- syslog-ng - lists.balabit.hu

compilation errors with --enable-spoof-source
by Ravi Papisetti -X (rpapiset - HCL＠Cisco) 07 Mar '07

07 Mar '07

Hi, I am using syslog-ng 1.6.11 and trying to compile this package with ./configure --enable-spoof-source, it throws errors as below checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... ./configure: test: too many arguments configure: error: libnet-config not found It compiles fine without --enable-spoof-source this option. Could you do the needful. Thanks, Ravi Kumar P.

3 11

Re: [syslog-ng] MySQL syslog-ng regex
by Fat Wallet 06 Mar '07

06 Mar '07

Thanks Bazsi, I'd appreciate if you could send me a patch. Currently, I need to parse upto 18 arguments to before inserting into MySQL database. muchas gracius. ----- Original Message ---- From: Balazs Scheidler <bazsi(a)balabit.hu> To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Sent: Thursday, March 1, 2007 2:38:32 AM Subject: Re: [syslog-ng] MySQL syslog-ng regex On Thu, 2007-03-01 at 10:24 +0000, Hari Sekhon wrote: > one more thought, did you try ${10} or something? > > This works in shell so it's worth a try. currently syslog-ng supports max $9. It's not too difficult to add more, I'll look into it. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ____________________________________________________________________________________ Need Mail bonding? Go to the Yahoo! Mail Q&A for great tips from Yahoo! Answers users. http://answers.yahoo.com/dir/?link=list&sid=396546091

3 5

Incorrect message: SIGTERM received
by bryanh＠giraffe-data.com 05 Mar '07

05 Mar '07

If you send a SIGINT signal to Syslog-ng, it issues the message SIGTERM received, terminating Looking at the code, it uses the same code for both SIGTERM and SIGINT. I suggest the message be reworded as SIGTERM or SIGINT received, terminating -- Bryan Henderson San Jose, California

2 2

Unix datagram
by Bruno Vieira 03 Mar '07

03 Mar '07

Hello fellows. I will try to be brief with my question. I am integrating a team that is developing a system where syslog will receive messages and according to some match expressions will have to send those messages to another process. So, to do this, I have tried unix-dgram. I use Linux Ubuntu and what happens is that when I reload or stop/start syslog I get CORE DUMPED. I have made some research in the documents trying to find out the reason. What I understood was that unix.dgram only works in BSD. Is this the truth? My solution so far is to use a named pipe instead of an unix datagram socket. Tell me your opinion please. Regards, Bruno.

2 3

? Message encryption
by Andy 02 Mar '07

02 Mar '07

Hello sysloggers, Forgive my ignorance and lack of mailing list experience - I failed to figure out how to dig for information in the archives, and could find nothing in the docs. Please give some links to the archive search, or to archive FAQ, if any exist. I am responsible for monitoring and audit log collection in a very sensitive project. No cleartext communication is allowed between any nodes. Log collection server will be a Solaris based cluster (Veritas or SC or homegrown failover/loadalancing method) Under certain circumstances, tunnelling the traffic may introduce more than prevent vulnerabilities, specifically, by hiding the traffic from firewals and local packet filters. Therefore, an ideal solution for syslog so far looks like numbering and encrypting/signing each individual syslog message (obviously, on the fly, to prevent local tampering), and broadcast it to the syslog subnet for stealth pickup by both nodes of the syslog cluster. Is it something that can be acieved using syslog-ng, or the effort of building the relevant extentions for syslog-ng and to a vanilla Solaris syslog is equal? Many thanks in advance for any pointers, hints and suggestions Regards, Andrei

