- syslog-ng - lists.balabit.hu

Logs for patterns, patterns for logs
by Peter Czanik 15 Sep '11

15 Sep '11

Hello, I'd like to pick one topic from last weeks syslog-ng newsletter: " Logs for patterns, patterns for logs ------------------------------------ We also would like to extend our UNIX/Linux patterns. Creating logs in a "lab" environment just for pattern creation is very time consuming. It would be very helpful for us, if you could send logs in exchange for patterns. Just make sure, that there is no sensitive data left in the logs, as the result will be published to make it available for the whole syslog-ng community. I published a blog ( http://czanik.blogs.balabit.com/2010/11/log-sample-collecting-project/ ), how I collect logs for pattern creation, but of course, any logs are welcome! " Currently I'd like to extend our coverage of login/logout events, but any other logs are welcome. We already have many ftp services covered, but only the ancient uw-imap is covered from e-mail (as that's what I used in the past 15+ years :) ). If you could send logs, I'd be very happy to turn them into patterns. Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

[PATCH 0/2] More packaging tweaks
by Gergely Nagy 10 Sep '11

10 Sep '11

Two patches will follow, one to disable the "Compile Date" in syslog-ng --version's output, and another to force the tar format used for make dist to ustar. The latter is due to the included libmongo-client library having some long filenames, which hit the 99 char limit when distributed with syslog-ng. Increasing the limit to 255 bytes makes the problem disappear.

4 5

tcp source configuration
by drkmkzs 09 Sep '11

09 Sep '11

Hello, I'm trying to configure my syslog serveur to receive syslog message from a rsyslog client. I used something like that : *source myRemote { tcp(ip(172.25.5.1) port (69000)); }* * * Indeed, all works fine except the fact that the port i specify is never used, and it seems that a random port is chosen instead ( at least, it a tcp port ).* * Each time I change the port in configuration, another port is chosen. I checked in netstat that the port I specify is not already used, so it's another problem. Can somebody help me ? Thanks a lot :)

2 2

syslog-ng Insider - September 2011
by Peter Czanik 08 Sep '11

08 Sep '11

Dear syslog-ng users, This is the 6th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> POLL Please take a minute to answer three syslog-ng performance related questions at https://www.surveymonkey.com/s/6ZQDVH6 FEATURED NEWS Please test 3.3 git! -------------------- Version 3.3 release is just around the corner. There were many smaller fixes since the last beta release, so please check out the latest source code from git and help us to make sure the release is free from known problems! Your feedback is very valuable, especially if you could test it in real world situations with logs and configurations we could never imagine ourselves. As threading is a major new feature, which is not enabled by default, please try it by adding “threaded(yes)” to your options in syslog-ng.conf You can download it by “git clone git://git.balabit.hu/bazsi/syslog-ng-3.3” or browse sources online at http://git.balabit.hu/?p=bazsi/syslog-ng-3.3.git;a=summary Documentation is also available: http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guid… Binary packages from latest git are available: * openSUSE: http://download.opensuse.org/repositories/home:/czanik:/syslog-ng33/ * Debian: https://lists.balabit.hu/pipermail/syslog-ng/2011-August/017126.html Logs for patterns, patterns for logs ------------------------------------ We also would like to extend our UNIX/Linux patterns. Creating logs in a "lab" environment just for pattern creation is very time consuming. It would be very helpful for us, if you could send logs in exchange for patterns. Just make sure, that there is no sensitive data left in the logs, as the result will be published to make it available for the whole syslog-ng community. I published a blog ( http://czanik.blogs.balabit.com/2010/11/log-sample- <http://czanik.blogs.balabit.com/2010/11/log-sample-collecting-project/>collecting-project/ <http://czanik.blogs.balabit.com/2010/11/log-sample-collecting-project/> ), how I collect logs for pattern creation, but of course, any logs are welcome! Syslog clients for Windows -------------------------- Central logging using syslog is long part of the UNIX / Linux infrastructure. But if someone also happens to have Windows machines, it is still possible to use the proven syslog-ng servers. There are many clients available, both open and closed source, ranging from simple event forwarders to complex logging solutions. Here is a collection of them: http://czanik.blogs.balabit.com/2011/09/syslog-clients-for-windows/ OTHER SHORT NEWS * Octopussy now supports syslog-ng: http://czanik.blogs.balabit.com/2011/08/octopussy/ * We published some patterns for Windows Server 2008 (most of these should also work with other releases): http://czanik.blogs.balabit.com/2011/07/patterns-for-windows-server-2008/ WHITE PAPERS Download our latest white paper titled "Logging, the Pillar of Compliance". From this White Paper you can learn: * How can you avoid a breach of compliance, and ensure your business continuity. * What are the key IT security requirements of the most frequently applied standards, such as the ISO 27001, PCI, SOX or COBIT. * How advanced logging technology can contribute to cost-effective compliance and successful accomplishment of audits. It is available at http://www.balabit.com/compliance-and-logging *syslog-ng PE Case Study - DataPath Inc.* DataPath, founded in 1984, is a management-owned, privately held company based in Little Rock, Arkansas, that produces software solutions for administering employee benefit plans. They implemented a SYSLOG-NG AGENT FOR WINDOWS-based logging infrastructure to meet HIPAA and PCI DSS requirements in their Microsoft-based environment. It is available at http://www.balabit.com/support/documentation/PE_DataPath_en.pdf ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

