January 2002 - syslog-ng - lists.balabit.hu

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

Ok -- this is what i came up with ,, i am able to get syslog-ng to run b/c it does like like "program" thats if i am correct. destination rrouter { program("/usr/bin/mysql -u root -D rrrouter -t -p")}; filter f_192.168.3.254 { host(192.168.3.254); }; log { source(net); filter(f_192.168.3.254); destination(rrrouter); }; thanks michael >>> nate(a)campin.net 01/14/02 20:16 PM >>> On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier." _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

so u are saying that i can write something like this ## tking switch 192.168.3.254 destination 192.168.3.254 {program("/usr/bin/mysql -u sysloguser -t logs 192.168.3.254 -p")}; filter f_192.168.3.254 { host(192.168.3.254); }; log { source(net); filter(f_192.168.3.254); destination(192.168.3.254); }; the databse is logs and the table is 192.168.3.254, am i correct, thanks michael >>> Nate Campi <nate(a)campin.net> 01/14/02 20:07 PM >>> On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier."

1 0

Re: [syslog-ng]syslog-ng
by Nate Campi 15 Jan '02

15 Jan '02

On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier."

1 0

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, do u have an example syslog-ng file and mysql database? mearls >>> nate(a)campin.net 01/14/02 17:57 PM >>> On Mon, Jan 14, 2002 at 04:49:46PM -0500, Michael Earls wrote: > Hi -- i am new here, and was not sure if this has been posted > > i am trying to use syslog-ng to log to a mysql datase, i was told that i could pipe or use program, but i do not know how to, > > my syslog-ng file is very basic, i am adding lines to create sep files like this for each router, is there a way to just pipe this to a mysql database. I put up some pointers on this stuff at http://www.campin.net/newlogcheck.html -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "Whom computers would destroy, they must first drive mad." -Anon. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, do u have an example syslog-ng file and mysql database? mearls >>> nate(a)campin.net 01/14/02 17:57 PM >>> On Mon, Jan 14, 2002 at 04:49:46PM -0500, Michael Earls wrote: > Hi -- i am new here, and was not sure if this has been posted > > i am trying to use syslog-ng to log to a mysql datase, i was told that i could pipe or use program, but i do not know how to, > > my syslog-ng file is very basic, i am adding lines to create sep files like this for each router, is there a way to just pipe this to a mysql database. I put up some pointers on this stuff at http://www.campin.net/newlogcheck.html -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "Whom computers would destroy, they must first drive mad." -Anon. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

syslog-ng
by Michael Earls 14 Jan '02

14 Jan '02

Hi -- i am new here, and was not sure if this has been posted i am trying to use syslog-ng to log to a mysql datase, i was told that i could pipe or use program, but i do not know how to, my syslog-ng file is very basic, i am adding lines to create sep files like this for each router, is there a way to just pipe this to a mysql database. ### ### 7206-core ### destination 192.168.1.245 { file("/var/log/routers/7206-core.log"); }; filter f_192.168.1.245 { host(192.168.1.245); }; log { source(net); filter(f_192.168.1.245); destination(192.168.1.245); }; ## main router destination 192.168.1.1 { file("/var/log/routers/main-rr.log"); }; filter f_192.168.1.1 { host(192.168.1.1); }; log { source(net); filter(f_192.168.1.1); destination(192.168.1.1); }; ## switch 192.168.1.254 destination 192.168.1.254 { file("/var/log/routers/michaeleaarls-switch.log"); }; filter f_192.168.1.254 { host(192.168.1.254); }; log { source(net); filter(f_192.168.1.254); destination(192.168.1.254); }; ### ### this should work... ### ## tony kings router destination 192.168.3.1 { file("/var/log/routers/tking-main.log"); }; filter f_192.168.3.1 { host(192.168.3.1); }; log { source(net); filter(f_192.168.3.1); destination(192.168.3.1); }; ## tking switch 192.168.3.254 destination 192.168.3.254 { file("/var/log/routers/tking-switch.log"); }; filter f_192.168.3.254 { host(192.168.3.254); }; log { source(net); filter(f_192.168.3.254); destination(192.168.3.254); };

2 1

syslog-ng mistreating data as part of the hostname ?
by Hildenbrand, Patrick 14 Jan '02

14 Jan '02

Hi everybody, getting logs from cabeltron ssr's into syslog-ng, we've some trouble. The data sent (the was syslog will fromat it) is like the line below: Jan 13 04:02:12 loghost %ACL_LOG-I-DENY, ACL [280] on "rtfa" UDP 192.168.1.2:4721 -> 14.9.1.3:53 using options keep_hostname(no); long_hostnames(no); chain_hostnames(on) syslog-ng presents us: Jan 13 04:02:12 %ACL_LOG-I-DENY,/loghost ACL [280] on "rtfa" UDP 192.168.1.2:4721 -> 14.9.1.3:53 changing chain_hostnames to off, we even get: Jan 13 04:02:12 loghost ACL [280] on "rtfa" UDP 192.168.1.2:4721 -> 14.9.1.3:53 so the important part about what happend to the router is lost (all messages on the cabletron routers are formatted like this). It appears to me as if syslog-ng while parsing adds the first value of the message to the hostname. Is there some configuration setting to disable this ? BTW: this is using 1.4.11 as well as with 1.5.13 Kind regards, Patrick Hildenbrand

