February 2002 - syslog-ng - lists.balabit.hu

Solved: Not writing to new logfile after rotate and restart
by Livens Wim 18 Feb '02

18 Feb '02

> hmm.. are you HUP-ping the correct pid? you could possibly > truss syslog-ng > while sending the HUP to see whether it closes and reopens > its files. (it > should do so) The truss showed only /var/adm/messages was being reopened. I found that there were multiple syslog-ng's running. Killing them solved the problem. I falsely assumed the solaris init.d start script checked that. Thanks, -- Wim Livens.

1 0

RE: [syslog-ng]Not writing to new logfile after rotate and restar t
by Livens Wim 18 Feb '02

18 Feb '02

> On Mon, Feb 18, 2002 at 01:00:27PM +0100, Livens Wim wrote: > > > > I have a rather straightforward syslog-ng.conf. I write > all messages from > > the local host to /var/adm/messages and things that come > from the net to a > > separate (customer specific file) filtered on the source > host. All works > > well except that I can't rotate the customer specific > logfiles. I can > > rotate /var/adm/messages. > > > > doing: > > # mv /var/adm/messages /var/adm/messages.0 > > # kill -HUP `cat /etc/syslog-ng/syslog-ng.pid` > > > > and new log are written to /var/adm/messages > > > > BUT: > > # mv /data/customer-logs/491 /data/customer-logs/491.0 > > # kill -HUP `cat /etc/syslog-ng/syslog-ng.pid` > > > > and new messages are still written to data/customer-logs/491.0 > > > > I also tried stopping and starting syslog-ng and moving the > file somewhere > > completly different. > > It still magically remembers the old file. > > hmm.. are you HUP-ping the correct pid? you could possibly > truss syslog-ng > while sending the HUP to see whether it closes and reopens > its files. (it > should do so)

1 0

How do I send message to all ttys/ptys?
by Subodh Nijsure 18 Feb '02

18 Feb '02

Hello, Is there a way to send message to all tty/ptys of logged in users? Say I configure something on my system I want that message to be sent to all currently logged in users as well as to the console, which in my case is /dev/ttyS0 Via syslog-ng how do I redirect message to currently logged in ptys? /Subodh

3 2

RE: [syslog-ng]syslog-ng logging to mysql
by Abraham, Ajamu 18 Feb '02

18 Feb '02

Thanks for the link! However I got another novice question. I am having troubles getting sqlsyslogd running. I get this message when I try to make: ogbitch# make cc -O6 -Wall -pipe -I/usr/local/include -DCONF=\"/usr/local/etc/sqlsyslogd.conf\" -L/usr/local/lib/mysql -lmysqlclient sqlsyslogd.c -o sqlsyslogd /usr/local/lib/mysql/libmysqlclient.so: undefined reference to `strtoll' *** Error code 1 Stop in /usr/local/lab. I am running syslog-ng this on freeBSD. I checked to see if libmysqlclient.so is in the correct location and it is: logbitch# ls -la /usr/local/lib/mysql total 984 drwxr-xr-x 2 root wheel 512 Feb 16 20:48 . drwxr-xr-x 7 root wheel 1024 Feb 13 15:35 .. -r--r--r-- 1 root wheel 10542 Jan 23 14:47 libdbug.a -r--r--r-- 1 root wheel 34278 Jan 23 14:48 libheap.a -r--r--r-- 1 root wheel 15138 Jan 23 14:47 libmerge.a -r--r--r-- 1 root wheel 223014 Jan 23 14:47 libmyisam.a -r--r--r-- 1 root wheel 23010 Jan 23 14:48 libmyisammrg.a -rw-r--r-- 1 root wheel 187098 Jan 23 07:39 libmysqlclient.a lrwxr-xr-x 1 root wheel 20 Feb 13 15:35 libmysqlclient.so -> libmysqlclient.so.10 -rwxr-xr-x 1 root wheel 132453 Jan 23 07:39 libmysqlclient.so.10 -r--r--r-- 1 root wheel 35136 Jan 23 14:47 libmystrings.a -r--r--r-- 1 root wheel 193874 Jan 23 14:47 libmysys.a -r--r--r-- 1 root wheel 98296 Jan 23 14:47 libnisam.a I am wondering if you or anyone else can point me in the right direction. Thanks in advance. - Ajamu

1 0

Messages to console getting "chopped"
by Subodh Nijsure 18 Feb '02

18 Feb '02

Hello, I have setup one of the destination as /dev/ttyS0 and what I am observing is messages that are displayed on my serial console are "chopped", this serial console works fine for vi and all the other work I do, is this something error in configuration of syslog-ng, buffers? /Subodh

