March 2001 - syslog-ng - lists.balabit.hu

parser
by YAMAUCHI Tomohiro 07 Mar '01

07 Mar '01

Hi, I using 1.5.3. I wrote syslog-ng.conf. filter xconsole { level(debug..waning); }; I mistake warning <-> waning. In this case, syslog-ng output the following message. % syslog-ng Warning: Unknown priority level debug I want to output Warning: Unknown priority level waning or Warning: Unknown priority level debug..waning Is This difficult? -- YAMAUCHI Tomohiro handy(a)nid.co.jp

1 0

Need help.
by Simeon Johnston 06 Mar '01

06 Mar '01

I am sorry if this is in the doc's somewhere but I couldn't find it. I also could not find the archives for this list. How do I specify more than one priority? Actually a range of priorities. With syslog it is supposed to log that priority and above but I thought I read that it was different with syslog-ng. I seem to recal that you had to specify a range. I just can't remember where I read it. : ) BTW - solved the remote logging thing. It was the server side that was the problem. I changed the rule to accept everything instead of specifying a IP address and it works great now. Thanks everyone for all the help. sim

2 2

reg usage of syslog-ng
by Ramesh Kumar V 06 Mar '01

06 Mar '01

Hi, I have to port HP-UX code to linux. It uses "nettl" product for tracing and loging. Nettl is tool which provides loginf and tracing for an HPUX application. With this tool we can take logs and traces of a perticular Sub system in an application. We can filter loging with error level(like informative ,warning ,error etc). Can syslog-ng give similar functionalty. reg ramesh -- _/ _/_/_/_/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ _/ _/ _/ : Ramesh Kumar V _/_/_/_/ _/_/_/_/ : HP-ISO _/ _/ _/ : Ph: 2251554 Ext: 1273 _/ _/ _/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: [syslog-ng]Syslog-ng and Minilogd
by John_Delisle＠ceridian.ca 05 Mar '01

05 Mar '01

It could be killed by logrotate, check /etc/logrotate.d. It gzips logs, and restarts daemons. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 "Brian E. Seppanen" <seppy(a)chartermi.net> To: <syslog-ng(a)lists.balabit.hu> Sent by: cc: syslog-ng-admin@lists. Subject: [syslog-ng]Syslog-ng and Minilogd balabit.hu 2001/03/05 02:23 PM Please respond to syslog-ng Hello: I'm running syslog-ng on a redhat-7.0 box. I have a monitoring script that checks to insure that syslog-ng is running. The script greps the process listing for the pid listed in the pid file. If it's not found its not running, and its restarted. Now I'm not sure if my script is crap or whether I have another problem, because it seems that syslog-ng is getting restarted quite a bit. I'd say probably every other day. What I've noticed is that after syslog-ng restarts minilogd (which is I believe redhat specific)is also running and I believe there is contention for /dev/log. Minilogd apparently is used during the redhat boot process and logs stuff, before syslog starts and then hands off to syslog once it starts. This issue is occurring well after boot. Has anyone seen this issue as well? Below is my monitoring script. Perhaps there is an error there that is reporting a false positive? Anyone know of a better way to monitor a process to insure its running. snmptraps? ? I get no real indication of any sort of problem. Any insight appreciated. #!/usr/bin/perl -w use MIME::Entity; my $pid=`cat /var/run/syslog-ng.pid`; chomp $pid; my $check = `ps -eo pid,command| grep '$pid' | grep -v grep`; if ($check ne "") { #print "OK - check = $check"; exit 0; } else { my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time); $year %= 100; my $errortime = sprintf ("%02d:%02d:%02d-%02d/%02d/%02d",$hour,$min,$sec,$mon+1,$mday,$year); #print "NOT OK - check = $check"; system "/etc/rc.d/init.d/syslog-ng start"; $minilogd = `ps -eo pid,command | grep minilogd | grep -v grep`; $page = "Syslog Error at $errortime"; $top = MIME::Entity->build(Type =>"multipart/mixed", From =>"admin", To =>"pager\@localhost"); $top->attach(Data=>$page); $message="\n There is a problem with syslog-ng at $errortime, it's last known whereabouts were $pid. Syslog has been restarted. "; $top->attach(Data=>$message); open (MAIL, "| /usr/sbin/sendmail -t"); $top->print(\*MAIL); close MAIL; exit 0; } Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Syslog-ng and Minilogd
by Brian E. Seppanen 05 Mar '01

