- syslog-ng - lists.balabit.hu

Standard TCP port for Syslog?
by Lowkrantz, Goran 06 Sep '99

06 Sep '99

Has there been any desision for a TCP syslog port, as 514 is taken? Cheers, GLZ --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

2 1

syslog-ng 1.1.32 on FreeBSD
by Lowkrantz, Goran 06 Sep '99

06 Sep '99

Hi, Built the 1.1.32 on FreeBSD 3.3-RC today and there are just two small things to make this a compleat joy. 1 - The configure script don't find thet FreeBSD should have #define HAVE_MODERN_UTMP 0. 2 - The following warnings are generated at the inclusion of /usr/include/arpa/inet.h in src/utils.c I have added the lines from the system header that generates the warning. In file included from utils.c:32: /usr/include/arpa/inet.h:89: warning: parameter has incomplete type unsigned long inet_lnaof __P((struct in_addr)); /usr/include/arpa/inet.h:92: warning: parameter has incomplete type unsigned long inet_netof __P((struct in_addr)); /usr/include/arpa/inet.h:96: warning: parameter has incomplete type char *inet_ntoa __P((struct in_addr)); Cheers, GLZ --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

2 1

Re: syslog-ng under OpenBSD
by Balazs Scheidler 02 Sep '99

02 Sep '99

> > > > Could you send me your config.log and config.h files? > > I sent them as separate e-mails with proper subject lines. Thanks. I've fixed these compilation problems. Will be available in the next release. > > > > > > also, I get these warnings: > > > > > > parameter list > > > /usr/include/arpa/inet.h:79: warning: parameter has incomplete type > > > /usr/include/arpa/inet.h:82: warning: parameter has incomplete type > > > /usr/include/arpa/inet.h:86: warning: parameter has incomplete type > > > > In which file? > > during this command, here: > gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.1.32/src -I. -O2 -Wall -I/usr/local/include/libol -c utils.c Fixed this one too. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

updated documentation
by Balazs Scheidler 01 Sep '99

01 Sep '99

Hi! I've updated the documentation on the webpage. It's not complete yet, but it's definitely more complete than it was previously. http://www.balabit.hu/products/syslog-ng/doc/book1.html -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

Remote loging and facility seperation of incoming logs.
by deant＠stsi.net 01 Sep '99

01 Sep '99

Salutations all, I am attempting to set up a network log server for our Debian and RedHat servers. I can cause the other boxen to send the information to the log server. The log server receives the packets. However, I am having some difficulty separating the inbound packets by box and routing them to different files by facility. Any assistance would be appreciated. ****************************************************** * <<<<<<<<<<<<<< SouthNet <> TeleComm >>>>>>>>>>>>>> * ****************************************************** * Man generally seeks wisdom * T. Dean Tate * * only after all other options * deant(a)stsi.net * * have been exhausted. * UNIX Administration * ******************************************************

2 3

regular expressions ...
by Josef Bergmann 01 Sep '99

01 Sep '99

Hi! I made some fine Deb-Pakets from libol 0.2.3 and syslog-ng 1.1.31 and installed it on a Debian 2.1 system. Everthing works/logs nicely :-) Now I want enable the "hashing-feature" and filter against a file with regex- terms but I found now proper info in the docs. How can configure this features? (I don't found "genh0" and "checkhash" as mentioned in the syslog-ng manpage). How can I realize a system which for example executes a script if a regex- target gets hit. The idea is to get a realtime logchecker which mails faults to the admin ... Thanks for help. bye Josef -- BERGMANN engineering & consulting http://bec.at/ 'While we liked developing Windows applications, we never inhaled.' - Philippe Kahn, 1992

