- syslog-ng - lists.balabit.hu

How do I adjust logging for "foreign" facilites?
by Wayne Sweatt 03 Jun '03

03 Jun '03

I am running syslog-ng-1.6.0rc2+20030423 on Solaris 8. I see a problem with the udp logging of facilities from non-Solaris clients. For example, syslog-ng is storing the authpriv facility from Linux clients as "a" as the $FACILITY value, and cron as "9". It also sets the value of "a" for MacOS X client's netinfo facility. I can understand strange values for the "non_Solaris" facilites - authpriv and netinfo, but . the cron value is set correctly from Solaris clients while not for Linux clients. I thought these numeric Facility codes were "standard' between OSes. Any explanations? Is there a suggested way to convert these values at runtime using filters(?), or maybe there an easy way to re-compile this functionality in for Solaris? The logs are arriving and being stored just fine, it's just the $FACILITY value that I would like to translate back to it's native "name" for clean parsing reasons. Thanks, Wayne Sweatt

2 1

Help - How do I reply to a thread?
by Wayne Sweatt 03 Jun '03

03 Jun '03

How do I reply to a thread? The Web Form has no "Reply" action built in, so I'm assuming it's a Subject line format? Thanks, Wayne Sweatt Sr. UNIX System Administrator Comforce Technical Services LANL SCC Team

2 1

Losing 25% of messages using UDP
by Wayne Sweatt 02 Jun '03

02 Jun '03

I just changed my udp_recv_hiwat to 65536 (Solaris 8). It worked for me! Wayne Sweatt Sr. UNIX System Administrator Comforce Technical Services LANL SCC Team

1 0

Rotate my logs files
by Moktar KONE 02 Jun '03

02 Jun '03

Hi , I am testing syslog-ng and I want to know how can I rotate my logs file . To logs messages I have a directory for many hosts, for each host, logs are classified by facilities, I have a new log file each day for each facility. so the name of my logs files changes according to the date. how can rotate the old log files? the logs of 2days ago? 3days ago? thanks this is the section that logs my files : destination hosts { file("/var/log/HOSTS/$HOST/$FACILITY/$FACILITY_$YEAR_$MONTH_$DAY" create_dirs(yes)); };

5 4

syslog-ng and Linux kernel 2.4.20
by Balazs Scheidler 29 May '03

29 May '03

hi, this message is to inform you that syslog-ng might crash on kernels 2.4.20 due to a kernel bug. It causes syslog-ng to crash every few days. the problem is that recvfrom() returns without touching either the sockaddr length or the socket address. If the memory area contains a seemingly valid AF_INET address (because of a previous invocation), then sockaddr2address_info memcpy()s socklen (which is 256 in our case) amount of memory to a sockaddr_in. I've now added a workaround, and an assert statement to catch these cases. Patch is included below, but grabbing the latest libol snapshot should also help. A workaround is attached: diff -u -r1.36 -r1.37 --- io.c 30 Apr 2003 08:08:50 -0000 1.36 +++ io.c 22 May 2003 16:56:59 -0000 1.37 @@ -1,6 +1,6 @@ /* io.c * - * $Id: io.c,v 1.36 2003/04/30 08:08:50 bazsi Exp $ */ + * $Id: io.c,v 1.37 2003/05/22 16:56:59 bazsi Exp $ */ /* lsh, an implementation of the ssh protocol * @@ -373,9 +373,13 @@ for (;;) { int res; + /* This is another workaround for Linux kernel bugs */ + + ((struct sockaddr *) addr)->sa_family = 0; + res = recvfrom(closure->fd, buffer, length, 0, (struct sockaddr *) addr, (socklen_t *) addrlen); - if (*addrlen == 2) { + if (*addrlen == 2 || (*addrlen >= 2 && ((struct sockaddr *) addr)->sa_family == 0)) { /* HACK: this is a workaround of a Linux 2.2 & 2.4 bug, * it doesn't return anything sensible in sockaddr buf */ @@ -1013,6 +1017,7 @@ struct sockaddr_in *in = (struct sockaddr_in *) addr; UINT32 ip, port; + assert(addr_len == sizeof(struct sockaddr_in)); ip = ntohl(in->sin_addr.s_addr); port = ntohs(in->sin_port); a = make_inet_address(c_format_cstring("%i.%i.%i.%i", -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

A few questions
by Keith Olmstead 29 May '03

29 May '03

Hello, I have been messing with syslog-ng for awhile now. and I have it working on a central log server that I am working on, and now I have a few questions. 1. Is it better to do the filtering on the remote log server or the syslog server? I would think sending all logs to the syslog server would create uneeded traffic. 2. I am logging using the following variables, but it seems that the log is only getting logged as message_$date in the dir. Why is this? /$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH_$DAY" TIA, Keith Olmstead

