October 2000 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]Solaris
by Ohrberg, Mick 26 Oct '00

26 Oct '00

Sounds to me like you've just left out the internal() statement in the source section. /Mick > -----Original Message----- > From: kleyson.rios [mailto:kleyson.rios@bol.com.br] > Sent: Thursday, October 26, 2000 1:19 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Solaris > > > The syslog-ng no this playing the > messages for logs, and the following > message appears when start syslog-ng : > > "Internal messages are not referenced, > they'll go to /dev/null" > > what I must make ? > > My System is Solaris 2.8 Intel > > > ______________________________________________________________ > ____________ > Todo brasileiro tem direito a um e-mail grátis > http://www.bol.com.br > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

Solaris
by kleyson.rios 26 Oct '00

26 Oct '00

The syslog-ng no this playing the messages for logs, and the following message appears when start syslog-ng : "Internal messages are not referenced, they'll go to /dev/null" what I must make ? My System is Solaris 2.8 Intel __________________________________________________________________________ Todo brasileiro tem direito a um e-mail grátis http://www.bol.com.br

1 0

RE: [syslog-ng]/var/adm/messages
by Ohrberg, Mick 25 Oct '00

25 Oct '00

> I use this source on the 5.6 systems [snip] > sun-streams("/dev/log" door("/etc/.syslog_door") ); [snip] > and this one on 5.8 systems [snip] > sun-streams("/dev/log" door("/var/run/syslog_door") ); What's the difference between these two files? I use /etc/.syslog_door on my 5.8 system. /Mick

1 0

RE: [syslog-ng]/var/adm/messages
by Russell Street 25 Oct '00

25 Oct '00

You need to add the syslog door to the source list. I use this source on the 5.6 systems source local { sun-streams("/dev/log" door("/etc/.syslog_door") ); internal(); udp(ip(0.0.0.0) port(514) ); }; and this one on 5.8 systems source local { sun-streams("/dev/log" door("/var/run/syslog_door") ); internal(); udp(); }; The cluster messages go to the local0 facility by default. The switch over messages come out as local0.err. It is a really good idea to replicate the cluster messages to a local file and to the console. If you have a public network failure and the cluster reconfigures the messages will be lost. Russell -----Original Message----- From: Franco Cucchi [mailto:franco.cucchi@db.com] Sent: Thursday, 26 October 2000 5:16 a.m. To: syslog-ng(a)lists.balabit.hu Cc: Manuela Burzoni Subject: [syslog-ng]/var/adm/messages Hi all, I installed the syslog-ng on two SUN machines those are in cluster. The messages generated by the machines those refer to the cluster software are stored in the /var/adm/messages file. In this file it's possible to find the 12 steps sequence of messages generated when the logical host switches from a machine to another due to a failure or a forced takeover. I would like to know if the syslog-ng, with is config file reported below, redirects ALL messages generated (I mean also the log from cluster software) to the machine I use as loghost and not permit the file /var/adm/messages to be written as normal. Any advice or correction welcome. Thanks all Franco # this file show more or less all the features of syslog-ng options { sync(0); time_reopen(10); log_fifo_size(100); }; source direct { sun-stream("/dev/log"); internal();}; source tngsrc { file ("/var/adm/sulog");}; destination loghost { tcp("10.138.xxx.xxx" port (516)); }; destination tngdest { pipe("/usr/tngem/opr/config/dbf1/pipe/oprpipe0009"); }; log { source (direct); destination (loghost); }; log { source (direct); destination (tngdest); }; -- Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet. This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

/var/adm/messages
by Franco Cucchi 25 Oct '00

25 Oct '00

Hi all, I installed the syslog-ng on two SUN machines those are in cluster. The messages generated by the machines those refer to the cluster software are stored in the /var/adm/messages file. In this file it's possible to find the 12 steps sequence of messages generated when the logical host switches from a machine to another due to a failure or a forced takeover. I would like to know if the syslog-ng, with is config file reported below, redirects ALL messages generated (I mean also the log from cluster software) to the machine I use as loghost and not permit the file /var/adm/messages to be written as normal. Any advice or correction welcome. Thanks all Franco # this file show more or less all the features of syslog-ng options { sync(0); time_reopen(10); log_fifo_size(100); }; source direct { sun-stream("/dev/log"); internal();}; source tngsrc { file ("/var/adm/sulog");}; destination loghost { tcp("10.138.xxx.xxx" port (516)); }; destination tngdest { pipe("/usr/tngem/opr/config/dbf1/pipe/oprpipe0009"); }; log { source (direct); destination (loghost); }; log { source (direct); destination (tngdest); }; -- Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet. This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

1 0

Re: [syslog-ng]Buffering to a program.
by John A. Parker 24 Oct '00

24 Oct '00

Mahlon, >My eventual goal is to have one 'logging server', receiving logs from all >of the other servers around here, and parsing/pushing them into a mysql >database. We've implemented basically the same topology here, but instead of "mysql"ing the messages we're parsing and monitoring the lot of them looking for those (repeated login failures within or across system(s), etc..) which might concern us. What we did was write all messages to named pipes, one for each priority level. We made our perl script a daemon which reads the messages out of the named pipes. One of the perceived advantages here was that all buffering is provided by the OS. Our central server (AIX) comfortably supports over 50 disparate clients (AIX, Sun, NT) and handles an average of 310000 messages a day. (We had an anomalous day two weeks ago with 800000 messages with no observed problems.) The only significant disadvantage we've encountered is that our daemon has to be running before syslog-ng is started, this due to syslog-ng rightfully failing to startup if the named pipes are not open, something our daemon does. Good luck, John

