[syslog-ng] syslog-ng always using default permissions
Andrey Smetanin
Andrey.Smetanin at commerx.ca
Tue Dec 30 15:51:24 CET 2014
Here is the version:
-----------------------------------------------------------------------------------
[root at logmonitor ~]# syslog-ng -V
syslog-ng 3.6.1
Installer-Version: 3.6.1
Revision:
Compile-Date: Dec 12 2014 15:08:34
Available-Modules: afsocket,syslogformat,afsocket-notls,affile,afprog,afuser,afamqp,afmongodb,csvparser,confgen,system-source,linux-kmsg-format,basicfuncs,cryptofuncs,dbparser,afstomp,pseudofile,graphite
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-IPv6: on
Enable-Spoof-Source: off
Enable-TCP-Wrapper: off
Enable-Linux-Caps: off
----------------------------------------------------------------------
Sorry, didn’t understand the last question about “later release”.
Is there any way to see in the logs, debug messages...whatever...in which syslog-ng is making the decision what permissions to use? When I run debug mode all I can see is the messages about compiling config file.. You can see below, where I started syslog-ng in debug verbose mode, waited for a first log message and shut it down with CTL+C :
----------------------------------------------------------------------------------------------
[root at logmonitor ~]# systemctl stop syslog-ng
[root at logmonitor ~]# ps aux | grep syslog-ng
root 14070 0.0 0.0 110208 900 pts/0 R+ 09:34 0:00 grep --color=auto syslog-ng
[root at logmonitor ~]# syslog-ng -vFed
[2014-12-30T09:34:38.103631] Starting to read include file; filename='/usr/local/etc/scl.conf', depth='1'
[2014-12-30T09:34:38.103935] Global value changed; define='scl-root', value='/usr/local/share/include/scl'
[2014-12-30T09:34:38.103966] Global value changed; define='include-path', value='/usr/local/etc:/usr/local/share/include'
[2014-12-30T09:34:38.104013] Starting to read include file; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2'
[2014-12-30T09:34:38.104431] Module loaded and initialized successfully; module='system-source'
[2014-12-30T09:34:38.104447] Finishing include; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2'
[2014-12-30T09:34:38.104510] Starting to read include file; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2'
[2014-12-30T09:34:38.104603] Reading path for candidate modules; path='/usr/local/lib/syslog-ng'
[2014-12-30T09:34:38.104659] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='afsocket.so', module='afsocket'
[2014-12-30T09:34:38.104900] Registering candidate plugin; module='afsocket', context='source', name='unix-stream', preference='0'
[2014-12-30T09:34:38.104911] Registering candidate plugin; module='afsocket', context='destination', name='unix-stream', preference='0'
[2014-12-30T09:34:38.104919] Registering candidate plugin; module='afsocket', context='source', name='unix-dgram', preference='0'
[2014-12-30T09:34:38.104927] Registering candidate plugin; module='afsocket', context='destination', name='unix-dgram', preference='0'
[2014-12-30T09:34:38.104934] Registering candidate plugin; module='afsocket', context='source', name='tcp', preference='0'
[2014-12-30T09:34:38.104941] Registering candidate plugin; module='afsocket', context='destination', name='tcp', preference='0'
[2014-12-30T09:34:38.104968] Registering candidate plugin; module='afsocket', context='source', name='tcp6', preference='0'
[2014-12-30T09:34:38.104982] Registering candidate plugin; module='afsocket', context='destination', name='tcp6', preference='0'
[2014-12-30T09:34:38.104990] Registering candidate plugin; module='afsocket', context='source', name='udp', preference='0'
[2014-12-30T09:34:38.104997] Registering candidate plugin; module='afsocket', context='destination', name='udp', preference='0'
[2014-12-30T09:34:38.105004] Registering candidate plugin; module='afsocket', context='source', name='udp6', preference='0'
[2014-12-30T09:34:38.105017] Registering candidate plugin; module='afsocket', context='destination', name='udp6', preference='0'
[2014-12-30T09:34:38.105024] Registering candidate plugin; module='afsocket', context='source', name='syslog', preference='0'
[2014-12-30T09:34:38.105031] Registering candidate plugin; module='afsocket', context='destination', name='syslog', preference='0'
[2014-12-30T09:34:38.105044] Registering candidate plugin; module='afsocket', context='source', name='network', preference='0'
