- syslog-ng - lists.balabit.hu

Convert syslog to traps
by Jay 14 Dec '10

14 Dec '10

Have a requirement to convert all incoming syslogs to SNMP traps and send it to another host. One option I could think of is to use program () destination. When I tried this option, I find that syslog-ng is continuously sending newline characters to the specified program. i.e. even when no syslog is received, syslog-ng seems to be pumping newline chars to the specified program. Also I read the warning message in admin guide that, it will open up the door to DOS attack. Could someone let me know the best way to achieve this, please ? Thanks in advance for the help. John

5 8

Microsoft SQL connect issue
by Shawn Cannon 14 Dec '10

14 Dec '10

When a Microsoft SQL connection is attempted, I get the following errors. I am trying to connect to a names instance of MS SQL over TCP 1785. Any ideas? Thanks.... Dec 13 10:33:23 syslog01 syslog-ng[27963]: Error running SQL query; type='freetds', host='sql.hidden.local\instance', port='1785', user='user', database='syslog', error='', query='CREATE TABLE syslogng (datetime varchar(16), host varchar(32), program varchar(32), pid varchar(8), message varchar(4096))' Dec 13 10:33:23 syslog01 syslog-ng[27963]: Error creating table, giving up; table='syslogng' Dec 13 10:33:23 syslog01 syslog-ng[27963]: Error checking table, disconnecting from database, trying again shortly; time_reopen='60' Shawn Cannon IT Professional http://www.shawncannon.com Contact Me <http://www.linkedin.com/pub/shawn-cannon/5/84/81a> LinkedIn<http://www.linkedin.com/pub/shawn-cannon/5/84/81a> <http://www.facebook.com/rolltidega72> Facebook<http://www.facebook.com/rolltidega72> <http://twitter.com/rolltidega> Twitter <http://twitter.com/rolltidega> My blog: My thoughts on VMworld… a week later…<http://www.shawncannon.com/?p=19>

3 13

Help configuring a basic setup
by Shawn Cannon 10 Dec '10

10 Dec '10

OK I want to setup syslog-ng to listen for syslog traffic on the standard UDP port and have the messages received logged to a Microsoft SQL database. I am having trouble finding documentation I can understand. I am a very GUI driven admin so all the command line stuff is messing with me! If anyone can assist I would appreciate it. Thanks.... Shawn Cannon IT Professional http://www.shawncannon.com Contact Me <http://www.linkedin.com/pub/shawn-cannon/5/84/81a> LinkedIn<http://www.linkedin.com/pub/shawn-cannon/5/84/81a> <http://www.facebook.com/rolltidega72> Facebook<http://www.facebook.com/rolltidega72> <http://twitter.com/rolltidega> Twitter <http://twitter.com/rolltidega> My blog: My thoughts on VMworld… a week later…<http://www.shawncannon.com/?p=19>

1 0

Re: [syslog-ng] Creating a "log" block (OSE 3.2.1)
by Eric Berggren 10 Dec '10

10 Dec '10

> thanks for noticing this error. I've corrected it in the source repo of the > adminguide, and will update the docs on the website when someone tells me if > using {} within blocks is permitted (but now buggy) or forbidden. > changing the type of the block to root should workaround the problem. I see, it's really about using { }'s within the block definition. Making it a "root" block (as a completely separately log {} stanza) is probably cleaner in this particular case, but the same restriction applies at the moment -- the example from the OSE 3.2 documentation [5.3.2]: block root mylogs() { source s_file { file("/var/log/mylogs.log" follow_freq(1)); }; destination d_local { file("/var/log/messages"); }; log { source(s_file); destination(d_local); }; }; doesn't parse either (same error on the final "};") The documentation (html/PDF) could use some minor updates in this area for clarity: - block definitions also require ()'s after the name (including non-parameterized); e.g. block root foo() { ... } - perhaps add an additional example for using parameterized blocks; e.g. block destination foo ( logname("some.log") ) { file( "/var/log/`logname`" ... ); }; destination bar { foo( logname("other.log") ) }; destination baz { foo() }; regards, -eric ps: I have yet to actually *test* any of this new functionality myself yet (later today :)

3 4

Re: [syslog-ng] Creating a "log" block (OSE 3.2.1)
by Eric Berggren 10 Dec '10

10 Dec '10

Admittedly, I ended up just using a separate log {} statement (obviating the need for the block statement in this particular instance, but using blocks successfully elsewhere -- very nice). I tested the earlier lexer patch and found it works (as I imagined you did), and sure I'll find more creative uses . Allowing the extra ";" when referencing blocks indeed makes it look more consistent . thanks again -eric > I've just committed these 3 patches that implement block support for > block statements. I've also resolved the '{' issue and also made it > possible to use several ';' characters in place of a single one.

