- syslog-ng - lists.balabit.hu

syslon-ng temote logging
by Vasiliy G Tolstov 02 Nov '09

02 Nov '09

Hello. I have some trouble - all my mail logs send to local syslog-ng on server, that put it into file /var/log/maillog and send to remote logger by udp, then remote logging server dies, local syslog-ng buffers logs some time, after that - system has very big lavg. Is that possible to drops some logs if the destination server not available? -- Vasiliy G Tolstov <v.tolstov(a)selfip.ru> Selfip.Ru

2 1

Syslog-NG interpreting Cisco message 'count' number as $Program
by Patrick Smith 30 Oct '09

30 Oct '09

Hi all, wondering if anyone is familiar with this issue. Have several Cisco switches logging to a syslog-ng server. The syslog-ng server creates a new file for every message as it is interpreting the 'count' item added by the switch as the $program. My configs as follows to demonstrate what I mean: Syslog-ng.conf: destination d_all { file("/var/log/syslog-ng/$HOST/$PROGRAM-$YEAR-$MONTH-$DAY.log"); }; * This has always worked for me before and creates logs for each host with the program prefixed (e.g. snmp-date..., ssl_access_log-date...) But for Cisco switches it writes a new logfile for every message, with the Cisco message number (i.e. log count #) prepended. E.g., for a 6509 switch: -rw-r--r-- 1 syslog-ng wheel 165 Oct 21 11:51 1655156-2009-10-21.log -rw-r--r-- 1 syslog-ng wheel 168 Oct 21 11:51 1655157-2009-10-21.log -rw-r--r-- 1 syslog-ng wheel 147 Oct 21 11:51 1655158-2009-10-21.log -rw-r--r-- 1 syslog-ng wheel 150 Oct 21 11:51 1655159-2009-10-21.log -rw-r--r-- 1 syslog-ng wheel 154 Oct 21 11:52 1655160-2009-10-21.log * where 16551xx is the count of the log message on the switch And each of those files contains one log message, e.g. syslog-ng # cat 1655156-2009-10-21.log Oct 21 11:51:15 6509switch1 1655156: Oct 21 18:51:14.922: %LINK-5-CHANGED: Interface GigabitEthernet3/35, changed state to administratively down For reference the logging on the switches are set as: 6509s: service timestamps log datetime msec logging buffered 20000 debugging logging rate-limit 1000 log-adjacency-changes logging <syslog host IP> logging synchronous 2960s: service timestamps log uptime logging buffered 20000 logging <syslog host IP> logging synchronous I'm thinking I could have a separate destination statement to properly deal with these but I'm wondering if there's any other steps I can take to mitigate it. I have several Cisco firewalls logging to syslog-ng and they do not have the same issue. Thanks for any help. IMPORTANT NOTICE THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer. Learn more about Payment Processing's services at www.paypros.com.

3 10

MySQL Pipe for Syslog-NG not working
by Patrick Smith 29 Oct '09

29 Oct '09

Hi, I realize this is a syslog-ng users list but I know many of you are using/developing php-syslog-ng/logzilla as well so I thought I'd post the question here. I did a fresh install of syslog-ng on 3 servers, all running installed via rpm, but on one server the mysql pipe isn't working successfully. 2 servers are 64-bit RHEL4, syslog-ng-3.0.4-1.el4 (rpm), remote MySQL community server (mysql pipe works) 1 is 64-bit RHEL5, syslog-ng-3.0.4-1.el5 (rpm), local RedHat MySQL server (mysql pipe is not inserting messages) The pipe is taken direct from the php-syslog-ng wiki installation guide: destination d_mysql { program("/var/www/logzilla/scripts/db_insert.pl" template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t $HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n") ); }; destination d_localfiles { file("/var/log/syslog-ng/$HOST/$PROGRAM-$YEAR-$MONTH-$DAY.log"); }; log { source(s_remote); filter(f_allsystem); destination(d_mysql); }; log { source(s_remote); filter(f_allsystem); destination(d_localfiles); }; I have the same syslog-ng.conf file on all 3 hosts. Everything seems to be working normally, the logs just aren't making it into the RHEL5 mysql db. - Syslog messages are being received and written to local files. - Test access to mysql syslog DB as syslogadmin and sysloguser works fine. Correct passwds are in config file. - Test run of DBGen.pl works normally and the log messages are searchable in the logzilla UI. - No error messages in syslog-ng.log, mysqld.log, or logzilla logs. Any ideas as to how to further troubleshoot would be appreciated. IMPORTANT NOTICE THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer. Learn more about Payment Processing's services at www.paypros.com.