[2014-12-30T09:34:38.105053] Registering candidate plugin; module='afsocket', context='destination', name='network', preference='0'
[2014-12-30T09:34:38.105060] Registering candidate plugin; module='afsocket', context='source', name='systemd-syslog', preference='0'
[2014-12-30T09:34:38.105136] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='syslog-ng-crypto.so', module='syslog-ng-crypto'
[2014-12-30T09:34:38.105333] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='syslogformat.so', module='syslogformat'
[2014-12-30T09:34:38.105488] Registering candidate plugin; module='syslogformat', context='format', name='syslog', preference='0'
[2014-12-30T09:34:38.105504] Registering candidate plugin; module='syslogformat', context='parser', name='syslog-parser', preference='0'
[2014-12-30T09:34:38.105558] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='afsocket-notls.so', module='afsocket-notls'
[2014-12-30T09:34:38.105727] Registering candidate plugin; module='afsocket-notls', context='source', name='unix-stream', preference='0'
[2014-12-30T09:34:38.105737] Registering candidate plugin; module='afsocket-notls', context='destination', name='unix-stream', preference='0'
[2014-12-30T09:34:38.105744] Registering candidate plugin; module='afsocket-notls', context='source', name='unix-dgram', preference='0'
[2014-12-30T09:34:38.105751] Registering candidate plugin; module='afsocket-notls', context='destination', name='unix-dgram', preference='0'
[2014-12-30T09:34:38.105758] Registering candidate plugin; module='afsocket-notls', context='source', name='tcp', preference='0'
[2014-12-30T09:34:38.105765] Registering candidate plugin; module='afsocket-notls', context='destination', name='tcp', preference='0'
[2014-12-30T09:34:38.105781] Registering candidate plugin; module='afsocket-notls', context='source', name='tcp6', preference='0'
[2014-12-30T09:34:38.105789] Registering candidate plugin; module='afsocket-notls', context='destination', name='tcp6', preference='0'
[2014-12-30T09:34:38.106087] Registering candidate plugin; module='afsocket-notls', context='source', name='udp', preference='0'
[2014-12-30T09:34:38.106096] Registering candidate plugin; module='afsocket-notls', context='destination', name='udp', preference='0'
[2014-12-30T09:34:38.106102] Registering candidate plugin; module='afsocket-notls', context='source', name='udp6', preference='0'
[2014-12-30T09:34:38.106109] Registering candidate plugin; module='afsocket-notls', context='destination', name='udp6', preference='0'
[2014-12-30T09:34:38.106115] Registering candidate plugin; module='afsocket-notls', context='source', name='syslog', preference='0'
[2014-12-30T09:34:38.106121] Registering candidate plugin; module='afsocket-notls', context='destination', name='syslog', preference='0'
[2014-12-30T09:34:38.106134] Registering candidate plugin; module='afsocket-notls', context='source', name='network', preference='0'
[2014-12-30T09:34:38.106142] Registering candidate plugin; module='afsocket-notls', context='destination', name='network', preference='0'
[2014-12-30T09:34:38.106148] Registering candidate plugin; module='afsocket-notls', context='source', name='systemd-syslog', preference='0'
[2014-12-30T09:34:38.106214] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='affile.so', module='affile'
[2014-12-30T09:34:38.106454] Registering candidate plugin; module='affile', context='source', name='file', preference='0'
[2014-12-30T09:34:38.106470] Registering candidate plugin; module='affile', context='source', name='pipe', preference='0'
[2014-12-30T09:34:38.106497] Registering candidate plugin; module='affile', context='destination', name='file', preference='0'
[2014-12-30T09:34:38.106527] Registering candidate plugin; module='affile', context='destination', name='pipe', preference='0'
[2014-12-30T09:34:38.106611] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='afprog.so', module='afprog'
[2014-12-30T09:34:38.106846] Registering candidate plugin; module='afprog', context='source', name='program', preference='0'
[2014-12-30T09:34:38.106857] Registering candidate plugin; module='afprog', context='destination', name='program', preference='0'
[2014-12-30T09:34:38.106908] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='afuser.so', module='afuser'
[2014-12-30T09:34:38.107058] Registering candidate plugin; module='afuser', context='destination', name='usertty', preference='0'
