- syslog-ng - lists.balabit.hu

RE: [syslog-ng] Losing TAG information
by SOLIS, ALEX 22 Jun '06

22 Jun '06

I appreciate your sympathy but it does not help me with my TAG problem. :) Anyone else have any idea how to stop syslog-ng from purging the TAG information from an AIX syslogd message. I have successfully sniffed syslog traffic between the AIX servers and my LOGHOST. The TAG (Process Name info) is definitely intact on the wire. This confirms that syslog-ng is simply parsing the log message and removing the TAG info. I did some more tests on the Linux LOGHOST using the logger utility and I found that syslog-ng does not like spaces after the TAG information. For example: 1) Logger -p syslog.info -t "TEST_TAG" "TEST_MESSAGE" Generates the log: Jun 19 08:42:38 loghost TEST_TAG: TEST_MESSAGE 2) Logger -p syslog.info -t "TEST_TAG " "TEST_MESSAGE" Generates the log: Jun 19 08:44:08 loghost : TEST_MESSAGE Example two lost the TAG information because of the space after TEST_TAG. I have considered the possibility that the messages being sent from the AIX box do not conform to syslog formatting standards and therefore syslog-ng discards the field. But I would like to know if there is anything that can be done to stop this behavior. Thanks for all responses, even sympathetic ones. :) Alex -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Tuesday, June 13, 2006 9:09 PM To: SOLIS, ALEX Subject: Re: [syslog-ng] Losing TAG information On Tue, 13 Jun 2006 10:07:33 CDT, "SOLIS, ALEX" said: (off-list reply) > I have about 20 or so AIX 4.3 servers that are sending syslog messages > to a Linux desktop running syslog-ng 1.6.5. You have my condolences. IBM dropped support for even AIX 4.3.3 several years ago - hopefully you're not having problems keeping the software running and secure... -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Tuesday, June 13, 2006 9:09 PM To: SOLIS, ALEX Subject: Re: [syslog-ng] Losing TAG information On Tue, 13 Jun 2006 10:07:33 CDT, "SOLIS, ALEX" said: (off-list reply) > I have about 20 or so AIX 4.3 servers that are sending syslog messages > to a Linux desktop running syslog-ng 1.6.5. You have my condolences. IBM dropped support for even AIX 4.3.3 several years ago - hopefully you're not having problems keeping the software running and secure... This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

3 5

unattended-gui 0.3 released -> module syslog-ng
by Mario Gzuk 22 Jun '06

22 Jun '06

Hi, with the module syslog-ng you can manage several syslog-ng servers wich are logging into several databases and tables. Search is possible over all servers as a timeline or per table. Main content of this release: Support automatic installations of the following operating systems: * Windows Xp * Windows 2003 * SuSE Linux 10.1 * Red Hat Enterprise Linux 4 * Fedora Core 5 * CentOS 4.3 * Whit Box Enterprise Linux 4 * Scientific Linux 4.3 * Aurox 11.1 New modules: * php-ssh * usersettings * dhcp-ldap * samhain * syslog-ng * ldap-manager * cron Please have a look at the documentation: http://unattended.technikz.de/index.php/Documentation If there is something missing or if you need help feel free to use the forum here: http://sourceforge.net/forum/?group_id=127437 or the mailing list: http://sourceforge.net/mail/?group_id=127437 greetings mario gzuk

1 0

Syslog-NG and STunnel
by Wolfram Schlich 22 Jun '06

22 Jun '06

I'm currently trying out this setup: - logserver at home, connected via ADSL with a fixed IPv4 subnet - IP address: 192.168.0.1 - syslog-ng listening on 127.0.0.1:514 TCP - stunnel listening on 192.168.0.1:514 TCP and connecting to 127.0.0.1:514 TCP - logclient at a remote datacenter - IP address: 172.16.0.1 - syslog-ng delivering to 127.0.0.1:514 TCP - stunnel listening on 127.0.0.1:514 TCP and connecting to 192.168.0.1:514 TCP Here are the STunnel configs: --8<--[ stunnel.conf on logserver (excluding cert/key stuff) ]--8<-- [syslog-ng] client = no accept = 192.168.0.1:514 local = 127.0.0.1 connect = 127.0.0.1:514 --8<-- --8<--[ stunnel.conf on logclient (excluding cert/key stuff) ]--8<-- [syslog-ng] client = yes accept = 127.0.0.1:514 local = 172.16.0.1 connect = 192.168.0.1:514 --8<-- This works fine so far, logs are sent over the encrypted tunnel without problems. Except one situation: the STunnel or Syslog-NG itself on the logserver goes down. Then this happens on the logclient: --8<-- syslog-ng[30119]: EOF occurred while idle; fd='33' --8<-- There are *lots* of those messages, like 20 per second. Is it possible to prevent Syslog-NG of creating such messages? -- Wolfram Schlich

2 3

priority and facility gone when using template for remote logging
by Wolfram Schlich 22 Jun '06

