[syslog-ng] Problems with short messages
Guy Fleegman
network.monger at gmail.com
Fri Feb 8 20:11:40 CET 2008
Hello:
We have a system that sends messages to syslog-ng (Latest version
2.0.8..but this has occurred on all 2.x versions so far)
This is what is happening.... An application has a message that us too
long for syslog.. .so it breaks the message into 2 separate syslog
messages. The first one is a length seen in wireshark of 1066 bytes.
The second packet is either 69 or 70 bytes and it it simply the
leftover characters 0/n/n
The problem is that the filter in my syslog-ng.conf file is not
catching the second smaller messages Instead of going to the file i
direct it to. It goes to the default file (which i do not want)
What is causing this packet to not be processed by my filter? Attached
is a copy of the relevant syslog-ng.conf data as well as the actual
wireshark trace information
Please advise and thanks !
-Chris
syslog-ng.conf file
source all_devices { udp(ip(0.0.0.0) port(514)); };
destination d_catch_all_others{
file("/var/log/syslog-ng-logs/everything_else.1" perm(0644)
template(t_default)); };
destination d_pt_network_device{
file("/var/log/syslog-ng-logs/pt_network_device.1" perm(0644)
template(t_default)); };
filter f_all_devices { not (host(1.2.3.4) or host(2.3.4.5)); };
filter f_pt_network_device{ (host1.2.3.4) or host(2.3.4.5)); };
log { source(all_devices); filter(f_all_devices);
destination(d_catch_all_others); };
log { source(all_devices); filter(f_pt_network_device);
destination(d_pt_network_device); };
here is the wireshark capture
No. Time Source Destination
Protocol Packet length Info
1 09:14:23.073515 1.2.3.4 9.8.7.6 Syslog 1066
LOCAL2.ERR: Feb 1 09:14:23 auditd: Feb 1 14:14:23 2008 GMT
f_system a_hmon t_geninfo p_major pid: 1372 ruid: 0 euid: 0 pgid: 1372
fid: 0 logid: 0 cmd: 'monitord' domain: HMON edomain: HMON hostname:
perfjupiterb.bwc.state.oh.us +|health
monitor|MON_INFO|MAJOR|SYS|HMONINFO\n=Health Monitor data
follows\n\nuptime_util:\t 32 days\t 5:59\nload_avg:\t
0.10\nmem_percent:\t 6.09\ncpu_percent:\t 0\ntcp_count:\t
19\nudp_count:\t 8\nproxy_info:\t syslogd
\t1\nproxy_info:\t named \t7\nproxy_info:\t squid
\t6\nproxy_info:\t ntpd \t2\nproxy_info:\t
snmpp \t2\nproxy_info:\t pudp
\t63\nproxy_info:\t entrelayd \t3\nproxy_info:\t dnsp
\t2\nproxy_info:\t tcpgsp:(1425) \t2\nproxy_info:\t
warder_auth \t5\nproxy_info:\t sshd
\t2\ntcp_data:\t ESTABLISHED\t13\ntcp_data:\t
TIME_WAIT\t6\ntcp_data:\t FIN_WAIT_1\t0\ntcp_data:\t
FIN_WAIT_2\t0\ntcp_data:\t CLOSE_WAIT\t0\nipf_data:\t TCP
Total\t\t0\nipf_data:\t UDP Total\t\t0\nipf_total:\t
Frame 1 (1066 bytes on wire, 1066 bytes captured)
Arrival Time: Feb 1, 2008 09:14:23.073515000
[Time delta from previous packet: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Packet Length: 1066 bytes
Capture Length: 1066 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:syslog]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: Cisco_12:b4:4a (00:0f:f8:12:b4:4a), Dst:
CompaqHp_41:c6:af (00:0b:cd:41:c6:af)
Destination: CompaqHp_41:c6:af (00:0b:cd:41:c6:af)
Address: CompaqHp_41:c6:af (00:0b:cd:41:c6:af)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique
address (factory default)
Source: Cisco_12:b4:4a (00:0f:f8:12:b4:4a)
Address: Cisco_12:b4:4a (00:0f:f8:12:b4:4a)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique
address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 1.2.3.4 (1.2.3.4), Dst: 9.8.7.6 (9.8.7.6)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1052
Identification: 0xa1db (41435)
Flags: 0x00
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 61
Protocol: UDP (0x11)
Header checksum: 0xf7a4 [correct]
[Good: True]
[Bad : False]
Source: 1.2.3.4 (1.2.3.4)
Destination: 9.8.7.6 (9.8.7.6)
User Datagram Protocol, Src Port: syslog (514), Dst Port: syslog (514)
Source port: syslog (514)
Destination port: syslog (514)
Length: 1032
Checksum: 0xf9d3 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Syslog message: LOCAL2.ERR: Feb 1 09:14:23 auditd: Feb 1 14:14:23
2008 GMT f_system a_hmon t_geninfo p_major pid: 1372 ruid: 0 euid: 0
pgid: 1372 fid: 0 logid: 0 cmd: 'monitord' domain: HMON edomain: HMON
hostname: perfjupiterb.bwc.sta
1001 0... = Facility: LOCAL2 - reserved for local use (18)
.... .011 = Level: ERR - error conditions (3)
Message [truncated]: Feb 1 09:14:23 auditd: Feb 1 14:14:23 2008
GMT f_system a_hmon t_geninfo p_major pid: 1372 ruid: 0 euid: 0 pgid:
1372 fid: 0 logid: 0 cmd: 'monitord' domain: HMON edomain: HMON
hostname: perfjupiterb.bwc.state.oh.u
No. Time Source Destination
Protocol Packet length Info
2 09:14:23.073537 1.2.3.4 9.8.7.6 Syslog 69
LOCAL2.ERR: Feb 1 09:14:23 0\n\n
Frame 2 (69 bytes on wire, 69 bytes captured)
Arrival Time: Feb 1, 2008 09:14:23.073537000
[Time delta from previous packet: 0.000022000 seconds]
[Time since reference or first frame: 0.000022000 seconds]
Frame Number: 2
Packet Length: 69 bytes
Capture Length: 69 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:syslog]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: Cisco_12:b4:4a (00:0f:f8:12:b4:4a), Dst:
CompaqHp_41:c6:af (00:0b:cd:41:c6:af)
Destination: CompaqHp_41:c6:af (00:0b:cd:41:c6:af)
Address: CompaqHp_41:c6:af (00:0b:cd:41:c6:af)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique
address (factory default)
Source: Cisco_12:b4:4a (00:0f:f8:12:b4:4a)
Address: Cisco_12:b4:4a (00:0f:f8:12:b4:4a)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique
address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 1.2.3.4 (1.2.3.4), Dst: 9.8.7.6 (9.8.7.6)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 55
Identification: 0xa1dc (41436)
Flags: 0x00
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 61
Protocol: UDP (0x11)
Header checksum: 0xfb88 [correct]
[Good: True]
[Bad : False]
Source: 1.2.3.4 (1.2.3.4)
Destination: 9.8.7.6 (9.8.7.6)
User Datagram Protocol, Src Port: syslog (514), Dst Port: syslog (514)
Source port: syslog (514)
Destination port: syslog (514)
Length: 35
Checksum: 0xec1c [correct]
[Good Checksum: True]
[Bad Checksum: False]
Syslog message: LOCAL2.ERR: Feb 1 09:14:23 0\n\n
1001 0... = Facility: LOCAL2 - reserved for local use (18)
.... .011 = Level: ERR - error conditions (3)
Message: Feb 1 09:14:23 0\n\n
More information about the syslog-ng
mailing list