<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<STYLE>.hmmessage P {
PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; PADDING-TOP: 0px
}
BODY.hmmessage {
FONT-SIZE: 10pt; FONT-FAMILY: Verdana
}
</STYLE>
<META content="MSHTML 6.00.2900.3562" name=GENERATOR></HEAD>
<BODY class=hmmessage>
<DIV dir=ltr align=left><SPAN class=648135712-07072009><FONT face=Arial
color=#0000ff>There are many problems with this example.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=648135712-07072009><FONT face=Arial
color=#0000ff></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=648135712-07072009><FONT face=Arial
color=#0000ff>1. A syslog-ng "program" script is not allowed to process one
message and exit. It must run in a loop, reading individual messages from its
stdin and handling each one separately e.g. sending each as a separate email.
Check the archives of this list, you will see that discussed many
times.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=648135712-07072009><FONT face=Arial
color=#0000ff></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=648135712-07072009><FONT face=Arial
color=#0000ff>2. The source you have defined will read the existing contents of
that file when syslog-ng is started and send them to the script. That's all it
will do. Run your restart test again - I expect that it sends you the exact same
email every time, the first line of that log file.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=648135712-07072009><FONT face=Arial
color=#0000ff></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=648135712-07072009><FONT face=Arial
color=#0000ff>Joe.</FONT></SPAN></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma><B>From:</B> syslog-ng-bounces@lists.balabit.hu
[mailto:syslog-ng-bounces@lists.balabit.hu] <B>On Behalf Of </B>Reaky
Rok<BR><B>Sent:</B> 07 July 2009 13:36<BR><B>To:</B>
syslog-ng@lists.balabit.hu<BR><B>Subject:</B> Re: [syslog-ng] Must Restart
syslog-ng to send email<BR></FONT><BR></DIV>
<DIV></DIV>Dear friends<BR>Is there any update please, The Idea that I want to
filter the logs that comes from the server 172.31.250.68 to send it by
email, that's the purpose of this configuration I did.<BR>(note) the path
" /var/log/syslog-ng/servers/172.31.250.68/local7.log" is the path of the log
file for this server in the my syslog-ng machine, I tried to add more options to
the destination line like the following:<BR> destination maillog {
program("/usr/local/bin/syslog-mail-perl" flush_lines(1)
flush_timeout(30));<BR> };<BR>But the problem still exist<BR>Please if
anyone have a solution for this Or any other solution or guide lines please tell
me.<BR><BR>Thanks<BR><BR>
<HR id=stopSpelling>
From: reakyrok@hotmail.com<BR>To: syslog-ng@lists.balabit.hu<BR>Date: Mon, 6 Jul
2009 16:44:37 +0300<BR>Subject: Re: [syslog-ng] Must Restart syslog-ng to send
email<BR><BR>
<STYLE>.ExternalClass .EC_hmmessage P {
PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; PADDING-TOP: 0px
}
.ExternalClass BODY.EC_hmmessage {
FONT-SIZE: 10pt; FONT-FAMILY: Verdana
}
</STYLE>
Sorry there's Small mistake that In both internal send or out send I must
restart syslog-ng first<BR><BR>
<HR id=EC_stopSpelling>
From: reakyrok@hotmail.com<BR>To: syslog-ng@lists.balabit.hu<BR>Date: Mon, 6 Jul
2009 15:50:00 +0300<BR>Subject: [syslog-ng] Must Restart syslog-ng to send
email<BR><BR>
<STYLE>.ExternalClass .EC_hmmessage P {
PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; PADDING-TOP: 0px
}
.ExternalClass BODY.EC_hmmessage {
FONT-SIZE: 10pt; FONT-FAMILY: Verdana
}
</STYLE>
Dear friends<BR> I
have a small problem with my syslog-ng server, I use a configuration to filter
mail from log file and forwerd it to perl script to send it, the configuration
like the
following:<BR>=====================================================<BR>source
sme {file (/var/log/syslog-ng/servers/172.31.250.68/local7.log);
};<BR><BR>destination maillog { program ("/usr/local/bin/syslog-mail-perl"
);<BR> };<BR>log {source(sme); destination(maillog);
};<BR>=====================================================<BR><BR>And the perl
script like the
following:<BR>+++++++++++++++++++++++++++++++++++=<BR>#!/usr/bin/perl -n<BR>#
thanks to Brian Dowling for an example with security in mind.<BR><BR>$TO =
'reaky@domain.com';<BR>$FROM = $TO;<BR><BR>s/^//;<BR><BR>open(MAIL,
"|/usr/sbin/sendmail -t");<BR><BR>print MAIL "EOT";<BR>To: $TO<BR>From:
$FROM<BR>Subject: SME Log Alert:
$_<BR><BR>$_<BR><BR>EOT<BR><BR>close(MAIL);<BR>+++++++++++++++++++++++++++++++++++++++<BR><BR>It
worked very fine when I send to root user in the machine, But when I tried to
send to outside I found that I must restart syslog every time to send the mails
to sendmail, In another word it buffer the emails tell I restart syslog-ng then
It forwerd it to send mail and can see it in the mail log.<BR>Do you have any
idea for that ?<BR>Thanks<BR><BR>
<HR>
Windows Live™: Keep your life in sync. <A
href="http://windowslive.com/explore?ocid=TXT_TAGLM_WL_t1_allup_explore_012009">Check
it out!</A><BR>
<HR>
Invite your mail contacts to join your friends list with Windows Live Spaces.
It's easy! <A
href="http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&mkt=en-us">Try
it!</A><BR>
<HR>
Invite your mail contacts to join your friends list with Windows Live Spaces.
It's easy! <A
href="http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&mkt=en-us"
target=_new>Try it!</A> </BODY></HTML>