1 0

keep_timestamp() and use_time_recvd() equivalent?
by Craig Bell 09 Dec '10

09 Dec '10

Q: Is option keep_timestamp(no) reasonably equivalent to use_time_recvd(yes)? Background: We recently upgraded from OSE v2.1 to v3.1.2. This went well, but our global options include the deprecated use_time_recvd(). We see this advisory on startup: > Your configuration file uses an obsoleted keyword, please update your configuration; keyword='use_time_recvd', change='Use R_ or S_ prefixed macros in templates' We don't modify the default templates, so adding these for the first time wouldn't be my first choice. Instead, can I simply use global option keep_timestamp(no) as a replacement? I looked around for advice, but didn't see anything obvious. Thanks in advance! -cheers, CSB

2 2

advice/assistance with parsing attempt requested
by syslog-ng2010＠hushmail.com 08 Dec '10

08 Dec '10

i've spent the better part of the past week reading and trying to understand both the documentation and list posts trying to sort this out, if anyone can offer some advice as to whether this is possible or not and if so, what i'm doing wrong; i would really appreciate it! … i have a simple enough task, or so i thought! i've got a syslog stream being received by syslog-ng with too much data. what i'd like to do is parse out pieces of the stream and write only those to a file. the tricky part is that the order of the stream is very variable so that sometimes the desired named parser preceding strings and associated values are present and sometimes not. furthermore, the extra data is also quite variable. can this challenge even be addressed with syslog-ng ose? if so, can it be done with patterned without creating a pattern for EVERY variation of possible streams? for clarification, we've tried to leverage an external perl script which does this using regexs but, it seems that it can't keep up with the stream, we only receive 10% of the original events in the output. if this (external parsing script) only way this can be done, we will continue our efforts to enhance the external script but, if this is possible to be done natively within syslog-ng, i'd rather do that. with the following configuration, i am able to generate output log entries which correctly contain the global macros of $DATE $FULLHOST $PROGRAM as well as the strings preceding the named parser variables but, not the named parser macros. my output looks like this: Dec 2 11:11:11 127.0.0.1 ABC: 0 namedparser1= namedparser2= namedparser3= namedparser4= namedparser5= *****examples of entries in source stream***** Dec 2 11:11:11 127.0.0.1 ABC: 0 namedparser1=namedparser1value extra1=extravalue1 namedparser2=namedparser2value namedparser3=namedparser3value extra2=extravalue2 namedparser4=namedparser4value namedparser5=namedparser5value extra3=extravalue3 Dec 2 11:11:11 127.0.0.1 ABC: 0 extra1=extravalue1 namedparser3=namedparser3value extra2=extravalue2 namedparser4=namedparser4value namedparser5=namedparser5value extra3=extravalue3 extra4=extravalue4 Dec 2 11:11:11 127.0.0.1 ABC: 0 namedparser1=namedparser1value extra1=extravalue1 namedparser2=namedparser2value namedparser3=namedparser3value extra2=extravalue2 namedparser4=namedparser4value extra3=extravalue3 *****examples of desired output***** Dec 2 11:11:11 127.0.0.1 ABC: 0 namedparser1=namedparser1value namedparser2=namedparser2value namedparser3=namedparser3value namedparser4=namedparser4value namedparser5=namedparser5value Dec 2 11:11:11 127.0.0.1 ABC: 0 namedparser3=namedparser3value namedparser4=namedparser4value namedparser5=namedparser5value Dec 2 11:11:11 127.0.0.1 ABC: 0 namedparser1=namedparser1value namedparser2=namedparser2value namedparser3=namedparser3value namedparser4=namedparser4value *****included in conf file***** parser pattern_db { db_parser(file("/opt/syslog-ng/config/patterndb.xml") }; template reduced { template("$DATE $FULLHOST $PROGRAM: 0 namedparser1=$NAMEDPARSER1 namedparser2=$NAMEDPARSER2 namedparser3=$NAMEDPARSER3 namedparser4=$NAMEDPARSER4 namedparser5=$NAMEDPARSER5 \n"); template_escape(no); } destination d_logfile { file("/opt/syslog-ng/logs/logfile" template(reduced)); } log { source(source); parser(pattern_db); destination(d_logfile); }; *****patterndb.xml contents***** <patterndb version='3' pub_date=''> <ruleset name='globe' id='1234567890'> <pattern>ABC</pattern> <rules> <rule provider='someone' id='123' class='system'> <patterns> <pattern>ABC namedparser1=@ESTRING:NAMEDPARSER1:\ @ namedparser2=@ESTRING:NAMEDPARSER2:\ @ namedparser3=@ESTRING:NAMEDPARSER3:\ @ namedparser4=@ESTRING:NAMEDPARSER4:\ @ namedparser5=@ESTRING:NAMEDPARSER5:\ @</pattern> <patterns> </rule> <rules> </ruleset> </patterndb> MANY thanks in advance!

