- syslog-ng - lists.balabit.hu

RE: [syslog-ng]regex and priority(local7) question
by cdowns 03 Mar '04

03 Mar '04

I do have one quick question on the filter f_local7 { facility(local7) and level(debug..emerg); }; does this mean it is grabbing all level between debug - emerg, or just those 2 ? thanks again. ~!>D This config snippet works for me .... my PIXies are set to log via TCP1468 rather than UDP/514. Real IP Addresses replaced with fakes. As with your situation, I have other network gear running on local7 as well. Syslog-ng's wonderful filtration allows for a nice separation of all the classes of switch/router/firewall/VPN-bricks. Ted ...... source local { unix_stream("/dev/log" max-connections(200) keep-alive(yes) ); # UDP listeners for Internal syslog-ng interconnections udp(ip(127.0.0.1) port(514)); udp(ip(1.2.3.4) port(514)); }; source pixtcp { tcp(ip(1.2.3.4) port(1468) max-connections(10) keep-alive(yes)); }; filter f_local7 { facility(local7) and level(debug..emerg); }; filter f_pixmsg { match("%PIX"); }; filter f_misclocal7 { filter(f_local7) and not filter(f_pixmsg); }; destination d_local7 { file("/var/log/local7.debug" sync(0) ); }; destination d_pixlog { file("/var/log/pixlog.debug" sync(0) ); }; log { source(pixtcp); filter(f_local7); filter(f_pixmsg); destination(d_pixlog); }; log { source(local); filter(f_misclocal7); destination(d_local7); }; ...... >> -----Original Message----- >> From: syslog-ng-admin(a)lists.balabit.hu >> [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of cdowns >> Sent: Monday 01 March 2004 17:11 >> To: syslog-ng(a)lists.balabit.hu >> Subject: [syslog-ng]regex and priority(local7) question >> >> >> Good Morning, >> Im new to the list and have a couple questions. >> >> I have a PIX firewalls logging on local7.info, how can I >> match this >> correctly ? I also have switches logging on local7.info but I >> need this >> one pix removed and placed into its own destination. >> >> Where can i get a list of the regex syntax used in >> syslog-ng ? like >> perl / awk / grep etc.. . >> >> Here is what I currently have: >> >> ------ Snip ------- >> ## Regex >> filter f_fw01 { >> host("x.x.x.x") and match("PIX"); >> }; >> filter f_fw02 { >> host("x.x.x.x") and match("PIX"); >> }; >> filter f_fw03 { >> host("x.x.x.x") and match("PIX"); >> }; >> filter f_fw04 { >> host("x.x.x.x") and match("PIX"); >> }; >> >> #!!! not working yet.. . >> filter f_pix{ >> facility(local7) and match("%PIX*"); >> }; >> >> filter f_iss { >> match("issDaemon"); >> }; >> filter f_snmp { >> match("ucd-snmp"); >> }; >> >> ## everything else incoming >> filter f_local7 { facility(local7); }; >> >> >> ----- snip ------ >> >> TIA. >> >> ~!>D >> _______________________________________________ >> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >> https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >> >> > > ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

cycling filenames every n-secs?
by email lists 03 Mar '04

03 Mar '04

Hi All, Is it possible to have syslog-ng cycle filename every n-seconds (eg - every 5, 10 or 15 secs) instead of every minute or every second? Tia, Darren

1 0

Re:[syslog-ng]Log prefix under Solaris
by Amodiovalerio Verde 03 Mar '04

03 Mar '04

You can disable solaris message ID generation editing the file /kernel/drv/log.conf Just set msgid=0 instead of msgid=1. That way message IDs will not be generated. Amodiovalerio [Hypo] Verde ---------- Initial Header ----------- From : syslog-ng-admin(a)lists.balabit.hu To : "Syslog-NG" syslog-ng(a)lists.balabit.hu Cc : Date : Tue, 2 Mar 2004 11:34:52 +0100 Subject : [syslog-ng]Log prefix under Solaris > Hey again, > > All log messages that syslog-ng reads from sun-streams("/dev/log" > door("/etc/.syslog_door")); are prefixed with the following string: > "[ID 702911 local3.alert] " > > If I understand correctly, it seems that any program using the standard > syslog interface under Solaris will see there messages prefixed with an > ID and the facility they used. This is despite any formatting option I > can tell, this is simply the content of $MSG. > > This, however, doesn't happen with UDP messages. > > I wonder if there's a way to remove this part, either at on syslog-ng > side or in the calls to the syslog interface of Solaris? > > Regards, > > -- > Loïc Minier <lool(a)dooz.org> > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

