December 2000 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]syslog-ng question on filter facility/priority
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 12 Dec '00

12 Dec '00

Yes, you set up a logical filter. filter f_kern.debug { facility(kern) and level(debug); }; filter f_kern { facility(kern) and not level(debug); }; Hope it helps. Regards, Drew > -----Original Message----- > From: Ann Markley [SMTP:amarkley@aventail.com] > Sent: Tuesday, December 12, 2000 12:52 AM > To: 'syslog-ng(a)lists.balabit.hu' > Subject: [syslog-ng]syslog-ng question on filter facility/priority > > I would like to filter out kern.debug info from messages when we HUP > syslog-ng. I have set up a filter: "filter f_kern.debug { not > facility(kern); };" which filters out all kern messages from going to > /var/adm/messages. I set up another filter "filter f_kern { > facility(kern); > };" that logs to destination file /var/log/kern.log" so I can pick up any > kernel messages. Is there a way to set up a filter for facilty(kern) that > will filter out the debug info but still log the higher level messages to > /var/adm/messages? We are running on Solaris 2.6. > > Thanks! > > Ann Markley > Systems Engineer > amarkley(a)aventail.com > > Aventail Corporation > www.aventail.com > > > > Ann Markley > Systems Engineer > amarkley(a)aventail.com > > Aventail Corporation > www.aventail.com > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

syslog-ng question on filter facility/priority
by Ann Markley 11 Dec '00

11 Dec '00

I would like to filter out kern.debug info from messages when we HUP syslog-ng. I have set up a filter: "filter f_kern.debug { not facility(kern); };" which filters out all kern messages from going to /var/adm/messages. I set up another filter "filter f_kern { facility(kern); };" that logs to destination file /var/log/kern.log" so I can pick up any kernel messages. Is there a way to set up a filter for facilty(kern) that will filter out the debug info but still log the higher level messages to /var/adm/messages? We are running on Solaris 2.6. Thanks! Ann Markley Systems Engineer amarkley(a)aventail.com Aventail Corporation www.aventail.com Ann Markley Systems Engineer amarkley(a)aventail.com Aventail Corporation www.aventail.com

1 0

Preventing syslog-ng from halting if a source is not found
by Nick DeClario 11 Dec '00

11 Dec '00

I am having difficulty trying to setup syslog-ng to continue running if a source is not found. Right now I have it scanning /dev/log and /var/chroot/named/dev/log on my Linux system. In some cases the /var/chroot/named/dev/log will not exist on some systems I have here. Is there a way I can setup the configuration file to say if /var/chroot/named/dev/log doesn't exist to simply ignore it and not look for logs there at all? Right now syslog-ng refuses to start if it doesn't exist. -Nick

1 0

Filtering confusion.
by Brian Leveille 08 Dec '00

08 Dec '00

All, I have a config I need help with: I have 2 Linux boxes running syslog-ng behind a Foundry ServerIron load balancing switch, which provides both load sharing and redundancy. The Foundry maintains it's server farm by both pings and actual syslog messages. It does this by sending garbage to the specified UDP port (514). If it receives a 'Port Unavailable' message, the service must no longer be running and the Foundry removes the server from the farm and redirects traffic to available servers. If it receives nothing, it assumes the service must be running and the message was received successfully. My problem is that my syslog-ng receives this message and processes it. My conf dictates that anything coming over udp 514 get written to a $HOST macro and $DATE macro expanded filename. So, I end up with a directory that contains files with garbage messages from the Foundry switch. How do I put a filter in to redirect these garbage test messages? Preferably redirecting them to pipe("/dev/null"). My foundry is called ns-foundry1 in my DNS server and it's IP is 208.3.134.90. The config file below allows the Foundry garbage messages to hit on the second log statement (log { source(src); destination(everything); };), which is bad. Thanks for your help... Here is my config file: options { sync(0); #use_dns(no); create_dirs(yes);}; source foundry { udp(ip("208.3.134.90") port(514)); }; source int { unix-stream("/dev/log"); internal(); }; source src { udp(port(514)); }; destination everything { file("/NetscreenLogs/$HOST/$HOST.$MONTH-$DAY-$YEAR.log" owner(NetscreenLogs) group(NetscreenLogs) perm(0777) dir_perm(0777)); }; filter foundryfilt { host("ns-foundry1"); }; destination void { pipe("/dev/null"); }; destination internallogs { file("/var/log/messages"); }; log { source(foundry); filter(foundryfilt); destination(void); }; log { source(src); destination(everything); }; log { filter(DEFAULT); destination(internallogs); }; Brian Leveille ------------------- Senior Internetworking Engineer DefendNet Solutions, Inc. www.defendnet.com

