May 2001 - syslog-ng - lists.balabit.hu

sending alerts to phones
by foob＠return0.net 10 Jun '01

10 Jun '01

Maybe a bit off topic - but the syslog-ng feature to pipe logs to programs got me thinking: does anyone know of a provider or service that will allow me to send mobile SMS messages from the command line? I like the idea of getting alerts if, say, login fails for root and other such naughtyness :) - foob

4 4

AIX and repeated message formats - fix?
by Jon Marks 04 Jun '01

04 Jun '01

Earlier I posted a message asking about whether syslog-ng had standard equipment for dealing with a couple of strange message types: 1) Messages forwarded by AIX syslogd which contain the string "Message forwarded from [hostname]: " ... and 2) Messages of the form: "last message repeated _n times" I haven't received any responses. I've read traffic in the mailing list archives (e.g. December 2000) regarding the topic, but I haven't found any solutions. If I've missed something vital, please help me and let me know about it.. I certainly apologize if I haven't been observant enough to skim the answers from the available resources. I've taken a stab at solving the problem myself, and I thought I'd share it with all of you. Those of you who are so much more familiar with the source than I, please comment about whether you find I might have broken other functionality or adversely affected performance. I'm glad for you suggestions, or if this can help somebody else. For my installation, being able to handle AIX messages is particularly important. My solution is just a simple and straightforward refactoring in log.c/parse_log_msg(). A patch against the 1.4.11 source distribution is attached to this message. I've tested it only on AIX, but I think it ought to work elsewhere since it only adds standard library stuff. (Basically, a couple of memcmp's). Some commented-out debugging output (to stderr) is there, too, if you'd want to enable it. I'll describe the intended effects of this patch: 1) Messages forwarded by AIX systems are recognized, and the source hostname is taken from the string appended by AIX syslogd. For example, MMM DD HH:MM:SS Message forwarded from <hostname>: ... will use <hostname> for the source address. "Message" isn't taken as the source host. 2) If the message is forwarded by AIX syslogd but originally of syslog-ng origin, it'll have the form MMM DD HH:MM:SS Message forwarded from <hostname>: source@hostname ... In this case, "source@hostname" will be used as the source hostname (so that syslog-ng's source info is preserved). 3) If the message doesn't contain a hostname because it's of the form MMM DD HH:MM:SS last message repeated *n* times then it won't try to extract one (so it won't improperly use 'last'). The hostname will just come later when in sources.c it's gotten from the message source socket or wherever. 4) If the message is a "last message repeated ..." which was *also* forwarded by an AIX syslogd, it'll get the hostname extracted from AIX's "Message forwarded from ..." message. I'm no expert in the syslog protocol/format, and I can see there is variablilty in implementation. So I'm certain there are plenty of cases that are left unaddressed. If you don't find this patch helpful in general, perhaps its useful for some common cases. One thing that's not addressed: When a "last message repeated ..." line is received, it's certainly helpful to know *which* was the last line-- the one that got repeated. If you're outputting to files by PROGRAM, then no program name is inherently available from this kind of message itself. And syslog-ng isn't keeping track of what PROGRAM logged last from a particular source host. So these "last message repeated ..." messages won't fall into the same logs as the lines for the PROGRAMs which produced the repeated messages. No simple solution is readily apparent to me... Also, please note that "keep_hostname(yes)" is important, otherwise the AIX sender of forwarded messages is used anyway-- despite that the real origin is available. If you use chain_hostnames(yes), then this info ought to be preserved anyway. Again, please comment and critique! Thanks very much. -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign

3 5

syslog server for more 8 devices
by colette tostivint 01 Jun '01

01 Jun '01

Hi everybody, I setup a syslog server in order to monitoring routeurs and firewalls. I use this command : logging facility local0 ..................... logging facility local7 so I can only 8 devices and each device sends syslog messages to the same log file on my server. Only EIGHT devices? Thanks Colette

2 1

Question
by colette tostivint 31 May '01

31 May '01

Hi How do you configure syslog-ng.conf for each device sends syslog messages to the different log file on my syslog server and it works like a old syslog.conf. Give me an example of configuration. Thanks Colette

