- syslog-ng - lists.balabit.hu

FreeBSD install with SSL
by John Kristoff 16 Mar '11

16 Mar '11

I have a FreeBSD system that has the SSL libraries not built from ports. Apparently the syslog-ng port expects ssl to be installed from ports. I'd prefer not to do that at this time. However, when building syslog-ng from source, it expects pkg-config (or gnome-config as this FreeBSD still refers to it) for SSL, which also is not going to work. I've not tried the balabit supplied FreeBSD package. Any guidance on the best approach to get syslog-ng with SSL support installed onto this FreeBSD box? Keep in mind I'd like to avoid changing the installed openssl libaries at this time. Will the balabit package do the trick? Perhaps it is better to modify the build process from source? John

5 4

afsql module error
by Eshan Bhide 16 Mar '11

16 Mar '11

Hi guys, I'm trying to setup a master syslog-ng server which listens on UDP syslog port to incoming squid access log and Cisco syslog messages. It uses a db_parser to parse and store these access logs in different variables. I now need to store these values in a simple mysql database. I have created the database schema and thought of using a pipe and a wrapper script to write the query. But read that there are problems sometimes with this approach. I then thought about doing it using libddb and downloaded the package syslog-ng_3.2.2 from the website. So far so good, but when I try to run syslog-ng it gives me an error: syslog-ng Error opening plugin module; module='afsql', error='/usr/local/lib/syslog-ng/libafsql.so: undefined symbol: dbi_result_free' Error opening plugin module; module='afsql', error='/usr/local/lib/syslog-ng/libafsql.so: undefined symbol: dbi_result_free' Error parsing destination, destination plugin sql not found in /usr/local/etc/syslog-ng.conf at line 61, column 3: sql(type(mysql) ^^^ Any pointers on what I'm missing here ? I have commented out the '@module afsql' line in modules.conf, have made sure I've got the latest libdb and libdb-devel packages. I'm running CentOS 5.x and just don't know how to proceed :( Appreciate all and any help guys thank you. -- Eshan Bhide Engineer, Core Infrastructure and Systems Development Global Gossip 14 Wentworth Ave Surry Hills, NSW 2010 Australia ------------------------------------------------- IMPORTANT NOTICE : The information in this email is confidential and may also be privileged. If you are not the intended recipient, any use or dissemination of the information and any disclosure or copying of this email is unauthorised and strictly prohibited. If you have received this email in error, please promptly inform us by reply email or telephone. You should also delete this email and destroy any hard copies produced.

5 14

[PATCH] Fix autogen.sh to autogen submodules by default.
by Gergely Nagy 15 Mar '11

15 Mar '11

Call autogen_submodules even if $skip_modules is unset (which it would be on most systems that just cloned the repository). Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- autogen.sh | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/autogen.sh b/autogen.sh index 3569af3..569f134 100755 --- a/autogen.sh +++ b/autogen.sh @@ -31,7 +31,7 @@ autogen_submodules() done } -if [ "$skip_submodules" = 0 ]; then +if [ -z "$skip_submodules" ] || [ "$skip_modules" = 0 ]; then autogen_submodules fi -- 1.7.2.3

2 1

logging stopped
by Len Conrad 15 Mar '11

15 Mar '11

uname -a FreeBSD 7.0-RELEASE syslog-ng --version syslog-ng 2.0.10 change date on syslog-ng.conf is "Apr 20 2009" been running untouched for at least that long. about 00:20 today Friday, all syslogging to syslog-ng stopped. chkrootkit shows nothing wrong stop syslog-ng then pkg_delete, and then cd /usr/ports/sysutils/syslog-ng2 make && make install start it, no change I rebooted the syslog server. no change trafshow -i bce0 -n then filter 514 shows 100KBs arriving from our syslog clients. df shows plenty of disk space for /var suggestions? Len

