- syslog-ng - lists.balabit.hu

Fulldate in log files
by Gustavo Mendes de Carvalho 02 Feb '06

02 Feb '06

Hi All, Actually, I have my syslog-ng configured as shown bellow. Jan 29 12:17:01 linux1 CRON[31468]: message itself My conf file has this statements # begin of log conf file source s_all { unix-stream("/dev/log"); internal(); }; destination d_auth { file("/var/log/auth.log"); }; destination d_syslog { file("/var/log/syslog"); }; destination d_cron { file("/var/log/cron.log"); }; filter f_auth { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; log { source(s_all); filter(f_auth); destination(d_auth); }; log { source(s_all); filter(f_syslog); destination(d_syslog); }; log { source(s_all); filter(f_cron); destination(d_cron); }; log { source(s_all); filter(f_daemon); destination(d_daemon); }; # end of log conf file How can I do to put a full date (including year) in this logfile ? Thanks in advance Gustavo

1 0

strange message handling in syslog-ng
by BURRUSS, RICHARD S (ASI) 02 Feb '06

02 Feb '06

Hello all, I am trying to set up a new central syslogd server. I want to keep logging locally as well as on the new server. I have my syslogd.conf from the local machines and my syslog-ng.conf from the central server listed below. The problem I am having is that some messages being sent to the log server are not being sorted by their hostname field. They are instead being broken down into many different directories as shown in the example below. So, instead of the message going to the correct directory for that hostname it is creating numerous new directories with the name of that part of the message beginning with a ".". Odd. I can't figure out why it is these messages are being handled this way. Can anyone help please? Example of the directories being created. The first seven entries should not be there. # cd /var/log/HOSTS # ls -la total 28 drwx------ 14 root root 512 Jan 26 22:31 . drwxr-xr-x 6 root sys 512 Jan 11 10:44 .. drwx------ 3 root root 512 Jan 26 22:31 .Cmd drwx------ 3 root root 512 Jan 26 22:31 .Disconnected drwx------ 3 root root 512 Jan 26 22:29 .SCSI drwx------ 3 root root 512 Jan 26 22:31 .got drwx------ 3 root root 512 Jan 26 22:31 .pkt_flags=0x4000 drwx------ 3 root root 512 Jan 26 22:31 .pkt_scbp=0x0 drwx------ 3 root root 512 Jan 26 00:02 SRS drwx------ 3 root root 512 Jan 11 15:18 dbln-jumpstart drwx------ 3 root root 512 Jan 25 15:33 eight drwx------ 3 root root 512 Jan 11 11:23 ndpsunray1 drwx------ 3 root root 512 Jan 11 13:27 ndpsunray2 drwx------ 3 root root 512 Jan 25 15:26 nine # syslogd.conf #ident "@(#)syslog.conf 1.4 96/10/11 SMI" /* SunOS 5.0 */ # # Copyright (c) 1991-1993, by Sun Microsystems, Inc. # # syslog configuration file. # # This file is processed by m4 so be careful to quote (`') names # that match m4 reserved words. Also, within ifdef's, arguments # containing commas must be quoted. # # *.err;kern.notice;auth.notice /dev/console kern.notice;user.err /dev/console kern.notice @loghost auth.info /var/adm/messages auth.info @loghost *.err;daemon.none;kern.info;mail.crit /var/adm/messages *.err;daemon.none;kern.info;mail.crit @loghost daemon.crit /var/adm/messages daemon.crit @loghost daemon.notice /var/adm/messages daemon.notice @loghost *.alert;kern.err;daemon.err operator *.alert root *.emerg * mail.info /var/adm/messages mail.debug @loghost user.alert @loghost user.alert /var/adm/messages syslogd-ng.conf # # syslog-ng package built by Nate Campi <nate(a)campin.net> # # This should behave pretty much like the original syslog on SunOS. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { sun-stream ("/dev/log" door("/etc/.syslog_door")); }; source net { udp(); }; source s_internal { internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/adm/messages"); }; destination d_mail { file("/var/log/syslog"); }; destination d_auth { file("/var/log/authlog"); }; destination d_mlop { usertty("operator"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; destination std { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$FACILITY$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) );}; filter f_filter1 { level(err) or (level(notice) and facility (auth, kern)); }; filter f_filter2 { level(err) or (facility(kern) and level(notice)) or (facility(daemon) and level(notice)) or (facility(mail) and level(crit)); }; filter f_filter3 { level(alert) or (facility(kern) and level(err)) or (facility(daemon) and level(err)); }; filter f_filter4 { level(alert); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(kern) and level(notice); }; filter f_filter7 { facility(mail) and level(debug); }; filter f_filter8 { facility(user) and level(err); }; filter f_filter9 { facility(user) and level(alert); }; log { source(net); destination(std); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_mlop); }; log { source(s_sys); filter(f_filter4); destination(d_mlrt); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_auth); }; log { source(s_sys); filter(f_filter7); destination(d_mail); }; log { source(s_sys); filter(f_filter8); destination(d_cons); destination(d_mesg); }; log { source(s_sys); filter(f_filter9); destination(d_mlop); destination(d_mlrt); }; log { source(s_internal); destination(d_mesg); }; Thanks for looking,

