- syslog-ng - lists.balabit.hu

[PATCH] logrewrite: Correctly initialize the conditional rules.
by Gergely Nagy 09 Jan '12

09 Jan '12

In case where the condition of a rewrite used a filter reference instead of inlining the filter itself, the filter expression was never initialized. This resulted in the condition always evaluating to not-match, making the following construct completely useless: rewrite("new-value", value("MESSAGE"), condition(filter(f_my_filter))) The fix is to introduce a new function, log_rewrite_init_method(), which will initialize the condition filter if it exists, and has an init method. Then we bind this method to LogPipe's init callback during log_rewrite_init(). This way, when initializing the rewrite pipe, the condition will get initialised too. Reported-by: Thomas Wollner <tw(a)wollner-net.de> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/logrewrite.c | 12 ++++++++++++ 1 files changed, 12 insertions(+), 0 deletions(-) diff --git a/lib/logrewrite.c b/lib/logrewrite.c index a578439..3ff245a 100644 --- a/lib/logrewrite.c +++ b/lib/logrewrite.c @@ -75,6 +75,17 @@ log_rewrite_free_method(LogPipe *s) log_process_pipe_free_method(s); } +static gboolean +log_rewrite_init_method(LogPipe *s) +{ + LogRewrite *self = (LogRewrite *) s; + + if (self->condition && self->condition->init) + self->condition->init(self->condition, log_pipe_get_config(s)); + + return TRUE; +} + static void log_rewrite_init(LogRewrite *self) { @@ -83,6 +94,7 @@ log_rewrite_init(LogRewrite *self) self->super.super.flags |= PIF_CLONE; self->super.super.free_fn = log_rewrite_free_method; self->super.super.queue = log_rewrite_queue; + self->super.super.init = log_rewrite_init_method; self->value_handle = LM_V_MESSAGE; } -- 1.7.7.3

2 1

Error while starting Syslog-ng
by Kareep Navas 03 Jan '12

03 Jan '12

Error creating AF_INET socket (Error 0) Error initializing configuration, exiting.

2 1

What is the latest version of Syslog-ng?
by Kareep Navas 03 Jan '12

03 Jan '12

Hi All, We are currently using syslog-ng 1.4.14 and i would like to use & know the latest version of this syslog-ng? What is the purpose of the latest version? How to download the latest version? What are all the dependencies? Please direct me.. Thank you,