1 0

Re: [syslog-ng]Re: Having trouble with the options syntax for file permissions (fwd)
by Leonard Mills 15 Feb '02

15 Feb '02

On Fri, 15 Feb 2002 12:16:12 +0100 Balazs Scheidler <bazsi(a)balabit.hu> wrote: >as it seems your OS doesn't allow setting /dev/null to nonblocking mode and it >is fatal as of now: >what platform are you running syslog-ng? admin:{90} PM:uname -a BSD/OS admin.sjc.in.sel.sony.com 4.0.1 BSDI BSD/OS 4.0.1 Kernel #2: Mon Jan 14 03:20:12 UTC 2002 tra@admin.sjc.in.sel.sony.com:/usr/src/sys/compile/ADMIN i386 Len

1 0

log rotation not completing
by Len Conrad 15 Feb '02

15 Feb '02

FreeBSD 4.5R and syslog-ng 1.1.14. We have FreeBSD newsyslog rotate /var/log/maillog and /var/log/pop-before-smtp at 00:00. the rotation is working, we get the .0.gz files and new log files, but newsyslog-ng is apparently not receiving or reacting to the -HUP or whatever newsyslog sends after rotating the files, so logging to the new files stops at 00:00. We don't have this problem with FreeBSD syslogd. We run syslog-ng witht the standard .conf file delivered with the FreeBSD package and installed with pkg_add, with a couple of our lines added for filtering. eg, the pop-before-smtp log shows : Feb 15 00:00:00 buzzard newsyslog[2885]: logfile turned over Feb 15 03:13:45 ns1 POP3D (0000066C) logon success for nnn navymars.org from 66.26.185.182 no logging until we -HUP manually at 3:13. same situ with maillog. suggestions? Thanks Len http://MenAndMice.com/DNS-training http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K http://IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways

4 5

Multiple Filters
by Gehring, Andrew x66132 15 Feb '02

15 Feb '02

Does a "and" and a "or" work together? i.e.: filter f_myfilter { level(crit) and match("NOT OK") or match("terminated"); }; Would I get messages that are crit and contain "NOT OK", as well as crit and contain "terminated" Also, what is the best source statement for AIX 4.3.3? I have unix_dgram("/dev/log") and internal() Thanks, Andrew

2 1

log files showing short name.
by Yan Lau 15 Feb '02

15 Feb '02

Hello, I am using syslog-ng 1.5.14. I am trying to get the log messages to display the full hostname instead of the short name. For instance, Feb 4 10:06:42 mailhost su: 'su toto' succeeded for ylau on /dev/pts/0 We have several servers with the name "mailhost" so I would like it to show mailhost.nyc1.globix.net so I can tell which one it is. Here are the options I have set: options { sync (0); time_reopen (10); log_fifo_size (1000); create_dirs (yes); chain_hostnames (no); use_dns (no); use_fqdn (yes); }; Where is it picking up the short name and how can I get it to show the full name? Sometimes the log shows IP addresses, that is OK. Thanks, Yan.

2 1

Having trouble with the options syntax for file permissions
by Leonard Mills 15 Feb '02

15 Feb '02

Running v.1.5.13 Couldn't find likely questions in the archives, going to the list. I have been getting several gigabytes per day in the logs of entries similar to (line broken for length considerations: Feb 13 00:28:04 admin monitor_mail(a)admin.sjc.in.sel.sony.com: [daemon.info] monitor_mail(a)admin.sjc.in.sel.sony.com[24759]: connect from hpntbox1.corpnet.sel.sony.com To try and prevent these, I tried changing the conf file by adding: # DESTINATION ... destination trash { file("/dev/null"); }; ... # FILTER ... filter f_trash { match("connect from hpntbox1.corpnet.sel.sony.com"); }; ... # first exact rule log { source(src); filter(f_trash); destination(trash); flags(final); }; That works. Of course, the daemon then goes ahead and puts the default mode (0600) on /dev/null, which is not a good thing. I haven't been able to decipher a proper syntax for the options in the destination line. My best hints seem to have been in section 2.5 of the reference manual, so I tried: destination trash { file("/dev/null" options{perm(0666);}; ); }; But this gives a syntax error. Also tried eliding the options as in destination trash { file("/dev/null" perm(0666);); } to no avail. Obviously I'm missing something simple, but can't see it. TIA for any hints, Len

3 2