July 2002 - syslog-ng - lists.balabit.hu

Re: [syslog-ng]dns caching
by Michael Renner 13 Jul '02

13 Jul '02

At 12:16 09.07.2002 +0200, you wrote: >i've been using syslog-ng for a while, and now that i've setup dnscache >(from djb) to use syslog instead of his own loggin method (multilog), i've >found a funny thing that fulls my log files. (dnscache pc and syslog-ng >hosting pc are different machines, i log through network). > >1- when a dnscache-request is made, dnscache issues a message to syslog-ng. >2- syslog-ng writes down to the syslog file the new entry, but it does a dns >lookup (because the log entry is coming from a machine on the network). >3- loop forever :) > >i don't want to use the use_dns(off) option of syslog-ng, because i wan't >ips translated. Is there a way that syslog-ng could cache the dns querys, so >id doesn't do one dns lookup for each line? This was discussed previously on this list; dns caching shouldn't be the job of syslog-ng and would need much "unnecessary" code in syslog-ng; there are other programs which are more capable of doing this (dnscache from djb). I would suggest that you stick with multilog because dnscache is quite verbose and logging these rather unnecessary messages via syslog-ng would waste lots of cpu cycles (you don't log your apache access-logs via syslog, do you?) mfg/best regards -- Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at/ Michael Renner - Junior System Engineer m.renner(a)inode.at, Tel.: +43 59999 0 Fax.: +43 59999 6599 Buero Wien - Millennium Tower Handelskai 94-96/43 - A-1200 Wien Buero Graz - Schmiedlstrasse 1 - A-8042 Graz Buero Sbg - Schillerstrasse 30 - A-5020 Salzburg Buero Ibk - Eduard Bodem Gasse 5-7 - A-6020 Innsbruck

2 1

[nate@campin.net: Re: Thanks for syslog-ng info]
by Dale Amon 12 Jul '02

12 Jul '02

1 0

syslog-ng compile errors
by Dale Amon 12 Jul '02

12 Jul '02

sed: can't read /usr/src/syslog-ng-1.5.18/utils/Makefile.in: No such file or directory creating syslog-ng.spec creating src/config.h src/config.h is unchanged > /usr/src/syslog-ng-1.5.18# ls /usr/src/syslog-ng-1.5.18/utils/ Makefile > /usr/src/syslog-ng-1.5.18# make Making all in src make[1]: Entering directory `/usr/src/syslog-ng-1.5.18/src' cd /usr/src/syslog-ng-1.5.18 && autoheader make all-recursive make[2]: Entering directory `/usr/src/syslog-ng-1.5.18/src' Making all in . make[3]: Entering directory `/usr/src/syslog-ng-1.5.18/src' make_class <main.c >main.c.xT /bin/sh: /usr/local/bin/make_class: \: bad interpreter: No such file or directory make[3]: *** [main.c.x] Error 126 make[3]: Leaving directory `/usr/src/syslog-ng-1.5.18/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/syslog-ng-1.5.18/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/src/syslog-ng-1.5.18/src' make: *** [all-recursive] Error 1

2 3

configuration problem: destination where the logfiles are saved
by Buerger, Manfred 12 Jul '02

12 Jul '02

hello, i have installed syslog-ng on Suse Linux 8.0, and i want to monitor the network components (switches, routers...). i have allready done the configuration in the syslog-ng.conf. with cisco components it works fine! the logs are correct stored in "/var/log/syslog-ng/$HOST/messages" . for each network host a seperate directory is generated, where the logs are stored! But this don´t work with enterasys and cabletron network equipment! instead of the host, the message itself bilds the directory: myhost:/var/log/syslog-ng # ls -ll total 2 drwxr-x--- 2 root root 72 Jul 9 17:56 %CLI-E-FACUNKNWN, drwxr-x--- 2 root root 72 Jul 9 22:40 %CLI-E-IVCMD, drwxr-x--- 2 root root 72 Jul 9 19:05 %CLI-E-IVPORTLIST, drwxr-x--- 2 root root 72 Jul 9 19:03 %SYS-I-BKPLANEOFFLINED, drwxr-x--- 2 root root 72 Jul 9 19:05 %SYS-I-DSCVMOD, drwxr-x--- 2 root root 72 Jul 9 19:05 %SYS-I-HOTSWAPIN, drwxr-x--- 2 root root 72 Jul 9 18:50 %SYS-I-HOTSWAPOUT, drwxr-x--- 2 root root 72 Jul 9 19:05 %SYS-I-HOTSWAP_INRXD, drwxr-x--- 2 root root 72 Jul 9 18:50 %SYS-I-HOTSWAP_OUTRXD, drwxr-x--- 2 root root 72 Jul 9 19:05 %SYS-I-INITPORT, drwxr-x--- 2 root root 72 Jul 9 18:19 %SYS-W-PWRFAIL, drwxr-x--- 2 root root 72 Jul 3 10:52 %TELNETD-W-IDLE_TIMEOUT, drwxr-x--- 2 root root 72 Jul 6 12:07 %TELNETD-W-LOGINFAIL, drwxr-x--- 2 root root 72 Jul 9 19:06 %VLAN-I-ADDSUCCESS, drwxr-x--- 2 root root 72 Jul 4 00:22 %WAN-I-MSG, drwxr-x--- 2 root root 72 Jul 9 10:13 10.146.18.3 the last directory "10.146.18.3" is correct, it contains the logs of a cisco device. how can i configure syslog-ng, that also the enterasys/cabletron devices build correct directory structure, like the cisco device does ??? thanks in advance manfred