2 1

missing IP information at the message part
by Oğuz Yarımtepe 01 Jan '12

01 Jan '12

I have syslog-ng and logzilla 2.9.9g installed on a Debian squeeze machine. I can see the logs at the web interface. I configured syslog-ng to collect apache error and access logs. The problem is that i don't see IP information at the message part, on web interface. For ex, one of the machine that is sending apache logs is "www" machine. The syslog-ng configuration is as below: # All messages send to a remote site # #log { source(s_src); destination(d_net); }; #manual edit options { log_msg_size(8192); }; ####### # sources # ####### source s_apache_access { # unix-stream("/var/log/httpd/apache_log.socket" # max-connections(512) # keep-alive(yes)); file ("/var/log/apache2/access.log" flags(no-parse)); }; source s_apache_error { # unix-stream("/var/log/httpd/apache_log.socket" # max-connections(512) # keep-alive(yes)); file ("/var/log/apache2/error.log" flags(no-parse)); }; ################ # destinations # ################ destination d_custom_access { file("/var/log/apache2/custom_access.log"); }; destination d_custom_error { file("/var/log/apache2/custom_error.log"); }; destination d_apache_tls { tcp("192.168.1.145" port(6514) tls(ca_dir("/etc/syslog-ng/etc/ca.d") key_file("/etc/syslog-ng/etc/key.d/debian4key.pem") cert_file("/etc/syslog-ng/etc/cert.d/debian4cert.pem"))); }; ########### # filters # ########### filter f_apache_access { message("GET|POST"); }; filter f_apache_error { message("error"); }; log { source(s_apache_access); # filter(f_apache_access); destination(d_apache_tls); }; log { source(s_apache_error); # filter(f_apache_access); destination(d_apache_tls); }; and # tail -n1 /var/log/apache2/access.log 78.185.240.170 - - [01/Jan/2012:13:35:06 +0200] "GET /images/rand/randpic11.jpg HTTP/1.1" 200 45670 "http://www.comu.edu.tr/" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.63 Safari/535.7" www:/home/oguz# For the www machine i don't see the 78.185.240.170 information at the web ui, but the rest of the line starting with -- Thogh another machine, "reverse", is sending apache logs with and additional field and i can see its log at the web ui without any missing information. The reverse has the same configuration except from the key information. # tail -n1 /var/log/apache2/other_vhosts_access.log www.beeseurope.eu:80 178.154.160.29 - - [01/Jan/2012:13:36:46 +0200] "GET /mod/forum/discuss.php?d=55&parent=88 HTTP/1.1" 200 34557 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)" At the web interface, I can see the IP information also at the message part. My syslog-ng configuration at the server is as below: options { long_hostnames(off); # doesn't actually help on Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance flush_lines(16384); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(16384); # Hosts we don't want syslog from #bad_hostname("^(ctld.|cmd|tmd|last)$"); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); #Use DNS so that our good names are used, not hostnames use_dns(yes); dns_cache(yes); #Use the whole DNS name use_fqdn(yes); keep_hostname(yes); chain_hostnames(no); #Read permission for everyone perm(0644); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # # how many messages syslog-ng missed (0). # stats(43200); log_msg_size(8192); }; source s_apache { tcp(ip(0.0.0.0) port(6514) tls( key_file("/etc/syslog-ng/etc/key.d/debian1key.pem") cert_file("/etc/syslog-ng/etc/cert.d/debian1cert.pem") ca_dir("/etc/syslog-ng/etc/ca.d"))); }; filter f_apache_access { message("GET|POST"); }; filter f_apache_error { message("error"); }; # Create destination to LogZilla destination d_logzilla { program("/opt/logzilla-2.9.9g/scripts/db_insert.pl" template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n") #template("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC\t$HOST\t$PRI\t$PROGRAM\t$MSGONLY\n") ); }; # test purposes destination d_apache_test_access { file("/var/log/apache2/hosts/$HOST/$YEAR/$MONTH/$DAY/access.log" create_dirs(yes)); }; destination d_apache_test_error { file("/var/log/apache2/hosts/$HOST/$YEAR/$MONTH/$DAY/error.log" create_dirs(yes)); }; # Tell syslog-ng to log to our new destination log { source(s_apache); destination(d_logzilla); }; log { source(s_apache); filter(f_apache_error); destination(d_apache_test_error); }; log { source(s_apache); filter(f_apache_access); destination(d_apache_test_access); }; Any ides about how i can fix the missing IP information at the web ui of logzilla?

