January 2002 - syslog-ng - lists.balabit.hu

Re: [syslog-ng]syslog-ng mistreating data as part of the hostname ?
by Hildenbrand, Patrick 16 Jan '02

16 Jan '02

some more info. tracing the output of the SSR, the packet does not contain the hostname at the proper place but only the timestamp. So the output looks like (translated into ascii): <174>Jan 13 04:02:12 %ACL_LOG-I-DENY, ACL [280] on "rtfa" UDP 192.168.1.2:4721 -> 14.9.1.3:53 The format as described in rfc3164 is only required for relays, which the router is not, as it is the originator of the packet. In fact in the standard it reads: 4.2 Original syslog Packets Generated by a Device There are no set requirements on the contents of the syslog packet as it is originally sent from a device. It should be reiterated here that the payload of any IP packet destined to UDP port 514 MUST be considered to be a valid syslog message. It is, however, RECOMMENDED that the syslog packet have all of the parts described in Section 4.1 - PRI, HEADER and MSG - as this enhances readability by the recipient and eliminates the need for a relay to modify the message. Setting 'keep_hostname(yes)', the message will be displayed correctly but without the hostname (contrary to the normal linux syslog). I could not fiddle out a single set of options that would have given me the output of the standard syslog. Any hints what I can do besides calling an external Program ? Mit besten Grüssen, Kind regards, Patrick Hildenbrand > Patrick Hildenbrand > Operations & Technology > SAP Hosting AG & Co. KG > Raiffeisenring 45 > 68789 St. Leon-Rot, Germany > T +49/6227/7-66410 > F +49/6227/7-66301 > E patrick.hildenbrand(a)sap.com > http://www.saphosting.com >

2 1

Re: [syslog-ng]syslog-ng
by Michael Earls 16 Jan '02

16 Jan '02

I will make things very clear on what i am trying to do with syslog-ng,, i have 200 routers and i want them to all point to my syslog server, that is why i created a sep file for each router, how can i get them to log to a mysql databse, i have tried just loggin one ip to the databse useing sqlsyslogd tables but that did not work, How can I go about getting this to work,?? thanks michael >>> nate(a)campin.net 01/14/02 08:06PM >>> On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier." _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

logging T3 messages to central loghost?
by KONSTANTIN GINZBURG 16 Jan '02

16 Jan '02

Does anybody have experience with logging T3 array messages to a central loghost? I'm running syslog-ng on the central loghost. I have my loglevel set to '3' on the T3 and the following line in /etc/syslog.conf on the T3 (I also have corresponding line in /etc/hosts): *.notice central_loghost In syslog-ng.conf on 'central_loghost' I have: source external { tcp(port(1999) max-connections(50)); }; source external_udp { udp(port(514)); }; filter f_udp { host("some_name") or host("T3_array_name"); }; destination hosts { file("/var/log/$HOST/$FACILITY/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) create_dirs(yes)); }; log { source(external); destination(hosts); }; log { source(external_udp); destination(hosts); }; In other words I'm listening on TCP port 1999 for all hosts except for special cases like T3 (because I don't know any way to make it send its logs via tcp). However, I don't get anything from the T3 array on the central log host even though local 'syslog' on the T3 gets a lot of messages. Am I missing something? I would appreciate any ideas or suggestions. Thanks in advance. Konstantin Ginzburg UNIX Engineering Eagan COSC (651) 406-2614

1 0

Conditional Logic
by jesse.keefe＠convergys.com 16 Jan '02

16 Jan '02

David hit it on the head. The messages I receive are on two seperate lines. The daemon calls for MountTape and on the next line I will get an "open failed". I understand the idea of swatch, we use it here, but I'm trying to kill two birds here. Syslog-ng has the capability of replacing swatch, I've already . I probably could write a small program to evaluate the MountTape, but I was hoping for a simpler solution. Jesse Keefe Analyst Convergys Corp -- NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected.

1 0

iptables and /v/l/messages
by greg whorley 15 Jan '02

15 Jan '02

I got syslog-ng to log iptables messages to /v/l/iptables using match(IN=) and it works fine. However, I still get iptables messages in /v/l/messages because, well, it's supposed to log all info level messages there. I changed my firewall script so that --log-level is 7 (debug) instead of 6 (info). I tested, and the messages are still logging to /v/l/messages. There is no filter for level(debug), only level(info). I bet there is a simple resolution to this. Can anyone help? -- _______________________________________________ Sign-up for your own FREE Personalized E-mail at Mail.com http://www.mail.com/?sr=signup 1 cent a minute calls anywhere in the U.S.! http://www.getpennytalk.com/cgi-bin/adforward.cgi?p_key=RG9853KJ&url=http:/…

1 0

Conditional logic
by jesse.keefe＠convergys.com 15 Jan '02

15 Jan '02

I'm running syslog-ng 1.4.14. I'm running Netbackup and I'm having certain messages paged out to certain people. Is there a way to have a filter use conditional logic? ie: Here are the messages I'm interested in: Jan 15 12:47:25 linen/linen tldd[25799]: [ID 992021 daemon.notice] TLD(0) MountTape CVG121 on drive 5, from slot 20 5 Jan 15 12:47:45 linen/linen tldd[26280]: [ID 302958 daemon.notice] TLD(0) open failed in io_open, I/O error What I would like to do is have the Mount Tape matched and if it fails page someone. If it passes, just continue on. Any ideas? Jesse Keefe Analyst Convergys Corp -- NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected.

3 3

logging by IP
by Chuck Kelly 15 Jan '02

15 Jan '02

Anyone know how to get syslog-ng to log to /var/log/<Source_ip> instead of /var/log/$HOST ?? I have routers, switches, UNIX hosts with different log formats and as a result, I get funky directories created like 04DA, VPN, etc. Unless there is a way to prevent the funky directories from being created. -- Chuck

2 1

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

I will make things very clear on what i am trying to do with syslog-ng,, i have 200 routers and i want them to all point to my syslog server, that is why i created a sep file for each router, how can i get them to log to a mysql databse, i have tried just loggin one ip to the databse useing sqlsyslogd tables but that did not work, what would be the best way for me to do this, and how do i do this, thanks michael >>> nate(a)campin.net 01/14/02 08:06PM >>> On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier." _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

how to make program destination
by David Monk 15 Jan '02

15 Jan '02

I am fairly new to central logging with syslog-ng and had a couple questions. I tried briefly looking to the mailing list archives, but I couldn't find any way to easily search it. I want to have some matched log entries from various hosts sent to the network admin staff. What would be most preferential is to have the source hostname in the subject line and the log message as the body. I defined the following: destination d_mail { program("mail -s \"Matched log entry from $HOST\" syslog); }; With this I DO get an email, but the $HOST macro is empty and the message body is also empty. Is there a better method? Or can anyone help with an example or two? Thanks, David Monk CCNA, MCSE david(a)purplebear.net

1 0

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

what do u think about this one, b/c i still can not get to to log to the mysql database, destination rrrouter { program("/usr/bin/mysql -u root -p -D rrrouter -t"); }; filter f_192.168.3.254 { host(192.168.3.254); }; log { source(net); filter(f_192.168.3.254); destination(rrrouter); }; thanks michael >>> nate(a)campin.net 01/14/02 20:16 PM >>> On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier." _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0