- syslog-ng - lists.balabit.hu

check clients
by Josu Lazkano 14 Jul '11

14 Jul '11

Hello list, I want to know if there is a option to know which log-clients are sending data to syslog-ng server. Is it possible to get a list of clients? Thanks and best regards.

4 4

change rsyslog for syslog-ng
by Josu Lazkano 14 Jul '11

14 Jul '11

Hello list, I am learning how to get a syslog server with syslog-ng. I started working on a IT department and I have more than 50 servers, we actually has rsyslog on the client side and syslog-ng on the syslog server. I want to change the client side rsyslog to configure it with syslog-ng. On the server side I read lot of documentation and I know how to configure it (source, destination and filter). I want to get this logs on the client side and send to the syslog server on a TCP+SSL: /var/log/auth.log /var/log/daemon.log /var/log/dmesg /var/log/messages /var/log/syslog I want to get on the server side something like this: /var/log/extern/host1/auth.log /var/log/extern/host1/ daemon.log /var/log/extern/host1/ dmesg /var/log/extern/host1/ messages /var/log/extern/host1/ syslog /var/log/extern/host2/auth.log /var/log/extern/host2/ daemon.log /var/log/extern/host2/ dmesg /var/log/extern/host2/ messages /var/log/extern/host2/ syslog ... /var/log/extern/hostn/auth.log /var/log/extern/hostn/ daemon.log /var/log/extern/hostn/ dmesg /var/log/extern/hostn/ messages /var/log/extern/hostn/ syslog On the past post you help me and I have how to get It on the server side for the TCP+SSL: source s_tcptls { tcp (ip("10.200.42.1") port(10514) tls( peer-verify(require-trusted) ca_dir("/etc/syslog-ng/certs/") key_file("/etc/syslog-ng/certs/server.key") cert_file("/etc/syslog-ng/certs/server.crt") ) ); }; I have some questions: 1. Must I uninstall rsyslog before install syslog-ng? 2. How can I configure the client side to send my logs to the server and to save on the local /var/log/? 3. Is there any client limit on syslog-ng? I will try to read and learn as much as I can, I will appreciate your help. Thanks for your job and best regards.

4 4

Macros expansion in pattern-db actions
by Denis Gasparin 14 Jul '11

14 Jul '11

Hi to all. We're using syslog-ng 3.2.4 and we're having a weird behaviour in using macros with actions values. Here it is a sample pattern-db rule: <?xml version='1.0' encoding='UTF-8'?> <patterndb version='4' pub_date='2011-06-20'> <ruleset name='cron' id='cron-ruleset'> <pattern>/usr/sbin/cron</pattern> <rules> <rule provider="patterndb" id="cron-1" class="system" context-id="sample-context-id"> <patterns> <pattern>(@ESTRING:usracct.username:) @CMD (@ESTRING:details:)@</pattern> </patterns> <actions> <action trigger="match" condition="match('mymatch' value('details'))"> <message> <values> <value name="MESSAGE">[${details}] was found in a cron log message. Rule number [${.classifier.rule_id}]</value> <value name="TRIGGER">yes</value> </values> </message> </action> </actions> </rule> </rules> </ruleset> </patterndb> We tested the rule using pdtool match command and the output was: # pdbtool match -P "/usr/sbin/cron" -M "(root) CMD (mymatch)" MESSAGE=(root) CMD (mymatch) PROGRAM=/usr/sbin/cron .classifier.class=system .classifier.rule_id=cron-1 usracct.username=root details=mymatch HOST= MESSAGE=[] was found in a cron log message. Rule number [] PROGRAM=/usr/sbin/cron PID= TRIGGER=yes We instead expected the following output from pdtool match execution : # pdbtool match -P "/usr/sbin/cron" -M "(root) CMD (mymatch)" MESSAGE=(root) CMD (mymatch) PROGRAM=/usr/sbin/cron .classifier.class=system .classifier.rule_id=cron-1 usracct.username=root details=mymatch HOST= MESSAGE=[mymatch] was found in a cron log message. Rule number [cron-1 ] PROGRAM=/usr/sbin/cron PID= TRIGGER=yes Macro expansion was not executed in action values but it was in action definition... What are we missing? Thank you in advance for your help Denis Gasparin --- Edistar SRL

