- syslog-ng - lists.balabit.hu

syslog -> syslog-ng
by Billy 06 Jan '03

06 Jan '03

If I install syslog-ng as a log server can I have the original syslog mechinisam from all of my other boxes send to the syslog-ng server? Will it map the same, are there any modifications I need to make to the other syslog conf? Will I need to install syslog-ng on all boxes? Thanks, Bill

2 1

replacing part of prog name with hostname
by Nate Campi 06 Jan '03

06 Jan '03

I have syslog-ng 1.5.24 on solaris 8, reading from /etc/.syslog_door and I have a log entry like this: Dec 31 13:48:15 larry 6.0[8704]: [ID 702911 local0.warning] [0] Can't stat file in FlushFile [news/PointCast]: No such file or directory ...but the program name was sent from the app was: "ctlds 6.0[8704]:" and syslog-ng replaced the first part of the messed up program name with the host's name. In the next version, can syslog-ng "learn" that it don't get a hostname from solaris ever and that the entire text coming in is actually the log message? I'm losing information this way. I wonder how many other apps split up the program name and lose data - most people would never know as end users. -- Nate Campi http://www.campin.net An Emacs reference mug is what I want. It would hold ten gallons of coffee. -- Steve VanDevender And, no doubt, have a lid that could only be removed with an obscure finger combination requiring both hands. (Ctrl-Alt-Meta-X gimme-the-damn-coffee) -- William Beegle

5 14

Over zealous syslog-ng problem
by Aaron Jackson 06 Jan '03

06 Jan '03

My Setup: I have syslog-ng running on several Solaris 8 machines. Each machine writes log messages to their local disks and also forwards the messages to a central log server via a UPD connection, also a Solaris 8 machine. The central log server stores everything into a mysql database via a perl script I wrote. My Problem: I am running the UNIX version of Cisco Secure on one of the Solaris boxes. A couple of times it has blown up. When this happens, it generates millions of log messages in a very short period. The problem is that syslog-ng logs most of these messages (I also get the mangled message problem during these heavy loads). The most recent episode generated 1,930,974 messages that made it into the mysql database and 49,573 mangled messages on the central log server, but 16,040,886 messages were written to disk on the local machine (see below). My Questions: Is there any way to throttle syslog-ng, or make syslog-ng not accept all log messages when an app goes crazy? I want to log some of these messages, so I know when to restart the service, but I don't want all 16 million. Also, it seems that around 15 million log messages didn't make it to my central server. Where were they lost? Is this a problem with the UDP transport? Aaron # cat local0.log | grep -c 'ERROR - error on accept' 16040886 jackson@auth:/tmp {5} cat sql_errors | grep -c 'INSERT INTO' 49573 mysql> delete from logs where host='acs' and facility='local0' and priority='err' and msg like '%ERROR - error on accept%'; Query OK, 1943387 rows affected (1 hour 40.16 sec)

5 10

RE: [syslog-ng]replacing part of prog name with hostname
by Noam Meltzer 04 Jan '03

