- syslog-ng - lists.balabit.hu

Syslog messages are getting combined...
by Scott, Joshua 27 Apr '01

27 Apr '01

Has anyone ever had an issue where sometimes you get the information from one syslog message combined with another syslog message? Every one in a while I get some of my firewall syslog messages combined with messages from my DNS servers. This causes my scripts to fail since there is invalid data in the log message. Can anyone shed some light for me? Thank you very much! Joshua Scott Jacobs Engineering

3 2

Secure syslog-ng.
by Scott A. McIntyre 27 Apr '01

27 Apr '01

Hi, I was looking for a way to have a secured form of syslog-ng and the most obvious way that came up (without playing IPSEC games) was to use SSH with remote port forwarding. After mucking about with the configurations for an hour (apparently, destination and source descriptors take different syntax for specifying a network connection -- annoyingly undocumented) I got things working more or less as I'd like...however, I did notice that after a few messages sent through this way OpenSSH would die (the main daemon itself, not the one doing the port forwarding). I know this may seem unrelated and the version of OpenSSH (2.3.0p1) wasn't the most up to date (now upgraded) but this was repeatable behaviour. Has anyone else tried such a setup and noticed anything curious about how things interact? Any other solutions for a secured implementation of syslog-ng would also be appreciated. I think that this method will serve me well, after I get the configurations all tweaked and tuned to operate properly. Regards, Scott

2 1

RE: [syslog-ng]Syslog messages are getting combined...
by Andrew Fort 27 Apr '01

27 Apr '01

There was a bug in syslog-ng in one of the 1.4.x releases that caused this to happen. I dont have this prob any longer with 1.5.3, and from memory it was fixed in 1.4.10 (check the CHANGELOG perhaps?) -afort >Hi Joshua, > >I installed the lastest version of syslog-ng on our central >loghost last days. >I have the same problem. Our firewall logs get meshed with the >Catalyst Logs >etc. >Well... I havent figured out the error yet, but I think there >may be a problem >when u use same filters for different sources (What we do.. >cos the Cisco IOS >Msg'es are all the same :-) >We do a first a hostcheck [ host("hostname") ] and then a >contentcheck [ >match("<cisco-msg'es>") ]. >If this all doesnt match the stuff goes into the DEFAULT log file. > >Gotta investigate it tomorrow :) > >Bye > >"Scott, Joshua" wrote: > >> Has anyone ever had an issue where sometimes you get the >information from >> one syslog message combined with another syslog message? >Every one in a >> while I get some of my firewall syslog messages combined >with messages from >> my DNS servers. This causes my scripts to fail since there >is invalid data >> in the log message. Can anyone shed some light for me? >Thank you very >> much! >> >> Joshua Scott >> Jacobs Engineering

1 0

Re: [syslog-ng]Linefeed in incoming messages
by Michael.Garvin＠carolinabroadband.com 26 Apr '01

26 Apr '01

In doing some further debugging to the hack I posted to work around the logging problems with the Cisco VPN3000 I discovered some changes that need to be made to not break TCP-based logging. Here's the updated code, with the existing prefix line for positioning: closure->pos += n; start = closure->buffer + 1; eol = closure->buffer + closure->pos - 1; while (start++ < eol) if ((start[-1] == 0x0a) && (start[0] != 0x3c)) start[-1] = ' '; Sorry about that... -- Michael Garvin mailto:mgarvin@carolinabroadband.com

