December 2000 - syslog-ng - lists.balabit.hu

Syslog-ng adds unwanted entries to my logs...
by Matt Mencel 19 Dec '00

19 Dec '00

Let me try this again. Sorry for inconveniencing you all with multiple emails last night. I have several servers logging to one central server through a firewall. No big deal. However the central logging server is adding entries to the beginning of each line of each log. This is great for most of the logs as it lets me know where each entry came from. In the case of my web and ftp logs however this information is unnecessary and prevents Analog and Webalizer from parsing through the logs correctly. Here's an example from my httpd-access log on my logging server. Dec 19 08:22:28 otherserver root: www.somewebpage.com 123.123.123.123 - - [19/Dec/2000:08:22:28 -0600] "GET /index.html HTTP/1.1" 200 2026 http://www.somewebpage.com/ "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)" The stuff it adds, and that I don't want is everything up to the first entry of the virtualserver. In this case, www.somewebpage.com. So "Dec 19 08:22:28 otherserver root:" needs to be tossed out somehow. Is anyone else doing this or is it not possible to tell syslog-ng not to add these entries? Thanks for any help. Matt mmatt(a)freew3.com

2 1

Re: syslog-ng question on filter facility/priority
by Balazs Scheidler 19 Dec '00

19 Dec '00

> I would like to filter out kern.debug info from messages when we HUP > syslog-ng. I have set up a filter: "filter f_kern.debug { not > facility(kern); };" which filters out all kern messages from going to > /var/adm/messages. I set up another filter "filter f_kern { facility(kern); > };" that logs to destination file /var/log/kern.log" so I can pick up any > other kernel messages. Is there a way to set up a filter for facilty(kern) > that will filter out the debug info but still log the higher level messages > to /var/adm/messages? We are running on Solaris 2.6. filter f_kern { facility(kern) and not level(debug); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

3 3

Can I prevent syslog-ng from prepending logs from other servers?
by Matt Mencel 18 Dec '00

18 Dec '00

I am recieving web and ftp logs from another machine on my central logging machine. Syslog-ng prepends the logs with a bunch of information that I don't need and it prevents Analog and Webalizer from parsing the logs correctly. Is there a way to tell syslog-ng not to prepend this information to certain logs? Thanks. Matt mmatt(a)freew3.com

1 0

RE: [syslog-ng]filter(DEFAULT)
by Andrew Fort 18 Dec '00

18 Dec '00

> So it will have the opposite affect of what I wanted then... anything > that matches host1 will set match=1 and DEFAULT won't match. Heh, > somehow I find it amusing that my logic was completely backwards. Or > maybe I'm up too late. :-) Correct :) Your rules have two filter statements, it's only the filter(host1); and not the filter(DEFAULT); which is causing any action. -- afort

5 4

"Macros"
by Ohrberg, Mick 15 Dec '00

15 Dec '00

Gentlemen, I am trying to call external programs with syslog-ng and I would like to know if there's a complete list of macros (such as $PROGRAM, $HOST) out there somewhere. I have a piece of software that I want to trigger on certain conditions (host, type of message etc), and I would like to be able to pass these values as arguments in the program("...")-statement. Thanks in advance! Regards, -- Mick Öhrberg Open Systems Administrator, UMB Bank n.a [NYSE:FGP] Ph: (816)860-1064 Fax: (816)860-3934 PGP: http://www.worldinter.net/~aoao/PGP/pub.key.asc

2 1

File Creation Permissions
by Brian E. Seppanen 14 Dec '00

14 Dec '00

I've set up syslog-ng to create certain files with very specific permissions such as destination tvc.cisco { file("/var/log/cisco/tvc-cisco.$PRIORITY" owner("admin") group("apache") perm(0640));}; files are created with permissions 0600. What am I missing? Thanks, Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

2 1

RE: [syslog-ng]facility numbers
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 14 Dec '00

