February 2002 - syslog-ng - lists.balabit.hu

Log Stoppage
by Gorm Jensen 01 Mar '02

01 Mar '02

I run syslog 1.4.12 on Redhat 7.1, kernel 2.4.17. Occasionally, I find that my logserver has stopped logging some packets. This is after, or during, a log rotation. Processes 'CRON' and 'minilogd' are running. Killing minilogd and HUPping all processes restores normal operations. Any help would be appreciated.

2 2

template() can't contain a newline...?
by Chan Wilson 28 Feb '02

28 Feb '02

Hey there. It appears that specifying a template in a file destination neither adds a trailing newline (which is OK, I s'pose), nor does it allow (in any way I can fanthom) any way of specifying such a newline. Obvious things like '\n' or '%n' fail to work, and shy of hacking either syslog-ng or libol source, I don't see any way of making it work...? TIA, --Chan

1 0

Splitting routerlogs from servers
by Michael Renner 28 Feb '02

28 Feb '02

Hiya! I've got a setup like this with many log hosts (~200, raising) and want to split the server logfiles from those of our routers. i've got a setup like this: --- options { sync (0); log_fifo_size (1000); use_fqdn (yes); chain_hostnames(no); stats (86400); }; source src { unix-stream("/dev/log"); internal(); }; source net { udp(ip(0.0.0.0) port(514)); }; source srck { pipe("/proc/kmsg"); }; destination messages { file("/var/log/local/$YEAR-$MONTH-$DAY" create_dirs(yes)); }; destination router { file("/var/log/router/$HOST/$YEAR-$MONTH-$DAY" create_dirs(yes)); }; destination server { file("/var/log/server/$HOST/$YEAR-$MONTH-$DAY" create_dirs(yes)); }; destination unknown { file("/var/log/unknown/$HOST/$YEAR-$MONTH-$DAY" create_dirs(yes)); }; filter f_router { facility(local1,local2,local3,local4,local5,local6,local7); }; filter f_server { host("server1|server2|serverx|..."); }; log { source(src); source(srck); destination(messages); flags(final); }; log { source(net); filter(f_server); destination(server); flags(final); }; log { source(net); filter(f_router); destination(router); }; log { source(net); destination(unknown); flags(fallback); }; --- This is a very ugly setup because i always have to add new servers to the f_server filter, otherwise it would get logged in the router/unknown dir Is there a better way to solve this with one ip address or should i add a secondary interface to the server and let the routers log to the second ip? mfg -- Renner Michael Junior System Engineer Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at support(a)inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699

3 3

Working example of forward logs
by sdouche.ml＠free.fr 28 Feb '02

28 Feb '02

Hi, I want forward all server syslog logs to a Linux supervision box. You have a complete example for this work ? Thanks -- Sébastien Douche <sdouche(a)free.fr>

2 1

problem with creating AF_INET socket at startup
by Frédéric LE BASTARD 28 Feb '02

28 Feb '02

Hi, I'm setting up a config with a frontal 'naked' linux RedHat 7.2 box / 2.4.18 (no X, no compiling tools, a basic firewall router) named celti000 I'd like to forward all the logs of celti000 on another linux box (RedHAt 7.2 / 2.4.18, with compiling tools). launching syslog-ng works on both machine, excpet on celti000, when I put this line in syslog-ng.conf : destination d_celti001 { udp("celti001" port (999)); }; if I have this line in my config file I get: error creating AF_INET socket (No such file or directory) any hints ? Thanks, Fred

2 2

Re: [syslog-ng]syslog-ng mysteriously exits
by Michael Earls 22 Feb '02

22 Feb '02

Syslog-ng running on debian / testing / Do we have an answer why syslog-ng just stops logging? and is there a fix? thanks michael

3 3

new macro feature request
by Nate Campi 21 Feb '02

21 Feb '02

I sort logs by hostname, but often the hostname field is wrong, containg a program name (from some solaris hosts) or a severity level (some network devices). Would it be possible to add a macro for the client IP/hostname? Instead of logging like this: destination hosts { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(logs) perm(0644) dir_perm(0755) create_dirs(yes)); }; I could log like this: destination hosts { file("/var/log/HOSTS/$gethostbyaddr/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(logs) perm(0644) dir_perm(0755) create_dirs(yes)); }; This way, /var/log/HOSTS/unixbox gets the log that the host "unixbox" sent even if the message itself is formatted incorrectly. Man I wish I knew C and could supply patches. Maybe I'll finally apply myself to the K&R C book soon and see what I can churn out ;) -- Nate "Mac users swear by their Mac, PC users swear at their PC."

1 0

Re: [syslog-ng]syslog-ng mysteriously exits
by Michael Earls 21 Feb '02

21 Feb '02

ok, cool, the ver of my syslog-ng is 1.5.13. thanks bazsi >>> bazsi(a)balabit.hu 02/21/02 03:48 AM >>> On Wed, Feb 20, 2002 at 04:24:10PM -0500, Michael Earls wrote: > Syslog-ng running on debian / testing / > > Do we have an answer why syslog-ng just stops logging? and is there a fix? 1.5.13 & 1.5.14 seems to have a bug, that it keeps alive incoming connections as it should, but stops logging from such kept alive connection. I know about the bug, but didn't have time to fix it until now. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Not writing to new logfile after rotate and restart
by Livens Wim 21 Feb '02

21 Feb '02

I have a rather straightforward syslog-ng.conf. I write all messages from the local host to /var/adm/messages and things that come from the net to a separate (customer specific file) filtered on the source host. All works well except that I can't rotate the customer specific logfiles. I can rotate /var/adm/messages. doing: # mv /var/adm/messages /var/adm/messages.0 # kill -HUP `cat /etc/syslog-ng/syslog-ng.pid` and new log are written to /var/adm/messages BUT: # mv /data/customer-logs/491 /data/customer-logs/491.0 # kill -HUP `cat /etc/syslog-ng/syslog-ng.pid` and new messages are still written to data/customer-logs/491.0 I also tried stopping and starting syslog-ng and moving the file somewhere completly different. It still magically remembers the old file. Any idea ?? Relevant part of my config: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination syslogfile { file("/var/adm/messages"); }; log { source(local); destination(syslogfile); }; source net { udp(); }; filter filter491 { host("12.34.56.78");}; destination logfile491 { file("/data/customer-logs/log491" perm(0644)); }; log { source(net); filter(filter491); destination(logfile491); }; (I'm using syslog-ng-1.4.14 on SunOS 5.8 sparc) Thanks, -- Wim Livens. IP Security Engineer. C o l t B e l g i u m

6 8

Buffer size for message
by Gehring, Andrew x66132 19 Feb '02

19 Feb '02

The buffer size for messages in syslog is 1024. I assume it is the same in syslog-ng. Is there any reason that I can't make this larger... Very long story as to why... Thanks, Andrew

1 0