- syslog-ng - lists.balabit.hu

Re: [syslog-ng]Issues with HP-UX
by Stephan Hendl 03 May '05

03 May '05

your source should look the following source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; the pad_size ist very important. BTW, it is included in the doku as well as in the faq I think. regards Stephan >>> stanner(a)leeclerk.org 05/02/05 9:23 >>> I have recently started using syslog-ng so that I can use stunnel to log to a central loghost. I have gotten syslog-ng working on a linux box, and everything works fine, but my HP-UX boxes won't even log locally, much less log to a loghost. Below, I have included the syslog-ng.conf for one of the hosts. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= options { use_fqdn(no); keep_hostname(no); use_dns(no); long_hostnames(off); sync(3); log_fifo_size(300); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # source src { unix-dgram("/dev/log.un"); internal(); }; # After that set destinations. # First some standard logfile # destination lpr { file("/var/adm/lpr.log"); }; destination mail { file("/var/adm/mail.log"); }; # Some `catch-all' logfiles. # destination syslog { file("/var/adm/syslog/syslog.log"); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { level(info .. warn)and not facility(auth, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; ############################################################### log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_messages); destination(syslog); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); destination(messages); }; ############################################################### ## set up logging to a loghost forwarded from localhost via stunnel destination loghost {tcp("127.0.0.1" port(514));}; # send everything to loghost, too log { source(src); destination(loghost); }; ###############################################################

1 0

RE: [syslog-ng]RE: Recommended windows event logger products to work with syslog-ng
by SOLIS, ALEX 03 May '05

03 May '05

I use nt-syslog (http://ntsyslog.sorceforge.net) It seems to work fine although I too get corrupt event logs on the windows boxes every now and then. I am not 100 percent convinced that it is caused by nt-syslog but it seems to be a posibility. Alex -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu on behalf of Bill Nash Sent: Thu 4/21/2005 5:46 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]RE: Recommended windows event logger products to work with syslog-ng We're using Snare. Haven't seen any problems at all with it. It provides fairly detailed logs. - billn On Thu, 21 Apr 2005, Adams, Russell L. wrote: > We're using Event Reporter. > > Only problem we've had is a corrupt event log caused it to repeatedly > send the few hours messages nonstop. > > Russell > > On Thu, Apr 21, 2005 at 10:54:32AM +0100, Stevan Popovic wrote: >> >> Hello >> >> I have configured syslog-ng to work on my linux box. >> >> I am wondering does anyone use syslog-ng to log windows event logs. If so which products from the windows side are used? >> >> TIA >> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

2 1

Issues with HP-UX
by Stephen Tanner 02 May '05

02 May '05

I have recently started using syslog-ng so that I can use stunnel to log to a central loghost. I have gotten syslog-ng working on a linux box, and everything works fine, but my HP-UX boxes won't even log locally, much less log to a loghost. Below, I have included the syslog-ng.conf for one of the hosts. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= options { use_fqdn(no); keep_hostname(no); use_dns(no); long_hostnames(off); sync(3); log_fifo_size(300); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # source src { unix-dgram("/dev/log.un"); internal(); }; # After that set destinations. # First some standard logfile # destination lpr { file("/var/adm/lpr.log"); }; destination mail { file("/var/adm/mail.log"); }; # Some `catch-all' logfiles. # destination syslog { file("/var/adm/syslog/syslog.log"); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { level(info .. warn)and not facility(auth, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; ############################################################### log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_messages); destination(syslog); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); destination(messages); }; ############################################################### ## set up logging to a loghost forwarded from localhost via stunnel destination loghost {tcp("127.0.0.1" port(514));}; # send everything to loghost, too log { source(src); destination(loghost); }; ###############################################################

1 0

Change the facility of forwarded message using syslog-ng is it possible?
by Subodh Nijsure 02 May '05

02 May '05

Hello, I have system where lot of different machines are forwarding me messages with facility of local6 what I want to do is forward them on but change the facility to say local1 when sending it to an udp destination. Is this possible using syslog-ng. I have gone through all the log but couldn't find any of doing this, is it possible to change facility of incoming message using syslog-ng? /Subodh Nijsure

2 2

Re: [syslog-ng]Change the facility of forwarded message using syslog-ng is it possible?
by jbrunke＠ctsgi.com 02 May '05

