- syslog-ng - lists.balabit.hu

Re: [syslog-ng]replacing part of prog name with hostname
by Noam Meltzer 03 Jan '03

03 Jan '03

I won't expect Sun to change their native syslogd. Their syslogd is working good in its native environment, and its "harmonic" with other native syslogd is evry good. For me it doesn't seem like a bug. Just another mechanism. Solaris' syslogd recognize the hostname by doing reverse-resolution for each packet. And I don't think it's such a bad idea. The current mechanism of syslog-ng is trying to run some regexp on the data string (If I understood you correctly). I believe that the Solaris mechanism is more secure because that way you know for sure that the originating IP is who it claims to be. (Yes, you can always hijack (hope i spelled this correct) an IP in the network, but I guess that in that case you have other trouble). In syslog-ng mechanism, some1 can inject you fake logs. (I don't know what good it can give an attacker... but I'm sure that some criminal mind can find what to do with this). Noam --- On Fri 01/03, Balazs Scheidler wrote:From: Balazs Scheidler [mailto: bazsi(a)balabit.hu]To: syslog-ng(a)lists.balabit.huDate: Fri, 3 Jan 2003 10:48:51 +0100Subject: Re: [syslog-ng]replacing part of prog name with hostnameOn Thu, Jan 02, 2003 at 03:28:49PM -0500, Noam Meltzer wrote:> I thing you confused it a little...> According to my last message (and a similar thread I created recently)> The problem with the hostname resolving of Solaris is fixed with using:> > keep_hostname(no)> > But, I would really like to understand what's going on in there.> Is my assumption correct?No. syslog-ng parses the incoming message, but the format of messages is_very_ vague. Depending on the sender the message itself can have many form.The problem here was the sender program contains a space, and Solarissyslogd does not add originating hostname to its local messages (unless itrelays the message) Thus it is not possible to decide whether the messagereceived contains 'hostname' & 'program' or a single 'program' but with aspace in it.keep_hostname() is not a solution, just a workaround, so syslog-ng itselfdoes not rewrite the hostname. The filter expression host('^hostname$')would still use the part before the space (e.g. the program name).The solution is to fix the sender program, no better workaround exists insyslog-ng.Nate, the problem does not apply to local messages only, it happens to caseswhen Solaris sends these messages via UDP. It is not a solution to simplyassume that there is no hostname for local messages-- BazsiPGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1

RE: [syslog-ng]Syslog and Checkpoint-NG
by Nicholas Berry 02 Jan '03

02 Jan '03

We haven't upgraded to NG yet, but pre-NG works fine. When we start testing NG, I can let you know what results we get. Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. nberry(a)ragingwire.com -----Original Message----- From: Jason Howell [mailto:jason.howell@triadbeemers.org] Sent: Sunday, December 29, 2002 10:06 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Syslog and Checkpoint-NG Has anyone heard of any problems getting Checkpoint-NG to syslog to a remote server? I am running CP-NG on RH7.3 and I can get it to syslog local but it won't send the logs to a remote server. J

1 0

Re: [syslog-ng](no subject)(solaris hostnames wrongly discovered)
by Noam Meltzer 02 Jan '03