Re: [syslog-ng] syslog-ng own logs
by André Larose 07 Sep '11

07 Sep '11

Thank you for your help Sandor, it is much appreciated. The documentation is there but the information on internal is so small is missed it. However I would like to point the source configuration should be like this: source s_syslogng { internal(); }; Kind regards, >>Hi, >> >>On Fri, Sep 2, 2011 at 3:46 PM, Andr? Larose <andre.larose(a)telus.com> wrote: >> >>> I only ?use syslog-ng to capture logs of my in-house applications but not the usual syslog messages, I leave that to the sysadm team. This means when syslog-ng sends messages about itself I am not be able to see them as they end up in the other syslog, ?I think?. >> >>syslog-ng never sends logs to /dev/log unless configured to do so, but >>uses the internal facility which might missing from your >>configuration. >> >>> I would like to know how I can save to file the logs generated by syslog-ng itself . >> >>using something like this >> >>source s_syslogng { >> source(internal); >>}; >> >>destination d_syslongng { >> file("/var/log/syslog-ng.log"); >>}; >> >>log { >> source(s_syslogng); >> destination(d_syslogng); >>}; >> >>will do the trick. >> >>Regards, >> >>Sandor >>

1 0

patterndb & windows
by Peter Czanik 06 Sep '11

06 Sep '11

Hello, A few weeks ago we posted a collection of patterns for Windows 2k8 (but most of it should work also with other releases). While there were many people downloading it, I received no feedback at all. So I'd like to ask, what are your experiences with it? Where could it be improved? Please leave your comments here or answer me in private (some UNIX admins tend to keep it secret, that they also deal with Windows machines :-) ), so we could make our Windows patterns more useful for you! For those, who missed the original announcement, you can read it at https://czanik.blogs.balabit.com/2011/07/patterns-for-windows-server-2008/ Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

3 4

syslog-ng own logs
by André Larose 06 Sep '11

06 Sep '11

Hello everybody, I have a simple question, I googled it but got sooooooooo many hits and found no answer so far I thought I would ask the experts. I only use syslog-ng to capture logs of my in-house applications but not the usual syslog messages, I leave that to the sysadm team. This means when syslog-ng sends messages about itself I am not be able to see them as they end up in the other syslog, "I think". I would like to know how I can save to file the logs generated by syslog-ng itself . Regards, André Larose Senior Systems Analyst TELUS Solutions en santé | avec l'expertise d'Emergis TELUS Health Solutions | backed by Emergis L'information contenue dans ce message, y compris les fichiers joints, est de nature exclusive et confidentielle, et ne doit être utilisée que par le destinataire. Ce message peut contenir des renseignements réservés, sujets aux dispositions des lois sur la confidentialité. En conservant et en utilisant les renseignements contenus dans ce message, le destinataire autorisé s'engage à protéger l'information qu'il contient contre la perte, la divulgation, le vol ou l'exposition à tout risque, en appliquant des précautions au moins égales à celles qu'il utilise pour la protection de ses propres renseignements personnels. Toute diffusion ou utilisation de l'information contenue dans ce message par une personne autre que son destinataire explicite constitue un acte non autorisé et potentiellement illicite. Si vous avez reçu ce message par erreur, veuillez nous aviser en répondant à l'expéditeur et détruire toutes les copies du message en votre possession. The information contained herein, including any attachments, is proprietary and confidential and is intended for the exclusive use of the addressee. It also may contain privileged information and/or personal information subject to privacy legislation. The authorized addressee of this information, by its retention and use, agrees to protect the information contained herein from loss, disclosure, theft or compromise with at least the same care it employs to protect its own confidential information. Any dissemination or use of this information by a person other than the intended recipient is unauthorized and may be illegal. If you have received this e-mail in error, please notify us immediately by reply e-mail and destroy this message.

2 1

OSX
by Peter Czanik 06 Sep '11

06 Sep '11

Hello, A quick question to anybody using OSX: do you see a demand for using OSX as a syslog client or central log server? Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 1

3.3 memory leaks
by Balazs Scheidler 04 Sep '11

04 Sep '11

Hi, I think I have closed the memory leaks reported on syslog-ng 3.3.0beta2, so hopefully it is now more usable now in production. All fixes pushed to the git tree. I haven't received other issues, and I saw some success reports, so we're gearing towards a final release. I'd appreciate further testing though, but if nothing major shows up, I'm going to prepare 3.3.1 in the next couple of weeks. -- Bazsi

1 0

[PATCH] str-format: Fix month name parsing in BSD timestamps
by Gergely Nagy 04 Sep '11

04 Sep '11

When parsing the month name in scan_month_abbrev(), use memcmp() in all cases to compare only the first three chars. Using strcmp() will always result in us taking the false branch on well-formed timestamps, as it will scan past the 3-char length. Signed-off-by: Gergely Nagy <algernon(a)madhouse-project.org> --- lib/str-format.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/str-format.c b/lib/str-format.c index 6c974ba..9011461 100644 --- a/lib/str-format.c +++ b/lib/str-format.c @@ -200,19 +200,19 @@ scan_month_abbrev(const gchar **buf, gint *left, gint *mon) *mon = 7; break; case 'S': - if (strcmp(*buf, "Sep") == 0) + if (memcmp(*buf, "Sep", 3) == 0) *mon = 8; break; case 'O': - if (strcmp(*buf, "Oct") == 0) + if (memcmp(*buf, "Oct", 3) == 0) *mon = 9; break; case 'N': - if (strcmp(*buf, "Nov") == 0) + if (memcmp(*buf, "Nov",3 ) == 0) *mon = 10; break; case 'D': - if (strcmp(*buf, "Dec") == 0) + if (memcmp(*buf, "Dec", 3) == 0) *mon = 11; break; default: -- 1.7.5.4

2 2