Problem to Get UDP Packets - Syslog-ng
Hello Everyone, I installed syslog-ng on a new machine, however in initial tests, there was no collection of UDP packages by syslog-ng. Here are some points I checked: sudo netstat -plunt | grep -e PID -e syslog Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:601 0.0.0.0:* LISTEN 16169/syslog-ng udp 0 0 10.96.145.42:514 0.0.0.0:* 16169/syslog-ng netstat -anu | grep 514 udp 0 0 10.96.145.42:514 0.0.0.0:* [cgnat@mgalnxa01 etc]$ sudo systemctl status syslog-ng -l ● syslog-ng.service - System Logger Daemon Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2020-03-25 12:38:08 -03; 5min ago Process: 114207 ExecReload=/bin/kill -HUP $MAINPID (code=exited, status=0/SUCCESS) Main PID: 16169 (syslog-ng) CGroup: /system.slice/syslog-ng.service └─16169 /opt/syslog-ng/libexec/syslog-ng -F --enable-core Mar 25 12:38:08 mgalnxa01 systemd[1]: Starting System Logger Daemon... Here is an example of the package received via tcpdump, but it was not captured by syslog-ng: 10:46:13.529331 IP (tos 0x20, ttl 251, id 33055, offset 0, flags [none], proto UDP (17), length 243) 10.96.145.98.syslog > mgalnxa01.9514: [udp sum ok] SYSLOG, length: 215 Facility user (1), Severity info (6) Msg: Mar 24 13:46:13 2020 RTCGNMGA0103 RT_NAT: RT_SRC_NAT_PBA_ALLOC: Subscriber 100.64.1.6 used/maximum [2/2] blocks, allocates port block [47104-47167] from 177.51.116.146 in source pool PUBLIC-NAT-POOL-1 lsys_id: 0 0x0000: 3c31 343e 4d61 7220 3234 2031 333a 3436 0x0010: 3a31 3320 3230 3230 2052 5443 474e 4d47 0x0020: 4130 3130 3320 5254 5f4e 4154 3a20 5254 0x0030: 5f53 5243 5f4e 4154 5f50 4241 5f41 4c4c 0x0040: 4f43 3a20 5375 6273 6372 6962 6572 2031 0x0050: 3030 2e36 342e 312e 3620 7573 6564 2f6d 0x0060: 6178 696d 756d 205b 322f 325d 2062 6c6f 0x0070: 636b 732c 2061 6c6c 6f63 6174 6573 2070 0x0080: 6f72 7420 626c 6f63 6b20 5b34 3731 3034 0x0090: 2d34 3731 3637 5d20 6672 6f6d 2031 3737 0x00a0: 2e35 312e 3131 362e 3134 3620 696e 2073 0x00b0: 6f75 7263 6520 706f 6f6c 2050 5542 4c49 0x00c0: 432d 4e41 542d 504f 4f4c 2d31 206c 7379 0x00d0: 735f 6964 3a20 30 What I need to analyze / verify, for syslog-ng will capture this type of package and convert it to a file. Atenciosamente, WILLIAM LUIZ R V SILVA Mediation Ericsson Rua Maria Preste Maia, 300 02879-130, Brazil Phone +55 11 2760-3785 Mobile +55 11 97979-9886 wsilva_ericsson@timbrasil.com.br<mailto:wsilva_ericsson@timbrasil.com.br> www.ericsson.com<http://www.ericsson.com/> [Descricao: Descricao: Ericsson]<http://www.ericsson.com/> Esta mensagem, incluindo seus anexos, pode conter informacoes privilegiadas e/ou de carater confidencial, nao podendo ser retransmitida sem autorizacao do remetente. Se voce nao e o destinatario ou pessoa autorizada para recebe-la, informamos que o seu uso, divulgacao, copia ou arquivamento sao proibidos. Portanto, se voce recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteudo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto
Hello, I can not remember a case from the recent past, where "can not receive UDP packets" was not an environment problem. Please check your: - firewall settings - SELinux options - Is syslog-ng configured to bind to the right interface Note: to rule out syslog-ng from the debugging process you can start "netcat" in listening mode, where it will print out EVERY message it receives. If you can not see any output from netcat, than you UDP packets do not reach the application level. IF the problem still exist, please share more details about your environment. (Distributions, version numbers, etc.) Best regards, Laci ________________________________________ From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of William Luiz Ribeiro Vasconcelos Da Silva <wsilva_ericsson@timbrasil.com.br> Sent: Wednesday, March 25, 2020 16:48 To: Syslog-ng users' and developers' mailing list Cc: Hebert Silva Vasconcelos; Ana Carolina De Bastos Souza; HEBERT VASCONCELOS S (hebert.s.vasconcelos@ericsson.com) Subject: [syslog-ng] Problem to Get UDP Packets - Syslog-ng CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Hello Everyone, I installed syslog-ng on a new machine, however in initial tests, there was no collection of UDP packages by syslog-ng. Here are some points I checked: sudo netstat -plunt | grep -e PID -e syslog Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:601 0.0.0.0:* LISTEN 16169/syslog-ng udp 0 0 10.96.145.42:514 0.0.0.0:* 16169/syslog-ng netstat -anu | grep 514 udp 0 0 10.96.145.42:514 0.0.0.0:* [cgnat@mgalnxa01 etc]$ sudo systemctl status syslog-ng -l ● syslog-ng.service - System Logger