- syslog-ng - lists.balabit.hu

Eric Savidan/France/Equant is out of the office. : Re: anybody using flags(fallback) ?
by eric.savidan＠orange-ftgroup.com 11 Feb '08

11 Feb '08

I will be out of the office starting 11/02/2008 and will not return until 18/02/2008. Pour tout problème sur bongrain et valrhona, veuillez contacter M. Abdelmounim Baroudi (02 23 28 64 96) Pour tout autre problème SB Alliance, veuillez contacter M. Hervé Samson (01 44 45 12 91) Pour tout autre problème urgent, veuillez contacter Mme Gwenola Wyckens (02 23 28 33 15)

1 0

Problems with short messages
by Guy Fleegman 11 Feb '08

11 Feb '08

Hello: We have a system that sends messages to syslog-ng (Latest version 2.0.8..but this has occurred on all 2.x versions so far) This is what is happening.... An application has a message that us too long for syslog.. .so it breaks the message into 2 separate syslog messages. The first one is a length seen in wireshark of 1066 bytes. The second packet is either 69 or 70 bytes and it it simply the leftover characters 0/n/n The problem is that the filter in my syslog-ng.conf file is not catching the second smaller messages Instead of going to the file i direct it to. It goes to the default file (which i do not want) What is causing this packet to not be processed by my filter? Attached is a copy of the relevant syslog-ng.conf data as well as the actual wireshark trace information Please advise and thanks ! -Chris syslog-ng.conf file source all_devices { udp(ip(0.0.0.0) port(514)); }; destination d_catch_all_others{ file("/var/log/syslog-ng-logs/everything_else.1" perm(0644) template(t_default)); }; destination d_pt_network_device{ file("/var/log/syslog-ng-logs/pt_network_device.1" perm(0644) template(t_default)); }; filter f_all_devices { not (host(1.2.3.4) or host(2.3.4.5)); }; filter f_pt_network_device{ (host1.2.3.4) or host(2.3.4.5)); }; log { source(all_devices); filter(f_all_devices); destination(d_catch_all_others); }; log { source(all_devices); filter(f_pt_network_device); destination(d_pt_network_device); }; here is the wireshark capture No. Time Source Destination Protocol Packet length Info 1 09:14:23.073515 1.2.3.4 9.8.7.6 Syslog 1066 LOCAL2.ERR: Feb 1 09:14:23 auditd: Feb 1 14:14:23 2008 GMT f_system a_hmon t_geninfo p_major pid: 1372 ruid: 0 euid: 0 pgid: 1372 fid: 0 logid: 0 cmd: 'monitord' domain: HMON edomain: HMON hostname: perfjupiterb.bwc.state.oh.us +|health monitor|MON_INFO|MAJOR|SYS|HMONINFO\n=Health Monitor data follows\n\nuptime_util:\t 32 days\t 5:59\nload_avg:\t 0.10\nmem_percent:\t 6.09\ncpu_percent:\t 0\ntcp_count:\t 19\nudp_count:\t 8\nproxy_info:\t syslogd \t1\nproxy_info:\t named \t7\nproxy_info:\t squid \t6\nproxy_info:\t ntpd \t2\nproxy_info:\t snmpp \t2\nproxy_info:\t pudp \t63\nproxy_info:\t entrelayd \t3\nproxy_info:\t dnsp \t2\nproxy_info:\t tcpgsp:(1425) \t2\nproxy_info:\t warder_auth \t5\nproxy_info:\t sshd \t2\ntcp_data:\t ESTABLISHED\t13\ntcp_data:\t TIME_WAIT\t6\ntcp_data:\t FIN_WAIT_1\t0\ntcp_data:\t FIN_WAIT_2\t0\ntcp_data:\t CLOSE_WAIT\t0\nipf_data:\t TCP Total\t\t0\nipf_data:\t UDP Total\t\t0\nipf_total:\t Frame 1 (1066 bytes on wire, 1066 bytes captured) Arrival Time: Feb 1, 2008 09:14:23.073515000 [Time delta from