- syslog-ng - lists.balabit.hu

RE: [syslog-ng] syslog-ng- filter() problem
by Kelly Pow 05 Aug '05

05 Aug '05

HI, Am currently using Syslog-ng to collect snmptraps. My problem is that I amcurrently receiving traps from three different networks and I have to filter them out. I am receiving traps from 64.251.65.224/255.255.255.240 66.163.79.0/255.255.255.128 204.209.214.0/255.255.254.0 Where I want traps from 64.251.65.224/255.255.255.240 and 66.163.79.0/255.255.255.128 to be stored in one file While traps from 204.209.214.0/255.255.254.0 in another. Currently this is what my syslog-ng.conf looks like And I am receiving nothing :-( I am very frustrated with this. Please help. Thank you. options { long_hostnames(yes); keep_hostname(yes); use_fqdn(on); create_dirs(yes); owner(nmadmin); group(users); perm(0755); dir_owner(nmadmin); dir_group(users); dir_perm(0755); sync(0); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #for SNMPTRAP destination ipbb_lab_traps { file("/store/ipbb_lab/traps/$YEAR-$MONTH-$DAY"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; #filter snmptrap filter f_testA { level(warn)and netmask(64.251.65.224/255.255.255.240); }; filter f_testB { level(warn)and netmask(66.163.79.0/255.255.255.128); }; log { source(src); filter(f_testA); destination(ipbb_traps); }; log { source(src); filter(f_testB); destination(ipbb_traps); }; filter f_test2 { level(warn)and netmask(204.209.214.0/255.255.254.0); }; log { source(src); filter (f_test2); destination(ipbb_lab_traps); }; Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca> _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Frans Stekelenburg Sent: Wednesday, August 03, 2005 5:27 AM To: Syslog-ng users' and developers' mailing list; ebroo(a)healthydirections.com Subject: RE: [syslog-ng] syslog-ng- filter() problem try making another filter first with the three filters and 'or' statements. Sounds like your config creates an and-and-and situation for you, leading in nothing beeing logged. I think I came across this situation on one of the helpful pages around (google), but unfortunatly don't remember where, so I can't refer you to it. regards, frans _____ From: Kelly Pow [mailto:kelly.pow@sjrb.ca] Sent: dinsdag 2 augustus 2005 18:55 To: Syslog-ng users' and developers' mailing list; ebroo(a)healthydirections.com Subject: RE: [syslog-ng] syslog-ng- filter() problem Hi, I am collecting traps and syslog data Yes they are being sent to the right place. Yes the destinations exist and the permissions are correct I am running Gentoo And syslog-ng version- 1.6.5-r2 The problem is: log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; if I only have : log { source(src); filter(f_snmptrap); destination(ipbb_traps); }; or log { source(src); filter(f_ipbb1); destination(ipbb_traps); }; but when I add more filters it give me nothing Why? Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca> _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Edward Brookhouse Sent: Friday, July 29, 2005 5:08 AM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] syslog-ng- filter() problem Are you collecting traps or syslog data ? Tcpdump is your friend - are the syslog speakers speaking to the right place ? Is anything else being logged on the box from other sources? Does the destination exist and permissions correct What os ? Which versions of syslog-ng _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Kelly Pow Sent: Thursday, July 28, 2005 5:55 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng- filter() problem Hi, I am trying to collect traps from these two networks. 66.163.79.0/255.255.255.128 and 64.251.65.224/255.255.255.240 I don't understand why when I do this it doesn't collect anything Any ideas/.?? ---------------------------------------------------------------------------- --------------------------- source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #filter snmptrap filter f_snmptrap { level(warn); }; #testing filters for the different networks filter f_ipbb1 {netmask("66.163.79.0/255.255.255.128"); }; filter f_ipbb2 {netmask("64.251.65.224/255.255.255.240"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; ---------------------------------------------------------------------------- ------------------------------- Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca>

