- syslog-ng - lists.balabit.hu

Local7 issue
by Cardia E. - GDI/BH/O&I 20 Mar '11

20 Mar '11

Gentlemen, I've got an issue that the bootlog info doesn't appear in the bootlog file as I would like ( running Red Hat 5.6 EL ). Here are the syslog-ng.conf file parameters : destination bootlog { file("/var/remote2_log/$HOST/$YEAR$MONTH$DAY/boot.log"); }; filter f_local7 { facility(local7); }; log { source(system); filter(f_local7); destination(bootlog); }; Someone an idea ?? Greetz, Efisio --------------------------------------------------------------------------------- Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten. Ministerie van Veiligheid en Justitie This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages. Ministry of Security and Justice ---------------------------------------------------------------------------------

2 1

TLS - Authentication problem
by Honza Mach 18 Mar '11

18 Mar '11

Hi everyone, I am currently implementing central syslog server using syslog-ng and I have encontered some problems when configuring mutual TLS authentication. On client machine I keep getting the following errors: Mar 18 12:54:22 machine syslog-ng[5432]: Syslog connection established; fd='9', server='AF_INET(xxx.113.161.23:514)', local='AF_INET(0.0.0.0:0)' Mar 18 12:54:22 machine syslog-ng[5432]: Certificate validation failed; subject='CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE', issuer='CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE', error='self signed certificate in certificate chain', depth='3' Mar 18 12:54:22 machine syslog-ng[5432]: SSL error while writing stream; tls_error='SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed' Mar 18 12:54:22 machine syslog-ng[5432]: I/O error occurred while writing; fd='9', error='Broken pipe (32)' Mar 18 12:54:22 machine syslog-ng[5432]: Syslog connection broken; fd='9', server='AF_INET(xxx.113.161.23:514)', time_reopen='60' This is the exact same problem as in the following thread: https://lists.balabit.hu/pipermail/syslog-ng/2011-January/015613.html I have verified the functionality without TLS settings and everything works perfectly, so there is no problem on the way (firewall, etc.). I studied carefully the manual and everything is as it is supposed to be: CLIENT MACHINE -------------- OS - Debian 6.0 Squeeze SYSLOG-NG VERSION: client:# syslog-ng --version syslog-ng 3.1.3 Installer-Version: 3.1.3 Revision: ssh +git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#def34661b08109f8148904b860457d5747c425b3 Compile-Date: Feb 1 2011 19:36:27 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: on Enable-Pcre: on DESTINATION CONFIGURATION FROM SYSLOG-NG.CONF: destination d_net { tcp("xxx.113.161.23" port(514) tls( key_file("/etc/ssl/private/client.company.cz-nopass.key") cert_file("/etc/ssl/certs/client.company.cz.pem") ca_dir("/etc/ssl/trusted_ca")) ); }; CA HASH: client:# openssl x509 -in /etc/ssl/trusted_ca/tcs.pem -noout -hash 9df51c42 CA CERTIFICATE DIRECTORY: client:# ll /etc/ssl/trusted_ca total 12 lrwxrwxrwx 1 root root 27 Mar 18 12:30 9df51c42.0 -> /etc/ssl/trusted_ca/tcs.pem -rw-r--r-- 1 root root 1655 Mar 18 12:29 tcs.pem VALIDATE CERTIFICATE AGAINST CA: client:# openssl verify -CAfile /etc/ssl/trusted_ca/9df51c42.0 -verbose /etc/ssl/certs/client.company.cz.pem /etc/ssl/certs/client.company.cz.pem: OK SERVER MACHINE -------------- OS - Debian 6.0 Squeeze SYSLOG-NG VERSION: server:# syslog-ng --version syslog-ng 3.1.3 Installer-Version: 3.1.3 Revision: ssh +git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#def34661b08109f8148904b860457d5747c425b3 Compile-Date: Feb 1 2011 19:36:27 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: on Enable-Pcre: on SOURCE CONFIGURATION FROM SYSLOG-NG.CONF: source s_net { tcp( ip(0.0.0.0) port(514) tls( key_file("/etc/ssl/private/server.company.cz-nopass.key") cert_file("/etc/ssl/certs/server.company.cz.pem") ca_dir("/etc/ssl/trusted_ca")) ); }; CA HASH: server:# openssl x509 -in /etc/ssl/trusted_ca/tcs.pem -noout -hash 9df51c42 CA CERTIFICATE DIRECTORY: server:# ll /etc/ssl/trusted_ca total 12 lrwxrwxrwx 1 root root 27 Mar 18 12:30 9df51c42.0 -> /etc/ssl/trusted_ca/tcs.pem -rw-r--r-- 1 root root 1655 Mar 18 12:29 tcs.pem VALIDATE CERTIFICATE AGAINST CA: server:# openssl verify -CAfile /etc/ssl/trusted_ca/9df51c42.0 -verbose /etc/ssl/certs/server.company.cz.pem /etc/ssl/certs/server.company.cz.pem: OK Certificates for the CA are the same on both machines. I tried to put either the whole chain up to the root certificate, or the last certificate, but the error keeps to appear. It the thread mentioned above the community member Baszi suggested following: ------ It's the whole point in certificate validation to use self-signed CA certificates. (after all, a centrally trusted CA is self-signed too). Try validating that your directory is correct usign "openssl verify", once that validates the cert, syslog-ng should too. -- Bazsi ------- What is meant by validate the directory, I do not understand that. As I said, I succefully validated both client and server certificate against the CA certificate using openssl command, but syslog-ng is still complaining. Am I missing something? I will gladly provide more information, if needed. Thank you for your time Regards Honza Mach

