- syslog-ng - lists.balabit.hu

Central Logging
by Lightfoot.Michael 02 Sep '02

02 Sep '02

I am setting up central logging for all my DMZ systems which are all Sun boxes running Solaris 2.6 or Solaris 8. What I want to achieve is to logg stuff locally as standard syslog did previously and in addition forward all syslog data to a central host to be stored identically in a subdirectory /var/log/$HOST/ - so I'll have files such as /var/log/foo/messages, /var/log/foo/syslog, /var/log/foo/authlog, etc. Has anyone done this in a way that doesn't demand a humungous config file on the central host with near identical settings for each remote host? Michael Lightfoot Unix Consultant ISG Host Systems Comcare +61 2 62750680 NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries.

1 0

Incomplete library checking when building 1.4.15 on Sol7/SPARC
by Adam Steffes 30 Aug '02

30 Aug '02

While trying to build syslog-ng v1.4.15 on a rather plain Solaris 7/SPARC machine, I found that the configure script doesn't look everywhere it should to find yywrap. My system had it in /usr/lib/libl.a while the configure script seemed to look only in /usr/lib/libfl.a. I basically hardcoded the configure script to look at libl.a in a hurried attempt to get it to compile. Is this something anyone has looked at before? I admit I am not a developer by any means, and certainly do not want to insult anyone. It seems a small bit of code could be added to the 'case' statement in the configure script to perform a more extensive search for yywrap. Here is how I found the location of yywrap on my machine: $ for lib in /usr/lib/*.a ; do echo $lib ; nm $lib | grep yywrap ; done <other libs snipped> /usr/lib/libintl.a /usr/lib/libkrb.a /usr/lib/libl.a /usr/lib/libl.a[yywrap.o]: [5] | 0| 8|FUNC |GLOB |0 |2 |yywrap [1] | 0| 0|FILE |LOCL |0 |ABS |yywrap.c /usr/lib/libldfeature.a /usr/lib/libm.a /usr/lib/libmail.a /usr/lib/libmalloc.a <the rest snipped> I hope this helps. -Adam

1 0

Priming the database.
by Scott A. McIntyre 30 Aug '02

30 Aug '02

Hi, I'm pondering moving towards mysql logging for syslog-ng, but was wondering if anyone has already got a tool/script laying around to take current logs and import into the database accurately and correctly. Thanks for any pointers, Scott

1 0

syslog over TCP
by BONIKOWSKE, SCOTT 28 Aug '02

28 Aug '02

--- Received from WPS.SBONIKOW (608) 226-2630 08-28-02 1021a Hello, I am new to syslog-ng, and I had a couple questions that I have not seen answered before in the archives (from what I saw), and I was wondering if anyone out there could help. I hope this is the right area for these questions. First, Does TCP increase the load on the CPU alot over UDP? the situation is, we are looking at using syslog-ng on a midsized company (overall about 6,000+ people). we would like to monitor all syslog activity from NT,2000, XP, HPUX, AIX, Cisco routers/switches/PIXs, linux. The windows machiens are mostly file/application servers, the linux boxes are file/web/application servers, the HPUX and AIX boxes are application servers also. There is a lot of logging that will need to be watched because of security reasons (including file access, logins, etc.), so we are expecting a lot of traffic. The end goal will be to have all of the logs filtered by machine (in some cases even more granular than that like cisco errors going into the main log, and a seperate error log for that machine, and an error log for all networking devices), and maybe even searchable if I have enough time. I am only going into high detail above becase I would like to know opinions about using TCP vs UDP for load on the CPU, and to see if anyone else has maybe done something like this themselves for a company close to the same size. Any help and comments would be welcome. Thanks Scott Bonikowske Open Systems Analyst WPS ---- 08-28-02 1021a ---- Sent to ------------------------------------ -> syslog-ng(a)lists.balabit.hu

1 0

syslog-ng documentation and some minor niggles
by Ted_Rule＠flextech.co.uk 28 Aug '02

28 Aug '02

Many thanks to Stephen Frost and Balazs for the useful information and suggestions regarding PIX syslogging. Having had a slightly deeper read of the latest src tree, I'd like to just make a few suggestions and comments. Several of the options available have Default Settings in their relevant subsection of the HTML tree within: /usr/src/syslog-ng/syslog-ng-1.5.19/doc/sgml/syslog-ng.html However, several options don't have defaults listed therein. Perhaps the next round of documentation updates could double check that all defaults are fully listed in the html pages. The Main HTML Doc Pages at http://www.balabit.hu/static/syslog-ng/reference/book1.html contain no reference to recent dns_cache options - even though this option appears to have been available for about 18 months. As I think several others have mentioned on the list, it would seem reasonable for a more up to date copy of the html pages to be glued up onto the website. The syslog-ng man pages explicitly state that destinations are closed and re-opened on SIGHUP, as per dear-old syslogd's behaviour. There have been references on the mailing list and the FAQs to the corresponding close / re-open of sources, but no explicit statement in the docs. Could I request that an explicit statement of source file descriptor open/close behaviour on SIGHUP be added to the docs/FAQ, please. Others on the list have noted that closing /dev/log on HUP causes certain programs grief - notably sendmail which requires a further HUP to itself to properly heal the broken syslog file descriptor. If syslog-ng does indeed close descriptors on HUP, can we please have an option to explicitly keep certain descriptors open on HUP. ( The docs suggest this may already be possible for TCP sockets, and Unix SOCK_STREAM sockets, but not Unix SOCK_DGRAM sockets ). See ensuing paragraphs for why I'd like the option to be available on Unix SOCK_DGRAM. In all the syslog-ng docs, Linux platforms are documented as having a default log listener socket of /dev/log SOCK_STREAM. However, the most recent RedHat sysklogd RPMs open /dev/log in SOCK_DGRAM mode. I believe this was done as part of a security patch to avoid a potential DoS attack against the stream socket. To the best of my recollection, this behaviour changed about a year ago. This seems to bring RedHat - at least - in line with other BSD variants. glibc openlog() call on RedHat opens SOCK_DGRAM first, falling back to SOCK_STREAM if that fails. Hence RedHat's glibc still supports either socket type, and hence syslog-ng's documented Linux defaults still work. Likewise, Perl's Syslog.pm module calls SOCK_DGRAM first falling back to SOCK_STREAM. Sometime during the change from kernel 2.0 to 2.2 I believe, the Unix DGRAM socket type behaviour was adjusted to blocking ( this assumption purely based on the perceived behaviour of sysklogd ). Thus it should be impossible to drop a message across a Unix DGRAM socket , as compared with the ease of such a message being dropped across an UDP DGRAM socket when the system is really busy. Hence the change from SOCK_STREAM to SOCK_DGRAM within sysklogd should not make the system more prone to dropping locally logged messages, as might have been the case with earlier kernels? Given all of the above, is it reasonable to change the preferred documented socket type from STREAM to DGRAM on /dev/log for syslog-ng on Linux? "logger-ng" - I believe others may also have asked for this - does such a thing exist? to allow one to create test messages and the like over TCP etc etc etc. Sys::Syslog-NG.pm ?? does such a thing exist to support Perl Syslogging over TCP and suchlike? Ted Rule, Flextech Television *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

1 0

Please help fast...
by Keven Belanger 28 Aug '02

28 Aug '02

What is incorrect in this line ??? log { source(s_udp); destination(d_std); flags(fallback); }; Thanx... Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

2 1

2 more question...please help
by Keven Belanger 27 Aug '02

27 Aug '02

Okay! We have 2 problems; 1- The hostname of the syslog receiver is SECU-Rcv1 and SECU-Rcv2 So with a destinations like destination: d_std { file("/export/disk1/log/$HOST/$YEAR/$MONTH/messages.log"); }; We receive the log in /export/disk1/log/SECU-Rcv2 on the local host why not the ip like other host ?? 2- We have 2 syslog collector and a big config file with each host (customer) defined line by line and a rule with unknown, the problem is that each host log correctly to the respective directory but they also log to my unknown directory, I want to be able to say, if no filter match, log to unknown... Thanx a lot! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

1 0

some questions
by Joerg Sommer 27 Aug '02

27 Aug '02

Hi, * What's the difference between long_hostnames() and use_fqdn()? * How get I names instead of ips in the logs? With use_dns()? How dangerouse is use of use_dns()? * Can I write a hostname instead of a ip in tcp()? * I miss the default values of the options in the docu. What's default for use_dns(), stats(),...? * When will encryption and authentication come? Joerg.

