March 2001 - syslog-ng - lists.balabit.hu

logging from 20 hosts
by Dennis Kruyt 20 Mar '01

20 Mar '01

Hi, What sould be the best solution with syslog-ng for logging about 20 hosts to one log machine and to sort them on that machine. Has someone done this before???? Dennis Kruyt, ZXFactory BV Telefoonweg 44b 6712 GD EDE The Netherlands T +31 138 693 111 F +31 139 693 042 I www.zxfactory.nl

3 2

RE: [syslog-ng]logging from 20 hosts
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 20 Mar '01

20 Mar '01

I log about 1000 machines to one loghost using syslog-ng. Would you count that? What do you want to do? Regards, Drew > -----Original Message----- > From: Dennis Kruyt [SMTP:d.kruyt@zx.nl] > Sent: Tuesday, March 20, 2001 2:55 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]logging from 20 hosts > > Hi, > > What sould be the best solution with syslog-ng for logging about 20 hosts > to one log machine and to sort them on that machine. Has someone done this > before???? > > Dennis Kruyt, > > ZXFactory BV > Telefoonweg 44b > 6712 GD EDE > The Netherlands > T +31 138 693 111 > F +31 139 693 042 > I www.zxfactory.nl <http://www.zxfactory.nl> >

1 0

Multiple udp sources
by John_Delisle＠ceridian.ca 19 Mar '01

19 Mar '01

Can I use multiple UDP sources? I'd like to listen on 2 ports. I've tried configuring this, but no luck. I don't seem to get any messages. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909

1 0

Logwatch and syslog-ng
by Simeon Johnston 17 Mar '01

17 Mar '01

Has anyone configured logwatch to work with syslog-ng ( or the reverse )? I am trying to keep the originating host in the logs but logwatch seems to strip all relevant information from the log files. Has anyone done anything like this? sim

1 0

1.4.11 fixes SIGHUP problems?
by Balazs Scheidler 16 Mar '01

16 Mar '01

Hi, I was wondering whether the 1.4.11 release did really fix the SIGHUP problems many of you encountered? Some feedback would be useful. TIA, -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 2

Ofer Aaronson/AME/APPLIED MATERIALS - Out from the office
by Out_Of_Office＠amat.com 14 Mar '01

14 Mar '01

**PLEASE DO NOT REPLY TO THIS MESSAGE** I will be out of the office from 03/12/2001 until 03/15/2001. Hello Everybody , I will be out from the office for training. Please contact Ed Shyng (x31921 or 408 563 1921) for any Data Network Operations issues . If you need to reach me, please leave me Email or Vmail and I'll try to return back to you within a 24h window. Thanks , Ofer Aaronson .

1 0

partition full
by Torsten Curdt 13 Mar '01

13 Mar '01

can syslog-ng be configured to check for enough logging space? It would be cool to be able to start a script if the free space of the log partition drops under x percent. -- Torsten

2 1

RE: [syslog-ng]1.4.11 fixes SIGHUP problems?
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 13 Mar '01

13 Mar '01

I definitely agree that there is nothing more that can be done. I write my internal() source to a different file and after I HUP the daemon I just tail the file and I know whether the config was any good. You could write a wrapper script that HUPped the daemon and tailed the output of your internal file all for you on restart. That would at least give you immediate gratification, which is what this is all about anyway, right? Regards, Drew > -----Original Message----- > From: Scott McDermott [SMTP:mcdermot@questra.com] > Sent: Monday, March 12, 2001 10:10 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]1.4.11 fixes SIGHUP problems? > > Balazs Scheidler on Mon 12/03 19:07 +0100: > > > Can't you just write it to the internal source ? > > > > I _write_ it there, that's why it pops up in logs. > > Then there's nothing more that can be done :) Person in question will > just have to maintain a regex watcher on the logs for failures. Since > syslog-ng closes all its terminal-inherited FDs, forks and sets SID, I > don't see where else it would go...I mean you could write it to > /dev/console but that's icky. > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]1.4.11 fixes SIGHUP problems?
by John_Delisle＠ceridian.ca 12 Mar '01

12 Mar '01

Would it make sense then to also send it to: destination d_mlal { usertty("*"); }; or destination d_cons { file("/dev/console"); }; John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Balazs Scheidler <bazsi(a)balabit.hu> To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: Re: [syslog-ng]1.4.11 fixes SIGHUP problems? balabit.hu 2001/03/12 11:57 AM Please respond to syslog-ng On Mon, Mar 12, 2001 at 12:49:40PM -0500, William Yodlowsky wrote: > On Mon, Mar 12, 2001 at 12:47:33PM -0500, jon(a)dumbo.pobox.com wrote: > > IMO, it should dump to STDOUT/ERR as well...much like apachectl restart. > > > > apache says something like "config is broken, ignoring restart" > > > > i've made changes to the config file before(with errors) never thinking there's a problem. > > logging continued normally, not error messages i could see. > > I'm afraid I agree totally with this... I've done the same thing. You could tell me a clue _where_ I could write this message? syslog-ng is running in the background with no stderr or stdout. It has nothing to write to except for its logfiles. As I see Apache has a configtest mode which is ran prior to sending a signal to the daemon, and although this can be done with syslog-ng as well, the configuration can be broken even if it's syntactically correct. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]1.4.11 fixes SIGHUP problems?
by John_Delisle＠ceridian.ca 12 Mar '01

12 Mar '01

I'd say it does make sense, but the point was that not starting with a broken config wasn't a bug. Output to stderr would be fantastic. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 William Yodlowsky <wyodlows(a)andromeda.ru To: syslog-ng(a)lists.balabit.hu tgers.edu> cc: Sent by: Subject: Re: [syslog-ng]1.4.11 fixes SIGHUP problems? syslog-ng-admin@lists. balabit.hu 2001/03/12 11:49 AM Please respond to syslog-ng On Mon, Mar 12, 2001 at 12:47:33PM -0500, jon(a)dumbo.pobox.com wrote: > IMO, it should dump to STDOUT/ERR as well...much like apachectl restart. > > apache says something like "config is broken, ignoring restart" > > i've made changes to the config file before(with errors) never thinking there's a problem. > logging continued normally, not error messages i could see. I'm afraid I agree totally with this... I've done the same thing. > not many people will want to have to check a log file after a restart, they may think > "telling it to HUP, didn't report any errors, and my other logs are still there..." > > On Mon, Mar 12, 2001 at 11:33:35AM -0600, John_Delisle(a)ceridian.ca wrote: > | > | > | I'm not sure thats a bug, it may be a feature actually. If you look at > | /var/log/messages, theres an entry saying the new config is bad, and > | syslog-ng will continue running with the old config. This prevents lost > | syslog messages. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0