1 0

Re: [syslog-ng] syslog-ng Digest, Vol 80, Issue 33
by Anup Shetty 23 Dec '11

23 Dec '11

I cant execute those commands. Here's the error Unknown command Syntax: pdbtool <command> [options] Possible commands are: match Match a message against the pattern database dump Dump pattern datebase tree merge Merge pattern databases dictionary Dump pattern dictionary Version syslog-ng-premium-edition 3.2.1 Installer-Version: 3.2.1 > > > > > > ------------------------------ > > Message: 3 > Date: Thu, 22 Dec 2011 13:11:05 -0600 > From: Martin Holste <mcholste(a)gmail.com> > Subject: Re: [syslog-ng] Pattern matching. > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CANpnLHgau7bZrSP2ro0QY=a8ZcJZLyqJgAVegWufDuszOjuCMA(a)mail.gmail.com > > > Content-Type: text/plain; charset=ISO-8859-1 > > You can also include an example pattern as part of the actual rule like > this: > > <ruleset> > <program></program> > <rule id="2"> > <pattern>@ESTRING:user::@ Security Microsoft > Windows security auditing.: [Success Audit] A computer account was > changed. Subject: Security ID: S-1-5-7 Account Name: > ANONYMOUS LOGON Account Domain: NT AUTHORITY Logon ID: 0x3e6 > Computer Account That Was Changed: Security ID: @ESTRING:: > @Account Name: @ESTRING:ACC_NAME: @ Account Domain: WW002 > Changed Attributes: SAM Account Name: - Display Name: - User > Principal Name: - Home Directory: - Home Drive: - Script Path: > - Profile Path: - User Workstations: - Password Last Set: > @ESTRING:: @@ESTRING:: @ Account Expires: - Primary Group ID: - > AllowedToDelegateTo: - Old UAC Value: - New UAC Value: - User > Account Control: - User Parameters: - SID History: - Logon > Hours: - DNS Host Name: - Service Principal Names: - > Additional Information: Privileges: - (EventID 4742)</pattern> > <examples> > <example> > <test_message > program="Microsoft_Windows_security_auditing.[5784]">: Security > Microsoft Windows security auditing.: [Success Audit] A computer > account was changed. Subject: Security ID: S-1-5-7 Account > Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logon ID: > 0x3e6 Computer Account That Was Changed: Security ID: > S-1-5-21-776561741-789336058-725345543-305444 Account Name: User1$ > Account Domain: TEST Changed Attributes: SAM Account Name: - > Display Name: - User Principal Name: - Home Directory: - Home > Drive: - Script Path: - Profile Path: - User Workstations: - > Password Last Set: 12/22/2011 3:38:32 AM Account Expires: - > Primary Group ID: - AllowedToDelegateTo: - Old UAC Value: - New > UAC Value: - User Account Control: - User Parameters: - SID > History: - Logon Hours: - DNS Host Name: - Service Principal > Names: - Additional Information: Privileges: - (EventID > 4742)</test_message> > <test_value > name="ACC_NAME">User1$</test_value> > </example> > </examples> > </rule> > </ruleset> > > Then you can test it more easily like this: > pdbtool test patterndb.xml > > On Thu, Dec 22, 2011 at 8:04 AM, Balazs Scheidler <bazsi(a)balabit.hu> > wrote: > > On Thu, 2011-12-22 at 14:31 +0530, Anup Shetty wrote: > >> Nope, no luck yet. Still blanks being spit out. > >> > >> > >> Here's the exact extract of the pattern matching and the log: > >> > >> > >> Pattern String > >> --------------------------- > >> > >> > >> @ESTRING:user::@ Security Microsoft Windows security auditing.: > >> [Success Audit] A computer account was changed. ? ?Subject: ? Security > >> ID: ?S-1-5-7 ? Account Name: ?ANONYMOUS LOGON ? Account Domain: ?NT > >> AUTHORITY ? Logon ID: ?0x3e6 ? ?Computer Account That Was Changed: > >> Security ID: ?@ESTRING:: ?@Account Name: ? @ESTRING:ACC_NAME: @ > >> Account Domain: ?WW002 ? ?Changed Attributes: ? SAM Account Name: - > >> Display Name: ?- ? User Principal Name: - ? Home Directory: ?- ? Home > >> Drive: ?- ? Script Path: ?- ? Profile Path: ?- ? User Workstations: - > >> Password Last Set: @ESTRING:: @@ESTRING:: @ ? Account Expires: ?- > >> Primary Group ID: - ? AllowedToDelegateTo: - ? Old UAC Value: ?- ? New > >> UAC Value: ?- ? User Account Control: - ? User Parameters: - ? SID > >> History: ?- ? Logon Hours: ?- ? DNS Host Name: ?- ? Service Principal > >> Names: - ? ?Additional Information: ? Privileges: ?- (EventID 4742) > >> > >> > >> Log > >> ------------------ > >> > >> > >> Dec 22 03:38:32 Server.zoom11.test.net > >> Microsoft_Windows_security_auditing.[5784]: : Security Microsoft > >> Windows security auditing.: [Success Audit] A computer account was > >> changed. ? ?Subject: ? Security ID: ?S-1-5-7 ? Account Name: > >> ?ANONYMOUS LOGON ? Account Domain: ?NT AUTHORITY ? Logon ID: ?0x3e6 > >> ?Computer Account That Was Changed: ? Security ID: > >> ?S-1-5-21-776561741-789336058-725345543-305444 ? Account Name: ?User1$ > >> Account Domain: ?TEST ? ?Changed Attributes: ? SAM Account Name: - > >> Display Name: ?- ? User Principal Name: - ? Home Directory: ?- ? Home > >> Drive: ?- ? Script Path: ?- ? Profile Path: ?- ? User Workstations: - > >> Password Last Set: 12/22/2011 3:38:32 AM ? Account Expires: ?- > >> Primary Group ID: - ? AllowedToDelegateTo: - ? Old UAC Value: ?- ? New > >> UAC Value: ?- ? User Account Control: - ? User Parameters: - ? SID > >> History: ?- ? Logon Hours: ?- ? DNS Host Name: ?- ? Service Principal > >> Names: - ? ?Additional Information: ? Privileges: ?- (EventID 4742) > >> > >> > > "pdbtool match" can be used to test patterns. > > > > pdbtool patch -p <path to xml file> -P '<appname>' -M '<msg>' --debug > --color-out > > > > This even colours the output so that the partial matches can be > > recognized. This is the best way to troubleshoot patterns. > > > > -- > > Bazsi > > > > > -- Thanks and regards, Anup

