- syslog-ng - lists.balabit.hu

Syslog-ng SRC IP filter doesn't appear to work
by Matty 20 Oct '09

20 Oct '09

Howdy, I am using syslog-ng 3.0.4, and am encountering a bizarre issue where a small percentage of messages don't match the following filter: filter f_hosts { (host("192.168.1.2") or host("192.168.1.3") or host("192.168.1.4")); }; log { source(network); filter(f_hosts); destination(d_messages); flags(final); }; log { source(network); destination(d_catchall); }; When the hosts 192.168.1.[2-4] send messages to our syslog-ng server, 99% of the time they are routed to the d_messages destination. But in a few rare cases, messages similar to the following don't match and are send to the d_catchall destination: Text data: Syslog message: KERN.INFO: Oct 19 14:54:55 \t<STK T10000B > Raw data: <6>Oct 19 14:54:55 <STK T10000B > I verified the SRC IP address for the message in question is correct, and I also ran syslog-ng with the -d -e and -F options to watch message processing. For some reason syslog-ng doesn't match against the filter listed above, which is quite bizarre. I also tried enabling the 'no-parse' flag, but that doesn't appear to help either. Has anyone experienced this issue? Any thoughts on how to debug this issue further? Thanks, - Ryan

2 1

TLS problem
by Carlo Balbo 20 Oct '09

20 Oct '09

Hi All, I have a problem from source tls... no logs are writing, no errors in logs file of syslog-ng . I hope that you have some ideas... :-) Follow the scenario : Server ----------------------------- syslog-ng log file : 2009-10-14T11:43:54+02:00 s_local@zpvm0306-1515 syslog-ng[14171]: Syslog connection accepted; fd='25', client='AF_INET(10.1.1.57:10865)', local='AF_INET(10.1.1.55:1999)' 2009-10-14T11:44:05+02:00 s_local@zpvm0306-1515 syslog-ng[14171]: Reaping unused destination files; template='/var/log/HOSTS/$HOST/encrypt-$PROGRAM-$YEAR-$MONTH.log' 2009-10-14T11:44:05+02:00 s_local@zpvm0306-1515 syslog-ng[14171]: Reaping unused destination files; template='/var/log/HOSTS/$HOST/$R_YEAR-$R_MONTH-$PROGRAM.log' syslog-ng.conf : source s_tcp_tls { tcp( ip(10.1.1.55) port(1999) tls( key_file("/opt/syslog-ng/etc/key.d/syslog-ng.key") cert_file("/opt/syslog-ng/etc/cert.d/syslo-ng.cert") peer_verify(optional-untrusted) ) ); }; destination zlog { file("/var/log/HOSTS/$HOST/$R_YEAR-$R_MONTH-$PROGRAM.log" template("$ISODATE\t[<$FACILITY.$PRIORITY>]\t$HOST\t$PROGRAM\t$MSGHDR $MSG\n") template_escape(no) ); }; log { source(s_tcp_tls); destination(zlog); }; -------------------------------------- Client ---------------------------- source s_local { unix-stream("/dev/log"); internal(); }; destination tls_syslog_destination { tcp("10.1.1.55" port(1999) tls( ca_dir("/opt/syslog-ng/etc/cert.d") ) ); }; log { source(s_local); destination(tls_syslog_destination); }; Oct 14 11:46:02 zpvm0306-1630 syslog-ng[30713]: Syslog connection established; fd='16', server='AF_INET(10.1.1.55:1999)', local='AF_INET( 0.0.0.0:0)' Oct 14 11:46:02 zpvm0306-1630 syslog-ng[30713]: Syslog connection broken; fd='16', server='AF_INET(10.1.1.55:1999)', time_reopen='60' Oct 14 11:46:02 zpvm0306-1630 syslog-ng[30713]: Closing log transport fd; fd='16' ------------------------------------- syslog-ng.key and syslog-ng.cert from syslog-ng.pem -----BEGIN RSA PRIVATE KEY----- MIICXAIBAAKBgQCmf/eIUSTa6jyPiqOfWnofHmVkYRHx+QG9Obml1g3oX6YQEecl UwpFtpaZQHNGbZoCiM3TNr8/rj92yT/i1X4HAuqVrnZ9ra4GD2SQ4/C06Xe5d2+L