- syslog-ng - lists.balabit.hu

Problems compiling
by Nathaniel Hall 06 Aug '04

06 Aug '04

I am trying to install Syslog-NG on RH AS 3 Update 2. I have downloaded the syslog-ng gzips along with libol v 0.3.13. I ran configure, make, and install alright, but when I go to configure Syslog-ng, I get the following error. configure: error: Required libol version not found, make sure that your libol version is in the 0.3.x branch Any ideas? ~~~~~~~~~~~~~~~~~~~~~~~~~~ Nathaniel Hall Intrusion Detection and Firewall Technician Ozarks Technical Community College -- Office of Computer Networking halln(a)otc.edu 417-799-0552

2 2

Missing Log Entries under Load
by Tim Burress 06 Aug '04

06 Aug '04

Hello! Apparently this is sort of a FAQ, but despite wading through many Google searches, I haven't really found a good explanation or set of suggestions, so I thought I would post the question and then duck. We're running: syslog-ng 1.6.4 iptables v1.2.11-20040621 Linux 2.4.26 with iptables rules set up to log incoming connections. What we see is that, when we do a very fast port scan, the logs are very incomplete. For instance, in a scan of 440 ports, only about 210 entries appear in the logs. We also get a small number of corrupted log entries in our default messages file, where leading characters of the message appear to have been lost. We have our log sources set up as: source src { internal(); file("/proc/kmsg"); unix-stream ("/dev/log" max-connections(200)); unix-stream ("/var/log/snort/dev/log" max-connections(30)); }; Could someone explain, or point me to an explanation of, why these problems occur? It seems likely that the message corruption problem is due to wrap-around of the kernel message ring buffer. I suppose the missing messages could also be caused by that, however doubling the size of the buffer and rebuilding the kernel didn't seem to have any effect. And then, are there any suggestions for ways to tune the system so that a greater proportion of messages can be logged? We've tried tweaking the syslog-ng FIFO size and garbage collection parameters, but these, too, seemed to have little effect, at least in isolation. Any suggestions greatly appreciated! Thanks! Tim __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - 100MB free storage! http://promotions.yahoo.com/new_mail

1 0

Normalizing syslogs from FreeBSD and Solaris machines
by Ken McKittrick 05 Aug '04

05 Aug '04

Hello I can't seem to get syslog outputs from Postfix running on Solaris and FreeBSD servers to look the same. FreeBSD - Aug 5 11:14:43 69.67.254.17 postfix/smtp[80999]: 9FAA9EB760: to=<adams4(a)usadatanet.net>, relay=127.0.0.1[127.0.0.1], delay=1, status=sent (250 2.6.0 Ok, id=81995-01, from MTA: 250 Ok: queued as E16ECEB7CD) This corresponds to $DATE $HOST $MESSAGE, yes the postfix/smtp[80999] which would be $PROGRAM is actually part of the $MESSAGE. Solaris - Aug 5 11:16:06 69.67.254.10 postfix/smtp[10111]: [ID 197553 mail.info] B3391B26D: to=<taptoes(a)usadatanet.net>, relay=127.0.0.1[127.0.0.1], delay=2, status=sent (250 2.6.0 Ok, id=11585-10, from MTA: 250 Ok: queued as 9190DAE91) This corresponds to $DATE $PROGRAM $MESSAGE. Which is closer to what I would expect. My main problem is that Solaris stuffs the ID and facility.priority into the message itself. I've tried logging with defined message formats and that doesn't seem to help. So how can I gracefully removed the [ID xxxxxx Facility.Priority] from the message in the Solaris log lines? Thanks Ken McKittrick ISP Engineer USADatanet

2 3

syslog-ng 1.6.5 and libol 0.3.14
by Balazs Scheidler 05 Aug '04

05 Aug '04

hi, I have prepared a new syslog-ng release, found at the usual locations, http://www.balabit.hu/downloads/syslog-ng/ The summary of user-visible changes: News for the 1.6.5 release Thu, 05 Aug 2004 13:50:11 +0200 * cleaned up libol and syslog-ng compilation warnings and made configure.in/Makefile.am files autoconf2.50 compliant * fixed a BSD specific compilation problem * check if the UDP datagram ends in a NL or NUL character and strip that away if present -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

