- syslog-ng - lists.balabit.hu

Stripping the original hostname /ip from the syslog message
by Shashank Vinchurkar 12 Jun '09

12 Jun '09

Hi, We have a setup where multiple syslog-ng servers send logs to a central syslog-ng server. Finally this central syslog-ng server sends the consolidated logs to an outside server. The outside server can be any server accepting standard syslog messages. The first group of servers are running in the internal network and don't have any hostname associated with them. Also the ip address is internal and does not make sense to outside world. My requirement is that the outside server should only see the ip address of the syslog-ng server which consolidates the messages from these syslog-ng servers. But I always see the ip address of the syslog-ng server which originated the message. Is there anyway to get rid of this? I tried playing with the keep_hostname, long_hostname, chain_hostname and bad_hostname options but I still see the ip address of the originating server. Thanks in advance for the help. -Shashank

3 5

Backslash before quote
by Pennington, Philip 11 Jun '09

11 Jun '09

Syslog-ng version 2. Can anyone please explain the purpose of the backslash being added before each quote in syslog output ? Is there any way to disable this feature ? Is this flags(noparse) ? Is there any other way to do it (other than stripping it out on an output process)? Regards Philip =============================================================================== Please access the attached hyperlink for an important electronic communications disclaimer: http://www.credit-suisse.com/legal/en/disclaimer_email_ib.html ===============================================================================

3 4

I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\'
by Clayton Dukes 08 Jun '09

08 Jun '09

Hi Folks, I am the owner of php-syslog-ng... While working on one of my servers, I notice the following error getting repeated (a lot): syslog-ng[23692]: I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\' I've done multiple searches but haven't been able to nail down why this error is constantly getting logged into my pipe. I've found google results where Baszi asked the user to try using strace and/or lsof, but I can't gleen anything useful from it (maybe I'm just too dumb :-)) Any help would be greatly appreciated :-) Here's my syslog-ng config: options { long_hostnames(off); # doesn't actually help on Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(1); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(16384); # Hosts we don't want syslog from #bad_hostname("^(ctld.|cmd|tmd|last)$"); bad_hostname("^11.16.254.134$"); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); #Use DNS so that our good names are used, not hostnames use_dns(yes); dns_cache(yes); #Use the whole DNS name use_fqdn(yes); keep_hostname(yes); chain_hostnames(no); #Read permission for everyone perm(0644); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; destination d_syslogdb { pipe("/var/log/mysql.pipe", template ("'$HOST''$FACILITY''$PRIORITY''$LEVEL''$TAG''$YEAR-$MONTH-$DAY''$HOUR:$MIN:$SEC''$PROGRAM''$MSG'\n") template_escape(yes) ); }; log { source(s_all); destination(d_syslogdb); }; -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

