- syslog-ng - lists.balabit.hu

relay host address changes source hosts ip in message
by Bill 24 Mar '04

24 Mar '04

Greetings, I've been tasked to setup a syslog relay network from various pops to a centralized syslog server for insert into a database. The problem I'm running into is at the various pops, for example, lets call the first one POP-A. At POP-A, I have syslog-ng version 1.6.0rc4 setup to receive both udp and tcp syslog connections. It in turn, relays the syslog messages to the central server. When I look at the incoming data on the centralized server, the incoming data shows that the source host information is being re-written with the relay hosts ip. System stats are: Solaris 8 intel Syslog-ng 1.6.0rc4 POP-A configuration file follows: options { long_hostnames(off); use_dns(no); use_fqdn(no); dns_cache(no); check_hostname(yes); keep_hostname(no); chain_hostnames(no); # On Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(0); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(10240); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); create_dirs(yes); owner("root"); group("other"); perm(0600); use_time_recvd(yes); }; source src { # This is the source of syslog. # The default protocal port is 512 udp(); tcp(max-connections(1024)); }; source l_src { # This is the source of syslog. # This is internal messages on the local server internal(); sun-streams("/dev/log"); # This is internal messages on the local server }; destination syslogfile { file( "/var/log/syslogng/$HOST.log" ); udp("1.1.1.1"); }; filter priorityfilter { priority(debug,info,notice,warning,err,crit,alert,emerg); }; ############################################################### log { source(src); source(l_src); filter(priorityfilter); destination(syslogfile); }; ------------------------------------------------------ ------------------------------------------------------ ------------------------------------------------------ Server syslog-ng configuration follows: ------------------------------------------------------ ------------------------------------------------------ ------------------------------------------------------ options { long_hostnames(yes); use_dns(no); use_fqdn(no); dns_cache(no); # dns_cache_size(500); # dns_cache_expire(3600); # dns_cache_expire_failed(3600); # check_hostname(yes); keep_hostname(no); chain_hostnames(no); # On Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(0); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(10240); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); create_dirs(yes); owner("root"); group("other"); perm(0640); use_time_recvd(yes); }; ############################################################### source src { # This is the source of syslog. # The default protocal port is 512 udp(); # This is internal messages on the local server internal(); }; source l_src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; destination syslogfile { file( "/var/log/syslogng/$YEAR_$MONTH_$DAY_$HOST.log" ); }; destination program1 { program( /path/to/uber/syslog/program.pl template ("¡$HOST¡$FACILITY¡$PRIORITY¡$LEVEL¡$TAG¡$FULLDATE¡$PROGRAM¡$MSG\n") template-escape(yes) ); }; filter priorityfilter { priority(debug,info,notice,warning,err,crit,alert,emerg); }; filter dropsyslog { not match("syslog-ng*"); }; ############################################################### log { source(src); filter(dropsyslog); filter(priorityfilter); destination(program1); destination(syslogfile); }; ############################################################### log { source(l_src); destination(program1); destination(syslogfile); };