3 2

afinet.c:: Compilation help needed on HP-UX 11i
by Shamim 02 Mar '07

02 Mar '07

afunix.c: In function 'afunix_sd_init': afunix.c:73: warning: comparison is always true due to limited range of data type if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT afinet.o -MD -MP -MF ".deps/afinet.Tpo" \ -c -o afinet.o `test -f 'afinet.c' || echo './'`afinet.c; \ then mv -f ".deps/afinet.Tpo" ".deps/afinet.Po"; \ else rm -f ".deps/afinet.Tpo"; exit 1; \ fi afinet.c: In function 'afinet_setup_socket': afinet.c:156: error: storage size of 'mreq' isn't known afinet.c:156: warning: unused variable 'mreq' *** Error exit code 1 Stop. *** Error exit code 1 Stop. *** Error exit code 1 Stop. # uname -a HP-UX wlggh010 B.11.23 U 9000/785 2006586620 unlimited-user license # Packages installed on my Machine are # swlist |grep gcc gcc 4.1.1 gcc libgcc 4.1.1 libgcc # swlist |grep glib glib 1.2.10 glib glib2 2.12.8 glib2 # --------------------------------- New Yahoo! Mail is the ultimate force in competitive emailing. Find out more at the Yahoo! Mail Championships. Plus: play games and win prizes.

2 9

Re: syslog-ng.1.6.11
by Balazs Scheidler 02 Mar '07

02 Mar '07

On Wed, 2007-02-28 at 16:43 +0000, Michael, Desiree wrote: > > > I am installing syslog-ng on Solaris 9, and have downloaded it, and > libol, from the sunfreeware site, and have run a pkgadd to install > both. On advice from my colleague, I did not follow the INSTALL > instructions in /usr/local/doc/syslogng/INSTALL, because it did look > as though it had already been compiled. Is it correct that I think I > should end up with > > > > 1) /usr/local/sbin/syslog-ng > > 2) /etc/init.d/syslog-ng > > 3) /etc/syslog-ng/syslog.conf > > > > > > BUG 1: I only have the first file in place. The others need to be > renamed and moved out of some subdirectories. Is there any reason why > the pkgadd could not move each of the files into place? (And any > others I need, as I am left only guessing what I need to do to install > it.) > > > > BUG 2: The file /usr/local/doc/syslogng/solbuild/syslog-ng.init.d, > assuming this is the one to go in /etc/init.d, contains the following > lines which I think need editing, because we don’t > have /opt/syslog-ng. > > > > DAEMON=/opt/syslog-ng/sbin/syslog-ng > > CONFFILE=/opt/syslog-ng/etc/syslog-ng/syslog-ng.conf > > > > I do not mind doing this manually, but it seems unusual nowadays to > have to do this sort of modifying, as pkgadd usually does this. This > makes me wonder if there is a reason, for example, that I have missed > something? The sunfreeware packages are not maintained by BalaBit, please contact their maintainer. OTOH our Solaris packages do not perform init script installations either, as: 1) to replace syslogd on the system, you need a script that removes the stock syslogd configuration, this can be difficult as syslogd is not a separate package on Solaris, and it is tied into the base system. 2) once you add a postinstall script, the package cannot be installed automatically, as pkgadd will request some answers by the administrator who performs the installation from its console These might be the same reasons why the sfw packages don't add the init script, however I have no information about that. -- Bazsi

1 0

MySQL syslog-ng regex
by Fat Wallet 01 Mar '07

01 Mar '07

Hi, I am having problem inserting logs into MySQL using match() that returns more than 10 arguements. destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO mydatabase (content_name) VALUES ('$10');\n") template-escape(yes)); }; filter f_filter { match ("^.*?: \"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)$"); }; log { source(s_stunnel); filter(f_filter); destination(d_mysql); }; incoming log message is as followed: "test1","test2","test3","test4","test5","test6","test7","test8","test9","testN","testN1" catting mysql.pipe: $>cat /tmp/mysql.pipe INSERT INTO mydatabase (content_name) VALUES ('test10'); So instead of 'testN', I am getting the 'test1' appends with 0 which is 'test10' Thanks for the help! ____________________________________________________________________________________ Any questions? Get answers on any topic at www.Answers.yahoo.com. Try it now.