2 1

io.c: do_read: read( ) failed (errno 1), Operation not permitted
by Rick.Daoust＠borealc.on.ca 01 Feb '06

01 Feb '06

I installed syslog-ng version 1.6.9 on Fedora Core 4 in a chroot jail and when starting it, I receive the following message "io.c: do_read: read( ) failed (errno 1), Operation not permitted". I believe this message is the result of syslog-ng not being able to read from /proc/kmsg. However, I'm a newbie to Linux and Sylog-ng! Any suggestions would be greatly appreciated!

4 4

Inserting text in syslog messages
by Gustavo Mendes de Carvalho 31 Jan '06

31 Jan '06

Dear All, Does anybody knows how to insert some string in a message that will be apended in log files ? I mean, imagine that syslog-ng receives this message to insert in /var/log/auth.log. Jan 31 13:18:01 host sshd[6278]: Accepted keyboard-interactive/pam for user from 10.10.0.29 port 49105 ssh2 And I would like to insert some text together, resulting in some like this Jan 31 13:18:01 host sshd[6278]: Accepted keyboard-interactive/pam for root from 10.10.0.29 port 49105 ssh2 - service xyz for user root How can I include this string " - service xyz for user root" ? I know that it's possible, but I didn't find how to. Thanks in advance Gustavo

2 1

SuSE 10.0 - Changing permissions on special file /dev/xconsole
by George 30 Jan '06

30 Jan '06

Hello, I am getting the following in my /var/log/warn file at each bootup. What is it about and how do I fix it? Jan 26 06:26:52 dns1 syslog-ng[3430]: Changing permissions on special file /dev/xconsole Jan 26 06:26:52 dns1 syslog-ng[3430]: Changing permissions on special file /dev/tty10 I have SuSE 10.0 installed on a IBM X330 (8654-51Y) eserver xseries with a dual Pentium III (x84) and a S3 Savage 4 video card. Thanks, George -- George genz1968(a)fastmail.fm -- http://www.fastmail.fm - One of many happy users: http://www.fastmail.fm/docs/quotes.html