3 4

Details
by PRINCE MARK ADE 24 Aug '02

24 Aug '02

FROM THE DESK OF: PRINCE MARK ADE ATTN: PRESIDENT / M. D/ C.E .O SIR, /MADAM REQUEST FOR URGENT BUSINESS RELATIONSHIP WE ARE MAKING THIS CONTACT WITH YOU AFTER SATISFACTORY INFORMATION WE GATHERED FROM THE FOREIGN TRADE OFFICE NIGERIA CHAMBER OF COMMERCE AND INDUSTRY HIGHLIGHTING YOUR COMPANYS PROFILE. WE ARE MEMBERS OF THE PROJECT CONSULTING ANDCONTRACT AWARDING COMMITTEE OF THE NIGERIAN NATIONAL PETROLEUM CORPORATION (NNPC). WE ARE AS CONVINCED AS TO BELIVE THAT YOU WILL PROVIDE US WITH A SOLUTION TO EFFECT A REMITTANCE OF FUND RESULTIN FROM OVER INVOICING OF JOB/ SERVICES DONE TO THE NIGERIAN NATIONAL PETROLEUM CORPORATION BY A FOREIGN CONTRACTOR, CONTRACT NO: NNPC/PED/AJO/1088/94. THIS PROJECT HAS BEEN FULLY EXECUTED AND COMMISSIONED. THE PRESENT GOVERNMENT IN NIGERIA HAS DUE TO THE BILATERAL AGREEMENT REACHED WITH THE WORLD BANK AND IMF, DIRECTED THAT ALL DEBTS OWENED BY FOREIGN CONTRACTORS BE PAID. WE ARE THEREFORE DESIROUS OF TRANSFERRING THE OVER INVOICE SUM OF TWENTY MILLION US DOLLAR (20,000,000,00) ONLY INTO YOUR COMPANYS OR PRIVATE ACCOUNT. NOTE, AS CIVIL SERVANTS, WE ARE NOT PERMITTED TO OWN FOREIGN ACCOUNT BY NIGERIAN CIVIL SERVICE LAW. THEREFORE, INORDER TO FACILITATE THE TRASFER OF THIS FUND INTO YOUR ACCOUNT, YOU ARE URGED. TO REPLY THROUGH THE ABOVE EMAIL ADDRESS FOR CONFIDENTIAL PURPOSE AND FOR THE URGENT NATURE OF THIS TRANSACTION. THE FOLLOWING ARE REQURED FROM YOU. (1) YOUR COMPANYS NAME AND ADDRESS (2) YOUR PERSONAL OR COMPANYS BANK NAME, ADDRESS ACCOUNT NUMBER AND TELEX NO. (3) YOUR PRIVATE AND OFFICIAL TELEPHONE AND FAX NUMBER THE FUND WILL BE SHARED, AS FOLLOWS 30% OF THE TOTAL VALUE SHOULD GO TO YOU AS THE OWNER OF THE ACCOUNT, WHILE 60% SHALL BE RELEASES TO US WHEN WE ARRIVE YOUR COUNTRY AFTER THE TRANSFER, THEN 10% WILL BE FOR EXPENSES INCURRED BY BOTH PARTIES IN THE COURSE OF THE TRANSFER INTO YOUR ACCOUNT. ON RECEIPT OF YOUR PAPERS, WE WILL TENDER AN APPLICATION FOR PAYMENT AT THE CENTRAL BANK OF NIGERIA, FEDERAL MINISTRY OF FINANCE AND ITS AFFILIATE MINISTRIES. FINALLY, THE CONFIDENCE AND TRUST RESPONDED ON YOU CANNOT BE OVER EMPHASISED; THEREFORE YOU ARE TO KEEP THIS TRANSACTION TO YOURSELF AND FOR CONFIDENTIAL REASONS. BEST REGARD. PRINCE MARK ADE (qus,jp,mon,gcon) (CHAIRMAN CONTRACT AWARD COMMITTEE (NNPC)

1 0

RE: [syslog-ng]directory owner
by Keven Belanger 23 Aug '02

23 Aug '02

Sorry ;) I have re-read the mail ! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717 -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, August 23, 2002 11:31 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]directory owner On Fri, Aug 23, 2002 at 11:28:18AM -0400, Keven Belanger wrote: > Hi guys, we use syslog-ng 1.4.15 and I presently use the create_dirs (yes); option but the directory are always created with root:root > How can we change the directory owner and group ?? specify dir_owner() and dir_group() either globally, or locally. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]directory owner
by Keven Belanger 23 Aug '02

23 Aug '02

This is what I try but doesn't work, I use Solaris 8 Sparc ### # Common Options options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); dir_perm (0700); owner ("514"); group ("514"); keep_hostname (no); }; Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717 -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, August 23, 2002 11:31 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]directory owner On Fri, Aug 23, 2002 at 11:28:18AM -0400, Keven Belanger wrote: > Hi guys, we use syslog-ng 1.4.15 and I presently use the create_dirs (yes); option but the directory are always created with root:root > How can we change the directory owner and group ?? specify dir_owner() and dir_group() either globally, or locally. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

directory owner
by Keven Belanger 23 Aug '02

23 Aug '02

Hi guys, we use syslog-ng 1.4.15 and I presently use the create_dirs (yes); option but the directory are always created with root:root How can we change the directory owner and group ?? We need a fast answer please! Thanx! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

2 1

syslog-ng 1.5.20, unix-dgram source on BSD broken
by Balazs Scheidler 23 Aug '02

23 Aug '02

... and this patch fixes it: diff -u -r1.23 afunix.c --- afunix.c 21 Aug 2002 14:03:50 -0000 1.23 +++ afunix.c 23 Aug 2002 12:02:56 -0000 @@ -51,7 +51,7 @@ CAST(afsocket_source_connection, self, c); io_read(self->client, - make_log_reader(0, NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, c), + make_log_reader(!!(self->owner->flags & AFSOCKET_DGRAM), NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, c), make_afsocket_source_close_callback(self)); return ST_OK | ST_GOON; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

help please...
by Keven Belanger 23 Aug '02

23 Aug '02

I have 2 question: 1- I'm looking for a script (perl or other) to scan a file to find unique line (line that are duplicate will be remove) 2- Also want to know which log rotation people are using under Solaris ?? Answer soon! Thanx! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

3 2

RE: [syslog-ng]help please...
by Glenn Harrison 23 Aug '02

23 Aug '02

I can answer 2 fairly simply. Whilst using syslog-ng, I just set the logs to go into a dated directory or filename, that way they automatically get rotated each night without disrupting syslog at all. For example: destination messages { file("/var/log/syslog-dated/$HOST/$YEAR-$MONTH-$DAY/messages" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(sysadmin) perm(0640) dir_perm(0750) dir_owner(root) dir_group(sysadmin)); }; You could of course simplify this even more, and just have: destination messages { file("/var/adm/messages-$YEAR-$MONTH-$DAY" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(sysadmin) perm(0640) dir_perm(0750) dir_owner(root) dir_group(sysadmin)); }; Which would put dated messages files into your /var/adm directory, then run a find command each night to clean up the old logs once they're archived off to tape or whatever your policy is. I personally use these 2 cron entries to clean up my messages each night: 15 4 * * * /usr/bin/find /var/log/syslog-dated $ -name '*-*-*' $ -follow -mount -mtime +32 -type d -exec /usr/bin/rm -rf {} \; 30 4 * * * /usr/bin/find /var/log/syslog-dated $ -name '*.log' $ -follow -mount -mtime +2 -type f -exec /usr/bin/gzip {} \; This gzips the older logs, and deletes stuff over a month old. -----Original Message----- From: Keven Belanger [mailto:kbelanger@logicon.ca] Sent: Friday, 23 August 2002 5:23 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]help please... I have 2 question: 1- I'm looking for a script (perl or other) to scan a file to find unique line (line that are duplicate will be remove) 2- Also want to know which log rotation people are using under Solaris ?? Answer soon! Thanx! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717 Our Privacy statement AM Corporation manages Personal information as required by Privacy legislation. To provide the products and services you request and for related purposes, we collect information from you or from someone you have authorised. If your information is sensitive, such as health information, we will use it only for the purpose that you have requested. Sometimes, we must give your information to appropriate external service providers, such as our underwriter, administrators, your banking service provider and/or Financial Adviser. However, we will give your information only if you authorise us, or if we are legally required to, or if it is part of our normal procedures and necessary to provide what you have requested. This email is confidential > This email and any files transmitted with it are intended solely for the > use of the addressee(s) and may contain information which is confidential > or privileged. Any unauthorised use, in particular forwarding the > contents of this email and any files to third parties (other than is > expressly authorised) is prohibited. > > If you receive this email and you are not the addressee (or responsible > for the delivery of the email to the addressee) please notify us > immediately and delete the email and all copies. > > We do not guarantee that this email is virus or error free, and the > attached files are provided and may only be used on the basis that the > recipient assumes all responsibility for any loss, damage or consequence > resulting directly or indirectly from the use of the attached files, > whether caused by the negligence of the sender or not. > > The contents and opinions in non business emails are not necessarily those > of AM. >

1 0

RE: [syslog-ng]help please...
by Nicholas Berry 22 Aug '02

22 Aug '02

We're using the macro abilities of syslog-ng to write out to a YYYY-MM format example: destination default { file ("/var/syslog-ng/$YEAR-$MONTH/$HOST_FROM/messages" ... ); } Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. nberry(a)ragingwire.com -----Original Message----- From: Keven Belanger [mailto:kbelanger@logicon.ca] Sent: Thursday, August 22, 2002 12:23 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]help please... I have 2 question: 1- I'm looking for a script (perl or other) to scan a file to find unique line (line that are duplicate will be remove) 2- Also want to know which log rotation people are using under Solaris ?? Answer soon! Thanx! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

