November 2000 - syslog-ng - lists.balabit.hu

Real time .conf?
by Brian Leveille 08 Nov '00

08 Nov '00

What conf settings can I use for my syslog-ng.conf file so that messages are written to disk the instant they are received? Thanks, Brian Leveille ------------------- Senior Internetworking Engineer DefendNet Solutions, Inc. www.defendnet.com

2 1

Re: syslog-ng digest, Vol 1 #293 - 10 msgs
by Emil Obermayr 08 Nov '00

08 Nov '00

> so delimiting the message with spaces should give you the correct results. --- > How do you reliably determine the incoming fields? AFAIK, there is no > RFC nor standard for syslog - it is ad hoc. severities/levels and facilities are two fields for example that the syslogd knows and that are filter-able but so far they are not available in the syslog itself. Especially with the database-solution I have in mind it would be very nice to have them in the output, too. BTW: Did you had a look at the perl-module SyslogScan::SyslogEntry? This one seems to have some nice features that could get included in syslog-ng. I look forward to the futures enhancements and I allready like syslog-ng. Thanks for coding it. -- _/ _/ _/ Emil Obermayr QEDEMOB @ EED/E/P _/ _/ _/ fone +49-5121-707-356 fax: -170 _/ _/ _/ http://www.ericsson.de/ecc/fue/standort.html#hildeshm _/ _/ _/ Ericsson Eurolab Deutschland GmbH, Hildesheim, Germany

1 0

syslog-ng 1.4.8 released
by Balazs Scheidler 07 Nov '00

07 Nov '00

Here's the NEWS entry: News for the 1.4.8 release (11/03/2000) Fixed memory leak in destination files (occured if you had several macro-expanded files) Added some new expansion macros: HOUR, MIN and SEC. Some new global options: time_reap() the number of seconds when an idle destination file is closed use_time_recvd()if you want your date expansion macros to use the received time, instead of the time specified in the log message. Updated documentation to include the changes above. Added contrib subdirectory to include init scripts and config files for various platforms. Scott, this should fix your memory problems. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 2

destination-feature
by Emil Obermayr 07 Nov '00

07 Nov '00

relating to my last question about SQL-output another idea: the destination-function should have an printf-like option so you can format the output the way you like it; specially for the programm-destination it would be nice to have separators for the different fields to let the program handle and process these during runtime with each message. -- _/ _/ _/ Emil Obermayr QEDEMOB @ EED/E/P _/ _/ _/ fone +49-5121-707-356 fax: -170 _/ _/ _/ http://www.ericsson.de/ecc/fue/standort.html#hildeshm _/ _/ _/ Ericsson Eurolab Deutschland GmbH, Hildesheim, Germany

3 3

Re: syslog-g and bsdi
by Balazs Scheidler 07 Nov '00

07 Nov '00

> I was wondering if anyone has a compatible function to replace strptime. > this is a function that is not included in BSDI (4.0+ a least) > if no one has coded a replacement, i would be willing to add another patch > to fix it. > otherwise, you should take off "this has been compiled for bsdi" on the Thanks. you may be interested in the glibc sources, it should have an strptime implementation. I don't know how much it depends on internal libc stuff though. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Hi all,. does anyone know of a compiled RPM for SysLog-NG?
by todd glassey 07 Nov '00

07 Nov '00

I would like to find out if there are any RedHat 6.1 compliant RPM's for Syslog-NG out there. Or does someone have a binary copy that they could send me? Thanks Todd

3 6

RE: [syslog-ng]PTR lookups; leak/crash fixes
by Ohrberg, Mick 07 Nov '00

07 Nov '00

[snip] > But now there is a bunch of extra CPU usage (syslog-ng has accumulated 600 > minutes of CPU time after running for just one day; this is a 333Mhz machine and > there are only a couple dozen logging hosts, most of which comes relayed > through other syslog-ngs anyways). [snip] I keep thinking I'm doing something wrong... I have syslog-ng running on a SUN Ultra 10, and it's been running for 192 days, and I have 700 minutes time and 4.5M size... Of course, I only log from 6 other boxes to it for now. :) Consider this a success story :) I have used syslog-ng to split up incoming logs per facility and priority, so that if I see a message in the crit file, I can go to the corresponding facility file and see if there were any more message. This functionality has come in very handy a few times. :) /Mick

7 23

RE: [OT] distributed UNIX FS layout policy (was Re: [syslog-ng]Hi all,. does anyone know of a compiled RPM for SysLog-NG?)
by Hamilton, Andrew Mr. 07 Nov '00

