- syslog-ng - lists.balabit.hu

RE: [syslog-ng]syslog-ng misinterpreting messages from Enterasys Routers.
by Rule, Ted 30 Jul '03

30 Jul '03

Dunno if you wanted to know, but I'll answer it anyway. My simple fix was to change this: options { chain_hostnames(no); keep_hostname (yes); to this: options { chain_hostnames(no); check_hostname(yes); # Added to fix SSR decode bug keep_hostname (yes); # Changed from yes to try and fix SSR decode bug # now changed back following use of check_hostname... in the Global Options settings... the default check_hostname code hard-wired in the source were sufficient to avoid the problem of misinterpretation, even on my old v1.5.24 code at the time. i.e. this bit of code was effectively enabled, causing it to skip over the %CONS-W-BADPASSWD string by dint of it not being deemed a valid hostname character: while (left && *src != ' ' && *src != ':' && *src != '[') { if (lm->flags & LF_CHECK_HOSTNAME && !((*src >= 'A' && *src <= 'Z') || (*src >= 'a' && *src <= 'z') || (*src >= '0' && *src <= '9') || *src == '-' || *src == '_' || *src == '.' || *src == ':' || *src == '@' || *src == '/')) { break; } src++; left--; } Ted -----Original Message----- From: "Urmas Jagomann" <urmas(a)eyp.ee>@FLEXTECH Sent: Wednesday 30 July 2003 10:06 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng misinterpreting messages from Enterasys Routers. Lugupidamisega, Urmas Jagomann 6655424 ----- Original Message ----- From: <Ted_Rule(a)flextech.co.uk> To: <syslog-ng(a)lists.balabit.hu> Sent: Thursday, January 23, 2003 2:21 PM Subject: [syslog-ng]syslog-ng misinterpreting messages from Enterasys Routers. > > > Having finally bitten the bullet and installed syslog-ng ( libol-0.3.6 / > syslog-ng-1.5.24 ), > I've only come across one problem... syslog messages from our Enterasys Routers > are being > corrupted. All Unix and Cisco messages appear Ok. > > As an example, these raw packets from an SSR and a Cisco: > > tcpdump -s 512 -x -e -l -n udp and port 514 and host fttv-gps-core-ssrA | > tcpdumpascii.pl > tcpdump: listening on eth0 > 10:29:54.111864 0:e0:63:93:25:bf 0:50:8b:f3:93:46 ip 100: 192.168.32.11.4739 > > 172.17.12.6.syslog: udp 58 > 4500 0056 73a2 0000 3f11 6f2a c0a8 200b E..Vs...?.o*.. . > ac11 0c06 1283 0202 0042 b5ba 3c31 3838 .........B..<188 > 3e4a 616e 2032 3320 3130 3a32 393a 3533 >Jan 23 10:29:53 > 2025 434f 4e53 2d57 2d42 4144 5041 5353 %CONS-W-BADPASS > 5744 2c20 696e 636f 7272 6563 7420 7061 WD, incorrect pa > 7373 776f 7264 ssword > > 1 packets received by filter > 0 packets dropped by kernel > > tcpdump -s 512 -x -e -l -n udp and port 514 and host gps-enterprise-cisco-e0 | > tcpdumpascii.pl > tcpdump: listening on eth0 > 10:30:44.037939 0:10:7b:80:f:fb 0:50:8b:f3:93:46 ip 138: 172.17.8.76.8800 > > 172.17.12.6.syslog: udp 96 > 4500 007c 29b5 0000 ff11 2547 ac11 084c E..|).....%G...L > ac11 0c06 2260 0202 0068 187a 3c31 3839 ...."`...h.z<189 > 3e31 3036 3737 3a20 4a61 6e20 3233 2031 >10677: Jan 23 1 > 303a 3330 3a34 3320 474d 543a 2025 5359 0:30:43 GMT: %SY > 532d 352d 434f 4e46 4947 5f49 3a20 436f S-5-CONFIG_I: Co > 6e66 6967 7572 6564 2066 726f 6d20 636f nfigured from co > 6e73 6f6c 6520 6279 2076 7479 3020 2831 nsole by vty0 (1 > 3732 2e31 372e 3132 2e37 3229 72.17.12.72) > > > Result in this in the log: > > Jan 23 10:29:53 %CONS-W-BADPASSWD, incorrect password > Jan 23 10:30:44 gps-enterprise-cisco-e0 10677: Jan 23 10:30:43 GMT: > %SYS-5-CONFIG_I: Configured from console by vty0 (172.17.12.72) > > > It looks as if syslog-ng is assuming %CONS-W-BADPASSWD is a hostname....and the > Cisco message picks up a hostname via DNS, which > is NOT included in the packet. > > > I note the version 1.5.25 has a bad_hostname() option. Is it possible that this > may be used to alleviate this issue, or is some other workround > needed? I'm guessing "keep_hostname(no)" might fix it, but would that > potentially lead to other problems? Is there a summary of the algorithm > which syslog-ng uses to determine whether the message contains a hostname? > > > > Current Options settings laid out below. > > > ............... > > # Global Options Settings > options { > chain_hostnames(no); > keep_hostname (yes); > use_dns (yes); > use_fqdn (no); > long_hostnames (off); > dns_cache(yes); > dns_cache_size(100); > dns_cache_expire(600); > dns_cache_expire_failed(120); > > create_dirs (no); > dir_owner(root); > dir_group(root); > dir_perm(0755); > owner(root); > group(root); > perm(0600); > > stats(120); > > sync(10); > time_reopen (10); > time_reap(20); > > use_time_recvd(no); > > log_fifo_size (1000); > log_msg_size (1024); > > gc_idle_threshold(100); ### default 100 > gc_busy_threshold(3000); ### default 3000 > }; > > ............... > > > Thanks, > > > Ted > > > > > > > > > > ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

