- syslog-ng - lists.balabit.hu

particular source
by luigi augello 13 Nov '07

13 Nov '07

hello I need to use a source file as some as source src_backup { file ('/log//192.168.2.180/LOG.$S_MONTH$S_YEAR' log_prefix("Log backup: ")); }; It is possible I tried but don't work Tanks.. Regards Luigi

2 1

syslog-ng not relaying snort 2.6 events properly.
by Mike Fratto 12 Nov '07

12 Nov '07

I have been playing with macros to ensure messages are reformatted to a consistent format. I am viewing the events on the wire using tcpdump on the syslog-ng relay. The first event comes from snort. The second event is sent from syslog-ng. Note the sent message is [|syslog]. This same macro (the syslog-ng.conf file is pasted below) works with other syslog sources. Any thoughts on what the problem is? 10:39:29.810836 IP (tos 0x0, ttl 63, id 60806, offset 0, flags [DF], proto UDP (17), length 183) 192.168.14.13.syslog > 192.168.17.212.syslog: SYSLOG, length: 155 Facility local5 (21), Severity alert (1) Msg: snort[433]: [1:466:5] ICMP L3retriever Ping [Classification: Attempted Information Leak] [Priority: 2]: <eth2> {ICMP} 192.168.17.220 -> 192.168.14.44\012 10:39:29.810968 IP (tos 0x0, ttl 64, id 10591, offset 0, flags [DF], proto UDP (17), length 178) 192.168.17.212.32848 > 192.168.17.198.syslog: [|syslog] # Options options { chain_hostnames(no); keep_hostname(no); use_time_recvd(no); }; # network syslog listener source s_udp { udp(); unix-stream("/dev/log"); }; # Strip headers because syslog-ng wants to add them template strip_header { template("$MSG\n"); template_escape(no); }; #hosts that should have headers stripped filter strip_header_hosts { host("192.168.14.5")or host("example") or host("example.com") or host("mail.example.com") or host("mail") or host("192.168.14.13") or host("snort") or host("snort.example.com") ; }; destination d_test {udp("192.168.17.198"); }; destination d_strip_test {udp("192.168.17.198" template (strip_header)); }; log { source(s_udp); filter(strip_header_hosts); destination(d_strip_test); flags(final); }; log { source(s_udp); destination(d_test); flags(final); };

3 2

syslog-ng relay pre-pends headers
by Mike Fratto 08 Nov '07

08 Nov '07

I know this has been asked alot, but I haven't found a working answer (after much failed googling and reading the admin guide). I am using syslog-ng 2.0.5 on Fedora 7. I am trying to relay syslog messages. Syslog messages sent to syslog-ng in the format: "priority datestamp host message" are being relayed as "priority "datestamp of syslog-ng" "hostname of syslog-ng" "datestamp orig" "hostname original" message" I have chain_hostnames(no) defined and I restarted syslog-ng (the options stanza is below) but still the headers are pre-pended. Any advice? # Options options { chain_hostnames(no); keep_hostname(yes); use_time_recvd(no); };

2 4

Question about Syslog
by FRANCIS PROVENCHER 06 Nov '07

06 Nov '07

Hi all, I configure a central syslogger. In my syslog-ng.conf destination "servername" { file("/var/log/"servername"/$YEAR/$MONTH/$DAY/$HOST.log" owner(root) group(wheel) perm(0600) dir_perm(0700) create_dirs(yes)); }; But the syslog call/errors from "servername" is write in /var/log/messages ... What i'm making wrong? thanks for your help Francis Provencher Ministère de la Sécurité publique du Québec Direction des technologies de l'information Division de la sécurité informatique Tél: 1 418 646-3258 Courriel: Francis.provencher(a)Msp.gouv.qc.ca CEH - Certified Ethical Hackers SSCP - System Security Certified Practitionner Sec+ - Security +

4 8

Connection broke using remote syslog-ng clients
by LESOUEF Emmanuel 05 Nov '07

05 Nov '07

Hello, I'm getting this kind of logs (facility syslog) on my central syslog-ng server : Oct 31 12:08:10 lxnetmgmt syslog-ng[8698]: EOF occurred while idle; fd='6' Oct 31 12:08:10 lxnetmgmt syslog-ng[8698]: Connection broken; time_reopen='10' Oct 31 12:08:20 lxnetmgmt syslog-ng[8698]: Connection failed; error='Connection refused (111)', time_reopen='10' It occurs after restarting the central syslog-ng server. These messages come from remote hosts sending their logs via tcp to the central syslog-ng server. Any idea ? Thanks for your help. -- Emmanuel Lesouef DSI | CRBN t : 0231069671 m : e.lesouef(a)crbn.fr

3 2

Patch submission
by Philip Bellino 03 Nov '07

03 Nov '07

Hello, Could someone provide me with directions on how to submit a patch to the open source 2.0.5 syslog-ng? Thanks, Phil Bellino Phil Bellino Software Engineer MRV Communications, Inc. 295 Foster Street Littleton, MA. 01460 Phone: 978-952-4807 Fax: 978-952-5444 Email: pbellino(a)mrv.com <http://www.mrv.com/>

