October 2002 - syslog-ng - lists.balabit.hu

Erreur configuration file
by Laurent Mesuré 09 Oct '02

09 Oct '02

Hi, i ve used the HOWTO from Ben Russo to install syslog-ng on a Mandrake Linux box. I ve already have a PostgreSQL running on this box. I 've build both libol and syslog-ng without any problem. I ve made all steps specified in the HOWTO. But when i launch my /etc/init.d/syslog-ng i go the following error: Starting syslog-ng: parse error at 37 Parse error reading configuration file, exiting. And in the configuration file at line 37 i have the following lines: destination d_msgs { file("/var/log/messages" template("$FULLDATE $HOST $FACILITY.$PRIORITY $MSG\n")); }; What happened? regards -- Laurent Mesuri Steria Group http://www.steria.com SAF/DAF Boulogne Billancourt France Tel: +33.1.46.20.65.57 Fax: +33.1.46.20.65.65 Mob: +33.6.82.68.15.22

3 3

Re: Solved: Re: troubles with postfix and syslog-ng 1.5.21: lost log lines
by Balazs Scheidler 09 Oct '02

09 Oct '02

Hi, Thanks for finding this out. Ccing to the syslog-ng list. postfix is chrooted, and thus cannot reopen log connections from the chrooted jail. if one runs postfix it is advisably to fetch logs from /var/spool/postfix/dev/log It's not syslog-ng specific though. Nate could you add this to the FAQ? On Wed, Oct 09, 2002 at 03:05:07PM +0200, Dr. Peter Bieringer wrote: > > > --On Dienstag, 8. Oktober 2002 15:48 +0200 Balazs Scheidler > <bazsi(a)balabit.hu> wrote: > > >> 2) after restarting syslog-ng, postfix/nqmgr do no longer log > >> > >> That's very strange, I don't find a solution until now. Do you have > >> hints? > > > > this is a libc issue IMHO, libc doesn't immediately reopen log connections > > if sending a message fails. as you restart syslog-ng the connections to > > the previous instance of syslog-ng are lost. > > Looks like through a magic mechanism, logging works on startup also by the > chrooted-postfix process. To reestablish the log on syslog-ng restart, the > log socket has to be connected again: > > > -- syslog-ng.conf 8 Oct 2002 12:13:53 -0000 1.9 > +++ syslog-ng.conf 9 Oct 2002 12:54:56 -0000 > @@ -13,6 +13,7 @@ > > source s_local { internal(); > unix-stream("/dev/log" keep-alive(yes) > max-connections(100)); > + unix-stream("/var/spool/postfix/dev/log" keep-alive(yes) > max-connections(100)); > file("/proc/kmsg"); > }; > > > Perhaps an entry for a FAQ. Also the one with the too few log connect > limits. > > Peter > -- > Dr. Peter Bieringer Phone: +49-8102-895190 > AERAsec Network Services and Security GmbH Fax: +49-8102-895199 > Wagenberger Straße 1 Mobile: +49-174-9015046 > D-85662 Hohenbrunn mailto:pbieringer@aerasec.de > Germany Internet: http://www.aerasec.de > PGP/GPG: http://www.aerasec.de/wir/publickeys/PeterBieringer.asc > -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

apache logs, again
by Andreas Hasenack 08 Oct '02

08 Oct '02

Ok, I'm using the tail | logger thing and it sort of works. But there is a problem: date/time. I get entries like this in mysql: (long line below, sorry) 714 machine local4 info 2001-12-31 00:00:00 apache: 127.0.0.1 - - [07/Oct/2002:17:43:41 -0300] "POST /syslog/results.php HTTP/1.1" 200 700 Of course, only the date/time of the entry itself (msg field) is correct. Logger doesn't seem to add date/time info to the logs it sends. Any clever way around this? Is this a logger bug?

2 3

getting a build error on Solaris8,
by Todd S. Ness 08 Oct '02

08 Oct '02

here is the output from my make command: I see that res_init is defined in resolve.h on my system in /usr/include/resolve.h, I don't know where to look for yywrap problem. Thanks Todd. make Making all in src make all-recursive Making all in . gcc -g -O2 -Wall -I/opt/a/src/syslog-ng/SunOS5.8/libol-0.3.3/src -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor /opt/a/src/syslog-ng/SunOS5.8/libol-0.3.3/src/.libs/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file res_init main.o yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /opt/a/src/syslog-ng/SunOS5.8/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /opt/a/src/syslog-ng/SunOS5.8/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /opt/a/src/syslog-ng/SunOS5.8/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' -- ToddNess - EDS/StorageTek Infrastructure Specialist 303-661-5854 Better to keep quiet and be thought wise than to speak up and remove all doubt.