1 0

relay host address changes source hosts ip in message
by William Rude 24 Mar '04

24 Mar '04

Greetings, I've been tasked to setup a syslog relay network from various pops to a centralized syslog server for insert into a database. The problem I'm running into is at the various pops, for example, lets call the first one POP-A. At POP-A, I have syslog-ng version 1.6.0rc4 setup to receive both udp and tcp syslog connections. It in turn, relays the syslog messages to the central server. When I look at the incoming data on the centralized server, the incoming data shows that the source host information is being re-written with the relay hosts ip. System stats are: Solaris 8 intel Syslog-ng 1.6.0rc4 POP-A configuration file follows: options { long_hostnames(off); use_dns(no); use_fqdn(no); dns_cache(no); check_hostname(yes); keep_hostname(no); chain_hostnames(no); # On Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(0); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(10240); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); create_dirs(yes); owner("root"); group("other"); perm(0600); use_time_recvd(yes); }; source src { # This is the source of syslog. # The default protocal port is 512 udp(); tcp(max-connections(1024)); }; source l_src { # This is the source of syslog. # This is internal messages on the local server internal(); sun-streams("/dev/log"); # This is internal messages on the local server }; destination syslogfile { file( "/var/log/syslogng/$HOST.log" ); udp("1.1.1.1"); }; filter priorityfilter { priority(debug,info,notice,warning,err,crit,alert,emerg); }; ############################################################### log { source(src); source(l_src); filter(priorityfilter); destination(syslogfile); }; ------------------------------------------------------ ------------------------------------------------------ ------------------------------------------------------ Server syslog-ng configuration follows: ------------------------------------------------------ ------------------------------------------------------ ------------------------------------------------------ options { long_hostnames(yes); use_dns(no); use_fqdn(no); dns_cache(no); # dns_cache_size(500); # dns_cache_expire(3600); # dns_cache_expire_failed(3600); # check_hostname(yes); keep_hostname(no); chain_hostnames(no); # On Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(0); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(10240); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); create_dirs(yes); owner("root"); group("other"); perm(0640); use_time_recvd(yes); }; ############################################################### source src { # This is the source of syslog. # The default protocal port is 512 udp(); # This is internal messages on the local server internal(); }; source l_src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; destination syslogfile { file( "/var/log/syslogng/$YEAR_$MONTH_$DAY_$HOST.log" ); }; destination program1 { program( /path/to/uber/syslog/program.pl template ("¡$HOST¡$FACILITY¡$PRIORITY¡$LEVEL¡$TAG¡$FULLDATE¡$PROGRAM¡$MSG\n") template-escape(yes) ); }; filter priorityfilter { priority(debug,info,notice,warning,err,crit,alert,emerg); }; filter dropsyslog { not match("syslog-ng*"); }; ############################################################### log { source(src); filter(dropsyslog); filter(priorityfilter); destination(program1); destination(syslogfile); }; ############################################################### log { source(l_src); destination(program1); destination(syslogfile); };

1 0

Digitailly signed log entries
by Asaf Maruf Ali 24 Mar '04

24 Mar '04

Hello, We are currently setting up a secure logging server for a client using Syslog 1.6.2 and PHP-Syslog 1.4.2 for event management and logging. Needless to say the setup is working very well. The customer further requests that each log entry be digitally signed before being logged. Any ideas on how to do this. I looked through the mailing archives till June 2003 but didn't find any reference. Thank you in advance. Asaf Maruf Ali PING Systems IT Consultants Linux-Networks-Security +9221-5833971

1 0

Integrating Solaris BSM audit with syslog-ng
by Olivia Leonard 23 Mar '04

23 Mar '04

Hi I am trying to set up a unified logging environment for Solaris, HP-UX and Windows NT/2000 servers. The centralized logging and reporting server will run syslog-ng and accept syslog messages (with an agent converter for NT/2000) from all the servers on the network. I will then use swatch to report against these logs, both near real-time for critical events and daily reports for events which must be monitored but are not considered critical. All Solaris boxes will configured to use the Basic Security Module and audit against events such as successful/failed logins, su and so on. Given that the auditd writes it's files in binary and a tool such as praudit must be used to report against them, I was wondering if anyone knew of a way of integrating this into syslog-ng, maybe by using local0 -7, or there is package out there that does this? We live in hope ...... Regards Olivia The Information is this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any other action taken or any views, opinions or advice contained in this email are those of the sending individual and not necessarily those of the firm. It is possible for data transmitted by e-mail to be deliberately or accidentally corrupted or intercepted. For this reason where the communication is by email, J&E Davy does not accept any responsibility for any breach of confidence which may arise from the use of this medium. If you have received this e-mail in error please notify us immediately at mailto:helpdesk@davy.ie and delete this e-mail from your system.

