August 2002 - syslog-ng - lists.balabit.hu

Re: [syslog-ng]Message forwarding problem
by Dale Amon 09 Aug '02

09 Aug '02

Thanks much, options { keep_hostname(yes); }; on the master server sorted everything out.

1 0

Re: [syslog-ng][PATCH] please test: syslog-ng message mangling fix
by Ron Braley 08 Aug '02

08 Aug '02

No, I thought about the same things you did at first (configuration, etc.) but can't think of anything else. Going backwards to syslog isn't a good option, as we'd be very limited and all like logs would be dumped into the same file regardless of the originating server. Tell Baszi what you found (or didn't find) and see if he can duplicate and fix it (I wouldn't hold my breath, though). rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> caylan(a)cs.und.edu 08/08/02 12:31PM >>> Hello, I tried to apply the patch and got this: [root@smack src]# patch -p0 < patchto.bazsi patching file sources.c Hunk #1 FAILED at 80. Hunk #2 FAILED at 114. 2 out of 2 hunks FAILED -- saving rejects to file sources.c.rej [root@smack src]# patch -p1 < patchto.bazsi missing header for unified diff at line 8 of patch can't find file to patch at input line 8 Perhaps you used the wrong -p or --strip option? The text leading up to this was: -------------------------- |Index: sources.c |=================================================================== |RCS file: /var/cvs/syslog-ng/syslog-ng/src/sources.c,v |retrieving revision 1.34 |diff -u -r1.34 sources.c |--- sources.c 18 Jul 2002 13:18:02 -0000 1.34 |+++ sources.c 8 Aug 2002 10:01:18 -0000 -------------------------- File to patch: sources.c patching file sources.c Hunk #1 FAILED at 80. Hunk #2 FAILED at 114. 2 out of 2 hunks FAILED -- saving rejects to file sources.c.rej I know what was going on here so I just edited sources.c by hand. Unfortunately after a complete deletion of the src directory, unpacking, copied over sources.c, ./configure, touch src/sources.c.x, make, make install. I restarted syslog-ng had a look at /var/log/kern and these entries were still happening: Aug 8 12:29:23 smack IPTABLES UDP-IN:etOUT= MAC44:00:05:01:fb:e3:fc:08:00 SRC=6EN=141 TOS=0x00 PREC=0x00 UDP SP3014 LEN=121 Aug 8 12:29:28 smack IPTABLES UDP-INOUT= MAC=00:03:47:4e:3:05:01:fb::00 SRC=64.12.51.129 DST=134.129 LEN=141 TOSPROTO=UDP SPT=53 DPTIN: IN=eth1 OUT= MAC=00:03:47:4eRC=64.12.51.129 D0x00 PREC=0x00 L=45 ID=47526 PROTO=UDP SPT=53 D<6> IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:005:fbSR SP<6> IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3fc:08 SRC=1329.9DS89 <6> IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.217.172 DST=134.129.212.30 LEN=244 TOS=0x00 PREC=0x00 TTL=127 ID=60809 PROTO=UDP SPT=138 DPT=138 LEN=224 Aug 8 12:29:29 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.120 DST=134.129.212.30 LEN=78 TOS=0x00 PREC=0x00 TTL=2 I404LEN= Aug 8 12:29:29 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.120 DST=134.129.12.C=0x0TL=12ID6 PRO Aug 8 12:29:30 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.120 DST=134.129.212.30 LEN=78 TOS=0x00 PREC=0x00 TT=127 44047 PROTO=UDP SP37 DPT=137 LEN=58 Aug 8 12:29:33 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08: I have no clue :( Any ideas? Caylan Van Larson Unix Administrator - Systems Team Member University of North Dakota (Aerospace College) caylan(a)cs.und.edu 701-777-6151 (work) On Thu, 8 Aug 2002, Balazs Scheidler wrote: > On Thu, Aug 08, 2002 at 08:47:01AM -0500, Caylan Van Larson wrote: > > Mr. Scheidler, > > > > May I ask you the correct way to apply this patch. I have applied kernel > > patches before but I am not aware of this syntax (not that it is different > > I just am curious on your "Right Way"). I thought it would be best to ask > > you instead of trying it 10 different ways hoping it worked. > > unpack a vanilla 1.5.19 syslog-ng > cd syslog-ng-1.5.19 > patch -p1 <path to file> > touch src/sources.c.x > > (the last one is needed if you don't have scsh, to satisfy make > dependencies) > > rebuild. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Problem with syslogd and syslog-ng...
by BENGT OLSSON 08 Aug '02

