- syslog-ng - lists.balabit.hu

Problem of recording
by Stefano Tanfoglio 06 Nov '02

06 Nov '02

I am Stefano Tanfoglio, I work from one bank in Italy. I use syslog-ng for archive the log of 176 computer. ( 2 router - 125 windows server - 51 linux server ). In Windows server i use ntsyslog service. protocol = udp destination server = ip syslog-ng server destination port = 514 Ntsyslog send all log In Linux server i use the syslog auth.* @syslog01.xxxx.it authpriv.* @syslog01.xxxx.it kernel.=err;kernel.=warn @syslog01.xxxx.it mail.=err;mail.=warn @syslog01.xxxx.it daemon.=err;daemon.=warn @syslog01.xxxx.it local7.=err;local7.=warn @syslog01.xxxx.it ... ... Configuratione syslong-ng.conf: Versione: syslog-ng-1.4.14-2mdk options { sync (0); time_reopen (10); log_fifo_size (3000); long_hostnames (on); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); }; source remote { udp(); }; destination linux { file("/var/log/HOSTS/LINUX/$HOST/$FACILITY" dir_perm(0755) perm(0655)); }; destination windows { file("/var/log/HOSTS/WINDOWS/$HOST/$FACILITY" dir_perm(0755) perm(0655)); }; destination router { file("/var/log/HOSTS/ROUTER/$HOST/$FACILITY" dir_perm(0755) perm(0655)); }; filter f_linux { host("name1.domain.tld|name2.domain.tld|name3.domain.tld|...........|51"); } ; filter f_windows { host("name1.domain.tld|name2.domain.tld|name3.domain.tld|...........|125"); }; filter f_router { host("name1.domain.tld|name2.domain.tld"); }; log { source(remote); filter(f_linux); destination(linux); }; log { source(remote); filter(f_windows); destination(windows); }; log { source(remote); filter(f_router); destination(router); }; Problem: 1) In the windows section I have 125 machine and only 80 recording. I try to move the last hostname in first position: filter f_windows { host("125|name1.domain.tld|name2.domain.tld|name3.domain.tld|...........|124 "); }; the test it ok, hostname logger and recording. 2)Every 10-15 minutes the syslog-ng system it down. 3) I try the new version but I have not obtained the positive information. 4) I have modified the syslog-ng.conf: .... .... destination tem { file("/var/log/HOSTS/ALL/$HOST" dir_perm(0755) perm(0655)); }; ... ... ... log { source(remote); destination(tem); }; .. .. The all machine recording and the server don' t crash with this solution. I don't try the DB recording. Thanks for the collaboration. Stefano Tanfoglio Assyrus Srl www.assyrus.it ICQ:146827274

3 2

Re: chroot and hostname resolution problem [was : Re: [syslog-ng]centralized
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

The last missing lib was : 8677 open("/lib/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) Thanks to all who helped me. But as I'm just starting playing with syslog-ng, I think I'll be back quickly with some other questions ... ;-) Regards, Guillaume - - - Balazs Scheidler wrote : (snip) > those files are loaded dynamically by the libc ok I now understand better > do you have resolv.conf/host.conf ? You're right ! 8561 open("/etc/resolv.conf", O_RDONLY) = 5 8561 open("/etc/host.conf", O_RDONLY) = -1 ENOENT (No such file or directory) question : what's the difference, in name resolution process, between /etc/hosts.conf and /etc/nsswitch.conf my updated config : $JAIL/etc/resolv.conf is ok and working (tested outside the jail) $JAIL/etc/nsswitch.conf contain "hosts: dns" $JAIL/etc/hosts.conf contain "order bind" syslog-ng continue to resolve hostnames only if they are in $JAIL/etc/hosts

1 0

Re: chroot and hostname resolution problem [was : Re: [syslog-ng]centralized
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

Gregor Binder wrote : > Msg from Guillaume LACHENAL: > > Hi Guillaume, > > > and I suppose those libs are needed by the resolver ... > > most likely :) > > > Why 'ldd syslog-ng' does not reported this two files ? > > (nor ldd on the libs returned by the previous commands) > > You might find them if you continue to search recursively through the > results. This is what I've done ! : G> nor ldd on the libs returned by the previous command > > > How could I 'guessed' that I need to copy this files into the jail ? > > I've set up quite a few chroots for all kinds of services. Experience > says, that guessing (i.e. trying to figure out in advance) will usually > only save you the first few trace-sessions but almost never make the > chrooted service work 100% right away. Ok > > Althougt my $JAIL/etc/nsswitch.conf contains "hosts dns", > > hostnames are only resolved if they are in $JAIL/etc/hosts ! > > Amazing ... > > As you seem to start having fun with process tracing, try to find out > where resolving fails, or if it is attempted at all. I'm on this way ! > Regards, > Gregor.