previous packet: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Packet Length: 1066 bytes Capture Length: 1066 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:syslog] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_12:b4:4a (00:0f:f8:12:b4:4a), Dst: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) Destination: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) Address: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_12:b4:4a (00:0f:f8:12:b4:4a) Address: Cisco_12:b4:4a (00:0f:f8:12:b4:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 1.2.3.4 (1.2.3.4), Dst: 9.8.7.6 (9.8.7.6) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1052 Identification: 0xa1db (41435) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: UDP (0x11) Header checksum: 0xf7a4 [correct] [Good: True] [Bad : False] Source: 1.2.3.4 (1.2.3.4) Destination: 9.8.7.6 (9.8.7.6) User Datagram Protocol, Src Port: syslog (514), Dst Port: syslog (514) Source port: syslog (514) Destination port: syslog (514) Length: 1032 Checksum: 0xf9d3 [correct] [Good Checksum: True] [Bad Checksum: False] Syslog message: LOCAL2.ERR: Feb 1 09:14:23 auditd: Feb 1 14:14:23 2008 GMT f_system a_hmon t_geninfo p_major pid: 1372 ruid: 0 euid: 0 pgid: 1372 fid: 0 logid: 0 cmd: 'monitord' domain: HMON edomain: HMON hostname: perfjupiterb.bwc.sta 1001 0... = Facility: LOCAL2 - reserved for local use (18) .... .011 = Level: ERR - error conditions (3) Message [truncated]: Feb 1 09:14:23 auditd: Feb 1 14:14:23 2008 GMT f_system a_hmon t_geninfo p_major pid: 1372 ruid: 0 euid: 0 pgid: 1372 fid: 0 logid: 0 cmd: 'monitord' domain: HMON edomain: HMON hostname: perfjupiterb.bwc.state.oh.u No. Time Source Destination Protocol Packet length Info 2 09:14:23.073537 1.2.3.4 9.8.7.6 Syslog 69 LOCAL2.ERR: Feb 1 09:14:23 0\n\n Frame 2 (69 bytes on wire, 69 bytes captured) Arrival Time: Feb 1, 2008 09:14:23.073537000 [Time delta from previous packet: 0.000022000 seconds] [Time since reference or first frame: 0.000022000 seconds] Frame Number: 2 Packet Length: 69 bytes Capture Length: 69 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:syslog] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_12:b4:4a (00:0f:f8:12:b4:4a), Dst: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) Destination: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) Address: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_12:b4:4a (00:0f:f8:12:b4:4a) Address: Cisco_12:b4:4a (00:0f:f8:12:b4:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 1.2.3.4 (1.2.3.4), Dst: 9.8.7.6 (9.8.7.6) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 55 Identification: 0xa1dc (41436) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: UDP (0x11) Header checksum: 0xfb88 [correct] [Good: True] [Bad : False] Source: 1.2.3.4 (1.2.3.4) Destination: 9.8.7.6 (9.8.7.6) User Datagram Protocol, Src Port: syslog (514), Dst Port: syslog (514) Source port: syslog (514) Destination port: syslog (514) Length: 35 Checksum: 0xec1c [correct] [Good Checksum: True] [Bad Checksum: False] Syslog message: LOCAL2.ERR: Feb 1 09:14:23 0\n\n 1001 0... = Facility: LOCAL2 - reserved for local use (18) .... .011 = Level: ERR - error conditions (3) Message: Feb 1 09:14:23 0\n\n