Daemon Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2020-03-25 12:38:08 -03; 5min ago Process: 114207 ExecReload=/bin/kill -HUP $MAINPID (code=exited, status=0/SUCCESS) Main PID: 16169 (syslog-ng) CGroup: /system.slice/syslog-ng.service └─16169 /opt/syslog-ng/libexec/syslog-ng -F --enable-core Mar 25 12:38:08 mgalnxa01 systemd[1]: Starting System Logger Daemon... Here is an example of the package received via tcpdump, but it was not captured by syslog-ng: 10:46:13.529331 IP (tos 0x20, ttl 251, id 33055, offset 0, flags [none], proto UDP (17), length 243) 10.96.145.98.syslog > mgalnxa01.9514: [udp sum ok] SYSLOG, length: 215 Facility user (1), Severity info (6) Msg: Mar 24 13:46:13 2020 RTCGNMGA0103 RT_NAT: RT_SRC_NAT_PBA_ALLOC: Subscriber 100.64.1.6 used/maximum [2/2] blocks, allocates port block [47104-47167] from 177.51.116.146 in source pool PUBLIC-NAT-POOL-1 lsys_id: 0 0x0000: 3c31 343e 4d61 7220 3234 2031 333a 3436 0x0010: 3a31 3320 3230 3230 2052 5443 474e 4d47 0x0020: 4130 3130 3320 5254 5f4e 4154 3a20 5254 0x0030: 5f53 5243 5f4e 4154 5f50 4241 5f41 4c4c 0x0040: 4f43 3a20 5375 6273 6372 6962 6572 2031 0x0050: 3030 2e36 342e 312e 3620 7573 6564 2f6d 0x0060: 6178 696d 756d 205b 322f 325d 2062 6c6f 0x0070: 636b 732c 2061 6c6c 6f63 6174 6573 2070 0x0080: 6f72 7420 626c 6f63 6b20 5b34 3731 3034 0x0090: 2d34 3731 3637 5d20 6672 6f6d 2031 3737 0x00a0: 2e35 312e 3131 362e 3134 3620 696e 2073 0x00b0: 6f75 7263 6520 706f 6f6c 2050 5542 4c49 0x00c0: 432d 4e41 542d 504f 4f4c 2d31 206c 7379 0x00d0: 735f 6964 3a20 30 What I need to analyze / verify, for syslog-ng will capture this type of package and convert it to a file. Atenciosamente, WILLIAM LUIZ R V SILVA Mediation Ericsson Rua Maria Preste Maia, 300 02879-130, Brazil Phone +55 11 2760-3785 Mobile +55 11 97979-9886 wsilva_ericsson@timbrasil.com.br<mailto:wsilva_ericsson@timbrasil.com.br> www.ericsson.com<https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.ericsson.com%2F&data=02%7C01%7CLaszlo.Szemere%40oneidentity.com%7Cd57a1cb4bc9245b232ca08d7d0d4093e%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637207481434233380&sdata=DOfZY2QTEjBphAB170lKFbR4BXZsaYwINm0UG72oPYs%3D&reserved=0> [Descrição: Descrição: Ericsson]<https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.ericsson.com%2F&data=02%7C01%7CLaszlo.Szemere%40oneidentity.com%7Cd57a1cb4bc9245b232ca08d7d0d4093e%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637207481434233380&sdata=DOfZY2QTEjBphAB170lKFbR4BXZsaYwINm0UG72oPYs%3D&reserved=0> Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto
Hello again, I believe that firewall settings, is not a problem because We can see the packet using tcpdump But, what can I check this other items: - SELinux options - Is syslog-ng configured to bind to the right interface And what is the command to use: netcat to listening the 514 port Tks, Atenciosamente, WILLIAM LUIZ R V SILVA Mediation Ericsson Mobile +55 11 97979-9886 www.ericsson.com -----Mensagem original----- De: syslog-ng <syslog-ng-bounces@lists.balabit.hu> Em nome de Laszlo Szemere (lszemere) Enviada em: quarta-feira, 25 de março de 2020 13:00 Para: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Cc: HEBERT VASCONCELOS S (hebert.s.vasconcelos@ericsson.com) <hebert.s.vasconcelos@ericsson.com>; Hebert Silva Vasconcelos <hvasconcelos_ericsson@timbrasil.com.br>; Ana Carolina De Bastos Souza <absouza_ericsson@timbrasil.com.br> Assunto: Re: [syslog-ng] Problem to Get UDP Packets - Syslog-ng Hello, I can not remember a case from the recent past, where "can not receive UDP packets" was not an environment problem. Please check your: - firewall settings - SELinux options - Is syslog-ng configured to bind to the right interface Note: to rule out syslog-ng from the debugging process you can start "netcat" in listening mode, where it will print out EVERY message it receives. If you can not see any output from netcat, than you UDP packets do not reach the application level. IF the problem still exist, please share more details about your environment. (Distributions, version numbers, etc.) Best regards, Laci ________________________________________ From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of William Luiz Ribeiro Vasconcelos Da Silva <wsilva_ericsson@timbrasil.com.br> Sent: Wednesday, March 25, 2020 16:48 To: Syslog-ng users' and developers' mailing list Cc: Hebert Silva Vasconcelos; Ana Carolina De Bastos Souza; HEBERT VASCONCELOS S (hebert.s.vasconcelos@ericsson.com) Subject: [syslog-ng] Problem to Get UDP Packets - Syslog-ng CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Hello