January 2003 - syslog-ng - lists.balabit.hu

syslog-ng misinterpreting messages from Enterasys Routers.
by Ted_Rule＠flextech.co.uk 30 Jul '03

30 Jul '03

Having finally bitten the bullet and installed syslog-ng ( libol-0.3.6 / syslog-ng-1.5.24 ), I've only come across one problem... syslog messages from our Enterasys Routers are being corrupted. All Unix and Cisco messages appear Ok. As an example, these raw packets from an SSR and a Cisco: tcpdump -s 512 -x -e -l -n udp and port 514 and host fttv-gps-core-ssrA | tcpdumpascii.pl tcpdump: listening on eth0 10:29:54.111864 0:e0:63:93:25:bf 0:50:8b:f3:93:46 ip 100: 192.168.32.11.4739 > 172.17.12.6.syslog: udp 58 4500 0056 73a2 0000 3f11 6f2a c0a8 200b E..Vs...?.o*.. . ac11 0c06 1283 0202 0042 b5ba 3c31 3838 .........B..<188 3e4a 616e 2032 3320 3130 3a32 393a 3533 >Jan 23 10:29:53 2025 434f 4e53 2d57 2d42 4144 5041 5353 %CONS-W-BADPASS 5744 2c20 696e 636f 7272 6563 7420 7061 WD, incorrect pa 7373 776f 7264 ssword 1 packets received by filter 0 packets dropped by kernel tcpdump -s 512 -x -e -l -n udp and port 514 and host gps-enterprise-cisco-e0 | tcpdumpascii.pl tcpdump: listening on eth0 10:30:44.037939 0:10:7b:80:f:fb 0:50:8b:f3:93:46 ip 138: 172.17.8.76.8800 > 172.17.12.6.syslog: udp 96 4500 007c 29b5 0000 ff11 2547 ac11 084c E..|).....%G...L ac11 0c06 2260 0202 0068 187a 3c31 3839 ...."`...h.z<189 3e31 3036 3737 3a20 4a61 6e20 3233 2031 >10677: Jan 23 1 303a 3330 3a34 3320 474d 543a 2025 5359 0:30:43 GMT: %SY 532d 352d 434f 4e46 4947 5f49 3a20 436f S-5-CONFIG_I: Co 6e66 6967 7572 6564 2066 726f 6d20 636f nfigured from co 6e73 6f6c 6520 6279 2076 7479 3020 2831 nsole by vty0 (1 3732 2e31 372e 3132 2e37 3229 72.17.12.72) Result in this in the log: Jan 23 10:29:53 %CONS-W-BADPASSWD, incorrect password Jan 23 10:30:44 gps-enterprise-cisco-e0 10677: Jan 23 10:30:43 GMT: %SYS-5-CONFIG_I: Configured from console by vty0 (172.17.12.72) It looks as if syslog-ng is assuming %CONS-W-BADPASSWD is a hostname....and the Cisco message picks up a hostname via DNS, which is NOT included in the packet. I note the version 1.5.25 has a bad_hostname() option. Is it possible that this may be used to alleviate this issue, or is some other workround needed? I'm guessing "keep_hostname(no)" might fix it, but would that potentially lead to other problems? Is there a summary of the algorithm which syslog-ng uses to determine whether the message contains a hostname? Current Options settings laid out below. ............... # Global Options Settings options { chain_hostnames(no); keep_hostname (yes); use_dns (yes); use_fqdn (no); long_hostnames (off); dns_cache(yes); dns_cache_size(100); dns_cache_expire(600); dns_cache_expire_failed(120); create_dirs (no); dir_owner(root); dir_group(root); dir_perm(0755); owner(root); group(root); perm(0600); stats(120); sync(10); time_reopen (10); time_reap(20); use_time_recvd(no); log_fifo_size (1000); log_msg_size (1024); gc_idle_threshold(100); ### default 100 gc_busy_threshold(3000); ### default 3000 }; ............... Thanks, Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

3 2

Urgent: Mangled messages in pipe() destinations in version 1.5.19
by Andreas Schulze 20 Mar '03

