January 2003 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]sending mail
by Michael.Semling＠swisscom.com 08 Jan '03

08 Jan '03

Hi N! If you really need an SMTP server running, I can highly recommend postfix. Otherwise, set up the mailhost correctly and use the mailx programm. e.g. for an empty message mailx -v -s test_email John.Doe(a)mailinglist.net </dev/null -v to see all the messages. But maybe I misunderstood your question and you just want to read the mails? Generally the mails are stored under /var/mail/<user>, you can easily read them be entering the command "mail" You'll see the mail list. Just type the number and you have the content. Regards, Michael -----Original Message----- From: netsec novice [mailto:netsec9@hotmail.com] Sent: Dienstag, 7. Januar 2003 22:03 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]sending mail I am a linux newbie - sorry. I already have an SMTP server on my network. Can I use mail from within syslog-ng to send messages to my account for alerting purposes without configuring a full blown mail server on my linux box? I don't know if there is a default SMTP client on linux (SuSE 8.1) or how to configure it. any help is appreciated N _____ The new MSN 8 is here: Try it free* for 2 months <http://g.msn.com/8HMEEN/2018> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]sending mail
by Hamilton, Andrew 08 Jan '03

08 Jan '03

You don't need a mail server running to SEND mail. Most, if not all, UNIX flavors come with some form of mail client, most of which are based upon some version of sendmail. However, you will need to send it to a mail SERVER. You'll have to check for a mail client, since I don't use SuSE I can't tell you where one will be, I have used several other flavors of Linux and they have all had the "mail" client. You could set up your mail program inside your syslog-ng.conf the same as you would to any other program by using the "program" key word in a destination. The message from syslog-ng is then passed to the program as an argument I believe. If you are using syslog-ng version 1.5.x, you can also use templates to format the message passed to the program. Or you can write a small program that parses the message sent to it from syslog-ng and then use that program to intelligently send mail. I think that is the best option since then you can control what you send and how you send it as opposed to trying to make syslog-ng do it. If you have a busy syslog-ng host, that could slow it down and you don't want that. Regards, Drew -----Original Message----- From: netsec novice [mailto:netsec9@hotmail.com] Sent: Tuesday, January 07, 2003 4:03 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]sending mail I am a linux newbie - sorry. I already have an SMTP server on my network. Can I use mail from within syslog-ng to send messages to my account for alerting purposes without configuring a full blown mail server on my linux box? I don't know if there is a default SMTP client on linux (SuSE 8.1) or how to configure it. any help is appreciated N _____ The new MSN 8 is here: Try it free* for <http://g.msn.com/8HMEEN/2018> 2 months _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

caching/tcp fault tolerant syslog?
by Aleksandr Koltsoff 08 Jan '03

08 Jan '03

hello (pls cc the replies, I'm not on the list) I have the following scenario: about 20 linux boxes in separate geographical areas, connected via WAN links which I don't completely trust. what I would like is this: run syslog-ng on each box, they should not write to files, but instead they should send all their messages over to a central log server so far so good :-) in the event of tcp-breakage (when the client boxes cannot reach the server via tcp, maybe with some keepalive "pings"), the syslogd should firstly start collating the log messages into memory (size settable by user), after that to disk (or directly to disk, if memory cache size is 0)). after some retries, cached log entries should be flushed to central server once connection is established. I went trough the archives (not all of them, but some) and seems that some ppl could use this functionality as well. basically I think couple of options, write my own syslogd or start hacking on syslog-ng, or, write a fault transparent buffering program that would implement all this and stick with stock syslog-ng that would always feed this program. any ideas on this? Aleksandr Koltsoff

1 0

sending mail
by netsec novice 07 Jan '03

07 Jan '03

1 0

Re: [syslog-ng]replacing part of prog name with hostname
by Noam Meltzer 07 Jan '03