08 Aug '02

Hello Can some one help me with this? I have syslog-ng running on the loggserver and syslogd on the clients and syslog-ng servern dosn't trig on all levels. ex. on the client(etc/syslog.conf) *.debug @loghost *.info @loghost #*.notice @loghost #*.warning @loghost #*.err @loghost #*.crit @loghost #*.alert @loghost #*.emerg @loghost gives 2 entries in the logfile #*.debug @loghost *.info @loghost #*.notice @loghost #*.warning @loghost #*.err @loghost #*.crit @loghost #*.alert @loghost #*.emerg @loghost gives zero entries in the logfile?? I want to log all levels from warning to emerg. *.warning @loghost in the syslog.conf file would be enough or is in't? And this should gives one entrie in the logfile? the syslog-ng.conf looks like this: options { use_fqdn(yes); keep_hostname(yes); use_dns(yes); long_hostnames(off); sync(3); log_fifo_size(1000); }; source all { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; # automatic host sorting # set it up destination hosts { file("/var/syslog/hosts/$HOST/$FACILITY_$YEAR-$MONTH-$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; # log by host log { source(all); destination(hosts); }; /Benke -- Bengt Olsson Blekinge Tekniska Högskola Datorenheten Campus Gräsvik Vallhallavägen 1 371 79 Karlskrona Mail: bol(a)bth.se Tel: 0455-385152 Mobil: 0708-787 780

2 1

[PATCH] please test: syslog-ng message mangling fix
by Balazs Scheidler 08 Aug '02

08 Aug '02

Hi, This patch should fix the message mangling problems you might have encountered. As the log parsing routines are quite critical I don't want to release this patch without testing on most platforms. It seems to work on Linux for me, but tests from more exotic platforms are welcome. (the problem this patch fixes occurs only if you have messages longer than the default limit. the limit can be changed by log_msg_size) to test: apply the patch, and touch sources.c.x, and recompile Index: sources.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/sources.c,v retrieving revision 1.34 diff -u -r1.34 sources.c --- sources.c 18 Jul 2002 13:18:02 -0000 1.34 +++ sources.c 8 Aug 2002 09:21:34 -0000 @@ -112,8 +113,8 @@ closure->pos = 0; return ST_OK | ST_GOON; } - if (!eol && closure->pos) { - /* we don't have a terminating nl nor \0 */ + if (!eol && closure->pos == closure->max_log_line) { + /* we don't have a terminating nl nor \0, and our buffer is full */ do_handle_line(closure, closure->pos, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 1

