- syslog-ng - lists.balabit.hu

Chroot/Vserver config
by Ed W 04 Sep '07

04 Sep '07

Hi I am setting up a bunch of vserver machines on a single host (basically just a fancy chroot setup) - just looking for advice on a decent setup. 1) Would prefer not to run multiple instances of syslogd in each vserver if possible (no special reason, just seems pointless). 2) Each vserver runs multiple processes, so need a fairly fully featured set of logging for each 3) Want to keep the logs readonly, or basically untouchable in the vservers So I tried a) setting up the host system to run the /vserver/xxx/dev/log as it's source b) using destinations of the form: "/var/log/$HOST/messages", "/var/log/$HOST/mail.log", etc However, this doesn't seem to work because $HOST always shows the same name for every vhost (actually it has the name of the host server) I tried setting up syslog-ng in each vserver to log via a unix-stream to the host and again this has the same issue $HOST is always the same as the host machine What does seem to work is running syslog-ng in each vhost and logging via TCP. OR using duplicating my destination {} and log{} stanzas for every single vserver, ie basically filtering on the source{}. However, this later option seems error prone and boring to maintain, the former option seems to need extra resources and unneccesarily complicated for such a simple setup What I really want is some way that I can set some MACRO in the "source{}" stanza and then use that later on in my destinations{} - is this possible? Any other ways to achieve this? Actually I can't find any way to define custom macros, but this feature would seem to solve a lot of configuration scenarios? Grateful for any pointers Ed W

2 2

Application Log is not in Standard log format?
by Wilson Lai 04 Sep '07

04 Sep '07

Dear ALL, If the third party application logs are not the standard log format as the following error msg: “ ERROR IMAP Server Da(IMAP Server Pr) Sun Jan 14 10:16:50 2007 [OM 24070] Debug message for Lab use : imapMimeGetTextPreview: Could not open container for dref: 0006ee358745d1fc User Name: carrielou / macausjm/CN=Carrie Lou Pid of logging process: 22910 Last Msg Id: 12110767.1167991848536.JavaMail.root(a)scalix-a.macausjm.com Last Msg DirectRef: 0006c6aad146aa20 “ How could I insert this error message into the MSSQL database format? Thanks a lot!!! Regards, Wilson Lai System Engineer IT Dept., SJM Office ( : (853)2978585 Mobile ( : (853)66506709 Email +: : wilsonlai(a)macausjm.com

1 0

error sending raw frame
by James B Horwath 31 Aug '07

31 Aug '07

I recently upgraded to syslog-ng 2.0.4 running on a Red Hat AS release 4. I have the following on the system: eventlog-0.2.5-1.i386.rpm eventlog-devel-0.2.5-1.i386.rpm libnet-devel-1.1.2.1-6.i386.rpm syslog-ng-2.0.4-1.i386.rpm When I fire up syslog-ng I receive a large number of the following: Aug 30 14:36:07:2007 syslogger1 syslog-ng[31079]: Error sending raw frame; error=\'libnet_write_raw_ipv4(): -1 bytes written (Message too long)\\x0a\' Aug 30 14:36:07:2007 syslogger1 syslog-ng[31079]: Error sending raw frame; error=\'libnet_write_raw_ipv4(): -1 bytes written (Message too long)\\x0a\' Aug 30 14:36:07:2007 syslogger1 syslog-ng[31079]: Error sending raw frame; error=\'libnet_write_raw_ipv4(): -1 bytes written (Message too long)\\x0a\' I am trying to forward packets onto another log product, so I have spoof_source(yes) specified. What is the remedy for this error, am I loosing data? Please advise, Jim ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

