June 2001 - syslog-ng - lists.balabit.hu

Virus
by colette tostivint 22 Jun '01

22 Jun '01

Hi everybody I need a virus to do tests for a new mail server. Can you send a virus, please.. Thanks Colette

2 1

syslog entries without hostnames
by David Douthitt 20 Jun '01

20 Jun '01

It seems like there are a LOT of these. Isn't it possible to make some options to handle them? I was thinking of options, but... what about this? Check the hostname of the message against the hostname using DNS and see if they match. If not, shift the message over and put the hostname in - and perhaps label it to show that it was inserted.... So a message from 192.168.3.3 (hostname folly) that contained no hostname but said: "last message repeated 5 times" would then become: Jun-XX XX:XX:XX folly* last message repeated 5 times ...and the log might look like this: Jun-XX XX:XX:XX folly su: access denied Jun-XX XX:XX:XX folly* last message repeated 5 times Jun-XX XX:XX:XX folly --mark-- Well? Only problem I could see is if the hostname in the syslog entry doesn't match the name of the host as a normal event; I don't see this happening. This does, however, generate more DNS traffic, unless you cache the entries - maybe within syslog-ng.

3 4

riverstone devices not logging hostname
by Mickey Everts 19 Jun '01

19 Jun '01

For some reason, our Riverstone routers are not logging their hostnames or IP's. Here is a sample entry: Jun 01 07:28:13 %L2TM-W-INVALID_VLAN, Port et.1.1 receiving frames from non-member VLAN(3265). Possible misconfiguration. Any ideas? All our other network devices work fine, so it's probably something with them, but I was hoping I could fix it on the server side. Is anyone else here using Riverstone? Here is some more info on our setup: Riverstone (http://www.riverstonenetworks.com) info: -- Software Information Software Version : 7.0.0.0 Copyright : Copyright (c) 2000-2001 Riverstone Networks Syslog host: XX.XX.XX.XX, Facility: LOG_LOCAL0 Minimum syslog level: INFO, Buffer Size: 50 messages Source IP address: XX.XX.XX.XX -- Here are my syslog-ng (version 1.4.10) options: -- # Global options { sync(0); log_fifo_size (1000); long_hostnames(off); use_fqdn(yes); use_dns (yes); time_reopen (10); create_dirs (no); keep_hostname (yes); }; -- Regards, -MiC Mickey Everts 415.901.2223 direct Unix System Administrator 415.901.2000 main Yipes Communications, Inc. 415.533.1402 cell http://www.yipes.com/ 415.358.4112 fax

1 0

Access Control List on AIX system
by Kai Wang 18 Jun '01

18 Jun '01

I have been using syslog-ng 1.4.11 for several months. I found the "kill -HUP" command doesn't change an existing log file mode, which means not only the mode and ownership haven't been changed but also the Access Control List(acl) hasn't been changed. I just downloaded and run syslog-ng 1.5.7. I found a big change of this. When you do "kill -HUP", the log files' mode and ownership have been reset and the acl has been disabled. Mode and ownership are not a problem. But I really want to keep the old acl or allow me to reset it like the file mode and ownership. Kai

2 1

syslog-ng / logcheck
by colette tostivint 15 Jun '01

15 Jun '01

Hi everybody I setup a syslog server and upgrade it with syslog-ng for logging lot of firewall pix and routeurs. I use a script Logcheck-1.1.1 to send me the most important logs. Is syslog-ng compatible with logcheck ??? I don't believe. Thanks Colette Tostivint

3 2

compress?
by Rory Toma 15 Jun '01

15 Jun '01

Is compress on the list to be added soon? I'd like to know before I go off and try to add it. Thx. -- Rory Toma rory(a)colinburns.com Game Master http://www.colinburns.com Colin Burns Games

1 0

using ^ and/or $ in a regular expression match
by nick 15 Jun '01

15 Jun '01

Is it possible to use a ^ and $ in a regular expression in syslog-ng? This filter doesnt seem to catch the logged status message below, but if I remove the ^ from the match, then the status message is excluded.. Does syslog-ng just not support ^ and/or $, or is there something else I have to do to get them working? filter f_lost { facility(local0) and program(lost[0-9]*) and not match(^status); }; Jun 14 16:59:39 local@biggayal lost: tcpserver: status: 0/5 -- nick

1 0

separating logs by hostname
by Greg Heim 14 Jun '01

14 Jun '01

I keep reading that syslog-ng has the capability to divert into different log files based on hostname. I'm doing this with an older version by manually specifying for each machine as shown below. I'd like to avoid mucking with the config file every time we add or remove a machine (all the time). I've downloaded 1.5.7, but can't find any examples of this. Is there a simple way to do this or do I need to just add an entry for every new host? filter f_shaggy { host(shaggy); }; destination d_shaggy { file("/var/syslog-ng/shaggy"); }; log { source(src); filter(f_shaggy); destination(d_shaggy); }; TIA, Greg

2 1

syslog on a dec ev6 (es 40) with osf 4.0f?
by Daan Hoogland 14 Jun '01

14 Jun '01

Does anyone have any experience? I try to make this work with gcc and with cxx (from compaq), but neither does. The cxx version cores on startup. The gcc 2.95.2 version starts with 4 alignement messages, and then only reports internal messages and no udp. It also cores when i send it a HUP, after it has said to have reinitialized. I think it is only in compiler options but really haven't a clue. I tried 1.4.11 and 1.5.7. Compiling with -Wcast-align gives warnings on socket operations where a sockaddr_in is used as a sockaddr. Is there an explanation/man/info file for the mechanism with the .x files? tia

1 0

RE: [syslog-ng]newbie Solaris question
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 13 Jun '01

13 Jun '01

What do you mean you can't get it to output every message it receives? I have used syslog-ng on Solaris for 2 years with very few problems and I log over 1000 devices. Do you know if it is receiving messages? You're not running syslogd as well are you? In low volumes the defaults for garbage collection should be sufficient. How many hosts are you logging? Try setting sync(0). Regards, Drew -----Original Message----- From: T. Esting [mailto:T_Esting@excite.com] Sent: Tuesday, June 12, 2001 6:16 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]newbie Solaris question I've been trying to get both 1.4.11 and 1.5.7 to run on my Solaris system, and have met with limited success. Compiling and installing were fairly easy, as was creating a configuration file. I understand from the docs that the mark() feature still doesn't work, and from the mailing list that sync_freq() should actually be sync(). I am having trouble, however, with flushing output in low-volume scenarios. Here is the configuration file I am using: options { use_dns(no); log_fifo_size(XXX); gc_idle_threshold(YYY); gc_busy_threshold(ZZZ); use_time_recvd(yes); }; source sun { sun-streams ( "/dev/log" door("/etc/.syslog_door")); internal(); }; destination testout { file ( "/var/adm/testout.txt" sync(WWW)); } ; log { source (sun); destination (testout); }; I've tried various values for WWW, XXX, YYY, and ZZZ, even setting WWW to 1. I have not been able to influence syslog-ng to write out every message it receives. Does anyone have any pointers on what I might want to try next to get syslog-ng to more reliably receive and log messages on Solaris? Thanks. _______________________________________________________ Send a cool gift with your E-Card http://www.bluemountain.com/giftcenter/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0