- syslog-ng - lists.balabit.hu

[Fwd: Re: iptables logging in a separate logfile works not properly]
by Ralf Heidenreich 14 Jul '09

14 Jul '09

Hello, if I use the final flag, postfix loggs to /var/log/messages, not to /var/log/maillog. What I am doing wrong? regards ralf Here my config: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; destination iptables { file("/var/log/firewall.log"); }; filter iptables { match("INPUT:"); }; log { source(s_sys); filter(iptables); destination(iptables);flags(final); }; #log { source(s_sys); filter(iptables); destination(iptables); }; filter noiptables { not match("INPUT:"); }; log { source(s_sys); filter(noiptables); destination(d_kern); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/messages"); }; destination d_mlal { usertty("*"); }; # direct iptables logs into /var/log/firewall.log filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; #log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; Ralf Heidenreich schrieb: > Hello, > > can you give me an example, how to use the final flag? > thanks in advance. > > regards > Ralf > > Szalay Attila schrieb: >> Hi, >> >> On Fri, 2009-05-29 at 14:15 +0200, Ralf Heidenreich wrote: >>> Hello, >>> >>> I have the following line in iptables: >>> iptables -A INPUT -j LOG --log-prefix "INPUT: " >>> In syslog-ng (/etc/syslog-ng/syslog-ng.conf) I have the following config: >> [...] >>> filter iptables { match("INPUT:"); }; >>> log { source(s_sys); filter(iptables); destination(iptables); }; >> [...] >>> filter f_default { level(info..emerg) and >>> not (facility(mail) >>> or facility(authpriv) >>> or facility(cron)); }; >> [...] >>> log { source(s_sys); filter(f_default); destination(d_mesg); }; >> syslog-ng do not stop the evaluation when a destination is found. And >> because of this and because the second log statement is matching to the >> line the syslog-ng store it to the message too. >> >> If you want to order the syslog-ng to stop you can use the final >> directive. >> >> >> >> ------------------------------------------------------------------------ >> >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.campin.net/syslog-ng/faq.html >> > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

1 1

Missing hosts
by Christopher Bland 14 Jul '09

14 Jul '09

Hi guys, I have a problem that needs guru magic. When I first setup syslog-ng I had too many host/log entries for the system I was using to handle. I had tens of thousands of entries and each day created a 10G database table. I remedied this logging certain hosts to flat files and separating host and network equipment into different databases. I left my original catch all DB in place for comparison, to verify that all hosts were being logged properly. When I do queries I find that a number of hosts are in the catch all but not in the individual databases. Many of the missing hosts should be caught by the netmask entries but aren't. options { sync (0); time_reopen (10); log_fifo_size (10000); time_sleep(50); log_fetch_limit(100); chain_hostnames(no); long_hostnames (off); keep_hostname(no); use_dns (yes); dns_cache(yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; source s_everything { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(); }; destination d_database { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; destination d_networkdb { pipe("/tmp/mysql-network.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; destination d_hostsdb { pipe("/tmp/mysql-hosts.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; filter f_nofw { not host("fwhost"); }; filter f_hosts { netmask("10.16.5.0/255.255.255.0") or netmask("10.16.6.0/255.255.255.0") or host("hostA") or host("hostB") or host("hostC"); }; filter f_network { not host("fwhost") and ( host("host1") or host("host2") or host("host3") or netmask("10.16.57.0/255.255.255.0") or netmask("10.16.36.0/255.255.255.0") or netmask("10.16.120.0/255.255.255.0") or netmask("10.16.217.0/255.255.255.0") ); }; log { source(s_everything); filter(f_hosts); destination(d_hostsdb); }; log { source(s_everything); filter(f_network); destination(d_networkdb); }; log { source(s_everything); filter(f_nofw); destination(d_database); };

2 3

What is syslog-ng control socket?
by Subodh Nijsure 13 Jul '09

13 Jul '09

When I start syslog-ng I always get following error in the log. Jun 17 10:34:22 Node1 syslog-ng[836]: syslog-ng starting up; version='3.0.2' Jun 17 10:34:22 Node1 syslog-ng[836]: Error opening control socket, bind() faile d; socket='/home/subodh/install/syslog-ng/install//var/syslog-ng.ctl', error='N o such file or directory (2)' What is the control socket in syslog-ng? Should I be worried about this,what functionality do I loose 'cause syslog-ng is not able to create control socket? I am running version 3.0.2 on PowerPC 85xxx platform. Below is the output of syslog-ng -v syslog-ng 3.0.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#e1c8e7f086f5c5b73727cfef6d351614d87574ed Compile-Date: Jun 16 2009 16:54:10 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: off Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on /Subodh Nijsure

3 2

SEC and syslog-ng - stop the SEC process
by Clayton Dukes 12 Jul '09

12 Jul '09

Hi, Not sure if I should ask this here or in the SEC forum... Does anyone know how to stop an sec process that's called from syslog-ng? i.e: when I issue an /etc/init.d/syslog-ng stop I still have the following running: root 28202 1 1 12:34 pts/1 00:00:00 /usr/bin/perl -w ... root 28207 28202 0 12:34 pts/1 00:00:00 sh -c /usr/bin/tail -F /tmp/sec.log ... root 28208 28207 0 12:34 pts/1 00:00:00 /usr/bin/tail -F /tmp/sec.log root 28209 28202 0 12:34 pts/1 00:00:00 sh -c /usr/bin/tail -F /tmp/sec_reactive.log... root 28210 28209 0 12:34 pts/1 00:00:00 /usr/bin/tail -F... Here's my syslog-ng config: destination d_sec { program("/www/svn/php-syslog-ng/scripts/sec/sec.pl -input=\"-\" -conf=/www/svn/php-syslog-ng/scripts/sec/001_proactive.conf -conf=/www/svn/php-syslog-ng/scripts/sec/002_reactive.conf -log=/var/log/php-syslog-ng/sec_run.log -intevents" template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n") ); }; # Tell syslog-ng to log to our new destination log { source(s_all); destination(d_sec); }; -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