2 1

Client forwarding to server
by mailing list 30 Aug '07

30 Aug '07

My syslog-ng is now running. However, I cannot get the client to forward its messages to the server. To be certain, I have disabled my firewall, on both the client and server side, but still get the below errors in /var/adm/messages. The client is logging normally in /var/adm/messages. Aug 29 14:54:33 client1 syslog-ng[18639]: Connection failed; error='Connection refused (146)', time_reopen='10' Aug 29 14:54:43 client1 syslog-ng[18639]: Connection failed; error='Connection refused (146)', time_reopen='10' Aug 29 14:54:53 client1 syslog-ng[18639]: Connection failed; error='Connection refused (146)', time_reopen='10' Aug 29 14:54:59 client1 syslog-ng[18639]: Log statistics; dropped='tcp(AF_INET(w.x.y.z:5140))=0', processed='center(queued)=8844', processed='center(received)=4424', processed='destination(messages)=4420', processed='destination(loghost)=4420', processed='destination(syslog)=4', processed='source(src)=4424' Aug 29 14:55:03 client1 syslog-ng[18639]: Connection failed; error='Connection refused (146)', time_reopen='10' I have "destination loghost { tcp("w.x.y.z" port(5140)); };" in my syslog-ng.conf on the client1. Here's my complete syslog-ng.conf file on the client1 side. options { long_hostnames(off); log_msg_size(8192); sync(1); log_fifo_size(2048); bad_hostname("^(ctld.|cmd|tmd|last)$"); time_reopen(10); }; source src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; destination syslog { file("/var/log/syslog"); }; destination messages { file("/var/adm/messages"); }; destination loghost { tcp("w.x.y.z" port(5140)); }; filter f_mail { facility(mail); }; filter f_not_mail { not facility(mail); }; log { source(src); filter(f_mail); destination(syslog); }; log { source(src); filter(f_not_mail); destination(messages); }; Any help/pointer is greatly appreciated. Thank you. ____________________________________________________________________________________ Building a website is a piece of cake. Yahoo! Small Business gives you all the tools to get online. http://smallbusiness.yahoo.com/webhosting

4 6

disk full memory leak
by Alexander Clouter 30 Aug '07

30 Aug '07

Hi, I hope I did not miss the memo but I think I have stumbled on a memory leak; due to my own poor administration :) When a partition fills up and syslog-ng cannot write out log files to, it seems to start soaking up memory. Looking in the output from 'top' you can see the resident memory size ('RES') creeping up and not being released. It seems to be at the rate of logging messages themselves. I'm guessing this bug has not been seen mainly as whilst syslog-ng soaks up memory unattended Linux will kill it once it soaks up all the available RAM; probably people would just assume "ahhhh syslog-ng gracefully died when it could not write out to the disk", I know I would :) It is easy to reproduce, I did it by creating a small partition of about 10MB and letting it fill up (you can hurry it along by dd'ing 8MB's worth of /dev/zero to the partition as a file). Then whilst running top you can see the memory creeping up the moment the partition fills. I found that after a day of "max'ed out partition time" syslog-ng got as high as 512MB of resident memory! I am pretty sure it is not configuration file related but if you would like a copy do ask and I will send it 'offline'. I'm running the regular 2.0.5 tarball from the website with the Debian related package patches applied from 2.0.0-1[1]. If this bug is fixed at least I will be able to lvextend/xfs_growfs a partition to 'gracefully' recover....maybe syslog-ng could flush this data polling regularly to see if it can write the data at a later time? Cheers Alex [1] http://ftp.debian.org/debian/pool/main/s/syslog-ng/syslog-ng_2.0.0-1.diff.gz

1 0

HPUX binary core dump
by Blurry 30 Aug '07

30 Aug '07

How can I figure out why syslog-ng is core dumping ? I have HPUX 11i 11.11 and I downloaded the 11.11 depot and it just says Memory Fault and renders a core dump. I had to load FLEX as a prereq. Thanks

2 3

More syslog-ng woes
by mailing list 29 Aug '07

29 Aug '07

I keep getting the below error and syslog-ng would not starts. Error in configuration, unresolved destination reference; filter='loghost' I have "log { source(loghost); };" in my log entries section, and I thought this would define "loghost" variable? Additionally, if I comment out the below section, then syslog-ng would starts and no error. log { source(src); filter(f_not_mail); filter(f_not_brightmail); destination(loghost); }; Is the above filter important/needed for syslog-ng? I'm thinking the "f_not_brightmail" is something specific if you're using brightmail, but then it would not address the "destination(loghost);" which reference loghost variable. I'm running syslog-ng 2.0.4 on Solaris 10 SPARC, and I'm referencing: http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/bk01-toc.html ...but not seeing anything referencing source(loghost); configuration. I was able to comprehend that syslog-ng.conf breaks into four parts, by referencing http://linux.cudeso.be/linuxdoc/syslog-ng.php but I'm still learning the syntax from the admin's guide above. Thanks. ____________________________________________________________________________________ Be a better Globetrotter. Get better travel answers from someone who knows. Yahoo! Answers - Check it out. http://answers.yahoo.com/dir/?link=list&sid=396545469

