July 2002 - syslog-ng - lists.balabit.hu

Conf. syntax error?
by Gruber Zsolt 19 Jul '02

19 Jul '02

Hi, i would like to set up the syslog-ng, but by starting it, I get always syntax error messages for the first line of the config file. (it is independent from the containt of the 1. line) I made a very simly version: options { chain_hostnames(no); sync(0); }; but I got syntax error again : ... syslog-ng.conf: line 1 : syntax error near unexpected token `chains_hostnames(n' ... syslog-ng.conf: line 1 : `options { chain_hostnames(no); sync(0); };' What made I wrong? ( the syslog-ng 1.4.15 and the libol 0.2.23 was compiled from the source without errors) regards Zsolt

2 1

Solaris 8 + syslog-ng-1.5.18
by Sangbutsarakum, Patai 19 Jul '02

19 Jul '02

Dear friends, Anyone success to compile syslog-ng-1.5.18 on Solaris 8. I've try to search from mailing list, I've add stdio.h to cfg-grammar.c already (otherwise, error in make time) But after I passed that error. I still faced with the below error. Please suggest me to deal with the below error messages. Thanks in advance Pat. [..snipped..] D_GNU_SOURCE -c getopt.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c getopt1.c gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor -ll /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file request_init afinet.o sock_host afinet.o hosts_access afinet.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive

4 4

syslog-ng 1.5.19 released
by Balazs Scheidler 19 Jul '02

19 Jul '02

syslog-ng 1.5.19 has been released: News for the 1.5.19 release Thu, 18 Jul 2002 15:16:37 +0200 * Fixed a compile problem, which prevented non-debug compiles (stdio.h in cfg-grammar.y) * initial support for padded pipe sources (used on HP-UX /dev/log) * Other minor fixes it is available at http://www.balabit.hu/en/downloads/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]Solaris 8 + syslog-ng-1.5.18
by Sangbutsarakum, Patai 19 Jul '02

19 Jul '02

I'm using tcpwrapper that support IPV6 in my solaris 8 box $ pwd /usr/local/lib $ ls -al total 9758 drwxr-xr-x 4 bin bin 512 Jul 18 01:27 . drwxr-xr-x 11 root other 512 Jul 8 23:55 .. drwxr-xr-x 3 bin bin 512 Jun 3 12:02 gcc-lib drwxr-xr-x 2 root other 512 Jun 3 15:18 ipv4 -rw-r--r-- 1 bin bin 329544 Mar 16 2001 libiberty.a -rw-r--r-- 1 root other 58016 Jul 18 01:27 libol.a -rwxr-xr-x 1 root other 714 Jul 18 01:27 libol.la lrwxrwxrwx 1 root other 14 Jul 18 01:27 libol.so -> libol.so.0.0.0 lrwxrwxrwx 1 root other 14 Jul 18 01:27 libol.so.0 -> libol.so.0.0.0 -rwxr-xr-x 1 root other 52980 Jul 18 01:27 libol.so.0.0.0 -rw-r--r-- 1 bin bin 2222756 Mar 16 2001 libstdc++.a.2.10.0 -r-xr-xr-x 1 bin bin 2232464 Mar 16 2001 libstdc++.so.2.10.0 -rw-r--r-- 1 root other 51592 Jul 8 22:10 libwrap.a Am I correct? Please suggest Pat. -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, July 19, 2002 14:21 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Solaris 8 + syslog-ng-1.5.18 On Fri, Jul 19, 2002 at 01:52:35PM +0700, Sangbutsarakum, Patai wrote: > Dear firends, > Thanks for your suggest, I've done as shown below. > Unlucky, problem still occur > > gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 > -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c getopt1.c > gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -lwrap -o > syslog-ng -lwrap main.o sources.o center.o filters.o destinations.o log.o > cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o > afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o > syslog-names.o getopt.o getopt1.o -lpthread -ldoor -ll > /usr/local/lib/libol.a -lsocket -lnsl -lxnet > Undefined first referenced > symbol in file > request_init afinet.o > sock_host afinet.o > hosts_access afinet.o do you have a -lwrap at all? maybe you should not use --enable-tcp-wrappers commandline option. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]Solaris 8 + syslog-ng-1.5.18
by Sangbutsarakum, Patai 19 Jul '02

