- syslog-ng - lists.balabit.hu

RE: [syslog-ng]UDP syslog not being logged by syslog-ng
by Moxey, Joel, CND Tech Dev, VF UK 29 Jan '03

29 Jan '03

Drew, Thanks for you help. It was me being stupid! It's the Red Hat firewall stopping it working! Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 5:14 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Joel, I'm not sure this will really make a difference and it may just be a typo in the message, but in the filters you have authprov which should be authpriv, I believe. You could also try logging just source, destination and not use any filters to see what you are getting. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 12:02 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng They are in the local log files either. I tried changing the parameter to yes and still no success. Thanks for the ideas so far... Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 2:23 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Did you check the log file for the log server host? You have keep_hostname(no) so I think that the machine will log as from the local log server. Check to see if they are in the local host log file. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 9:08 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]UDP syslog not being logged by syslog-ng Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]UDP syslog not being logged by syslog-ng
by Hamilton, Andrew 29 Jan '03

29 Jan '03

Joel, I'm not sure this will really make a difference and it may just be a typo in the message, but in the filters you have authprov which should be authpriv, I believe. You could also try logging just source, destination and not use any filters to see what you are getting. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 12:02 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng They are in the local log files either. I tried changing the parameter to yes and still no success. Thanks for the ideas so far... Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 2:23 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Did you check the log file for the log server host? You have keep_hostname(no) so I think that the machine will log as from the local log server. Check to see if they are in the local host log file. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 9:08 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]UDP syslog not being logged by syslog-ng Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]UDP syslog not being logged by syslog-ng
by Moxey, Joel, CND Tech Dev, VF UK 29 Jan '03

29 Jan '03

They are in the local log files either. I tried changing the parameter to yes and still no success. Thanks for the ideas so far... Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 2:23 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Did you check the log file for the log server host? You have keep_hostname(no) so I think that the machine will log as from the local log server. Check to see if they are in the local host log file. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 9:08 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]UDP syslog not being logged by syslog-ng Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]UDP syslog not being logged by syslog-ng
by Hamilton, Andrew 29 Jan '03

29 Jan '03

Did you check the log file for the log server host? You have keep_hostname(no) so I think that the machine will log as from the local log server. Check to see if they are in the local host log file. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 9:08 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]UDP syslog not being logged by syslog-ng Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Problems with Regexp Matching
by Brian E. Seppanen 29 Jan '03

29 Jan '03

Hi Folks: I have a bunch of cisco routers that are all configured on the routers themselves to log at facility local0, and to send their logs to one host (well a couple of hosts simlarily configured, actually). I have the following filter for syslog filter f_syslog { not facility(auth, authpriv, local0, local1, mail) and level(debug..notice) and not match("nsca");}; I've likewise tried it as filter f_syslog { not facility(auth, authpriv, mail) and level(debug..notice) and not match("nsca");}; I then have a bunch of host filters that are supposed to filter router logs filter hostA { facility(local0) and host("192.168.0.1");}; unfortunately the logs are getting into syslog, I assume because they fall within the proper level, but why is the facility not preventing that? The same thing is happening with snmptraps which are received at local1. I'd appreciate any insights. syslog-ng 1.4.16 on redhat linux 7.2 and 7.3 Are there any general rules to follow when constructing filters??? thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

1 0

UDP syslog not being logged by syslog-ng
by Moxey, Joel, CND Tech Dev, VF UK 29 Jan '03

29 Jan '03

Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel

1 0

syslog-ng 1.5.25 released
by Balazs Scheidler 29 Jan '03

29 Jan '03

Hi, I have released syslog-ng 1.5.25, available at the usual places: http://www.balabit.hu/en/downloads/syslog-ng/ Here's the NEWS file entry: News for the 1.5.25 release Mon, 20 Jan 2003 16:34:03 +0100 * The previous kernel bug workaround in libol fixed the issue for the 2.4.20rc? kernels only, the current workaround should also work for 2.4.20 final as well. * Added bad_hostname() feature where the administrator can specify a regular expression to match bad hostnames, works around bad programs such as ctld which uses a space within its program name. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

5 19

RE: [syslog-ng]Ayuda....
by Hamilton, Andrew 28 Jan '03

28 Jan '03

You should probably post your configuration but I think you have a log statement that references a source called net that is not defined as a source. Regards, Drew -----Original Message----- From: rlobo [mailto:rlobo@ula.ve] Sent: Tuesday, January 28, 2003 2:02 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Ayuda.... Buenos dias y disculpen la molestia... necesito la ayuda de ustedes, estoy compilando el syslog -ng version 1.5.23 y el php-syslog-ng-1.2, ya tengo montado los requerimientos para este paquete... El problema es que cuando hago un start al syslog-ng me refleja este erro en el archivo de configuracion del syslog-ng.conf unresolved reference: net Error initializing configuration, exiting. Nota: Ya probe colocando la mi red donde dice net, tambien coloque la ip de la maquina en donde estoy compilando el paquete... Si no soy muy explicativo por favor me lo dicen.... Muchas Gracias.... _/ _/ _/ _/ Richard J. Lobo U. _/ _/ _/ _/ _/ T.S.U. en Informatica _/ _/ _/ _/_/_/ Tecnico de Red. _/_/_/ _/_/_/ _/ _/ Facultad de Ciencias y Rectorado Merida - Venezuela Telf: +58-274-2402437 *** RedULA *** rlobo(a)ula.ve Celular 0414 - 7485627 ------------------------------------------------------------------ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]logs getting stomped on
by Hamilton, Andrew 28 Jan '03

28 Jan '03

I would have to agree with Bazsi. I've been running syslog-ng on Solaris 8 for a long while now and this never happened to me. It would pretty much have to be something on your system that is causing it. Regards, Drew -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, January 28, 2003 2:46 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]logs getting stomped on On Mon, Jan 27, 2003 at 11:10:48PM -0500, Brian Landers wrote: > > This happened to me when I had the files on a filesystem that > > had a 2GB file size limit and I hit the 2GB limit. > > Unfortunately, I'm reasonably sure this isn't the issue, unless > syslog-ng itself has problems with large files. This is on > Solaris 8, and the filesystem is mounted with the largefiles > option: > > /system on /dev/md/dsk/d50 > read/write/setuid/intr/largefiles/logging/onerror=panic/dev=1540032 on > Wed Aug 14 07:38:02 2002 > > Same thing happened again tonight, around the same time. At > about 22:30, the log mysteriously was truncated and restarted. > Arggh!!! I think it should be something outside syslog-ng as I have never heard syslog-ng doing something like this (and I was listening carefully ;) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng]logs getting stomped on
by Brian Landers 28 Jan '03

28 Jan '03

> This happened to me when I had the files on a filesystem that > had a 2GB file size limit and I hit the 2GB limit. Unfortunately, I'm reasonably sure this isn't the issue, unless syslog-ng itself has problems with large files. This is on Solaris 8, and the filesystem is mounted with the largefiles option: /system on /dev/md/dsk/d50 read/write/setuid/intr/largefiles/logging/onerror=panic/dev=1540032 on Wed Aug 14 07:38:02 2002 Same thing happened again tonight, around the same time. At about 22:30, the log mysteriously was truncated and restarted. Arggh!!! -- Brian Landers | packetslave(a)sapient.com Network System Exorcist | vox://404/439.4117 Sapient Information Technology | aim://Bluecoat93 CCNA, SCSA, EIEIO | yim://brian_landers "Trust your family to have a Bottomless Pit, Malfoy," said Harry darkly. "Other people have shrubbery in the garden. You have a Bottomless Pit."

2 1