- syslog-ng - lists.balabit.hu

syslog-ng NOT Reading source file, which grows. HELP!
by alex 15 Jul '04

15 Jul '04

Hello, I have compiled syslog-ng (latest ver syslog-ng 1.6.4) on AIX 5.1 and have configured the client to send sudo logs to the centrilized server. The Network part is working fine, and I know my binary compiled OK. In addition to sudo activity logging I was going to send logs, produced by the other daemon--sudoscriptd--which logs all root shell activities to some predefined file on the same server (for testing) and later I will send it too. In my case: var/log/sudoscript. I was going to centrilized this one as well, but for now I can't figured out why syslog-ng is NOT READING from the source file. Also, I was trying: source sudo_scr {pipe("/var/log/sudoscript"); }; - with no success. PLEASE HELP! ##HERE IS MY syslon-ng.conf#### #cat syslog-ng.conf options { sync (0); mark (10); time_reopen (10); log_fifo_size (2000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source sys { unix-dgram("/dev/log" ); internal(); }; #STANDARD staff. This works. source sudo_scr {file("/var/log/sudoscript"); }; # THIS IS FILE WHICH GROWS as sudoscript writes to it. #syslog-ng CAN"T READ from it. destination internal_1 { file("/var/log/sudologs/sudolog"); }; #THIS IS TEMP. DESTINATION FILE (EMPTY?) destination host01 { tcp(1.5.7.15 port(514)); }; #THIS IS WORKING PART TOO filter f_sudo { facility(local2); }; log { source(sudo_scr); destination(internal_1); }; # THIS IS NOT WORKING PART log { source(sys); filter(f_sudo); destination(host01); }; # THIS PART IS WORKING

2 1

difference between 1.6.4 & 1.7.0 branches?
by OpenMacNews 15 Jul '04

15 Jul '04

hi, can someone clarify the difference between the 1.6.4 & 1.7.0 branches? the 1.7.0 branch doesn't seem to have been touched for awhile, but the 1.6.4 branch seems current ... syslog-ng-1.6.4+20040710.tar.gz 07/10/2004 syslog-ng-1.7.0+20040514.tar.gz 05/14/2004 i'm building on OSX 10.3.4, and have read others have used 1.7.0 .... is there a reason? which branch is 'best'? thanks! richard

2 1

RE: [syslog-ng]syslog-ng on Sol8 - newbie questions
by jbrunke＠ctsgi.com 14 Jul '04

14 Jul '04

For whatever reason, my syslogd probe IS configured to listen on the UDP port by default... I confirmed this by stopping syslogd, starting syslog-ng and then trying to restart syslogd. Syslogd would not start because it could not hook to port 514... Creating the /etc/default/syslogd was the answer. There is also a "-t" option for syslogd that may also do the same thing. As for your other suggestion. I was unable to get syslogd to forward anything to @localhost. It would complain at startup it was undefined (it is not). When I put @theactualhostname, no compaints on startup, but that didn't seem to do it either. So I went back and took the @theactualhostname definition out of syslogd.conf (making syslogd.conf "stock") and put the sun-streams src back in syslog-ng. That seems to have done the trick. Both syslogd and syslog-ng "see" local system messages and take appropriate action(s). So I guess there is no issue with syslog & syslog-ng "sharing" the /dev/log stream. Can someone confirm I won't run into problems with this config? So now I believe I have the best of both worlds... The SA can have his syslog.conf file and whatever files he wants to do there. All remote syslog traffic is received and managed by syslog-ng. The SA never liked the fact that forwarded syslog messages "gummed up" /var/adm/messages anyway... ;-) Thanks, Jim Brunke ------------------------------------------------------------------------------- - From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng- admin(a)lists.balabit.hu] On Behalf Of Pedroche, Raúl Sent: Wednesday, July 14, 2004 3:52 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]syslog-ng on Sol8 - newbie questions The idea would be configuring syslogd to not to listen on UDP and send messages to it, while syslog-ng listens on UDP socket and does not read from /dev/log. You can add a line "LOG_FROM_REMOTE=NO" to /etc/default/syslogd (but it should not be necessary, as Solaris syslogd does not listen on UDP port by default) and add a line to /etc/syslog.conf alike to whatever.whatever,*.somethingelse @localhost Then create (and use) an UDP source in syslog-ng.conf and NOT a source of type sun-streams. -----Original Message----- From: jbrunke(a)ctsgi.com [mailto:jbrunke@ctsgi.com] Sent: Tuesday, July 13, 2004 10:18 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng on Sol8 - newbie questions I'm running Solaris 8. I would like to setup syslog-ng and syslogd to operate together. Reading the faq, it says: Q: I'm new to syslog-ng. Is there a way for syslog-ng and syslogd to co- exist?... A: Yes, syslog-ng can accept messages from stock syslogd using the udp() source. Can anyone give me more specifics on how to setup the source for this setup? We've got syslogs forwarded from our network gear to this box so I want to make sure syslog-ng can get those forwarded messages from syslogd. Also, can anyone give a suggested filter setup for the following syslog.conf entry: local7.notice;*.err;kern.debug;daemon.notice;mail.none /var/log/error.log Thanks, Jim _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