20 Mar '03

Hello Balazs, in version 1.5.19 (and in other versions between >1.5.7 and <=1.5.19, too) we observing obscure message mangling in pipe() destinations. Imagine the config below and the scenario: syslog-ng --write(2)--> pipe() --read(2)--> application All four log paths below, writes lines to the pipe '/tmp/pipe'. With 1.5.7 we read from the pipe exactly that, what syslog-ng (using the config below) writes to it. But with all newer versions (espec. 1.5.19) we read (with the same config): message_1 message_2 messagmessage_4 !!! ... message_n if we try to let syslog-ng write: message_1 message_2 message_3 message_4 ... message_n (The numbers and terms are only examples, because of the different sources and high message load.) Seems, that write(2) to fifo skips some message ends now. (espec. the terminating newline) > # example config: > # > source sys { sun-streams ("/dev/log" door("/var/run/syslog_door")); }; > source net { udp (ip(w.x.y.z) port(n)); }; > destination d_cisco { pipe("/tmp/pipe" template("@cisco: | $MSG\n")); }; > destination d_icmp { pipe("/tmp/pipe" template("@icmpd: | $MSG\n")); }; > log { source(net); filter(fa); destination(da); destination(d_cisco); }; > log { source(net); filter(fb); destination(db); destination(d_cisco); }; > log { source(sys); filter(f1); destination(d1); destination(d_icmp); }; > log { source(sys); filter(f2); destination(d2); destination(d_icmp); }; We are running a config similar to this above, with 1.5.7 since a lot of months very successfully in production ennvironment with very high message load. Since 1.5.1? the message mangling occurs. But now, some of your newer features becomes mission critical for us. Have you any idea, what happens? Versions <= 1.5.7 works well. Thanks a lot. -- Best regards --Andreas Schulze [phone: +49.5246.80.1275, fax: +49.5246.80.2275] | I believe, it was Dennis Ritchie who said something like: | "C is rarely the best language for a given task, | but it's often the second-best". | The implication being that: "[...]" | | sh# cat>$$.c<<EOT | main(l,a,n,d)char**a;{for(d=atoi(a[1])/10*80-atoi(a[2])/5-596;n="@NK\ | ACLCCGZAAQBEAADAFaISADJABBA^SNLGAQABDAXIMBAACTBATAHDBANZcEMMCCCCAAhE\ | IJFAEAAABAfHJETBdFLDAANEfDNBPHdBcBBBEA_AL H E L L O, W O R L D! " | [l++-3];)for(;n-->64;)putchar(!d+++33^l&1);} | EOT | gcc -o$$ $$.c;clear;./$$ 52 8;rm -f $$*

