January 2003 - syslog-ng - lists.balabit.hu

rotate files
by Sergio A Lima Jr. 16 Jan '03

16 Jan '03

Hello all, how to for determine log files rotate in the syslog-ng? Below, this syslog-ng.conf: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source stdlog { unix-stream("/dev/log"); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_iptl { file("/var/log/filtering.log"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or facility(news) and level(crit); }; filter f_filter7 { facility(mail) and not match ("i[pP]op3"); }; filter f_filter8 { facility(mail) and not match ("ipop3d"); }; filter f_filter9 { facility(kern) and match ("Bad packet from localnet"); }; log { source(stdlog); filter(f_filter1); destination(d_cons); }; log { source(stdlog); filter(f_filter2); destination(d_mesg); }; log { source(stdlog); filter(f_filter3); destination(d_auth); }; log { source(stdlog); filter(f_filter4); destination(d_mail); }; log { source(stdlog); filter(f_filter5); destination(d_mlal); }; log { source(stdlog); filter(f_filter6); destination(d_spol); }; log { source(stdlog); filter(f_filter9); destination(d_iptl); }; thank's for the help me!!! []'s Sergio Lima

2 1

filter(xxx); filter(DEFAULT); - flaw known ?
by Arnold Schommer 16 Jan '03

16 Jan '03

Hello, i have syslog-ng 1.4.14; there seems to be a flaw in config-parsing that lets the parser accept filter(xxx); filter(DEFAULT); but filter(DEFAULT); filter(xxx); leads to an error message Default statement may not have additional filters. (and syslog-ng does not start). My question: is this already known/fixed or should i send a note to the programmers ? tia Arnold Schommer -- FS EDV Service & Beratung GmbH An der Pönt 48 40885 Ratingen fon: +49 2102 186 400 fax: +49 2102 186 499 mailto:aschommer@fs-edv.de http://www.fs-edv.de

1 0

directing logs by application
by rich coco 15 Jan '03

15 Jan '03

I am confused by the documentation with respect to the possibility of directing output based on the *name* of an application. For example, consider 2 legacy applications - appName1 and appName2 - that historically wrote to syslogd via the LOG_USER facility. Using syslog-ng, can I redirect each app's log to different files via the syslog-ng.conf file? if this is do-able, is the following the correct approach? source src { unix-stream("/dev/log"); internal(); }; destination app1 { file("/var/log/app1.log") }; destination app2 { file("/var/log/app2.log") }; filter f_app1 { program("appName1") }; filter f_app2 { program("appName2") }; log { source(src); filter(f_app1); destination(app1); }; log { source(src); filter(f_app2); destination(app2); }; Also, it is not clear to me how i make the program-name (eg, "appName1") known to syslog-ng in the first place. Any help/advice welcome. (Oh, Running RH 7.x Linux, to the extent this may matter) Tia, - rich -- racoco(a)sockeye.com Sockeye Networks 52 Second Ave Suite 100 Waltham, MA 02451 781.693.7051

1 0

Re: [syslog-ng]syslog-ng and MySQL
by Michael Earls 14 Jan '03

14 Jan '03

What is the source of the syslog messages? Are you trying to log messages though UDP or local messages? michael PGP Info: KeyID 0x5EB59708 Fingerprint 108B A1D8 76F5 08A8 501A F28C 86F4 4BC5 5EB5 9708 >>> james.fleet(a)upbna.com 01/13/03 01:57PM >>> > Hello, > > I have been trying to create a syslog server with MySQL and with several > attempts it does not work. I have attached my configs for the system which > runs on Linux RH 7.3. > > > This is my syslog-ng.conf file : > > # > # Syslog-ng example configuration file showing all the existing/future > # features. > # > # Copyright (c) 1999 Balazs Scheidler > # $Id: syslog-ng.conf.demo,v 1.2 1999/11/15 12:30:41 bazsi Exp $ > # > # Note that some of the keywords do _nothing_, this includes: > # mac, authentication, encryption, compress > # > > #options { sync(0); time_reopen(10); log_fifo_size(100); }; > ## Log syslog-ng to mysql database > ## > destination d_mysql { > pipe("/tmp/mysql.pipe" > template ("INSERT INTO logs (host, facility, priority, level, tag, date, > time, program, msg) VALUES ( '$HOST', '$FACILITY', > '$PRIORITY','$LEVEL','$TAG','$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC','$PROGRAM' > ,'$MSG' );\n") template-escape(yes)); > }; > log { source(net); destination(d_mysql); > > }; > #source src { > # unix-stream("/dev/log"); > # udp(); > # tcp(ip("127.0.0.1") port(1000) mac(allow) authentication(required) > encrypt(allow)); > # tcp(); > # sun-streams("/dev/log" door("/etc/.syslog_door")); > # internal(); > #}; > source src { unix-dgram("/etc/log/log"); internal(); }; > source net { udp(); }; > > #log { source(src); destination(everything); }; > > > I also have this script running which says that /tmp/msql.pipe is my fifo > directory. > > But I am still not receiving logs into the database but when I switch it > will log to messages. > > > -James Fleet - > > Systems Engineer > Union Planters Bank > > > > > > > > > > > > > -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng for cygwin ?
by a12 14 Jan '03

14 Jan '03

Hi gurus, Is there a syslog-ng package for cygwin ?