1 0

Running Syslog-ng chrooted
by Kaladis 31 May '01

31 May '01

Dear Mailinglistpeoples, First of all I'd appreciate it if you could cc all replies to kaladis(a)gmx.de since I'm not a member of this mailing list. I am trying to run syslog-ng chrooted - to be accurate, from /usr/jail/syslog. I created /usr/sbin/syslog-ng, created all directories and so on, copied the needed libraries etc. Syslog-ng is starting quite fine within that chrooted environment as user syslog group syslog. However it is not logging anything. I guess that it must have to do with /dev/log since that isn't accesiable out of that environment anymore. Now I'm asking myself how I could have /dev/log under /usr/jail/syslog/dev/log or what else the problem could be. Thanks for your help - Kaladis --- www.maganation.com/~kaladix - Kaladix Linux - Your Secure Linux Choice

6 6

syslog-ng compilation error
by Andrew Small 29 May '01

29 May '01

1 0

figuring out what facility & priority is used
by nick 28 May '01

28 May '01

Maybe I missed something somewhere, I dunno.. Is there anyway to figure out what facility and/or priority a program or logged message is using to log stuff, without going through the source code of the program? -- nick

2 4

kernel logging
by geoffrey 25 May '01

25 May '01

Hi all, I was wondering, sysklogd has two daemons - one for syslogs, and one for kernel logs. Does syslog-ng handle both facilities, or am I missing out on the kernel logs that would be done by klogd? Is there any way to get all of the same logging that I was getting provided by sysklogd? I have read what documentation I can find, but am still a bit confused - obviously. Thanks. geoffrey -- +++++++++++++++++++++++++++++++++++++++++++++++++++ "There really isn't much value in free." -- Doug Miller MS group product manager for competitive strategies +++++++++++++++++++++++++++++++++++++++++++++++++++

4 4

logger & splogger alternatives
by nicholas 25 May '01

25 May '01

Im just wondering if anyone knows of some alternatives to using syslog's logger, or qmail's splogger since it doesnt look like syslog-ng comes with one? -- nick

4 3

simple performance test paradigm
by Jon Marks 25 May '01

25 May '01

Hi, This is in reponse to the request for an alternative logger-- some of this code could probably be adapted for that job without too much fuss. This stuff is tested on Solaris7/8 and AIX4.3.3, but probably not too hard to get to work for other platforms. In any case.. In order to performance-test a syslog-ng installation and compare with vendor syslogd's, I wrote a simple set of three programs. One is the main log message generator (which uses the syslog.h API to log locally), one is a "master" synchronization control, and one gathers the results. These are each little single-sourcefile programs. They're pretty primitive, so don't expect the greatest in command line processing and user interface, but could be useful for setting up, testing, and performance profiling. The main log message generator "syslogtest.c" takes a facility and level, number of repetitions, a sleep interval, and a "server mode" flag on the command line. It locally logs the specified number of messages (like logger, but with with preset content) at the given priority with a sequence number, sleeping the given number of microseconds between each. After logging the battery of messages, the running time for the battery is also logged (and output to the terminal along with PID). In "server mode" it listens to a preset TCP port for a connection from the master synchronization control. The master control "master.c" reads "./servers" for a flat list of hostnames to connect with. Each host runs an instance of "syslogtest" in "server mode". Once connected, the user can give a simple "go" signal or "exit" signal. When the given the "go" signal, each server sends the volley of syslog messages specified on its command line, forks (just to change the reported PID), and waits for another signal. When given "stop" all servers exit. Consider when each host's syslog daemon is configured to send to a common loghost. This lets you recruit a number of synchronized remote hosts to either flood syslog-ng (or syslogd) and measure message loss, or (by using the microsecond sleeping) simulate the intended server load. The last program is a perl script, "results," which takes as arguments a logfile name, a PID, and a number of trials. It reads the logfile, scanning for lines by the given PID, and tracking the sequence numbers to determine which are missing, and reports the results. After running a test trial, this is run at each syslogtest host to determine how many were lost locally (e.g. in AIX's datagram /dev/log socket), and then on the common loghost to determine which ones never made it over the network or were dropped by syslog-ng. You can use this to help you tune output fifo sizes under particular loads, or to determine the maximum reasonable capacity of your loghost. Oh, yeah-- if you invoke the syslogtest.c program as "lasttest" then it omits the sequence numbers. This generates "last message repeated..." output from vendor syslogd's (and was used to develop the patch submitted previously). -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign

2 1