kern (iptable) logs cut off
by Caylan Van Larson 08 Aug '02

08 Aug '02

Greetings, This is on a RedHat 7.3 Box. We were using the latest syslog-ng rpm from redhat and we noticed that upon migration from syslogd to syslog-ng our iptable logs were getting mangled. Here is an exert from syslogd logging of iptables (/var/log/messages): Aug 7 23:41:47 smack kernel: IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.217.37 DST=134.129.212.30 LEN=240 TOS=0x00 PREC=0x00 TTL=127 ID=13570 PROTO=UDP SPT=138 DPT=138 LEN=220 Aug 7 23:41:48 smack kernel: IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.201.29 DST=134.129.212.30 LEN=60 TOS=0x00 PREC=0x00 TTL=61 ID=10095 DF PROTO=TCP SPT=4997 DPT=53 WINDOW=32120 RES=0x00 SYN URGP=0 Aug 7 23:41:48 smack kernel: IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.220.175 DST=134.129.212.30 LEN=78 TOS=0x00 PREC=0x00 TTL=127 ID=12752 PROTO=UDP SPT=137 DPT=137 LEN=58 Aug 7 23:41:49 smack kernel: IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.220.175 DST=134.129.212.30 LEN=78 TOS=0x00 PREC=0x00 TTL=127 ID=13008 PROTO=UDP SPT=137 DPT=137 LEN=58 Aug 7 23:41:49 smack kernel: IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.220.175 DST=134.129.212.30 LEN=78 TOS=0x00 PREC=0x00 TTL=127 ID=13264 PROTO=UDP SPT=137 DPT=137 LEN=58 Very nice as you can see. Now, we would love to use syslog-ng but this is from syslog-ng (/var/log/kern): Aug 7 23:38:17 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00: Aug 7 23:38:17 smack IPTABLES ICMP-IN: IN=eth1 OUT= MAC=00:03: Aug 7 23:38:19 smack IPTABLES ICMP-IN: IN=eth1 OUT= MAC=00:03: Aug 7 23:38:20 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=24.220.215.146 DST=134.129.212.30 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=20216 DF PROTO=TCP SPT=2406 DPT=53 WINDOW=2144 RES=0x00 SYN URGP=0 Aug 7 23:38:20 smack IPTABLES ICMP-IN: IN=eth1 OUT= MAC= Aug 7 23:38:23 smack IPTABLES ICMP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=192.36.148.20 DST=134.129.212.30 LEN=52 TOS=0x00 PREC=0x00 TTL=5 ID=6179 PROTO=ICMP TYPE=8 CODE=0 ID=22608 SEQ=17 Aug 7 23:38:23 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC= Aug 7 23:38:24 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03: Aug 7 23:38:25 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.201.29 DST=134.129.212.30 LEN=60 TOS=0x00 PREC=0x00 TTL=61 ID=6213 DF PROTO=TCP SPT=1030 DPT=53 WINDOW=32120 RES=0x00 SYN URGP=0 Aug 7 23:38:25 smack IPTABLES ICMP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=192.36.148.20 DST=134.129.212.30 LEN=52 TOS=0x00 PREC=0x00 TTL=243 ID=6479 PROTO=ICMP TYPE=8 CODE=0 ID=22608 SEQ=255 At the same time I find this!!! Could this be the other part of whats missing above? [root@smack log]# tail -f user Aug 7 23:42:26 smack TO=0x00 PREC=0x00 TTL=127 ID=14587 PROTO=UDP SPT=137 DPT=137 LEN=58 Aug 7 23:42:37 smack C=UDPT=1 Aug 7 23:42:39 smack 0TL=127 I5998 PROTO=UDP SPT=137 DPT=137 L8 Aug 7 23:42:43 smack 0 PREC=0 TTL=127 ID=18027 PROTO=UDP SPT=17 D37 N= Aug 7 23:42:57 smack =x00L=127D=1826 PROTO=UDP SPT=137 DPT=137N= Aug 7 23:43:05 smack =0x00 TTL7 I14 DF Aug 7 23:43:22 smack O=TCP SPT=4481 DPT=53 WINDOW=16384 RES=0x00 SYN U Aug 7 23:43:24 smack LEN=78 =0x00 PREC=0x00 TTL=127 ID=21968 PROTDP SPT=137 DPT=137 LEN=58 Aug 7 23:43:28 smack T=138 DPT Aug 7 23:43:31 smack T53 W Not to mention some other output going to /var/log/bootup. This output consists of iptable startup information... I have tried every combo of syslog-ng klogd imaginable. I have tried to tinker with the global src using pipes and files for the kernel logging but that got nowhere... Same results. This is experienced using: libol-0.3.3 syslog-ng-1.5.19 syslog-ng-1.5.17-1.i386.rpm The command dmesg gives nice iptables output. So I know it is not iptablse fault. Iptables is configured to log at level 5 for normal dropped packets and log level 5 for other more serious packets. Below is my syslog-ng.conf file. Thank you for any help!!! I need to work on the firewall and it is hard with no logs.. :( Thanks again, Caylan Van Larson --SNIP Here is my syslog-ng.conf: # This file should be compatible with the out-of-the-box # /etc/syslog.conf on Red Hat Linux # global options # options { use_dns(yes); use_fqdn(no); use_time_recvd(no); chain_hostnames(no); mark(0); sync(0); }; # sources # source s_all { internal(); unix-stream("/dev/log"); file("/proc/kmsg"); }; # facility filters # filter f_authpriv { facility(authpriv); }; filter f_auth { facility(auth); }; filter f_boot { facility(local7); }; filter f_2511 { facility(local5); }; filter f_6509-1-log { facility(local4); }; filter f_6509-2-log { facility(local3); }; filter f_cron { facility(cron); }; filter f_kern { facility(kern); }; filter f_user { facility(user); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon); }; filter f_messages { priority(info..emerg) and not facility(mail, news, authpriv, cron, local1, local2, local3, local4, local5, local6); }; filter f_news { facility(news); }; # priority filters # filter f_emerg { priority(emerg); }; filter f_crit { priority(crit..emerg); }; filter f_crit_only { priority(crit); }; filter f_err { priority(err..emerg); }; filter f_err_only { priority(err); }; filter f_warn { priority(warning..emerg); }; filter f_notice { priority(notice..emerg); }; filter f_info { priority(info..emerg); }; filter f_debug { priority(debug..emerg); }; # host filters # filter f_smack { host(smack); }; #destination filters # # *network* destination d_tcp { tcp("134.129.212.33"); }; destination d_udp { udp("134.129.212.33"); }; # *everyone* destination d_all { usertty("*"); }; # *console* destination d_console { file("/dev/console"); }; # *boot* destination d_smacboot { file("/var/log/bootlog"); }; # *cron* destination d_smaccron { file("/var/log/cron"); }; # *mail* destination d_smacmail { file("/var/log/maillog"); }; # *messages* destination d_smacmsg { file("/var/log/messages"); }; # *secure (auth & authpriv)* destination d_smacsec { file("/var/log/secure"); }; # *user* destination d_smacuser { file("/var/log/user"); }; # *kern* destination d_smackern { file("/var/log/kern"); }; # *daemon* destination d_smacdaemon { file("/var/log/daemon"); }; # *spool (lpr)* destination d_smacspool { file("/var/log/spooler"); }; #Everyone gets emergency messages log { source(s_all); filter(f_emerg); destination(d_all); }; #Log messages from Smack log { source(s_all); filter(f_cron); filter(f_debug); filter(f_smack); destination(d_smaccron); destination(d_tcp); }; log { source(s_all); filter(f_authpriv); filter(f_debug); filter(f_smack); destination(d_smacsec); destination(d_tcp); }; log { source(s_all); filter(f_mail); filter(f_warn); filter(f_smack); destination(d_smacmail); destination(d_tcp); }; log { source(s_all); filter(f_boot); filter(f_debug); filter(f_smack);destination(d_smacboot); destination(d_tcp); }; # fw-iptables logs at NOTICE <5> (fragments/unknown protocols) and INFO <6> (known udp/tcp/icmp) # This line will log ALL of kern locally log { source(s_all); filter(f_kern); filter(f_messages); filter(f_debug); filter(f_smack); destination(d_smackern); }; # This line will only remotely log NOTICE <5> and above (5,4,3,2,1,0) log { source(s_all); filter(f_kern); filter(f_messages); filter(f_notice); filter(f_smack); destination(d_tcp); }; log { source(s_all); filter(f_user); filter(f_debug); filter(f_smack); destination(d_smacuser); destination(d_tcp); }; log { source(s_all); filter(f_lpr); filter(f_debug); filter(f_smack); destination(d_smacspool); destination(d_tcp); }; log { source(s_all); filter(f_daemon); filter(f_notice); filter(f_smack); destination(d_smacdaemon); destination(d_tcp); }; --SNAP Whew Thanks, Caylan Van Larson Unix Administrator - Systems Team Member University of North Dakota (Aerospace College) caylan(a)cs.und.edu 701-777-6151 (work)

