- syslog-ng - lists.balabit.hu

OpenBSD named pipe
by Bobby Johnson 26 Nov '03

26 Nov '03

I'm new to the list, hope this hasn't been covered before. I'm having some problems with syslog-ng, a named pipe and a shell script. I've created a destination in syslog-ng.conf that points to a pipe. In short the shell script looks like this. while read -r line; do sort input and output to file done < named.pipe Almost no matter what I do the script will sit outside the while loop not reading anything as things are input into the pipe. If i echo "anything" > named.pipe the shell script will run through all or most(not absolutly sure on this) of the input and then exit. I have this same setup on a FreeBSD computer and it works great, moved it to OpenBSD and it doesn't. If I do a tail -f on the pipe while my script is running then exit the tail the script works properly. I have tried a few different versions of syslog-ng and libol currently I have 1.6.0rc4 and 0.3.11. I have tried bourne, bash and ksh. Please help. Bobby Johnson Plexus Computer Services www.plexuscomp.com

2 3

Membership?
by David Aldrich 25 Nov '03

25 Nov '03

Hi How can I become a member of this list? (A post I sent yesterday is awaiting approval by the moderator.) Best regards David Telecom MODUS is an ISO9001/TickIT approved Company. LRQA Certificate of Approval reference 0965133 ************************************************************ THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS PRIVATE AND/OR PROPRIETARY. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please forward the whole message to admin(a)t-modus.nec.co.uk Company Registration No.3493954 Telephone Number +44 (0) 1372 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk ************************************************************

1 0

Use_dns(no)
by Jay Davis 25 Nov '03

25 Nov '03

I seem to still be getting hostnames in my messages with this turned on. Am I missing something? I need messages to retain their IP addresses and not get translated to a hostname. I need to get the IP for other information then have an application convert the name. Thanks!!! Please reply to jay_davis(a)fanniemae.com as well as the listserv. Thanks!!!!

2 1

errors on HPUX 11.0 (syslog-ng-1.6.rc4)
by Stephan Hendl 25 Nov '03

25 Nov '03

Hi all, I get the following errors on HPUX11 using syslog-ng-1.6.rc4 What does "...unparseable log message: " mean and how can I solve the problem? My /etc/syslog-ng.conf ion enclosed. Thanks Stephan ------------------ -- root@tc1:/var/adm/syslog> cat messages [2003/11/25 13:29:24] tc1 notice [syslog] syslog-ng[1057]: syslog-ng version 1.6.0rc4 starting [2003/11/25 13:29:25] tc1 notice [daemon] prngd[1083]: prngd 0.9.12 (05 March 2001) started up for user root [2003/11/25 13:29:25] tc1 notice [daemon] prngd[1083]: have 7 out of 60 filedescriptors open Y!åC=>e^a01 01:00:00] tc1 err [syslog] unparseable log message: \"<¿vz?á²ÝªšRª9P3_}£šzL;œ óE2÷ãäáCÆ9J®Sr# ej3\'žpâAßyŽ,YåÄò±Ãs SÒÖqÞyÒâIšüÍ 4¿DåªR [2003/11/25 13:29:28] tc1 info [auth] sshd[1118]: Server listening on 0.0.0.0 port 22. [2003/11/25 13:29:28] tc1 emerg [kern] [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1240]: Setting STREAMS-HEAD high water value to 65536. [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: nfsd do_one mpctl succeeded: ncpus = 1. [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: nfsd do_one pmap 2 [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: nfsd do_one pmap 3 [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: nfsd do_one bind 0 [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: Return from t_optmgmt(XTI_DISTRIBUTE) 0 [1970/01/01 01:00:00] tc1 err [syslog] unparseable log message: \"<h@\" [1970/01/01 01:00:00] tc1 err [syslog] unparseable log message: \"<h@\" [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1247]: nfsd 0 1 sock 4 [1970/01/01 01:00:00] tc1 err [syslog] unparseable log message: \"<h@\" [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1248]: nfsd 0 2 sock 4 [1970/01/01 01:00:00] tc1 err [syslog] unparseable log message: \"<h@\" [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: nfsd 0 3 sock 4 [1970/01/01 01:00:00] tc1 err [syslog] unparseable log message: \"<h@\" [2003/11/25 13:30:02] tc1 info [auth] sshd[1408]: Accepted publickey for hendl from 10.128.11.71 port 37605 ssh2 ------------------------ root@tc1:/var/adm/syslog> cat /etc/syslog-ng.conf # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe("/dev/log"); internal(); }; destination d_syslog { file("/var/adm/syslog/messages" owner("root") group("root") perm(0644) template( "[$YEAR/$MONTH/$DAY $HOUR:$MIN:$SEC] $HOST $PRIORITY [$FACILITY] $MESSAGE\n")); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/adm/syslog/syslog.log"); }; destination d_mail { file("/var/adm/syslog/mail.log"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(mail) and level(debug); }; filter f_filter2 { level(debug) or level(info) or level(alert) or level(emerg); }; filter f_filter3 { level(alert); }; filter f_filter4 { level(emerg); }; filter f_syslog { not (facility(mail) or facility(user)); }; log { source(s_sys); filter(f_filter1); destination(d_mail); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_cons); destination(d_mlrt); }; log { source(s_sys); filter(f_filter4); destination(d_mlal); }; log { source(s_sys); filter(f_syslog); destination(d_syslog); }; root@tc1:/var/adm/syslog> Stephan Hendl <Stephan.Hendl(a)lds.brandenburg.de>