19 Jul '02

Dear firends, Thanks for your suggest, I've done as shown below. Unlucky, problem still occur ======================= Add -lwrap to LDFLAGS ======================= $ pwd /usr/local/src/syslog-ng-1.5.18/src $ grep LDFLAG * Makefile:LDFLAGS = -lwrap <<============= Makefile:syslog_ng_LDFLAGS = -lwrap <<============= Makefile:LINK = $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ Makefile: $(LINK) $(syslog_ng_LDFLAGS) $(syslog_ng_OBJECTS) $(syslog_ng_LDADD) $(LIBS) Makefile.in:LDFLAGS = @LDFLAGS@ Makefile.in:syslog_ng_LDFLAGS = -lwrap <<============ Makefile.in:LINK = $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ Makefile.in: $(LINK) $(syslog_ng_LDFLAGS) $(syslog_ng_OBJECTS) $(syslog_ng_LDADD) $(LIBS) ======================= Compile errors ======================= [..snipped..] gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c getopt1.c gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -lwrap -o syslog-ng -lwrap main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor -ll /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file request_init afinet.o sock_host afinet.o hosts_access afinet.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Thanks in advance Pat. -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, July 18, 2002 20:08 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Solaris 8 + syslog-ng-1.5.18 On Thu, Jul 18, 2002 at 04:43:24PM +0700, Sangbutsarakum, Patai wrote: > Dear friends, > > Anyone success to compile syslog-ng-1.5.18 on Solaris 8. > I've try to search from mailing list, > I've add stdio.h to cfg-grammar.c already (otherwise, error in make > time) > But after I passed that error. I still faced with the below error. > Please suggest me to deal with the below error messages. > > Thanks in advance > Pat. > > [..snipped..] > > D_GNU_SOURCE -c getopt.c > gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g > -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c getopt1.c > gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng > main.o sources.o center.o filters.o destinations.o log.o cfgfile.o > cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o > afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o > syslog-names.o getopt.o getopt1.o -lpthread -ldoor -ll > /usr/local/lib/libol.a -lsocket -lnsl -lxnet > Undefined first referenced > symbol in file > request_init afinet.o > sock_host afinet.o > hosts_access afinet.o > ld: fatal: Symbol referencing errors. No output written to syslog-ng > collect2: ld returned 1 exit status > *** Error code 1 > make: Fatal error: Command failed for target `syslog-ng' > Current working directory /usr/local/src/syslog-ng-1.5.18/src > *** Error code 1 > make: Fatal error: Command failed for target `all-recursive' > Current working directory /usr/local/src/syslog-ng-1.5.18/src > *** Error code 1 > make: Fatal error: Command failed for target `all-recursive-am' > Current working directory /usr/local/src/syslog-ng-1.5.18/src > *** Error code 1 > make: Fatal error: Command failed for target `all-recursive you enabled tcp wrapper support, and the configure script didn't detect -lwrap, you might want to change the generated Makefile, and add -lwrap to LDFLAGS -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: Very strange syslog-ng log forwarding behavior
by Balazs Scheidler 19 Jul '02