3 3

anybody using flags(fallback) ?
by Balazs Scheidler 11 Feb '08

11 Feb '08

Hi, As I wrote earlier I'm in the process of redesigning syslog-ng internals, and some log statement flags are way more difficult to implement than with the previous model. These are: "final" -- I see the merit here, and even though it's more difficult to implement, it's worth it "fallback" -- as I see this can perfectly be substituted by a series of lost statement each with "final" flag. Using the final flag is also faster, as syslog-ng does not have to evaluate filters. What do you think? Does anyone use fallback in a way that is not possible using final? If you need more information on the flags above, it is described in the documentation: http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/ch08s03.html -- Bazsi

3 3

[Bug 12] New: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=87927
by bugzilla＠bugzilla.balabit.com 08 Feb '08

08 Feb '08

https://bugzilla.balabit.com/show_bug.cgi?id=12 Summary: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=87927 Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=87927 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I'd like to be able to include a log source within another log source, e.g.: source local { internal(); unix-stream("/dev/log"); }; source all { source("local"); udp(ip(1.2.3.4) port(514)); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

New 2.0.8 abort with use_dns(persist_only);
by Marc Wiatrowski 08 Feb '08

08 Feb '08

I had been running 2.0.7 fine. When I install and start the new 2.0.8 version I get the following error and fails to actually start if I use the the options use_dns(persist_only); and dns_cache_hosts(/etc/hosts); Syslog connection established; from='AF_INET(0.0.0.0:0)', to='AF_INET(192.168.176.3:514)' syslog-ng starting up; version='2.0.8' Incoming log entry; line='<134>id=firewall sn=00XXXXXXXX time="2008-02-05 08:34:52" fw=1.1.1.1 pri=6 c=1024 m=98 n=133049021 src=192.168.184.83:25753:HomePort proto=icmp/8 rcvd=52 \x0d\x0a' file dnscache.c: line 100 (dns_cache_key_hash): should not be reached Abort With the use_dns(no); option it runs fine. bug? thanks, marc

2 3

syslog-ng doesn't log anything with local configuration
by Uwe Galle 08 Feb '08

08 Feb '08

Hi, I am using openSUSE 10.3 with syslog-ng 1.6.12-33 with the following configuration file: # source s_file { internal(); }; destination d_file { file("/home/uga/Daten/system/system.msg"); }; log { source(s_file); destination(d_file); }; You see, it's really simple. ls -l displays for the file: -rw-rw-rw- 1 root root 0 2008-02-07 22:03 system.msg So system.msg is writable for all. But nothing is logged to the file, even after restart. The FAQ mentions a similar case (http://www.campin.net/syslog-ng/faq.html#dupe_sources) but the problem here are clearly duplicate sources in the directives. This is not the case here. Any ideas are very welcome. Thanks

3 3

syslog-ng & rewrite
by Balazs Scheidler 08 Feb '08

08 Feb '08

Hi, I've written a long blog post about my intentions regarding the rewriting functionality in syslog-ng. If you were interested in the anonimizing patches, be sure to check out. Also, the URL of my blog has changed, the old one redirects to the new one, but please update your bookmarks. The new address is: http://bazsi.blogs.balabit.com/ The RSS feed has not changed. -- Bazsi

