<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
abhay singh wrote:
<blockquote
cite="mid:g2i7eb4b7181004202352xb188dd84xc5dc7e26f1459d59@mail.gmail.com"
type="cite">
<div>Hi, </div>
<div> </div>
<div>Yes, it worked when i changed underscore(_) to hyphen(-).</div>
<div>But again if you check<br>
"destination d_stunnel{
file("/data/extract/syslogs/$HOST/$HOST_syslog.log" "</div>
<div>in this line am creating directory of $HOST first then log file
name, this should work right?</div>
</blockquote>
<br>
Yes, excepting that you are using "_" instead of "-" again. If you
insist on using underscore, use with the following form:<br>
/data/extract/syslogs/${HOST}/${HOST}_syslog.log<br>
<blockquote
cite="mid:g2i7eb4b7181004202352xb188dd84xc5dc7e26f1459d59@mail.gmail.com"
type="cite">
<div><br>
</div>
<div class="gmail_quote">On Tue, Apr 20, 2010 at 4:08 PM, Zoltán
Pallagi <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:pzolee@balabit.hu">pzolee@balabit.hu</a>></span> wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0px 0px 0px 0.8ex; padding-left: 1ex;">
<div text="#000000" bgcolor="#ffffff">Hi,<br>
<br>
Replace $HOST_syslog.log to $HOST-syslog.log and it will work.
Syslog-ng seems to be handling wrong if underscore character is after
macroname.<br>
Report a bug about it, please (<a moz-do-not-send="true"
href="https://bugzilla.balabit.com/" target="_blank">https://bugzilla.balabit.com/</a>)<br>
<br>
<br>
abhay singh wrote:
<blockquote type="cite">
<div>
<div class="h5">I have made that changes and restarted syslog
services even though its not working///<br>
Now its like this<br>
<br>
options { <br>
long_hostnames(off); <br>
sync(0); <br>
perm(0640); <br>
stats(3600); <br>
keep_hostname(yes);<br>
};<br>
source s_external {<br>
udp(port(514));<br>
#udp(ip("192.168.114.129") port(514));<br>
#udp(ip("0.0.0.0") port(514));<br>
}; # Specific<br>
source s_stunnel {<br>
tcp(ip("127.0.0.1")<br>
port(514)<br>
max-connections(1));<br>
};<br>
destination d_external { file("/data/extract/syslogs/$HOST_syslog.log" \<br>
owner(cubot) group(users) perm(0600) dir_perm(0700) create_dirs(yes)<br>
template("$DATE $FULLHOST $PROGRAM $TAG [$FACILITY.$LEVEL] $MESSAGE
\n") );<br>
};<br>
<br>
destination d_stunnel{
file("/data/extract/syslogs/$HOST/$HOST_syslog.log" \<br>
owner(cubot) group(users) perm(0600) dir_perm(0700) create_dirs(yes)<br>
template("$DATE $FULLHOST $PROGRAM $TAG [$FACILITY.$LEVEL] $MESSAGE
\n") );<br>
};<br>
<br>
log { source(s_external); destination(d_external); };<br>
log { source(s_stunnel); destination(d_stunnel); };<br>
<br>
<br>
<br>
<div class="gmail_quote">On Tue, Apr 20, 2010 at 1:55 PM, Alan
McKinnon <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:Alan.McKinnon@is.co.za" target="_blank">Alan.McKinnon@is.co.za</a>></span>
wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>On Tuesday 20 April 2010 08:38:51 abhay singh wrote:<br>
> Hi All,<br>
><br>
> I have made changes in syslog-ng.conf to redirect logs coming from
other<br>
> server to some specified log file and in some format<br>
><br>
> source s_external {<br>
> udp(port(514));<br>
> };<br>
> source s_stunnel {<br>
> tcp(ip(127.0.0.1) port(514));<br>
> };<br>
><br>
> destination s_external { file("/mydir/syslogs/$HOST_syslog.log" \<br>
> owner(user) group(group) perm(0600) dir_perm(0700)
create_dirs(yes));<br>
> };<br>
><br>
> destination s_stunnel { file("/mydir/syslogs/$HOST/syslog.log" \<br>
> owner(user) group(group) perm(0600) dir_perm(0700)
create_dirs(yes));<br>
> };<br>
><br>
> log { source(s_external); destination(s_external); };<br>
> log { source(s_stunnel); destination(s_stunnel); };<br>
><br>
> But my log file is being created with name "syslog.log" and not as<br>
> "<hostnmae/ip>_syslog.log" neither $HOST directory made,
what may be the<br>
> issue?<br>
><br>
> Globle options are<br>
><br>
> option{<br>
><br>
> long_hostname(off);<br>
> sync(0);<br>
> }<br>
<br>
<br>
</div>
Your sources and destinations have the same name. That is not allowed.<br>
<br>
Rename the destinations to d_<something><br>
<br>
--<br>
Alan McKinnon<br>
Systems Engineer^W Technician<br>
Infrastructure Services<br>
Internet Solutions<br>
<br>
+27 11 575 7585<br>
<br>
Please note: This email and its content are subject to the disclaimer
as displayed at the following link <a moz-do-not-send="true"
href="http://www.is.co.za/legal/E-mail+Confidentiality+Notice+and+Disclaimer.htm"
target="_blank">http://www.is.co.za/legal/E-mail+Confidentiality+Notice+and+Disclaimer.htm</a>.
Should you not have Web access, send a mail to <a
moz-do-not-send="true" href="mailto:disclaimers@is.co.za"
target="_blank">disclaimers@is.co.za</a> and a copy will be emailed to
you.<br>
______________________________________________________________________________<br>
Member info: <a moz-do-not-send="true"
href="https://lists.balabit.hu/mailman/listinfo/syslog-ng"
target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a moz-do-not-send="true"
href="http://www.balabit.com/support/documentation/?product=syslog-ng"
target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a moz-do-not-send="true"
href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
<br>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
Regards..<br>
Abhay Singh..<br>
91-98804-55587<br>
Sr. Software Engineer.<br>
Robust Designs India Pvt Ltd.<br>
Bangalore<br>
</div>
</div>
<pre><hr size="4" width="90%"><div class="im">
______________________________________________________________________________
Member info: <a moz-do-not-send="true"
href="https://lists.balabit.hu/mailman/listinfo/syslog-ng"
target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a moz-do-not-send="true"
href="http://www.balabit.com/support/documentation/?product=syslog-ng"
target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a moz-do-not-send="true"
href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a>
</div></pre>
</blockquote>
<br>
<br>
<pre cols="72">--
pzolee
</pre>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
Regards..<br>
Abhay Singh..<br>
91-98804-55587<br>
Sr. Software Engineer.<br>
Robust Designs India Pvt Ltd.<br>
Bangalore<br>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
pzolee
</pre>
</body>
</html>