Skip to main content

syslog-ng 3.0 and SNMP traps

Last time I've written about how syslog-ng is able to change message contents. I thought it'd be useful to give you a more practical example, instead of a generic description.

It is quite common to convert SNMP traps to syslog messages. The easiest implementation is to run snmptrapd and have it create a log message based on the trap. There's a small issue though: snmptrapd uses the UNIX syslog() API, and as such it is not able to propagate the originating host of the SNMP trap to the hostname portion of the syslog message. This means that all traps are logged as messages coming from the host running snmptrapd, and the hostname information is part of the message payload.

Of course it'd be much easier to process syslog messages, if this were not the case.

A solution would be to patch snmptrapd to send complete syslog frames, but that would require changing snmptrapd source. The alternative is to use the new parse and rewrite features of syslog-ng 3.0.

First, you need to filter snmptrapd messages:

filter f_snmptrapd { program("snmptrapd"); };

Then we'd need to grab the first field of the message payload, where snmptrapd is configured to put it:

rewrite r_snmptrapd {
subst("^([^ ]+) (.*)$ ", "${2}");
set("${1}" value("HOST"));
};

Both rewrite expression kinds are demonstrated here:
  • subst() has two arguments: the first is a regexp to search for, the second is a template to be substituted if there's a match
  • set() has a single argument: a template to be used as the new value
Rewrite rules operate by the contents of the $MESSAGE value by default, which holds the message payload. Of course this can be changed by specifying the value() option. The notion 'value' in syslog-ng 3.0 refers to a name-value pair, in syslog-ng 3.0 every message is composed of a set of name-value pairs. The names of standard values match the name of the corresponding macro, but without the '$' sign.

Please NOTE that the new value is a template which makes it possible to use macros such as $HOST or $MESSAGE defined by syslog-ng.

Now let's wire the complete configuration together:

filter f_snmptrapd { program("snmptrapd"); };

rewrite r_snmptrapd {
subst("^([^ ]+) (.*)$ ", "${2}");
set("${1}" value("HOST"));
};

log {
source(s_all);
filter(f_snmptrapd);
rewrite(r_snmptrapd);
destination(d_all);
flags(final);
};

log {
source(s_all);
destination(d_all);
flags(final);
};

Of course this is only an example of the power of what syslog-ng is now capable of doing. Please let me know if you can think of other uses.

The current 3.0 branch of syslog-ng has not been released yet, it is available in the git repository at git.balabit.hu, and also as nightly snapshots.

I'd be grateful for any kind of feedback you might have, please post it either as comments on this blog, or to the mailing list.
Labels:

Comments

Unknown said…
Hi, good issue. But I'm interesting on how to sent message via snmptrap based on syslog-ng service. Could you please tell me more.
1:31 PM
Bazsi said…
Well, the same way you'd integrate with any 3rd party application.

destination d_snmp { program("yourscript.sh");}

where yourscript.sh would read the matching messages from its stdin and send them out by invoking snmptrap.
5:04 PM
Post a Comment

Popular posts from this blog

syslog-ng fun with performance

I like christmas for a number of reasons: in addition to the traditional "meet and have fun with your family", eat lots of delicious food and so on, I like it because this is the season of the year when I have some time to do whatever I feel like. This year I felt like doing some syslog-ng performance analysis. After reading Ulrich Deppert's series about stuff "What every programmer should know about memory" on LWN, I thought I'm more than prepared to improve syslog-ng performance. Before going any further, I'd recommend this reading to any programmer, it's a bit long but every second reading it is worth it. As you need to measure performance in order to improve it, I wrote a tool called "loggen". This program generates messages messages at a user-specifyable rate. Apart from the git repository you can get this tool from the latest syslog-ng snapshots. Loggen supports TCP, UDP and UNIX domain sockets, so really almost everything can be me...
17 comments
Read more

syslog-ng contributions redefined

syslog-ng has been around for about 12 years now, but I think the biggest change in the project's life is imminent: with the upcoming release of syslog-ng OSE 3.2, syslog-ng will become an independent entity. Until now, syslog-ng was primarily maintained & developed by BalaBit, copyrights needed to be reassigned in order to grant BalaBit special privileges. BalaBit used her privileges to create a dual-licensed fork of syslog-ng, named "syslog-ng Premium Edition". The value we offer over the Open Source Edition of syslog-ng are things that larger enterprises require: support on a large number of UNIX platforms (27 as of 3.1), smaller and larger feature differences (like the encrypted/digitally signed logfile feature) better test coverage and release management longer term support Although perfectly legal, this business model was not welcome in various Free Software communities, and has caused friction and harm, because BalaBit has enjoyed a privilege that no others cou...
Post a Comment
Read more

An introduction to db-parser()

As promised on the mailing list here comes a short description of the new db-parser functionality of syslog-ng. For an introduction to parsers in general see my previous blog post here . The aim for db-parser is two-fold: extract interesting information from a log message attach tags to a log message for later classification. For instance here's a log sample (lines broken for readability): Feb 24 11:55:22 bzorp sshd[4376]: Accepted password for bazsi \ from 10.50.0.247 port 42156 ssh2 This message states that a user named "bazsi" has logged into the host named "bzorp" using SSH2 from the quoted IP and port. When you read this message as a human, the event that happened is perfectly clear. However if it is not a human, but a piece of software that has to make out the meaning of the message, you need to identify the event (e.g. that a user login has happened) and the additional information associated with the event (e.g. that he used 10.50.0.247 as the cl...
7 comments
Read more