- syslog-ng - lists.balabit.hu

Constant syslog-ng startup message
by srainville＠videotron.ca 26 Mar '09

26 Mar '09

1 0

Syslog-ng and tcpd
by Liam Kirsher 25 Mar '09

25 Mar '09

Hi -- I'm noticing lot's of these in the /var/log/messages file: > Mar 24 15:16:07 domU-12-31-39-00-09-F2 syslog-ng[25138]: warning: > /etc/hosts.allow, line 17: host name/name mismatch: > ec2-67-202-53-122.compute-1.amazonaws.com != > domU-12-31-35-00-04-A1.z-2.compute-1.internal > Mar 24 15:16:07 domU-12-31-39-00-09-F2 syslog-ng[25138]: Syslog > connection rejected by tcpd; from='AF_INET(67.202.53.122:48703)' > Mar 24 15:16:17 domU-12-31-39-00-09-F2 syslog-ng[25138]: Syslog > connection accepted; fd='22', client='AF_INET(67.202.53.122:48187)', > local='AF_INET(0.0.0.0:5000)' Apparently, access is being denied, as it should be. It's just a little disconcerting to see the "connection accepted" message after it has been rejected. > telnet this.domain.com 5000 > Trying 171.122.232.186... > Connected to this.domain.com. > Escape character is '^]'. > Connection closed by foreign host. Is this the expected behavior? Is there some way to prevent all these messages from showing up in the log file? Liam -- Liam Kirsher PGP: http://liam.numenet.com/pgp/

3 2

Syntax error due to include files in syslog-ng.conf
by Ritesh Sood 25 Mar '09

25 Mar '09

Hi all, I've built syslog-ng V 3.0.1 from the released source and have the following at the top of syslog-ng.conf ----- @version:3.0 include "/etc/syslog-ng/options.inc"; include "/etc/syslog-ng/src-dest-defs.inc"; include "/etc/syslog-ng/filter-defs.inc"; include "/etc/syslog-ng/common-log-defs.inc"; ------ syntax checking as # syslog-ng -s returns with syntax error at line 3. Here are the relevant portion from the syslog-ng-admin-guide.pdf ----- Every syslog-ng configuration file must begin with a line containing the version infor mation of syslog-ng. For syslog- ng version 3.0, this line looks like: @version:3.0 . . . The syslog-ng application supports including external files in its configuration file, so parts of its configuration can be managed separately. To include the contents of a file in the syslog- ng configuration, use the following syntax include "filename"; This imports the entire file into the configuration of syslog-ng, at the location of the include statement. If you specify a directory, syslog-ng will try to include every file in alphabetic order. When including configuration files, consider the following points: ---- The config file works okay if I copy-paste the corresponding files in place of the include statements so the included files themselves are syntactically correct. So I don't see where I'm making an error. I hope there isn't a bug in the source. I'm not counting out that possibility since there was a bug in the released source for which I had to obtain a patch from the git repo: https://lists.balabit.hu/pipermail/syslog-ng/2009-January/012400.html Help much appreciated ! Ritesh

2 2

[Bug 40] New: Cisco ASA format is not understood
by bugzilla＠bugzilla.balabit.com 23 Mar '09

23 Mar '09

https://bugzilla.balabit.com/show_bug.cgi?id=40 Summary: Cisco ASA format is not understood Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vincent.panel(a)telindus.be Type of the Report: --- Estimated Hours: 0.0 Syslog-ng receives messages like this from Cisco ASA devices : <PRI>MM DD YYYY HH:mm:ss HOSTNAME %MSGID: CONTENT "YYYY" part is not conform to BSD-style syslog timestamp : it shouldn't exist. Unfortunately, it can't be changed on the ASA side. Syslog-ng does not see any header in this message and think "MM" is the process sending the message, hence adds ":" behind it. Additionnaly, syslog-ng prepends its own header which leads to a total mess in the destination syslog... On the other hand, syslog-ng also receives messages from another Cisco device (FWSM) like this : <PRI>MM DD YYYY HH:mm:ss %MSGID: CONTENT Note the hostname is not specified. And this format is well understood by syslog-ng (no prepended header, no ":" after the month) ! I've also read here : http://www.balabit.com/dl/html/syslog-ng-v3.0-guide-admin-en.html/ch02s17.h… syslog-ng should be able to understand "PIX extended format" but I can't find anywhere in the documentation nor on the internet what it refers to... So would it be possible to make sure the first format is well understood by syslog-ng ? Regards, Vincent Panel -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

binary packages success/failure reports
by Balazs Scheidler 23 Mar '09

23 Mar '09

Hi, I'd be eager to hear any success/failure reports with the binary installation packages I've posted about last week. I'd really like to do a release of syslog-ng 3.0.2, but since I want to do that together with the binary packages and I don't want to be ashamed for the binary packages, I'd really be interested in some field testing. Thanks in advance. -- Bazsi