2 3

Newbie
by ajc80＠o2.co.uk 29 Jan '06

29 Jan '06

Hello, I'm a newbie to syslog-ng, I have followed the instructions and used and altered the necessary examples to suit my directory structures, so my syslog messages are dumped in to mysql database. I'm using: syslog-ng-1.6.8 libol-0.3.16 mysql 3.23.58 When starting syslog-ng I get the following messages: # /etc/init.d/syslog-ng start Starting MySQL pipe... Starting syslog-ng... Warning: No source refers to internal messages, they'll go to /dev/null unresolved reference: inputs Error initializing configuration, exiting. The "No source refers to internal messages...." message I understand. The "unresolved reference: inputs" I don't and can't seem to find anything in the archives. I've included the syslog-ng.conf file and the mysql.pipe file below. Any help would be appreciated. Thanks, Adrian. ************ /etc/init.d/mysql.pipe *********** #!/bin/sh # # Script to create a named pipe so syslog-ng messages # can be sent to a MySQL database # if [ -p /var/run/mysql.pipe ]; then mysql -u xxxxxxx --password=xxxxxxx logs < /var/run/mysql.pipe & else mkfifo /var/run/mysql.pipe mysql -u xxxxxx --password=xxxxxx logs < /var/run/mysql.pipe & fi ************ /etc/syslog-ng/syslog-ng.conf *********** ##################################################################### # syslog-ng central log host configuration file # # installed: 29/01/2006 13:18 # ##################################################################### # General options options { check_hostname(yes); keep_hostname(yes); chain_hostnames(no); }; # Other important general options # use_fqdn(yes); # sync(0); # keep_hostname(yes); # chain_hostnames(no); # create_dirs(yes); ##################################################################### # Define syslog input stream # This is specific to Solaris 9 # source inputs { internal(); # sun-streams("/dev/log" door("/var/run/syslog_door")); # tcp(max_connections(1000)); }; # For newer versions of Linux (Debian GNU/Linux woody, # and RedHat Linux post 7.0) # source stdlog { unix-dgram("/dev/log"); }; ##################################################################### # Define filters # Level Filters filter f_emerg { level (emerg); }; filter f_alert { level (alert .. emerg); }; filter f_crit { level (crit .. emerg); }; filter f_err { level (err .. emerg); }; filter f_warning { level (warning .. emerg); }; filter f_notice { level (notice .. emerg); }; # Facility Filters filter f_kern { facility (kern); }; filter f_user { facility (user); }; filter f_mail { facility (mail); }; filter f_daemon { facility (daemon); }; filter f_auth { facility (auth); }; filter f_syslog { facility (syslog); }; filter f_lpr { facility (lpr); }; filter f_news { facility (news); }; filter f_uucp { facility (uucp); }; filter f_cron { facility (cron); }; filter f_local0 { facility (local0); }; filter f_local1 { facility (local1); }; filter f_local2 { facility (local2); }; filter f_local3 { facility (local3); }; filter f_local4 { facility (local4); }; filter f_local5 { facility (local5); }; filter f_local6 { facility (local6); }; filter f_local7 { facility (local7); }; # syslog-ng stats filter filter f_n_stats { not match("STATS: dropped 0"); }; # syslog-ng "connect from filter filter f_n_connected { not match("AF_INET client connected from"); }; ##################################################################### # Define where the logs can be stored # Log log files destination logpile { file("/var/log/syslog-ng/$HOST/$YEAR/$MONTH/$FACILITY.$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) create_dirs(yes) dir_perm(0700)); }; # Console log destination console { file("/dev/sysmsg"); }; # Linux Console # destination console { file("/dev/console"); }; # MySQL Database destination d_mysql { pipe("/var/run/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; ##################################################################### # Define logging # Local log log { source(inputs); filter(f_n_stats); filter(f_notice); filter(f_n_connected); destination(logpile); }; # Console log { source(inputs); filter(f_n_stats); filter(f_err); filter(f_n_connected); destination(console); }; # MySQL Database log { source(inputs); filter(f_n_stats); filter(f_notice); filter(f_n_connected); destination(d_mysql); }; ________________________________________ For a wide range of mobile phones,free upgrades,accessories and tariffs plus special deals when you buy online,visit www.o2.co.uk/shop <http://www.o2.co.uk/shop>

