- syslog-ng - lists.balabit.hu

More verisign questions
by Jimmy McDonald 15 Dec '09

15 Dec '09

Hello, Thank you very much for the information! It got me one step closer. My root CA does not have basicConstraints set, but my intermediate does. Is there any way around this issue? I have spoken with my CA (Verisign) and they cannot provide a different root CA. Any ideas? Thank you, Jimmy Sent from my iPhone... So expect typos.

2 1

syntax error in config-file
by andip 15 Dec '09

15 Dec '09

Hi folks, I just tried updating syslog-ng to version 3.0.4, from 2.1.4. i use the gentoo linux-distro, and the new version came into "stable" gentoo a few days ago. I'm no syslog-ng expert, but i use it to log quite a few things, so my config-file it not default. I've read a bit in the admin-guide, but did not find any reason to my problem. i've tried converting my 2.1.4 config-file to the new 3.0.4 version, with no success. this is parts of my old config-file. ### are comments made to reflect changes i made for v2 -> v3 conversion ---------------------------------------------------------------------------- options { chain_hostnames(off); ### changed this to "no" sync(0); ### changed this to "flush_lines" time_sleep(20); log_fifo_size (2048); create_dirs (yes); perm (0640); dir_perm (0750); stats(43200); ### changed this to "stats_freq" owner (syslogger); group (syslogger); perm (0664); }; source sys { unix-stream("/dev/log" max-connections(256)); internal(); file("/proc/kmsg"); }; source net { udp(); }; destination clients { file ("/var/log/fwlogs/netclients/$HOST"); }; destination console_all { file ("/dev/tty12"); }; destination authlog { file ("/var/log/authlog"); }; destination messages { file ("/var/log/messages"); }; destination maillog { file ("/var/log/maillog"); }; destination ipflog { file ("/var/log/ipflog"); }; destination imaplog { file ("/var/log/imaplog"); }; destination console { file ("/dev/console"); }; destination syslog { file ("/var/log/syslog"); }; ### changed to _syslog destination komm { file ("/var/log/fwlogs/kommunikasjon-context.log"); }; destination asa { file ("/var/log/fwlogs/asa.log"); }; destination edb { file ("/var/log/fwlogs/edb-pix.log"); }; destination gje { file ("/var/log/fwlogs/gjerdrum.log"); }; destination nes { file ("/var/log/fwlogs/nes.log"); }; destination ull { file ("/var/log/fwlogs/ullensaker.log"); }; destination hur { file ("/var/log/fwlogs/hurdal.log"); }; destination eid { file ("/var/log/fwlogs/eidsvoll.log"); }; destination nan { file ("/var/log/fwlogs/nannestad.log"); }; destination datas { file ("/var/log/fwlogs/datasenter-context.log"); }; destination mgmt { file ("/var/log/fwlogs/management-context.log"); }; destination wifi { file ("/var/log/fwlogs/wifi-context.log"); }; destination aplog { file ("/var/log/aplog/aplog.txt"); }; filter aplog { host (10.20.); }; ### this line caused the syntax error (line 35) filter gje { host (10.8.30.28); }; filter nes { host (10.8.30.20); }; filter ull { host (10.8.30.36); }; filter hur { host (10.8.30.12); }; filter eid { host (10.8.30.44); }; filter nan { host (10.8.30.52); }; filter datas { host (10.8.0.1); }; filter mgmt { host (10.8.30.60); }; filter wifi { host (10.8.30.92); }; filter asa { host (ASA-R111); }; filter komm { host (10.8.30.76); }; filter edb { host (edb-pix); }; filter emerg { level (emerg); }; filter alert { level (alert .. emerg); }; filter crit { level (crit .. emerg); }; filter err { level (err .. emerg); }; filter warning { level (warning .. emerg); }; filter notice { level (notice .. emerg); }; filter info { level (info .. emerg); }; filter debug { level (debug .. emerg); }; filter kern { facility (kern); }; filter user { facility (user); }; filter mail { facility (mail); }; filter daemon { facility (daemon); }; filter auth { facility (auth); }; filter syslog { facility (syslog); }; filter lpr { facility (lpr); }; filter news { facility (news); }; filter uucp { facility (uucp); }; filter cron { facility (cron); }; #filter local0 { facility (local0); }; #filter local1 { facility (local1); }; #filter local2 { facility (local2); }; #filter local3 { facility (local3); }; #filter local4 { facility (local4); }; #filter local5 { facility (local5); }; #filter local6 { facility (local6); }; #filter local7 { facility (local7); }; filter user_none { not facility (user); }; filter kern_debug { filter (kern) and filter (debug); }; filter daemon_notice { filter (daemon) and filter (notice); }; filter mail_crit { filter (mail) and filter (crit); }; filter mesg { filter (kern_debug) or filter (daemon_notice) or filter (mail_crit); }; filter authinfo { filter (auth) or program (sudo); }; log { source (sys); destination(messages); }; log { source (sys); destination(console_all); }; log { source (sys); filter (authinfo); destination (authlog); }; log { source (sys); filter (mail); destination (maillog); }; #log { source (sys); filter (local0); destination (ipflog); }; #log { source (sys); filter (local1); destination (imaplog); }; log { source (sys); filter (syslog); destination (syslog); }; log { source (sys); filter (emerg); filter (user_none); destination (console); }; log { source (sys); filter (mesg); filter (user_none); destination (messages); }; log { source (net); destination (clients); }; log { source (net); filter (komm); destination (komm); }; log { source (net); filter (asa); destination (asa); }; log { source (net); filter (mgmt); destination (mgmt); }; log { source (net); filter (wifi); destination (wifi); }; log { source (net); filter (datas); destination (datas); }; log { source (net); filter (wifi); destination (wifi); }; log { source (net); filter (gje); destination (gje); }; log { source (net); filter (nan); destination (nan); }; log { source (net); filter (ull); destination (ull); }; log { source (net); filter (hur); destination (hur); }; log { source (net); filter (eid); destination (eid); }; log { source (net); filter (nes); destination (nes); }; log { source (net); filter (edb); destination (edb); }; log { source (net); filter (aplog); destination (aplog); }; #log { source (net); filter (komm); destination (komm); }; ---------------------------------------------------------------------- This is the error i got : syntax error in /etc/syslog-ng/syslog-ng.conf at line 35. syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng * Configuration error. Please fix your configfile (/etc/syslog-ng/syslog-ng.conf) It is not a very big deal at the moment, as i've reverted back to version 2.1.4, but i'd like to keep my system current, and somewhat up to date. this server's main function is as a syslogger for a few firewalls though, so i cannot leave it unable to log for long. hope someone can help. cheers andip