1 0

Re: [syslog-ng] Problem with hostnames!
by mrgenius 05 Aug '05

05 Aug '05

phewww.. Its been over a month i am trying different things ..but its not giving me desired result... i have even switched my os from mandrake to RHEL 4 .. still no sucess. i am again explaining my issue.. i've syslog-ng-1.6.8-1 running on RHEL 4 AS. This Server is on public IP 202.163.x.x . And Its receving Logs from Different Devices on network. (basically i run own isp). In Order to give friendly name to IPs of devices what i have done is to enter hostnames against IPs in /etc/hosts file. So as a result of it.. All logs i get gets name of my desire. however Problem arises when i enabled syslog on certain devices which have Prive IP of 192.168.x.x I entered hostnames in /etc/hosts for these private Ips as i did in case of public iP hosts .. but what i am getting in database is not the names of these Hosts.. instead i am getting PRIVATE IPs. I tried running local DNS on machine and make even reserve zones.. still result remained same.. then i entered these hosts names in my ISP's DNS .. but even then same result.. Can Some one tell me Why this is happening?? why in the world syslog-ng is not giving hostnames to PRIVATE IPs. Please help me out :( On 7/15/05, Edward Brookhouse <ebroo(a)healthydirections.com> wrote: > > About the last thing I can think of would be to run syslog-ng in a debug > window (or attach to it with gdb) and see exactly which system calls are > made when an entry arrives. This will tell you which function is being used > to do name resolution – > > So just to make sure I understand whats happening – no matter how hosts > file or use_dns is set you have hosts that are not being resolved? > > > Oh – did you check reverse dns ? > > ------------------------------ > > *From:* mrgenius [mailto:mrgenius420@gmail.com] > *Sent:* Friday, July 15, 2005 3:01 AM > *To:* Edward Brookhouse > *Cc:* Syslog-ng users' and developers' mailing list > *Subject:* Re: [syslog-ng] Problem with hostnames! > > Well if set use_dns(off) then it stops reading /etc/hosts file and start > storing hosts as IP addresses. > > I am using Mandrake 10.1 Official...... > > In nsswitch.conf i have tried by giving DNS, file and file,dns both > combination.. but it doesn't make any difference... its still neither > picking private Ips from /etc/hosts nor from local cache dns server. > > > > On 7/14/05, *Edward Brookhouse* <*ebroo(a)healthydirections.com*<ebroo(a)healthydirections.com>> > wrote: > > What happens if you set use_dns (off); does your hosts file get read then? > What OS is this? How is the system nsswitch.conf setup for resolution? > > Also maybe double check your resolv.conf what is the domain listing and > search order listed in there? > > ------------------------------ > > *From:* *syslog-ng-bounces(a)lists.balabit.hu*<syslog-ng-bounces(a)lists.balabit.hu>[mailto: > *syslog-ng-bounces(a)lists.balabit.hu* <syslog-ng-bounces(a)lists.balabit.hu>] > *On Behalf Of *mrgenius > *Sent:* Thursday, July 14, 2005 12:53 AM > *To:* Ken Garland > *Cc:* Syslog-ng users' and developers' mailing list > *Subject:* Re: [syslog-ng] Problem with hostnames! > > Yes here is the portion of my syslog-ng.cong > > ##################################### > > options { sync (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames (yes); > use_dns (yes); > use_fqdn (yes); > create_dirs (no); > keep_hostname (no); > }; > > source sys { unix-stream ("/dev/log"); internal(); }; > source net { > udp(ip(* 0.0.0.0* <http://0.0.0.0/>) port(514) ); > }; > > > destination d_mysql { > pipe("/tmp/mysql.pipe" > template("INSERT INTO logs > (host, facility, priority, level, tag, datetime, program, msg) > VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', > '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', > '$PROGRAM', '$MSG' );\n") template-escape(yes)); > }; > log { source(net); destination(d_mysql); > > ############################################## > > But if you say that syslog-ng first queries DNS Server ... then why it > is resolving names for all public Ips which i defined in /etc/hosts and > those public Ips have no entries in my defined DNS Servers. > > i am quite confused how this thing is actually working?? > > Regards, > > -Geni > > > > On 7/14/05, *Ken Garland* <* ken.garland(a)rotech.com*<ken.garland(a)rotech.com>> > wrote: > > paste the relevant parts of your .conf file. > > mrgenius wrote: > > > > > Hi All! > > > > I am using Syslog-ng with php-syslog-ng. to give names of my choices > > to different hosts IP what i did was to define hostnames against each > > IP of host in /etc/hosts file. > > > > It was working fine with Public IP adresses.. But I have some hosts on > > local network too with 192.168 IPs . The pRoblem i am now facing is > > that its not storing logs with HOSTNAMES of private IPs. Where as its > > working fine and giving names of Public IPs. > > > > For example In My /etc/hosts file i have these 2 entries > > > > *202.164.1.1* <http://202.164.1.1/> <* http://202.164.1.1*<http://202.164.1.1/>> > broadband-router > > *192.168.77.1* <http://192.168.77.1/> <* http://192.168.77.1*<http://192.168.77.1/>> > primary-router > > > > For 1st entry Logs in database will come with name broadband-router, > > which is what i want > > For 2nd Entry Logs in database will come with name *192.168.77.1*<http://192.168.77.1/> > > <* http://192.168.77.1* <http://192.168.77.1/>>, which is what i Don't > want > > > > > > Any body has any idea?? any thing to do in configuration of syslog-ng?? > > > > Regards, > > > > -Geni > > > >------------------------------------------------------------------------ > > > >_______________________________________________ > >syslog-ng maillist - *syslog-ng(a)lists.balabit.hu*<syslog-ng(a)lists.balabit.hu> > *** * > >*https://lists.balabit.hu/mailman/listinfo/syslog-ng*<https://lists.balabit.hu/mailman/listinfo/syslog-ng> > >Frequently asked questions at *http://www.campin.net/syslog-ng/faq.html*<http://www.campin.net/syslog-ng/faq.html> > > > > > > > >

