- syslog-ng - lists.balabit.hu

how can i get usb and printer detailed logs with syslog-ng
by ismail başaran 18 Jun '12

18 Jun '12

Hi, İ am using ubuntu 11.04. My server machine and clients ubuntu 11.04. i am trying to get usb and printer detailed logs. i can see usb connect and disconnect logs. But i want to see what operations execute on it like copied file name or printed file name. How can i achive this. thanks -- İsmail BAŞARAN http://www.softera.com.tr

2 1

issue with rewrite. Please help.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 15 Jun '12

15 Jun '12

Hi all, We have the following log 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 [ID 800047 auth.info] Accepted publickey for xyz We wanted to replace [ID 800047 auth.info] with empty string (i.e. "") and print the following 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 Accepted publickey for xyz So we have used the below re-write with subst. But this is not working in syslog-ng 3.4.0alpha2. rewrite rw_msg{subst("\\[.*\\]", "", value("MESSAGE"));}; Can somebody help out here? Thanks Hithendra

2 1

Re: [syslog-ng] issue with rewrite. Please help.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 15 Jun '12

15 Jun '12

Can somebody help here on this issue? _____________________________________________ From: Balla, Hithendra (EXT-Other - IN/Bangalore) Sent: Friday, June 15, 2012 9:09 AM To: 'Syslog-ng users' and developers' mailing list' Subject: issue with rewrite. Please help. Hi all, We have the following log 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 [ID 800047 auth.info] Accepted publickey for xyz We wanted to replace [ID 800047 auth.info] with empty string (i.e. "") and print the following 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 Accepted publickey for xyz So we have used the below re-write with subst. But this is not working in syslog-ng 3.4.0alpha2. rewrite rw_msg{subst("\\[.*\\]", "", value("MESSAGE"));}; Can somebody help out here? Thanks Hithendra

2 1

syslog-ng 3.3.4 Coredumps on AIX 5.2
by Divya Vikraman 15 Jun '12

15 Jun '12

Hello ALL, I have compiled syslog-ng 3.3.4 version using dynamic linking. But , while trying to run syslog-ng it coredumps # /opt/soe/local/syslog-ng-3.3.4/sbin/syslog-ng -F Memory fault(coredump) # I have compiled glib-2.19.7 with the (--enable-static and --with-libiconv) option After searching over the net for some possibel solutions , i found that a possible solution for this is to use the AIX libiconv instead of the GNU one. If this is correct, then the issue is , glib-2 needs the GNU glib, if i try with the system one the make fails with the below error. "error GNU libiconv not in use but included iconv.h is from libiconv". So, I cannot use the system libiconv as glib-2 will fail to compile and if I use GNU libiconv syslog-ng coredumps. though, the configure and stages do not complaing anything. Has, anyone else faced this issue , please let me know how can I get this working. Best Regards, Divya.

2 1

syslog-ng maintenance changes
by Balazs Scheidler 15 Jun '12

15 Jun '12

Hi, I had a decreasing amount of time to work on syslog-ng in the past year, as you may have noticed by my absense on the mailing list, and the relative rarity of my blog posts. More and more is done by Algernon (aka Gergely Nagy), and I felt it to be incorrect to be the bottleneck in a number of cases. Even though Algernon is emloyed by BalaBit, his daily job didn't and doesn't mandate such close relationship with syslog-ng. That was his own motivation, and I think that is a key to maintaining or developing open source software. After talking to him in real life, we've decided to make a shift, he is going to maintain the 3.3 tree and making releases instead of myself. This will make 3.3 maintenance smoother, and free some precious time for me, which I'd use to work on the 3.4 features. The location of the syslog-ng trees will change too, they would be available at: git://github.com/balabit/syslog-ng-3.3.git git://github.com/balabit/syslog-ng-3.4.git or the web interface at: http://github.com/balabit I am certain that this change is for the better of syslog-ng, and I hope the conclusion of the community will be the same in a few months. I really thank him for helping me out. Cheers, Bazsi