2 1

How to split logs in the default folders?
by tokie＠tiscali.it 23 Dec '11

23 Dec '11

Hi, I'm not yet able to store my log by ip address. Can someone help me? How can I redirect everything that comes from a unique ip address (from LAN) to a folder I created? eg.: 192.168.1.1 (host1) == logs ==> 192.168.1.2 (syslog-ng-server )--->/ var/log/hosts/192.168.1.1 Tks and merry xmas!!! Tokie E' nata indoona: chiama, videochiama e messaggia Gratis. Scarica indoona per iPhone, Android e PC: http://www.indoona.com/

2 1

Solaris 10 support(?) in latest versions (e.g. 3.3.2)
by Marvin Nipper 22 Dec '11

22 Dec '11

Apologies upfront for the length, but this addresses two different problems. Environment: Solaris 10 x64 U10, fully patched (i.e. pretty much "new"). Currently operating (successfully) with 3.0.5, compiled on that platform, and distributed to a number of other Solaris 10 x64 targets. Problem: Trying to "make the leap" to 3.3.2, and get current, but that version seems to have numerous Solaris compatibility issues. Just trying to understand the status of Solaris support. Problem #1 Latest packaging no longer works with Solaris-based "make". After a clean configure (output here): syslog-ng Open Source Edition 3.3.2 configured Compiler options: compiler : gcc -std=gnu99 compiler options : -g -O2 -Wall -pthread -D_REENTRANT -D_PTHREADS -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -I/usr/local/ssl/include -DLIBNET_LIL_ENDIAN -I$(top_srcdir)/lib/ivykis/lib/include -I$(top_builddir)/lib/ivykis/lib/include -I$(top_srcdir)/lib/ivykis/modules/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -R/usr/local/lib -lpthread prefix : /usr/local linking mode : dynamic __thread keyword : yes Submodules: ivykis : internal libmongo-client : internal Features: Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : yes tcp-wrapper support : no Linux capability support : no PCRE support : no Env wrapper support : no systemd support : no (unit dir: none) Modules: Module search path : /usr/local/lib/syslog-ng Default module list : affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat,afstreams Sun STREAMS support (module): yes SSL support (module) : yes SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : no (using no) ..... a simple "make" attempt now immediately results in this: # make make all-recursive Making all in lib make: Fatal error in reader: Makefile, line 991: Unexpected end of line seen Current working directory /var/opt/packages/syslog-ng-3.3.2/lib *** Error code 1 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='lib modules syslog-ng scripts tests doc contrib scl debian tgz2build build'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /var/opt/packages/syslog-ng-3.3.2 *** Error code 1 make: Fatal error: Command failed for target `all' Not being a developer, per se, I spent time in Google-land, the general result that I find is: "These are caused because Solaris "make" doesn't accept the 'GNU multi-line Makefile format'. Use gmake instead." But there are obviously folks who also say that this can be fixed by "correcting" the problems in the Makefiles (so that would seem to be a preferable alternative). Problem #2 Can no longer perform successful compilations, due to this error: ld: fatal: relocation error: R_386_GOTOFF Same configure output as previously shown, followed by gmake (to get around the first problem). Numerous modules compile successfully, but then this happens: gcc -DHAVE_CONFIG_H -I. -I../.. -D_GNU_SOURCE -I../../lib/include -I../../lib/include -I../../modules/include -Wall -g -O2 -D_REENTRANT -D_POSIX_C_SOURCE=199506L -D_POSIX_PTHREAD_SEMANTICS -D_XPG4_2 -MT iv_event_test.o -MD -MP -MF .deps/iv_event_test.Tpo -c -o iv_event_test.o iv_event_test.c mv -f .deps/iv_event_test.Tpo .deps/iv_event_test.Po /bin/bash ../../libtool --tag=CC --mode=link gcc -Wall -g -O2 -D_REENTRANT -D_POSIX_C_SOURCE=199506L -D_POSIX_PTHREAD_SEMANTICS -D_XPG4_2 -R/usr/local/lib -o iv_event_test