May 2000 - syslog-ng - lists.balabit.hu

A Bug and few sugestions..
by Felix Meulenkamp 26 May '00

26 May '00

Hi... I'm running Syslog-ng 1.4.3 as a loghost and on a workstation behind a gateway... both RedHat 6.1 hmmm problems i've found... '#' seems to work not correctly... i've comment a few things in my syslog-ng.conf... and if the comment was not at the beginning of a line.. i got a parsing error.. '#' seems not to comment out log, source, ... -statements.... if i comment out the destination and filter rule for ppp from the standart debian example syslog-ng.conf .... i got a parsing error... saying something like... ppp was an unresolve identifer... and here my sugestions... what about ...say 'virtual pipes'.... or bracket rules... what i meen is... if you have a logingstatement like this log {source(src1); filter(f_1); source(src2); destination(dst1); }; (this seems to work on my maschine... throu this is not documented) and you now want to filter src2 with another filter.... when filter f_2 will filter both.... and not just the 2nd source... There would be something like a internal pipe helpy... So you define a pipe and use this to curving around the 2nd source and filter... or what would be even better... to create brackets around the 2nd source and filter... so the filter will just afect src2.... customized macros... what about just defining your own macros... say like constants... for example you can define LOGDIR="/var/log"; and then in a destination-rule it will sound like destination warn {file("$LOGDIR/warn");}; ....or just... FNW="not filter(warn);"; but i thing macros an const have to be captalized by definition... Felix... ICQ: 5227897/samon007 PS:Thanxs for writing this great programm...

3 3

Ignoring previously handled/filtered messages
by John Goggan 26 May '00

26 May '00

Hello all. I am new to syslog-ng (today) and have a question. I have looked through all of the documentation that I can find -- as well as scanned the mailing list archives, and cannot find a solution. In fact, I see that Un L'Unique had this same problem last month, and it was partially discussed, but there was no final answer. Basically, it seems that there should be an easy way to make syslog-ng NOT resend messages that have already been sent to some other log. Here is what I am trying to do... I have several daemons (we'll shorten the list to just ftpd and named for this example) that currently send daemon.info messages. I want each application to have its own log file. So, I have tried configuring them like this: destination ftpd { file("/var/log/ftplog"); }; destination named { file("/var/log/namedlog"); }; destination daemon { file("/var/log/daemonlog"); }; filter f_ftpd { program("ftpd"); }; filter f_named { program("named"); }; filter f_daemon { facility(daemon); }; log { source(src); filter(f_ftpd); destination(ftpd); }; log { source(src); filter(f_named); destination(named); }; log { source(src); filter(f_daemon); destination(daemon); }; This makes messages for ftpd go to ftpdlog and for named go to namedlog. The problem is that they still also go to the daemonlog since they are daemon.info messages. What I want is a way to tell syslog-ng that I do NOT want it to also send those to the daemonlog file. It seems that there should be a directive to say "send these to this log ONLY if they haven't already been handled." I did try doing this for the daemon filter: filter f_daemon { facility(daemon) and not filter(f_ftpd) and not filter(f_named); }; ...but this does not work. I still get the ftpd and named messages in daemonlog (as well as ftpdlog and namedlog). This is exactly what Un L'Unique experienced last month when he said that the "not filter" did not appear to be working for him. I get the same behavior -- it does not work for me. This is, however, not even a good system even if it DID work, because then I would have to specific each and ever "not filter" for other daemons that are handled and remember to add them each time I add logging for a new daemon. It would just be so much better if the facility(daemon) could be told to only log daemon messages that were NOT already logged elsewhere. I believe that this can be done (and is the default behavior) in standard syslog. I tried working with the filter(DEFAULT) command, but this also did not seem to do what I wanted since I can't tell it to JUST do it for facility(daemon). Thank you! - John...

4 4

RE: Re [syslog-ng] Ignoring previously handled/filtered messages
by Hamilton, Andrew Mr. 26 May '00

