February 2002 - syslog-ng - lists.balabit.hu

Re: Having trouble with the options syntax for file permissions (fwd)
by Leonard Mills 15 Feb '02

15 Feb '02

laszlo.murvai-buzogany(a)gt-systems.hu wrote on Thu Feb 14 at 09:59:19 2002: >I have had the same problem before, here is the thing you need: >destination trash { file("/dev/null" perm(0666) ); }; >That's how it works for me. Thanks, but this won't work for me. It doesn't drop core, but the daemon dies without writing anything to the log file(s).

2 1

Sorting based on incoming hostname.
by Konstantin Riabitsev 15 Feb '02

15 Feb '02

Hi, folks: I am trying to achieve the following setup. Say, I have Solaris boxes and Linux boxes on my network, and I want them all to log to one loghost. However, I would like to separate the incoming logs by system type. I had this idea: Solaris boxes would log to log-sol.domain.com, while Linux boxes would log to log-lnx.domain.com, which are both CNAME's to loghost.domain.com. Would it be possible for syslog-ng to put all solaris logs in /var/log/solaris and linux logs into /var/log/linux, based entirely on which hostname they arrived at? Cheers, -- 0> Konstantin ("Icon") Riabitsev / ) Duke University Physics Sysadmin ~ www.phy.duke.edu/~icon/pubkey.asc

2 1

syslog-ng logging to mysql
by Abraham, Ajamu 15 Feb '02

15 Feb '02

I am rather new to syslog-ng but love the way it can parse through my logs. I just need to get it writing to a database, thereby making my logs searchable. Can someone send me some links or steps that I need to take to get this accomplished. Thanks in advance. - Ajamu

2 1

Re: [syslog-ng]Having trouble with the options syntax for file permissions (fwd)
by Leonard Mills 14 Feb '02

14 Feb '02

Michael Renner <m.renner(a)inode.at> At Thu, 14 Feb 2002 09:49:06 +0100 (08:49 >Hi Len! >destination trash { file("/dev/null" perm(0666)); }; >should work. I must be denser than I thought, because that dumps core on starting the daemon: (gdb) bt #0 0xc076c11 in kill () #1 0xc0c27c9 in abort () #2 0x8054842 in fatal () #3 0x8054227 in io_set_nonblocking () #4 0x8054275 in io_init_fd () #5 0x80543e2 in make_io_fd () #6 0x804e703 in do_init_dest_writer (c=0x809d708, cfg=0x805f508, persistent=0x0) at affile.c:220 #7 0x804f032 in affile_find_writer (self=0x809cf88, msg=0x80a7e8c) at affile.c:669 #8 0x804f18b in do_handle_affile_log (c=0x809cf88, msg=0x80a7e8c) at affile.c:736 #9 0x804b43d in do_handle_log (c=0x809bf08, msg=0x80a7e8c) at destinations.c:103 #10 0x804ab79 in do_distribute_log (c=0x80a7e48, msg=0x80a7e8c) at center.c:149 #11 0x804a79b in do_add_source_name (c=0x80bd708, logmsg=0x80a7e8c) at sources.c:238 #12 0x804f513 in do_handle_afunix_line (c=0x80a7ec8, msg=0x80a7e8c) at afunix.c:70 #13 0x804a3dc in do_handle_line (self=0x8090008, length=109, data=0x8090020 "<30>Feb 14 19:52:52 monitor_kern(a)admin.sjc.in.sel.sony.com[ 19699]: connect from hpntbox1.corpnet.sel.sony.com", addr=0x0, addrlen=0) at sources.c:67 #14 0x804a54a in do_read_line (h=0x809d0d0, read=0x8047858) at sources.c:122 #15 0x80534c3 in read_callback () #16 0x8053243 in io_iter () #17 0x8049c3e in main_loop (backend=0x805e008) at main.c:174 #18 0x804a345 in main (argc=3, argv=0x80479f8) at main.c:472 #19 0x8049994 in __start () Any other ideas? Len

1 0

Re: Having trouble with the options syntax for file permissions
by MURVAI-BUZOGANY Laszlo 14 Feb '02

14 Feb '02

Hi! > I haven't been able to decipher a proper syntax for the options in the > destination line. My best hints seem to have been in section 2.5 of the > reference manual, so I tried: > > destination trash { file("/dev/null" options{perm(0666);}; ); }; > > destination trash { file("/dev/null" perm(0666);); } > I have had the same problem before, here is the thing you need: destination trash { file("/dev/null" perm(0666) ); }; That's how it works for me. Laszlo

1 0

Re: Logrotate "remove_if_older" documentation
by klaas.vangend＠philips.com 14 Feb '02

