- syslog-ng - lists.balabit.hu

syslog-ng loghost project documentation
by Nate Campi 23 Nov '01

23 Nov '01

I've documented just about every part of my syslog-ng setup at work, and place it at http://www.campin.net/newlogcheck.html. It covers the whole deal, from reporting with custom log scanners, swatch, archiving to files and to a database, and more. This may save others time when they are starting out on their projects. This is a work in progress, but I'm sure it could be useful now. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 Your mantra for today is: Don't let data from the network near a shell. Bad things happen. -- Randall Schwartz

1 0

Feature Suggestion: Additional variable $PROGRAM_ESC for filename expansion
by Norbert Nemec 23 Nov '01

23 Nov '01

Hi there, I've been using syslog-ng for quite a while and I really like that program. There is just one feature I'm missing: In my current setup, I have all the logging data sorted into files within one directory, according the the name of the program sending the message. The documentation states correctly that this is a security problem, since the $PROGRAM variable might contain just about anything, including / and . making it possible for any user to write data to about any file in the filesystem. Even on my private system, where security is not a concern, this turns out to be nasty, since a small number of programs state their whole path as program name. my idea whould be to provide an alternative variable, e.g. $PROGRAM_ESC that is internally converted to a defined set of legal characters. This does not even have to be a high-quality, reversable conversion. A plain, well defined mangling should be absolutely enough. Ciao, Nobbi PS: Please CC me, I'm not subscribed. -- -- ______________________________________________________ -- JESUS CHRIST IS LORD! -- To Him, even that machine here has to obey... -- -- _________________________________Norbert "Nobbi" Nemec -- Hindenburgstr. 44 ... D-91054 Erlangen ... Germany -- eMail: <nobbi(a)cheerful.com> Tel: +49-(0)-9131-204180

1 0

variables and match()
by Paul Miles 23 Nov '01

23 Nov '01

Hi, We're using syslog-ng daemon although and we think we've noticed a feature that appears to be missing. When you do a pattern match using match(), we require the value of the pattern match to be available as a variable, say $1, $2 etc etc. Our aim is to be able to farm different syslog entries off to different files based on the matched text from the reg. expression. Is this possible. Thanks and kind regards Paul Miles All Secure Networks Visit www.allsecuredomain.com for low cost web hosting and domain registration

2 1

RE: [syslog-ng]TCP Connection Problem
by Mike Kelland 23 Nov '01

23 Nov '01

Well, it's really not much of a change (2 characters on line 341 of afinet.c) but here's the diff: 341c341,345 < self->super.max_connections = 10; --- > self->super.max_connections = 1000; > -----Original Message----- > From: Ed Ravin [mailto:eravin@panix.com] > Sent: Friday, November 16, 2001 10:43 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]TCP Connection Problem > > > Mike Kelland writes: > > This may be a similar situation to the one we ran into. > Syslog-ng allows 10 > > connections from a single source max (appears to be hardcoded into > > afinet.c). > ... > > we are testing a new compile where we have changed the max > connections to > > 1000. We've managed to make the 1000 connections with no > ill effects but > > have not yet stress tested it with these 1000 connections. > > Patches? Patches? Please share... > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1

syslog-ng DNS
by Matt Mariscal 23 Nov '01

23 Nov '01

Hello, I have a question concerning the use_dns option. Is this a global option only, or is there some way to change this per source or destination? I am currently running v 1.4.14 on a Solaris box with multiple logical interfaces. Each logical interface is defined as a separate source within syslog-ng. I would like to enable DNS resolution for specific sources only but it does not appear as though this is possible. It appears as though my alternatives are to either globally enable DNS (not feasible) or run a separate instance of syslog-ng with DNS enabled. Any ideas? Matt Mariscal

2 1

Max number of TCP connections?
by Chris Sibbitt 23 Nov '01

23 Nov '01

SUMMARY: How many connection can I have to a tcp() source? 10? Why? I have been experiencing a problem with a syslog-ng (1.4.11) server seemingly only allowing 10 connections to a tcp() source. A quick tour of the code found the offending code at line 341 in afinet.c: self->super.max_connections = 10; Elsewhere in the file I see this (with code missing): if (c->num_connections >= c->max_connections) { #FAIL TO CONNECT }else{ #SUCCESSFULLY CONNECT } Unless this is not the code to handle tcp() sources, I think I've found what I need to change in order to fix this. My question is to Balazs, or anyone else with insight into the design of this daemon: Why is the limit set to 10? I want to change it, potentially to something very high (100 sounds about right for now), what impact is this going to have? JetNet Logo Chris Sibbitt Operations Development 333 Preston St, 3rd floor Ottawa, Ontario K1S 5N4 Phone (613) 237-5995, ext228 Fax (613) 237-9002

