February 2001 - syslog-ng - lists.balabit.hu

Re: syslog-g and bsdi
by Balazs Scheidler 11 Apr '01

11 Apr '01

> I was wondering if anyone has a compatible function to replace strptime. > this is a function that is not included in BSDI (4.0+ a least) > if no one has coded a replacement, i would be willing to add another patch > to fix it. > otherwise, you should take off "this has been compiled for bsdi" on the I was wondering if you tried compiling syslog-ng 1.5 which included such a compatibility strptime() function. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 2

restarting syslog-ng
by Brian E. Seppanen 08 Mar '01

08 Mar '01

I'm trying to set up syslog-ng to rotate it's logs with logrotate. One question this brings to mind is whether syslog-ng will restart with the HUP signal. #/bin/kill -HUP `cat /var/run/syslog-ng.pid` Thanks, Brian Seppanen Charter Communications Regional Data Center 906-228-3100 ext 23 Marquette, MI seppy(a)chartermi.net

4 4

program() destination
by Maciek Pasternacki 01 Mar '01

01 Mar '01

Hello, I have following configuration on my machine: source logdev { unix-stream("/dev/log"); }; destination foo { program("/home/foo/.bin/loglogs.pl"); }; filter f_foo { not priority(debug) and not facility(mail); }; log { source(logdev); filter(f_foo); destination(foo); }; File /home/foo/.bin/loglogs.pl come as follows: #!/usr/bin/perl open FOO, ">/tmp/loglog.log"; while ( <STDIN> ) { print FOO $_; } close FOO; Could anybody tell why file /tmp/loglog.log stays empty no matter what I do? Greets, --Maciek -- __ Maciek Pasternacki <maciekp(a)japhy.fnord.org> [ http://japhy.fnord.org/ ] `| _ |_\ / *CENSORED* ( full version at http://japhy.fnord.org/sig.txt ) ,|{-}|}| }\/ \/ |____/

2 2

Re: [syslog-ng]program() destination
by John_Delisle＠ceridian.ca 01 Mar '01

01 Mar '01

I've found a way to send the message to an email address. It's a bit of a hack, but.. Basically you output your log to a file, and have a cron job that watches for that file, emails its contents, and deletes it. I'm using it to email a pager. 1- Configure your source line properly for the type of log you are catching 2 - Add a destination file rule 3 - Add a filter to filter for what you're looking for 4 - Add a log with above source, filter, and destination 5 - Install this script in /usr/bin or wherever 6 - Add a cron job such as the example that follows Sample syslog-ng.conf ------------------------------------------ options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); }; source s_remote { udp(ip(0.0.0.0) port(514)); }; destination d_powerpay { file("/var/log/powerpay"); }; destination d_powerpay_email { file("/var/log/powerpay_email"); }; filter f_emerg { level(emerg); }; filter f_powerpay { facility(local1); }; log { source(s_remote); filter(f_powerpay); destination(d_powerpay); }; log { source(s_remote); filter(f_powerpay); filter(f_emerg); destination(d_powerpay_email); }; log { source(s_remote); filter(DEFAULT); destination(d_mesg); }; ------------------------------------- Sample cron entry ------------------------------------ 5,10,15,20,25,30,35,40,45,50,55,0 * * * * /usr/bin/mail_log.sh /var/log/powerpay_email inet_admin(a)ceridian.ca ----------------------------------- mail_log.sh script ----------------------------------- #!/bin/bash # # mail_log.sh # by John Delisle john_delisle(a)ceridian.ca # Feb 28 2001 # # # If a file $1 exists, it mails its contents to $2, and deletes $1 # # MAILPROG="/usr/sbin/mail" if [ $# != 2 ]; then echo "Usage: $0 file_to_check email_address" exit 1; fi if [ ! -e $1 ]; then #echo "$1 not found, exiting" exit 2; else $MAILPROG $2 < $1 echo "Message Sent to $2"; echo "Removing $2"; rm $2 fi exit 0; ----------------------------------- John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 John_Delisle@ceridian. ca To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: Re: [syslog-ng]program() destination balabit.hu 2001/02/28 01:59 PM Please respond to syslog-ng Maciek, have you had any success sending email using this method? I'm trying to get syslog-ng to send an email when a certain alert comes in. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Maciek Pasternacki <maciekp(a)japhy.fnord.o To: syslog-ng(a)lists.balabit.hu rg> cc: Sent by: Subject: [syslog-ng]program() destination syslog-ng-admin@lists. balabit.hu 2001/02/28 12:43 PM Please respond to syslog-ng Hello, I have following configuration on my machine: source logdev { unix-stream("/dev/log"); }; destination foo { program("/home/foo/.bin/loglogs.pl"); }; filter f_foo { not priority(debug) and not facility(mail); }; log { source(logdev); filter(f_foo); destination(foo); }; File /home/foo/.bin/loglogs.pl come as follows: #!/usr/bin/perl open FOO, ">/tmp/loglog.log"; while ( <STDIN> ) { print FOO $_; } close FOO; Could anybody tell why file /tmp/loglog.log stays empty no matter what I do? Greets, --Maciek -- __ Maciek Pasternacki <maciekp(a)japhy.fnord.org> [ http://japhy.fnord.org/ ] `| _ |_\ / *CENSORED* ( full version at http://japhy.fnord.org/sig.txt ) ,|{-}|}| }\/ \/ |____/ (See attached file: atty1o2p.dat) (See attached file: atty1o2p.dat)