iv_event_test.o ../../lib/libivykis.la ../libivykis-modules.la -lrt -lpthread -lsocket libtool: link: gcc -Wall -g -O2 -D_REENTRANT -D_POSIX_C_SOURCE=199506L -D_POSIX_PTHREAD_SEMANTICS -D_XPG4_2 -o iv_event_test iv_event_test.o ../../lib/.libs/libivykis.a ../.libs/libivykis-modules.a /var/opt/packages/syslog-ng-3.3.2/lib/ivykis/lib/.libs/libivykis.a -lrt -lpthread -lsocket -R/usr/local/lib ld: fatal: relocation error: R_386_GOTOFF: file ../.libs/libivykis-modules.a(iv_event.o): symbol __tls: relocation illegal for TLS symbol ld: fatal: relocation error: R_386_GOTOFF: file ../.libs/libivykis-modules.a(iv_event.o): symbol __tls: relocation illegal for TLS symbol ld: fatal: relocation error: R_386_GOTOFF: file ../.libs/libivykis-modules.a(iv_event.o): symbol __tls: relocation illegal for TLS symbol ld: fatal: relocation error: R_386_GOTOFF: file ../.libs/libivykis-modules.a(iv_event.o): symbol __tls: relocation illegal for TLS symbol collect2: ld returned 1 exit status gmake[7]: *** [iv_event_test] Error 1 gmake[7]: Leaving directory `/var/opt/packages/syslog-ng-3.3.2/lib/ivykis/modules/test' gmake[6]: *** [all-recursive] Error 1 gmake[6]: Leaving directory `/var/opt/packages/syslog-ng-3.3.2/lib/ivykis/modules' gmake[5]: *** [all-recursive] Error 1 gmake[5]: Leaving directory `/var/opt/packages/syslog-ng-3.3.2/lib/ivykis' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/var/opt/packages/syslog-ng-3.3.2/lib/ivykis' gmake[3]: *** [all-recursive] Error 1 gmake[3]: Leaving directory `/var/opt/packages/syslog-ng-3.3.2/lib' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/var/opt/packages/syslog-ng-3.3.2/lib' gmake[1]: *** [all-recursive] Error 1 gmake[1]: Leaving directory `/var/opt/packages/syslog-ng-3.3.2' gmake: *** [all] Error 2 Again, adopting the "Google is my friend" approach, this appears to be an issue with "Solaris not supporting Visibility". (http://www.ilkda.com/compile/Build_Problems.htm) Most of the sites where I see this being discussed, with other (various) source components, I also see the developers subsequently modifying their environment to "adjust for" the Visibility issue in Solaris. So, again, not being a C developer myself, I guess I'm wondering whether I'm just doing something wrong with 3.3.2 (i.e. something that I need to do different from my 3.0.5 compilation), or whether this is truly just a "Solaris thing" that has not been accounted for in the current code base? Sorry for not being better at sorting this out myself. Any and all help/guidance would certainly be appreciated. GLAD to do some sort of testing here, if that will help. Also, just for reference, here is the full "configure" output from the 3.0.5 build, that compiles clean, and works just fine: checking pkg-config is at least version 0.9.0... yes checking for a BSD-compatible install... ./install-sh -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... ./install-sh -c -d checking for gawk... no checking for mawk... no checking for nawk... nawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc... (cached) gcc checking whether we are using the GNU C compiler... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ISO C89... (cached) none needed checking dependency style of gcc... (cached) gcc3 checking for bison... bison -y checking for flex... flex checking lex output file root... lex.yy checking lex library... -lfl checking whether yytext is a pointer... yes checking whether make sets $(MAKE)... (cached) yes checking for ranlib... ranlib checking for special C compiler options needed for large files... no checking for _FILE_OFFSET_BITS value needed for large files... 