- syslog-ng - lists.balabit.hu

Windows event logs vs syslog format
by Jerry Riedel 15 Oct '10

15 Oct '10

I have the latest syslog-ng on an Opensuse 11.2 acting as a syslog server and it is working well except for one thing - the Windows event logs that are being sent with the Datagram Syslog Agent contain a space that causes issues. Initially, all of these were going into /var/log/messages until I added the keep_hostname(yes) argument. After doing that, it now puts the Windows logs into the appropriate folder under /var/log/hosts/ but it still puts a copy into the /var/log/messages file. I would like to have that log only contain log messages from Opensuse. Is there a configuration setting I am missing, or is this caused by the fact that the syslog agent does not correct the eventlog message so that it adheres to the standard syslog message format? If the latter, does anyone know of an open source/free agent that does this? An example of one of the problematic messages is: Oct 6 11:02:08 cli-fs-1 security[success] 576 NT AUTHORITY\SYSTEM Special privileges assigned to new logon: User Name:CLI-FS-1$ Domain:(obscured) Logon ID:(0x0,0x11331C8) Thanks, Jerry Riedel

4 12

request for smtp/imap/pop3 server log samples
by Peter Czanik 14 Oct '10

14 Oct '10

Hello, As you can see from my last few e-mails, I started to work on patterns for mail related (smtp/imap/pop3) servers. For now I'm only concentrating on login/login failure/logout events. There are many related servers, so it is a lot of work to install/configure/collect logs from them, even from the most important ones. So I'd like to ask for some help here, with an offer, which is beneficial also for you. Here is my offer: - you send me log samples for the following situations from your mail related servers: successful login, logout, invalid password, invalid username) - I create patterns, discuss here when I run into troubles - I push the results into the git tree, so patterns will be available for you and the syslog-ng community - you have patterns you can use immediately with your software (vs. patterns for software I find interesting :-) ) - you see how your log samples turn into patterns If you send the log samples to the list, please make sure, that confidential information is replaced. If you send them directly to me, I can also do it for you, but obviously it's better when sensitive information never leaves your network. Please use the method I showed at http://czanik.blogs.balabit.com/2010/10/pattern-writing-tips-and-tricks/ to collect your logs. If you don't want to read those few paragraphs, here is the most important part, a short syslog-ng.conf snippet: filter f_myprogi { program('pure-ftpd'); }; destination d_myprogi { file('/var/log/myprogi'); }; log { source(src); filter(f_myprogi); destination(d_myprogi); }; As other way messages are scattered among many log files, and difficult to see which messages cover which event. Thanks for your help! Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

uw-imapd patterns
by Peter Czanik 13 Oct '10

13 Oct '10

Hello, Attached you can find UW-imapd samples and patterns. Please test it and let me know, if you have any login/logout related log message left as "Unknown". Known problem: login failures generate the same name value pairs twice. These patterns were created on Ubuntu 10.04 LTS. I'd be very interested to know, if using them on other distributions or UNIX variants makes a difference. -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

ip vs hostname
by Peter Czanik 13 Oct '10

13 Oct '10

Hello, We have a single entry in the SCHEMAS to store login/logout sources: usracct.device. Often only IP address appears in the logs, but sometimes both hostname and IP address. I tend to use IP address in this case, as that's something stable network wide, while a hostname could have only local relevance (/etc/hosts or a local DNS server). What do you think? Is IP enough, or we should also find a way to store hostnames? Is there any situation, when hostnames matter? Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

proftpd, blog
by Peter Czanik 12 Oct '10

12 Oct '10

Hello, Attached is a pre version of proftpd login/logout/failure events and the samples I used. As usual, new application, new problems. The first problem is, that out of box proftpd uses its own log files instead of syslog. This poses a couple of problems: * it resembles syslog logs, but looking closer it is not * it does not have all the logs So for collecting logs I commented out the SystemLog line, so syslog is used, and also enabled anonymous ftp. I could not find a perfect message suitable for 'logout'. There are two related lines: proftpd[6848]: ubuntu (::ffff:192.168.2.179[::ffff:192.168.2.179]) - FTP session closed. But this is used any time a TCP/IP connection is closed, even when there was no actual login. And even if there was a login, it has no user information... proftpd: pam_unix(proftpd:session): session closed for user czanik This one has the user name, but no information at all about the session or IP address. What do you think? Could any of these be useful for creating name - value pairs? Also: if I discard some messages, like opening/closing a session, is it enough if I handle it with one rule (omitting checking the end of message) or it should be handled with two separate messages? And finally some self marketing, hoping that it might be useful some someone: please check my blog (URL in my signature), I have already have two blog posts about pattern writing. Please comment on them here on the mailing list, as if you find something problematic, it should be discussed, and without an additional blog comment login... Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 4

