March 2001 - syslog-ng - lists.balabit.hu

Question...
by Simeon Johnston 11 Mar '01

11 Mar '01

I am setting up a bunch of computers to send there logs to a logserver. I have it set up pretty well and finally figured out the network issue. Everything works great. I was wondering about how daemons send there logs to syslog/syslog-ng. Do all daemons send there logs through the kernel/klogd or do some of them send there logs directly to syslog? If I stop syslog will they start to send them to syslog-ng? Also I am having trouble with the rules for syslog-ng.conf. If I tell it to send everything with a priority of emerg through debug it should send everything right? I am not receiving some logs that are being picked up by syslog. Do some logs not have a priority? How do I tell syslog-ng just to send everything to the logserver? No filters? It might not work too well because of the volume of logs but I would like to try it. BTW Is there going to be an updated manual anytime soon? The current one is not very helpfull. sim

1 0

(no subject)
by jansa＠udba.org 11 Mar '01

11 Mar '01

1 0

Re: syslog-ng suggestion
by Balazs Scheidler 09 Mar '01

09 Mar '01

On Mon, Mar 05, 2001 at 06:09:19PM -0600, Lee Eakin wrote: > Well, it appears the I did not include the attachment (patch) which was the > whole point of the message. My apologies if I DID include it and this is > just wasted bandwidth. Sorry for not reacting your message sooner. > > For instance, 'logger test' prints: > > > > Mar 2 20:18:15 japh[user,notice] logger: test > > > > My patch is against 1.4.11 (current stable).I hope you will consider it's > > inclusion, or some variation of this patch. You can achieve the same by using a release in the new 1.5.x branch, and using the template() feature of file destinations like this: destination d_file { file("/var/log/messages" template("$DATE $HOST[$FACILITY,$PRIORITY] $PROGRAM $MSG\n"); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

Re: [syslog-ng]Re:restarting syslog-ng
by John_Delisle＠ceridian.ca 09 Mar '01

09 Mar '01

You may see it mentioned as SIGHUP (same thing). Take a look at man 7 signal. It covers them all. Also, does syslog-ng re-create files if you remove them and send it a SIGHUP? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 jmad <than(a)wwa.com> Sent by: To: syslog-ng(a)lists.balabit.hu syslog-ng-admin@lists. cc: balabit.hu Subject: [syslog-ng]Re:restarting syslog-ng 2001/03/08 12:05 PM Please respond to syslog-ng I saw the e-mail below and have a question: I'm currently using Caldera's Linux to host my syslog-ng. I currently use a cron script similar to below to stop, rotate my logs and restart the service (obviously not ideal, there's a brief moment where I lose messages). When I look at the man page for kill I do not see a -HUP switch. Does anyone know if this is just an undocumented option, or is it not available? If not, any ideas on what I can do to fix this? Thanks for any help you can provide, JonM Balazs Scheidler wrote: > > I'm trying to set up syslog-ng to rotate it's logs with logrotate. One > > question this brings to mind is whether syslog-ng will restart with the > > HUP signal. > > > > #/bin/kill -HUP `cat /var/run/syslog-ng.pid` > > yes. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

restarting syslog-ng
by Brian E. Seppanen 08 Mar '01

08 Mar '01

I'm trying to set up syslog-ng to rotate it's logs with logrotate. One question this brings to mind is whether syslog-ng will restart with the HUP signal. #/bin/kill -HUP `cat /var/run/syslog-ng.pid` Thanks, Brian Seppanen Charter Communications Regional Data Center 906-228-3100 ext 23 Marquette, MI seppy(a)chartermi.net

4 4

Re: [syslog-ng]program() destination
by John_Delisle＠ceridian.ca 08 Mar '01

08 Mar '01

Would you be able to provide an example of how one could use this to send mail? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 "amover(a)libero.it"<amo ver To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: [syslog-ng]program() destination balabit.hu 2001/03/08 02:18 AM Please respond to syslog-ng (I'm sending it again cause I'm not sure the first send was successful so sorry if it's a duplicate) About launching a program, specifically a perl script to do other jobs when some filters are matched the right code snippet is : #!/usr/bin/perl $fh = select (FOO); $| = 1; select ($fh); open FOO, ">>/foo.log" or die $!; while ( <STDIN> ) { print FOO $_; } close FOO; you need the first to line to disable buffering...(that's why you cannot say any lines in the file) Hope this could help the syslog-ng people :) Amodiovalerio Verde Computer freak and consultant amover(a)libero.it _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

error message
by jon＠dumbo.pobox.com 08 Mar '01

08 Mar '01

any ideas what this is? it goes away when i comment out the unix-stream line but..thats what the docs say to use for a linux-based distribution Mar 7 16:45:26 src@host/host syslog-ng[29264]: Error accepting AF_UNIX connection, opened connections: 100, max: 100 relevant info: Linux dolly1 2.4.0-test9 #12 Thu Dec 21 19:55:09 EST 2000 i686 unknown syslog-ng-1.4.11/ libol-0.2.21/ redhat options { create_dirs(yes); use_dns(no); sync(0); }; source src { unix-stream("/dev/log"); #############^^^^^^^^ internal(); udp(ip(0.0.0.0) port(514)); };

2 1

multiple destinations?
by jon＠dumbo.pobox.com 08 Mar '01

08 Mar '01

i would like to have syslog-ng log to two destinations...is that possible? ie... filter mail_filt { facility(mail) or facility(local4); }; destination maillogs { file("/var/log/ng/maillogs/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY.$HOUR" dir_perm(0755) perm(0644)); }; destination loghost { udp(host=x,port=y); # note, i know this is wrong...i will make it right when i actually do the config }; log { source(src); destination(maillogs); destination(loghost); filter(mail_filt); };

2 1

program() destination
by amover＠libero.it 08 Mar '01

08 Mar '01

(I'm sending it again cause I'm not sure the first send was successful so sorry if it's a duplicate) About launching a program, specifically a perl script to do other jobs when some filters are matched the right code snippet is : #!/usr/bin/perl $fh = select (FOO); $| = 1; select ($fh); open FOO, ">>/foo.log" or die $!; while ( <STDIN> ) { print FOO $_; } close FOO; you need the first to line to disable buffering...(that's why you cannot say any lines in the file) Hope this could help the syslog-ng people :) Amodiovalerio Verde Computer freak and consultant amover(a)libero.it

1 0

RE: [syslog-ng]multiple destinations?
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 08 Mar '01

08 Mar '01

Yes, this is possible. Regards, Drew > -----Original Message----- > From: jon(a)dumbo.pobox.com [SMTP:jon@dumbo.pobox.com] > Sent: Wednesday, March 07, 2001 10:04 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]multiple destinations? > > i would like to have syslog-ng log to two destinations...is that possible? > > ie... > filter mail_filt { facility(mail) or facility(local4); }; > > destination maillogs { > > file("/var/log/ng/maillogs/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY.$HOUR" > dir_perm(0755) perm(0644)); > }; > destination loghost { > udp(host=x,port=y); > # note, i know this is wrong...i will make it right when i > actually do the config > }; > > log { > source(src); > destination(maillogs); > destination(loghost); > filter(mail_filt); > }; > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0