- syslog-ng - lists.balabit.hu

RE: [syslog-ng] host$
by SOLIS, ALEX 25 May '05

25 May '05

My syslog-ng setup will resolve to hostnames as long as the /etc/resolv.conf or /etc/hosts entries are valid. If you ping the hosts logging to your box by IP does it resolve to the hostname? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Speedy Sweedy Sent: Wednesday, May 25, 2005 12:34 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] host$ >Most likely, you have a borked syslog-ng.te that doesn't allow the >syslog-ng >process to read /etc/nsswitch.conf or similar, breaking DNS lookups. I used an RPM to install syslog-ng - could I get away with downloading the source, compile it and replace the syslog-ng bin? > >Grep through your logs and find any avc entries that reference syslog-ng. > >(And BTW - FC4 is about to escape, I'd *strongly* recommend upgrading to it >if you're doing any SELinux work - the policy definitions have been worked >on a *lot*. If you can't upgrade, at least get the updated SELinux RPMs >(they >should work OK on the FC3 kernel)). Yeah, I've read about FC4 being much better for syslog-ng. I'm about ready to start over using the FC4 test3 iso's but didn't know what happens once fc4 is released as far as installing the new released version. _________________________________________________________________ Don't just Search. Find! http://search.sympatico.msn.ca/default.aspx The new MSN Search! Check it out! _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

1 0

Netscreen fw logs not piped in mysql
by Christian Janssen 25 May '05

25 May '05

Hi, I'm close to give up and have following problem: * Netscreen Firewalls (Screen OS 5.1r3 & 4.1) * Syslog-ng [&php-syslog-ng] My System is Debian sarge, syslog-ng 1.6.5 a) Unix syslog entries are stored correctly in mysql database (and textfile) all seems fine ! b) Netscreen syslog infos are logged as expected in txt file (see attach) c) [PROBLEM] but logging in mysql are not working, got following message from my pipe script ERROR at line 1: Unknown command '\"'. ERROR at line 1: Unknown command '\"'. ERROR at line 1: Unknown command '\"'. Maybe a truncating problem ? Seems related to following questions, but unfortunately never found a solution https://lists.balabit.hu/pipermail/syslog-ng/2004-November/006678.html http://www.experts-exchange.com/Security/Unix_Security/Q_21077259.html http://www.netscreenforum.com/viewtopic.php?t=1209&highlight=syslogng I followed mostly these instructions: http://gentoo-wiki.com/HOWTO_setup_PHP-Syslog-NG Hope somebody can help me and have an idea or solution. Many thanks in advance Cheers Christian ---------------------------------------------------- e.g. syslog Apr 25 14:08:38 172.29.8.2 co-gw: NetScreen device_id=co-gw system-notification-00257(traffic): start_time="2005-04-25 13:08:37" duration=0 policy_id=320001 service=udp/port:1985 proto=17 src zone=Null dst zone=self action=Deny sent=0 rcvd=48 src=195.122.33.7 dst=224.0.0.2 src_ Apr 25 14:08:38 196.35.45.2 co-gw: NetScreen device_id=co-gw system-notification-00257(traffic): start_time="2005-04-25 13:08:37" duration=0 policy_id=320001 service=proto:88/port:0 proto=88 src zone=Null dst zone=self action=Deny sent=0 rcvd=60 src=172.30.7.1 dst=224.0.0.10 ---------------------------------------------------- or e.g. sep. file via filter destination firewalls { file("/var/log/netscreen"); }; filter f_firewalls { facility(local7); }; log { source(s_all); filter(f_firewalls); destination(firewalls); }; Apr 25 17:45:06 172.29.5.163 ns5gt: NetScreen device_id=ns5gt [Root]system-information-00524: SNMP request from an unknown SNMP community at 172.29.5.146:32862 has been received. (2005-04-25 17:57:41) ----------------------------------------------------