1 0

syslog-ng 1.5.20
by Holtzl Peter 22 Aug '02

22 Aug '02

Hi, New development version of syslog-ng has been released: News for the 1.5.20 release Thu, 22 Aug 2002 16:03:45 +0200 * fixed a kernel message mangling problem * implemented check_hostname() which checks if a hostname is acceptable (contains characters [0-9a-zA-Z-_.], and if not, it is not parsed as hostname, this fixes problems with devices which send messages which seem to contain a hostname, but in reality they don't -- Höltzl Péter Ho:ltzl Pe'ter | Tel: +36 1 371-0540 | GnuPG Fingerprint: BalaBit IT Kft | Mobil: +36 20 366-9667 | DB30 5E5B 8777 C06F 5A1F holtzl.peter(a)balabit.hu | http://www.balabit.hu/ | 4586 CEAF 9678 4A89 CFD6

3 3

RE: [syslog-ng]Problems compiling libol / syslog-ng
by Camacho, Christian 22 Aug '02

22 Aug '02

That's a weird error, the time was a couple of minutes ahead, I changed it now, but that's not the problem.... Anyone has compiled it on Redhat 7.3 before?? Christian -----Mensaje original----- De: Dustin Trammell [mailto:DTrammell@PENSON.COM] Enviado el: Miércoles, 14 de Agosto de 2002 13:07 Para: 'syslog-ng(a)lists.balabit.hu' Asunto: RE: [syslog-ng]Problems compiling libol / syslog-ng Check the time on your system, it's probably wrong. Usually configure won't continue if it finds files that are newer than current date/time, or it creates a file that is older than current date/time. --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Camacho, Christian [mailto:CCamacho@golder.cl] Sent: Wednesday, August 14, 2002 11:04 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Problems compiling libol / syslog-ng I have Redhat 7.3 and can't configure libol (I have the same problem with syslog-ng). I don't have an alias for ls, I don't know Why I'm having such problem, I've compiled other tar balls before without this error... Any idea?? [root@agua libol-0.3.3]# ./configure creating cache ./config.cache checking for a BSD compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking whether build environment is sane... configure: error: ls -t appears to fail. Make sure there is not a broken alias in your environment configure: error: newly created file is older than distributed files! Check your system clock Thanks, Chris DISCLAIMER: This message may contain confidential information. If you are not the intended recipient please advise the sender and erase the message. Thank you. DISCLAIMER: This message may contain confidential information. If you are not the intended recipient please advise the sender and erase the message. Thank you.

4 7

Updated Red Hat config file
by Frank Crawford 22 Aug '02

22 Aug '02

Folks, I've modified the contributed configuration file for Red Hat to update it to be more compatible with Red Hat 7.3. In particular, I've modified it to totally remove the requirement for running klogd (as described in the FAQ). In particular, I've added a template to include the program type "kernel:" for kernel messages. This is normally done by klogd, and is expected by such utilities as logwatch. The one question I have here is that I have two opens of "/var/log/messages" with different options, and I'm not sure if it is legal, although it does seem to work. Are there any possible problems with this? Thanks Frank Crawford -- ac3 Suite G16, Bay 7, Locomotive Workshop Phone: 02 9209 4600 Australian Technology Park Fax: 02 9209 4611 Eveleigh NSW 1430

2 4

compressed log
by Keven Belanger 22 Aug '02

22 Aug '02

Sorry I forgot to ask this one; can we compress log on the fly with gzip or something like that? So use a gz file as output Thanx again! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

2 1

Somebody help me !
by Le Nguyen Vu 22 Aug '02

22 Aug '02

Hi all, Sorry, my poor english... I install syslog-ng on my PC (flatform OS's Redhat Linux 7.3). But i can't get any log message form other machine (i.e Router, Server run on unix (linux) and windows 2000 server flatform). Some body know about it ? Please tell me how to config syslog-ng on redhat linux 7.3. Thanks, Please mail to me at misterde(a)wmail.saigonnet.vn. Thank again. Mister De misterde(a)wmail.saigonnet.vn

1 0

Re: OK
by Le Nguyen Vu 22 Aug '02

22 Aug '02

confirm 253008

1 0

Errors Compiling 1.5.19 with TCP_WRAPPERS
by Victor 22 Aug '02

22 Aug '02

I am trying to compile with tcp_wrappers, but I get this error: gcc -O2 -march=i686 -pipe -Wall -I/root/syslog-ng/work/src/libol-0.3.3/src -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o -lfl /root/syslog-ng/work/src/libol-0.3.3/src/.libs/libol.a -lnsl afinet.o: In function `do_open_afinet_connection': afinet.o(.text+0x3c3): undefined reference to `request_init' afinet.o(.text+0x3cf): undefined reference to `sock_host' afinet.o(.text+0x3d8): undefined reference to `hosts_access' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 Shouldn't it have something like -lwrap on the line above? Also, I heard on the mailing list that there is a patch for 1.5.19? Is there a link to it? What's the proper patch command to apply it? Thanks

1 0

RE: [syslog-ng]Supressing messages...
by Keven Belanger 21 Aug '02

21 Aug '02

If there is no way to exclude it, try to make a new destination to /dev/null ? Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717 -----Original Message----- From: bhartin(a)straus-frank.com [mailto:bhartin@straus-frank.com] Sent: Wednesday, August 21, 2002 15:25 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Supressing messages... I'm running syslog-ng-1.4.14-0. Long story short, I want to supress the logging of "VFS: Disk change detected..." messages that plague RH 7.1 installs using KDE w/autorun on CDs. Updating syslog-ng versions isn't happening anytime soon unless it is the only way to do so. What can I do to supress any and all logging of just this message, without affecting anything else in that group (kern.* or wherever it's at)? I'm sure newer versions have a working text based filter or such, but I'm pressed for time =(. Thanks for any help anyone can provide, -- Bradley Hartin - bhartin(a)straus-frank.com Communications and Network Administrator Straus-Frank Company _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3

syslog-ng 1.4.7 crashing randomly
by Adam Steffes 21 Aug '02

21 Aug '02

I'm running syslog-ng 1.4.7 on a Solaris 7 machine which acts as a middleman for my production servers and main log repository server. It crashes without warning, without logging any problems beforehand, and often requires several attempts at restarts before staying up. Time between crashes seems random; it will go for a few days, die, require ten restarts in five minutes to keep it up, then run for another week before having any problems. 'gdb' says it's dying from a SIGKILL but I don't have anything running on the machine that would send it any such flags. Any ideas what is going on here? I found two messages in the archives from Oct. 2001 asking similar questions, but no resolutions: Nicholas Berry nberry(a)ragingwire.com Wed, 10 Oct 2001 09:10:13 -0700 a.. I too am having the same issue with crashing under Solaris 8 with syslog-ng 1.5.10, but my crashes happen several hours between each other. _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048 -----Original Message----- From: Andreas Schulze [mailto:Andreas.Schulze@mediaWays.NET] Sent: Wednesday, October 10, 2001 6:01 AM To: syslog-ng list Subject: [syslog-ng]Mystic crashes of 1.5.10 Hello Bazsi, thanks a lot for the stats() feature in the new version. But unfortunately 1.5.10 crashes a few minutes after starting. We are running your software on SUN Solaris 8 boxes. I read about a similiar problem with Linux boxes some weeks ago in this list. For your convenience the backtrace is attached. The calling deps between #17 and #1 can differ in each core. But it crashed _always_ in __sigprocmask () from /usr/lib/libthread.so.1 And it crashed _always_ by receiving SIGKILL. Seems a little bit mystic for me, because I don't know why and who's sending the SIGKILL. Coredumps by SIGSEGV are more familiar to me :) Thx. for a fast fix --Andreas

2 2

RE: [syslog-ng]Supressing messages...
by Keven Belanger 21 Aug '02

21 Aug '02

A filter like this should work, be aware this is case _SENSITIVE_ filter f_vfs {match("VFS: Disk change detected");}; Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717 -----Original Message----- From: bhartin(a)straus-frank.com [mailto:bhartin@straus-frank.com] Sent: Wednesday, August 21, 2002 15:58 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Supressing messages... On Wed, 21 Aug 2002, Keven Belanger wrote: > If there is no way to exclude it, try to make a new destination to /dev/null ? The problem is that I haven't found a way for a filter to catch it. The kernel version uses a printk for KERN_DEBUG. I've tried a filter against facility for debug, kern.debug, and *.debug--all of which show up as unknown facilities. I tried 'match("Disk change detected")' to no avail either. I may have to bite the bullet and move to a newer version, but.... -- Bradley Hartin - bhartin(a)straus-frank.com Communications and Network Administrator Straus-Frank Company _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Supressing messages...
by bhartin＠straus-frank.com 21 Aug '02

21 Aug '02

I'm running syslog-ng-1.4.14-0. Long story short, I want to supress the logging of "VFS: Disk change detected..." messages that plague RH 7.1 installs using KDE w/autorun on CDs. Updating syslog-ng versions isn't happening anytime soon unless it is the only way to do so. What can I do to supress any and all logging of just this message, without affecting anything else in that group (kern.* or wherever it's at)? I'm sure newer versions have a working text based filter or such, but I'm pressed for time =(. Thanks for any help anyone can provide, -- Bradley Hartin - bhartin(a)straus-frank.com Communications and Network Administrator Straus-Frank Company