1 0

Re: [syslog-ng]Syntax question
by Michael Earls 11 Jul '02

11 Jul '02

the pipe template is not supported in that ver, u need to switch to 1.5.x release >>> mdodson(a)coremetrics.com 07/11/02 11:26AM >>> I am using syslog-ng-1.4.15 with libol-0.2.23 on RH72 On Thu, 2002-07-11 at 10:15, Michael Earls wrote: > what ver of syslog-ng, b/c template() destinations are only supported by > the 1.5.x releases. > > michael > > >>> mdodson(a)coremetrics.com 07/11/02 11:01AM >>> > > > Every time I start syslog-ng I receive a "Parse error reading > configuration file, exiting." It points to the following line in my > config: > > destination d_pipe { pipe("/tmp/mysql.pipe" template("INSERT INTO logs > (host, facility, priority, level, tag, date, time, program, msg) VALUES > ('$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG');\n") > template_escape(yes)); }; > > > Can anyone tell me what is wrong with this syntax? > Sorry for this newbie question but I can't seem to get the syntax right. > > > Thanks, > Mdodson > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://lists.balabit.hu/mailman/listinfo/syslog-ng> > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > <http://www.campin.net/syslog-ng/faq.html> > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 2

Re: [syslog-ng]Syntax question
by Michael Earls 11 Jul '02

11 Jul '02

what ver of syslog-ng, b/c template() destinations are only supported by the 1.5.x releases. michael >>> mdodson(a)coremetrics.com 07/11/02 11:01AM >>> Every time I start syslog-ng I receive a "Parse error reading configuration file, exiting." It points to the following line in my config: destination d_pipe { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ('$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG');\n") template_escape(yes)); }; Can anyone tell me what is wrong with this syntax? Sorry for this newbie question but I can't seem to get the syntax right. Thanks, Mdodson _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Syntax question
by Matthew Dodson 11 Jul '02

11 Jul '02

Every time I start syslog-ng I receive a "Parse error reading configuration file, exiting." It points to the following line in my config: destination d_pipe { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ('$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG');\n") template_escape(yes)); }; Can anyone tell me what is wrong with this syntax? Sorry for this newbie question but I can't seem to get the syntax right. Thanks, Mdodson

1 0

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Antai Ning 11 Jul '02

11 Jul '02

syslog-ng 1.4.11 on Redhat linux 7.2. And here is the syslog-ng globla option look like. (Sorry I can't post all the configuration because of obvious reasons :) ) But there is no options set for specific source, destionation or filter. options { use_dns (no); # Don't perform DNS lookups use_fqdn (no); # Don't use full hostname create_dirs (yes); # Create any necessary dirs for files use_time_recvd (yes); # Use our time, not the remote device time log_fifo_size(10000); # Queue 10000 msgs on a blocked dest sync(0); # Flush the queues as fast as possible # Tweak the sync parameter if the disks are # going wild and thrashing the machine chain_hostnames(on); # Chain hostname/IP information in log line }; source s_UDP { udp( ip(192.168.1.1) port(514) ); }; destination d_alert { pipe ("/usr/local/var/ALERT"); }; filter f_alert { match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ..."); }; log { source(s_UDP); filter(f_alert); destination(d_alert); }; Thanks, Andy -----Original Message----- From: Michael Earls [mailto:Michael.Earls@chmcc.org] Sent: Thursday, July 11, 2002 10:13 AM To: aning(a)jetnet.ca; syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Strang behaviour of syslog-ng (and my program) What ver of syslog-ng? and what distro are u running syslog-ng on? what does your config look like? michael >>> aning(a)jetnet.ca 07/11/02 09:49AM >>> Just add a little more info, if I send the first 10 messages a little bit slower, say delay 10 msec in between, then it doesn't happen. -----Original Message----- From: Antai Ning [mailto:aning@jetnet.ca] Sent: Wednesday, July 10, 2002 1:38 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Strang behaviour of syslog-ng (and my program) Hi Gurus, I got some strange phenomemon with syslog-ng. Here is what I'm doing. I configured syslog-ng to forward certain type of messages to a pipe. (say, ALERT). I wrote a program in perl to read from the pipe and print them out. The perl program first try to open the pipe and it'll block at the open function untill syslog-ng has some messages to write to the pipe. Then the perl program reads using IO::File can_read() function, with a 5 seconds timeout. So the function looks like this: $sel->can_read(5). Then I send 10 valid messages to syslog-ng from a remote machine by UDP. To my supprise, the perl program got only 2 of the 10! Then I send another 1 valid message to this syslog-ng after 5 minutes, and I got not only this message, but also the 8 I lost last time! This happens only for the first 10 messages (which includes the opening of the pipe). Everything is fine after the first round. It looks like it's related to the pipe opening and messages get queued somewhere until later messages trigger the queue to flush. So what's really happening inside? And is there a solution? Thanks, Andy