1 0

syslog-ng dying on hup
by nija＠magicaldesk.com 23 Oct '00

23 Oct '00

Hello, I am having a small problemm with syslog-ng. About every third time I hup syslog-ng, it dies. I can start it again immediately, but I am curious why it is dying. I have included the conf file. Any ideas? Thank you # Configuration file for server side syslog-ng ################################################ #################################### # Global options used by syslog-ng #################################### options { time_reopen ( 0 ); sync ( 0 ); chain_hostnames ( no ); use_dns ( yes ); use_fqdn ( yes ); }; ########################################### # Global Source statments for the program ########################################### source src { sun-streams( "/dev/log" door( "/etc/.syslog_door" )); internal ( ); tcp ( max-connections(1000) ); udp ( ); }; destination all_messages { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/all-messages" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_messages2 { pipe("/var/adm/nco" );}; destination all_program { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/$PROGRAM" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_facility { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/$FACILITY" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_priority { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/$PRIORITY" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_host { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/messages" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_only_program { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/program/$PROGRAM" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_only_priority { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/priority/$PRIORITY" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_only_facility { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/facility/$FACILITY" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_fac_pri { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/facility/$FACILITY.$PRIORITY" create_dirs(yes) perm(755) dir_perm(755) );}; log { source( src ); destination( all_messages );}; log { source( src ); destination( all_messages2 );}; log { source( src ); destination( all_program );}; log { source( src ); destination( all_facility );}; log { source( src ); destination( all_priority );}; log { source( src ); destination( all_host );}; log { source( src ); destination( all_only_program );}; log { source( src ); destination( all_only_priority );}; log { source( src ); destination( all_only_facility );}; log { source( src ); destination( all_fac_pri );}; _____________________________________________________________ Global Virtual Desktop Get your free Desktop at http://www.magicaldesk.com

1 0

Re: syslog-ng vs (of all things) Win2k + IIS
by wolfgang.braun＠gmx.de 21 Oct '00

21 Oct '00

Some thoughts to this. I refer to the machine collecting logs as server, the machines writing logs to it as clients. 1) TCP Connections syslog-ng uses persistent connections to clients logging to the server. It has been argued that TCP has some overhead over UDP. Now imagine you have 300 clients logging to your web server/CGI. Using HTTP you have to create a new connection every time a client wants to write logs to your server. If persistent TCP has _some_ overhead, this can only be called *huge* 2) Calling CGI Every time you want to log to the server it has to exec your CGI. 300 clients logging simultaneously, each forcing the server to exec the CGI over and over again. There's a reason people came up with ASP, PHP, embedded <script> and servlets: overhead in loading, linking and executing the called program. It get's even worse when you're using an interpreted language, since then every time the interpreter has to be loaded again. 3) File handling syslog opens local files once, keeps the fd and flushes its message queues from time to time. With CGI you have to open,write,close your files everytime a client delivers his logs. 4) Managing logs on the server with generic syslog you have some liberty to define which logs get written to which file, based on priority, facility or even regexps. on the opposit you're very limited on where you write to. if you let each instance of your CGI write to a file i imagine it could get a bit messy. Even if you build a system as proposed (HTTP+CGI), and the server can handle all that overhead the question remains if your homegrown system proves to be anywhere near as reliable as a piece of software that has been specifically designed for the task. -- Those who do not understand Unix are condemned to reinvent it, poorly. -- Henry Spencer

1 0

RE: [syslog-ng]global options problems on Solaris 7/sparc
by Tom Wells 21 Oct '00

21 Oct '00

> -----Original Message----- > From: Chris Scheller [mailto:schelcj@pobox.com] > > > perm(0600); > > dir_perm(0755); > someone correct me if i am wrong, but the perm options > belong in your > destination statement. here is an example from my conf > > destination d_faci { > file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$FACILITY" > perm(0600)); > }; There should be some globals..... It sucks to have to list the same things 30 times, both for local and remote destinations (on this loghost, anyways). Why can't there be a options { files (owner(root) group(root) perm(0640) dir_perm(0755)); }; as a global option???? It would sure help to keep things a tad bit simpler and cleaner..... Tom

1 0

global options problems on Solaris 7/sparc
by Tom Wells 21 Oct '00

21 Oct '00

Hi, I'm putting the following items in the global options section, but syslog-ng keeps complaining about parse errors in my config file, specifically the "owner", "group", "perm", and "dir_perm" options. I'm running libol-0.2.20 and syslog-ng.1.4.7, though it happened with libol-0.2.19 and syslog-ng.1.4.5 as well: ############################# # options ############################# options { use_dns(yes); use_fqdn(no); long_hostnames(off); sync(0); create_dirs(yes); owner(0); group(1); perm(0600); dir_perm(0755); }; Any help would be most appreciated. Tom -- Tom Wells Raza Foundries, Inc. email: twells(a)razafoundries.com Sr. Systems Administrator phone: 408-434-5544

2 1