syslog-ng misinterpreting messages from Enterasys Routers.
by Ted_Rule＠flextech.co.uk 30 Jul '03

30 Jul '03

Having finally bitten the bullet and installed syslog-ng ( libol-0.3.6 / syslog-ng-1.5.24 ), I've only come across one problem... syslog messages from our Enterasys Routers are being corrupted. All Unix and Cisco messages appear Ok. As an example, these raw packets from an SSR and a Cisco: tcpdump -s 512 -x -e -l -n udp and port 514 and host fttv-gps-core-ssrA | tcpdumpascii.pl tcpdump: listening on eth0 10:29:54.111864 0:e0:63:93:25:bf 0:50:8b:f3:93:46 ip 100: 192.168.32.11.4739 > 172.17.12.6.syslog: udp 58 4500 0056 73a2 0000 3f11 6f2a c0a8 200b E..Vs...?.o*.. . ac11 0c06 1283 0202 0042 b5ba 3c31 3838 .........B..<188 3e4a 616e 2032 3320 3130 3a32 393a 3533 >Jan 23 10:29:53 2025 434f 4e53 2d57 2d42 4144 5041 5353 %CONS-W-BADPASS 5744 2c20 696e 636f 7272 6563 7420 7061 WD, incorrect pa 7373 776f 7264 ssword 1 packets received by filter 0 packets dropped by kernel tcpdump -s 512 -x -e -l -n udp and port 514 and host gps-enterprise-cisco-e0 | tcpdumpascii.pl tcpdump: listening on eth0 10:30:44.037939 0:10:7b:80:f:fb 0:50:8b:f3:93:46 ip 138: 172.17.8.76.8800 > 172.17.12.6.syslog: udp 96 4500 007c 29b5 0000 ff11 2547 ac11 084c E..|).....%G...L ac11 0c06 2260 0202 0068 187a 3c31 3839 ...."`...h.z<189 3e31 3036 3737 3a20 4a61 6e20 3233 2031 >10677: Jan 23 1 303a 3330 3a34 3320 474d 543a 2025 5359 0:30:43 GMT: %SY 532d 352d 434f 4e46 4947 5f49 3a20 436f S-5-CONFIG_I: Co 6e66 6967 7572 6564 2066 726f 6d20 636f nfigured from co 6e73 6f6c 6520 6279 2076 7479 3020 2831 nsole by vty0 (1 3732 2e31 372e 3132 2e37 3229 72.17.12.72) Result in this in the log: Jan 23 10:29:53 %CONS-W-BADPASSWD, incorrect password Jan 23 10:30:44 gps-enterprise-cisco-e0 10677: Jan 23 10:30:43 GMT: %SYS-5-CONFIG_I: Configured from console by vty0 (172.17.12.72) It looks as if syslog-ng is assuming %CONS-W-BADPASSWD is a hostname....and the Cisco message picks up a hostname via DNS, which is NOT included in the packet. I note the version 1.5.25 has a bad_hostname() option. Is it possible that this may be used to alleviate this issue, or is some other workround needed? I'm guessing "keep_hostname(no)" might fix it, but would that potentially lead to other problems? Is there a summary of the algorithm which syslog-ng uses to determine whether the message contains a hostname? Current Options settings laid out below. ............... # Global Options Settings options { chain_hostnames(no); keep_hostname (yes); use_dns (yes); use_fqdn (no); long_hostnames (off); dns_cache(yes); dns_cache_size(100); dns_cache_expire(600); dns_cache_expire_failed(120); create_dirs (no); dir_owner(root); dir_group(root); dir_perm(0755); owner(root); group(root); perm(0600); stats(120); sync(10); time_reopen (10); time_reap(20); use_time_recvd(no); log_fifo_size (1000); log_msg_size (1024); gc_idle_threshold(100); ### default 100 gc_busy_threshold(3000); ### default 3000 }; ............... Thanks, Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