2 1

Re: chroot and hostname resolution problem [was : Re: [syslog-ng]centralized
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

Balazs Scheidler wrote : (snip) > those files are loaded dynamically by the libc ok I now understand better > do you have resolv.conf/host.conf ? You're right ! 8561 open("/etc/resolv.conf", O_RDONLY) = 5 8561 open("/etc/host.conf", O_RDONLY) = -1 ENOENT (No such file or directory) question : what's the difference, in name resolution process, between /etc/hosts.conf and /etc/nsswitch.conf my updated config : $JAIL/etc/resolv.conf is ok and working (tested outside the jail) $JAIL/etc/nsswitch.conf contain "hosts: dns" $JAIL/etc/hosts.conf contain "order bind" syslog-ng continue to resolve hostnames only if they are in $JAIL/etc/hosts

1 0

Re: chroot and hostname resolution problem [was : Re: [syslog-ng]centralized
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

Gregor Binder wrote : > Hi, > > > > doing 'strace /etc/init.d/syslog-ng start', I can't find something > > > strange, > > I don't know about Linux/strace, but on most systems, you would have > to use an option to the tracing utility to trace calls of child -- man strace -- -f Trace child processes as they are created by currently traced processes as a result of the fork(2) system call. -- man strace -- > processes. Looks to me like you are tracing the shell process only. > > Try to run the syslog-ng BINARY from strace, and look for problems > like Ed suggested. 8254 open("/lib/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) 8254 open("/lib/libnss_dns.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) and I suppose those libs are needed by the resolver ... Why 'ldd syslog-ng' does not reported this two files ? (nor ldd on the libs returned by the previous commands) How could I 'guessed' that I need to copy this files into the jail ? > > > > Is there someone who is running a chrooted syslog-ng running under a > > > non root user as a log collector without any (hostname resolution) problem > > > ? > > I am - but I have "use_dns(no)" in my config. > > Same here. I don't see any technical reason why this wouldn't work, > unless you are missing resolv libraries (e.g. on Solaris) or > supplementary configuration files in the jail. > > Gregor. Now my syslog-ng is resolving almost as I want : Althougt my $JAIL/etc/nsswitch.conf contains "hosts dns", hostnames are only resolved if they are in $JAIL/etc/hosts ! Amazing ... I'll continue debugging, I progress ;-)

3 2

Re: chroot and hostname resolution problem [was : Re: [syslog-ng]centralized
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

Ed Ravin wrote : > Guillaume LACHENAL writes: >> >> can't find ktrace > > Ah, you must be using Linux. Should have said that up front. Yes. >> doing 'strace /etc/init.d/syslog-ng start', I can't find something >> strange, > > Look for "file not found" errors or anything else related to file > access. Can't find any error like this > Is there someone who is running a chrooted syslog-ng running under a > non root user as a log collector without any (hostname resolution) problem > ? > > I am - but I have "use_dns(no)" in my config. Could you try with "use_dns(yes)" ? > How about posting the log - make sure there is no private information > in it. If it's too huge put it up on the web somewhere and post the > URL to the list. See strace log attached (I'm running syslog-ng in debug mode with -d -v)

1 0

chroot and hostname resolution problem [was : Re: [syslog-ng]centralized loghost]
by Guillaume LACHENAL 06 Nov '02

06 Nov '02

can't find ktrace doing 'strace /etc/init.d/syslog-ng start', I can't find something strange, but this kind of things if out of my knowledge. I can send the log if someone could help. Is there someone who is running a chrooted syslog-ng running under a non root user as a log collector without any (hostname resolution) problem ? The jail is correctly configured. I've checked the necessary libs w/ 'ldd syslog-ng' and build the cache with 'ldconfig' (chrooted of course) /etc/nsswitch.conf & /etc/resolv.conf are in the jail too I'm currently running 1.5.21 w/ libol-0.3.3 "Guillaume LACHENAL" <glachenal(a)on-x.com> Sent by: syslog-ng-admin(a)lists.balabit.hu 10/30/02 11:14 Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: Subject: Re: [syslog-ng]centralized loghost /etc/nsswitch.conf is available in the jail ktrace & truss are command not found on the box, i'll search for it when not chrooted, syslog-ng correctly resolve hostnames. "Ed Ravin" <eravin(a)panix.com> Sent by: syslog-ng-admin(a)lists.balabit.hu 10/28/02 17:31 Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: Subject: Re: [syslog-ng]centralized loghost Guillaume LACHENAL writes: > As syslog-ng run chrooted, I've copied /etc/resolv.conf & /etc/hosts > into the jail. > It does not fix the issue Does your system also require /etc/nsswitch.conf in the chroot? Do a ktrace/truss on the startup in the chroot and see if it finds all the files it needs to do DNS lookups. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

