October 2001 - syslog-ng - lists.balabit.hu

syslog-ng 1.5.12
by Balazs Scheidler 21 Oct '01

21 Oct '01

Hi, I've released syslog-ng 1.5.12 fixing a couple of bugs. Here's the NEWS entry: News for the 1.5.12 release Sun, 21 Oct 2001 13:03:53 +0200 Couple of bug fixes: * a bug in libol causing problems on PPC was found * fixed pipe chmod() problems * fixed problem with losing log sources during SIGHUP I don't plan to add any new features to this branch of syslog-ng, and plan to release 1.6 as soon as this branch stabilizes. I received reports that there's a crash bug in syslog-ng 1.5.11 (the type error problem) I was unable to reproduce it, but one of the fixes might affect it, so those who encountered this bug, _please_ try this release, and if the bug occurs, send me a syslog-ng -dv output (with --with-debug configure option for both libol and syslog-ng) Thanks. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

syslog-ng 1.5.11
by Balazs Scheidler 21 Oct '01

21 Oct '01

Hi, I released syslog-ng 1.5.11, which hopefully fixes the SIGKILL problem you might have encountered earlier. No further changes for now. The tarball is available at the usual places: http://www.balabit.hu/en/products/syslog-ng (I also updated 1.4.x related links, the webpage is being reorganized and that's why we didn't update the pages for so long. But since the new version is not yet ready I now updated the old pages) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 4

syslogd to syslog-ng
by Dustin H 19 Oct '01

19 Oct '01

in normal syslog i use *.=info;*.=notice;*.=debug;*.warn /dev/tty12 to have it dump to tty12 how can i do that in syslog-ng ?

2 1

Question on match() expression
by Antai Ning 19 Oct '01

19 Oct '01

Hi there, I know I shouid search the archive first before I ask. So I did that and here is the question that I haven't found an answer... I want to create a filter to capture certain messages from syslog. The message I want to match is something like this: "[out-proxy]: tcp from 192.168.10.28-3933 to 216.191.40.60-80 established". I tried 1. match("\[out-proxy\]: .*tcp from .* to .*-80 established"); 2. match("\[out-proxy]: .*tcp from .* to .*-80 established"); 3. match("[out-proxy]: .*tcp from .* to .*-80 established"); 4. match(".*out-proxy.*: .*tcp from .* to .*-80 established"); Only #4 works. It seems that it doesn't understand "[" and "]" and esc"\". I want a exact match for "[out-proxy]" anyway. So how to do that? Thanks in advance! Andy Internetworking Applications Engineer JETNET InternetWorking Services Inc. Email : aning(a)jetnet.ca Web : http://www.jetnet.ca Phone : (613) 237-5995 x 369 Fax : (613) 271-6229

1 0

syslog-ng 1.4.14 released
by Balazs Scheidler 19 Oct '01

19 Oct '01

Hi, I've released syslog-ng 1.4.14 which fixes a quite important problem with regard to local messages. NEWS entry follows: News for the 1.4.14 release Fri, 19 Oct 2001 14:45:12 +0200 Fixed a problem causing opened unix domain sessions to drop during SIGHUP. This new version can be found at: http://www.balabit.hu/en/products/syslog-ng -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]fully qualified hostname help
by Dawson, Kevin 18 Oct '01

18 Oct '01

Ugh...no. Can't it use DNS to resolve? I had use_dns(yes) set but it didn't work either. The number of hosts I'd have to add to /etc/hosts would be significant as we are relaying from *a bunch* of boxes to a central collection point. Kevin. -----Original Message----- From: Allen Bettilyon [mailto:allen@about-inc.com] Sent: Thursday, October 18, 2001 3:20 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]fully qualified hostname help Do you have the hosts listed in /etc/hosts? -- Allen "Dawson, Kevin" wrote: > I'm sure this has been asked a thousand times before (although I couldn't > find it in the archives), but here it goes. My options line reads: > > options { sync(0); time_reopen(10); log_fifo_size(100); long_hostnames(yes); > chain_hostnames(yes); }; > > I'm running version 1.4.12 on Solaris and the problem is my messages are > still listing the short hostname. Any thoughts on this? > > Best Regards, > Kevin. > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