2 1

Re: [syslog-ng]program() destination
by John_Delisle＠ceridian.ca 01 Mar '01

01 Mar '01

Maciek, have you had any success sending email using this method? I'm trying to get syslog-ng to send an email when a certain alert comes in. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Maciek Pasternacki <maciekp(a)japhy.fnord.o To: syslog-ng(a)lists.balabit.hu rg> cc: Sent by: Subject: [syslog-ng]program() destination syslog-ng-admin@lists. balabit.hu 2001/02/28 12:43 PM Please respond to syslog-ng Hello, I have following configuration on my machine: source logdev { unix-stream("/dev/log"); }; destination foo { program("/home/foo/.bin/loglogs.pl"); }; filter f_foo { not priority(debug) and not facility(mail); }; log { source(logdev); filter(f_foo); destination(foo); }; File /home/foo/.bin/loglogs.pl come as follows: #!/usr/bin/perl open FOO, ">/tmp/loglog.log"; while ( <STDIN> ) { print FOO $_; } close FOO; Could anybody tell why file /tmp/loglog.log stays empty no matter what I do? Greets, --Maciek -- __ Maciek Pasternacki <maciekp(a)japhy.fnord.org> [ http://japhy.fnord.org/ ] `| _ |_\ / *CENSORED* ( full version at http://japhy.fnord.org/sig.txt ) ,|{-}|}| }\/ \/ |____/ (See attached file: atty1o2p.dat)

