- syslog-ng - lists.balabit.hu

Unpredictable log output when message has many newlines
by Jean-Baptiste Quenot 26 Mar '08

26 Mar '08

Hi there, Thanks for the great syslog-ng program, it rocks. I have a step-by-step recipe below that yields unpredictable results in the syslog output, and this worries me a bit as in my company we have similar messages sent to syslog by PHP's print_r() function. The example is simplified to a message that consists of 40 occurences of an incrementing number, with a newline separating each number. Let's call it syslog_overflow.txt: ------------------------------------------------------------------------ 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 ------------------------------------------------------------------------ Now let's send this message repeatedly using a simple Perl script. Let's call it syslog_overflow.pl: ------------------------------------------------------------------------ #!/usr/bin/perl use Sys::Syslog qw( :DEFAULT setlogsock ); setlogsock('unix'); # First argument is program name, used for passing vhost openlog(@ARGV[0], 'cons,pid', 'user'); $log = `cat syslog_overflow.txt`; while (1) { syslog('notice', $log); } closelog ------------------------------------------------------------------------ Run this script, and watch the syslog output, while filtering out the expected message, where newlines are converted to spaces: tail -f /var/log/syslog | grep -v ': 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39' You will notice unpredictable results like this: ------------------------------------------------------------------------ Mar 16 16:17:42 dockee jbq[12563]: 0 Mar 16 16:17:42 dockee 1 Mar 16 16:17:42 dockee 2 Mar 16 16:17:42 dockee 3 Mar 16 16:17:42 dockee 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 Mar 16 16:17:42 dockee jbq[12563]: 0 Mar 16 16:17:42 dockee 1 Mar 16 16:17:42 dockee 2 Mar 16 16:17:42 dockee 3 Mar 16 16:17:42 dockee 4 Mar 16 16:17:42 dockee 5 Mar 16 16:17:42 dockee 6 Mar 16 16:17:42 dockee 7 Mar 16 16:17:42 dockee 8 Mar 16 16:17:42 dockee 9 Mar 16 16:17:42 dockee 10 Mar 16 16:17:42 dockee 11 Mar 16 16:17:42 dockee 12 Mar 16 16:17:42 dockee 13 Mar 16 16:17:42 dockee 14 Mar 16 16:17:42 dockee 15 Mar 16 16:17:42 dockee 16 Mar 16 16:17:42 dockee 17 Mar 16 16:17:42 dockee 18 ------------------------------------------------------------------------ I could reproduce this behaviour easily on various hosts, with syslog-ng 2.0.0 up to 2.0.8 from a fresh git checkout. However, this problem does not appear with the legacy syslog daemon. I'd be glad to provide more details if necessary. I tried to fiddle with the various options: log_fetch_limit, log_msg_size, with no luck. I also activated the various debugging features and had a look at logreader.c, but couldn't find anything obvious. The only noteworthy debugging output I could get is the one below, which means the bogus lines are already present on the logreader side: ------------------------------------------------------------------------ Incoming log entry; line='<13>Mar 16 16:33:36 jbq[12638]: 0' Incoming log entry; line='1' Incoming log entry; line='2' Incoming log entry; line='3' Incoming log entry; line='4\x0a5\x0a6\x0a7\x0a8\x0a9\x0a10\x0a11\x0a12\x0a13\x0a14\x0a15\x0a16\x0a17\x0a18\x0a19\x0a20\x0a21\x0a22\x0a23\x0a24\x0a25\x0a26\x0a27\x0a28\x0a29\x0a30\x0a31\x0a32\x0a33\x0a34\x0a35\x0a36\x0a37\x0a38\x0a39\x0a' ------------------------------------------------------------------------ Thanks in advance for your help, -- Jean-Baptiste Quenot http://caraldi.com/jbq/blog/

3 10

Timezone question
by Frank Wilkinson 25 Mar '08

25 Mar '08

Hi, I run syslog-ng 2.0 on RH el4. the local time zone here is CDT My template is: destination d_localhost { file("/logs/local_host/$FACILITY-$YEAR-$MONTH-$DAY.log" template("$DATE $HOST $MSG [recv-frm:$SOURCEIP $R_ISODATE $S_ISODATE $TZ dte:$R_DATE $FACILITY.$LEVEL] \n"); }; The log data is: Mar 25 15:01:01 sopher crond[31974]: (root) CMD (run-parts /etc/cron.hourly) [recv-frm:127.0.0.1 2008-03-25T15:01:01+05:00 2008-03-25T15:01:01+05:00 -05:00 dte:Mar 25 15:01:01 cron.info] Why do I have +05:00 in the ISODATES : $R_ISODATE: 2008-03-25T15:01:01+05:00 $S_ISODATE: 2008-03-25T15:01:01+05:00 When TZ is right? $TZ: -05:00 -frank-

