- syslog-ng - lists.balabit.hu

help required !!!! bit urgent
by Nilesh Naik 09 May '04

09 May '04

Hello Sir i have sucessfully installed 1) syslog-ng version 1.4.17 2) swatch-3.1 on my redhat 7.2 linux server , which is our central loghost system , all other server are mix of solaris 7,8,9 & redhat linux 7.x, The problem i am facing is i am not able to generate real time alerts using swatch , Following are my configuration files , syslog-ng.conf options { sync (1); time_reopen (10); log_fifo_size (2048); long_hostnames (off); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); }; source net { udp(); }; destination swatch { program("/usr/bin/swatch --read-pipe=\"cat /dev/fd/0\""); }; log { source(net); destination(swatch); }; destination hosts { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(net); destination(hosts); }; here , i am getting lots under /var/log/HOSTS directory , but not getting logs of the loghost itself , my swatchrs is small and simple coz its not working at the moment , the same is bellow swatchrc watchfor /error Authentication/ echo exec echo $0 | mail /usr/bin/mail -s \"log 11alert\" user\(a)testdomain.com throttle 10:00 watchfor /error Authentication/ echo exec echo $0 | bash-mail-alert swap_space user(a)testdomain.com ~ nighter of this is generating any alerts , nor any files is getting created under /root/swatch directory , but when i start the syslog-ng , and then give ps -ef | grep swatch , i can see swatch process i guess swatch is not getting anything from syslog-ng , no clues why ? please help me and guide me where the problem is , would be really grateful to you sir regards Prashant __________________________________ Do you Yahoo!? Win a $20,000 Career Makeover at Yahoo! HotJobs http://hotjobs.sweepstakes.yahoo.com/careermakeover

1 0

permissions
by mark 08 May '04

08 May '04

Ok, success is on the horizon. I can start syslog-ng like this: syslog-ng -d -v -f /etc/syslog-ng/syslog-ng.conf -u log -g log where "log" is an unprivileged user (with /bin/false as a shell when it's all working, to prevent logins). The config file specifies that syslog-ng writes to: /var/log/syslog-ng/local/ But the debugging output is giving "permission denied" errors. The permissions on the directories are setup like this: # ls /var drwxr-x--- 9 root root 4096 May 8 05:11 log/ # ls /var/log drwx------ 3 log log 4096 May 8 05:13 syslog-ng/ # ls /var/log/syslog-ng drwx------ 2 log log 4096 May 8 05:13 local/ So surely the user "log" and therefore syslog-ng has permission to read and write in this directory? It doesn't appear to be the case as I can $ su log and get permission denied errors whilst trying to read, write, or even cd into the directory. The permissions on /var/log need to be set as they are, however I'm guessing that this is the root of the problem (no pun intended). Can anyone suggest a fix? mark www.darklogik.org

2 2

Greetings, and a syntax error...
by mark 08 May '04

08 May '04

Good evening. Greetings to all users on this list, I've just signed up. Primarily I wanted syslog-ng to do secure remote logging by piping it through stunnel or ssh, but now I've had some time with the config file, I much prefer the syntax. A problem. I have a syntax error in my config file somewhere, and I just can't see it. syslog-ng gives the incredibly helpful: syntax error in 3 Parse error reading configuration file, exiting. (line 3) I've tried every variation I can think of on this line. Anyway, here is the config file: options { sync(0); }; source src { unix-dgram("/dev/log"); internal(); owner("syslog-ng"); group("syslog-ng"); perm(0600); }; source s_tcp { tcp( port(1028) ip("127.0.0.1") max-connections(2)); }; destination authlog { file("/var/log/syslog-ng/$HOST/auth.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination syslog { file("/var/log/syslog-ng/$HOST/syslog.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination cron { file("/var/log/syslog-ng/$HOST/cron.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination daemon { file("/var/log/syslog-ng/$HOST/daemon.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination kern { file("/var/log/syslog-ng/$HOST/kern.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination lpr { file("/var/log/syslog-ng/$HOST/lpr.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination user { file("/var/log/syslog-ng/$HOST/user.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination mail { file("/var/log/syslog-ng/$HOST/mail.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination debug { file("/var/log/syslog-ng/$HOST/debug" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination messages { file("/var/log/syslog-ng/$HOST/messages" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination all { file("/var/log/syslog-ng/$HOST/all.log" owner("syslog-ng") group ("syslog-ng") perm(0600) create_dirs(yes) dir_perm(0600)); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); destination(all); }; log { source(src); destination(console_all); }; As you can see I'm not intending to run syslog-ng as root. Any help would be appreciated. mark www.darklogik.org

