- syslog-ng - lists.balabit.hu

running syslog-ng and syslogd concurrently?
by Matt Camuto 29 Nov '08

29 Nov '08

Hi There - I am new to this group so I thank you in advance for any help. We are in the process of evaluating syslog-ng for a replacement for normal syslogd. However it is desired for a few months to have syslog-ng and syslogd running on the same box with syslog-ng simply not handling the normal 'syslog traffic' (udp/514). We currently have a 30 day eval license to test out syslog-ng. We are using a sun t1000 box as an fyi. When we install syslog-ng the install script informs us that syslogd will be removed as a service?!?! Has anybody ever run syslogd (in either agent or server mode) on the same machine with syslogd running. Any guidance there would be highly appreciated. We are not in the position to do a hard cross over to syslog-ng for our production environment. Thanks in advance. Matt

5 6

syslog-ng 2.1.3 has been released
by devel＠balabit.hu 26 Nov '08

26 Nov '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.1.3 SUMMARY : new stable release DATE : Nov 26, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.1.3) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: NOTE: this release fixes a security problem CVE-2008-5110, see the changelog below for more details. Bugfixes: * Fixed chroot() support to change into the chrooted directory after chroot is invoked. This fixes the security problem CVE-2008-5110. NOTE: this vulnerability is not exploitable on its own, it only makes breaking out of the jail somewhat easier. Please also NOTE that, even with this patch applied, it is still possible to break out of the jail if syslog-ng is running as root. * Fixed the code to resolve usernames, 2.1.2 had a regression which caused all username lookups to fail. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.1 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.1 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.1 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.1 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.1 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/

4 4

syslog-ng 2.0.10 has been released
by devel＠balabit.hu 26 Nov '08

26 Nov '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.10 SUMMARY : new stable release DATE : Nov 26, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.10) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: NOTE: this release fixes a security problem CVE-2008-5110, see the changelog below for more details. Bugfixes: * Fixed Solaris door support, the door portion of sun-streams() sources did not work in previous releases, as the door specific thread was lost through the fork() call used to background syslog-ng. * Fixed a possible segfault if non-existing, optional source files are present in the configuration. * Fixed the internal representation of "facility" values, earlier an 8 bit value was used for both the priority and facility values, and although systems do not define facilities in this range, the LOG_FACMASK macro defines two additional bits. The type of this field was changed to 16 bits. * Fixed a possible 100% CPU usage case on HP-UX. HP-UX may return POLLERR on its own without the other flags set, this was not properly handled by syslog-ng, causing it to spin on the CPU. * Fixed chroot() support to change into the chrooted directory after chroot is invoked. This fixes the security problem CVE-2008-5110. NOTE: this vulnerability is not exploitable on its own, it only makes breaking out of the jail somewhat easier. Please also NOTE that, even with this patch applied, it is still possible to break out of the jail if syslog-ng is running as root. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

1 0

2 Issues - Resolving User and corrupt forwarding
by Robert Kong 22 Nov '08

22 Nov '08

Syslog-ng Version 3.0+20081121 is not resolving the user when using the option "owner(0)" or "owner(root)". The following error message is displayed: Error resolving user; user='root' or Error resolving user; user='0' Going through the archives I found a posting stating a similar problem. I am wondering if the incorrect patch was also applied to version 3.0? After a little debugging I noticed that in resolve_user the conditional check "if (*user) return FALSE" looks to be the culprit. When comparing resolve_user to resolve_group I notice that under resolve_group the conditional is "if (!*group) return FALSE". Negating the conditional in resolve_user seems to correct the problem. Though I am not sure if would be the correct thing to do. The second issue that I am having is with forwarding of incoming syslog messages to a secondary server running a native syslogd daemon. If I leave the original syslog message un-touched destination D_ONE { udp("10.10.10.10" port(514)); }; log { source(S_ALL); destination(D_ONE); }; The remote server receives and processes the syslog msg correctly. However, if I attempt to use a template the forwarded syslog msg become corrupted. destination D_ONE { udp("10.10.10.10" port(514) template("$DATE $HOST $MSGHDR$MSGONLY")); }; log { source(S_ALL); destination(D_ONE); }; What seems to be occurring is the PRI portion of the syslog msg becomes malformed when using the template. Is this the proper behavior or am I doing something wrong? Thanks Bob

1 0

logwriter.c:241: error: LogWriterWatch has no member named - Red Hat 5.x 32BIT
by Saunders, Shawn 21 Nov '08

21 Nov '08

Can someone shed some light here? I am hoping to get to try the “parser” options, but need to successfully compile first. It appears to be dying at something in the eventlog On Red Hat - 2.6.18-92.1.18.el5 #1 SMP Wed Nov 5 09:00:13 EST 2008 i686 athlon i386 GNU/Linux I have eventlog installed: eventlog-0.2.9+20081116.tar.gz ./configure --enable-ssl=no --enable-dynamic-linking --enable-linux-caps syslog-ng Open Source Edition 3.0+20081116 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -I/usr/kerberos/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : prefix : /usr/local Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : yes SSL support : no SQL support : no Linux capability support : yes PCRE support : yes Env wrapper support : no A make gets me here: logwriter.c: In function â€˜log_writer_fd_dispatchâ€™: logwriter.c:241: error: â€˜LogWriterWatchâ€™ has no member named â€˜fdâ€™ make[2]: *** [logwriter.o] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-3.0+20081116/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/src/syslog-ng-3.0+20081116' make: *** [all] Error 2 snippet of logwriter.c lines 239-245 239 else if (self->pollfd.revents & (G_IO_ERR)) 240 { 241 msg_error("POLLERR occurred while idle", 242 evt_tag_int("fd", self->fd->fd), 243 NULL); 244 log_writer_broken(self->writer, NC_WRITE_ERROR); 245 } Thank you, Shawn Saunders UNIX Systems Administrator 818.953.2649 WMG, Digital Properties "UNIX is user-friendly ... it's just selective about who its friends are!!"

