- syslog-ng - lists.balabit.hu

TEMPLATE TO ANOTHER SYSLOG
by blizzards＠libero.it 23 Jul '09

23 Jul '09

Hi all. I need to send all my logs to one server with syslog-ng installed. This server write a local file and redirecd to another syslog-ng installed to another server. But when i sent this logs to the second syslog i wolud like to apply a TEMPLATE to it, appending custom words. I can send with no problem my logs via udp to 2nd syslog, but when i apply template to it, the logs does not containm custom words. I readed that template with udp/tcp destination is this is not possible, but someone know a workaround or a way to do it? Thank You. Giulius.

1 0

Compiled 3.0.3 on CentOS 5.3 with spoof source - not working
by Scott Ware 22 Jul '09

22 Jul '09

So, I complied Syslog-ng with the --enable-spoof-source option, and everything installed fine. However, when I have the spoof_source(yes) option in the config file, nothing gets re-directed to my logging destination. If I take the option out, everything gets re-directed. Can you possible help me? Thanks!

2 5

Before the basic 101 questions
by lance raymond 22 Jul '09

22 Jul '09

ok, I have tried 2ce (even using this list) and still have problems that just get dropped by the wayside, so resorting to a more basic approach. So with that, I have 8 ubunutu servers all running apache and I wish/need to have a place for all the logs to reside. I tried syslog-ng with hand updating the conf files, even tried using webmin to build, still can't get it to start, etc. So how about feedback on this. If all the webservers share an nfs mount for the web images, what if I change the log's to just point to those mounts and write them there? I don't know if syslog-ng streams them, waits till x size then copies them over, but since I can't get it working, figured the users/group here might say sure, we've seen a few posts by you, and yea, just do that, or have some really basic ideas as to why, maybe a few sample config's as all the help etc. I have yet to see a working config (both server and client) to try to undserstand why there are problems. Thanks to all Lance SFU(syslog fustrated user)

5 11

problem configuring syslog-ng with TLS
by Mohsen Alimomeni 21 Jul '09

21 Jul '09

Hi everyone, I want to configure syslog-ng with TLS, but there are problems in client connecting to server. This is the error in client side: { Jul 16 17:04:10 momeni syslog-ng[31084]: syslog-ng starting up; version='3.0.3' Jul 16 17:04:10 momeni syslog-ng[31084]: Syslog connection established; fd='7', server='AF_INET(192.168.13.39:1999)', local='AF_INET(0.0.0.0:0)' Jul 16 17:04:10 momeni syslog-ng[31084]: Certificate validation failed; subject='emailAddress=momeni(a)amnafzar.com, CN=momeni, ..to the end! ', error='invalid CA certificate', depth='1' Jul 16 17:04:10 momeni syslog-ng[31084]: SSL error while writing stream; tls_error='SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed' Jul 16 17:04:10 momeni syslog-ng[31084]: I/O error occurred while writing; fd='7', error='Broken pipe (32)' Jul 16 17:04:10 momeni syslog-ng[31084]: Syslog connection broken; fd='7', server='AF_INET(192.168.13.39:1999)', time_reopen='60' } To make sure my certificates are valid I run two commands: On server: openssl s_server -CApath CA/ -CAfile CA/cacert.pem -cert Client/clientcert.pem -key Client/clientkeye em -accept 8080 On client: openssl s_client -connect 192.168.13.39:8080 The result on the client is the server certificate and the last line is: { Verify return code: 19 (self signed certificate in certificate chain) } The client and server are both syslog-ng_3.0.2 (and 3.0.3) in ubuntu. These are the steps I configured the client and server: I used the script CA.sh to genereate X.509 certificates. I created a cacert using the command: CA.sh -newca created the ca files :cacert.pem, .. created a request: CA.sh -newreq rename the files created to syslog_cert.pem and syslog_ket.pem signed it with the ca: CA.sh -sign Then I copied the cacert.pem file to client and created it's hash as explained in syslog-ng documentation. configuration files: Client config: *destination d_tlsserver { tcp("192.168.13.39" port(1999) tls(ca_dir("/opt/syslog-ng/certs") peer_verify(required-trusted) )); };* Server config: *source rezvani_tls { tcp(ip(0.0.0.0) port(1999) max-connections(300) tls(key_file("/opt/certs/newcerts/syslogs_key.pem") cert_file("/opt/certs/newcerts/syslogs_cert.pem") peer_verify(optional-untrusted) )); }; * -- __ \ /_\\_-//_ Mohsen Alimomeni