2 1

SEC-2.6.0 released
by Risto Vaarandi 18 Mar '11

18 Mar '11

hi all, since a number of sites are running syslog-ng with SEC event log correlator, I thought I'll let you know about the new major release of SEC: http://sourceforge.net/projects/simple-evcorr/files/sec/2.6.0/ kind regards, risto

1 0

Syslog-ng Cisco CSS switch
by add gy 17 Mar '11

17 Mar '11

Hi, I am not ablle to recive syslog messsages from Cisco content switches I am able to recive messages from rest of the devices ex: cisco routers , switches ,firewalls , loadbalancers etc .. But not able to recive messages from cisco CSS Syslog version 3.0.9 stable Operating system Cento OS 4.7 Is there any configuration changes to be done on syslog file? Thanks Add

1 0

logging to the cloud
by Peter Czanik 16 Mar '11

16 Mar '11

Hello, Two weeks ago I wrote about Loganalyzer, which was one of my most read blog post ever. This time I wrote about a different approach: logging to the cloud: http://czanik.blogs.balabit.com/2011/03/logging-to-the-cloud/ which also provides a nice, web based gui for syslog-ng logs, without the need to set anything up locally. There are already a few more syslog web gui apps on my radar, as I wrote at the end Loganalzer blog. Please let me know, if you have any other syslog related web applications you find interesting! Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

FreeBSD install with SSL
by John Kristoff 16 Mar '11

16 Mar '11

I have a FreeBSD system that has the SSL libraries not built from ports. Apparently the syslog-ng port expects ssl to be installed from ports. I'd prefer not to do that at this time. However, when building syslog-ng from source, it expects pkg-config (or gnome-config as this FreeBSD still refers to it) for SSL, which also is not going to work. I've not tried the balabit supplied FreeBSD package. Any guidance on the best approach to get syslog-ng with SSL support installed onto this FreeBSD box? Keep in mind I'd like to avoid changing the installed openssl libaries at this time. Will the balabit package do the trick? Perhaps it is better to modify the build process from source? John

