February 2003 - syslog-ng - lists.balabit.hu

more syslog_ng config file on HP-UX ...
by Ola.Fjallman＠adb.ds.sll.se 06 Feb '03

06 Feb '03

Hello again, after reading docs and asking around I produced following config file : options { sync(0); time_reopen(10); log_fifo_size(100); }; source stdlog { pipe("/dev/log" pad_size(2048)); udp(); tcp(ip("192.168.0.1") port(514)); internal(); }; destination everything { udp("127.0.0.1" port(999)); tcp("127.0.0.1" port(999)); file("/tmp/logfile" sync(0) log_fifo_size(10)); }; log { source(stdlog); destination(everything); }; But when running syslog_ng I get this error : parse error at 3 Parse error reading configuration file, exiting. I'm running HP-UX 11.11 on my server. By the way, udp and tcp, is there any reason for running both? Regards, Ola

1 0

where docs on *REMOTE* logging using ssh??
by seberino＠spawar.navy.mil 05 Feb '03

05 Feb '03

Where can I find docs on setting up secure (SSH) remote syslog-ng logging? Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2363 49590 Lassing Road, Room A339 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-7940 Fax: (619) 553-1269 Email: seberino(a)spawar.navy.mil _______________________________________

3 6

Re: [syslog-ng]Please help with simple syslog-ng.conf creation questions....
by seberino＠spawar.navy.mil 05 Feb '03