2 3

Perl: Sys::Syslog - replace hostname (host rewrite rule?)
by Clayton Dukes 12 Jul '09

12 Jul '09

Hi folks, I'm trying to write a syslog "replay" script (in perl) and was wondering if there's a way to replace the source hostname so that it logs that host to syslog instead of my local machine's hostname. For example, the logit sub below logs (to /var/log/syslog): Jul 12 12:53:53 cdukes-lnx ./logreplay.pl[29476]: %CSM_SLB-6-RSERVERSTATE: Module 9 server state changed: SLB-NETMGT: TCP health probe re-activated server 10.13.164.13:0 in serverfarm 'ACC-FNET-AE' The original message is: Jun 19 05:11:57 ecdcsrvr2-6.some.domain 5476: Jun 19 05:11:56: %CSM_SLB-6-RSERVERSTATE: Module 9 server state changed: SLB-NETMGT: TCP health probe re-activated server 10.13.164.13:0 in serverfarm 'ACC-FNET-AE' So I want it to log the originating host as "ecdcsrvr2-6.some.domain" Additionally, if possible, I'd like to be able to log the original datetime field (but not as important as the hostname). Does anyone know if I could maybe accomplish this through a syslog-ng rule? sub logit { my ($priority, $message) = @_; setlogsock('unix'); # $prog is assumed to be a global. Also log the PID # and to Console if there's a problem. Use facility 'local7' since these are (presumably) Cisco messages. openlog($0, 'pid,cons', 'local7'); syslog($priority, $message); closelog(); return 1; } -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

1 0

syslog-ng-3.0.3 for x86_64?
by John Patrick Carroll 11 Jul '09

11 Jul '09

My question involves the availability of a x86_64 version of syslog-ng 3.0.3 for Red Hat/CentOS. According to the info on the first link below, it is available, but at the actual download site at the second link below, only a version for amd64 is available. Any ideas where I can get a version for Intel (x86_64)? I have had issues in the past with running amd64 binaries on an Intel 64-bit system, so I am reluctant to try to install the amd64 version on an Intel 64-bit system. Is the x86 version there 64 bit capable, i.e. does it use the 64-bit libraries by default, and fall back to 32-bit libraries only if 64-bit libraries are not available? http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… thanks, John John Patrick Carroll | Senior Systems Administrator GovDelivery, Inc. 408 St. Peter St, Ste 600 | St Paul, MN 55102-1147 651.757.4124 or 866.276.5583 ext. 124 Resources Website: www.govdelivery.com<http://www.govdelivery.com> Blog: www.reachthepublic.com<http://www.reachthepublic.com> Twitter: www.twitter.com/govdelivery<http://www.twitter.com/govdelivery>

2 1

Syslog-ng beginners guide
by Cosmin Neagu 10 Jul '09

10 Jul '09

Hello everybody, Sorry for bothering you with a beginners question. I have a cacti implementation in my network and a want to integrate it with syslog-ng. I have mostly cisco routers, all configured to sent syslog messages to two linux boxes (Ubuntu 9.04 and FedoraCore 10) where i have installed syslog-ng. I'm not able to find where the logs are kept, so this drives me crazy. Do you know any site or resource where i can find some beginners guide about using syslog-ng with cisco routers? I mean, a guide for someone who never used syslog-ng before. Thanks. -- Cosmin Neagu NOC Team Leader Str. I. G. Duca nr 36 Otopeni, Judetul Ilfov, 075100 Romania Tel: 021 303 3159 / 0732 669 193 www.omnilogic.ro

8 20

can't include externel file into syslog-ng.conf
by gatfi sami 08 Jul '09

08 Jul '09

Hi i am using syslog-ng 2.0.9-27.22 when i try to include an externel file into /etc/syslog-ng/syslog-conf options { long_hostnames(off); sync(0); perm(0640); stats(3600); #check_hostname(no); keep_hostname(yes); chain_hostnames(no); }; # # 'src' is our main source definition. you can add # more sources driver definitions to it, or define # your own sources, i.e.: # #source my_src { .... }; # source src { # # include internal syslog-ng messages # note: the internal() soure is required! # internal(); # # the default log socket for local logging: # unix-dgram("/dev/log"); }; *include "/opt/topnet/etc/client.conf";* ligne 52 But unfortunatly i have an error tarting syslog servicessyntax error at 52 > startproc: exit status of parent of /sbin/syslog-ng: 1 So how can i include an externel file into syslog-ng.conf ? need help around here gys i cant avoid including the file thks

2 1

about mysql log
by Jacopo Cappelli 08 Jul '09

08 Jul '09

Hi, it's possible to personalize mysql logging? actually i have $HOST,$FACILITY,$PRIORITY,$LEVEL,$TAG,$YEAR-$MONT-$DAY, $HOUR:$MIN:$SEC; $PROGRAM,$MSG i want to decompose $MGS in sub-level field because in $MSG i have a email-id and i use it to make web research. Thanks, Jacopo -- Linux, Windows Xp ed MS-DOS (anche conosciuti come il Bello, il Brutto ed il Cattivo). -- Matt Welsh

2 5

Forwarded messages modified by syslog-ng
by srainville＠videotron.ca 08 Jul '09

08 Jul '09

2 1