AlurTwVN9+4Zu73LpvCsfhJZgcros9A10Iq25TvYLu9pBchBLjnY1d2kewIDAQAB AoGAdCQhc8o+biIkenBX8Gl5dEmMqnd3wBVVHDyu/joRW32U5fLHDOce7EAQTviB MKh1XL027dVrlK0kgeSiFsWbcYKJdSLsY7J5osEPFAu9ZjaaXtE1hbQpAlZswLvE n12x6jbZSlVGBTfb6TsLWcgJ5QY2BAcntGZjz3ryffoE/BECQQDSIXBWX3OVuR6i +aFphzy5Hc+IUCsaPYQcSntnLLHa+W3W75sWMLTEjFZGXWQwtj8Ixk+4Ce650yLw B5CbnAYzAkEAythYir5ttKEPkixbGSrBntndJW8oNjXN6pR6ofklhGrV52oh7Y+A UW23lrvAyfAArArDiAcsxV+lYDRwQ5pQmQJADxAql2Z8SK1ejtxKP+Bb8AE9EU59 6IGkaMrGEd1YWpQq1Y+TlIGlU7mjraOgPQWzexOMP2sm29dQ19gS+7SxlQJAJwuD 55kGNvm1rJZbJroDMReQqO7/l4e9zkSsYlc58IY8DGJyi27O7V2oNByJ3JUVHAiq YJm49XkWtTEC1xByKQJBAKRiGABOrJwaOLOgMXreTykY7aX2uho+0gtOKewXoj42 3SwNLyW9rM0IK5lBKOyYyYZ6jn3bN9bYHE4jIjxiMfU= -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIDpzCCAxCgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBmjELMAkGA1UEBhMCSVQx DjAMBgNVBAgTBU1pbGFuMQ4wDAYDVQQHEwVNaWxhbjEUMBIGA1UEChMLWmVyb3Bp dSBTcEExHTAbBgNVBAsMFFJlc2VhcmNoJkRldmVsb3BtZW50MRMwEQYDVQQDEwp6 ZXJvcGl1Lml0MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QHplcm9waXUuaXQwHhcN MDkxMDExMTA1NTQwWhcNMTAxMDExMTA1NTQwWjCBmjELMAkGA1UEBhMCSVQxDjAM BgNVBAgTBU1pbGFuMQ4wDAYDVQQHEwVNaWxhbjEUMBIGA1UEChMLWmVyb3BpdSBT cEExHTAbBgNVBAsMFFJlc2VhcmNoJkRldmVsb3BtZW50MRMwEQYDVQQDEwp6ZXJv cGl1Lml0MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QHplcm9waXUuaXQwgZ8wDQYJ KoZIhvcNAQEBBQADgY0AMIGJAoGBAKZ/94hRJNrqPI+Ko59aeh8eZWRhEfH5Ab05 uaXWDehfphAR5yVTCkW2lplAc0ZtmgKIzdM2vz+uP3bJP+LVfgcC6pWudn2trgYP ZJDj8LTpd7l3b4sCW6tPBU337hm7vcum8Kx+ElmByuiz0DXQirblO9gu72kFyEEu OdjV3aR7AgMBAAGjgfowgfcwHQYDVR0OBBYEFGxV+r7bTgQw7qQFq+NOM2ZKswh/ MIHHBgNVHSMEgb8wgbyAFGxV+r7bTgQw7qQFq+NOM2ZKswh/oYGgpIGdMIGaMQsw CQYDVQQGEwJJVDEOMAwGA1UECBMFTWlsYW4xDjAMBgNVBAcTBU1pbGFuMRQwEgYD VQQKEwtaZXJvcGl1IFNwQTEdMBsGA1UECwwUUmVzZWFyY2gmRGV2ZWxvcG1lbnQx EzARBgNVBAMTCnplcm9waXUuaXQxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRAemVy b3BpdS5pdIIBADAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAEND4ifb Ntd7JJKVa6FDNS5ouLdfQq5sk+uwI9OyDuD2SUdfMuhpF2PZQFxSlI2esOcTwHro tx9FBiNeZkFElPZ82vPjgchGjcgIFfUYHwWH+8lfVXEsmOub0r9xBPZNZ5/mzEXQ 7mpgGYO3aSCzqOPpz0OFBF5cBrpYSzwenaYl -----END CERTIFICATE----- -- /* Carlo http://oblab.com */

2 1

Invalid frame header; header=''
by jnordwick 20 Oct '09

20 Oct '09

I can't seem to get syslog-ng to recongnize a syslog message. I used the example message you give in the docs, but all it says is "Invalid frame header". Here is the error message: Oct 13 14:35:55 logger-01 syslog-ng[29653]: Invalid frame header; header='' here is how I'm sending my test message: echo "<34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - ID47 - BOM'su root' failed for lonvick on /dev/pts/8" | nc logger-01 20514 Here is the config: options { flush_lines(1); }; source src { internal(); syslog(ip("192.168.27.198") port(20514) transport("tcp")); }; destination dest { file("/data/local/logs/sys.log" owner(xl) group (xl)); }; log { source(src); destination(dest); }; ------------------------------------------------------------------------------------------ This message is for the named person(s) use only. It may contain confidential proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. You must not, directly or indirectly use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. Allston Trading LLC and its subsidiaries and affiliates each reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity. ------------------------------------------------------------------------------------------

