- syslog-ng - lists.balabit.hu

Syslog daemon restart fails on AIX 7.1 in central server
by Rakesh Rajasekharan 16 Dec '11

16 Dec '11

Hi, I am faced with a rather strange issue with syslog 3.0.7 version. The daemon does not start at all when I try to run it in the central server mode. I though do not get any error messages . But, I noticed that after a reboot of the machine. Everything works fine. Can someone please suggest of any possible areas to check. Thanks, Rakesh

2 2

web interface
by Bely Silva Junior 15 Dec '11

15 Dec '11

Hi, I see phpsyslog-ng was deprecated, another option what would be a choice for this ? logzilla is a good idea? -- Bely Silva Junior

4 5

Problem instert data MSSQL
by Bely Silva Junior 14 Dec '11

14 Dec '11

hi i have problem when i try insert data in mssql server, when i try run script, just 2 or 3 lines insert ok, but , insert stop . I use pipe, my confs. destination d_mssql { pipe("/var/mssql.syslog-ng.pipe" template( "INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg ) VALUES ( '$HOST','$FACILITY','$PRIORITY','$LEVEL','$TAG','$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM','$MSG' );\n" ) template-escape(yes)); template-escape(yes)); }; log { source(s_all); destination(d_mssql); }; my script: if [ -e /var/mssql.syslog-ng.pipe ]; then while [ -e /var/mssql.syslog-ng.pipe ] do #isql -v MSSQL "syslogng" "h0hYgbDB6Q" < /var/mssql.syslog-ng.pipe > /dev/null isql -v MSSQL "syslogng" "h0hYgbDB6Q" < /var/mssql.syslog-ng.pipe done else mkfifo /var/mssql.syslog-ng.pipe fi when i try run script: ./syslog2mssql.sh +---------------------------------------+ | Connected! | | | | sql-statement | | help [tablename] | | quit | | | +---------------------------------------+ SQL> SQLRowCount returns 1 SQL> +------------+ | | +------------+ +------------+ SQLRowCount returns 0 SQL> SQLRowCount returns -1 SQL> SQLRowCount returns 1 SQL> [ISQL]ERROR: Could not SQLPrepare SQL> [ISQL]ERROR: Could not SQLPrepare./syslog2mssql.sh +---------------------------------------+ | Connected! | | | | sql-statement | | help [tablename] | | quit | | | +---------------------------------------+ SQL> SQLRowCount returns 1 SQL> +------------+ | | +------------+ +------------+ SQLRowCount returns 0 SQL> SQLRowCount returns -1 SQL> SQLRowCount returns 1 SQL> [ISQL]ERROR: Could not SQLPrepare SQL> [ISQL]ERROR: Could not SQLPrepare someone have idea for this ? -- Bely Silva Junior

2 1

syslog-ng article in BSDmag, not just for BSD users
by Peter Czanik 14 Dec '11

14 Dec '11

Hello, Robert Fekete, our technical writer wrote a very nice article for BSDmag about syslog-ng with the title: "Extracting Useful Information From Log Messages". The following topics are addressed: • The message model behind syslog messages • The importance of metadata • How to process, recognize, and correlate log messages using syslog-ng If you want just this single article, you can download it from http://www.balabit.com/support/documentation/BSD_12_2011%20-%20BalaBit_sing… Other way I'd recommend to download the complete December issue of BSDmag from http://bsdmag.org/magazine/1781-rolling-your-own-kernel Bye, -- Peter Czanik (CzP)<czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

GUI Web Interface for Syslog NG
by Kaushal Shriyan 14 Dec '11

14 Dec '11

Hi I happen to see that http://code.google.com/p/php-syslog-ng/ Php-syslog-ng is now known as LogZilla <http://www.logzilla.pro/>. Same owner, better code :-). But to my surprise,LogZilla is available for 30 days evaluation period. is there a free version available or a equivalent GUI Web Interface for Syslog NG Regards Kaushal

4 3

Re: [syslog-ng] Log only one host
by tokie＠tiscali.it 13 Dec '11

13 Dec '11

As you can see the device gives a valid syslog header. Destination of Firewall in fw.log: # tailf fw.log Dec 13 13:58:47 192.168.1.254/192. 168.1.254 Fw-Vigor2955: 149:13:59.970 lan->wan @S:R=13:1 p 192.168.1.8,19679 -> 82.200.234.214,33244 PR UDP len 20 131 Destination of Access Point .241 in ap241.log: # tailf ap241.log Dec 13 13:58:47 192.168.1.254/192.168.1.254 Fw-Vigor2955: 149:13:59.770 lan- >wan @S:R=13:1 p 192.168.1.8,19679 -> 94.244.30.85,63708 PR UDP len 20 131 It writes the same thing!! My configuration is the following: source udp { udp(); }; destination d_fw { file("/**/**/fw.log" create_dirs(yes) fsync(yes)); }; filter f_fw { netmask ("192.168.1.254/32"); ##try to log one host }; log { source(udp); destination(d_fw); filter(f_fw); }; Therefore, how I do?? Thanks Tokie E' nata indoona: chiama, videochiama e messaggia Gratis. Scarica indoona per iPhone, Android e PC: http://www.indoona.com/