1 0

strange problem when use "_" in the destination log file name
by Arnold Wang 05 Aug '05

05 Aug '05

Hi, I'm running into a strange problem with syslog-ng 1.6.8 on RHEL 4. In my configuration file, I have the following local log file defined: destination d_file { file("/var/syslog- ng/HOSTS/$HOST/$YEAR/$MONTH/$HOST_$MONTH$DAY.log" owner(root) group (root) perm(0600) dir_perm(0700) create_dirs(yes)); }; However, the log file generated by the syslog-ng for today is named "0803.log", which is different than "hostname_0803.log" as I expected. I tried using escape "\" so it looks like "$HOST\_$MONTH$DAY.log" and it didn't help at all. This problem actually doesn't bother me that much. I changed "_" to "-" or ".", it worked. I'm just curious about this.

4 9

Spoof-source issue
by Jose Gerardo Amaya Giron 05 Aug '05

05 Aug '05

Hello all. I'm using the spoof source feature to centralize my logs to a server. I was hoping that the server will receive the IP message with the source IP address from the source(spoofed of course), but it get it as the source address the syslog-ng server and the spoofed IP address in the message content. Is there a way I can generate the message not with the original source IP as a description, but to have it actually as the IP message. Thanks in advance Gerardo Amaya ---------------------------------------------------------------- Servicio de correo - Universidad Galileo - Guatemala

2 1

How to make syslog to write to a new file every 10 mins
by Hermann Tse 04 Aug '05

04 Aug '05

Hi, I can make it to write to a new file every hour by the following destination firewall {file ("var/log/firewall/firewall_$YEAR_$MONTH_$DAY_$HOUR")} but how I can make it to write to a new file every 5 minutes or 10 minutes? Thanks __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

FW: Mark from 1.9.4 to 1.9.5
by Edward Brookhouse 04 Aug '05

04 Aug '05

I was mistaken - the - MARK - is back - My only option left is to hack the source and remove the function and the reference to it - Anyone have any other suggestions for getting rid of the Mark ??? Is there a compile time option to turn this off??? Even stranger is that the source declares: cfg.c: self->mark_freq = 1200; /* 20 minutes */ but I am seeing a mark once an hour TIA EB _____ From: Edward Brookhouse [mailto:ebroo@healthydirections.com] Sent: Wednesday, August 03, 2005 9:58 AM To: 'Syslog-ng users' and developers' mailing list' Subject: Mark from 1.9.4 to 1.9.5 Hi all, Using 1.9.4 I experienced the -Mark-being inserted although no mark() option was specified in the config - I just upgraded to the 1.9.5 source and the behavior of mark seems to be back to normal - Just FYI E

3 3

RE: [syslog-ng] FW: Mark from 1.9.4 to 1.9.5
by Frans Stekelenburg 04 Aug '05

04 Aug '05

Are you absolutly sure it isn't a setting somewhere in /etc? You may set the interval to anything you like on Debian by editing /etc/init.d/sysklogd. This sets it to 60 minutes: SYSLOGD="-m 60" (Then restart the syslog daemon: # /etc/init.d/sysklogd restart ) On Red Hat and derivatives, edit /etc/sysconfig/syslog : SYSLOGD_OPTIONS="-m 60" Must come from somewhere, right? ;-) ________________________________ From: Edward Brookhouse [mailto:ebroo@healthydirections.com] Sent: woensdag 3 augustus 2005 18:56 To: 'Syslog-ng users' and developers' mailing list' Subject: [syslog-ng] FW: Mark from 1.9.4 to 1.9.5 I was mistaken - the - MARK - is back - My only option left is to hack the source and remove the function and the reference to it - Anyone have any other suggestions for getting rid of the Mark ??? Is there a compile time option to turn this off??? Even stranger is that the source declares: cfg.c: self->mark_freq = 1200; /* 20 minutes */ but I am seeing a mark once an hour TIA EB ________________________________ From: Edward Brookhouse [mailto:ebroo@healthydirections.com] Sent: Wednesday, August 03, 2005 9:58 AM To: 'Syslog-ng users' and developers' mailing list' Subject: Mark from 1.9.4 to 1.9.5 Hi all, Using 1.9.4 I experienced the -Mark-being inserted although no mark() option was specified in the config - I just upgraded to the 1.9.5 source and the behavior of mark seems to be back to normal - Just FYI E