2 1

patch for adding tcp wrappers to syslog-ng?
by Ed Ravin 20 Nov '01

20 Nov '01

I just patched my copy of syslog-ng-1.5.10 to use tcp wrappers - I want to strictly control who is allowed to talk to my log server, and since we do everything else at my shop with TCP wrappers, it seemed sensible to add it in. I am running NetBSD 1.5.2, which provides the tcp wrappers code as part of the base OS. The only other change needed was to add "-lwrap" to the link flags. Is there interest in this feature? The patch below is only for incoming TCP connections - I don't see the point of putting it in for udp, as the packets are trivially spoofable. I haven't had much time to review the syslog-ng code, so I suspect this is not the best way to apply the patch: on second thought, it seems it might belong in libol. -- Ed --- afinet.c 2001/10/27 01:57:51 1.1 +++ afinet.c 2001/10/27 03:29:11 @@ -28,6 +28,13 @@ #include "cfgfile.h" #include "pkt_buffer.h" +#ifndef WE_DONT_WANT_TCP_WRAPPERS +#include "tcpd.h" +int allow_severity; +int deny_severity; +#endif + + #include <errno.h> #include <string.h> #include <assert.h> @@ -210,6 +217,23 @@ CAST(afinet_source, self, c); struct afsocket_source_connection *conn; UINT32 res; + + +#ifndef WE_DONT_WANT_TCP_WRAPPERS + { + struct request_info req; + + request_init(&req, RQ_DAEMON, "syslog-ng", RQ_FILE, client->super.fd, 0); + fromhost(&req); + if (hosts_access(&req) == 0) + { + CAST(inet_address_info, inet_addr, client_addr); + notice("connection from %S:%i refused by hosts_access()\n", inet_addr->ip, inet_addr->port); + close_fd(&client->super, 0); + return ST_OK | ST_GOON; + } + } +#endif if (c->num_connections >= c->max_connections) { CAST(inet_address_info, inet_addr, client_addr);

2 2

setting up a loghost on AIX - please help!!
by Sippel, Christian 19 Nov '01

19 Nov '01

Dear list, I'm trying to set up an AIX-machine as a loghost by using syslog-ng but I can't get syslog-ng working, so I would be very thankful if you could give me some hints. After downloading, compiling and installing libol and syslog-ng on the AIX-machine that should be used as a loghost I wrote the following syslog-ng.conf file in the /etc/syslog-ng direcoty: source src { unix-dgram("/dev/log"); tcp(ip(1.5.19.253) port(514)); udp(ip(1.5.19.253) port(514)); internal(); }; destination test { file("/var/adm/log/test-ng.log"); }; log { source(src); destination(test); }; }; the client machine (also AIX, internal ip-adress 1.5.19.253 ) is running the standard syslogd, in the /etc/syslog.conf is the line: local2.info @dmz-loghost and the /etc/hosts contains the line 1.34.20.20 dmz-loghost sending a log-message with logger -plocal2.info with standard syslog to the loghost works fine (so port 514 should be open) but the file specified in syslog-ng.conf does not contain anything. I really would appreciate if you could give me some hints what I did wrong, Christian Sippel

1 0

Archiving log file
by Chee Chew 18 Nov '01

18 Nov '01

I wish to split the log file into daily basis by means of different file per day according to the received timestamp. Is there any option in syslog-ng can be configured for this. At normal, the log file will grow bigger and bigger and become more difficult to read especially when we want to search for certain event on certain date. By achiving the log into daily file with meaningful filename, it should be much more convenient. Perhaps if syslog-ng do not have this option, is there any workaround or better method to due with this? Regards

2 1

RE: [syslog-ng]TCP Connection Problem
by Mike Kelland 16 Nov '01

16 Nov '01

This may be a similar situation to the one we ran into. Syslog-ng allows 10 connections from a single source max (appears to be hardcoded into afinet.c). So you could be hitting this limit. In order to fix it, we started by making sure that each server returning syslog only made one connection (some of ours were making 5) by editing the config files and now we are testing a new compile where we have changed the max connections to 1000. We've managed to make the 1000 connections with no ill effects but have not yet stress tested it with these 1000 connections. Has anyone else run into a similar situation btw? I'd be interested to find out if there was a reason that the max connections was hardcoded to such a low number. Thanks, Mike > -----Original Message----- > From: Roman Ernst [mailto:roman_ernst@at.ibm.com] > Sent: Friday, November 16, 2001 7:05 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]TCP Connection Problem > > > Hi! > > I have configured about 10 Host logging directly to another > one (TCP!!!). > > Unfortunately I have the following problem: > > When I reboot this logging server then syslog-ng on all the > other hosts > crashes... > > Is there any work around or do you already know this bug? > > I think normal behavour should be trying to reconnect to the logging > server... > > > Thanks a lot for your help in advance! > > Roman Ernst > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1