2 1

Trying to let my harddrive spin down once in a while
by Lars Stokholm 12 Jul '11

12 Jul '11

Hello On my laptop I run Arch Linux with syslog-ng and cronie (cron) among other programs of course. I'm trying to get my harddrive to spin down automatically once in a while (using hdparm). Me and a lot of other people both in the Arch and Ubuntu community are having our attempts to do this ruined, by what first seemed to be the EXT4 journalling block device (jbd2). After long discussions and finally a bug report (see at the bottom of this mail), I think I've boiled my troubles down to be mostly about syslog-ng (and possibly cronie - but I don't think so). No matter what I try I can't seem to get syslog-ng to stop "waking up my disks" (at least that's what kernel tracing tells me). Killing the crond process almost totally stops these syslog-ng writes to the disk. Unfortunately I've been unable to configure my way out of it using syslog-ng.conf. So my harddrive won't stay spinned down - not even for a minute. This is what tracing the journalling gives me (see the kernel bug report below for an explanaition): http://pastebin.com/raw.php?i=J6BtGVrz As you can probably see, syslog-ng writes every minute at least. I guess that's because my user crontab has a command that gets run every minute. What I don't get is why syslog-ng writes to the disk, even though I'm telling it not to log crond's output. Here is my syslog-ng.conf - as you can see I tried to output the crond messages to /dev/null. I guess it works, because there are no mentions of crond anywhere in /var/log anymore. http://pastebin.com/raw.php?i=H02KKWPV Here are the discussions and the bug report I mentioned: https://bbs.archlinux.org/viewtopic.php?id=113516 https://bugs.launchpad.net/ubuntu/+source/linux/+bug/607560 https://bugzilla.kernel.org/show_bug.cgi?id=39072 I don't know if syslog-ng is causing trouble for only me, but it seems unlikely. Regards, Lars

3 13

Re: [syslog-ng] Syslog-ng log viewer/analyser
by Terry Slattery 08 Jul '11

08 Jul '11

I don't recall where I found it. It may have been at CiscoLive or from something on the Cisco web site, such as an article you wrote. I thought it was a very interesting statistic. -tcs On 7/8/11 2:17 PM, syslog-ng-request(a)lists.balabit.hu wrote: > Date: Fri, 8 Jul 2011 14:16:19 -0400 > From: Clayton Dukes<cdukes(a)gmail.com> > Subject: Re: [syslog-ng] Syslog-ng log viewer/analyser > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CAANP6Qd=0xnGJ6BkvuyLLTsz7yCQKJMXviwq6=PNV17DnJs8aQ(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi Terry, > Checked out your blog. > I was wondering where you got the quote about 90 traps and 6000 syslog > messages? > I ask because it's my quote, heh > Just think it's neat how things travel:-) > -- Terry Slattery CCIE# 1026

2 1

Re: [syslog-ng] Syslog-ng log viewer/analyser
by Terry Slattery 08 Jul '11

08 Jul '11

I have a couple of blogs that might be of interest. The first references a couple of other blogs about handling events. The second is about a summary script that I've found useful for summarizing syslog each day. http://www.netcordia.com/community/blogs/terrys_blog/archive/2010/06/06/han… http://www.netcordia.com/community/blogs/terrys_blog/archive/2009/10/28/sys… -tcs -- Terry Slattery CCIE# 1026 On Jul 8, 2011, at 6:00 AM, syslog-ng-request(a)lists.balabit.hu wrote: > > Date: Thu, 07 Jul 2011 15:08:02 +0200 > From: Peter Czanik <czanik(a)balabit.hu> > Subject: Re: [syslog-ng] Syslog-ng log viewer/analyser > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: <4E15AFB2.1070505(a)balabit.hu> > Content-Type: text/plain; charset=ISO-8859-1 > > On 07/07/2011 01:49 PM, Pramod Pillai wrote: >> Hi >> >> Is there any Syslog-ng log viewer/analyser which I can use along with >> syslog-ng . > There are many. See my blog at > https://czanik.blogs.balabit.com/2011/06/a-comparison-of-syslog-ng-web-guis/ > Bye, > > -- > Peter Czanik (CzP) <czanik(a)balabit.hu> > BalaBit IT Security / syslog-ng upstream > http://czanik.blogs.balabit.com/