02 May '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

2 1

incoming message stats (fwd)
by Jim 30 Apr '05

30 Apr '05

Anyone have any thoughts on this? ---------- Forwarded message ---------- Date: Fri, 1 Apr 2005 13:45:48 -0500 (EST) From: Jim <jim(a)jeke.fdns.net> Reply-To: syslog-ng(a)lists.balabit.hu To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]incoming message stats Hello, I would like to get some stats on the number of incoming messages I am receiving on a central log server. I am running syslog-ng 1.6.6, built with libol 0.3.15. >From what I can see, I will need to modify libol in order for syslog-ng to count these messages, and tell me at a regular interval. Does this sound right, or am I missing another simple way to do this? assuming I have to modify source, it looks like I can just add a counter to the do_write_str() function in pkt_buffer.c that looks something like this: if (self->queue_size == self->queue_max) { /* fifo full */ pktbuf_dropped_pkts++; ol_string_free(string); return ST_FAIL | ST_OK; } else { struct buffer_node *item; --> pktbuf_recved_pkts++; NEW_SPACE(item); item->packet = string; ol_queue_add_tail(&self->queue, &item->header); if (++self->queue_size == self->queue_max && self->super.writable) (*self->super.writable) = 0; } the "-->" indicates the new line. Pretty much all I did was copy where the "pktbuf_dropped_pkts" was, and added in my variable. The numbers that I get when I run with this don't appear to totally match up with what I expect, but is fairly close. Is this the right place to insert a counter to count total syslog messages recieved over the network (from both TCP and UDP sources). If not, can someone point me in a different direction? thanks! Mike _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