4 4

Observation of syslog-ng on HP-UX
by Shamim 28 Feb '07

28 Feb '07

Hi, Thanks for the help. It works now. My Observation are for HP-UX : 1. If both syslog and syslog-ng daemons are running on the system, then message sent through logger are being captured by syslog daemon only. 2. While in other OS like, AIX, Linux, Solaris message goes to both the file defined in syslog.conf and syslog-ng.conf. 3. So to captured all message on HP-UX to syslog-ng, I need to stop HP-UX's syslog daemon? Please any further comment on my Observation. Am I correct? Thanks and Regards Shamimuddin CSC India olivier rolland <madmax2010fr(a)yahoo.fr> wrote: Hi You can use logger on HP-UX using priority and Tag option For exemple logger -p local4.info -t WHATIHAVETOCATCH "My message " and you create a match filter like filter f_what {match (WHATIHAVETOCATCH);}; filter f_infolocal { level(info) and facility(local4);}; destination d_what { file(/place/fileyouwant.log);}; log { source(s_sys) ; filter(f_what); filter(infolocal) ; destination(d_what);}; Now you catch your regexp and you log messages into the file that you want. Shamim a écrit : > Hi > > Please can anyone help me how to log message to syslog-ng manually. > e.g. in Linux I can log message as # logger "test message" > ; and it goes to file defined in > syslog-ng.conf(/var/adm/messages), > > However in case of HP-UX it is not working as describe above for > Linux. Is there any other method to log message manually in HP-UX? > Or messages are dropping? > > Please suggest. > > Thanks > Shamimuddin > CSC Noida > > */olivier rolland /* wrote: > > You have to put the log device with the pad_size into your system > source. > source s_sys {pipe("/dev/log" pad_size(2048)); > internal(); }; > It's working on my system so you can try. > You can also add the klog device (/dev/klog) with same options than > /dev/log. > > Shamim a écrit : > > > > Hi, > > I've compile syslog-ng-2.0.2 on HP-UX-11.11, however messages > are not > > going to desired destinations as defined in the syslog-ng.conf . > > > > my syslog-ng.conf > > --------------------------------------------- > > # syslog-ng configuration file. > > # > > # This should behave pretty much like the original syslog on > HP-UX. But > > # it could be configured a lot smarter. > > # > > # See syslog-ng(8) and syslog-ng.conf(8) for more information. > > # > > # 20000925 gb(a)sysfive.com > > options { sync (0); > > time_reopen (10); > > log_fifo_size (1000); > > long_hostnames (off); > > use_dns (no); > > use_fqdn (no); > > create_dirs (no); > > keep_hostname (yes); > > }; > > source s_sys {internal();pipe("/dev/log"); }; > > destination d_cons { file("/dev/console1"); }; > > destination d_mesg { file("/var/adm/syslog/syslog-ng.log"); }; > > destination d_mail { file("/var/adm/syslog/mail-ng.log"); }; > > destination d_mlrt { usertty("root"); }; > > destination d_mlal { usertty("*"); }; > > filter f_filter1 { facility(mail) and level(debug); }; > > filter f_filter2 { (facility(mail) and level(debug)) or > > level(info); }; > > filter f_filter3 { level(alert); }; > > filter f_filter4 { level(emerg); }; > > log { source(s_sys); destination(d_mail); }; > > log { source(s_sys); destination(d_mesg); }; > > log { source(s_sys); destination(d_cons);destination(d_mlrt); }; > > log { source(s_sys); destination(d_mlal); }; > > # > > -------------------------------------------- > > Now If I generate message using "logger" utility on system, message > > should go to "/var/adm/syslog/syslog-ng.log", though they are > not going... > > Is there anything wrong with .conf file? > > > > What should be the conf file for central server and client on HP-UX? > > > > > > syslog-ng daemon is running like: > > > ------------------------------------------------------------------------------- > > syslog-ng service starting. > > # ps -eaf |grep syslog-ng > > root 14437 1 0 10:22:30 ? 0:00 > > /opt/soe/local/syslog-ng-2.0.2/sbin/syslog-ng -f /opt/soe/local > > # > > > ------------------------------------------------------------------------------ > > > > Thanks > > Shamim --------------------------------- What kind of emailer are you? Find out today - get a free analysis of your email personality. Take the quiz at the Yahoo! Mail Championship.