1 0

RE: [syslog-ng]Cisco Logging
by Shaw, Richard W 23 Apr '01

23 Apr '01

Hi Drew I've tried your extra setting but I still get nothing about our cisco routers in the cisco.log or the sys.log files I'd setup for syslog-ng. I do however still get them via the syslogd. Is there something I'm missing out of the source bit of the code ? Regards Richard > -----Original Message----- > From: Hamilton, Andrew Mr RAYTHEON 5 SIG CMD > [SMTP:HamiltonA@hq.5sigcmd.army.mil] > Sent: Friday, 6 April 2001 4:03 pm > To: 'syslog-ng(a)lists.balabit.hu' > Subject: RE: [syslog-ng]Cisco Logging > > Richard, > > syslog-ng does a considerably better job at filtering than does syslogd. > This can cause you problems if you are not looking at it correctly. > syslogd > will log up to a priority for a facility in the syslog.conf. syslog-ng > will > log only that facility given in the syslog-ng.conf. Cisco devices log at > the info level by default. So only if you are getting something from the > Cisco devices at the debug level. If you want the same behavior as in > syslogd you need to set your filter to "priority(info..debug)". > > Regards, > Drew > > > -----Original Message----- > > From: Shaw, Richard W [SMTP:Richard.W.Shaw@team.telstra.com] > > Sent: Friday, April 06, 2001 9:50 AM > > To: 'syslog-ng(a)lists.balabit.hu' > > Subject: [syslog-ng]Cisco Logging > > > > Hi Guys > > > > I've just found syslog-ng and am testing/comparing it to our current > > syslogd > > so I can match the logging then push everything to a syslog server. > > > > My problem is that I'm getting no logs for Cisco devices, I don't even > get > > anything in the sys.log file(see below): > > > > syslogd.conf file : > > local7.debug /var/log/cisco.log > > > > syslog-ng.conf file: > > source src { > > udp(); > > tcp(); > > sun-streams("/dev/log" door("/etc/.syslog_door")); > > internal(); > > }; > > destination d_mail { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/mail.log" > > create_dirs(yes) > > ); }; > > destination d_cisco { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/cisco.log" > > create_dirs(ye > > s)); }; > > destination d_sshd { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sshd.log" > > create_dirs(yes > > )); }; > > destination d_tac { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/tacplus.log" > > create_dirs(y > > es)); }; > > > > destination d_sys { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sys.log" > > create_dirs(yes)) > > ; }; > > > > filter f_mail { facility(mail); }; > > filter f_cisco { facility(local7) and priority(debug); }; > > filter f_sshd { match("sshd"); }; > > filter f_tac { facility(local6); }; > > > > log { source(src); filter(f_mail); destination(d_mail); }; > > log { source(src); filter(f_cisco); destination(d_cisco); }; > > log { source(src); filter(f_sshd); destination(d_sshd); }; > > log { source(src); filter(f_tac); destination(d_tac); }; > > > > > > log { source(src); destination(d_sys); }; > > > > > > Thanks in advance for any help > > > > Regards > > Richard Shaw > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Syslog-ng dies with logrotate
by Simeon Johnston 20 Apr '01

20 Apr '01

We am using logrotate to rotate our logs and when I send syslog-ng the HUP signal it dies. We am using version 1.4.11. Here is the config for logrotate. /var/log/serv/VPN.log { postrotate kill -HUP `cat /var/run/syslog-ng.pid` endscript } This is the same rule we use for all the logs. I thought the HUP signal problem was fixed? Should I try the newest 1.5.x version? Would this command work better? killall -HUP syslog-ng Thank you, sim

1 0

circular logging & control structure based destination
by Shawn Davenport 20 Apr '01

20 Apr '01

Hey Folks, Can syslog-ng do circular logging? If you are wondering what I mean by that, I'm referring to writing messages to a file, and when the destination reaches a limit, old messages are removed so the new ones can hang around for a bit. The limit could be file size, message date or time, or something else perhaps. For my needs, I would love to set a file size limit. Say 20megs per destination file. Also the idea of having the destination be chosen through a control structure like an if/then statement is very appealing. The idea being, if destination A is available (network connection, file w/ X amount of disk space, etc) then log there, otherwise check destination B, or the next, and so on... Having the destination be able to change dynamically would be ideal. Unfortunately I don't have the c knowledge to make that happen, so the best thing I've come up with is through the use of a few different syslog-ng.conf files and some perl to watch network connections. Kind of messy... Thoughts, ideas, rude comments? Finding a way to do the first one, and better way for the second would be great! Thanks... Shawn

3 2

Re: [syslog-ng]1.4.11 fixes SIGHUP problems?
by John_Delisle＠ceridian.ca 18 Apr '01

