<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
I hope, in fact your full config looks like this one, doesn't it?:<br>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">source
s_tcp { <o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">#
syslog(transport(tcp)); <o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">
udp(ip(10.13.6.83) port(514));<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">
tcp(ip(10.13.6.83) port(5149) max-connections(333));<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">};<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">destination
d_tcp {<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">
file("/var/log/messages_tcp"
owner("root") group("adm") perm(0640));<o:p></o:p></span></p>
<span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">};<br>
<br>
<b>log {<br>
source(s_tcp);<br>
destination(d_tcp);<br>
};</b><br>
</span><br>
If it is true, you can try the following things:<br>
-listening on the all addresses of this host: <span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">
udp(port(514));<br>
</span>-start syslog-ng in debug mode (syslog-ng -Fevd) and you should
see the incoming syslogd logs. For example:<br>
<br>
<i>root@thor:/opt/syslog-ng# sbin/syslog-ng -Fevd<br>
Server license found, starting in server mode; customer='BalaBit IT
Kft.', serial='708005-000000-2c8926', limit='-1'<br>
Running application hooks; hook='1'<br>
Running application hooks; hook='3'<br>
syslog-ng starting up; version='3.1.0',
cfg-fingerprint='5b1cb89509fcbe41d22634f2bce20323d2c87a55',
cfg-nonce-ndx='0',
cfg-signature='866ce1c9eac64d70356b90b0b4da411ae323c73b'<br>
Incoming log entry; line='<46>syslogd 1.5.0#5ubuntu4: restart.'<br>
Initializing destination file writer; template='/var/log/messages',
filename='/var/log/messages'<br>
</i><br>
If no "Incoming log entry..:" line is here, then syslogd doesn't send
logs to syslog-ng, and probably the reason for this behaviour will be
on client side or at least (I hope) you will see what the problem is.<br>
<br>
If these solutions don't help you, please send me the version of your
syslog-ng (syslog-ng -V) and the above debug output of syslog-ng.<br>
<br>
Lozada, Agustin T wrote:
<blockquote
cite="mid:8E5A3C03DF004A46B8E0A99C3ED38F29018314410E10@ECDCEX7CMS1.cnp.int"
type="cite">
<meta http-equiv="Content-Type" content="text/html; ">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:CourierNewPSMT;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="Section1">
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">I
got that part fixed thanks Zoltan. My next question is I set
up this box (AIX 5.3) to be the central server and configure a client
to
forward syslog and it looks like the client is doing it:<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">#
/usr/sbin/syslogd -d<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">0821-600
/usr/sbin/syslogd: continuing without SRC support<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">syslogd:
bind: errno = 67<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">logmsg:
pri 53, flags 8, from t01labax08, msg syslogd: bind:
errno = 67<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">off
& running....<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">init<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">cfline(*.debug
@10.13.6.83)<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">cfline(*.debug;mail.none
@10.13.6.83)<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">cfline(*.crit
@10.13.6.83)<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">cfline(mail.debug
@10.13.6.83 )<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">7
7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 X FORW:
10.13.6.83<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">7
7 X 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 X FORW:
10.13.6.83<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">2
2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 X FORW:
10.13.6.83<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">X
X 7 X X X X X X X X X X X X X X X X X X X X X X FORW:
10.13.6.83<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">logmsg:
pri 56, flags 8, from t01labax08, msg syslogd: restart<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">Logging
to FORW 10.13.6.83<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">Logging
to FORW 10.13.6.83<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">syslogd:
restarted<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">readfds
= 0x10<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">got
a message (-1, 0x10)<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">readfds
= 0x10<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">got
a message (-1, 0x10)<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">10.13.6.83
is my designated server and its seems it is not
getting the forwarded log messages, here is how my syslog.conf for
remote
logging:<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">source