19 Jul '02

On Thu, Jul 18, 2002 at 04:53:20PM -0400, Steve Lin wrote: > I have the following syslog-ng configuration on one machine. > > > source s_sys { unix-stream ("/dev/log"); internal(); }; > source s_udp { udp(); }; > > destination err { file("/var/log/err.log"); }; > destination external { tcp(xxx.xxx.xxx.xxx); }; > > filter err { level(err); }; > > log { source(s_sys); source(s_udp); filter(err); destination(err); }; > log { source(s_sys); source(s_udp); filter(err); destination(external); }; > > > And the following configuration on a second machine I'm trying to forward logs to: > > > source s_tcp { tcp(); }; > destination external { file("/var/log/$HOST_err.log"); }; > log { source(s_tcp); destination(external); }; > > > On the source machine, there is a java process running that is generating lots of ERROR messages to syslog using the Apache log4j java syslog utility. What I'm seeing is that the ERROR messages are getting logged on the source machine into "/var/log/err.log" but they fail to reach the destination machine. Now, here's where it gets weird, when I run the following command from command-line: > > logger -p local0.error -t TEST "This is a test ERROR message" > > The generated log message gets logged on the source machine AND it also reaches the destination machine and gets logged correctly. This is the expected behavior. So why are the java program generated ERROR logs only getting logged on the source machine and not on the destination machine? > > Any help you could provide is greatly appreciated, thanks. Try strace-ing both syslog-ng processes as you send a message from Java. It is interesting how the message looks like and whether the message is sent to the 2nd syslog-ng or dropped on the first -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

AW: [syslog-ng]logfile save problem (again ;)
by Buerger, Manfred 18 Jul '02

18 Jul '02

Hello, For test purposes i have changed my configuration, as you told me to do: now i try $HOST, $SOURCEIP and $SOURCE_IP for the destination folder, but nothing works! Take a look at my config, please: # Syslog-ng configuration. # # what the default options are for files that it writes # options { sync(0); time_reopen(10); log_fifo_size(100); }; source src { unix-stream("/dev/log"); internal(); udp(ip("0.0.0.0") port(514)); }; filter f_messages { facility(local7); }; filter f_bootlog { facility(local7); }; filter f_authlog { facility(local7); }; #i know that this filter config doesn´t make sense; its only for testing purposes! destination messages { file("/var/log/syslog-ng/$SOURCE_IP/messages" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; destination bootlog { file("/var/log/syslog-ng/$SOURCEIP/boot.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; destination authlog { file("/var/log/syslog-ng/$HOST/secure.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_bootlog); destination(bootlog); }; log { source(src); filter(f_authlog); destination(authlog); }; The results of this config: destination messages (with $SOURCE_IP in the pathname) writes the file "messages" to "/var/log/syslog-ng/messages" destination bootlog (with $SOURCEIP in the pathname) writes the file "boot.log" to "/var/log/syslog-ng/boot.log" destination authlog (with $HOST in the pathname) works fine for Cisco network components! e.g. the logfile is stored in "/var/log/syslog-ng/10.146.18.3".Well!!! As i wrote in an earlier mail it don´t work with enterasys/cabletron stuff. They build folders like this: /var/log/syslog-ng # ll total 79 drwxr-x--- 2 root root 72 Jul 9 17:56 %CLI-E-FACUNKNWN, drwxr-x--- 2 root root 72 Jul 13 20:16 %CLI-E-INCMPCMD, drwxr-x--- 2 root root 72 Jul 9 19:05 %CLI-W-MODNOTFOUND, drwxr-x--- 2 root root 72 Jul 17 07:38 %CONFIG-E-SEARCH, drwxr-x--- 2 root root 72 Jul 14 00:23 %CONFIG-I-NOCHANGES, At least please take a look at the Syslogmessages sent by different network components! The Enterasys/Cabletron components send messages like this: Jul 17 09:10:48 %STP-I-PORT_STATUS,/10.146.12.16 Port status change detected: et.1.7 - Port Down The Cisco´s use another formatting: Jul 18 09:31:02 10.146.18.3/10.146.18.3 5392: 3w2d: %AMDP2_FE-5-EXCESSCOLL: Ethernet1/0 TDR=2, TRC=0 Could this cause the problem?? What can I do?? (perhaps some important information: i am using syslog-ng version 1.4.14) Thank you in advance manfred bürger -----Ursprüngliche Nachricht----- Von: Balazs Scheidler [mailto:bazsi@balabit.hu] Gesendet: Mittwoch, 17. Juli 2002 13:35 An: syslog-ng(a)lists.balabit.hu Betreff: Re: [syslog-ng]logfile save problem (again ;) On Wed, Jul 17, 2002 at 11:33:41AM +0200, Buerger, Manfred wrote: > hello, > > i have changed my config as you told me to do: > > destination local7 { > file("/var/log/syslog-ng/$SOURCEIP/local7.log" > sync(0) log_fifo_size(10) create_dirs(yes) > owner(root) group(system) perm(0660) dir_perm(0770)); > }; > > but i have still the same problem! > the message: "Jul 17 02:19:19 %STATIC-W-GWAYNOTREACH,/10.146.18.5 Gateway > 172.28.3.126 is not reachable." > is stored in "/var/log/syslog-ng/%STATIC-W-GWAYNOTREACH,/local7.log" and not > in "/var/log/syslog-ng/10.146.18.5/local7.log" !!! Are you sure you have reloaded the configuration? SOURCE_IP always inserts IP addresses, as the following snippet shows: case M_SOURCE_IP: { char *ip; if (msg->saddr) { CAST(inet_address_info, addr, msg->saddr); ip = inet_ntoa(addr->sa.sin_addr); } else { ip = "127.0.0.1"; } length = append_string(dest, left, ip, strlen(ip), escape); break; } -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Syslog-ng doesn't parse certain log messages
by Michael Renner 17 Jul '02