2 1

Re: [syslog-ng]program() destination
by John_Delisle＠ceridian.ca 28 Feb '01

28 Feb '01

I've updated the script, looks like after deleting the file syslog-ng doesn't recreate. Here is the modified code. #!/bin/bash # # mail_log.sh # by John Delisle john_delisle(a)ceridian.ca # Feb 28 2001 # # # If a file $1 exists, it mails its contents to $2, and deletes $1 # # MAILPROG="/usr/sbin/mail" FACSEV="user.info" if [ $# != 2 ]; then echo "Usage: $0 file_to_check email_address" exit 1; fi if [ ! -s $1 ]; then #echo "$1 not found or size not greater than 0, exiting" exit 2; else $MAILPROG $2 < $1 echo "Message Sent to $2"; logger -p $FACSEV "Message from $1 sent to $2" echo "Removing $1"; > $1 fi exit 0; John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 John_Delisle@ceridian. ca To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: Re: [syslog-ng]program() destination balabit.hu 2001/02/28 04:27 PM Please respond to syslog-ng I've found a way to send the message to an email address. It's a bit of a hack, but.. Basically you output your log to a file, and have a cron job that watches for that file, emails its contents, and deletes it. I'm using it to email a pager. 1- Configure your source line properly for the type of log you are catching 2 - Add a destination file rule 3 - Add a filter to filter for what you're looking for 4 - Add a log with above source, filter, and destination 5 - Install this script in /usr/bin or wherever 6 - Add a cron job such as the example that follows Sample syslog-ng.conf ------------------------------------------ options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); }; source s_remote { udp(ip(0.0.0.0) port(514)); }; destination d_powerpay { file("/var/log/powerpay"); }; destination d_powerpay_email { file("/var/log/powerpay_email"); }; filter f_emerg { level(emerg); }; filter f_powerpay { facility(local1); }; log { source(s_remote); filter(f_powerpay); destination(d_powerpay); }; log { source(s_remote); filter(f_powerpay); filter(f_emerg); destination(d_powerpay_email); }; log { source(s_remote); filter(DEFAULT); destination(d_mesg); }; ------------------------------------- Sample cron entry ------------------------------------ 5,10,15,20,25,30,35,40,45,50,55,0 * * * * /usr/bin/mail_log.sh /var/log/powerpay_email inet_admin(a)ceridian.ca ----------------------------------- mail_log.sh script ----------------------------------- #!/bin/bash # # mail_log.sh # by John Delisle john_delisle(a)ceridian.ca # Feb 28 2001 # # # If a file $1 exists, it mails its contents to $2, and deletes $1 # # MAILPROG="/usr/sbin/mail" if [ $# != 2 ]; then echo "Usage: $0 file_to_check email_address" exit 1; fi if [ ! -e $1 ]; then #echo "$1 not found, exiting" exit 2; else $MAILPROG $2 < $1 echo "Message Sent to $2"; echo "Removing $2"; rm $2 fi exit 0; ----------------------------------- John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 John_Delisle@ceridian. ca To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: Re: [syslog-ng]program() destination balabit.hu 2001/02/28 01:59 PM Please respond to syslog-ng Maciek, have you had any success sending email using this method? I'm trying to get syslog-ng to send an email when a certain alert comes in. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Maciek Pasternacki <maciekp(a)japhy.fnord.o To: syslog-ng(a)lists.balabit.hu rg> cc: Sent by: Subject: [syslog-ng]program() destination syslog-ng-admin@lists. balabit.hu 2001/02/28 12:43 PM Please respond to syslog-ng Hello, I have following configuration on my machine: source logdev { unix-stream("/dev/log"); }; destination foo { program("/home/foo/.bin/loglogs.pl"); }; filter f_foo { not priority(debug) and not facility(mail); }; log { source(logdev); filter(f_foo); destination(foo); }; File /home/foo/.bin/loglogs.pl come as follows: #!/usr/bin/perl open FOO, ">/tmp/loglog.log"; while ( <STDIN> ) { print FOO $_; } close FOO; Could anybody tell why file /tmp/loglog.log stays empty no matter what I do? Greets, --Maciek -- __ Maciek Pasternacki <maciekp(a)japhy.fnord.org> [ http://japhy.fnord.org/ ] `| _ |_\ / *CENSORED* ( full version at http://japhy.fnord.org/sig.txt ) ,|{-}|}| }\/ \/ |____/ (See attached file: atty1o2p.dat) (See attached file: atty1o2p.dat) (See attached file: atty1o2p.dat)

1 0

Re: [syslog-ng]AIX compatability issue?
by John_Delisle＠ceridian.ca 28 Feb '01

28 Feb '01

I've discovered the problem. It seems AIX sends a 'verbose' string by default. If you add a -s to the line where you call AIXs syslogd from it sends a more typical message. After this change all my AIX messages are filtered correctly. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 John_Delisle@ceridian. ca To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: Re: [syslog-ng]AIX compatability issue? balabit.hu 2001/02/23 04:46 PM Please respond to syslog-ng Would it be easier to replace the AIX syslogd with syslog-ng? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Brad Arlt <arlt(a)cpsc.ucalgary.ca To: syslog-ng(a)lists.balabit.hu > cc: Sent by: Subject: Re: [syslog-ng]AIX compatability issue? syslog-ng-admin@lists. balabit.hu 2001/02/23 04:06 PM Please respond to syslog-ng On Fri, Feb 23, 2001 at 01:11:30PM -0600, John_Delisle(a)ceridian.ca wrote: > > Thanks for the response. Sorry to sound ignorant, but what do you mean by > truss or a strace? Is that a type of bracket? Below is the output I get strace and truss log to stderror (or a file) all the system call a process makes. I took a look at the AIX box we have kicking around and the only strace on it is for tracing STREAMS. This is not what you want. I looked at the strace homepage, and as far as I can tell, AIX is *not* one of the supported platforms. AIX seems to have a tracing utility called trace(1). It looks kinda odd, but should do the job. ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_) \(_) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Trying to send log over network
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 28 Feb '01