[2014-12-30T09:34:38.107116] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='afamqp.so', module='afamqp'
[2014-12-30T09:34:38.107301] Registering candidate plugin; module='afamqp', context='destination', name='amqp', preference='0'
[2014-12-30T09:34:38.107367] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='afmongodb.so', module='afmongodb'
[2014-12-30T09:34:38.107665] Registering candidate plugin; module='afmongodb', context='destination', name='mongodb', preference='0'
[2014-12-30T09:34:38.107756] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='csvparser.so', module='csvparser'
[2014-12-30T09:34:38.107907] Registering candidate plugin; module='csvparser', context='parser', name='csv-parser', preference='0'
[2014-12-30T09:34:38.107965] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='confgen.so', module='confgen'
[2014-12-30T09:34:38.108141] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='system-source.so', module='system-source'
[2014-12-30T09:34:38.108161] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='linux-kmsg-format.so', module='linux-kmsg-format'
[2014-12-30T09:34:38.108319] Registering candidate plugin; module='linux-kmsg-format', context='format', name='linux-kmsg', preference='0'
[2014-12-30T09:34:38.108359] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='basicfuncs.so', module='basicfuncs'
[2014-12-30T09:34:38.108525] Registering candidate plugin; module='basicfuncs', context='template-func', name='grep', preference='0'
[2014-12-30T09:34:38.108536] Registering candidate plugin; module='basicfuncs', context='template-func', name='if', preference='0'
[2014-12-30T09:34:38.108544] Registering candidate plugin; module='basicfuncs', context='template-func', name='or', preference='0'
[2014-12-30T09:34:38.108551] Registering candidate plugin; module='basicfuncs', context='template-func', name='echo', preference='0'
[2014-12-30T09:34:38.108870] Registering candidate plugin; module='basicfuncs', context='template-func', name='length', preference='0'
[2014-12-30T09:34:38.108879] Registering candidate plugin; module='basicfuncs', context='template-func', name='substr', preference='0'
[2014-12-30T09:34:38.108887] Registering candidate plugin; module='basicfuncs', context='template-func', name='strip', preference='0'
[2014-12-30T09:34:38.108894] Registering candidate plugin; module='basicfuncs', context='template-func', name='sanitize', preference='0'
[2014-12-30T09:34:38.108901] Registering candidate plugin; module='basicfuncs', context='template-func', name='lowercase', preference='0'
[2014-12-30T09:34:38.108908] Registering candidate plugin; module='basicfuncs', context='template-func', name='uppercase', preference='0'
[2014-12-30T09:34:38.108915] Registering candidate plugin; module='basicfuncs', context='template-func', name='replace-delimiter', preference='0'
[2014-12-30T09:34:38.108922] Registering candidate plugin; module='basicfuncs', context='template-func', name='padding', preference='0'
[2014-12-30T09:34:38.108929] Registering candidate plugin; module='basicfuncs', context='template-func', name='+', preference='0'
[2014-12-30T09:34:38.108942] Registering candidate plugin; module='basicfuncs', context='template-func', name='-', preference='0'
[2014-12-30T09:34:38.108950] Registering candidate plugin; module='basicfuncs', context='template-func', name='*', preference='0'
[2014-12-30T09:34:38.108957] Registering candidate plugin; module='basicfuncs', context='template-func', name='/', preference='0'
[2014-12-30T09:34:38.108964] Registering candidate plugin; module='basicfuncs', context='template-func', name='%', preference='0'
[2014-12-30T09:34:38.108971] Registering candidate plugin; module='basicfuncs', context='template-func', name='ipv4-to-int', preference='0'
[2014-12-30T09:34:38.108978] Registering candidate plugin; module='basicfuncs', context='template-func', name='indent-multi-line', preference='0'
[2014-12-30T09:34:38.108985] Registering candidate plugin; module='basicfuncs', context='template-func', name='context-length', preference='0'
[2014-12-30T09:34:38.108992] Registering candidate plugin; module='basicfuncs', context='template-func', name='env', preference='0'
[2014-12-30T09:34:38.109035] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='cryptofuncs.so', module='cryptofuncs'
[2014-12-30T09:34:38.109261] Registering candidate plugin; module='cryptofuncs', context='template-func', name='uuid', preference='0'