4 5

build problem on FreeBSD 7.2
by ko 18 Jul '09

18 Jul '09

Hi all, I'm trying to build v3.0.3 from source (with sql support) on a fresh install of FreBSD 7.2, and I have the following error when I lauch the make : "afsql.c:36:21: error: dbi/dbi.h: No such file or directory" I think I miss a library, something nedded for database support but I don't know what ? Could anymone help me ? Thanks a lot. Karl.

3 2

syslog-ng premium "$HOST" issue
by Arya, Manish Kumar 17 Jul '09

17 Jul '09

Hi, I am using syslog-ng opensource version 1.6.5 on central syslog server. which is receiving logs from 4 collectors and some individual hosts. To evaluate syslog-ng premium I got 30 day license of "syslog-ng-premium-edition 3.0.2a" and installed it on a new box. and forward events coming on central syslog server to this new box using a file template template("'$HOST'|'$FACILITY'|'$PRIORITY'|'$PROGRAM'|'$MONTH $DAY$ $YEAR $HOUR:$MIN:$SEC'|'$MSGONLY'\n")); but here in $HOST I am getting name of central syslog server instead of actual host. While in ver 1.6.5 it appears correct using same template on events coming from 4 collectors. is there version incompatibility or some bug in ver 3.0.2a Regards, -Manish

2 3

syslog-ng OSE 3.1 changes pushed
by Balazs Scheidler 17 Jul '09

17 Jul '09

Hi, I'm posting here to let you know that I've pushed the following patches to the 3.1 repository: a4d7533d9c826dcf405d94aa6644587feacf9e96 [patterndb] fixed parser node first char match handling 9e7a729f6b450c7ef5bf0b22943771f040fd110e [patterndb] Consider the value of the parameter when checking if two parser nodes are equal 73fe61c0dccd0453cb18d41e3bdca54a2525fba1 [patterndb] use strcmp instead of prefix match when looking up parser name 8c9e4099477866829b9de8dbdbcca97806856f00 [patterndb] added FLOAT radix parser ae1b7fd8f386c141056247264ccd06da78614136 On error r_insert_node displays more information about the node that caused the problem in logpatterns.c for rules, the rule_id is di 6be05a55fcfd55b4efa106e5c507ad3fad9cbdbc [patterndb] adapted db_parser configuration loader to new syntax with rulesets b0869709f98566d39b5b3d8bd793cdf12ccc1996 [patterndb] db_parser NUMBER parser now handles hexadecimal numbers in 0xXXXXX form 60dc446418bcb9e41436d5ab287f66a604172a6f [unit tests] white space cleanup 32e346803c04c8454ae7f9313ebf5f9fdac83553 [patterndb] added IPv6 and IPvANY parsers to db_parser a2b156f67a4cb7c5ee9438864c6d93870e668ac1 fixed a memory leak around parser match storing, check for parser node name length 53c07dc8bba32dab918d6ab782e0e1dfc6b210ff fixed a memory leak in db-parser() dynamic value handling 1c31f647245df4e6f8773d49c04ca32deb9d9bfc added testcase for real log radix parsing This contains a couple of patterndb bugfixes, some new parsers and the support for the v2 patterndb format. This code currently only supports v2, I'm going to publish a script that converts v1 to v2 automatically. Otherwise this also means that from now it is possible to use the syslog-ng Store Box patterns compiled by BalaBit directly from syslog-ng OSE: http://www.balabit.com/downloads/files/patterndb/1.0-20081117/patterndb/ If anyone asks, I'm willing to create an "alpha" release from the current state of affairs. The alpha sign only means that we still haven't reached all goals for 3.1 (as per the syslog-ng roadmap published on the website). I don't expect to have stability problems with the above changes, those are mostly trivial and have associated automatic testcases. -- Bazsi

