- syslog-ng - lists.balabit.hu

Re: [syslog-ng] match text within message
by Roberto Nibali 03 Oct '05

03 Oct '05

> Thanks Roberto, > I am trying to do exactly what you presumed. Ok. >>So you write: >> >>match PIX and not A and not B >> >>> Any suggestions? >> >>filter f_pix { >> match("PIX") and match("987.65.4.[34]"); >>}; > > > So, in order to exclude ip address 987.65.4.3 and ip address 987.65.4.4 > would the sytax be as follows? Well, I'm a bit unsure about your use of the term "ip address", since the noted dotted decimals are not valid ip addresses. > filter f_pix { > match("PIX") and not match("987.65.4.[34]"); > }; I would say so. > Thanks again!!! Tell us if it works and if not, we're more than happy to help you out further. Don't forget to cc the list since other people might want to know this as well and could potentially help you out better then I can. Best regards, Roberto Nibali, ratz -- ------------------------------------------------------------- addr://Kasinostrasse 30, CH-5001 Aarau tel://++41 62 823 9355 http://www.terreactive.com fax://++41 62 823 9356 ------------------------------------------------------------- terreActive AG Wir sichern Ihren Erfolg -------------------------------------------------------------

1 0

Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 03 Oct '05

03 Oct '05

Balazs... I didn't know if you'd seen this (original) thread (I won't repeat all of it here, but did repeat Peter's suggested fix below). I applied this fix, and it did resolve my problems, as it did Peter's. I looked at the latest snapshot, and didn't see this particular change applied, so I figured that I'd ask whether this is something that should be applied(?) Or... Possibly... It's resolved through some other means, or worse (for me) maybe it implies that I've got something else misconfigured, that is actually the root cause of my (and maybe Peter's) problem. If there's any information that you need from me, I'd be happy to supply it. Thanks for your good work and efforts! Marvin -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of pnahas(a)mrv.com Sent: Friday, September 30, 2005 2:27 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Ver 1.9.5 problems with facility/level filtering I too have experienced this problem and decided to investigate the source code. Unless I'm missing something, it appears that 1.9.5 simply does not set the correct variable internally, regardless of configuration. The following patch solved the problem for me: --- /home/pnahas/syslog-ng-1.9.5/src/filter.c 2005-01-05 06:40:50.000000000 -0500 +++ filter.c 2005-09-30 16:23:29.000000000 -0400 @@ -162,6 +162,7 @@ { FilterPri *self = g_new0(FilterPri, 1); + self->valid = facilities; self->super.eval = filter_facility_eval; return &self->super; } @@ -180,6 +181,7 @@ { FilterPri *self = g_new0(FilterPri, 1); + self->valid = levels; self->super.eval = filter_level_eval; return &self->super; } Hope that helps! -Peter Nahas

2 1

match text within message
by Antonio Brown 03 Oct '05

03 Oct '05

Below are a couple of message samples: "Message: %PIX-51-100908: Teardown UDP connection 30292827 for THEFORCEVPN: 123.45.678.91/3130 to inside:987.65.4.3/53 duration.......etc.." "Message: %PIX-51-070605: Teardown UDP connection 26252423 for ISSTRONGVPN: 111.21.314.15/3130 to inside:987.65.4.4/53 <http://210.65.4.4/53>duration.......etc.." I am trying to match 987.65.4.3 or 987.65.4.3/53 and 987.65.4.4<http://210.65.4.4>. Here is my syntax: filter f_pix { match(PIX) and not match("987.65.4.3") and not match(" 987.65.4.4 <http://210.65.4.4>"); }; Any suggestions? Thank You for your assistance! >match() matches the message part only, which does not include the >hostname part in the message header. If you actually copied a sample >message it would be easier to help out, and you have a much better >chance to receive messages on the syslog-ng mailing list. Lots of >helpful folks there, I'm sometimes unable to respond for days. :) > >-- > Bazsi >> Hello! >> >> I am trying to filter an IP by using match in the syslog-ng.conf file. >> Below (in bold) is a portion of the thread that sort of describes my problem. >> However the IP address that I am attempting to match is not the sender. >> >>It is actually located within the message. >> >> I am using the following syntax: >> >> filter f_pix { match(PIX) and not match("xxx\.xx\.x\.x"); }; >> >> Did not work. I've attempted many other variations and still no go. >> >> >> again the address that I am attempting to match is not the sender. It is located >> within the message.

2 1

Fwd: [syslog-ng] syslog-ng not logging
by catenate 03 Oct '05

03 Oct '05

Frowarding to the list, wish gmail used the reply-to header. :( ---------- Forwarded message ---------- From: catenate <infosec(a)gmail.com> Date: Sep 29, 2005 7:54 PM Subject: Re: [syslog-ng] syslog-ng not logging To: fico gid <ficohertz(a)gmail.com> On 9/29/05, fico gid <ficohertz(a)gmail.com> wrote: > > Hi Again, > > Below is the whole syslog-ng.conf file . Yes, it is not separating as > in /host/somehost/year/month/day .. > > <SNIP> > > Let me know if you need more info, Thanks Fico, This has to be the first time I've ever seen someone completely omit an options{}; block. Now I know that syslog-ng will gladly use defaults for all the options if/when you leave that out. Anyways, I'm still not completely clear on how exactly your installation is logging. Are you saying that you have logs going to /var/log/kern.log and the other NON-MACRO destinations, or are you saying that your macro filenames in /var/log/hosts/HOST/YEAR/... are being logged but incorrectly, like /var/log/hosts/YEAR/... ? Please be specific. I did a syntax check on your config file, and it looks fine to me. What version are you using?