5 8

[Bug 99] New: syslog-ng unable to write to files owned by another user and not world writable
by bugzilla＠bugzilla.balabit.com 08 Dec '10

08 Dec '10

https://bugzilla.balabit.com/show_bug.cgi?id=99 Summary: syslog-ng unable to write to files owned by another user and not world writable Product: syslog-ng Version: 3.1.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mimosinnet(a)ningunlugar.org Type of the Report: bug Estimated Hours: 0.0 I used to have a new destination that logged messages into a file owned by a certain user. This worked in syslog-ng-3.0.4: destination problem { file("/var/log/problem.log" owner("o3o") group("users")); }; # ls -lisah problem.log 6268890 920K -rw------- 1 o3o users 915K 7 des 12:52 problem.log After upgrading to syslog-ng-3.1.1, I get the following message: Dec 7 12:52:37 o3o syslog-ng[12594]: Error opening file for writing; filename='/var/log/problem.log', error='Permission denied (13)' Dec 7 12:52:37 o3o syslog-ng[12594]: syslog-ng internal() messages are looping back, preventing loop by suppressing further messages; recurse_count='2' I can write to the file as the o3o user (i.e. echo "test" >> /var/log/problem.log). I have tried to put the file in the home directory with the same result: destination problem { file("/home/o3o/problem.log" owner("o3o") group("users")); }; I had to give world permissions to the file for syslog-ng to be able to write to it: destination problem { file("/var/log/problem.log" owner("o3o") group("users") perm(0622)); }; The file should only be writable for the specific user. This seems similar to this other bug: https://bugzilla.balabit.com/show_bug.cgi?id=52 Thanks for the attention! -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 5

Creating a "log" block (OSE 3.2.1)
by Eric Berggren 08 Dec '10

08 Dec '10

Howdy Looking to use the new fancy "block" construct in syslog-ng 3.2.1 (OSE) -- (the example in the documentation [5.3.2] doesn't parse, but figured out needs to include ()'s as well in the block definition). Meanwhile, trying to define a "log" block, that contains other log {} stanza's, but fails to parse: filter f_zort { level(err); }; destination d_weblog_unknown { file("/tmp/foo"); }; block log bl_weblog() { filter(f_zort); log { destination(d_weblog_unknown); }; }; Error parsing main, syntax error, unexpected '}', expecting $end in /usr/local/etc/syslog-ng.d/10-weblog at line 7, column 1: included from /etc/syslog-ng.conf line 15, column 37 >> }; << The idea being I would include this within another "log { }" stanza in the main file. If I remove "log { destination(...); };" from the "bl_weblog()" block, it parses okay. I have another ("destination") block within the config that also parses okay (even parameterized). Strangely, commenting out the entry with a "#" at the start of that line still results in a syntax error. The error is independent of whether bl_weblog() is even referenced anywhere. The main config may include only 'include "10-weblog"' and nothing else to demonstrate. Seems otherwise a valid scenario, no ? thanks, -eric

3 3

[Bug 101] New: Typo in modules/afsocket/Makefile.am
by bugzilla＠bugzilla.balabit.com 08 Dec '10

08 Dec '10

https://bugzilla.balabit.com/show_bug.cgi?id=101 Summary: Typo in modules/afsocket/Makefile.am Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: All Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vinschen(a)redhat.com Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=27) --> (https://bugzilla.balabit.com/attachment.cgi?id=27) Patch to fix issue "Typo in modules/afsocket/Makefile.am" Usually $DESTDIR is used without a trailing slash, for instance: $(DESTDIR)$(prefix) In modules/afsocket/Makefile.am, it's erroneously used with a trailing slash in the rules creating the libafsocket.so symlink: $(DESTDIR)/$(moduledir) Assuming $(DESTDIR) is empty, this may result in an erroneous double slash at the beginning of the resulting path: moduledir=/usr/lib/syslog-ng ==> $(DESTDIR)/$(moduledir) == //usr/lib/syslog-ng Per POSIX, a double slash at the start of the path is allowed to have a system-dependent meaning, so this shouldn't happen. I've attached a patch to fix this issue. Corinna -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1