October 2002 - syslog-ng - lists.balabit.hu

Feedback about insertdb.pl
by _/CaT\_ 28 Oct '02

28 Oct '02

Hi *, You've posted any feed-back about this post of mine: http://lists.balabit.hu/pipermail/syslog-ng/2002-October/003905.html With this solution I've resolved all my problem with insertions into DB. Cheers _/CaT\_

1 0

RE: [syslog-ng]centralized loghost
by Guillaume LACHENAL 28 Oct '02

28 Oct '02

I've just set use_dns(yes) and restart syslog-ng. the same thing appear : logs go to /var/log/IP_of_$HOST/ resolver is correctly configured : host IP_of_$HOST return FQDN of $HOST As syslog-ng run chrooted, I've copied /etc/resolv.conf & /etc/hosts into the jail. It does not fix the issue thanks for help in advance. "Guillaume LACHENAL" <glachenal(a)on-x.com> Sent by: syslog-ng-admin(a)lists.balabit.hu 10/24/02 22:33 Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: Subject: RE: [syslog-ng]centralized loghost OK. I'll modify it tomorrow when back at work. Is there a way hostname resolution rely on /etc/hosts ? I'll prefer this setting. Just in case the DNS suffer a DoS thanks a lot regards, Guillaume "Hamilton, Andrew" <Andrew.Hamilton(a)afccc.af.mil> Sent by: syslog-ng-admin(a)lists.balabit.hu 10/24/2002 11:52 AM AST Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: bcc: Subject: RE: [syslog-ng]centralized loghost You have use_dns(no). Therefore the value of $HOST is the IP address. If you want the hostname instead then you need to turn on the use_dns option. Regards, Drew -----Original Message----- From: Guillaume LACHENAL [mailto:glachenal@on-x.com] Sent: Thursday, October 24, 2002 11:19 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]centralized loghost I've just install syslog-ng 1.5.21 for centralizing all servers log's Here is the conf file : - - syslog-ng.conf - - options { use_dns(no); sync(0); }; source s_internal { internal(); }; source net { udp( ip(192.168.12.2) port(514) ); }; destination hosts { file( "/var/log/$HOST/$YEAR/$MONTH/$DAY/$FACILITY"\ create_dirs(yes) owner("root") group("root")\ perm(0600) dir_perm(0700) ); }; log { source(s_internal); source(net); destination(hosts); }; - - the problem is that logs go to /var/log/IP_of_$HOST/ ... Thanks for help G. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RFC3195 - Reliable Delivery for syslog
by Borzenkov Andrey 28 Oct '02

28 Oct '02

Browsing RFCs I came over this one. What other thinks about the proposed extensions? Are there any plans to include them in syslog-ng? Regards -andrey

1 0

RE: [syslog-ng]1.5.21 no logger entries?
by Hamilton, Andrew 28 Oct '02

28 Oct '02

Well you don't really have to use 1.5.* to get your entries into a database. Check out this link http://www.campin.net/syslog-ng/faq.html Nate gives a lot of useful info as well as links to useful utilities, one of which is a program that enters log info into your database. Regards, Drew -----Original Message----- From: Michael.Semling(a)swisscom.com [mailto:Michael.Semling@swisscom.com] Sent: Saturday, October 26, 2002 10:49 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]1.5.21 no logger entries? Dear list members, I use SuSE 8.1. I installed syslog-ng 1.4.16 and it worked. Testing entries with the logger command appeared in the syslog. I want to get the data into a MYSQL database and I found in the list, that I have to switch to 1.5 ("templates are supported by the 1.5.x branch only, which is development version by its name, but seems to be quite stable.") Using 1.5.21 compiles fine (libol0.3.3 installed) but no entries are stored in the /var/log/* using the same logger command. Making a grep over all files and for all subdirs shows no entries. Any suggestions thanks in advance? Regards, Michael _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

A JED syntax highlighting mode
by Shane Lahey 27 Oct '02

27 Oct '02

Here is a simple JED mode for syntax highlighting of your syslog-ng.conf file(s). To use it simply add this to your ~/.jedrc file: Autoload ("syslog_ng_mode", "syslog-ng"); Then add the following line as the first line of your 'syslog-ng.conf' file: # -*- mode: syslog-ng; -*- please send any suggestions/bugs/comments to s.lahey [at] roadrunner.nf.net --- This email has been scanned for viruses and is considered Virus-Free.(Please note that this would not include new/undiscovered viruses)Which would be impossible to detect as they are ...unknown... :) Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.408 / Virus Database: 230 - Release Date: 10/24/02

1 0

1.5.21 no logger entries?
by Michael.Semling＠swisscom.com 26 Oct '02

26 Oct '02

Dear list members, I use SuSE 8.1. I installed syslog-ng 1.4.16 and it worked. Testing entries with the logger command appeared in the syslog. I want to get the data into a MYSQL database and I found in the list, that I have to switch to 1.5 ("templates are supported by the 1.5.x branch only, which is development version by its name, but seems to be quite stable.") Using 1.5.21 compiles fine (libol0.3.3 installed) but no entries are stored in the /var/log/* using the same logger command. Making a grep over all files and for all subdirs shows no entries. Any suggestions thanks in advance? Regards, Michael