1 0

Re: [syslog-ng] Lost packets; UDP Checksum (chksum) errors; forwarding - source spoofing; libnet bug
by Marvin.Nipper＠Stream.com 29 Aug '07

29 Aug '07

OK... I'll spare you the more gory details. My environment is all Solaris. A Sparc-based Solaris 8 system (that I'm trying to replace), and an Intel-based Solaris 10 system (running under VMware) that is intended to be the replacement). Although we were doing forwarding in other places, this was the first time that I was able to get some reasonable statistical reporting, between two servers that were initially supposed to be getting the same data (via the forwarding). The short story is that the receiving system "seemed" to be getting a fraction of the packets, and because the environment is slightly more complex (e.g. the VMware piece) I kept ass-u-me-ing that my original problem was not related to syslog-ng, but simply to something else going wrong. When I finally did start capturing packets with snoop, and more importantly, finally moved onto using Wireshark to look at those captures, that's when I realized that all of the forwarded packets WERE, in fact, making it to the second system, but that Solaris was tossing most of them out because their (UDP header) checksum was wrong. When I finally figured that out, I had suspected libnet might be the culprit, and after doing a bit more googling, I finally found someone else complaining about the checksum issue (albeit not in regard to using libnet with syslog-ng), and posting a suggested fix that they claimed solved the problem. Now that I know what I'm looking for, I think that Mike may have addressed the problem in his 1.1.3 Beta, but every time that ever I've tried to compile that version (on several different systems), I get a bazillion compile errors, so I've never used anything other than 1.1.2.1. The short description of the problem is that it's an "odd byte issue". The checksum process is done against 2-byte chunks of data, and if the amount of data being checksum'd is an odd number, then the code was not handling that last byte properly. So... The packets with even-numbered data volumes (in my case, about 1/3 of my forwarded packets) came through just fine, but everything else looks like a corrupted packet (to the receiving OS) and gets tossed in the bin. For your reference, here's where I lucked into the discussion: http://www.securityfocus.com/archive/89/384197/30/90/threaded I had to modify his suggested fix slightly, but this is what is now documented in my own "how to build syslog-ng" documentation: --------------------------------------- >From the libnet package directory, one needs to edit the checksum module, i.e.: vi src/libnet_checksum.c Then, you will need to locate this section of code: libnet_in_cksum(u_int16_t *addr, int len) { int sum; sum = 0; while (len > 1) { sum += *addr++; len -= 2; } if (len == 1) { sum += *(u_int16_t *)addr; } return (sum); } Now, replace that section with the following (and save/quit from the editor): libnet_in_cksum(u_int16_t *addr, int len) { int sum; u_int16_t last_byte; sum = 0; last_byte = 0; while (len > 1) { sum += *addr++; len -= 2; } if (len == 1) { *(u_int8_t*)&last_byte = *(u_int8_t*)addr; sum += last_byte; } return (sum); } -------------------------------------- Obviously, there are only a couple of lines of code modified in there, but for my purposes, it was simpler to just replace the section. I am NOT a C programmer (although I used to program in a lot of other older languages!). I can't speak to whether this is the "best" solution, or not (in terms of efficiency or coding techniques). BUT, bottom line... Once I made this change, it appears that I'm no longer receiving any packet loss at all. The sample captures that I've done, and then loaded into Wireshark, are showing no checksum errors. Whether you use this coding solution, or work up one of your own, the bottom line is that 1.1.2.1 absolutely needs to be modified, in order to make source-spoofed forwarding work as intended. Let me know if you have any questions about the above information. I'll do my best to provide answers. I'd be remiss if I didn't also take this opportunity to say THANKS for all of your syslog-ng efforts. It's a fine product. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of bazsi(a)balabit.hu Sent: Wednesday, August 29, 2007 7:06 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Lost packets; UDP Checksum (chksum) errors; forwarding - source spoofing; libnet bug On Wed, 2007-08-29 at 06:58 -0600, Marvin.Nipper(a)Stream.com wrote: > OK. I've only posted here a couple of times, but I've googled this > list (for help) extensively in the past. Before I waste everyone's > time, I just wanted to find out if I'm the only one who "didn't > already know" that there's a nasty bug in libnet-1.1.2.1, such that > anybody doing source-spoofed forwarding of UDP-based syslog packets > will likely end up losing large volumes of packets in the process (in > my case a 2/3 loss of packets). > > Again. I thought that I had searched the mailing list archives > properly, and that I didn't see a mention of this issue (as I've been > fighting my way through figuring this out, over a multi-week period), > BUT, as this would seem to impact a lot of syslog-ng users, I keep > thinking that I've just missed something, and everyone else already > knows about this. Before I waste time writing a detailed message on > the topic, I figured that I'd ask first. I would appreciate if you could write about this. I don't know about anything related. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Lost packets; UDP Checksum (chksum) errors; forwarding - source spoofing; libnet bug
by Marvin.Nipper＠Stream.com 29 Aug '07