05 Feb '03

Is there any danger in just starting /usr/local/sbin/syslog-ng from rc.local??? It will get started *later* than if I messed with startup scripts but then again... logging ain't really vital for kernel to run right??? Are there any vital switches or should I just do plain ol' /usr/local/sbin/syslog-ng & ?? Thanks, Chris On Tue, Feb 04, 2003 at 03:55:37PM -0500, Hamilton, Andrew wrote: > Forgot to mention that you need to change your startup scripts in RedHat to > work with > syslog-ng. It is fairly simple. Look in /etc/rc.d/init.d. > > Regards, > > Drew > > -----Original Message----- > From: seberino(a)spawar.navy.mil > To: Hamilton, Andrew > Cc: syslog-ng(a)lists.balabit.hu > Sent: 2/3/2003 3:23 PM > Subject: Re: [syslog-ng]Please help with simple syslog-ng.conf creation qu > estions.... > > Andrew > > Thanks again for all your help. I combined all your tips > to make a simple "just put everything in /var/log/messages for now" > version of /etc/syslog-ng/syslog-ng.conf.... > > ---- > source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); > internel();}; > destination dest {file("/var/log/messages");}; > log {source(src); destination(dest);}; > ---- > > Can I ask you a few more questions about this? > > I called my identifiers "src" and "dest". I assume it does not > matter what I call these as long as I use those same identifiers > in log line??? > > Since Red Hat is not set up to use syslog-ng by default, I assume I must > remove syslogd and klogd from startup "things to do list" and start > /usr/local/sbin/syslog-ng from /etc/rc.d/rc.local myself??? > > If I want syslog-ng to accept remote messages from remote syslog-ng > daemons, > must I add something else to syslog-ng.conf above such as item > regarding port #514 UDP??? (syslog is tied to this port). I need to ask > > this because the word "remote" is NOT even mentioned in the syslog-ng > docs???!?!? > > Thanks again, > > Chris > > > > On Mon, Feb 03, 2003 at 08:28:32AM -0500, Hamilton, Andrew wrote: > > It depends on what you want to do. I think it is a good idea to run > kernel > > messages through syslog-ng. I have less overhead and less to worry > about. > > The source you have is correct. > > > > Regards, > > > > Drew > > > > -----Original Message----- > > From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] > > Sent: Friday, January 31, 2003 6:59 PM > > To: Hamilton, Andrew > > Cc: syslog-ng(a)lists.balabit.hu > > Subject: Re: [syslog-ng]Please help with simple syslog-ng.conf > creation > > qu estions.... > > > > > > Andrew > > > > Thanks! There is lots to learn since config file much > > more complicated now. > > > > Do you run syslog-ng daemon AND klogd too??? > > > > FAQ says to have syslog-ng handle kernel messages I must > > kill klogd and add this to syslog-ng.conf.... > > > > source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internel(); > }; > > > > I assume this is a good idea. Perhaps that is what you do??? > > > > Thanks again, > > > > Chris > > > > > > On Thu, Jan 30, 2003 at 02:14:27PM -0500, Hamilton, Andrew wrote: > > > Nope. But you can do this: > > > > > > source s_all{ unix-stream("/dev/log"); internal(); }; > > > destination d_messages { file("/var/log/messages"); }; > > > > > > log { source(s_all); destination(d_messages); }; > > > > > > That should do it. If you are using Solaris you should use > > > > > > source local { sun-streams("/dev/log" door("/etc/.syslog_door")); > > > internal(); }; > > > > > > Look in the syslog-ng/doc directory for sample configs. > > > > > > > > > Regards, > > > > > > Drew > > > > > > -----Original Message----- > > > From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] > > > Sent: Thursday, January 30, 2003 2:01 PM > > > To: syslog-ng(a)lists.balabit.hu > > > Subject: [syslog-ng]Please help with simple syslog-ng.conf creation > > > questions.... > > > > > > > > > configure;make;make install of syslog-ng source did not create > > > /etc/syslog-ng directory with > > > /etc/syslog-ng.conf ready to go. > > > > > > I assume I must create this directory and file > > > myself??? > > > > > > syslog-ng has *tons* of features. Please tell > > > me how I can just throw everything into /var/log/messages. > > > I don't require fancy stuff just yet. > > > > > > In old syslog.conf this would be: > > > > > > *.info /var/log/messages > > > > > > Will syslog-ng recognize a one line syslog-ng.conf > > > containing this old style config??? > > > > > > thanks, > > > > > > Chris > > > -- > > > _______________________________________ > > > > > > Dr. Christian Seberino > > > SPAWAR Systems Center San Diego > > > Code 2363 > > > 49590 Lassing Road, Room A339 > > > San Diego, CA 92152-6147 > > > U.S.A. > > > > > > Phone: (619) 553-7940 > > > Fax: (619) 553-1269 > > > Email: seberino(a)spawar.navy.mil > > > _______________________________________ > > > > > > _______________________________________________ > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > > > > _______________________________________________ > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > > -- > > _______________________________________ > > > > Dr. Christian Seberino > > SPAWAR Systems Center San Diego > > Code 2872 > > San Diego, CA 92152-6147 > > U.S.A. > > > > Phone: (619) 553-9973 > > Fax: > > Email: seberino(a)spawar.navy.mil > > _______________________________________ > > -- > _______________________________________ > > Dr. Christian Seberino > SPAWAR Systems Center San Diego > Code 2872 > San Diego, CA 92152-6147 > U.S.A. > > Phone: (619) 553-9973 > Fax: > Email: seberino(a)spawar.navy.mil > _______________________________________ -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-9973 Fax: Email: seberino(a)spawar.navy.mil _______________________________________

1 0

RE: Re: [syslog-ng]HP-UX syslog_ng server configfile
by Ola.Fjallman＠adb.ds.sll.se 05 Feb '03