MORE: Syslog-ng unusual memory occupation
by G. C. 04 Aug '04

04 Aug '04

Researching the problem we found out that it seems to be related to the "address spoofing" options. Enabling this option, under heavy traffic (which means always, in our case) we experience this memory leak problem. Disabling the address spoofing option, everything runs smoothly with only about 720k memory occupation. The problem is "we need this option"... And this is getting critical, can anyone hep? Thanks, P. __________________________________ Hi, I'm using syslog-ng (1.6.4) on a RedHat Linux AS 3.0 and I'm experiencing a heavy memory occupation. Untill yesterday syslog-ng was using 1GB RAM, today I added 1 GB more and now it is using it too plus some swap (total 2.8 GB used. And it is growing...). I use this server for collecting logs from several hundreds network devices. The traffic collected is around 1GB/day and I save it to a text log file which is created and rotated daily. I cannot understand the reason, I tried to play with the garbage collection and fifo options but accomplished nothing. Any experience of such a behavior? Thanks in advance for your help, Peter. _________________________________________________________________ Add photos to your messages with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

1 0

Syslog-ng unusual memory occupation
by G. C. 02 Aug '04

02 Aug '04

Hi, I'm using syslog-ng (1.6.4) on a RedHat Linux AS 3.0 and I'm experiencing a heavy memory occupation. Untill yesterday syslog-ng was using 1GB RAM, today I added 1 GB more and now it is using it too plus some swap (total 2.8 GB used. And it is growing...). I use this server for collecting logs from several hundreds network devices. The traffic collected is around 1GB/day and I save it to a text log file which is created and rotated daily. I cannot understand the reason, I tried to play with the garbage collection and fifo options but accomplished nothing. Any experience of such a behavior? Thanks in advance for your help, Peter. _________________________________________________________________ The new MSN 8: smart spam protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0

RE: [syslog-ng]Sudden dead
by "Pedroche, Raúl" 02 Aug '04

02 Aug '04

Check whether you have a source that includes internal() and where is that source logged to. -----Original Message----- From: Francisco Javier Martinez Martinez [mailto:fjmartinez@csi.uned.es] Sent: Friday, July 30, 2004 11:38 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Sudden dead Hello world. I had installed syslog-ng 1.4.15 & libil 0.2.23 sometime ago in a red hat 7.2 box, it works fine as central logger for varius serevers some time, but suddenly it dead. When the daemon is started it show the literal Ok, but the truth is that there is no process running, if I run /etc/rc.d/initd/syslog-ng status it told me that is stopped but that there is a PID file, I didn`t know where syslog-ng log its own activity to be able to see what is wrong, any idea? thanks in advance. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