2 1

change from rsyslog to syslog-ng
by Josu Lazkano 08 Jul '11

08 Jul '11

Hello everybody! I finished to configure my syslog system. I am using rsyslog on clients side and syslog-ng on the server side. It works well, but I have a little problem with Apache vhosts logs. I want to send all vhosts logs to my syslog-ng server, but I don't know how to do with rsyslog. Is possible to do with syslog-ng? My Apache logs are configured this way: ErrorLog /var/www/domain1/log/error.log LogLevel warn SetEnvIf Remote_Addr "x\.x\.x\.x" dontlog SetEnvIf Remote_Addr "y\.y\.y\.y" dontlog CustomLog /var/www/domain1/log/access.log common env=!dontlog On the same machine I have lots of vhost logs: /var/www/domain1/log/error.log /var/www/domain1/log/access.log /var/www/domain2/log/error.log /var/www/domain2/log/access.log /var/www/domain3/log/error.log /var/www/domain3/log/access.log ... Is preferable to change all rsyslog to syslog-ng? Thanks for your great help. Best regards.

2 1

Syslog-ng log viewer/analyser
by Pramod Pillai 07 Jul '11

07 Jul '11

Hi Is there any Syslog-ng log viewer/analyser which I can use along with syslog-ng . Regards Pramod

5 4

syslog-ng help: how can I use function in double quotes?
by Henry Xu 05 Jul '11

05 Jul '11

Hi All, How can I use a function in double quote? I want to record the IP address of the syslog-ng server. Since there's no available macro that represent the IP of syslog-ng server(only have macros indicate where the message sent to syslog-ng server,like $HOST). So I want to use ip() function and record it to database. The configuration part is: columns( "datetime varchar2(24)", "server_ip varchar2(24)", "host varchar2(32)", ...) values( "${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "ip()", "$HOST", ...) When I started syslog-ng,it gave error message that said expecting double quotes. How can I use a function in double quotes? Or are there any other ways to get the syslog-ng server IP address and record them? Thanks, Henry

3 3

Re: [syslog-ng] Rpmbuild syslog-ng-3.2.4-1.el6: FAIL: test_nvtable - glib2 hash table
by JP Vossen 05 Jul '11

05 Jul '11

Any clues? -------- Original Message -------- Subject: Re: [syslog-ng] Rpmbuild syslog-ng-3.2.4-1.el6: FAIL: test_nvtable - glib2 hash table Date: Sat, 25 Jun 2011 04:49:38 -0400 From: JP Vossen To: syslog-ng@... On 06/24/2011 07:19 AM, Balazs Scheidler wrote: > On Mon, 2011-06-20 at 20:59 +0100, Jose Pedro Oliveira wrote: >> >> There is a problem with the hash table implementation of glib2 >> version 2.12.3-4 (version that ships in RHEL 5.x). >> More details in: >> >> * https://bugzilla.redhat.com/show_bug.cgi?id=714409#c7 > > Thanks for the information, if it's a glib bug then, can I help you in > any way? Or I can "close" the issue? I see that Jose already forwarded the bug, but I wonder; can you tell me what impact the failed test (and thus failed or potentially failed code block) may have on syslog-ng run-time on CentOS-5/RHEL5? Is this hash problem going to cause critical failures? Under what circumstances? Or is it, well, it'd be nice if that hash problem didn't happen, but it's not a big deal... Thanks, JP ----------------------------|:::======|------------------------------- JP Vossen, CISSP |:::======| http://bashcookbook.com/ My Account, My Opinions |=========| http://www.jpsdomain.org/ ----------------------------|=========|------------------------------- "Microsoft Tax" = the additional hardware & yearly fees for the add-on software required to protect Windows from its own poorly designed and implemented self, while the overhead incidentally flattens Moore's Law.

1 0