17 Jul '02

Hi! It seems that our syslog-ng (1.5.18, upgraded from 1.5.14 today) stopped logging messages from some routers. It seems to be a syslog-ng problem because the routers don't have anything in common (except that all of them are ciscos, but completely different hardware/ios versions). My configuration (only the relevant parts of the configfile are shown): --- options { sync (0); log_fifo_size (1000); use_fqdn (yes); chain_hostnames(no); stats (3600); use_time_recvd(no); use_dns(no); }; source netrout { udp(ip(213.229.60.108) port(514)); }; destination router { file("/var/log/router/$HOST/$YEAR-$MONTH-$DAY" create_dirs(yes) template("$DATE $HOST $MSG\n")); }; destination unknown { file("/var/log/unknown/$HOST/$YEAR-$MONTH-$DAY" create_dirs(yes) template("$DATE $HOST $MSG\n")); }; filter f_router { facility(local1,local2,local3,local4,local5,local6,local7); }; log { source(netrout); filter(f_router); destination(router); flags(final); }; log { source(netrout); destination(unknown); flags(fallback); }; --- "tcpdump -i eth0 -n -X -s0 port 514 and src 195.58.180.178" shows the following ouptut: This is a packet which doesn't get logged: 15:35:02.920137 195.58.180.178.54088 > 213.229.60.108.514: udp 129 0x0000 4500 009d 3294 0000 fc11 017d c33a b4b2 E...2......}.:.. 0x0010 d5e5 3c6c d348 0202 0089 545b 3c31 3733 ..<l.H....T[<173 0x0020 3e32 3733 3332 3136 3a20 4a75 6c20 3137 >2733216:.Jul.17 0x0030 2031 353a 3335 3a30 322e 3135 3520 4d45 .15:35:02.155.ME 0x0040 542d 4453 543a 2025 4c49 4e45 5052 4f54 T-DST:.%LINEPROT 0x0050 4f2d 352d 5550 444f 574e 3a20 4c69 6e65 O-5-UPDOWN:.Line 0x0060 2070 726f 746f 636f 6c20 6f6e 2049 6e74 .protocol.on.Int 0x0070 6572 6661 6365 2056 6972 7475 616c 2d41 erface.Virtual-A 0x0080 6363 6573 7338 3135 2c20 6368 616e 6765 ccess815,.change 0x0090 6420 7374 6174 6520 746f 2075 70 d.state.to.up --- "tcpdump -i eth0 -n -X -s0 port 514 and src 195.58.172.146" shows the following ouptut: This is a packet which gets correctly logged: 15:36:49.431070 195.58.172.146.9914 > 213.229.60.108.514: udp 123 0x0000 4500 0097 2c3a 0000 fc11 0ffd c33a ac92 E...,:.......:.. 0x0010 d5e5 3c6c 26ba 0202 0083 7d61 3c31 3733 ..<l&.....}a<173 0x0020 3e31 3538 3431 3837 3a20 4a75 6c20 3137 >1584187:.Jul.17 0x0030 2031 353a 3336 3a34 382e 3532 3020 4d45 .15:36:48.520.ME 0x0040 542d 4453 543a 2025 4c49 4e45 5052 4f54 T-DST:.%LINEPROT 0x0050 4f2d 352d 5550 444f 574e 3a20 4c69 6e65 O-5-UPDOWN:.Line 0x0060 2070 726f 746f 636f 6c20 6f6e 2049 6e74 .protocol.on.Int 0x0070 6572 6661 6365 2053 6572 6961 6c31 3a32 erface.Serial1:2 0x0080 2c20 6368 616e 6765 6420 7374 6174 6520 ,.changed.state. 0x0090 746f 2064 6f77 6e to.down --- I doubt that there's a permission problem on the syslog-ng side (All dirs have the permissions bits 700, logfiles 600; everything owned by root:root), the local syslog messages (internal()) don't show any suspicious messages (none at all). Can you give me a hint on how to resolve this problem? mfg/best regards -- Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at/ Michael Renner - Junior System Engineer m.renner(a)inode.at, Tel.: +43 59999 0 Fax.: +43 59999 6599 Buero Wien - Millennium Tower Handelskai 94-96/43 - A-1200 Wien Buero Graz - Schmiedlstrasse 1 - A-8042 Graz Buero Sbg - Schillerstrasse 30 - A-5020 Salzburg Buero Ibk - Eduard Bodem Gasse 5-7 - A-6020 Innsbruck