1 0

RE: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x
by Dustin Trammell 21 Aug '02

21 Aug '02

Ok, that's strange... apparently the patch didn't apply correctly (according to the output of that tail command), even though the output from patch appeared that it did; It still had the old code in sources.c. I re-applied the patch, verified that the source was indeed patched this time, and recompiled. After a bit of testing, I don't seem to be getting the truncated entries any more, so I'm guessing it was just an error on my part during the patching and re-compiling process. Thanks for your help in debugging (: I hadn't even thought to actually look at the source for the original problem since it had appeared that the patch applied correctly. --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Stephen Frost [mailto:sfrost@snowman.net] Sent: Wednesday, August 21, 2002 13:40 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x Hmm, odd, I'm not having any problems here.. Can you go into the syslog-ng-1.5.19 directory and run: tail +113 src/sources.c | head -10 And send the output here? Stephen

2 1

RE: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x
by Dustin Trammell 21 Aug '02

21 Aug '02

The problem entries are only coming from that source. If another system forwards any kernel logs, they come through fine. All other boxes are currently still running the standard syslogd + klogd. The central log server is the only one running syslog-ng. --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Stephen Frost [mailto:sfrost@snowman.net] Sent: Wednesday, August 21, 2002 12:20 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x * Dustin Trammell (DTrammell(a)PENSON.COM) wrote: > source s_kernel { file("/proc/kmsg" log_prefix("kernel: ")); }; Okay, and those kernel messages are being generated from this source, or are they coming from another machine and being delivered to the log server? Stephen

2 1

weekly directory
by Keven Belanger 21 Aug '02

21 Aug '02

Hi guys, is there any way to create a directory for each week?? We can do it by day/month/year but for some host month is too big and day is too small, so can we do something between ? Thanx a lot and have a nice day! Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717

1 0

RE: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x
by Dustin Trammell 21 Aug '02

21 Aug '02

Here's my conf in full: ### Syslog-NG Config File # Global Options options { # time_reopen(60); # mark(1200); stats(1200); chain_hostnames(no); use_dns(no); gc_idle_threshold(100); gc_busy_threshold(10000); log_fifo_size(2000); log_msg_size(2048); sync(0); }; # Source Objects source s_local { internal(); }; source s_kernel { file("/proc/kmsg" log_prefix("kernel: ")); }; source s_devlog { unix-stream("/dev/log" max-connections(150)); }; source s_udp514 { udp(); }; source s_tcp514 { tcp(ip("127.0.0.1") max-connections(150) keep-alive(yes)); }; # Destination Objects destination d_varlog { file("/var/log/log"); }; destination d_tty8 { pipe("/dev/tty8"); }; destination d_logresp { pipe("/usr/local/logrespond/fifo/log" owner(logrespond) group(root) perm(0600) ); }; destination d_logtraq { pipe("/usr/local/logtraq/logpipe" owner(root) group(logtraq) perm(0640) ); }; # Log Paths log { source(s_local); source(s_kernel); source(s_devlog); source(s_udp514); source(s_tcp514); destination(d_varlog); destination(d_tty8); destination(d_logresp); destination(d_logtraq); }; --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Stephen Frost [mailto:sfrost@snowman.net] Sent: Wednesday, August 21, 2002 11:56 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x * Dustin Trammell (DTrammell(a)PENSON.COM) wrote: > (sigh) ... At least they're no longer getting mangled (as far as I can tell, > I haven't seen any mangled lines since I patched), but some entries are > still getting split between two or more lines. Any ideas Balazs? What's your syslog-ng.conf look like in the sources part? Stephen

2 1

RE: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x
by Dustin Trammell 21 Aug '02

21 Aug '02

Well, that did the trick, and it compiled, however I'm still getting chopped log entries: Aug 21 10:36:54 loghost01 kernel: fwlog input drop cleanup IN=eth0 OUT= MAC=00:06:5b:84:60:7e:00:01:03:31:c1:be:08:00 SRC=172.30.10.42 DST=172.30.8.40 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=30431 DF PROTO=TCP SPT=33711 DPT=817 WINDOW=5840 RES=0x00 SYN URGP=0 Aug 21 10:37:00 loghost01 kernel: fwlog input drop cleanup IN=eth0 OUT= MAC=00:06:5b:84:60:7e:00:01:03:31:c1:be:08:00 SRC=172.30.10.42 DST=172.30.8.40 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=30432 DF PROTO=TCP SPT=33711 DPT=817 WINDOW=5840 RES=0x00 SYN URGP=0 Aug 21 10:37:12 loghost01 kernel: fwlog input drop cleanup IN=eth0 OUT= MAC=00: Aug 21 10:37:12 loghost01 kernel: 06:5b:84:60:7e:00:01:03:31:c1:be:08:00 SRC=172.30.10.42 DST=172.30.8.40 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=30433 DF PROTO=TCP SPT=33711 DPT=817 WINDOW=5840 RES=0x00 SYN URGP=0 Aug 21 10:38:33 loghost01 kernel: fwlog input drop cleanup IN=eth0 OUT= MAC=00:06:5b:84:60:7e:00:01:03:31:c1:be:08:00 SRC=172.30.10.42 DST=172.30.8.40 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=52186 DF PROTO=TCP SPT=33712 DPT=31337 WINDOW=5840 RES=0x00 SYN URGP=0 Aug 21 10:38:57 loghost01 kernel: fwlog input drop cleanup IN=eth0 OUT= MAC=00:06:5b:84:60:7e:00:01:03:31:c1:be:08:00 SRC=172.30.10.42 DST=172.30.8.40 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=52187 DF Aug 21 10:38:57 loghost01 kernel: PROTO=TCP SPT=33712 DPT=31337 WINDOW=5840 RES=0x00 SYN URGP=0 (sigh) ... At least they're no longer getting mangled (as far as I can tell, I haven't seen any mangled lines since I patched), but some entries are still getting split between two or more lines. Any ideas Balazs? --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Stephen Frost [mailto:sfrost@snowman.net] Sent: Wednesday, August 21, 2002 09:59 To: syslog-ng(a)lists.balabit.hu Cc: Dustin Trammell Subject: Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x * Dustin Trammell (DTrammell(a)PENSON.COM) wrote: > Having a bit of a problem with this patch... Using a freshly un-tarred copy > of 1.5.19: The quick and dirty answer is: touch sources.c.x or just touch *.x Stephen

2 1

RE: [syslog-ng][PATCH] please test: syslog-ng message mangling fi x
by Dustin Trammell 21 Aug '02

21 Aug '02

Having a bit of a problem with this patch... Using a freshly un-tarred copy of 1.5.19: [/usr/local/src/syslog-ng-1.5.19/src]# patch -p0 < /root/mangle.patch patching file sources.c [/usr/local/src/syslog-ng-1.5.19]# ./configure (snip - configure completes with no problems) [/usr/local/src/syslog-ng-1.5.19]# make Making all in src make[1]: Entering directory `/usr/local/src/syslog-ng-1.5.19/src' make all-recursive make[2]: Entering directory `/usr/local/src/syslog-ng-1.5.19/src' Making all in . make[3]: Entering directory `/usr/local/src/syslog-ng-1.5.19/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.19/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c main.c make_class <sources.c >sources.c.xT /bin/sh: /usr/local/bin/make_class: bad interpreter: No such file or directory make[3]: *** [sources.c.x] Error 126 make[3]: Leaving directory `/usr/local/src/syslog-ng-1.5.19/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-1.5.19/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.19/src' make: *** [all-recursive] Error 1 Without the patch it configures and compiles fine. Any ideas what could be causing the problem that's related to the patch under Linux 2.4.18 (libc 2.2.3 & libol 0.3.3)? Thanks, --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Wednesday, August 21, 2002 07:51 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fix On Tue, Aug 20, 2002 at 07:38:21AM -0400, Stephen Frost wrote: > Balazs and everyone, > > The first fix which was posted to the list changing the if to be: > > if (!eol && closure->pos == closure->max_log_line) > > appeared to work correctly for me. The second fix posted which > changed the if to be: > > if (!eol && (start_pos == 0 || closure->pos == closure->max_log_line)) > > had the same (broken) behaviour as the unmodified if. This leads me > to conclude that 'closure->pos == closure->max_log_line' is false, > '!eol' is true and 'start_pos == 0' is true. log_msg_size() does not > appear to have any effect. I have increased it to be 2048 and still > my logs are split amoung lines. Message length doesn't appear to > matter either as messages which are longer can end up being intact > while shorter messages are split. The one common factor is that all > of the messages being split are coming from /proc/kmsg. hm. as it seems there was a change on the behaviour of /proc/kmsg. The condition used to be: - if (!eol && closure->pos) { - /* we don't have a terminating nl nor \0 */ and there was no reports on mangled messages. Maybe 2.4 kernel introduced a change, and syslog-ng reads kernel message parts with multiple read() calls. > > Since there was some concern about UDP messages being broken by this > my first thought is to change the if to be: > > if (!eol && (closure->dgram || closure->pos == closure->max_log_line)) > > This makes the assumption that messages coming from streams such as a > TCP connection or /dev/log or a file/pipe will eventually have a > terminating newline or \0. Of course, it keeps the sanity check to > not create messages over max_log_line. I have this working on my > setup now but I don't swear that it's perfect, I'd love to hear > feedback on it, esp. from Balazs. These messages being split causes > me a real problem on my firewall. Relying on closure->dgram seems to me a sane decision. start_pos was only a hack anyway. Here's an updated patch (still against 1.5.19): diff -u -r1.34 sources.c --- sources.c 18 Jul 2002 13:18:02 -0000 1.34 +++ sources.c 21 Aug 2002 12:44:18 -0000 @@ -112,8 +113,11 @@ closure->pos = 0; return ST_OK | ST_GOON; } - if (!eol && closure->pos) { - /* we don't have a terminating nl nor \0 */ + if (!eol && (closure->dgram || closure->pos == closure->max_log_line)) { + /* we don't have a terminating nl nor \0, and our buffer is + full or we are a datagram receiver, when the message is in + its own packet. + */ do_handle_line(closure, closure->pos, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fix
by Stephen Frost 21 Aug '02