2 1

Re: [syslog-ng] afsql module error
by Eshan Bhide 15 Mar '11

15 Mar '11

Updated to the latest 3.3.0alpha2 build, libdbi-drivers and latest ivykis from git, and after much messing with the source I got it to compile and install. Now I get the error: "The database access library (DBI) reports no usable SQL drivers, perhaps DBI drivers are not installed properly; Error initializing dest driver; dest='d_sql', id='d_sql#0' Error initializing message pipeline;" I'm pulling my hair out at this point - could I get some help here please :) ? On 15 March 2011 14:13, Eshan Bhide <ebhide(a)globalgossip.net> wrote: > Here's another try: > > http://pastebin.com/7TV0nHzD > > On 14 March 2011 21:54, Hendrik Visage <hvjunk(a)gmail.com> wrote: >> >> >> On Mon, Mar 14, 2011 at 6:37 AM, Eshan Bhide <ebhide(a)globalgossip.net> >> wrote: >>> >>> Hi Hendrik, >>> Still having this problem of "No such DBI driver; type='mysql'" >>> >>> Strace is attached at: >>> http://pastebin.com/qaJZ2ZbE >> >> I see libdbi getting loaded, but what I am missing in that strace, is the >> libdbi searching for it's drivers.... >> >> >> > ------------------------------------------------- IMPORTANT NOTICE : The information in this email is confidential and may also be privileged. If you are not the intended recipient, any use or dissemination of the information and any disclosure or copying of this email is unauthorised and strictly prohibited. If you have received this email in error, please promptly inform us by reply email or telephone. You should also delete this email and destroy any hard copies produced.

2 1

Some messages are missing
by Tinnis G 14 Mar '11

14 Mar '11

Hi, I am not getting all the messages in the message log files . If someone helps me , it will be really appreciated. We have remote servers , where we are keeping the log files too. I feel that the problem is in the filter. Please correct me. I want all the logs will be reported . Mentioning below the configuration file on each server. These are all same throughout. Thanks in advance. _________________________________________________________ options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames(off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); stats (3600); }; source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; # Remote logging ################ ## Auth log destination loghost1 { tcp("log1.xx.org" port(514)); }; destination loghost2 { tcp("log2.xx.org" port(514)); }; destination loghost3 { tcp("log3.xx.org" port(514)); }; filter f_auth { facility(auth); }; log { source(src); filter(f_auth); destination(loghost1); }; log { source(src); filter(f_auth); destination(loghost2); }; log { source(src); filter(f_auth); destination(loghost3); }; # ## Authpriv log destination loghost1 { tcp("log1.xx.org" port(514)); }; destination loghost2 { tcp("log2.xx.org" port(514)); }; destination loghost3 { tcp("log3.xx.org" port(514)); }; filter f_authpriv { facility(auth, authpriv); }; log { source(src); filter(f_authpriv); destination(loghost1); }; log { source(src); filter(f_authpriv); destination(loghost2); }; log { source(src); filter(f_authpriv); destination(loghost3); }; ## Everything log destination loghost1 { tcp("log1.xx.org" port(514)); }; destination loghost2 { tcp("log2.xx.org" port(514)); }; destination loghost3 { tcp("log3.xx.org" port(514)); }; filter f_everything { level(debug..emerg); }; log { source(src); filter(f_everything); destination(loghost1); }; log { source(src); filter(f_everything); destination(loghost2); }; log { source(src); filter(f_everything); destination(loghost3); }; # # Local logging ################ # Local Destinations #%%%%%%%%%%%%%%%%%%% destination authpriv { file("/var/log/authpriv.log"); }; destination auth { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog.log"); }; destination messages { file("/var/log/messages.log"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kernel { file("/var/log/kernel.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination mail { file("/var/log/mail.log"); }; destination debug { file("/var/log/debug.log"); }; # # destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; # Local Filters ############### filter f_syslog { not facility(authpriv, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_authpriv { facility(auth, authpriv); }; filter f_auth { facility(auth); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kernel { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_debug { not facility(auth, authpriv, news, mail); }; # # filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; # Local Log ############ log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_authpriv); destination(authpriv); }; log { source(src); filter(f_auth); destination(auth); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kernel); destination(kernel); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_debug); destination(debug); }; # log { source(src); filter(f_emergency); destination(console); }; log { source(src); destination(console_all); }; # ## END /etc/syslog-ng/syslog-ng.conf _________________________________________________________