2 1

syslog-ng 2.0.9 has been released
by devel＠balabit.hu 25 Mar '08

25 Mar '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.9 SUMMARY : new stable release DATE : Mar 25, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.9) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.9 Sun, 23 Mar 2008 21:36:47 +0100 Bugfixes: * Fixed handling more than 256 destinations by changing the reference counter type of LogMessages to a 16 bit value. * Fixed a possible SIGABRT crash if the hosts file passed to dns-cache-hosts() had multiple entries with the same IP address. * Fixed a possible crash during startup if "-g" was specified without using "-u". BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

1 0

Configuring syslog-ng clients to log to a regular syslogd central log server
by Malcolm Heath 23 Mar '08

23 Mar '08

Hello, My company is planning on deploying syslog-ng as the default syslog daemon on our client images. However, we have a requirement that these machines log to a central log server owned by another group, running the regular syslog daemon. While there are plans in the works to move these central log servers to syslog-ng, our deployment timelines do not line up, so I need to figure out a way to have the syslog-ng clients send logs to the central hosts, without having to upgrade them. As near as I can tell, this should be no problem, using a destination driver of the udp() type on the clients. This assumes that the message sent will be in a format that the syslogd can understand. Could someone here confirm this for me? Thanks. Malcolm

2 1

Re: [syslog-ng] loop caused by syslog-ng filter
by JUNG, Christian 20 Mar '08

20 Mar '08

Hi Adam, syslog-ng does the right thing :-). It starts the program/script once and pipes on STDIN every log-message which matches the filter. If your script is started, it will call mail and pipe "Alert, priority 1" to its STDIN and then exits. syslog-ng sees this and restarts it (version 2.0 or higher behave that way, see <http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/ch09s02.html#r…>). For you purpose this would be better: ---8<--- #!/bin/bash while read LINE; do cat <<-EOF | mail -s "High Priority Snort Alert" Sub-Zero(a)xxx.de Alert, Priority 1 $LINE EOF done ---8<--- bye Chris > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of Adam Richter > Sent: Thursday, March 20, 2008 9:23 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] loop caused by syslog-ng filter > > > Hi! > > First off, sorry for my poor english! > I have a problem with a loop caused by syslog-ng v. 2.0.8. I > have set up Snort as an IDS System. Snort writes its messages > in unified-format to /var/log/snort/snort.alert and > /var/log/snort/snort.log. There are two Barnyard processes > which read the unified files and convert it to messages that > syslog and MySQL understand. Syslog-ng writes the messages > to /var/log/auth.log. All this is working fine. Now, I want > to set up a filter for Priority 1 alerts. This alert should > be send to the Administrator. > > I used following filter for syslog-ng: > > source src {unix-stream("/dev/log"); internal();}; > destination email{program("/usr/local/bin/alert_mail.sh");}; > filter high {match("[Priority: 1]");}; > log {source(src);filter(high); destination(email);}; > > > The alert_mail.sh: > > #!/bin/sh > cat << EOF | mail -s "High Priority Snort Alert" Sub-Zero(a)xxx.de > Alert, Priority 1 > EOF > > > Then I use Nessus to cause some alerts with Priority 1. I can > see 4 alerts with the Priority 1 with BASE and in /var/log/auth.log. > > Syslog-ng recognises the alert with Priority 1 and activates > the script /usr/local/bin/alert_mail.sh > > All this is working, but the script is restarted by syslog-ng > again an again. > > Extract from /var/log/messages: > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > status='0' > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination > program; cmdline='/usr/local/bin/alert_mail.sh ' > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Closing