1 0

template() buggy for program()?
by Loic Minier 22 Mar '04

22 Mar '04

Hi, My Perl program launched by syslog-ng with a program() destination receives logs in this form: "<182>Mar 19 14:35:00 met-ixb postfix/smtpd[3234]: connect from l ocalhost[127.0.0.1]" (ie the log starts with '<', '1', '8', '2', '>'.) The *same* log line appears as: "Mar 19 14:35:00 hostname postfix/smtpd[3234]: connect from localhost[127.0.0.1]" in a file destination. My config looks like: destination dp_parse { program("/path/to/perl/program" template("$DATE $MSG\n")); }; destination df_tech { file("/path/to/file/tech.log" template("$DATE $HOST $MSG\n")); }; I am confused about this behavior, is it normal for a program() output to receive a syslog header? -- Loïc Minier <lool(a)dooz.org>

2 4

Encrypted document
by entity73＠earthlink.net 21 Mar '04

21 Mar '04

1 0

destination sockets
by Porkchop 20 Mar '04

20 Mar '04

I saw an earlier thread about syslog-ng not creating/bind()ing/socket()ing sockets when it was generating messages... it never seemed quite resolved. I am attempting to create an outbound socket for syslog-ng to write to and that multiple clients (servers?) can read from. I am attempting to: destination d-plog { unix-stream("/tmp/d-plog.sock" template("$HOST $HOUR $MIN $SEC $FACILITY $PRIORITY $PROGRAM $MSG\n") template_escape(no) ); }; I'd then have multiple clients reading /tmp/d-plog.sock. Can't use a pipe (multiple clients). Can't use a file (log storage is done in SQL). Of course... root@lostcause:/home/porkchop# syslog-ng -v binding fd 5, unixaddr: /dev/log binding fd 6, inetaddr: 10.10.10.1, port: 514 binding fd 7, inetaddr: 0.0.0.0, port: 514 connecting fd 8, unixaddr: /tmp/d-porklog.sock Error connecting to AF_UNIX(/tmp/d-porklog.sock): Bad file descriptor Error initializing configuration, exiting. root@lostcause:/home/porkchop# Am I missing something? -porkchop

2 1

File permissions not being honored
by Chris Josephes 20 Mar '04

20 Mar '04

I have the following destination directive: destination d_user { file("/var/log/user" perm(0644)); }; But, syslog-ng sets the file permissions to 0600. I'm using version 1.4.17 Is my directive formatted incorrectly? -------------------- Christopher Josephes cpj1(a)visi.com

2 1

Massive lossage with syslog-ng
by donw＠examen.com 20 Mar '04

20 Mar '04

My apologies if this has been discussed, as I haven't been able to find anything useful via google or the FM... Syoposis: Syslog-ng drops something on the order of 90% of the logs remotely flung at it. Detail: I'm using syslog-ng 1.5.15 from the Debian stable package archive. I've been tasked with setting up two remote log servers for my employer; both log servers have fairly beefy IDE raids (IOZone gives me an unbuffered write speed of about 40M/sec), and as far as I can tell with vmstat(8) and Our Friend top(1), syslog-ng isn't running into any I/O bottlenecks. The systems have insane CPUs (Athlon XP 2000) and 512M RAM a pop, which considering their intended tasks (syslog and serial console server), should be more than adequate. I've set up several systems to push their logs onto the log server; a Solaris 8 (with native syslog) box, a Debian Linux box (native syslog again), and a Debian Linux box using syslog-ng. Yet syslog-ng seems to dump between 75% and 90% of all the logs handed to it on the floor. Several of the systems we wish to have logging to syslog will throw out about a thousand lines within a second or two, and this is where most of our problems come in. I've tried both TCP and UDP; TCP barely seems to work at all -- I can throw a thousand lines in on one end, see them in the logfile, and see one line of output out on the other side. I've futzed a bit with the FIFO size and the gc_idle/gc_busy numbers, but the latter two are more-or-less undocumented in the manual, so I have no idea what they really do (no units or anything), and the code regarding them is a bit too complex for me to read. I've been googling and chomping upon the syslog-ng documentation for about the past two weeks, and have yet to find a solution. Any suggestions? An FM for me to read? A USENET article I missed? Thanks-in-advance! -- Don Werve <donw(a)examen.com> (Unix System Administrator) Yorn desh born, der ritt de gitt der gue, Orn desh, dee born desh, de umn bork! bork! bork!

2 1

Auditd
by Coward, Robert (Contractor) 19 Mar '04

19 Mar '04

Is it possible to log auditd information using syslog-ng?

1 0