- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Re: logs written twice
by Nick Baronian 01 Nov '06

01 Nov '06

Thanks again Len. So I guess the standard conf (in the examples dir) logs a lot of the same stuff to multiple files, ie. messages file and syslog file. Why do this when the syslog statement catches everything the messages catches? It isn't that big of a division of types of events so I guess that was confusing me. If I understand this right in the example file snippet- filter f_syslog { not facility(authpriv, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; The messages will only log "info, notice and warning and everything but auth, authpriv, mail and news" but the syslog will log "all levels and everything but authpriv and mail"? Is that correct, if you don't specify the level, what does it default to? -Nick On 11/1/06, Leonard Mills <Leonard_Mills(a)corpnet.sel.sony.com> wrote: > Yes, you've got it exactly correct. Processing of the > incoming packet will end when a final flag is encountered. > Things that are desired in multiple places shouldn't be > allowed encounter the final flag (maybe things like > auth.crit should appear in more than one place). > > Len

1 0

Re: [syslog-ng] Re: logs written twice
by Nick Baronian 01 Nov '06

01 Nov '06

Thanks Len, I am not sure I fully understand what final does. The site states "This flag means that the processing of log statements ends here. Note that this does not necessarily mean that matching messages will be stored only once, as there can be matching log statements processed prior the current one." Does this mean that anything below my syslog log line would not get anything, so basically like everything below doesn't exist or is commented out? -Nick On 11/1/06, Leonard Mills <Leonard_Mills(a)corpnet.sel.sony.com> wrote: > Nick wrote: > > >If I don't want the the same messages logged to both files I would > >need to remove one of the two filters, right? > > you could add the controls to your log entries, something > like: > > log { source(src); filter(f_syslog); destination(syslog); flags(final); }; > > That would keep the messages out of messages :-). > > Len > >

1 0

Re: syslog-ng Digest, Vol 19, Issue 1
by G.W. Haywood 01 Nov '06

01 Nov '06

Hi there, On Wed, 1 Nov 2006 Nick Baronian wrote: > 2. logs written twice (Nick Baronian) > I setup a syslog-ng server to get logs from various boxes and devices. > I think I am a little confused about the correct way to set this up. > I am seeing a lot of logs getting written twice. > Is there a way I can duplicate the name schema the remote box is using I don't know exactly what you mean by that, and I do't think I'd know the answer if I did. :) > [snip] > filter pump_renewal { not program("pumpd") or not level(info,debug); }; > filter imap_debug { not program("imapd") or not level(info,debug); }; > filter ipop3_debug { not program("ipop3d") or not level(info,debug); }; > filter sshd_debug { not program("sshd") or not level(debug); }; > filter f_attack_alert { match("attackalert"); }; > filter f_ssh_login_attempt { > program("sshd.*") > and match("(Failed|Accepted)") > and not match("Accepted (hostbased|publickey) for > (root|zoneaxfr) from (10.4.3.1)"); }; > [snip] If I understand what you're trying to so, I don't think you're approaching this the right way at all. Think of a filter as being like a sieve. You keep what's filtered because you want it, you don't throw it away by 'filter'ing it out. Your filter 'sshd_debug' isn't being referenced at all, so it won't give you any output. If I wanted to see ssh debug messages (assuming that the ssh daemon was logging anything at the DEBUG level) then the filter I would use would be something like filter f_sshd_debug { program("sshd") and level(debug); }; log { source(src); filter(f_sshd_debug); destination(whatever); }; The problem with using 'or' is that not program("sshd") or not level(debug) will give you stuff that ISN'T sshd if it also ISN'T debug. Check out deMorgan's theorem on the Web. If I've got the wrong end of the stick here, a flame to my personal email address is in order but one to the list isn't. :) -- 73, Ged.

1 0

RE: [syslog-ng] help- Problem with TCP Based Centralized LogServer using Syslog-ng
by Padmanabhan, Rajeesh (GE Healthcare) 31 Oct '06

31 Oct '06

Hi Bazsi, Im using a Red Hat Enterprise Linux AS 4.0 as Syslog-ng Server ( Centralized Log Server). I have got Syslog-ng 1.6 running on Solaris 8.0 and Syslog-ng 2.0rc1 running on Linux AS 4.0. All the logs from clients ( Both Linux & Solaris ) are transferred to Syslog-ng Server ( Centralized Log Server) on TCP Based communication(Destination). I restarted the Central Log Server after I noticed the error messages in Clients. After I restarted the server, server is able to accept the logs. Thanks a lot for your quick response. -Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Tuesday, October 31, 2006 4:29 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] help- Problem with TCP Based Centralized LogServer using Syslog-ng On Tue, 2006-10-31 at 14:52 +0530, Padmanabhan, Rajeesh (GE Healthcare) wrote: > Hi > > Im trying to setup a centralized, TCP Based Log Server using > Syslog-ng. Syslog-ng server stops accepting logs from clients > intermediatley. > It works again, once i restart the syslog-ng server. Im getting > following error messages from clients. > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Oct 18 10:29:28 System1 syslog-ng[11745]: Connection broken; > time_reopen='60' > Oct 18 15:06:26 RADIUM syslog-ng[4999]: io.c: do_write: write() failed > (errno 32), Broken pipe Oct 18 15:06:26 RADIUM syslog-ng[4999]: > pkt_buffer::do_flush(): Error flushing data Oct 18 15:06:26 RADIUM > syslog-ng[4999]: Connection broken to AF_INET(10.70.201.233:514), > reopening in 10 seconds > syslog-ng[13843]: Connection failed; error='Connection refused > (111)', time_reopen='60 > syslog-ng[302]: Error connecting to remote host > AF_INET(10.70.201.233:514), reattempting in 10 seconds > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Please help me... > I'm sorry but you need to give further details, like OS, architecture syslog-ng version that you used. When did you receive the messages above? after restarting syslog-ng or was this the reason why you restarted syslog-ng in the first place? Because restarting syslog-ng naturally breaks existing connections and there's a small race of opportunity while the port is closed and clients try to connect to it, in this case you get connection refused. So all in all we'd need more information in order to help you. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