3 2

Reading Log file
by Shawn Cannon 14 Mar '11

14 Mar '11

Can someone tell me what the numbers mean for processed and dropped? Am I logging everything to SQL or am I dropping some? Mar 9 17:12:03 syslog01 syslog-ng[1738]: Log statistics; processed='source(s_gms)=2279331', dropped='dst.sql(d_mssql#0,freetds, rawsql.adbcefg.net,1785,Syslog)=2213605', stored='dst.sql(d_mssql#0,freetds, rawsql.abcdefg.net,1785,Syslog)=0',

3 4

[PATCH]: Experimental SMTP destination
by Gergely Nagy 11 Mar '11

11 Mar '11

Hi! I've had a little free time, and started toying with the idea of implementing an SMTP destination for syslog-ng. So far, it's progressing nicely, but there are a few shortcomings, as I will explain later. For anyone interested, it can be found on the 'work/modules/afsmtp' branch of my syslog-ng-3.3 tree: git://git.balabit.hu/algernon/syslog-ng-3.3.git Or, one can browse the branch on the web: http://git.balabit.hu/?p=algernon/syslog-ng-3.3.git;a=shortlog;h=work/modul… One will need the libesmtp library installed for the module to work. It should be available in most distributions, but if one doesn't have it, it can be downloaded from http://www.stafford.uklinux.net/libesmtp/ (although, as of this writing, the site seems to be down). The usage is something like this: destination d_smtp { smtp( host("localhost") port(25) mail_from("syslog-ng alert service <noreply(a)example.com>") rcpt_to("Admin #1 <admin(a)example.com>") rcpt_to("Admin #2 <admin2(a)example.com>") subject("[ALERT] $LEVEL condition in $PROGRAM!") header("X-Program" "$PROGRAM") header("X-Facility" "$FACILITY") body("Hi!\nThe syslog-ng alerting service thinks you might be interested in the following message:\n $MSG\n-- \nsyslog-ng\n") ); }; One can specify any number of recipients, and the mail will be sent to all of them. Custom headers can also be specified, but at this time, a selected few headers do not work as one would expect, due to libesmtp handling them specially. These are: Date, From, To, Cc, Bcc, Reply-To - trying to set either of these will result in unspecified behaviour (ranging from mangled headers to crashes, in case of Date). I will fix these at a later point. They will probably be need to set via their own statements (header_date, header_from, etc, or something along those lines). Specifying mail_from or subject multiple times will override any previous values. Adding the same custom header multiple times will only add the first (though, plans include changing that, so that one can include the same header multiple times, with different values - if I can find a use-case for that). There are also a few other minor issues here and there, but nothing major, as far as I could check. Further plans include authentication & starttls support. libesmtp supports both, I just didn't have time to write the neccessary glue code yet. -- |8]

8 26

Destination MySQL for Syslog-ng 2.0.x
by Hidayath Basha 11 Mar '11

11 Mar '11

Hi, How can I collect the logs in MySQL db with syslog-ng 2.0.x? There is a destination 'sql' in syslog-ng 3+, but how can I do it with 2.0? Thanks and regards, Hidayath

3 2

Transmitting a Huge Log File
by Hidayath Basha 11 Mar '11

11 Mar '11

Hi all, I'm trying to transmit a huge log file (of about 80k lines) to a centralized syslog server over TCP But, on the syslog server, I'm receiver only the last part of the log file (of about 7000 lines) How can I transmit the whole log file On client, the syslog-ng.conf file ... destination d_mydest { tcp("192.168.18.7" port(5140)); }; source s_src { file("/some/huge/file.log" follow_freq(1) log_prefix("mylogs:")); }; log { source(s_src); destination(d_mydest); }; On server (192.168.18.7) , the conf file ... source s_mysrc{ tcp(ip("192.168.18.7") port(5140) keep-alive(yes)); }; filter f_filter{ match("mylogs:"); }; destination d_mydest { file ("/var/log/hosts/$HOST/$YEAR-$MONTH/$YEAR-$MONTH-$DAY/hugefile.log" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; log { source(s_mysrc); filter(f_filter); destination(d_mydest); }; Thanks and regards, Hidayath

4 4