5 7

Re: Re: [syslog-ng]incoming message stats (fwd)
by jbrunke＠ctsgi.com 30 Apr '05

30 Apr '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

1 0

missing messages
by Andrew Culver 29 Apr '05

29 Apr '05

I have syslog-ng running on a central logging host. Messages received are stored first in a per-host log and then in a per-facility log. The messages that go into the per-facility logs depend on filters that I define, but EVERYTHING from a host should appear in its per-host logs. I'm finding that many messages from some hosts are appearing in the per-service log but not in the per-host logs. Has anyone else experienced anything like this? Any solutions? TIA Here is my conf file: [aculver@slogr etc]$ cat syslog-ng.conf #$Author: rich $ #$Date: 2005/02/04 14:50:38 $ #$Id: syslog-ng.conf,v 1.8 2005/02/04 14:50:38 rich Exp $ #$Source: /uwo/src/etc/RCS/syslog-ng.conf,v $ #$Locker: $ # # Syslog-ng configuration file. # revised muchly by Andrew Culver <aculver at uwo dot ca> ############################################################### # First, set some global options. options { use_fqdn(yes); use_dns(yes); dns_cache(yes); keep_hostname(no); long_hostnames(off); sync(1); log_fifo_size(1024); owner(syslogda); group(syslogda); perm(0640); dir_owner(syslogda); dir_group(syslogda); dir_perm(0755); create_dirs(yes); stats(0); }; ############################################################### # # Define some sources to gather logging messages from # source s_main { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); udp(port(514)); }; ############################################################### # # After that set destinations. # # the standard destination is to have a set of logs per host # ie: /syslogs/hosts/kam.its.uwo.ca/foolog/foolog destination d_default { file("/syslogs/hosts/$FULLHOST/$FACILITY/$FACILITY"); }; # collection of aggregate group logs destination d_console { file("/syslogs/services/console/console"); }; destination d_critical { file("/syslogs/services/critical/critical"); }; destination d_daemon { file("/syslogs/services/daemon/daemon"); }; destination d_login { file("/syslogs/services/login/login"); }; destination d_lpr { file("/syslogs/services/lpr/lpr"); }; destination d_mail { file("/syslogs/services/mail/mail"); }; destination d_misc { file("/syslogs/services/misc/misc"); }; destination d_routers { file("/syslogs/services/routers/routers"); }; destination d_named { file("/syslogs/services/named/named"); }; destination d_dhcp { file("/syslogs/services/dhcp/dhcp"); }; destination d_eventlog { file("/syslogs/services/eventlog/eventlog"); }; destination d_radius { file("/syslogs/services/radius/radius"); }; destination d_firewall { file("/syslogs/services/firewall/firewall"); }; destination d_loadbalancer { file("/syslogs/services/loadbalancer/loadbalancer"); }; destination d_netscreen { file("/syslogs/services/netscreen/netscreen"); }; destination d_ups { file("/syslogs/services/ups/ups"); }; destination d_bluesocket { file("/syslogs/services/bluesocket/bluesocket"); }; destination d_wireless { file("/syslogs/services/wireless/wireless"); }; destination d_dial { file("/syslogs/services/dial/dial"); }; ########################################## # # Here's the filter options. With these rules, we can set which # message go where. # ########################################## # First we'll define some sets of hosts which will be used in other filters # some routers/gateways filter f_hosts_router { host("^nebula\.wireless\.uwo\.ca$") or host("^(gate(1|2)|hse-rt1)\.netmgmt\.uwo\.ca$") or host("^(sup|msfc1|msfc2)\.l1uc00-1\.netmgmt\.uwo\.ca$") or host("^(sup|msfc1|msfc2)\.l1nsc2-2\.netmgmt\.uwo\.pri$"); }; # some firewalls filter f_hosts_firewall { host("^(FW|fw).*\.uwo\.(ca|pri)$") or host("^sgw\.ramp\.its\.uwo\.ca$") or host("^l1nsc2-2fwsm(1|2)\.netmgmt\.uwo\.pri$"); }; # some loadbalancers (.*.lb.its.uwo.ca) filter f_hosts_loadbalancer { host("^.*\.lb\.its\.uwo\.ca$"); }; # some dns servers filter f_hosts_named { host("^(romeo|hurdle)\.its\.uwo\.ca$") or host("^ns(1|2|3)\.uwo\.ca$"); }; # some dhcp servers filter f_hosts_dhcp { host("^(romeo|juliet)\.its\.uwo\.ca$") or host("^nebula\.wireless\.uwo\.ca$"); }; # some windows servers filter f_hosts_windows { host("^(ad4|cogs|elroy|mack|member2|nemo|nitrox|ntpsvcs|ntws(01|10|11|30)|opal|prof|rosie|ruby|winny|winter)\.uwo\.ca$") or host("^(amber|argon|beast|bigmac|cactus|casper|cosmos|crocus|jan|lily|magma|ntts(06|09)|onyx|rogue|storm|topaz|torch|weed1|weed2|weed3)\.its\.uwo\.ca$") or host("^(feb|koigu|manos)\.its\.uwo\.pri$") or host("^(testad1|testad3|smstest|member2|gecko\.frog)\.test\.uwo\.ca$") or host("^ntws(12|13)\.wisg\.its\.uwo\.pri$") or host("^(shop|mill|drill)\.ums\.uwo\.ca$") or host("^spider\.tel\.its\.uwo\.ca$") or host("^(SCCS50|dlink|docock)\.tel\.its\.uwo\.pri$"); }; # some radius servers # obsolete? see f_hosts_dial #filter f_hosts_radius { host("^uwonet-pm(1|2|3|4|5)\.netmgmt\.uwo\.ca$"); }; # some bluesocket servers filter f_hosts_bluesocket { host("^blusck(1|2|3|4)-pro\.wireless\.uwo\.ca$"); }; # some netscreen servers filter f_hosts_netscreen { host("^somenetscreenhost\.uwo\.ca$"); }; # some wireless devices filter f_hosts_wireless { host("^[Ww].*\..