07 Jan '03

I thing you confused it a little... According to my last message (and a similar thread I created recently) The problem with the hostname resolving of Solaris is fixed with using: keep_hostname(no) But, I would really like to understand what's going on in there. Is my assumption correct? Noam --- On Thu 01/02, Balazs Scheidler wrote:From: Balazs Scheidler [mailto: bazsi(a)balabit.hu]To: syslog-ng(a)lists.balabit.huDate: Thu, 2 Jan 2003 10:43:45 +0100Subject: Re: [syslog-ng]replacing part of prog name with hostnameOn Tue, Dec 31, 2002 at 02:05:34PM -0800, Nate Campi wrote:> I have syslog-ng 1.5.24 on solaris 8, reading from /etc/.syslog_door and> I have a log entry like this:> > Dec 31 13:48:15 larry 6.0[8704]: [ID 702911 local0.warning] [0] Can't> stat file in FlushFile [news/PointCast]: No such file or directory> > ...but the program name was sent from the app was: "ctlds 6.0[8704]:"> and syslog-ng replaced the first part of the messed up program name with> the host's name. > > In the next version, can syslog-ng "learn" that it don't get a hostname> from solaris ever and that the entire text coming in is actually the log> message? I'm losing information this way. I wonder how many other apps> split up the program name and lose data - most people would never know> as end users.the problem is ctlds sends a space in the program name tag, thus syslog-nginterprets 'ctlds' as hostname and '6.0' as program name. askeep_hostname() is set to no it rewrites originating host name.Try setting keep_hostname() to yes, it will not touch the hostname then.-- BazsiPGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

4 10

syslog -> syslog-ng
by Billy 06 Jan '03

06 Jan '03

If I install syslog-ng as a log server can I have the original syslog mechinisam from all of my other boxes send to the syslog-ng server? Will it map the same, are there any modifications I need to make to the other syslog conf? Will I need to install syslog-ng on all boxes? Thanks, Bill

2 1

replacing part of prog name with hostname
by Nate Campi 06 Jan '03

06 Jan '03

I have syslog-ng 1.5.24 on solaris 8, reading from /etc/.syslog_door and I have a log entry like this: Dec 31 13:48:15 larry 6.0[8704]: [ID 702911 local0.warning] [0] Can't stat file in FlushFile [news/PointCast]: No such file or directory ...but the program name was sent from the app was: "ctlds 6.0[8704]:" and syslog-ng replaced the first part of the messed up program name with the host's name. In the next version, can syslog-ng "learn" that it don't get a hostname from solaris ever and that the entire text coming in is actually the log message? I'm losing information this way. I wonder how many other apps split up the program name and lose data - most people would never know as end users. -- Nate Campi http://www.campin.net An Emacs reference mug is what I want. It would hold ten gallons of coffee. -- Steve VanDevender And, no doubt, have a lid that could only be removed with an obscure finger combination requiring both hands. (Ctrl-Alt-Meta-X gimme-the-damn-coffee) -- William Beegle

5 14

Over zealous syslog-ng problem
by Aaron Jackson 06 Jan '03

06 Jan '03

My Setup: I have syslog-ng running on several Solaris 8 machines. Each machine writes log messages to their local disks and also forwards the messages to a central log server via a UPD connection, also a Solaris 8 machine. The central log server stores everything into a mysql database via a perl script I wrote. My Problem: I am running the UNIX version of Cisco Secure on one of the Solaris boxes. A couple of times it has blown up. When this happens, it generates millions of log messages in a very short period. The problem is that syslog-ng logs most of these messages (I also get the mangled message problem during these heavy loads). The most recent episode generated 1,930,974 messages that made it into the mysql database and 49,573 mangled messages on the central log server, but 16,040,886 messages were written to disk on the local machine (see below). My Questions: Is there any way to throttle syslog-ng, or make syslog-ng not accept all log messages when an app goes crazy? I want to log some of these messages, so I know when to restart the service, but I don't want all 16 million. Also, it seems that around 15 million log messages didn't make it to my central server. Where were they lost? Is this a problem with the UDP transport? Aaron # cat local0.log | grep -c 'ERROR - error on accept' 16040886 jackson@auth:/tmp {5} cat sql_errors | grep -c 'INSERT INTO' 49573 mysql> delete from logs where host='acs' and facility='local0' and priority='err' and msg like '%ERROR - error on accept%'; Query OK, 1943387 rows affected (1 hour 40.16 sec)