22 Jun '06

On the logserver the priority.facility of all incoming log messages was "user.notice" instead of the original value. I used this on the logclient: template t_remote_s { template("${DATE} ${HOST} ${MSG}\n"); template_escape(no); }; destination d_remote { udp("syslog.mydomain.tld" port(514) template(t_remote_s)); }; log { source(s_local); source(s_kernel); destination(d_remote); }; When *not* using a template for the remote destination, everything works as expected, priority.facility is back with good values. Any idea why this happens? -- Wolfram Schlich

3 4

global option chain_hostnames() not explained
by Wolfram Schlich 21 Jun '06

21 Jun '06

Unfortunately the documentation leaves it unclear what exactly chain_hostnames() does. I just guess it does something like creating a chained hostname in the form "host1/host2/host3". What about use_fqdn() in that case? Will it be "host1.example.com/host2.example.com/host3.example.com"? Am I right when I think that use_fqdn() does only take effect for the hostname where syslog-ng is currently running on? Let's say use_fqdn() is on on host1 and host3 and off on host2. I guess it would look like this then: "host1.example.com/host2/host3.example.com" Can somebody clear it up? :-) -- Wolfram Schlich

2 1

Syslog-NG (1.9) documentation issues (lots of...)
by Wolfram Schlich 21 Jun '06

21 Jun '06

Referencing the current 2.0 online manual: http://www.balabit.com/products/syslog_ng/reference-2.0/syslog-ng.html/ - Table 3.13 - TZOFFSET: documented as '-0700', is effectively '-07:00'. - DATE: description is missing. Looks like "Jun 13 15:58:00". - FULLDATE: -"-. Looks like "2006 Jun 13 15:56:57". - ISODATE: -"-. Looks like "2006-06-13T15:56:51+02:00". - UNIXTIME: -"-. Standard UNIX timestamp. - FULLHOST, HOST_FROM, FULLHOST_FROM, SOURCEIP: -"- - 3.2: - fsync(), timezone() and ts_format() are undocumented (obviously, the ts_format() part just needs to be copied from 3.5) - 3.2.2.5 usertty(): - documented to support template(), but... ...this works (of course it does): destination d_admintty { usertty("root"); }; ...this makes 'syslog-ng -s' complain about a syntax error: destination d_admintty { usertty("root" template(t_admintty)); }; - 3.5 Options: - sync() and sync_freq() are marked as obsolete with flush_lines() as the successor, unfortunately flush_lines() itself is not documented in 3.5 (only in 3.2 with a reference to the global default which is just not present). - flush_timeout() is not documented in 3.5 (only in 3.2, just like flush_lines()) Yet more to come (no time right now :-() -- Regards, Wolfram Schlich <wschlich(a)gentoo.org> Gentoo Linux * http://dev.gentoo.org/~wschlich/

3 5

Re: [syslog-ng] plain stupid?
by Jacco Rens 20 Jun '06

20 Jun '06

On 20-jun-2006, at 21:37, Leonard Mills wrote: > Jacco wrote: > >> source s_1 { udp(ip(192.168.1.2) port(514)); >> source s_2 { udp(ip(192.168.2.2) port(514)); > > Those lines have mismatched {(...)} pairs. Plain stupid thus ;-) Thanks for all replies! - jacco

1 0

plain stupid?
by Jacco Rens 20 Jun '06

20 Jun '06

Hi list, I'm trying out syslog-ng for only an hour now, and got it logging all udp traffic to one file fine, but now I think I'm doing stupid, althoug this seemed logical to me: options { use_fqdn(yes); use_dns(yes); dns_cache(yes); keep_hostname(yes); long_hostnames(on); sync(1); log_fifo_size(1024); create_dirs(yes); }; source s_1 { udp(ip(192.168.1.2) port(514)); source s_2 { udp(ip(192.168.2.2) port(514)); destination d_1 { file("/var/log/1.log"); }; destination d_2 { file("/var/log/2.log"); }; log { source(s_1); destination(d_1); }; log { source(s_2); destination(d_2); }; It poops an error: ] mini:/var/log root# syntax error at 14 Parse error reading configuration file, exiting. (line 14) Thanks for your insight. - jacco

3 2

Future releases
by Anders.Backlund＠vattenfall.com 20 Jun '06

20 Jun '06

I was looking at the syslog-ng roadmap on the balabit webpage. I am aware of that you might not have made a final decision on the subject, but I am still curious For version 2.2 you state that you will have support for the BEEP protocol. By that do you mean RFC 3195? Do you have any plans for the upcoming syslog RFC (syslog-new, syslog-sign, syslog-tls)? Anders Backlund