2 5

configuration problem?
by The March Hare 31 Aug '99

31 Aug '99

I am having trouble getting syslog-ng to log anything besides its own startup and shutdown. I have used the following configuration file, which is very similar to the sample from the distribution: options { sync(0); time_reopen(10); log_fifo_size(100); }; source src { unix-stream("/var/run/log"); udp(); tcp(ip("127.0.0.1") port(1000) mac(allow) authentication(required) encry pt(allow)); tcp(); # sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination everything { file("/var/log/syslog-ng" compress(on) sync(0) log_fifo_size(10)); }; filter f_host1 { host("host1"); }; log { source(src); destination(everything); }; Is there anything obviously wrong here? -- Felicia ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I am not the poet of goodness only....I do not decline to be the poet of wickedness also. -Walt Whitman ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 2

Re: problems with syslogd-ng under openbsd
by Balazs Scheidler 31 Aug '99

31 Aug '99

On Tue, Aug 31, 1999 at 04:21:38PM -0400, Rex A. Roof wrote: > > I'm trying to use syslogd-ng under OpenBSD on a sparc machine. > > I get parse errors if I try and have a destination line like this: > > destination local { file/var/log/local/general; }; > > so, I changed them to look like this: > > destination local { file(/var/log/local/general); }; > > and, I don't get parse errors anymore, but, I don't know if it's working > or not. I can't seem to get any log {}; directives to work, > this is just one of the ones I have, but I get parse errors on it: > > log { source src; destination default; }; log { source(src); destination(default); }; I'll try to update, and complete the documentation ASAP. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: logging to another machine
by Balazs Scheidler 19 Aug '99

19 Aug '99

Hi, On Mon, Aug 16, 1999 at 11:35:06AM -0400, Jamie Orzechowski wrote: > Hi There ... I have your AWSOME syslog-ng installed and just have a few > questions > > 1) does it log TCP/UDP ?? .. so I can log port scans and attacks on my > machine ... syslog-ng listens on an UDP or TCP socket to get log messages from the network. It's not a portscan detection tool. For portscan detection you could use tcplogd, or ippl. > 2) I need a config line to send all the logs to another host (I have abackup > logging host) It's not a problem, but the needed source declaration depends on the platform you are trying to run syslog-ng. On a Linux box all local messages are sent to a UNIX SOCK_STREAM socket named /dev/log. On other operating systems, this can be something else. So to send all messages to another host from a Linux system use: source src { unix-stream("/dev/log"); internal(); }; destination all { udp("xxx.xxx.xxx.xxx"); }; log { source src; destination all; }; Substitute the IP address of your loghost to xxx.xxx.xxx.xxx. You could use a hostname as well, but syslog-ng has to be able to resolv this name upon startup. (e.g. you have to include it in your /etc/hosts file) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog-ng
by Stefan Monnier 19 Aug '99

19 Aug '99

Why is a `source' necessary in a `log' statement ? the example configuration in http://www.balabit.hu/products/syslog-ng/syslog-ng-1.1.22.html clearly shows that this has the nasty tendency to be verbose and redundant. Why not allow the set of sources to be empty in which case the source is the same as the last `log' statement (for example) ? Also having the words `source' `filter' and `destination' appear all the time seems too verbose. They don't seem to be necessary. I'd love to be able to say destination console { file /dev/tty11; }; log { ; facility(ppp); console } where the redundant keywords have been dropped, the default source is used and the filter appears directly in the `log' command. Apart from that, I have some trouble checking out the CVS repository: ~/install-1% cvs -d :pserver:cvs@cvs.balabit.hu:/usr/local/cvs checkout -d syslog-ng syslog-ng libol cvs server: Updating syslog-ng/syslog-ng cvs server: failed to create lock directory in repository `/usr/local/cvs/syslog-ng': Permission denied cvs server: failed to obtain dir lock in repository `/usr/local/cvs/syslog-ng' cvs [server aborted]: read lock failed - giving up ~/install-1% [ the login went though flawlessly ] Stefan "very happy about syslog-ng despite the present gripes" PS: I wish syslog-ng were a perl script so that the config file could use the full perl power (and you'd have saved all the parsing trouble: just say "do '/etc/syslogng.conf';" and that's it).

2 1