December 2003 - syslog-ng - lists.balabit.hu

$YEAR/$MONTH/$DAY generates always 2002/12/31
by Piotr Woliński 22 Feb '04

22 Feb '04

Hello, I have PLD Linux kernel 2.4.20 and syslog-ng-1.6.0-0.rc3.2 I put into into syslog-ng.conf lines (for test purpose): source net { udp(); }; destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log {source(net); destination(hosts); }; Now i can see directiories like that: /var/log/hosts/localhost/2003/2003/12/01 /var/log/hosts/localhost/2003/2003/12/02 that's OK. But also: /var/log/hosts/localhost/2002/12/31 Inside that dir files: auth, authpriv, local7. Dates inside above 3 files are OK. Anyone could help me? What's going on? Piotr Wolinski

6 12

Timezone problem with syslog-ng
by "Pedroche, Raúl" 04 Feb '04

04 Feb '04

Greetings. First of all, hello to everybody as this is my first post. I am not too sure if this falls into the "problems" or "feature requests" section. The matter is I have noticed that syslog-ng is using UTC instead of local time, as I'd like it to do. I am using the "use_time_recv" option and server is configured for MET timezone (BTW it is Solaris 9). This is affecting both filenames (I am using variations of .../$WEEKDAY/$HOST and yesterday files have a timestamp of "dec 19 00:59" local time) and the file contents (i.e. first columns). syslog-ng version is 1.6.0rc4. I must, anyway, congratulate the authors: we have been running syslog-ng for quite a while (in a server configured with UTC :>) and it has been proved being very effective (it is a very dated host being log server for a lot of networking devices, some of them generating more than 1GB logs/day and has a 0.05-0.08 load). Regards, Raúl Pedroche COLT Telecom Av. Manoteras, 42 - Calle 3, 28050 Madrid Teléfono de soporte técnico: 901 88 99 88 Para llamadas desde el extranjero: +34 91 320 60 18 Email: raul.pedroche(a)colt-telecom.es www.colt.net ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

3 3

syslog-ng hanging
by david＠reno2.com 17 Jan '04

17 Jan '04

I have noticed that syslog-ng has been hanging on my 2.6.0 kernel gentoo host. I saw in a previous post that strace was requested, so here is some info: cindy etc # ps -ef |grep syslog-ng root 3381 1 0 15:36 ? 00:00:00 /usr/sbin/syslog-ng root 11416 9238 0 20:34 pts/1 00:00:00 grep syslog-ng cindy etc # cindy etc # strace -f -v -i -t -p 3381 Process 3381 attached - interrupt to quit 20:34:39 [4011e878] read(3, <unfinished ...> Process 3381 detached cindy etc # (The above unfinished part happens after I CTRL-C) Using following version of syslog-ng: [ebuild R ] app-admin/syslog-ng-1.6.0_rc3-r1 I will leave the system in this state until tomorrow morning (Mon, Dec 29, 7AM PST) in case any further diagnostic info is requested by then. I appreciate any help that you can give, Regards, David

2 1

error "Cannot assign requested address"
by Matthew Bassili 17 Jan '04

17 Jan '04

List members, I am trying to setup syslog-ng (Red Hat9, syslog build 1.6.0rc4) with the following syslog-ng.conf file: ############################################################### # First, set some global options # options { keep_hostname(yes); long_hostnames(off); sync(0); log_fifo_size(1024); log_msg_size(8192); }; ############################################################### # # source local { unix-dgram("/dev/log"); internal(); pipe("/proc/kmsg" log_prefix("kernel: ")); }; #source nocpix # { udp(ip("172.31.30.2") port(514)); # }; source nocpix-out { udp(ip("147.76.127.44") port(514)); }; #source mb2-pix # { udp(ip("172.18.1.6") port(514)); # }; source other { udp(); }; # # ############################################################### # # destination local { file("/var/log/syslog-ng/local/local.$YEAR.$MONTH.$DAY"); }; destination other { file("/var/log/syslog-ng/other/other.$YEAR.$MONTH.$DAY"); }; destination nocpix { file("/var/log/syslog-ng/nocpix/nocpix.$YEAR.$MONTH.$DAY"); }; #destination mb2 { file("/var/log/syslog-ng/mb2/mb2.$YEAR.$MONTH.$DAY"); }; # # ############################################################### # # filter f_auth { facility(auth, authpriv); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { facility(daemon, kern, user); }; filter f_news { facility(news); }; filter f_spooler { facility(uucp,news) and level(crit); }; filter f_syslog { not facility(auth, authpriv) and not facility(mail); }; filter f_user { facility(user); }; # # ############################################################### # # log { source(local); destination(local);}; #log { source(nocpix); destination(nocpix);}; log { source(nocpix-out); destination(nocpix);}; #log { source(mb2-pix); destination(mb2);}; log { source(other); destination(other);}; & I get the following error message on startup: "Starting syslog-ng: io.c: bind_inet_socket() bind failed 147.76.127.44:514 Cannot assign requested address" When I comment out the line " source nocpix-out { udp(ip("147.76.127.44") port(514)); };" Everything works fine using udp();, but I really want to separate the sources so I can direct the log files to a different directory. Any help would be GREATLY appreciated. Matthew Bassili Senior Network Engineer NEC Business Solutions P/L 649 Springvale Rd Mulgarve, 3170 AUSTRALIA e-mail: matthew.bassili(a)nec.com.au

