- syslog-ng - lists.balabit.hu

Strange behaviour, Cisco, UDP & $HOST
by Jussi Tawaststjerna 01 Aug '05

01 Aug '05

Hello, Did a quick glance on the archives but didn't find an answer to this one, spent a good time googling too. Hopefully someone can help. I'm trying to build a central loghost with syslog-ng 1.9.5, for use with linux servers and cisco routers, and ran into a nice li'l problem. First some configuration: --8<-- options { chain_hostnames(no); long_hostnames(on); sync(0); keep_hostname(yes); dns_cache(yes); use_fqdn(yes); use_dns(yes); log_fifo_size(2048); log_msg_size(8192); }; source local { unix-stream("/dev/log"); internal(); }; source network { udp(ip("x.x.x.x") port(514)); }; (x.x.x.x is the interface machines are configured to use) destination hosts { file("/var/log/$HOST/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; .. .. log { source(network); destination(hosts); }; --8<-- It "works". I have two machines set up to send logs to this host, my own machine domain.org and a cisco device ciscorouter.net. When I do something on my machine to generate log, directory /var/log/domain.org is created and files appear in it, by facility. Sweet. domain.org resolves into an IP and the IP PTR is domain.org .. ciscorouter.net resolves into IP and IP PTR is ciscorouter.net .. OKAY, heart of the problem: Now I go to a Cisco device (7200 series) which is configured to send local3 to loghost, is working already with another sysklogd-host. I issue "conf t", ctrl-z and "wri", and the router sends a line to loghost, and loghost should create /var/log/<routers fqdn> and a file named local3 inside, right? Nope. The directory does not appear. No logfile is created or appended anywhere within loghost. Then I go to domain.org, exit from su and su back in again (generate a line of log) .. Now I see a new file on loghost, /var/log/domain.org/local3 .. and on one single line with no CR/LF it reads: Aug 1 11:23:53 domain.org/domain.org 915: *Aug 1 10:17:16.613: %SYS-5-CONFIG_I: Configured from console by user on vty0 (x.x.x.x)<86>su[2896]: + pts/23 user:root For the people not familiar with Cisco log entries, everything before <86> came from the Cisco, and starting from "su" is my domain.org linux. domain.org doesn't log anything using local3, this file shouldn't even exist. Can someone please immediately see what's wrong here, and what to put in syslog-ng.conf? Thank you very much. --- Jussi Tawaststjerna Nebula Oy ---

2 2

problem receiving non-NULL terminated UDP messages
by e09f6a7593f8ae3994ea57e1117f67ec 30 Jul '05

30 Jul '05

Hi, I have the same problem as someone 2 years ago (https://lists.balabit.hu/pipermail/syslog-ng/2003-September/005414.html) with UDP messages. Problem: My OpenWRT based wifi router messages are not recognized and written to file via syslog-ng-1.9.5. The configuration file constsits of single udp() source and destination to single file. Symptoms: I am running `./syslog-ng -F -v -d -e` and after receiving an UDP log message I get a log_reader_fd_prepare(); messages in console window, so that means that the packet has arrived. (also checked with tcpdump for that). Despite packet arrival nothing is written to log file. The udp message does not end with NULL character as expected in logreader.c/log_reader_iterate_buf() function. I scanned the RFC for that but there is not defined that the message must terminate with a NULL character. Workaround: (needs testing for side-efects) Replace in afsocket.c:425 line with self->reader = log_reader_new(... (self->flags & AFSOCKET_LOCAL) ? LR_LOCAL|LR_PKTTERM : LR_PKTTERM,...); (Insert fixed LR_PKTTERM flag) Debugging process and toughts: After a while debugging with gdb I noticed that logreader.c/log_reader_iterate_buf() does not recognise the incoming message because it is not terminated by a NULL or NL character. I noticed that there exists a flag LR_PKTTERM which is supposed to be used in UDP sources so I went after LR_PKTTERM flag. The only place that flag is set is in afsocket.c/afsocket_sc_init() function and only if socket is a DGRAM type. If you trace back you see that afsocket_sc_init() is used from afsocket_sc_new() which is used from afsocket_sd_process_connection() which is used from afsocket_sd_accept() which is used from afsocket_sd_init(). Let's stop now at afsocket_sd_init() function: If you look carefully you can notice that afsocket_sd_accept() function is used as callback _only_ if used in STREAM sockets and not DGRAM! For DGRAM sockets the reader is creaded by log_reader_new() and with flags set as `(self->flags & AFSOCKET_LOCAL) ? LR_LOCAL : 0`. That means that log_reader_iterate_buf() does not have LR_PKTTERM flag set and thus not extracting UDP message from my router. As I can see afsocket.c/afsocket_sc_init() function is not used by DGRAM connections at all thus LR_PKTTERM is never set. Thanks for patience :) Pinky