1 0

Syslog-ng via TCP socket
by Lathrop_Steve＠emc.com 08 Feb '08

08 Feb '08

I don't see a similar issue in the archives and I went back to August 2006... I am trying to send a message following RFC3164 to a syslog-ng daemon reading from port 601 on a SLES-10 Linux machine. The format of the message is: <64>Feb 7 16:42:03 c4dev-lathrs1 TAG: smlSocket Test TCP syslog buffer msg The reason for me to send the message is to understand whether the message was delivered (not necessarily written to disk). When I send the message to a UDP port (514) on the machine, I can see the message just fine. When I send the exact same message to the TCP port, I see the receipt processing (via strace), but nothing shows up in the /var/log/messages file. The version of syslog-ng is 1.6.8 according to what is in /var/log/messages Any suggestions? The /etc/services file references 601 as being syslog-conn for both tcp and udp syslog-conn 601/tcp # Reliable Syslog Service syslog-conn 601/udp # Reliable Syslog Service The remote config file is: # # /etc/syslog-ng/syslog-ng.conf # # Automatically generated by SuSEconfig on Thu Feb 7 12:00:53 EST 2008. # # PLEASE DO NOT EDIT THIS FILE! # # you can modify /etc/syslog-ng/syslog-ng.conf.in instead # # # # File format description can be found in syslog-ng.conf(5) # and /usr/share/doc/packages/syslog-ng/syslog-ng.txt. # # # Global options. # options { long_hostnames(off); sync(0); perm(0640); stats(3600); }; # # 'src' is our main source definition. you can add # more sources driver definitions to it, or define # your own sources, i.e.: # #source my_src { .... }; # source src { # # include internal syslog-ng messages # note: the internal() soure is required! # internal(); # # the following line will be replaced by the # socket list generated by SuSEconfig using # variables from /etc/sysconfig/syslog: # unix-dgram("/dev/log"); # # uncomment to process log messages from network: # udp(ip("0.0.0.0") port(514)); tcp( ip("0.0.0.0") port(601) keep-alive(yes) ); }; # # Filter definitions # filter f_iptables { facility(kern) and match("IN=") and match("OUT="); }; filter f_console { level(warn) and facility(kern) and not filter(f_iptables) or level(err) and not facility(authpriv); }; filter f_newsnotice { level(notice) and facility(news); }; filter f_newscrit { level(crit) and facility(news); }; filter f_newserr { level(err) and facility(news); }; filter f_news { facility(news); }; filter f_mailinfo { level(info) and facility(mail); }; filter f_mailwarn { level(warn) and facility(mail); }; filter f_mailerr { level(err, crit) and facility(mail); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_local { facility(local0, local1, local2, local3, local4, local5, local6, local7); }; filter f_acpid { match('^\[acpid\]:'); }; filter f_netmgm { match('^NetworkManager:'); }; filter f_messages { not facility(news, mail) and not filter(f_iptables); }; filter f_warn { level(warn, err, crit) and not filter(f_iptables); }; filter f_alert { level(alert); }; filter f_smlInfoNotice { level(info...notice); }; filter f_smlFacility { filter(f_local) and facility(user) and facility(auth) and facility(authpriv); }; filter f_smlCrit { level(crit); }; # # Most warning and errors on tty10 and on the xconsole pipe: # destination console { file("/dev/tty10" group(tty) perm(0620)); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole" group(tty) perm(0400)); }; log { source(src); filter(f_console); destination(xconsole); }; # Enable this, if you want that root is informed immediately, # e.g. of logins: # #destination root { usertty("root"); }; #log { source(src); filter(f_alert); destination(root); }; # # News-messages in separate files: # destination newscrit { file("/var/log/news/news.crit" owner(news) group(news)); }; log { source(src); filter(f_newscrit); destination(newscrit); }; destination newserr { file("/var/log/news/news.err" owner(news) group(news)); }; log { source(src); filter(f_newserr); destination(newserr); }; destination newsnotice { file("/var/log/news/news.notice" owner(news) group(news)); }; log { source(src); filter(f_newsnotice); destination(newsnotice); }; # # and optionally also all in one file: # (don't forget to provide logrotation config) # #destination news { file("/var/log/news.all"); }; #log { source(src); filter(f_news); destination(news); }; # # Mail-messages in separate files: # destination mailinfo { file("/var/log/mail.info"); }; log { source(src); filter(f_mailinfo); destination(mailinfo); }; destination mailwarn { file("/var/log/mail.warn"); }; log { source(src); filter(f_mailwarn); destination(mailwarn); }; destination mailerr { file("/var/log/mail.err" fsync(yes)); }; log { source(src); filter(f_mailerr); destination(mailerr); }; # # and also all in one file: # destination mail { file("/var/log/mail"); }; log { source(src); filter(f_mail); destination(mail); }; # # acpid messages in one file: # destination acpid { file("/var/log/acpid"); }; log { source(src); filter(f_acpid); destination(acpid); flags(final); }; # # NetworkManager messages in one file: # destination netmgm { file("/var/log/NetworkManager"); }; log { source(src); filter(f_netmgm); destination(netmgm); flags(final); }; # # Cron-messages in one file: # (don't forget to provide logrotation config) # #destination cron { file("/var/log/cron"); }; #log { source(src); filter(f_cron); destination(cron); }; # # Some boot scripts use/require local[1-7]: # destination localmessages { file("/var/log/localmessages"); }; log { source(src); filter(f_local); destination(localmessages); }; # # All messages except iptables and the facilities news and mail: # destination messages { file("/var/log/messages"); }; log { source(src); filter(f_messages); destination(messages); }; # # Firewall (iptables) messages in one file: # destination firewall { file("/var/log/firewall"); }; log { source(src); filter(f_iptables); destination(firewall); }; # # Warnings (except iptables) in one file: # destination warn { file("/var/log/warn" fsync(yes)); }; log { source(src); filter(f_warn); destination(warn); }; # # Enable this, if you want to keep all messages in one file: # (don't forget to provide logrotation config) # #destination allmessages { file("/var/log/allmessages"); }; #log { source(src); destination(allmessages); }; # sml TEST # log { source(src); filter(f_smlCrit); destination(smlFileDest) destination(smlTcpDest); }; #log { source(src); filter(f_smlCrit); destination(smlTcpDest); }; #log { source(src); filter(f_smlInfoNotice); destination(smlFileDest); }; destination smlFileDest { file("/var/log/smlDestination" fsync(yes)); }; #log { source(src); filter(f_smlInfoNotice); destination(smlFileDest); }; #log { source(src); filter(f_smlFacility); destination(smlFileDest); }; log { source(src); destination(smlFileDest); }; __________________ Stephen M. Lathrop mailto:lathrop_steve@emc.com EMC Corporation phone: (508) 305-8596 32 Coslin Drive internal: 824-48596 Southboro, MA 01772 fax: (508) 305-8474 www.emc.com Have-a-heck-of-a-day 4 under 4 apart