14 Dec '00

I'm not sure about the 9-14 codes but you can overload the other facilities. If you have them come in as different programs you can do something like this: filter f_prog1 { program("prog1") and facility(local1); }; filter f_prog2 { program("prog2") and facility(local1); }; I do this all the time and it works great. Regards, Drew > -----Original Message----- > From: Wendell Turner [SMTP:wturner@halcyon.com] > Sent: Wednesday, December 13, 2000 10:51 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]facility numbers > > > Sirs, > > Some questions about facilities and priorities: > > 1) I see from the stock sys/syslog.h file there is: > > #define LOG_UUCP (8<<3) /* uucp subsystem */ > #define LOG_CRON (15<<3) /* cron/at subsystem */ > /* other codes through 15 reserved for system use */ > > Have facility codes 9-14 ever been used? How could I use them for > my own logging? Would that interfere with any 'standard' syslog > functions? (I've already used the LOCAL0-7 ones, I would like > more.) The sl_facilities table in syslog-names.c doesn't seem to > allow for those in filters. > > 2) If that doesn't work, would it be proper to overload the stock > 0-8 items with my own? Would that 'confuse' any other logging > tools, or is it just a number used in the filtering? > > Thank you, > > Wendell Turner > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

facility numbers
by Wendell Turner 13 Dec '00

13 Dec '00

Sirs, Some questions about facilities and priorities: 1) I see from the stock sys/syslog.h file there is: #define LOG_UUCP (8<<3) /* uucp subsystem */ #define LOG_CRON (15<<3) /* cron/at subsystem */ /* other codes through 15 reserved for system use */ Have facility codes 9-14 ever been used? How could I use them for my own logging? Would that interfere with any 'standard' syslog functions? (I've already used the LOCAL0-7 ones, I would like more.) The sl_facilities table in syslog-names.c doesn't seem to allow for those in filters. 2) If that doesn't work, would it be proper to overload the stock 0-8 items with my own? Would that 'confuse' any other logging tools, or is it just a number used in the filtering? Thank you, Wendell Turner

1 0

RE: [syslog-ng]filter(DEFAULT)
by Andrew Fort 13 Dec '00

13 Dec '00

> What I have tried to do is log each service to its own file. At the > very bottom of the conf file I put: > > log { source(src); filter(f_host1); filter(DEFAULT); > destination(host1_messages); }; > etc. for host2 and host3 > > and finally another log line with ONLY filter(DEFAULT) for things that > don't get matched at all (which should never happen). > > However, what I am seeing appears to be that my host() > filters are being > ignored when using the DEFAULT filter with it. In other words, > unmatched log entries for host2 and host3 are appearing in > host1_messages. > > Is that correct behavior? It's the documented behaviour. Currently, I dont think syslog-ng can do "anything not already caught for this host" type filters; it's filtering logic is a little bit simpler than this.. The filter patch suggested for 1.5.0 (development release) forces the filters to be evaluated in the order they appear in the file, but essentially the logic is: - For each log line, match what is in the filter statement. If we get a hit, set the "match" flag. - Repeat for all futher filters (so multiple filters cause multiple matches, but match still =1). - When syslog-ng tests the "DEFAULT" filter, it only performs its action if match=0. This allows multiple filters to match out to multiple locations (useful), but doesn't allow the (arguably) also useful feature of excluding particular things as we go. I hope I got this right, I hope I'm close (this is the bit of syslog-ng i've been studying lately :) -- afort

2 1

filter(DEFAULT)
by William Yodlowsky 13 Dec '00

13 Dec '00

Hi, I'm sure I'm missing something... running 1.4.10 with libol-0.2.20 I setup some host filters like this: filter f_host1 { host("host1"); }; filter f_host2 { host("host2"); }; etc. Setup some service filters using match() ...and have several log statements for each host. What I have tried to do is log each service to its own file. At the very bottom of the conf file I put: log { source(src); filter(f_host1); filter(DEFAULT); destination(host1_messages); }; etc. for host2 and host3 and finally another log line with ONLY filter(DEFAULT) for things that don't get matched at all (which should never happen). However, what I am seeing appears to be that my host() filters are being ignored when using the DEFAULT filter with it. In other words, unmatched log entries for host2 and host3 are appearing in host1_messages. Is that correct behavior? Thanks in advance.

1 0