January 2001 - syslog-ng - lists.balabit.hu

Dropping entries.
by Scott A. McIntyre 26 Jan '01

26 Jan '01

Hi, I'm trying to use syslog-ng as a syslog sink for a number of boxes, but I've found that something in the chain is dropping some number of the syslog events. Specifically, I've got 10 mail servers all logging their sendmail's into one file on the syslog sink -- much easier to parse this way. Unfortunately, I've discovered that a number of entries were logged on the local box were dropped somewhere on their way to the Big Log file on the syslog-ng machine. Is there anything I can try to make sure this doesn't happen? Any options I can tweak, that sort of thing. Would logging to individual files on a host by host basis be better, coupled with sylog-ng monitoring those local files to concatenate them all into one larger file? It may very well be a case of UDP getting lost on a busy network, but I'd like to do everything I can on the syslog-ng side first. Thanks, Scott

2 1

Filter Problem
by John A. Parker 26 Jan '01

26 Jan '01

My intent with the following filter, etc. is to exclude messages coming in from facility local7 from being logged to /var/adm/messages. It does not seem to work as those messages are making it there. Can anyone spot what might be wrong with the filter/destination/log stanza(s)? filter f_var_adm { level(emerg,alert,crit,err) or ( facility(kern) and level(debug) ) or ( facility(daemon) and level(notice) ) or ( facility(local2) and level(notice) ) or ( facility(auth) and level(notice,info) ) or ( facility(mail) and level(crit) ) and not ( facility(local7) ); }; destination d_var_adm { file("/var/adm/messages"); }; # Log all messages conforming to the f_var_adm filter to /var/adm/messages log { source(stdlog); filter(f_var_adm); destination(d_var_adm); };

1 0

RE: [syslog-ng]help w/config script
by Ohrberg, Mick 24 Jan '01

24 Jan '01

> I am trying to compile the following script on a Solaris Machine running > Solaris 7...I'm using Syslog-ng 1.4.10....I keep getting an error message > that reads unexpected token on the options line...which I do not understand > since I just copied the 1st part of the script from the default script > included with Syslog-ng... [snip] Arthur, I don't believe you want blanks between e.g 'sync' and '(0)', i.e you want to make it sync(0); instead of sync (0); /Mick

1 0

help w/config script
by Arthur Abrego 24 Jan '01

24 Jan '01

I am trying to compile the following script on a Solaris Machine running Solaris 7...I'm using Syslog-ng 1.4.10....I keep getting an error message that reads unexpected token on the options line...which I do not understand since I just copied the 1st part of the script from the default script included with Syslog-ng... options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_net { tcp (ip(116.214.36.59) port(514)); }; destination d_kern { file("/var/log/syslog"); }; destination d_auth { file("/var/log/syslog"); }; destination d_user { file("/var/log/syslog"): }; destination d_daemon { file("/var/log/syslog"); }; destination d_cons { file("/dev/console") ; }; destination d_mesg { file("/var/adm/messages"); }; destination d_cron { file("/var/log/varlog"); }; destination d_local { file("/var/log"); }; destination d_mlop { usertty("operator"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; destination d_midget { tcp("216.141.36.59" port(514)); }; filter f_filter1 { level(emerg) or level(alert) or level(crit) or level(err)or (level(debug) or level(warning) or level(info)) }; filter f_filter2 { level(emerg) or level(alert) or level(warning) or (level(err) or level(crit)); }; filter f_filter3 { level(emerg) or level(alert) or level(warning) or (level(err) or level(crit) or level(debug)); }; filter f_filter4 { level(alert); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(kern) and level(notice); }; filter f_filter7 { facility(mail) and level(debug); }; filter f_filter8 { facility(user) and level(err); }; filter f_filter9 { facility(user) and level(alert); }; log { source(s_sys); filter(f_filter1); destination(d_kern); }; log { source(s_sys); filter(f_filter2); destination(d_auth); }; log { source(s_sys); filter(f_filter3); destination(d_daemon);}; log { source(s_sys); filter(f_filter4); destination(d_daemon);}; log { source(s_sys); filter(f_filter5); destination(d_daemon);}; log { source(s_sys); filter(f_filter6); destination(d_daemon);}; log { source(s_sys); filter(f_filter7); destination(d_daemon);}; log { source(s_sys); filter(f_filter8); destination(d_daemon);}; log { source(s_sys); filter(f_filter9); destination(d_daemon);}; log { source(s_sys); filter (DEFAULT); destination(d_midget); }; -- Arthur Abrego aabrego(a)onebox.com - email (512) 682-6934 x5113 - voicemail/fax __________________________________________________ FREE voicemail, email, and fax...all in one place. Sign Up Now! http://www.onebox.com

1 0

Re: [syslog-ng]sync question, feature request
by Thierry Besancon 22 Jan '01

22 Jan '01

Dixit Gregor Binder <gbinder(a)sysfive.com> (le Thu, 11 Jan 2001 17:05:03 +0100) : » > Nevertheless, I'm not sure that is really what you (and I) want. In my » > example, it creates files with the *dates of the syslog messages* what » > is different from the date of the day they are received. In my case, » > it seems I have syslog clients with unsynchronized clocks and I » > already have messages-20010704 for example (4th july 2001 !). » » I have requested the feature to change this behaviour some time ago, and » Balasz made it come true shortly after, it's an option. use_time_recvd() » boolean. It is not yet documented... But the source of course mention it. Thierry