3 2

All messages logging to all files
by Brian Foran 29 Jul '03

29 Jul '03

Hello I am having a problem where anytime I point a new host to my Syslog-ng server, it seems to write to all logfiles located in the syslog-ng.conf file. Thanks for your response in advance. Here is my configuration file: options { sync (0); time_reopen (10); log_fifo_size (1000); check_hostname(yes); long_hostnames (off); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); }; filter f_borderpix { host("525edgepixpair") or match ("*.*.*.*"); }; destination d_borderpix { file("/var/log/logfiles/borderpix/borderpix.log"); }; log { source(s_net); destination(d_borderpix); }; filter f_stelt_hurricane { host("hurricane") or match ("*.*.*.*"); }; destination d_stelt_hurricane { file("/var/log/logfiles/stelt/hurricane.log"); }; log { source(s_net); destination(d_stelt_hurricane); }; filter f_stelt_cyclone { host("cyclone") or match ("*.*.*.*"); }; destination d_stelt_cyclone { file("/var/log/logfiles/stelt/cyclone.log"); }; log { source(s_net); destination(d_stelt_cyclone); }; Thanks, Brian

1 0

syslog-ng
by Shetkar, Ravishankar 28 Jul '03

28 Jul '03

Hi All, I am working on a log centralization project in a Solaris environment and my initial search led me to syslog-ng. It seems like syslog-ng is a good product which is recommended by a lot of people. . If you are running syslog-ng in a Solaris environment (especially Solaris 8/9) I would very much be interested hearing about your experiences. I would really be interested in positive comments from someone who is successfully employing syslog-ng. I noticed there are frequent releases of syslog-ng. How easy/difficult/time consuming is it to upgrade an operational environment? It will be grate if some one give me a sample syslog-ng.conf files on syslog server and clients.And some hits about how to use and configure mysql with syslog-ng. thanks Ravi

1 0

syslog-ng under Solaris 5.6
by Martynas Buozis 24 Jul '03

24 Jul '03

Hello I have syslog-ng 1.6.0rc3 compiled with gcc 2.95.2. Every time I stop/start syslog-ng or send HUP to daemon I get logged by syslog-ng (but not with native for OS syslogd) same old messages (kernel facility) that comes since last system boot. Same messages I see when issue dmesg command. This is an example for first lines that comes out in logged messaged file : Jul 24 19:18:45 local@dev cpu0: SUNW,UltraSPARC-II (upaid 0 impl 0x11 ver 0x20 clock 296 MHz) Jul 24 19:18:45 local@dev cpu1: SUNW,UltraSPARC-II (upaid 1 impl 0x11 ver 0x20 clock 296 MHz) Jul 24 19:18:45 local@dev SunOS Release 5.6 Version Generic_105181-33 [UNIX(R) System V Release 4.0] Jul 24 19:18:45 local@dev Copyright (c) 1983-1997, Sun Microsystems, Inc. Jul 24 19:18:45 local@dev mem = 1048576K (0x40000000) Jul 24 19:18:45 local@dev avail mem = 1039056896 This behavious is same on all Solaris 5.6 machines, while no problems with Solaris 7 and 8 (same binary). Does anyone know how to get rid of these messages after HUP ? Thank you for any tips according this matter. With best regards Martynas

4 4

Forwarding unchanged Syslog messages
by Harrie.van.Arragon＠steinmuehlen-brot.de 24 Jul '03