26 May '00

I like the configuration option as well. I would like to be able to duplicate some but not others. Of course we all want as fine a grain of control as we can get. I do all the filtering and parsing and reporting on a considerable amount of log information, and while several places need to see some of the same logs, for the most part only the sysadmins are interested in it. I make the reports I generate from the logs available on the local intranet for whoever is interested, but I don't get to make all of it available. The security people are funny about that. For the stuff I want duplicated I can easily add a second or a third or a ... destination() to a log function and get my duplication that way. Matter of fact I prefer to do this as it gives ME the control over the logging. Anyway just my $.02 worth. Thanks Drew > -----Original Message----- > From: offset [SMTP:offset@privacyx.com] > Sent: Thursday, May 25, 2000 7:31 PM > To: syslog-ng(a)venus.terrasoft.hu > Subject: Re [syslog-ng] Ignoring previously handled/filtered messages > > I like the idea of having syslog messages duplicated. > > In a very large enterprise you have multiple groups wanting access to > the same information. > > System administration is looking for availability related logs > Security administration is looking for security related logs. > Groups above may having overlapping facility and level requirements. > > Such as SysAdmins needing kern.notice for kernel output, and SecAdmins > needing this log to catch Solaris stack executable buffer overflow > attempts. > > If I were in security parsing syslog output, I would not want the system > administration group grabbing all the content with nothing left for the > security administrators to pull from. This is especially true for > environments where system administration and security administration for > a server has been separated into different groups with different > management reporting structures. > > Perhaps as a compromise, a configuration setting in syslog-ng that > controls fall-through. > > -- offset -- > > John Goggan wrote: > > > ger wrote: > > > try > > > filter f_daemon { facility(daemon) and not program(name);}; > > > > > > where "name" is whatever program you're trying to filter out. > > > > Thanks to Ger and Ilya for their responses. While this does work, it > really > > seems like a poor way to do it to me -- and, I believe, is also quite a > bit > > different from the way standard syslog handles things. The problem is > that it > > should just be easy to make it so that messages are handled only ONCE > and then > > not sent to additional logs unless specifically desires. How many > people > > really want the same syslog message sent to multiple logs most of the > time? > > It just seems that the default (which does this) is the opposite of what > most > > would want. > > > > Plus, what needs to be done to get around this just doesn't make any > sense. > > This means that if I want separate logs for imapd, named, telnetd, and > ftpd > > (to name just a few common daemons) -- and I want any other daemons that > pop > > up to still go to a daemon.log, I have to do this in my filter section: > > > > filter f_imapd { program("imapd"); }; > > filter f_named { program("named"); }; > > filter f_telnetd { program("telnetd"); }; > > filter f_ftpd { program("ftpd"); }; > > filter f_auth { facility(auth) > > and not program("imapd") > > and not program("named") > > and not program("telnetd") > > and not program("ftpd"); }; > > filter f_daemon { facility(daemon) > > and not program("imapd") > > and not program("named") > > and not program("telnetd") > > and not program("ftpd"); }; > > filter f_messages { level(info..warn) > > and not facility(auth, authpriv, mail, news); > > and not program("imapd") > > and not program("named") > > and not program("telnetd") > > and not program("ftpd"); }; > > > > That just seems like a really bad design! I have to make sure that I > keep all > > of the names updated in several different locations. If I want to add a > log > > for just one more daemon, I have to add it to at least 3 other filters > besides > > its own filter! > > > > Aren't other people experiencing such problems? Or is no one out there > using > > syslog-ng to filter out specific daemons while still catching the > unlisted > > daemons in a daemon.log file? > > > > There must be a better way... > > > > - John... > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > ---------------------------------------------------------------- > > > > > > > > > > > > > > Link is external to the Privacyx.com System > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re [syslog-ng] Ignoring previously handled/filtered messages
by offset 25 May '00

25 May '00

I like the idea of having syslog messages duplicated. In a very large enterprise you have multiple groups wanting access to the same information. System administration is looking for availability related logs Security administration is looking for security related logs. Groups above may having overlapping facility and level requirements. Such as SysAdmins needing kern.notice for kernel output, and SecAdmins needing this log to catch Solaris stack executable buffer overflow attempts. If I were in security parsing syslog output, I would not want the system administration group grabbing all the content with nothing left for the security administrators to pull from. This is especially true for environments where system administration and security administration for a server has been separated into different groups with different management reporting structures. Perhaps as a compromise, a configuration setting in syslog-ng that controls fall-through. -- offset -- John Goggan wrote: > ger wrote: > > try > > filter f_daemon { facility(daemon) and not program(name);}; > > > > where "name" is whatever program you're trying to filter out. > > Thanks to Ger and Ilya for their responses. While this does work, it really > seems like a poor way to do it to me -- and, I believe, is also quite a bit > different from the way standard syslog handles things. The problem is that it > should just be easy to make it so that messages are handled only ONCE and then > not sent to additional logs unless specifically desires. How many people > really want the same syslog message sent to multiple logs most of the time? > It just seems that the default (which does this) is the opposite of what most > would want. > > Plus, what needs to be done to get around this just doesn't make any sense. > This means that if I want separate logs for imapd, named, telnetd, and ftpd > (to name just a few common daemons) -- and I want any other daemons that pop > up to still go to a daemon.log, I have to do this in my filter section: > > filter f_imapd { program("imapd"); }; > filter f_named { program("named"); }; > filter f_telnetd { program("telnetd"); }; > filter f_ftpd { program("ftpd"); }; > filter f_auth { facility(auth) > and not program("imapd") > and not program("named") > and not program("telnetd") > and not program("ftpd"); }; > filter f_daemon { facility(daemon) > and not program("imapd") > and not program("named") > and not program("telnetd") > and not program("ftpd"); }; > filter f_messages { level(info..warn) > and not facility(auth, authpriv, mail, news); > and not program("imapd") > and not program("named") > and not program("telnetd") > and not program("ftpd"); }; > > That just seems like a really bad design! I have to make sure that I keep all > of the names updated in several different locations. If I want to add a log > for just one more daemon, I have to add it to at least 3 other filters besides > its own filter! > > Aren't other people experiencing such problems? Or is no one out there using > syslog-ng to filter out specific daemons while still catching the unlisted > daemons in a daemon.log file? > > There must be a better way... > > - John... > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > ---------------------------------------------------------------- > > > > > > > Link is external to the Privacyx.com System >