4 12

Syslog-3.0.2 build failure on OS X
by Mark Duling 08 Jun '09

08 Jun '09

Hello, Syslog-ng 2.1.4 compiles fine on OS X, but 3.0.2 does not. Below is the error I get. Any idea what the problem might be? Thanks. Mark syslog-ng Open Source Edition 3.0.2 configured Compiler options: compiler : /usr/bin/gcc-4.0 compiler options : -O2 -Wall -I/opt/local/include -I/opt/local/include/glib-2.0 -I/opt/local/lib/glib-2.0/include -I/opt/local/include -I/opt/local/include/eventlog -I/opt/local/include -DHAVE_SOCKADDR_SA_LEN -DLIBNET_BSDISH_OS -DLIBNET_BSD_BYTE_SWAP -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -L/opt/local/lib prefix : /opt/local linking mode : dynamic Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : yes tcp-wrapper support : yes SSL support : yes SQL support : no Linux capability support : no PCRE support : no Env wrapper support : no ---> Building syslog-ng ........ rm -f libsyslog-ng.a ar cru libsyslog-ng.a misc.o utils.o messages.o syslog-names.o cfg.o filter.o logmsg.o logstamp.o logpipe.o logsource.o driver.o sgroup.o dgroup.o center.o templates.o logreader.o logwriter.o affile.o afstreams.o afuser.o afprog.o afsocket.o afunix.o afinet.o afinter.o children.o stats.o gsockaddr.o gsocket.o logtransport.o logproto.o memtrace.o dnscache.o serialize.o apphook.o radix.o logpatterns.o cfg-lex.o cfg-grammar.o timeutils.o alarms.o logparser.o logprocess.o logmpx.o logrewrite.o logmatcher.o gprocess.o globals.o control.o compat.o logqueue.o afsql.o tlscontext.o tlstransport.o ranlib: file: libsyslog-ng.a(afstreams.o) has no symbols ranlib: file: libsyslog-ng.a(compat.o) has no symbols ranlib: file: libsyslog-ng.a(afsql.o) has no symbols ranlib libsyslog-ng.a ranlib: file: libsyslog-ng.a(afstreams.o) has no symbols ranlib: file: libsyslog-ng.a(compat.o) has no symbols ranlib: file: libsyslog-ng.a(afsql.o) has no symbols if /usr/bin/gcc-4.0 -DHAVE_CONFIG_H -I. -I. -I.. -I/opt/local/include -I/opt/local/include/glib-2.0 -I/opt/local/lib/glib-2.0/include -I/opt/local/include -I/opt/local/include/eventlog -I/opt/local/include -DHAVE_SOCKADDR_SA_LEN -DLIBNET_BSDISH_OS -DLIBNET_BSD_BYTE_SWAP -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -Wall -MT main.o -MD -MP -MF ".deps/main.Tpo" -c -o main.o main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; else rm -f ".deps/main.Tpo"; exit 1; fi /usr/bin/gcc-4.0 -O2 -Wall -L/opt/local/lib -o syslog-ng main.o libsyslog-ng.a -lfl -L/opt/local/lib -lglib-2.0 -lintl -liconv -L/opt/local/lib -levtlog -L/opt/local/lib -lssl -lcrypto -lz -lz -lnet -lwrap -lresolv Undefined symbols: "_configuration", referenced from: _configuration$non_lazy_ptr in libsyslog-ng.a(stats.o) _configuration$non_lazy_ptr in libsyslog-ng.a(cfg.o) _configuration$non_lazy_ptr in libsyslog-ng.a(templates.o) _configuration$non_lazy_ptr in libsyslog-ng.a(cfg-lex.o) _configuration$non_lazy_ptr in libsyslog-ng.a(cfg-grammar.o) _configuration$non_lazy_ptr in libsyslog-ng.a(affile.o) _configuration$non_lazy_ptr in libsyslog-ng.a(logmatcher.o) _configuration$non_lazy_ptr in libsyslog-ng.a(logreader.o) ld: symbol(s) not found collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2

2 1

Critical hang while opening tty
by Jean-Baptiste Quenot 07 Jun '09

07 Jun '09

Hi there, I'm using syslog-ng 2.0.9-4.1 on Ubuntu 9.04. In the configuration file, emergency messages are configured to be logged to all ttys. Sometimes syslog-ng blocks the whole system while opening /dev/ttyS0: # pgrep -f syslog-ng # strace -f -p 3172 Process 3172 attached - interrupt to quit open("/dev/ttyS0", O_WRONLY|O_NOCTTY|O_APPEND I'm surprised because I saw the same bug report, and this was supposed to be fixed in Ubuntu's 2.0.9-1 version as stated in the changelog at See http://changelogs.ubuntu.com/changelogs/pool/universe/s/syslog-ng/syslog-ng… The changelog says: syslog-ng (2.0.9-1) unstable; urgency=low * New upstream version. (Closes: #397650, #447105) This corresponds to this bug: syslog-ng hangs writing to /dev/ttyN http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=397650 I notice the bug is fixed in syslog-ng: http://git.balabit.hu/?p=bazsi/syslog-ng-2.0.git;a=commit;h=c5cc92d54d2e33b… Is there maybe another call to tty open() that was not covered by alarm()? The issue happens on several machines, but I don't know what triggers this. Reloading syslog-ng fixes the problem. Thanks in advance, -- Jean-Baptiste Quenot http://jbq.caraldi.com/