1 0

RE: [syslog-ng] Losing TAG information
by SOLIS, ALEX 20 Jun '06

20 Jun '06

That is interesting. Thinking it is a version problem, I upgraded syslog-ng on another machine to 1.6.9. I attempted the same test below and got the same results. A space in the tag causes the TAG information to disappear. I am curious Evan, what are your syslog-ng options? I guess now it could be my LOGHOST environment. I am running syslog-ng 1.6.9 on a gentoo linux box running kernel 2.6-15. Here is another example of what this box does: # logger -t "alex" funny # logger -t "alex " funny Results: Jun 19 11:53:04 src@lookout alex: funny Jun 19 11:53:30 src@lookout : funny These results are on a totally separate box running a new version of syslog-ng. Since it worked in Evan's example below, syslog-ng might not be the one to blame. But what other factors could cause me to lose the TAG information of a local syslog message other than the process accepting, parsing, and storing the message itself; syslog-ng? Alex -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Rempel Sent: Monday, June 19, 2006 12:50 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Losing TAG information In an AIX 5.2 machine % logger -t evan funny % logger -t "evan " funny results in Jun 19 10:47:17 casa.comp.uvic.ca casa: evan: funny Jun 19 10:47:25 casa.comp.uvic.ca casa: evan : funny In AIX 4.3.3 % logger -t evan funny % logger -t "evan " funny results in Jun 19 10:48:57 casual.uvic.ca casual: evan: funny Jun 19 10:49:03 casual.uvic.ca casual: evan : funny So, it would appear that the 1.6.8 syslog-ng does not suffer from the symptoms you describe. Evan. SOLIS, ALEX wrote: > Thank you for your reply Evan. > > So, if you attempt what I did in bullet two in the previous post below > do you get different results? If you do, then maybe I should consider > upgrading my version of syslog-ng. Thanks again. > > > Alex > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Rempel > Sent: Monday, June 19, 2006 10:38 AM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] Losing TAG information > > All I can really add is that we have a mix ov AIX 4.3.3 through 5.3 that > are logging to a linux syslog-ng 1.6.8 machine > and we are not experiencing the symptoms that you describe. I have a > couple of applications where the tag ends up being > "syslog" when it should be something else, but that is quite a bit > different than removing it entirely. > > Evan. > > SOLIS, ALEX wrote: >> I appreciate your sympathy but it does not help me with my TAG > problem. >> :) >> >> Anyone else have any idea how to stop syslog-ng from purging the TAG >> information from an AIX syslogd message. I have successfully sniffed >> syslog traffic between the AIX servers and my LOGHOST. The TAG > (Process >> Name info) is definitely intact on the wire. This confirms that >> syslog-ng is simply parsing the log message and removing the TAG info. >> >> I did some more tests on the Linux LOGHOST using the logger utility > and >> I found that syslog-ng does not like spaces after the TAG information. >> For example: >> >> 1) Logger -p syslog.info -t "TEST_TAG" "TEST_MESSAGE" >> >> Generates the log: >> >> Jun 19 08:42:38 loghost TEST_TAG: TEST_MESSAGE >> >> >> 2) Logger -p syslog.info -t "TEST_TAG " "TEST_MESSAGE" >> >> Generates the log: >> >> Jun 19 08:44:08 loghost : TEST_MESSAGE >> >> Example two lost the TAG information because of the space after >> TEST_TAG. I have considered the possibility that the messages being >> sent from the AIX box do not conform to syslog formatting standards > and >> therefore syslog-ng discards the field. But I would like to know if >> there is anything that can be done to stop this behavior. >> >> Thanks for all responses, even sympathetic ones. :) >> >> Alex >> >> >> -----Original Message----- >> From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] >> Sent: Tuesday, June 13, 2006 9:09 PM >> To: SOLIS, ALEX >> Subject: Re: [syslog-ng] Losing TAG information >> >> On Tue, 13 Jun 2006 10:07:33 CDT, "SOLIS, ALEX" said: >> >> (off-list reply) >> >>> I have about 20 or so AIX 4.3 servers that are sending syslog > messages >>> to a Linux desktop running syslog-ng 1.6.5. >> You have my condolences. IBM dropped support for even AIX 4.3.3 > several >> years ago - hopefully you're not having problems keeping the software >> running and secure... >> -----Original Message----- >> From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] >> Sent: Tuesday, June 13, 2006 9:09 PM >> To: SOLIS, ALEX >> Subject: Re: [syslog-ng] Losing TAG information >> >> On Tue, 13 Jun 2006 10:07:33 CDT, "SOLIS, ALEX" said: >> >> (off-list reply) >> >>> I have about 20 or so AIX 4.3 servers that are sending syslog > messages >>> to a Linux desktop running syslog-ng 1.6.5. >> You have my condolences. IBM dropped support for even AIX 4.3.3 > several >> years ago - hopefully you're not having problems keeping the software >> running and secure... >> >> This e-mail contains Omaha Public Power District's confidential and > proprietary information and is for use only by the intended recipient. > Unless explicitly stated otherwise, this e-mail is not a contract offer, > amendment, nor acceptance. If you are not the intended recipient you > are notified that disclosing, copying, distributing or taking any action > in reliance on the contents of this information is strictly prohibited. >> _______________________________________________ >> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >> https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >> >> > > -- Evan Rempel erempel(a)uvic.ca Senior Programmer Analyst 250.721.7691 Computing Services University of Victoria _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1