18 Apr '01

I'm not sure thats a bug, it may be a feature actually. If you look at /var/log/messages, theres an entry saying the new config is bad, and syslog-ng will continue running with the old config. This prevents lost syslog messages. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 jon(a)dumbo.pobox.com Sent by: To: syslog-ng(a)lists.balabit.hu syslog-ng-admin@lists. cc: balabit.hu Subject: Re: [syslog-ng]1.4.11 fixes SIGHUP problems? 2001/03/12 11:21 AM Please respond to syslog-ng i noticed one problem. if the configuration file is broken to the point syslog-ng will not start, HUP does not notice this ie. if you forget a semicolon somewhere kill -HUP syslog-ng-pid works w/o erros but kill syslog-ng-pid and syslog-ng dies... y On Fri, Mar 09, 2001 at 10:01:08AM +0100, Balazs Scheidler wrote: | Hi, | | I was wondering whether the 1.4.11 release did really fix the SIGHUP | problems many of you encountered? Some feedback would be useful. | | TIA, | -- | Bazsi | PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 | | _______________________________________________ | syslog-ng maillist - syslog-ng(a)lists.balabit.hu | https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

6 7

Re: [syslog-ng]Linefeed in incoming messages
by Michael.Garvin＠carolinabroadband.com 18 Apr '01

18 Apr '01

> On 0, Balazs Scheidler <bazsi(a)balabit.hu> inscribed onto the electric medium... > > My question is, is there somewhere in the syslog-ng code where I can > > easily parse the incoming syslog message and replace linefeeds with > > something benign, such as spaces or tabs? Or is there another solution > > that would be better? In the meantime we're opening a bug with the > > vendor since I consider this their issue, but knowing vendors I'm not > > confident in their addressing the problem quickly. > > Vendor == cisco, perhaps? Not to name names, but... Yes. :-) One of their acquisitions to be precise. > > linefeeds take an important role in syslog messages, they terminate them. So > > I disagree. > > I just had to track this one down myself; the cisco vpn concentrator > is logging stuff with embedded newlines. The RH linux box was logging > the whole messages, but the Irix box wasn't. Hence clearly the > linefeed doesn't have any true bearing on the length of the syslog > message; it should be determined by the length of the incoming > message. Any imbedded newlines should be ignored; translated to > spaces (as the linux syslog does) or ^M (as the [patched] irix syslog > does.) Deja vu... This is exactly what we were running into. There's now an open TAC case with Cisco on it, since I call it a bug on their part. I'd tend to agree with Balazs on this point, to which end I added code to remove all but the final linefeed before processing. In 'src/sources.c' (I've included the existing line before and after for reference): closure->pos += n; start = closure->buffer; eol = closure->buffer + closure->pos; while (start++ < eol) if (start[-1] == '\n') start[-1] = ' '; eol = memchr(closure->buffer, '\0', closure->pos); It's not pretty, but so far it's gotten the job done. > "Be gracious in what you accept, and conservative in what you send." > (paraphrased sendmail quotation.) > > There's no RFC on syslog messages, is there? The Irix syslogd traces > its route all the way back to BSD 4.2, and the check that terminated > parsing when it hit a newline had been in there from the beginning. No, but there is a task force working on one if I recall. Better late than never? Thanks for the assistance, I think this is taken care of.

1 0

Re: [syslog-ng]Linefeed in incoming messages
by todd.glassey＠att.net 18 Apr '01

18 Apr '01

B-Man - one easy fix is to send the message length as an optional flag to the system, that is if this could be added to the "offensive piece of networking equipment". Then if the LF is detected before the EOM count is reached then there is some residual processing that this message will need , whatever that is. T. -- Regards, Todd > > My question is, is there somewhere in the syslog-ng code where I can > > easily parse the incoming syslog message and replace linefeeds with > > something benign, such as spaces or tabs? Or is there another solution > > that would be better? In the meantime we're opening a bug with the > > vendor since I consider this their issue, but knowing vendors I'm not > > confident in their addressing the problem quickly. > > linefeeds take an important role in syslog messages, they terminate them. So > syslog-ng takes its input packet, splits it by linefeeds and splits each of > these parts as separate messages. As you see it would be difficult to skip > processing linefeed characters because it would broke other syslog clients. > You may try looking around the function do_read_line() in sources.c and > change it the way that fits you, or wait for your vendor to fix the problem. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0