07 Nov '00

We use /opt but not /pkgs. Most of the software I compile or install is either in /opt, one of the system dirs /usr/sbin, /usr/bin, or in /usr/local. We use pretty much the same set up as you except for /pkgs. /usr/local is auto-mounted, /opt is local to machine. It works out fairly well that way. Regards, Drew Hamilton > -----Original Message----- > From: Scott McDermott [SMTP:mcdermot@questra.com] > Sent: Monday, November 06, 2000 11:57 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [OT] distributed UNIX FS layout policy (was Re: > [syslog-ng]Hi all,. does anyone know of a compiled RPM for SysLog-NG?) > > This is an off-topic post so please delete if you aren't interested. > > > > Whoops, apologies; I meant to send this privately. Please reply to > > > me privately and not the list. > > Guess you didn't see that part. Oh well, I have a question to ask of > the list. > > todd glassey on Mon 6/11 14:04 -0800: > > The /opt/local version will work for me. We use a somewhat Solaris > > mindset in our systems layout. > > I am curious if other admins use /opt/local/ ? Our layout looks like > this: > > /home/ automount NFS homes > > /usr/local/ automount-by-arch for site-wide bin, lib, sbin > and friends > > /opt/ local-to-machine package-type stuff (has own > bin, lib, sbin and friends for each package) > > /opt/local/ local-to-machine single bin, lib, sbin and > friends (would put this in /usr/local/ but since > that is distributed, won't work). > > /pkgs/ identical to /opt/ but distributed and > automounted-by-arch > > I am just curious how other admins lay out their filesystems, I have > never heard of anyone using /opt/local/ or /pkgs/ and was wondering if I > happened to make up stuff that coincided with other admins' thoughts on > the matter? /pkgs/ existed before I was here but /opt/local/ was my > idea. Anyone else use it? > > Oh BTW maybe I can be somewhat on-topic: the central loghost logs to > /var/log/syslog/host/program/year.month.day and exports /var/log/syslog > using an ACL of admin workstations only. This lets us view logs for any > host with nice granularity, from any admin workstation. Wondering how > others do this also? Leave it on central host and login to the machine? > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

SQL destination planned
by Emil Obermayr 06 Nov '00

06 Nov '00

Hi, I just configure syslog_ng for my network and I am up to collect the data in a mysql-database. Are there any plans to include a sql-destination in syslog_ng? If not I will code something. Bye! -- _/ _/ _/ Emil Obermayr QEDEMOB @ EED/E/P _/ _/ _/ fone +49-5121-707-356 fax: -170 _/ _/ _/ http://www.ericsson.de/ecc/fue/standort.html#hildeshm _/ _/ _/ Ericsson Eurolab Deutschland GmbH, Hildesheim, Germany

1 0

Kernel messages
by Erich Reitz 04 Nov '00

04 Nov '00

Hi, I run a RedHat 7 system (just upgraded from 5), and don't understand why my previous configuration of syslog-ng (1.4.7) doesn't log kernel messages with rh7, especially those from the IP Chains Packet log. These messages were logged with syslog, but no longer with syslog-ng: example: Nov 3 08:25:34 machine kernel: Packet log: input DENY eth0 PROTO=17 192.41.21.11:123 21.21.1.2:123 L=76 S=0x10 I=31802 F=0x0000 T=14 (#38) I do run klogd and these messages still show up if I issue a "dmesg" I've tried starting klogd before and after syslog-ng, but that doesn't seem to make a difference. Does anyone have any hints? Thanks. My config file: options { long_hostnames(off); sync(0); time_reopen(10); log_fifo_size(100); }; source src { unix-stream("/dev/log"); internal(); }; destination fw { file("/var/log/firewall"); }; destination ftpd { file("/var/log/ftpd"); }; destination sendmail { file("/var/log/maillog"); }; destination cron { file("/var/log/cron"); }; destination sshd { file("/var/log/sshd"); }; destination all { file("/var/log/ng-log"); }; destination dst { file("/var/log/msgs"); }; filter fw { match("Packet"); }; filter ftpd { program("ftpd"); }; filter sendmail { program("sendmail"); }; filter cron { program("CROND"); }; filter sshd { program("sshd"); }; filter remain { not program("CROND") and not program("ftpd") and not program("sshd") and not program("sendmail") and not match("Packet") ; }; log { source(src); filter(fw); destination(fw); }; log { source(src); filter(ftpd); destination(ftpd); }; log { source(src); filter(cron); destination(cron); }; log { source(src); filter(sshd); destination(sshd); }; log { source(src); filter(sendmail); destination(sendmail); }; log { source(src); filter(remain); destination(all); }; log {source(src); destination(dst); };

2 1