4 5

Building a syslog server (syslog-ng) with GUI
by Yu Watanabe 14 Jun '12

14 Jun '12

Hi all! I am planning to build a syslog server using syslog-ng, however, not using the configuration drivers of syslog-ng. Instead, I want to use a third party GUI that has a filtering function and would be better if can set actions for each fitlering. The reason for using other GUI is that because configuration file is getting bit complex. So, the story is make syslog-ng gather the logs and send it to database ( such as mysql ). The the thrid party GUI do the filtering. Cacti - camm plugin is one of my candidates. It would be helpful if people in this mailing list can give us some recommendation for the GUI. Thanks, Yu

6 5

logstore and idx files
by Anup Shetty 13 Jun '12

13 Jun '12

Hello, When using logstore(), it writes to log files with extension .lgs. The .jor files act as buffers before the logs are written on to the disk in .lgs files. Another file that gets created are the .idx files. What are the .idx files for? Each day logs from the servers gets stored into different files as the $Date parameter is used to create the file name. When this happens, suppose on 23:59:59 hrs, the journal file does not fill up to the chunk size defined or the chuck time does not expire and the syslog writes to a new file at 00:00:00hrs then what happens to the logs? do they get written onto the .lgs files? -- Thanks and regards, Anup Shetty +91-9820784185

2 2

php as program()
by Peter Czanik 13 Jun '12

13 Jun '12

Hello, A user in the web based community forum ran into trouble running php from program(). As it on SLES running syslog-ng 2.0 which is out of support for ages, I could not find anybody around me with an answer for it. The forum thread is available at http://communities.balabit.com/balabit/topics/php_as_programm and please register / write your solution there, if you have an answer for the question! (so I don't need to become a forum/list gw :-) ) Bye, -- Peter Czanik (CzP)<czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

FW: syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 13 Jun '12

13 Jun '12

Hi all, We found that the following rewrite caused the issue. We commented this part, and it was not giving any issue. But we need this rewrite option to be available. Can somebody let us know if this got changed in syslog-ng-3.4.0alpha2 ? Any suggestions ? #rewrite rw_msg{subst("\\[.*\\]", "", value("MESSAGE"));}; Thanks Hithendra From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ext anju.raveendrannair(a)wipro.com Sent: Friday, June 08, 2012 5:16 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance. Hi, We are using syslog-ng-3.4.0alpha2 binary and trying to run the syslog-ng server configuration file, but its not starting the syslog ng server. We are getting the following error incase of f__nonconsole_access filter when we ran the syslog-ng binary in debug mode. Filter rule evaluation result; result='match', rule='f_nonconsole_access', location='/ne_data/conf/syslogng/syslog-ng_server.conf:58:29' ** ERROR:logmsg.c:535:log_msg_set_value_indirect: assertion failed: (!log_msg_is_write_protected(self)) Abort (core dumped) PFA the debug.log The server conf is having the following line for the above mentioned filter, template ltemgr_msg_template { template("$S_ISODATE $HOST $FACILITY_NUM/$LEVEL_NUM $MSG\n"); }; #To strip of the msg_id introduced by syslogd rewrite rw_msg{subst("\\[.*\\] <file:///\\[.*\%5d> ", "", value("MESSAGE"));}; source s_LTEMGR_SYSLOG_CLIENTS{ tcp (ip (27.132.98.69) port(6515) max-connections(4) tls( key_file("/ne_data/conf/certificates/MOCM/MOCM_key.pem") cert_file("/ne_data/conf/certificates/MOCM/MOCM_SB_server.pem") ca_dir("/ne_data/conf/certificates/SYSLOGNG") cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SS Lv2") peer_verify(optional-untrusted) ) ); }; ....... destination d_ltemgr_nonconsoleaccess_log {file("/ne_data/syslog/ems" perm(0644) template(ltemgr_msg_template)); }; ...... filter f_nonconsole_access { level(info..notice) and facility(auth) and ( match("Accepted password for" value("MESSAGE")) or match("Failed password for" value("MESSAGE")) ); }; ..... log { source(s_LTEMGR_SYSLOG_CLIENTS); filter(f_nonconsole_access); rewrite(rw_msg); destination(d_ltemgr_nonconsoleaccess_log); }; Without debug mode, we were able to run the server but central logging is not happening when tried with logger command. Thanks, Anju Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