2 1

R: syslog-ng Digest, Vol 80, Issue 18
by tokie＠tiscali.it 13 Dec '11

13 Dec '11

As you can see the device gives a valid syslog header. Destination of Firewall in fw.log: # tailf fw.log Dec 13 13:58:47 192.168.1.254/192. 168.1.254 Fw-Vigor2955: 149:13:59.970 lan->wan @S:R=13:1 p 192.168.1.8,19679 -> 82.200.234.214,33244 PR UDP len 20 131 Destination of Access Point .241 in ap241.log: # tailf ap241.log Dec 13 13:58:47 192.168.1.254/192.168.1.254 Fw-Vigor2955: 149:13:59.770 lan- >wan @S:R=13:1 p 192.168.1.8,19679 -> 94.244.30.85,63708 PR UDP len 20 131 It writes the same thing!! My configuration is the following: source udp { udp(); }; destination d_fw { file("/**/**/fw.log" create_dirs(yes) fsync(yes)); }; filter f_fw { netmask ("192.168.1.254/32"); ## try for only host }; log { source(udp); destination(d_fw); filter(f_fw); }; Therefore, how can I do?? Thanks Tokie ------------------------------ Date: Mon, 12 Dec 2011 19: 10:30 -0500 From: Jim <jrhendri(a)maine.rr.com> Subject: Re: [syslog-ng] Log only one host To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1323735030.16055.1. camel@ubuntu> Content-Type: text/plain; charset="UTF-8" Couple things to note: - not all syslogs give a valid syslog header (e.g. <date> <time> <host> <program>:<message>) - name resolution costs cycles (may not be an issue) - know the difference between $HOST (parsed from the syslog header) and $HOST_FROM (the origin of the packet) Enjoy! On Mon, 2011-12-12 at 12:05 +0100, Thomas Wollner wrote: > Hello, > > to separate the destination logfiles for each host, use the following > > destination d_file_foreach_host { > file("/var/log/$FULLHOST.log"); > } > > > log { > source(s_all); > destination (d_file_foreach_host), > }; > > hope it helps, > regards, > > Tom > > > > Zitat von "tokie(a)tiscali.it" <tokie(a)tiscali.it>: > > >> Try using the netmask filter. > > > >> filter f_host_a_b_c_d { > >> netmask > > ("a.b.c.d/32"); > >> }; > > > > Tks for reply, > > I tried but don't work! > > More > > specific: > > I wish that all devicies in my network, logging into a > > specific file on syslog server. > > > > Now all files log all devicies!! > > I > > have the same result in different > > file(100.log, 101.log, and so on) > > > > > > Must I use iptables's match?? How?? > > > > tks > > Tokie > > > > p.s.: > > netmask ("a.b.c. > > > > d/32") or netmask("a.b.c.d/255.255.255.255") ??? E' nata indoona: chiama, videochiama e messaggia Gratis. Scarica indoona per iPhone, Android e PC: http://www.indoona.com/