1 0

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Antai Ning 11 Jul '02

11 Jul '02

syslog-ng 1.4.11 on Redhat linux 7.2. And here is the syslog-ng globla option look like. (Sorry I can't post all the configuration because of obvious reasons :) ) But there is no options set for specific source, destionation or filter. options { use_dns (no); # Don't perform DNS lookups use_fqdn (no); # Don't use full hostname create_dirs (yes); # Create any necessary dirs for files use_time_recvd (yes); # Use our time, not the remote device time log_fifo_size(10000); # Queue 10000 msgs on a blocked dest sync(0); # Flush the queues as fast as possible # Tweak the sync parameter if the disks are # going wild and thrashing the machine chain_hostnames(on); # Chain hostname/IP information in log line }; source s_UDP { udp( ip(192.168.1.1) port(514) ); }; destination d_alert { pipe ("/usr/local/var/ALERT"); }; filter f_alert { match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ..."); }; log { source(s_UDP); filter(f_alert); destination(d_alert); }; Thanks, Andy -----Original Message----- From: Michael Earls [mailto:Michael.Earls@chmcc.org] Sent: Thursday, July 11, 2002 10:13 AM To: aning(a)jetnet.ca; syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Strang behaviour of syslog-ng (and my program) What ver of syslog-ng? and what distro are u running syslog-ng on? what does your config look like? michael >>> aning(a)jetnet.ca 07/11/02 09:49AM >>> Just add a little more info, if I send the first 10 messages a little bit slower, say delay 10 msec in between, then it doesn't happen. -----Original Message----- From: Antai Ning [mailto:aning@jetnet.ca] Sent: Wednesday, July 10, 2002 1:38 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Strang behaviour of syslog-ng (and my program) Hi Gurus, I got some strange phenomemon with syslog-ng. Here is what I'm doing. I configured syslog-ng to forward certain type of messages to a pipe. (say, ALERT). I wrote a program in perl to read from the pipe and print them out. The perl program first try to open the pipe and it'll block at the open function untill syslog-ng has some messages to write to the pipe. Then the perl program reads using IO::File can_read() function, with a 5 seconds timeout. So the function looks like this: $sel->can_read(5). Then I send 10 valid messages to syslog-ng from a remote machine by UDP. To my supprise, the perl program got only 2 of the 10! Then I send another 1 valid message to this syslog-ng after 5 minutes, and I got not only this message, but also the 8 I lost last time! This happens only for the first 10 messages (which includes the opening of the pipe). Everything is fine after the first round. It looks like it's related to the pipe opening and messages get queued somewhere until later messages trigger the queue to flush. So what's really happening inside? And is there a solution? Thanks, Andy

1 0

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Michael Earls 11 Jul '02

11 Jul '02

What ver of syslog-ng? and what distro are u running syslog-ng on? what does your config look like? michael >>> aning(a)jetnet.ca 07/11/02 09:49AM >>> Just add a little more info, if I send the first 10 messages a little bit slower, say delay 10 msec in between, then it doesn't happen. -----Original Message----- From: Antai Ning [mailto:aning@jetnet.ca] Sent: Wednesday, July 10, 2002 1:38 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Strang behaviour of syslog-ng (and my program) Hi Gurus, I got some strange phenomemon with syslog-ng. Here is what I'm doing. I configured syslog-ng to forward certain type of messages to a pipe. (say, ALERT). I wrote a program in perl to read from the pipe and print them out. The perl program first try to open the pipe and it'll block at the open function untill syslog-ng has some messages to write to the pipe. Then the perl program reads using IO::File can_read() function, with a 5 seconds timeout. So the function looks like this: $sel->can_read(5). Then I send 10 valid messages to syslog-ng from a remote machine by UDP. To my supprise, the perl program got only 2 of the 10! Then I send another 1 valid message to this syslog-ng after 5 minutes, and I got not only this message, but also the 8 I lost last time! This happens only for the first 10 messages (which includes the opening of the pipe). Everything is fine after the first round. It looks like it's related to the pipe opening and messages get queued somewhere until later messages trigger the queue to flush. So what's really happening inside? And is there a solution? Thanks, Andy

1 0