Everyone, I installed syslog-ng on a new machine, however in initial tests, there was no collection of UDP packages by syslog-ng. Here are some points I checked: sudo netstat -plunt | grep -e PID -e syslog Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:601 0.0.0.0:* LISTEN 16169/syslog-ng udp 0 0 10.96.145.42:514 0.0.0.0:* 16169/syslog-ng netstat -anu | grep 514 udp 0 0 10.96.145.42:514 0.0.0.0:* [cgnat@mgalnxa01 etc]$ sudo systemctl status syslog-ng -l ● syslog-ng.service - System Logger Daemon Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2020-03-25 12:38:08 -03; 5min ago Process: 114207 ExecReload=/bin/kill -HUP $MAINPID (code=exited, status=0/SUCCESS) Main PID: 16169 (syslog-ng) CGroup: /system.slice/syslog-ng.service └─16169 /opt/syslog-ng/libexec/syslog-ng -F --enable-core Mar 25 12:38:08 mgalnxa01 systemd[1]: Starting System Logger Daemon... Here is an example of the package received via tcpdump, but it was not captured by syslog-ng: 10:46:13.529331 IP (tos 0x20, ttl 251, id 33055, offset 0, flags [none], proto UDP (17), length 243) 10.96.145.98.syslog > mgalnxa01.9514: [udp sum ok] SYSLOG, length: 215 Facility user (1), Severity info (6) Msg: Mar 24 13:46:13 2020 RTCGNMGA0103 RT_NAT: RT_SRC_NAT_PBA_ALLOC: Subscriber 100.64.1.6 used/maximum [2/2] blocks, allocates port block [47104-47167] from 177.51.116.146 in source pool PUBLIC-NAT-POOL-1 lsys_id: 0 0x0000: 3c31 343e 4d61 7220 3234 2031 333a 3436 0x0010: 3a31 3320 3230 3230 2052 5443 474e 4d47 0x0020: 4130 3130 3320 5254 5f4e 4154 3a20 5254 0x0030: 5f53 5243 5f4e 4154 5f50 4241 5f41 4c4c 0x0040: 4f43 3a20 5375 6273 6372 6962 6572 2031 0x0050: 3030 2e36 342e 312e 3620 7573 6564 2f6d 0x0060: 6178 696d 756d 205b 322f 325d 2062 6c6f 0x0070: 636b 732c 2061 6c6c 6f63 6174 6573 2070 0x0080: 6f72 7420 626c 6f63 6b20 5b34 3731 3034 0x0090: 2d34 3731 3637 5d20 6672 6f6d 2031 3737 0x00a0: 2e35 312e 3131 362e 3134 3620 696e 2073 0x00b0: 6f75 7263 6520 706f 6f6c 2050 5542 4c49 0x00c0: 432d 4e41 542d 504f 4f4c 2d31 206c 7379 0x00d0: 735f 6964 3a20 30 What I need to analyze / verify, for syslog-ng will capture this type of package and convert it to a file. Atenciosamente, WILLIAM LUIZ R V SILVA Mediation Ericsson Rua Maria Preste Maia, 300 02879-130, Brazil Phone +55 11 2760-3785 Mobile +55 11 97979-9886 wsilva_ericsson@timbrasil.com.br<mailto:wsilva_ericsson@timbrasil.com.br> https://nam01.safelinks.protection.outlook.com/?url=www.ericsson.com&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Cb2d19eb73e334cb1031808d7d0d5903f%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207487979138039&sdata=rVc%2FGQrqH5LdeDy7qOIsHoqozJ39ISFg%2Fc92BnEs%2Bu4%3D&reserved=0<https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.ericsson.com%2F&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Cb2d19eb73e334cb1031808d7d0d5903f%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207487979138039&sdata=xlPd3OQBIPTDpY%2BRCRSd3C%2B1pwsUj6XArHl%2FZYe%2BIks%3D&reserved=0> [Descrição: Descrição: Ericsson]<https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.ericsson.com%2F&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Cb2d19eb73e334cb1031808d7d0d5903f%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207487979138039&sdata=xlPd3OQBIPTDpY%2BRCRSd3C%2B1pwsUj6XArHl%2FZYe%2BIks%3D&reserved=0> Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto
Hello, "I believe that firewall settings, is not a problem because We can see the packet using tcpdump" tcpdump will capture EVERYTHING on the interface, and do not mean that your packets will reach your applications. "the right interface" From your netstat output I can see that syslog-ng is binding to "10.96.145.42". Does your UDP packets arrive on that interface? "netcat command" (note: this is from the man page) -l listening -u udp -k keep netcat running all together: "netcat -lku 514" Br, László Szemere ________________________________________ From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of William Luiz Ribeiro Vasconcelos Da Silva <wsilva_ericsson@timbrasil.com.br> Sent: Wednesday, March 25, 2020 17:36 To: Syslog-ng users' and developers' mailing list Cc: Ana Carolina De Bastos Souza; HEBERT VASCONCELOS S (hebert.s.vasconcelos@ericsson.com); Hebert Silva Vasconcelos Subject: [syslog-ng] RES: Problem to Get UDP Packets - Syslog-ng CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Hello again, I believe that firewall settings, is not a problem because We can see the packet using tcpdump But, what can I check this other items: - SELinux options - Is syslog-ng