- syslog-ng - lists.balabit.hu

syslog-ng using ssl
by Luigi Augello 22 Mar '09

22 Mar '09

Hello I try to use ssl ad I have the follow scenario: One server (192.168.1.2) with this syslog.ng.conf ########################################### @version:3.0 source s_sk{file("/var/log/messages");}; source s_ssl{ tcp(ip("0.0.0.0") port (1999) tls(key_file("/root/Scaricati/certificati/privkey.pem") cert_file("/root/Scaricati/certificati/cacert.pem")));}; destination d_file{file("/var/log/syslog-ng.log");}; log{source(s_sk);destination(d_file);}; log{source(s_ssl);destination(d_file);}; One client (192.168.1.3) with this syslog.ng.conf ################################################### @version:3.0 source s_sk{file("/var/log/messages");}; destination d_file{file("/var/log/syslog-ng.log");}; destination d_ssl{tcp("192.168.1.2" port (1999) tls(ca_dir("/root/software/ca/")));}; log{source(s_sk);destination(d_file);}; log{source(s_sk);destination(d_ssl);}; I haven't a CA certificate and I use a self-signed certificate created by these instructions opennsl genrsa -out privkey.pem opennsl req -new -x509 -key prixkey.pem -out cacert.pem -days 1095 I follow step by step the instructions on "The syslog-ng Administrators guide " page 58 and so on and I copied the cacert.pem generated in the server in the client and I use ln -s .... When I try to start the server it starts. Though the client doesn't give me any errors it doesn't start. I suppose the certificate may crate some problems. tanks for help Luigi

1 0

no_multi_line - have cake, eat too
by Ross Andrus 22 Mar '09

22 Mar '09

Hi, Thanks for the great tool! I really enjoy the power and flexibility of syslog-ng, and I wanted to send along a local modification I've made to the 3.0.1 release. My situation is that I'd like to have *both* the traditional behavior in which newlines are replaced with spaces, and also the new no_multi_line feature. Basically, developers want to see the stack traces, operations wants simple scanning and analysis. So, I created a new template macro named "ONELINE" that is a variant of the MSGONLY macro, but it makes a local copy of the buffer and performs the newline replacement on it, then sends it off. I didn't put any time into thinking about performance, so I won't be surprised to here there's a better way or etc, but it works well enough so far. Regards Ross Andrus

2 1

Re: [syslog-ng] seeking for a help
by dhanesh m 20 Mar '09

20 Mar '09

friend, Thanks for ur reply iam very happy and i got sum confidence too there are few friends around me to help expecting the same with regards, dhanesh m Connect with friends all over the world. Get Yahoo! India Messenger at http://in.messenger.yahoo.com/?wm=n/

1 0

why i have to restart syslog to have the new apache log??
by gatfi sami 19 Mar '09

19 Mar '09

hi i am using syslog-ng 2.0.9.1 on open suse 11.0 i configured this littele script in /etc/syslog-ng/syslog-ng.conf source my_src { file("/var/log/apache2/error_log"); }; > > #filter my_filter { }; > > destination my_dest{ file("/var/log/Sami/$HOST/messages" owner("root") > group("root") perm(0640) dir_perm(0750) create_dirs(yes)); > }; > > log { source(my_src); #filter(my_filter); > destination(my_dest); }; > the problem is when i restart apache2 while using the *tail -f /var/log/Sami/$HOST/messages *nothing happens i have to restart syslog-ng to see those errors by the way i stoped the apparmor to avoid a permission denied on the destination driver i need help plz tks

4 8

s_tail not working
by Nikunj Shah 18 Mar '09

18 Mar '09

Hi, I am using syslog-ng 2.0.9 on my opensuse 11.1 box. I was trying to configure my apache log to be logged in syslog-ng. I used below syntax: source s_tail { file("/var/log/apache2/access_log" follow_freq(1) flags(no-parse));}; destination logserver { tcp("192.168.1.184" port(1470)); }; log { source(s_tail); destination(logserver); }; It gave me below error: >Mar 18 04:08:09 sugar3 syslog-ng[22107]: Follow-mode file source not found, deferring open; filename='/var/log/apache2/access_log' Help would be appreciated. Regards, Nikunj

