- syslog-ng - lists.balabit.hu

how to avoid logging to consoles?
by iv 23 May '05

23 May '05

hi all i'm trying to configure syslog-ng for logging events from firewall everything works fine, except one thing: all messages appear on all my consoles how can i avoid that? it makes impossible working with the console, logs appear even while editing files and situation does't change when i comment out all "log" entries in the syslog-ng.conf file please, any ideas:) my syslog-ng.conf: options { use_fqdn(yes); use_dns(no); chain_hostnames(yes); use_time_recvd(no); # sync(10); perm(0640); owner("root"); group("root"); create_dirs(yes); dir_perm(0750); dir_owner("root"); dir_group("root"); }; source syslog { unix-stream("/dev/log"); }; source kernel { file("/proc/kmsg"); }; source syslog-ng { internal(); }; destination firewall { file("/spool/$HOST/$YEAR/$MONTH/$DAY/firewall"); }; destination kernel { file("/spool/$HOST/$YEAR/$MONTH/$DAY/kernel"); }; destination invalid { file("/spool/unknown/$YEAR/$MONTH/$DAY/invalid"); }; destination postfix { file("/spool/$HOST/$YEAR/$MONTH/$DAY/postfix"); }; destination cron { file("/spool/$HOST/$YEAR/$MONTH/$DAY/cron"); }; destination generic { file("/spool/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM"); }; destination syslog-ng { file("/spool/$HOST/$YEAR/$MONTH/$DAY/syslog-ng"); }; destination misc { file("/spool/$HOST/$YEAR/$MONTH/$DAY/misc"); }; ## kernel filter firewall { match("IN=") and match("OUT=") and match("PROTO="); }; filter notfirewall { not match("IN=") and not match("OUT=") and not match("PROTO="); }; log { source(kernel); filter(firewall); destination(firewall); }; log { source(kernel); filter(notfirewall); destination(kernel); }; ## internal log { source(syslog-ng); destination(syslog-ng); }; ## syslog filter invalid { not host("^syslog@[a-z]+$"); }; filter postfix { host("^syslog@[a-z]+$") and program("^postfix/"); }; filter cron { host("^syslog@[a-z]+$") and program("^(/USR/SBIN/CRON|/usr/sbin/cron)$"); }; filter generic { host("^syslog@[a-z]+$") and program("^([a-z][a-z._-]*)$"); }; log { source(syslog); filter(invalid); destination(invalid); }; log { source(syslog); filter(postfix); destination(postfix); }; log { source(syslog); filter(cron); destination(cron); }; log { source(syslog); filter(generic); destination(generic); }; log { source(syslog); destination(misc); flags(fallback); }; i'm running linux debian 2.6.11.8 testing thanks in advance, iv

3 2

No line break every so often
by Mike Tremaine 23 May '05

23 May '05

I just converted a Redhat 9 machine to syslog-ng yesterday and I'm having a littel problem with 2 lines running together. Here are the specs in question. mgt@quasar ~ [1] rpm -q syslog-ng syslog-ng-1.6.7-2 mgt@quasar ~ [2] rpm -q sendmail sendmail-8.13.3-2.rhl9 mgt@quasar ~ [3] rpm -q libol libol-0.3.16-1 mgt@quasar ~ [4] uname -a Linux quasar 2.4.20-37.9.legacy #1 Mon Sep 27 19:40:23 EDT 2004 i686 i686 i386 GNU/Linux The problem I'm seeing is every so often sendmail will log like so... May 18 17:45:46 quasar sendmail[30415]: j4J0jdNg030415: from=<millie.zuniga_om(a)southtrust.com>, size=2520, class=0, nrcpts=1, msgid=<2.2.32.2004051809282400312642(a)southtrust.com>, proto=ESMTP, daemon=MTA, relay=[220.80.216.171]<22>May 18 17:45:46 sendmail[30415]: j4J0jdNg030415: Milter add: header: Received-SPF: none (quasar.stellarcore.net: 220.80.216.171 is neither permitted nor denied by domain of southtrust.com) receiver=quasar.stellarcore.net; client-ip=220.80.216.171; helo=localhost; envelope-from=millie.zuniga_om(a)southtrust.com; x-software=spfmilter 0.93 http://www.acme.com/software/spfmilter/; Notice the 22 that should be a line break between the 2 log lines. Has anyone noticed something like this? -- Mike Tremaine mgt(a)stellarcore.net http://www.stellarcore.net

2 6

Logs rotate and compress but still log to compressed file
by Rechtorik, Keith 21 May '05