2 1

sparc64 hostname weirdness with FreeBSD and NetBSD
by thomas+syslogng＠stromberg.org 03 Mar '04

03 Mar '04

I'm having problems with syslog-ng under both FreeBSD 5.2 and NetBSD 1.6.2 on the sparc64 architecture. For some reason, with my configuration, it thinks all log messages from remote hosts are actually coming from the current host. Even in chained hostname mode, all the messages came in with the hostname of the loghost itself. This seems to affect: FreeBSD 5.2 SPARC64 with libol 0.3.13 and syslog-ng 1.6.2 NetBSD 1.6.2 SPARC64 with libol 0.3.13 and syslog-ng 1.6.2 It seems to work perfectly fine with: FreeBSD 5.2 x86 with libol 0.3.12 and syslog-ng 1.6.1 OpenBSD 3.4 SPARC32 with libol ? and syslog-ng 1.5.24 While I went through many configurations, this is the last test case I used to demonstrate the issue: options { use_dns(yes);long_hostnames(off); chain_hostnames(on); owner(daemon); group(logreader); perm(0640); dir_perm(0750); dir_owner(daemon); dir_group(logreader); create_dirs(yes); }; source remote { tcp(); udp(); }; destination logremote { file("/var/log/ng/ALL.log"); }; log { source(remote); destination(logremote); }; Can anyone reflect a bit more on this? ----------------------------------------------------------- Thomas Stromberg <thomas(a)stromberg.org> Coordinator of UNIX Systems <tstrombe(a)indiana.edu> Department of Chemistry work://812-855-8450 Indiana University, Bloomington. cell://812-391-2843

1 0

RE: [syslog-ng]regex and priority(local7) question
by Rule, Ted 02 Mar '04

02 Mar '04

This config snippet works for me .... my PIXies are set to log via TCP1468 rather than UDP/514. Real IP Addresses replaced with fakes. As with your situation, I have other network gear running on local7 as well. Syslog-ng's wonderful filtration allows for a nice separation of all the classes of switch/router/firewall/VPN-bricks. Ted ...... source local { unix_stream("/dev/log" max-connections(200) keep-alive(yes) ); # UDP listeners for Internal syslog-ng interconnections udp(ip(127.0.0.1) port(514)); udp(ip(1.2.3.4) port(514)); }; source pixtcp { tcp(ip(1.2.3.4) port(1468) max-connections(10) keep-alive(yes)); }; filter f_local7 { facility(local7) and level(debug..emerg); }; filter f_pixmsg { match("%PIX"); }; filter f_misclocal7 { filter(f_local7) and not filter(f_pixmsg); }; destination d_local7 { file("/var/log/local7.debug" sync(0) ); }; destination d_pixlog { file("/var/log/pixlog.debug" sync(0) ); }; log { source(pixtcp); filter(f_local7); filter(f_pixmsg); destination(d_pixlog); }; log { source(local); filter(f_misclocal7); destination(d_local7); }; ...... > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of cdowns > Sent: Monday 01 March 2004 17:11 > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]regex and priority(local7) question > > > Good Morning, > Im new to the list and have a couple questions. > > I have a PIX firewalls logging on local7.info, how can I > match this > correctly ? I also have switches logging on local7.info but I > need this > one pix removed and placed into its own destination. > > Where can i get a list of the regex syntax used in > syslog-ng ? like > perl / awk / grep etc.. . > > Here is what I currently have: > > ------ Snip ------- > ## Regex > filter f_fw01 { > host("x.x.x.x") and match("PIX"); > }; > filter f_fw02 { > host("x.x.x.x") and match("PIX"); > }; > filter f_fw03 { > host("x.x.x.x") and match("PIX"); > }; > filter f_fw04 { > host("x.x.x.x") and match("PIX"); > }; > > #!!! not working yet.. . > filter f_pix{ > facility(local7) and match("%PIX*"); > }; > > filter f_iss { > match("issDaemon"); > }; > filter f_snmp { > match("ucd-snmp"); > }; > > ## everything else incoming > filter f_local7 { facility(local7); }; > > > ----- snip ------ > > TIA. > > ~!>D > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