configured to bind to the right interface And what is the command to use: netcat to listening the 514 port Tks, Atenciosamente, WILLIAM LUIZ R V SILVA Mediation Ericsson Mobile +55 11 97979-9886 https://nam05.safelinks.protection.outlook.com/?url=www.ericsson.com&data=02%7C01%7CLaszlo.Szemere%40oneidentity.com%7C668c8300948449a44e9808d7d0dab3e6%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637207510045415029&sdata=tvvTYaUFRGubRYE%2FsmBdNWAP9SdC8b4rUTAxlca1Jow%3D&reserved=0 -----Mensagem original----- De: syslog-ng <syslog-ng-bounces@lists.balabit.hu> Em nome de Laszlo Szemere (lszemere) Enviada em: quarta-feira, 25 de março de 2020 13:00 Para: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Cc: HEBERT VASCONCELOS S (hebert.s.vasconcelos@ericsson.com) <hebert.s.vasconcelos@ericsson.com>; Hebert Silva Vasconcelos <hvasconcelos_ericsson@timbrasil.com.br>; Ana Carolina De Bastos Souza <absouza_ericsson@timbrasil.com.br> Assunto: Re: [syslog-ng] Problem to Get UDP Packets - Syslog-ng Hello, I can not remember a case from the recent past, where "can not receive UDP packets" was not an environment problem. Please check your: - firewall settings - SELinux options - Is syslog-ng configured to bind to the right interface Note: to rule out syslog-ng from the debugging process you can start "netcat" in listening mode, where it will print out EVERY message it receives. If you can not see any output from netcat, than you UDP packets do not reach the application level. IF the problem still exist, please share more details about your environment. (Distributions, version numbers, etc.) Best regards, Laci ________________________________________ From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of William Luiz Ribeiro Vasconcelos Da Silva <wsilva_ericsson@timbrasil.com.br> Sent: Wednesday, March 25, 2020 16:48 To: Syslog-ng users' and developers' mailing list Cc: Hebert Silva Vasconcelos; Ana Carolina De Bastos Souza; HEBERT VASCONCELOS S (hebert.s.vasconcelos@ericsson.com) Subject: [syslog-ng] Problem to Get UDP Packets - Syslog-ng CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Hello Everyone, I installed syslog-ng on a new machine, however in initial tests, there was no collection of UDP packages by syslog-ng. Here are some points I checked: sudo netstat -plunt | grep -e PID -e syslog Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:601 0.0.0.0:* LISTEN 16169/syslog-ng udp 0 0 10.96.145.42:514 0.0.0.0:* 16169/syslog-ng netstat -anu | grep 514 udp 0 0 10.96.145.42:514 0.0.0.0:* [cgnat@mgalnxa01 etc]$ sudo systemctl status syslog-ng -l ● syslog-ng.service - System Logger Daemon Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2020-03-25 12:38:08 -03; 5min ago Process: 114207 ExecReload=/bin/kill -HUP $MAINPID (code=exited, status=0/SUCCESS) Main PID: 16169 (syslog-ng) CGroup: /system.slice/syslog-ng.service └─16169 /opt/syslog-ng/libexec/syslog-ng -F --enable-core Mar 25 12:38:08 mgalnxa01 systemd[1]: Starting System Logger Daemon... Here is an example of the package received via tcpdump, but it was not captured by syslog-ng: 10:46:13.529331 IP (tos 0x20, ttl 251, id 33055, offset 0, flags [none], proto UDP (17), length 243) 10.96.145.98.syslog > mgalnxa01.9514: [udp sum ok] SYSLOG, length: 215 Facility user (1), Severity info (6) Msg: Mar 24 13:46:13 2020 RTCGNMGA0103 RT_NAT: RT_SRC_NAT_PBA_ALLOC: Subscriber 100.64.1.6 used/maximum [2/2] blocks, allocates port block [47104-47167] from 177.51.116.146 in source pool PUBLIC-NAT-POOL-1 lsys_id: 0 0x0000: 3c31 343e 4d61 7220 3234 2031 333a 3436 0x0010: 3a31 3320 3230 3230 2052 5443 474e 4d47 0x0020: 4130 3130 3320 5254 5f4e 4154 3a20 5254 0x0030: 5f53 5243 5f4e 4154 5f50 4241 5f41 4c4c 0x0040: 4f43 3a20 5375 6273 6372 6962 6572 2031 0x0050: 3030 2e36 342e 312e 3620 7573 6564 2f6d 0x0060: 6178 696d 756d 205b 322f 325d 2062 6c6f 0x0070: 636b 732c 2061 6c6c 6f63 6174 6573 2070 0x0080: 6f72 7420 626c 6f63 6b20 5b34 3731 3034 0x0090: 2d34 3731 3637 5d20 6672 6f6d 2031 3737 0x00a0: 2e35 312e 3131 362e 3134 3620 696e 2073 0x00b0: 6f75 7263 6520 706f 6f6c 2050 5542 4c49 0x00c0: 432d 4e41 542d 504f 4f4c 2d31 206c 7379 0x00d0: 735f 6964 3a20 30 What I need to analyze / verify, for syslog-ng will capture this type of package and convert it to a file. Atenciosamente, WILLIAM LUIZ R V SILVA Mediation Ericsson Rua Maria Preste Maia, 300 02879-130, Brazil Phone +55 11 2760-3785 Mobile +55 11 97979-9886 