- syslog-ng - lists.balabit.hu

[Bug 52] CAP_DAC_OVERRIDE is missing when capabilities are enabled, unable to write to files created with the owner() option.
by bugzilla＠bugzilla.balabit.com 11 Oct '10

11 Oct '10

https://bugzilla.balabit.com/show_bug.cgi?id=52 Zbigniew Krzystolik <zbyniu(a)pld-linux.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |zbyniu(a)pld-linux.org --- Comment #2 from Zbigniew Krzystolik <zbyniu(a)pld-linux.org> 2010-10-11 15:03:30 --- > CAP_DAC_OVERRIDE is missing and necessary to open files not owned by root. Yes, to open for writing/appending. I created patch fixing such problems. - missing CAP_DAC_OVERRIDE, now owner(), group(), perms() works even if no DAC access is granted - create_dirs works also for dirs with none permissions - dir_owner(), dir_group(), dir_perms() are set as expected (added CAP_CHOWN, CAP_FOWNER) All changes tested, also reloads with -HUP. Now you can run syslog-ng as common user not root and all should work properly! :-) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 52] CAP_DAC_OVERRIDE is missing when capabilities are enabled, unable to write to files created with the owner() option.
by bugzilla＠bugzilla.balabit.com 11 Oct '10

11 Oct '10

https://bugzilla.balabit.com/show_bug.cgi?id=52 --- Comment #1 from Zbigniew Krzystolik <zbyniu(a)pld-linux.org> 2010-10-11 15:01:25 --- Created an attachment (id=24) --> (https://bugzilla.balabit.com/attachment.cgi?id=24) fixes for settings like owner(), group(), perm() and analogous dir_* -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

syslog-ng OSE 3.2 administrator guide draft
by Fekete Robert 08 Oct '10

08 Oct '10

Hi, For a couple of days now I have been working on the administrator guide for the upcoming syslog-ng Open Source Edition 3.2. So far, mostly I have taken the original 3.1 guide apart, and restructured it so that - hopefully - it is easier to use and find relevant information. The structure of the guide is now feature-based, after a brief theoretical introduction about how syslog-ng works and a not-yet-finished quickstart part the chapters focus on the different features, and all information related to a feature is available in the chapter - concepts, configuration, and options reference. Some of the new features of 3.2 are already documented, for example, global variables, the pacct() and system() drivers, and using code blocks. Of course, there are many things to do: the configuration syntax sections are under construction and need cleanup, SCLs and modules should be documented (though some of that will probably go to a developer doc or wiki), and some new features (correlation, patternize, an update on the patterndb project, ...) are missing as well. It is still an early draft, but if you have some time, please take a look and comment on the new structure - any feedback is welcome. The draft is available at http://people.balabit.hu/frobert/syslog-ng-ose-v3.2-guide-admin-en-draft.pdf Regards, Robert

1 0

login
by Peter Czanik 07 Oct '10

07 Oct '10

Hello, Attached is my list of sample log lines for console and telnet logins. I checked it with the login.pdb from http://git.balabit.hu/?p=bazsi/syslog-ng-patterndb.git;a=blob;f=access/logi… and ran into some troubles. ( pdbtool match -p login.pdb -f ~/login.samples )The generic problem is, that many lines appear as "Unknown". Some more specific problems: - root telnet access failure was not found - root/user logins are not matched - invalid user on console generates multiple name value pairs It seems to me, that telnet and console logins generate mostly similar log lines, but not the same. For "invalid user" we should probably create name value pairs only for the line which appears in both cases: pam_unix(login:auth): authentication failure;[...] Or would we miss failure events if we don't create name value pairs for: FAILED LOGIN (@NUMBER::@) on @QSTRING::'@ FOR 'UNKNOWN', Authentication failure Looking at my log samples, in the accepted login lines the only difference is, that I don't have "LOGIN" before "(uid=0)" in the login related lines. There is either nothing or a user name. Changing it to: @ESTRING::(@uid=0) did me the trick, and 'pdbtools test --validate login.pdb' still ran without errors. Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

FW: Syslog-NG with Mysql DB
by Anisur Rehman(IT) 07 Oct '10

07 Oct '10

From: Anisur Rehman(IT) Sent: Thursday, October 07, 2010 1:20 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: Syslog-NG with Mysql DB Hi, I have configured SyslogNG 3.x with mysql and php syslog ng as frontend. It seems everything fine except web URL is not showing Message part. Can you help in this? I can see in database as below mysql> select count(*) from mylog; +----------+ | count(*) | +----------+ | 82 | +----------+ 1 row in set (0.00 sec) Thanks Anisur Rehman CBS-SAS IT Department Bank Muscat S.A.O.G. P.O. Box 134, Ruwi P.C. 112, Sultanate of Oman GSM. +968-99826412 rehman(a)bankmuscat.com