*\.wireless\.uwo\.pri$"); }; # some dialpool devices filter f_hosts_dial { host("^uwonet-pm(1|2|3|4|5)\.netmgmt\.uwo\.ca$"); }; ########################################## # Now setup some filters based on facility, level and hosts # routers is actually local 0 on the routers/gateways hosts filter f_routers { facility(local0) and filter(f_hosts_router); }; # console is a big one filter f_console1 { facility(daemon,auth) and level(notice .. emerg); }; # we'll exclude any kern.info from nebula/nexus filter f_console_kern1 { facility(kern) and level(info,warning) and host("^(nebula|nexus)\.wireless\.uwo\.ca$"); }; # kern and syslog except for kern.info from nebula/nexus filter f_console_kern { facility(syslog, kern) and not filter(f_console_kern1); }; # join the above two and also grab any err to emerg or any messages that would go to the routers log filter f_console2 { filter(f_console1) or level(err .. emerg) or filter(f_console_kern) or filter(f_routers); }; # now exclude anything from local 0, 3 and 7. filter f_console { filter(f_console2) and not facility(local0,local3,local7); }; # critical is anything of priority critical and above filter f_critical { level(crit .. emerg); }; # daemon is actually daemon+syslog+cron filter f_daemon { facility(daemon, syslog, cron); }; # login is actually auth and authpriv filter f_login { facility(auth, authpriv); }; # lpr is just itself filter f_lpr { facility(lpr); }; # mail is actually user filter f_mail { facility(mail); }; # misc is actually user filter f_misc { facility(user); }; # named is lactually local1 on named hosts filter f_named { facility(local1) and filter(f_hosts_named); }; # dhcp is actually local2 on dhcp hosts filter f_dhcp { facility(local2) and filter(f_hosts_dhcp); }; # eventlog is actually local3 on windows hosts filter f_eventlog { facility(local3) and filter(f_hosts_windows); }; # radius is actually local6 on radius hosts #filter f_radius { facility(local6) and # filter(f_hosts_radius); }; # firewall is actually local7 on firewall hosts filter f_firewall { facility(local7) and filter(f_hosts_firewall); }; # loadbalancer is actually local6 on loadbalancer hosts filter f_loadbalancer { facility(local6) and filter(f_hosts_loadbalancer); }; # netscreen is actually local7 on netscreen hosts filter f_netscreen { facility(local7) and filter(f_hosts_netscreen); }; # ups is actually local0 on tazmo filter f_ups { facility(local0) and host("^tazmo\.its\.uwo\.ca$"); }; # bluesocket is actually local0 on bluesocket hosts filter f_bluesocket { facility(local0) and filter(f_hosts_bluesocket); }; # wireless is actually local0 on wireless hosts filter f_wireless { facility(local0,local1) and filter(f_hosts_wireless); }; # dial is actually local6 on dial hosts filter f_dial { facility(local6) and filter(f_hosts_dial); }; ############################################################### # # log statements actually send logs somewhere, to a file, across the network, etc # ########################################## # First, log everything to host-specific logs before considering aggregate logs log { source(s_main); destination(d_default); }; ########################################## # Next log the aggregate "services" logs such as mail, routers, console, etc log { source(s_main); filter(f_console); destination(d_console); }; log { source(s_main); filter(f_critical); destination(d_critical); }; log { source(s_main); filter(f_daemon); destination(d_daemon); }; log { source(s_main); filter(f_login); destination(d_login); }; log { source(s_main); filter(f_lpr); destination(d_lpr); }; log { source(s_main); filter(f_mail); destination(d_mail); }; log { source(s_main); filter(f_misc); destination(d_misc); }; log { source(s_main); filter(f_routers); destination(d_routers); }; log { source(s_main); filter(f_named); destination(d_named); }; log { source(s_main); filter(f_dhcp); destination(d_dhcp); }; log { source(s_main); filter(f_eventlog); destination(d_eventlog); }; #log { source(s_main); filter(f_radius); destination(d_radius); }; log { source(s_main); filter(f_firewall); destination(d_firewall); }; log { source(s_main); filter(f_loadbalancer); destination(d_loadbalancer); }; log { source(s_main); filter(f_netscreen); destination(d_netscreen); }; log { source(s_main); filter(f_ups); destination(d_ups); }; log { source(s_main); filter(f_bluesocket); destination(d_bluesocket); }; log { source(s_main); filter(f_wireless); destination(d_wireless); }; log { source(s_main); filter(f_dial); destination(d_dial); }; ###############################################################

2 1

RE: [syslog-ng]Fedora Core 4
by Michael Gargiullo 28 Apr '05

28 Apr '05

That would be HOT! Not that it's terrible building syslog-ng, but pre-packaged, I only have to compile one package for hidden sysloging. Even if someone compromises a machine, it still gets logged, and thanks to syslog-ng, to my database. Check out the latest issue of hackin9 (www.hackin9.org) -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of seth vidal Sent: Wednesday, April 27, 2005 4:38 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Fedora Core 4 On Wed, 2005-04-27 at 16:33 -0400, Mike Pepe wrote: > Fedora Core 4 is coming out soon. Is syslog-ng going to be included with it? > Not _in_ core but I think it might be possible for it to be in extras. -sv _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Fedora Core 4
by Mike Pepe 27 Apr '05

27 Apr '05

Fedora Core 4 is coming out soon. Is syslog-ng going to be included with it?

2 1