05 Mar '01

Hello: I'm running syslog-ng on a redhat-7.0 box. I have a monitoring script that checks to insure that syslog-ng is running. The script greps the process listing for the pid listed in the pid file. If it's not found its not running, and its restarted. Now I'm not sure if my script is crap or whether I have another problem, because it seems that syslog-ng is getting restarted quite a bit. I'd say probably every other day. What I've noticed is that after syslog-ng restarts minilogd (which is I believe redhat specific)is also running and I believe there is contention for /dev/log. Minilogd apparently is used during the redhat boot process and logs stuff, before syslog starts and then hands off to syslog once it starts. This issue is occurring well after boot. Has anyone seen this issue as well? Below is my monitoring script. Perhaps there is an error there that is reporting a false positive? Anyone know of a better way to monitor a process to insure its running. snmptraps? ? I get no real indication of any sort of problem. Any insight appreciated. #!/usr/bin/perl -w use MIME::Entity; my $pid=`cat /var/run/syslog-ng.pid`; chomp $pid; my $check = `ps -eo pid,command| grep '$pid' | grep -v grep`; if ($check ne "") { #print "OK - check = $check"; exit 0; } else { my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time); $year %= 100; my $errortime = sprintf("%02d:%02d:%02d-%02d/%02d/%02d",$hour,$min,$sec,$mon+1,$mday,$year); #print "NOT OK - check = $check"; system "/etc/rc.d/init.d/syslog-ng start"; $minilogd = `ps -eo pid,command | grep minilogd | grep -v grep`; $page = "Syslog Error at $errortime"; $top = MIME::Entity->build(Type =>"multipart/mixed", From =>"admin", To =>"pager\@localhost"); $top->attach(Data=>$page); $message="\n There is a problem with syslog-ng at $errortime, it's last known whereabouts were $pid. Syslog has been restarted. "; $top->attach(Data=>$message); open (MAIL, "| /usr/sbin/sendmail -t"); $top->print(\*MAIL); close MAIL; exit 0; } Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

1 0

match not match
by solarissparc 05 Mar '01

05 Mar '01

I have the following filter rules filter f_sonicwall { host("sonicwall") and (not match("*http*")); }; filter f_sonicwall-www { host("sonicwall") and match("*http*"); the sonicwall-www one works but the sonicwall just catches everything ignoring the not match statement i tried the following: filter f_sonicwall { host("sonicwall") and (not match("*http*")); }; filter f_sonicwall { host("sonicwall") and (not (match("*http*"))); }; filter f_sonicwall { host("sonicwall") and not match("*http*"); }; filter f_sonicwall { (host("sonicwall") and (not match("*http*"))); }; #filter f_kern { facility(kern) and not level(debug); }; Any ideas ?? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I am not the poet of goodness only....I do not decline to be the poet of wickedness also. -Walt Whitman ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

HP-UX logging solved (I think...)
by Stefan Nilsson 05 Mar '01

05 Mar '01

Hi, Finally I've managed to remove those strange extra lines from my logfiles: It turned out that /dev/log always gets 4096 bytes written to it, regardless of the length of the log entry - so I changed the MAX_LINE macro in read_line.h(libol) to 4096. I Also made a change to sources.c in the while (eol) loop in the function 'do_read_line'; after the call to do_handle_line I added the following lines: closure->pos = 0; return ST_OK | ST_GOON; This means that we will only log the first log-entry in the buffer, I think thats ok because the rest of the buffer seems to contain plain rubbish. Oh, I almost forgot; I'm using gcc on a HP-UX 11.00 system, libol 0.2.21, syslog-ng 1.4.4 Regards /stefan

2 1

filter syslog
by pierrick le fol 05 Mar '01

05 Mar '01

Hello, I seek a person who could help me in the filtering of event syslog. I wish filter the messages by address IP. If you have information or competences in this field, I am taking. Thank you for

2 2

no match() statement
by death die 02 Mar '01

02 Mar '01

For some reason for the sonicwall lines the "sonicwall" line doesn't seem to filter messages taht have proto=http even though I specify not match. source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal (); }; source network { udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514));}; destination messages { file("/var/adm/messages"); }; destination non-catch { file("/var/syslog/non-catch"); }; destination console { usertty("root"); }; destination auth { file("/var/log/authlog"); }; destination mail { file("/var/log/syslog"); }; destination debug { file("/var/log/debug"); }; destination console_all { usertty("*"); }; destination sonicwall { file("/var/syslog/sonicwall"); }; destination sonicwall-www { file("/var/syslog/sonicwall-www"); }; filter f_sonicwall { host("sonicwall") and not match("proto=http"); }; filter f_sonicwall-www { host("sonicwall") and match("proto=http"); }; filter f_auth { facility(auth); }; filter f_syslog { not facility( mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; log { source(network); filter(f_sonicwall-www); destination(sonicwall-www); }; log { source(network); filter(f_sonicwall); destination(sonicwall); }; log { source(local); filter(f_auth); destination(auth); }; log { source(local); filter(f_syslog); destination(messages); }; log { source(local); filter(f_daemon); destination(messages); }; log { source(local); filter(f_kern); destination(messages); }; log { source(local); filter(f_mail); destination(mail); }; log { source(network); filter(DEFAULT); destination(non-catch); _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

1 0

program() destination
by Maciek Pasternacki 01 Mar '01

01 Mar '01

Hello, I have following configuration on my machine: source logdev { unix-stream("/dev/log"); }; destination foo { program("/home/foo/.bin/loglogs.pl"); }; filter f_foo { not priority(debug) and not facility(mail); }; log { source(logdev); filter(f_foo); destination(foo); }; File /home/foo/.bin/loglogs.pl come as follows: #!/usr/bin/perl open FOO, ">/tmp/loglog.log"; while ( <STDIN> ) { print FOO $_; } close FOO; Could anybody tell why file /tmp/loglog.log stays empty no matter what I do? Greets, --Maciek -- __ Maciek Pasternacki <maciekp(a)japhy.fnord.org> [ http://japhy.fnord.org/ ] `| _ |_\ / *CENSORED* ( full version at http://japhy.fnord.org/sig.txt ) ,|{-}|}| }\/ \/ |____/

2 2