[Bug 52] CAP_DAC_OVERRIDE is missing when capabilities are enabled, unable to write to files created with the owner() option.
by bugzilla＠bugzilla.balabit.com 11 Oct '10

11 Oct '10

https://bugzilla.balabit.com/show_bug.cgi?id=52 Zbigniew Krzystolik <zbyniu(a)pld-linux.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |zbyniu(a)pld-linux.org --- Comment #2 from Zbigniew Krzystolik <zbyniu(a)pld-linux.org> 2010-10-11 15:03:30 --- > CAP_DAC_OVERRIDE is missing and necessary to open files not owned by root. Yes, to open for writing/appending. I created patch fixing such problems. - missing CAP_DAC_OVERRIDE, now owner(), group(), perms() works even if no DAC access is granted - create_dirs works also for dirs with none permissions - dir_owner(), dir_group(), dir_perms() are set as expected (added CAP_CHOWN, CAP_FOWNER) All changes tested, also reloads with -HUP. Now you can run syslog-ng as common user not root and all should work properly! :-) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 52] CAP_DAC_OVERRIDE is missing when capabilities are enabled, unable to write to files created with the owner() option.
by bugzilla＠bugzilla.balabit.com 11 Oct '10

11 Oct '10

https://bugzilla.balabit.com/show_bug.cgi?id=52 --- Comment #1 from Zbigniew Krzystolik <zbyniu(a)pld-linux.org> 2010-10-11 15:01:25 --- Created an attachment (id=24) --> (https://bugzilla.balabit.com/attachment.cgi?id=24) fixes for settings like owner(), group(), perm() and analogous dir_* -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

syslog-ng OSE 3.2 administrator guide draft
by Fekete Robert 08 Oct '10

08 Oct '10

Hi, For a couple of days now I have been working on the administrator guide for the upcoming syslog-ng Open Source Edition 3.2. So far, mostly I have taken the original 3.1 guide apart, and restructured it so that - hopefully - it is easier to use and find relevant information. The structure of the guide is now feature-based, after a brief theoretical introduction about how syslog-ng works and a not-yet-finished quickstart part the chapters focus on the different features, and all information related to a feature is available in the chapter - concepts, configuration, and options reference. Some of the new features of 3.2 are already documented, for example, global variables, the pacct() and system() drivers, and using code blocks. Of course, there are many things to do: the configuration syntax sections are under construction and need cleanup, SCLs and modules should be documented (though some of that will probably go to a developer doc or wiki), and some new features (correlation, patternize, an update on the patterndb project, ...) are missing as well. It is still an early draft, but if you have some time, please take a look and comment on the new structure - any feedback is welcome. The draft is available at http://people.balabit.hu/frobert/syslog-ng-ose-v3.2-guide-admin-en-draft.pdf Regards, Robert

1 0

login
by Peter Czanik 07 Oct '10

07 Oct '10

Hello, Attached is my list of sample log lines for console and telnet logins. I checked it with the login.pdb from http://git.balabit.hu/?p=bazsi/syslog-ng-patterndb.git;a=blob;f=access/logi… and ran into some troubles. ( pdbtool match -p login.pdb -f ~/login.samples )The generic problem is, that many lines appear as "Unknown". Some more specific problems: - root telnet access failure was not found - root/user logins are not matched - invalid user on console generates multiple name value pairs It seems to me, that telnet and console logins generate mostly similar log lines, but not the same. For "invalid user" we should probably create name value pairs only for the line which appears in both cases: pam_unix(login:auth): authentication failure;[...] Or would we miss failure events if we don't create name value pairs for: FAILED LOGIN (@NUMBER::@) on @QSTRING::'@ FOR 'UNKNOWN', Authentication failure Looking at my log samples, in the accepted login lines the only difference is, that I don't have "LOGIN" before "(uid=0)" in the login related lines. There is either nothing or a user name. Changing it to: @ESTRING::(@uid=0) did me the trick, and 'pdbtools test --validate login.pdb' still ran without errors. Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

FW: Syslog-NG with Mysql DB
by Anisur Rehman(IT) 07 Oct '10

07 Oct '10

From: Anisur Rehman(IT) Sent: Thursday, October 07, 2010 1:20 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: Syslog-NG with Mysql DB Hi, I have configured SyslogNG 3.x with mysql and php syslog ng as frontend. It seems everything fine except web URL is not showing Message part. Can you help in this? I can see in database as below mysql> select count(*) from mylog; +----------+ | count(*) | +----------+ | 82 | +----------+ 1 row in set (0.00 sec) Thanks Anisur Rehman CBS-SAS IT Department Bank Muscat S.A.O.G. P.O. Box 134, Ruwi P.C. 112, Sultanate of Oman GSM. +968-99826412 rehman(a)bankmuscat.com

1 0