2 1

syslog-ng.conf problem on HP-UX-11.11
by Shamim 26 Feb '07

26 Feb '07

Hi, I've compile syslog-ng-2.0.2 on HP-UX-11.11, however messages are not going to desired destinations as defined in the syslog-ng.conf . my syslog-ng.conf --------------------------------------------- # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys {internal();pipe("/dev/log"); }; destination d_cons { file("/dev/console1"); }; destination d_mesg { file("/var/adm/syslog/syslog-ng.log"); }; destination d_mail { file("/var/adm/syslog/mail-ng.log"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(mail) and level(debug); }; filter f_filter2 { (facility(mail) and level(debug)) or level(info); }; filter f_filter3 { level(alert); }; filter f_filter4 { level(emerg); }; log { source(s_sys); destination(d_mail); }; log { source(s_sys); destination(d_mesg); }; log { source(s_sys); destination(d_cons);destination(d_mlrt); }; log { source(s_sys); destination(d_mlal); }; # -------------------------------------------- Now If I generate message using "logger" utility on system, message should go to "/var/adm/syslog/syslog-ng.log", though they are not going... Is there anything wrong with .conf file? What should be the conf file for central server and client on HP-UX? syslog-ng daemon is running like: ------------------------------------------------------------------------------- syslog-ng service starting. # ps -eaf |grep syslog-ng root 14437 1 0 10:22:30 ? 0:00 /opt/soe/local/syslog-ng-2.0.2/sbin/syslog-ng -f /opt/soe/local # ------------------------------------------------------------------------------ Thanks Shamim syslog-ng-request(a)lists.balabit.hu wrote: Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: Is this possible in syslog-ng.conf . (v2.0.2) (Balazs Scheidler) 2. Re: Setting permissions on log files (Balazs Scheidler) 3. Re: Is this possible in syslog-ng.conf . (v2.0.2) (Evan Rempel) 4. compilation errors with --enable-spoof-source (Ravi Papisetti -X (rpapiset - HCL at Cisco)) 5. Re: Is this possible in syslog-ng.conf . (v2.0.2) (Balazs Scheidler) 6. Re: compilation errors with --enable-spoof-source (Balazs Scheidler) 7. RE: compilation errors with --enable-spoof-source (Ravi Papisetti -X (rpapiset - HCL at Cisco)) 8. RE: compilation errors with --enable-spoof-source (Balazs Scheidler) ---------------------------------------------------------------------- Message: 1 Date: Mon, 19 Feb 2007 17:14:12 +0100 From: Balazs Scheidler Subject: Re: [syslog-ng] Is this possible in syslog-ng.conf . (v2.0.2) To: Syslog-ng users' and developers' mailing list Message-ID: <1171901652.11781.7.camel(a)bzorp.balabit> Content-Type: text/plain On Sun, 2007-02-18 at 16:48 -0800, Mr. James W. Laferriere wrote: > Ok . IMO counter intuitive , Tho reasonable with your explanation . > One is very used to the 'source' in FW/router/...'s as being the source > device(s) IP from where a packet came from . syslog-ng is not a firewall :) this is sometimes strange to me as well, being involved in firewall products as well. But putting the joke aside, syslog-ng is a "syslog message pipe" processor: sources generate messages, destinations serve as message sinks. Some filtering here and there, that's about syslog-ng's internal structure. So, naming source as a source is consistent with syslog-ng itself. > An aside , Can one do the 'Formatting' like my example above , again > no examples show up like that , but I am hopeful . > > > > To do that you need the netmask() filter. > > Next time I'll go looking at the Blog at Gmane first before shooting my > mouth off . netmask was just the hint I needed . > Tho it sure would be nice for netmask() to support the /xx bits netmask > format . It does support this format. -- Bazsi ------------------------------ Message: 2 Date: Mon, 19 Feb 2007 17:15:57 +0100 From: Balazs Scheidler Subject: Re: [syslog-ng] Setting permissions on log files To: Syslog-ng users' and developers' mailing list Message-ID: <1171901757.11781.10.camel(a)bzorp.balabit> Content-Type: text/plain On Mon, 2007-02-19 at 01:45 +0000, Bryan Henderson wrote: > With the 'file' destination, Syslog-ng modifies the ownership and > permissions of the file when it opens it. There are configuration > file options to choose what it sets them to, but AFAICT, no way to > have Syslog-ng just leave the files as it finds them. > > I prefer to maintain permissions and ownership separately; I set them > when I create the file and expect them to stick. Could there be a > configuration file option for that? > IIRC, you can use -1 for various options, which means "do not touch". But I would need to test it. The code in the C part is there, the only question that remains whether the parser accepts "-1" in the place of owner/group/permissions. -- Bazsi ------------------------------ Message: 3 Date: Mon, 19 Feb 2007 09:02:15 -0800 From: Evan Rempel Subject: Re: [syslog-ng] Is this possible in syslog-ng.conf . (v2.0.2) To: "Syslog-ng users' and developers' mailing list" Message-ID: <45D9D817.7050309(a)uvic.ca> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Balazs Scheidler wrote: > On Sun, 2007-02-18 at 16:48 -0800, Mr. James W. Laferriere wrote: > >> Ok . IMO counter intuitive , Tho reasonable with your explanation . >> One is very used to the 'source' in FW/router/...'s as being the source >> device(s) IP from where a packet came from . > > syslog-ng is not a firewall :) this is sometimes strange to me as well, > being involved in firewall products as well. But putting the joke aside, > syslog-ng is a "syslog message pipe" processor: sources generate > messages, destinations serve as message sinks. Some filtering here and > there, that's about syslog-ng's internal structure. > > So, naming source as a source is consistent with syslog-ng itself. I think that the author of the original comment was refereing to the IP address binding in the source definition source network { tcp( ip(xxxx) ); }; where the IP address is NOT the source at all, it is a local IP address to bind the listener to. Perhaps the syntax should be source network { tcp( bind(xxxx) ); }; since the bind address MUST be ip since the definition is already defined to be tcp. I think it is a little counter intuitive even within the scope of syslog-ng. Evan. > >> An aside , Can one do the 'Formatting' like my example above , again >> no examples show up like that , but I am hopeful . >> >> >>> To do that you need the netmask() filter. >> Next time I'll go looking at the Blog at Gmane first before shooting my >> mouth off . netmask was just the hint I needed . >> Tho it sure would be nice for netmask() to support the /xx bits netmask >> format . > > It does support this format. > -- Evan Rempel erempel(a)uvic.ca Senior Programmer Analyst 250.721.7691 Computing Services University of Victoria ------------------------------ Message: 4 Date: Mon, 19 Feb 2007 13:09:41 -0600 From: "Ravi Papisetti -X (rpapiset - HCL at Cisco)" Subject: [syslog-ng] compilation errors with --enable-spoof-source To: "syslog-ng(a)lists.balabit.hu" Message-ID: <5A8F8213-CAC5-4190-A902-FE91C0DC844D@mimectl> Content-Type: text/plain; charset="iso-8859-1" Hi, I am using syslog-ng 1.6.11 and trying to compile this package with ./configure --enable-spoof-source, it throws errors as below checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... ./configure: test: too many arguments configure: error: libnet-config not found It compiles fine without --enable-spoof-source this option. Could you do the needful. Thanks, Ravi Kumar P.

4 4