1 0

RE: [syslog-ng]syslog-ng on Sol8 - newbie questions
by "Pedroche, Raúl" 14 Jul '04

14 Jul '04

The idea would be configuring syslogd to not to listen on UDP and send messages to it, while syslog-ng listens on UDP socket and does not read from /dev/log. You can add a line "LOG_FROM_REMOTE=NO" to /etc/default/syslogd (but it should not be necessary, as Solaris syslogd does not listen on UDP port by default) and add a line to /etc/syslog.conf alike to whatever.whatever,*.somethingelse @localhost Then create (and use) an UDP source in syslog-ng.conf and NOT a source of type sun-streams. -----Original Message----- From: jbrunke(a)ctsgi.com [mailto:jbrunke@ctsgi.com] Sent: Tuesday, July 13, 2004 10:18 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng on Sol8 - newbie questions I'm running Solaris 8. I would like to setup syslog-ng and syslogd to operate together. Reading the faq, it says: Q: I'm new to syslog-ng. Is there a way for syslog-ng and syslogd to co- exist?... A: Yes, syslog-ng can accept messages from stock syslogd using the udp() source. Can anyone give me more specifics on how to setup the source for this setup? We've got syslogs forwarded from our network gear to this box so I want to make sure syslog-ng can get those forwarded messages from syslogd. Also, can anyone give a suggested filter setup for the following syslog.conf entry: local7.notice;*.err;kern.debug;daemon.notice;mail.none /var/log/error.log Thanks, Jim _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

1 0

syslog-ng on Sol8 - newbie questions
by jbrunke＠ctsgi.com 13 Jul '04

13 Jul '04

I'm running Solaris 8. I would like to setup syslog-ng and syslogd to operate together. Reading the faq, it says: Q: I'm new to syslog-ng. Is there a way for syslog-ng and syslogd to co- exist?... A: Yes, syslog-ng can accept messages from stock syslogd using the udp() source. Can anyone give me more specifics on how to setup the source for this setup? We've got syslogs forwarded from our network gear to this box so I want to make sure syslog-ng can get those forwarded messages from syslogd. Also, can anyone give a suggested filter setup for the following syslog.conf entry: local7.notice;*.err;kern.debug;daemon.notice;mail.none /var/log/error.log Thanks, Jim

