- syslog-ng - lists.balabit.hu

RE: [syslog-ng]RE: [Abacus] Virus
by Ohrberg, Mick 22 Jun '01

22 Jun '01

I suggest we keep the subject in this mailing list to the intended one - Syslog-ng. > -----Original Message----- > From: shadowboxer [mailto:shadowboxer@undr.net] > Sent: Friday, June 22, 2001 8:34 AM > To: abacus-admin(a)psionic.com; maik.fischer(a)rb3m.com > Cc: abacus(a)psionic.com; syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]RE: [Abacus] Virus > > > Yeah right. Send yourself one. > > -Da shadow > > -----Original Message----- > From: abacus-admin(a)psionic.com [mailto:abacus-admin@psionic.com]On > Behalf Of colette tostivint > Sent: Friday, June 22, 2001 9:31 AM > To: maik.fischer(a)rb3m.com > Cc: abacus(a)psionic.com; syslog-ng(a)lists.balabit.hu > Subject: [Abacus] Virus > > > Hi everybody > > I need a virus to do tests for a new mail server. Can you > send a virus, > please.. > Thanks > > Colette > > _______________________________________________ > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

RE: [Abacus] Virus
by Lyle 22 Jun '01

22 Jun '01

www.eicar.org provides a test file just for this purpose and almost all virus software honors this test file for testing purposes. Lyle -----Original Message----- From: colette tostivint [mailto:colette.tostivint@fortuneo.com] Sent: Friday, June 22, 2001 8:31 AM To: maik.fischer(a)rb3m.com Cc: abacus(a)psionic.com; syslog-ng(a)lists.balabit.hu Subject: [Abacus] Virus Hi everybody I need a virus to do tests for a new mail server. Can you send a virus, please.. Thanks Colette _______________________________________________

1 0

Virus
by colette tostivint 22 Jun '01

22 Jun '01

Hi everybody I need a virus to do tests for a new mail server. Can you send a virus, please.. Thanks Colette

2 1

syslog entries without hostnames
by David Douthitt 20 Jun '01

20 Jun '01

It seems like there are a LOT of these. Isn't it possible to make some options to handle them? I was thinking of options, but... what about this? Check the hostname of the message against the hostname using DNS and see if they match. If not, shift the message over and put the hostname in - and perhaps label it to show that it was inserted.... So a message from 192.168.3.3 (hostname folly) that contained no hostname but said: "last message repeated 5 times" would then become: Jun-XX XX:XX:XX folly* last message repeated 5 times ...and the log might look like this: Jun-XX XX:XX:XX folly su: access denied Jun-XX XX:XX:XX folly* last message repeated 5 times Jun-XX XX:XX:XX folly --mark-- Well? Only problem I could see is if the hostname in the syslog entry doesn't match the name of the host as a normal event; I don't see this happening. This does, however, generate more DNS traffic, unless you cache the entries - maybe within syslog-ng.

3 4

riverstone devices not logging hostname
by Mickey Everts 18 Jun '01

18 Jun '01

For some reason, our Riverstone routers are not logging their hostnames or IP's. Here is a sample entry: Jun 01 07:28:13 %L2TM-W-INVALID_VLAN, Port et.1.1 receiving frames from non-member VLAN(3265). Possible misconfiguration. Any ideas? All our other network devices work fine, so it's probably something with them, but I was hoping I could fix it on the server side. Is anyone else here using Riverstone? Here is some more info on our setup: Riverstone (http://www.riverstonenetworks.com) info: -- Software Information Software Version : 7.0.0.0 Copyright : Copyright (c) 2000-2001 Riverstone Networks Syslog host: XX.XX.XX.XX, Facility: LOG_LOCAL0 Minimum syslog level: INFO, Buffer Size: 50 messages Source IP address: XX.XX.XX.XX -- Here are my syslog-ng (version 1.4.10) options: -- # Global options { sync(0); log_fifo_size (1000); long_hostnames(off); use_fqdn(yes); use_dns (yes); time_reopen (10); create_dirs (no); keep_hostname (yes); }; -- Regards, -MiC Mickey Everts 415.901.2223 direct Unix System Administrator 415.901.2000 main Yipes Communications, Inc. 415.533.1402 cell http://www.yipes.com/ 415.358.4112 fax

1 0

Access Control List on AIX system
by Kai Wang 18 Jun '01

18 Jun '01

I have been using syslog-ng 1.4.11 for several months. I found the "kill -HUP" command doesn't change an existing log file mode, which means not only the mode and ownership haven't been changed but also the Access Control List(acl) hasn't been changed. I just downloaded and run syslog-ng 1.5.7. I found a big change of this. When you do "kill -HUP", the log files' mode and ownership have been reset and the acl has been disabled. Mode and ownership are not a problem. But I really want to keep the old acl or allow me to reset it like the file mode and ownership. Kai

2 1

syslog-ng / logcheck
by colette tostivint 15 Jun '01

15 Jun '01

Hi everybody I setup a syslog server and upgrade it with syslog-ng for logging lot of firewall pix and routeurs. I use a script Logcheck-1.1.1 to send me the most important logs. Is syslog-ng compatible with logcheck ??? I don't believe. Thanks Colette Tostivint

3 2

compress?
by Rory Toma 15 Jun '01

15 Jun '01

Is compress on the list to be added soon? I'd like to know before I go off and try to add it. Thx. -- Rory Toma rory(a)colinburns.com Game Master http://www.colinburns.com Colin Burns Games

1 0

using ^ and/or $ in a regular expression match
by nick 15 Jun '01

15 Jun '01

Is it possible to use a ^ and $ in a regular expression in syslog-ng? This filter doesnt seem to catch the logged status message below, but if I remove the ^ from the match, then the status message is excluded.. Does syslog-ng just not support ^ and/or $, or is there something else I have to do to get them working? filter f_lost { facility(local0) and program(lost[0-9]*) and not match(^status); }; Jun 14 16:59:39 local@biggayal lost: tcpserver: status: 0/5 -- nick

1 0

separating logs by hostname
by Greg Heim 14 Jun '01

14 Jun '01

I keep reading that syslog-ng has the capability to divert into different log files based on hostname. I'm doing this with an older version by manually specifying for each machine as shown below. I'd like to avoid mucking with the config file every time we add or remove a machine (all the time). I've downloaded 1.5.7, but can't find any examples of this. Is there a simple way to do this or do I need to just add an entry for every new host? filter f_shaggy { host(shaggy); }; destination d_shaggy { file("/var/syslog-ng/shaggy"); }; log { source(src); filter(f_shaggy); destination(d_shaggy); }; TIA, Greg

2 1