2 1

How to filter XDMCP messages ?
by Gerard Breiner 12 Jan '04

12 Jan '04

Hello, I wonder how to configure syslog-ng to filtering the messages emitted by gdm_xdmcp. this type of messages pollutes my files of logs. Here is messages i don't want : "gdm[3798]: gdm_xdmcp_handle_query: Opcode 1 from ". Best regards Gerard Gerard Breiner Institut d'Astrophysique Spatiale Orsay Campus France

4 5

patch for log parsing bugs (log4j)
by Balazs Scheidler 09 Jan '04

09 Jan '04

hi, Attached you'll find a patch against syslog-ng 1.6.0rc4 which addresses some issues wrt log parsing. Please test if the patch fixes your problems. It might be part of a future release if it proves to interoperate with other platforms. People with not to frequent platforms (HP-UX comes to mind), please also test this patch as it might break there. Thanks. And finally the patch: Index: src/sources.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/sources.c,v retrieving revision 1.37 diff -u -r1.37 sources.c --- src/sources.c 8 Jan 2003 09:31:37 -0000 1.37 +++ src/sources.c 3 Oct 2003 14:22:32 -0000 @@ -107,23 +107,32 @@ } closure->pos += n; + /* UDP packets are complete log lines on their own */ + if (closure->dgram) { + do_handle_line(closure, closure->pos, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); + closure->pos = 0; + return ST_OK | ST_GOON; + } + eol = memchr(closure->buffer, '\0', closure->pos); - if (eol == NULL) - eol = memchr(closure->buffer, '\n', closure->pos); if (closure->pad_size && eol) { + + /* HP-UX sends chunks of pad_size in size, each containing a + * separate message, terminated by NUL */ do_handle_line(closure, eol - closure->buffer, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; } - if (!eol && (closure->dgram || closure->pos == closure->max_log_line)) { - /* we don't have a terminating nl nor \0, and our buffer is - full or we are a datagram receiver, when the message is in - its own packet. - */ + if (eol == NULL) + eol = memchr(closure->buffer, '\n', closure->pos); + if (!eol && closure->pos == closure->max_log_line) { + /* we don't have a terminating nl nor \0, and our buffer is full */ do_handle_line(closure, closure->pos, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; } + + /* iterate through lines */ start = closure->buffer; while (eol) { /* eol points at the newline character. end points at the -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 5

syslog-ng mysql syntax error
by Asif Iqbal 07 Jan '04

07 Jan '04

Hi All Since yesterday I am getting this syntax errors while pushing the log to the mysql database I followed the instruction exactly how it was said in http://vermeer.org/syslog/ and it was working fine until today it started complaining ERROR 1064 at line 841: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'level, tag, date, time, program, msg) VALUES ( '63.152.4.63', ' ERROR 1064 at line 1: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '/22/3 session 4612f4 Session End' ); INSERT INTO logs (host, fa ERROR 1064 at line 424: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '63.152.0.100', 'local4', 'err', 'err', 'a3', '2003-12-31', '17: Any suggestion/hint would be greatly appreciated -- Asif Iqbal http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x8B686E08 There's no place like 127.0.0.1

1 1

syslog-ng spec file
by Aladdin 31 Dec '03

31 Dec '03

Hello , I want to make RPM file for my RedHat system from spec file which is included in source tarball. Syslog-ng is 1.6.0rc4 version. I stucked with the following part: Source2: syslog-ng.init Source3: mysql-syslog.pipe Source4: mysql-syslog.buffer Source5: syslog-ng.sysconfig So my question is - where can I get the following files mentioned as sources. I was unable to find them anywhere in the tarball:( Thanks. -- Best regards, Aladdin mailto:aladdin@antakalnis.lt

1 0

central syslog server
by Asif Iqbal 31 Dec '03

31 Dec '03

Hi All I am trying to setup a central syslog server. Server A will push all its data to Server B (central syslog server, ip 1.2.3.4) Server A: ********* options { dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname(yes); }; source src { sun-streams("/dev/log"); udp(); internal(); }; destination d_server_B { udp("1.2.3.4" port(514)); }; log { source(src); destination(d_server_B); }; Server B: ********** options { dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname(yes); }; source local { sun-streams("/dev/log"); udp(); internal(); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(local); destination(d_mysql); }; But It does not seem to fully working. I get lots of logs in Server A from the routers. However only logs that Server B (central syslog server) gets from Server A are internal logs, nothing about the routers Am I missing something ? Thanks -- Asif Iqbal http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x8B686E08 There's no place like 127.0.0.1

1 2

Old Syslog Data
by Asif Iqbal 23 Dec '03

23 Dec '03

Hi All I am using syslog-ng which pipes the log to mysql database in this format host, facility, priority, level, tag, date, time, program, msg I installed the php plugin and now I can browse through the web real fast. Is there a way I can push all the previous logs in the database in the same format ? That way users can also look at the previous datam Thanks -- Asif Iqbal http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x8B686E08 There's no place like 127.0.0.1

3 3