3 2

Re: [syslog-ng]1.5.19 and tcp
by CHENNES＠Nationwide.com 08 Aug '02

08 Aug '02

Here's the gdb backtrace: gdb syslog-ng -c core GNU gdb 4.18 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "sparc-sun-solaris2.8"... Core was generated by `/test/syslog/bin/syslog-ng -f /etc/syslog-ng.conf -p /etc/s'. Program terminated with signal 9, Killed. Reading symbols from /usr/lib/libpthread.so.1...done. Reading symbols from /usr/lib/libdoor.so.1...done. Reading symbols from /usr/lib/libl.so.1...done. Reading symbols from /usr/lib/libsocket.so.1...done. Reading symbols from /usr/lib/libnsl.so.1...done. Reading symbols from /usr/lib/libxnet.so.1...done. Reading symbols from /usr/lib/libc.so.1...done. Reading symbols from /usr/lib/libdl.so.1...done. Reading symbols from /usr/lib/libmp.so.2...done. Reading symbols from /usr/platform/SUNW,Sun-Fire-880/lib/libc_psr.so.1...done. Reading symbols from /usr/lib/libthread.so.1...done. #0 0xff141d00 in _malloc_unlocked () from /usr/lib/libc.so.1 (gdb) bt #0 0xff141d00 in _malloc_unlocked () from /usr/lib/libc.so.1 #1 0xff141ad0 in malloc () from /usr/lib/libc.so.1 #2 0x2219c in xalloc () #3 0x17978 in make_log_info (length=0, msg=0x3d8d8 "<13>Aug 7 13:59:21 test/test user: [ID 702911 user.notice] test message number 3\n<13>Aug 7 13:59:21 test/ test user: [ID 702911 user.notice] test message number 4\n<13>Aug 7 13:59:21 "..., prefix=0x0) at log.c:263 #4 0x15be8 in do_handle_line (self=0xffbefa90, length=89, data=0x3d8d8 "<13>Aug 7 13:59:21 test/test user: [ID 702911 user.notice] test message number 3\n<13>Aug 7 13:59:21 test /test user: [ID 702911 user.notice] test message number 4\n<13>Aug 7 13:59:21 "..., addr=0x3d8d8, addrlen=0) at sources.c:67 #5 0x15de0 in do_read_line (h=0x3d8a0, read=0xffbefa90) at sources.c:134 #6 0x202f4 in read_callback () #7 0x1fed4 in io_iter () #8 0x152dc in main_loop (backend=0x395d8) at main.c:191 #9 0x159ec in main (argc=6, argv=0xffbefd54) at main.c:513 (gdb) Balazs Scheidler <bazsi(a)balabit.hu> T To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin(a)lists.b alabit.hu bcc: Subject: Re: [syslog-ng]1.5.19 and tcp 08/07/02 11:24 AM Please respond to syslog-ng On Wed, Aug 07, 2002 at 09:31:50AM -0400, CHENNES(a)Nationwide.com wrote: > I am having difficulty keeping 1.5.19 running when receiving syslog > messages via tcp. I have a central logging host that receives messages via > tcp from collection hosts. The collection hosts are receiving messages > from various hosts via udp and tcp. Essentially, the ng process > immediately dies on the central logging host as soon as I start it. > However, if I alter the configurations to use only udp, I have no problems. > The central logging host and the collection hosts are all running Solaris 8 > with 1.5.19. I have tested the same exact scenario using a previous > version of ng (1.4.14) on the central logging host and it works just fine. > I have included some configuration information below. can you provide a gdb backtrace based on the core file? gdb syslog-ng -c core gdb> bt and the results. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng]new... simple examples?
by Michael Earls 07 Aug '02

