- syslog-ng - lists.balabit.hu

Must Restart syslog-ng to send email
by Reaky Rok 07 Jul '09

07 Jul '09

Dear friends I have a small problem with my syslog-ng server, I use a configuration to filter mail from log file and forwerd it to perl script to send it, the configuration like the following: ===================================================== source sme {file (/var/log/syslog-ng/servers/172.31.250.68/local7.log); }; destination maillog { program ("/usr/local/bin/syslog-mail-perl" ); }; log {source(sme); destination(maillog); }; ===================================================== And the perl script like the following: +++++++++++++++++++++++++++++++++++= #!/usr/bin/perl -n # thanks to Brian Dowling for an example with security in mind. $TO = 'reaky(a)domain.com'; $FROM = $TO; s/^//; open(MAIL, "|/usr/sbin/sendmail -t"); print MAIL "EOT"; To: $TO From: $FROM Subject: SME Log Alert: $_ $_ EOT close(MAIL); +++++++++++++++++++++++++++++++++++++++ It worked very fine when I send to root user in the machine, But when I tried to send to outside I found that I must restart syslog every time to send the mails to sendmail, In another word it buffer the emails tell I restart syslog-ng then It forwerd it to send mail and can see it in the mail log. Do you have any idea for that ? Thanks _________________________________________________________________ Windows Live™: Keep your life in sync. Check it out! http://windowslive.com/explore?ocid=TXT_TAGLM_WL_t1_allup_explore_012009

2 3

Send a specific log by email
by Reaky Rok 06 Jul '09

06 Jul '09

Hi friends I have syslog-ng installed in RHEL5 server, I make it as CEntral log for all servers in my network, Filtered by IP Now What I want to do is make it send to me an email for a specific log for one of my server, In other word when any log sent from this IP (192.168.1.1 ) For example to send me email with this new log value to myemail(a)mydomain.com The following is the part of configuration for my syslog-ng.conf that related with remote servers. ============================================= source s_remote { tcp(ip(0.0.0.0) port(514)); udp(ip(0.0.0.0) port(514)); }; destination d_separatedbyhosts { file("/var/log/syslog-ng/servers/$HOST/$FACILITY.log" owner("root") group("root") perm(0640) dir_perm(0750) create_dirs(yes)); }; log { source(s_remote); destination(d_separatedbyhosts); }; =============================================== Thanks Best Regards Reaky _________________________________________________________________ Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy! http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx…

4 15

Question about reopening sockets
by Zoltan HERPAI 06 Jul '09

06 Jul '09

Hi all, I'm writing a small script that would be fed with data via pipe by syslog-ng 2.0.9. The script itself is responsible for creating the socket into which syslog-ng would be writing to. I'm looking for an option within syslog-ng that would allow for reopening the socket in case the script dies, quits, or it gets removed for some reason (like an epic admin fail). I did some testing, and as per that, checking with lsof, syslog-ng opens the socket only on the first time it would be writing to that destination, which is good. After the socket gets removed, it shows up as... syslog-ng 31666 root 17u FIFO 253,2 24624 /tmp/pw.sock (deleted) ... in lsof, and the deleted flag does not go away after the socket gets recreated (f.e. the script is restarted), and a test message is sent into the given destination. Is there a config option available for reopening sockets? Thanks, Zoltan HERPAI