1 1

syslog-ng 1.6.x on OpenBSD on sparc64
by Bostjan Golob 25 May '05

25 May '05

It appears that syslog-ng has an issue on OpenBSD/sparc64, as it does not determine the hostname of the remote system, making all messages appear to be from the syslog-ng server. The bug appears to be well hidden in sources.c. In line 98, the call to do_recv (as seen in gdb backtrace) is made, which requires a socklen_t* parameter. The catch is in line 88, where salen is declared as size_t and then cast to socklen_t; on sparc64, size_t is 64bit and socklen_t is 32bit and that causes the salen variable to always contain 0, causing the known bug. If you change line 88 to socklen_t salen = sizeof(sabuf), the host name of the sending host is determined correctly and written in the logfiles. That also explains why syslog-ng works correctly on OpenBSD/i386, but not on sparc64. Bostjan Golob IT department, Gimnazija Bezigrad, Ljubljana, SI

2 1

Error while making on Mac OS X Tiger
by Tristan Natsirt 25 May '05

25 May '05

I've got libol 0.3.16, glib 2.0.7, and i'm trying to configure and make syslog-ng-1.6.7 and I recieve the following errors: ./configure make [...] gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lresolv /usr/local/lib/libol.a -Wl,-Bstatic -lfl -lwrap -Wl,-Bdynamic ld: unknown flag: -Bstatic make[3]: *** [syslog-ng] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all] Error 2 make: *** [all-recursive] Error 1 any help at all would be much obliged. Thanks, Adam.

3 2

syslog-ng on Trusted Solaris
by Charles D Smith 24 May '05

24 May '05

I have been running syslog-ng on Solaris for the past few months. I would also like to try to run it on Trusted Solaris. Has any consideration been given to supporting syslog-ng on Trusted Solaris? Also if anyone has experimented with syslog-ng on Trusted Solaris, I would be interested in hearing about your experience. Thanks, Charles

1 0

Syslog-ng 1.9.4 configure/compile question
by Hokhold, Mark 24 May '05

24 May '05

Syslog-ng Users, I'm currently trying to configure syslog-ng 1.9.4 on my Sunblade 100 (Solaris 9) as a test. I've loaded and compiled the following software: Stunnel-4.10 openssl-0.9.7g eventlog-0.1.2 All three packages compiled cleanly. The "eventlog" compiled successfully, but no eventlog.pc was produced when completed and I still receive the following output compiling syslog-ng: # ./configure ..... ... checking GLIB CFLAGS... -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include checking GLIB_LIBS... -lglib-2.0 checking for eventlog... Package eventlog was not found in the pkg-config search path Perhaps you should add the directory containing `eventlog.pc` To the PKG_CONFIG_PATH environment variable No package 'eventlog' found Configure: error: Library requirements (eventlog) not met;....... ########################################################################### MORE INFO: I've been loading all packages under /usr/local, so by default everything will get placed within the /usr/local directory tree. I've tried NOT setting up the PKG_CONFIG and PKG_CONFIG_PATH variables -using the default. And I've also tried setting different values, all with the same results. Mark

1 0

RE: [syslog-ng] Syslog-ng 1.9.4 configure question
by Hokhold, Mark 24 May '05

24 May '05

Thanks Jerry, I'll get it a shot. Just another newbie. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Jerry Bell Sent: Tuesday, May 24, 2005 11:35 AM To: Syslog-ng users' and developers' mailing list Cc: 'syslog-ng(a)lists.balabit.hu' Subject: Re: [syslog-ng] Syslog-ng 1.9.4 configure question eventlog is a separate distribution that you need to compile and install. You can find it here: http://www.balabit.com/downloads/syslog-ng/1.9/src/ alongside the source for syslog-ng 1.9 > I checked my system and eventlog.pc doesn't exist on my > system, > so therefore I don't have this package installed. > Jerry http://www.syslog.org _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng] Syslog-ng 1.9.4 configure question
by Jerry Bell 24 May '05

24 May '05

eventlog is a separate distribution that you need to compile and install. You can find it here: http://www.balabit.com/downloads/syslog-ng/1.9/src/ alongside the source for syslog-ng 1.9 > I checked my system and eventlog.pc doesn't exist on my > system, > so therefore I don't have this package installed. > Jerry http://www.syslog.org