1 0

syslog-ng and MySQL
by Fleet, James 13 Jan '03

13 Jan '03

> Hello, > > I have been trying to create a syslog server with MySQL and with several > attempts it does not work. I have attached my configs for the system which > runs on Linux RH 7.3. > > > This is my syslog-ng.conf file : > > # > # Syslog-ng example configuration file showing all the existing/future > # features. > # > # Copyright (c) 1999 Balazs Scheidler > # $Id: syslog-ng.conf.demo,v 1.2 1999/11/15 12:30:41 bazsi Exp $ > # > # Note that some of the keywords do _nothing_, this includes: > # mac, authentication, encryption, compress > # > > #options { sync(0); time_reopen(10); log_fifo_size(100); }; > ## Log syslog-ng to mysql database > ## > destination d_mysql { > pipe("/tmp/mysql.pipe" > template ("INSERT INTO logs (host, facility, priority, level, tag, date, > time, program, msg) VALUES ( '$HOST', '$FACILITY', > '$PRIORITY','$LEVEL','$TAG','$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC','$PROGRAM' > ,'$MSG' );\n") template-escape(yes)); > }; > log { source(net); destination(d_mysql); > > }; > #source src { > # unix-stream("/dev/log"); > # udp(); > # tcp(ip("127.0.0.1") port(1000) mac(allow) authentication(required) > encrypt(allow)); > # tcp(); > # sun-streams("/dev/log" door("/etc/.syslog_door")); > # internal(); > #}; > source src { unix-dgram("/etc/log/log"); internal(); }; > source net { udp(); }; > > #log { source(src); destination(everything); }; > > > I also have this script running which says that /tmp/msql.pipe is my fifo > directory. > > But I am still not receiving logs into the database but when I switch it > will log to messages. > > > -James Fleet - > > Systems Engineer > Union Planters Bank > > > > > > > > > > > > > -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Re: Lost CR-LF ?
by Hypo 13 Jan '03

13 Jan '03

I'm using syslog-ng v1.5.24 with libol 0.2.23 To generate log messages from a remote machine I use Kiwi SyslogGen v2.0.2 http://www.kiwisyslog.com/software_downloads.htm ) When used in burst mode ( 100 msg/sec ), in UDP I just lost some messages, but in TCP starts omitting CR-LF ( while in continuos mode it works well ). I don't know if is a KIWI problem while generatig lot of messages, or a syslog-ng one. Another little thing I like to ask, is why not all facility ( as RFC ) are defined, and why there's no mapping with numeric values...there's any reason for that choice ? Thx for support Amodiovalerio [Hypo] Verde > > which version of syslog-ng are you using? > > -- Bazsi

1 0

RE: [syslog-ng]problem with multiply-defined source/filter/destin ation combinations?
by Hamilton, Andrew 13 Jan '03