[2014-12-30T09:34:38.109373] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='dbparser.so', module='dbparser'
[2014-12-30T09:34:38.109739] Registering candidate plugin; module='dbparser', context='parser', name='db-parser', preference='0'
[2014-12-30T09:34:38.109821] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='afstomp.so', module='afstomp'
[2014-12-30T09:34:38.109988] Registering candidate plugin; module='afstomp', context='destination', name='stomp', preference='0'
[2014-12-30T09:34:38.110050] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='pseudofile.so', module='pseudofile'
[2014-12-30T09:34:38.110205] Registering candidate plugin; module='pseudofile', context='destination', name='pseudofile', preference='0'
[2014-12-30T09:34:38.110262] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='graphite.so', module='graphite'
[2014-12-30T09:34:38.110419] Registering candidate plugin; module='graphite', context='template-func', name='graphite_output', preference='0'
[2014-12-30T09:34:38.110517] Finishing include; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2'
[2014-12-30T09:34:38.110585] Starting to read include file; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2'
[2014-12-30T09:34:38.110951] Module loaded and initialized successfully; module='confgen'
[2014-12-30T09:34:38.110967] Finishing include; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2'
[2014-12-30T09:34:38.111026] Starting to read include file; filename='/usr/local/share/include/scl/nodejs/plugin.conf', depth='2'
[2014-12-30T09:34:38.111137] Finishing include; filename='/usr/local/share/include/scl/nodejs/plugin.conf', depth='2'
[2014-12-30T09:34:38.111187] Starting to read include file; filename='/usr/local/share/include/scl/graphite/plugin.conf', depth='2'
[2014-12-30T09:34:38.111532] Finishing include; filename='/usr/local/share/include/scl/graphite/plugin.conf', depth='2'
[2014-12-30T09:34:38.111561] Finishing include; filename='/usr/local/etc/scl.conf', depth='1'
[2014-12-30T09:34:38.113146] system(): json-parser() is missing, skipping the automatic JSON parsing of messages submitted via syslog(3), Please install the json module;
[2014-12-30T09:34:38.113505] Module loaded and initialized successfully; module='afsocket'
[2014-12-30T09:34:38.113926] Module loaded and initialized successfully; module='affile'
[2014-12-30T09:34:38.114025] Finishing include; content='source confgen system', depth='1'
[2014-12-30T09:34:38.115377] Compiling #unnamed sequence [log] at [/usr/local/etc/syslog-ng.conf:30:2]
[2014-12-30T09:34:38.115388] Compiling s_local reference [source] at [/usr/local/etc/syslog-ng.conf:30:2]
[2014-12-30T09:34:38.115394] Compiling s_local sequence [source] at [/usr/local/etc/syslog-ng.conf:9:1]
[2014-12-30T09:34:38.115399] Compiling #unnamed junction [log] at [/usr/local/etc/syslog-ng.conf:9:17]
[2014-12-30T09:34:38.115404] Compiling #unnamed sequence [log] at [source confgen system:2:5]
[2014-12-30T09:34:38.115409] Compiling #unnamed sequence [source] at [source confgen system:2:5]
[2014-12-30T09:34:38.115414] Compiling #unnamed junction [log] at [source confgen system:2:13]
[2014-12-30T09:34:38.115419] Compiling #unnamed sequence [log] at [source confgen system:4:5]
[2014-12-30T09:34:38.115425] Compiling #unnamed sequence [source] at [source confgen system:4:5]
[2014-12-30T09:34:38.115430] Compiling #unnamed junction [log] at [source confgen system:4:13]
[2014-12-30T09:34:38.115435] Compiling #unnamed single [log] at [source confgen system:4:14]
[2014-12-30T09:34:38.115441] Compiling #unnamed sequence [rewrite] at [source confgen system:6:5]
[2014-12-30T09:34:38.115446] Compiling #unnamed single [log] at [source confgen system:6:15]
[2014-12-30T09:34:38.115451] Compiling #unnamed single [log] at [source confgen system:8:1]
[2014-12-30T09:34:38.115457] Compiling #unnamed single [log] at [/usr/local/etc/syslog-ng.conf:11:2]
[2014-12-30T09:34:38.115465] Compiling d_local reference [destination] at [/usr/local/etc/syslog-ng.conf:32:2]
[2014-12-30T09:34:38.115471] Compiling d_local sequence [destination] at [/usr/local/etc/syslog-ng.conf:18:1]
[2014-12-30T09:34:38.115475] Compiling #unnamed junction [log] at [/usr/local/etc/syslog-ng.conf:18:22]
[2014-12-30T09:34:38.115480] Compiling #unnamed single [log] at [/usr/local/etc/syslog-ng.conf:19:2]
[2014-12-30T09:34:38.115487] Compiling #unnamed sequence [log] at [/usr/local/etc/syslog-ng.conf:37:2]