1 0

AW: [syslog-ng]logfile save problem (again ;)
by Buerger, Manfred 17 Jul '02

17 Jul '02

hello, i have changed my config as you told me to do: destination local7 { file("/var/log/syslog-ng/$SOURCEIP/local7.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; but i have still the same problem! the message: "Jul 17 02:19:19 %STATIC-W-GWAYNOTREACH,/10.146.18.5 Gateway 172.28.3.126 is not reachable." is stored in "/var/log/syslog-ng/%STATIC-W-GWAYNOTREACH,/local7.log" and not in "/var/log/syslog-ng/10.146.18.5/local7.log" !!! i hope you can help me once more manfred bürger -----Ursprüngliche Nachricht----- Von: Balazs Scheidler [mailto:bazsi@balabit.hu] Gesendet: Dienstag, 16. Juli 2002 10:21 An: syslog-ng(a)lists.balabit.hu Betreff: Re: [syslog-ng]logfile save problem (again ;) On Tue, Jul 16, 2002 at 09:48:45AM +0200, Buerger, Manfred wrote: > hello, > > I have allready posted my syslog-ng problem to this mailinglist on friday; > now, I hope I can make things more clear: > > I am using Suse8.0 with syslog-ng to monitor enterasys ans cabletron network > equipment (switches, routers.... ); and have some problems with the > configuration: > > in my syslog-ng.conf: > > destination local7 { > file("/var/log/syslog-ng/$HOST/local7.log" > sync(0) log_fifo_size(10) create_dirs(yes) > owner(root) group(system) perm(0660) dir_perm(0770)); > }; > > because of this configuration a system message like: > "Jul 15 13:56:28 %STP-I-PORT_STATUS,/10.146.12.16 Port status change > detected: et.3.6 - Port Up" > should be stored in "/var/log/syslog-ng/10.146.12.16/local7.log" > but it´s stored in: "/var/log/syslog-ng/%STP-I-PORT_STATUS,/local7.log". destination local7 { file("/var/log/syslog-ng/$SOURCEIP/local7.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; here's the list of macros you can use: { "FACILITY", M_FACILITY }, { "PRIORITY", M_LEVEL }, { "LEVEL", M_LEVEL }, { "TAG", M_TAG }, { "DATE", M_DATE }, { "FULLDATE", M_FULLDATE }, { "ISODATE", M_ISODATE }, { "YEAR", M_YEAR }, { "MONTH", M_MONTH }, { "DAY", M_DAY }, { "HOUR", M_HOUR }, { "MIN", M_MIN }, { "SEC", M_SEC }, { "WEEKDAY", M_WEEKDAY }, { "UNIXTIME", M_UNIXTIME }, { "R_DATE", M_DATE_RECVD }, { "R_FULLDATE", M_FULLDATE_RECVD }, { "R_ISODATE", M_ISODATE_RECVD }, { "R_YEAR", M_YEAR_RECVD }, { "R_MONTH", M_MONTH_RECVD }, { "R_DAY", M_DAY_RECVD }, { "R_HOUR", M_HOUR_RECVD }, { "R_MIN", M_MIN_RECVD }, { "R_SEC", M_SEC_RECVD }, { "R_WEEKDAY", M_WEEKDAY_RECVD }, { "R_UNIXTIME", M_UNIXTIME_RECVD }, { "S_DATE", M_DATE_STAMP }, { "S_FULLDATE", M_FULLDATE_STAMP }, { "S_ISODATE", M_ISODATE_STAMP }, { "S_YEAR", M_YEAR_STAMP }, { "S_MONTH", M_MONTH_STAMP }, { "S_DAY", M_DAY_STAMP }, { "S_HOUR", M_HOUR_STAMP }, { "S_MIN", M_MIN_STAMP }, { "S_SEC", M_SEC_STAMP }, { "S_WEEKDAY", M_WEEKDAY_STAMP }, { "S_UNIXTIME", M_UNIXTIME_STAMP }, { "HOST_FROM", M_HOST_FROM }, { "FULLHOST_FROM", M_FULLHOST_FROM }, { "HOST", M_HOST }, { "FULLHOST", M_FULLHOST }, { "PROGRAM", M_PROGRAM }, { "MSG", M_MESSAGE }, { "MESSAGE", M_MESSAGE }, { "SOURCEIP", M_SOURCE_IP } you might also use HOST_FROM or FULLHOST_FROM if you want hostnames instead of IPs (though it requires use_dns(yes)) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