13 Jan '03

Well. That was a hefty message. Anyway, syslog-ng will typically log messages only once unless you tell it otherwise. This is the default behavior. You may think that by adding another log line that sends the same message to a different destination you are telling it to do just that. That is incorrect. Once a message is logged it is then forgotten in a sense. The way to do this is to use multiple destinations on the same line. (i.e., log { source(src); filter(filter1); destination(d1); destination(d2); }; ). This works well for me, I have been doing it for nearly 4 years. Syslog-ng will do exactly what you want to do you just have to tweak it a little. I have never done this before but in theory, and I guess someone else from the list can correct me if I'm wrong, you could write a log line from multiple sources as well. (i.e., log { source(s1); source(s2); filter(f1); destination(d1); destination(d2); }; ) etc... I think you can probably get the picture. That might help you clean up your config file a little. I hope this helps. Regards, Drew -----Original Message----- From: Jay Goldberg [mailto:jg@open.ch] Sent: Monday, January 13, 2003 4:34 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]problem with multiply-defined source/filter/destination combinations? Hi all I've just encountered a very strange problem with syslog-ng after modifying our standard syslog-ng.conf file, and hopefully someone on the group has seen this problem. Background: We've created a fairly complex system for managing logs on hosts in various locations. We have log collectors all running syslog-ng, and we're now using an Event-to-Syslog package that we have configured to send Windows Event Log messages to our log collectors. The log collectors use an external Perl script which filters out 'uninteresting' messages and uses our own reliable encrypted transport mechanism to send the logs to our in-house management systems. The Windows messages come in on local3. The external Perl script sends messages on local6. The intention of the configuration is: - local6 gets written to its own logfile so that our system doesn't get into any message loops if it encounters problems. - everything else is written to its appropriate logfile on disk AND sent through this external Perl program. Before modifying our syslog-ng.conf file to send messages to the external program, we saw all messages written to their appropriate logfiles on disk. After modifying the syslog-ng.conf, we see that the external script is working just fine, but the messages received on UDP are no longer being written to disk; they are only being sent to this external Perl script. I've implemented a workaroud, but I don't know if I've done something wrong, or if there's perhaps a bug in syslog-ng (we're running 1.5.22 on Solaris 8). Here's the original syslog-ng.conf: ================== start syslog-ng.conf, ORIGINAL ===================== options { sync (0); owner(syslogd); group(syslogd); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_udp { udp(); }; destination d_cons { file("/dev/console"); }; destination d_smsg { file("/dev/sysmsg"); }; destination d_udp { udp("loghost" port(514)); }; destination d_mlop { usertty("operator"); }; destination d_mlrt { usertty("root"); }; # # the following are scripts using cronolog to control logfile rotation # only so we can maintain symlinks to the 'traditional' logfile locations # destination d_mesg { program("/opt/OSAGslog/bin/c_messages"); }; destination d_sysl { program("/opt/OSAGslog/bin/c_syslog"); }; destination d_mail { program("/opt/OSAGslog/bin/c_maillog"); }; destination d_auth { program("/opt/OSAGslog/bin/c_authlog"); }; destination d_clog { program("/opt/OSAGslog/bin/cronolog"); }; filter f_auth { facility(auth); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_mesg { facility(cron) or facility(daemon) or facility(kern) or facility(lpr) or facility(news) or facility(user) or facility(uucp) or facility(local0) or facility(local1) or facility(local2) or facility(local3) or facility(local4) or facility(local5) or facility(local7); }; # # Log Directives # # We log AUTH to authlog, MAIL to syslog, everything # else to messages. # log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_udp); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_sysl); }; log { source(s_udp); filter(f_mail); destination(d_sysl); }; log { source(s_sys); filter(f_mesg); destination(d_mesg); }; log { source(s_udp); filter(f_mesg); destination(d_mesg); }; ================== end syslog-ng.conf, ORIGINAL ===================== ...here is the addition that we made to the end of the syslog-ng.conf to send logs to our Perl script called 'gumafilter': ================== start additions for 'gumafilter' ===================== source sg_global { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; # # c_gumalog just uses cronolog to control logfile rotation for # messages generated by the 'gumafilter' script. # destination dg_filt { program("/opt/OSAGguma/bin/gumafilter"); }; destination dg_log { program("/opt/OSAGslog/bin/c_gumalog"); }; filter fg_local6 { facility(local6); }; filter fg_all { facility(auth) or facility(mail) or facility(cron) or facility(daemon) or facility(kern) or facility(syslog) or facility(lpr) or facility(news) or facility(user) or facility(uucp) or facility(local0) or facility(local1) or facility(local2) or facility(local3) or facility(local4) or facility(local5) or facility(local7); }; # This guma sensor accepts remote messages (from guma.conf) log { source(sg_global); filter(fg_all); destination(dg_filt); }; log { source(sg_global); filter(fg_local6); destination(dg_log); }; ================== end additions for 'gumafilter' ===================== The workaround is to add the following line at the bottom of the syslog-ng.conf file, and I don't know why it's needed! log { source(sg_global); filter(f_mesg); destination(d_mesg); }; Without this line, the Perl script 'gumafilter' works correctly, but none of the logs received on UDP get written to disk in the messages file, which I would have expected based on the lines: log { source(s_sys); filter(f_mesg); destination(d_mesg); }; log { source(s_udp); filter(f_mesg); destination(d_mesg); }; Any ideas? ...sorry for the long message! Thanks in advance, Jay -- jay goldberg . open systems ag raeffelstrasse 29 jg(a)open.ch _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

(no subject)
by syslogng-bipsen＠nerdnet.dk 13 Jan '03

13 Jan '03

From: <big(a)boss.com> To: <syslogng-bipsen(a)nerdnet.dk> Date: Mon, 13 Jan 2003 12:37:17 +0100 Importance: Normal Subject: Segmentation fault ? Hi! When using the supplied init.d script for RedDat in /contrib I get a segmentation fault is I do a: /etc/init.d/syslog-ng status Any idea why ?? /Brian

1 0

Segmentation fault ?
by syslogng-bipsen＠nerdnet.dk 13 Jan '03

13 Jan '03

Hi! When using the supplied init.d script for RedHat in /contrib I get a segmentation fault is I do a: /etc/init.d/syslog-ng status Any idea why ?? I'm using version 1.4.17 of syslog-ng /Brian

1 0