- syslog-ng - lists.balabit.hu

FW: syslog-ng-1.6.0rc3 - problem with incorrect separation of syslog messages from Cisco PIX
by email lists 11 May '03

11 May '03

Just realised the example tha were provided only contain IPSec SA data - apoologies, but I think you get the idea. Darten -----Original Message----- From: email lists Sent: Sunday, 11 May 2003 6:06 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: syslog-ng-1.6.0rc3 - problem with incorrect separation of syslog messages from Cisco PIX <snip> May 10 11:51:02 192.168.100.252 May 10 2003 01:51:02: %PIX-7-702301: lifetime expiring, (sa) sa_dest= 10.0.0.1, sa_prot= 50, sa_spi= 0xe859748d(3898176653), sa_trans= esp-3des esp-md5-hmac , sa_conn_id= 1, (identity) local= 10.0.0.1, remote= 10.1.1.1, local_proxy= 192<166>May 10 2003 01:51:02: %PIX-6-602302: deleting SA, (sa) sa_dest= 10.0.0.1, sa_prot= 50, sa_spi= 0xe859748d(3898176653), sa_trans= esp-3des esp-md5-hmac , sa_conn_id= 1 The same syslog message SQL formated to file - same template as program(): BEGIN; INSERT INTO rawlogs (host, datetime, facility, priority, level, tag, program, msg) VALUES ('192.168.100.252', '2003-05-10 11:51:02', 'local4', 'debug', 'debug', 'a7', 'May', 'May 10 2003 01:51:02: %PIX-7-702301: lifetime expiring, (sa) sa_dest= 10.0.0.1, sa_prot= 50, sa_spi= 0xe859748d(3898176653), sa_trans= esp-3des esp-md5-hmac , sa_conn_id= 1, (identity) local= 10.0.0.1, remote= 10.1.1.1, local_proxy= 192<166>May 10 2003 01:51:02: %PIX-6-602302: deleting SA, (sa) sa_dest= 10.0.0.1, sa_prot= 50, sa_spi= 0xe859748d(3898176653), sa_trans= esp-3des esp-md5-hmac , sa_conn_id= 1'); COMMIT; <snip>

1 0

RE: [syslog-ng]syslog-ng blanks in Servicename
by Lixin Liu 09 May '03

09 May '03

Is it possible to DNS to verify the valid hostnames? Our syslog produces many bogus hostnames and it is almost impossible to list all of them in bad_hostname(). Thanks, Lixin. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Friday, May 09, 2003 9:42 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng blanks in Servicename On Fri, May 09, 2003 at 10:24:22AM -0600, markallen wrote: > I recently read a thread that described an option you can set so your > not logging blanks in servernames. I seen where I can set the option > to ignore bogus hostnames but how do you ignore bogus hostnames that > start with a tab? > > This is what I'm currently using: > > options { > bad_hostname("snmp|AFSR|AFSR.PSYND|Delete|In|UDBH|Use|ready32"); }; > > I would like to exclude everything that starts with a tab as well. > Does anyone have any suggestions? options { bad_hostname("\t"); }; here's the set of special characters you can use (quoting cfg-lex.l): <string>\\a { append_char(7); } <string>\\n { append_char(10); } <string>\\r { append_char(13); } <string>\\t { append_char(9); } <string>\\v { append_char(11); } e.g \a, \n, \r, \t and \v are all supported special characters (similarly to C) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng blanks in Servicename
by markallen 09 May '03

09 May '03

I recently read a thread that described an option you can set so your not logging blanks in servernames. I seen where I can set the option to ignore bogus hostnames but how do you ignore bogus hostnames that start with a tab? This is what I'm currently using: options { bad_hostname("snmp|AFSR|AFSR.PSYND|Delete|In|UDBH|Use|ready32"); }; I would like to exclude everything that starts with a tab as well. Does anyone have any suggestions? Mark Allen

2 1

Match host with IP address when using use_dns?
by Marco P. Rodrigues 09 May '03

09 May '03

Couldn't seem to find an answer to this in the documentation. Is it possible to the have the use_dns(yes) option enabled but match hosts based on their IP address? I want to be able to write files as their FQDN but fo the REGEX matching based on the IP address. I can get this to work when I disable the use_dns(yes) option but then the files are the IP. I don't want to match based on hostnames. example: destination net_host_all { file("/tmp/$HOST"); }; filter f_hosts_all { host("^10\.201\.140\.*") or host("^10\.201\.150\.*") or host("^192\.168\.0\.[0-3][0-9]"); }; log { source(net); filter(f_hosts_all); destination(net_host_all); flags(final); }; While I'm hear might as well kill two birds with one stone. Can someone give ma a real life example of the practical use of using the fallback option? I must be inept because I can't see a valid reason to have it that the final/catchall statement couldn't do (with proper logical placements of the log statements in the configuration). MPR. -- "I am kind of a paranoiac in reverse. I suspect people of plotting to make me happy." - J.D. Salinger

2 1

Problem with chained hostnames..
by Michael Boman 09 May '03

09 May '03

I have tried a series of keep_hostname() and chain_hostnames() settings, but I still won't get it as logrelay/server Either I get it as "logrelay" or as "server". I want this as I want a dir structure like: /var/log/HOSTS/$relay/$server/....... What combination should I have on the: Relay? Final destination (ie: the log server)? Best regards Michael Boman -- Michael Boman Security Architect, SecureCiRT Pte Ltd http://www.securecirt.com