2 2

How can I get logs without date,time hostname and facility ?
by alexch 07 Oct '02

07 Oct '02

ok I have correct this line in my syslog-ng.conf destination hosts { file("/var/log/hosts/$HOST/$FACILITY/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" template("$MSG\n") owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; and now log looks like this squid: 1033739673.117 10818 192.168.1.29 TCP_REFRESH_MISS/200 19595 GET http://lists.balabit.hu/pipermail/syslog-ng/ - DIRECT/62.80.73.147 text/html squid: 1033739687.778 3124 192.168.1.29 TCP_MISS/200 180 GET http://216.239.33.102/search? - DIRECT/216.239.33.102 text/html I need exclude word "squid" from logs, it need for SQRMGLOG. It doesn't work correctly with this log How ????????? Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628

2 1

Apologies
by Brett Dubroy 07 Oct '02

07 Oct '02

Hello, It's been brought to my attention that I inadvertently posted a "I'm going home sick" type message to the mailing list; If anyone on the list is in Ottawa, I highly recommend *not* catching the latest round of the flu ;-) TTYL & Apologies Brett --- Brett Dubroy Jetnet Internetworking Services Email : bdubroy(a)jetnet.ca Phone : (613) 237-5995 x 227 This communication contains confidential information intended solely for the use of the individual/s and/or entity or entities to whom it was intended to be addressed. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this transmission is prohibited. If you have received this communication in error, please contact the sender immediately, delete the communication from your system and do not disclose its contents to any third party or use its contents. Any opinions expressed are solely those of the author and do not necessarily represent those of JETNET Internetworking Services Inc. unless otherwise specifically stated.

1 0

internal logging problem
by Carlos Velasco 04 Oct '02

04 Oct '02

Hi, I have tried syslog-ng versions 1.5.18 and 1.5.21 with the same problem. My system is: > uname -a Linux atlas 2.4.19 #1 Tue Aug 6 01:59:40 CEST 2002 i586 unknown syslog-ng.conf: source src { internal(); }; destination syslog { file("/var/log/syslog.log"); }; log { source(src); destination(syslog); }; I can't see any internal messages in /var/log/syslog.log file tcp, udp and unix-streams works fine, only problem is with internal. Any help would be apreciated. Regards, Carlos Velasco

2 7

RE: [syslog-ng]How can I get logs without date,time hostname and facility ?
by Hamilton, Andrew 04 Oct '02

04 Oct '02

It means that you want to define your own logfile format. To do this you use the template function. $MESSAGE is a MACRO that is defined inside syslog-ng and returns only the message portion of the log entry which is what you said you were looking for. -----Original Message----- From: alexch [mailto:alexch@gc.lviv.ua] Sent: Friday, October 04, 2002 8:22 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]How can I get logs without date,time hostname and facility ? What does it mean ???? template("$MESSAGE\n"); Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

How can I get logs without date,time hostname and facility ?
by alexch 04 Oct '02

04 Oct '02

What does it mean ???? template("$MESSAGE\n"); Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628

1 0

RE: [syslog-ng]How can I get logs without date,time hostname and facility ?
by Hamilton, Andrew 04 Oct '02

04 Oct '02

Alex, Try use the template function to in your destination file definition. I haven't used this so I'm not 100% sure of the syntax but you can try the destination. You might have to tweak it a bit to get it right. destination hosts { file("/var/log/hosts/$HOST/$FACILITY/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(src); destination(hosts); template("$MESSAGE\n"); }; Regards, Drew -----Original Message----- From: alexch [mailto:alexch@gc.lviv.ua] Sent: Friday, October 04, 2002 7:53 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]How can I get logs without date,time hostname and facility ? Ok I have done that my squid's access.log works via syslog-ng. That's nice. I get log given below -------------cut----------------- Oct 4 14:34:48 gw squid: 1033731288.219 1234 192.168.1.29 TCP_MISS/000 0 GET http://www.sans.org/infosecFAQ/sec_solaris.htm - NONE/- - Oct 4 14:34:48 gw squid: 1033731288.755 1764 192.168.1.29 TCP_MISS/200 192 GET http://216.239.33.102/search? - DIRECT/216.239.33.102 text/html -------------cut----------------- but I want to get log without "Oct 4 14:34:48 gw squid:" (date,time hostname and facility) How can I do it??? my syslog-ng.conf ------begin------------- options { keep_hostname(no); long_hostnames(off); sync(0); }; # source src { unix-dgram("/var/run/log"); # udp(); internal(); file("/dev/klog"); udp(ip("192.168.1.7") port(514)); destination hosts { file("/var/log/hosts/$HOST/$FACILITY/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(src); destination(hosts); }; -----end------ Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0