- syslog-ng - lists.balabit.hu

syslog-ng3 with SQL on FreeBSD
by Michael W. Lucas 03 Nov '09

03 Nov '09

Hi, I'm working on getting syslog-ng 3.0.3 to support SQL on FreeBSD, and hopefully get it added to the FreeBSD package or port. It looks like something isn't quite right in the configure script, however. I have libdbi 0.8.3 installed, but "./configure --enable-sql=yes" still reports: checking for LIBDBI... gnome-config: not found no checking for dbi_initialize in -ldbi... no I've reviewed /usr/local/include/dbi/dbi.h, and dbi_initialize is in there. Can anyone suggest a fix? Thanks, ==ml -- Michael W. Lucas mwlucas(a)BlackHelicopters.org http://www.MichaelWLucas.com/ Latest book: Cisco Routers for the Desperate, 2nd Edition http://www.CiscoRoutersForTheDesperate.com/

2 1

can two destinations refer to the same file?
by Jason Haar 03 Nov '09

03 Nov '09

Hi there I'm wanting to configure syslog-ng so that I have two different filters that are associated with two different destinations - which have the same filename - but different templates. The issue I have is that we have a range of syslog clients, which may or may not have trustworthy clocks. So I default to ignoring their timestamps and use the syslog servers clock, except for the hosts I know to also use NTP. What I want to confirm is that syslog-ng will happily open /var/log/messages ONCE and will parse the following the way I intend? ie #clocks on unix systems (which are named 'blah-unix-number') are always configured correctly filter f_goodclock { host("-unix-") }; #can't trust everything else filter f_badclock { not host("-unix-") }; destination d_badclock_messages { file("/var/log/messages" template("$R_ISODATE $HOST $FACILITY $PRIORITY $MSG\n") }; destination d_goodclock_messages { file("/var/log/messages" template("$S_ISODATE $HOST $FACILITY $PRIORITY $MSG\n") }; log { ... filter(f_badclock); destination(d_badclock_messages);}; log { ... filter(f_goodclock); destination(d_goodclock_messages);}; Should that work as I hope? Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

3 3

HOST macro using relay
by Jason Barrett 03 Nov '09

03 Nov '09

Hi all, I'm relaying log messages from one syslog-ng server to another. At the final stop, the only way I can get the $HOST macro to work is if I enable dns resolution on server 1 (I'd like to avoid this). Is this by design? Here are the relevant configs: ---------------------------------------------------------------------- syslog-ng server 1 (relays to server 2): chain_hostnames(yes); keep_hostname(yes); use_dns(no); source s_udp { udp(port(514)); }; destination df_udpback { udp("192.168.1.157" port(514)); }; log { source(s_udp); destination(df_udpback); }; ---------------------------------------------------------------------- syslog-ng server 2: chain_hostnames(yes); keep_hostname(yes); use_dns(yes); source s_udp { udp(port(514)); }; destination df_udp { file("/var/log/ics/$HOST/$YEAR/$MONTH/$DAY"); }; log { source(s_udp); destination(df_udp); }; ---------------------------------------------------------------------- Sample log message on server 2: Oct 30 09:35:03 10.12.24.46/10.12.24.46 %ASA-5-111005: 10.28.22.55 end configuration: OK 10.12.24.46 is the correct IP address of the originating host, and $HOST resolves to this IP address. I would prefer $HOST to resolve to the hostname as it exists in the /etc/hosts file. Thanks!

