- syslog-ng - lists.balabit.hu

Re: [syslog-ng]List of Valid Source Addresess
by Daniel.N.Sferas＠us.hsbc.Com 21 Jul '03

21 Jul '03

Bazsi, I am interested in filtering based on the sender's IP address. My preferred method would be to read a file containing the list of valid source IP addresses, automagically generated by our management system. The file could contain up to 6,000 entries. Dan syslog-ng-request@lists.balabit.hu@lists.balabit.hu on 18 Jul 2003 08:31 Please respond to syslog-ng(a)lists.balabit.hu Sent by: syslog-ng-admin(a)lists.balabit.hu To: syslog-ng(a)lists.balabit.hu Message: 1 To: syslog-ng(a)lists.balabit.hu From: Daniel.N.Sferas(a)us.hsbc.Com Date: Thu, 10 Jul 2003 06:13:55 -0400 Subject: [syslog-ng]List of Valid Source Addresess Reply-To: syslog-ng(a)lists.balabit.hu Greetings, I would like to be able to validate that incoming syslog messages from the network are from "Well known" sources. Is there a way for syslog-ng to parse the source address against a flat file of IP addresses or patterns? I hesitate to use a match string in the syslog-ng.conf file as the filter would be very large. I am using 1.6.0rc3. Thanks in advance for any tips. Dan Sferas ************************************************************************ This E-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return E-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. ************************************************************************ --__--__-- Message: 2 Date: Thu, 10 Jul 2003 13:01:07 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]List of Valid Source Addresess Reply-To: syslog-ng(a)lists.balabit.hu On Thu, Jul 10, 2003 at 06:13:55AM -0400, Daniel.N.Sferas(a)us.hsbc.Com wrote: > Greetings, > > I would like to be able to validate that incoming syslog messages from the > network are from "Well known" sources. Is there a way for syslog-ng to > parse the source address against a flat file of IP addresses or patterns? > I hesitate to use a match string in the syslog-ng.conf file as the filter > would be very large. do you want to filter based on sender IP address, or the hostname part? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 ************************************************************************ This E-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return E-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. ************************************************************************

2 1

is flags(fallback) b0rken in 1.6.0rc3?
by Asher Yanich 18 Jul '03

18 Jul '03

Hi, I finally went ahead and upgraded my syslog-ng from 1.5.7 to 1.6.0r3. Previously, I used filter(DEFAULT) to catch all logs that had not matched anything else. I updated my config, to log { source(src); destination(d_default); flags(fallback); }; I however do not recieve anything to this destination, so it seems that fallback is broken? Can someone verify that this is the current state of syslog-ng? Thanks, -asher Asher Yanich Systems & Network Support Group Florida International University School of Computer Science "I've never had problems with 'extra time'. As far as I know, 'extra time' as a concept is right up there with Santa Claus and the Tooth Fairy." -Linus Torvalds

1 1

Running two syslog-ng on Solaris 8 ?
by Georg Oppenberg 18 Jul '03

18 Jul '03

Hi, I'm trying to run two syslog-ng on a Solaris 8 box: One is a replacement of the original syslogd, the other one is running in a chrooted environment and configured to log to into file inside the chroot jail. Inside the chroot jail I have made a /dev/log with 'mknod /dev/log -c 21 5'. I'm using the streams server with doors. The corresponding statement in syslog-ng.conf is: source local { sun-streams ("/dev/log" door("/var/run/syslog_door")); internal(); }; /etc/.syslog_door is soft-linked to /var/run/syslog_door. I would like to separate the logs of the chroot environment from the logs of the server. This is not working, though. Log entries generated either on the machine or in the chroot environment are logged in two files. I think this is caused by the log driver, which is responsible for passing messages between applications and syslog daemons. Do I try the impossible or does anybody have configured a similar setup sucessfully? Please respond also directly to me, as I'm not subscribed to the list, yet. Cheers Georg

1 0

RE: [syslog-ng]Syslog-ng Logging message three times?
by Hamilton, Andrew 18 Jul '03