1 0

Log only one host
by tokie＠tiscali.it 13 Dec '11

13 Dec '11

> Try using the netmask filter. > filter f_host_a_b_c_d { > netmask ("a.b.c.d/32"); > }; Tks for reply, I tried but don't work! More specific: I wish that all devicies in my network, logging into a specific file on syslog server. Now all files log all devicies!! I have the same result in different file(100.log, 101.log, and so on) Must I use iptables's match?? How?? tks Tokie p.s.: netmask("a.b.c. d/32") or netmask("a.b.c.d/255.255.255.255") ??? ----Messaggio originale---- Da: syslog-ng-request(a)lists.balabit.hu Data: 10/12/2011 12.00 A: <syslog-ng(a)lists.balabit.hu> Ogg: syslog-ng Digest, Vol 80, Issue 15 Send syslog-ng mailing list submissions to syslog-ng@lists. balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request@lists. balabit.hu You can reach the person managing the list at syslog-ng- owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: syslog-ng 3.3.3 repeatedly writes same message to local file when forwarding enabled (Dave Haywood) 2. Re: Log only one host (tokie(a)tiscali.it) 3. Re: Log to syslog file, filter from fifo (Balazs Scheidler) 4. [Bug 146] pdbtool match does not display tags (bugzilla(a)bugzilla.balabit.com) ---------------------------------------------------------------------- Message: 1 Date: Fri, 09 Dec 2011 11:22:24 +0000 From: Dave Haywood <tla(a)oak.selfip.net> Subject: Re: [syslog-ng] syslog-ng 3.3.3 repeatedly writes same message to local file when forwarding enabled To: Syslog-ng users' and developers' mailing list <syslog-ng@lists. balabit.hu> Cc: Sandor Geller <Sandor.Geller(a)morganstanley.com> Message- ID: <4EE1EF70.1060001(a)oak.selfip.net> Content-Type: text/plain; charset=ISO-8859-1 On 09/12/2011 09:53, Sandor Geller wrote: > Sounds like messages sent to 192.168.0.7 are feeded back to syslog-ng > so there is a logging loop. Is this address local? When not then there > is a chance that the packet filter rule isn't correct. Thanks! You were right, the issue was with the iptables rule. I was trying to capture traffic from localhost to port 514 and redirect it to 1514 using NAT table OUTPUT. I use this for testing every facility / severity combination during install. But I didn't specify a destination host (of the local IP address); I only specified the port. This meant and traffic forwarded to a remote host is redirected by iptables back to the localhost, causing a loop. Thanks for the help :) > > On Fri, Dec 9, 2011 at 10:34 AM, Dave Haywood <tla(a)oak.selfip. net> wrote: >> Hi, >> >> I have a problem with syslog-ng 3.3.3. When I have forwarding enabled to a remote syslog server (via UDP) syslog-ng repeatedly writes the same message(s) to the log file and only stops when the disk is full. Using tcpdump on the remote server, I don't see any data arrive from the syslog-ng server so forwarding is not working either. >> >> When I remove the forwarding part of the config file the local file is written correctly (ie once). If I remove the local file part from the config file and only enable the forwarding, I see syslog- ng take all the CPU time. I never see any syslog messages arrive at the remote syslog server. >> >> I tried: >> 1) disabling IPv6 - no change >> 2) running outside the chroot jail - no change >> 3) running as userid root - no change >> >> Does anyone have any idea what would cause this? Debug info below. >> >> The environment is: >> >> RedHat AS 4.8 (linux 2.6.9-89.ELsmp) on vmware ESXi 4.1.0 >> >> All required software built and installed in /usr/local/ : >> >> eventlog_0.2.12.tar.gz >> gettext-0.18.1.1.tar.gz >> glib-2.29.90.tar.bz2 >> libdbi-0.8.4.tar.gz >> libdbi-drivers-0.8.3. tar.gz >> libffi-3.0.9.tar.gz >> libnet-0.10.11.tar.gz >> pkg-config- 0.26.tar.gz >> Python-2.7.2.tar.bz2 >> zlib-1.2.5.tar.bz2 >> syslog- ng_3.3.3.tar.gz >> >> syslog-ng is running chroot() in directory /data as user E' nata indoona: chiama, videochiama e messaggia Gratis. Scarica indoona per iPhone, Android e PC: http://www.indoona.com/

3 2

error while loading shared libraries
by Johnson, Chris (HP TippingPoint Roseville) 12 Dec '11

12 Dec '11

I'm getting the following error: /usr/local/sbin/syslog-ng: error while loading shared libraries: /usr/local/lib/libsyslog-ng-3.3.3.so: ELF file OS ABI invalid When I try to run syslog-ng (also occurs when I run pbdtool) pdbtool: error while loading shared libraries: /usr/local/lib/libsyslog-ng-3.3.3.so: ELF file OS ABI invalid I'm building on one box (RedHat), and running on another (not sure what flavor of Linux, might be CentOS). Any pointers to what I can set during the build phase that will allow it to run? Thanks, Chris ---------------------------------------- Christopher Johnson chris.johnson3(a)hp.com HP Software - Security Product Group ----------------------------------------

2 4

[Bug 146] New: pdbtool match does not display tags
by bugzilla＠bugzilla.balabit.com 09 Dec '11

09 Dec '11

https://bugzilla.balabit.com/show_bug.cgi?id=146 Summary: pdbtool match does not display tags Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: bug Estimated Hours: 0.0 When using the pdbtool match command the tags of a message are not displayed. % pdbtool match -M "Fri Nov 25 00:00:29.618 2011: Accepted and connected to 172.20.102.38 hermes0080 <c0n350>" -p mmfs.xml --program=mmfs MESSAGE=Fri Nov 25 00:00:29.618 2011: Accepted and connected to 172.20.102.38 hermes0080 <c0n350> PROGRAM=mmfs .classifier.class=security .classifier.rule_id=463e34dd-f946-4f25-9cd2-9c00e25eba4c .net.destination.address=172.20.102.38 .net.destination.name=hermes0080 .mmfs.node=c0n350 application=mmfs -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1