3 5

Solaris10 install Syslogng3.0.4 License clarification
by Zeek Anow 21 Oct '09

21 Oct '09

My goal is to install the server and client free version of syslog-ng.3.0.4 on Solaris 10 servers. I read the syslog-ng 3.0 Admin Guide (dated Aug 19, 2009) and the install instructions in the solaris10_install.txt file. My confusion is the constant reference to the Premium Edition for files and licensing. Do I have the wrong documentation or did I download the wrong product? I downloaded syslogng-3.0.4-sol10-sparc-local.gz package from SunFreeware. I filled out the request form on your website that is supposed to be reviewed and the license info returned to me. Again, this is for the Premium Edition. There wasn't anything mentioned about the free version. Hope I'm not confusing you, but I'm lost:)) Thanks!!

2 2

Fwd: Seg fault with include file contains an error
by anthony lineham 20 Oct '09

20 Oct '09

Hi, I sent this patch to the list last month, but haven't had any feedback yet. Does anyone have any comments (aside from my poor spelling and grammar)? Am I way off track with this fix or is it ok? Looking forward to your comments. best regards, Anthony >>> On 9/14/2009 at 4:50 PM, in message <4ADD7D39.7D71.00E6.0(a)alliedtelesis.co.nz>, anthony lineham wrote: > Hi Bazsi, > > I've been investigating a seg fault that occurs when using an include > statement in the config file. The error > occurs when one of the included files contains an syntax error. The first > time syslog-ng is restarted with the bad > config, the error is detected and restart is aborted. However, if a second > HUP is sent a seg fault occurs. > > I had a bit of trouble tracking down the cause and I'm still not entirely > sure of the mechanism that leads to the > crash but I found a couple of apparent problems, which when corrected > prevent it. > > 1. There is a global variable "include_depth" which normally gets > decremented back to zero after successful > parsing of included config files. However, if an error is detected it stays > at its current value and subsequent > restarts increment from that point. This doesn't cause the crash, but given > enough restarts would lead to > overrun or exhaustion of the "include_stack" array. > > 2. In the case of unsuccessful config parsing certain bits of memory are > dealloced but their pointers that not > reset. This seems to be what was causing the seg fault but I've found it a > bit hard to pin down. > > 3. There was an off-by-1 error in the included config deinit loop. > > The following patch fixes the problem, but may not necessarily be the best > way to do it - particularly issue 1. > > Regards, > Anthony > > --- syslog-ng_3.0.1-63-g41f77f5-old/src/cfg-lex.l 2009-09-14 > 16:02:09.000000000 +1200 > +++ syslog-ng_3.0.1-63-g41f77f5/src/cfg-lex.l 2009-09-14 > 16:15:30.000000000 +1200 > @@ -626,17 +626,24 @@ > { > gint i; > > - for (i = 0; i < include_depth; i++) > + for (i = 0; i <= include_depth; i++) > { > CfgIncludeLevel *level = &include_stack[i]; > > if (level->current_file) > - g_free(level->current_file); > + { > + g_free(level->current_file); > + level->current_file = NULL; > + } > > g_slist_foreach(level->files, (GFunc) g_free, NULL); > g_slist_free(level->files); > level->files = NULL; > if (level->yybuf) > - yy_delete_buffer(level->yybuf); > + { > + yy_delete_buffer(level->yybuf); > + level->yybuf = NULL; > + } > } > + include_depth = 0; > } >

2 2

Default SQL Server Informations / Global Constants?
by Jean F. Mousinho 20 Oct '09

20 Oct '09

Hello, Is there a way of defining a default hostname, username, password, etc for the sql destination? or I've to duplicate this information for every destination defined? If not, is there a way of defining some global constants and use them later? Thanks for your time. Jean F. mousinho

4 3

Syslog-ng SRC IP filter doesn't appear to work
by Matty 20 Oct '09

20 Oct '09

Howdy, I am using syslog-ng 3.0.4, and am encountering a bizarre issue where a small percentage of messages don't match the following filter: filter f_hosts { (host("192.168.1.2") or host("192.168.1.3") or host("192.168.1.4")); }; log { source(network); filter(f_hosts); destination(d_messages); flags(final); }; log { source(network); destination(d_catchall); }; When the hosts 192.168.1.[2-4] send messages to our syslog-ng server, 99% of the time they are routed to the d_messages destination. But in a few rare cases, messages similar to the following don't match and are send to the d_catchall destination: Text data: Syslog message: KERN.INFO: Oct 19 14:54:55 \t<STK T10000B > Raw data: <6>Oct 19 14:54:55 <STK T10000B > I verified the SRC IP address for the message in question is correct, and I also ran syslog-ng with the -d -e and -F options to watch message processing. For some reason syslog-ng doesn't match against the filter listed above, which is quite bizarre. I also tried enabling the 'no-parse' flag, but that doesn't appear to help either. Has anyone experienced this issue? Any thoughts on how to debug this issue further? Thanks, - Ryan