6 19

performance test questions
by Roberto Nibali 10 Mar '03

10 Mar '03

Hi, I'm conducting syslog-ng performance tests. I've deployed a central loghost environment and three clients trying to send messages which should end up on the central loghost with as few losses as possible. The whole thing is currently done over UDP and the clients have either syslogd or syslog-ng as daemons. If I deploy syslog-ng as a client to send messages from /dev/log via UDP to the central loghost I experience a rather high message loss starting on a threshold of about 1000 messages sent in the least amount of time possible. If I do the same thing with syslogd the threshold is up to 35000 from the same machine. That means I can send 35000 messages to /dev/log as fast as possible and they still get reliably transferred to the central loghost and written to disk there. A little stunned over this strange occurrance I've started to narrow the problem down and I ended up with following question: Why does syslog-ng not send a UDP packet per message sent via syslog() and an ending '\n'? And is there a mean to configure this odd behaviour? To illustrate what I mean I provide you with two sample dumps from a tcpdump session where I sent 3 messages. The first one is the tcpdump snipped of syslogd processing the messages and the second one is the result when syslog-ng processes the logs: 16:01:09.210645 x.y.z.6.514 > x.y.z.117.514: udp 71 0x0000 4500 0063 ca2c 0000 4011 87aa ac1b e806 E..c.,..@....... 0x0010 ac1b e875 0202 0202 004f 3a51 3c31 313e ...u.....O:Q<11> 0x0020 6c6f 6774 6573 7420 3a20 5b31 5d20 4920 logtest.:.[1].I. 0x0030 6c69 6b65 2074 6f20 6c6f 6720 6661 7374 like.to.log.fast 0x0040 2062 7574 206d 6f73 7420 696d 706f 7274 .but.most.import 0x0050 616e 746c 7920 6163 6375 7261 7465 2121 antly.accurate!! 0x0060 2120 0a !.. 16:01:09.210820 x.y.z6.514 > x.y.z.117.514: udp 71 0x0000 4500 0063 ca2d 0000 4011 87a9 ac1b e806 E..c.-..@....... 0x0010 ac1b e875 0202 0202 004f 3a50 3c31 313e ...u.....O:P<11> 0x0020 6c6f 6774 6573 7420 3a20 5b32 5d20 4920 logtest.:.[2].I. 0x0030 6c69 6b65 2074 6f20 6c6f 6720 6661 7374 like.to.log.fast 0x0040 2062 7574 206d 6f73 7420 696d 706f 7274 .but.most.import 0x0050 616e 746c 7920 6163 6375 7261 7465 2121 antly.accurate!! 0x0060 2120 0a !.. 16:01:09.211064 x.y.z.6.514 > x.y.z.117.514: udp 71 0x0000 4500 0063 ca2e 0000 4011 87a8 ac1b e806 E..c....@....... 0x0010 ac1b e875 0202 0202 004f 3a4f 3c31 313e ...u.....O:O<11> 0x0020 6c6f 6774 6573 7420 3a20 5b33 5d20 4920 logtest.:.[3].I. 0x0030 6c69 6b65 2074 6f20 6c6f 6720 6661 7374 like.to.log.fast 0x0040 2062 7574 206d 6f73 7420 696d 706f 7274 .but.most.import 0x0050 616e 746c 7920 6163 6375 7261 7465 2121 antly.accurate!! 0x0060 2120 0a !.. ------ 16:01:53.458412 x.y.z.6.1031 > x.y.z.117.514: udp 306 0x0000 4500 014e ca6c 0000 4011 867f ac1b e806 E..N.l..@....... 0x0010 ac1b e875 0407 0202 013a b8e8 3c31 313e ...u.....:..<11> 0x0020 4a61 6e20 3330 2031 373a 3137 3a31 3920 Jan.30.17:17:19. 0x0030 735f 696e 7440 6d69 6c6b 2d6e 6574 5f6f s_int@milk-net_o 0x0040 7665 7266 6c6f 7720 3a20 5b31 5d20 4920 verflow.:.[1].I. 0x0050 6c69 6b65 2074 6f20 6c6f 6720 6661 7374 like.to.log.fast 0x0060 2062 7574 206d 6f73 7420 696d 706f 7274 .but.most.import 0x0070 616e 746c 7920 6163 6375 7261 7465 2121 antly.accurate!! 0x0080 210a 3c31 313e 4a61 6e20 3330 2031 373a !.<11>Jan.30.17: 0x0090 3137 3a31 3920 735f 696e 7440 6d69 6c6b 17:19.s_int@milk 0x00a0 2d6e 6574 5f6f 7665 7266 6c6f 7720 3a20 -net_overflow.:. 0x00b0 5b32 5d20 4920 6c69 6b65 2074 6f20 6c6f [2].I.like.to.lo 0x00c0 6720 6661 7374 2062 7574 206d 6f73 7420 g.fast.but.most. 0x00d0 696d 706f 7274 616e 746c 7920 6163 6375 importantly.accu 0x00e0 7261 7465 2121 210a 3c31 313e 4a61 6e20 rate!!!.<11>Jan. 0x00f0 3330 2031 373a 3137 3a31 3920 735f 696e 30.17:17:19.s_in 0x0100 7440 6d69 6c6b 2d6e 6574 5f6f 7665 7266 t@milk-net_overf 0x0110 6c6f 7720 3a20 5b33 5d20 4920 6c69 6b65 low.:.