1 0

Making Logs Viewable as a Webpage
by Aaron Brown 14 Jan '02

14 Jan '02

First off, Congrats on making an awesome utility. I've used it in 2 nationwide networks utilizing over 200 Routers, servers and network appliances and its run rock solid. But I would like to make the logs viewable via a webpage for security purposes. Unfortunately the Logs come out as a continuous line when viewed as html. Basically I'd like to be able to add a html page break ,<br>, to the end of each log message as they are written. I'm sure its an easy fix, but I am by no means a programmer. If possible could you tell me which src file and line that holds the command that writes the actual syslog message to the file. Any help would be appreciated. Aaron

3 2

Re: syslog-ng digest, Vol 1 #612 - 6 msgs
by wireless 13 Jan '02

13 Jan '02

Dear Krishna, Seems that there is conflict in your installation. To install syslog-ng I recommend that u first install the libol. get the libol tar.gz file from the http://www.balabit.hu/en/downloads/syslog-ng/downloads/ . Choose suitable one. After installing the libol, proceed with the syslog-ng installation. Any difficulties? Do write it in again. Best Regards, Anup Sainju WorldLink Communications Kathmandu Nepal wireless(a)wlink.com.np www.wlink.com.np snalbh> Krishna wrote: snalbh> Hi, snalbh> I have been trying to install syslog-ng and during this phase I got snalbh> lot of error's.After installing libol I tried to install but thus time i snalbh> gave the path to where libol-config was. I got the binary file snalbh> syslog-ng in the src directory. snalbh> But when I do make install it says "noting to be done in this directory" snalbh> and quit. snalbh> I am not getting syslog-ng.conf in the /etc.There is no directory of snalbh> syslog-ng in the /etc directory snalbh> Please Help snalbh> Any help would be appreciated snalbh> regards snalbh> Krishna Shekhar snalbh> Network Administrator snalbh> Wiplash.com snalbh> http://wiplash2000.com snalbh> _______________________________________________ snalbh> --__--__-- snalbh> Message: 2 snalbh> Date: Fri, 11 Jan 2002 18:00:55 +0545 snalbh> From: wireless <wireless(a)wlink.com.np> snalbh> Reply-To: wireless <wireless(a)wlink.com.np> snalbh> Organization: Worldlink Communnications snalbh> To: syslog-ng(a)lists.balabit.hu snalbh> Subject: [syslog-ng]to receive log messages from remote terminals. snalbh> Reply-To: syslog-ng(a)lists.balabit.hu snalbh> Hello syslog-ng, snalbh> What should I fix in the conf file to receive log messages from snalbh> remote terminals. snalbh> Best regards, snalbh> wireless mailto:wireless@wlink.com.np snalbh> --__--__-- snalbh> Message: 3 snalbh> From: "Ohrberg, Mick" <Mick.Ohrberg(a)umb.com> snalbh> To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> snalbh> Subject: RE: [syslog-ng]INSTALLATION PROBLEM <Can't get /etc/syslog-ng/sys log-ng.conf>>PLEASE HELP!!!!!! snalbh> Date: Fri, 11 Jan 2002 06:35:36 -0600 snalbh> charset="iso-8859-1" snalbh> Reply-To: syslog-ng(a)lists.balabit.hu snalbh> Krishna, snalbh> If there is no /etc/syslog-ng/syslog-ng.conf, I suggest you create one. snalbh> /Mick >> -----Original Message----- >> From: Krishna [mailto:Krishna_shekhar@gmx.net] >> Sent: Thursday, January 10, 2002 4:27 PM >> To: syslog-ng(a)lists.balabit.hu >> Subject: [syslog-ng]INSTALLATION PROBLEM <Can't get >> /etc/syslog-ng/syslog-ng.conf>PLEASE HELP!!!!!! >> >> >> >> >> Krishna wrote: >> >> Hi, >> I have been trying to install syslog-ng and during this >> phase I got >> lot of error's.After installing libol I tried to install but >> thus time i >> gave the path to where libol-config was. I got the binary file >> syslog-ng in the src directory. >> But when I do make install it says "noting to be done in >> this directory" >> and quit. >> I am not getting syslog-ng.conf in the /etc.There is no directory of >> syslog-ng in the /etc directory >> Please Help >> Any help would be appreciated >> >> regards >> Krishna Shekhar >> Network Administrator >> Wiplash.com >> snalbh> http://wiplash2000.com snalbh> _______________________________________________ snalbh> _______________________________________________ snalbh> syslog-ng maillist - syslog-ng(a)lists.balabit.hu