack ? not yet. > > How about dealing with growing logs and if they are about to fill up a > partition - maybe an option should exist to alert admins if the partition > becomes full to some user specified % or some given number of MB is left > free. This can be accomplished by other tools, a simple shell script called from cron would suffice. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Troubles with kernel facility items (firewall DENYs esp.)
by Jason Hollinden 09 Oct '99

09 Oct '99

I've set up syslog-ng as directed by everything I could find. In the .conf file below, yertle is the local machine running syslog-ng, and the other 2 are remote machines. The remote machine lines output everything fine, but the local (yertle) will not report any kernel messages (such as kernel firewall DENYs). I've tried adding the unix-stream /dev/klog for the inside_src, but that didn't help. Here's my .conf: ==========8<--------------------------------------- options { long_hostnames(off); sync(0); }; source inside_src { unix-stream("/dev/log"); internal(); }; source outside_src { udp(ip(0.0.0.0) port(514)); }; filter f_nancy { host("nancy"); }; filter f_hbgb { host("hbgb"); }; destination yertle { file("/var/log/yertle"); }; destination nancy { file("/var/log/nancy"); }; destination hbgb { file("/var/log/hbgb"); }; log { source(inside_src); destination(yertle); }; log { source(outside_src); filter(f_nancy); destination(nancy); }; log { source(outside_src); filter(f_hbgb); destination(hbgb); }; ==========8<--------------------------------------- Since I've only been messing with this for 1 hour, I'm sure I've just glanced over the answer, but any help would be appreciated. -- Liar (HBGB) jasonh(a)kiva.net ----------------------------------------------------------------------- "You can't be a real country unless you have a beer and an airline. It helps if you have some kind of a football team, or some nuclear weapons, but at the very least you need a beer." -Frank Zappa

2 1

filters and directory/filenames
by Christi Lipscomb 09 Oct '99

09 Oct '99

Hi, With syslog-ng, is there anyway to take the date and hostname in the log message and use them as part of the filename in the destination? We would like to use the date as a directory and within that directory save log files by hostname.logtype. Thank you, Christi acl4p(a)virginia.edu

2 1

MySQL Destination
by H D Moore 28 Sep '99

28 Sep '99

Hi, I started writing a MySQL based version of syslogd a couple weeks ago, it turns out that the original sysklogd package is an ugly mess and it wasnt feasible to try rewriting it for mysql support. Would you consider adding a mysql destination to the syslog-ng source? Would you mind if I write one and distributed it as a patch/module/etc? Would anyone else want to work on this? The original product page is located at http://www.phunc.com/~spinux (myLog). -HD Like Nmap? Try Nlog! (http://nlog.ings.com) IEEE Member (http://www.ieee.org)

2 1

CVS updated
by Balazs Scheidler 06 Sep '99

06 Sep '99

Hi, The previously mentioned compilation fixes are available in the CVS repository, only *BSD users are affected. For CVS instructions, see the webpage. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 2

Standard TCP port for Syslog?
by Lowkrantz, Goran 06 Sep '99

06 Sep '99

Has there been any desision for a TCP syslog port, as 514 is taken? Cheers, GLZ --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

2 1

syslog-ng 1.1.32 on FreeBSD
by Lowkrantz, Goran 06 Sep '99

06 Sep '99

Hi, Built the 1.1.32 on FreeBSD 3.3-RC today and there are just two small things to make this a compleat joy. 1 - The configure script don't find thet FreeBSD should have #define HAVE_MODERN_UTMP 0. 2 - The following warnings are generated at the inclusion of /usr/include/arpa/inet.h in src/utils.c I have added the lines from the system header that generates the warning. In file included from utils.c:32: /usr/include/arpa/inet.h:89: warning: parameter has incomplete type unsigned long inet_lnaof __P((struct in_addr)); /usr/include/arpa/inet.h:92: warning: parameter has incomplete type unsigned long inet_netof __P((struct in_addr)); /usr/include/arpa/inet.h:96: warning: parameter has incomplete type char *inet_ntoa __P((struct in_addr)); Cheers, GLZ --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