RE: [syslog-ng]fully qualified hostname help
by Dawson, Kevin 18 Oct '01

18 Oct '01

Allen- Thanks a ton for the help. This fixes the problem - or more specifically my lack of knowledge. Now it's off to update all the hosts...where's the coffee! Best Regards, Kevin. -----Original Message----- From: Allen Bettilyon [mailto:allen@about-inc.com] Sent: Thursday, October 18, 2001 3:51 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]fully qualified hostname help Yes, it can use dns. I was just asking if you ALSO had the hosts listed in your /etc/hosts file. If you did, than it would ask that first. I actually relay about 80 boxes to my loghost, and I prefer having them all listed in /etc/hosts. This way, if dns falls down, my logs still retain hostnames. I think the option your looking for is: use_fqdn (yes); -- Allen "Dawson, Kevin" wrote: > Ugh...no. Can't it use DNS to resolve? I had use_dns(yes) set but itss > didn't work either. The number of hosts I'd have to add to /etc/hosts would > be significant as we are relaying from *a bunch* of boxes to a central > collection point. > > Kevin. > > -----Original Message----- > From: Allen Bettilyon [mailto:allen@about-inc.com] > Sent: Thursday, October 18, 2001 3:20 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]fully qualified hostname help > > Do you have the hosts listed in /etc/hosts? > > -- Allen > > "Dawson, Kevin" wrote: > > > I'm sure this has been asked a thousand times before (although I couldn't > > find it in the archives), but here it goes. My options line reads: > > > > options { sync(0); time_reopen(10); log_fifo_size(100); > long_hostnames(yes); > > chain_hostnames(yes); }; > > > > I'm running version 1.4.12 on Solaris and the problem is my messages are > > still listing the short hostname. Any thoughts on this? > > > > Best Regards, > > Kevin. > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]fully qualified hostname help
by Dawson, Kevin 18 Oct '01

18 Oct '01

Actually both - the remote hosts are running syslog-ng as well with the exception of the routers which simply spit out messages w/o a syslog daemon. BTW, the syslogd daemon was able to resolve the full hostname without any entries in the /etc/hosts file. I changed to syslog-ng...no full hostnames. -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Thursday, October 18, 2001 2:45 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]fully qualified hostname help Also, are you referring to locally generated syslog messages or ones from remote hosts? The difference is important. On Thu, Oct 18, 2001 at 03:19:47PM -0700, Allen Bettilyon wrote: > Do you have the hosts listed in /etc/hosts? > > -- Allen > > "Dawson, Kevin" wrote: > > > I'm sure this has been asked a thousand times before (although I couldn't > > find it in the archives), but here it goes. My options line reads: > > > > options { sync(0); time_reopen(10); log_fifo_size(100); long_hostnames(yes); > > chain_hostnames(yes); }; > > > > I'm running version 1.4.12 on Solaris and the problem is my messages are > > still listing the short hostname. Any thoughts on this? -- Nate Campi <nate(a)campin.net> GnuPG key: 0xC17AEF79 http://www.campin.net But, for my own part, it was Greek to me. -- William Shakespeare, "Julius Caesar" _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

fully qualified hostname help
by Dawson, Kevin 18 Oct '01

18 Oct '01

I'm sure this has been asked a thousand times before (although I couldn't find it in the archives), but here it goes. My options line reads: options { sync(0); time_reopen(10); log_fifo_size(100); long_hostnames(yes); chain_hostnames(yes); }; I'm running version 1.4.12 on Solaris and the problem is my messages are still listing the short hostname. Any thoughts on this? Best Regards, Kevin.

3 2

How to use Macros in file() ?
by Denis Doublet 17 Oct '01

17 Oct '01

Hello, Currently using syslog-ng 1.5.9 on Solaris, I would to see in the generated logs, the Facility and criticity of each line. Could you give me an example of the usage of macros in filename? The documentation is quite light about this subject. Thanks for your help. Denis

1 0