log writer > fd; fd='11' > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > status='0' > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination > program; cmdline='/usr/local/bin/alert_mail.sh ' > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > status='0' > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination > program; cmdline='/usr/local/bin/alert_mail.sh ' > … > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > status='256' > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Starting > destination program; cmdline='/usr/local/bin/alert_mail.sh ' > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > status='256' > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Starting > destination program; cmdline='/usr/local/bin/alert_mail.sh ' > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program > exited, restarting; > > … > > > I get thousands of mails per minute till I stop syslog-ng. > > Output of /var/log/auth.log(so y see that syslog-ng writes > snort/barnyard messages correctly to auth.log): > > Mar 19 13:56:54 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > x86 NOOP [Classification: Executable code was detected] > [Priority: 1] {UDP} 172.25.1.152:4758 -> 172.28.100.10:137 > Mar 19 13:57:13 src@Sensor1 barnyard: [1:1446:8] SMTP vrfy > root [Classification: Attempted Information Leak] [Priority: > 2] {TCP} 172.25.1.152:1085 -> 172.28.100.10:25 > Mar 19 13:57:13 src@Sensor1 barnyard: [1:660:11] SMTP expn > root [Classification: Attempted Information Leak] [Priority: > 2] {TCP} 172.25.1.152:1085 -> 172.28.100.10:25 > Mar 19 13:57:22 src@Sensor1 barnyard: [1:12626:2] Snort Alert > [1:12626:0] [Classification: Decode of an RPC Query] > [Priority: 2] {UDP} 172.25.1.152:1146 -> 172.28.100.10:111 > Mar 19 13:57:22 src@Sensor1 barnyard: [1:585:9] RPC portmap > sadmind request UDP [Classification: Decode of an RPC Query] > [Priority: 2] {UDP} 172.25.1.152:1146 -> 172.28.100.10:111 > Mar 19 13:57:24 src@Sensor1 barnyard: [1:566:6] POLICY > PCAnywhere server response [Classification: Misc activity] > [Priority: 3] {UDP} 172.25.1.152:1155 -> 172.28.100.10:5632 > Mar 19 15:11:27 src@Sensor1 barnyard: [122:1:0] portscan: TCP > Portscan [Classification: Unknown] [Priority: 3] {PROTO255} > 172.25.1.152 -> 172.28.100.10 > Mar 19 15:11:58 src@Sensor1 barnyard: [1:1420:13] SNMP trap > tcp [Classification: Attempted Information Leak] [Priority: > 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:162 > Mar 19 15:11:58 src@Sensor1 barnyard: [1:1418:13] SNMP > request tcp [Classification: Attempted Information Leak] > [Priority: 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:161 > Mar 19 15:12:05 src@Sensor1 barnyard: [1:1421:13] SNMP > AgentX/tcp request [Classification: Attempted Information > Leak] [Priority: 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:705 > Mar 19 15:12:16 src@Sensor1 barnyard: [122:1:0] portscan: TCP > Portscan [Classification: Unknown] [Priority: 3] {PROTO255} > 172.25.1.152 -> 172.28.100.10 > Mar 19 15:12:19 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > x86 NOOP [Classification: Executable code was detected] > [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 > Mar 19 15:12:20 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > x86 NOOP [Classification: Executable code was detected] > [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 > Mar 19 15:12:22 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > x86 NOOP [Classification: Executable code was detected] > [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 > > > I think it has something in common with this topic: > > https://lists.balabit.hu/pipermail/syslog-ng/2006-October/009454.html > > Thanks in advance! > > Sub-Zero > > > -- > GMX startet ShortView.de. Hier findest Du Leute mit Deinen Interessen! > Jetzt dabei sein: http://www.shortview.de/?mc=sv_ext_mf@gmx > ______________________________________________________________ > ________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1