wsilva_ericsson@timbrasil.com.br<mailto:wsilva_ericsson@timbrasil.com.br> https://nam05.safelinks.protection.outlook.com/?url=www.ericsson.com&data=02%7C01%7CLaszlo.Szemere%40oneidentity.com%7C668c8300948449a44e9808d7d0dab3e6%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637207510045415029&sdata=tvvTYaUFRGubRYE%2FsmBdNWAP9SdC8b4rUTAxlca1Jow%3D&reserved=0<https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.ericsson.com%2F&data=02%7C01%7CLaszlo.Szemere%40oneidentity.com%7C668c8300948449a44e9808d7d0dab3e6%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637207510045415029&sdata=E0MchEqC7i2vX5q7KH3blGEJpX20p9nNIAFWzBXaDkw%3D&reserved=0> [Descrição: Descrição: Ericsson]<https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.ericsson.com%2F&data=02%7C01%7CLaszlo.Szemere%40oneidentity.com%7C668c8300948449a44e9808d7d0dab3e6%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637207510045415029&sdata=E0MchEqC7i2vX5q7KH3blGEJpX20p9nNIAFWzBXaDkw%3D&reserved=0> Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto ______________________________________________________________________________ Member info: https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7CLaszlo.Szemere%40oneidentity.com%7C668c8300948449a44e9808d7d0dab3e6%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637207510045415029&sdata=%2FSHwF2plR8N886bOTWGJ%2FdivNMUCkHw8vgv97WeS%2B%2B0%3D&reserved=0 Documentation: https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7CLaszlo.Szemere%40oneidentity.com%7C668c8300948449a44e9808d7d0dab3e6%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637207510045415029&sdata=U%2BBvgdj49QcAuWNeD4c4C5ifNdzASpUOvjliEbe5sGM%3D&reserved=0 FAQ: https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7CLaszlo.Szemere%40oneidentity.com%7C668c8300948449a44e9808d7d0dab3e6%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637207510045424975&sdata=VnFnf%2FuSzyWGkPs%2F88lh1Xh1mtpKKxHVUE53myWDdmE%3D&reserved=0
I still understand that it is not a firewall, because the machine that sends the packets is on the same network as my machine: 10.96.145.98> 10.96.145.42 Yes, I am receiving the packets on the network interface where the IP "10.96.145.42" is allocated, in my case eth1. Tks, Atenciosamente, WILLIAM LUIZ R V SILVA Mediation Ericsson Mobile +55 11 97979-9886 wsilva_ericsson@timbrasil.com.br www.ericsson.com -----Mensagem original----- De: syslog-ng <syslog-ng-bounces@lists.balabit.hu> Em nome de Laszlo Szemere (lszemere) Enviada em: quarta-feira, 25 de março de 2020 14:39 Para: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Cc: Hebert Silva Vasconcelos <hvasconcelos_ericsson@timbrasil.com.br>; Ana Carolina De Bastos Souza <absouza_ericsson@timbrasil.com.br>; HEBERT VASCONCELOS S (hebert.s.vasconcelos@ericsson.com) <hebert.s.vasconcelos@ericsson.com> Assunto: Re: [syslog-ng] Problem to Get UDP Packets - Syslog-ng Hello, "I believe that firewall settings, is not a problem because We can see the packet using tcpdump" tcpdump will capture EVERYTHING on the interface, and do not mean that your packets will reach your applications. "the right interface" From your netstat output I can see that syslog-ng is binding to "10.96.145.42". Does your UDP packets arrive on that interface? "netcat command" (note: this is from the man page) -l listening -u udp -k keep netcat running all together: "netcat -lku 514" Br, László Szemere ________________________________________ From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of William Luiz Ribeiro Vasconcelos Da Silva <wsilva_ericsson@timbrasil.com.br> Sent: Wednesday, March 25, 2020 17:36 To: Syslog-ng users' and developers' mailing list Cc: Ana Carolina De Bastos Souza; HEBERT VASCONCELOS S (hebert.s.vasconcelos@ericsson.com); Hebert Silva Vasconcelos Subject: [syslog-ng] RES: Problem to Get UDP Packets - Syslog-ng CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Hello again, I believe that firewall settings, is not a problem because We can see the packet using tcpdump But, what can I check this other items: - SELinux options - Is syslog-ng configured to bind to the right interface And what is the command to use: netcat to listening the 514 port Tks, Atenciosamente, WILLIAM LUIZ R V SILVA Mediation Ericsson Mobile +55 11 97979-9886 https://nam01.safelinks.protection.outlook.com/?url=www.ericsson.com&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Ce514eb6ec0c34b33ea7608d7d0e37b78%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207547759767084&sdata=nEQ%2BREZ8E933jkGNUBZiSKTj0Vfj1%2ByLgSjhOT7LFwg%3D&reserved=0 -----Mensagem original----- De: syslog-ng <syslog-ng-bounces@lists.balabit.hu> Em nome de Laszlo Szemere (lszemere) Enviada em: quarta-feira, 25 de março de 2020 13:00 