2 1

file driver not usable in version 1.6.12 & version 2.0.8 not installable
by Uwe Galle 08 Feb '08

08 Feb '08

Hi, I am working with openSUSE 10.3 what comes with version 1.6.12 preinstalled. I tried to use the file driver with this version but it didn't allow me to use it. First I tried the following syslog-ng.conf file: source s_file { file("/var/log/boot.msg"); }; destination d_file { file("/home/uga/Daten/test/syslog.log"); }; log {source (s_file); destination(d_file); }; When syslog-ng was started, it displayed the following error: Re-Starting syslog servicesError opening file /var/log/boot.msg for reading (Permission denied) Error initializing configuration, exiting. startproc: exit status of parent of /sbin/syslog-ng: 1 OK, I thought, this sounds like an OS problem. I investigated the file but didn't find any problem related to permissions. Then, I tried another file and added that after the first line: source s_file { file("/var/log/boot.msg"); }; source a_file { file("/var/log/apache2/access_log"); }; destination d_file { file("/home/uga/Daten/test/syslog.log"); }; log {source (s_file); destination(d_file); }; Now I got the error: Re-Starting syslog servicesError opening file /var/log/apache2/access_log for reading (Permission denied) Error initializing configuration, exiting. startproc: exit status of parent of /sbin/syslog-ng: 1 I saw that the error related to the first file has disappeared but reappeared with the second file. That let me suspect that this error is a bug that always causes an error with the last source file in the config file. To go sure I tried a third version: source s_file { file("/var/log/boot.msg"); }; source a_file { file("/var/log/apache2/access_log"); }; source x_file { file("/home/uga/Daten/test/test.msg"); }; destination d_file { file("/home/uga/Daten/test/syslog.log"); }; log {source (s_file); destination(d_file); }; I fact, the error still appears, but not with the first two and already tested files but with the last third and new file. Now I installed the last Open Source version 2.0.8. All steps finished without error but syslog-ng -V still shows "syslog-ng 1.6.12", even after reboot. I didn't find any entry in the FAQ related to these two problems so I want to ask you to help me. Thanks.

2 1

Re: [syslog-ng] syslog-ng doesn't log anything with local configuration
by infosec＠gmail.com 08 Feb '08

08 Feb '08

Couple thoughts, probably things that you've already looked at: 1. Was that log file created by syslog-ng or by you? If by you, check for a typo (since you don't have the full path in the 'ls -l' output it's good to be sure). 2. Are you sure syslog-ng is using this config file? Pass the flag and argument to force it to that file just in case. 3. Are you sure it's really starting? If it created that logfile then it must be, but good to be sure. Unresolved library dependencies would show up on the command ine but I don't know how you're starting it. If none of these help report back to the list, there's probably some other simple explanation. Oh and I'm assuming you didn't compile it yourself (since the version is 1.6.12-33), let us know if you built it yourself. -----Original Message----- From: Uwe Galle <uga(a)domestic.de> Subj: [syslog-ng] syslog-ng doesn't log anything with local configuration Date: Thu Feb 7, 2008 3:08 pm Size: 920 bytes To: syslog-ng(a)lists.balabit.hu Hi, I am using openSUSE 10.3 with syslog-ng 1.6.12-33 with the following configuration file: # source s_file { internal(); }; destination d_file { file("/home/uga/Daten/system/system.msg"); }; log { source(s_file); destination(d_file); }; You see, it's really simple. ls -l displays for the file: -rw-rw-rw- 1 root root 0 2008-02-07 22:03 system.msg So system.msg is writable for all. But nothing is logged to the file, even after restart. The FAQ mentions a similar case (http://www.campin.net/syslog-ng/faq.html#dupe_sources) but the problem here are clearly duplicate sources in the directives. This is not the case here. Any ideas are very welcome. Thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0