21 Aug '02

Balazs and everyone, The first fix which was posted to the list changing the if to be: if (!eol && closure->pos == closure->max_log_line) appeared to work correctly for me. The second fix posted which changed the if to be: if (!eol && (start_pos == 0 || closure->pos == closure->max_log_line)) had the same (broken) behaviour as the unmodified if. This leads me to conclude that 'closure->pos == closure->max_log_line' is false, '!eol' is true and 'start_pos == 0' is true. log_msg_size() does not appear to have any effect. I have increased it to be 2048 and still my logs are split amoung lines. Message length doesn't appear to matter either as messages which are longer can end up being intact while shorter messages are split. The one common factor is that all of the messages being split are coming from /proc/kmsg. Since there was some concern about UDP messages being broken by this my first thought is to change the if to be: if (!eol && (closure->dgram || closure->pos == closure->max_log_line)) This makes the assumption that messages coming from streams such as a TCP connection or /dev/log or a file/pipe will eventually have a terminating newline or \0. Of course, it keeps the sanity check to not create messages over max_log_line. I have this working on my setup now but I don't swear that it's perfect, I'd love to hear feedback on it, esp. from Balazs. These messages being split causes me a real problem on my firewall. Thanks, Stephen

2 1

Re: [syslog-ng]logging into database
by Michael Earls 21 Aug '02

21 Aug '02

thank you,, I will make note of that in my mini how to >>> bazsi(a)balabit.hu 08/21/02 08:08 AM >>> On Fri, Aug 16, 2002 at 02:10:53PM -0400, Michael Earls wrote: > I have not had any trouble logging messages to the mysql database with > this option set in syslog-ng. The one thing I have noticed from pple > asking for help is that this example only explains how to setup > syslog-ng to log from udp/external source, and not log internal > messages. > > Bazi * What is the correct syntax " template-escape or > template_escape" it is the same. currently I prefer using _ in names, but those introduced earlier contain '-' as well. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Cisco PIX TCP syslog stream format - and UDP truncation.
by Ted_Rule＠flextech.co.uk 21 Aug '02

21 Aug '02

I have a little problem with a PIX using UDP syslog to an old syslogd server, which I'm hoping members of the list may be able to assist me with. Some time ago, I noticed that some of the bigger messages were being truncated. Further investigation suggested that Cisco were imposing a 256 character limit on messages sent via syslog. The problem is rarely seen - mostly it shows up with IPSEC key renewal messages which happen to be very long. After several "oh yes it does, oh no it doesn't" rounds of trying to convince our suppliers, and in turn Cisco - who initially swore blind they couldn't reproduce the fault - Cisco finally admitted that they do indeed impose a 256 limit on UDP syslog messages. The PIX is perfectly capable of handling bigger UDP messages than that - it has to do in order just to process DNS messages - so the problem only affects the PIX UDP syslog stream. Cisco also recommend , of course, using TCP instead, which they haven't apparently imposed such a restriction on; TCP usage would also help to improve the general security of the logging process, which would also be a good thing anyway. Cisco don't appear to be very interested in my request to patch the UDP message buffer size; I think it would be nothing more than a single line code change to raise the buffer size to 512 which should easily cover any IPSEC syslog messages I can see being truncated. I'm strongly considering migrating the syslog server to syslog-ng so that I could support TCP syslog streams anyway, but in order to defend against any migration problems I wanted a backup plan for PIX TCP stream support. My current plan is some form of very temporary perl daemon listening on TCP redirecting to the Unix Domain syslog socket. So. Does anyone on the list have experience of Cisco PIX TCP Syslog stream talking to syslog-ng? Does anyone on the list have a good idea of the internal layout of the PIX TCP syslog stream - in particular how is the end of message encoded? ( Under UDP of course , EOM is implied by end of packet, but under TCP some explicit EOM marker would have(?) to be added to the stream. ) Would anyone be able to send me some tcpdumps or similar for me to decode the format so that I could generate some test data to fire at the listener? Ted *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

3 2

Re: [syslog-ng]logging into database
by Michael Earls 21 Aug '02

21 Aug '02

I have not had any trouble logging messages to the mysql database with this option set in syslog-ng. The one thing I have noticed from pple asking for help is that this example only explains how to setup syslog-ng to log from udp/external source, and not log internal messages. Bazi * What is the correct syntax " template-escape or template_escape" Thanks Michael Earls http://www.vermeer.org >>> mdodson(a)coremetrics.com 08/16/02 12:56PM >>> I noticed one thing. In the following section -- "template-escape" should be "template_escape" " d_mysql { > > pipe("/tmp/mysql.pipe" > > template("INSERT INTO logs (host, facility, priority, > level, tag, date, > time, > program, msg) VALUES ( '$HOST', '$FACILITY', > '$PRIORITY', '$LEVEL', '$TAG', > > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', > '$MSG' );\n") template-escape(yes));" On Fri, 2002-08-16 at 06:49, hicham rahimi wrote: > > hi, > > i want to setup logging syslog-ng'messages into a > mysql database ,in order to make the messages > organization more powerful. > > i have tested an exemple given in www.vermeer.com > but it doesn't work. > if any one have tested it , tell me please if it > contain a bug or not > thanks > hicham; > > here the exemple: > > Centralized syslog-ng to mysql database > > > by Michael Earls > > To established a centralized location for syslog-ng > collection in order to facilitate: > > Immediate log reporting (both real time and summary > reporting) > Long term log storage (for archival and for possible > later analysis). > Tools used: > syslog-ng -- template() destinations are only > supported by the 1.5.x releases. > mysql > My Own PhP Files > phpmyedit > phpmyadmin > Syslog-ng/Pipe Scripts > MySql Replication > > > Demo https://daffy.chmcc.org/syslog// > This site is still in testing phase > > > Demo-files The files I used for the Demo -- NEW DEMO > FILE -- > > To setup syslog-ng to log to a mysql database. This > assumes that you have installed and setup syslog-ng > and mysql. > > Edit the syslog-ng.conf file > This tells syslog-ng to pipe to a fifo template > > Add the following lines -- > > ## Log syslog-ng > to mysql database > ## > > destination > d_mysql { > > pipe("/tmp/mysql.pipe" > > template("INSERT INTO logs (host, facility, priority, > level, tag, date, > time, > program, msg) VALUES ( '$HOST', '$FACILITY', > '$PRIORITY', '$LEVEL', '$TAG', > > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', > '$MSG' );\n") template-escape(yes)); > }; > log { > source(net); destination(d_mysql); > }; > > Then comment out this line -- > > # This is the > default behavior of sysklogd package > # Logs may > come from unix stream, but not from another machine. > # > #source src { > unix-dgram("/dev/log"); internal(); }; > > Then uncomment out this line -- > > # If you wish > to get logs from remote machine you should uncomment > # this and > comment the above source line. > # > source src { > unix-dgram("/etc/log/log"); internal(); }; > source net { > udp(); }; > > > > Create the database for syslog-ng -- > > Create a file called syslog.sql and paste this > below, this will create the database " syslog" and > table " logs" in mysql. > > # > # Table structure for table > `logs` > # > > CREATE DATABASE syslog; > > USE syslog; > > CREATE TABLE logs ( > host varchar(32) default NULL, > facility varchar(10) default > NULL, > priority varchar(10) default > NULL, > level varchar(10) default > NULL, > tag varchar(10) default NULL, > date date default NULL, > time time default NULL, > program varchar(15) default > NULL, > msg text, > seq int(10) unsigned NOT NULL > auto_increment, > PRIMARY KEY (seq), > KEY host (host), > KEY seq (seq), > KEY program (program), > KEY time (time), > KEY date (date), > KEY priority (priority), > KEY facility (facility) > ) TYPE=MyISAM; > > Run this command > > mysql -u root -p < syslog.sql > > This will install the database into mysql. > > Create a fifo pipe file -- > This is the file that syslog-ng will store > records before writing to the database. > > > mkfifo /tmp/mysql.pipe > > You need to restart syslog-ng -- > > /etc/init.d/syslog-ng stop # Stop > syslog-ng > /etc/ini.d/syslog-ng start # Start > syslog-ng > > Run this command to pipe the file mysql.pipe to mysql > database > > You need to create a script that will check to make > sure this command is running and restart if stopped. > Syslog-ng/Pipe scripts > > When this file is started it will hang, You > need to create a script and have it run on startup. > > mysql -u root --password=passwd > syslog < /tmp/mysql.pipe > > > > > -------------------------------------------------------------------------------- > > > This is a mini how-to and is in the second > draft::Thanks again to everyone.. > > Michael > > Any questions just email me > --Michael(a)michaelearls.com-- > > Created Jan 18, 2002 > Last Updated May 18, 2002 > > > > ___________________________________________________________ > Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! > Yahoo! Mail : http://fr.mail.yahoo.com > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

