April 2002 - syslog-ng - lists.balabit.hu

io.c: do_write: write() failed (errno 146), Connection refused
by Vaningh, Ronny 08 Apr '02

08 Apr '02

My syslog-ng sometimes dies with the following message Apr 8 11:20:02 local@loghost syslog-ng[18617]: io.c: do_write: write() failed (errno 146), Connection refused I`m writing to a file on a local disk and forwarding over udp to a plain unix syslog server destination pix { file("/prod/log/$HOST/pix.log" create_dirs(yes) ); }; destination blah { udp(1.2.3.4); }; # # Lets chain everything together # log { source(net); filter(f_pix); destination(pix); destination(blah); }; Any idea what is causing this Thanks Ronny

1 0

RE: Filter Question.
by Kevin Welch 04 Apr '02

04 Apr '02

I fixed it.... after I found the link to the archives, I managed to figure out that the ; makes a big difference. -- Kevin -----Original Message----- From: Kevin Welch Sent: Thursday, April 04, 2002 2:57 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: Filter Question. Im trying to setup a filter as follows: filter f_terse { facility(local7); and match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; filter f_notterse { facility(local7); and not match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; Now my problem is that this doesnt work and kicks back an error, it seems I cannot use the match keyword and define other parameters. Is this correct or do I have the syntax messed up? My reason for needing this is that terse call records from my my dial systems take over 10000 calls a day and generate alot of syslog information, I need a way to filter these to a different logfile from other syslog events. Thanks -- Kevin

1 0

Filter Question.
by Kevin Welch 04 Apr '02

04 Apr '02

Im trying to setup a filter as follows: filter f_terse { facility(local7); and match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; filter f_notterse { facility(local7); and not match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; Now my problem is that this doesnt work and kicks back an error, it seems I cannot use the match keyword and define other parameters. Is this correct or do I have the syntax messed up? My reason for needing this is that terse call records from my my dial systems take over 10000 calls a day and generate alot of syslog information, I need a way to filter these to a different logfile from other syslog events. Thanks -- Kevin

1 0

Newbie questions.
by Stephen Amadei 04 Apr '02

04 Apr '02

Hello. I have been considering changing to syslog-ng for a while now, but I've been unable to wrap my brain around the idea since I don't exactly understand how syslog-ng replaces the old syslog. My first question is just that: How does syslog-ng replace the syslog? Do you simply remove klogd and syslogd from running and run syslog-ng instead? Is there a sample syslog-ng.conf that I can use to approximate the old syslog functionality until I get brave enough to tinker with it myself? My next concern is the "syslog -a" function. Where chrooting programs, I need to create extra /dev/log things by using the -a option. Can Syslog-ng also do this? Does syslog-ng still use the normal /dev/log device? I'm sorry if these are simple questions, but I think I will be pretty well set if I understand how closely to syslog syslog-ng works. ----Steve Stephen Amadei Dandy.NET! CTO Atlantic City, NJ

1 0

syslog-ng
by Michael Earls 03 Apr '02

03 Apr '02

Will syslog-ng ever be native to log to mysql or any other type of external database? thanks michael

3 2

Re: [syslog-ng]syslog-ng
by bretwatson＠charteredsemi.com 03 Apr '02

03 Apr '02

If you really want there is some work on a system that takes syslog on stdin and feeds into a modified snort IDS - thus you can have stateful inspection of content and all sorts of filtering.. look at sourceforge for snortadapter Bret Balazs Scheidler <bazsi(a)balabit.hu> 03/04/2002 05:55 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: (bcc: WATSON Bret/IT/CHRT/ST Group) Subject: Re: [syslog-ng]syslog-ng On Wed, Apr 03, 2002 at 03:38:03AM -0500, Michael Earls wrote: > Will syslog-ng ever be native to log to mysql or any other type of > external database? I don't understand what the problems with using an external program for such purpose are. Simply write a 10 line long perl script where you can even preprocess messages before they go to the database, and feed this script with a pipe/program destination. Adding support for pgsql/mysql/sybase/whatever into syslog-ng is bloat in my opinion. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

1 0

Filtering out multiple entries in log files due to different level
by Nick Chondropoulos 03 Apr '02

03 Apr '02

I just started testing syslog-ng in our enviroment a few days ago. I've been able to do what I want for the most part but the one thing that I'm stuck on (and it's probably a stupid admin trick I've missed) is to remove multiple entries from a log file due to level reporting. The necessary bit of backgound: Solaris 8 10/01 on both the client and server. The config file is: --------------------------------------------------------------------- options { sync(0); time_reopen(10); log_fifo_size(100); keep_hostname (no); chain_hostnames (no); create_dirs (yes); }; source net { udp (); }; destination all_by_host-facility { file ("/var/logs/$HOST/$FACILITY/$YEAR/$HOST.$FACILITY.$YEAR.$MONTH.log"); }; destination all_by_facility { file ("/var/logs/$FACILITY/$YEAR/$MONTH/$FACILITY.$LEVEL.$YEAR.$MONTH.log"); }; log { source(net); destination(all_by_host-facility); destination(all_by_facility); }; --------------------------------------------------------------------- I get the logs to split out by hostname year etc. but I get multiple entries in a log file the higher the level. The idea was to log a facility per file so I expected a single entry in the log file which I guess was a woring assumption. Is there a way to stop the following from happening: client> logger -p auth.emerg EMERG server> tail <log> Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG and replace it with a single line of: Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Is it even a syslog-ng config question? Maybe it's an OS question. TIA Nick -------------------------------+------------------+------------------- Nick Chondropoulos | Schlumberger | ZHTW H ELLAS Senior UNIX Systems Manager | 525 3rd Ave S.W. | nickc(a)calgary.geoquest.slb.com | Calgary, AB | If it's not P) 403-509-4000 | CANADA | dedicated hardware F) 403-509-4170 | T2P 0G4 | it's crap! -------------------------------+------------------+------------------- QUOMODO ARDUUM ESSE POSSIT

2 1

Is there a way to define message priority for syslog-ng?
by Antai Ning 03 Apr '02

03 Apr '02

4 5

(no subject)
by joyce_qian 02 Apr '02

02 Apr '02

syslog-ng，您好！致礼！ joyce_qian joyce_qian(a)mail.ihep.ac.cn

1 0

warning
by John_Delisle＠ceridian.ca 02 Apr '02

02 Apr '02

One thing to watch for in the latest version of syslog-ng - If you create a destination of /dev/null it changes the permissions on /dev/null to 0600 by default. This causes all sorts of problems. Perhaps a warning is in order? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 ********************************************************************** This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege. If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please notify the sender immediately. **********************************************************************

2 1