1 0

wu-ftpd
by Peter Czanik 07 Oct '10

07 Oct '10

Hello, I covered the three major ftpd implementations (proftpd/pureftpd/vuftpd) with login/logout/failure patterns, and as I used wu-ftpd for a long time, I also wanted to create a pattern for that one. No luck, I can't get it running, there are no messages in the logs and strace does not reveal anything :-( So, I'd like to ask, if anybody uses wu-ftpd here? Some logs or even better, patterns, would be very helpful. My latest blogs have some hints, how I collect logs and create rules ( http://czanik.blogs.balabit.com/2010/10/pattern-writing-tips-and-tricks/ and http://czanik.blogs.balabit.com/2010/10/pattern-writing-tips-and-tricks-ii/ ). For ftp I collected logs for the following situations: - anonymous ftp login - root login (actually a failure...) - invalid username - valid user, invalid password - valid user, successful login Anyone could help? Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

error in syslog-ng 3.2alpha2: missing m4 macros directory
by Guillaume Rousse 06 Oct '10

06 Oct '10

Hello. configure.in has this macro: AC_CONFIG_MACRO_DIR([m4]) However, the m4 directory doesn't exist. As a consequence, running 'autoreconf' fails immediatly. I guess it's just missing, as previous release had it. -- BOFH excuse #312: incompatible bit-registration operators

2 1

syslog-ng issue
by anushri kannu 06 Oct '10

06 Oct '10

Hi Every one, I am new to concept of syslog-ng configuration. Already syslog-ng configured in linux server We have 6 syslog-ng server 4 location syslog-ng server receives logs from all the syslog client .. working fine 1 centralized syslog-ng (server receives log from 4 locations ....... working fine 1 we have tcim syslog-ng server receives logs from centralized syslog-ng server... it was working before for both solaris and linux . Now suddenly not collecting logs only for linux. No changes were made. Centalized syslog-ng configuration file options { log_fifo_size(8192); create_dirs(yes); group(sysgrp); dir_group(sysgrp); dir_perm(0750); perm(0440); chain_hostnames(no); keep_hostname(yes); stats(3600); use_fqdn(yes); use_time_recvd(yes); }; Standard filters # Level Filters filter f_emerg { level (emerg); }; filter f_alert { level (alert .. emerg); }; filter f_crit { level (crit .. emerg); }; filter f_err { level (err .. emerg); }; filter f_warning { level (warning .. emerg); }; filter f_notice { level (notice .. emerg); }; filter f_info { level (info .. emerg); }; filter f_debug { level (debug .. emerg); }; # Facility Filters filter f_kern { facility (kern); }; filter f_user { facility (user); }; filter f_mail { facility (mail); }; filter f_daemon { facility (daemon); }; filter f_auth { facility (auth); }; filter f_authpriv { facility (authpriv); }; filter f_syslog { facility (syslog); }; filter f_lpr { facility (lpr); }; filter f_news { facility (news); }; filter f_uucp { facility (uucp); }; filter f_os_unix { not program(EvntSLog) and not program(NetScreen) and not match ("NetScreen device_id") and not match ("%AAA-") and not match ("%AUTH-") and not match ("%AUTHPRIV-") and not match ("%CALLHOME-") and not match ("%CDP-") and not match ("%EARL-") and not match ("%FILESYS-") and not match ("%IMAGE_DNLD-SLOT") and not match ("%IP-") and not match ("%KERN-") and not match ("%LICMGR-") and not match ("%LINEPROTO-") and not match ("%LINK-") and not match ("%MCAST-") and not match ("%MODULE-") and not match ("%OSPF-") and not match ("%PLATFORM-") and not match ("%PRUNING-") and not match ("%PORT-") and not match ("%SPANTREE-") and not match ("%SYS-") and not match ("%UDLD-") and not match ("%VSHD-") source s_local { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(5149) max-connections(333)); internal(); pipe("/proc/kmsg"); }; destination dl_hosts-unix { file("/var/log/syslog-ng/hosts-unix/$HOST/$YEAR/$MONTH/$DAY/$FACILITY.$LEVEL"); }; log { source(s_local); filter(f_os_unix); ###not filter(f_os_switch); destination(dl_hosts-unix); }; destination dl_tcim { udp("10.230.148.18" port(514) template("<$PRI> $DATE $HOST $MESSAGE\r\n")); }; log { source(s_local); destination(dl_tcim); }; tcim server configurarion file. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); # use_dns (no); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source src { udp(); tcp(port(514) keep-alive(yes)); filter f_lnx_hosts { host("amex") or host("green") or host("sa") or host("yellow") or host("urinf01") or etc..; .. .. . }; destination d_lnx { file("/var/log/tcim/$HOST/syslog-$YEAR-$MONTH-$DAY.log" template("<$PRI>$DATE $HOST $MSG\n") create_dirs(yes) owner(svc-tcim) group(users) perm(0660) dir_owner(svc-tcim) dir_group(users) dir_perm(0770) ); }; log { source(src); filter(f_lnx_hosts); destination(d_lnx); }; I did try below command in TCIM server to check the comunication between centralized syslog-ng serer and tcim server tcpdump -nn -tp -port 514.. IP 10.180.40.83.59535 > 10.230.148.18.514: UDP, length 375 IP 10.180.40.83.59535 > 10.230.148.18.514: UDP, length 193 IP 10.180.40.83.59535 > 10.230.148.18.514: UDP, length 638 IP 10.180.40.83.59535 > 10.230.148.18.514: UDP, length 638 1740 packets captured 1740 packets received by filter 0 packets dropped by kernel Packets are getting from centralised log server. Do not know where the mistake is. Please help to resolve this issue.