2 1

Crosscompile Syslog-ng
by Kenneth Kassing 27 Jan '06

27 Jan '06

I am crosscompileing syslog-ng to to a powerpc, and had to make a few changes to make it compile properly. If anyone is interested I have included these two patch files here. First I updated configure.in to allow you to specify a path to libfl.a (it should also work with libl.a, but I have not tested this). The configure tests already included does not find the lex libraries for me (I do not have them installed. Instead I am just building flex as compile time dependency.) Second, the configure script was explicitly running configure and make from the script. I did not like configure calling make, and it was not using any of my configure arguements for libol. As a result libol was built for my build machine instead of the target device. The syslog-ng configure script will now now call configure for libol (with all the supplied options), and will not run make. When make is run from the syslog-ng directory it will also run make for libol. -Ken --- Makefile.am.org 2006-01-24 17:18:51.000000000 -0500 +++ Makefile.am 2006-01-24 22:26:21.000000000 -0500 @@ -1,4 +1,4 @@ -SUBDIRS = src doc contrib +SUBDIRS = $(LIBOL_DIR) src doc contrib EXTRA_DIST = PORTS syslog-ng.spec syslog-ng.spec.in syslog-ng.spec.bb syslog-ng.spec.bb.in README.spoof dist.conf dist.conf.in --- configure.in.org 2006-01-24 11:56:15.000000000 -0500 +++ configure.in 2006-01-25 11:19:34.000000000 -0500 @@ -56,6 +56,11 @@ AC_ARG_WITH(libnet, [ --with-libnet=path use path to libnet-config script], , [with_libnet=""]) + +AC_ARG_WITH(lex, + AC_HELP_STRING([--with-lexlib=path],[use an uninstalled copy of lex]), + [with_lex=`cd $with_lex; pwd`], + [with_lex=""]) AC_ARG_ENABLE(sun-streams, [ --enable-sun-streams enable Sun STREAMS support even if not detected]) @@ -85,8 +90,8 @@ sysconfdir="${sysconfdir}/syslog-ng" AM_SANITY_CHECK dnl Checks for programs. -AC_PROG_CC -AM_PROG_CC_STDC +#AC_PROG_CC +#AM_PROG_CC_STDC AC_PROG_YACC AM_PROG_LEX AC_PROG_MAKE_SET @@ -355,15 +360,33 @@ else AC_MSG_RESULT([no clues, linking everything dynamically, please send appropriate ld arguments to syslog-ng(a)lists.balabit.hu] fi -AC_MSG_CHECKING(libol version >= $LIBOL_REQ_MAJOR.$LIBOL_REQ_MINOR.$LIBOL_REQ_PATCH) +if test "$with_lex" != ""; then + AC_MSG_CHECKING(for uninstalled version of lex in $with_lex) + if test -f "$with_lex/libfl.a"; then + LEXLIB="$with_lex/libfl.a" + AC_MSG_RESULT($LEXLIB) + elif test -f "$with_lex/libl.a"; then + LEXLIB="$with_lex/libl.a" + AC_MSG_RESULT($LEXLIB) + else + AC_ERROR(no) + fi +fi + +AC_MSG_CHECKING(for libol) if test "$with_libol" = ""; then if test ! -x "`which libol-config`" ; then bundled_libol_dir="`find $srcdir/libol-* -maxdepth 0 -type d 2>/dev/null`" if test -n "$bundled_libol_dir"; then - test -d $bundled_libol_dir || mkdir $bundled_libol_dir - (cd $bundled_libol_dir; ./configure && make) + test -d $bundled_libol_dir || mkdir $bundled_libol_dir with_libol=$bundled_libol_dir + AC_MSG_RESULT(Configuration required) + + # Remove the single quotes from the configure args, and pass them to + # configure for libol + ac_configure_str=`echo $ac_configure_args | sed -e "s/'//g"` + (cd $bundled_libol_dir; ./configure $ac_configure_str) else AC_ERROR(Bundled libol not found) fi @@ -372,9 +395,12 @@ if test "$with_libol" = ""; then LIBOL_CFLAGS=`libol-config --cflags` LIBOL_LIBS=`libol-config --static-libs` MAKE_CLASS="make_class" + AC_MSG_RESULT(ok) fi fi +AC_MSG_CHECKING(libol version >= $LIBOL_REQ_MAJOR.$LIBOL_REQ_MINOR.$LIBOL_REQ_PATCH) + if test "$with_libol" != ""; then if test ! -x $with_libol/libol-config; then AC_ERROR(libol-config not found in the specified location) @@ -386,7 +412,6 @@ if test "$with_libol" != ""; then MAKE_CLASS="$with_libol/utils/make_class" fi - LIBOL_VERSION=[`echo $LIBOL_VERSION | cut -d '+' -f 1`] LIBOL_MAJOR=[`echo $LIBOL_VERSION | cut -d '.' -f 1`] LIBOL_MINOR=[`echo $LIBOL_VERSION | cut -d '.' -f 2`]