1 0

(no subject)
by Marco P. Rodrigues 08 May '03

08 May '03

Couldn't seem to find an answer to this in the documentation. Is it possible to the have the use_dns(yes) option enabled but match hosts based on their IP address? I want to be able to write files as their FQDN but fo the REGEX matching based on the IP address. I can get this to work when I disable the use_dns(yes) option but then the files are the IP. I don't want to match based on hostnames. example: destination net_host_all { file("/tmp/$HOST"); }; filter f_hosts_all { host("^10\.201\.140\.*") or host("^10\.201\.150\.*") or host("^192\.168\.0\.[0-3][0-9]"); }; log { source(net); filter(f_hosts_all); destination(net_host_all); flags(final); }; While I'm hear might as well kill two birds with one stone. Can someone give ma a real life example of the practical use of using the fallback option? I must be inept because I can't see a valid reason to have it that the final/catchall statement couldn't do (with proper logical placements of the log statements in the configuration). MPR. -- "I am kind of a paranoiac in reverse. I suspect people of plotting to make me happy." - J.D. Salinger

1 0

xinet.d
by sjm 08 May '03

08 May '03

Could someone please post the xinet.d script they use with syslog-ng? Thanks for you time, -- /*-----------------------------*\ | | | Steve McKinney | | ARDI - Web Programmer | | sjm(a)porter.appstate.edu | | (828) 262-6553 | | | \*-----------------------------*/

1 0

Problem getting init logs
by arthur.chereau 08 May '03

08 May '03

Hi, I've installed syslog-ng and it is working fine. There's just one remaining problem I can't solve: I use monit, which is started from inittab. Logs go to the file I defined. But they also go to the console (tty1). I tried to remove all syslog-ng entries sending logs to usertty (alert and emerg) and restart, but it didn't change anything. So the problem must be that init logs are different from other logs. Is it possible for syslog-ng to intercept logs sent by init to the console ? ------------------------------------------ Faites un voeu et puis Voila ! www.voila.fr

3 2

RE: [syslog-ng]syslog-ng blanks in Servicename
by Christian Osbahr 07 May '03

07 May '03

Hi, I just installed syslog-ng, and had a similar experience with a certain type of switches (Alteon's). Only in this case the syslog messages were formatted so that syslog-ng saw the level as the hostname (i.e. my syslog files would be named e.g. NOTICE.log when using $HOST.log for the filename). Using the bad_hostname() option, as described below, solved the problem. However, the question this is all leading to is this: When a hostname is matched by the bad_hostname option, what mechanism does syslog-ng use to establish a new name? Best regards, Christian -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: 7. maj 2003 13:54 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng blanks in Servicename On Wed, May 07, 2003 at 12:25:28PM +0200, Unger, Christian wrote: > >On Wed, Apr 30, 2003 at 12:22:34PM +0200, Unger, Christian wrote: > >> i log many informations via NT-Syslog to syslog-ng. Windows 2000 > >> have some services with a blank in the Servicename. ex: NTDS ISAM > >> > >> the log entry from syslog-ng seams as following: > >> Apr 15 15:42:33 ntds isam[info] 700 NTDS (268) Online > >> defragmentation is beginning a full pass on database > >> 'C:\WINNT\NTDS\ntds.dit'. > >> > >> NTDS ist NOT my hostname, thats the problem! > >> > >> I think thats the problem is in RFC. But i don't read it. ( no time > >> :[ ) > >> > >> is there a easy escape? or will the next version of syslog-ng have > >> a escape? > > > >try check_hostname(yes) > > > ---- > > check_hostnames(yes) doesn't help. > > I checked some information's with tcpdump. An I found a very interest > handling. Syslog-ng is able to handle hostnames in syslog datagram, > the delimiter between hostname and service name seams to be a space. > So if I have spaces in service name syslog-ng thinks that the first > word must be the hostname, but that's wrong. What can I do know? sorry, check_hostname() is meant for cases when the word seeming to be a hostname contains invalid characters (like '%'). The problem is that there is no way to distinguish between a hostname and a programname containing a space. The workaround I implemented was the bad_hostname() option, which contains a regular expression which covers bad hostnames. E.g. if you have a program that sends messages like: Apr 28 15:13:54 snmp ctld[12345]: message And "snmp ctld" is the program name, then you can use bad_hostname() to make syslog-ng think that "snmp" itself is a bad hostname. (of course this will not work if you really have a host named snmp) options { bad_hostname("snmp"); }; bad_hostname() accepts an extended regular expression so you can list several bad hostnames like this: options { bad_hostname("snmp|iis|foo|bar"); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

AW: [syslog-ng]syslog-ng blanks in Servicename
by Unger, Christian 07 May '03

07 May '03

>On Wed, Apr 30, 2003 at 12:22:34PM +0200, Unger, Christian wrote: >> Hi, >> >> i log many informations via NT-Syslog to syslog-ng. Windows 2000 have some services with a blank in the Servicename. ex: NTDS ISAM >> >> the log entry from syslog-ng seams as following: >> Apr 15 15:42:33 ntds isam[info] 700 NTDS (268) Online defragmentation is beginning a full pass on database 'C:\WINNT\NTDS\ntds.dit'. >> >> NTDS ist NOT my hostname, thats the problem! >> >> I think thats the problem is in RFC. But i don't read it. ( no time :[ ) >> >> is there a easy escape? or will the next version of syslog-ng have a escape? > >try check_hostname(yes) > ---- check_hostnames(yes) doesn't help. I checked some information's with tcpdump. An I found a very interest handling. Syslog-ng is able to handle hostnames in syslog datagram, the delimiter between hostname and service name seams to be a space. So if I have spaces in service name syslog-ng thinks that the first word must be the hostname, but that's wrong. What can I do know?

2 1