05 Feb '03

ok, thanks! Another dumb question : dows this line replace the whole source src { ... udp(); tcp(); } and if so, I suspect that my other lines : udp(); tcp(ip("192.168.0.1") port(514)); tcp(); internal(); goes within the source stdlog {} Regards, Ola -----Original Message----- From: bazsi [mailto:bazsi@balabit.hu] Sent: den 5 februari 2003 14:59 To: syslog-ng Cc: bazsi Subject: Re: [syslog-ng]HP-UX syslog_ng server configfile On Wed, Feb 05, 2003 at 02:46:07PM +0100, Ola.Fjallman(a)adb.ds.sll.se wrote: > "io.c: bind_unix_socket(): /dev/log not a socket > Error initializing configuration, exiting." > > > Does anyone have any idea what this means? As I have understood > /dev/log is correct unix-stream on HP-UX. no, it is a pipe(), each message padded to 2048 bytes. Here's an excerpt from the INSTALL file: HP-UX (HP-UX 11.0) ------------------ HP-UX uses a named pipe called /dev/log for log transport, and you can use this with the pipe() driver with an additional option. HP-UX pads all incoming messages to 2048 bytes by default, so you need to specify this: source stdlog { pipe("/dev/log" pad_size(2048)); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

HP-UX syslog_ng server configfile
by Ola.Fjallman＠adb.ds.sll.se 05 Feb '03

05 Feb '03

Hello, I have some problems. I run version 1.5.8 on HP-UX 11.11 The problem is with the unix-stream in syslog_ng.conf file. I have added the following configuration for test purposes : __________________________________________________ options { sync(0); time_reopen(10); log_fifo_size(100); }; source src { unix-stream("/dev/log"); udp(); tcp(ip("192.168.0.1") port(514)); tcp(); internal(); }; destination everything { udp("127.0.0.1" port(999)); tcp("127.0.0.1" port(999)); pipe("/dev/xconsole"); file("/tmp/logfile" compress(on) sync(0) log_fifo_size(10)); }; log { source(src); destination(everything); }; __________________________________________________ When trying to start syslog_ng I get this error message : "io.c: bind_unix_socket(): /dev/log not a socket Error initializing configuration, exiting." Does anyone have any idea what this means? As I have understood /dev/log is correct unix-stream on HP-UX. Regards, Ola

2 1

Re: [syslog-ng]Changing Permissions on /dev/null
by Ted_Rule＠flextech.co.uk 05 Feb '03

05 Feb '03

An utterly kludgy fix suggestion .... Instead of a /dev/null 'file' destination, have a 'program' destination which merely runs a script to call "cat >/dev/null", and leave sync() settings fairly big so that the pipe isn't flushed very often. Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

2 1

Changing Permissions on /dev/null
by Brian E. Seppanen 05 Feb '03

05 Feb '03

Hi Folks: I've just installed 1.5.26 and for some reason I get the following errors Feb 4 12:23:01 host syslog-ng[15522]: Changing permissions on special file /dev/null permissions are then listed as crw------- 1 root root 1, 3 Apr 11 2002 /dev/null cronjobs that redirect output to dev null for ordinary admin accounts are failing because they no longer have permissions to write to /dev/null When did syslog-ng start changing the permissions on /dev/null, so what release do I need to backpeddle to. Thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

3 4

RE: [syslog-ng]Changing Permissions on /dev/null
by pothier, brian 04 Feb '03

04 Feb '03

You could also create another /dev/null for syslog to use.. > ls -lL /dev/null crw------- 1 root root 1, 3 Apr 11 2002 /dev/null major^ ^minor > mknod usage: mknod name [ b/c major minor ] [ p ] > mknod /dev/null.syslog-ng c 1 3 The major/minor numbers will vary from Unix to Unix. (i.e. Solaris is 13 and 2) Brian -----Original Message----- From: Brian E. Seppanen [mailto:seppy@chartermi.net] Sent: Tuesday, February 04, 2003 2:32 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Changing Permissions on /dev/null On Tue, 4 Feb 2003, Nate Campi wrote: > On Tue, Feb 04, 2003 at 01:09:39PM -0500, Brian E. Seppanen wrote: > > Hi Folks: > > > > I've just installed 1.5.26 and for some reason I get the following errors > > Feb 4 12:23:01 host syslog-ng[15522]: Changing permissions on special > > file /dev/null > > > > permissions are then listed as > > crw------- 1 root root 1, 3 Apr 11 2002 /dev/null > > > > cronjobs that redirect output to dev null for ordinary admin accounts are > > failing because they no longer have permissions to write to /dev/null > > > > When did syslog-ng start changing the permissions on /dev/null, so what > > release do I need to backpeddle to. > > You need to modify your syslog-ng conf file to not use /dev/null as a > destination. Is there some way to have it leave the permissions of /dev/null as it previously was? I toss messages for a page queue run that is done every 10 seconds. I don't want to drown in those messages, and I don't want to waste the disk space. I also want the queue processed as fast and as often possible. Thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Please help with simple syslog-ng.conf creation qu estions....
by Hamilton, Andrew 04 Feb '03