1 0

seeking for a help
by dhanesh m 18 Mar '09

18 Mar '09

freind, iam a redhat certified engineer , now iam concentrating on suse linux, and i wanna configure syslog-ng server in suse i gone through google search and got some idea i tried but its not coming juss tell me wat all entries i hav to give in server and client normal entries for remote logging hope some1 will help me...................................... Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/

2 1

[Bug 39] New: Memory exhaustion when using UDP destination to send to a remote server.
by bugzilla＠bugzilla.balabit.com 16 Mar '09

16 Mar '09

https://bugzilla.balabit.com/show_bug.cgi?id=39 Summary: Memory exhaustion when using UDP destination to send to a remote server. Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: gillespiem(a)pa.net Type of the Report: --- Estimated Hours: 0.0 I have noticed that if syslog-ng receives an ICMP Type 3 / Code 3 message from a syslog-ng server configured as a remote destination (using UDP as the transport), the syslog-ng process starts consuming more and more memory, finally exhausting all resources. I've found this issue can be consistently replicated. Centos 5.2 (Final) syslog-ng 2.1.3 syslog-ng.conf (snippet from sending server) destination d_syslog_rtr0 {udp("syslog-server.blah.com" port(514));}; Config on receiving server doesn't matter, you can send the packets to a blackhole when replicating the issue. Steps to replicate: Using tcpdump, determine the port the sending server is using to send messages. Then, using sing (or any packetcrafting tool), do the following (or similar): sing -du -S <receiving syslog server IP> -x port-unreach -prot udp -psrc <Sending server source port (determined above)> --pdst 514 <Sending syslog server> When viewing processes using "top", it's apparent that memory usage of the syslog-ng process starts increasing every ~2 seconds, until the server has exhausted all memory. (I can replicate this on 3 separate servers) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

syslog-ng OSE binary packages
by Balazs Scheidler 14 Mar '09

14 Mar '09

Hi, I'm happy to announce that BalaBit has decided to make the binary packages for syslog-ng OSE available for free. As you may know, BalaBit has various syslog-ng support packages and as a part of this service it prepared binary installation packages for different platforms. The access to these packages either required a support contract but could also be purchased separately for a yearly fee. With syslog-ng 3.0, the binary packages for syslog-ng OSE will become freely accessible. Since syslog-ng is an open source project, BalaBit planned to finish this task in the Open Source spirit: open and visible to all community members. This also means that the set of packages published with this e-mail is NOT yet release grade, rather it is more of a development snapshot of the current state of affairs. So please don't ruin your production systems with this package, it is more advisable to try them in a test environment (chroot or a dedicated test machine). With all these said, here is the link: https://www.balabit.com/network-security/syslog-ng/opensource-logging-syste… Please pick the release named "3.0HEAD". This contains a source snapshot (effectively git from two days ago), and a set of packages for SUSE 10, RHEL4/5, FreeBSD 6.x, Debian etch, and Linux generic. The binary packages contain all runtime dependencies needed to run syslog-ng, thus no further packages are required, it is an all-in-one package. The rpm/deb packages are prepared the same, they install syslog-ng in /opt/syslog-ng in order to avoid clashes with a system supplied syslog-ng daemon. There are two install kits for each platform: * one that includes database drivers (dubbed as "server") * one that does not include database drivers (dubbed as "client") Currently there are no other differences between the packages, but later on there might be. With the current infrastructure in place, I'm confident that with each syslog-ng OSE release, I can publish the source AND binary packages at the same time. I'd really appreciate success/failure reports and also any kind of comment you may have. I'd like to release 3.0.2 together with its binary packages, let's hope that I get enough feedback on these packages so that I can do that. Enjoy! -- Bazsi

2 1

question about message parsing behavior
by Joe Shaw 14 Mar '09

14 Mar '09

Hi, What happens if a parser fails to parse a message? Let's say I have a parser: csv_parser(columns("COL1", "COL2", "COL3") delimiters(",")); If I pass in "foo", does COL1 get set to "foo" and COL2 and COL3 are undefined? If I pass in "foo,bar" is just COL3 undefined? If I pass in "foo,bar,baz,quux" is COL3 "baz,quux" ? I am wondering if I can set up a filter for messages which don't meet the parsing rules, so that I can use the catch-all directive for logging rules and filter out messages that don't match the format (in lieu of the tagging that was discussed in a different thread). Thanks! Joe