[Bug 183] New: Threaded Syslog-ng chashes resolving locally
by bugzilla＠bugzilla.balabit.com 08 Jun '12

08 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=183 Summary: Threaded Syslog-ng chashes resolving locally Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: egon(a)local.ee Type of the Report: bug Estimated Hours: 0.0 Syslog-ng crashes with segfault with following combination: threaded(yes); use_dns(persist_only); dns_cache_hosts(/etc/hosts); Jun 8 11:32:09 kernel: [5626308.537129] syslog-ng[15155]: segfault at 10 ip 00007fb09a512208 sp 00007fb0962b52a0 error 4 in libc-2.13.so[7fb09a49a000+17d000] Also tried to compile from source and on Debian squeeze distro, same issue occurred. System info: Debian GNU/Linux wheezy/sid \n \l Linux dev1 2.6.32-5-xen-amd64 #1 SMP Mon Jan 16 20:48:30 UTC 2012 x86_64 dpkg -l | grep -e syslog-ng -e libevtlog ii libevtlog0 0.2.12-5 Syslog event logger library ii libsyslog-ng-3.3.5:amd64 3.3.5-2 Next generation system logging daemon (private library) ii syslog-ng 3.3.5-2 Next generation system logging daemon (metapackage) ii syslog-ng-core 3.3.5-2 Next generation system logging daemon (core) ii syslog-ng-mod-json 3.3.5-2 Next generation system logging daemon (JSON plugin) ii syslog-ng-mod-mongodb 3.3.5-2 Next generation system logging daemon (MongoDB plugin) ii syslog-ng-mod-sql 3.3.5-2 Next generation system logging daemon (SQL plugin) # /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid -F --enable-core *** glibc detected *** /usr/sbin/syslog-ng: double free or corruption (fasttop): 0x00007f2ef25584c0 *** ======= Backtrace: ========= /lib/x86_64-linux-gnu/libc.so.6(+0x75b46)[0x7f2eeef75b46] /lib/x86_64-linux-gnu/libc.so.6(cfree+0x6c)[0x7f2eeef7a87c] /usr/lib/x86_64-linux-gnu/libsyslog-ng-3.3.5.so(main_loop_io_worker_thread_stop+0x65)[0x7f2ef0843755] /usr/lib/x86_64-linux-gnu/libsyslog-ng-3.3.5.so(+0x55b5b)[0x7f2ef085eb5b] /usr/lib/x86_64-linux-gnu/libsyslog-ng-3.3.5.so(+0x56226)[0x7f2ef085f226] /lib/x86_64-linux-gnu/libpthread.so.0(+0x6b50)[0x7f2eef28db50] /lib/x86_64-linux-gnu/libc.so.6(clone+0x6d)[0x7f2eeefd89dd] ======= Memory map: ======== 7f2ee4000000-7f2ee4022000 rw-p 00000000 00:00 0 7f2ee4022000-7f2ee8000000 ---p 00000000 00:00 0 7f2eea308000-7f2eea31d000 r-xp 00000000 ca:01 1180084 /lib/x86_64-linux-gnu/libgcc_s.so.1 7f2eea31d000-7f2eea51d000 ---p 00015000 ca:01 1180084 /lib/x86_64-linux-gnu/libgcc_s.so.1 7f2eea51d000-7f2eea51e000 rw-p 00015000 ca:01 1180084 /lib/x86_64-linux-gnu/libgcc_s.so.1 7f2eea51e000-7f2eea51f000 ---p 00000000 00:00 0 7f2eea51f000-7f2eead1f000 rw-p 00000000 00:00 0 