- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Syslog-ng log viewer/analyser
by Terry Slattery 08 Jul '11

08 Jul '11

I don't recall where I found it. It may have been at CiscoLive or from something on the Cisco web site, such as an article you wrote. I thought it was a very interesting statistic. -tcs On 7/8/11 2:17 PM, syslog-ng-request(a)lists.balabit.hu wrote: > Date: Fri, 8 Jul 2011 14:16:19 -0400 > From: Clayton Dukes<cdukes(a)gmail.com> > Subject: Re: [syslog-ng] Syslog-ng log viewer/analyser > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CAANP6Qd=0xnGJ6BkvuyLLTsz7yCQKJMXviwq6=PNV17DnJs8aQ(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi Terry, > Checked out your blog. > I was wondering where you got the quote about 90 traps and 6000 syslog > messages? > I ask because it's my quote, heh > Just think it's neat how things travel:-) > -- Terry Slattery CCIE# 1026

2 1

Re: [syslog-ng] Syslog-ng log viewer/analyser
by Terry Slattery 08 Jul '11

08 Jul '11

I have a couple of blogs that might be of interest. The first references a couple of other blogs about handling events. The second is about a summary script that I've found useful for summarizing syslog each day. http://www.netcordia.com/community/blogs/terrys_blog/archive/2010/06/06/han… http://www.netcordia.com/community/blogs/terrys_blog/archive/2009/10/28/sys… -tcs -- Terry Slattery CCIE# 1026 On Jul 8, 2011, at 6:00 AM, syslog-ng-request(a)lists.balabit.hu wrote: > > Date: Thu, 07 Jul 2011 15:08:02 +0200 > From: Peter Czanik <czanik(a)balabit.hu> > Subject: Re: [syslog-ng] Syslog-ng log viewer/analyser > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: <4E15AFB2.1070505(a)balabit.hu> > Content-Type: text/plain; charset=ISO-8859-1 > > On 07/07/2011 01:49 PM, Pramod Pillai wrote: >> Hi >> >> Is there any Syslog-ng log viewer/analyser which I can use along with >> syslog-ng . > There are many. See my blog at > https://czanik.blogs.balabit.com/2011/06/a-comparison-of-syslog-ng-web-guis/ > Bye, > > -- > Peter Czanik (CzP) <czanik(a)balabit.hu> > BalaBit IT Security / syslog-ng upstream > http://czanik.blogs.balabit.com/

2 1

change from rsyslog to syslog-ng
by Josu Lazkano 08 Jul '11

08 Jul '11

Hello everybody! I finished to configure my syslog system. I am using rsyslog on clients side and syslog-ng on the server side. It works well, but I have a little problem with Apache vhosts logs. I want to send all vhosts logs to my syslog-ng server, but I don't know how to do with rsyslog. Is possible to do with syslog-ng? My Apache logs are configured this way: ErrorLog /var/www/domain1/log/error.log LogLevel warn SetEnvIf Remote_Addr "x\.x\.x\.x" dontlog SetEnvIf Remote_Addr "y\.y\.y\.y" dontlog CustomLog /var/www/domain1/log/access.log common env=!dontlog On the same machine I have lots of vhost logs: /var/www/domain1/log/error.log /var/www/domain1/log/access.log /var/www/domain2/log/error.log /var/www/domain2/log/access.log /var/www/domain3/log/error.log /var/www/domain3/log/access.log ... Is preferable to change all rsyslog to syslog-ng? Thanks for your great help. Best regards.

2 1

Syslog-ng log viewer/analyser
by Pramod Pillai 07 Jul '11

07 Jul '11

Hi Is there any Syslog-ng log viewer/analyser which I can use along with syslog-ng . Regards Pramod

5 4

syslog-ng help: how can I use function in double quotes?
by Henry Xu 05 Jul '11

05 Jul '11

Hi All, How can I use a function in double quote? I want to record the IP address of the syslog-ng server. Since there's no available macro that represent the IP of syslog-ng server(only have macros indicate where the message sent to syslog-ng server,like $HOST). So I want to use ip() function and record it to database. The configuration part is: columns( "datetime varchar2(24)", "server_ip varchar2(24)", "host varchar2(32)", ...) values( "${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "ip()", "$HOST", ...) When I started syslog-ng,it gave error message that said expecting double quotes. How can I use a function in double quotes? Or are there any other ways to get the syslog-ng server IP address and record them? Thanks, Henry

3 3

Re: [syslog-ng] Rpmbuild syslog-ng-3.2.4-1.el6: FAIL: test_nvtable - glib2 hash table
by JP Vossen 05 Jul '11