07 Aug '02

look at the FAQ page Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >>> dbarber(a)tdschas.com 08/07/02 02:12PM >>> Hi, Does anyone have a simple example for a config file which will log all logs to a remote host via tcp? or a site that has some examples? thanks, Dan _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

Re: [syslog-ng]new... simple examples?
by Michael Earls 07 Aug '02

07 Aug '02

not sure if it has a config file for logging syslog via tcp, but there are some examples of logging via udp, here is an example to log udp and filter based on ip address, # Tucson # destination 12.9.1.226 { file("/var/syslog/Arizona/Tucson/JC-Tucson/redback/JC-Tucson.log"); }; filter f_12.9.1.226 { host(12.9.1.226); }; log { source(net); filter(f_12.9.1.226); destination(12.9.1.226); }; destination 12.126.138.90 { file("/var/syslog/Arizona/Tucson/JC-Tucson/router/JC-Tucson.log"); }; filter f_12.126.138.90 { host(12.126.138.90); }; log { source(net); filter(f_12.126.138.90); destination(12.126.138.90); }; Nate — do we have an example of syslog-ng config file for logging via tcp? >>> dbarber(a)tdschas.com 08/07/02 02:47PM >>> I must be missing something... Michael, can you point out in the FAQ where it has a link to or specific examples of a config log which uses tcp to log remotely? thanks, Dan On Wed, 2002-08-07 at 14:22, Michael Earls wrote: > look at the FAQ page > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > >>> dbarber(a)tdschas.com 08/07/02 02:12PM >>> > Hi, > > Does anyone have a simple example for a config file which will log all > logs to a remote host via tcp? > > or a site that has some examples? > > thanks, > > Dan > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

new... simple examples?
by Dan Barber 07 Aug '02

07 Aug '02

Hi, Does anyone have a simple example for a config file which will log all logs to a remote host via tcp? or a site that has some examples? thanks, Dan

1 0

Message forwarding problem
by Dale Amon 07 Aug '02

07 Aug '02

I've got the following situation: Host A can talk to Host B Host B can talk to Host C Host A can NOT talk to Host C directly Host C is the master logger So I'm trying to set up Host B to act as a forwarder. This "mostly" works: HOST A: destination mylogger { tcp(<HOST B> port(1999) localport(999)); }; filter all { level(info..err); }; log { source(src); filter(all); destination(console_all); destination(mylogger); }; HOST B: source s_tcp { tcp(localip(<HOST B>) port(1999) max-connections(50)); }; destination mylogger { tcp(<HOST C> port(1999) localport(999)); }; filter all { level(info..err); }; log { source(s_tcp); source(src); filter(all); destination(console_all); destination(mylogger); }; HOST C source s_tcp { tcp(localip(<HOST C>) port(1999) max-connections(50)); }; destination logtest { file("/var/log/logtest.log" owner("root") group("adm") perm(0640)); }; filter drop1 { not match ( " session opened|closed for user root|mail") and not match ("STATS: dropped 0"); }; log { source(s_tcp); source(src); filter(drop1); destination(logtest); }; The problem is, HOST B rewrites the message source to itself, so all messages from HOST A arriving at HOST C appear to have "occurred" on HOST B. Is there a way to do real forwarding rather than hacking it as I did above?

3 2