02 Jan '03

Here's the solution: There's a parameter you can set in the configuration of the logserver itslef: keep_hostname() it should be set to: "NO" Some info about it: In order to understand things better, i sniffed the syslog network traffic, to see what i can learn about the problem. The main differences between syslog-ng and Solaris native syslog are: 1. It seems that syslog-ng terminates a single line of data with "\n" Like Balazs said). Native Solaris syslog terminates the line with nothing. 2. Syslog-ng adds in the beginning of the data line, the hostname which originated the log. Solaris' native doesn't do that, and counts on the log-server to reverse-resolve the originating IP, and get the host name. Now (and this is only my assumption, i haven't got into syslog-ng sources), when there's an host which sends two seperate packets of syslog data, which follows each other instantly, syslog-ng reverse resolve the first packet, and gets the hostname correctly. After that, it's supposed to cache the hostname from the earlier packet (according to the default value of keep_hostname(yes) ), and according to that to know the 2nd packet originating host. But, something goes wrong. Instead, syslog-ng tries to run some regexp or something of the kind of the data packet itself, and because there's no hostname written in the data, it finds some other word and decides that "THIS IS THE HOSTNAME!!!" (weepee!). setting "keep_hostname(no)" as I suggested overcomes this bug. (Or some other bug. The last paragraph is only my assumption what's going on inthere) Have a pleasent new year, Noam --- On Tue 12/31, Balazs Scheidler wrote:From: Balazs Scheidler [mailto: bazsi(a)balabit.hu]To: syslog-ng(a)lists.balabit.huDate: Tue, 31 Dec 2002 09:07:46 +0100Subject: Re: [syslog-ng](no subject)On Mon, Dec 30, 2002 at 05:32:09PM -0500, Noam Meltzer wrote:> > I did a little experiment and tried sending logs from one native solaris syslog to another. It worked just fine (except the fact i can't into hostnames...)> I looked at the big log "/var/adm/messages" (of two hosts) and saw that the "bad" logs, were logged by the native logger just fine, with stating the originating host as it should be in the beginning of the line.> > I tried simulating this using the command "logger" with no sucess.> > I suspect that sends the data of each packet, not to lines as> syslog-ng expects and this cause its mechanism to fail recognizing the> originating host succesfully.> > Did any1 encountered this problem? How did you solve it? syslog-ng terminates messages at '\n' even in UDP packets unless you areusing a recent version of syslog-ng.-- BazsiPGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

(no subject)
by Noam Meltzer 31 Dec '02

31 Dec '02

Hi! I am using Linux running Syslog-ng as my logserver, while the logs for each host i have are sent into different directory (and in the directory, i create files for each facility.priority). My clients platforms (the servers being logged) are: 1. Linux (runnig classic syslogd... can't remember which) 2. HPUX11i (running the native syslogd) 3. Solaris7&8 The mechanism works flowlessly, except for solaris. What happens? If I have a one line log, it works just fine. Syslog-ng identifies the host it comes from, and divide the data to files according to the rules I mentioned above. When I have a longer logs which takes two lines or more, starting from the 2nd line, syslog-ng doesn't know the the message was originated from, and creates for funny like: "?DLT" "?corrupt" "?See", etc. (The ? is actually 1 character or more, which the terminal can't recognize) The word you see, is actually the first word of the actual message. If I look at the operation of the native on solaris, local messages are logged just fine. I did a little experiment and tried sending logs from one native solaris syslog to another. It worked just fine (except the fact i can't into hostnames...) I looked at the big log "/var/adm/messages" (of two hosts) and saw that the "bad" logs, were logged by the native logger just fine, with stating the originating host as it should be in the beginning of the line. I tried simulating this using the command "logger" with no sucess. I suspect that sends the data of each packet, not to lines as syslog-ng expects and this cause its mechanism to fail recognizing the originating host succesfully. Did any1 encountered this problem? How did you solve it? Noam tsnoam(a)excite.com _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

4 3

Re: Bad hostname from solaris (added a subject now)
by Noam Meltzer 31 Dec '02

31 Dec '02

Hi! It is possible to use syslog-ng on solaris, but not preferable. I don't like the idea of replacing something core from the system. I'm trying to find a solution for the solaris syslogd, not to replace it with a different product. As I said: When its one native solaris syslog sending to another, it works flowlessly. Noam >Can you replace the Solaris syslog with syslog-ng? >Aaron >On Monday, December 30, 2002, at 05:32 PM, Noam Meltzer wrote: >>Hi! >>I am using Linux running Syslog-ng as my logserver, while the logs for >>each host i have are sent into different directory (and in the directory, i create files for each facility.priority). >>My clients platforms (the servers being logged) are: >>1. Linux (runnig classic syslogd... can't remember which) >>2. HPUX11i (running the native syslogd) >>3. Solaris7&8 >>The mechanism works flowlessly, except for solaris. >>What happens? If I have a one line log, it works just fine. Syslog-ng >>identifies the host it comes from, and divide the data to files according to the rules I mentioned above. >>When I have a longer logs which takes two lines or more, starting from >>the 2nd line, syslog-ng doesn't know the the message was originated from, and creates for funny like: >>"?DLT" "?corrupt" "?See", etc. >>(The ? is actually 1 character or more, which the terminal can't recognize) >>The word you see, is actually the first word of the actual message. >>If I look at the operation of the native on solaris, local messages are logged just fine. >>I did a little experiment and tried sending logs from one native solaris syslog to another. It worked just fine (except the fact i can't into hostnames...) >>I looked at the big log "/var/adm/messages" (of two hosts) and saw that the "bad" logs, were logged by the native logger just fine, with stating the originating host as it should be in the beginning of the line. >>I tried simulating this using the command "logger" with no sucess. >>I suspect that sends the data of each packet, not to lines as syslog-ng expects and this cause its mechanism to fail recognizing the originating host succesfully. >>Did any1 encountered this problem? How did you solve it? >>Noam >>tsnoam(a)excite.com _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