1 0

Re: [syslog-ng] syslog-ng using ssl
by Hahusseau, Thomas 23 Mar '09

23 Mar '09

Hi, Maybe you should try to launch syslog-ng with debug & verbose options to see error. I had some seg fault with ssl and syslog-ng and it's now fixed thanks to a patch posted on this mailing list. Bye Thomas -----Message d'origine----- De : syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] De la part de Luigi Augello Envoyé : dimanche 22 mars 2009 17:53 À : Syslog-ng users' and developers' mailing list; syslog-ng-bounces(a)lists.balabit.hu Objet : [syslog-ng] syslog-ng using ssl Hello I try to use ssl ad I have the follow scenario: One server (192.168.1.2) with this syslog.ng.conf ########################################### @version:3.0 source s_sk{file("/var/log/messages");}; source s_ssl{ tcp(ip("0.0.0.0") port (1999) tls(key_file("/root/Scaricati/certificati/privkey.pem") cert_file("/root/Scaricati/certificati/cacert.pem")));}; destination d_file{file("/var/log/syslog-ng.log");}; log{source(s_sk);destination(d_file);}; log{source(s_ssl);destination(d_file);}; One client (192.168.1.3) with this syslog.ng.conf ################################################### @version:3.0 source s_sk{file("/var/log/messages");}; destination d_file{file("/var/log/syslog-ng.log");}; destination d_ssl{tcp("192.168.1.2" port (1999) tls(ca_dir("/root/software/ca/")));}; log{source(s_sk);destination(d_file);}; log{source(s_sk);destination(d_ssl);}; I haven't a CA certificate and I use a self-signed certificate created by these instructions opennsl genrsa -out privkey.pem opennsl req -new -x509 -key prixkey.pem -out cacert.pem -days 1095 I follow step by step the instructions on "The syslog-ng Administrators guide " page 58 and so on and I copied the cacert.pem generated in the server in the client and I use ln -s .... When I try to start the server it starts. Though the client doesn't give me any errors it doesn't start. I suppose the certificate may crate some problems. tanks for help Luigi ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng using ssl
by Luigi Augello 22 Mar '09

22 Mar '09

Hello I try to use ssl ad I have the follow scenario: One server (192.168.1.2) with this syslog.ng.conf ########################################### @version:3.0 source s_sk{file("/var/log/messages");}; source s_ssl{ tcp(ip("0.0.0.0") port (1999) tls(key_file("/root/Scaricati/certificati/privkey.pem") cert_file("/root/Scaricati/certificati/cacert.pem")));}; destination d_file{file("/var/log/syslog-ng.log");}; log{source(s_sk);destination(d_file);}; log{source(s_ssl);destination(d_file);}; One client (192.168.1.3) with this syslog.ng.conf ################################################### @version:3.0 source s_sk{file("/var/log/messages");}; destination d_file{file("/var/log/syslog-ng.log");}; destination d_ssl{tcp("192.168.1.2" port (1999) tls(ca_dir("/root/software/ca/")));}; log{source(s_sk);destination(d_file);}; log{source(s_sk);destination(d_ssl);}; I haven't a CA certificate and I use a self-signed certificate created by these instructions opennsl genrsa -out privkey.pem opennsl req -new -x509 -key prixkey.pem -out cacert.pem -days 1095 I follow step by step the instructions on "The syslog-ng Administrators guide " page 58 and so on and I copied the cacert.pem generated in the server in the client and I use ln -s .... When I try to start the server it starts. Though the client doesn't give me any errors it doesn't start. I suppose the certificate may crate some problems. tanks for help Luigi

1 0

no_multi_line - have cake, eat too
by Ross Andrus 22 Mar '09

22 Mar '09

Hi, Thanks for the great tool! I really enjoy the power and flexibility of syslog-ng, and I wanted to send along a local modification I've made to the 3.0.1 release. My situation is that I'd like to have *both* the traditional behavior in which newlines are replaced with spaces, and also the new no_multi_line feature. Basically, developers want to see the stack traces, operations wants simple scanning and analysis. So, I created a new template macro named "ONELINE" that is a variant of the MSGONLY macro, but it makes a local copy of the buffer and performs the newline replacement on it, then sends it off. I didn't put any time into thinking about performance, so I won't be surprised to here there's a better way or etc, but it works well enough so far. Regards Ross Andrus

2 1

Re: [syslog-ng] seeking for a help
by dhanesh m 20 Mar '09

20 Mar '09

friend, Thanks for ur reply iam very happy and i got sum confidence too there are few friends around me to help expecting the same with regards, dhanesh m Connect with friends all over the world. Get Yahoo! India Messenger at http://in.messenger.yahoo.com/?wm=n/

1 0

why i have to restart syslog to have the new apache log??
by gatfi sami 19 Mar '09

19 Mar '09

hi i am using syslog-ng 2.0.9.1 on open suse 11.0 i configured this littele script in /etc/syslog-ng/syslog-ng.conf source my_src { file("/var/log/apache2/error_log"); }; > > #filter my_filter { }; > > destination my_dest{ file("/var/log/Sami/$HOST/messages" owner("root") > group("root") perm(0640) dir_perm(0750) create_dirs(yes)); > }; > > log { source(my_src); #filter(my_filter); > destination(my_dest); }; > the problem is when i restart apache2 while using the *tail -f /var/log/Sami/$HOST/messages *nothing happens i have to restart syslog-ng to see those errors by the way i stoped the apparmor to avoid a permission denied on the destination driver i need help plz tks

4 8