2 2

installing syslog-ng on a CentOS 5.2
by Luigi Augello 14 Mar '09

14 Mar '09

Hi I have tried to install syslog-ng-3.0.1+20090312 with eventlog-0.2.9+20090312 on a CentOS 5.2 following this steps below 1) tar -xzvf eventlog-0.2.9+20090312.tar.gz 2) tar -xzvf syslog-ng-3.0.1+20090312.tar.gz 3) mkdir -p /opt/syslog-ng-3.0.1/eventlog 4) cd eventlog-0.2.9+20090312 5) ./configure --prefix=/opt/syslog-ng-3.0.1/eventlog/ 6) make&&make install 7) export PKG_CONFIG_PATH=/opt/syslog-ng-3.0.1/eventlog/lib/pkgconfig/ 8) cd syslog-ng-3.0.1+20090312 9) ./configure --prefix=/opt/syslog-ng-3.0.1/ and this is the output executing the last command checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc... (cached) gcc checking whether we are using the GNU C compiler... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ISO C89... (cached) none needed checking dependency style of gcc... (cached) gcc3 checking for bison... no checking for byacc... no checking for flex... no checking for lex... no checking whether make sets $(MAKE)... (cached) yes checking for ranlib... ranlib checking for special C compiler options needed for large files... no checking for _FILE_OFFSET_BITS value needed for large files... 64 checking how to enable static linking for certain libraries... GNU or Solaris checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dmalloc.h usability... no checking dmalloc.h presence... no checking for dmalloc.h... no checking for strings.h... (cached) yes checking getopt.h usability... yes checking getopt.h presence... yes checking for getopt.h... yes checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/strlog.h usability... no checking sys/strlog.h presence... no checking for sys/strlog.h... no checking door.h usability... no checking door.h presence... no checking for door.h... no checking sys/capability.h usability... no checking sys/capability.h presence... no checking for sys/capability.h... no checking sys/prctl.h usability... yes checking sys/prctl.h presence... yes checking for sys/prctl.h... yes checking tcpd.h usability... yes checking tcpd.h presence... yes checking for tcpd.h... yes checking whether struct tm is in sys/time.h or time.h... time.h checking for struct tm.tm_gmtoff... yes checking for I_CONSLOG... no checking for O_LARGEFILE... yes checking for struct sockaddr_storage... yes checking for struct sockaddr_in6... yes checking for PR_SET_KEEPCAPS... yes checking for door_create in -ldoor... no checking for socket in -lsocket... no checking for nanosleep in -lrt... yes checking for gethostbyname in -lnsl... yes checking for regexec in -lregex... no checking for res_init in -lresolv... no checking for cap_set_proc in -lcap... no checking for pcre_compile in -lpcre... no checking for strdup... yes checking for strtol... yes checking for strtoll... yes checking for strtoimax... yes checking for inet_aton... yes checking for inet_ntoa... yes checking for getopt_long... yes checking for getaddrinfo... yes checking for getutent... yes checking for strcasestr... yes checking for TCP wrapper library... -lwrap checking for OPENSSL... yes checking for dlsym in -ldl... yes checking for inflate in -lz... yes checking for dlsym in -ldl... (cached) yes checking for LIBDBI... no checking for dbi_initialize in -ldbi... no checking for LIBNET... no checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... yes checking whether to enable spoof source support... no checking whether to enable IPv6 support... yes checking whether to enable SQL support... no checking whether to enable Linux capability support... no checking whether to enable PCRE support... no checking for pkg-config... /usr/bin/pkg-config checking for GLIB - version >= 2.10.1... no *** Could not run GLIB test program, checking why... *** The test program failed to compile or link. See the file config.log for the *** exact error that occured. This usually means GLIB is incorrectly installed. configure: error: Cannot find GLIB version >= 2.10.1: is pkg-config in path? the latest 5 lines upon the GLIB library not updated, but mi CentOS is the latest. So, why this error? All hepls will be highly appreciated bye Luigi

2 2