suggestion for keep_hostname() option
by Nam 05 Nov '02

05 Nov '02

Could keep_hostname() be implemented as an option usable locally to source drivers tcp and udp instead of just being a global option? The following example will illustrate what I'm getting at. The following excerted configs are used on the syslog-ng servers: options{ keep_hostname(no); use_dns(no); chain_hostname(no); }; source syslog { udp( port(514) ); }; source syslog-ng { tcp( port(514) ); }; When host A sends syslog message to syslog-ng server B, the message is written with the host A IP address. Then, syslog-ng server B relays this message to a central syslog-ng server C, the message is written with the syslog-ng server B IP address. It would be useful to write the message at the central server with the host A IP address as that is the IP address that originated the message. I could change the global option on the central syslog-ng server to be keep_hostname(yes) and the message will be written with host A IP address. However, that means that messages that are not being relayed (e.g. sent directly from a syslog host to the central syslog-ng server C) will have the keep_hostname(yes) applied when the desired option is keep_hostname(no) for those messages. The following example config shows the extension of keep_hostname() use that I'm suggesting. options{ use_dns(no); chain_hostname(no); }; source syslog { udp( port(514); keep_hostname(no); ); }; source syslog-ng { tcp( port(514); keep_hostname(yes); ); }; Possibly a patch Balazs? :-) A side note, with keep_hostname(no) and use_dns(no) the syslog-ng internally generated messages are written with the hostname. Possibly make it (or optionable) that when keep_hostname is no, those internal messages are written with the host IP address? Keeps the written log structures consistent especially when using macro expansions. Nam __________________________________________________________ Get your FREE personalized e-mail at http://www.canada.com

1 0

1.5.23 dies
by Jaakko Niemi 05 Nov '02

05 Nov '02

Hi, gc_mark: Marking object of class 'affile_dest_reaper' (1) io.c: sockaddr2info(): Unsupported address family 63828. Program received signal SIGABRT, Aborted. 0x40054781 in kill () from /lib/libc.so.6 (gdb) bt #0 0x40054781 in kill () from /lib/libc.so.6 #1 0x40054464 in raise () from /lib/libc.so.6 #2 0x40055be1 in abort () from /lib/libc.so.6 #3 0x080599ee in fatal ( format=0x8061000 "io.c: sockaddr2info(): Unsupported address family %i.\n") at werror.c:190 #4 0x08058e96 in sockaddr2address_info (addr_len=256, addr=0xbffff7a8) at io.c:1032 #5 0x0804aaf0 in do_handle_line (self=0x8070600, length=62, data=0x8070644 "<86>Nov 5 18:26:38 sshd[346]: connection from \"192.168.1.1\"", addr=0xbffff7a8, addrlen=256) at sources.c:70 #6 0x0804ad7a in do_read_line (h=0x80639a0, read=0xbffff90c) at sources.c:121 #7 0x08057c1f in read_callback (fd=0x8063958) at io.c:419 #8 0x0805780b in io_iter (b=0x80637f8) at io.c:263 #9 0x0804a07f in main_loop (backend=0x80637f8) at main.c:197 #10 0x0804a9d6 in main (argc=2, argv=0xbffffb74) at main.c:527 Seems to be happening when something gets logged from pam to authlog. 1.5.15 works with same configuration. In configuration I have: source src { unix-dgram("/dev/log"); internal(); file("/proc/kmsg"); }; Any more info I can give? --j

2 6

RE: [syslog-ng]Feedback about insertdb.pl
by _/CaT\_ 04 Nov '02

04 Nov '02

Sorry, is only a obsolete variable. Please comment or removed $ENV{'DBI_DSN'}='syslog'; $ENV{'DBI_USER'}='root'; $ENV{'DBI_PASS'}='mysqladmin'; #$ENV{'DBI_TABLE_SYSLOG'}='xxx'; $ENV{'DBI_PIPE_SYSLOG'}='/var/chroot/syslog-ng/dev/mysql.pipe'; $ENV{'ERR_MSG'}='/var/chroot/syslog-ng/var/log/err_DB_msg.log'; my $DB_SB='mysql'; my $DEBUG = 1; my $test_dsn = $ENV{'DBI_DSN'} || die "DSN not set\n"; my $test_user = $ENV{'DBI_USER'} || die "User not set\n"; my $test_password = $ENV{'DBI_PASS'} || die "Password not set\n"; #my $table = $ENV{'DBI_TABLE_SYSLOG'} || die "Table not set\n"; my $pipe = $ENV{'DBI_PIPE_SYSLOG'} || die "Pipe file not set\n"; my $errmsg = $ENV{'ERR_MSG'} || die "File ERR_MSG not set\n"; -----Original Message----- From: M.Ghalaie [mailto:mgh@mgn.net] Sent: Monday, November 04, 2002 8:00 PM To: cat_roger22(a)hotmail.com Subject: Re: [syslog-ng]Feedback about insertdb.pl Hello, I tested used your scripts "Perl". But I do not know to what "$ENV{'DBI_TABLE_SYSLOG'}='xxxxx'"... _/CaT\\_ wrote: > Hi *, > You've posted any feed-back about this post of mine: > http://lists.balabit.hu/pipermail/syslog-ng/2002-October/003905.html > With this solution I've resolved all my problem with insertions into > DB. > > Cheers > _/CaT\_ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > -- ---------------------------------------------- Mansour GHALAIE ---------------------------------------------- MGN De'partement Syste`me 8 Rue Grange Dame rose-78140 VELIZY (France) Tel : 01 34 49 06 37 Fax : 01 34 49 06 79 E.mail : mgh(a)mgn.net Site web : www.mgn.net ----------------------------------------------

1 0