1 0

syslog-ng in an O'Reilly book
by Balazs Scheidler 25 Oct '02

25 Oct '02

Hi, I wanted to let you know that book has been released which contains a full chapter on syslog-ng. This book should be a useful addition to the set of documents available for syslog-ng. The author is Michael D. Bauer, and the title is "Building Secure Servers With Linux." A sample chapter is available at the book's website, which documents syslog-ng itself, the url is: http://www.oreilly.com/catalog/bssrvrlnx/ I hope the book will be a useful resource for syslog-ng users. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

RE: [syslog-ng]centralized loghost
by Guillaume LACHENAL 24 Oct '02

24 Oct '02

1 0

syslog-ng stops logging after one or two entries....
by Paul.Fiero＠ci.austin.tx.us 24 Oct '02

24 Oct '02

I am new to syslog stuff but here is my problem. I have syslog-ng v1.5.21 running on a RedHat Linux server. I have a Mandrake 9 workstation running plain ole syslogd. The two boxes are talking to each other without a problem but when a message is sent to the syslog-ng box it will log the message once or twice but fails after that until syslog-ng and syslogd are restarted on both boxes. I am using this to log the status of an application on several boxes to this one server about 30 times an hour (yes it is huge overhead but is required for this application). I need help with this ASAP. Paul Fiero Information Security Analyst City of Austin - ISD Security Engineering (512) 974-3559 paul.fiero(a)ci.austin.tx.us CONFIDENTIALITY NOTICE: ************************************************************************ The information contained in this ELECTRONIC MAIL transmission is confidential. It may also be privileged work product or proprietary information. This information is intended for the exclusive use of the addressee(s). If you are not the intended recipient, you are hereby notified that any use, disclosure, dissemination, distribution [other than to the addressee(s)], copying or taking of any action because of this information is strictly prohibited. ************************************************************************

2 2

RE: [syslog-ng]syslog-ng stops logging after one or two entries.. ..
by Hamilton, Andrew 24 Oct '02

24 Oct '02

Paul, Your posts got to me out of order. Glad all is good. Enjoy, Drew -----Original Message----- From: Paul.Fiero(a)ci.austin.tx.us [mailto:Paul.Fiero@ci.austin.tx.us] Sent: Thursday, October 24, 2002 2:13 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog-ng stops logging after one or two entries.. .. Drew, I don't know if you saw my last post but the problem is taken care of. Apparently what was happening is that the message that I am expecting to see on the syslog-ng system was the same each time and it wasn't displaying the message because it was identical. By changing the syntax of the command that generates the message I am logging it is different each time. It all works fine now. Paul -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Thursday, October 24, 2002 1:07 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog-ng stops logging after one or two entries.. .. Paul, Could you post your configuration file? Drew -----Original Message----- From: Paul.Fiero(a)ci.austin.tx.us [mailto:Paul.Fiero@ci.austin.tx.us] Sent: Thursday, October 24, 2002 1:23 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog-ng stops logging after one or two entries.. .. Drew, I am not getting a core and syslog-ng just pounds right along. Seems to log for other things, just not this traffic coming from the remote host. I have run syslog-ng with the -dv switch from a shell prompt and there seems to be little additional information that it wants to give me. I am still getting similar results....logs one or two messages from the remote machine then just sits there and continues logging other traffic. Paul -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Thursday, October 24, 2002 12:04 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog-ng stops logging after one or two entries.. .. Paul, Shut the daemon down and run syslog-ng in a shell with the -dv switch. This will give you some debug information. Are you getting a core dump? You can use strace or truss to watch it if you want to run those and watch the system calls. Without a little more info it will be difficult to help you. Regards, Drew -----Original Message----- From: Paul.Fiero(a)ci.austin.tx.us [mailto:Paul.Fiero@ci.austin.tx.us] Sent: Thursday, October 24, 2002 12:59 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng stops logging after one or two entries.... Importance: High I am new to syslog stuff but here is my problem. I have syslog-ng v1.5.21 running on a RedHat Linux server. I have a Mandrake 9 workstation running plain ole syslogd. The two boxes are talking to each other without a problem but when a message is sent to the syslog-ng box it will log the message once or twice but fails after that until syslog-ng and syslogd are restarted on both boxes. I am using this to log the status of an application on several boxes to this one server about 30 times an hour (yes it is huge overhead but is required for this application). I need help with this ASAP. Paul Fiero Information Security Analyst City of Austin - ISD Security Engineering (512) 974-3559 paul.fiero(a)ci.austin.tx.us CONFIDENTIALITY NOTICE: ************************************************************************ The information contained in this ELECTRONIC MAIL transmission is confidential. It may also be privileged work product or proprietary information. This information is intended for the exclusive use of the addressee(s). If you are not the intended recipient, you are hereby notified that any use, disclosure, dissemination, distribution [other than to the addressee(s)], copying or taking of any action because of this information is strictly prohibited. ************************************************************************ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0