- syslog-ng - lists.balabit.hu

help on DNS issue when running syslog-ng chrooted
by Arnold Wang 03 Aug '05

03 Aug '05

Hi, I'm a newbie to the syslog-ng. I just have the application installed and configured since yesterday and I like it already. However, I'm running into a problem. I hope someone on this list has done it already and can help me out. I'm running syslog-ng in chroot mode, followed the instructions in http://www.campin.net/syslog-ng/chroot-jail.html. I also enabled DNS lookup so I can show the Cisco routers in their friendly names instead of IPs. The DNS lookup works fine until I enabled chroot mode. I copied "nsswitch.conf" and "resolv.conf" files into $CHROOTDIR/etc as well, just in case. BTW, the host is RHEL4 and I set SELinux to "permissive". Will my configuration work? If so, what should I check? Thanks in advance for help.

2 1

syslog-ng starting problem
by javier rojas 02 Aug '05

02 Aug '05

hello, i'm getting an error when trying to start the syslog-ng server... here's the error: [root@monitor-2 etc]# /etc/init.d/syslog-ng start Starting system logger: parse error at 16 Parse error reading configuration file, exiting. [FAILED] Starting kernel logger: [root@monitor-2 etc]# here's the syslog-ng.conf file: # # Configuration file for syslog-ng under Debian # # attempts at reproducing default syslog behavior # the standard syslog levels are (in descending order of priority): # emerg alert crit err warning notice info debug # the aliases "error", "panic", and "warn" are deprecated # the "none" priority found in the original syslogd configuration is # only used in internal messages created by syslogd ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY',---line 16 '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; ## Log on to text file ## destination hosts { file("/var/log/$HOST.$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log {source(net); destination(hosts); }; ## Log on to text file ## destination hosts { file("/var/log/messages"); }; log {source(net); destination(hosts); }; #Then comment out this line -- # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; #Then uncomment out this line -- # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. source src { unix-dgram("/dev/log"); internal(); }; source net { udp(); }; ###### # options options { # disable the chained hostname format in logs # (default is enabled) chain_hostnames(0); # the time to wait before a died connection is re-established # (default is 60) time_reopen(10); # the time to wait before an idle destination file is closed # (default is 60) time_reap(360); # the number of lines buffered before written to file # you might want to increase this if your disk isn't catching with # all the log messages you get or if you want less disk activity # (say on a laptop) # (default is 0) #sync(0); # the number of lines fitting in the output queue log_fifo_size(2048); # enable or disable directory creation for destination files create_dirs(yes); # default owner, group, and permissions for log files # (defaults are 0, 0, 0600) #owner(root); group(adm); perm(0640); # default owner, group, and permissions for created directories # (defaults are 0, 0, 0700) #dir_owner(root); #dir_group(root); dir_perm(0755); # enable or disable DNS usage # syslog-ng blocks on DNS queries, so enabling DNS may lead to # a Denial of Service attack # (default is yes) use_dns(no); # maximum length of message in bytes # this is only limited by the program listening on the /dev/log Unix # socket, glibc can handle arbitrary length log messages, but -- for # example -- syslogd accepts only 1024 bytes # (default is 2048) #log_msg_size(2048); }; ###### # sources # all known message sources source s_all { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); # use the above line if you want to receive remote UDP logging messages # (this is equivalent to the "-r" syslogd flag) # udp(); }; ###### # destinations # some standard log files destination df_auth { file("/var/log/auth.log"); }; destination df_syslog { file("/var/log/syslog"); }; destination df_cron { file("/var/log/cron.log"); }; destination df_daemon { file("/var/log/daemon.log"); }; destination df_kern { file("/var/log/kern.log"); }; destination df_lpr { file("/var/log/lpr.log"); }; destination df_mail { file("/var/log/mail.log"); }; destination df_user { file("/var/log/user.log"); }; destination df_uucp { file("/var/log/uucp.log"); }; # these files are meant for the mail system log files # and provide re-usable destinations for {mail,cron,...}.info, # {mail,cron,...