snalbh> https://lists.balabit.hu/mailman/listinfo/syslog-ng snalbh> --__--__-- snalbh> Message: 4 snalbh> Date: Fri, 11 Jan 2002 09:49:18 -0500 snalbh> From: "Paul C. Williamson" <pwilliamson(a)mandtbank.com> snalbh> To: <syslog-ng(a)lists.balabit.hu> snalbh> Subject: [syslog-ng]Accepting messages from all devices (including Cisco) snalbh> Reply-To: syslog-ng(a)lists.balabit.hu snalbh> Ok, now that I've got it installed and running (thanks to all who snalbh> helped)...I have yet another question. snalbh> When starting syslog-ng (I'm on RedHat 7.2), it just reports that it snalbh> is starting Kernel Logger, but never reports that syslog-ng started. snalbh> Is this normal? snalbh> What am I missing? I modified the init.d script for syslog-ng and put it in the /etc/rc.d/init.d directory, and put syslog-ng.conf.RedHat into snalbh> /etc/syslog-ng directory. snalbh> I was also capturing all Cisco devices on my network with syslog, so snalbh> I added: snalbh> destination ciscol { file("/var/log/cisco.log"); }; snalbh> log { source(src1); filter(ciscof); destination(ciscol);}; snalbh> To capture all the cisco stuff. I did not modify the facility on the Cisco devices, but they are all set to source-interface loopback0. snalbh> Any ideas? snalbh> Thanks, snalbh> Paul snalbh> --__--__-- snalbh> Message: 5 snalbh> Date: Fri, 11 Jan 2002 09:30:12 -0700 snalbh> From: Brad Arlt <arlt(a)cpsc.ucalgary.ca> snalbh> To: syslog-ng(a)lists.balabit.hu snalbh> Subject: Re: [syslog-ng]INSTALLATION PROBLEM <Can't get /etc/syslog-ng/syslog-ng.conf>PLEASE HELP!!!!!! snalbh> Reply-To: syslog-ng(a)lists.balabit.hu snalbh> On Fri, Jan 11, 2002 at 03:57:17AM +0530, Krishna wrote: >> I have been trying to install syslog-ng and during this phase I got >> lot of error's.After installing libol I tried to install but thus time i >> gave the path to where libol-config was. I got the binary file >> syslog-ng in the src directory. >> But when I do make install it says "noting to be done in this directory" >> and quit. snalbh> I am not certain that "make install" does anthing. I have never snalbh> bothered to run it. Just "cp" the syslog-ng executable wherever you snalbh> feel like putting it. If you made libol dynamic, make sure it is snalbh> copied to the appropriate place as well. If you are uncertian whether snalbh> you need to copy libol use "ldd" on the syslog-ng executable. If you snalbh> see libol in the dynamic dependancy list, then you will need to snalbh> install libol. >> I am not getting syslog-ng.conf in the /etc. There is no directory of >> syslog-ng in the /etc directory >> Please Help >> Any help would be appreciated snalbh> You need to make your own syslog-ng.conf file. There are examples in snalbh> the doc directory of the syslog-ng source distribution (or there was snalbh> in the 1.4.x distribution). You will almost certainly have to alter snalbh> the samples, please consult the documentation to figure out how. snalbh> mkdir -p -m 750 /etc/syslog-ng snalbh> should solve your latter problem. snalbh> ---------------------------------------------------------------------------- snalbh> __o Bradley Arlt Security Team Lead snalbh> _ \<_ arlt(a)cpsc.ucalgary.ca University Of Calgary snalbh> (_)/(_) http://pages.cpsc.ucalgary.ca/~arlt/ Computer Science snalbh> --__--__-- snalbh> _______________________________________________ snalbh> syslog-ng maillist - syslog-ng(a)lists.balabit.hu snalbh> https://lists.balabit.hu/mailman/listinfo/syslog-ng snalbh> End of syslog-ng Digest -- Best regards, wireless mailto:wireless@wlink.com.np

1 0

INSTALLATION PROBLEM <Can't get /etc/syslog-ng/syslog-ng.conf>PLEASE HELP!!!!!!
by Krishna 11 Jan '02

11 Jan '02

Hi, I have been trying to install syslog-ng and during this phase I got lot of error's.After installing libol I tried to install but thus time i gave the path to where libol-config was. I got the binary file syslog-ng in the src directory. But when I do make install it says "noting to be done in this directory" and quit. I am not getting syslog-ng.conf in the /etc.There is no directory of syslog-ng in the /etc directory Please Help Any help would be appreciated regards Krishna Shekhar Network Administrator Wiplash.com http://wiplash2000.com

2 2