5 10

RE: [syslog-ng]replacing part of prog name with hostname
by Noam Meltzer 04 Jan '03

04 Jan '03

This sounds like a nice idea, but I think that if you use such a mechanism you should also state how to find the missing field, if you don't mention it. Also, you should think a lot of how to describe you regexp to support multi-platforms environment. Noam --- On Sat 01/04, Borzenkov Andrey wrote:From: Borzenkov Andrey [mailto: Andrey.Borzenkov(a)siemens.com]To: syslog-ng(a)lists.balabit.huDate: Sat, 4 Jan 2003 14:55:51 +0300Subject: RE: [syslog-ng]replacing part of prog name with hostname> > On Thu, Jan 02, 2003 at 10:43:45AM +0100, Balazs Scheidler wrote:> >> > the problem is ctlds sends a space in the program name tag, thus syslog-> ng> > interprets 'ctlds' as hostname and '6.0' as program name. as> > keep_hostname() is set to no it rewrites originating host name.> >> > Try setting keep_hostname() to yes, it will not touch the hostname then.> > Right but "ctlds" isn't the hostname, larry is. My logs are wrong either> way - I either lose half my program name or get the wrong hostname.> Either way I lose.> > Arg, I actually wrote my own syslog daemon to relay and rewrite all> these last year. The only way to fix this with syslog-ng would be to add> a feature like> > options {> bad_hostnames("ctlds","last");> };> > When syslog-ng sees either of these:> > Jan 2 15:06:47 ctlds 6.0[11718]: [0] Request error (500): Template> processing error> Jan 2 15:06:47 last message repeated 123 times> > It knows to actually shift the message over one place to the right and> stick the value of the $FULLHOST_FROM macro in there. Even if I tried> templating out the message on my own syslog-ng will still think that> "ctlds" or "last" isn't part of the message and it'll get lost.Better is to implement source templates. This way you can precisely describeinput line, so if you know your source never appends host name, you justomit this from template. Something likesource s_stream { unix-stream("/dev/log" max-connections(10)); template(DATEPROG[PID]:... );}; Cheers-andrey_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

Re: [syslog-ng]replacing part of prog name with hostname
by Noam Meltzer 04 Jan '03

04 Jan '03

Such a feature must support netgroups, though, because otherwise when you have hunderds of servers in your network, you'll have a problem. Noam --- On Fri 01/03, Nate Campi wrote:From: Nate Campi [mailto: nate(a)campin.net]To: syslog-ng(a)lists.balabit.huDate: Fri, 3 Jan 2003 12:28:57 -0800Subject: Re: [syslog-ng]replacing part of prog name with hostnameOn Fri, Jan 03, 2003 at 03:21:25PM -0500, Ed Ravin wrote:> Nate Campi writes:> > > > On Fri, Jan 03, 2003 at 10:48:51AM +0100, Balazs Scheidler wrote:> > > > > > The solution is to fix the sender program, no better workaround exists in> > > syslog-ng.> > > > I tried that. I spent months trying to explain it to their developers. I> > almost got one of them to understand, at which point he said they don't> > really care.> > How about a feature in syslog-ng like this:> > add_hostname(host1, host2, host3 [, ...])> > Which would cause syslog-ng to insert a hostname or IP number for all> packets received from the hosts requested. That would cover packets> from Solaris hosts received via UDP - the add_hostname() option should> also be available on individual syslog sources, so you could correct> messages received from the local host via the syslog door or whatever> that funky thing is Solaris uses.Exactly what I suggested, except I called mine "bad_hostnames". I thinkthis feature could work.-- Nate Campi http://www.campin.net "What a good thing Adam had. When he said a good thing, he knew nobody had said it before." - Samuel Clemens_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0