1 0

Can some servers only be allowed to chained?
by Jason Haar 25 May '03

25 May '03

I have a central syslog server. destination d_messages { template("$R_ISODATE $HOST $FACILITY $PRIORITY $MSG\n") ... I also have some DMZes and complex firewall configs that make it not practical (or secure) to open up incoming connections from all the syslog clients back to the server. So instead, each of these "complex" areas has a syslog server in it that all the others in that subnet talk to via UDP. That one syslog server then talks to the central server via TCP - leading to one server with all syslog records. This all works fine, but I have to "chain_hostnames(yes)" for that to work. What I want is the UDP source on the central server to be that it does the PTR thing to figure out what $HOST is - i.e. "chain_hostnames(no)". For TCP only, "chain_hostnames(yes)". Then I can use netfilter to limit who can TCP to the server, etc. Can that be done? Thanks -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 6

tcp wrapper support on FreeBSD 5.0
by Mike Thomas 22 May '03

22 May '03

Hello, I recently discovered the wonders and joys of syslog-ng, and have been attempting to get tcp wrapper support to work, and unfortunately, to no avail. What I am experiencing is simply it is not working, I wish I could provide a more descriptive and detailed 'error', but it just simply won't block denied hosts. Here's the relevent output from ./configure, etc. ./configure --prefix=/usr --enable-tcp-wrapper checking for tcpd.h... yes checking for TCP wrapper library... -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... yes As you can see, tcp wrapper support was sucessfully compiled in. I did not have any issues/warnings/errors while compiling. Everything looked good on that end. Here's the relevant entries from /etc/hosts.allow (I don't use hosts.deny, all my entries are in hosts.allow, both deny and allow) syslog-ng: draco.cems.umn.edu, centaurus.cems.umn.edu, lupus.cems.umn.edu, cygnus.cems.umn.edu, orion.cems.umn.edu, gemini.cems.umn.edu, crux.cems.umn.edu, mozart.cems.umn.edu, : ALLOW syslogng: draco.cems.umn.edu, centaurus.cems.umn.edu, lupus.cems.umn.edu, cygnus.cems.umn.edu, orion.cems.umn.edu, gemini.cems.umn.edu, crux.cems.umn.edu, mozart.cems.umn.edu : ALLOW #deny *EVERYTHING* else ALL : ALL : DENY I've used tcpdmatch to verify that the rules are being examined and caught in the right fashion and, they are. Here's the output of tcpdmatch for instance: loki:root(~/syslog-ng/syslog-ng-1.6.0rc3)# tcpdmatch syslog-ng oberlin.cems.umn.edu warning: syslog-ng: no such process name in /etc/inetd.conf client: hostname oberlin.cems.umn.edu client: address 134.84.165.104 server: process syslog-ng matched: /etc/hosts.allow line 25 option: DENY access: denied Line 25 is the ALL: ALL : DENY loki:root(~/syslog-ng/syslog-ng-1.6.0rc3)# tcpdmatch syslog-ng mozart.cems.umn.edu warning: syslog-ng: no such process name in /etc/inetd.conf client: hostname mozart.cems.umn.edu client: address 134.84.164.249 server: process syslog-ng matched: /etc/hosts.allow line 20 option: ALLOW access: granted Line 20 is the syslog-ng: etc... line I have also used strace and truss on the syslog-ng binary and discovered that it is sucessfully making a call to the libwrap library, but it doesn't read hosts.allow/hosts.deny (I'm not sure if its supposed to or not). As far as how I have syslog-ng setup, I have it running on the default udp port, 514, bound to a specific ip which is not the main ip of the machine, but setup as a virtual interface, in linux it would be known as eth0:0, BSD just regards it as a second ip. Syslog-ng itself functions perfectly, accepting remote connections and the whole nine yards, it just simply refuses to work with tcp wrappers. Thanks in advance for your help, --Mike

2 2

failover
by Joxn 21 May '03

21 May '03

Hi everybody, I log messages to a remote server. But what happens if that server is not reachable? Is there a way to implement a failover to second server? Thanks very much in advance. bye Joxn

2 2

100% newbie match question
by Michael Hare 19 May '03

19 May '03

Guys- I know a little bit about syslog-ng, and a little bit about regular expressions. I haven't been able to put the two together to come up with a match expression that has the following behavior; match lines that do -not- contain word FOO. The thing I tried that I thought would work, but didn't, was "^[FOO]". Help? Thanks- -Michael /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ Michael Hare UW-Madison/WiscNet Network Engineering My phone: 608-262-5236 24-Hour NOC: 608-263-4188 WiscNet: 608-265-6761

2 1