[3].I.like 0x0120 2074 6f20 6c6f 6720 6661 7374 2062 7574 .to.log.fast.but 0x0130 206d 6f73 7420 696d 706f 7274 616e 746c .most.importantl 0x0140 7920 6163 6375 7261 7465 2121 210a y.accurate!!!. ------ The configuration file for syslogd is: --------------------------------------------------------- user.err @x.y.z.117 --------------------------------------------------------- The configuration file for syslog-ng is: --------------------------------------------------------- options { sync (0); time_reopen (10); log_fifo_size (1024); long_hostnames (on); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_int { internal(); unix-stream("/dev/log" max-connections(256)); }; filter f_test { facility(user) and level(err); }; destination d_test { udp("x.y.z.117" port(514)); }; log { source(s_int); filter(f_test); destination(d_test); flags(final); }; --------------------------------------------------------- Please enlighten me with an explanation to this problem. As an example take following verified numbers for a syslog() storm of 50000 messages where I do a 50ms sleep every 250 messages sent. All in all this results in a 14332ms log burst (usleep() syscall overhead). Message lines lost with syslog-ng (average): ~6300 Message lines lost with syslogd (average): 0 !!!! I've also attached the test tool which I use to conduct my tests. It's extremely simple so I don't expect any problems with this. It has sequence numbers so one is able to track down the losses (something which should be in syslog-ng too IMHO). I currently have no explanation for this observation because I haven't read the whole source code yet. I suspect you have a read buffer on sources (/dev/log in this example) which overrides the '\n' -> fflush() semantics to be able to send less UDP packets with more content per packet. So I hope this is tunable somewhere or one can even disable it to mimic the old syslogd behavior. Another question: Why is there no message sent when a buffer reaches its maximum size? This would help debugging and tuning a lot IMHO. Sorry if this has been discussed before. Best regards, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc #include <stdio.h> #include <stdlib.h> #include <syslog.h> #include <unistd.h> #include <sys/time.h> /* logtest.c: RTSL! Copyright 2003, Roberto Nibali, terreActive AG Published under the GPLv2 license. */ #define DEF_STRING "I like to log fast but most importantly accurate!!!" #define DEF_IDENT "logtest " #define DEF_FACILITY LOG_KERN #define DEF_PRIO LOG_ERR #define DEF_NUM 10 #define DEF_INT -1 #define DEF_MOD 1 void flood_log(const char *message, unsigned int num, unsigned int seq, long int interval, unsigned int mod) { int i; for (i=1; i<=num; i++, seq++) { syslog(DEF_PRIO, "[%d] %s\n", seq, message); if (interval != DEF_INT && ((seq % mod) == 0)) { usleep(interval*1000); } } } int main(int argc, char *argv[]) { unsigned int seq = 1; unsigned int num = DEF_NUM; long int interval= DEF_INT; unsigned int mod = DEF_MOD; struct timeval start; struct timeval end; unsigned long diff; if (argc < 2) { printf("\n"); printf("Usage: %s [<num>][<int>{ms}][<mod>]\n\n", argv[0]); printf("<num>: Amount of log messages\n"); printf("<int>: Sleep time in miliseconds\n"); printf("<mod>: Every <mod> do sleep for <int> miliseconds\n\n"); printf("Example: %s 1000 700 250\n", argv[0]); printf("--------\n"); printf("This will send 1000 messages and do a 0.7s delay "); printf("for every 250 messages sent.\n"); printf("It should approximately take 2.8sec plus syscall "); printf("overhead which depends on the\n"); printf("CPU, thus it effectively takes roughly 3s.\n"); printf("\n"); exit(1); } else if (argc == 2) { num=atoi(argv[1]); } else if (argc == 3) { num=atoi(argv[1]); interval=strtoul(argv[2], NULL, 10); } else if (argc == 4) { num=atoi(argv[1]); interval=strtoul(argv[2], NULL, 10); mod=atoi(argv[3]); } printf("Estimated time: %ld msecs\n",num*(interval==-1?1:interval)/mod); openlog(DEF_IDENT, 0, DEF_FACILITY); gettimeofday(&start, NULL); flood_log(DEF_STRING, num, seq, interval, mod); gettimeofday(&end, NULL); closelog(); diff = (end.tv_sec - start.tv_sec) * 1000000 + (end.tv_usec - start.tv_usec); printf("Message string: %s\n", DEF_STRING); printf("Sent messages : %d\n", num); printf("Elapsed time : %ld msecs\n", diff/1000); printf("Bytes written : %d Bytes\n", num*sizeof(DEF_STRING)); printf("Interval : %ld msecs\n", interval == -1 ? 0 : interval); printf("Modulus : %d\n", mod); return(0); }