2 2

TLS - Mutual authentication issue
by Hahusseau, Thomas 07 Jun '09

07 Jun '09

Hi, I'm using syslog-ng OSE with encrypted message transport thanks to TLS for few week. Now I try to activate the mutual authentication option. I have several issues with the TLS mutual authentication logs error : Jun 4 16:01:31 desktop syslog-ng[26644]: SSL error while reading stream; tls_error='SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca' Jun 4 16:01:31 desktop syslog-ng[26644]: I/O error occurred while reading; fd='14', error='Connection reset by peer (104)' Jun 4 16:01:31 desktop syslog-ng[26644]: Syslog connection closed; fd='14', client='AF_INET(10.254.1.172:43751)', local='AF_INET( <http://0.0.0.0:9999> 0.0.0.0:9999) This is samples of config file: Server : source s_net_tls { tcp(port(9999) tls(key_file("/etc/pfc/credentials/Server/server.key") cert_file("/etc/pfc/credentials/Server/server.pem") ca_dir("/etc/pfc/credentials/CA/") # peer_verify(optional-untrusted) peer_verify(required-trusted) ) ); }; Client : destination d_remote_server_tls { tcp("10.254.1.141" port(9999) tls(ca_dir("/etc/pfc/credentials/CA") key_file("/etc/pfc/credentials/Client/client.key") cert_file("/etc/pfc/credentials/Client/client.pem") peer_verify(required-trusted) # peer_verify(optional-untrusted) )); }; here is how I generated my CA certificate, server and client certificate : openssl genrsa 1024 > CA/ca.key openssl req -new -x509 -days 365 -key CA/ca.key -out CA/ca.cert cat CA/ca.cert CA/ca.key > CA/ca.pem openssl genrsa 1024 > Client/client.key openssl req -new -key Client/client.key -out Client/client.csr openssl x509 -req -days 365 -in Client/client.csr -CA CA/ca.cert -CAkey CA/ca.key -set_serial 01 -out Client/client.cert cat Client/client.cert Client/client.key > Client/client.pem openssl genrsa 1024 > Server/server.key openssl req -new -key Server/server.key -out Server/server.csr openssl x509 -req -days 365 -in Server/server.csr -CA CA/ca.cert -CAkey CA/ca.key -set_serial 01 -out Server/server.cert cat Server/server.cert Server/server.key > Server/server.pem Of course I done the link with Openssl x509 -noout -hash -in ca.pem Ln -s ca.pem XXXX If anyone can help me, or give a step by step procedure that works. I also tried the procedure described in the "Syslog-nd admin guide" it doesn't work too. Regards Thomas ------------------- Thomas Hahusseau Apprenti ingénieur EADS - DS / ENST Bretagne

2 1

udp drops
by Jan Schaumann 06 Jun '09

06 Jun '09

Hello, I have a FreeBSD 6.2 (amd64) host where I'd like to replace the stock syslogd with syslog-ng (3.0.2). This host receives a lot of syslog messages per second from a large number of clients via UDP. The stock syslogd configuration is trivial: *.* /var/log/all This host currently drops about 2-4% of all UDP packets, syslog takes about 50-65% of one CPU. A drop-in replacement configuration using syslog-ng: options { create_dirs(yes); use_dns(no); }; template t_default { template("${DATE} <${FACILITY}.${PRIORITY}> ${HOST} ${MSG}\n"); }; source s_standard { file("/dev/klog"); internal(); udp(); unix-dgram("/var/run/log"); }; destination d_all { file("/var/log/all" template(t_default) ); }; # *.* /var/log/all log { source(s_standard); destination(d_all); }; syslog-ng uses about 90% of one CPU and drops between 15% and 20% of UDP packets (and, based on traffic patterns and logfile size, concurrent logfile rotation etc. even as high as 30%). I've tried a number of things to improve this performance, including: log_fetch_limit(100); log_iw_size(10000); flush_lines(100000); flush_timeout(10); in the global options and log_fifo_size(100000) in the destination definition with flags(flow-control) in the log definition. The best I was able to get with these numbers was 5-7% of UDP drops (ie still double of what the stock syslogd drops). I also tried adjusting "so_rcvbuf" for UDP with no noticable difference. Now consider that I did not do any sysctl tuning, as those should equally influence the stock syslog and I'm trying to sort out why one performs so significantly better than the other. Leaving aside any of the things I can do with syslog-ng further down the road (such as filtering and intentionally dropping certain messages), what can I do to get syslog-ng up to the same performance as the stock syslogd? Many thanks in advance for any pointers and help. -Jan