logging pauses and log entry truncation
by Dustin Trammell 21 Aug '02

21 Aug '02

Has anyone else experienced syslog-ng occasionally pausing for a few minutes, immediately after logging one or more truncated entries? It usually pauses for anywhere from 1-10 minutes or so, and the process seems to be fine during this time (still bound to the port, doesn't appear to be zombied or using up all the CPU or memory, etc), then it continues after the pause as if nothing happened. The entry immediately after the pause is sometimes truncated also. The lines that are getting truncated appear to always be kernel log entries, more specifically from iptables, so I tried both using klogd as well as a file() source using /proc/kmsg, both with the same results. I saw a thread a few days ago about garbled/truncated entries, and what I got from that thread was to set the log_msg_size() option to something larger than the largest line your expecting. I set mine to 2048, and that still has not solved the problem, so I'm not sure if it's the same issue that has been discussed in the previous thread or something different. Below I've listed a few log entries (gathered from tail -f logfile), and my syslog-ng.conf file is appended below my sig. ---8<-----(snip)-----8<--- Aug 12 08:10:01 172.30.10.3 arpwatch: eth7 bogon 192.168.168.14 0:4:c0:3:a8:0 Aug 12 08:10:01 172.30.10.60 traqer: doing 10 minute stuff Aug 12 08:10:01 172.30.10.60 kernel: fwlog output accept db IN= OUT=ipsec0 SRC=172.30.10.60 DST=172.30.10.61 LEN=60 TOS=0x00 PREC=0x00 TTL=232 ID=1196 PROTO=TCP SPT=51118 DPT=5432 WINDOW=32440 RES=0x00 CWR ECE SYN URGP=0 Aug 12 08:10:01 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC=00:06:5b:84:60:7e:00:08:02:10: (pause) Aug 12 08:20:01 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC=00:06: Aug 12 08:11:05 loghost01 stunnel[23914]: httpd connected from 172.30.8.40:47705 Aug 12 08:11:05 loghost01 stunnel[23914]: SSL_accept: Peer suddenly disconnected ---8<-----(snip)-----8<--- Aug 12 11:01:29 172.30.10.60 pluto[3590]: "itdb" #814: ignoring Delete SA payload Aug 12 11:01:29 172.30.10.60 pluto[3590]: "itdb" #814: received and ignored informational message Aug 12 11:01:29 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC=00:06:5b:84:60:7e:00:08: Aug 12 11:01:29 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC= Aug 12 11:01:29 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC= (pause) Aug 12 11:06:49 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC=00:06: Aug 12 11:02:07 loghost01 snmptrapd[31633]: 209.48.214.5: Enterprise Specific Trap (500) Uptime: 6 days, 16:43:47.00, SNMPv2-SMI::enterprises.3224.2.1 = 40, SNMPv2-SMI::enterprises.3224.2.3 = "ALARM: vpn \"LC*Lon-VPN\" is up. (08/12/2002 11:01:27)" Aug 12 11:02:06 loghost01 stunnel[11455]: httpd connected from 172.30.8.40:40969 Aug 12 11:02:06 loghost01 stunnel[11455]: SSL_accept: Peer suddenly disconnected ---8<-----(snip)-----8<--- Aug 12 11:06:49 10.10.2.200 kernel: fwlog inet accept ssl IN=eth0 OUT=eth3 SRC=195.126.219.35 DST=192.168.200.20 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=59691 DF PROTO=TCP SPT=19846 DPT=443 WINDOW=32120 RES=0x00 SYN URGP=0 Aug 12 11:06:49 172.31.1.5 LasColinas-NS10: ALARM: vpn "LC*Lon-VPN" is up. (08/12/2002 11:01:27) Aug 12 11:06:49 172.30.10.3 arpwatch: eth1 bogon 172.19.1.6 0:3:fe:60:8:40 Aug 12 11:06:49 172.31.1.5 LasColinas-NS10: Can't connect to E-mail server 172.30.2.51 (08/12/2002 11:01:49) Aug 12 11:06:49 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC=00:06:5b:84:60:7e:00:08:02:10: (pause) Aug 12 11:08:36 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= MAC=00:06: Aug 12 11:08:07 loghost01 stunnel[24185]: httpd connected from 172.30.8.40:60549 Aug 12 11:08:07 loghost01 stunnel[24185]: SSL_accept: Peer suddenly disconnected ---8<-----(snip)-----8<--- Aug 12 11:16:13 172.31.1.5 LasColinas-NS10: NetScreen Traffic Log: device_id=LasColinas-NS10 start_time="08/12/2002 11:09:21" src=172.30.8.76 dst=172.31.1.5 service=icmp proto=1 policy_id=18 direction=incoming duration=1 sent=96 rcvd=96 action=Tunnel (LC*Dal-VPN) icmp type=8 Aug 12 11:20:01 loghost01 fwlog input drop cleanup IN=ipsec0 OUT= Aug 12 11:11:04 loghost01 tac_plus[9564]: Read -1 bytes from 172.30.8.40 , expecting 12 (pause) Aug 12 11:20:01 loghost01 MAC=00:06:5b:84:60:7e:00:08:02:10:cb:a4:08:00 SRC=172.30.10.61 DST=172.30.8.40 LEN=275 TOS=0x00 PREC=0x00 TTL=134 ID=4745 DF PROTO=UDP SPT=514 DPT=514 LEN=255 Aug 12 11:20:01 172.31.1.5 LasColinas-NS10: NetScreen Traffic Log: device_id=LasColinas-NS10 start_time="08/12/2002 11:09:20" src=172.30.8.5 dst=172.31.1.5 service=icmp proto=1 policy_id=18 direction=incoming duration=1 sent=112 rcvd=112 action=Tunnel (LC*Dal-VPN) icmp type=8 ---8<-----(snip)-----8<--- If anyone has experienced this or has any other ideas that I may not have tried yet, any info you can provide would be most appreciated. Thanks, --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. ### Syslog-NG Config File # Global Options options { chain_hostnames(no); use_dns(no); log_fifo_size(2000); log_msg_size(2048); sync(0); }; # Source Objects source s_local { internal(); }; source s_kmsg { file("/proc/kmsg"); }; source s_devlog { unix-stream("/dev/log" max-connections(150)); }; source s_udp514 { udp(); }; source s_tcp514 { tcp(ip("127.0.0.1") max-connections(150) keep-alive(yes)); }; source s_kernel { file("/proc/kmsg"); }; # Destination Objects destination d_varlog { file("/var/log/log"); }; destination d_tty8 { pipe("/dev/tty8"); }; destination d_logresp { pipe("/usr/local/logrespond/fifo/log" owner(logrespond) group(root) perm(0600) ); }; destination d_logtraq { pipe("/usr/local/logtraq/logpipe" owner(root) group(logtraq) perm(0640) ); }; # Log Paths log { source(s_local); source(s_kmsg); source(s_devlog); source(s_udp514); source(s_tcp514); source(s_kernel); destination(d_varlog); destination(d_tty8); destination(d_logresp); destination(d_logtraq); };

3 2

PID of programs
by harald schmidt 20 Aug '02

20 Aug '02

hello, I'm using syslog-ng to let my loghosts log to MySQL-databases as described under www.vermeer.org/syslog. Is it possible to filter the PID of a program to write it to an extra column of the MySQL table? This would be very useful to filter for example the sendmail-process of one mail. There are ~7 entries from sendmail for one mail, because of the virus scanner. Would it furthermore be possible to disperse the message in "to=.." and "from=.." to let that fields go to extra columns, too. thanks Harald -- Neu: Fakten testen jetzt noch günstiger 35% billiger + ein Geschenk Ihrer Wahl!! http://bonus.gmx.net/?gid=46842444&prid=687

1 0

output format to remote syslog duplicates info
by Clemson, Chris 20 Aug '02

20 Aug '02

Hello! I've been playing with syslog-ng, which is great, but I have a question. I am logging locally, and forwarding on entries to a remote syslogd (SL4NT). both work fine, and the entries in the /var/log/ syslog files are fine. However, on the SL4NT machine, the message entries include the date and machine name in the message log, even though it is included as fields in SL4NT. This behaviour doesn't happen when normal syslogds forward to my SL4NT server. Is there a way of turning this off by default? I'd prefer not to have to write templates for each rule I want sending to a remote syslogd. does anyone know if there is an option to turn this off? thanks! chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

[bug] Output templates.
by Sergey Y. Afonin 19 Aug '02

19 Aug '02

Hello. I think what I find one small bug in templates. The messages in log file have "\" before some symbols (",' etc). For example, log file definition: destination d_lan_by_host { file("/var/log/lan/$HOST.log" template("$DATE $MESSAGE\n")); }; The log file line is: Aug 18 12:28:53 At 07:28:50, Facility \"Auth Facility\", Level \"VERBOSE\":: A call, call id = 34996311, has arrived on interface slot:3/mod:23 The normal line is: Aug 18 12:28:53 At 07:28:50, Facility "Auth Facility", Level "VERBOSE":: A call, call id = 34996311, has arrived on interface slot:3/mod:23 Is it for normal file name generation, isn't it ? But it's not very suitable for log file... The version: 1.5.19 -- Regards, Sergey Afonin asy(a)kraft-s.ru

2 2

example config file
by Joerg Sommer 18 Aug '02

18 Aug '02

Hi, 2 changes on the sample config file for syslog-ng, I would prefer: * set the fileoptions (owner(), group(), perm()) in the global section * the file for logs of the facility user should have permission 644, that users can see, what they have done. Joerg.

