- syslog-ng - lists.balabit.hu

Syslog-ng on Ubuntu and OEL
by Andy Kannberg 06 Jul '09

06 Jul '09

Hi, In our environment we are thinking of using syslog-ng for logging purposes. We use Ubuntu 8.04 and OEL 5.3 Ubuntu 8.04 has a version of syslog-ng in it's repository. However, that is version 2.09, which I cannot find on the site of Balabit, only version 2.010 OEL has no syslog-ng in it's default repo's. I would like to use one version, to prevent compatibility-issues and to keep the environment as clean as possible. I saw that there are binary packages available for Debian and RedHat. However, as said, I would like to keep the environment as clean as possible. So if possible, no individual package installed outside of the package manager. Does anyone know if there are repositories available where I can get a recent version of syslog-ng for Ubuntu as well as OEL ?? cheers, Andy

3 3

syslog-ng 3.0.3 has been released
by devel＠balabit.hu 03 Jul '09

03 Jul '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.3 SUMMARY : new stable release DATE : Jul 3, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.3) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.3 Thu, 25 Jun 2009 08:20:28 +0200 IMPORTANT CHANGES: * There was an unintended change in the meaning of command line argument -C (--chroot) and -R (--persist-file) between 2.x and 3.x versions of syslog-ng. This release reverts this change back to the original 2.x behaviour. This is a incompatible change compared against 3.0.2. Please review your startup scripts if you use either -C or -R. Bugfixes: * Fixed a compilation problem if IPv6 is disabled. * Fixed a crash problem if a log statement has a filter but no destinations. * The usertty() driver was changed to open the terminal device in nonblocking mode, as open on a serial device might block which cause the syslog-ng process to hang. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

Re: [syslog-ng] How to configure mail alerts
by ccie 6862 30 Jun '09

30 Jun '09

I had looked at this page several times, and I didn't realize the perl script on the page referenced by "Use this perl script to strip off the..." was the same as what was in the configuration file. It is working. Thank you very much. --- On Tue, 6/30/09, Siem Korteweg <Siem.Korteweg(a)qnh.nl> wrote: > From: Siem Korteweg <Siem.Korteweg(a)qnh.nl> > Subject: Re: [syslog-ng] How to configure mail alerts > To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> > Date: Tuesday, June 30, 2009, 12:37 AM > Have a look at: http://www.campin.net/newlogcheck.html > > regards, > > Siem Korteweg > > -----Oorspronkelijk bericht----- > Van: syslog-ng-bounces(a)lists.balabit.hu > namens ccie 6862 > Verzonden: ma 29-6-2009 22:25 > Aan: syslog-ng(a)lists.balabit.hu > Onderwerp: [syslog-ng] How to configure mail alerts > > > This is a pretty basic question, but I'm stumped as to what > to install to get > email alerts. The configuration is simple, but in the > sample configs I've run > across, I've seen something similar to the following: > > destination mail-alert-perl { > program("/usr/local/bin/syslog-mail-perl"); }; > > I've installed perl-Parse-Syslog-1.10-1.el4.rf.noarch.rpm > and > perl-Parse-Syslog-Mail-0.14-1.el4.rf.noarch.rpm, but > nothing remotely close > has been installed. Can someone please point me in the > right direction? > > Thanks > > > > _____________________________________________________________________________ > _ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > > > > -----Inline Attachment Follows----- > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > >

1 0

How to configure mail alerts
by ccie 6862 30 Jun '09

30 Jun '09

This is a pretty basic question, but I'm stumped as to what to install to get email alerts. The configuration is simple, but in the sample configs I've run across, I've seen something similar to the following: destination mail-alert-perl { program("/usr/local/bin/syslog-mail-perl"); }; I've installed perl-Parse-Syslog-1.10-1.el4.rf.noarch.rpm and perl-Parse-Syslog-Mail-0.14-1.el4.rf.noarch.rpm, but nothing remotely close has been installed. Can someone please point me in the right direction? Thanks

