April 2002 - syslog-ng - lists.balabit.hu

Re: [syslog-ng]hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 11 Apr '02

11 Apr '02

hmm must have been a typo somewhere in the command - I started afresh and now it works :} Cheers, Bret [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

1 0

[PATCH] Unixtime (again)
by Gert Menke 10 Apr '02

10 Apr '02

Hi! Here's my Unixtime-Patch again, this time against syslog-ng-1.5.15. Balazs, I understand that you don't have much time, but please tell me what you think of it and if you will include it in 1.5.16, or why you won't. Also, I would like to have an option do define one or more default templates, perhaps like this: template t_unixtime { "$S_UNIXTIME $R_UNIXTIME $SOURCEIP $HOST $MSG\n" }; template t_isotime { "$S_ISOTIME $R_ISOTIME $SOURCEIP $HOST $MSG\n" }; destination d_foo { file("foo.log"); template(t_unixtime); }; destination d_bar { file("bar.log"); template(t_unixtime); }; destination d_human-readable { file("human-readable.log"); template(t_isotime); }; How can I do this? Could you help me implementing it? Greetings Gert

1 0

hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 10 Apr '02

10 Apr '02

Hi All, a stupid question most probably, I'd like to build a generic destination for my default filter so that any new hosts get dropped into their own directory something like destination host { file("/usr/log1/$HOST/$YEAR$MONTH$DAY" owner(root) group(logusers) perm(0640) dir_perm(0755)); }; But syslog-ng doesn't seem to like it and complains of syntax errors all the time.. Any hints? Thanks, Bret [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

2 1

RE: Passing IP address to a program
by Kevin Welch 09 Apr '02

09 Apr '02

Ignore that, its early. -----Original Message----- From: Kevin Welch Sent: Tuesday, April 09, 2002 8:04 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: Passing IP address to a program When my log events come in, I want to pass some of them to an external program to e-mail them, since the log event does not contain the ip address of the host, is there a way to pass this information along with the syslog event? -- Kevin

1 0

Passing IP address to a program
by Kevin Welch 09 Apr '02

09 Apr '02

When my log events come in, I want to pass some of them to an external program to e-mail them, since the log event does not contain the ip address of the host, is there a way to pass this information along with the syslog event? -- Kevin

1 0

Secondary date code
by Kevin Welch 08 Apr '02

08 Apr '02

All my syslog events have two date codes, is there any way to stop this? Apr 8 15:11:29 208.224.0.252 32200: Apr 8 14:11:28.307 EST: %SYS-5-CONFIG_I: Configured from console by vty1 (206.114.47.144) -- Kevin

1 0

RE: [syslog-ng]syslog-ng
by Michael Earls 08 Apr '02

08 Apr '02

i never ran into that problem on debian, i did have have it working to log to mysql,. but i was using mysql / pipe to enter stuff in the table, but the mysql client would die, for some unknow reason, that is why i am looking at a differnet way to set it up, and i need advise/help thanks michael www.vermeer.org -----Original Message----- From: AGehring(a)bis.adp.com Sent: Monday, April 08, 2002 2:28 PM To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> Subject: RE: [syslog-ng]syslog-ng I don't see how adding the ability for syslog ng to write to a database (SQL based) is any more different/difficult the allowing it to write to a file... We've modified it to natively write to Sybase... The problem with external programs, at least in our case, was that we would end up having 20+ process running to get the data where we needed it.... Andrew

1 0

RE: [syslog-ng]syslog-ng
by Gehring, Andrew x66132 08 Apr '02

08 Apr '02

I don't see how adding the ability for syslog-ng to write to a database (SQL based) is any more different/difficult the allowing it to write to a file... We've modified it to natively write to Sybase... The problem with external programs, at least in our case, was that we would end up having 20+ process running to get the data where we needed it.... Andrew

1 0

RE: [syslog-ng]syslog-ng
by Michael Earls 08 Apr '02

08 Apr '02

The reason I want it to log to a database is that I have over 100 routers and switches in different cities, I want a central Syslog server, I want all of techs in each city to be able to view the Syslog messages from a web browser anywhere. The only way I know to do this is have Syslog log to some database then have php/perl search from the web. What is the best way for me to do this with Syslog-ng? thanks michael -----Original Message----- From: bazsi(a)balabit.hu Sent: Wednesday, April 03, 2002 4:55 AM To: <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng]syslog-ng On Wed, Apr 03, 2002 at 03:38:03AM 0500, Michael Earls wrote: > Will syslog ng ever be native to log to mysql or any other type of > external database? I don't understand what the problems with using an external program for such purpose are. Simply write a 10 line long perl script where you can even preprocess messages before they go to the database, and feed this script with a pipe/program destination. Adding support for pgsql/mysql/sybase/whatever into syslog ng is bloat in my opinion. Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog ng maillist syslog ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog ng

1 0

RE: [syslog-ng]syslog-ng
by Michael Earls 08 Apr '02

08 Apr '02

the ver of syslog-ng 1.5.15, does it support templates? i can not get this line to work in this ver,, ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; is there a debug mode and where does that debug file go? thanks michael

1 0