July 2001 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]Include files in Config
by Andrew Fort 18 Jul '01

18 Jul '01

Hi Brian, >Would it be possible to have a config file read in include >files that have >other definitions. I haven't seen anyone mention such a patch, but, you can use a makefile to build the single config file from multiple build files. You could use the Makefile to kill -HUP also, leaving updating your syslog-ng as simple as "cd blah && make" -afort

1 0

Include files in Config
by Brian E. Seppanen 17 Jul '01

17 Jul '01

Would it be possible to have a config file read in include files that have other definitions. For example, say I've got six different markets with cisco's all logging to different places is it possible to do include city1 include city2 include city3 This wouldn't serve much purpose other than cleaning up my config file I suppose, but that would help quite a bit. Has anyone implemented something similar? Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

1 0

RE: syslog-ng digest, Vol 1 #465 - 2 msgs
by Rolland, Yan 17 Jul '01

17 Jul '01

There is a problem with version 1.5.8. The config file that the daemon is checkin for is syslog-ngsyslog-ng.conf Seems like an accidental repeat. Should be syslog-ng.conf Yan Rolland The Parameter -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] Sent: Saturday, July 14, 2001 00:57 To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng digest, Vol 1 #465 - 2 msgs Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-admin(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: pulling data from a file (Brad Arlt) 2. Syslog 1.4.12, Solaris 8-x86: Too few arguments... (Sander) --__--__-- Message: 1 Date: Fri, 13 Jul 2001 14:02:57 -0600 From: Brad Arlt <arlt(a)cpsc.ucalgary.ca> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]pulling data from a file Reply-To: syslog-ng(a)lists.balabit.hu On Fri, Jul 13, 2001 at 12:32:39PM -0500, Matt Okeson-Harlow wrote: > this is all well and good, a fifo works just fine, > only problem is that cnr rolls the log files over itself... > any ideas on how to get a tail -f to reset and start reading the new file? tail won't. You would normally restart tail. You could just put the needed commands in your log rolling script. ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_) --__--__-- Message: 2 Date: Fri, 13 Jul 2001 23:25:10 +0200 From: Sander <sander(a)sanderscorner.com> To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Syslog 1.4.12, Solaris 8-x86: Too few arguments... Reply-To: syslog-ng(a)lists.balabit.hu I'm trying to compile syslog-ng 1.4.12 using gcc-2.95.3 and receive this error: gcc -DHAVE_CONFIG_H -I. -I/v/src/syslog-ng-1.4.12/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c: In function `io_stream_get': afstreams.c:167: too few arguments to function `init_file' *** Error code 1 make: Fatal error: Command failed for target `afstreams.o' Current working directory /v/src/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /v/src/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /v/src/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Anyone seen this before? Sander P.S.: Another minor point (just a warning), gcc also complains about this: gcc -DHAVE_CONFIG_H -I. -I/v/src/syslog-ng-1.4.12/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c log.c log.c: In function `parse_log_msg': log.c:58: warning: subscript has type `char' --__--__-- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng End of syslog-ng Digest

2 1

Syslog 1.4.12, Solaris 8-x86: Too few arguments...
by Sander 17 Jul '01

17 Jul '01

I'm trying to compile syslog-ng 1.4.12 using gcc-2.95.3 and receive this error: gcc -DHAVE_CONFIG_H -I. -I/v/src/syslog-ng-1.4.12/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c: In function `io_stream_get': afstreams.c:167: too few arguments to function `init_file' *** Error code 1 make: Fatal error: Command failed for target `afstreams.o' Current working directory /v/src/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /v/src/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /v/src/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Anyone seen this before? Sander P.S.: Another minor point (just a warning), gcc also complains about this: gcc -DHAVE_CONFIG_H -I. -I/v/src/syslog-ng-1.4.12/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c log.c log.c: In function `parse_log_msg': log.c:58: warning: subscript has type `char'

3 2

syslog binary error
by Ravi Malghan 16 Jul '01

16 Jul '01

Hello: I created a pkg (using pkgmk, pkgtrans) for syslog1.4.11 for solaris 7. I installed it on another solaris machine. It seems to be running normal, where syslog messages are passed from source to desitnation etc. But when I start the syslog-ng it outputs the string "Terminated". But the syslog is still running in the background. I donot get this error on the machine where I compiled the source code. Anybody noticed this? Thanks Ravi __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

1 0

RE: [syslog-ng]some basic questions syslog-ng
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 16 Jul '01

