- syslog-ng - lists.balabit.hu

RE: [syslog-ng] Re: question regarding program name logs
by Justin Randall 07 Oct '06

07 Oct '06

Sorry I pasted the wrong "log" statement, here it is: log { source(src_udp); source(src_tcp); filter(fltr_PROGRAM); destination(dst_ PROGRAM); flags(final, flow-control); }; -----Original Message----- From: Justin Randall Sent: Wednesday, September 27, 2006 10:07 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Re: question regarding program name logs Hi and thanks for the response. This is actually relating to UDP logging. I have devices sending Syslog messages via UDP to a central Syslog-NG server. Usually the devices log messages to Syslog-NG via UDP in bursts (about 20-25 message within a couple seconds). The source, filter, destination, log statements for the handling are as follows: source src_udp { udp( ip(IPADDRESS) port(PORT) ); }; filter fltr_PROGRAM { program("PROGRAM") or match("PROGRAM"); }; destination dst_PROGRAM { file( "/var/log/PROGRAM/messages" owner(root) group(tomcat) perm(0640) ); }; log { source(src_udp); source(src_tcp); destination(dst_remote_system); flags(final, flow-control); }; What ends up happening when a host falls into this flow, the first log message is missed. The format of the bursts of messages are exactly the same. This did not happen in 2.0rc2, I have downgraded and verified this. Let me know if there's any other info I can provide that would help out. Regards, Justin. -----Original Message----- From: G.W. Haywood [mailto:ged@jubileegroup.co.uk] Sent: Wednesday, September 27, 2006 7:42 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Re: question regarding program name logs Hi there, On Wed, 27 Sep 2006 Justin Randall wrote: > Can anyone confirm if the patch that was to fix this issue was included > in 2.0rc3? Yes, it was. Note that it only affects logging via UDP. -- 73, Ged. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 2

Re: [syslog-ng] bug report
by G.W. Haywood 07 Oct '06

07 Oct '06

Hi there, On Fri, 6 Oct 2006 Balazs Scheidler wrote: > Syslog-ng 2.0.x ... can stop reading input messages if the output > queues are full. This can be enabled on a per-log-statement basis, > using the "flow-control" flag, like this: > > log { source(src); destination(dst); flags(flow-control); }; Hmmm. I knew I'd seen that syntax somewhere. But where...? :) 73, Ged.

2 1

Re: question regarding program name logs
by G.W. Haywood 07 Oct '06

07 Oct '06

Hi there, On Wed, 27 Sep 2006 Justin Randall wrote: > Can anyone confirm if the patch that was to fix this issue was included > in 2.0rc3? Yes, it was. Note that it only affects logging via UDP. -- 73, Ged.

2 1

RE: [syslog-ng] Re: question regarding program name logs
by Justin Randall 07 Oct '06

07 Oct '06

After upgrading and monitoring, the logs which would previously get logged incorrectly due to the angle bracket prefixing are now not being logged at all. These logs don't come in with any peculiarity about them. The only thing if interest to note is that it is always the first log message in a group of log messages (i.e. host sends 5 Syslog messages, the first one is missed). What kind of logs, information would be helpful to diagnose? I'm currently running on 2.0rc3. Regards, Justin. -----Original Message----- From: G.W. Haywood [mailto:ged@jubileegroup.co.uk] Sent: Tuesday, September 12, 2006 6:27 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Re: question regarding program name logs Hi there, On Tue, 12 Sep 2006 Justin Randall wrote: > I am currently using Syslog-NG version 2.0rc1. > > I've noticed that sometimes when Syslog-NG is logging messages, it > prefixes something onto the program name which disrupts filters > while matching against a program name. For example, in some logs > for a program named "foo" I'll see logs in the form of "<15>foo" > which fail to be matched against a filter of 'program("foo") '. > This seems to only be noticed on logs which originate from remote > hosts. > > Could anyone provide an explanation for what is going on with this? I reported this problem a couple of weeks ago, and Balazs kindly provided a patch which fixed it. I imagine the patch is in .rc2, try upgrading. -- 73, Ged. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Controlling Logging to Central Syslog-ng Server, DoS etc
by Hari Sekhon 06 Oct '06