3 4

Unable to set PRIORITY and LEVEL in rewrite
by Siem Korteweg 06 Jul '09

06 Jul '09

Hi, with the central logging of syslog in place, I moved on to the file /var/log/httpd/ssl_error_log to explore the syslog-ng (3.0.2-1 OSE on CentOS 5.3) capabilities with logfiles from other applications. The contents of this file are rather straightforward: [Wed Jun 24 12:14:49 2009] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Wed Jun 24 12:14:49 2009] [error] [client 192.168.3.178] PHP Notice: Undefined offset: 2 I want to skip the date/time (assuming there is no delay before syslog-ng processes the data) and to set the PRIORITY and LEVEL attributes to "warning" and "err". The following config file (included in the main config) should do the job. source s_http_ssl_error { file ( "/var/log/httpd/ssl_error_log" flags(no-parse) follow_freq(1) ); }; # Split the message. parser p_http_ssl_error { csv-parser( columns( "HTTP.TIMESTAMP", "HTTP.SEVERITY", "HTTP.MSG" # Match the remainder of the message (greedy). ) delimiters( " " ) flags( greedy, escape-double-char, strip-whitespace ) quote-pairs( '""[]' ) ); }; filter f_http_ssl_error_warn{ match( "warn" value( "HTTP.SEVERITY" ) ); }; rewrite r_http_ssl_error_warn{ set( "warning" value( "LEVEL" ) ); set( "warning" value( "PRIORITY" ) ); }; filter f_http_ssl_error_error{ match( "error" value( "HTTP.SEVERITY" ) ); }; rewrite r_http_ssl_error_error{ set( "err" value( "LEVEL" ) ); set( "err" value( "PRIORITY" ) ); }; # Eliminate the severity as soon as PRIORITY and LEVEL are set! # Set the attribute program to "http_ssl_error". template t_http_ssl_error{ template( "http_ssl_error ${HTTP.SEVERITY} ${HTTP.MSG}\n" ); }; # Send the message to the regular syslog in order to transfer it to the syslog-ng collector. destination d_http_ssl_error{ unix-dgram( "/dev/log" template( t_http_ssl_error ) ); }; # Handle the warnings. log { source( s_http_ssl_error ); parser( p_http_ssl_error ); filter( f_http_ssl_error_warn ); rewrite( r_http_ssl_error_warn ); destination( d_http_ssl_error ); flags( final ); }; # Handle the errors. log { source( s_http_ssl_error ); parser( p_http_ssl_error ); filter( f_http_ssl_error_error ); rewrite( r_http_ssl_error_error ); destination( d_http_ssl_error ); flags( final ); }; # Handle the other messages. log { source( s_http_ssl_error ); parser( p_http_ssl_error ); destination( d_http_ssl_error ); }; Inserting [warn], [error] and [other] lines in the logfile, results in the proper number of syslog-ng messages with the desired MSG-contents. However, the priority and level attributes are unchanged ("notice"). What is wrong? kind regards, Siem Korteweg

2 5

Syslog-ng on Ubuntu and OEL
by Andy Kannberg 06 Jul '09

06 Jul '09

Hi, In our environment we are thinking of using syslog-ng for logging purposes. We use Ubuntu 8.04 and OEL 5.3 Ubuntu 8.04 has a version of syslog-ng in it's repository. However, that is version 2.09, which I cannot find on the site of Balabit, only version 2.010 OEL has no syslog-ng in it's default repo's. I would like to use one version, to prevent compatibility-issues and to keep the environment as clean as possible. I saw that there are binary packages available for Debian and RedHat. However, as said, I would like to keep the environment as clean as possible. So if possible, no individual package installed outside of the package manager. Does anyone know if there are repositories available where I can get a recent version of syslog-ng for Ubuntu as well as OEL ?? cheers, Andy

3 3

syslog-ng 3.0.3 has been released
by devel＠balabit.hu 03 Jul '09

03 Jul '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.3 SUMMARY : new stable release DATE : Jul 3, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.3) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.3 Thu, 25 Jun 2009 08:20:28 +0200 IMPORTANT CHANGES: * There was an unintended change in the meaning of command line argument -C (--chroot) and -R (--persist-file) between 2.x and 3.x versions of syslog-ng. This release reverts this change back to the original 2.x behaviour. This is a incompatible change compared against 3.0.2. Please review your startup scripts if you use either -C or -R. Bugfixes: * Fixed a compilation problem if IPv6 is disabled. * Fixed a crash problem if a log statement has a filter but no destinations. * The usertty() driver was changed to open the terminal device in nonblocking mode, as open on a serial device might block which cause the syslog-ng process to hang. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

