- syslog-ng - lists.balabit.hu

Collecting Logs on Loghost
by Wolfgang Braun 05 Apr '00

05 Apr '00

Greetings I'm writing my thesis on the subject of collecting and analysing logfiles. i'm in the information gathering and i'm interested in your opinions on the topic. the primary idea is that hosts log all their syslog (and maybe other files like http-logs) to a dedicated loghost where the log messages are inserted into a DB. additionally there should be a filter program that scans the message stream for certain patterns and triggers actions (information gathering like backfinger, ripe data etc). things to be evaluated now are o how much net load does syslog create? one pitfall could be that logging to the extreme could have an impact on network performance making it impossible to transfer all logging information. my view (not yet supported by numbers) is that the impact on net performance should be rather low, but i'm setting up a test environment to packet count. since i assume thet remote logging is common practice i'm interested in your experiences. o how much data does a host generate? this is of course dependant on which services are running on the machine and the usage of the services. question is how much data a DB (e.g. PostgreSQL) can handle (real time queries should be possible). this will be taken care of in the test environment, too. o common tools i'm aware of several analyzing tools (swatch, logsurfer ... from freshmeat). i like the logsurfer approach on creating contexts (to gather information from different sources into a small report on specified events). are there more tools like that that do a good job? some unsorted ideas: + doing long term analysis via the DB interface, to maybe trace long term patterns (slow portscans or door knob testing come to mind) + central administration of configurations and pushing of configurations to 'agents' running on each host + default filter configurations to handle standard services and their logs (bind, sendmail, ftpd), creation of regular reports as said, i'd be very interested on your thoughts on the topic, your experiences and maybe references to papers/tools. wolfi -- Internet ist das Ding mit den Kabeln. Usenet ist das Ding mit den Menschen. -- Hubert Partl

2 1

syslog-ng under HP-UX 10.20
by Gero Krueger 28 Mar '00

28 Mar '00

Hello snort-users ! I tried to compile syslog-ng-1.4.2 under HP-UX 10.20 (using gcc 2.8). During the linker process, I realized that there is no snprintf (and vsnprintf) function in the libc. Does anyone know a solution for this ? -- < Gero Krueger | DeTeCSM > < Tel. : +49-541-333-2488 | IVS Osnabrueck > < Fax : +49-541-333-2940 | Hannoversche Str. 6-8 > < mailto: krueger(a)obk.telekom.de | 49084 Osnabrueck >

4 9

Re: syslog-ng
by Balazs Scheidler 25 Mar '00

25 Mar '00

> > Great program from what I have read so far. Just installed it. I was > curious if there were any plans to add an option to syslog-ng.conf > under DESTINATIONS: > > * mail <email address> - Emails specified logs to user. you can easily achieve this using the program() destination. Write a simple shell script: #!/bin/sh while read line; do echo $line | mail root(a)domain.com done -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog and syslog-ng together
by Gero Krueger 23 Mar '00

23 Mar '00

Hello snort-users ! I've got another interesting issue here: I set up syslog-ng on a solaris-2.6-box running together with the standard syslog. syslog-ng only forwards everything (/dev/log) to another loghost via tcp - this works fine. All messages are logged locally and on the remote loghost. Trying this under Linux 2.2.13, syslog and syslog-ng end up in some kind of race condition (messages are spread between them). Is there any way to get these two working at the same time like under solaris ? -- < Gero Krueger | DeTeCSM > < Tel. : +49-541-333-2488 | IVS Osnabrueck > < Fax : +49-541-333-2940 | Hannoversche Str. 6-8 > < mailto: krueger(a)obk.telekom.de | 49084 Osnabrueck >

1 0

syslog-ng 1.4.1
by Balazs Scheidler 20 Mar '00

20 Mar '00

Hi, I've released syslog-ng 1.4.1. This time I announce it to this list only, and if no bugs show up in two-three days, the announcement goes up to freshmeat. I've fixed a couple of bugs in this release: * fixed a filter evaluation bug (not in 'or' and 'and') * configuration file reading with syntax errors * pipe() cleanup This driver readds the requirement for GNU flex. I need a way to reinitialize lex buffers, and I know how to do that only with GNU flex (yyreinit(), patches to support other lex versions are welcome) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

3 2

syslog-ng on AIX 4.x
by Ohrberg, Mick 16 Mar '00

16 Mar '00

Dear syslog-ng users, Is there anyone out there who has successfully installed and used syslog-ng on an AIX machine? I use it in Solaris 2.6, and it works great! As a Solaris-user, I really don't know where to look for the syslog-equivalent in AIX. Syslog-ng compiles great under AIX, but using the logger doesn't give me the expected result... Anyone? Thanks in advance! -- Mick Öhrberg EMTS System Administrator, UMB (816)860-1064

1 0

sendmail with syslog-ng
by Simon Yang 15 Mar '00

15 Mar '00

Hi folks, I installed syslog-ng 1.3.14 under Solaris 2.6 and used the following config file source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination syslog { file("/var/tmp/syslog.trc"); program("/usr/lib/sendmail john(a)company.com"); }; log { source(local); destination(syslog); }; I expect that emails should only be sent to john(a)company.com when an error message occurs. With the current implementation of the syslog-ng, only one messages is sent out containing the whole syslog.trc that is defined in the config file when the syslog-ng is started. Obviously, something is wrong. Is this a feature or bug with syslog-ng or the config file was not configured correctly. Any help will be greatly appreciated.

1 0

Odd error
by Hamilton, Andrew Mr. 15 Mar '00

15 Mar '00

Hi, I'm relatively new to syslog-ng and have been working with it constantly over the last couple of weeks trying to get it to work with my systems. For the most part I have had no problems, or very few but now I am getting an odd error. I am running it on a Sun Solaris 5.6 and have run it on other systems identical to this system but I am getting this error: Error creating AF_INET socket (Error 0) Error initializing configuration, exiting. I've checked my config file and it doesn't appear to be messed up. Any ideas? Thanks Drew

2 1

RE: syslog-ng digest, Vol 1 (Cu)167 - 4 msgs
by Nick Hindley 10 Mar '00

10 Mar '00

This message has been automatically generated. I am out of the office from 6 March 2000 for approximately two weeks. To contact me before my return, please resend your message to nick.hindley(a)ukgateway.net

1 0

Small log entries are discarded in 1.4.0
by Jeffrey W. Baker 09 Mar '00

09 Mar '00

Hi there, I have found another serious bug in the 1.4.0 syslog-ng code. Actually the bug is in libol. The log is configured to read log entries from a named pipe, write them to a local file, and forward them to a remote machine which writes them to a file. The input testing program is writing log entries which are four bytes: three bytes of integers and a carraige return. The problem is that syslog-ng is throwing away most of these entries. It reads 1024 bytes from the input pipe. 1024 bytes is 256 log entries. It then takes 100 of these entries and puts them in the log queue. These 100 are logged properly, and then another 1024 bytes are read from the pipe. The remaining 156 log entries from the original read are simply overwritten. I believe the solution would be to write log entries into the queue until the input buffer is empty. Any other way will result in the loss of log entries. Perhaps I will have a patch for this later. Also, I found another small bug in src/sources.c. On line 128, memcpy is used to copy memory between overlapping regions. At least on Linux, memcpy should not be used to copy between overlapping regions. memmove() should be used instead. Cheers, Jeffrey

2 1