1 0

logging into database
by hicham rahimi 16 Aug '02

16 Aug '02

hi, i want to setup logging syslog-ng'messages into a mysql database ,in order to make the messages organization more powerful. i have tested an exemple given in www.vermeer.com but it doesn't work. if any one have tested it , tell me please if it contain a bug or not thanks hicham; here the exemple: Centralized syslog-ng to mysql database by Michael Earls To established a centralized location for syslog-ng collection in order to facilitate: Immediate log reporting (both real time and summary reporting) Long term log storage (for archival and for possible later analysis). Tools used: syslog-ng -- template() destinations are only supported by the 1.5.x releases. mysql My Own PhP Files phpmyedit phpmyadmin Syslog-ng/Pipe Scripts MySql Replication Demo https://daffy.chmcc.org/syslog// This site is still in testing phase Demo-files The files I used for the Demo -- NEW DEMO FILE -- To setup syslog-ng to log to a mysql database. This assumes that you have installed and setup syslog-ng and mysql. Edit the syslog-ng.conf file This tells syslog-ng to pipe to a fifo template Add the following lines -- ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; Then comment out this line -- # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; Then uncomment out this line -- # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # source src { unix-dgram("/etc/log/log"); internal(); }; source net { udp(); }; Create the database for syslog-ng -- Create a file called syslog.sql and paste this below, this will create the database " syslog" and table " logs" in mysql. # # Table structure for table `logs` # CREATE DATABASE syslog; USE syslog; CREATE TABLE logs ( host varchar(32) default NULL, facility varchar(10) default NULL, priority varchar(10) default NULL, level varchar(10) default NULL, tag varchar(10) default NULL, date date default NULL, time time default NULL, program varchar(15) default NULL, msg text, seq int(10) unsigned NOT NULL auto_increment, PRIMARY KEY (seq), KEY host (host), KEY seq (seq), KEY program (program), KEY time (time), KEY date (date), KEY priority (priority), KEY facility (facility) ) TYPE=MyISAM; Run this command mysql -u root -p < syslog.sql This will install the database into mysql. Create a fifo pipe file -- This is the file that syslog-ng will store records before writing to the database. mkfifo /tmp/mysql.pipe You need to restart syslog-ng -- /etc/init.d/syslog-ng stop # Stop syslog-ng /etc/ini.d/syslog-ng start # Start syslog-ng Run this command to pipe the file mysql.pipe to mysql database You need to create a script that will check to make sure this command is running and restart if stopped. Syslog-ng/Pipe scripts When this file is started it will hang, You need to create a script and have it run on startup. mysql -u root --password=passwd syslog < /tmp/mysql.pipe -------------------------------------------------------------------------------- This is a mini how-to and is in the second draft::Thanks again to everyone.. Michael Any questions just email me --Michael(a)michaelearls.com-- Created Jan 18, 2002 Last Updated May 18, 2002 ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com

2 1

Adding log format parameters
by 조은진 16 Aug '02

16 Aug '02

1 0

RE: [syslog-ng]Problems compiling libol / syslog-ng
by Camacho, Christian 14 Aug '02

14 Aug '02

For the record, I deleted the part of the script that gives the error and resolved (workaround) the problem. Maybe there's a bug in the config file... :( Thanks, Christian -----Mensaje original----- De: Camacho, Christian Enviado el: Miércoles, 14 de Agosto de 2002 14:50 Para: syslog-ng(a)lists.balabit.hu Asunto: RE: [syslog-ng]Problems compiling libol / syslog-ng That's a weird error, the time was a couple of minutes ahead, I changed it now, but that's not the problem.... Anyone has compiled it on Redhat 7.3 before?? Christian -----Mensaje original----- De: Dustin Trammell [mailto:DTrammell@PENSON.COM] Enviado el: Miércoles, 14 de Agosto de 2002 13:07 Para: 'syslog-ng(a)lists.balabit.hu' Asunto: RE: [syslog-ng]Problems compiling libol / syslog-ng Check the time on your system, it's probably wrong. Usually configure won't continue if it finds files that are newer than current date/time, or it creates a file that is older than current date/time. --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Camacho, Christian [mailto:CCamacho@golder.cl] Sent: Wednesday, August 14, 2002 11:04 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Problems compiling libol / syslog-ng I have Redhat 7.3 and can't configure libol (I have the same problem with syslog-ng). I don't have an alias for ls, I don't know Why I'm having such problem, I've compiled other tar balls before without this error... Any idea?? [root@agua libol-0.3.3]# ./configure creating cache ./config.cache checking for a BSD compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking whether build environment is sane... configure: error: ls -t appears to fail. Make sure there is not a broken alias in your environment configure: error: newly created file is older than distributed files! Check your system clock Thanks, Chris DISCLAIMER: This message may contain confidential information. If you are not the intended recipient please advise the sender and erase the message. Thank you. DISCLAIMER: This message may contain confidential information. If you are not the intended recipient please advise the sender and erase the message. Thank you. DISCLAIMER: This message may contain confidential information. If you are not the intended recipient please advise the sender and erase the message. Thank you.

1 0

RE: [syslog-ng] logging pauses and log entry truncation
by Dustin Trammell 14 Aug '02

14 Aug '02

I can't comment on the /var/log/kern or /var/log/bootup stuff, as I simply have ALL logs go to a single file and do post-processing on it nightly which filters, splits, etc., and so far I have not had any problems with it failing to log to the logfile at any point. Because I'm sending all logs to a single destination (actually multiple destinations, but the point here is that ALL logs go to them), I don't set the log-level in my iptables statements, but I do set the log prefix: iptables -A INPUT -j LOG --log-prefix "$pkey input drop cleanup " iptables -A INPUT -j DROP So perhaps the log-prefix option could be the cause of the problem since we're both using them. If I get some time this afternoon I'll remove those from a test firewall and see if it continues to mangle/truncate the iptables log entries. --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Caylan Van Larson [mailto:caylan@cs.und.edu] Sent: Wednesday, August 14, 2002 10:57 To: Dustin Trammell Cc: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng] logging pauses and log entry truncation Also, I would like to add that syslog-ng stops appending to /var/log/kern after about 20k of data. It just stops, nothing. I restart syslog-ng and here is what happens: /var/log/bootup Aug 14 10:49:44 smack syslog-ng: klogd shutdown succeeded Aug 14 10:49:48 smack syslog-ng: syslog-ng startup succeeded Aug 14 10:49:48 smack syslog-ng: klogd startup succeeded (never says anything about syslog-ng shutdown ducceeded, is this normal?) /var/log/kern Populated for about 30k of data, truncated. I would also like to know why when I restart iptables it puts any output from the scripts to /var/log/bootup??? For instance, the iptables init script calls a firewall script that runs a bunch of iptable commands. This script also outputs some settings: --SNIP (from /var/log/bootup on iptables restart) Aug 14 10:50:53 smack fw-iptables: Serving port 22 (tcp) only to 134.129.212.0/24 134.129.217.128/26 Aug 14 10:50:53 smack fw-iptables: Serving port 113 (tcp) only to 134.129.212.0/24 Aug 14 10:50:53 smack fw-iptables: Serving port 515 (tcp) to the world. Aug 14 10:50:53 smack fw-iptables: Serving needs client as well: Client may access port 9100 (tcp) anywhere. Aug 14 10:50:53 smack fw-iptables: Enabling DNS Server Communications: Aug 14 10:50:53 smack fw-iptables: Serving port 53 (udp) to the world. Aug 14 10:50:53 smack fw-iptables: Serving needs client as well: Client may access port 53 (udp) anywhere. Aug 14 10:50:53 smack fw-iptables: Serving port 53 (tcp) Zone Transfers to 134.129.217.44 Aug 14 10:50:53 smack fw-iptables: Serving port 53 (tcp) Zone Transfers to 134.129.217.46 Aug 14 10:50:53 smack fw-iptables: Serving port 67 (udp) to the world. Aug 14 10:50:53 smack fw-iptables: Serving port 58884 (tcp) only to 134.129.212.0/24 Aug 14 10:50:53 smack fw-iptables: Client may access port 515 (tcp) only on 134.129.212.0/24 Aug 14 10:50:53 smack fw-iptables: Client may access port 389 (tcp) only on 134.129.212.0/24 Aug 14 10:50:53 smack fw-iptables: Client may access port 636 (tcp) only on 134.129.212.0/24 Aug 14 10:50:53 smack fw-iptables: Client may access port 37 (tcp) only on 134.129.212.0/24 Aug 14 10:50:53 smack fw-iptables: Client may access port 514 (tcp) only on 134.129.212.0/24 Aug 14 10:50:53 smack fw-iptables: Client may access port 514 (udp) only on 134.129.212.0/24 Aug 14 10:50:53 smack fw-iptables: Client may access port 143 (tcp) only on 134.129.212.0/24 Aug 14 10:50:53 smack fw-iptables: Client may access port 993 (tcp) only on 134.129.212.0/24 Aug 14 10:50:53 smack fw-iptables: Client may access port 110 (tcp) only on 134.129.212.0/24 Aug 14 10:50:53 smack fw-iptables: Client may access port 995 (tcp) only on 134.129.212.0/24 Aug 14 10:50:53 smack fw-iptables: Client may access port 58884 (tcp) only on 134.129.212.0/24 Aug 14 10:50:53 smack fw-iptables: Client may access port 23 (tcp) anywhere. Aug 14 10:50:53 smack fw-iptables: Client may access port 113 (tcp) anywhere. --SNAP Also, it may help to know that I am running all of my iptables LOG commands with the --log-level 6 and with custom --log-prefix "PREFIX" like this: --SNIP # Any tcp not already allowed is logged and then dropped. iptables -A INPUT -i $IFACE -p tcp -j LOG --log-level 6 --log-prefix "IPTABLES TCP-IN: " iptables -A INPUT -i $IFACE -p tcp -j DROP iptables -A OUTPUT -o $IFACE -p tcp -j LOG --log-level 6 --log-prefix "IPTABLES TCP-OUT: " iptables -A OUTPUT -o $IFACE -p tcp -j DROP --SNAP Are you adding these loglevel and logprefix switches also? Could this possibly be the problem? If iptables is adding these prefixes to late? I dont know :P Thanks, Caylan