3 3

syslog-ng 1.6.8 and dns cache issue
by Ketan Vankawala 02 Oct '05

02 Oct '05

I have currently installed Syslog-ng ver 1.6.8. Here is a snippet of my syslog-ng config file.So accordingly when a syslog message comes in, depending on the ip address, it does a lookup in /etc/hosts, creates an appropriate host name folder and forwards the message there. If the hostname does not exists, it creates a folder named with the ip address. Here is my question: 1) How often does syslog-ng refreshes its dns /hosts cache? Because I have run into issues that even after the /etc/hosts file is updated syslog still keeps logging to the folder created with the ip address. If I restart syslog-ng service it immediately starts forwarding the messages correctly to hostname folder. 2) How can I reduce the dns cache timeout, so it checks /etc/hosts more frequently for any changes? Thanks in advance. Ketan destination hostslocal { file("/var/log/HOSTS/$HOST/$YEAR-$MONTH-$DAY.log" owner(root) group(xxx) perm(0740) dir_perm(0740) create_dirs(yes) template("$R_DATE $FULLHOST $MONTH $S_DAY $S_YEAR $S_HOUR:$S_MIN:$S_SEC: $MESSAGE\n") template-escape(no)); }; log { source(src); destination(hostslocal); };

2 2

RE: [syslog-ng] Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 01 Oct '05

01 Oct '05

>>On Mon, Sep 26, 2005 at 12:30:23PM -0600, Marvin.Nipper(a)Stream.com wrote: >> >> So. I'm looking for any input as to what might be a potential root >> problem. Obviously, there are a whole set of different pre-req components >> for the 1.9.5 world. I'm not sure if I'm dealing with some compatibility >> problem amongst the component versions that I've selected(?), or if the >> problem lies elsewhere. > >There's no obvious cause going by your description, but maybe if we saw >your config we'd notice something. Please post your complete config >file, if you don't mind. > >Thanks. >-- >Nate Here's my current configuration: options { dir_perm(0755); perm(0600); chain_hostnames(no); keep_hostname(yes); log_fifo_size(1000); }; # Catch everything coming from other sysloggers source any_udp { udp(); }; # Pipe used by SEC (Simple Event Correlation) destination SEC {pipe("/tmp/sec"); }; # Various segregated logging files destination routers_log { file("/var/adm/log/routers.log" create_dirs(yes)); }; destination ravlin_log { file("/var/adm/log/ravlin.log" create_dirs(yes)); }; destination windows_log { file("/var/adm/log/windows.log" create_dirs(yes)); }; destination catch-all_log { file("/var/adm/log/catch-all.log" create_dirs(yes)); }; destination test { file("/var/adm/log/test.log" create_dirs(yes)); }; # Some place to dump noise destination dev_null { file("/dev/null" ); }; ######## Logging commands ############# # Send a copy of everything to SEC #log { source(any_udp); destination(SEC); }; # syslog.info /var/adm/log/windows.log filter f_4 { facility(syslog) and level(info..emerg); }; log { source(any_udp); filter(f_4); destination(windows_log); flags(final); }; # local5.debug /var/adm/log/routers.log filter f_1 { facility(local5) and level(debug..emerg); }; log { source(any_udp); filter(f_1); destination(routers_log); flags(final); }; # Kill SonicWall Noise first filter SonicWallNoise { match("id=firewall") and filter(SonicWallMsgs); }; filter SonicWallMsgs { match("m=97") or match("m=98") or match("m=537"); }; log { source(any_udp); filter(SonicWallNoise); destination(dev_null); flags(fina l); }; # local0.debug /var/adm/log/ravlin.log filter f_3 { facility(local0) and level(debug..emerg); }; log { source(any_udp); filter(f_3); destination(ravlin_log); flags(final); }; # (catch all) /var/adm/log/catch-all.log log { source(any_udp); destination(catch-all_log); flags(final); }; Again, this configuration works just fine with my 1.6.8 compilation. Output is properly distributed to all of the listed files. With my 1.9.5 compilation, the final (unfiltered) file gets everything. In short, I know that the inbound syslog packets are fine (i.e. that they have the correct facility/level information), or 1.6.8 would be broken as well. THANKS for any and all help! Marvin