16 Jul '01

Ravi, Well, you are close but not quite there. When you set up a network source such as tcp or udp you are merely setting up a socket on which the server listens. It doesn't listen for a particular host. You set the server up to receive from a source and then you have your client log to that ip/port on the server. For example: source s_tcp { tcp(ip(192.168.1.1) port(2222)); }; This will cause syslog-ng to listen for log messages on the interface with 192.168.1.1 ip address and port number 2222. It doesn't matter where the messages is coming from. That is handled with the filters: filter f_host10 { host("192.168.10.1"); }; This will filter out the host with the ip address of 192.168.10.1. Then to log the remote host to the server you would use this line in your server: log { source(s_tcp); filter(f_host10); destination(d_host10); }; where d_host10 is a destination which the definition is not shown here. Hope this helps. Regards, Drew -----Original Message----- From: Ravi Malghan [mailto:rmalghan@yahoo.com] Sent: Friday, July 13, 2001 5:25 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]some basic questions syslog-ng So if I want to accept syslog messages on syslog-ng server X/port: 1111 from host 192.168.1.1, port: 2222 and host 192.168.10.1, port: 2222. I will have the following on server X source host10 {tcp(ip(192.168.1.1) port(2222); tcp(ip(192.168.10.1) port(2222); }; destination host10logs { file("/var/adm/host10.log" compress(on) sync(0); }; log {source(host10);destination(host10logs); }; Is this correct? I will similarly set the destination on the client machines to have destination {tcp(ip(server X) port (1111);} What does filter host10 {host("192.168.1.1"); }; give me ? Thanks Ravi --- "Hamilton, Andrew Mr RAYTHEON 5 SIG CMD" <HamiltonA(a)hq.5sigcmd.army.mil> wrote: > 1. The client syslog-ng makes a TCP connection to > the server which is > listening for a TCP request. > 2. Standard syslog is UDP and doesn't do TCP. You > have to have syslog-ng on > both the client and the server. > 3. The port is the same as the UDP port, 514. You > can have both types on > the same port. Yes you do have control over it. > You can change the source > port on the server and change the destination port > on the client. > > Regards, > Drew > -----Original Message----- > From: Ravi Malghan [mailto:rmalghan@yahoo.com] > Sent: Thursday, July 12, 2001 9:58 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]some basic questions syslog-ng > > > Hi I have few basic questions about syslog-ng. If > somebody can give me answers or give me some > pointers. > I am using syslog-ng to log syslog messages from a > client to server and a firewall between them. > 1. How is the sysloging TCP instead of UDP? Is this > something the syslog-ng needs to be configured. > 2. The client which initiates the syslog logging, is > this normal syslog client? or do I need to install > syslog-ng there too? > 3.When it uses TCP, which port does it use? Does the > user have control over the port number? > > Thanks in advance > Ravi > > > __________________________________________________ > Do You Yahoo!? > Get personalized email addresses from Yahoo! Mail > http://personal.mail.yahoo.com/ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 2

pulling data from a file
by Matt Okeson-Harlow 13 Jul '01

13 Jul '01

i have a question about syslog-ng and it's ability to pull from a non syslog file, i have a cisco network registrar dhcp server that is looking to /var/nwreg2/logs/name_dhcp_1_log (standard location) on Solaris 2.7 however when i have a source of source cnr { file("/var/nwreg2/logs/name_dhcp_1_log"); }; nothing gets logged, i did some reading it seems people have tried using logger to get to these kind of log files (tail -f | logger) however either i am missing something or it does not work here, anyone have any ideas? btw, syslog-ng when it starts up gives a EOF error which i am assuming is because it is expecting the file to never end. any ideas that anyone has would be appreciated -- matt okeson-harlow matt at technomage.net http://www.technomage.net ($do || !$do) && undef($try) ; # Master of Perl, Yoda is. Hmmmm? http://shellforce.com <- shell accounts - web hosting -> http://cyberius.net send icbm here =--> 43°3'11'N-89°28'52"W

4 4

anybody have syslog-ng binary?
by Ravi Malghan 13 Jul '01

13 Jul '01

Hi: Does anybody have syslog-ng binary to run on Solaris 2.7? If yes, could you please share it Thanks Ravi __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

1 0

RE: [syslog-ng]some basic questions syslog-ng
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 13 Jul '01

