October 2002 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]syslog-ng and my console
by Hamilton, Andrew 22 Oct '02

22 Oct '02

Franz, Could you post your configuration file? That would help track down your problem. Regards, Drew -----Original Message----- From: ?error?5.1.2?"553 percent hack not allowed." [mailto:?error?5.1.2?"553 percent hack not allowed."] Sent: Tuesday, October 22, 2002 5:27 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng and my console hi, syslog-ng is filling my console with my netfilter output stuff which i redirect via destination filter and stuff to /var/log/firewall.log. now i don't want all that stuff in my ttys. i've removed the destinations for console and console_all, now what can i do`? Mit freundlichen Grüßen BIG-SPIELWARENFABRIK Dipl.-Ing. Ernst A. Bettag e. K. Franz Bettag http://www.BIG.de

1 0

Can't get syslog-ng to compile under solaris 8
by Romildo Wildgrube 22 Oct '02

22 Oct '02

Hi, I'm trying to compile syslog-ng under solaris but have no success. I am doing a straight compile, make, make install and I keep getting the following error during make. Any help will be much appreciated. Thanks, Romi gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg- lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afpr ogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthre ad -ldoor -lfl /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file res_init main.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /apps/home/romildo/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /apps/home/romildo/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /apps/home/romildo/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive'

2 1

syslog-ng and my console
by Franz.Bettag/SOFTWERK/DE%BIG＠big.de 22 Oct '02

22 Oct '02

hi, syslog-ng is filling my console with my netfilter output stuff which i redirect via destination filter and stuff to /var/log/firewall.log. now i don't want all that stuff in my ttys. i've removed the destinations for console and console_all, now what can i do`? Mit freundlichen Grüßen BIG-SPIELWARENFABRIK Dipl.-Ing. Ernst A. Bettag e. K. Franz Bettag http://www.BIG.de

1 0

Syslog is spamming up my console
by Franz.Bettag/SOFTWERK/DE%BIG＠big.de 22 Oct '02

22 Oct '02

hi, i have syslog-ng running with filtering my iptables ouput correctly. no i don't like that it spams up my console (tty). i've already removed the console and console_all destination.. does anybody know a solution? Mit freundlichen Grüßen BIG-SPIELWARENFABRIK Dipl.-Ing. Ernst A. Bettag e. K. Franz Bettag http://www.BIG.de

2 1

email.sh script for syslog-ng using qmail
by L. Jankok 21 Oct '02

21 Oct '02

Hi, I have a e-mail.sh script which used /usr/bin/mail to send "logging" mails from syslog-conf. I am looking for some similar e-mail.sh script using qmail for the e-mail.sh I am using right now doesn't work. this is my current e-mail.sh script #!/bin/sh while read line; do echo $line | /usr/bin/mail -s "log alert" admin(a)example.net done A "ps -ef | grep -i syslog | grep -v grep" gives me the following output. root 14191 1 0 19:36:45 ? 0:00 /usr/local/sbin/syslog-ng root 14193 14192 0 19:36:45 pts/2 0:00 /bin/sh /usr/local/sbin/syslog-mail.sh root 14192 14191 0 19:36:45 pts/2 0:00 /bin/sh -c /usr/local/sbin/syslog-mail.sh

