April 2002 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]AIX 4.3.3 and pipe problem?
by Michael Earls 24 Apr '02

24 Apr '02

i have not seen that on the AIX but i have seen that on linux ver 1.5.15, the pipe does not work. -----Original Message----- From: AGehring(a)bis.adp.com Sent: Monday, April 22, 2002 12:31 PM To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng]AIX 4.3.3 and pipe problem? I'm running syslog ng on AIX 4.3.3 and while it works fine for system log calls, it doesn't seem to connect to a defined pipe and send information to it based on a logger call... below is a test conf file that I'm using. Send a message with logger is shows up in the d_mesg, but not to the d_pipe (Netcool is attached to the pipe. lsof shows the /var/adm/messages file being open, and again not the pipe... source s_sys { unix dgram ("/dev/log"); internal (); } destination d_mesg { file("/var/adm/messages"); }; destination d_pipe { pipe("/var/adm/mypipe"); }; log { source (s_sys); destination (d_mesg); destination (d_pipe); }; Any one seen this, or something like it? TIA, Andrew

2 1

IPtables Problem with syslog-ng
by Kaan Saldiraner 23 Apr '02

23 Apr '02

I have the latest STABLE version of syslog-ng. I want this machine to become my Log server for 5 or 6 machines. I am having trouble with iptables logging on the local machine. It doesn't log through syslog-ng. And also i would like to have a look at a sample config file for syslog-ng configured to be a Log Server. if you can provide this to me.. it will be great. Thank you in advance... Kaan Saldiraner Steltor Inc. (514)733-8500 x6503 www.steltor.com

1 0

Problems with Iptables Logging
by Kaan Saldiraner 23 Apr '02

23 Apr '02

I have the latest STABLE version of syslog-ng. I want this machine to become my Log server for 5 or 6 machines. I am having trouble with iptables logging on the local machine. It doesn't log through syslog-ng. And also i would like to have a look at a sample config file for syslog-ng configured to be a Log Server. if you can provide this to me.. it will be great. Thank you in advance... Kaan Saldiraner Steltor Inc. (514)733-8500 x6503 www.steltor.com

1 0

No indication of facility/level on AIX 4.3.3 using syslog-ng 1.4. 14
by Gehring, Andrew x66132 23 Apr '02

23 Apr '02

Is there something special I need to define or configure to have syslog-ng on AIX (4.3.3) write the facility/severity as part of the messages? On solaris we saw [facility/severity] written with each messages, but we don't get this on AIX... Did I miss something while configuring/compiling? Thanks, Andrew

3 4

AIX 4.3.3 and pipe problem?
by Gehring, Andrew x66132 23 Apr '02

23 Apr '02

I'm running syslog-ng on AIX 4.3.3 and while it works fine for system log calls, it doesn't seem to connect to a defined pipe and send information to it based on a logger call... below is a test conf file that I'm using. Send a message with logger is shows up in the d_mesg, but not to the d_pipe (Netcool is attached to the pipe. lsof shows the /var/adm/messages file being open, and again not the pipe... source s_sys { unix-dgram ("/dev/log"); internal (); } destination d_mesg { file("/var/adm/messages"); }; destination d_pipe { pipe("/var/adm/mypipe"); }; log { source (s_sys); destination (d_mesg); destination (d_pipe); }; Any one seen this, or something like it? TIA, Andrew

2 1

rotation log for syslog-ng
by J�r�me Tournier 23 Apr '02

23 Apr '02

Hello, i am trying to use syslog-ng. Could anyone brievely explain me how to have rotation log ? I can find any document about that. Is it possible ? Haw can i fixe the size of the files, and how can i specifie the number of files i want ? Thanks -- Jérôme

1 0

Re: Im sorry Im writing direct to you but the list is not working Re: [syslog-ng]filtering with regexp
by Balazs Scheidler 23 Apr '02