24 Jul '03

Is it possible to forward syslogmessages without modifing the Host and the messages. I thought "keep_hostname(yes)" would solve the problem, but it didn't. Normaly i use version 1.5.15 shipped with debian, but I tryed 1.5.26 too. I don't konw if its important, but our syslogserver has a load of 100% the whole day (not from syslog-ng). I tryed the following config: options { use_fqdn(yes); sync(0); use_dns(yes); chain_hostnames(yes); keep_hostname(yes); }; source net { tcp(); udp();}; destination pc1 { udp(192.168.1.1);}; destination pc2 { udp(192.168.1.2);}; destination pc3 { udp(192.168.1.3);}; log { source(net); destination(pc1);}; log { source(net); destination(pc2);}; log { source(net); destination(pc3);}; bye Harrie

1 0

fopen fails under load on Solaris, HUP doesn't work
by Ryan Moon 23 Jul '03

23 Jul '03

Hi all, I'm running version 1.6.0rc3 of syslog-ng on Solaris 2.6 and I have a problem where a HUP signal is not correctly processed due to limitations in the Solaris stdio library. I've traced this down to the use of fopen in make_syslog_config() in cfgfile.c. When the server is under load (several hundred TCP connections from clients), the HUP is not processed because fopen() does not work when it receives a file descriptor from open() above 255. The fopen() fails and the rest of the actions to be performed on a HUP are skipped. I see that the fopen is used because of the fread and fwrite calls in cfg-lex.c. Is there any way that lex/flex could be configured to use read/write instead of fread/fwrite, and the call to fopen in cfgfile.c replaced with open? I really don't want to restart syslog-ng every time I need to rotate logs, as the overhead is too high. I'd much rather just HUP so that I can keep the client TCP connections alive via the keep-alive option. Thank you, Ryan Moon rmoon(a)gocougs.wsu.edu

1 0

UDP Source removal
by Tom Oele 22 Jul '03

22 Jul '03

First off, thanks for the syslog-ng effort. :-) Setting up a "middle-man" syslog forwarder for multiple IDS devices. The issue I'm having is that I need to keep the originating device IP through this forwarder. The original message is old syslog to syslog-ng then off again to a correlation host with a syslogd listener. The correlation host needs those messages in their original form instead of with the middle mans IP attached. IDS1(syslog)----->Middle Host(syslog-ng)------>Correlation(syslogd -r) ^ | IDS2(syslog)--------- So the correlation host obviously is taking the UDP source from the middle man and appending it to the beginning of the message. Have tried using keep_hostname() with no avail. Current options are the following: options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(yes); chain_hostnames(no); }; Am I missing something here? Ideas? Thnx, T -- Neohapsis, Inc. Thomas Oele - Network Security Consultant 414.289.0966 Milwaukee 773.394.8310 Chicago www.Neohapsis.com

2 1

netmask() and syslog-ng 1.6.0rc3
by Rick Shank 22 Jul '03

22 Jul '03

Hello, I saw a post showing the netmask() function for filters. I'm trying to do a filter such as: filter f_company { host("company-firewall") or host("company-ids") or netmask("10.128.53.0/24") or netmask("10.128.54.0/24") or netmask("10.128.55.0/24") or netmask("10.128.56.0/24") or netmask("10.128.57.0/24") or netmask("10.128.58.0/24");}; This doesn't seem to work. What am I doing wrong? I'm using the netmasks because the server can't get DNS for those hosts (internal Windows 2000 hosts using EvntSLog). Thanks, ~rick shank

1 0

Destiniation program question
by Aaron Jackson 22 Jul '03

22 Jul '03

I am trying to get syslog-ng 1.6.0rc3 to run a program as soon as it receives a message that matches a specific string, but I am having a few problems. My syslog-ng.conf file has the following set up: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_udp { udp(); }; source s_tcp { tcp(); }; destination d_prog { program("/path/to/program.pl" template("$HOST,$MSG\n")); }; filter f_fetch { level(notice) and match("MATHC_STRING"); }; log {source(s_sys); source(s_udp); source(s_tcp); filter(f_fetch); destination(d_prog); }; My first question is an easy one. My perl program has the form: while ($line=<>) { ... } Is this correct? When syslog-ng forks my perl script, can I assum that STDIN is always open or should my script have a form like so? while (1) { $line=<>; ... } My second question has to do with when the perl script is run. It looks like syslog-ng waits for either several log messages or gets a SIGTERM (or similar) before it runs the program. I would like for this to happen in real time. The only option I see that might change the timimg of when the program is run is log_fifo_size. But since I have to use a production system that collects over 20K log messages/day for development (yes, this is bad), I would like to know if I'm on the right track before I change anything. Any info would be helpful. Thanks. Aaron

1 0