- syslog-ng - lists.balabit.hu

program destination problem (again...)
by Alberto Sierra 18 Aug '09

18 Aug '09

hi there, i know this is been discussed like a million times already but i'm stuck and can't get around this. i'm using a program destination in my syslog-ng config, like this: destination test_log { file("/var/log/testlog"); }; destination sshd_alerts { program("/usr/local/bin/ssh_alert_by_email.sh" template("$DATE $HOST $PROGRAM $MSGONLY")); }; filter sshd { program("sshd"); }; filter login_accepted { match("Accepted password|Accepted publickey"); }; log { source(s_all); filter(sshd); filter(login_accepted); destination(sshd_alerts); destination(test_log); }; and the script as follows: #!/bin/bash while read line ; do echo $line >> /tmp/testlog done that's it, it logs to the destination(test_log) but the script does nothing. i followed a similar thread: https://lists.balabit.hu/pipermail/syslog-ng/2008-March/011512.html and the script works well interactively in the shell. I think i hit a dead end here... btw version 2.0.9 -- Alberto Sierra

5 6

Can't make Makefike of syslog-ng-3.0.4. OSE
by seki-norihiko＠mdis.co.jp 18 Aug '09

18 Aug '09

Hello everyone. I am user of syslog-ng. I wanna use syslog-ng instead of syslog on Red Hat Linux 5.2. CPU is Intel Xeon 64-bit architecture. I downloaded "eventlog_0.2.10.tar.gz" and "syslog-ng-3.0.4.tar.gz" Open Source Edition, from www.balabit.com. Thank you. I can make install eventlog_0.2.10. But I can't make Makefike of syslog-ng-3.0.4. I show error at below [root@hostname syslog-ng-3.0.4]# make make all-recursive ・・・ logmatcher.c: In function ‘log_matcher_pcre_re_compile’: logmatcher.c:534: error: ‘PCRE_NEWLINE_ANYCRLF’ undeclared (first use in this function) logmatcher.c:534: error: (Each undeclared identifier is reported only once logmatcher.c:534: error: for each function it appears in.) Would you please teach me what I should do to solve this error? I can't info about this error on the web. I need help. Thank you. Nori.

3 3

port 514 not used
by stephen.greenfield＠wachovia.com 15 Aug '09

15 Aug '09

I configure syslog-ng to use udp port 514, on the syslog server receiving log messages. When I issue a `netstat -lp | grep syslog` it shows different ports but never 514. Any ideas why? /steve