2 1

Re: syslog-ng under OpenBSD
by Balazs Scheidler 02 Sep '99

02 Sep '99

> > > > Could you send me your config.log and config.h files? > > I sent them as separate e-mails with proper subject lines. Thanks. I've fixed these compilation problems. Will be available in the next release. > > > > > > also, I get these warnings: > > > > > > parameter list > > > /usr/include/arpa/inet.h:79: warning: parameter has incomplete type > > > /usr/include/arpa/inet.h:82: warning: parameter has incomplete type > > > /usr/include/arpa/inet.h:86: warning: parameter has incomplete type > > > > In which file? > > during this command, here: > gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.1.32/src -I. -O2 -Wall -I/usr/local/include/libol -c utils.c Fixed this one too. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

updated documentation
by Balazs Scheidler 01 Sep '99

01 Sep '99

Hi! I've updated the documentation on the webpage. It's not complete yet, but it's definitely more complete than it was previously. http://www.balabit.hu/products/syslog-ng/doc/book1.html -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

Remote loging and facility seperation of incoming logs.
by deant＠stsi.net 01 Sep '99

01 Sep '99

Salutations all, I am attempting to set up a network log server for our Debian and RedHat servers. I can cause the other boxen to send the information to the log server. The log server receives the packets. However, I am having some difficulty separating the inbound packets by box and routing them to different files by facility. Any assistance would be appreciated. ****************************************************** * <<<<<<<<<<<<<< SouthNet <> TeleComm >>>>>>>>>>>>>> * ****************************************************** * Man generally seeks wisdom * T. Dean Tate * * only after all other options * deant(a)stsi.net * * have been exhausted. * UNIX Administration * ******************************************************

2 3

regular expressions ...
by Josef Bergmann 01 Sep '99

01 Sep '99

Hi! I made some fine Deb-Pakets from libol 0.2.3 and syslog-ng 1.1.31 and installed it on a Debian 2.1 system. Everthing works/logs nicely :-) Now I want enable the "hashing-feature" and filter against a file with regex- terms but I found now proper info in the docs. How can configure this features? (I don't found "genh0" and "checkhash" as mentioned in the syslog-ng manpage). How can I realize a system which for example executes a script if a regex- target gets hit. The idea is to get a realtime logchecker which mails faults to the admin ... Thanks for help. bye Josef -- BERGMANN engineering & consulting http://bec.at/ 'While we liked developing Windows applications, we never inhaled.' - Philippe Kahn, 1992

2 5

configuration problem?
by The March Hare 31 Aug '99

31 Aug '99

I am having trouble getting syslog-ng to log anything besides its own startup and shutdown. I have used the following configuration file, which is very similar to the sample from the distribution: options { sync(0); time_reopen(10); log_fifo_size(100); }; source src { unix-stream("/var/run/log"); udp(); tcp(ip("127.0.0.1") port(1000) mac(allow) authentication(required) encry pt(allow)); tcp(); # sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination everything { file("/var/log/syslog-ng" compress(on) sync(0) log_fifo_size(10)); }; filter f_host1 { host("host1"); }; log { source(src); destination(everything); }; Is there anything obviously wrong here? -- Felicia ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I am not the poet of goodness only....I do not decline to be the poet of wickedness also. -Walt Whitman ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 2

Re: problems with syslogd-ng under openbsd
by Balazs Scheidler 31 Aug '99

31 Aug '99

On Tue, Aug 31, 1999 at 04:21:38PM -0400, Rex A. Roof wrote: > > I'm trying to use syslogd-ng under OpenBSD on a sparc machine. > > I get parse errors if I try and have a destination line like this: > > destination local { file/var/log/local/general; }; > > so, I changed them to look like this: > > destination local { file(/var/log/local/general); }; > > and, I don't get parse errors anymore, but, I don't know if it's working > or not. I can't seem to get any log {}; directives to work, > this is just one of the ones I have, but I get parse errors on it: > > log { source src; destination default; }; log { source(src); destination(default); }; I'll try to update, and complete the documentation ASAP. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: logging to another machine
by Balazs Scheidler 19 Aug '99