loop caused by syslog-ng filter
by Adam Richter 20 Mar '08

20 Mar '08

Hi! First off, sorry for my poor english! I have a problem with a loop caused by syslog-ng v. 2.0.8. I have set up Snort as an IDS System. Snort writes its messages in unified-format to /var/log/snort/snort.alert and /var/log/snort/snort.log. There are two Barnyard processes which read the unified files and convert it to messages that syslog and MySQL understand. Syslog-ng writes the messages to /var/log/auth.log. All this is working fine. Now, I want to set up a filter for Priority 1 alerts. This alert should be send to the Administrator. I used following filter for syslog-ng: source src {unix-stream("/dev/log"); internal();}; destination email{program("/usr/local/bin/alert_mail.sh");}; filter high {match("[Priority: 1]");}; log {source(src);filter(high); destination(email);}; The alert_mail.sh: #!/bin/sh cat << EOF | mail -s "High Priority Snort Alert" Sub-Zero(a)xxx.de Alert, Priority 1 EOF Then I use Nessus to cause some alerts with Priority 1. I can see 4 alerts with the Priority 1 with BASE and in /var/log/auth.log. Syslog-ng recognises the alert with Priority 1 and activates the script /usr/local/bin/alert_mail.sh All this is working, but the script is restarted by syslog-ng again an again. Extract from /var/log/messages: Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', status='0' Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination program; cmdline='/usr/local/bin/alert_mail.sh ' Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Closing log writer fd; fd='11' Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', status='0' Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination program; cmdline='/usr/local/bin/alert_mail.sh ' Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', status='0' Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination program; cmdline='/usr/local/bin/alert_mail.sh ' … Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', status='256' Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Starting destination program; cmdline='/usr/local/bin/alert_mail.sh ' Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', status='256' Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Starting destination program; cmdline='/usr/local/bin/alert_mail.sh ' Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program exited, restarting; … I get thousands of mails per minute till I stop syslog-ng. Output of /var/log/auth.log(so y see that syslog-ng writes snort/barnyard messages correctly to auth.log): Mar 19 13:56:54 src@Sensor1 barnyard: [1:1394:8] SHELLCODE x86 NOOP [Classification: Executable code was detected] [Priority: 1] {UDP} 172.25.1.152:4758 -> 172.28.100.10:137 Mar 19 13:57:13 src@Sensor1 barnyard: [1:1446:8] SMTP vrfy root [Classification: Attempted Information Leak] [Priority: 2] {TCP} 172.25.1.152:1085 -> 172.28.100.10:25 Mar 19 13:57:13 src@Sensor1 barnyard: [1:660:11] SMTP expn root [Classification: Attempted Information Leak] [Priority: 2] {TCP} 172.25.1.152:1085 -> 172.28.100.10:25 Mar 19 13:57:22 src@Sensor1 barnyard: [1:12626:2] Snort Alert [1:12626:0] [Classification: Decode of an RPC Query] [Priority: 2] {UDP} 172.25.1.152:1146 -> 172.28.100.10:111 Mar 19 13:57:22 src@Sensor1 barnyard: [1:585:9] RPC portmap sadmind request UDP [Classification: Decode of an RPC Query] [Priority: 2] {UDP} 172.25.1.152:1146 -> 172.28.100.10:111 Mar 19 13:57:24 src@Sensor1 barnyard: [1:566:6] POLICY PCAnywhere server response [Classification: Misc activity] [Priority: 3] {UDP} 172.25.1.152:1155 -> 172.28.100.10:5632 Mar 19 15:11:27 src@Sensor1 barnyard: [122:1:0] portscan: TCP Portscan [Classification: Unknown] [Priority: 3] {PROTO255} 172.25.1.152 -> 172.28.100.10 Mar 19 15:11:58 src@Sensor1 barnyard: [1:1420:13] SNMP trap tcp [Classification: Attempted Information Leak] [Priority: 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:162 Mar 19 15:11:58 src@Sensor1 barnyard: [1:1418:13] SNMP request tcp [Classification: Attempted Information Leak] [Priority: 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:161 Mar 19 15:12:05 src@Sensor1 barnyard: [1:1421:13] SNMP AgentX/tcp request [Classification: Attempted Information Leak] [Priority: 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:705 Mar 19 15:12:16 src@Sensor1 barnyard: [122:1:0] portscan: TCP Portscan [Classification: Unknown] [Priority: 3] {PROTO255} 172.25.1.152 -> 172.28.100.10 Mar 19 15:12:19 src@Sensor1 barnyard: [1:1394:8] SHELLCODE x86 NOOP [Classification: Executable code was detected] [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 Mar 19 15:12:20 src@Sensor1 barnyard: [1:1394:8] SHELLCODE x86 NOOP [Classification: Executable code was detected] [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 Mar 19 15:12:22 src@Sensor1 barnyard: [1:1394:8] SHELLCODE x86 NOOP [Classification: Executable code was detected] [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 I think it has something in common with this topic: https://lists.balabit.hu/pipermail/syslog-ng/2006-October/009454.html Thanks in advance! Sub-Zero -- GMX startet ShortView.de. Hier findest Du Leute mit Deinen Interessen! Jetzt dabei sein: http://www.shortview.de/?mc=sv_ext_mf@gmx