4 4

program trouble
by Robert Andersson 22 Jan '01

22 Jan '01

Hi all! I have a problem with the program destination when having the following in my syslog-ng.conf file ###start options { long_hostnames(off); sync(0); }; source src { unix-stream("/dev/log"); internal(); }; destination dhcp { program("script-program"); }; filter f_dhcp { program("dhclient"); }; log { source(src); filter(f_dhcp); destination(dhcp); }; ###stop it will run the script-program once when reloading syslog-ng not when matching the filter. Though, if I alter the destination line to ### start destination dhcp { file("/var/log/dummy"); }; ### stop it will output (as I thought and like :) to this dummy log everytime it matches the filter, not once when reloading syslog-ng. I would like my first destination file to behave in a similar manner, that is when doing a program destination it should run the script each time it matches the filter. Is it just me or is something else? Been trying to find it for hours now, searching through this mailing lists archive, searching the docs... but without success. I really hope you can help me out here. Ooops forgot my setup is syslog-ng version 1.4.10 debian 2.2r2 sparc on a sparc station 10 (40MHz wee! :) Yours, /Robert -- Computational Linguistics Department of Linguistics Göteborg University

2 2

Re: [syslog-ng]program trouble
by Wendell Turner 22 Jan '01

22 Jan '01

> I have a problem with the program destination when having the > following in my syslog-ng.conf file > > destination dhcp { program("script-program"); }; > > it will run the script-program once when reloading syslog-ng > not when matching the filter. I've been using a C program rather than a script. It seems that syslog-ng loads the program once, and sends input to it whenever the filter matches. That is, the C program must while ((r = read(0, buffer, Buf_Len)) > 0) { process input } I suppose your script would need to do the same thing. Wendell Turner

1 0

hostnames matching problem still unsolved
by Keith McDuffee 19 Jan '01

19 Jan '01

I posted this last month but I'm still surprised nobody else has run into this problem, so I'm giving it one more shot: One problem I've found after installing syslog-ng 1.4.10 on a Solaris 2.6 system is with repeating messages, especially those originating from remote hosts. For example, here's some lines from my config file: ---- source s_udp { udp(); }; destination d_udp { file("/var/log/remote/$HOST.$FACILITY"); }; filter f_udp { level(notice) or (facility(local0) and level(info)) or (facility(local1) and level(info)) or (facility(local2) and level(info)); }; log ( source(s_udp); filter(f_udp); destination(d_udp); }; ---- Using this configuration, I get files in /var/log/remote that look like this: hostname1.local0 hostname2.local2 hostname1.auth last.local2 See that "last.local2"? Well, "last" is not a host -- it's taking it from the log message and mistakenly turning it into a hostname. Here's a line from "last.local2": --- Dec 22 10:14:13 last message repeated 2 times --- Any idea at all how to fix that besides making a filter for any hosts named "last"? Thanks, Keith

2 1

RE: [syslog-ng]syslog-ng 1.5.3 released
by Andrew Fort 19 Jan '01

19 Jan '01

> Hi, > > syslog-ng 1.5.3 released which adds support for user > definable log file > formats. Here's how to use it: > > destination my_file { > file("/var/log/messages" template("$ISODATE $TAG > $FULLHOST $MESSAGE")); > }; > > Documentation is not updated, for a list of available macros check out > affile.c, expand_macros() function. I'd appreciate some > testing, because I > won't have too much time to do it myself. Here's a list of the macros and an example of their output, in the following format $MACRO_NAME description/type example $FACILITY syslog facility name daemon $PRIORITY the syslog priority name debug $LEVEL ; same output as $PRIORITY $TAG Hex representaiton of the 32-bit priority/facility pair (see /usr/include/sys/syslog.h) 1f (1f is the output for "daemon/debug" as above) $DATE The local system time Jan 19 23:27:21 $FULLDATE Same as $DATE but with %Y appended, 2001 Jan 19 23:27:21 $ISODATE ISO-standard format date (strftime format "%Y-%m-%dT%H:%M:%S%z") 2001-01-19T23:27:21+1000 $YEAR 4-digit year string 2001 $MONTH 2-digit month string 01 $DAY 2-digit day string 19 $HOUR 2-digit hour string 23 $MIN 2-digit minutes string 27 $SEC 2-digit seconds string 21 $HOST host string; not sure how to decode this function, in my example it's the same as fullhost (?) avrio $FULLHOST "full hostname" (msg->host->data) avrio $PROGRAM If syslog-ng has pulled a 'program name' out of the message, this will return that qpage $MSG || $MESSAGE The full syslog message qpage[9366]: processing the page queue Balazs forgot one thing - you'll also need to include a "\n" at the end of your template directive if you want to make your output readable :) e.g. destination my_file { file("/var/log/messages" template("$ISODATE $TAG $FULLHOST $MESSAGE\n")); }; Balazs, my test config was: destination d_format_test { file("/var/log/test" template("$FACILITY $PRIORITY $LEVEL $TAG $DATE $FULLDATE $ISODATE $YEAR $MONTH $DAY $HOUR $MIN $SEC $HOST $FULLHOST $PROGRAM $MSG\n")); }; log { source(s_sys); filter(DEFAULT); destination(d_format_test); }; the output used in the examples above is daemon debug debug 1f Jan 19 23:27:21 2001 Jan 19 23:27:21 2001-01-19T23:27:21+1000 2001 01 19 23 27 21 avrio avrio qpage qpage[9366]: processing the page queue seems to work okay with the \n. Thanks Balazs, now I can use the clock on my ciscos for the log messages, again! -afort

2 1

RE: [syslog-ng]syslog-ng 1.5.3 released
by Andrew Fort 19 Jan '01

19 Jan '01

Balazs, Excellent! I have been wanting this feature the whole time, I'll do a little black-box testing for you. > syslog-ng 1.5.3 released which adds support for user > definable log file > formats. Here's how to use it:

1 0