}.notice, etc. destination df_facility_dot_info { file("/var/log/$FACILITY.info"); }; destination df_facility_dot_notice { file("/var/log/$FACILITY.notice"); }; destination df_facility_dot_warn { file("/var/log/$FACILITY.warn"); }; destination df_facility_dot_err { file("/var/log/$FACILITY.err"); }; destination df_facility_dot_crit { file("/var/log/$FACILITY.crit"); }; # these files are meant for the news system, and are kept separated # because they should be owned by "news" instead of "root" destination df_news_dot_notice { file("/var/log/news/news.notice" owner("news")); }; destination df_news_dot_err { file("/var/log/news/news.err" owner("news")); }; destination df_news_dot_crit { file("/var/log/news/news.crit" owner("news")); }; # some more classical and useful files found in standard syslog configurations destination df_debug { file("/var/log/debug"); }; destination df_messages { file("/var/log/messages"); }; # pipes # a console to view log messages under X destination dp_xconsole { pipe("/dev/xconsole"); }; # consoles # this will send messages to everyone logged in destination du_all { usertty("*"); }; ###### # filters # all messages from the auth and authpriv facilities filter f_auth { facility(auth, authpriv); }; # all messages except from the auth and authpriv facilities filter f_syslog { not facility(auth, authpriv); }; # respectively: messages from the cron, daemon, kern, lpr, mail, news, user, # and uucp facilities filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; # some filters to select messages of priority greater or equal to info, warn, # and err # (equivalents of syslogd's *.info, *.warn, and *.err) filter f_at_least_info { level(info..emerg); }; filter f_at_least_notice { level(notice..emerg); }; filter f_at_least_warn { level(warn..emerg); }; filter f_at_least_err { level(err..emerg); }; filter f_at_least_crit { level(crit..emerg); }; # all messages of priority debug not coming from the auth, authpriv, news, and # mail facilities filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; # all messages of info, notice, or warn priority not coming form the auth, # authpriv, cron, daemon, mail, and news facilities filter f_messages { level(info,notice,warn) and not facility(auth,authpriv,cron,daemon,mail,news); }; # messages with priority emerg filter f_emerg { level(emerg); }; # complex filter for messages usually sent to the xconsole filter f_xconsole { facility(daemon,mail) or level(debug,info,notice,warn) or (facility(news) and level(crit,err,notice)); }; ###### # logs # order matters if you use "flags(final);" to mark the end of processing in a # "log" statement # these rules provide the same behavior as the commented original syslogd rules # auth,authpriv.* /var/log/auth.log log { source(s_all); filter(f_auth); destination(df_auth); }; # *.*;auth,authpriv.none -/var/log/syslog log { source(s_all); filter(f_syslog); destination(df_syslog); }; # this is commented out in the default syslog.conf # cron.* /var/log/cron.log #log { # source(s_all); # filter(f_cron); # destination(df_cron); # daemon.* -/var/log/daemon.log log { source(s_all); filter(f_daemon); destination(df_daemon); }; # kern.* -/var/log/kern.log log { source(s_all); filter(f_kern); destination(df_kern); }; # lpr.* -/var/log/lpr.log log { source(s_all); filter(f_lpr); destination(df_lpr); }; # mail.* -/var/log/mail.log log { source(s_all); filter(f_mail); destination(df_mail); }; # user.* -/var/log/user.log log { source(s_all); filter(f_user); destination(df_user); }; # uucp.* /var/log/uucp.log log { source(s_all); filter(f_uucp); destination(df_uucp); }; # mail.info <http://mail.info> -/var/log/mail.info log { source(s_all); filter(f_mail); filter(f_at_least_info); destination(df_facility_dot_info); }; # mail.warn -/var/log/mail.warn log { source(s_all); filter(f_mail); filter(f_at_least_warn); destination(df_facility_dot_warn); }; # mail.err /var/log/mail.err log { source(s_all); filter(f_mail); filter(f_at_least_err); destination(df_facility_dot_err); }; # news.crit /var/log/news/news.crit log { source(s_all); filter(f_news); filter(f_at_least_crit); destination(df_news_dot_crit); }; # news.err /var/log/news/news.err log { source(s_all); filter(f_news); filter(f_at_least_err); destination(df_news_dot_err); }; # news.notice /var/log/news/news.notice log { source(s_all); filter(f_news); filter(f_at_least_notice); destination(df_news_dot_notice); }; # *.=debug;\ # auth,authpriv.none;\ # news.none;mail.none -/var/log/debug log { source(s_all); filter(f_debug); destination(df_debug); }; # *.=info;*.=notice;*.=warn;\ # auth,authpriv.none;\ # cron,daemon.none;\ # mail,news.none -/var/log/messages log { source(s_all); filter(f_messages); destination(df_messages); }; # *.emerg * log { source(s_all); filter(f_emerg); destination(du_all); }; # daemon.*;mail.*;\ # news.crit;news.err;news.notice;\ # *.=debug;*.=info;\ # *.=notice;*.=warn |/dev/xconsole log { source(s_all); filter(f_xconsole); destination(dp_xconsole); }; does anybody know why?.... thanx...!!! -- Ciao,Javier linux user #393724

