December 2003 - syslog-ng - lists.balabit.hu

Newbie question
by Asif Iqbal 21 Dec '03

21 Dec '03

Whats the difference between these two lines source local { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; Which one should I use for my Solaris SPARC 8 ? Thanks a lot -- Asif Iqbal http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x8B686E08 There's no place like 127.0.0.1

2 3

RE: [syslog-ng]Config file error?
by Hamilton Andrew 18 Dec '03

18 Dec '03

Your source line should look like this: source src_udp { udp( ip("131.97.91.56") port(514)); internal(); }; Regards, Drew -----Original Message----- From: carl andreasson [mailto:karlblau@hotmail.com] Sent: Thursday, December 18, 2003 8:21 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Config file error? No Thats just becase of the copy-paste... the config file is correct there.. i checked it, It seems to be complaining about the UDP stuff.... /calle > >Maybe it's just a copy-pase thing, but a space seem to have crept into >template-escape at the end of your destination line: "templa >te-escape(yes))" . > >/Christian > > >The config file: >*********************************************** > >options { long_hostnames(on); sync(0); }; > >source src_udp {udp(131.97.91.56) port(514); internal; }; > >destination d_mysql { pipe("/tmp/mysql.pipe"template("INSERT INTO logs >(host, facility, priority,level, tag, date,time,program, msg) VALUES ( >'$HOST', '$FACILITY','$PRIORITY', '$LEVEL', '$TAG','$YEAR-$MONTH-$DAY', >'$HOUR:$MIN:$SEC', '$PROGRAM','$MSG' );\n") templa te-escape(yes));}; > >log { source(src_udp); > destination(d_mysql); }; > >*********************************************** > >and i get this when i try to run it, >*********************************************** >[root@guardian-angel syslog-ng]# syslog-ng start parse error at 3 Parse >error reading configuration file, exiting. (line 3) [root@guardian-angel >syslog-ng]# >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

AIX syslog
by Schernau, Ed 18 Dec '03

18 Dec '03

I have seen AIX syslog fail if you define a log destination in the AIX syslog.conf file as just an IP address, as opposed to a hostname. In other words, the entry: *.debug @12.34.56.78 fails *.debug @loghost works (provided that it can resolve loghost) There's an IBM fix for this, but its part of a larger patch, IIRC. Ed Schernau Systems Management Specialist, ECC Citizens Bank, East Providence Operations Center 401.282.1262 ed.schernau(a)citizensbank.com *****This information may be confidential and/or privileged. Use of this information by anyone other than the intended recipient is prohibited. If you received this in error, please inform the sender and remove any record of this message.*****

1 0

RE: [syslog-ng]Config file error?
by Christian Osbahr 18 Dec '03

18 Dec '03

Well the space-thing would have been too easy;-) Have you tried adding a semi-colon after "udp(131.97.91.56)" (=> "udp(131.97.91.56);") ? /Christian No Thats just becase of the copy-paste... the config file is correct there.. i checked it, It seems to be complaining about the UDP stuff.... /calle > >Maybe it's just a copy-pase thing, but a space seem to have crept into >template-escape at the end of your destination line: "templa >te-escape(yes))" . > >/Christian > > >The config file: >*********************************************** > >options { long_hostnames(on); sync(0); }; > >source src_udp {udp(131.97.91.56) port(514); internal; }; > >destination d_mysql { pipe("/tmp/mysql.pipe"template("INSERT INTO logs >(host, facility, priority,level, tag, date,time,program, msg) VALUES ( >'$HOST', '$FACILITY','$PRIORITY', '$LEVEL', '$TAG','$YEAR-$MONTH-$DAY', >'$HOUR:$MIN:$SEC', '$PROGRAM','$MSG' );\n") templa te-escape(yes));}; > >log { source(src_udp); > destination(d_mysql); }; > >*********************************************** > >and i get this when i try to run it, >*********************************************** >[root@guardian-angel syslog-ng]# syslog-ng start parse error at 3 Parse >error reading configuration file, exiting. (line 3) >[root@guardian-angel syslog-ng]# >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Config file error?
by carl andreasson 18 Dec '03

18 Dec '03

No Thats just becase of the copy-paste... the config file is correct there.. i checked it, It seems to be complaining about the UDP stuff.... /calle > >Maybe it's just a copy-pase thing, but a space seem to have crept into >template-escape at the end of your destination line: "templa >te-escape(yes))" . > >/Christian > > >The config file: >*********************************************** > >options { long_hostnames(on); sync(0); }; > >source src_udp {udp(131.97.91.56) port(514); internal; }; > >destination d_mysql { pipe("/tmp/mysql.pipe"template("INSERT INTO logs >(host, facility, priority,level, tag, date,time,program, msg) VALUES ( >'$HOST', '$FACILITY','$PRIORITY', '$LEVEL', '$TAG','$YEAR-$MONTH-$DAY', >'$HOUR:$MIN:$SEC', '$PROGRAM','$MSG' );\n") templa te-escape(yes));}; > >log { source(src_udp); > destination(d_mysql); }; > >*********************************************** > >and i get this when i try to run it, >*********************************************** >[root@guardian-angel syslog-ng]# syslog-ng start parse error at 3 Parse >error reading configuration file, exiting. (line 3) [root@guardian-angel >syslog-ng]# >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