18 Jul '03

What does your config look like? Especially the log lines. Are you logging three times to the same file? Please post your config so we can take a look at it. Regards, Drew -----Original Message----- From: markallen(a)micron.com [mailto:markallen@micron.com] Sent: Friday, July 18, 2003 9:32 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Syslog-ng Logging message three times? I'm running syslog-ng version 1.6 and I notice that any message that is logged to syslog-ng is logged three times versus once. I can do logger command and log to it and three message pop into the file system. Is this normal? Is it a bug? How do I fix it? Thanks -Mark _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Syslog-ng Logging message three times?
by markallen＠micron.com 18 Jul '03

18 Jul '03

I'm running syslog-ng version 1.6 and I notice that any message that is logged to syslog-ng is logged three times versus once. I can do logger command and log to it and three message pop into the file system. Is this normal? Is it a bug? How do I fix it? Thanks -Mark

1 0

Config error
by TIM MOORE 18 Jul '03

18 Jul '03

I just loaded Syslog-ng 1.6.0rc3 on a SuSE 8.2 linux box. I have successfully been running version 1.6.0rc1 on another LFS box for months. I took my config from the box running 1.6.0rc1 and put it on the new box. I get an error on the options. Did something change in the format or something with the options? I didn't see anything in the documentation that said formating or options changed. The daemon does run, but kicks out this for error: syslog1:~ # /etc/init.d/syslog-ng start /etc/init.d/syslog-ng: /etc/syslog-ng/syslog-ng.conf: line 12: syntax error near unexpected token `(' /etc/init.d/syslog-ng: /etc/syslog-ng/syslog-ng.conf: line 12: `options { long_hostnames(off); use_fqdn(yes); use_dns(yes); dns_cache(yes); keep_hostname(yes); use_time_recvd(yes); sync(0); };' Starting Syslog-ng done Everything looks right to me and it works fine on another box running 1.6.0rc1. Can anyone see the problem? I must be missing something little. Thanks, --------------------------------------- Tim Moore DNS/Linux/Cisco Admin ODJFS

1 0

Syslog-ng in a windowed shell
by will＠villa442.freeserve.co.uk 14 Jul '03

14 Jul '03

Is it posssible to have syslog-ng to output log data to a windowed shell rather than a main terminal. I'm currently running Debian v3 with KDE, & can get it to output ok to fullscreen terminal screens e.g. tty8 and root, but not windowed in the KDE environment. If so what should the config line be for this. Thanks in Advance. Will __________________________________________________________________________ Join Freeserve http://www.freeserve.com/time/ Winner of the 2003 Internet Service Providers' Association awards for Best Unmetered ISP and Best Consumer Application.

2 1

Year off the first of the month
by Keith Olmstead 14 Jul '03

14 Jul '03

Hello, Something strange is happening. At the first of the month I have logs that create a dir for 2002, one year ago and log breafly for 2002. It seems to be happening at the first of the month and only last breafly. Does anyone know why this is happening? Thanks, Keith

4 3

Log TCP
by Darrell Boyd 12 Jul '03

12 Jul '03

1 0

RE: [syslog-ng]Dropped messages and UDP buffer sizes
by Clemson, Chris 11 Jul '03

11 Jul '03

> On Thu, Jul 10, 2003 at 09:39:18AM +0100, Clemson, Chris wrote: > > Hello! > > We are trying to use syslog-ng to log messages from several servers. > > We get quite a few "dropped" messages from syslog-ng saying > between 70 and > > 290 are being dropped each time. > > According to the list, it sounds like we need to increase > out UDP receive > > buffer size. > > If syslog-ng reports dropped messages in itself, increasing > UDP receive > buffer will not help, as syslog-ng itself has already pulled > the message. ah, i see. > Message drops within syslog-ng might happen because one or more of the > destinations process messages slower than the sources. If you > only have file > destinations then increasing log_fifo_size() might help. it seems, after a bit more fiddling around, that it is a problem when logging to mysql (i didn't realise we were still logging to it). when we stop logging to mysql, 0 lines are dropped. is there anything we can do to buffer logging to mysql? thanks, chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

2 1