1 0

Syslog-ng 1.9.4 configure question
by Hokhold, Mark 24 May '05

24 May '05

Syslog-ng Users, I'm currently trying to configure syslog-ng 1.9.4 on my Sunblade 100 (Solaris 9) as a test. I've loaded and installed Stunnel-4.10 and openssl-0.9.7g so far, but when I configure syslog-ng, I get the following: # ./configure ..... ... checking GLIB CFLAGS... -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include checking GLIB_LIBS... -lglib-2.0 checking for eventlog... Package eventlog was not found in the pkg-config search path Perhaps you should add the directory containing `eventlog.pc` To the PKG_CONFIG_PATH environment variable No package 'eventlog' found Configure: error: Library requirements (eventlog) not met;....... I checked my system and eventlog.pc doesn't exist on my system, so therefore I don't have this package installed. Where can I find them? Thanks in advance, Mark

1 0

Re: syslog-ng Digest, Vol 1, Issue 1253
by M.Balajee 24 May '05

24 May '05

Hi, You can edit /etc/syslog-ng.conf file to avoid this. Edit this file so that you will not be seeing the messages on the console. On Tue, 24 May 2005 syslog-ng-request(a)lists.balabit.hu wrote : >Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > >To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng >or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > >You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of syslog-ng digest..." > > >Today's Topics: > > 1. Re: No line break every so often (Balazs Scheidler) > 2. how to avoid logging to consoles? (iv) > 3. Re: how to avoid logging to consoles? (Balazs Scheidler) > 4. Re: how to avoid logging to consoles? (Jesse Molina) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Mon, 23 May 2005 12:59:04 +0200 > From: Balazs Scheidler <bazsi(a)balabit.hu> >Subject: Re: [syslog-ng] No line break every so often >To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> >Message-ID: <1116845944.23550.11.camel(a)bzorp.balabit> >Content-Type: text/plain > >On Fri, 2005-05-20 at 12:14 -0700, Mike Tremaine wrote: > > On Fri, 2005-05-20 at 04:49, Balazs Scheidler wrote: > > > Luckly it is... Attached is a trimmed down trace file with a few > > examples of the problem [about 200lines let me know if more would be > > useful...] > > > > To my [uneducated] eye it looks like sendmail is the problem but like I > > said sometimes it does it right sometime it doesn't. > > > > Example: > > > > read(16, "<20>May 20 07:48:02 sendmail[16668]: j4KEkWOv016668: collect: > > premature EOM: unexpected close", 2048) = 93 > > > > Notice no \0 or \n > > > > Then the next read > > > > read(16, "<21>May 20 07:48:02 sendmail[16668]: j4KEkWOv016668: collect: > > unexpected close on connection from [61.43.165.161], > > sender=<Hager(a)indiatimes.com>\0<22>May 20 07:48:02 sendmail[16668]: > > j4KEkWOv016668: from=<Hager(a)indiatimes.com>, size=0, class=0, nrcpts=1, > > proto=SMTP, daemon=MTA, relay=[61.43.165.161]\0", 1955) = 300 > > > > > > A null terminator > > That leads to the output > > > > write(22, "2005-05-20 07:48:02 quasar mail.warning sendmail[16668]: > > j4KEkWOv016668: collect: premature EOM: unexpected close<21>May 20 > > 07:48:02 sendmail[16668]: j4KEkWOv016668: collect: unexpected close on > > connection from [61.43.165.161], > > sender=<Hager(a)indiatimes.com>\n2005-05-20 07:48:02 quasar mail.info > > sendmail[16668]: j4KEkWOv016668: from=<Hager(a)indiatimes.com>, size=0, > > class=0, nrcpts=1, proto=SMTP, daemon=MTA, relay=[61.43.165.161]\n", > > 430) = 430 > > . > > > > So the null was caught and turned into \n but the line before it runs > > together. With some weird <21> [and more often <22> see trace file]. > >Hm. Sendmail really seems to be the culprit, it is only hidden by >sysklogd using unix-dgram() sockets in which case the syslog daemon does >not care whether the message was NL or \0 terminated or not. > >The manpage for syslogd, mentions: > >... "A trailing newline is added when needed." > >This does not seem to be true. After judging the source it seems to be >adding the NL character only if LOG_PERROR is specified to openlog() >which