6 26

about syslog
by Moktar KONE 10 Mar '03

10 Mar '03

hi , I have three machines A B and C which run syslog (not syslog-ng) and they send now their logs toward a remote host S. How is it possible with syslogd (running over S) to manage differents logs from A, B and C according to the log source (i.e create a file for log coming from A , an other file for log coming from B and an other file for C). the machine S, which receive logs is running syslogd , how can it manage the logs coming from the others machines according to their source. If syslog is not able to manage this , can syslog-ng do it?how? thanks

2 1

where docs on *REMOTE* logging using ssh??
by seberino＠spawar.navy.mil 05 Feb '03

05 Feb '03

Where can I find docs on setting up secure (SSH) remote syslog-ng logging? Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2363 49590 Lassing Road, Room A339 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-7940 Fax: (619) 553-1269 Email: seberino(a)spawar.navy.mil _______________________________________

3 6

Filtering Large Syslog Messages
by Brian E. Seppanen 03 Feb '03

03 Feb '03

Hi Folks: I have snmptrapd running so that any trap that it receives should be logged to local1. I have a filter taking anything received via local1 to a specific file filter snmptrap {facility(local1);}; destination snmptraps { file("/var/log/snmptraps";}; Unfortunately a number of traps are getting cut off at a specific point, and the remainder of the trap ends up in syslog and not in the proper destination. I'm running syslog-ng 1.4.17, libol 0.2.24, redhat linux 7.2 Jan 29 12:34:43 hostname ts.cerent454Mib.cerent454Objects.cerent454AlarmGroup.cerent454AlarmTable.cer ent454AlarmEntry.cerent454AlarmSlotNumber.1.normalCondition = 0, enterprises.cerent.cerentProducts.c erent454Mib.cerent454Objects.cerent454AlarmGroup.cerent454AlarmTable.cerent454AlarmEntry.cerent454Al armPortNumber.1.normalCondition = 0, enterprises.cerent.cerentProducts.cerent454Mib.cerent454Objects .cerent454AlarmGroup.cerent454AlarmTable.cerent454AlarmEntry.cerent454AlarmLineNumber.1.normalCondit ion = 0 Here's the beginning of the trap that found its way to the proper file Jan 29 12:34:43 hostname snmptrapd[11851]: 192.168.0.1 [192.168.0.1]: Trap system.sysUpTime.0 = Timeticks: (2968512686) 343 days, 13:52:06.86, .iso.org.dod.internet.snmpV2.snmpModules.snmpMIB.snmpMIBObjects.snmpTrap.snmpTrapOID.0 = OID: enterprises.cerent.cerentProducts.cerent454Mib.cerent454Events.cerent454V2Events.normalCondition, enterprises.cerent.cerentProducts.cerent454Mib.cerentCommonObjects.cerentCommonObjectsGroup.cerentNodeTime.0 = 20030129123442D, enterprises.cerent.cerentProducts.cerent454Mib.cerent454Objects.cerent454AlarmGroup.cerent454AlarmTable.cerent454AlarmEntry.cerent454AlarmState.1.normalCondition = administrative(20), enterprises.cerent.cerentProducts.cerent454Mib.cerent454Objects.cerent454AlarmGroup.cerent454AlarmTable.cerent454AlarmEntry.cerent454AlarmObjectType.1.normalCondition = ne(10), enterprises.cerent.cerentProducts.cerent454Mib.cerent454Objects.cerent454AlarmGroup.cerent454AlarmTable.cerent454AlarmEntry.cerent454AlarmObjectIndex.1.normalCondition = 0, enterprises.cerent.cerentProduc All of the message would be coming in via local1 so it's not that a pattern match is failing.. Any ideas? Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

4 3

Re: [syslog-ng]logs getting stomped on
by Brian Landers 02 Feb '03

02 Feb '03

Sorry to keep harping on this guys, but this is a ^%$#@ mystery! Once again, my mail log restarted at around 10:30pm tonight. Lest you think I'm just whining and not making an effort to solve this one, here's what I've come up with: 1) I've checked all of my crontabs and at jobs, and there's nothing that runs around that time. 2) Went through all the long-running processes. Nothing that would interact with syslog-ng or the log files directly. No processes started or restarted around that time in ps. No weird logins around that time that would seem to indicate operator error. 3) My /var/adm/messages file did NOT restart, just the mail logs coming in from the remote SSH tunnels. 4) I changed my syslog-ng.conf to not use macros for the filename, but rather to log to a static filename "current.log". Didn't help. 5) I added a second destination, breaking out the logs by hour: destination inboundlog { file("/system/inbound_mail/logs/current.log"); file("/system/inbound_mail/logs/$YEAR/$MONTH/$DAY/$HOUR.log"); }; current.log had the entire day's logs, and was truncated and restarted at 22:33:04, however the hourly log 2003/01/29/22.log was NOT, it kept right on ticking. 6) total size of messages logged up to 22:33:04 was approximately 29mb, so largefile issues should not be a factor. I'm at a loss here, folks. I'm ready to consult an exorcist. I seem to have a workaround in that my logs split out by hour don't appear to be getting truncated, but I'd love to track this one down. Any suggestions for things I've haven't considered or should I start shopping for goats and black candles? Thanks, Brian P.S. sorry for the threading issues, was reading through the web archives but I've now joined the list since I'm busily replacing Solaris syslog everywhere with syslog-ng! -- "We've heard that a million monkeys at a million keyboards coud produce the complete works of Shakespeare; now, thanks to the Internet, we know that is not true."