29 Aug '07

OK. I've only posted here a couple of times, but I've googled this list (for help) extensively in the past. Before I waste everyone's time, I just wanted to find out if I'm the only one who "didn't already know" that there's a nasty bug in libnet-1.1.2.1, such that anybody doing source-spoofed forwarding of UDP-based syslog packets will likely end up losing large volumes of packets in the process (in my case a 2/3 loss of packets). Again. I thought that I had searched the mailing list archives properly, and that I didn't see a mention of this issue (as I've been fighting my way through figuring this out, over a multi-week period), BUT, as this would seem to impact a lot of syslog-ng users, I keep thinking that I've just missed something, and everyone else already knows about this. Before I waste time writing a detailed message on the topic, I figured that I'd ask first. Marvin Nipper Director of Security Stream mailto:marvin.nipper@stream.com PGP Key ID: 0x8EE28551 (DSS/DH) 8C5D 403A D107 0A95 672B B637 BCF1 919A 8EE2 8551

2 1

syslog-ng error
by Javier Terceiro 29 Aug '07

29 Aug '07

Hello list, my problem is the following one, syslog-ng does not write in the corresponding files according to the configuration. The configuration says that all the packages with facility mail, are written in a file, mail.log, whereas those of facility local7 in another file, according to the priority, info in $program.info.log and error in $program.error.log. Being $program the name of the program. In config of local7 I have writes in disc the following thing: template ("$FULLDATE <> $PROGRAM --$FACILITY-- <> $MSGONLY \ n") The problem is that some of the mail message with facility (among others facility's) are written like local7, when they would not have. An example is: 2007 Aug 29 06:25:58 <> cyrus --mail-- <> DBERROR: reading /var/lib/cyrus/db/skipstamp, assuming the worst: No such file or directory 2007 Aug 29 06:25:58 <> cyrus --mail-- <> IOERROR: opening /var/lib/cyrus/mailboxes.db: No such file or directory 2007 Aug 29 05:05:45 <> kernel --kern-- <> drbd0: incompatible states And the config file is: filter f_mail { facility(mail); }; destination df_mail { file("/var/log/mail.log" template("$FULLDATE <> $PROGRAM <> $MSGONLY\n") template_escape(no)); }; log { source(s_udp); filter(f_mail); destination(df_mail); filter f_local0_err { facility(local7) and level(warn) or level(err); }; destination df_local0_err { file("/var/log/$PROGRAM.error.log" template("$FULLDATE <> $PROGRAM --$FACILITY-- <> $MSGONLY\n") template_escape(no)); }; log { source(s_udp); filter(f_local0_err); destination(df_local0_err); }; Some idea of so that this happens? -- A greeting, Javier.

2 1