19 Aug '99

Hi, On Mon, Aug 16, 1999 at 11:35:06AM -0400, Jamie Orzechowski wrote: > Hi There ... I have your AWSOME syslog-ng installed and just have a few > questions > > 1) does it log TCP/UDP ?? .. so I can log port scans and attacks on my > machine ... syslog-ng listens on an UDP or TCP socket to get log messages from the network. It's not a portscan detection tool. For portscan detection you could use tcplogd, or ippl. > 2) I need a config line to send all the logs to another host (I have abackup > logging host) It's not a problem, but the needed source declaration depends on the platform you are trying to run syslog-ng. On a Linux box all local messages are sent to a UNIX SOCK_STREAM socket named /dev/log. On other operating systems, this can be something else. So to send all messages to another host from a Linux system use: source src { unix-stream("/dev/log"); internal(); }; destination all { udp("xxx.xxx.xxx.xxx"); }; log { source src; destination all; }; Substitute the IP address of your loghost to xxx.xxx.xxx.xxx. You could use a hostname as well, but syslog-ng has to be able to resolv this name upon startup. (e.g. you have to include it in your /etc/hosts file) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog-ng
by Stefan Monnier 19 Aug '99

19 Aug '99

Why is a `source' necessary in a `log' statement ? the example configuration in http://www.balabit.hu/products/syslog-ng/syslog-ng-1.1.22.html clearly shows that this has the nasty tendency to be verbose and redundant. Why not allow the set of sources to be empty in which case the source is the same as the last `log' statement (for example) ? Also having the words `source' `filter' and `destination' appear all the time seems too verbose. They don't seem to be necessary. I'd love to be able to say destination console { file /dev/tty11; }; log { ; facility(ppp); console } where the redundant keywords have been dropped, the default source is used and the filter appears directly in the `log' command. Apart from that, I have some trouble checking out the CVS repository: ~/install-1% cvs -d :pserver:cvs@cvs.balabit.hu:/usr/local/cvs checkout -d syslog-ng syslog-ng libol cvs server: Updating syslog-ng/syslog-ng cvs server: failed to create lock directory in repository `/usr/local/cvs/syslog-ng': Permission denied cvs server: failed to obtain dir lock in repository `/usr/local/cvs/syslog-ng' cvs [server aborted]: read lock failed - giving up ~/install-1% [ the login went though flawlessly ] Stefan "very happy about syslog-ng despite the present gripes" PS: I wish syslog-ng were a perl script so that the config file could use the full perl power (and you'd have saved all the parsing trouble: just say "do '/etc/syslogng.conf';" and that's it).

2 1

closed TCP streams
by Bradley Urberg Carlson 18 Aug '99

18 Aug '99

If I am using a destination: destination tcptest { tcp("137.192.192.104" port(4020) ); }; ...and I kill and restart the TCP server at my end, then syslog-ng complains: io.c: do_write: write() failed (errno 32), Broken pipe ...but does not try to reconnect until HUP or restart. -Bradley

1 0

multiple facilities/streams into a named pipe?
by streiner-syslogng＠sgi.net 17 Aug '99

17 Aug '99

This is a pretty off-the-wall question, but I figure I'd give it a shot ;-) I work in a largely Solaris shop and have to deal with many of the quirks of its syslog implementation. One of these quirks came up when I tried on a hunch to get multiple event streams to feed into the same named pipe, which would then get pushed off to a network management system. The reason I wanted to do this was organizational; i.e. have all routers log to local7.debug on my log server, switches log to local6.debug, ras servers to local5.debug and so on. From what I've seen in early tests, this type of setup either causes Sun's syslogd fits or could potentially clobber data being written to the pipe. My questions are: 1) has anyone ever tried anything like this? 2) is syslog-ng capable of supporting a setup like this on a Solaris 2.7 box? tia jms