2 3

compiling on Redhat Linux ES 4 with Solaris support
by Jeff Wilson 29 Jul '05

29 Jul '05

Ok I can compile and configure syslog-ng with out Solaris support but when I add --enable-sun-streams to the configure command and then run make I get an error. I have searched every where I can for an answer but can not find one. Any help would be appreciated. here is the out put. [syslog-ng-1.6.8]# make Making all in src make[1]: Entering directory `/root/jeff/syslog-ng-1.6.8/src' make all-recursive make[2]: Entering directory `/root/jeff/syslog-ng-1.6.8/src' Making all in . make[3]: Entering directory `/root/jeff/syslog-ng-1.6.8/src' if gcc -DHAVE_CONFIG_H -I. -I/root/jeff/syslog-ng-1.6.8/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -MT afstreams.o -MD -MP -MF ".deps/afstreams.Tpo" \ -c -o afstreams.o `test -f 'afstreams.c' || echo '/root/jeff/syslog-ng-1.6.8/src/'`afstreams.c; \ then mv -f ".deps/afstreams.Tpo" ".deps/afstreams.Po"; \ else rm -f ".deps/afstreams.Tpo"; exit 1; \ fi afstreams.c:38:24: sys/strlog.h: No such file or directory afstreams.c: In function `do_stream_read': afstreams.c:95: error: storage size of 'lc' isn't known afstreams.c:95: warning: unused variable `lc' afstreams.c: In function `do_init_afstreams_source': afstreams.c:238: error: `I_CONSLOG' undeclared (first use in this function) afstreams.c:238: error: (Each undeclared identifier is reported only once afstreams.c:238: error: for each function it appears in.) make[3]: *** [afstreams.o] Error 1 make[3]: Leaving directory `/root/jeff/syslog-ng-1.6.8/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/jeff/syslog-ng-1.6.8/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/root/jeff/syslog-ng-1.6.8/src'

2 2

syslog-ng- filter() problem
by Kelly Pow 29 Jul '05

29 Jul '05

Hi, I am trying to collect traps from these two networks. 66.163.79.0/255.255.255.128 and 64.251.65.224/255.255.255.240 I don't understand why when I do this it doesn't collect anything Any ideas/.?? ---------------------------------------------------------------------------- --------------------------- source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #filter snmptrap filter f_snmptrap { level(warn); }; #testing filters for the different networks filter f_ipbb1 {netmask("66.163.79.0/255.255.255.128"); }; filter f_ipbb2 {netmask("64.251.65.224/255.255.255.240"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; ---------------------------------------------------------------------------- ------------------------------- Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca>

3 2

syslog-ng fails to bind socket
by javier rojas 29 Jul '05

29 Jul '05

hello, im configuring syslog-ng to log on central logserver, however, when trying to start the server i get this error: jrojas:/etc/syslog-ng# /etc/init.d/syslog-ng start # Start syslog-ng CONSOLE_LOG_LEVEL is of unaccepted value. KERNEL_RINGBUF_SIZE is of unaccepted value. Starting system logging: syslog-ngio.c: bind_unix_socket(): bind failed /etc/log/log (No such file or directory) Error initializing configuration, exiting. start failed. can anyone help me out here... do i have to add the ip entry on /etc/hosts on the server side?, i allowed the entry on the client side... i'm all lost here... -- Ciao,Javier linux user #393724