2 1

Re: syslog-ng Digest, Vol 4, Issue 5
by Arnold Wang 03 Aug '05

03 Aug '05

Thanks for your help, Valdis. I run the strace and found the missing library files. My current $CHROOTDIR looks like this: ./ ./lib ./lib/libnss_dns.so.2 ./etc ./etc/ld.so.cache ./etc/resolv.conf ./etc/localtime ./etc/host.conf ./etc/hosts ./etc/syslog-ng ./etc/syslog-ng/syslog-ng.conf ./etc/nsswitch.conf ./dev ./dev/zero ./dev/null ./var ./var/log ./var/log/syslogng.log ./var/log/HOSTS I guess I'll need more files once I start logging to MYSQL, however it should be a easy task now with the help of strace and the kind people of this list, I hope. On Wed, 2005-08-03 at 12:00 +0200, syslog-ng-request(a)lists.balabit.hu wrote: > On Tue, 02 Aug 2005 15:28:01 PDT, Arnold Wang said: > > > I'm running syslog-ng in chroot mode, followed the instructions in > > http://www.campin.net/syslog-ng/chroot-jail.html. I also enabled DNS > > lookup so I can show the Cisco routers in their friendly names instead > > of IPs. The DNS lookup works fine until I enabled chroot mode. I copied > > "nsswitch.conf" and "resolv.conf" files into $CHROOTDIR/etc as well, > > just in case. > > You'll also need any shared libs your syslog-ng binary needs (use ldd to find them), > and probably stuff in $CHROOT/dev as well (dev/null and dev/zero come to mind). > > I'm probably missing something here - 'strace -f chroot $CHROOT bin/syslog-ng' will > show you if you're missing anything else... > > > BTW, the host is RHEL4 and I set SELinux to "permissive". > > 'permissive' will probably throw a whole lot of AVC messages unless you label > the contexts for the files in the chroot tree (fortunately, there's hopefully > not a lot, so hand-labelling is probably feasible). Sorry, the inability to > use 'restorecon' to label a chroot tree is a known deficiency in the current > tools... > > Fortunately, in permissive mode, each avc message is only printed once, so you'll > get spammed with a bunch of messages at startup (and probably one/two more logmsgs > for each logfile it opens). > > > Will my configuration work? If so, what should I check? Thanks in > > advance for help. > > Shared libs.. /dev entries. The strace command I gave should help find > other stuff that's missing. Good luck. ;)

1 0

Mark from 1.9.4 to 1.9.5
by Edward Brookhouse 03 Aug '05

03 Aug '05

Hi all, Using 1.9.4 I experienced the -Mark-being inserted although no mark() option was specified in the config - I just upgraded to the 1.9.5 source and the behavior of mark seems to be back to normal - Just FYI E

1 0

RE: [syslog-ng] syslog-ng- filter() problem
by Frans Stekelenburg 03 Aug '05

03 Aug '05

try making another filter first with the three filters and 'or' statements. Sounds like your config creates an and-and-and situation for you, leading in nothing beeing logged. I think I came across this situation on one of the helpful pages around (google), but unfortunatly don't remember where, so I can't refer you to it. regards, frans _____ From: Kelly Pow [mailto:kelly.pow@sjrb.ca] Sent: dinsdag 2 augustus 2005 18:55 To: Syslog-ng users' and developers' mailing list; ebroo(a)healthydirections.com Subject: RE: [syslog-ng] syslog-ng- filter() problem Hi, I am collecting traps and syslog data Yes they are being sent to the right place. Yes the destinations exist and the permissions are correct I am running Gentoo And syslog-ng version- 1.6.5-r2 The problem is: log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; if I only have : log { source(src); filter(f_snmptrap); destination(ipbb_traps); }; or log { source(src); filter(f_ipbb1); destination(ipbb_traps); }; but when I add more filters it give me nothing Why? Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Edward Brookhouse Sent: Friday, July 29, 2005 5:08 AM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] syslog-ng- filter() problem Are you collecting traps or syslog data ? Tcpdump is your friend - are the syslog speakers speaking to the right place ? Is anything else being logged on the box from other sources? Does the destination exist and permissions correct What os ? Which versions of syslog-ng _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Kelly Pow Sent: Thursday, July 28, 2005 5:55 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng- filter() problem Hi, I am trying to collect traps from these two networks. 66.163.79.0/255.255.255.128 and 64.251.65.224/255.255.255.240 I don't understand why when I do this it doesn't collect anything Any ideas/.?? ------------------------------------------------------------------------ ------------------------------- source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #filter snmptrap filter f_snmptrap { level(warn); }; #testing filters for the different networks filter f_ipbb1 {netmask("66.163.79.0/255.255.255.128"); }; filter f_ipbb2 {netmask("64.251.65.224/255.255.255.240"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; ------------------------------------------------------------------------ ----------------------------------- Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca

1 0