5 4

afsql module error
by Eshan Bhide 15 Mar '11

15 Mar '11

Hi guys, I'm trying to setup a master syslog-ng server which listens on UDP syslog port to incoming squid access log and Cisco syslog messages. It uses a db_parser to parse and store these access logs in different variables. I now need to store these values in a simple mysql database. I have created the database schema and thought of using a pipe and a wrapper script to write the query. But read that there are problems sometimes with this approach. I then thought about doing it using libddb and downloaded the package syslog-ng_3.2.2 from the website. So far so good, but when I try to run syslog-ng it gives me an error: syslog-ng Error opening plugin module; module='afsql', error='/usr/local/lib/syslog-ng/libafsql.so: undefined symbol: dbi_result_free' Error opening plugin module; module='afsql', error='/usr/local/lib/syslog-ng/libafsql.so: undefined symbol: dbi_result_free' Error parsing destination, destination plugin sql not found in /usr/local/etc/syslog-ng.conf at line 61, column 3: sql(type(mysql) ^^^ Any pointers on what I'm missing here ? I have commented out the '@module afsql' line in modules.conf, have made sure I've got the latest libdb and libdb-devel packages. I'm running CentOS 5.x and just don't know how to proceed :( Appreciate all and any help guys thank you. -- Eshan Bhide Engineer, Core Infrastructure and Systems Development Global Gossip 14 Wentworth Ave Surry Hills, NSW 2010 Australia ------------------------------------------------- IMPORTANT NOTICE : The information in this email is confidential and may also be privileged. If you are not the intended recipient, any use or dissemination of the information and any disclosure or copying of this email is unauthorised and strictly prohibited. If you have received this email in error, please promptly inform us by reply email or telephone. You should also delete this email and destroy any hard copies produced.

5 14

[PATCH] Fix autogen.sh to autogen submodules by default.
by Gergely Nagy 15 Mar '11

15 Mar '11

Call autogen_submodules even if $skip_modules is unset (which it would be on most systems that just cloned the repository). Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- autogen.sh | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/autogen.sh b/autogen.sh index 3569af3..569f134 100755 --- a/autogen.sh +++ b/autogen.sh @@ -31,7 +31,7 @@ autogen_submodules() done } -if [ "$skip_submodules" = 0 ]; then +if [ -z "$skip_submodules" ] || [ "$skip_modules" = 0 ]; then autogen_submodules fi -- 1.7.2.3

2 1

logging stopped
by Len Conrad 15 Mar '11

15 Mar '11

uname -a FreeBSD 7.0-RELEASE syslog-ng --version syslog-ng 2.0.10 change date on syslog-ng.conf is "Apr 20 2009" been running untouched for at least that long. about 00:20 today Friday, all syslogging to syslog-ng stopped. chkrootkit shows nothing wrong stop syslog-ng then pkg_delete, and then cd /usr/ports/sysutils/syslog-ng2 make && make install start it, no change I rebooted the syslog server. no change trafshow -i bce0 -n then filter 514 shows 100KBs arriving from our syslog clients. df shows plenty of disk space for /var suggestions? Len

2 1

Re: [syslog-ng] afsql module error
by Eshan Bhide 15 Mar '11

15 Mar '11

Updated to the latest 3.3.0alpha2 build, libdbi-drivers and latest ivykis from git, and after much messing with the source I got it to compile and install. Now I get the error: "The database access library (DBI) reports no usable SQL drivers, perhaps DBI drivers are not installed properly; Error initializing dest driver; dest='d_sql', id='d_sql#0' Error initializing message pipeline;" I'm pulling my hair out at this point - could I get some help here please :) ? On 15 March 2011 14:13, Eshan Bhide <ebhide(a)globalgossip.net> wrote: > Here's another try: > > http://pastebin.com/7TV0nHzD > > On 14 March 2011 21:54, Hendrik Visage <hvjunk(a)gmail.com> wrote: >> >> >> On Mon, Mar 14, 2011 at 6:37 AM, Eshan Bhide <ebhide(a)globalgossip.net> >> wrote: >>> >>> Hi Hendrik, >>> Still having this problem of "No such DBI driver; type='mysql'" >>> >>> Strace is attached at: >>> http://pastebin.com/qaJZ2ZbE >> >> I see libdbi getting loaded, but what I am missing in that strace, is the >> libdbi searching for it's drivers.... >> >> >> > ------------------------------------------------- IMPORTANT NOTICE : The information in this email is confidential and may also be privileged. If you are not the intended recipient, any use or dissemination of the information and any disclosure or copying of this email is unauthorised and strictly prohibited. If you have received this email in error, please promptly inform us by reply email or telephone. You should also delete this email and destroy any hard copies produced.

2 1