Hello,<br><br>I am trying to "read" a log stream from interface eth0 and to save it in a file (/var/log/messages_tcp). I am newbie on the use of syslog-ng but I try to learn reading the official manual and a lot of configuration examples. Although, I have try a lot of different configurations, the result is always the same : Syslog-ng cannot read the streaming data. I hope that you can help me.<br>
<br>That's the version of syslog-ng that I use:<br><br><i>~# /usr/local/syslog-ng/sbin/syslog-ng -V<br>syslog-ng 3.2.4<br>Installer-Version: 3.2.4<br>Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6<br>
Compile-Date: Sep 6 2012 14:36:19<br>Enable-Threads: off<br>Enable-Debug: off<br>Enable-GProf: off<br>Enable-Memtrace: off<br>Enable-Sun-STREAMS: off<br>Enable-IPv6: on<br>Enable-Spoof-Source: on<br>Enable-TCP-Wrapper: off<br>
Enable-SSL: on<br>Enable-SQL: off<br>Enable-Linux-Caps: on<br>Enable-Pcre: on<br>Enable-Pacct: off</i><br><br>There is an incoming log stream in eth0 (udp), as you can see next :<br><br><i>~# tcpdump -i eth0 udp 'port 514' -v<br>
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes<br>06:05:58.669992 IP (tos 0x0, ttl 254, id 20209, offset 0, flags [none], proto UDP (17), length 82)<br> 172.29.1.6.syslog-ng > 172.30.6.70.syslog-ng: SYSLOG, length: 54<br>
Facility local4 (20), Severity debug (7)<br> Msg: %ASA-7-609001: Built local-host WAN:172.30.254.4\0x0a<br>06:05:58.670134 IP (tos 0x0, ttl 254, id 52, offset 0, flags [none], proto UDP (17), length 85)<br> 172.29.1.6.syslog-ng > 172.30.6.70.syslog-ng: SYSLOG, length: 57<br>
Facility local4 (20), Severity debug (7)<br> Msg: %ASA-7-609001: Built local-host outside:172.26.10.4\0x0a<br>………..</i><br><br><br>The syslog-ng.conf that I use is the following:<br><i><br>@version: 3.2<br><br>options {<br>
chain_hostnames(off);<br> long_hostnames(off);<br> use_dns(no); # We don't want DNS names, IP's only.<br> flush_lines(0);<br> stats_freq(43200);<br> time_reopen(10);<br>
};<br><br>source s_network {<br><br># tcp(ip("172.30.6.70") port(514));<br># udp(ip("172.30.6.70") port(514));<br># syslog(<br># flags(no-multi-line)<br># ip(172.30.6.70)<br>
# keep-alive(yes)<br># keep_hostname(yes) <br># transport(udp)<br># TLS Options<br># tls()<br># );<br>
<br> tcp();<br> udp();<br>};<br><br>destination d_tcp {<br> file("/var/log/messages_tcp" owner("root") group("adm") perm(0640));<br>};<br><br>log {<br> source(s_network);<br>
destination(d_tcp);<br>};<br></i><br><br>When I start syslog-ng in debug mode (syslog-ng -Fevd) the results are the followings:<br><br><i>~# /usr/local/syslog-ng/sbin/syslog-ng -Fevdt<br>Trying to open module; module='syslogformat', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libsyslogformat.so'<br>
Trying to open module; module='basicfuncs', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libbasicfuncs.so'<br>Trying to open module; module='afsocket', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libafsocket.so'<br>
Trying to open module; module='affile', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libaffile.so'<br>Trying to open module; module='afprog', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libafprog.so'<br>
Trying to open module; module='afuser', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libafuser.so'<br>Trying to open module; module='dbparser', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libdbparser.so'<br>
Trying to open module; module='csvparser', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libcsvparser.so'<br>Running application hooks; hook='1'<br>Running application hooks; hook='3'<br>
syslog-ng starting up; version='3.2.4'<br>^CTermination requested via signal, terminating;<br>syslog-ng shutting down; version='3.2.4'<br>Closing log transport fd; fd='6'<br>Running application hooks; hook='4'</i><br>
<br>As you can see there is no "Incoming log entry..:" line. I pressed Ctrl+C for the termination of program.<br><br><br>Also listening to the network interface seems to be right:<br><br><i>~# netstat -tanpu | grep syslog<br>
tcp 0 0 <a href="http://0.0.0.0:514">0.0.0.0:514</a> 0.0.0.0:* LISTEN 25950/syslog-ng <br>udp 0 0 <a href="http://0.0.0.0:514">0.0.0.0:514</a> 0.0.0.0:* 25950/syslog-ng <br>
</i><br><br>Please, can anyone help me with this problem? I don't know what could be <br>blocking the packets, if it is because of the OS or because of syslog-ng <br>configuration.What could it be wrong? I am waiting for your response.<br>
<br>PS. Sorry for my "bad" English.<br><br>Thanks is advance,<br>Alex<br>