23 Apr '02

On Mon, Apr 22, 2002 at 12:02:05PM -0700, mar tin wrote: > Im sorry Im writing direct to you but the list is not > working.. I get all the messages back! > > now I've the lines duplicated: > I have them in auth.log and cron.log! > how can I tell syslog to put them only in cron.log? syslog-ng forwards messages to all matching destinations. you have two options to change this behaviour: * use filters that match only the lines you are interested in * use the flags(fallback) feature of syslog-ng 1.5.x > > --- Balazs Scheidler <bazsi(a)balabit.hu> wrote: > > On Thu, Apr 18, 2002 at 01:06:32PM -0700, mar tin > > wrote: > > > Hello :) > > > When cron runs, it sends the following lines > > > Apr 18 16:50:01 martinII PAM_unix[26181]: (cron) > > > session opened for user smmsp by (uid=0) > > > Apr 18 16:50:01 martinII PAM_unix[26182]: (cron) > > > session opened for user runa by (uid=0) > > > Apr 18 16:50:01 martinII PAM_unix[26183]: (cron) > > > session opened for user runa by (uid=0) > > > Apr 18 16:50:02 martinII PAM_unix[26181]: (cron) > > > session closed for user smmsp > > > Apr 18 16:50:25 martinII PAM_unix[26183]: (cron) > > > session closed for user runa > > > Apr 18 16:50:27 martinII PAM_unix[26182]: (cron) > > > session closed for user runa > > > > > > I want to filter those lines and send them to > > other > > > files, so I did: > > > > > > filter f_cron2{match("(cron) session opened");}; > > > log { source(src); filter(f_cron2); > > > destination(cron);}; > > > > > > but it sends the lines to auth.log! > > > > > > what am I doing wrong? > > > > match() expects an extended regular expression, thus > > '(' and ')' are > > interpreted as special characters. You need to > > escape them via '\', but as > > this is the escape character in the string, you need > > to double the backslash > > like: > > > > match("\$cron\$ session opened") > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C > > 0944 9CFD 804E C82C 8EB1 > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > __________________________________________________ > Do You Yahoo!? > Yahoo! Games - play chess, backgammon, pool and more > http://games.yahoo.com/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

program destination prob ?
by Thomas Ackermann 19 Apr '02

19 Apr '02

hy! i'm using syslog-ng to send remote log messages over an stunnel to a log server. everything's running quite fine, besides one little problem i have.. i'm starting the stunnel with program("/usr/sbin/stunnel -r 192.168.3.125:6543 -c"); when the stunnel is killed or quits because of a bad connection, syslog-ng doesn't even bother 'bout trying to restart it. is that a wanted behaviour and, or, is there a way to gat syslog-ng to respawn processes called with program() ? thx, thomas

4 4

Re: [syslog-ng]Different messages being logged
by Michael Renner 19 Apr '02

19 Apr '02

At 15:46 19.04.2002 +0100, you wrote: >log { source(s_sys); filter(f_filter1); destination(d_cons); }; >log { source(s_sys); filter(f_filter2); destination(d_mesg); }; >log { source(s_sys); filter(f_filter3); destination(d_auth); }; >log { source(s_sys); filter(f_filter4); destination(d_mail); }; >log { source(s_sys); filter(f_filter5); destination(d_mlal); }; >log { source(s_sys); filter(f_filter6); destination(d_spol); }; > > >The syslog.conf from my HPUX box has the following line added >*.info;mail.none @central-syslog-server > >I figure its got something to do with filters, but I dont know where to >start. Basically I want everything logged and then I'll start deciding what >to filter out. Maybe there are messages sent on facilities which aren't mentioned in your filters (like local1..7), try putting a "catch-everything-which-hasnt-been-logged-yet" rule somewhere in there. In 1.5.* it's something like log { source(s_sys); destination(leftover); flags(fallback); }; unfortunately i can't remember the syntax for 1.4.* anymore. You should also use something like "*.* @central-syslog-server" on the syslogd's if you really want all messages from the hpux'n. mfg/best regards -- Michael Renner Junior System Engineer Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at support(a)inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699

1 0

Different messages being logged
by Tom Horan 19 Apr '02

19 Apr '02

Hi, I'm running syslog-ng 1.4.14 on a RedHat 7 box, using it to log messages from a mixture of 10.20 and 11.0 HP-UX boxes. The HP boxes are using their own syslog here. I've got messages coming in from the hosts fine, but some stuff isnt coming through - ie syslog on the local box has more messages that the log on the central syslog-ng server. In particular is anything coming from vmunix. Here is what my config file looks like, it is taken from a sample config with just the udp added in and the $HOST variable added in for paths. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (no); }; source s_sys { unix-stream ("/dev/log"); internal(); udp(ip(10.16.6.102) port(51 4)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/syslog/$HOST/messages"); }; destination d_auth { file("/var/syslog/$HOST/secure"); }; destination d_mail { file("/var/syslog/$HOST/maillog"); }; destination d_spol { file("/var/syslog/$HOST/spooler"); }; destination d_boot { file("/var/syslog/$HOST/boot.log"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; The syslog.conf from my HPUX box has the following line added *.info;mail.none @central-syslog-server I figure its got something to do with filters, but I dont know where to start. Basically I want everything logged and then I'll start deciding what to filter out. Can anyone help me out here ? Thanks, Tom ************************************************************************ This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. http://www.esatbusiness.com Subscribe to the Esat Business Online Magazine: http://www.esatbusiness.com/news/subscribe.asp Subscribe to REALISE - the online magazine from BT Ignite: http://www.btignite.com/realise ************************************************************************

1 0