2 3

syslog + snare + mysql
by Eli Robinson 20 Nov '08

20 Nov '08

Hello all! I am currently running the following: Syslog-ng 2.0.5 on FC8, kernel 2.6.23.1-42, no firewall, SELinux disabled, logging to mysql 5.0.45 via a named pipe Snare 2.6.1 on Windows Server 2003 with the enable syslog header option checked The Snare clients have been running for several years and were communicating with an older version of snare. Everything logged perfectly. Unfortunately a hardware failure caused loss of the config file and old syslog server, so I do not have the configuration or version which worked. My setup notes reference a howto online, which I followed again. I use the following destination to log to mysql destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg, username) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' , '$USERNAME' );\n") template-escape(yes)); }; And also this collector script to run the actual mysql client: # #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u syslogusername --password=syslogpassword syslog < /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi I use out of the box filters and destinations to log to the messages logfile (for debugging at this point) My problem arises from the fact that for this entry in my messages file: Nov 20 16:01:14 testserver.mydomain.com FTPSvcLog 3 21:01:11 172.16.5.166 [36863]created /index.htm 226 0 I only get 'FTPsvcLog' written to the messages field in mysql. I am pretty sure its something obviously wrong but at this point I need another set of eyes. My gut feeling is the issue stems from the tabs following FTPSvcLog and the number 3. Any thoughts? Thanks in advance! Eli

1 0

facility(kern) not working? Syslog-ng 2.0.7
by Fegan, Joe 20 Nov '08

20 Nov '08

Hi, I am using 2.0.7 and it seems that facility(kern) does not match messages from "logger -p kern.info". I am trying to filter kernel messages into a file but nothing goes there. Below are details of the test. Joe. [root@node1 ~]# cat /etc/syslog-ng/syslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats_freq(2592000); mark_freq(0); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); # tcp(ip(0.0.0.0) port(514)); }; template t_withsev { template("${DATE} ${HOST} ${PRI} ${PRIORITY} ${MSG}\n"); }; destination d_klog { file("/var/log/klog"); }; destination d_mesg { file("/var/log/messages" template(t_withsev)); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_klog); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; [root@node1 ~]# logger -i -p kern.info "hello from kern" [root@node1 ~]# tail -2 /var/log/messages Nov 17 12:40:45 dizzyfive1 189 notice syslog-ng: syslog-ng startup succeeded Nov 17 12:41:40 dizzyfive1 14 info root[19336]: hello from kern [root@node1 ~]# ls -l /var/log/klog ls: /var/log/klog: No such file or directory [root@node1 ~]#

3 5

parser option in v2.1.3?
by Saunders, Shawn 20 Nov '08

20 Nov '08

Is the parser option to split and work with the $MSG or $MSGONLY variables and split and use various fields from them in the destination filename available in the 2.1.3 tree or is this only available in the 3.x tree? Thank you, Shawn Saunders UNIX Systems Administrator 818.953.2649 WMG, Digital Properties "UNIX is user-friendly ... it's just selective about who its friends are!!"

2 3

Need some help with syslog-ng configuration on firewalled environment
by Ankit Kukreja 19 Nov '08

19 Nov '08

Hi All, Need some help with syslog configuration on firewalled environment. I wanted to implement syslog-ng in firewalled environment. The setup is like: I have one Syslog-ng outside the firewall which collects logs from various components in the network. Now what I want is to pass on these logs from this syslog-ng server (outside firewall) to a syslog server inside the firewall i.e. to make the whole setup firewall friendly. One of the standard way to make anything firewall friendly is that the communications between two server should be started from the server inside the firewall. Is there a way we can do this with syslog-ng? Can someone please provide some insights, it would be really appreciated. Thanks and Regards Ankit Kukreja

2 3

v2.1.2 Open Source Version: Error resolving user; user
by Saunders, Shawn 19 Nov '08

19 Nov '08

When I start syslog-ng 2.1.2 (Opensource) I receive the following error. It worked fine with the same syslog-ng.conf file under v2.0.9 Starting syslog-ng: Error resolving user; user='root' Error resolving user; user='root' Error resolving user; user='root' Error resolving user; user='apache' Error resolving user; user='apache' Error resolving user; user='apache' These users do exist. I use them and their existence is self-explanatory. I have tried using the UID #'s for them and get basically the same errors. Any ideas? I have tried even moving these entries from the destination to the global section to no avail. Here is a sample: destination d_somelocation_logs { file ( "/content/syslog/somelocation/$YEAR/$MONTH/$DAY/$FULLHOST-$FACILITY-$YEA R-$MONTH-$DAY.log" owner(apache) group( apache ) perm ( 0600 ) dir_perm( 0755 ) create_dirs ( yes ) template ( "$MESSAGE\n" ) ); }; Am I loosing my mind? This seems pretty clear, and it always worked before. One of the reasons I upgraded was the hope of utilizing the parser function and templatizing my 507 line conf file, but until I get the basics working again without the errors, I don't know. Thank you, Shawn Saunders UNIX Systems Administrator 818.953.2649 WMG, Digital Properties "UNIX is user-friendly ... it's just selective about who its friends are!!"

2 2