1 0

Re: [syslog-ng] Re : flags(final)
by Michael J. Bauer 03 Nov '09

03 Nov '09

I've upgraded from syslog-ng 2.1.4 to 3.0.4, in case flags(final) was somehow broken in that version. The upgrade has made no difference: flags(final) still appears to have no effect. I am attempting to shunt all entries containing FWNAT into a separate file (network-address-translation), and keep them out of the default destination (default). The configuration, below, writes the entries to both, despite the presence of flags(final) in a prior log{} statement. My understanding based on reading the documentation and various sample configurations is that flags(final) in one log{} statement should preclude the log entry in question from going to any subsequent log{} statement. Am I misunderstanding how flags(final) works, or should I submit a bug report? If I'm misunderstanding, please let me know if there is a way to get the behavior I'm describing. Thanks, MJB My syslog-ng 3-ified configuration: @version:3.0 options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" program_override("kernel")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination d_network_address_translation { file("/var/log/network-address-translation" flush_lines(10) flush_timeout(1000)); }; destination d_default { file("/var/log/default" flush_lines(10) flush_timeout(1000)); }; filter f_network_address_translation { host("hlgn-crtr-01-service") and priority(info) and facility(local2) and match("FWNAT"); }; log { source(s_sys); filter(f_network_address_translation); destination(d_network_address_translation); flags(final); }; log { source(s_sys); destination(d_default); }; Michael J. Bauer wrote: > That flags(final) is in fact part of the log{} line. The destination() > is also part of the log{} line, and appears on a line of its own because > of line wrap. The log{} line is, in one line (and hoping to avoid wrap): > > log { source(s_sys); filter(f_network_address_translation); > destination(d_network_address_translation); flags(final); }; > > The terminating }; is after flags(final);. Neither of the real > destination{} lines contain flags(final). > > MJB > > srainville(a)videotron.ca wrote: > >> The flags(final) goes at the end of the log statement, not the >> destination. >> >> Cheers, >> >> Steve >> ----- Message d'origine ----- >> De: "Michael J. Bauer" <mjbauer(a)eecs.tufts.edu> >> Date: Jeudi, 24 Septembre 2009, 23:00 >> Objet: [syslog-ng] flags(final) >> À: syslog-ng(a)lists.balabit.hu >> >> >>> I think I am misunderstanding what flags(final) is supposed to >>> do. I'm >>> running syslog-ng 2.1.4 on RHEL 5.4 (Tikanga). >>> >>> I have a fairly simple syslog-ng configuration, which I've >>> attached >>> below. I'm trying to pick off individual groups of log >>> entries and put >>> them in their own individual files. I want to ensure that >>> each gets >>> logged exactly once, so I'm using flags(final). I also >>> have a catch-all >>> at the end in case I've missed something, but the ultimate goal >>> is to >>> have that file present, but empty. >>> >>> However, with this configuration, the log entries that appear in >>> d_network_address_translation (/var/log/network-address- >>> translation) >>> also appear in d_default (/var/log/default) despite the presence >>> of >>> flags(final) on an earlier log() line. Should it work this >>> way? If so, >>> what can I do to get the desired behavior? >>> >>> Thanks, >>> MJB >>> >>> options { >>> sync (0); >>> time_reopen (10); >>> log_fifo_size (1000); >>> long_hostnames (off); >>> use_fqdn (no); >>> create_dirs (no); >>> keep_hostname (yes); >>> }; >>> >>> source s_sys { >>> file ("/proc/kmsg" >>> log_prefix("kernel: ")); >>> unix-stream ("/dev/log"); >>> internal(); >>> udp(ip(0.0.0.0) port(514)); >>> }; >>> >>> destination >>> d_network_address_translation { >>> file("/var/log/network-address-translation"); }; >>> destination >>> d_default { file("/var/log/default"); }; >>> >>> filter f_network_address_translation { host("router-service- >>> interface") and >>> priority(info) and >>> facility(local2) and >>> match("FWNAT"); }; >>> >>> log { source(s_sys); >>> filter(f_network_address_translation); >>> >>> destination(d_network_address_translation); flags(final); }; >>> log { source(s_sys); >>> destination(d_default); }; >>> >>> >>> >> ______________________________________________________________________________ >> >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation: >>> http://www.balabit.com/support/documentation/?product=syslog-ng >>> FAQ: http://www.campin.net/syslog-ng/faq.html >>> >>> >> ------------------------------------------------------------------------ >> >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.campin.net/syslog-ng/faq.html >> >> >> > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > >

2 1

syslon-ng temote logging
by Vasiliy G Tolstov 02 Nov '09

02 Nov '09

Hello. I have some trouble - all my mail logs send to local syslog-ng on server, that put it into file /var/log/maillog and send to remote logger by udp, then remote logging server dies, local syslog-ng buffers logs some time, after that - system has very big lavg. Is that possible to drops some logs if the destination server not available? -- Vasiliy G Tolstov <v.tolstov(a)selfip.ru> Selfip.Ru

2 1

Syslog-NG interpreting Cisco message 'count' number as $Program
by Patrick Smith 30 Oct '09

30 Oct '09

Hi all, wondering if anyone is familiar with this issue. Have several Cisco switches logging to a syslog-ng server. The syslog-ng server creates a new file for every message as it is interpreting the 'count' item added by the switch as the $program. My configs as follows to demonstrate what I mean: Syslog-ng.conf: destination d_all { file("/var/log/syslog-ng/$HOST/$PROGRAM-$YEAR-$MONTH-$DAY.log"); }; * This has always worked for me before and creates logs for each host with the program prefixed (e.g. snmp-date..., ssl_access_log-date...) But for Cisco switches it writes a new logfile for every message, with the Cisco message number (i.e. log count #) prepended. E.g., for a 6509 switch: -rw-r--r-- 1 syslog-ng wheel 165 Oct 21 11:51 1655156-2009-10-21.log -rw-r--r-- 1 syslog-ng wheel 168 Oct 21 11:51 1655157-2009-10-21.log -rw-r--r-- 1 syslog-ng wheel 147 Oct 21 11:51 1655158-2009-10-21.log -rw-r--r-- 1 syslog-ng wheel 150 Oct 21 11:51 1655159-2009-10-21.log -rw-r--r-- 1 syslog-ng wheel 154 Oct 21 11:52 1655160-2009-10-21.log * where 16551xx is the count of the log message on the switch And each of those files contains one log message, e.g. syslog-ng # cat 1655156-2009-10-21.log Oct 21 11:51:15 6509switch1 1655156: Oct 21 18:51:14.922: %LINK-5-CHANGED: Interface GigabitEthernet3/35, changed state to administratively down For reference the logging on the switches are set as: 6509s: service timestamps log datetime msec logging buffered 20000 debugging logging rate-limit 1000 log-adjacency-changes logging <syslog host IP> logging synchronous 2960s: service timestamps log uptime logging buffered 20000 logging <syslog host IP> logging synchronous I'm thinking I could have a separate destination statement to properly deal with these but I'm wondering if there's any other steps I can take to mitigate it. I have several Cisco firewalls logging to syslog-ng and they do not have the same issue. Thanks for any help. IMPORTANT NOTICE THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer. Learn more about Payment Processing's services at www.paypros.com.

3 10

MySQL Pipe for Syslog-NG not working
by Patrick Smith 29 Oct '09

29 Oct '09

Hi, I realize this is a syslog-ng users list but I know many of you are using/developing php-syslog-ng/logzilla as well so I thought I'd post the question here. I did a fresh install of syslog-ng on 3 servers, all running installed via rpm, but on one server the mysql pipe isn't working successfully. 2 servers are 64-bit RHEL4, syslog-ng-3.0.4-1.el4 (rpm), remote MySQL community server (mysql pipe works) 1 is 64-bit RHEL5, syslog-ng-3.0.4-1.el5 (rpm), local RedHat MySQL server (mysql pipe is not inserting messages) The pipe is taken direct from the php-syslog-ng wiki installation guide: destination d_mysql { program("/var/www/logzilla/scripts/db_insert.pl" template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t $HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n") ); }; destination d_localfiles { file("/var/log/syslog-ng/$HOST/$PROGRAM-$YEAR-$MONTH-$DAY.log"); }; log { source(s_remote); filter(f_allsystem); destination(d_mysql); }; log { source(s_remote); filter(f_allsystem); destination(d_localfiles); }; I have the same syslog-ng.conf file on all 3 hosts. Everything seems to be working normally, the logs just aren't making it into the RHEL5 mysql db. - Syslog messages are being received and written to local files. - Test access to mysql syslog DB as syslogadmin and sysloguser works fine. Correct passwds are in config file. - Test run of DBGen.pl works normally and the log messages are searchable in the logzilla UI. - No error messages in syslog-ng.log, mysqld.log, or logzilla logs. Any ideas as to how to further troubleshoot would be appreciated. IMPORTANT NOTICE THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer. Learn more about Payment Processing's services at www.paypros.com.