2 1

syslog-ng 1.6.0rc4 build problems
by David Aldrich 24 Nov '03

24 Nov '03

Hi I am trying to compile syslog-ng 1.6.0rc4 under Redhat Linux. The make is failing because some header files appear to be missing. Please see the make output below. Can you suggest what is wrong please? Best regards David bash-2.05$ pwd /home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4 bash-2.05$ bash-2.05$ make Making all in src make[1]: Entering directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' make all-recursive make[2]: Entering directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' Making all in . make[3]: Entering directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' gcc -DHAVE_CONFIG_H -I. -I/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src -I. -g -O2 -Wall -D_GNU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33:18: list.h: No such file or directory main.c:29:20: format.h: No such file or directory main.c:30:20: werror.h: No such file or directory main.c:31:19: queue.h: No such file or directory main.c:32:24: pkt_buffer.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' make: *** [all-recursive] Error 1 bash-2.05$ bash-2.05$ cd src bash-2.05$ bash-2.05$ ls affile.c afremctrl.h afuser.h cfg-lex.l getopt.h Makefile.in strptime.h affile.c.x afsocket.c center.c config.h log.c nscache.c syslog-names.c affile.h afsocket.c.x center.c.x config.h.in log.h nscache.h syslog-names.h afinet.c afsocket.h center.h destinations.c log.h.x snprintf.c syslog-ng.h afinet.c.x afsocket.h.x center.h.x destinations.h macros.c sources.c tests afinter.c afstreams.c cfgfile.c destinations.h.x macros-gperf.c sources.c.x utils.c afinter.h afstreams.c.x cfgfile.h filters.c macros.gprf sources.h utils.h afprogram.c afstreams.h cfgfile.h.x filters.c.x macros.h sources.h.x afprogram.c.x afunix.c cfg-grammar.c filters.h main.c stamp-h afprogram.h afunix.c.x cfg-grammar.h filters.h.x main.c.x stamp-h.in afremctrl.c afuser.c cfg-grammar.y getopt1.c Makefile strcasecmp.c afremctrl.c.x afuser.c.x cfg-lex.c getopt.c Makefile.am strptime.c bash-2.05$ Telecom MODUS is an ISO9001/TickIT approved Company. LRQA Certificate of Approval reference 0965133 ************************************************************ THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS PRIVATE AND/OR PROPRIETARY. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please forward the whole message to admin(a)t-modus.nec.co.uk Company Registration No.3493954 Telephone Number +44 (0) 1372 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk ************************************************************

1 0

Sanity checking
by Carol Overes 21 Nov '03

21 Nov '03

Hi, I'm looking for a way to do some sanity checking on logs messages. My goal is to delete any logmessages which might contain malicious strings or commands like "halt". I'm thinking of using a combination of syslog-ng and logsurfer. However I haven;t have any experience with this combination. Any thoughts or tips about this matter are appreciated. Regards, Carol __________________________________ Do you Yahoo!? Free Pop-Up Blocker - Get it now http://companion.yahoo.com/

2 1

syslog-ng and security
by joop jansen 20 Nov '03

20 Nov '03

Hi, I was wondering if anyone has experience with sanity checking of syslog messages. I'm looking for a manner to filter syslog messages such as: "set passwd ....", which could start commands on a UNIX system. Also, I use a webinterface to view the syslog messages (like the vermeer.org) However I want to filter syslog messages that could exploit browser vulnerabilities. Anyone experience with this or have some good advice ? Thanks in advance for any help. Carol Overes __________________________________ Do you Yahoo!? Protect your identity with Yahoo! Mail AddressGuard http://antispam.yahoo.com/whatsnewfree

5 12

RE: [syslog-ng]Please help with logging remote machines
by Hamilton Andrew 19 Nov '03