05 Jul '11

Any clues? -------- Original Message -------- Subject: Re: [syslog-ng] Rpmbuild syslog-ng-3.2.4-1.el6: FAIL: test_nvtable - glib2 hash table Date: Sat, 25 Jun 2011 04:49:38 -0400 From: JP Vossen To: syslog-ng@... On 06/24/2011 07:19 AM, Balazs Scheidler wrote: > On Mon, 2011-06-20 at 20:59 +0100, Jose Pedro Oliveira wrote: >> >> There is a problem with the hash table implementation of glib2 >> version 2.12.3-4 (version that ships in RHEL 5.x). >> More details in: >> >> * https://bugzilla.redhat.com/show_bug.cgi?id=714409#c7 > > Thanks for the information, if it's a glib bug then, can I help you in > any way? Or I can "close" the issue? I see that Jose already forwarded the bug, but I wonder; can you tell me what impact the failed test (and thus failed or potentially failed code block) may have on syslog-ng run-time on CentOS-5/RHEL5? Is this hash problem going to cause critical failures? Under what circumstances? Or is it, well, it'd be nice if that hash problem didn't happen, but it's not a big deal... Thanks, JP ----------------------------|:::======|------------------------------- JP Vossen, CISSP |:::======| http://bashcookbook.com/ My Account, My Opinions |=========| http://www.jpsdomain.org/ ----------------------------|=========|------------------------------- "Microsoft Tax" = the additional hardware & yearly fees for the add-on software required to protect Windows from its own poorly designed and implemented self, while the overhead incidentally flattens Moore's Law.

1 0

Save ALL logs
by Josu Lazkano 05 Jul '11

05 Jul '11

Hello again, I just installed my new log server and I am configuring to save ALL logs on the log server. On the client side I have rsyslog configured this way: $ cat /etc/rsyslog.conf $ModLoad imuxsock $ModLoad imklog $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $RepeatedMsgReduction on $KLogPath /proc/kmsg $WorkDirectory /rsyslog/work $ActionQueueType LinkedList $ActionQueueFileName srvrfwd1 $ActionResumeRetryCount -1 $ActionQueueSaveOnShutdown on *.* @@logserver On the server side I have syslog-ng: source logs_externs{ tcp(); }; destination rdf_all { file("/var/log/extern/${HOST}/${YEAR}/${MONTH}/"); }; log { source(logs_externs); destination(rdf_all); }; I want to get all the logs on the log servers and then archive each month. This way it doesn't work, how I must configure it? Thanks for all your help. Kind regards.

2 1

[Bug 127] New: 3.2.4 ose segfaults during startup
by bugzilla＠bugzilla.balabit.com 01 Jul '11

01 Jul '11

https://bugzilla.balabit.com/show_bug.cgi?id=127 Summary: 3.2.4 ose segfaults during startup Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: balazs.nemeth(a)balabit.com Type of the Report: bug Estimated Hours: 0.0 This bugreport has been opened from an email came to info(a)balabit.com. ------------------------ Core was generated by `syslog-ng -d -p /var/run/syslog-ng.pid -e --enable-core -s'. Program terminated with signal 11, Segmentation fault. #0 0x00000031566795d0 in strcmp () from /lib64/libc.so.6 (gdb) bt #0 0x00000031566795d0 in strcmp () from /lib64/libc.so.6 #1 0x00002b71bfe565d5 in cfg_process_flag (handlers=0x2b71c0082230, base=0x228b5f0, flag=0xffffffff <Address 0xffffffff out of bounds>) at cfg-parser.c:249 #2 0x00002b71c04a6ec6 in afsocket_parse (lexer=0x2265440, last_driver=0x7fffe7126608) at afsocket-grammar.y:864 #3 0x00002b71bfe58c67 in cfg_parser_parse (self=0x2b71c06b2760, cfg=<value optimized out>, yylloc=<value optimized out>) at cfg-parser.h:82 #4 plugin_parse_config (self=0x2b71c06b2760, cfg=<value optimized out>, yylloc=<value optimized out>) at plugin.c:124 #5 0x00002b71bfe570ae in main_parse (lexer=0x2265440, dummy=0x7fffe7128a28) at cfg-grammar.y:539 #6 0x00002b71bfe37a01 in cfg_parser_parse (self=0x22649b0, lexer=0x2265440, parser=0x2b71c00829e0, result=0x2269640) at cfg-parser.h:82 #7 cfg_run_parser (self=0x22649b0, lexer=0x2265440, parser=0x2b71c00829e0, result=0x2269640) at cfg.c:376 #8 0x00002b71bfe37b03 in cfg_read_config (self=0x22649b0, fname=0x402bb7 "/etc/syslog-ng/syslog-ng.conf", syntax_only=<value optimized out>, preprocess_into=0x0) at cfg.c:398 #9 0x000000000040220c in initial_init () #10 0x000000000040280c in main () (gdb) quit This causes it: source 32001_udp { udp( port(32001) so_rcvbuf(12000000) flags(no_multi_line) ); }; ------------------ ps.: With the given config line snippet it is easy to reproduce. I have cc'd the original author of the email. I hope he doesn't mind it. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 126] New: [systemd] Add installation of systemd unit file via build-sys
by bugzilla＠bugzilla.balabit.com 01 Jul '11