2 2

Re: [syslog-ng]Greetings, and a syntax error...
by mark 08 May '04

08 May '04

I think I have it solved... :) (blindingly obvious error is swept under the carpet) mark www.darklogik.org

1 0

libol.spec.in patch
by José Pedro Oliveira 07 May '04

07 May '04

Bazsi. The specfile included in libol no longer builds correctly (it is broken since Red Hat 9, or more correctly, since rpm 4.2). With the attached patch is builds correctly at least in RH73, RH9, and Fedora Core 1. The history of fedora.us libol SRPM can be found here: https://bugzilla.fedora.us/show_bug.cgi?id=1331 A scsh SRPM can be found here: https://bugzilla.fedora.us/show_bug.cgi?id=919 Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B * diff -ru libol-0.3.13+20040506-original/libol.spec.in libol-0.3.13+20040506-modified/libol.spec.in --- libol-0.3.13+20040506-original/libol.spec.in 2003-04-10 15:55:26.000000000 +0100 +++ libol-0.3.13+20040506-modified/libol.spec.in 2004-05-06 02:42:04.000000000 +0100 @@ -1,24 +1,39 @@ +# +# Before changing the macro below see the README file included in +# the syslog-ng package. +# +%define with_scheme_preprocessor 0 + Summary: Support library for syslog-ng Name: libol Version: @VERSION@ Release: 1 +Epoch: 0 License: GPL Group: System Environment/Libraries -Url: http://www.balabit.hu/products/syslog-ng/ -Source: http://www.balabit.hu/downloads/syslog-ng/libol/0.3/%{name}-%{version}.tar.… -Packager: Hollis Blanchard <hollis(a)penguinppc.org> -Buildroot: %{_tmppath}/%{name}-%{version}-buildroot +Url: http://www.balabit.com/products/syslog-ng/ +Source: http://www.balabit.com/downloads/syslog-ng/libol/0.3/%{name}-%{version}.tar… +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +Requires(post): /sbin/ldconfig +Requires(postun): /sbin/ldconfig +%if %{with_scheme_preprocessor} +BuildRequires: scsh +%endif %description Support library for syslog-ng. + %package devel -Summary: libol headers, libraries -Group: Development/Libraries -Requires: %name = %{version} +Summary: Support library for syslog-ng: headers and libraries +Group: Development/Libraries +Requires: %{name} = %{epoch}:%{version}-%{release} +%if %{with_scheme_preprocessor} +Requires: scsh +%endif %description devel -libol headers, libraries +Support library for syslog-ng: headers and libraries. %prep @@ -26,7 +41,7 @@ %build %configure -make +make %{?_smp_mflags} %install rm -rf ${RPM_BUILD_ROOT} @@ -42,21 +57,31 @@ %files -%defattr(-,root,root) -%doc ChangeLog -%{_bindir}/libol-config -%{_libdir}/libol.so +%defattr(-,root,root,-) +%doc ChangeLog COPYING %{_libdir}/libol.so.0 %{_libdir}/libol.so.0.0.0 %files devel -%defattr(-,root,root) -%{_includedir}/libol +%defattr(-,root,root,-) +%if %{with_scheme_preprocessor} +%{_bindir}/make_class +%else +%exclude %{_bindir}/make_class +%endif +%{_bindir}/libol-config %{_libdir}/libol.a %{_libdir}/libol.la +%{_libdir}/libol.so +%{_includedir}/libol %changelog +* Thu May 6 2004 Jose Pedro Oliveira <jpo(a)di.uminho.pt> - 0:0.3.13 +- update to version 0.3.13 +- macro %{with_scheme_preprocessor} +- merged several changes from the fedora.us libol specfile + * Thu Apr 10 2003 Jose Pedro Oliveira <jpo(a)di.uminho.pt> - specfile reformated - replaced hard coded values by RPM macros

2 2

RE: [syslog-ng]Problem with "kill -HUP" on syslog-ng
by Wyner, Peter 06 May '04

06 May '04

I'm receiving thousands of syslogs per second, so the truss is not that useful - it's too difficule to isolate the interval. When failed HUP issue occurrs, no log entry is written to syslog, and the daemon continues running normally. When a successful HUP occurs, the appropriate message appears in syslog. I did not have this issue when I was testing, only when I put the server under extreme load, so that be a prerequisite for the issue to occur. Peter -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Balazs Scheidler Sent: Thursday, May 06, 2004 12:59 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Problem with "kill -HUP" on syslog-ng 2004-05-06, cs keltezéssel 18:39-kor Wyner, Peter ezt írta: > I have had similar issues HUPing 1.6.2 under Solaris 2.8. My resolution > is to kill have the script kill -9 the process and start a new one > instead of HUPing. The behavior is not consistant - sometimes it will > honor the SIGHUP and sometimes it won't. can you be more specific? it simply does nothing, it crashes or? syslog-ng should send this message to the system log when it receives a system log: notice("SIGHUP received, restarting syslog-ng\n") do you receive this message when it does not correctly restart? can you attach truss to the running syslog-ng process when you send a HUP signal to it? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Tuning for high-throughput
by Wyner, Peter 06 May '04