1 0

Re: [syslog-ng] syslog to java
by JUNG, Christian 18 Mar '08

18 Mar '08

Hi Andrea, in my opinion the best way would be to use the "program" destination. There you could call a java-application which reads the log from standard input and puts the messages in the java-based log system: destination java_log_system { program("/path/to/java-connector" template("<$PRI>$DATE $HOST $MSG\n")); }; log { source(src); destination(java_log_system); }; With named pipes you've got the problem, that they won't block after the first read anymore (that's the way they behave under Linux). So your app would use a lot of CPU-cycles for nothing. syslog-ng will restart your app if it receives a HUP signal. bye Chris -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of Andrea Shore Sent: Tuesday, March 18, 2008 3:21 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog to java Hi, I've seen a lot of information on the web for logging from Log4j to syslog. I have a requirement to do the opposite; redirect syslog logs to a Java-based logging system. Does anyone have any ideas about how this could most effectively be accomplished? A production quality solution is required. Is a Java process reading from a named piped the best way to go about this? Thanks a lot for your help, Andrea

3 2

syslog to java
by Andrea Shore 18 Mar '08

18 Mar '08

Hi, I've seen a lot of information on the web for logging from Log4j to syslog. I have a requirement to do the opposite; redirect syslog logs to a Java-based logging system. Does anyone have any ideas about how this could most effectively be accomplished? A production quality solution is required. Is a Java process reading from a named piped the best way to go about this? Thanks a lot for your help, Andrea

1 0

TAG-Macro
by JUNG, Christian 18 Mar '08

18 Mar '08

Hello, we've been using the old BSD-implementation of syslogd on linux for quite a while and want to migrate to Syslog NG now. We've got the problem, that the priority/facility-encoding of the $TAG macro isn't the same as running syslogd with option -S. Here an excerpt of syslogd's man-page: ---8<--- The priority/facility code takes the form of a priority number followed by a letter that indicates the facility. The priority number can range from 0 to 7. The facility letter can range from 'A' to 'Y', where 'A' corresponds to facility number zero (LOG_KERN), 'B' corresponds to facility 1 (LOG_USER), etc. See /usr/include/sys/syslog.h for a list of priority and LOG_xxx codes. Example: Jun 27 19:22:20 5Q:silence test[1966]: testing The above message contains a priority/facility code of '5Q', which breaks down to a priority of 5 (LOG_NOTICE) and a facility of 16 (LOG_LOCAL0). ---8<--- I'd like to add this functionality to syslog-ng because this encoding is more suitable for log-analysis etc. as the hexadecimal format. Should I use a different macro-name (if yes: which?) or should I modify the TAG part in macro.c? bye Chris -- phone: +49 6898/10-4987 web : www.saarstahl.de mail : Hofstattstraße 106a D 66333 Voelklingen

2 1

Troubleshooting local5.* output
by Sean Carolan 18 Mar '08

18 Mar '08

I am trying to troubleshoot some syslog servers that are not properly sending local5.* logs to a remote syslog-ng server. The syslog-ng server is behaving as it should, and I am able to do this from remote hosts: $ logger -p local5.info "My test message here" This message is correctly written to the local log and remote syslog-ng server. The filters on the syslog-ng box work correctly and the entry is made in the right file for the host. But there is one file on the client, /var/log/mylogfile.log that is being filled up by a running java process. Messages that are written to this file are *not* being sent to the remote server. I ran tcpdump and verified that there are no network packets accompanying these log entries. So, maybe someone can help me. How do I find out how this java process is writing to the log file, and why are messages not being forwarded to the remote host? lsof shows that the only process that has the /var/log/mylogfile.log open is the syslog daemon. Here are some configuration files if it helps: SERVER: /etc/syslog-ng/syslog-ng.conf (excerpt below) options { log_fifo_size(8192); # garden gnomes shouldn't log (Gnome has a buggy log implementation) # needs to be set on client systems, too... bad_hostname("gconfd"); use_time_recvd(no); group(logs); create_dirs(yes); dir_group(logs); dir_perm(0750); perm(0640); chain_hostnames(no); keep_hostname(yes); stats(3600); use_fqdn(yes); }; source syslog { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(5149) max-connections(300)); internal(); }; destination mylogfile.log { file(/var/log/syslog-ng/$HOST/mylogfile.log); }; destination boot.log { file(/var/log/syslog-ng/$HOST/boot.log); }; filter f_local7 { facility(local7); }; filter f_local5 { facility(local5); }; log { source(syslog); filter(f_local7); destination(boot.log); }; log { source(syslog); filter(f_local5); destination(mylogfile.log); }; CLIENT /etc/syslog.conf excerpt *.* @syslogngbox local7.* /var/log/boot.log local5.* /var/log/mylogfile.log

2 3