January 2002 - syslog-ng - lists.balabit.hu

Accepting messages from all devices (including Cisco)
by Paul C. Williamson 11 Jan '02

11 Jan '02

Ok, now that I've got it installed and running (thanks to all who helped)...I have yet another question. When starting syslog-ng (I'm on RedHat 7.2), it just reports that it is starting Kernel Logger, but never reports that syslog-ng started. Is this normal? What am I missing? I modified the init.d script for syslog-ng and put it in the /etc/rc.d/init.d directory, and put syslog-ng.conf.RedHat into /etc/syslog-ng directory. I was also capturing all Cisco devices on my network with syslog, so I added: destination ciscol { file("/var/log/cisco.log"); }; log { source(src1); filter(ciscof); destination(ciscol);}; To capture all the cisco stuff. I did not modify the facility on the Cisco devices, but they are all set to source-interface loopback0. Any ideas? Thanks, Paul

1 0

RE: [syslog-ng]INSTALLATION PROBLEM <Can't get /etc/syslog-ng/sys log-ng.conf>PLEASE HELP!!!!!!
by Ohrberg, Mick 11 Jan '02

11 Jan '02

Krishna, If there is no /etc/syslog-ng/syslog-ng.conf, I suggest you create one. /Mick > -----Original Message----- > From: Krishna [mailto:Krishna_shekhar@gmx.net] > Sent: Thursday, January 10, 2002 4:27 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]INSTALLATION PROBLEM <Can't get > /etc/syslog-ng/syslog-ng.conf>PLEASE HELP!!!!!! > > > > > Krishna wrote: > > Hi, > I have been trying to install syslog-ng and during this > phase I got > lot of error's.After installing libol I tried to install but > thus time i > gave the path to where libol-config was. I got the binary file > syslog-ng in the src directory. > But when I do make install it says "noting to be done in > this directory" > and quit. > I am not getting syslog-ng.conf in the /etc.There is no directory of > syslog-ng in the /etc directory > Please Help > Any help would be appreciated > > regards > Krishna Shekhar > Network Administrator > Wiplash.com > http://wiplash2000.com _______________________________________________ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

to receive log messages from remote terminals.
by wireless 11 Jan '02

11 Jan '02

Hello syslog-ng, What should I fix in the conf file to receive log messages from remote terminals. Best regards, wireless mailto:wireless@wlink.com.np

1 0

How to run syslog-ng
by Paul C. Williamson 11 Jan '02

11 Jan '02

I know I must be missing something... The docs aren't real clear on this, but to I remove the syslogd daemon and replace it with syslog-ng? I am able to compile it, but there isn't anything that says how to run it. Also, is there an archive of the mailing list? Thanks, Paul

2 1

RE: [syslog-ng]How to run syslog-ng
by Ohrberg, Mick 10 Jan '02

10 Jan '02

Paul, I have run them both in parallel, but the general idea is to stop using syslogd - syslog-ng is a replacement. /Mick > -----Original Message----- > From: Paul C. Williamson [mailto:pwilliamson@mandtbank.com] > Sent: Thursday, January 10, 2002 2:48 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]How to run syslog-ng > > > I know I must be missing something... > > The docs aren't real clear on this, but to I remove the > syslogd daemon > and replace it with syslog-ng? > > I am able to compile it, but there isn't anything that says > how to run it. > > Also, is there an archive of the mailing list? > > Thanks, > Paul > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

RE: [syslog-ng]Messages from AIX 4.3.2 syslog always 'forwarded'
by Douwe Dijkstra 09 Jan '02

09 Jan '02

> > I just installed syslog-ng on a central loghost and it > seems to think that > > messages from AIX systems are 'forwarded'. > > > > Messages from AIX machines look like: > > Jan 4 10:00:20 pg forwarded from pg: > > > > Messages from Solaris machines look like: > > Jan 3 17:16:41 mailhost sshd[1386]: > > > > What is wrong here? > > It might be hostname chaining, but I seem to recall another AIX person > was having this issue a while ago. I would look the the mailing list > archive to see if the answer isn't there. I don't look after any AIX > boxes so I try not to remember these sorts of things. The mailing list archive is not searchable, so I browsed a few months back. Couldn't find anything usefull. Douwe

1 0

RE: [syslog-ng]Messages from AIX 4.3.2 syslog always 'forwarded'
by Douwe Dijkstra 09 Jan '02

09 Jan '02

I added this option, and it did not work. Douwe > options { chain_hostnames(no); }; > > in the syslog-ng.conf file, I think I solved the problem with this. > > > ---------- > > Von: Douwe Dijkstra[SMTP:Douwe.Dijkstra@i-pay.com] > > Antwort an: syslog-ng(a)lists.balabit.hu > > Gesendet: Freitag, 4. Januar 2002 14:03 > > An: syslog-ng(a)lists.balabit.hu > > Betreff: [syslog-ng]Messages from AIX 4.3.2 syslog > always 'forwarded' > > > > Hi there! > > > > I just installed syslog-ng on a central loghost and it > seems to think that > > messages from AIX systems are 'forwarded'. > > > > Messages from AIX machines look like: > > Jan 4 10:00:20 pg forwarded from pg: > > > > Messages from Solaris machines look like: > > Jan 3 17:16:41 mailhost sshd[1386]: > > > > What is wrong here? > > > > FYI: Using syslog-ng 1.4.14 on Solarix x86 8.0, AIX client > machines are > > 4.3.2, Solaris client machines are x86 7.0 or 8.0. > > All machines are in the loghost host file. > > > > Douwe > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

Sudo logging
by Chuck Kelly 09 Jan '02

09 Jan '02

I can't seem to get sudo logs logging properly. Would like each host to log to sudo.log instead of local2. /var/log/syslog-ng/$HOST/sudo.log Anyone have any examples of how they did it? -- Chuck

2 1

logging to a central server
by Stephen C Burns 08 Jan '02

08 Jan '02

Hey all, Excuse the ignorance, first of all. I have always just used syslog/syslog-ng as logging sources on local machines, I've yet to use the network functionality. How exactly would one configure a host, so that it sends all logs to a central syslog-ng machine? I am using linux, I assume that I would just change the unix-stream to an IP address, or something of the source? Thanks in advance everyone.

3 2

no logging after HUP (1.5.13)
by Arnold Pulleman 05 Jan '02

05 Jan '02

Because of the template feature I want to use syslog-ng 1.5 on a FreeBSD 4.2 and 4.3 platform. While testing 1.5.13 I found a problem when sending a hangup signal to syslog-ng. The restart message is shown but nothing follows until syslog-ng is stopped and started again. My question is how to solve this problem? The following output of the messages file appeared: Oct 30 11:06:49 humble syslog-ng[5018]: syslog-ng version 1.5.13 starting Oct 30 11:08:56 humble su: BAD SU user to root on /dev/ttyp7 Oct 30 11:09:28 humble su: user to root on /dev/ttyp7 Oct 30 11:16:49 humble syslog-ng[5018]: STATS: dropped 0 Oct 30 11:25:09 humble su: BAD SU user to root on /dev/ttyp7 Oct 30 11:26:05 humble su: user to root on /dev/ttyp3 Oct 30 11:26:49 humble syslog-ng[5018]: STATS: dropped 0 Oct 30 11:27:00 humble syslog-ng[5018]: SIGHUP received, restarting syslog-ng Oct 30 11:35:36 humble syslog-ng[5109]: syslog-ng version 1.5.13 starting Oct 30 11:35:49 humble syslog-ng[5109]: SIGHUP received, restarting syslog-ng

4 6