- syslog-ng - lists.balabit.hu

message parsing help
by blenox＠gmx.net 05 Oct '05

05 Oct '05

Hello All, i have a few questions about syslog-ng message parsing is it possible to scan each syslog message for system-notification*(traffic) once this matches, to insert the values !splitted! into a database with the the following fields: device_id start_time duration policy_id service ip_proto src_zone dst_zone action sent rcvd src_ip dst_ip src_port dst_port src_xlated_ip dst_xlated_ip port session_id the whole message looks like this: Oct 3 15:35:32 172.10.0.10 NS50: NetScreen device_id=NS50 [No Name]system-notification-00257(traffic): start_time="2005-10-03 15:01:37" duration=21 policy_id=1 service=https proto=6 src zone=Trust dst zone=Untrust action=Permit sent=2454 rcvd=1601 src=172.18.12.10 dst=172.17.10.24 src_port=1458 dst_port=443 src-xlated ip=172.18.12.113 port=1458 session_id=63649 i was able to filter certain messages, but never to split up the real "message field". Any help with examples would be great im using syslog-ng 1.6.8 Cheers and thank's in advance Marco -- GMX DSL = Maximale Leistung zum minimalen Preis! 2000 MB nur 2,99, Flatrate ab 4,99 Euro/Monat: http://www.gmx.net/de/go/dsl

2 1

spoof_source not working
by Chance Ellis 04 Oct '05

04 Oct '05

I am running syslog-ng 1.6.8 on Solaris 9. I recompiled with the --enable-spoof-source configure option. Here is my config: destination d_squelch_acl { udp("10.159.234.52 <http://10.159.234.52>" port(514) spoof_source(yes)); }; filter f_squelch_acl { match("list squelch denied"); }; log { source(net); filter(f_squelch_acl); destination(d_squelch_acl);}; source net { udp(); }; If I start syslog-ng without spoof_source(yes) option, all messages matching are forwarded to the machine in the destination. If I change to spoof_source(yes) nothing gets forwarded at all. I do not get any errors when I start syslog-ng, like "spoof-source support not compiled in" which I get on other boxes I have not recompiled on yet. Any ideas? Chance

4 10

- Syslog not logging
by kevin_herald 04 Oct '05

04 Oct '05

Hello, I've installed syslog-ng-1.9.5 on Solaris 9 and it appears to startup and be running. root 430 1 0 14:17:46 ? 0:00 /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf -p /etc/syslog-ng/sy However, I see no logging in any of the destination files. Is there some type of debugging switch to help determine why the logs are not being written to? Thanks for any help, Kevin ps. Here is a copy of my syslog-ng.conf file. # syslog-ng configuration file. # # This should behave pretty much like the original syslog on SunOS. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_remote { udp(ip(0.0.0.0) port(514)); internal(); }; destination syslog { file("/var/log/syslog"); }; destination messages { file("/var/adm/messages"); }; destination loghost { tcp("191.168.230.20" port (5140)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/adm/messages"); }; destination d_mail { file("/var/log/syslog"); }; destination d_auth { file("/var/log/authlog"); }; destination d_mlop { usertty("operator"); };filter f_filter1 { level(err) or (level(notice) and facility (auth, kern)); }; filter f_filter2 { level(err) or (facility(kern) and level(notice)) or (facility(daemon) and level(notice)) or (facility(mail) and level(crit)); }; filter f_filter3 { level(alert) or (facility(kern) and level(err)) or (facility(daemon) and level(err)); }; filter f_filter4 { level(alert); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(kern) and level(notice); }; filter f_filter7 { facility(mail) and level(debug); }; filter f_filter8 { facility(user) and level(err); }; filter f_filter9 { facility(user) and level(alert); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_mlop); }; log { source(s_sys); filter(f_filter4); destination(d_mlrt); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_auth); }; log { source(s_sys); filter(f_filter7); destination(d_mail); }; log { source(s_sys); filter(f_filter8); destination(d_cons); destination(d_mesg); }; log { source(s_sys); filter(f_filter9); destination(d_mlop); destination(d_mlrt); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); };

1 0

RE: [syslog-ng] Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 04 Oct '05

04 Oct '05

> > I tried the latest snapshot of syslog-ng, but it fails to > compile the > > initial module. I get: > > misc.c: In function `get_local_timezone_ofs': > > misc.c:83: error: structure has no member named `tm_gmtoff' > > Hmm, this is a BSD extension, and IIRC you are using a BSD system, > aren't you? Actually, this is a Solaris 8 system (with gcc 3.4.2). The (original) July 1.9.5 compiles just fine. I'm just uncertain what has changed since then, that is causing this issue. The time.h file on this system appears to have come as part of the SUNWhea package, and does not include the information shown above. Not sure if that helps(?). THANKS for your guidance. Marvin

3 2

Thomas X Hill/GIS/CSC is out of the office.
by Thomas X Hill 04 Oct '05

04 Oct '05

I will be out of the office starting 04.10.2005 and will not return until 07.10.2005. I will respond to your message when I return.