[2014-12-30T09:34:38.115492] Compiling s_network reference [source] at [/usr/local/etc/syslog-ng.conf:37:2]
[2014-12-30T09:34:38.115497] Compiling s_network sequence [source] at [/usr/local/etc/syslog-ng.conf:14:1]
[2014-12-30T09:34:38.115502] Compiling #unnamed junction [log] at [/usr/local/etc/syslog-ng.conf:14:19]
[2014-12-30T09:34:38.115506] Compiling #unnamed single [log] at [/usr/local/etc/syslog-ng.conf:15:2]
[2014-12-30T09:34:38.115512] Compiling d_network reference [destination] at [/usr/local/etc/syslog-ng.conf:38:2]
[2014-12-30T09:34:38.115517] Compiling d_network sequence [destination] at [/usr/local/etc/syslog-ng.conf:22:1]
[2014-12-30T09:34:38.115522] Compiling #unnamed junction [log] at [/usr/local/etc/syslog-ng.conf:22:24]
[2014-12-30T09:34:38.115527] Compiling #unnamed single [log] at [/usr/local/etc/syslog-ng.conf:23:2]
[2014-12-30T09:34:38.115721] Module loaded and initialized successfully; module='syslogformat'
[2014-12-30T09:34:38.116794] Module loaded and initialized successfully; module='linux-kmsg-format'
[2014-12-30T09:34:38.117946] Running application hooks; hook='1'
[2014-12-30T09:34:38.117957] Running application hooks; hook='3'
[2014-12-30T09:34:38.118009] syslog-ng starting up; version='3.6.1'
[2014-12-30T09:35:52.469935] Incoming log entry; line='<14>1 2014-12-30T09:35:52-05:00 PA-2020.mydomain.com - - - - 1,2014/12/30 09:35:52,0004C103903,SYSTEM,userid,0,2014/12/30 09:35:52,,connect-server-monitor,,0,0,general,informational,User-ID server monitor ad02.mydomain.com(vsys1): connected to ad02.mydomain.com,35356,0x0 '
[2014-12-30T09:35:52.473174] Initializing destination file writer; template='/LOGS/fromnetwork', filename='/LOGS/fromnetwork'
[2014-12-30T09:35:52.473825] Outgoing message; message='Dec 30 09:35:52 pa 1 2014-12-30T09:35:52-05:00 PA-2020.mydomain.com - - - - 1,2014/12/30 09:35:52,0004C103903,SYSTEM,userid,0,2014/12/30 09:35:52,,connect-server-monitor,,0,0,general,informational,User-ID server monitor ad02.mydomain.com(vsys1): connected to ad02. mydomain.com,35356,0x0 \x0a'
^C[2014-12-30T09:36:48.735984] syslog-ng shutting down; version='3.6.1'
[2014-12-30T09:36:48.836215] Closing log transport fd; fd='11'
[2014-12-30T09:36:48.836318] Closing log transport fd; fd='12'
[2014-12-30T09:36:48.836348] Closing log transport fd; fd='13'
[2014-12-30T09:36:48.836405] Closing log transport fd; fd='16'
[2014-12-30T09:36:48.836590] Running application hooks; hook='4'
----------------------------------------------------------------------------------------------------
My full config file just in case :
-----------------------------------------------------------------------------
@version: 3.6
@include "scl.conf"
options {
perm(0664);
};
source s_local {
system();
internal();
};
source s_network {
udp(ip(0.0.0.0) port(514));
};
destination d_local {
file("/LOGS/local");
};
destination d_network {
file("/LOGS/fromnetwork" owner('logstash') group('logstash') perm(0660));
};
log {
source(s_local);
destination(d_local);
};
log {
source(s_network);
destination(d_network);
};
------------------------------------------------------------------
Andrey Smetanin
From: syslog-ng-bounces at lists.balabit.hu [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Scheidler, Balázs
Sent: December-30-14 3:16 AM
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] syslog-ng always using default permissions
Your config seems legit. Can you tell your syslog-ng version? Check with a later release?
On Dec 29, 2014 7:10 PM, "Andrey Smetanin" <Andrey.Smetanin at commerx.ca> wrote:
Here is the part of my configuration file:
...
destination d_network {
file("/LOGS/fromnetwork" owner('logstash') group('logstash') perm(0660));
};
...
File "/LOGS/fromnetwork" is created with the proper user and group ("logstash"), but permissions are always "0600", regardless whatever I am trying.
I don't see any errors while running "syslog-ng -vFe"
What else I can troubleshoot?
Andrey Smetanin
--
This message has been scanned by Commerx Computer Systems Inc. and is believed to be clean.
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq
--
This message has been scanned for viruses and dangerous content by
Commerx Computer Systems Inc., and is believed to be clean.
Click here to report this message as spam.
--
This message has been scanned by Commerx Computer Systems Inc. and is believed to be clean.
More information about the syslog-ng
mailing list