1 0

Question....
by Sami Saleh 07 Dec '00

07 Dec '00

We're trying to configure syslog-ng to only accept logs from specific servers. Here is the code we've implemented within syslog-ng.conf. options { long_hostnames(off); sync(0); }; source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(192.168.1.20,514); }; However, we get the following error when we start the daemon: parse error at 5 Parse error reading configuration file, exiting. The objective is to only allow certain hosts to log to this server. Any help would be appreciated. Sami

3 4

Host matching
by Brian E. Seppanen 06 Dec '00

06 Dec '00

Ok, my previous message about it not creating the files. Forget it. My host patterns aren't matching, and the macro expansion works just fine. However. I have a couple of hosts that have lengthy names and don't seem to be cooperating. filter router {host("router-2-fe0-1-bb-vl4");}; I've taken exactly what appears in my message files and put it into this filter. However, the filter won't match. Would this be a problem with all of the - characters? I've attempted to escape these characters with \. How can I match these hostnames? Thanks, Brian Seppanen Charter Communications Regional Data Center 906-228-3100 ext 23 Marquette, MI seppy(a)chartermi.net

1 1

Using File Macros.
by Brian E. Seppanen 06 Dec '00

06 Dec '00

Hi: I just got a working config going. I'm trying to set up my config to auto create files based on Priority Level. The files are not being created. What am I missing? These are logs from cisco routers that have been configured to log to this host. source udp_src {udp();}; destination up.cisco { file("/var/log/cisco/up.cisco.$PRIORITY");}; log { source(udp_src); filter(esc7223); filter(imt7206); destination(up.cisco);$ It was working previously with syslog, and I know that I'd get some output immediately. Also does this auto create files? What is the proper way of shutting down the daemon? Will it take -HUP -USR1 or any of the other signals? Thanks for the help. Brian Seppanen Charter Communications Regional Data Center 906-228-3100 ext 23 Marquette, MI seppy(a)chartermi.net

1 0

BSDi strptime function ?
by Bharath Aleti 06 Dec '00

06 Dec '00

Hi Wanted to know if anyone on this list had any success with a function to replace strptime() function for BSDi ? Any inputs (pros and cons) regarding working with syslog-ng on BSDi systems are most welcome. Thanks in advance Bharath Aleti

3 3

TCP based Windows syslog client
by Dan Schleifer 06 Dec '00

06 Dec '00

Howdy Folks, I've been looking at syslog clients for windows, and have not yet found one that can do tcp based logging. Does anyone know of such a program (OpenSource/Commercial/Free Software, doesn't matter)? I'm in the unfortunate situation of needing to log events from about 100 NT machines, and would rather not rely upon UDP... Thank. -Dan -- Dan Schleifer | 804.242.5088 | dan(a)soyjew.com Super Jew

3 2

Encryption?
by Brian E. Seppanen 06 Dec '00

06 Dec '00

Hello: I've started looking into using syslog-ng and it looks very nice. I was curious about the encryption option in the sample config. How is that accomplished? Where would the documentation for that option be? How comparible is syslog-ng to syslog in performance terms? Obviously encryption would increase the load and that is acceptable to a point. Thanks for your assistance. Brian Seppanen Charter Communications Regional Data Center 906-228-3100 ext 23 Marquette, MI seppy(a)chartermi.net

2 1