01 Jul '11

https://bugzilla.balabit.com/show_bug.cgi?id=126 Summary: [systemd] Add installation of systemd unit file via build-sys Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: d(a)falconindy.com Type of the Report: enhancement Estimated Hours: 0.0 I'd like to see syslog-ng offer installation of the systemd unit file via the build system, similar to how other services (e.g., udev or rsyslog) provide this, with the --with-systemdsystemunitdir configure option. autotools is unfortunately not my forte, so the attached patch may not be the most eloquent of solutions (borrowing bits from udev), but it does the job, and does not appear to bother configurations which avoid --enable-systemd or the new --with flag. I felt it was prudent to separate the --enable-systemd flag from this new flag as there's certainly a case for using the --enable flag without the --with flag. I've also provided a one line amendment to the service file itself, which removes the ExecReload. This is discouraged by upstream, as systemd is unable to properly track the behavior of the daemon due to the effects of an asynchronous trigger. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 10

Transparent TCP forward: what am I doing wrong?
by JP Vossen 30 Jun '11

30 Jun '11

I need to be able to accept TCP/514 and transparently forward it to UDP/514 on the same box. I have a config that almost works, except I'm getting an "extra" time stamp and hostname on the TCP messages. I'm using Netcat to send: echo "<182>loop_test[$$]: LOOP testing 514 UDP, one ping only..." | nc -u -w1 192.168.1.151 514 echo "<182>loop_test[$$]: LOOP testing 514 TCP, one ping only..." | nc 192.168.1.151 514 I'm getting: <182>loop_test[11061]: LOOP testing 514 UDP, one ping only... <182>Jun 30 01:48:36 192.168.1.10 loop_test[11061]: LOOP testing 514 TCP, one ping only... I want: <182>loop_test[11061]: LOOP testing 514 UDP, one ping only... <182>loop_test[11061]: LOOP testing 514 TCP, one ping only... If I send the messages into syslog-ng or rsyslog, I get the correct data with no "extra" fields in the log file. But unfortunately, I need to send messages into another proprietary syslog listener, and in that one I'm getting the extra fields. I'd blame the whole mess on that, except that when I do a packet dump I do see the 2 extra fields in there. So I *think* that syslog-ng and rsyslog are smart enough to handle them and my other thing isn't. I'm already using keep_timestamp(no) and keep_hostname(no) but they have no effect I've been able to detect. I've tried commented out, set to yes and set to no, but no matter what I get the 2 extra fields. I've also tried syslog-ng 3.0.8 and 3.2.4, same effect. This is the relevant part of the syslog-ng config I'm using: ####### BEGIN: Forward TCP syslog source s_tcpincoming { tcp( ip(0.0.0.0) port(514) max_connections(1000) keep_timestamp(no) keep_hostname(no) ); }; destination d_fe_tcp { udp( "127.0.0.2" port(514) spoof_source(yes) ); }; log { source(s_tcpincoming); # With no "filter" we get everything, which is what we want destination(d_fe_tcp); }; ####### END: Forward TCP syslog As I said, my goal is to receive TCP/514 and **transparently** forward logs with no changes, as if they came in via UDP, to the localhost via UDP/514. In other words, I'm using syslog-ng as a shim to feed syslog over TCP to a listener which only listens on UDP. Why doesn't it work? What totally obvious thing am I missing? Am I doing anything else dumb? TIA, JP ----------------------------|:::======|------------------------------- JP Vossen, CISSP |:::======| http://bashcookbook.com/ My Account, My Opinions |=========| http://www.jpsdomain.org/ ----------------------------|=========|------------------------------- "Microsoft Tax" = the additional hardware & yearly fees for the add-on software required to protect Windows from its own poorly designed and implemented self, while the overhead incidentally flattens Moore's Law.

4 4