19 Nov '03

Looks to me like you are using some flavor of linux. My process table on Redhat only has one entry for syslog-ng. I think you should probably stop the syslog-ng process via your usual startup/shutdown method to see what process it thinks it is running. Then look to see what processes are still alive. Kill those via the kill command then restart syslog-ng via your normal startup procedure. That might clear up some of your issues. Regards, Drew -----Original Message----- From: Daniel Flick [mailto:dflick@pdq.net] Sent: Wednesday, November 19, 2003 2:39 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Please help with logging remote machines On Wed, 2003-11-19 at 12:26, Balazs Scheidler wrote: > On Wed, Nov 19, 2003 at 08:53:51AM -0600, Daniel Flick wrote: > > On Tue, 2003-11-18 at 03:06, Balazs Scheidler wrote: > > > On Mon, Nov 17, 2003 at 02:56:49PM -0600, Daniel Flick wrote: > > > > I have been beating my head against a wall getting this to work but no > > > > joy. Syslog-ng is running and logging on the local system but no remote > > > > logs are being saved. Devices in question are PIX firewalls and > > > > NetCache proxies. > > > > > > Have you checked whether syslog-ng is actually receiving messages ? > > > > > > tcpdump and strace would help here. > > tcpdump shows that the firewalls are contacting the machine. > > > > I was not able to get anything of value with "strace syslog-ng" I am > > new to this tool so I may not be using it right. This is the only error > > I could find but I don't know what that means. > > > > open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or > > directory) > > check the pid of the syslog-ng process as it is running in the background, > and attach to it using strace > > strace -s 256 -o /tmp/syslog-ng.trace -p <syslog-ng pid> > > run it for a couple of seconds, to let your firewall send syslog messages. > Then grep the file /tmp/syslog-ng.trace for the string "recvfrom" > > Each received message should have a corresponding recvfrom() call. If you > can't see anything either syslog-ng is not correctly bound, or your packet > filter drops syslog traffic Interesting that I have so many syslog-ng processes. Is this normal? ps -aux | grep [s]yslog root 11118 0.0 0.0 1780 808 ? S Nov17 1:31 syslog-ng root 11994 0.0 0.0 1724 696 ? S 08:31 0:01 syslog-ng root 11999 0.0 0.0 1712 724 ? S 09:00 0:00 syslog-ng all all root 12066 0.0 0.0 1708 680 ? S 09:22 0:00 syslog-ng root 12071 0.0 0.0 1680 652 ? S 09:23 0:00 syslog-ng root 12075 0.0 0.0 1688 660 ? S 09:23 0:00 syslog-ng root 12079 0.0 0.0 1680 652 ? S 09:23 0:00 syslog-ng root 12083 0.0 0.0 1700 672 ? S 09:24 0:00 syslog-ng root 12087 0.0 0.0 1688 656 ? S 09:24 0:00 syslog-ng root 12091 0.0 0.0 1684 656 ? S 09:24 0:00 syslog-ng root 12095 0.0 0.0 1728 740 ? S 09:25 0:11 syslog-ng I attached to 11999 and a few others and could not find recvfrom anywhere. The file is rather small and I posted one here. I also tries to attach to several other syslog-ng processes with the same results. I also verified that no filters are running that may be dropping the packets. cat /tmp/syslog-ng.trace time(NULL) = 1069271394 poll([{fd=8, events=0}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 5, 100) = 0 poll([{fd=8, events=0}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 5, 31000) = 0 time(NULL) = 1069271425 poll([{fd=8, events=0}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 5, 100) = 0 poll([{fd=8, events=0}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 5, 0) = 0 getpid() = 11999 time(NULL) = 1069271425 time(NULL) = 1069271425 time(NULL) = 1069271425 poll([{fd=8, events=0}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 5, 100) = 0 poll( <unfinished ...> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Flood Protection
by Thomas Vögtle 19 Nov '03

19 Nov '03

Hello, we are using syslog-ng on our servers and we are quite satiesfied with it. But there is still one question open for me: is there any kind of flood protection like the old syslog has? One stupid program got mad and flooded our logs until the harddisk was full. I want to have the same as that: Nov 18 15:58:56 tv2 user: allwaysthesame Nov 18 15:58:56 tv2 last message repeated 137 times No way to configure this behaviour? Thanks, Thomas

3 3

RE: [syslog-ng]Flood Protection
by Rule, Ted 19 Nov '03

19 Nov '03

Surely one can code round that little problem. Instead of maintaining a history table which records the number of times the last message has been received, one records the number of times in the last N seconds that a given client's last message has been repeated. The history table, instead of being one count, and one string buffer, becomes an array indexed by clients of with each item containing a count and a buffer and a timestamp. Obviously the table would have to be size limited and probably idle-time-purged, to avoid it eating up resource. Ted > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Jason Haar > Sent: Tuesday 18 November 2003 22:10 > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Flood Protection > > > On Wed, 2003-11-19 at 04:02, Thomas Vögtle wrote: > > I want to have the same as that: > > Nov 18 15:58:56 tv2 user: allwaysthesame > > Nov 18 15:58:56 tv2 last message repeated 137 times > > > > One problem with this feature is that it can only work if the last 137 > syslog events to occur were the same event. We run a large centralized > syslog server environment, with lots of syslog clients, and > as such this > sort of limiting feature never really gets to work, as it's quite rare > for one event to occur record after record without some other client > squirting in a new record. > > Oh well... > > Cheers > > Jason Haar > Information Security Manager, Trimble Navigation Ltd. > Phone: +64 3 9635 377 Fax: +64 3 9635 417 > PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0