1 0

Syslog-ng with Ipsec or with Stunnel?
by Mounib Khanafer 27 Jan '06

27 Jan '06

Hi all, I hope if someone can help me with this. I'm researching syslog-ng and colllecting as much info as posiible bout it. I want to know which does perform better when working with syslog-ng: IPsec or Stunnel? Please note that I use Solaris 8 and 9 worksations. Thanks a lot. Best Regards, Mounib -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Heigl Florian - Munich-MR - external Sent: Friday, January 27, 2006 11:43 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] chroot or configuration issue when directories getcreated as 'root'? Hi list, I'm stumbling over what is hopefully just a configuration issue... syslog-ng 'seems' to drop privileges and run as user syslogng, but creates new directories as root and will fail to write new logfiles inside them. I'm afraid this is related to still having port 514 open... Funny thing: The files in those directories will use the specified permissions :) I was starting syslog-ng with the following parameters: /opt/syslog-ng/sbin/syslog-ng --pidfile=/var/run/syslog-ng.pid --chroot=/var/opt/syslog-ng --user=syslogng --group=syslogng # Log file options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (yes); create_dirs (yes); # leave this to 'no', see http://www.campin.net/syslog-ng/faq.html#bad_filenames keep_hostname (no); }; # Source - only listen on UDP, don't read /dev/log source s_udp { udp(); }; # [ I cut filters section out ] # testing external input now destination logip { file("/logs/remote/$HOST_FROM/$YEAR$MONTH/$FACILITY$YEAR$MONTH$DAY" owner(syslogng) group(syslogng) perm(0600) dir_perm(0700) create_dirs(yes) template("$DATE $FULLHOST $PROGRAM $TAG [$FACILITY.$LEVEL] $MESSAGE\n") ); }; log { source(s_udp); destination(logip); }; # EOF Currently I'm running it as root and am thinking about using a portforward 514->10514 so I don't require any root privileges. Alternatively I could try out Balabit's restrict, which seems to be better at dropping root privileges, but unfortunately I have no clue how it works, and am not sure if it will work on HP-UX :) Can You try to make me understand where the problem is hiding? Configuration? Port Number? Bug? User? Thanks a lot of Your time! Florian -- I'll save You the signature :) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

chroot or configuration issue when directories get created as 'root'?
by Heigl Florian - Munich-MR - external 27 Jan '06

27 Jan '06

Hi list, I'm stumbling over what is hopefully just a configuration issue... syslog-ng 'seems' to drop privileges and run as user syslogng, but creates new directories as root and will fail to write new logfiles inside them. I'm afraid this is related to still having port 514 open... Funny thing: The files in those directories will use the specified permissions :) I was starting syslog-ng with the following parameters: /opt/syslog-ng/sbin/syslog-ng --pidfile=/var/run/syslog-ng.pid --chroot=/var/opt/syslog-ng --user=syslogng --group=syslogng # Log file options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (yes); create_dirs (yes); # leave this to 'no', see http://www.campin.net/syslog-ng/faq.html#bad_filenames keep_hostname (no); }; # Source - only listen on UDP, don't read /dev/log source s_udp { udp(); }; # [ I cut filters section out ] # testing external input now destination logip { file("/logs/remote/$HOST_FROM/$YEAR$MONTH/$FACILITY$YEAR$MONTH$DAY" owner(syslogng) group(syslogng) perm(0600) dir_perm(0700) create_dirs(yes) template("$DATE $FULLHOST $PROGRAM $TAG [$FACILITY.$LEVEL] $MESSAGE\n") ); }; log { source(s_udp); destination(logip); }; # EOF Currently I'm running it as root and am thinking about using a portforward 514->10514 so I don't require any root privileges. Alternatively I could try out Balabit's restrict, which seems to be better at dropping root privileges, but unfortunately I have no clue how it works, and am not sure if it will work on HP-UX :) Can You try to make me understand where the problem is hiding? Configuration? Port Number? Bug? User? Thanks a lot of Your time! Florian -- I'll save You the signature :)

1 0

Syslog-ng & pipe question
by syslogyk 26 Jan '06

26 Jan '06

Hi! Could you please help me with this question? I have the following strings in my syslog-ng.conf: source src { internal(); unix-dgram("/dev/log"); unix-dgram("/var/lib/named/dev/log"); }; ... skipped ... filter f_debug { level(debug); }; destination d_yuri { pipe("/dev/yuri_pipe"); }; log { source(src); filter(f_debug); destination(d_yuri); }; With this configuration, I execute the following commands in the first console: mkfifo /dev/yuri_pipe cat /dev/yuri_pipe On the other console I generate an event (for instance, "logger blablabla"). And cat /dev/yuri_pipe on the first console outputs nothing. What's wrong in my syslog-ng.conf? Can I get events in my pipe? Thank you in advance, Yuri P.S. Sorry, if you receive this message twice.

3 3