1 0

RE: [syslog-ng] Mark problems
by Frans Stekelenburg 02 Aug '05

02 Aug '05

I think it is (also) something that can be turned on on a SYSLOG client (sending host) with an extra option to the syslog daemon, and in it's local syslog.conf. The fact that you don't have mark in your conf, explains perhaps why it is not filtered out;-) Regards, Frans Some info from our internal KB: Add mark.debug to the syslog.conf # Selector Action Comment mark.debug;*.debug @centrallog # 10.20.30.40 Mark Messages ------------- Make use of mark messages (time stamps). Mark messages can be turned on to make it easier to analyze the timeline of messages and to identify possible gaps within the log archives. Mark messages are generated by syslogd after a predefined time period. Other periods can be specified during the syslogd startup. To activate mark messages, the script file that starts syslogd needs to be to edited. The file "/etc/init.d/syslog" (solaris) must be edited within the "start" section. In the following example, syslogd is called to set a mark interval of 10 minutes, as follows: /usr/sbin/syslog -m 10 1>/dev/console 2>&1 If only -m is stated, the default interval is 20 minutes. > -----Original Message----- > From: Edward Brookhouse [mailto:ebroo@healthydirections.com] > Sent: dinsdag 2 augustus 2005 13:33 > To: 'Syslog-ng users' and developers' mailing list' > Subject: [syslog-ng] Mark problems > > Hi all, > > I am using Syslog-NG 1.9.4 on Fedora Core4 - and I am seeing -- > MARK - in my logs when I should not be. > > To my understanding (via google and man pages) If you put the option * > mark(n) in the options section you will get a -- MARK -- > every N times. > > I have no mark option... > > Any thoughts on how to trouble shoot? > > > My conf file has this for options > > options { > # use_fqdn(yes); > # use_dns(yes); > # dns_cache(yes); > keep_hostname(yes); > long_hostnames(off); > sync(1); > log_fifo_size(1024); > }; > > > A search for mark in the conf returns nada ... > > > TIA > > Edward > Ebrooathealthydirectionsdotcomlame > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

3 2

RE: [syslog-ng] ng to ng then to syslog
by Frans Stekelenburg 02 Aug '05

02 Aug '05

I agree with the previous poster, why indeed use another (lesser) syslog ;-) But if you insist: Try with the 'spoof_source(yes)' as option in your tcp(... <options>). I also learned that localip() can be used to force a certain local ip, but I don't think that applies to your setup. Ref: http://www.balabit.com/products/syslog_ng/reference-2.0/syslog-ng.html/i ndex.html#destinations 'luck! Frans -----Original Message----- From: Gerardo Amaya [mailto:joseg@galileo.edu] Sent: Friday, July 29, 2005 11:10 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] ng to ng then to syslog Hello all. First thanks for all the help on first issue, it was some stupid filter. I'm configured to send syslog messages from server1 to server2 both with syslog-ng. Now what I need is to pass messages from server1 to server2 via syslog-ng(already done that) and as soon as the event gets in syslog-ng of server2 to send it to syslog daemon in server2. I have also done that but the problem is that the events appear as they are coming locally and not from server1. Is there a way to change that? thanks in advance Gerardo Amaya _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3