06 Oct '06

Hi all, What is the best way to control logging to my central log server? I have read syslog-ng docs quite a lot when I was first setting it up but I don't recall seeing anything on access control. Doesn't this leave me open to DoS attacks etc? After all, you couldn't somebody just write a loop to send garbage to it and fill the whole machine up, not to mention drown out all other valid logs so you miss any important events (oops, I am giving away too much here?). I'm actually tempted to write an attack for this right now... So what do I do to stop some other person from doing this to me? I guess I could use iptables to make sure that only authorized ips can connect to my tcp and udp ports. Is there a better way I haven't thought of? -h -- Hari Sekhon

6 6

connecting to syslog-ng
by Torsten Curdt 06 Oct '06

06 Oct '06

Hi there! Is there a way to connect to a syslog-ng on a machine via a client to receive the events? ...as opposed to just having the syslog-ng pushing the event to another machine all the time. Basically I want only to connect to those machines running syslog-ng in certain situations. Like ssh root@machine tail -f /var/log/messages ...without the need for a ssh account cheers -- Torsten

6 12

FAQ site down - found temporary home
by catenate 06 Oct '06

06 Oct '06

The web site hosting the syslog-ng FAQ has been down for about two days now. This will continue for about another day (or more) until the telco guys come by and figure out where the line is broken. Until it's back up, I recommend using the copy that I put on Splunk Base: http://www.splunk.com/base/syslog-ng-faq Once www.campin.net is back up, I'll evaluate how much sense it makes to keep the FAQ in a wiki. So if you always wanted to update or reformat the FAQ - now is your chance while the FAQ is on one. I'll look closely at any mods made and be sure to keep the good ones. Note that the page isn't formatted very well, and none of the old links actually work. If you want anything from the old real site, google's cache is your friend: http://66.102.7.104/search?q=cache:meyHWPX8PUYJ:www.campin.net/syslog-ng/fa… Input appreciated. Nate Campi

2 1

proper procedure for filing bug reports
by Matt Zagrabelny 06 Oct '06

06 Oct '06

just curious what people do for bug reports with syslog-ng... thanks, -- Matt Zagrabelny - mzagrabe(a)d.umn.edu - (218) 726 8844 University of Minnesota Duluth Information Technology Systems & Services PGP key 1024D/84E22DA2 2005-11-07 Fingerprint: 78F9 18B3 EF58 56F5 FC85 C5CA 53E7 887F 84E2 2DA2 He is not a fool who gives up what he cannot keep to gain what he cannot lose. -Jim Elliot

2 1

problem with syslog-ng hanging on saturday after working all week
by Steven Meacham 06 Oct '06

06 Oct '06

Hi all, Need help. My syslog-ng is hanging on Saturdays. It is like the service just stops responding even though it is running. The system having the problem is just basically a syslog bridging/filtering server. I am using syslog-ng to accept syslog messages and filter for only what I need out of them, and then forwarding them on. It is basiclly setup like below: Webserver>>(udp 514)>syslog-ngfileterserver>>(udp1514)>Syslog Loghost Any help you could give to a newbie about debugging or find the issue would be great..Also any scripts to check the service and restart would be great to. Thanks Steven Meacham

4 4

Gentoo issues with new portage (maybe)
by Rob Munsch 04 Oct '06

04 Oct '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At least i think that's what this is. After a successful install of eventlog, i get this at syslog configure: - ----- checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... configure: error: Package requirements (eventlog) were not met: No package 'eventlog' found Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. Alternatively, you may set the environment variables EVTLOG_CFLAGS and EVTLOG_LIBS to avoid the need to call pkg-config. - ----- Why can't pkg-config find eventlog? Should i go bug Gentoo about this? (there's an eventlog ebuild, but it's masked...). And syslog-ng itself is at 1.6.9 (in ebuilds). Yeah, i looked at man pkg-config, I'm not sure how to proceed. Should i be telling p-c where to find it, or bypassing p-c entirely..? I see this: /usr/local/lib/pkgconfig/eventlog.pc which contains: - ----- prefix=/usr/local exec_prefix=${prefix} libdir=${exec_prefix}/lib includedir=${prefix}/include/eventlog Name: EventLog Description: General system logging format library Version: 0.2.5 Cflags: -I${includedir} Libs: -L${libdir} -levtlog - ----- Seems like enough info, yah? What went wrong? Anyone else on Gentoo hit this..? TIA, - -- Rob Munsch Solutions For Progress IT www.solutionsforprogress.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFIT4rBvBcJFK6xYURAsAGAKCPCygDfOkVaIoxgK5rybqRF6bavwCdHoX7 hcXJsQ1UPHt8O+kUIn0vjmE= =mt/P -----END PGP SIGNATURE-----

2 1