4 8

New to syslog-ng, basic setup help reuqested
by lance raymond 05 Jun '09

05 Jun '09

Afternoon, looking to do some real basic logging for our webservers. They are all running ubuntu-server 8.10, and I have a standalone box which will act as the 'log server'. They have webmin installed, so I setup using that as it seemed pretty straight forward. So the server is running and when I start one of the webservers which I configured, I recive the following error; * Starting system logging syslog-ng Error binding socket; addr='AF_UNIX(/var/log/apache2/ws8.mydomain.com-access_log)', error='Address already in use (98)' I thought it might be due to apache running, so stopped that, but still the same error. the conf file is HUGE, and 95% is a stock install, so I will just put what the client / server has that is specific to this item I wish to remote log. Client: destination WFLogger { udp(192.168.2.60); }; source domain_access { unix-stream("/var/log/apache2/ws8.domain.com-access_log"); }; log { source(domain_access); destination(WFLogger); flags(catchall); }; On the server, I don't see anything that stands out that say's "accept connections" so not sure if there is anything special that has to be done, but the error on the client is immediate so that part seems to be a local issue. Thanks

2 2

no compatibility between syslog and apache log priority
by gatfi sami 05 Jun '09

05 Jun '09

Hi i a successfully configured a centralised syslog server using syslog-ng 2.09 here is the structure: syslog-client(read apache error log) -------> *send* to a syslog-relay --------->* forword* to a syslog server ----> centralise in a mysql tabe 'logs' CREATE TABLE `syslogtopnet`.`log` ( `seq` int(10) unsigned NOT NULL auto_increment, `host` varchar(60) NOT NULL, `facility` varchar(40) NOT NULL, `*priority*` varchar(40) NOT NULL, `*level*` varchar(40) NOT NULL, `date_log` date NOT NULL, `time_log` time NOT NULL, `program` varchar(40) NOT NULL, `*message*` text NOT NULL, PRIMARY KEY (`seq`), KEY `index_log` (`host`) ) ENGINE=InnoDB AUTO_INCREMENT=684 DEFAULT CHARSET=latin1; my problème is : i find for exemple priority ='*Notice*' and level='*Notic*e' but in the message i find *[warn]* here is an exemple: INSERT INTO `syslogtopnet`.`log` VALUES (320,'192.168.9.195','user',* 'notice'*,*'notice'*,'2009-05-19','19:33:24','','[Tue May 19 19:33:24 2009] *[warn]* Init: Session Cache is not configured [hint: SSLSessionCache]'); i discovered that apache log level are different then syslog's so !!!!! 1 wired isnt it lease is there a solution to keep the same level in the original priority? 2 beside in more than 20589 line in my table priority and level have the same values. is it normal that the level and priority are the same how can this be? thank you

2 1

New db-parser format and other improvements
by ILLES, Marton 05 Jun '09

05 Jun '09

Hi, I have already mentioned earlier that I am planning to back-port the new db-parser patterndb format to syslog-ng OSE. After Bazsi's plan on the 4.0 roadmap I had no more excuse and did the backporting last week. So anyone interested in the new format can find the code in my git tree. Format 2 is more flexible and hopefully easier to use. Meanwhile I removed support for version 1 format. Converting between the formats is very straight forward, but I also plan to add an XSLT for conversions. The new format has support and flexibility for couple of interesting things: * rules for one program can be separated into multiple rulesets * rulesets can be defined without program pattern where these act as a fail-back rule sets if no program pattern is matching or when message does not have program part * one rule can have any number of pattern attached to it (sometimes the same message has multiple format, just think about multilingual messages) * tags can be attached to rules (IMPORTANT: as of now tags are not considered, but at least the format has place for them!) The new patterndb format looks like this: <patterndb version="2" pub_date="2009-06-04"> <ruleset name="testset" id="4182799f-9d1e-48a2-aa1e-aa4bdac6aff8"> <rules> <rule provider="balabit" id="4a3b027a-3c5c-4c55-a28b-ce8052e8a327" class="system"> <tags> <tag>login</tag> </tags> <patterns> <pattern>HERE COMES THE PATTERN</pattern> </patterns> </rule> </rules> </patterndb> I have added new parsers to the db-parser: * IPv6 to parser IPv6 addresses with all the special notation styles * IPvANY to match either IPv4 or IPv6 addresses * NUMBER parser now handles hexadecimal numbers with the 0x or 0X prefix * DOUBLE parser to match and parse non integer I am trying to find some time in the near future to add the missing tag support and provide some more details on the new format. cheers, Marton -- Key fingerprint = F78C 25CA 5F88 6FAF EA21 779D 3279 9F9E 1155 670D

1 0