s_tcp { <o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">#
syslog(transport(tcp)); <o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">
udp(ip(10.13.6.83) port(514));<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">
tcp(ip(10.13.6.83) port(5149) max-connections(333));<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">};<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">destination
d_tcp {<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">
file("/var/log/messages_tcp"
owner("root") group("adm") perm(0640));<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">};<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">I
do not see any traffic coming to my client t01labax08 going to
my syslog server and /var/log/messages_tcp not even been created. Again
what am
I missing here? Sorry I’m syslog-ng newbie here….<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">Thanks
and regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">Agustin
Lozada<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">UNIX
System Admin<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">713-207-2474<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span
style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<div>
<div
style="border-style: solid none none; border-color: rgb(181, 196, 223) -moz-use-text-color -moz-use-text-color; border-width: 1pt medium medium; padding: 3pt 0in 0in;">
<p class="MsoNormal"><b><span
style="font-size: 10pt; font-family: "Tahoma","sans-serif"; color: windowtext;">From:</span></b><span
style="font-size: 10pt; font-family: "Tahoma","sans-serif"; color: windowtext;">
Zoltán Pallagi
[<a class="moz-txt-link-freetext" href="mailto:pzolee@balabit.hu">mailto:pzolee@balabit.hu</a>] <br>
<b>Sent:</b> Thursday, March 18, 2010 1:42 PM<br>
<b>To:</b> Syslog-ng users' and developers' mailing list; Lozada,
Agustin T<br>
<b>Subject:</b> Re: [syslog-ng] Server conf for syslog-ng.conf<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi,<br>
replace this line:<br>
<span
style="background: yellow none repeat scroll 0%; font-family: CourierNewPSMT; -moz-background-clip: -moz-initial; -moz-background-origin: -moz-initial; -moz-background-inline-policy: -moz-initial;">source
s_network {
syslog(transport(tcp))};<br>
with this one(missing semicolon at the end of last bracket):<br>
source s_network { syslog(transport(tcp));};</span><br>
2010.03.18. 19:29 keltezéssel, Lozada, Agustin T írta: <o:p></o:p></p>
<div>
<p class="MsoNormal"><span
style="font-size: 7.5pt; font-family: CourierNewPSMT;">@version:3.0</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size: 7.5pt; font-family: CourierNewPSMT;">options
{</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size: 7.5pt; font-family: CourierNewPSMT;">time_reap(30);</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size: 7.5pt; font-family: CourierNewPSMT;">mark_freq(10);</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size: 7.5pt; font-family: CourierNewPSMT;">keep_hostname(yes);</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size: 7.5pt; font-family: CourierNewPSMT;">};</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size: 7.5pt; font-family: CourierNewPSMT;">source
s_local { unix-stream("/dev/log"); internal();};</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="background: yellow none repeat scroll 0%; font-size: 7.5pt; font-family: CourierNewPSMT; -moz-background-clip: -moz-initial; -moz-background-origin: -moz-initial; -moz-background-inline-policy: -moz-initial;">source
s_network { syslog(transport(tcp))};</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="background: yellow none repeat scroll 0%; font-size: 7.5pt; font-family: CourierNewPSMT; -moz-background-clip: -moz-initial; -moz-background-origin: -moz-initial; -moz-background-inline-policy: -moz-initial;">destination
d_logs {</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size: 7.5pt; font-family: CourierNewPSMT;">file(</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size: 7.5pt; font-family: CourierNewPSMT;">"/var/log/syslog-ng/logs.txt"</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size: 7.5pt; font-family: CourierNewPSMT;">owner("root")</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size: 7.5pt; font-family: CourierNewPSMT;">group("root")</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size: 7.5pt; font-family: CourierNewPSMT;">perm(0777)</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size: 7.5pt; font-family: CourierNewPSMT;">);
};</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size: 7.5pt; font-family: CourierNewPSMT;">log
{ source(s_local); source(s_network); destination(d_logs); };</span><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size: 10pt; font-family: "Calibri","sans-serif";"> <o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="margin-bottom: 12pt;"><o:p> </o:p></p>
<div>
<p class="MsoNormal">-- <br>
pzolee<o:p></o:p></p>
</div>
</div>
<pre wrap="">
<hr size="4" width="90%">
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
pzolee
</pre>
</body>
</html>