1 0

RE: [syslog-ng]Problems compiling libol / syslog-ng
by Dustin Trammell 14 Aug '02

14 Aug '02

Check the time on your system, it's probably wrong. Usually configure won't continue if it finds files that are newer than current date/time, or it creates a file that is older than current date/time. --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Camacho, Christian [mailto:CCamacho@golder.cl] Sent: Wednesday, August 14, 2002 11:04 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Problems compiling libol / syslog-ng I have Redhat 7.3 and can't configure libol (I have the same problem with syslog-ng). I don't have an alias for ls, I don't know Why I'm having such problem, I've compiled other tar balls before without this error... Any idea?? [root@agua libol-0.3.3]# ./configure creating cache ./config.cache checking for a BSD compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking whether build environment is sane... configure: error: ls -t appears to fail. Make sure there is not a broken alias in your environment configure: error: newly created file is older than distributed files! Check your system clock Thanks, Chris DISCLAIMER: This message may contain confidential information. If you are not the intended recipient please advise the sender and erase the message. Thank you.

1 0

Problems compiling libol / syslog-ng
by Camacho, Christian 14 Aug '02

14 Aug '02

I have Redhat 7.3 and can't configure libol (I have the same problem with syslog-ng). I don't have an alias for ls, I don't know Why I'm having such problem, I've compiled other tar balls before without this error... Any idea?? [root@agua libol-0.3.3]# ./configure creating cache ./config.cache checking for a BSD compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking whether build environment is sane... configure: error: ls -t appears to fail. Make sure there is not a broken alias in your environment configure: error: newly created file is older than distributed files! Check your system clock Thanks, Chris DISCLAIMER: This message may contain confidential information. If you are not the intended recipient please advise the sender and erase the message. Thank you.

1 0

RE: [syslog-ng] logging pauses and log entry truncation
by Dustin Trammell 14 Aug '02

14 Aug '02

One difference I noticed between your log entries and mine is, yours appear to either get mangled and/or truncated, and then that's it, it continues on the next line with a new log entry. I've seen a bit different behavior in mine, where it will mangle and/or truncate a line, but then on the next entry, it continues with the rest of the previous entry. It's like when reading from /proc/kmsg it's erroneously detecting an end of line, sending that bit of data to the destinations, then continues reading from /proc/kmsg, starting where it cut off. For example: Aug 14 10:17:46 loghost01 fwlog input drop cleanup IN=eth0 OUT= MAC=00:06: Aug 14 10:17:46 loghost01 5b:84:60:7e:00:50:04:a5:11:1f:08:00 SRC=172.30.10.33 DST=172.30.8.40 LEN=60 TOS=0x00 PREC=0x00 TTL=219 ID=61008 DF PROTO=TCP SPT=54189 DPT=32601 WINDOW=5840 RES=0x00 SYN URGP=0 Aug 14 10:17:52 loghost01 <4>fwlog input drop cleanup IN=eth0 OUT= MAC=00: Aug 14 10:17:52 loghost01 06:5b:84:60:7e:00:50:04:a5:11:1f:08:00 SRC=172.30.10.33 DST=172.30.8.40 LEN=60 TOS=0x00 PREC=0x00 TTL=219 ID=36311 DF PROTO=TCP SPT=54189 DPT=32601 WINDOW=5840 RES=0x00 SYN URGP=0 As you can see, the first line gets truncated, then on the next line, it continues with the rest of the log entry starting where the previous one got cut off. While writing this, I just saw the most mangled entry I've seen yet: Aug 14 10:16:15 loghost01 fwlog input drop clenup Ib:84:602. PREC=0x00 TTL=79 ID=T=TCP S SYN TCP i OUT MAC=00:06:5b:84172.3072.=5840 RES=0x00 N=0 As opposed to what it /should/ look like: Aug 14 10:17:46 loghost01 fwlog input drop cleanup IN=eth0 OUT= MAC=00:06:5b:84:60:7e:00:50:04:a5:11:1f:08:00 SRC=172.30.10.33 DST=172.30.8.40 LEN=60 TOS=0x00 PREC=0x00 TTL=219 ID=45827 DF PROTO=TCP SPT=38821 DPT=32606 WINDOW=5840 RES=0x00 SYN URGP=0 Weird weird stuff. Hopefully some of this discussion and related log snippets will help Balazs pinpoint the problem. --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Caylan Van Larson [mailto:caylan@cs.und.edu] Sent: Wednesday, August 14, 2002 10:08 To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng] logging pauses and log entry truncation Yes, similar, but also erratic. I have it happening in the MAC addy and toward the end. Sometimes it seems as they are folded in on itself. I have placed a sample on www.cs.und.edu/~caylan/kern for your viewing pleasure. It is not my sytle to make things like this publicly accessible but I want to get this issue resolved. In case you did not see the above URL or are too lazy :P Aug 14 10:02:30 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08: Aug 14 10:02:31 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=63.151.197.164 DST=134.129.212.30 LEN=48 TOS=0x00 PREC=0x00TT14 2103DF PRTCP SW=163 Aug 14 10:02:32 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08: Aug 14 10:02:32 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc: Aug 14 10:02:32 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.215.35 DST=1PSPT7 DPT=137 L Aug 14 10:02:32 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08: Aug 14 10:02:33 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.215.35 DST=134.129.212.30 LEN=9 138 N=20 Aug 14 10:02:33 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08: Thats a pretty damn good sample! Good luck, Caylan Van Larson Unix Administrator - Systems Team Member University of North Dakota (Aerospace College) caylan(a)cs.und.edu 701-777-6151 (work)

2 1

RE: [syslog-ng] logging pauses and log entry truncation
by Dustin Trammell 14 Aug '02

14 Aug '02

I found out why syslog-ng was doing the pausing... I had accidentally left two source entries for /proc/kmsg in my syslog-ng.conf file (I was originally trying to see if using file() vs. pipe() made any difference in the log entry truncation), so I assume it was a locking issue with both of them trying to read from the same place. After removing one of them, I haven't had syslog-ng pause on me once, but I am still getting the log entry truncation on entries from iptables. It usually truncates on iptables log entries that have an empty OUT= tag (no out interface), and truncates just after the OUT= tag and before the MAC= tag, or somewhere halfway through the MAC address in the MAC= tag. Are you getting the truncation at the same place on the same types of log entries? --- Dustin D. Trammell Information Security Specialist Penson Financial Services, Inc. -----Original Message----- From: Caylan Van Larson [mailto:caylan@cs.und.edu] Sent: Monday, August 12, 2002 15:54 To: Dustin Trammell Cc: 'syslog-ng(a)lists.balabit.hu' Subject: Re: [syslog-ng]logging pauses and log entry truncation I am having very similar truncating going on. Bazsi is working on a fix. However, my logs never paused, maybe for a little bit (5-10seconds) but that is prolly just net traffic jumps. Good luck to Bazsi!!!

2 1