7f2eead1f000-7f2eead20000 ---p 00000000 00:00 0 7f2eead20000-7f2eeb520000 rw-p 00000000 00:00 0 7f2eeb520000-7f2eeb527000 r-xp 00000000 ca:01 2886205 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1 7f2eeb527000-7f2eeb726000 ---p 00007000 ca:01 2886205 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1 7f2eeb726000-7f2eeb727000 r--p 00006000 ca:01 2886205 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1 7f2eeb727000-7f2eeb728000 rw-p 00007000 ca:01 2886205 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1 7f2eeb728000-7f2eeb729000 r-xp 00000000 ca:01 3020751 /usr/lib/syslog-ng/3.3.5/libtfjson.so 7f2eeb729000-7f2eeb929000 ---p 00001000 ca:01 3020751 /usr/lib/syslog-ng/3.3.5/libtfjson.so 7f2eeb929000-7f2eeb92a000 r--p 00001000 ca:01 3020751 /usr/lib/syslog-ng/3.3.5/libtfjson.so 7f2eeb92a000-7f2eeb92b000 rw-p 00002000 ca:01 3020751 /usr/lib/syslog-ng/3.3.5/libtfjson.so 7f2eeb92b000-7f2eeb93d000 r-xp 00000000 ca:01 2886210 /usr/lib/x86_64-linux-gnu/libmongo-client.so.0.3.1 7f2eeb93d000-7f2eebb3d000 ---p 00012000 ca:01 2886210 /usr/lib/x86_64-linux-gnu/libmongo-client.so.0.3.1 7f2eebb3d000-7f2eebb3e000 r--p 00012000 ca:01 2886210 /usr/lib/x86_64-linux-gnu/libmongo-client.so.0.3.1 7f2eebb3e000-7f2eebb3f000 rw-p 00013000 ca:01 2886210 /usr/lib/x86_64-linux-gnu/libmongo-client.so.0.3.1 7f2eebb3f000-7f2eebb49000 r-xp 00000000 ca:01 3020746 /usr/lib/syslog-ng/3.3.5/libafmongodb.so 7f2eebb49000-7f2eebd48000 ---p 0000a000 ca:01 3020746 /usr/lib/syslog-ng/3.3.5/libafmongodb.so 7f2eebd48000-7f2eebd49000 r--p 00009000 ca:01 3020746 /usr/lib/syslog-ng/3.3.5/libafmongodb.so 7f2eebd49000-7f2eebd4a000 rw-p 0000a000 ca:01 3020746 /usr/lib/syslog-ng/3.3.5/libafmongodb.so 7f2eebd4a000-7f2eebd55000 r-xp 00000000 ca:01 1180101 /lib/x86_64-linux-gnu/libnss_files-2.13.so 7f2eebd55000-7f2eebf54000 ---p 0000b000 ca:01 1180101 /lib/x86_64-linux-gnu/libnss_files-2.13.so 7f2eebf54000-7f2eebf55000 r--p 0000a000 ca:01 1180101 /lib/x86_64-linux-gnu/libnss_files-2.13.so 7f2eebf55000-7f2eebf56000 rw-p 0000b000 ca:01 1180101 /lib/x86_64-linux-gnu/libnss_files-2.13.so 7f2eebf56000-7f2eebf60000 r-xp 00000000 ca:01 1180097 /lib/x86_64-linux-gnu/libnss_nis-2.13.so 7f2eebf60000-7f2eec15f000 ---p 0000a000 ca:01 1180097 /lib/x86_64-linux-gnu/libnss_nis-2.13.so 7f2eec15f000-7f2eec160000 r--p 00009000 ca:01 1180097 /lib/x86_64-linux-gnu/libnss_nis-2.13.so 7f2eec160000-7f2eec161000 rw-p 0000a000 ca:01 1180097 /lib/x86_64-linux-gnu/libnss_nis-2.13.so 7f2eec161000-7f2eec168000 r-xp 00000000 ca:01 1180090 /lib/x86_64-linux-gnu/libnss_compat-2.13.so 7f2eec168000-7f2eec367000 ---p 