September 2000 - syslog-ng - lists.balabit.hu

RE: [syslog-ng][daan@sambal.hobby.nl: syslog-ng on rm/sinix-y]
by Looy.Gert-Jan 25 Sep '00

25 Sep '00

This is what I get on sinix (ReliantUnix v5.43c40) : (and on any version of syslog-ng I've tried) io.c: bind_inet_socket() bind failed 0.0.0.0:9876 Socket operation on non-socket Error initializing configuration, exiting. Where is that libxnet and could it have anything to do with this? The port choosen is definitely not in use by any other program.. Thanks! -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: maandag 25 september 2000 10:55 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng][daan(a)sambal.hobby.nl: syslog-ng on rm/sinix-y] For those trying to run syslog-ng on sinix. As it seems removing the the library libxnet from the makefile fixes network related problems on sinix. ----- Forwarded message from daan <daan(a)sambal.hobby.nl> ----- Date: Sun, 24 Sep 2000 21:39:03 +0200 (MEST) From: daan <daan(a)sambal.hobby.nl> To: Balazs Scheidler <bazsi(a)balabit.hu> Subject: syslog-ng on rm/sinix-y -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I should have reported this back a week ago, sorry. The problem was libxnet. I removed it from the Makefile after running configure in both libol and syslog-ng. It now runs as perfect as could be (to me). I didn't compile in the unix-streams i think, because /dev/log seems quiet. (It is not a sun-stream is it?). Thank you for a great package. :wq! Daan Hoogland v v dhoogland(a)snow.nl OO developers / ### ## ## # >---X---< http://snow.nl # # # # # # # # / Snow B.V. ## # # # # # # # ^ ^ Tel. (+31)418-653333 # # # # # # # # Fax. (+31)418-653666 ### # # ## ## ## -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.1 (GNU/Linux) Comment: For info see http://www.gnupg.org Filter: gpg4pine 4.0 (http://azzie.robotics.net) iD8DBQE5zlhZ8i4+cJqeNIwRAl03AJ9QntcWIK6Y1QLAjsR9thgaIPO+8ACdEIBw 4ZqXSflktFIMsS3918oCY0E= =ukV5 -----END PGP SIGNATURE----- ----- End forwarded message ----- -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

[daan@sambal.hobby.nl: syslog-ng on rm/sinix-y]
by Balazs Scheidler 25 Sep '00

25 Sep '00

For those trying to run syslog-ng on sinix. As it seems removing the the library libxnet from the makefile fixes network related problems on sinix. ----- Forwarded message from daan <daan(a)sambal.hobby.nl> ----- Date: Sun, 24 Sep 2000 21:39:03 +0200 (MEST) From: daan <daan(a)sambal.hobby.nl> To: Balazs Scheidler <bazsi(a)balabit.hu> Subject: syslog-ng on rm/sinix-y -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I should have reported this back a week ago, sorry. The problem was libxnet. I removed it from the Makefile after running configure in both libol and syslog-ng. It now runs as perfect as could be (to me). I didn't compile in the unix-streams i think, because /dev/log seems quiet. (It is not a sun-stream is it?). Thank you for a great package. :wq! Daan Hoogland v v dhoogland(a)snow.nl OO developers / ### ## ## # >---X---< http://snow.nl # # # # # # # # / Snow B.V. ## # # # # # # # ^ ^ Tel. (+31)418-653333 # # # # # # # # Fax. (+31)418-653666 ### # # ## ## ## -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.1 (GNU/Linux) Comment: For info see http://www.gnupg.org Filter: gpg4pine 4.0 (http://azzie.robotics.net) iD8DBQE5zlhZ8i4+cJqeNIwRAl03AJ9QntcWIK6Y1QLAjsR9thgaIPO+8ACdEIBw 4ZqXSflktFIMsS3918oCY0E= =ukV5 -----END PGP SIGNATURE----- ----- End forwarded message ----- -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Syslog-ng , Syslog and routers
by Kleyson Rios 20 Sep '00

20 Sep '00

Hello, I can send messages remotely of the syslog and routers for the syslog-ng ? Kleyson Rios. Brazil.