3 4

SOLVED: program destination problem (again...)
by Alberto Sierra 13 Aug '09

13 Aug '09

Ok, i finally found the problem, i don't know if it is only related to the "template" option within the program directive, but it must end with a newline character "\n" for the program to process every line. like this: program("/usr/local/bin/ssh_alert_by_email.sh" template("$DATE $HOST $PROGRAM $MSGONLY\n")); }; *note the \n after $MSGONLY for the curious, this is the script that i implemented to get a notification for every ssh successful login: #!/bin/bash recipient="alerts(a)example.com" processLog() { subject=$(echo $1 |awk '{print "Successful ssh login by " $9, "on " $4}') body=$(echo $1 |awk '{printf ("%s %s %s", "Date: " $1, $2, $3 "\\n" "Hostname: " $4 "\\n" "Username: " $9 "\\n" "Source host: " $11); }') /bin/echo -e $body | mail -e -s "$subject" $recipient } while read msg ; do processLog "$msg" done On Thu, Aug 13, 2009 at 9:44 AM, Alberto Sierra<albertosierra(a)aesetres.com> wrote: > 0 S root 20465 1 0 80 0 - 443 - 11:26 pts/0 > 00:00:00 /bin/sh -c /usr/local/bin/ssh_alert_by_email.sh > 0 S root 20466 20465 0 80 0 - 443 - 11:26 pts/0 > 00:00:00 /bin/bash /usr/local/bin/ssh_alert_by_email.sh > 5 S root 20468 1 0 80 0 - 572 - 11:26 ? > 00:00:00 /sbin/syslog-ng -p /var/run/syslog-ng.pid > > the PID is not changing, (unless the syslog-ng is restarted of > course), the debug.log shows the program runs until syslog-ng is > restarted as well. but it still sends nothing to the /tmp/testlog > file. > > > > On Thu, Aug 13, 2009 at 3:47 AM, Fegan, Joe<Joe.Fegan(a)hp.com> wrote: >> In "ps -elf" do you see your script? Does the pid stay the same as time advances, or does it change (which would mean it's exiting and being replaced with a new instance by syslog-ng automatically). You could add a start and end marker to see if it's starting at all and if/when it's exiting. Like: >> >> #!/bin/bash >> echo "$0 started `date`" >> /tmp/debug.log >> while read line ; do >> echo $line >> /tmp/testlog >> done >> echo "$0 exited `date`" >> /tmp/debug.log >> >> >> >> -----Original Message----- >> From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alberto Sierra >> Sent: 13 August 2009 07:26 >> To: syslog-ng(a)lists.balabit.hu >> Subject: [syslog-ng] program destination problem (again...) >> >> hi there, >> >> i know this is been discussed like a million times already but i'm >> stuck and can't get around this. >> >> i'm using a program destination in my syslog-ng config, like this: >> destination test_log { file("/var/log/testlog"); }; >> destination sshd_alerts { >> program("/usr/local/bin/ssh_alert_by_email.sh" template("$DATE $HOST >> $PROGRAM $MSGONLY")); }; >> >> filter sshd { program("sshd"); }; >> filter login_accepted { match("Accepted password|Accepted publickey"); }; >> >> >> log { >> source(s_all); >> filter(sshd); >> filter(login_accepted); >> destination(sshd_alerts); >> destination(test_log); >> }; >> >> and the script as follows: >> >> #!/bin/bash >> while read line ; do >> echo $line >> /tmp/testlog >> done >> >> that's it, it logs to the destination(test_log) but the script does nothing. >> >> i followed a similar thread: >> https://lists.balabit.hu/pipermail/syslog-ng/2008-March/011512.html >> >> and the script works well interactively in the shell. I think i hit a >> dead end here... btw version 2.0.9 >> >> -- >> Alberto Sierra >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.campin.net/syslog-ng/faq.html >> >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.campin.net/syslog-ng/faq.html >> >> > > > > -- > Alberto Sierra Reales [aesetres] > IT Consultant > Cel. 8319-1805 > -- Alberto Sierra Reales [aesetres] IT Consultant Cel. 8319-1805

1 0

syslog-ng and oracle
by Andreas Sartori 12 Aug '09

12 Aug '09

hello, we are currently setting up a new syslog server and switching from a sun fire v880 with syslog-ng and plain files to a new linux based (centos 5.3) syslog server with oracle as logging backend. we do not want to use pipes to write to the database, so we compiled libdbi-dbd-oracle with the oracle instantclient 10.2.0.4-1. syslog-ng is starting up fine (not complaining about the oracle backend), but we do have some problem with the inserts to the database. our trial syslog-ng configuration: destination d_sql_fwint { sql(type(oracle) username("xxx") password("xxx") database("dashb") table("SYSLOG_FWINT") columns("MSG_RCV_TIME varchar2(16)", "HOSTNAME varchar2(256)", "MESSAGE varchar2(2048)") values("$R_DATE", "$HOST", "$MSGONLY") }; when running in debug mode we get the following output: Running SQL query; query='INSERT INTO SYSLOG_FWINT (MSG_RCV_TIME, HOSTNAME, MESSAGE) VALUES (\'Aug 11 21:24:14\', \'gw20\', \'Built outbound TCP connection 144547326429398234 for LAN230:10.20.30.17/43825 (10.20.30.17/43825) to outside:10.10.10.102/80 (10.10.10.102/80)\')' this cant work sind oracle is not accepting \ as escape char, and in this case we do not need an escape at all. the sql syntax is right without the \. since templates are not working when using the sql driver, does anyone has an idea how to fix that? are we missing something? oracle setup is right, tnsnames or works and we can connect to the database with sqlplus. the syslog-ng init script as the environment variables set (ORACLE_HOME, LD_LIBRARY_PATH) thanks for any help -andy

2 5

syslog-ng exits when system time set backwards
by Kirill Stepanchuk 12 Aug '09

12 Aug '09

Hello, I've googled the mailing list, but could find any related threads. On FreeBSD, syslog-ng 1.6.8 exits when the system time is set to a value earlier than the previous value. Has anyone else encountered this before? Is there a fix or a configuration issue? $ ps auxwww | grep syslog-ng root 1040 0.0 0.1 1516 1208 ?? Ss 10:15AM 0:00.08 /usr/local/sbin/syslog-ng kstepanchuk 6529 0.0 0.0 1568 980 p0 R+ 10:38AM 0:00.00 grep syslog-ng $ sudo date 200501010000 Sat Jan 1 00:00:00 EST 2005 $ ps auxwww | grep syslog-ng mfeeney 6533 0.0 0.0 1612 996 p0 S+ 12:00AM 0:00.00 grep syslog-ng Thanks,

