RE: [syslog-ng]relay host address changes source hosts ip in mess age

25 Mar 2004

      Greetings,

  The problem is quite simple: you have set the option "keep_hostname(no)"
on both
servers, which implies that syslog-ng will not trust the hostname in the
packet
payload, that is, the hostname by which the original server refers to
itself, and
will use reverse IP resolution to set it.

  In this scenario, this means that central server will see packets coming
from
POP-A and will not use the hostname in the packet but the reverse IP
resolution
of the packet source IP (or the IP by itself if it can not resolve it).

  You should remove the option from the central server configuration.

  Regards,

Raúl Pedroche 
COLT Telecom 
Email: raul.pedroche@colt-telecom.es 
www.colt.net

-----Original Message-----
From: Bill [mailto:syslog-ng@gardrail.com] 
Sent: Wednesday, March 24, 2004 9:28 PM
To: syslog-ng@lists.balabit.hu
Subject: [syslog-ng]relay host address changes source hosts ip in message

Greetings, 

I've been tasked to setup a syslog relay network from various pops to a 
centralized syslog server for insert into a database. 

The problem I'm running into is at the various pops, for example, lets call 
the first one POP-A.  At POP-A, I have syslog-ng version 1.6.0rc4 setup to 
receive both udp and tcp syslog connections.  It in turn, relays the syslog 
messages to the central server.  When I look at the incoming data on the 
centralized server, the incoming data shows that the source host information

is being re-written with the relay hosts ip. 

System stats are: 

Solaris 8 intel 
Syslog-ng 1.6.0rc4 

POP-A configuration file follows: 

options { 
       long_hostnames(off); 
       use_dns(no); 
       use_fqdn(no); 
       dns_cache(no); 
       check_hostname(yes); 
       keep_hostname(no); 
       chain_hostnames(no); 
       # On Solaris, log(3) truncates at 1024 chars 
       log_msg_size(8192); 
       # buffer just a little for performance 
       sync(0); 
       # memory is cheap, buffer messages unable to write (like to loghost) 
       log_fifo_size(10240); 
       # The time to wait before a dead connection is reestablished
(seconds) 
       time_reopen(10); 
       create_dirs(yes); 
       owner("root"); 
       group("other"); 
       perm(0600); 
       use_time_recvd(yes); 
}; 

source src { 
       # This is the source of syslog. 
       # The default protocal port is 512 
       udp(); 
       tcp(max-connections(1024)); 

}; 
source l_src { 
       # This is the source of syslog. 
       # This is internal messages on the local server 
       internal(); 
       sun-streams("/dev/log"); 
       # This is internal messages on the local server 
}; 
destination syslogfile { 
      file( 
               "/var/log/syslogng/$HOST.log" 
       ); 
       udp("1.1.1.1");             
}; 
filter priorityfilter { 
       priority(debug,info,notice,warning,err,crit,alert,emerg); 
}; 
############################################################### 
log { 
       source(src); 
       source(l_src); 
       filter(priorityfilter); 
       destination(syslogfile); 
}; 

------------------------------------------------------ 
------------------------------------------------------ 
------------------------------------------------------ 
Server syslog-ng configuration follows: 
------------------------------------------------------ 
------------------------------------------------------ 
------------------------------------------------------ 

options { 
       long_hostnames(yes); 
       use_dns(no); 
       use_fqdn(no); 
       dns_cache(no); 
#       dns_cache_size(500); 
#       dns_cache_expire(3600); 
#       dns_cache_expire_failed(3600); 
#       check_hostname(yes); 
       keep_hostname(no); 
       chain_hostnames(no); 
       # On Solaris, log(3) truncates at 1024 chars 
       log_msg_size(8192); 
       # buffer just a little for performance 
       sync(0); 
       # memory is cheap, buffer messages unable to write (like to loghost) 
       log_fifo_size(10240); 
       # The time to wait before a dead connection is reestablished
(seconds) 
       time_reopen(10); 
       create_dirs(yes); 
       owner("root"); 
       group("other"); 
       perm(0640); 
       use_time_recvd(yes); 
}; 
############################################################### 
source src { 
       # This is the source of syslog. 
       # The default protocal port is 512 
       udp(); 
       # This is internal messages on the local server 
       internal(); 
}; 

source l_src { 
       sun-stream("/dev/log" door("/etc/.syslog_door")); 
       internal(); 
}; 

destination syslogfile { 
      file( 
               "/var/log/syslogng/$YEAR_$MONTH_$DAY_$HOST.log"       
       ); 

}; 

destination program1 { 
       program( 
               /path/to/uber/syslog/program.pl 
               template 
("¡$HOST¡$FACILITY¡$PRIORITY¡$LEVEL¡$TAG¡$FULLDATE¡$PROGRAM¡$MSG\n") 
               template-escape(yes) 
       ); 
}; 

filter priorityfilter { 
       priority(debug,info,notice,warning,err,crit,alert,emerg); 
}; 
filter dropsyslog { 
       not match("syslog-ng*"); 
}; 
############################################################### 
log { 
       source(src); 
       filter(dropsyslog); 
       filter(priorityfilter); 
       destination(program1); 
       destination(syslogfile); 
}; 
############################################################### 
log { 
       source(l_src); 
       destination(program1); 
       destination(syslogfile); 
}; 

_______________________________________________
syslog-ng maillist  -  syslog-ng@lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

RE: [syslog-ng]relay host address changes source hosts ip in mess age

"Pedroche, Raúl"