2 1

change msg text before db inserting
by Henk van Lingen 30 Jun '09

30 Jun '09

Hi, Is is possible to change the message text before it is inserted into a database? I have syslog-ng-3.0.2 running and it does insert the messages directly into a PostgreSQL database, using the new sql(type(pgsql) destination feature. The problem is I have lots of cisco firewall loggings, and in the database I have of gin index for doing full text searching. For this index, the database decomposes the message into tokens. I want to be able to search on IP-numbers. However, in lines like world/123.456.192.46(0) -> some-fwsm/123.456.221.121(0) this won't work because the tokens are world/123.456.192.46 and /123.456.192.46, not 123.456.192.46. To solve the prob it would be nice if there is a way to replace the slashes with spaces before the message goes to the database. Regards, -- Henk van Lingen, (o- -+ Netwerk & Telefonie, ICT Service Center /\ | Universiteit Utrecht, Jenalaan 18a, kamer 1.40 v_/_ http://henk.vanlingen.net/ http://www.tuxtown.net/netiquette/

3 2

Talk on syslog-ng a the 10th Libre Software Meeting
by ILLES, Marton 26 Jun '09

26 Jun '09

Hi, For those of you interested, I will be giving a talk at the 10th Libre Software Meeting at Nantes, France. The talk will be in English and I try to focus on syslog-ng 3.0 and the db-parser feature. http://2009.rmll.info/Syslog-ng-3-a-step-towards-log.html?lang=en If you gonna be there at the conference and want to meet to discuss something syslog-ng related stuff or anything else, just drop me line. cheers, Marton -- Key fingerprint = F78C 25CA 5F88 6FAF EA21 779D 3279 9F9E 1155 670D

1 0

Inconsistent Command Line Arguments
by Leonid Chaichenets 24 Jun '09

24 Jun '09

Hello List, there seems to be a problem with the command line parameter list of syslog-ng (tested for ver. 3.0.2): from what I understand from the source code command line parameters are defined in gprocess.c (g_process_option_entries[]) and in main.c (syslogng_options[]). Only the latter are described by syslog-ng --help (but both of them are usable). Furthermore, the short version of '--chroot' should be '-C', according to the syslog-ng administration guide (The syslog-ng manual pages -> syslog-ng), but '-C' is defined in gprocess.c as "Set default capability set". According to gprocess.c the correct short version for '--chroot' would be '-R', but it collides and is overridden by the short version of the same name from main.c (there it means "persist-file"). IMHO this is a security relevant bug: one might think syslog-ng is running chrooted while it actually has root powers. PS: This also applies to the git-versions syslog-ng-3.0.git and syslog-ng-3.1.git. -- Best Regards, Leonid Chaichenets.

2 2

apache
by john.li＠fifasci.com.ph 24 Jun '09

24 Jun '09

Hello, How do i enable send apache logs on syslog-ng client? Im using centos5 the default location of logs are /var/log/httpd/access_log and /var/log/httpd/error_log? any ideas. tnx Here's my syslog-ng client configuration source log002 { unix-stream("/dev/log" max_connections(1000)); internal(); }; destination splunk {udp("x.x.x.x" port(514));}; log { source(log002); destination(splunk); };

3 3

Perl FIFO eating CPU
by Clayton Dukes 21 Jun '09

21 Jun '09

Hiya Folks! I know this isn't necessarily the purview of this group but I thought I'd ask anyways since there are so many smart people here :-) I have syslog-ng feeding to a pipe which my perl script reads from, does some filtering/deduplication of messages, and then inserts into a mysql db. For some reason, the perl script is running between 85-100% cpu at all times (mysql cpu is ok). I'm receiving roughly 1-2 messages per second on my test server, but plan to use this for a production box that will receive much more (around 50 mps) Is there some perl magic I can do to lower the cpu utilization? caching, etc? I'm happy to share my script, but a large portion of it depends on variables set from within my program (php-syslog-ng) so it won't run on outside systems (unless, of course, you install my software :-)) Thanks! -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

2 1

Time slice destination files
by Martin Holste 20 Jun '09

20 Jun '09

The indexing system I'm writing will work best if it can read in syslog-ng logs as regular files (as opposed to fifos, sockets or SQL). In order to have multiple indexing workers going at the same time, I'm finding it easiest if the output from syslog-ng can be divided into chunks like this: destination d_file { file("/tmp/slices/$R_UNIXTIME.${.classifier.rule_id}" template(t_db_parsed)); }; The workers index the chunks as syslog-ng spits them into the slices buffer directory. This works pretty well, but I'm limited to tuning only between one second intervals provided by $R_UNIXTIME, or minute, hour, etc. intervals by concatenating other time macros together. Is there some way I could get syslog-ng to spit out something lke 5 second slices? Also, will syslog-ng know to close the file handle on a log slice when the $R_UNIXTIME second has elapsed? Thanks, Martin

2 3