2 1

Re: [syslog-ng]chain_hostname(yes) complicates use of $HOST variable
by John A. Parker 18 Sep '00

18 Sep '00

On our AIX server, I'm getting a "Parse error reading configuration file, exiting." when I use the keep_hostnames option. This does not happen on our Solaris instance. Any ideas? Thanks! --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

2 4

Re: [syslog-ng]more bugs?
by John A. Parker 15 Sep '00

15 Sep '00

I'm having the same problem detailed by Lawrence with my central AIX syslog-ng server dying when anything happens to a client Sun instance of syslog-ng. In the referenced posting, you mention syslog-ng.1.4.6 and libol.0.2.19 for this problem, but I don't see that version on the http://www.balabit.hu/products/syslog-ng/ page. Should I be looking elsewhere for these packages? Thanks! > The only problem Ive come across (running syslog-ng on 6 servers logging using > tcp to a remote machine). Is that when I kill syslog-ng on my free-bsd machine > the remote machines syslog-ng also dies(linux machine). Not that annoying > though only happens if there is a power cut or I reboot.. try the latest syslog-ng 1.4.6 with libol 0.2.19 --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

3 3

RE: [syslog-ng]chain_hostname(yes) complicates use of $HOST varia ble
by Hamilton, Andrew Mr. 14 Sep '00

14 Sep '00

I use syslog-ng on Solaris 7 but before that I used it on 2.6. I do something very similar to what you are doing in that I log my cisco stuff to local7 as well. I haven't had any problems with it at all. All the cisco stuff goes where it should. I would have to look at the config file to see if there is something wrong there. Your source statement is identical to mine so that seems OK. I don't use chain_hostname() because I don't particularly care where it came through I only want to know where it came from so I use keep_hostname(yes). This keeps only the originating hostname. Hope this helps some. Drew > -----Original Message----- > From: John A. Parker [SMTP:jap54@cornell.edu] > Sent: Thursday, September 14, 2000 12:55 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]chain_hostname(yes) complicates use of $HOST > variable > > Per the extracts from our syslog-ng.conf file shown below, our syslog > server logs messages to machine specific locations based on the sourcing > host name. After turning on the chain_hostnames option, the host name > value in log messages now appear as concatenations of strings. For the > most part they appear similar to: > > aaaa.bbbb.cornell.edu/aaaa.bbbb.cornell.edu > > Messages like the above are still logged correctly. However, we now also > get messages in the formats: > > src@aaaa > > and > > Message/aaaa.bbbb.cornell.edu > last/aaaa.bbbb.cornell.edu > > The first message (src delimited by an ampersand) is logged correctly. > However, the messages prefixed by Message and last are logged to the > directories /logs/machine_specific/Message and > /logs/machine_specific/last. > > Is there a variable other than $HOST I should be using when the > chain_hostnames option is enabled? > > Thanks! > > ########################################################################## > ############# > > options { long_hostnames(off); > use_fqdn(yes); > log_fifo_size(1000); > chain_hostnames(yes); }; > > source src { unix-dgram("/dev/log"); internal(); udp(ip(0.0.0.0) > port(514)); }; > > destination d_all_ms > { > file("/logs/machine_specific/$HOST/all.$LEVEL.$YEAR$MONTH$DAY" > group(systems) perm(0664) dir_perm(0664) create_dirs(yes) > );}; > > # NO CISCO (local7) messages: > filter f_no_cisco { not facility(local7); }; > > # Forward all messages to machine specific log monitored by system admins > log { source(src); > filter(f_no_cisco); > destination(d_all_ms); > }; > > ########################################################################## > ############# > > > > --- > > John A. Parker Senior Programmer/Analyst - AIX Cornell > University > jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

1 0

chain_hostname(yes) complicates use of $HOST variable
by John A. Parker 14 Sep '00