3 2

RE: [syslog-ng] Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 30 Sep '05

30 Sep '05

>I too have experienced this problem and decided to investigate the >source code. Unless I'm missing something, it appears that 1.9.5 simply >does not set the correct variable internally, regardless of >configuration. The following patch solved the problem for me > >............ > >Hope that helps! > >-Peter Nahas I won't be able to give it a go to test it until next week, BUT I wanted to fire off a quick message and thank you for your QUICK response and help. I'm betting that if it worked for you, it will solve my problem as well. THANKS AGAIN for your help! Marvin

1 0

Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 30 Sep '05

30 Sep '05

Sorry (in advance) if this is a dimwitted question.. I've slurped down and compiled these components on my Solaris 8 system: pkg-config-0.19; glib-2.8.1; eventlog-0.2.3+20050116+1856; and finally the non-snapshot flavor of syslog-ng 1.9.5. Everything appears to have compiled OK, and I am able to load and execute syslog-ng, and it actually operates, albeit not exactly right (which is the driver for this email). I have a 1.6.8 version of syslog-ng that "eats" my (fairly simple) config file, and sorts thru the incoming syslog traffic, filtering it to one of three primary target files, based upon facility/level combinations. These log statements all use a flags-final setting. There is one final (fourth) log statement that feeds a catch-all file, with anything not distributed to the first three files. When using the 1.6.8 executable, these four files accumulate data, as anticipated (i.e. everything works just fine). However, when I attempt to utilize the new 1.9.5 executable (on the same system), nothing is fed to the first three files. The only file getting any input is the final, catch-all file. Essentially, the only difference between the catch-all statement, and the filtered statements, is the existence of the filters on those statements, which reference filters similar to this: filter f_1 { facility(local5) and level(debug..emerg); }; It's not clear to me why the filtering activity is failing. Again, those filters are fine in a 1.6.8 setting. So. I'm looking for any input as to what might be a potential root problem. Obviously, there are a whole set of different pre-req components for the 1.9.5 world. I'm not sure if I'm dealing with some compatibility problem amongst the component versions that I've selected(?), or if the problem lies elsewhere. Thanks for any and all input and suggestions. > Marvin Nipper Director of Security Stream > mailto:marvin.nipper@stream.com > PGP Key ID: 0xD3EB5CE5 (RSA); 0x8EE28551 (DSS/DH) >

2 1

syslog-ng not logging
by fico gid 30 Sep '05

30 Sep '05

hi there syslog gurus.. Is the configuration below enough for me to log some of my routers ? 157.0.1.1 is my syslog server and im suppose to get logs frm a few routers. I have added appropriate logging commands on the routers to log to the syslog server but i don't see anything. syslog-ng is started and listening on both udp/tcp . Im running on freebsd --start-- ## syslog-ng source remote { unix-stream("/var/run/log"); internal(); pipe("/dev/klog"); udp(ip(157.0.1.1) port(514)); tcp(ip(157.0.1.1) port(514) keep-alive(yes)); }; destination std { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; log { source(remote); destination(std); }; destination authlog { file("/var/log/auth.log"); }; destination cron { file("/var/log/cron.log"); }; destination debug { file("/var/log/debug.log"); }; destination kern { file("/var/log/kern.log"); }; destination user { file("/var/log/userlog"); }; destination maillog { file("/var/log/maillog"); }; destination security { file("/var/log/security"); }; destination messages { file("/var/log/messages"); }; --end-- any hints or help is much appreciated. thanks fico

2 4

Syslog compile error
by philip 29 Sep '05

29 Sep '05

Hi, I got the following error message when I run "make" Making all in src make[1]: Entering directory `/root/syslog-ng-1.6.0rc3/src' make all-recursive make[2]: Entering directory `/root/syslog-ng-1.6.0rc3/src' Making all in . make[3]: Entering directory `/root/syslog-ng-1.6.0rc3/src' gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lnsl -lresolv -lfl /usr/local/lib/libol.a -lnsl sources.o(.text+0x211): In function `do_read_line': /root/syslog-ng-1.6.0rc3/src/sources.c:91: undefined reference to `MIN' sources.o(.text+0x443): In function `make_log_reader': /root/syslog-ng-1.6.0rc3/src/sources.c:169: undefined reference to `MAX' cfg-lex.o(.text+0x4cc): In function `append_string': /root/syslog-ng-1.6.0rc3/src/cfg-lex.l:239: undefined reference to `MIN' affile.o(.text+0x59f): In function `do_init_dest_writer': /root/syslog-ng-1.6.0rc3/src/affile.c:286: undefined reference to `MAX' afinet.o(.text+0x83d): In function `do_init_afinet_dest': /root/syslog-ng-1.6.0rc3/src/afinet.c:478: undefined reference to `MAX' macros.o(.text+0x85): In function `append_string': /root/syslog-ng-1.6.0rc3/src/macros.c:84: undefined reference to `MIN' macros.o(.text+0x3e9): In function `expand_macros': /root/syslog-ng-1.6.0rc3/src/macros.c:182: undefined reference to `MIN' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/root/syslog-ng-1.6.0rc3/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/syslog-ng-1.6.0rc3/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/root/syslog-ng-1.6.0rc3/src' make: *** [all-recursive] Error 1 Any suggestion what cause it? Thanks

2 1