1 0

SV: [syslog-ng] Architecture Question'
by kenneth.gullberg＠foreningssparbanken.se 04 Oct '05

04 Oct '05

im afraid that the only answer you are going to get is: Depends on what kind of traffic you expect to be seeing.. 7000 machines logging 1 message every minute is nothing but if you are expected to receive 1 message / second / server then you need a different setup.. You need to be more specific! -----Ursprungligt meddelande----- Från: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] För CIKALA Frederic ROSI/DOSI Skickat: den 4 oktober 2005 09:34 Till: syslog-ng(a)lists.balabit.hu Ämne: [syslog-ng] Architecture Question' Hello everyone' I'm new to this mailing list and i do not know syslogNG yet Actually, i have to prepare a server that will centralize a lot of logs, from about 7000 other servers. I've read that syslogNG is a great tool that can do a lot of interresting things. Therefore, i chose this application for my project but i do not know if it needs big ressources to be launched ... In fact, i'm wondering about the hardware i'll have to buy in order to make this project Maybe someone of this list has got a greater opinion about what i'll have to buy for example "at least a 3gHz cpu, with 2 gig of ram ..." It could be usefull', thank you ^^ *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

1 0

RE: [syslog-ng] Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 04 Oct '05

04 Oct '05

> Exactly. Here is the full code which seems to work around > those issues > rather nicely (you're in for a good treat reading the comment block > almost at the end of the code): > > http://svn.apache.org/viewcvs.cgi/apr/apr/trunk/time/unix/time.c?view=mark up Can you say "Jump thru hoops"? > I wonder if this should be implemented in syslog-ng as well? I hope so! But that's easy for me to say, looking in from the outside. ;-) > Bazsi is > in Sevilla > enjoying the sun and giving interesting speeches at the > present time ;). Sounds well deserved! I hope that it's an enjoyable trip! > Could you grep for this tm_gmtoff and altzone as follows, > please (maybe > it's defined as __tm_gmtoff)? > > find /usr/ -type f -name "*.h" -exec grep "tm_gmtoff" /dev/null {} \; These hits: /usr/local/lib/perl5/5.8.7/sun4-solaris/CORE/config.h: * the struct tm has a tm_gmtoff field. /usr/local/lib/perl5/5.8.7/sun4-solaris/CORE/uconfig.h: * the struct tm has a tm_gmtoff field. > find /usr/ -type f -name "*.h" -exec grep "altzone" /dev/null {} \; These hits: /usr/include/time.h:extern long altzone; /usr/include/time.h:extern long timezone, altzone; Thanks for the help Roberto. You have a great week. Marvin

2 1

Architecture Question'
by CIKALA Frederic ROSI/DOSI 04 Oct '05

04 Oct '05

Hello everyone' I'm new to this mailing list and i do not know syslogNG yet Actually, i have to prepare a server that will centralize a lot of logs, from about 7000 other servers. I've read that syslogNG is a great tool that can do a lot of interresting things. Therefore, i chose this application for my project but i do not know if it needs big ressources to be launched ... In fact, i'm wondering about the hardware i'll have to buy in order to make this project Maybe someone of this list has got a greater opinion about what i'll have to buy for example "at least a 3gHz cpu, with 2 gig of ram ..." It could be usefull', thank you ^^ *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

1 0

RE: [syslog-ng] Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 04 Oct '05

04 Oct '05

> I didn't check but most probably he added the > localtime(&when) call in > get_local_timezone_ofs() to extract the seconds you are away > from UTC, > including DST handling. Unfortunately I do not understand enough of > timezone handling to be much of a help here. Time is too a difficult > subject for me to understand, so I'm glad it works most of > the time :). > ............................... > > Hmm, the "correct" file I see has shown up in Solaris 10 ;) > with the libbc: > > http://cvs.opensolaris.org/source/xref/usr/src/lib/libbc/inc/i > nclude/time.h > > Tomorrow I'll have access again to a Solaris 8 machine where > I could try > compiling the source. Bazsi seems to be very busy these days, > so we just > have to wait for a bit ... > > Regards, > Roberto Nibali, ratz Well this is depressing.... I'm googling this, and found this: http://archive.apache.org/gnats/7902 I get the distinct impression that tm_getoff doesn't exist on Solaris 8 (although it appears that Sun finally added it later on, as it's obviously there in 10). I guess the Apache guys produced a Solaris-specific chunk of code to work around that shortcoming (and that's what the web page is discussing). If anyone has any clues as to how one might add the "later" (more capable) time functionality on Solaris 8, I'd obviously love to hear it, or it looks like I'm dead in the water for using the future version of syslog-ng at this point. (i.e. a possible patch, or external component, that has this extended capability.) Thanks! Marvin

2 1

unsubscribe
by Brown, Donna Jeanne 03 Oct '05

03 Oct '05

Please unsubscribe me from this list. Donna Brown (djbrown(a)sandia.gov)

1 0