clearly isn't the case for sendmail. > >I'd say this is a libc bug which you can work around by avoiding using >unix-stream and sticking to unix-dgram instead. (a solution which I >myself do not like). > >-- >Bazsi > > > >------------------------------ > >Message: 2 >Date: Mon, 23 May 2005 17:15:34 +0200 > From: iv <iv(a)zabuchy.net> >Subject: [syslog-ng] how to avoid logging to consoles? >To: syslog-ng(a)lists.balabit.hu >Message-ID: <4291F396.8040307(a)zabuchy.net> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >hi all >i'm trying to configure syslog-ng for logging events from firewall >everything works fine, except one thing: all messages appear on all my >consoles >how can i avoid that? it makes impossible working with the console, logs >appear even while editing files >and situation does't change when i comment out all "log" entries in the >syslog-ng.conf file >please, any ideas:) > >my syslog-ng.conf: > >options { > use_fqdn(yes); > use_dns(no); > chain_hostnames(yes); > use_time_recvd(no); ># sync(10); > > perm(0640); > owner("root"); > group("root"); > create_dirs(yes); > dir_perm(0750); > dir_owner("root"); > dir_group("root"); >}; > > > >source syslog { > unix-stream("/dev/log"); >}; > >source kernel { > file("/proc/kmsg"); >}; > >source syslog-ng { > internal(); >}; > > > >destination firewall { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/firewall"); >}; > >destination kernel { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/kernel"); >}; > >destination invalid { > file("/spool/unknown/$YEAR/$MONTH/$DAY/invalid"); >}; > >destination postfix { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/postfix"); >}; > >destination cron { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/cron"); >}; > >destination generic { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM"); >}; > >destination syslog-ng { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/syslog-ng"); >}; > >destination misc { > file("/spool/$HOST/$YEAR/$MONTH/$DAY/misc"); >}; > > >## kernel >filter firewall { > match("IN=") and match("OUT=") and match("PROTO="); >}; > >filter notfirewall { > not match("IN=") and not match("OUT=") and not match("PROTO="); >}; > >log { > source(kernel); > filter(firewall); > destination(firewall); >}; > >log { > source(kernel); > filter(notfirewall); > destination(kernel); >}; > > >## internal >log { > source(syslog-ng); > destination(syslog-ng); >}; > > >## syslog >filter invalid { > not host("^syslog@[a-z]+$"); >}; > >filter postfix { > host("^syslog@[a-z]+$") > and program("^postfix/"); >}; > >filter cron { > host("^syslog@[a-z]+$") > and program("^(/USR/SBIN/CRON|/usr/sbin/cron)$"); >}; > >filter generic { > host("^syslog@[a-z]+$") > and program("^([a-z][a-z._-]*)$"); >}; > >log { > source(syslog); > filter(invalid); > destination(invalid); >}; > >log { > source(syslog); > filter(postfix); > destination(postfix); >}; > >log { > source(syslog); > filter(cron); > destination(cron); >}; > >log { > source(syslog); > filter(generic); > destination(generic); >}; > >log { > source(syslog); > destination(misc); > flags(fallback); >}; > >i'm running linux debian 2.6.11.8 testing > >thanks in advance, >iv > > >------------------------------ > >Message: 3 >Date: Mon, 23 May 2005 18:08:35 +0200 > From: Balazs Scheidler <bazsi(a)balabit.hu> >Subject: Re: [syslog-ng] how to avoid logging to consoles? >To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> >Message-ID: <1116864515.19621.7.camel(a)bzorp.balabit> >Content-Type: text/plain > >On Mon, 2005-05-23 at 17:15 +0200, iv wrote: > > hi all > > i'm trying to configure syslog-ng for logging events from firewall > > everything works fine, except one thing: all messages appear on all my > > consoles > > how can i avoid that? it makes impossible working with the console, logs > > appear even while editing files > > and situation does't change when i comment out all "log" entries in the > > syslog-ng.conf file > > please, any ideas:) > >short answer: "dmesg -n1" > >long answer: syslog-ng does not change kernel logging parameters on its >own, which is performed automatically