64 checking how to enable static linking for certain libraries... GNU or Solaris checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /usr/sfw/bin/ggrep checking for egrep... /usr/sfw/bin/ggrep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dmalloc.h usability... no checking dmalloc.h presence... no checking for dmalloc.h... no checking for strings.h... (cached) yes checking getopt.h usability... yes checking getopt.h presence... yes checking for getopt.h... yes checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/strlog.h usability... yes checking sys/strlog.h presence... yes checking for sys/strlog.h... yes checking door.h usability... yes checking door.h presence... yes checking for door.h... yes checking sys/capability.h usability... no checking sys/capability.h presence... no checking for sys/capability.h... no checking sys/prctl.h usability... no checking sys/prctl.h presence... no checking for sys/prctl.h... no checking tcpd.h usability... yes checking tcpd.h presence... yes checking for tcpd.h... yes checking whether struct tm is in sys/time.h or time.h... time.h checking for struct tm.tm_gmtoff... no checking for I_CONSLOG... yes checking for O_LARGEFILE... yes checking for struct sockaddr_storage... yes checking for struct sockaddr_in6... yes checking for PR_SET_KEEPCAPS... no checking for door_create in -ldoor... yes checking for socket in -lsocket... yes checking for nanosleep in -lrt... yes checking for gethostbyname in -lnsl... yes checking for regexec in -lregex... no checking for res_init in -lresolv... yes checking for cap_set_proc in -lcap... no checking for PCRE... no configure: WARNING: Cannot find pcre version >= 7.3. pcre support disabled. checking for strdup... yes checking for strtol... yes checking for strtoll... yes checking for strtoimax... yes checking for inet_aton... no checking for inet_ntoa... no checking for getopt_long... yes checking for getaddrinfo... no checking for getutent... yes checking for pread... yes checking for pwrite... yes checking for strcasestr... no checking for TCP wrapper library... -lwrap checking for OPENSSL... yes checking for dlsym in -ldl... yes checking for inflate in -lz... yes checking for dlsym in -ldl... (cached) yes checking for LIBDBI... no checking for dbi_initialize in -ldbi... no checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking for pthread_create in -lpthread... yes checking for LIBNET... stty: : No such device or address stty: : No such device or address yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking whether to enable IPv6 support... yes checking whether to enable SQL support... no checking whether to enable Linux capability support... no checking whether to enable PCRE support... no checking pkg-config is at least version 0.14... yes checking for GLIB - version >= 2.10.1... yes (version 2.13.5) checking for EVTLOG... yes checking for LIBNET... stty: : No such device or address stty: : No such device or address yes checking for static GLib libraries... yes checking sanity checking Glib headers... yes configure: creating ./config.status config.status: creating dist.conf config.status: creating Makefile config.status: creating syslog-ng.spec config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating doc/docvars.xml config.status: creating contrib/Makefile config.status: creating tests/Makefile config.status: creating debian/Makefile config.status: creating tgz2build/Makefile config.status: creating tests/unit/Makefile config.status: creating tests/functional/Makefile config.status: creating tests/loggen/Makefile config.status: creating config.h config.status: executing depfiles commands syslog-ng Open Source Edition 3.0.5 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -I/usr/local/include/glib-2.0 -I/u sr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -I/usr/local/ssl /include -DLIBNET_LIL_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET _BITS=64 linker flags : -R/usr/local/lib -lpthread prefix : /usr/local linking mode : dynamic Features: Sun STREAMS support : yes Sun Door support : yes Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : yes tcp-wrapper support : no SSL support : yes SQL support : no Linux capability support : no PCRE support : no Env wrapper support : no This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