14 Sep '00

Per the extracts from our syslog-ng.conf file shown below, our syslog server logs messages to machine specific locations based on the sourcing host name. After turning on the chain_hostnames option, the host name value in log messages now appear as concatenations of strings. For the most part they appear similar to: aaaa.bbbb.cornell.edu/aaaa.bbbb.cornell.edu Messages like the above are still logged correctly. However, we now also get messages in the formats: src@aaaa and Message/aaaa.bbbb.cornell.edu last/aaaa.bbbb.cornell.edu The first message (src delimited by an ampersand) is logged correctly. However, the messages prefixed by Message and last are logged to the directories /logs/machine_specific/Message and /logs/machine_specific/last. Is there a variable other than $HOST I should be using when the chain_hostnames option is enabled? Thanks! ####################################################################################### options { long_hostnames(off); use_fqdn(yes); log_fifo_size(1000); chain_hostnames(yes); }; source src { unix-dgram("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination d_all_ms { file("/logs/machine_specific/$HOST/all.$LEVEL.$YEAR$MONTH$DAY" group(systems) perm(0664) dir_perm(0664) create_dirs(yes) );}; # NO CISCO (local7) messages: filter f_no_cisco { not facility(local7); }; # Forward all messages to machine specific log monitored by system admins log { source(src); filter(f_no_cisco); destination(d_all_ms); }; ####################################################################################### --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

2 2

Yet another question on filtering
by John A. Parker 13 Sep '00

13 Sep '00

I have yet another filtering question. On an AIX server using the syslog-ng.conf stanzas shown below, the only messages being logged to the d_cisco destination are those I know are coming in under facility local7. However, those same messages are also being logged to the d_all_ms destination which I think I'm filtering out. The filters seems correct and I am successfully using a similar "not" filter elsewhere (for local2 messages). Can anyone explain what I'm doing wrong? Thanks! ####################################################################################### options { long_hostnames(off); use_fqdn(yes); log_fifo_size(1000); chain_hostnames(yes); }; source src { unix-dgram("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination d_all_ms { file("/logs/machine_specific/$HOST/all.$LEVEL.$YEAR$MONTH$DAY" group(systems) perm(0664) dir_perm(0664) create_dirs(yes) );}; destination d_cisco { file("/logs/cisco/cisco.messages" group(systems) perm(0664) );}; # CISCO (local7) messages: filter f_cisco { facility(local7); }; # NO CISCO (local7) messages: filter f_no_cisco { not facility(local7); }; # Forward all messages to machine specific log monitored by system admins log { source(src); filter(f_no_cisco); destination(d_all_ms); }; # Log all messages coming in on local7 facility to /logs/cisco/cisco.messages log { source(src); filter(f_cisco); destination(d_cisco); }; ####################################################################################### --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

1 0

Solaris 2.6 Sources?
by John A. Parker 13 Sep '00

13 Sep '00

I've installed syslog-ng 1.4.5 on a Solaris system and am having trouble "seeing" messages I know are arriving from remote CISCO devices on the local7 facility. (Or even messages via logger -p local7.whatever.) The source statement I have in syslog-ng.conf is: source stdlog { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; (This is as suggested in the INSTALL file provided with the package, except for the addition of the internal clause, the inclusion of which makes no difference in the way syslog-ng is performing.) I have a number of filters, destinations, and log clauses, with some messages "log"ged more than once. (This multiple logging practice seems to work fine on our AIX server.) If I ignore all of the filters and simply log all output to /var/adm/messages, it would appear all messages EXCEPT those coming in on the local7 facility (we're also looking for local0 and local1 messages, but I have not verified any have occurred and that therefore syslog-ng is or is not handling those as well) go to the messages file. Is there something special I should be doing on a Solaris system (a realm WAY outside my experience base) to include local7 logs? Is there a modification to the above source statement that is required for messages from external devices? Thanks! --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

1 0

does not work with klogd
by Torsten Curdt 13 Sep '00

13 Sep '00

I've been using syslogd-ng for quite a while now... like it a lot! Just installed the latest stable version on a new system and now I see a strange behaviour: I installed syslogd-ng. He's logging just fine but then I realized that I don't get any klogd messages!! Not even when klogd comes up! Using the standard syslogd works just fine... Where's the problem? -- Torsten

3 6