- syslog-ng - lists.balabit.hu

Question RE: Timezone in filename
by Brian Donaldson 23 Mar '10

23 Mar '10

I've configured syslog-ng to include the timezone in the log filename -- but the value used is "07:00". Any way to get "PDT" instead?

2 1

Spoofing SRC of forwarded syslog
by AM M84 23 Mar '10

23 Mar '10

Hi, I want to know if it is possible to spoof(UDP) the original source IP of a message that has already been forwarded. Server1 (Original Source)--> Server2 (Forwarding Syslog Server )--> Server3 (Server Source Spoofing Server1) --> Final Dest. Thanks, AMM

2 2

facility 10 plus?
by fedora fedora 23 Mar '10

23 Mar '10

Hi, I have some odd devices using syslog facility 24, and there is no way I can change it! In this case, is it possible letting syslog-ng use facility 24? right now it gives me, 24 is not supported error and quits. Thanks

3 3

syslog-ng client messages delayed
by mark peters 22 Mar '10

22 Mar '10

Hi, We are running into a issue where syslog-ng clients who are configured to forward to a central syslog-ng destination server that are reasonably chatty are getting there messages delayed at the source (ie. 'tcpdump'ing the client shows it is sending messages from N minutes ago, where N is anything from 5 to 60 minutes on average sometimes more). We have also seen a small percentage of loss at the destination. On these 'delayed' clients we also see the resident memory footprint on the growing. Clients are running 1.6.12 (have tried 2.0.8 also - same symptons). The central syslog-ng server is running 2.0.8. relevant config entries are: syslog-ng client: options { sync (1); time_reopen (10); log_fifo_size (2097152); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; destination d_central { tcp("log2.xyz.com" port(5140)); }; filter f_local5 { facility(local5); }; log { source(s_sys); filter(f_local5); destination(d_central); flags(final); }; syslog-ng central server: options { time_reopen (10); log_fifo_size (2097152); long_hostnames (off); use_dns (yes); dns_cache (yes); dns_cache_expire (28800); use_fqdn (no); create_dirs (yes); dir_perm (0755); perm (0644); keep_hostname (no); use_time_recvd (no); stats_freq(600); flush_timeout(16000); flush_lines(256); time_sleep(80); }; destination d_server { file("/logs/server.$LEVEL.log"); }; filter f_server { facility(local5) and program("server"); }; log { source(s_sys); filter(f_server); destination(d_server); flags(final); }; to give a rough idea of message volume the server is receiving approximately 50 million log lines per day on average any help/information would be appreciated thanks -------------------------------------- Easy + Joy + Powerful = Yahoo! Bookmarks x Toolbar http://pr.mail.yahoo.co.jp/toolbar/

3 4

log failback groups
by Patrick H. 22 Mar '10

22 Mar '10

How do you do groups of failbacks? For example log { filter(f_filter1); destination(d_file1); }; log { filter(f_filter1); destination(d_file2); }; <-- log here only if the above fails log { filter(f_filter2); destination(d_sql1); }; <-- may include messages from the above 2 lines log { filter(f_filter2); destination(d_sql2); }; <-- log here only if d_sql1 fails So, say lines 1 and 3 both fail, lines 2 and 3 should both start working. If I put a fallback flag on d_file2 and d_sql2, and d_sql1 fails, d_sql2 wont kick in on matches that d_file1 is still taking. It seems like there should be a way to do "log { destination(...) or destination(...); };", or "log {...} or log {...};".

7 12

syslog-ng 3.1.0 has been released
by devel＠balabit.hu 22 Mar '10

22 Mar '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.1.0 SUMMARY : new feature release DATE : Mar 22, 2010 ------------------------------------------------------------------------------ DESCRIPTION: This is the first stable release of syslog-ng Open Source Edition 3.1. syslog-ng 3.1 is the first so called "feature release" of syslog-ng, as such its support period ends when either the next feature (named 3.2) or the next stable (named 4.0) version is published. Please note that this announcement contains features that were already published in one of the earlier BETA releases. If you are upgrading from 3.1beta2, please see the list of changes relative to that version at the end of the "CHANGES" block below. CHANGES SINCE v3.0: New features: * Support for patterndb v2 and v3 format, along with a bunch of new parsers: ANYSTRING, IPv6, IPvANY and FLOAT. * Added a new "pdbtool" utility to manage patterndb files: convert them from v1 or v2 format, merge mulitple patterndb files into one and look up matching patterns given a specific message. * Support for message tags: tags can be assigned to log messages as they enter syslog-ng: either by the source driver or via patterndb. Later it these tags can be used for efficient filtering. * Added support for rewriting structured data. * Macros and name-value pairs got a little tighter integration, in filters where syslog-ng 3.0 was limited to only use name-value pairs, with 3.1 you can also use macros. * Enhanced dynamic name-value performance by a factor of three. * Some parsers got additional features: NUMBER is now able to parse hexadecimal numbers, ESTRING is now able to search for multiple characters as the end of the string. * Added non-standard and non-portable facility codes (range 10-15), decouple syslog-ng facility name information from the system used to compile syslog-ng on. * Added pcre support in the binary packages of syslog-ng. An updated administrator's guide is available on the BalaBit documentation page at: http://www.balabit.com/support/documentation/ CHANGES SINCE v3.1beta2: Bugfixes: * Fixed Solaris 10 SMF script to properly handle svcadm refresh requests. * Fixed a possible segmentation fault for unix-dgram/unix-stream destinations on some (non-Linux) platforms. * Fixed processing empty log entries when using the syslog() protocol. * Fixed processing partially received syslog messages. Other changes: * It is now possible to add comments before the @version header in the configuration file. * Decrease the frequency of gettimeofday() calls during syslog-ng operation, as gettimeofday() is expensive to call on some platforms. * The SQL destination will only attempt to INSERT a given log message 3 times, and after that it gives up, instead of trying indefinitely. * Tru64 portability fixes. * The functional test program was improved to check the new RFC5424 syslog protocol. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