4 7

syslog-ng OSE in relay mode?
by Massimo Ianni 20 Oct '09

20 Oct '09

Hi, I'm a new syslog-ng user. I have a question about syslog-ng OSE: can an instance of this version be configuable in relay mode? Otherwise should I use syslog-ng PE? Best Regards. Massimo

2 1

Introduction to the syslog-ng developer team
by Balazs Scheidler 19 Oct '09

19 Oct '09

Dear syslog-ng users, Due to an internal reorganization in BalaBit, some additional developer time is being allocated to syslog-ng development. Until now I was the only visible figure on this mailing list, even though some other people were sometimes working on syslog-ng. I would like to change this, therefore please allow me to introduce the development team assigned to syslog-ng inside BalaBit (in abc order): András Tevesz (ghost(a)balabit.hu) András Miczki (micek(a)balabit.hu) Viktor Juhász (jviktor(a)balabit.hu) Zoltán Pallagi (pzolee(a)balabit.hu) Some of them has a long syslog-ng related history, but one of them is completely new to the project. I'm urging them to take part in the syslog-ng community, engage conversations on this mailing list or run a blog. However it is important to point out that some of you on this mailing list may have more syslog-ng related experience than what they currently do: they are primarily software engineers, not system administrators. So whenever they take part in a conversation, please bear this in mind, the opinions they have is not an official BalaBit opinion, they are just fellows whose job happens to include work on an Open Source project. -- Bazsi

1 0

Log all user commands
by Ian Masters 19 Oct '09

19 Oct '09

Hello I'd like to know if it's possible to log the commands of all users logged into a system using syslog-ng. I googled and looked through the man pages for syslon-ng and syslog-ng.conf but I didn't find anything useful. Thanks in advance for your help. Ian

3 2

trying to install syslog-ng 3.0.4 and drivers for oracle
by Ross, Michael W. 10 Oct '09

10 Oct '09

We are trying to get syslog-ng (OSE) 3.0.4 on Red Hat AS 4 to feed into an oracle DB using the sql() destination. We get syslog-ng to install and run A-OK and we think we have it configured right. What we are struggling with is what all we need to install in addition to syslog-ng. We have installed libdbi-0.8.3.1 and libdbi-devel-0.8.3.1. We have not been able to find the specific oracle driver, which we think we need. Do we need the specific oracle driver, if so where can we find it? Thanks... Mike

3 2

syslog-ng with sql() command, cpu to 100%
by Garry De Toffoli 10 Oct '09

10 Oct '09

I am using the version 3.04 of syslog-ng, as reported: $./syslog-ng -V syslog-ng 3.0.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#1b5d618e301ad94aa20e692ffba16469dece8d10 Compile-Date: Aug 5 2009 17:38:20 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: on Enable-Pcre: off I would like to use the sql() features; but syslog-ng does not write anything on dbase, and the cpu go to 100%; this is the configuration of the destination sql destination d_mysql { sql(type(mysql) host("localhost") username("syslogadmin") password("syslogadmin") database("syslog") table("logs") columns("host", "facility", "priority", "level", "tag", "datetime", "program", "msg", "seq") values("$HOST_FROM", "$FACILITY", "$PRIORITY", "$LEVEL", "$TAG", "$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC", "$PROGRAM", "$MSG", "$SEQNUM") indexes("host", "facility", "priority", "datetime", "program", "seq")); }; of course, the configuration like this destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; run OK, but I would like to use the sql() statement instead; what can I do? Is the sql() command supported by the syslog-ng 3.0.4? Thank you. _________________________________________________________________ Gossip, Sport, Notizie... Accendi la Messenger TV! http://www.messenger.it/messengerTV.aspx

3 2

Strange behaviour of syslog-ng. Date macros not working and missing character in file name.
by Nilshar 10 Oct '09

10 Oct '09

Thank you Bazsi ! could you point me to the reported bug, or any more informations about it ? I don't see it in changelog file, and can't find it in the bug tracking system. Thank you.

2 1

Re: [syslog-ng] Question about flags(ignore-case) option
by PAUL WILLIAMSON 10 Oct '09

10 Oct '09

>>> Balazs Scheidler <bazsi(a)balabit.hu> 10/10/09 8:37 AM >>> > > it should be: > > host("system" flags(ignore-case)); > > this is indeed a bug in the documentation. Excellent! That works perfectly! (of course!) -- Paul ************************************ This email may contain privileged and/or confidential information that is intended solely for the use of the addressee. If you are not the intended recipient or entity, you are strictly prohibited from disclosing, copying, distributing or using any of the information contained in the transmission. If you received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. This communication may contain nonpublic personal information about consumers subject to the restrictions of the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. You may not directly or indirectly reuse or disclose such information for any purpose other than to provide the services for which you are receiving the information. There are risks associated with the use of electronic transmission. The sender of this information does not control the method of transmittal or service providers and assumes no duty or obligation for the security, receipt, or third party interception of this transmission. ************************************

1 0