2 2

messages with newlines
by Dmitry Frolov 01 Feb '03

01 Feb '03

Hello! I encountered some problems with syslog-ng 1.5.25, while trying to separate logs by program name. Our developers often use multiline log messages, stack traces for example. The problem is that when multiline message received via network (udp) it is logged as several lines, and only first line has program name in it. So, when i configure 'program' filter, it only catches first line. Example: We are logging this message and it is sent to loghost (in one udp packet, tested with snoop). <30>Jan 31 13:51:30 Yadda yadda[17245]: Time to die. die now! Loghost writes it in this way: Jan 31 13:42:29 host yadda[17231]: Time to die. Jan 31 13:42:29 host die now! The second line "die now!" will not match 'program' filter. I suppose it would be correct to replace all '\n', '\r', etc in log messages and log them as single line as common syslogd does in any case and as syslog-ng does when source is unix domain socket. Another problem is that first word of program name disappears. if program name is missing, the first word of log msg disappears instead. Here's script to send log message used in my example. #!/usr/bin/perl -w use strict; use Sys::Syslog; # all except setlogsock, or: use Sys::Syslog qw(:DEFAULT setlogsock); # default set, plus setlogsock my $ident = 'Yadda yadda'; my $logopt = 'pid,ndelay'; my $facility = 'daemon'; my $priority = 'info'; my $format = "Time to die.\ndie now!"; my @args; setlogsock 'unix'; openlog $ident, $logopt, $facility; syslog $priority, $format, @args; closelog; -- Dmitry Frolov, Zenon N.S.P. (095) 250-4629, http://www.zenon.net/

3 4

RE: [syslog-ng]Please help with simple syslog-ng.conf creation qu estions....
by Hamilton, Andrew 31 Jan '03

31 Jan '03

Nope. But you can do this: source s_all{ unix-stream("/dev/log"); internal(); }; destination d_messages { file("/var/log/messages"); }; log { source(s_all); destination(d_messages); }; That should do it. If you are using Solaris you should use source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; Look in the syslog-ng/doc directory for sample configs. Regards, Drew -----Original Message----- From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] Sent: Thursday, January 30, 2003 2:01 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Please help with simple syslog-ng.conf creation questions.... configure;make;make install of syslog-ng source did not create /etc/syslog-ng directory with /etc/syslog-ng.conf ready to go. I assume I must create this directory and file myself??? syslog-ng has *tons* of features. Please tell me how I can just throw everything into /var/log/messages. I don't require fancy stuff just yet. In old syslog.conf this would be: *.info /var/log/messages Will syslog-ng recognize a one line syslog-ng.conf containing this old style config??? thanks, Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2363 49590 Lassing Road, Room A339 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-7940 Fax: (619) 553-1269 Email: seberino(a)spawar.navy.mil _______________________________________ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Please help with simple syslog-ng.conf creation questions....
by seberino＠spawar.navy.mil 30 Jan '03

30 Jan '03

configure;make;make install of syslog-ng source did not create /etc/syslog-ng directory with /etc/syslog-ng.conf ready to go. I assume I must create this directory and file myself??? syslog-ng has *tons* of features. Please tell me how I can just throw everything into /var/log/messages. I don't require fancy stuff just yet. In old syslog.conf this would be: *.info /var/log/messages Will syslog-ng recognize a one line syslog-ng.conf containing this old style config??? thanks, Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2363 49590 Lassing Road, Room A339 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-7940 Fax: (619) 553-1269 Email: seberino(a)spawar.navy.mil _______________________________________

1 0