Re: [syslog-ng] How to configure mail alerts
by ccie 6862 30 Jun '09

30 Jun '09

I had looked at this page several times, and I didn't realize the perl script on the page referenced by "Use this perl script to strip off the..." was the same as what was in the configuration file. It is working. Thank you very much. --- On Tue, 6/30/09, Siem Korteweg <Siem.Korteweg(a)qnh.nl> wrote: > From: Siem Korteweg <Siem.Korteweg(a)qnh.nl> > Subject: Re: [syslog-ng] How to configure mail alerts > To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> > Date: Tuesday, June 30, 2009, 12:37 AM > Have a look at: http://www.campin.net/newlogcheck.html > > regards, > > Siem Korteweg > > -----Oorspronkelijk bericht----- > Van: syslog-ng-bounces(a)lists.balabit.hu > namens ccie 6862 > Verzonden: ma 29-6-2009 22:25 > Aan: syslog-ng(a)lists.balabit.hu > Onderwerp: [syslog-ng] How to configure mail alerts > > > This is a pretty basic question, but I'm stumped as to what > to install to get > email alerts. The configuration is simple, but in the > sample configs I've run > across, I've seen something similar to the following: > > destination mail-alert-perl { > program("/usr/local/bin/syslog-mail-perl"); }; > > I've installed perl-Parse-Syslog-1.10-1.el4.rf.noarch.rpm > and > perl-Parse-Syslog-Mail-0.14-1.el4.rf.noarch.rpm, but > nothing remotely close > has been installed. Can someone please point me in the > right direction? > > Thanks > > > > _____________________________________________________________________________ > _ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > > > > -----Inline Attachment Follows----- > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > >

1 0

How to configure mail alerts
by ccie 6862 30 Jun '09

30 Jun '09

This is a pretty basic question, but I'm stumped as to what to install to get email alerts. The configuration is simple, but in the sample configs I've run across, I've seen something similar to the following: destination mail-alert-perl { program("/usr/local/bin/syslog-mail-perl"); }; I've installed perl-Parse-Syslog-1.10-1.el4.rf.noarch.rpm and perl-Parse-Syslog-Mail-0.14-1.el4.rf.noarch.rpm, but nothing remotely close has been installed. Can someone please point me in the right direction? Thanks

2 1

change msg text before db inserting
by Henk van Lingen 30 Jun '09

30 Jun '09

Hi, Is is possible to change the message text before it is inserted into a database? I have syslog-ng-3.0.2 running and it does insert the messages directly into a PostgreSQL database, using the new sql(type(pgsql) destination feature. The problem is I have lots of cisco firewall loggings, and in the database I have of gin index for doing full text searching. For this index, the database decomposes the message into tokens. I want to be able to search on IP-numbers. However, in lines like world/123.456.192.46(0) -> some-fwsm/123.456.221.121(0) this won't work because the tokens are world/123.456.192.46 and /123.456.192.46, not 123.456.192.46. To solve the prob it would be nice if there is a way to replace the slashes with spaces before the message goes to the database. Regards, -- Henk van Lingen, (o- -+ Netwerk & Telefonie, ICT Service Center /\ | Universiteit Utrecht, Jenalaan 18a, kamer 1.40 v_/_ http://henk.vanlingen.net/ http://www.tuxtown.net/netiquette/

3 2

Talk on syslog-ng a the 10th Libre Software Meeting
by ILLES, Marton 26 Jun '09

26 Jun '09

Hi, For those of you interested, I will be giving a talk at the 10th Libre Software Meeting at Nantes, France. The talk will be in English and I try to focus on syslog-ng 3.0 and the db-parser feature. http://2009.rmll.info/Syslog-ng-3-a-step-towards-log.html?lang=en If you gonna be there at the conference and want to meet to discuss something syslog-ng related stuff or anything else, just drop me line. cheers, Marton -- Key fingerprint = F78C 25CA 5F88 6FAF EA21 779D 3279 9F9E 1155 670D

1 0