June 2000 - syslog-ng - lists.balabit.hu

RE: [syslog-ng] Ignoring previously handled/filtered messages
by Ohrberg, Mick 02 Jun '00

02 Jun '00

IMHO, I WANT the messages to go to several logfiles. For instance, I want a message mail.fatal to go to the fatal logfile as well as the mail logfile. This way I can trigger on messages in the fatal logfile, look in the mail logfile and see if there were any messages in from mail that lead up to the fatal situation. However, when you do the same thing loggin to a remote host, this procedure results in four (!) messages being generated. A better way to handle 'double' messages would be very very nice. : -----Original Message----- : From: John Goggan [mailto:jgoggan@dcg.com] : Sent: Wednesday, May 24, 2000 4:46 PM : To: syslog-ng(a)venus.terrasoft.hu : Subject: Re: [syslog-ng] Ignoring previously handled/filtered messages : : : : ger wrote: : > try : > filter f_daemon { facility(daemon) and not program(name);}; : > : > where "name" is whatever program you're trying to filter out. : : Thanks to Ger and Ilya for their responses. While this does : work, it really : seems like a poor way to do it to me -- and, I believe, is : also quite a bit : different from the way standard syslog handles things. The : problem is that it : should just be easy to make it so that messages are handled : only ONCE and then : not sent to additional logs unless specifically desires. How : many people : really want the same syslog message sent to multiple logs : most of the time? : It just seems that the default (which does this) is the : opposite of what most : would want. : : Plus, what needs to be done to get around this just doesn't : make any sense. : This means that if I want separate logs for imapd, named, : telnetd, and ftpd : (to name just a few common daemons) -- and I want any other : daemons that pop : up to still go to a daemon.log, I have to do this in my : filter section: : : filter f_imapd { program("imapd"); }; : filter f_named { program("named"); }; : filter f_telnetd { program("telnetd"); }; : filter f_ftpd { program("ftpd"); }; : filter f_auth { facility(auth) : and not program("imapd") : and not program("named") : and not program("telnetd") : and not program("ftpd"); }; : filter f_daemon { facility(daemon) : and not program("imapd") : and not program("named") : and not program("telnetd") : and not program("ftpd"); }; : filter f_messages { level(info..warn) : and not facility(auth, authpriv, mail, news); : and not program("imapd") : and not program("named") : and not program("telnetd") : and not program("ftpd"); }; : : That just seems like a really bad design! I have to make : sure that I keep all : of the names updated in several different locations. If I : want to add a log : for just one more daemon, I have to add it to at least 3 : other filters besides : its own filter! : : Aren't other people experiencing such problems? Or is no one : out there using : syslog-ng to filter out specific daemons while still catching : the unlisted : daemons in a daemon.log file? : : There must be a better way... : : - John... : : _______________________________________________ : syslog-ng maillist - syslog-ng(a)lists.balabit.hu : http://lists.balabit.hu/mailman/listinfo/syslog-ng :

5 10

Re: [syslog-ng] ipfw logging
by Ilya 02 Jun '00

02 Jun '00

ok i tried /dev/log - no result, same thing - ipfw is not being logged anywhere. i noiced that i am not the only one with this problem. the other person from japan seems to have similar issue. ---------- Original Message ---------------------------------- From: "Ilya" <maillist(a)krel.org> Reply-To: syslog-ng(a)venus.terrasoft.hu Date: Wed, 31 May 2000 01:36:19 -0400 >I am running on Freebsd 4.0 stable. >i just kept it the way documentation and examples have it and had no problem >except with ipfw

4 4

FW: Newbie...still ty'en
by Mike Novak 01 Jun '00

01 Jun '00

opps sorry did not mean to waste your guys time... Balazs just anwsered my ?..a couple of e-mails ago Thanks Novak > -----Original Message----- > From: Mike Novak > Sent: Thursday, June 01, 2000 10:10 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Newbie...still ty'en > > i have set up syslog-ng on solaris, > and have a stupid ? about destanations > > do i need to create the files in /var/log > > eg.. > > destination security { file("/var/log/security"); }; > > do i need to create the file security... > if so how do i chown it to other? > messages, is owned by other > > > sorry for the trouble i would love any help > Novak

1 0

Newbie...still ty'en
by Mike Novak 01 Jun '00

01 Jun '00

i have set up syslog-ng on solaris, and have a stupid ? about destanations do i need to create the files in /var/log eg.. destination security { file("/var/log/security"); }; do i need to create the file security... if so how do i chown it to other? messages, is owned by other sorry for the trouble i would love any help Novak

1 0