Para: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Cc: HEBERT VASCONCELOS S (hebert.s.vasconcelos@ericsson.com) <hebert.s.vasconcelos@ericsson.com>; Hebert Silva Vasconcelos <hvasconcelos_ericsson@timbrasil.com.br>; Ana Carolina De Bastos Souza <absouza_ericsson@timbrasil.com.br> Assunto: Re: [syslog-ng] Problem to Get UDP Packets - Syslog-ng Hello, I can not remember a case from the recent past, where "can not receive UDP packets" was not an environment problem. Please check your: - firewall settings - SELinux options - Is syslog-ng configured to bind to the right interface Note: to rule out syslog-ng from the debugging process you can start "netcat" in listening mode, where it will print out EVERY message it receives. If you can not see any output from netcat, than you UDP packets do not reach the application level. IF the problem still exist, please share more details about your environment. (Distributions, version numbers, etc.) Best regards, Laci ________________________________________ From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of William Luiz Ribeiro Vasconcelos Da Silva <wsilva_ericsson@timbrasil.com.br> Sent: Wednesday, March 25, 2020 16:48 To: Syslog-ng users' and developers' mailing list Cc: Hebert Silva Vasconcelos; Ana Carolina De Bastos Souza; HEBERT VASCONCELOS S (hebert.s.vasconcelos@ericsson.com) Subject: [syslog-ng] Problem to Get UDP Packets - Syslog-ng CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Hello Everyone, I installed syslog-ng on a new machine, however in initial tests, there was no collection of UDP packages by syslog-ng. Here are some points I checked: sudo netstat -plunt | grep -e PID -e syslog Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:601 0.0.0.0:* LISTEN 16169/syslog-ng udp 0 0 10.96.145.42:514 0.0.0.0:* 16169/syslog-ng netstat -anu | grep 514 udp 0 0 10.96.145.42:514 0.0.0.0:* [cgnat@mgalnxa01 etc]$ sudo systemctl status syslog-ng -l ● syslog-ng.service - System Logger Daemon Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2020-03-25 12:38:08 -03; 5min ago Process: 114207 ExecReload=/bin/kill -HUP $MAINPID (code=exited, status=0/SUCCESS) Main PID: 16169 (syslog-ng) CGroup: /system.slice/syslog-ng.service └─16169 /opt/syslog-ng/libexec/syslog-ng -F --enable-core Mar 25 12:38:08 mgalnxa01 systemd[1]: Starting System Logger Daemon... Here is an example of the package received via tcpdump, but it was not captured by syslog-ng: 10:46:13.529331 IP (tos 0x20, ttl 251, id 33055, offset 0, flags [none], proto UDP (17), length 243) 10.96.145.98.syslog > mgalnxa01.9514: [udp sum ok] SYSLOG, length: 215 Facility user (1), Severity info (6) Msg: Mar 24 13:46:13 2020 RTCGNMGA0103 RT_NAT: RT_SRC_NAT_PBA_ALLOC: Subscriber 100.64.1.6 used/maximum [2/2] blocks, allocates port block [47104-47167] from 177.51.116.146 in source pool PUBLIC-NAT-POOL-1 lsys_id: 0 0x0000: 3c31 343e 4d61 7220 3234 2031 333a 3436 0x0010: 3a31 3320 3230 3230 2052 5443 474e 4d47 0x0020: 4130 3130 3320 5254 5f4e 4154 3a20 5254 0x0030: 5f53 5243 5f4e 4154 5f50 4241 5f41 4c4c 0x0040: 4f43 3a20 5375 6273 6372 6962 6572 2031 0x0050: 3030 2e36 342e 312e 3620 7573 6564 2f6d 0x0060: 6178 696d 756d 205b 322f 325d 2062 6c6f 0x0070: 636b 732c 2061 6c6c 6f63 6174 6573 2070 0x0080: 6f72 7420 626c 6f63 6b20 5b34 3731 3034 0x0090: 2d34 3731 3637 5d20 6672 6f6d 2031 3737 0x00a0: 2e35 312e 3131 362e 3134 3620 696e 2073 0x00b0: 6f75 7263 6520 706f 6f6c 2050 5542 4c49 0x00c0: 432d 4e41 542d 504f 4f4c 2d31 206c 7379 0x00d0: 735f 6964 3a20 30 What I need to analyze / verify, for syslog-ng will capture this type of package and convert it to a file. Atenciosamente, WILLIAM LUIZ R V SILVA Mediation Ericsson Rua Maria Preste Maia, 300 02879-130, Brazil Phone +55 11 2760-3785 Mobile +55 11 97979-9886 wsilva_ericsson@timbrasil.com.br<mailto:wsilva_ericsson@timbrasil.com.br> https://nam01.safelinks.protection.outlook.com/?url=www.ericsson.com&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Ce514eb6ec0c34b33ea7608d7d0e37b78%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207547759767084&sdata=nEQ%2BREZ8E933jkGNUBZiSKTj0Vfj1%2ByLgSjhOT7LFwg%3D&reserved=0<https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.ericsson.com%2F&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Ce514eb6ec0c34b33ea7608d7d0e37b78%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207547759767084&sdata=canMvelFLR%2B4uunJB3e3nbd%2F%2FfIQCQ294M09Hu3NtFc%3D&reserved=0> [Descrição: Descrição: Ericsson]<https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.ericsson.com%2F&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Ce514eb6ec0c34b33ea7608d7d0e37b78%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207547759767084&sdata=canMvelFLR%2B4uunJB3e3nbd%2F%2FfIQCQ294M09Hu3NtFc%3D&reserved=0> Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto ______________________________________________________________________________ Member info: https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Ce514eb6ec0c34b33ea7608d7d0e37b78%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207547759777082&sdata=lFc4WcFNoxz2kAQAQmRSW%2BrdejWKTdJs0Gu18FsC9Eo%3D&reserved=0 Documentation: https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Ce514eb6ec0c34b33ea7608d7d0e37b78%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207547759777082&sdata=VEPwryZceXmilLIf3XYP2uBgxH2zdMmgblS2J0ZhK%2Fc%3D&reserved=0 FAQ: https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Ce514eb6ec0c34b33ea7608d7d0e37b78%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207547759777082&sdata=mhr3EKgWfk%2B%2BPq6el2jKewWHzAAo0QcLTBednUwJIK4%3D&reserved=0 ______________________________________________________________________________ Member info: https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Ce514eb6ec0c34b33ea7608d7d0e37b78%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207547759777082&sdata=lFc4WcFNoxz2kAQAQmRSW%2BrdejWKTdJs0Gu18FsC9Eo%3D&reserved=0 Documentation: https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Ce514eb6ec0c34b33ea7608d7d0e37b78%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207547759777082&sdata=VEPwryZceXmilLIf3XYP2uBgxH2zdMmgblS2J0ZhK%2Fc%3D&reserved=0 FAQ: https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Ce514eb6ec0c34b33ea7608d7d0e37b78%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207547759777082&sdata=mhr3EKgWfk%2B%2BPq6el2jKewWHzAAo0QcLTBednUwJIK4%3D&reserved=0
On 25.03.20 17:54, William Luiz Ribeiro Vasconcelos Da Silva wrote:
I still understand that it is not a firewall, because the machine that sends the packets is on the same network as my machine: 10.96.145.98> 10.96.145.42
iptables on destination linux machine is also a firewall. firewall does not necessarily mean another machine
Yes, I am receiving the packets on the network interface where the IP "10.96.145.42" is allocated, in my case eth1.
is it the "mgalnxa01" in your capture example below?
10:46:13.529331 IP (tos 0x20, ttl 251, id 33055, offset 0, flags [none], proto UDP (17), length 243) 10.96.145.98.syslog > mgalnxa01.9514: [udp sum ok] SYSLOG, length: 215
next time run tcpdump with "-n" option -- Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. LSD will make your ECS screen display 16.7 million colors
The IP from mgalnxa01 is 10.96.145.42 This its example from tcpdump /usr/sbin/tcpdump -vn port 9514 -i eth1 tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes 14:11:19.670962 IP (tos 0x20, ttl 251, id 16868, offset 0, flags [none], proto UDP (17), length 244) 10.96.145.98.syslog > 10.96.145.42.9514: SYSLOG, length: 216 Facility user (1), Severity info (6) Msg: Mar 25 17:11:19 2020 RTCGNMGA0103 RT_NAT: RT_SRC_NAT_PBA_ALLOC: Subscriber 100.64.1.59 used/maximum [2/2] blocks, allocates port block [63616-63679] from 177.51.116.174 in source pool PUBLIC-NAT-POOL-1 lsys_id: 0 14:15:45.153159 IP (tos 0x20, ttl 251, id 16869, offset 0, flags [none], proto UDP (17), length 245) 10.96.145.98.syslog > 10.96.145.42.9514: SYSLOG, length: 217 Facility user (1), Severity info (6) Msg: Mar 25 17:15:44 2020 RTCGNMGA0103 RT_NAT: RT_SRC_NAT_PBA_RELEASE: Subscriber 100.64.1.59 used/maximum [1/2] blocks, releases port block [63616-63679] from 177.51.116.174 in source pool PUBLIC-NAT-POOL-1 lsys_id: 0 Atenciosamente, WILLIAM LUIZ R V SILVA Mediation Ericsson Rua Maria Preste Maia, 300 02879-130, Brazil Phone +55 11 2760-3785 Mobile +55 11 97979-9886 wsilva_ericsson@timbrasil.com.br www.ericsson.com -----Mensagem original----- De: syslog-ng <syslog-ng-bounces@lists.balabit.hu> Em nome de Matus UHLAR - fantomas Enviada em: quarta-feira, 25 de março de 2020 15:13 Para: syslog-ng@lists.balabit.hu Assunto: Re: [syslog-ng] RES: Problem to Get UDP Packets - Syslog-ng On 25.03.20 17:54, William Luiz Ribeiro Vasconcelos Da Silva wrote:
I still understand that it is not a firewall, because the machine that sends the packets is on the same network as my machine: 10.96.145.98> 10.96.145.42
iptables on destination linux machine is also a firewall. firewall does not necessarily mean another machine
Yes, I am receiving the packets on the network interface where the IP "10.96.145.42" is allocated, in my case eth1.