2 1

TLS problem
by Carlo Balbo 20 Oct '09

20 Oct '09

Hi All, I have a problem from source tls... no logs are writing, no errors in logs file of syslog-ng . I hope that you have some ideas... :-) Follow the scenario : Server ----------------------------- syslog-ng log file : 2009-10-14T11:43:54+02:00 s_local@zpvm0306-1515 syslog-ng[14171]: Syslog connection accepted; fd='25', client='AF_INET(10.1.1.57:10865)', local='AF_INET(10.1.1.55:1999)' 2009-10-14T11:44:05+02:00 s_local@zpvm0306-1515 syslog-ng[14171]: Reaping unused destination files; template='/var/log/HOSTS/$HOST/encrypt-$PROGRAM-$YEAR-$MONTH.log' 2009-10-14T11:44:05+02:00 s_local@zpvm0306-1515 syslog-ng[14171]: Reaping unused destination files; template='/var/log/HOSTS/$HOST/$R_YEAR-$R_MONTH-$PROGRAM.log' syslog-ng.conf : source s_tcp_tls { tcp( ip(10.1.1.55) port(1999) tls( key_file("/opt/syslog-ng/etc/key.d/syslog-ng.key") cert_file("/opt/syslog-ng/etc/cert.d/syslo-ng.cert") peer_verify(optional-untrusted) ) ); }; destination zlog { file("/var/log/HOSTS/$HOST/$R_YEAR-$R_MONTH-$PROGRAM.log" template("$ISODATE\t[<$FACILITY.$PRIORITY>]\t$HOST\t$PROGRAM\t$MSGHDR $MSG\n") template_escape(no) ); }; log { source(s_tcp_tls); destination(zlog); }; -------------------------------------- Client ---------------------------- source s_local { unix-stream("/dev/log"); internal(); }; destination tls_syslog_destination { tcp("10.1.1.55" port(1999) tls( ca_dir("/opt/syslog-ng/etc/cert.d") ) ); }; log { source(s_local); destination(tls_syslog_destination); }; Oct 14 11:46:02 zpvm0306-1630 syslog-ng[30713]: Syslog connection established; fd='16', server='AF_INET(10.1.1.55:1999)', local='AF_INET( 0.0.0.0:0)' Oct 14 11:46:02 zpvm0306-1630 syslog-ng[30713]: Syslog connection broken; fd='16', server='AF_INET(10.1.1.55:1999)', time_reopen='60' Oct 14 11:46:02 zpvm0306-1630 syslog-ng[30713]: Closing log transport fd; fd='16' ------------------------------------- syslog-ng.key and syslog-ng.cert from syslog-ng.pem -----BEGIN RSA PRIVATE KEY----- MIICXAIBAAKBgQCmf/eIUSTa6jyPiqOfWnofHmVkYRHx+QG9Obml1g3oX6YQEecl UwpFtpaZQHNGbZoCiM3TNr8/rj92yT/i1X4HAuqVrnZ9ra4GD2SQ4/C06Xe5d2+L AlurTwVN9+4Zu73LpvCsfhJZgcros9A10Iq25TvYLu9pBchBLjnY1d2kewIDAQAB AoGAdCQhc8o+biIkenBX8Gl5dEmMqnd3wBVVHDyu/joRW32U5fLHDOce7EAQTviB MKh1XL027dVrlK0kgeSiFsWbcYKJdSLsY7J5osEPFAu9ZjaaXtE1hbQpAlZswLvE n12x6jbZSlVGBTfb6TsLWcgJ5QY2BAcntGZjz3ryffoE/BECQQDSIXBWX3OVuR6i +aFphzy5Hc+IUCsaPYQcSntnLLHa+W3W75sWMLTEjFZGXWQwtj8Ixk+4Ce650yLw B5CbnAYzAkEAythYir5ttKEPkixbGSrBntndJW8oNjXN6pR6ofklhGrV52oh7Y+A UW23lrvAyfAArArDiAcsxV+lYDRwQ5pQmQJADxAql2Z8SK1ejtxKP+Bb8AE9EU59 6IGkaMrGEd1YWpQq1Y+TlIGlU7mjraOgPQWzexOMP2sm29dQ19gS+7SxlQJAJwuD 55kGNvm1rJZbJroDMReQqO7/l4e9zkSsYlc58IY8DGJyi27O7V2oNByJ3JUVHAiq YJm49XkWtTEC1xByKQJBAKRiGABOrJwaOLOgMXreTykY7aX2uho+0gtOKewXoj42 3SwNLyW9rM0IK5lBKOyYyYZ6jn3bN9bYHE4jIjxiMfU= -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIDpzCCAxCgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBmjELMAkGA1UEBhMCSVQx DjAMBgNVBAgTBU1pbGFuMQ4wDAYDVQQHEwVNaWxhbjEUMBIGA1UEChMLWmVyb3Bp dSBTcEExHTAbBgNVBAsMFFJlc2VhcmNoJkRldmVsb3BtZW50MRMwEQYDVQQDEwp6 ZXJvcGl1Lml0MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QHplcm9waXUuaXQwHhcN MDkxMDExMTA1NTQwWhcNMTAxMDExMTA1NTQwWjCBmjELMAkGA1UEBhMCSVQxDjAM BgNVBAgTBU1pbGFuMQ4wDAYDVQQHEwVNaWxhbjEUMBIGA1UEChMLWmVyb3BpdSBT cEExHTAbBgNVBAsMFFJlc2VhcmNoJkRldmVsb3BtZW50MRMwEQYDVQQDEwp6ZXJv cGl1Lml0MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QHplcm9waXUuaXQwgZ8wDQYJ KoZIhvcNAQEBBQADgY0AMIGJAoGBAKZ/94hRJNrqPI+Ko59aeh8eZWRhEfH5Ab05 uaXWDehfphAR5yVTCkW2lplAc0ZtmgKIzdM2vz+uP3bJP+LVfgcC6pWudn2trgYP ZJDj8LTpd7l3b4sCW6tPBU337hm7vcum8Kx+ElmByuiz0DXQirblO9gu72kFyEEu OdjV3aR7AgMBAAGjgfowgfcwHQYDVR0OBBYEFGxV+r7bTgQw7qQFq+NOM2ZKswh/ MIHHBgNVHSMEgb8wgbyAFGxV+r7bTgQw7qQFq+NOM2ZKswh/oYGgpIGdMIGaMQsw CQYDVQQGEwJJVDEOMAwGA1UECBMFTWlsYW4xDjAMBgNVBAcTBU1pbGFuMRQwEgYD VQQKEwtaZXJvcGl1IFNwQTEdMBsGA1UECwwUUmVzZWFyY2gmRGV2ZWxvcG1lbnQx EzARBgNVBAMTCnplcm9waXUuaXQxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRAemVy b3BpdS5pdIIBADAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAEND4ifb Ntd7JJKVa6FDNS5ouLdfQq5sk+uwI9OyDuD2SUdfMuhpF2PZQFxSlI2esOcTwHro tx9FBiNeZkFElPZ82vPjgchGjcgIFfUYHwWH+8lfVXEsmOub0r9xBPZNZ5/mzEXQ 7mpgGYO3aSCzqOPpz0OFBF5cBrpYSzwenaYl -----END CERTIFICATE----- -- /* Carlo http://oblab.com */