by klogd. but you can do the same >using dmesg. > >-- >Bazsi > > > >------------------------------ > >Message: 4 >Date: Mon, 23 May 2005 10:40:13 -0700 > From: Jesse Molina <jesse(a)opendreams.net> >Subject: Re: [syslog-ng] how to avoid logging to consoles? >To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> >Message-ID: <20050523174013.GA18331@shoebox> >Content-Type: text/plain; charset=us-ascii > > >Hi > >man dmesg > >Use the -n arg, which will do what you want. > >You will probably need to add this to a startup script. Use update-rc.d >for that, or make yourself a .deb if you must. > > > >On Mon, May 23, 2005 at 05:15:34PM +0200, iv wrote: > > hi all > > i'm trying to configure syslog-ng for logging events from firewall > > everything works fine, except one thing: all messages appear on all my > > consoles > > how can i avoid that? it makes impossible working with the console, logs > > appear even while editing files > > and situation does't change when i comment out all "log" entries in the > > syslog-ng.conf file > > please, any ideas:) > > > > my syslog-ng.conf: > > > > options { > > use_fqdn(yes); > > use_dns(no); > > chain_hostnames(yes); > > use_time_recvd(no); > > # sync(10); > > > > perm(0640); > > owner("root"); > > group("root"); > > create_dirs(yes); > > dir_perm(0750); > > dir_owner("root"); > > dir_group("root"); > > }; > > > > > > > > source syslog { > > unix-stream("/dev/log"); > > }; > > > > source kernel { > > file("/proc/kmsg"); > > }; > > > > source syslog-ng { > > internal(); > > }; > > > > > > > > destination firewall { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/firewall"); > > }; > > > > destination kernel { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/kernel"); > > }; > > > > destination invalid { > > file("/spool/unknown/$YEAR/$MONTH/$DAY/invalid"); > > }; > > > > destination postfix { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/postfix"); > > }; > > > > destination cron { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/cron"); > > }; > > > > destination generic { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM"); > > }; > > > > destination syslog-ng { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/syslog-ng"); > > }; > > > > destination misc { > > file("/spool/$HOST/$YEAR/$MONTH/$DAY/misc"); > > }; > > > > > > ## kernel > > filter firewall { > > match("IN=") and match("OUT=") and match("PROTO="); > > }; > > > > filter notfirewall { > > not match("IN=") and not match("OUT=") and not match("PROTO="); > > }; > > > > log { > > source(kernel); > > filter(firewall); > > destination(firewall); > > }; > > > > log { > > source(kernel); > > filter(notfirewall); > > destination(kernel); > > }; > > > > > > ## internal > > log { > > source(syslog-ng); > > destination(syslog-ng); > > }; > > > > > > ## syslog > > filter invalid { > > not host("^syslog@[a-z]+$"); > > }; > > > > filter postfix { > > host("^syslog@[a-z]+$") > > and program("^postfix/"); > > }; > > > > filter cron { > > host("^syslog@[a-z]+$") > > and program("^(/USR/SBIN/CRON|/usr/sbin/cron)$"); > > }; > > > > filter generic { > > host("^syslog@[a-z]+$") > > and program("^([a-z][a-z._-]*)$"); > > }; > > > > log { > > source(syslog); > > filter(invalid); > > destination(invalid); > > }; > > > > log { > > source(syslog); > > filter(postfix); > > destination(postfix); > > }; > > > > log { > > source(syslog); > > filter(cron); > > destination(cron); > > }; > > > > log { > > source(syslog); > > filter(generic); > > destination(generic); > > }; > > > > log { > > source(syslog); > > destination(misc); > > flags(fallback); > > }; > > > > i'm running linux debian 2.6.11.8 testing > > > > thanks in advance, > > iv > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > >-- ># Jesse Molina ># Mail = jesse(a)opendreams.net ># Page = page-jesse(a)opendreams.net ># Cell = 1.602.323.7608 ># Web = http://www.opendreams.net/jesse/ > > > > >------------------------------ > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng > > >End of syslog-ng Digest, Vol 1, Issue 1253 >****************************************** Muggalla Balajee,

1 0