logs written twice
by Nick Baronian 31 Oct '06

31 Oct '06

I setup a syslog-ng server to get logs from various boxes and devices. I think I am a little confused about the correct way to set this up. I am seeing a lot of logs getting written twice. For instance I have some old Unix boxes logging to it and some Linux boxes. The old Unix boxes log to a syslog file for most stuff and the Linux boxes log most stuff to the messages file. I have some cisco devices that I wanted to log to particular filename but it is getting written to the custom filename and being duplicated to a syslog file, plus it is writing a messages file which is not an exact duplicate for some reason. I am guessing my reason is because I have stuff like filter f_syslog { not facility(auth, authpriv) and not facility(mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail); }; destination syslog { file("/u01/log/$HOST/syslog"); }; destination messages { file("/u01/log/$HOST/messages"); }; Is there a way I can duplicate the name schema the remote box is using or do I need to say all syslog type events goto blah file and such? My conf looks like options { chain_hostnames(no); create_dirs (yes); dir_perm(0750); dns_cache(no); keep_hostname(no); log_fifo_size(2048); log_msg_size(8192); perm(0640); stats(3600); sync(0); time_reopen (10); use_dns(no); use_fqdn(yes); }; source src { unix-dgram("/dev/log"); internal(); udp(); tcp(); }; destination authlog { file("/u01/log/$HOST/auth.log"); }; destination syslog { file("/u01/log/$HOST/syslog"); }; destination cron { file("/u01/log/$HOST/cron.log"); }; destination daemon { file("/u01/log/$HOST/daemon.log"); }; destination kern { file("/u01/log/$HOST/kern.log"); }; destination lpr { file("/u01/log/$HOST/lpr.log"); }; destination user { file("/u01/log/$HOST/user.log"); }; destination uucp { file("/u01/log/$HOST/uucp.log"); }; destination debug { file("/u01/log/$HOST/debug"); }; destination messages { file("/u01/log/$HOST/messages"); }; destination bootlog { file("/u01/log/$HOST/boot.log"); }; destination mail { file("/u01/log/$HOST/mail.log"); }; destination maillog { file("/u01/log/$HOST/maillog"); }; destination mailinfo { file("/u01/log/$HOST/mail.info"); }; destination mailwarn { file("/u01/log/$HOST/mail.warn"); }; destination mailerr { file("/u01/log/$HOST/mail.err"); }; destination cisco_asa { file("/u01/log/$HOST/cisco_asa.log"); }; destination console { usertty("root"); }; filter cr_asa { facility(local5); }; filter pump_renewal { not program("pumpd") or not level(info,debug) ; }; filter imap_debug { not program("imapd") or not level(info,debug) ; }; filter ipop3_debug { not program("ipop3d") or not level(info,debug); }; filter sshd_debug { not program("sshd") or not level(debug); }; filter f_attack_alert { match("attackalert"); }; filter f_ssh_login_attempt { program("sshd.*") and match("(Failed|Accepted)") and not match("Accepted (hostbased|publickey) for (root|zoneaxfr) from (10.4.3.1)"); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv) and not facility(mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail); }; filter f_emergency { level(emerg); }; filter f_bootlog { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_daemon); destination(messages); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_kern); destination(messages); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(messages); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); destination(maillog); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(cr_asa); destination(cisco_asa); }; Thanks, Nick

1 0

help- Problem with TCP Based Centralized Log Server using Syslog-ng
by Padmanabhan, Rajeesh (GE Healthcare) 31 Oct '06

31 Oct '06

Hi Im trying to setup a centralized, TCP Based Log Server using Syslog-ng. Syslog-ng server stops accepting logs from clients intermediatley. It works again, once i restart the syslog-ng server. Im getting following error messages from clients. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Oct 18 10:29:28 System1 syslog-ng[11745]: Connection broken; time_reopen='60' Oct 18 15:06:26 RADIUM syslog-ng[4999]: io.c: do_write: write() failed (errno 32), Broken pipe Oct 18 15:06:26 RADIUM syslog-ng[4999]: pkt_buffer::do_flush(): Error flushing data Oct 18 15:06:26 RADIUM syslog-ng[4999]: Connection broken to AF_INET(10.70.201.233:514), reopening in 10 seconds syslog-ng[13843]: Connection failed; error='Connection refused (111)', time_reopen='60 syslog-ng[302]: Error connecting to remote host AF_INET(10.70.201.233:514), reattempting in 10 seconds ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Please help me... Thanks in advance. Rajeesh