21 May '05

I am running SUSE 9.1 and I have syslog-ng logging information from our PIX. After a rotate is done the file is compressed and rotated but syslog-ng keeps logging to the compressed file instead of the newly created file. Any help would be greatly appreciated. Here are my conifgs. If you need anymore information I will gladly send it. /etc/logrotate.d/syslog /var/log/pix/voclog { rotate 4 daily compress delaycompress postrotate # kill -HUP `cat /var/run/syslog-ng.pid` # /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null ||true /etc/init.d/syslog reload /etc/init.d/apache2 reload endscript } /etc/syslog-ng/syslog-ng.conf source src { # # include internal syslog-ng messages # note: the internal() soure is required! # unix-stream("/dev/log"); internal(); tcp(); udp(); # # the following line will be replaced by the # socket list generated by SuSEconfig using # variables from /etc/sysconfig/syslog: # #@SuSEconfig_SOCKETS@ # # # uncomment to process log messages from network: # #udp(ip("0.0.0.0") port(514)); }; # # filter definitions # filter voclog { facility(local5); }; filter vpnlog { facility(local7); }; destination voclog { file("/var/log/pix/voclog"); }; log { source(src); filter(voclog); destination(voclog); }; destination vpnlog { file("/var/log/vpnlog"); }; log { source(src); filter(vpnlog); destination(vpnlog); }; Keith Rechtorik Network Administrator Information Systems and Technology krechtorik(a)vocollect.com * CONFIDENTIAL, PRIVILEGED COMMUNICATION * This e-mail transmission is private and intended for the addressee(s) only. It may contain information that is privileged and/or confidential. If you have received this transmission in error, you are not authorized to read, copy, disclose or disseminate it in any manner. If you have received it in error, please delete it and all copies (including backup copies) that have been made, and transmit a reply message informing the sender that it was misdirected.

3 2

syslog-ng not starting
by Rechtorik, Keith 20 May '05

20 May '05

I am attempting to install syslog-ng on SUSE Linux and having issues starting the service. Port 514 is not listening and I assume it because the syslog-ng service is not starting. Does the syslog service start the syslog-ng service? If not how do I start the service? Thanks. Keith Rechtorik Network Administrator

5 4

Shiming Yang/OCIO_CorpDataSecurity/Planning_Office/HQ_for_the_Americas/BTMNA is out of the office.
by Shiming Yang 20 May '05

20 May '05

I will be out of the office starting 05/20/2005 and will not return until 05/21/2005. I will respond to your message when I return. If there is problem about Proxy or IBM web hosting facility, please call my backup Will at 8380. ----------------------------------------- The information contained in this electronic mail message, and any and all accompanying documents, constitutes confidential information. If you are not the intended recipient of this information, any disclosure, copying, distribution, or the taking of any action in reliance on it is strictly prohibited. If you received this information in error, please notify the sender immediately and destroy this communication. Messages sent via this medium may be subject to delays and/or unauthorized alteration. Neither The Bank of Tokyo-Mitsubishi, Ltd. nor any of its affiliates shall be held liable for the contents of this message.

1 0

[PATCH] use_fqdn with gethostname() not returning fqdn
by Sven Wegener 19 May '05

19 May '05

Hi all! I came across this issue while I was setting up a central syslog-ng server that collects logs from several hosts in different domains. I wanted to use the use_fqdn option to distinguish every host in my logs better, but all I saw was just the plain hostname. Please find attached two patches, one against 1.6.7 and one against 1.9.4 that add support for fqdns. If gethostname() returns a name without dots it tries to lookup the fqdn of the host. Cheers, Sven -- Sven Wegener Gentoo Linux Developer http://www.gentoo.org/

2 4

RE: [syslog-ng] Logs rotate and compress but still log to compres sed file
by Rechtorik, Keith 18 May '05

18 May '05

I was testing things out at that point. Sorry for the confusion. Even when those lines are uncommented the logs still do not rotate. I guess I do not know how to kill the process. The syslog-ng pid never 'resets' itself when issuing the kill -HUP command. -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Tuesday, May 17, 2005 12:29 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Logs rotate and compress but still log to compressed file _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

5 4

Program Filters
by Metal Gear 16 May '05

16 May '05

Hi all, i m having too much noise in my syslog-ng logs both in mysql db and in text logs. For that i tried program filters like . filter f_auth { facility(auth); }; filter f_ftp {program(ftp);}; filter f_ssh {program(pam_unix);}; log {source(stunnel); filter(f_syslog); filter(f_auth); filter(f_ftp); filter(f_ssh); destination(d_mysql);}; what actually i want to log messages from program 'vsftp', 'wsftpd' and 'sshd' for that i tried regexp like '*ftp*', *ssh*, but its not working can someone refine the filters for just logging traffic having program 'ftp' or 'ssh' in them. Thanks

2 1

help about multiple files in syslog-ng
by Sarfraz Rustam 15 May '05

15 May '05

Hi; I want some information regarding to multiple files in syslog-ng; The scenerio is that i have 4 devices normally router and i want information of each device but with same facility (local7) and this information must be in each seperate file say router1, router2 .... so on. How i can do this; I have attached a router via console and trying to access its log but not succeeded. Plz guide me to the solution. -- Sarfraz

2 1

Subsys Dead, syslog-ng and SELinux
by Anand Shankar 13 May '05

13 May '05

I recently installed syslog-ng successfully on a FC3-SELinux enabled box. Everything is fine except that: # service syslog-ng status syslog-ng dead but subsys locked # ls --context /var/lock/subsys/syslog-ng -rw------- root root root:object_r:var_lock_t syslog-ng The root:object_r:var_lock_t should have been user_u:object_r:var_lock_t, and that is what is causing syslog-ng daemon to die. Also, the file permissions generally are 666. One easy way is to switch off SELinux for syslog-ng, but is there a better way?? Why are the permissions wrong?? ---- Anand Shankar

4 3