28 Feb '01

Sim, I have just a couple of other questions. What is the address of your loghost and the address of the clients? I'm looking at your two configs and I want to make sure that the destination for the problem machine is ok. Do you have a 192.168.1.19 host on your network and is it listening for tcp connections on port 514? In the loghost config you reference a source of 192.168.1.1 which tells me that your loghost is 192.168.1.1. If you are trying to establish a connection to a host using the tcp/ip you also need to make sure that the host is listening for tcp/ip connections. The loghost config is listening for tcp/ip on 192.168.1.1 port 10001 and you are trying to make a tcp connection with 192.168.1.19 on port 514. Is this what you are intending, if so this won't work. Change your destination in your client to read destination d_bg {tcp("192.168.1.1:10001") }; That should at least let you log to that loghost. Regards, Drew > -----Original Message----- > From: Simeon Johnston [SMTP:simeonuj@eetc.com] > Sent: Wednesday, February 21, 2001 5:39 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Trying to send log over network > > Here are the configs. > > I have added as an attachment the strace output files using "strace -f -ff > -o > localfile syslog-ng". > > This is the config for the problem conputers. > > options { sync (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames (on); > use_dns (no); > use_fqdn (no); > create_dirs (yes); > keep_hostname (yes); > }; > > source s_sys { unix-stream ("/dev/log"); internal(); }; > > destination d_cons { file("/var/log/ng/kern.log"); }; > destination d_mesg { file("/var/log/ng/messages"); }; > destination d_auth { file("/var/log/ng/secure"); }; > destination d_mail { file("/var/log/ng/maillog"); }; > destination d_spol { file("/var/log/ng/spooler"); }; > destination d_boot { file("/var/log/ng/boot.log"); }; > destination d_mlal { file("/var/log/ng/emerg.log"); }; > destination d_bg { tcp("192.168.1.19:514"); }; > destination d_sshd { file("/var/log/ng/sshd.log"); }; > > filter f_filter1 { facility(kern); }; > filter f_filter2 { level(info); }; > filter f_filter3 { facility(authpriv); }; > filter f_filter4 { facility(mail); }; > filter f_filter5 { level(emerg); }; > filter f_filter6 { facility(uucp) or > (facility(news) and level(crit)); }; > filter f_tcplog { level(debug); }; > filter f_sshd { match("sshd"); }; > > log { source(s_sys); filter(f_filter1); destination(d_cons); }; > log { source(s_sys); filter(f_filter2); destination(d_mesg); }; > log { source(s_sys); filter(f_filter3); destination(d_auth); }; > log { source(s_sys); filter(f_filter4); destination(d_mail); }; > log { source(s_sys); filter(f_filter5); destination(d_mlal); }; > log { source(s_sys); filter(f_filter6); destination(d_spol); }; > log { source(s_sys); filter(f_tcplog); destination(d_bg); }; > log { source(s_sys); filter(f_sshd); destination(d_sshd); }; > > > This is the logserver config > > options { sync (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames (on); > use_dns (no); > use_fqdn (no); > create_dirs (yes); > keep_hostname (yes); > }; > > source s_sys { unix-stream ("/dev/log"); internal(); }; > source s_tcp { tcp (ip(192.168.1.1) port(10001)); }; > > destination d_cons { file("/var/log/ng/kernel"); }; > destination d_mesg { file("/var/log/ng/messages"); }; > destination d_auth { file("/var/log/ng/secure"); }; > destination d_mail { file("/var/log/ng/maillog"); }; > destination d_spol { file("/var/log/ng/spooler"); }; > destination d_boot { file("/var/log/ng/boot.log"); }; > destination d_mlal { file("/var/log/ng/emerg.log"); }; > destination d_pptp { file("/var/log/ng/pptpd.log"); }; > destination d_daemon { file("/var/log/ng/daemon.log"); }; > destination d_firewall { file("/var/log/ng/firewall.log"); }; > > filter f_filter1 { facility(kern); }; > filter f_filter2 { level(info) and not facility(mail,authpriv,kern); > }; > filter f_filter3 { facility(authpriv); }; > filter f_filter4 { facility(mail); }; > filter f_filter5 { level(emerg); }; > filter f_filter6 { facility(uucp); }; > filter f_pptpd { match("pptpd"); }; > filter f_daemon { facility(daemon); }; > filter f_boot { facility(local7); }; > filter f_firewall { level(debug); }; > > log { source(s_sys); filter(f_filter1); destination(d_cons); }; > log { source(s_sys); filter(f_filter2); destination(d_mesg); }; > log { source(s_sys); filter(f_filter3); destination(d_auth); }; > log { source(s_sys); filter(f_filter4); destination(d_mail); }; > log { source(s_sys); filter(f_filter5); destination(d_mlal); }; > log { source(s_sys); filter(f_filter6); destination(d_spol); }; > log { source(s_sys); filter(f_pptpd); destination(d_pptp); }; > log { source(s_sys); filter(f_daemon); destination(d_daemon); }; > log { source(s_sys); filter(f_boot); destination(d_boot); }; > log { source(s_tcp); filter(f_firewall); destination(d_firewall); }; > > Thank you for your help. > > sim > > "Hamilton, Andrew Mr RAYTHEON 5 SIG CMD" wrote: > > > 1. No syslog-ng runs as its own daemon. Works much better this way. > > 2. If the answer to 1 was yes it would make a difference. But since it > > isn't then no. > > 3. Could you post a sample of your config file? That might be helpful. > > Also could you post part of your strace results? That would at least > give > > us info on where to look for your problem. > > > > Random thoughts...do you have some sort of port monitor that could be > > blocking your default ports? I have seen that before. > > > > Regards. > > Drew << File: strace.syslog-ng >> << File: strace.syslog-ng.25136 >>