2 1

syslog-ng to syslog not working
by Gerardo Amaya 29 Jul '05

29 Jul '05

Hello all. I have a syslog-ng server and I want to forward some messages to a Syslogd Server. I don't want stunnel or anything special, just send syslog-ng messages via udp(514), but right now I get the following error: Jul 22 20:10:06 s_localhost@RHTSRV syslog-ng[31406]: io.c: do_write: write() fai led (errno 111), Connection refused Jul 22 20:10:06 s_localhost@RHTSRV syslog-ng[31406]: Connection broken to AF_INE T(192.168.4.252:514), reopening in 60 seconds Jul 22 20:11:07 s_localhost@RHTSRV syslog-ng[31406]: io.c: do_write: write() fai led (errno 111), Connection refused Jul 22 20:11:07 s_localhost@RHTSRV syslog-ng[31406]: Connection broken to AF_INE T(192.168.4.252:514), reopening in 60 seconds Jul 22 20:12:07 s_localhost@RHTSRV syslog-ng[31406]: io.c: do_write: write() fai led (errno 111), Connection refused Jul 22 20:12:07 s_localhost@RHTSRV syslog-ng[31406]: Connection broken to AF_INE T(192.168.4.252:514), reopening in 60 seconds This is the definition in my syslog-ng.conf file source s_localhost { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination d_TestServer { udp ("192.168.4.252" port(514)); }; log { source(s_localhost); destination(d_localhost); destination(d_TestServer); }; Can someone help me to find the source of the problem? Thanks in advance Gerardo Amaya

3 3

syslog-ng not logging in mysql
by javier rojas 28 Jul '05

28 Jul '05

hello, i created the pipe file on /tmp (/tmp/mysql.pipe) but it doesn't write the logs into the mysql db, here's the extract from the syslog-ng.conf file: destination d_mysql {pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(20)); }; log { source(net); destination(d_mysql); }; it just doesn't work and i've followed the steps from the documentation on www.vermeer.org... so if anybody can help me... -- Ciao,Javier linux user #393724

1 0

[PATCH] [1.9.5] address flex warning and suboptimal distclean target
by Roberto Nibali 28 Jul '05

28 Jul '05

Hello, The attached patch fixes following two things: 1. #define YY_NO_UNPUT 1 is an undocumented feature of flex and has been obsoleted in recent flex versions. So this is a void operation. The correct way of dealing with the compiler warning is to add %option nounput as flex directive. 2. cfg-lex.c is autogenerated during the make compile process. However it is never removed, especially not for the distclean target. IMHO this is not so clean, so I've added cfg-lex.c to the list of the to-be-removed files. Please consider applying. Cheers, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc

2 1

ipv6 support
by Conor Svensson 28 Jul '05

28 Jul '05

What's the status of ipv6 support for syslog-ng, as far as I could tell from the doco, support does not currently exist & is not planned in the near future? I would be very grateful for any info on this. Many thanks, Conor ______________________________________________________ In the Invesment Research business? Want to improve your client offering? Production costs getting out of control? Agile Research is the answer. http://www.evolution.net/propositions/agile/index.html ______________________________________________________ Evolution is the investment banking and venture capital industry's first choice for practical advice on strategy, business process and the application of advanced technology. Evolution Tel: +44 (0) 20 7664 6640 Peninsular House Fax: +44 (0) 20 7664 6641 30-36 Monument Street London EC3R 8LJ URL: http://www.evolution.net United Kingdom ______________________________________________________ The information in this Internet e-mail is confidential and is intended solely for the addressee. Access, copying or re-use of information in it by anyone else is unauthorised. Any views or opinions presented are solely those of the author and do not necessarily represent those of Evolution or any of its affiliates. If you are not the intended recipient please contact Evolution, London, +44 (0) 20 7664 6640 _____________________________________________________

2 1

syslog starting trouble
by javier rojas 27 Jul '05

27 Jul '05

hello, i just installed syslog-ng in my debian box, but i can't seem to be able to start it, each time i get the same error: jrojas:/etc/init.d# /etc/init.d/syslog-ng stop # Stop syslog-ng CONSOLE_LOG_LEVEL is of unaccepted value. KERNEL_RINGBUF_SIZE is of unaccepted value. Stopping system logging: syslog-ng not running. does anybody knows why i-m getting this error? or even better..... does anybody knows how to fix it? i got nothing from google..... -- Ciao,Javier

2 1