getting duplicated entries in messages-file
by Reinhold.Farsch＠HVBInfo.com 17 Jul '02

17 Jul '02

Hi, maybe there is a posting covering my question... I installed syslog-ng 1.4.15 on a Solaris 8 box. I use an default configfile from the contrib directory. Every time there is a log message I get up to four entries in my logfile. Is anybody using this configfile? Where is the problem? Regards Reinhold # syslog-ng configuration file. # # This should behave pretty much like the original syslog on SunOS. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/adm/messages"); }; destination d_mail { file("/var/log/syslog"); }; destination d_auth { file("/var/log/authlog"); }; destination d_mlop { usertty("operator"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { level(err) or (level(notice) and facility (auth, kern)); }; filter f_filter2 { level(err) or (facility(kern) and level(notice)) or (facility(daemon) and level(notice)) or (facility(mail) and level(crit)); }; filter f_filter3 { level(alert) or (facility(kern) and level(err)) or (facility(daemon) and level(err)); }; filter f_filter4 { level(alert); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(kern) and level(notice); }; filter f_filter7 { facility(mail) and level(debug); }; filter f_filter8 { facility(user) and level(err); }; filter f_filter9 { facility(user) and level(alert); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_mlop); }; log { source(s_sys); filter(f_filter4); destination(d_mlrt); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_auth); }; log { source(s_sys); filter(f_filter7); destination(d_mail); }; log { source(s_sys); filter(f_filter8); destination(d_cons); destination(d_mesg); }; log { source(s_sys); filter(f_filter9); destination(d_mlop); destination(d_mlrt); }; Mit freundlichen Grüßen Reinhold Farsch HVBInfo GmbH Abt. INF5M2 - Unix Systeme :: Am Tucherpark 12, 80538 München :: phone: +49(0)89-378-31892 :: fax: +49(0)89-378-23375 :: e-mail: Reinhold.Farsch(a)HVBInfo.com

1 0