04 Jan '03

This sounds like a nice idea, but I think that if you use such a mechanism you should also state how to find the missing field, if you don't mention it. Also, you should think a lot of how to describe you regexp to support multi-platforms environment. Noam --- On Sat 01/04, Borzenkov Andrey wrote:From: Borzenkov Andrey [mailto: Andrey.Borzenkov(a)siemens.com]To: syslog-ng(a)lists.balabit.huDate: Sat, 4 Jan 2003 14:55:51 +0300Subject: RE: [syslog-ng]replacing part of prog name with hostname> > On Thu, Jan 02, 2003 at 10:43:45AM +0100, Balazs Scheidler wrote:> >> > the problem is ctlds sends a space in the program name tag, thus syslog-> ng> > interprets 'ctlds' as hostname and '6.0' as program name. as> > keep_hostname() is set to no it rewrites originating host name.> >> > Try setting keep_hostname() to yes, it will not touch the hostname then.> > Right but "ctlds" isn't the hostname, larry is. My logs are wrong either> way - I either lose half my program name or get the wrong hostname.> Either way I lose.> > Arg, I actually wrote my own syslog daemon to relay and rewrite all> these last year. The only way to fix this with syslog-ng would be to add> a feature like> > options {> bad_hostnames("ctlds","last");> };> > When syslog-ng sees either of these:> > Jan 2 15:06:47 ctlds 6.0[11718]: [0] Request error (500): Template> processing error> Jan 2 15:06:47 last message repeated 123 times> > It knows to actually shift the message over one place to the right and> stick the value of the $FULLHOST_FROM macro in there. Even if I tried> templating out the message on my own syslog-ng will still think that> "ctlds" or "last" isn't part of the message and it'll get lost.Better is to implement source templates. This way you can precisely describeinput line, so if you know your source never appends host name, you justomit this from template. Something likesource s_stream { unix-stream("/dev/log" max-connections(10)); template(DATEPROG[PID]:... );}; Cheers-andrey_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

Re: [syslog-ng]replacing part of prog name with hostname
by Noam Meltzer 04 Jan '03

04 Jan '03

Such a feature must support netgroups, though, because otherwise when you have hunderds of servers in your network, you'll have a problem. Noam --- On Fri 01/03, Nate Campi wrote:From: Nate Campi [mailto: nate(a)campin.net]To: syslog-ng(a)lists.balabit.huDate: Fri, 3 Jan 2003 12:28:57 -0800Subject: Re: [syslog-ng]replacing part of prog name with hostnameOn Fri, Jan 03, 2003 at 03:21:25PM -0500, Ed Ravin wrote:> Nate Campi writes:> > > > On Fri, Jan 03, 2003 at 10:48:51AM +0100, Balazs Scheidler wrote:> > > > > > The solution is to fix the sender program, no better workaround exists in> > > syslog-ng.> > > > I tried that. I spent months trying to explain it to their developers. I> > almost got one of them to understand, at which point he said they don't> > really care.> > How about a feature in syslog-ng like this:> > add_hostname(host1, host2, host3 [, ...])> > Which would cause syslog-ng to insert a hostname or IP number for all> packets received from the hosts requested. That would cover packets> from Solaris hosts received via UDP - the add_hostname() option should> also be available on individual syslog sources, so you could correct> messages received from the local host via the syslog door or whatever> that funky thing is Solaris uses.Exactly what I suggested, except I called mine "bad_hostnames". I thinkthis feature could work.-- Nate Campi http://www.campin.net "What a good thing Adam had. When he said a good thing, he knew nobody had said it before." - Samuel Clemens_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

Re: [syslog-ng]replacing part of prog name with hostname
by Noam Meltzer 04 Jan '03

04 Jan '03

--- On Fri 01/03, Balazs Scheidler wrote:From: Balazs Scheidler [mailto: bazsi(a)balabit.hu]To: syslog-ng(a)lists.balabit.huDate: Fri, 3 Jan 2003 12:13:20 +0100Subject: Re: [syslog-ng]replacing part of prog name with hostnameOn Fri, Jan 03, 2003 at 05:03:03AM -0500, Noam Meltzer wrote:> I won't expect Sun to change their native syslogd. Their syslogd is> working good in its native environment, and its "harmonic" with other> native syslogd is evry good. For me it doesn't seem like a bug. Just> another mechanism. It is not Solaris's syslogd that has the bug. It's ctld which sends bogusdata in its messages.> And many other Solaris' internal mechanisms, like a warning that "/var/adm/utmp exists", and then in another line "for more information refer to the manpage of utmp". and when you have problems with you hd, you get bad warnings then, and when the lpr complains about printing, it also send a two line logs. This is just a different method of sending the logs. Solaris counts on you that you will reverse resolve the originating machine, and not to interpeter the data line you get. I can send you reports of my sniffing to show you that this is not a bug in syslogd of solaris, if you would like me to. (even though i'm sure you have a reachable solaris machine, and already done it yourself) Solaris' syslogd recognize the hostname by doing> reverse-resolution for each packet. And I don't think it's such a bad> idea. The current mechanism of syslog-ng is trying to run some regexp on> the data string (If I understood you correctly). I believe that the> Solaris mechanism is more secure because that way you know for sure that> the originating IP is who it claims to be. (Yes, you can always hijack> (hope i spelled this correct) an IP in the network, but I guess that in> that case you have other trouble). In syslog-ng mechanism, some1 can> inject you fake logs. (I don't know what good it can give an attacker...> but I'm sure that some criminal mind can find what to do with this).in keep_hostname(no) state, syslog-ng does not trust the host name in anyway. but this interacts badly with ctld. You still haven't answered about my security-question. Noam _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