1 0

db-parser
by Jacopo Cappelli 17 Jul '09

17 Jul '09

I can't understand how work db-parser, i want to parse a string: m-56767-1333854 79.127.28.54 <mfdesigner(a)diggitgraphics.com> MessageScore is now 30, after adding 30 (Suspicious HELO - contains IP: '[79.127.28.54]') I wanto to have m-56767-1333854 on $ID_MESSAGE and 79.127.28.54 <mfdesigner(a)diggitgraphics.com> MessageScore is now 30, after adding 30 (Suspicious HELO - contains IP: '[79.127.28.54]') on $MSG i try with: <patterndb> <ruleset name='assp'> <pattern>assp</pattern> <rules> <rule provider='balabit' id='1' class='system'> <patterns> <pattern>@QSTRING:id_message: @ @QSTRING:msg@</pattern> </patterns> </rule> </rules> </ruleset> </patterndb> But i have the field on db empty. I read link about db-parser usage but i can't resolve... Thanks, Jacopo -- Linux, Windows Xp ed MS-DOS (anche conosciuti come il Bello, il Brutto ed il Cattivo). -- Matt Welsh

4 9

Syslog-ng with --enable-spoof-source, does it work for anyone?
by Scott Ware 16 Jul '09

16 Jul '09

I have been trying to figure out why I can't seem to get this option to work? Everything complies ok, but in the syslog-ng.conf file, when I have the spoof_source(yes) option, my syslog messages don't get forwarded on to my destination. But if I remove the spoof_source(yes) option, then they do. I just want to know if anyone has had this option work for them before. Thanks!

1 0

Another beginners problem
by Andy Kannberg 16 Jul '09

16 Jul '09

Hi folks, I'm new to syslog-ng. I'm trying to get it running on a bunch of Ubuntu 8.04 LTS and OEL 5.3 systems. For a start, I'm trying to get it working on 2 Ubuntu 8.04 LTS boxes. What I want is that all logging of all systems is sent to a central loghost. Systems do not need to keep a local logfile. So, I've shamelesly copied over a (as said working) config from another thread a few days ago on this list. The client part works, at least, the reload goed ok. However, on the server, the reload fails, giving no kind of warning or message whatsoever to hint where the problem lies. The configuration is as follows (With thanks to Siem Korteweg, from whom I copied the config over). Client & server: source s_internal { internal(); }; destination d_syslogng_log { file("/var/log/syslog-ng.log"); }; source s_local { unix-dgram("/dev/log"); file("/proc/kmsg" program_override("kernel:")); }; destination d_remote { tcp("10.0.13.152" port(514) ) ; }; destination d_local { file("/var/log/messages"); }; log { source( s_internal ); destination( d_remote ); }; log { source( s_internal ); destination( d_syslogng_log ); }; log { source( s_local ); destination( d_remote ); }; log { source( s_local ); destination( d_local ); }; On the central loghost, adittional lines are added: source s_network { tcp (ip("10.0.13.152") port(514)); }; destination d_network { file("/var/log/syslog-ng/hosts/$HOST_FROM/$R_YEAR/$R_MONTH/$R_YEAR-$R_MONTH-$R_DAY" create_dirs(yes)); }; log { source( s_network ); destination( d_network ); }; But, as said, a reload fails. Can someone help me out a little ? Oh, I am running syslog-ng 3.03, installed from the .deb package available on the website of Balabit. cheers and thanks in advance. Andy

4 5