1 1

Config ?
by Jack Sasportas 21 Oct '02

21 Oct '02

I used a much older version of syslog-ng previously, but the newer version is a little different, so I just want to confirm a couple of things. 1. If I install the RPM under redhat 7.2 what do I need to do to basically insure that the old syslog isn't going to kick in etc. 2. I want to split any pop activity from maillog into poplog, so I configured what I thought would work, and it does most of the time, but there are times when I pop the server, and there is no long entry. Here is my entire config. Any help appreciated.... THANKS -------- Config File ---------- # This file should be compatible with the out-of-the-box # /etc/syslog.conf on Red Hat Linux # global options # options { use_dns(yes); use_fqdn(no); use_time_recvd(no); chain_hostnames(no); mark(0); sync(0); }; source s_local { internal(); unix-stream("/dev/log" keep-alive(yes) max-connections(10)); file("/proc/kmsg"); }; # facility filters # # Jack filter f_authpriv { facility(authpriv); }; filter f_authpriv { facility(authpriv) and not program("popper"); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; filter f_kern { facility(kern); }; # Jack filter f_mail { facility(mail); }; filter f_mail { facility(mail) and not program("popper"); }; filter f_messages { priority(info..emerg) and not facility(mail, news, authpriv, cron, local1, local2, local3, local4, local5, local6); }; # Jack filter f_news { facility(news); }; # priority filters # filter f_crit { priority(crit..emerg); }; filter f_crit_only { priority(crit); }; filter f_emerg { priority(emerg); }; filter f_err { priority(err..emerg); }; filter f_err_only { priority(err); }; filter f_info { priority(info..emerg); }; filter f_notice { priority(notice..emerg); }; filter f_warn { priority(warning..emerg); }; # Jack filter f_pop { program(popper); }; destination d_all { usertty("*"); }; destination d_boot { file("/var/log/bootlog"); }; destination d_console { file("/dev/console"); }; destination d_cron { file("/var/log/cron"); }; destination d_mail { file("/var/log/maillog"); }; destination d_messages { file("/var/log/messages"); }; # Jack destination d_news_crit { file("/var/log/news/news.crit"); }; destination d_news_err { file("/var/log/news/news.err"); }; destination d_news_notice { file("/var/log/news/news.notice"); }; destination d_secure { file("/var/log/secure"); }; destination d_spooler { file("/var/log/spooler"); }; # Jack destination d_pop { file("/var/log/poplog"); }; # Everybody gets emergency messages log { source(s_local); filter(f_emerg); destination(d_all); }; # Log anything (except mail) of level info or higher. # Don't log private authentication messages! log { source(s_local); filter(f_messages); destination(d_messages); }; # The authpriv file has restricted access. log { source(s_local); filter(f_authpriv); destination(d_secure); }; # Jack Log all the pop mail messages. log { source(s_local); filter(f_pop); destination(d_pop); }; # Log all the mail messages in one place. log { source(s_local); filter(f_mail); destination(d_mail); }; # Log cron stuff log { source(s_local); filter(f_cron); destination(d_cron); }; # Save boot messages also to boot.log log { source(s_local); filter(f_boot); destination(d_boot); }; # # INN # log { source(s_local); filter(f_news); filter(f_crit_only); destination(d_news_crit); }; log { source(s_local); filter(f_news); filter(f_err_only); destination(d_news_err); }; log { source(s_local); filter(f_news); filter(f_notice); destination(d_news_notice); }; -------- Config File ---------- Thanks Jack

1 0

RE: [syslog-ng]separate logs from different sources
by Hamilton, Andrew 21 Oct '02

21 Oct '02

And of course you really don't need to have the filter statement in it at all if you use the $HOST macro. you could then just use: source net { tcp(); udp(); }; destination hostfile { file("/path/to/logs/$HOST"); }; log { source(net); destination(hostfile); }; Drew -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Monday, October 21, 2002 8:56 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]separate logs from different sources Olav, This should work for you. Of course you should substitute real names where I have placed the x's and the filter and destination names should be meaningful names. Whether you use TCP is up to you. You will need to use UDP because that is how Cisco routers send their logs. source net { tcp(); udp(); }; filter f_host { host("xxx.xxx.xxx.xxx"); }; destination hostfile { file("/path/to/logs/$HOST"); }; log { source(net); filter(f_host); destination(hostfile); }; Regards, Drew -----Original Message----- From: Olav Langeland [mailto:Olav.Langeland@activeisp.com] Sent: Monday, October 21, 2002 8:47 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]separate logs from different sources I want to send syslog from 3 different Cisco routers to a FreeBSD box and have syslog-ng separate them into different output files based on IP. Would appreciate if anyone could help me with configuration examples/ideas. thanks, olav. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]separate logs from different sources
by Hamilton, Andrew 21 Oct '02

21 Oct '02

Olav, This should work for you. Of course you should substitute real names where I have placed the x's and the filter and destination names should be meaningful names. Whether you use TCP is up to you. You will need to use UDP because that is how Cisco routers send their logs. source net { tcp(); udp(); }; filter f_host { host("xxx.xxx.xxx.xxx"); }; destination hostfile { file("/path/to/logs/$HOST"); }; log { source(net); filter(f_host); destination(hostfile); }; Regards, Drew -----Original Message----- From: Olav Langeland [mailto:Olav.Langeland@activeisp.com] Sent: Monday, October 21, 2002 8:47 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]separate logs from different sources I want to send syslog from 3 different Cisco routers to a FreeBSD box and have syslog-ng separate them into different output files based on IP. Would appreciate if anyone could help me with configuration examples/ideas. thanks, olav. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

separate logs from different sources
by Olav Langeland 21 Oct '02

21 Oct '02

I want to send syslog from 3 different Cisco routers to a FreeBSD box and have syslog-ng separate them into different output files based on IP. Would appreciate if anyone could help me with configuration examples/ideas. thanks, olav.