00007000 ca:01 1180090 /lib/x86_64-linux-gnu/libnss_compat-2.13.so 7f2eec367000-7f2eec368000 r--p 00006000 ca:01 1180090 /lib/x86_64-linux-gnu/libnss_compat-2.13.so 7f2eec368000-7f2eec369000 rw-p 00007000 ca:01 1180090 /lib/x86_64-linux-gnu/libnss_compat-2.13.so 7f2eec369000-7f2eec36b000 r-xp 00000000 ca:01 3015504 /usr/lib/syslog-ng/3.3.5/libconfgen.so 7f2eec36b000-7f2eec56a000 ---p 00002000 ca:01 3015504 /usr/lib/syslog-ng/3.3.5/libconfgen.so 7f2eec56a000-7f2eec56b000 r--p 00001000 ca:01 3015504 /usr/lib/syslog-ng/3.3.5/libconfgen.so 7f2eec56b000-7f2eec56c000 rw-p 00002000 ca:01 3015504 /usr/lib/syslog-ng/3.3.5/libconfgen.so 7f2eec56c000-7f2eec570000 r-xp 00000000 ca:01 3015523 /usr/lib/syslog-ng/3.3.5/libsyslogformat.so 7f2eec570000-7f2eec76f000 ---p 00004000 ca:01 3015523 /usr/lib/syslog-ng/3.3.5/libsyslogformat.so 7f2eec76f000-7f2eec770000 r--p 00003000 ca:01 3015523 /usr/lib/syslog-ng/3.3.5/libsyslogformat.so 7f2eec770000-7f2eec771000 rw-p 00004000 ca:01 3015523 /usr/lib/syslog-ng/3.3.5/libsyslogformat.so 7f2eec771000-7f2eec787000 r-xp 00000000 ca:01 3015515 /usr/lib/syslog-ng/3.3.5/libdbparser.so 7f2eec787000-7f2eec987000 ---p 00016000 ca:01 3015515 /usr/lib/syslog-ng/3.3.5/libdbparser.so 7f2eec987000-7f2eec988000 r--p 00016000 ca:01 3015515 /usr/lib/syslog-ng/3.3.5/libdbparser.so 7f2eec988000-7f2eec989000 rw-p 00017000 ca:01 3015515 /usr/lib/syslog-ng/3.3.5/libdbparser.so 7f2eec989000-7f2eec991000 r-xp 00000000 ca:01 3015509 /usr/lib/syslog-ng/3.3.5/libcsvparser.so 7f2eec991000-7f2eecb91000 ---p 00008000 ca:01 3015509 /usr/lib/syslog-ng/3.3.5/libcsvparser.so 7f2eecb91000-7f2eecb92000 r--p 00008000 ca:01 3015509 /usr/lib/syslog-ng/3.3.5/libcsvparser.so 7f2eecb92000-7f2eecb93000 rw-p 00009000 ca:01 3015509 /usr/lib/syslog-ng/3.3.5/libcsvparser.so 7f2eecb93000-7f2eecb95000 r-xp 00000000 ca:01 3015503 /usr/lib/syslog-ng/3.3.5/libbasicfuncs.so 7f2eecb95000-7f2eecd95000 ---p 00002000 ca:01 3015503 /usr/lib/syslog-ng/3.3.5/libbasicfuncs.so 7f2eecd95000-7f2eecd96000 r--p 00002000 ca:01 3015503 /usr/lib/syslog-ng/3.3.5/libbasicfuncs.so 7f2eecd96000-7f2eecd97000 rw-p 00003000 ca:01 3015503 /usr/lib/syslog-ng/3.3.5/libbasicfuncs.so 7f2eecd97000-7f2eece18000 r-xp 00000000 ca:01 1180092 /lib/x86_64-linux-gnu/libm-2.13.so 7f2eece18000-7f2eed017000 ---p 00081000 ca:01 1180092 /lib/x86_64-linux-gnu/libm-2.13.so 7f2eed017000-7f2eed018000 r--p 00080000 ca:01 1180092 /lib/x86_64-linux-gnu/libm-2.13.so 7f2eed018000-7f2eed019000 rw-p 00081000 ca:01 1180092 /lib/x86_64-linux-gnu/libm-2.13.soAborted (core dumped) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4