<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=windows-1250">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:595.3pt 841.9pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-GB link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I am a fairly new to all this so please excuse me.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I am having lots of problems getting syslog-ng to send email
alerts based upon certain text based filters. I am running RedHat 9.0 with syslog-ng-1.6.2-1
installed from the rpm, I have configured the syslog-ng.conf file correctly to
enable filtering with a match statement for a specific IP address in the logs
and this works when using ‘destination file { file("/etc/syslog-ng/test.log");
};’ but when I point this to the perl script that I have got off of this
URL <a href="http://www.campin.net/newlogcheck.html">http://www.campin.net/newlogcheck.html</a>
I get nothing. Please see below the destination statement and perl script that
I have created with executable permissions.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Syslog-ng.conf<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>destination email {
program("/etc/syslog-ng/mail.pl"); };<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> filter
f_test {<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
match(192.168.1.1);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>};<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='margin-left:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>log {<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
source(src);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
filter(f_test);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
destination(email);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>};<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Mail.pl<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>#!/usr/bin/perl -n<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>#<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>## shell version<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>#<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'># while read line; do<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'># echo $line
| /bin/mail -s "log alert" support@businessfcl.com<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'># done<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'># strip the priority<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>s/^<[\d]{1,2}>//;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'># mail the cleaned up message<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:36.0pt'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>system("echo \"$_\" |
/bin/mail -s \"log alert\" monitor");<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Every time I restart the syslog-ng service I get a mail to
the monitor user which would indicate that the perl script sends mail and that
syslog-ng runs it during startup but it does not appear to work when the filter
is applied. Can any one help with this please?<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Regards<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>Stuart
Burgis<br>
<br>
</span></font><span lang=EN-US><o:p></o:p></span></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
</body>
</html>
<BR>
<P><FONT SIZE=2>--<BR>
No virus found in this outgoing message.<BR>
Checked by AVG Free Edition.<BR>
Version: 7.1.375 / Virus Database: 267.15.2/252 - Release Date: 06/02/2006<BR>
</FONT> </P>