2 2

syslog-ng3 host_override() issue and proposed fix.
by Nat Baldwin 05 Oct '10

05 Oct '10

Hi there, While trying to do something fairly specific with syslog-ng3, I ran into an error with an easy fix. I'm running syslog-ng3 3.1.1_1 on FreeBSD, installed from ports with SSL enabled and everything else default. What I was trying to do was to use the host_override() function on a unix-dgram() source. Time and again it was acting like the program_override() function instead; altering the program entry and not the host entry in the log. When I went and looked at the source code, I noticed this in logsource.c: 145 if (self->options->program_override) 146 { 147 if (self->options->program_override_len < 0) 148 self->options->program_override_len = strlen(self->options->program_override); 149 log_msg_set_value(msg, LM_V_PROGRAM, self->options->program_override, self->options->program_override_len); 150 } 151 if (self->options->host_override) 152 { 153 if (self->options->host_override_len < 0) 154 self->options->host_override_len = strlen(self->options->host_override); 155 log_msg_set_value(msg, LM_V_PROGRAM, self->options->host_override, self-> options->host_override_len); 156 } Taking a not-so-wild guess, I changed line 155 to read: log_msg_set_value(msg, LM_V_HOST,self->options->host_override, self-> options->host_override_len); (changing LM_V_PROGRAM to LM_V_HOST) and that fixed my problem. Is this something that can be fixed, or should I be bringing this issue to someone in particular's attention? thanks, -- Nat Baldwin Unix Systems Administrator Network Infrastructure, RSSP-IT UC Berkeley ----- End forwarded message ----- -- Nat Baldwin Unix Systems Administrator Network Infrastructure, RSSP-IT UC Berkeley

2 1

syslog-ng issue collecting logs
by anushri kannu 04 Oct '10

04 Oct '10

Hi Every one... As i am new to this concept,Kindly help on this All the syslog-ng client forward logs to centralized log server-- works fine. centralized log server forward logs to tcim server -- works fine for solaris server and other network device-- >From centralized log server to tcim server -- issue ( not collecting logs for linux servers in tcim server ) Centralized log server forward all the logs to tcim server, In Tcim server 4000 devices are configured to collect logs from centralized log server, However in TCIM sever option for log_fifo_size ( 1000) defined and did not mention any variable as max_conncection. Will this affect logs fails to collect from centralized log to tcim server. Below options defined in tcim server. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); # use_dns (no); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source src { udp(); tcp(port(514) keep-alive(yes)); }; 1. If i increase the max-connection(4000 ). do we need to declare below variable like this...... (User requested me to define the below value. in tcim server.) Since i am new to this, Please advice. if i declare the below variable, will server get hangs. this is very critical server. log_fifo_size=4000000 log_iw_size=1000 max-connection(4000) Thanks in advance.

2 1