January 2002 - syslog-ng - lists.balabit.hu

[PATCH] netmask-filter
by Gert Menke 04 Feb '02

04 Feb '02

Hi everybody, I have implemented a new filter for syslog-ng. You can now filter log messages based on their sender's IP address like this: # match a single host filter f_noc21 { netmask("134.130.3.73"); }; # match a whole subnet filter f_noc { netmask("134.130.3.0/255.255.255.0"); }; I'll attach patches for syslog-ng versions 1.4.14 and 1.5.13. I have also made a small patch that fixes the behaviour of the emulated inet_aton function in utils.c. (It would not work with "255.255.255.255".) On some architectures you need this patch for my netmask-filter to work properly! Have fun and tell me what you think about it! Greetings Gert

5 12

host() expression
by Chuck Kelly 04 Feb '02

04 Feb '02

I would like to be able to create a single filter for multiple hosts. Can someone help me with the syntax. i.e. filter f_sec1 { program(sudo) and host(host1 or host2 or host3) ; }; -- Chuck

2 1

Regular Expressions with Syslog-nt
by Leon Oosterwijk 04 Feb '02

04 Feb '02

All, I'm trying to use Regular Expressions for my hostname. I'm running into somewhat of a problem with finding out what I can match on. Here are my questions. I appears that the logging only matches on the host portion of the hostname unless you turn on use_fqdn(yes); in the options section. However, if I turn this on, it will start writing the entries to the log file as: > Jan 30 13:19:15 gw03-bna.isdn.net/gw03-bna.isdn.net I wish it to only write > Jan 30 13:19:15 gw03-bna/gw03-bna But still be able to match on FQDN. (BTW, what is the deal with the hostname/hostname. Can I make it just be "hostname" no slashes, and name duplication) The second issue is the RegEx Syntax. I'm trying this: filter f_rtr_bna { host("^.*rtr.nrep.bna.isdn.net$"); }; filter f_rtr_mem { host("^.*mem.isdn.net$"); }; Which is obviously not working. What do need to do here?

2 1

buffering during network outage between relays
by Martin, Sylvain R. (LNG) 04 Feb '02

04 Feb '02

We're logging the data to a central database from 2 relays. Is there a way for syslog-ng to buffer the data while the database server is rebooting or innaccessible? Here's our current setup. All machines forward the syslog msg to either a production or development relay which runs syslog-ng and then the messages are forwarded to a server running an oracle DB. You may wonder why we have 2 relays... well we have a few hundrer servers and workstations and we're just implementing the DB aspect of it. 15 Millions rows for 6months growing by 100K rows/day. on the DB server I have a custom written syslogd which buffers data in case the DB is down but the problem resides with syslog-ng interrupting the relay, for 60 seconds, of messages to the oracle DB server if the server dies or reboots. Is there someway for syslog-ng to relay missed messages? The only other way I can think of doing it is kinda messy... having syslog-ng dump to a FIFO pipe where a perl script could buffer the data in an array or file until the DB server comes alive again. We're using 1.4.14 -------------------- - Cloud of servers - -------------------- / \ / \ -------- ------- relays - prod - - dev - -------- ------- \ / \ / ------------- - oracle DB - ------------- Sylvain Martin

2 1

[PATCH] Bug in syslog-ng-1.5.13/src/affile.c/expand_macro
by Gert Menke 04 Feb '02

04 Feb '02

Hi! I think I have found a small bug/typo in affile.c. Here's the patch: diff -r -U3 syslog-ng-1.5.13-orig/src/affile.c syslog-ng-1.5.13-patched/src/affile.c --- syslog-ng-1.5.13-orig/src/affile.c Wed Oct 24 12:46:06 2001 +++ syslog-ng-1.5.13-patched/src/affile.c Tue Jan 29 14:21:25 2002 @@ -578,11 +578,11 @@ break; } break; + } case M_MESSAGE: { /* message */ length = append_string(dest, left, msg->msg->data, msg->msg->length, escape); break; - } } default: break; Greetings Gert