2 1

which syslog-ng version support default filter rule to uncaught messages?
by Csuti Istvan 31 Oct '06

31 Oct '06

I use syslog-ng 1.6.5-2.2 on debian sarge, and I try DEFAULT filter to manage uncaught messages. log { source(s_sys); filter(DEFAULT); destination(df_facility_other); }; When I restart syslog-ng daemon, I get a following error message: Starting system logging: syslog-ngunresolved reference: DEFAULT Error initializing configuration, exiting. start failed. The Question: Which syslog-ng version support the DEFAULT filter rule? Or, I must compile the pached source version? Istvan Csuti

2 1

Idea for streaming logs to my workstation as well as logserver
by Hari Sekhon 31 Oct '06

31 Oct '06

I have a cunning idea. When I first set up a logserver, I also had it log to tty12, and a monitor next to my desk of the server with the network logs streaming down the screen. This was very interesting and I managed to pick up quite a lot about my network by noticing when a sudden screen full of information would whizz by instead of the usual incremental logs coming in. I would like to implement something similar by having the logserver also send on it's logs to my linux workstation by way of udp. I could then have my local syslog-ng listen for this udp and write it to a pipe (similar to the way you integrate mysql with syslog-ng). I would then like to have root-tail read from this pipe and output to my X background so that I have a continuous stream of network logs in the background. Are there any pitfalls that you can think of when doing this? I don't think this will risk filling up the bit bucket on the logserver since the logs are immediately sent on via udp, "spray and pray". If they don't get to my workstation for any reason, no harm done, it won't clog up the logserver. I guess the root-tail will take a bit out of my workstation having to draw on the X background all the time but it's a fast machine. I believe that it would block my local syslog-ng on my workstation if the root-tail were to stop reading from it. Which brings me to my next question: Is it better to do root-tail /var/log/logstream.pipe or root-tail - < /var/log/logstream.pipe Since I'm not sure that the first will take the actual throughput away from the pipe to stop the logger from blocking on the sending side. Also, this would require that the my X session not be closed otherwise the root-tail wouldn't be able to run to take away the logs from the other side of the pipe and the local logger would block again. All feedback welcome. Thanks. -h -- Hari Sekhon

2 3

Re: [syslog-ng] runaway programs started by syslog-ng
by Dev Man 30 Oct '06

30 Oct '06

A followup... On a test server, I have noticed that when the system reboots there is one instance of syslog-ng but two instances of the program being executed. There should only be one. If I do a /etc/init.d/syslog-ng restart, then I end up with just one instance of the program as expected, and the system appears to be fine. Any ideas?

3 2

2.0RC4 make warning on OS X 10.4.8 PPC G4
by Mr. Brian Opitz 30 Oct '06

30 Oct '06

System is OS X 10.4.8, Xcode 2.4, PPC G4(2.7), configure --enable-debug --enable-dynamic-linking I am seeing the following warnings during compiling 2.0RC4: logmsg.c: In function 'log_msg_parse': logmsg.c:149: warning: pointer targets in assignment differ in signedness logmsg.c:212: warning: pointer targets in passing argument 2 of 'g_string_assign_len' differ in signedness logmsg.c:214: warning: pointer targets in assignment differ in signedness logmsg.c:232: warning: pointer targets in passing argument 1 of 'strlen' differ in signedness logmsg.c:271: warning: pointer targets in passing argument 2 of 'g_string_assign_len' differ in signedness logmsg.c:309: warning: pointer targets in assignment differ in signedness logmsg.c:313: warning: pointer targets in assignment differ in signedness logmsg.c:344: warning: pointer targets in assignment differ in signedness logmsg.c:378: warning: pointer targets in assignment differ in signedness logmsg.c:389: warning: pointer targets in assignment differ in signedness logmsg.c:401: warning: pointer targets in assignment differ in signedness logmsg.c:413: warning: pointer targets in assignment differ in signedness logmsg.c:435: warning: pointer targets in assignment differ in signedness logmsg.c:440: warning: pointer targets in assignment differ in signedness logmsg.c:445: warning: pointer targets in passing argument 2 of 'g_string_assign_len' differ in signedness and: affile.c: In function 'affile_dd_init': affile.c:456: warning: comparison is always false due to limited range of data type affile.c:462: warning: comparison is always false due to limited range of data type and: afuser.c: In function 'afuser_dd_queue': afuser.c:57: warning: implicit declaration of function 'getutent' afuser.c:57: warning: assignment makes pointer from integer without a cast and finally: gsockaddr.c: In function 'g_accept': gsockaddr.c:116: warning: pointer targets in passing argument 3 of 'accept' differ in signedness Can these safely be ignored or is there something that needs to be changed to make them go away? --

5 5