2 1

Re: syslog-ng 1.1.31 && Solaris 2.6 SPARC
by Bradley Urberg Carlson 17 Aug '99

17 Aug '99

Erik M. Beebe erik(a)infi.net wrote on Thu, 12 Aug 1999 16:56:37 -0400: > I have recently installed syslog-ng 1.1.31 && libol-0.2.3 on a machine > running SPARC Solaris 2.6; If I connect to port 514/UDP using NetCat, > syslog-ng logs it just fine. If I try to use "logger" locally, it does > not. ... > I don't believe it's any problems with the destination/filter/log lines > causing this problem -- it looks like syslog-ng just isn't getting what is > sent to /dev/log. Anyone have any idea what could be causing this? There are a bunch of messages in the June archive with the thread "syslog-ng and solaris doors again". Apparently, there is still some work going into logging messages locally under solaris. I also tried v1.1.31 with Solaris and found the same problem. My workaround was to run syslog-ng AND the Solaris syslogd, with syslogd forwarding all local messages to syslog-ng on the localhost using UDP. Since syslog-ng works fine from UDP, this gets all the messages (network-generated + locally-generated) into syslog-ng. Details: -syslogd listens to bogus/unused UDP port 999, and sends local messages to syslog-ng using UDP 999: *** /etc/services~ Mon Aug 16 21:02:39 1999 --- /etc/services Mon Aug 16 20:28:30 1999 *************** *** 61,63 **** who 513/udp whod ! syslog 514/udp talk 517/udp --- 61,63 ---- who 513/udp whod ! syslog 999/udp talk 517/udp *** /etc/syslog.conf~ Mon Mar 29 10:17:35 1999 --- /etc/syslog.conf Mon Aug 16 21:05:03 1999 *************** *** 1,1 **** ! *.debug @loghost --- 1,1 ---- ! *.debug @localhost -syslog-ng listens to the network-generated messages coming in on 514/UDP, and also listens to locally-generated messages coming in from syslogd on 999/UDP: source s_network { udp(ip(0.0.0.0) port(514)); }; source s_syslogd { udp(ip(localhost) port(999)); };

1 0

RE: [syslog-ng] Got 1.1.31 running on FreeBSD3
by Lowkrantz, Goran 14 Aug '99

14 Aug '99

And then I missed the obvious. I have attached the patch of src/utils.c, just a missing variable. Cheers, Goran L -----Original Message----- From: Lowkrantz, Goran [mailto:Goran.Lowkrantz@infologigruppen.se] Sent: Saturday, August 14, 1999 3:13 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng] Got 1.1.31 running on FreeBSD3 Hi, I got the 1.1.31 version up and running on FreeBSD 3.1R and 3.2S with two small glitches. 1: src/config.h: #define HAVE_MODERN_UTMP 0 2: When compiling util.c I get the following messages. gcc -DHAVE_CONFIG_H -I. -I/usr/home/glz/work.d/syslog-ng-1.1.31/src -I. -O2 -Wall -I/usr/local/include/libol -c utils.c In file included from utils.c:32: /usr/include/arpa/inet.h:89: warning: parameter has incomplete type /usr/include/arpa/inet.h:92: warning: parameter has incomplete type /usr/include/arpa/inet.h:96: warning: parameter has incomplete type I will track them down later today if no-one have a quick answer. The tests I have made so far work OK. Cheers, Goran L --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Got 1.1.31 running on FreeBSD3
by Lowkrantz, Goran 14 Aug '99

14 Aug '99

Hi, I got the 1.1.31 version up and running on FreeBSD 3.1R and 3.2S with two small glitches. 1: src/config.h: #define HAVE_MODERN_UTMP 0 2: When compiling util.c I get the following messages. gcc -DHAVE_CONFIG_H -I. -I/usr/home/glz/work.d/syslog-ng-1.1.31/src -I. -O2 -Wall -I/usr/local/include/libol -c utils.c In file included from utils.c:32: /usr/include/arpa/inet.h:89: warning: parameter has incomplete type /usr/include/arpa/inet.h:92: warning: parameter has incomplete type /usr/include/arpa/inet.h:96: warning: parameter has incomplete type I will track them down later today if no-one have a quick answer. The tests I have made so far work OK. Cheers, Goran L --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

1 0