1 0

Newbie Look'en for some Direction...
by Mike Novak 24 May '00

24 May '00

Hey All I have recently started to install syslog-ng on some boxs and am having trouble finding good documentaion.....i was hoping that one of you might be able to point me in a good diriection Thanx Novak

2 1

syslog and "...last message repeated..."
by John A. Parker 23 May '00

23 May '00

A slightly off subject question. I've installed syslog-ng on a central AIX server, setup to receive and process log messages from all of the other servers in our network. In our environment, we want to be able to watch for messages of a common theme that might be coming from disparate systems. As part of the implementation, in addition to simply logging the messages, I have syslog-ng forwarding (through named pipes) all of the messages on to a daemon we've implemented that performs the desired "collection" work. (In addition to lots of other things of course.) My question is this: Is there anyway to stop the distributed syslogd daemons from aggregating messages? Having a message with the string "abcd..." repeated is easy to track, no matter the sourcing system. Having the same message from system "a", followed by some other messages from systems "b"-"z", followed by "...last message repeated 2 times..." from system "a" makes keeping track of message counts very complicated. Thanks in advance! John --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

2 1

Localized datestamps
by Gero Krueger 23 May '00

23 May '00

Hi syslog-ng users/developers ! I've got a linux box running here running the lastest syslog-ng. I'm using the messages syslog-ng generates as input for my project and noticed a strange effect: Some daemons (especially the PAM-library) produce loglines with a localized (here: german) monthname. This is very uncomfortable for my work. How can that happen if syslog-ng generates them ? Does anyone know how to get all datestamps in english ? -- < Gero Krueger | DeTeCSM > < Tel. : +49-541-333-2488 | IVS Osnabrueck > < Fax : +49-541-333-2940 | Hannoversche Str. 6-8 > < mailto: krueger(a)obk.telekom.de | 49084 Osnabrueck >

2 1

Solaris 2.5.1
by Gero Krueger 22 May '00

22 May '00

Hello syslog-ng users/developers ! I've got problems to compile syslog-ng 1.4.3 under solaris 2.5.1 (using gcc 2.95.1): [make...] gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.4.3/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c snprintf.c snprintf.c: In function `dopr': snprintf.c:200: warning: subscript has type `char' snprintf.c:224: warning: subscript has type `char' snprintf.c: In function `snprintf': snprintf.c:715: argument `__builtin_va_alist' doesn't match prototype snprintf.c:95: prototype declaration snprintf.c:715: number of arguments doesn't match prototype snprintf.c:95: prototype declaration make[3]: *** [snprintf.o] Error 1 Any ideas ? -- < Gero Krueger | DeTeCSM > < Tel. : +49-541-333-2488 | IVS Osnabrueck > < Fax : +49-541-333-2940 | Hannoversche Str. 6-8 > < mailto: krueger(a)obk.telekom.de | 49084 Osnabrueck >

2 2

(syslog-ng): unaligned access:
by James Hamilton 22 May '00

22 May '00

I fired up syslog-ng on my alpha OpenBSD 2.6 loghost and got this. I have no what to make of it. I'm running syslog-ng 1.4.3 and libol.0.2.16. Is this a problem, perhaps similar to ger(a)tinet.ie's post earlier this month? pid 4179 (syslog-ng): unaligned access: va=0x140017a5c pc=0x120013be4 ra=0x120013be4 op=stq pid 4179 (syslog-ng): unaligned access: va=0x140017a4c pc=0x120013a38 ra=0x120013a38 op=stq pid 4179 (syslog-ng): unaligned access: va=0x140017a54 pc=0x120013a40 ra=0x120013a40 op=stq pid 4179 (syslog-ng): unaligned access: va=0x140017a4c pc=0x120013a48 ra=0x120013a48 op=ldq pid 4179 (syslog-ng): unaligned access: va=0x140017adc pc=0x120013be4 ra=0x120013be4 op=stq pid 4179 (syslog-ng): unaligned access: va=0x140017acc pc=0x120013a38 ra=0x120013a38 op=stq pid 4179 (syslog-ng): unaligned access: va=0x140017ad4 pc=0x120013a40 ra=0x120013a40 op=stq pid 4179 (syslog-ng): unaligned access: va=0x140017acc pc=0x120013a48 ra=0x120013a48 op=ldq James Hamilton

2 1

Configuring syslog-ng
by Kalusniak, Jeff 19 May '00

19 May '00

Can anyone help??? I can start syslog-ng (1.4.3), but nothing spits out to /var/adm/messages. Thank You! Jeff Kalusniak Goliath Falls Inc.

1 0