2 1

questions
by luoli1974 30 Jan '02

30 Jan '02

hello! I meet some questions when I make syslog-ng .Sure that I configure it before doing this. Questions reports: sources.h:33: list.h: No such file or directory main.c:29: format.h: No such file or directory main.c:30: werror.h: No such file or directory ... etc. version:1.4.4 Give me help ,Thanks for you help! ============================================================= http://popme.163.com/sms/vip.html ¶©°üÔÂ¶ÌÐÅÏ¢¡¢ËÍÍøÒ×VIPÊÕ·ÑÓÊÏä http://friend.163.com ÓÐÊÖ»úŸÍÄÜVœ»ÓÑ£¬ŽŽÔìVÉú»î£¡ http://news.163.com/editor/etalk.html ÍøÑÔÒ×Óï£ºÆß×ì°ËÉàŽóŒÒËµ http://love.163.com ŽºÌì»š»á¿ª£¬ÄÐº¢Å®º¢ÒªÁµ°®¡«

2 1

possible bug in syslog-ng with logrotate?
by greg whorley 30 Jan '02

30 Jan '02

I edited my log rotate conf file on RH 7.2 so that it will rotate/gzip the custom log names I have given for the normal logs (i.e. messages is now big.log and maillog is mail.log). A couple days ago, the log rotator did it's job and rotated/gzipped the logs. However, no new logs appeared. I noticed this two days after the rotation. I restarted syslog-ng and they started filling up again. Does anyone know why this may have happened? -- _______________________________________________ Sign-up for your own FREE Personalized E-mail at Mail.com http://www.mail.com/?sr=signup Win a ski trip! http://www.nowcode.com/register.asp?affiliate=1net2phone3a

2 1

syslogd logging to syslog-ng. [2]
by Yan Lau 29 Jan '02

29 Jan '02

I knew I forgot to put this in my previous message. I've distilled my syslog-ng.conf file to: # syslog-ng configuration file. options { sync (0); time_reopen (10); log_fifo_size (1000); create_dirs (yes); chain_hostnames (yes); use_dns (no); use_fqdn (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); tcp(); udp(); }; destination d_file_messages { file("/var/adm/messages" perm(0644)); }; filter f_lvl_err { level(err); }; log { source(s_sys); filter(f_lvl_err); destination(d_file_messages); } When I start syslog-ng, I get this: # /usr/local/sbin/syslog-ng -v -f /tmp/my.conf binding fd 7, inetaddr: 0.0.0.0, port: 514 binding fd 8, inetaddr: 0.0.0.0, port: 514 Yan.

1 0

syslogd logging to syslog-ng.
by Yan Lau 29 Jan '02

29 Jan '02

I've set up a server with syslog-ng. It works find for local messages. On another server I'm running the syslogd that came with the system (Solaris). I've tried to set up the old syslogd server to forward messages to the syslog-ng server. However, I can not get it to work. For instance, I have under the old syslog.conf: user.notice @log.globix.net In debug mode it shows: writemsg(6): Logging msg 'Jan 29 14:26:27 ylau: hi there' to FORW log.globix.net However, when I truss syslog-ng with -dv options, it doesn't receive anything. I'd rather not have to install syslog-ng on all the servers. Yan. (I speak for myself only)

2 1

How do I make logging of a message to stop after certain filter?
by Subodh Nijsure 29 Jan '02

29 Jan '02

Hello, I have seen reference to this in some syslog-ng document but I can not find it now. What I want to do is log ftpd or dhcpd related messages to go to ftpd.log and dhcpd.log respectively. But I also have "default" rule that catches all messages not logged, currently what is happening is all the ftp and dhcpd messages are getting logged to ftpd.log and dhcpd.log , but they are also getting logged to here is the relevant section of the syslog-ng.conf file source scm_messages { unix-dgram("/dev/log"); internal(); }; filter f_ftpd { match("ftpd"); }; filter f_dhcpd { match("dhcpd"); }; destination ftpdlog { file("/var/log/ftpd.log"); }; destination dhcpdlog { file("/var/log/dhcpd.log"); }; destination scmlog { file("/var/log/scm.log"); }; log { source(scm_messages); filter(f_ftpd); destination(ftpdlog); }; log { source(scm_messages); filter(f_dhcpd); destination(dhcpdlog); }; <<- I want ftp logging to stop here log { source(scm_messages); destination(scmlog); }; <<---- This is my catchall entry Also does syslog-ng have any options to set max-size of the log file? or do I have to run logroate? Thanks. /Subodh Nijsure Software Manager - Network Media Routers SkyStream Networks

1 0