14 Feb '02

> I read something about a "remove_if_older" Config variable in Baszis 1.5.14 > announce, but couldn't find any documentation for it. In which context do i > have to use this function (destination i guess..) and which options does it > accept/need? > Is there also a function which compresses the "rotated-away" logfiles, or > do i have to use the "find -mtime" hack? I added documentation in the patch I sent. Yes, remove_if_older requires one parameters, stating the number of seconds (it was days in my patch, but Balazs changed that to seconds to match all other syslog-ng parameters). If the file where the log line is to be written to is older than the number of seconds specified, the file will be removed prior to writing the log to file. Thus it is a parameter of the file() destination. I originally though about implementing some other features, like the ones you described, but because our product (which uses syslog-ng as logger) doesn't need those features, my boss didn't allow me to work on those. It shouldn't be too complex to add, by the way. You can take my patch as a basis for knowing where to change the source code. Groetjes, Klaas van Gend

3 3

Why can't I get NOT to work in a filter?
by Chad White 13 Feb '02

13 Feb '02

Hi all, I am trying to filter out some things from my log files using a filter with a NOT command and I can't get it to work. I am running Syslog-ng 1.4.14 on Solaris 8 (SPARC). What I am trying to do in this case is ensure that sudo doesn't get logged into my /var/adm/messages file. Here are the pertinent lines of my config file: options { dir_perm(0755); perm(0640); owner(root); group(wheel); chain_hostnames (no); keep_hostname(yes); }; source local { sun-streams("/dev/log" door ("/etc/.syslog_door") ); internal(); }; filter not_sudo { not facility(local2); }; filter notice_emerg { level(notice...emerg); }; destination messages { file("/var/adm/messages" create_dirs(yes)); }; log { source(local); filter(notice_emerg); filter(not_sudo); destination(message s); }; Now, it is my understanding that the filters are AND'd together so that log statement should basically say "log everything with a level between notice and emergency unless it is facility(local2)." However, I am still getting this is my log files: Dec 30 03:32:24 hqmon /usr/local/bin/sudo: [ID 850335 local2.notice] nobody : TTY=unknown ; PWD=/opt/bb18d ; USER=root ; COMMAND=/usr/sbin/vxdisk check rootdisk Also another filter that dumps everything from facility(local2) does dump all the sudo stuff into a file like I want.. Starting to feel like an idiot since I can't get this to work. Can someone give me some pointers to filtering out just a few cases based on facility or strings? thx, --Chad

1 0

Splitting UDP syslog traffic
by Eduardo Seud�nimo 13 Feb '02

13 Feb '02

I'm interested in doing a 'tee' to syslog traffic much in the same way that the tee command does to stdout. I currently have a syslog-ng server that gets a whole lot of traffic sent his way. Because of bandwidth contraints, I do not want to double the traffic flow by sending it to two servers. I would like to have a way to listen for the incoming syslog traffic and redirect each packet to a different IP address while preserving the original packet destined for my syslog box. For each packet that looks like this: source IP ----> syslog server IP I want two packets like this: source IP ----> syslog server IP source IP ----> syslog server2 IP This will allow me to send a stream to both servers while preserving the bandwidth to the remote sites. I need to preserve the source IP traffic because I'm using sysng to break it up into seperate paths/files based on source. Is this possible with NG? It looks like NG will bind to a local address when using the udp destination driver.

2 1

Re: A question on syslog-ng
by Balazs Scheidler 13 Feb '02

13 Feb '02

On Wed, Feb 13, 2002 at 01:12:49AM -0800, Subodh Nijsure wrote: > Is there any way in syslog-ng to stop logging of message once it has > been logged to "a destination". > > I am getting say ftpd messsages logged in ftpd.log file as well as my catch > all > entries I want to configure things such that they get logged only once. 1. use negative filters 2. in the 1.5.x tree you have the following flags on destinations you could use for this purpose: <entry>final</entry> <entry> This flag means that the processing of log statements ends here. Note that this doesn't necessarily mean that matching messages will be stored once, as they can be matching log statements processed prior the current one. </entry> </row> <row> <entry>fallback</entry> <entry> This flag makes a log statement 'fallback'. Being a fallback statement means that only messages not matching any 'non-fallback' log statements will be dispatched. </entry> </row> <row> <entry>catchall</entry> <entry> This flag means that the source of the message is ignored, only the filters are taken into account when matching messages. </entry> </row> -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Logrotate "remove_if_older" documentation
by Michael Renner 12 Feb '02

12 Feb '02

Hiya! I read something about a "remove_if_older" Config variable in Baszis 1.5.14 announce, but couldn't find any documentation for it. In which context do i have to use this function (destination i guess..) and which options does it accept/need? Is there also a function which compresses the "rotated-away" logfiles, or do i have to use the "find -mtime" hack? mfg/best eregards -- Renner Michael Junior System Engineer Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at support(a)inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699

1 0