3 5

Solaris10 install Syslogng3.0.4 License clarification
by Zeek Anow 21 Oct '09

21 Oct '09

My goal is to install the server and client free version of syslog-ng.3.0.4 on Solaris 10 servers. I read the syslog-ng 3.0 Admin Guide (dated Aug 19, 2009) and the install instructions in the solaris10_install.txt file. My confusion is the constant reference to the Premium Edition for files and licensing. Do I have the wrong documentation or did I download the wrong product? I downloaded syslogng-3.0.4-sol10-sparc-local.gz package from SunFreeware. I filled out the request form on your website that is supposed to be reviewed and the license info returned to me. Again, this is for the Premium Edition. There wasn't anything mentioned about the free version. Hope I'm not confusing you, but I'm lost:)) Thanks!!

2 2

Fwd: Seg fault with include file contains an error
by anthony lineham 20 Oct '09

20 Oct '09

Hi, I sent this patch to the list last month, but haven't had any feedback yet. Does anyone have any comments (aside from my poor spelling and grammar)? Am I way off track with this fix or is it ok? Looking forward to your comments. best regards, Anthony >>> On 9/14/2009 at 4:50 PM, in message <4ADD7D39.7D71.00E6.0(a)alliedtelesis.co.nz>, anthony lineham wrote: > Hi Bazsi, > > I've been investigating a seg fault that occurs when using an include > statement in the config file. The error > occurs when one of the included files contains an syntax error. The first > time syslog-ng is restarted with the bad > config, the error is detected and restart is aborted. However, if a second > HUP is sent a seg fault occurs. > > I had a bit of trouble tracking down the cause and I'm still not entirely > sure of the mechanism that leads to the > crash but I found a couple of apparent problems, which when corrected > prevent it. > > 1. There is a global variable "include_depth" which normally gets > decremented back to zero after successful > parsing of included config files. However, if an error is detected it stays > at its current value and subsequent > restarts increment from that point. This doesn't cause the crash, but given > enough restarts would lead to > overrun or exhaustion of the "include_stack" array. > > 2. In the case of unsuccessful config parsing certain bits of memory are > dealloced but their pointers that not > reset. This seems to be what was causing the seg fault but I've found it a > bit hard to pin down. > > 3. There was an off-by-1 error in the included config deinit loop. > > The following patch fixes the problem, but may not necessarily be the best > way to do it - particularly issue 1. > > Regards, > Anthony > > --- syslog-ng_3.0.1-63-g41f77f5-old/src/cfg-lex.l 2009-09-14 > 16:02:09.000000000 +1200 > +++ syslog-ng_3.0.1-63-g41f77f5/src/cfg-lex.l 2009-09-14 > 16:15:30.000000000 +1200 > @@ -626,17 +626,24 @@ > { > gint i; > > - for (i = 0; i < include_depth; i++) > + for (i = 0; i <= include_depth; i++) > { > CfgIncludeLevel *level = &include_stack[i]; > > if (level->current_file) > - g_free(level->current_file); > + { > + g_free(level->current_file); > + level->current_file = NULL; > + } > > g_slist_foreach(level->files, (GFunc) g_free, NULL); > g_slist_free(level->files); > level->files = NULL; > if (level->yybuf) > - yy_delete_buffer(level->yybuf); > + { > + yy_delete_buffer(level->yybuf); > + level->yybuf = NULL; > + } > } > + include_depth = 0; > } >

2 2

Default SQL Server Informations / Global Constants?
by Jean F. Mousinho 20 Oct '09

20 Oct '09

Hello, Is there a way of defining a default hostname, username, password, etc for the sql destination? or I've to duplicate this information for every destination defined? If not, is there a way of defining some global constants and use them later? Thanks for your time. Jean F. mousinho

4 3