Server conf for syslog-ng.conf
by Lozada, Agustin T 19 Mar '10

19 Mar '10

Hi, Can somebody show to me a sample to set-up for server of syslog-ng.conf? I'm trying to use this config but its complaining on s_network: @version:3.0 options { time_reap(30); mark_freq(10); keep_hostname(yes); }; source s_local { unix-stream("/dev/log"); internal();}; source s_network { syslog(transport(tcp))}; destination d_logs { file( "/var/log/syslog-ng/logs.txt" owner("root") group("root") perm(0777) ); }; log { source(s_local); source(s_network); destination(d_logs); }; What Im missing here? Thanks and regards, Agustin Lozada UNIX System Admin 713-207-2474

3 4

Problem with sql destination
by yavuz 19 Mar '10

19 Mar '10

Hi all, I want to insert logs directly to mysql database, I am using two destinations one is a file(for testing purposes) and the second is sql. Logs are written to file but not sql destination. I couldn't find the problem because don't know where to look. The configuration file is attached. thanks in advance. // ps.

3 3

Specific log messages have wrong hostname
by Christopher Jon Caldwell 18 Mar '10

18 Mar '10

All of the syslog messages sent by our Solaris servers that contain output from the service processor are getting the wrong hostname assigned to them - the log messages get filed under the hostname of the receiving syslog-ng server. They all share the same process name "SC Alert". The packets look correctly formed so I am assuming it is the space in the process name. Any way to fix this without dropping the messages completely using something like bad_hostname? We are running 2.1.11a Enterprise Edition. Here is the relevant part of my syslog-ng.conf: options { sync (0); create_dirs (yes); keep_hostname (yes); check_hostname (yes); chain_hostnames (no); bad_hostname ("\t"); normalize_hostnames (yes); mark_freq (10); }; source src_net { udp(port(514)); }; destination d_hosts { file("/var/log/systems/$HOST_FROM/$FACILITY/$YEAR/$MONTH/$FACILITY\-$YEAR$MONTH$DAY" perm(0644) dir_perm(0755) create_dirs(yes)); ... log { source(src_net); destination(d_hosts); destination(d_splunk); flags(fallback); }; And here is an example packet from snoop. ETHER: ----- Ether Header ----- ETHER: ETHER: Packet 36 arrived at 12:09:18.28026 ETHER: Packet size = 169 bytes ETHER: Destination = 0:3:ba:71:22:65, ETHER: Source = 0:21:28:4:ec:b7, ETHER: Ethertype = 0800 (IP) ETHER: IP: ----- IP Header ----- IP: IP: Version = 4 IP: Header length = 20 bytes IP: Type of service = 0x00 IP: xxx. .... = 0 (precedence) IP: ...0 .... = normal delay IP: .... 0... = normal throughput IP: .... .0.. = normal reliability IP: .... ..0. = not ECN capable transport IP: .... ...0 = no ECN congestion experienced IP: Total length = 155 bytes IP: Identification = 25576 IP: Flags = 0x4 IP: .1.. .... = do not fragment IP: ..0. .... = last fragment IP: Fragment offset = 0 bytes IP: Time to live = 255 seconds/hops IP: Protocol = 17 (UDP) IP: Header checksum = f267 IP: Source address = 10.244.236.183, vienna IP: Destination address = 10.241.34.101, auctor.backup.es.gwu.edu IP: No options IP: UDP: ----- UDP Header ----- UDP: UDP: Source port = 32832 UDP: Destination port = 514 (SYSLOG) UDP: Length = 135 UDP: Checksum = F5D8 UDP: SYSLOG: ----- SYSLOG: ----- SYSLOG: SYSLOG: Priority: <29> (daemon.notice) SYSLOG: "<29>Mar 12 12:09:18 SC Alert: [ID 362536 daemon.notice] Audi" SYSLOG: -- Christopher Caldwell Senior Engineer, Technology Operations and Engineering The George Washington University caldwell @ gwu . edu | +1 202.994.4674 (w) | +1 202.409.0878 (c) PGP key ID: 0x0A0EC46C "Quis custodiet ipsos custodes?" - Juvenal

4 3

subst() pcre escape sequences
by Patrick H. 18 Mar '10

18 Mar '10

Ok, I'm trying to lowercase a certain macro with a pcre rewrite rule. Unfortunately it doesnt seem to be observing pcre escape sequences. subst('^(.+)$','\L$1\E',value('FROM') flags('store-matches') type('pcre')); (the FROM macro is created from the named match of an earlier pcre filter() It ends up just putting a literal '\L' and '\E' at the start and end of the string. Is this a bug, or am I doing something wrong, or is there another way to do this?

3 3