syslog server config question
by Mark Schipper 04 Jan '03

04 Jan '03

syslog-ng seems to work quite well for sorting logs by facility and/or priority to the nth degree....but I'm struggling to do something that one would expect to be fairly simple (perhaps it is, and I'm even more simple...). I'm trying to setup a syslog server that sorts input by hostname and throws that input into /var/log/HOSTS/$hostname file. It's strictly for a backup copy of each system log for audit puposes in case a host is compromised, but I'd prefer to have each host have its own file. Easier to find stuff that way. I was expecting to setup the syslog servers syslog.conf file (not using syslog-ng) to pipe to a shell or perl script that did the parsing, but everything I ran across looked like it was aimed at intrusion detection. A quick search convinced me that syslog-ng was my best bet so I compiled and replaced syslogd with syslog-ng, but it is still logging my client logs to /var/log/messages (yes, I killed syslogd first), even though I setup the following at the end of the syslog-ng.conf file: # automatic host sorting (usually used on a loghost) # destination std { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$HOST_$YEAR_$MONTH_$D AY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # log it log { source(src); destination(std); }; I obviously need to spend some more time on this, but perhaps someone has a quick suggestion or knows of a better way to do what I'm looking for. In the meantime I'll read 'til my eyes bleed....... I'm not on the list, so please reply to mschipper(a)lightsurf.com Thanks.

2 1

log checking
by Peter Straka 03 Jan '03

03 Jan '03

Hi What about log-checking? I tried logcheck,logscanner,logsurger,logwatch,swatch, but every-one is only like better grep. Which is the best log checker? I expect somethink on statistical base - somethink like http analyze. I have centralized loghost with directory structure: log/HOSTS/<IPadr>/facility.<YYMMDD>.log How to setup logchecker to control all logs? Use the PIPE? What are you thinking about? Is somewhere else discussion about that? by peter ________ Pocitacove hry? http://hry.sme.sk

1 0

chatt for linux
by Peter Straka 03 Jan '03

03 Jan '03

Hi I use syslog-ng on linux platform and I in crontab I use chattr to change log files (imutable and appendable) I think it would be goot idea to have implemented option attr() {like perm()}. And for acl somethinf like acl option. Would be this posible in future version? by peter ________ Pocitacove hry? http://hry.sme.sk

1 0

�ؼ��&�Կ��
by �� 03 Jan '03

03 Jan '03

特价新书75折！自考教材、辅导、试卷：一律8折，深圳市提供送货上门服务！深圳网络书店祝您新年愉快！点击进入深圳网络书店：　http://www.szbookshop.com ----------------------------------------------------------------------- 使用极星邮件群发，无须通过邮件服务器，直达对方邮箱，速度绝对一流！下载网址：http://love2net.51.net/，更多免费的超酷软件等你来下…… ---------------------------------------------------- INFORMATION This message has been sent using a trial-run version of the TSmtpRelayServer Delphi Component. ----------------------------------------------------

1 0