13 Jul '01

1. The client syslog-ng makes a TCP connection to the server which is listening for a TCP request. 2. Standard syslog is UDP and doesn't do TCP. You have to have syslog-ng on both the client and the server. 3. The port is the same as the UDP port, 514. You can have both types on the same port. Yes you do have control over it. You can change the source port on the server and change the destination port on the client. Regards, Drew -----Original Message----- From: Ravi Malghan [mailto:rmalghan@yahoo.com] Sent: Thursday, July 12, 2001 9:58 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]some basic questions syslog-ng Hi I have few basic questions about syslog-ng. If somebody can give me answers or give me some pointers. I am using syslog-ng to log syslog messages from a client to server and a firewall between them. 1. How is the sysloging TCP instead of UDP? Is this something the syslog-ng needs to be configured. 2. The client which initiates the syslog logging, is this normal syslog client? or do I need to install syslog-ng there too? 3.When it uses TCP, which port does it use? Does the user have control over the port number? Thanks in advance Ravi __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

filter(DEFAULT); not working?
by Volker Apelt 13 Jul '01

13 Jul '01

Hallo, I tried to use the filter(DEFAULT); expression but failed. Entries like <<datum>> www imapd[27520]: open: user va opened INBOX.misc.Tipps-und-Tricks <<datum>> www imapd[27520]: open: user va opened INBOX.OS.Netware.Tools <<datum>> www imapd[27520]: open: user va opened INBOX.Abfall <<datum>> www imapd[27555]: login: apelt-pc.in-house[192.168.51.2] va plaintext <<datum>> www imapd[27555]: seen_db: user va opened /var/imap/user/v/va.seen <<datum>> www imapd[27555]: open: user va opened user.va.Listen.SuSE.Security go to the default destination, too, although they have been written to some other destination already _and_ are explicitly excluded in the DEFAULT expression. Here is the log expression, which is responsible for the mysterious filter results. #all, not yet handled, should be low traffic log { source(src); filter(l_warn_or_worse); filter(F_not_mail); filter(F_not_news); filter(F_not_syslog); filter(f_not_kommunikation); filter(DEFAULT); destination(daemon); }; Is this a case of docu missinterpretation ? I have appended a shortend version of my syslog-ng.conf file a below. Thanks Volker Apelt -- Volker Apelt Group of Prof. Dr. Ch. Griesinger Dipl. Chem. Johann Wolfgang Goethe Universität +49 6172 31126 Frankfurt am Main, Germany va .@. org.chemie.uni-frankfurt.de (remove the dots, please) ###### part of syslog-ng.conf options { long_hostnames(off); sync(0); }; source src { unix-stream("/dev/log"); file("/proc/kmsg"); unix-stream("/cache/chroot/named/dev/log"); internal(); }; destination daemon { file("/var/log/daemon"); }; destination mailstore_info { file("/var/log/mail/mail_store.info"); }; destination mailstore_warn { file("/var/log/mail/mail_store.warn"); }; destination mailstore_err { file("/var/log/mail/mail_store.err"); }; filter F_news { facility(news); }; filter F_not_mail { not facility(mail); }; filter F_not_user { not facility(user); }; filter F_not_news { not facility(news); }; ### Levels # debug, info, notice, warning, err, crit, alert, emerg filter l_debug { level(debug); }; filter l_debug_or_worse { level(debug..emerg); }; filter l_info { level(info); }; filter l_info_or_worse { level(info..emerg); }; filter l_normal { level(info..notice); }; filter l_not_debug { level(info..emerg); }; filter l_notice { level(notice); }; filter l_notice_or_worse { level(notice..emerg); }; filter l_warn { level(warn); }; filter l_warn_or_worse { level(warn..emerg); }; filter l_err { level(err); }; filter l_err_or_worse { level(err..emerg); }; filter l_crit { level(crit); }; filter l_crit_or_worse { level(crit..emerg); }; filter l_alert { level(alert); }; filter l_alert_or_worse { level(alert..emerg); }; filter l_emergency { level(emerg); }; filter f_mailstore { not program("postfix.*") and ( program("imapd.*") or program("imap.*") or program("popper.*") or program("procmail.*") ) ; }; filter f_not_kommunikation { not program("imap.*") and not program("imapd.*") and not program("leafnode.*") and not program("mailfw.*") and not program("popper.*") and not program("postfix.*") and not program("procmail.*") and not program("qmgr.*") and not program("sendmail.*") and not program("test_filter.*") and not program("fetchnews") and not program("imapd.*") and not program("postfix.*") and not program("texpire"); }; # # a lot of other log {}; destinations .. # ## mail store server log { source(src); filter(F_mail);filter(f_mailstore); filter(l_debug_or_worse); destination(dev_null);}; log { source(src); filter(F_mail);filter(f_mailstore); filter(l_normal); destination(mailstore_info);}; log { source(src); filter(F_mail);filter(f_mailstore); filter(l_warn_or_worse); destination(mailstore_warn);}; log { source(src); filter(F_mail);filter(f_mailstore); filter(l_err_or_worse); destination(mailstore_err);}; #all, not yet handled, should be low traffic log { source(src); filter(l_warn_or_worse); filter(F_not_mail); filter(F_not_news); filter(F_not_syslog); filter(f_not_kommunikation); filter(DEFAULT); destination(daemon); };

1 0