RE: [syslog-ng] syslog-ng- filter() problem
by Kelly Pow 02 Aug '05

02 Aug '05

Hi, I am collecting traps and syslog data Yes they are being sent to the right place. Yes the destinations exist and the permissions are correct I am running Gentoo And syslog-ng version- 1.6.5-r2 The problem is: log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; if I only have : log { source(src); filter(f_snmptrap); destination(ipbb_traps); }; or log { source(src); filter(f_ipbb1); destination(ipbb_traps); }; but when I add more filters it give me nothing Why? Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca> _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Edward Brookhouse Sent: Friday, July 29, 2005 5:08 AM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] syslog-ng- filter() problem Are you collecting traps or syslog data ? Tcpdump is your friend - are the syslog speakers speaking to the right place ? Is anything else being logged on the box from other sources? Does the destination exist and permissions correct What os ? Which versions of syslog-ng _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Kelly Pow Sent: Thursday, July 28, 2005 5:55 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng- filter() problem Hi, I am trying to collect traps from these two networks. 66.163.79.0/255.255.255.128 and 64.251.65.224/255.255.255.240 I don't understand why when I do this it doesn't collect anything Any ideas/.?? ---------------------------------------------------------------------------- --------------------------- source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #filter snmptrap filter f_snmptrap { level(warn); }; #testing filters for the different networks filter f_ipbb1 {netmask("66.163.79.0/255.255.255.128"); }; filter f_ipbb2 {netmask("64.251.65.224/255.255.255.240"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; ---------------------------------------------------------------------------- ------------------------------- Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca>

1 0

problems with mysql pipe
by javier rojas 02 Aug '05

02 Aug '05

hello, i'm having trouble with the template i created to pipe to mysql (acording to php-syslog-ng), at first it was working fine but then (i started messing around) and it just stop working, i had configure syslog-ng to store logs coming from server A into mysql and on a text file, here's my syslog-ng.conf : ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; ## Log on to text file ## destination hosts { file("/var/log/$HOST.$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log {source(net); destination(hosts); }; #Then comment out this line -- # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; #Then uncomment out this line -- # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. source src { unix-dgram("/dev/log"); internal(); }; source net { udp(); }; it actually worked, but i don't know what i did, i see the logs coming from server A (#tcpdump host server A and port 514) but it doesn't store them on mysql... help please!!! -- Ciao,Javier linux user #393724

1 0

Mark problems
by Edward Brookhouse 02 Aug '05

02 Aug '05

Hi all, I am using Syslog-NG 1.9.4 on Fedora Core4 - and I am seeing -- MARK - in my logs when I should not be. To my understanding (via google and man pages) If you put the option * mark(n) in the options section you will get a -- MARK -- every N times. I have no mark option... Any thoughts on how to trouble shoot? My conf file has this for options options { # use_fqdn(yes); # use_dns(yes); # dns_cache(yes); keep_hostname(yes); long_hostnames(off); sync(1); log_fifo_size(1024); }; A search for mark in the conf returns nada ... TIA Edward Ebrooathealthydirectionsdotcomlame

1 0

ng to ng then to syslog
by Gerardo Amaya 01 Aug '05

01 Aug '05

Hello all. First thanks for all the help on first issue, it was some stupid filter. I'm configured to send syslog messages from server1 to server2 both with syslog-ng. Now what I need is to pass messages from server1 to server2 via syslog-ng(already done that) and as soon as the event gets in syslog-ng of server2 to send it to syslog daemon in server2. I have also done that but the problem is that the events appear as they are coming locally and not from server1. Is there a way to change that? thanks in advance Gerardo Amaya

2 1

Syslog running slow
by Shlomi Wexler 01 Aug '05

01 Aug '05

Hi, I'm using Syslong-ng with Postgre SQL Database. I have a problem of queries running realy slow since the Database reached about 5 million records. Cleaning the DB and vacumdb didn't work and also other programs running on the same computer are running fine. I'm using Gentoo Linux. Does anyone have an idea ? Thanks Shlomi _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

syslo-ng to mysql and to plaintext file
by javier rojas 01 Aug '05

01 Aug '05

hello, i've configure successfuly the syslog-ng server to save logs on mysql 4.0and i would like it to store the logs (just for a test) on a text file ( example.txt), so i was searching aroun and found that i should add the followin line to syslog-ng.conf: destination file_text{ file("/var/log/example.txt"); }; i don't want to mess anything and i was wondering if it's ok or if anybody has set this before, i don't want it to stop saving it on mysql i just want syslog-ng to save in both (mysql and example.txt) at the same time... thanx for the help... -- Ciao,Javier linux user #393724

3 2