2 1

Issue while logging to messages file
by Paul Jasa 02 Mar '04

02 Mar '04

Good morning! I am testing syslog-ng to find an alternative to syslog. So far, so good, the instructions have been great and I got it to work. However, I have one issue I can't seem to fix nor find literature which addresses it. I discovered that when the /var/log/messages file gets switched to messages.1 (then messages.2 and so forth), syslog-ng keeps logging to the new file name messages.1 instead of messages as I defined it in the conf file. I was hoping someone might know why does syslog-ng do this, and how can it be fixed? Thanks in advance for any info. Best regards to all, Paul ====================================== Paul Jasa Network Engineer ====================================== The information contained in this e-mail and any attached documents may be privileged, confidential and protected from disclosure. If you are not the intended recipient you may not read, copy, distribute or use this information. If you have received this communication in error, please notify the sender immediately by replying to this message and then delete it from your system.

2 1

Log prefix under Solaris
by Loic Minier 02 Mar '04

02 Mar '04

Hey again, All log messages that syslog-ng reads from sun-streams("/dev/log" door("/etc/.syslog_door")); are prefixed with the following string: "[ID 702911 local3.alert] " If I understand correctly, it seems that any program using the standard syslog interface under Solaris will see there messages prefixed with an ID and the facility they used. This is despite any formatting option I can tell, this is simply the content of $MSG. This, however, doesn't happen with UDP messages. I wonder if there's a way to remove this part, either at on syslog-ng side or in the calls to the syslog interface of Solaris? Regards, -- Loïc Minier <lool(a)dooz.org>

1 0

Changing permissions on /dev/sysmsg
by Loic Minier 02 Mar '04

02 Mar '04

Hey, While this doesn't cause any noticeable disfunction, I keep getting a message from syslog-ng which says: syslog-ng[14172]: Changing permissions on special file /dev/sysmsg I understand this is the consequence of the owner/group/perm options of the following block: destination df_dev_sysmsg { file("/dev/sysmsg" perm(0777) owner(root) group(other) template("$DATE $HOST $MSG\n")); }; On Solaris 8, /dev/sysmsg is a symlink t othe real sysmsg device, here's an output of ls -l /dev/sysmsg: lrwxrwxrwx 1 root other 33 Dec 17 2002 /dev/sysmsg -> ../devices/pseudo/sysmsg@0:sysmsg And here is ls -l /devices/pseudo/sysmsg\@0\:sysmsg: crwxrwxrwx 1 root other 97, 0 Mar 2 11:26 /devices/pseudo/sysmsg@0:sysmsg As you see, the permissions of /dev/sysmsg and of /devices/pseudo/sysmsg@0:sysmsg match the mask I set, and I wonder how can I can tell syslog-ng not to touch the permission of this "file". Thanks for any hint, Regards, -- Loïc Minier <lool(a)dooz.org>

1 0

Current stable syslog-ng + libol
by Loic Minier 01 Mar '04

01 Mar '04

Hey, (Thank you for syslog-ng.) I'd like to build the current stable version of syslog-ng, I've seen syslog-ng-1.4.17 on the balabit's website (following the "stable" link) and built with libol-0.2.24 (following INSTALL's instructions). However, Freshmeat has 1.5 as stable and 1.9 as dev, Debian has 1.5 as stable, 1.6 in testing and unstable, ... What versions are considered "stable"? I particularly need template() which doesn't fit in the conf -- neither does log_msg_size() -- right now. While we're at it, what is the appropriate version of libol for this syslog-ng? Regards, -- Loïc Minier <lool(a)dooz.org>

2 3

regex and priority(local7) question
by cdowns 01 Mar '04

01 Mar '04

Good Morning, Im new to the list and have a couple questions. I have a PIX firewalls logging on local7.info, how can I match this correctly ? I also have switches logging on local7.info but I need this one pix removed and placed into its own destination. Where can i get a list of the regex syntax used in syslog-ng ? like perl / awk / grep etc.. . Here is what I currently have: ------ Snip ------- ## Regex filter f_fw01 { host("x.x.x.x") and match("PIX"); }; filter f_fw02 { host("x.x.x.x") and match("PIX"); }; filter f_fw03 { host("x.x.x.x") and match("PIX"); }; filter f_fw04 { host("x.x.x.x") and match("PIX"); }; #!!! not working yet.. . filter f_pix{ facility(local7) and match("%PIX*"); }; filter f_iss { match("issDaemon"); }; filter f_snmp { match("ucd-snmp"); }; ## everything else incoming filter f_local7 { facility(local7); }; ----- snip ------ TIA. ~!>D

1 0