1 0

OpenBSD 3.5 not logging.. anything
by markzero＠logik.ath.cx 31 Jul '04

31 Jul '04

I have sandboxed Syslog-ng on OpenBSD 3.5. It doesn't appear to be logging anything other than itself. # ls -al /dev/log sr-Sr-S--- 1 _syslogng _syslogng 0 Jul 30 22:50 /dev/log # ls -al /var/log/ total 156 drwx------ 2 _syslogng _syslogng 512 Jul 30 22:36 . drwxr-xr-x 20 root wheel 512 Jul 28 11:21 .. -rw-r----- 1 _syslogng _syslogng 566 Jul 30 22:50 all.log -rw-r----- 1 _syslogng _syslogng 586 Jul 28 11:20 authlog -rw-r----- 1 _syslogng _syslogng 45 Jul 28 11:15 daemon -rw-r----- 1 _syslogng _syslogng 22685 Jul 30 22:50 debug -rw------- 1 _syslogng _syslogng 304 Jul 28 13:30 failedlogin -rw-r----- 1 _syslogng _syslogng 0 Mar 29 19:47 ftpd -rw-r----- 1 _syslogng _syslogng 268536 Jul 30 22:36 lastlog -rw-r----- 1 _syslogng _syslogng 0 Mar 29 19:47 lpd-errs -rw------- 1 _syslogng _syslogng 415 Jul 28 11:30 maillog -rw-r----- 1 _syslogng _syslogng 33733 Jul 30 22:50 messages -rw------- 1 _syslogng _syslogng 0 Mar 29 19:47 secure -rw-r----- 1 _syslogng _syslogng 22685 Jul 30 22:50 syslog -rw-r----- 1 _syslogng _syslogng 9600 Jul 30 22:46 wtmp -rw-r--r-- 1 _syslogng _syslogng 147 Jul 28 11:49 wtmp.0.gz -rw-r----- 1 _syslogng _syslogng 0 Mar 29 19:47 xferlog and my config file: # $Xanthus: syslog-ng.conf,v 1.1 2004/07/27 02:56:44 markzero Exp $ # syslog-ng config # options { long_hostnames(off); owner(_syslogng); group(_syslogng); perm(0640); dir_owner(_syslogng); dir_group(_syslogng); dir_perm(0640); sync(0); }; source src { unix-stream("/dev/log" owner("_syslogng") group("_syslogng") perm(06440)); internal(); }; destination all { file("/var/log/all.log"); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination mail { file("/var/log/mail.log"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; #destination loghost { udp("loghost" port(999)); }; filter test { level(debug..emerg); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(test); destination(all); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); destination(console_all); }; -although this config is theoretical, it's not one I plan on using in production (hence the (all) destination). The contents of the log files in /var/log include: STATS: dropped 0 syslog-ng version 1.5.24 going down syslog-ng version 1.5.24 starting ..and not a lot else. I've tried generating alerts with the 'logger' command, as well as deliberately typing in the wrong password to su, attempting to login as root over ssh and sending lots of mail to nonexistant users on my system. No logs of any kind are generated. I don't get any errors, where do I go from here? mark

1 0

RE: [syslog-ng]Problem with syslog-ng on OpenBSD 3.5 Sparc64
by Coward, Robert (Contractor) 30 Jul '04

30 Jul '04

Here is a copy of my conf file. I also noted today that if I start the daemon by hand the error did not show up. The connection is mad to a port on localhost which is then forwarded to the main log server via stunnel. This same config works with OpenBSD 3.4 Sparc 64. options { keep_hostname(yes); sync(0); log_fifo_size(1024); stats(36000); }; source localhost { unix-dgram("/dev/log"); internal(); }; destination localhost@chrome { file("/var/log/syslog-ng.all"); }; destination loghost@phantom { tcp("localhost" port(5141)); }; filter f_no_stats { not match("STATS: dropped 0"); }; # (src + dst [+ filters] = logging) log { source(localhost); filter(f_no_stats); destination(localhost@chrome); source(localhost); filter(f_no_stats); destination(loghost@phantom); }; Its very simple no bells and whistles. --- 30 July 2004 "I fought the Dharma, and the Dharma won." (Allen Ginsberg) --- Robert V. Coward UNIX System Administrator Computer Science Corporation

1 0

Problem with syslog-ng on OpenBSD 3.5 Sparc64
by Coward, Robert (Contractor) 30 Jul '04

30 Jul '04

I recently upgraded to OpenBSD version 3.5 Sparc64. I installed syslog-ng version 1.5.24 from the OpenBSD ports tree. The install went fine and there were no errors. I substituted the line in /etc/rc that normally starts syslogd for /usr/local/sbin/syslog-ng. On boot up it starts fine. However after the system comes up all entries to the log are proceeded with the following entry: syslog-ng[18782]: io.c: sockaddr2info(): Unsupported address family 110 (addrlen=256). I did some googling and the only refernces i can find about this, concerns a kernel error in a much earlier release in OpenBSD. I've been playing with it to see if I can determine why the error comes up to no avail. Has anyone seen anything like this? --- 30 July 2004 "Theology, by diverting the attention of men from this life to another, and by endeavoring to coerce all men into one religion, constantly preaching that this world is full of misery, but the next world would be beautiful -- or not, as the case may be -- has forced on men the thought of fear where otherwise there might have been the happy abandon of nature." (Elbert Hubbard, 1856-1915) --- Robert V. Coward UNIX System Administrator Computer Science Corporation

2 1