2 1

multiple destinations
by Ulrich David 14 Dec '09

14 Dec '09

Hi, If I use multiple destinations like : log { source(src); filter(f_52); destination(mysql_52); destination(file_52); flags(final); }; If my first destination is down (a mysql database), does the second destination works correctly ? There is 2 fifo, one for each destinations, but are the 2 destinations working totally independantly? Regards David

2 1

Syslog-NG 3.0.5 incorrectly parsing messages without program names
by Larry Low 11 Dec '09

11 Dec '09

In the past I used the MSG macro to get the full syslog message. Now MSG is broken into MSG and MSGHDR. If a message comes in without a program name such as "exiting on signal 15" or "last message repeated 20 times", syslog-ng incorrectly takes the first word as the program name. Trying to rebuild it with $MSGHDR$MSG causes an erroneous : to be placed on these messages since $MSGHDR is filled in with "exiting" and "last". --- Larry Low 480.385.7045 (w) | llow(a)telesphere.com | www.telesphere.com 9237 E Via de Ventura | Suite 250 | Scottsdale, AZ 85258

1 0

udp packet receive errors
by Paras Fadte 11 Dec '09

11 Dec '09

Hi, When logging to a remote syslog server , I see a lot of udp "packet receive errors" on the remote syslog server . The source machines don't show any such packet loss. I tried increasing net.core.wmem_max to 16MB and changed the log_fifo_size value to 2000 from default 100 on remote syslog server but still I continue to see udp packet receive errors . What could be the issue here ? The incoming request rate is inorder of 50k/sec during peak time. What can be done to minimize these errors? Syslog-ng version is syslog-ng 1.6.8 Thank you. -Paras

3 2

Chroot Occuring Too Early
by Larry Low 11 Dec '09

11 Dec '09

Building out a new syslog-ng server and it seems that in syslog-ng 3.0.5 is chrooting before reading the config file and setting up /dev/log. I ran the same configuration in syslog 2.0.7 without this problem. /opt/syslog-ng/sbin/syslog-ng --chroot /var/log Error opening configuration file; filename='/opt/syslog-ng/etc/syslog-ng.conf', error='No such file or directory (2)' --- Larry Low

2 2

colored messages
by Gaydov Victor 11 Dec '09

11 Dec '09

Hello. I wrote a small patch to add colorization to syslog-ng. The idea is to apply different color schemes to messages (that are going to a tty, for example) depending on their type and importance and using standard syslog-ng filters. IMHO this makes tty log much more readable. There is a new keyword: 'scheme'. "scheme { ... }" construction binds colors to message fields and "scheme()" field of "log {...}" adds scheme filter that colorizes the output (before it will be sent to destination). The filter uses ANSI escape sequences but it's easy to extend it to anything else. Color support is enabled with defining 'ENABLE_COLOR' or using '--enable-colors' in configure script. If you'll find it useful you can use it :) The patch and example (draft) syslog-ng.conf are attached. -- Gaydov Victor. Practically perfect people never permit sentiment to muddle their thinking. -- Mary Poppins