2 3

timezone issues
by Campbell Simpson 03 Nov '07

03 Nov '07

Hi I'm having problems using the timezone() function on my source drivers. My syslog-ng server is set up to receive syslog messages from the network. The servers sending to it are set to GMT+0 and the timezone information is not sent in the syslog messages. I would like to be able to do a conversion on the received time stamp and write the time to a fifo buffer in localtime on the syslog box. I'm running syslog-ng 2.0.5 on Redhat Enterprise. My config looks like: options { sync (20); stats_freq (60); dns_cache (yes); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (persist_only); dns_cache_hosts(/etc/hosts); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_net { udp(port(514) time_zone(+00:00)); }; destination splunk1 { pipe("/var/data/syslog.fifo" template("$DATE $TZ - $R_TZ - $S_TZ $HOST $MSG\n")); }; destination splunk2 { pipe("/var/data/syslog2.fifo"); }; destination aaatransact { file("/var/data/aaatransact.log"); }; destination aaaprocess { file("/var/data/aaaprocess.log"); }; log { source(s_net); filter(f_local4); destination(splunk1); }; log { source(s_net); filter(f_local4); destination(aaatransact); }; log { source(s_net); filter(f_local5); destination(splunk2); }; log { source(s_net); filter(f_local5); destination(aaaprocess); }; The output to /var/data/syslog.fifo however looks like: Oct 26 00:39:55 +13:00 - +13:00 - +13:00 blah blah blah It doesn't matter what I change the time_zone value to, it always gets reported as +13:00. Even setting the global recv_time_zone doesn't change anything... Anyone got any ideas? Thanks Campbell

2 1

syslog-ng crashing at startup
by Shashank Vinchurkar 03 Nov '07

03 Nov '07

Hi, I have cross compiled syslog-ng-2.0.5 for 64bit mips processor. I am using glib-2.12.13. syslog-ng server crashes at startup. Here is the stack trace of the crash: Reading symbols from /lib64/libnsl.so.1...done. Loaded symbols for /lib64/libnsl.so.1 Reading symbols from /lib64/librt.so.1...done. Loaded symbols for /lib64/librt.so.1 Reading symbols from /syslog-ng/lib/libglib-2.0.so.0...done. Loaded symbols for /syslog-ng/lib/libglib-2.0.so.0 Reading symbols from /syslog-ng/lib/libevtlog.so.0...done. Loaded symbols for /syslog-ng/lib/libevtlog.so.0 Reading symbols from /lib64/libc.so.6...done. Loaded symbols for /lib64/libc.so.6 Reading symbols from /lib64/libpthread.so.0...done. Loaded symbols for /lib64/libpthread.so.0 Reading symbols from /lib64/ld.so.1...done. Loaded symbols for /lib64/ld.so.1 Core was generated by `./syslog-ng -v -d -F -f /syslog-ng/syslog-ng.conf'. Program terminated with signal 11, Segmentation fault. #0 0x0000005555bd9a30 in free () from /lib64/libc.so.6 (gdb) bt #0 0x0000005555bd9a30 in free () from /lib64/libc.so.6 #1 0x000000012000e6a8 in log_msg_clear_matches (self=0x120133e10) at logmsg.c:512 #2 0x000000012000f790 in log_msg_unref (self=0x120133e10) at logmsg.c:532 #3 0x0000000120012984 in log_writer_fd_dispatch (source=<value optimized out>, callback=<value optimized out>, user_data=<value optimized out>) at logwriter.c:324 #4 0x00000055558cdf84 in IA__g_main_context_dispatch (context=0x120133560) at gmain.c:2045 #5 0x00000055558d1a68 in g_main_context_iterate (context=0x120133560, block=1, dispatch=1, self=<value optimized out>) at gmain.c:2677 #6 0x00000055558d2298 in IA__g_main_context_iteration (context=0x120133560, may_block=1) at gmain.c:2736 #7 0x0000000120006b34 in main_loop_run (cfg=0xffffc61930) at main.c:164 #8 0x000000012000715c in main (argc=<value optimized out>, argv=<value optimized out>) at main.c:426 Thanks for the help in advance. -Shashank

2 1

Eric Savidan/France/Equant is out of the office. : Eric Savidan/France/Equant is out of the office. :Question about Syslog
by eric.savidan＠orange-ftgroup.com 02 Nov '07

02 Nov '07

I will be out of the office starting 02/11/2007 and will not return until 06/11/2007.

1 0

Eric Savidan/France/Equant is out of the office. : Question about Syslog
by eric.savidan＠orange-ftgroup.com 02 Nov '07

02 Nov '07

I will be out of the office starting 02/11/2007 and will not return until 06/11/2007.

1 0