1 0

RE: [syslog-ng]Config file error?
by Christian Osbahr 18 Dec '03

18 Dec '03

Maybe it's just a copy-pase thing, but a space seem to have crept into template-escape at the end of your destination line: "templa te-escape(yes))" . /Christian The config file: *********************************************** options { long_hostnames(on); sync(0); }; source src_udp {udp(131.97.91.56) port(514); internal; }; destination d_mysql { pipe("/tmp/mysql.pipe"template("INSERT INTO logs (host, facility, priority,level, tag, date,time,program, msg) VALUES ( '$HOST', '$FACILITY','$PRIORITY', '$LEVEL', '$TAG','$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM','$MSG' );\n") templa te-escape(yes));}; log { source(src_udp); destination(d_mysql); }; *********************************************** and i get this when i try to run it, *********************************************** [root@guardian-angel syslog-ng]# syslog-ng start parse error at 3 Parse error reading configuration file, exiting. (line 3) [root@guardian-angel syslog-ng]#

1 0

Config file error?
by carl andreasson 18 Dec '03

18 Dec '03

Hello, im quite a newbie to syslog-ng but what i basicly want to do is to log syslog messages from routers in to a mysql database, and i have some problems with the configuration file so please help me. The config file: *********************************************** options { long_hostnames(on); sync(0); }; source src_udp {udp(131.97.91.56) port(514); internal; }; destination d_mysql { pipe("/tmp/mysql.pipe"template("INSERT INTO logs (host, facility, priority,level, tag, date,time,program, msg) VALUES ( '$HOST', '$FACILITY','$PRIORITY', '$LEVEL', '$TAG','$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM','$MSG' );\n") templa te-escape(yes));}; log { source(src_udp); destination(d_mysql); }; *********************************************** and i get this when i try to run it, *********************************************** [root@guardian-angel syslog-ng]# syslog-ng start parse error at 3 Parse error reading configuration file, exiting. (line 3) [root@guardian-angel syslog-ng]# _________________________________________________________________ Add photos to your messages with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

1 0

Problems....
by carloscar 18 Dec '03

18 Dec '03

Hello, im quite a newbie to syslog-ng but what i basicly want to do is to log syslog messages from routers in to a mysql database, and i have some problems with the configuration file so please help me. The config file: *********************************************** options { long_hostnames(on); sync(0); }; source src_udp {udp(131.97.91.56) port(514); internal; }; destination d_mysql { pipe("/tmp/mysql.pipe"template("INSERT INTO logs (host, facility, priority,level, tag, date,time,program, msg) VALUES ( '$HOST', '$FACILITY','$PRIORITY', '$LEVEL', '$TAG','$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM','$MSG' );\n") templa te-escape(yes));}; log { source(src_udp); destination(d_mysql); }; *********************************************** and i get this when i try to run it, *********************************************** [root@guardian-angel syslog-ng]# syslog-ng start parse error at 3 Parse error reading configuration file, exiting. (line 3) [root@guardian-angel syslog-ng]# Mvh // Carloscar Andreasson *********************************** Volvo Information Technology Dept 8320 : Wide Area Network Solutions Tel nat : 031-3220665 Tel int : +46 31-3220665 Location : Da 2s 40805 göteborg Sweden

1 0

Quoting ( and ) in a match
by allanwind＠lifeintegrity.com 18 Dec '03

18 Dec '03

Hello friends, I am trying to match the following entry with syslog-ng 1.6.0rc4: Dec 11 15:25:10 log_source@pawan amavis[29961]: (29961-01-2) Passed, <syslog-ng-admin(a)lists.balabit.hu> -> <allanwind(a)lifeintegrity.com>, Message-ID: <20031211202502.22100.73262.Mailman(a)www.balabit.hu>, Hits: -1.364 And expected this to do the trick (after a bit of trial and error and checking the archives): match("^\$.*Passed, ") and eventually match("^\\(\d+-\d+\$ Passed") however neither works. If I leave out "\\(" on the first match, it works as expected. Any ideas? /Allan -- Allan Wind P.O. Box 2022 Woburn, MA 01888-0022 USA

3 8

Re: Compiling syslog-ng for IRIX!
by Gabor Szabo 17 Dec '03

17 Dec '03

It works on IRIX 6.5.19m & GCC3.3. Send your error messages to me. -- Gabor SZABO, support engineer, Silicon Computers Kft.

1 0