July 2001 - syslog-ng - lists.balabit.hu

syslog-ng.conf
by Nijs, Daniel 10 Jul '01

10 Jul '01

Hello, I am relatively new to syslog-ng (only been running it for a month) and love the software. I would like to congratulate the author on doing such a great job. This is a powerful product, and with this comes complexity, and I have a few questions I am not able to find an answer for. I have a webserver logging to a centralized host, and I filter the logs using specific criteria (i.e. document name). Let's give this file a name to make this question easier to understand. I log this data to hits.log. Now, I want to filter out a certain IP to a separate file (ip.log), and not show the entries that were logged to ip.log in hits.log. It seems that syslog-ng keeps processing all rules, even after there was a match. I was hoping that there was an option to stop processing any further rules for that matched data to solve this problem, but am unable to find any solution. Does anyone have any suggestions on how to do this? Thanks. Best regards, Dan

1 0

From Linux to Solaris
by Brian E. Seppanen 09 Jul '01

09 Jul '01

Hello: I'm in the process of moving logging from a linux box to a solaris 2.6 box. Can someone who's done similar point out any caveats of doing so? Will I only need to enable a new source for door? Are kernel messages still handled by /proc/kmesg? Any help appreciated...Thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

2 1

Log Stopage
by Gorm Jensen 08 Jul '01

08 Jul '01

After upgrading from RH6.1 and syslog-ng-1.4.2 to RH7.1 and syslog-ng-1.4.11, only the first hit of a series of hits on the firewall is logged. Restarting the daemon will cause the next hit to be logged, but no more than that. Only the logging of firewall hits is effected. After a great deal of trial and error, I traced the problem to a specific destination in the configuration file. I have attached two verions (Linux text and MS.txt) of the config file. To simplify the configuraton for testing, I deleted several other log destinations, filters and actions. The anomaly persisted, even with the simplified configuration. When the lines containing the destination 'whodat' are commented out, logging proceeds as expected. When the comments are aranged to include either one of the lines containing the whodat destination, the logging reverts to what is described in para one. Can anyone tell what is required to fix the problem?

2 1

Duplicate Entries
by Vinay Bharel 08 Jul '01

08 Jul '01

I just started running syslog-ng on a Linux box. I have also configured one of my Solaris 8 servers to send logs to this machine. I have noticed that I get duplicate log entries sometimes. I can't figure out why. For example: Jul 3 20:32:44 dns-a vinay: [ID 702911 daemon.warning] test Jul 3 20:32:44 dns-a vinay: [ID 702911 daemon.warning] test Jul 3 20:32:44 dns-a vinay: [ID 702911 daemon.warning] test Jul 3 20:32:44 dns-a vinay: [ID 702911 daemon.warning] test The Solaris 8 box has the following entry in it's syslog.conf: *.debug @loghost This is my syslog-ng.conf: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); }; source external { udp(ip (0.0.0.0) port(514)); }; filter f_filter1 { level(info) and facility(user) or facility(kern) or facility(mail) or facility(daemon) or facility(daemon) or facility(auth) or facility(lpr) or facility(news) or facility(uucp) or facility(cron) or facility(syslog) or facility(ftp) or facility(authpriv) or facility(cron); }; filter f_dns-a { host(dns-a); }; destination d_dns-a { file("/var/log/machine/$YEAR/$MONTH/$HOST.$DAY");}; log { source(external); filter(f_dns-a); destination (d_dns-a); }; - Vinay Bharel <vinay(a)bharel.com>

2 1

Syslog.conf translator
by Keith Morse 05 Jul '01

05 Jul '01

This is a follow on to Jonathan Marks awk script published 1 May 2001. I've just started down the path to enlightenment (or getting up to speed on syslog-ng) with respect to implementing on solaris. A couple of notes in relation to your awk script. 1. I believe the error you are getting is due to the fact you were probably using the original awk variant. "close()" is only applicable for nawk and gawk. Which make sense as Balazs Scheidler had luck with this on Linux, which if I remember correctly awk is a link to gawk. 2. Conversely I couldn't get the script to work with the file as an arguement but only if I fed it to the script. Go figure? Thanks for taking the time to write this script. I think it will help in providing me a starting place to figure this critter out. >On 4 May 2001, Jon Marks j-marks(a)uiuc.edu spake thusly: > >Hi, > >I've tried out the copy of the awk script syslog2ng incorporated into >the development branch contrib directory-- but it won't run. It's a >parse error that only seems to crop up when awk is fed this program on >its stdin, but not as a command line argument. I'm still not sure why >it doesn't work-- what about its parsing would change using -f? Any >seasoned awk programmers out there want to help out? I'm grateful for >any advice! It's always the same syntactic construct that causes the >error: >BEGIN { > # Handle the various platforms- determine proper log device > "/bin/uname -s" | getline sysname; # <-- ERROR HERE!! > close("/bin/uname -s");

1 0