2 1

Invalid frame header; header=''
by jnordwick 20 Oct '09

20 Oct '09

I can't seem to get syslog-ng to recongnize a syslog message. I used the example message you give in the docs, but all it says is "Invalid frame header". Here is the error message: Oct 13 14:35:55 logger-01 syslog-ng[29653]: Invalid frame header; header='' here is how I'm sending my test message: echo "<34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - ID47 - BOM'su root' failed for lonvick on /dev/pts/8" | nc logger-01 20514 Here is the config: options { flush_lines(1); }; source src { internal(); syslog(ip("192.168.27.198") port(20514) transport("tcp")); }; destination dest { file("/data/local/logs/sys.log" owner(xl) group (xl)); }; log { source(src); destination(dest); }; ------------------------------------------------------------------------------------------ This message is for the named person(s) use only. It may contain confidential proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. You must not, directly or indirectly use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. Allston Trading LLC and its subsidiaries and affiliates each reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity. ------------------------------------------------------------------------------------------

4 7

syslog-ng OSE in relay mode?
by Massimo Ianni 20 Oct '09

20 Oct '09

Hi, I'm a new syslog-ng user. I have a question about syslog-ng OSE: can an instance of this version be configuable in relay mode? Otherwise should I use syslog-ng PE? Best Regards. Massimo

2 1