syslog-ng doesn't work with minilogd
by Daniel Tschan 30 Dec '02

30 Dec '02

Hi I installed syslog-ng 1.5.24 on Red Hat Linux 7.3 and 8.0 and discovered that it doesn't work together with minilogd. For a description of minilogd please see: <http://www.cygnus.com/support/wpapers/redhat/initscripts/what.html>. Minilogd terminates if syslog-ng is started like expected, but the messages buffered by minilogd are lost. Any idea what's the cause and how to fix it? Daniel

3 2

Syslog and Checkpoint-NG
by Jason Howell 29 Dec '02

29 Dec '02

Has anyone heard of any problems getting Checkpoint-NG to syslog to a remote server? I am running CP-NG on RH7.3 and I can get it to syslog local but it won't send the logs to a remote server. J

1 0

Can Not Compile on Solaris 2.8
by Stephen Bargon 27 Dec '02

27 Dec '02

I've looked to Google and found references to the problem. I'm afraid I'm more a router / network person then Unix programmer and need more information. Where do I make the link to yacc and put the -ll or -ly switches? -----Original Message----- From: Aaron Jackson [mailto:Aaron.Jackson@dc.gov] Sent: Thursday, December 26, 2002 4:30 PM To: syslog-ng(a)lists.balabit.hu Cc: sbargon(a)amdocs.com Subject: Re: [syslog-ng]Can Not Compile on Solaris 2.8 Search the mailing list archive and google. This problem has been thoroughly discussed and solved. Aaron On Thursday, December 26, 2002, at 05:09 PM, Stephen Bargon wrote: I'm recieving the following error(s) when trying run make on syslog-ng-1.5.23. Any suggestions or help would be appreciated. # make Making all in src make all-recursive Making all in . gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file res_init main.o yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /usr/local/syslog-ng-1.5.23/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /usr/local/syslog-ng-1.5.23/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /usr/local/syslog-ng-1.5.23/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' # ------------------------------------------------------------------------------------- The information contained in this message is proprietary of Amdocs, protected from disclosure, and may be privileged. The information is intended to be conveyed only to the designated recipient(s) of the message. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, use, distribution or copying of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. ------------------------------------------------------------------------------------- ------------------------------------------------------------------------------------- The information contained in this message is proprietary of Amdocs, protected from disclosure, and may be privileged. The information is intended to be conveyed only to the designated recipient(s) of the message. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, use, distribution or copying of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. -------------------------------------------------------------------------------------

2 1

Option to determine which IP syslog-ng listens on?
by Jason Howell 27 Dec '02

27 Dec '02

Is there an option to force syslog-ng to only listen on a certain IP address on a multihomed machine? Ja

2 1

Can Not Compile on Solaris 2.8
by Stephen Bargon 26 Dec '02

26 Dec '02

I'm recieving the following error(s) when trying run make on syslog-ng-1.5.23. Any suggestions or help would be appreciated. # make Making all in src make all-recursive Making all in . gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file res_init main.o yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /usr/local/syslog-ng-1.5.23/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /usr/local/syslog-ng-1.5.23/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /usr/local/syslog-ng-1.5.23/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' # ------------------------------------------------------------------------------------- The information contained in this message is proprietary of Amdocs, protected from disclosure, and may be privileged. The information is intended to be conveyed only to the designated recipient(s) of the message. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, use, distribution or copying of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. -------------------------------------------------------------------------------------

2 1