5 6

Syslogd and syslog-ng
by Rocco Scappatura 11 Dec '09

11 Dec '09

Hello, I'm configuring a centralized loghost (SLES 10 SP3) based on syslog-ng, for collecting mail log of different clients. Several machine which are entitled to log its mail logs on the central loghost (Debian), still use old syslogd as logger system. I configured one of this to send its mail logs to the loghost putting: mail.* @syslogmi01.local in /etc/syslog.conf file and restarted the service. Moreover on the loghost I set: source mail_gateway_src { udp(ip("0.0.0.0") port(514)); }; filter ernesto_mail_f { facility(mail); }; destination d_ernesto_mail { file("/var/log/ernesto_mail"); }; log { source(mail_gateway_src); filter(ernesto_mail_f); destination(d_ernesto_mail); }; And restarted it. But no file are created and so no log are saved on the loghost. With tcpdump I see the the log comes on the loghost, but syslog doesn't want to catch them. # tcpdump -vvv host 192.168.252.107 and port 514 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 18:04:57.046952 IP (tos 0x0, ttl 64, id 3157, offset 0, flags [DF], proto: UDP (17), length: 358) 192.168.252.107.syslog > syslogmi01.local.syslog: SYSLOG, length: 330 Facility mail (2), Severity info (6) Msg: postfix/smtpd[30946]: NOQUEUE: reject: RCPT from u[|syslog] 18:04:57.046962 IP (tos 0x0, ttl 64, id 3158, offset 0, flags [DF], proto: UDP (17), length: 360) 192.168.252.107.syslog > syslogmi01.local.syslog: SYSLOG, length: 332 I saw that the logs coming from Debian machine (so using syslogd) miss of timestamp and host name that generates host. Could be this a source of incompatibility between syslogd and syslog-ng? Or there is something that I'm wrong? Thanks in advance, rocsca

5 10

re-opening it's logs
by Tim Rupp 11 Dec '09

11 Dec '09

will syslog-ng re-open it's log files if it finds that the size of the log has suddenly decreased or the inode has changed or something similar that may be caused by a logrotate? Or should I just get in the habit of sighup'ing the process? I have a log file on AFS space that seems to have stopped being written to, but log files on the local system are still chugging along just fine, so I think an errant rotate script is taking place on that remote system and moving the file and syslog-ng isn't noticing. My last log entry in the syslog-ng log is this Dec 7 15:56:02 clogger syslog-ng[23479]: Initializing destination file writer; template='/afs/files/data/k5logs/tmp/kdc.log', filename='/afs/files/data/k5logs/tmp/kdc.log' but, and this is my next question, that timestamp is ~8 hours off. It's 9:47 am here and syslog-ng is writing Dec 8 01:38:01 into the syslog-ng.log file. `date` command on the system is reporting [root@clogger tarupp]# date Tue Dec 8 09:43:16 CST 2009 and other log files have a correct date in them. The related log config entries are source s_internal { internal(); }; destination d_syslog { file("/logging/syslog-ng/syslog-ng.log"); }; log { source(s_internal); destination(d_syslog); }; a snippet of the syslog-ng.log file is Dec 8 01:44:01 clogger syslog-ng[23479]: Closing log transport fd; fd='1043' Dec 8 01:44:01 clogger syslog-ng[23479]: Destination timed out, reaping; template='/logging/syslog-ng/$HOST/secure', filename='/logging/syslog-ng/fnd0763/secure' and there are a bunch of these going into the file. The "seconds" in the timestamp also do not change even though time is. For example, that 01 seconds could stay there for a minute or so for each log entry and then a Dec 8 01:45:31 clogger syslog-ng[23479]: Reaping unused destination files; template='/logging/syslog-ng/$HOST/messages' will come along and increment the seconds by 1; not to the new time though. If I had to venture a guess, maybe the time_reap value is too low? (ours is set to the default) and maybe we have such a large number of one-shot hosts that syslog-ng is getting backed up writing to that log file? Any ideas? Thanks, Tim

2 1

Re: [syslog-ng] Macro expansion in program destination
by chris packham 11 Dec '09

11 Dec '09

This is intentional behaviour. Syslog-ng starts any "program()" when syslog-ng is started and it expects that the program will perform read from stdin and block waiting for data. This protects syslog-ng againts the overhead of forking a new process everytime a matching log message is seen. You can still use filters so I'd suggest modifying your program so that it can have the $S_DAY fed to it at the start of each log message. >>> Evan Rempel <erempel(a)uvic.ca> 12/04/09 4:07 PM >>> Is it possible to use macro expansion in the program destination. I wanted to write something like destination mydest{ program("/some/path/to/filter/program -options >> /path/log.$S_DAY"));}; I was hoping that syslog-ng would not open this destination until the first message was ready for this destination. I was hoping that syslog-ng would open a new one when the $S_DAY changed, allowing me to have each day of logs processed by my program with outputs based on day. Does anyone know if macro expantion can be used on program destinations? If not, can someone explain what I am overlooking that makes this a bad thing? Thanks, -- Evan Rempel ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

4 7