3 3

Newbie intro/question
by Dave Carmean 28 Feb '01

28 Feb '01

Greetings from a list newbie. I discovered syslog-ng the other day while STFW for more info about logsurfer, which I've been trying out recently. I've looked at the list archives for several months back, but don't see obvious answers to the following: - Are people using -ng to perform noise filtering and/or alerting a-la Swatch, WOTS, logsurfer, etc? Or is most filtering just to effectively increase the number of facilities by sorting on reporting program name? - Has anybody devised a way with -ng to monitor the repeat rate of a particular message? I.e. if you get 10 log_info messages per hour from named on host foo, ignore them, but if you get 100, save them and trigger some event? - I would like to embed the message's facility/level into the recorded message text, similar to what SGI's Irix' syslogd does, although probably in human-readable form rather than an octal number. Maybe I'm looking in the wrong docs, but I'd like to write something like this to the output channel: "Feb 27 01:31:05 foo sendmail[nnn]: ${FACILITY}/${PRIORITY} \ $rest_of_message" I'll go RTFM some more, but if anybody can give some basic answers, I'd be grateful. Thanks. -- Dave Live fast. Die young. Leave a good-looking audit trail.

1 0

Re: [syslog-ng]Mailing alerts
by John_Delisle＠ceridian.ca 27 Feb '01

27 Feb '01

Just had a thought, would a better way be to have two destinations, a file (say /tmp/tmp_alert) and a program destination that mails a user that file? Is there any way to overwrite a file when using a file destination so there are no stale entries in it? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 John_Delisle@ceridian. ca To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: [syslog-ng]Mailing alerts balabit.hu 2001/02/27 04:07 PM Please respond to syslog-ng Has anyone had any success getting syslog-ng to send an alert via email? I'd guess you use the program destination, but I'm unsure how to call it etc. Any ideas? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0