1 0

syslog-ng conf confusion
by Chet Harvey 13 Jul '04

13 Jul '04

Hi all, I am trying to change a box from syslog to syslog-ng but I cant quite get the syntax down. I was hoping someone could steer me in the right direction. Here is my current syslog.conf: local0.* %/var/log/filter.log local7.* %/var/log/dhcpd.log *.notice;kern.debug;lpr.info;mail.crit;news.err;local0.none;local7.none %/var/log/system.log security.* %/var/log/system.log auth.info;authpriv.info;daemon.info %/var/log/system.log *.emerg * This is how I did my syslog-ng.conf: # # This sample configuration file is essentially equilivent to the stock # FreeBSD /etc/syslog.conf file. # # # options options { long_hostnames(off); sync(0); }; source src { unix-stream("/var/run/log"); pipe("/dev/klog"); internal(); }; destination dest { file("/var/log/filter.log"); }; destination stunnel { tcp("127.0.0.1" port(514)); }; log { source(src);destination(dest); }; log { source(src);destination(stunnel); }; # # destinations # destination messages { file("/var/log/system.log"); }; destination firewall { file("/var/log/filter.log"); }; destination dhcp { file("/var/log/dhcp.log"); }; # log facility filters # filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_console { facility(console); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # # log level filters # filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info..emerg); }; filter f_debug { level(debug..emerg); }; # # *.err;kern.debug;auth.notice;mail.crit /dev/console # # # *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages # log { source(src); filter(f_notice); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # # security.* /var/log/security # log { source(src); filter(f_security); destination(messages); }; ## firewall specific log { source(src); filter(f_local0); destination(firewall); }; log { source(src); filter(f_local7); destination(dhcp); }; Hopelessly lost......thanks for any insight/education... -- Chet

1 0

Hostname Problem
by phusion 10 Jul '04

10 Jul '04

I've been having a problem with the $HOST macro. My setup is as follows: message gets sent from HostA through HostB and finally to the log server HostC. HostA is a Windows box running Snare for Windows, HostB is a FreeBSD box running syslog-ng, and HostC is a FreeBSD box running syslog-ng. HostA doesn't have a config file, it's a GUI app, but here are parts of the syslog-ng config files: HostB Config ------------ # Options options { keep_hostname(yes); long_hostnames(off); sync(0); }; HostC Config ------------ # Options options { keep_hostname(yes); long_hostnames(off); sync(0); }; HostA - moon-a, 10.10.2.2 HostB - moon, 10.10.1.7, 10.10.2.1 HostC - mars, 10.10.1.2 On the log server I have files from HostA go to $HOST.log. It then puts it as 10.10.1.7.log instead of moon-a.log. Also, here is a line from the file where it puts the IP address of HostB and hostname of HostA. Jul 8 10:57:00 10.10.1.7 moon-a MSWinEventLog 1 Application 675 Thu Jul 08 10:56:08 2004 0 sshd SYSTEM User Information MOON-A None sshd : PID 1808 : Server listening on 0.0.0.0 port 22. 1 Let me know what you think the problem is? Phusion __________________________________ Do you Yahoo!? Yahoo! Mail Address AutoComplete - You start. We finish. http://promotions.yahoo.com/new_mail

1 0

syslog-ng on OSX 10.3.4
by OpenMacNews 09 Jul '04

09 Jul '04

hi all, i'm new to syslog-ng. i've installed 1.7x on OSX 10.3.4; now, starting to deal with the config file. i dl'd and searched thru the list archives for pointers, etc. and found the last relevant, post by Kim Cary, but nothing further. i contacted Kim -- not yet finished/successful. soooooo, to ask: has anyone here got syslog-ng up/running on OSX, and would you be willing to share your conf file? thx! richard

1 0

regex support
by Joe.Reeves＠Regions.com 09 Jul '04

09 Jul '04

I am trying to use syslog-ng to reduce certain types of logging. I have scoured the web looking for information on the supposed regex support in syslog-ng, but the only thing I have really found mention of is the "match" keyword that matches a simple string. What I wanted to know is if syslog-ng supports either posix or perl style regular expressions. If not, has anyone found any other effective method of reducing logs using regex with an external program? (that could be used with the "program" keyword perhaps?) Thanks in advance, -- ____________________________________________ Joe Reeves Security Engineer II, IDS Regions Technology Risk Management Office: 334-956-6189 joe.reeves(a)regions.com ____________________________________________ "Wisdom is knowing what to do with what you know." -- J. Winter Smith

3 2

syslog-ng sighup problem
by jayesh 08 Jul '04

08 Jul '04

Hi , I want to know how should I re-read my syslog-ng configuration file without restarting syslog-ng. I found out solution by sending sighup signal to syslog-ng but its not re-reading it i.e when I give kill command with sighup signal to syslog-ng pid it does nothing what is the problem or any other solution. With regards, Jayesh shah

2 1