1 0

Ca ne marche pas
by Laurent Mesuré 19 Oct '02

19 Oct '02

Hi, i've installed the 1.5.21 version of syslog-ng with postgresql 7.2.2 But if i try to log anything nothing happened, neither in files nor in database. i've made a test with the debug (-d) option and here is the resulting log in log.log file joined to this mail. I've joined also my syslog-ng.conf Laurent Mesuré #*********************************************************************** # Fichier de configuration pour syslog-ng # Voir syslog-ng(8) et syslog-ng.conf(5) pour plus d'informations # #*********************************************************************** # Versions Date Auteur # 1.0 25/09/2002 gb(a)sysfive.com # 2.0 24/04/2002 ben(a)pleasenospam.tnsi.com # 3.0 16/10/2002 Laurent Mesure <lmesure(a)nerim.net> #*********************************************************************** # Versions Description # 1.0 Original # 2.0 Modifie # 3.0 Francisation et adaptation #*********************************************************************** options { sync (0); time_reopen (10); log_fifo_size (100); long_hostnames (on); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); time_reap(12); gc_busy_threshold(768); }; #*********************************************************************** source s_sys { unix-stream ("/dev/log"); internal(); }; source s_udp { udp(); }; source s_tcp { tcp(); }; source s_local { internal(); }; #*********************************************************************** # destination d_files { file("/var/log/syslog-ng/$HOST/$FACILITY.$LEVEL" # template{"$ISODATE $HOST $FACILITY $PRIORITY $PROCESS $MSG\n")); # }; destination d_local { file("/var/log/syslog-ng.$MONTH"); }; destination d_msgs { file("/var/log/messages" template("$FULLDATE $HOST $FACILITY.PRIORITY $MSG\n")); }; destination d_mail { file("/var/log/maillog" template("$FULLDATE $HOST mail.$PRIORITY $MSG\n")); }; destination d_secure { file("/var/log/secure" template("$FULLDATE $HOST authpriv.$PRIORITY $MSG\n")); }; destination d_cron { file("/var/log/cron" template("$FULLDATE $HOST cron.$PRIORITY $MSG\n")); }; destination d_bootlog { file("/var/log/boot.log" template("$FULLDATE $HOST local7.$PRIORITY $MSG\n")); }; destination d_postgres { file("/mnt/disk2/spooldir/syslog2pgsql/fulllog.$YEAR.$MONTH.$DAY.$HOUR.$MIN.$SEC" template("INSERT INTO msg_table VALUES$ '$R_ISODATE', '$S_ISODATE', '$HOST', '$FACILITY', $PRIORITY', '$MSG'$\;\n") template_escape(yes) owner(postgres)); }; #*********************************************************************** #*********************************************************************** filter f_msgs { host("syslogdb") and level(warning,err,crit,alert,emerg) and not facility(mail,authpriv,cron); }; filter f_mail { host("syslogdb") and facility(mail); }; filter f_cron { host("syslogdb") and facility(cron); }; filter f_secure { host("syslogdb") and facility(authpriv); }; filter f_bootlog { host("syslogdb") and facility(local7); }; filter f_postgres { host("syslogdb"); }; #*********************************************************************** #*********************************************************************** # log { source(s_sys); source(s_udp); destination(d_files); }; log { source(s_sys); source(s_udp); filter(f_msgs); destination(d_msgs); }; log { source(s_sys); source(s_udp); filter(f_mail); destination(d_mail); }; log { source(s_sys); source(s_udp); filter(f_secure); destination(d_secure); }; log { source(s_sys); source(s_udp); filter(f_cron); destination(d_cron); }; log { source(s_sys); source(s_udp); filter(f_bootlog); destination(d_bootlog); }; log { source(s_sys); source(s_udp); source(s_tcp); filter(f_postgres); destination(d_postgres); }; log { source(s_local); destination(d_local); };

1 0