is it the "mgalnxa01" in your capture example below?
10:46:13.529331 IP (tos 0x20, ttl 251, id 33055, offset 0, flags [none], proto UDP (17), length 243) 10.96.145.98.syslog > mgalnxa01.9514: [udp sum ok] SYSLOG, length: 215
next time run tcpdump with "-n" option -- Matus UHLAR - fantomas, uhlar@fantomas.sk<mailto:uhlar@fantomas.sk> ; https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.fantomas.sk%2F&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Cfe6a5330623642b5985f08d7d0e81996%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207567601775321&sdata=UCoCK%2BXjh2XkiCz0SKZlS%2FbwU7mgTErYtimnz%2FzgI8w%3D&reserved=0 Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. LSD will make your ECS screen display 16.7 million colors ______________________________________________________________________________ Member info: https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Cfe6a5330623642b5985f08d7d0e81996%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207567601775321&sdata=q9XFmGZTc7fQVO2c9PvpV6RLET8DAwva%2F0pSVB30pyE%3D&reserved=0 Documentation: https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Cfe6a5330623642b5985f08d7d0e81996%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207567601775321&sdata=1XNmPeVHdYDczMcvk1KVWhuGd8YSqsV8VIgOcOlua8M%3D&reserved=0 FAQ: https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cwsilva_ericsson%40timbrasil.com.br%7Cfe6a5330623642b5985f08d7d0e81996%7C57b8c96eac2f4d78a149f1fc6817d3c4%7C0%7C0%7C637207567601775321&sdata=LsvnJIBF%2FUDvN5t4pqKBhIZfopCOJGaZ42x%2FohwbWHc%3D&reserved=0 Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto
On 25.03.20 18:29, William Luiz Ribeiro Vasconcelos Da Silva wrote:
The IP from mgalnxa01 is 10.96.145.42
I then have explained it in my first post to this thread. https://lists.balabit.hu/pipermail/syslog-ng/2020-March/025798.html
This its example from tcpdump
/usr/sbin/tcpdump -vn port 9514 -i eth1
tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes 14:11:19.670962 IP (tos 0x20, ttl 251, id 16868, offset 0, flags [none], proto UDP (17), length 244) 10.96.145.98.syslog > 10.96.145.42.9514: SYSLOG, length: 216
these packets come from port 514 on 10.96.145.98, to port 9514 on your machine 10.96.145.42. Your machine's syslog listens on port 514 (10.96.145.42:514) so it won't see packets that are coming to port 9514. -- Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. There's a long-standing bug relating to the x86 architecture that allows you to install Windows. -- Matthew D. Fuller
On 25.03.20 15:48, William Luiz Ribeiro Vasconcelos Da Silva wrote:
I installed syslog-ng on a new machine, however in initial tests, there was no collection of UDP packages by syslog-ng.
Here are some points I checked:
udp 0 0 10.96.145.42:514 0.0.0.0:* 16169/syslog-ng
Here is an example of the package received via tcpdump, but it was not captured by syslog-ng:
10:46:13.529331 IP (tos 0x20, ttl 251, id 33055, offset 0, flags [none], proto UDP (17), length 243) 10.96.145.98.syslog > mgalnxa01.9514: [udp sum ok] SYSLOG, length: 215
this packer was sent from IP 10.96.145.98 port 514 (syslog) to host mgalnxa01 (is it 10.96.145.42?) port 9514 1. it must come to port 514 on your host if you want to capture it 2. note that at least on linut you will see packets coming to your machine, even if they are blocked by your firewall -- Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Eagles may soar, but weasels don't get sucked into jet engines.
participants (3)
-
Laszlo Szemere (lszemere)
-
Matus UHLAR - fantomas
-
William Luiz Ribeiro Vasconcelos Da Silva