4 15

Pattern matching.
by Anup Shetty 22 Dec '11

22 Dec '11

I am trying to match the pattern for DC logs and here is my XML format Here's the patterndb.xml file at /opt/syslog-ng/var/patterndb.xml" --------------------------------------- <?xml version='1.0' encoding='UTF-8'?> <patterndb version='3' pub_date='2011-12-21'> <ruleset id='90c9b341f4e3d63c5ed8b29950491bf8' name='Domain Ctrls'> <rules> <rule provider='localtest' id='012c230f236d6a3f761ba956e7dff26a' class='system'> <patterns> <pattern> @ESTRING:user::@ Security Microsoft Windows security auditing.: [Success Audit] A computer account was changed. Subject: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logon ID: 0x3e6 Computer Account That Was Changed: Security ID: @ESTRING:: @Account Name: @ESTRING:*ACC_NAME*: @ Account Domain: testdomain Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: @ESTRING:: @@ESTRING:: @ Account Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value: - New UAC Value: - User Account Control: - User Parameters: - SID History: - Logon Hours: - DNS Host Name: - Service Principal Names: - Additional Information: Privileges: - (EventID 4742) </pattern> </patterns> </rule> </rules> </ruleset> </patterndb> --------------------------------------- Here's the syslog-ng conf extract: --------------------------------------- parser pattern_db { db_parser( file("/opt/syslog-ng/var/patterndb.xml") ); }; destination patt_d{ file("/data/test/${R_YEAR}/${R_MONTH}/${R_DAY}/Domain_Ctrl__${SOURCEIP}_${R_YEAR}_${R_MONTH}_${R_DAY}.log" owner("test") group("test") perm(0660) dir-owner("test") dir-group("test") dir-perm(0770) template("$*ACC_NAME*\n $MSG\n") ); }; --------------------------------- but the *ACC_NAME* returns blank, although the log contains that field. -- Thanks Anup

4 4

Quick filter question again
by Lay, James 22 Dec '11

22 Dec '11

Hey all! Hope this is quick/easy. So I'm matching IP's that I don't want to see...filter below: message("66\.220\.") My issues is, this will match not only say 66.220.1.1, but also 166.220.1.1. I've tried changing to: message(" 66\.220\.") but that'd didn't fly. Any suggestions on how to more exactly match IP blocks? Thanks all. James

2 2

[PATCH (3.4) 0/1]: value-pairs: Add value_pairs_foreach_sorted().
by Gergely Nagy 22 Dec '11

22 Dec '11

The patch that will follow shortly implements a value_pairs_foreach_sorted() function, that can be used for multiple purposes in the future: - Template functions that want to format their output with keys always in a predictable order. - Various other parts of the code, that work better when operating on a sorted collection. I'm submitting it separately, so that it'll be easier for me to build upon it in the not too distant future. (And because I almost forgot to send it, even though it was origianlly made in early november...)

2 3