June 2001 - syslog-ng - lists.balabit.hu

Filtering "syslog-ng daemon" logs
by Eric Parusel 05 Jun '01

05 Jun '01

Hi, I'd like to filter out the syslog-ng logs that I get in my /var/log/messages file. Can I use a command-line flag to turn off these logs?: Jun 4 10:20:00 ldap1 syslog-ng[84369]: io.c: do_write: write() failed (errno 32), Broken pipe Jun 4 10:20:00 ldap1 syslog-ng[84369]: Connection broken, reopening in 60 seconds Jun 4 10:21:00 syslog1 syslog-ng[274]: AF_INET client connected from 127.0.0.1, port 1046 If not, can will the following filter work? filter f_nosyslog-ng { program("syslog-ng") and ( match("io\.c\:") or match("Connection\ broken\,\ reopening") or match("SIGHUP") or match("AF_INET_client") ); }; Did I use the brackets correctly? filter foo { program() and (match() or match() ); }; I'm no expert with regular expressions or syslog-ng filters, so bear with me :) As well, I'm using a tcp connection over stunnel, I would assume that it is normal to receive these messages occasionally? Thanks, Eric Parusel Systems Administrator Global Relay Communications

2 1

AIX and repeated message formats - fix?
by Jon Marks 04 Jun '01

04 Jun '01

Earlier I posted a message asking about whether syslog-ng had standard equipment for dealing with a couple of strange message types: 1) Messages forwarded by AIX syslogd which contain the string "Message forwarded from [hostname]: " ... and 2) Messages of the form: "last message repeated _n times" I haven't received any responses. I've read traffic in the mailing list archives (e.g. December 2000) regarding the topic, but I haven't found any solutions. If I've missed something vital, please help me and let me know about it.. I certainly apologize if I haven't been observant enough to skim the answers from the available resources. I've taken a stab at solving the problem myself, and I thought I'd share it with all of you. Those of you who are so much more familiar with the source than I, please comment about whether you find I might have broken other functionality or adversely affected performance. I'm glad for you suggestions, or if this can help somebody else. For my installation, being able to handle AIX messages is particularly important. My solution is just a simple and straightforward refactoring in log.c/parse_log_msg(). A patch against the 1.4.11 source distribution is attached to this message. I've tested it only on AIX, but I think it ought to work elsewhere since it only adds standard library stuff. (Basically, a couple of memcmp's). Some commented-out debugging output (to stderr) is there, too, if you'd want to enable it. I'll describe the intended effects of this patch: 1) Messages forwarded by AIX systems are recognized, and the source hostname is taken from the string appended by AIX syslogd. For example, MMM DD HH:MM:SS Message forwarded from <hostname>: ... will use <hostname> for the source address. "Message" isn't taken as the source host. 2) If the message is forwarded by AIX syslogd but originally of syslog-ng origin, it'll have the form MMM DD HH:MM:SS Message forwarded from <hostname>: source@hostname ... In this case, "source@hostname" will be used as the source hostname (so that syslog-ng's source info is preserved). 3) If the message doesn't contain a hostname because it's of the form MMM DD HH:MM:SS last message repeated *n* times then it won't try to extract one (so it won't improperly use 'last'). The hostname will just come later when in sources.c it's gotten from the message source socket or wherever. 4) If the message is a "last message repeated ..." which was *also* forwarded by an AIX syslogd, it'll get the hostname extracted from AIX's "Message forwarded from ..." message. I'm no expert in the syslog protocol/format, and I can see there is variablilty in implementation. So I'm certain there are plenty of cases that are left unaddressed. If you don't find this patch helpful in general, perhaps its useful for some common cases. One thing that's not addressed: When a "last message repeated ..." line is received, it's certainly helpful to know *which* was the last line-- the one that got repeated. If you're outputting to files by PROGRAM, then no program name is inherently available from this kind of message itself. And syslog-ng isn't keeping track of what PROGRAM logged last from a particular source host. So these "last message repeated ..." messages won't fall into the same logs as the lines for the PROGRAMs which produced the repeated messages. No simple solution is readily apparent to me... Also, please note that "keep_hostname(yes)" is important, otherwise the AIX sender of forwarded messages is used anyway-- despite that the real origin is available. If you use chain_hostnames(yes), then this info ought to be preserved anyway. Again, please comment and critique! Thanks very much. -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign

3 5

Log paths that DON'T stop matching....
by David Douthitt 04 Jun '01

04 Jun '01

It's hard to explain what I want, but here I'll try. A normal log path is thus: log { source(...); filter(...); destination(...); }; ...and when a match occurs (source and filter) then the message is sent to the destination and matching stops. To do what I'd like, with what I've seen so far, is to do something like this: log { source(a); filter(f_ba); destination(c); destination(d); }; log { source(a); filter(f_bb); destination(c); destination(e); }; log { source(a); filter(f_bc); destination(c); destination(f); }; log { source(a); filter(f_bd); destination(c); destination(g); }; log { source(a); filter(f_other); destination(c); }; What I'd like would be something closer to this - taking "passthru" to be an option to NOT stop filtering: log { source(a); filter(f_ba); destination(d); passthru; }; log { source(a); filter(f_bb); destination(e); passthru; }; log { source(a); filter(f_bc); destination(f); passthru; }; log { source(a); filter(f_bd); destination(g); passthru; }; log { source(a); filter(f_other); destination(c); }; This would be very much useful in situations like: log { source(internal); filter(f_crit); destination(pager); } log { source(internal); filter(DEFAULT); destination(mesg); } Or other similar...

2 2

Irix Support?
by Sean Brannon 02 Jun '01

02 Jun '01

I've grep'd thru the last 1.5 years of this mailing list and not come up with a definitive answer so I have to ask: Does syslog-ng compile and function properly on Irix 6.5.x? TIA....

1 0

syslog server for more 8 devices
by colette tostivint 01 Jun '01

01 Jun '01

Hi everybody, I setup a syslog server in order to monitoring routeurs and firewalls. I use this command : logging facility local0 ..................... logging facility local7 so I can only 8 devices and each device sends syslog messages to the same log file on my server. Only EIGHT devices? Thanks Colette

2 1

Re:
by colette tostivint 01 Jun '01

01 Jun '01

confirm 966360

1 0