06 May '04

On another topic..... Anyone have any guidance on optimizing syslog-ng for high-volume systems? For example, what is a good range for sync(), and are there any other options that may assist in lowering CPU? We are not using any variables in the directory of filenames other than $HOST. Here's the current conf: options { log_fifo_size(1024); dns_cache(yes); use_dns(yes); chain_hostnames(no); keep_hostname(no); create_dirs(yes);}; source local { sun-streams("/dev/log"); internal(); }; source std_udp { udp( port(52001) ); }; destination all { file("/var/log/messages"); }; destination std { file("/syslog/std/current/$HOST" dir_perm(0755) perm(0644)); }; log { source(local); destination(all); }; log { source(std_udp); destination(std); }; TIA, Peter

1 0

RE: [syslog-ng]Problem with "kill -HUP" on syslog-ng
by Wyner, Peter 06 May '04

06 May '04

I have had similar issues HUPing 1.6.2 under Solaris 2.8. My resolution is to kill have the script kill -9 the process and start a new one instead of HUPing. The behavior is not consistant - sometimes it will honor the SIGHUP and sometimes it won't. Peter -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Balazs Scheidler Sent: Thursday, May 06, 2004 12:01 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Problem with "kill -HUP" on syslog-ng 2004-05-06, cs keltezéssel 13:16-kor Stephane OMNES ezt írta: > Hi, > I need some help because I encountered a problem when trying to make some > automatic logrotate script with syslog-ng. > My "logrotate script" is the following : > /var/log/*.log { > sharedscripts > postrotate > /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || > true > endscript > } > > The syslog-ng daemon never restarts when you type "kill -HUP <syslog-ng.pid>" > I tried also "kill -SIGUP ..." same result (the daemon is stopped but never > restarts...). > Did someone ever encountered this problem ? > Is there any "proper" solution ? > > I'm currently workin under RedHat Enterprise v3.0 I don't know any problems wrt reload in syslog-ng 1.6.x, are you really sure you are HUPing the correct PID? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Problem with "kill -HUP" on syslog-ng
by Stephane OMNES 06 May '04

06 May '04

Hi, I need some help because I encountered a problem when trying to make some automatic logrotate script with syslog-ng. My "logrotate script" is the following : /var/log/*.log { sharedscripts postrotate /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true endscript } The syslog-ng daemon never restarts when you type "kill -HUP <syslog-ng.pid>" I tried also "kill -SIGUP ..." same result (the daemon is stopped but never restarts...). Did someone ever encountered this problem ? Is there any "proper" solution ? I'm currently workin under RedHat Enterprise v3.0 Thanks in advance to answer my question. Regards. Stéphane OMNES Security Engineer ************************************************************ The contents of this email and any attachments are confidential. They are intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to anyone or make copies. * email scanned for viruses, vandals and malicious content * ************************************************************

2 1

syslog-ng 1.6.3 released
by Balazs Scheidler 06 May '04

06 May '04

Hi, I have released syslog-ng 1.6.3 with the following user-visible changes: News for the 1.6.3 release Thu, 06 May 2004 11:05:46 +0200 * fixed possible abort when several UNIX domain sources refer to the same socket * fixed afunix and afinet destination template handling, do not include the PRI value automatically, let the administrator do it explicitly in its template * fixed possible segfault when the value of 0 is represented as a string in port specications (e.g. remoteport, localport, port) * added MSGONLY macro which expands to the message only without the program name which sent the log message * added global sanitize_filenames() option which changes control characters in all filenames to '.', defaults to TRUE, this might avoid escape sequence attacks embedded in filenames (imagine an administrator doing an ls in a directory where filenames contain any control characters) * avoid using GNU extensions in strftime (more specificly the timezone expansion in $ISODATE used %z which is not portable for IRIX) * added address spoofing support (use the original IP address when resending messages, read the file README.spoof for more information) * couple of IRIX specific patches were integrated * updated documentation have fun! -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0