2 1

3.0.3: Accessing unix-dgram source appears to break all logging
by Markus Stalder 06 Aug '09

06 Aug '09

Hello list, my first post to the list, so hello everybody! :-) I'm on Ubuntu 8.04.2 amd64 and trying to upgrade from syslog-ng 2.0.9-1ubuntu1 to syslog-ng 3.0.3. I've both tried the on balabit.com provided amd64 .deb package and also created an own amd64 .deb with the default settings in /debian using dpkg buildpackage. I have the following two sources in my config: source s_all { internal(); unix-stream("/dev/log"); file("/proc/kmsg" program_override("kernel: ")); }; source src { internal(); unix-dgram("/dev/log"); file("/proc/kmsg" program_override("kernel: ")); }; Logging works just fine with the s_all source. However, as soon as I access the src source, by, for example destination temp_logfile { fifo("/tmp/.tivoli/.logfile."); }; log { source(src); destination(temp_logfile); }; all logging will cease. Meaning, other than Aug 5 15:04:23 server syslog-ng[17505]: syslog-ng starting up; version='3.0.3' I'm not getting *anything* in my logs after restarting syslog-ng. If I then comment destination temp_logfile ... again and restart syslog-ng, logging works again. The exact same config has worked just fine with 2.0.9-1ubuntu1. Any idea what could be wrong here? Thanks a lot! Best regards Markus

4 4

syslog-ng 3.0.4 has been released
by devel＠balabit.hu 05 Aug '09

05 Aug '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.4 SUMMARY : new stable release DATE : Aug 5, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.4) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.4 Wed, 05 Aug 2009 12:51:31 +0200 Bugfixes: * The use of the tcp6 destination caused aborts during startup, which has now been fixed. * The window size used for flow control could be decremented to a negative value in case multiple incoming connections overflowed the queue. This could cause an abort if a SIGHUP was received at this time. * Fixed a possible segmentation fault under Solaris if the syslog() driver was used without explicitly specifying a transport() option. * Fixed parse error handling when loading the patterndb. * Fixed the handling of door initialization failures on Solaris. Other changes: * Fixed performance degradation when using the host_override/program_override options. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

IPv6 destination host + port causes assertion failure in gsockaddr.h
by Alexei Aliaev 05 Aug '09

05 Aug '09

Hi, I am trying to solve an issue with syslog-ng 3.0.3 in IPv6 environment... I have a destination specified in my config file as such: destination collector { tcp6("fdab:228b:77af:6e7e:206:5bff:fef6:e2af" port(514)); }; When I run syslog-ng, I get this: file gsockaddr.h: line 86 (g_sockaddr_inet_get_sa): assertion failed: (g_sockaddr_inet_check(s)) Aborted I tracked down that this is caused by the destination definition above. The destination address is of the same box and port 514 is open and listening. If I remove the port, everything seems to start-up fine but it tries to connect to the specified IP to port 0 and I keep getting connection refused messages. Are there any known issues that could explain this? -- Alexey

2 7

Re: [syslog-ng] 3.0.3: Accessing unix-dgram source appears to break all logging
by Markus Stalder 05 Aug '09

05 Aug '09

> But who and what is reading the fifo /tmp/.tivoli/.logfile. in your > configuration? Opening a fifo for write will hang until someone else opens > it for read, that's how named pipes work... Thanks for your reply. As said before, the config worked just fine with 2.0.9. Also, the following config snippet will produce the exact same effect, ALL logging will stop, and there's no fifo involved at all: destination dings { udp("172.30.10.204" port(514) ); file("/var/monitoring/chk/logs/chk.log"); }; filter f_local5 { facility(local5); }; filter f_info { level(info); }; log { source(src); filter(f_local5); filter(f_info); destination(dings); }; So, it got to be about the source, since only this snippet and the previous one refer to the unix-dgram source "src". If I comment them, everything works fine, and I got a few dozen other log-entries in the config which refer to the unix-stream source "s_all". Again, *ALL* logging stops! Or, put differently: syslog-ng stops to log anything. It stops working. Thanks, Markus

1 0