04 Feb '03

Chris, Names don't matter much to syslog-ng. You just don't want to use any of the keywords. I'm not sure that syslog-ng even cares about that but it could confuse the reader. To add a network source, use udp, tcp or both. Like this: source src { unix-stream("/dev/log"); pipe("/proc/kmsg"); tcp(); udp(); internal(); }; by default you get the installed interface and port 514. Both of which can be specified: tcp(ip("192.168.0.2") port(555)); You might check the syntax of that in the docs, I haven't used it in a while. It may be slightly different, but that is the principal. udp is the same. Regards, Drew -----Original Message----- From: seberino(a)spawar.navy.mil To: Hamilton, Andrew Cc: syslog-ng(a)lists.balabit.hu Sent: 2/3/2003 3:23 PM Subject: Re: [syslog-ng]Please help with simple syslog-ng.conf creation qu estions.... Andrew Thanks again for all your help. I combined all your tips to make a simple "just put everything in /var/log/messages for now" version of /etc/syslog-ng/syslog-ng.conf.... ---- source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internel();}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; ---- Can I ask you a few more questions about this? I called my identifiers "src" and "dest". I assume it does not matter what I call these as long as I use those same identifiers in log line??? Since Red Hat is not set up to use syslog-ng by default, I assume I must remove syslogd and klogd from startup "things to do list" and start /usr/local/sbin/syslog-ng from /etc/rc.d/rc.local myself??? If I want syslog-ng to accept remote messages from remote syslog-ng daemons, must I add something else to syslog-ng.conf above such as item regarding port #514 UDP??? (syslog is tied to this port). I need to ask this because the word "remote" is NOT even mentioned in the syslog-ng docs???!?!? Thanks again, Chris On Mon, Feb 03, 2003 at 08:28:32AM -0500, Hamilton, Andrew wrote: > It depends on what you want to do. I think it is a good idea to run kernel > messages through syslog-ng. I have less overhead and less to worry about. > The source you have is correct. > > Regards, > > Drew > > -----Original Message----- > From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] > Sent: Friday, January 31, 2003 6:59 PM > To: Hamilton, Andrew > Cc: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Please help with simple syslog-ng.conf creation > qu estions.... > > > Andrew > > Thanks! There is lots to learn since config file much > more complicated now. > > Do you run syslog-ng daemon AND klogd too??? > > FAQ says to have syslog-ng handle kernel messages I must > kill klogd and add this to syslog-ng.conf.... > > source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internel(); }; > > I assume this is a good idea. Perhaps that is what you do??? > > Thanks again, > > Chris > > > On Thu, Jan 30, 2003 at 02:14:27PM -0500, Hamilton, Andrew wrote: > > Nope. But you can do this: > > > > source s_all{ unix-stream("/dev/log"); internal(); }; > > destination d_messages { file("/var/log/messages"); }; > > > > log { source(s_all); destination(d_messages); }; > > > > That should do it. If you are using Solaris you should use > > > > source local { sun-streams("/dev/log" door("/etc/.syslog_door")); > > internal(); }; > > > > Look in the syslog-ng/doc directory for sample configs. > > > > > > Regards, > > > > Drew > > > > -----Original Message----- > > From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] > > Sent: Thursday, January 30, 2003 2:01 PM > > To: syslog-ng(a)lists.balabit.hu > > Subject: [syslog-ng]Please help with simple syslog-ng.conf creation > > questions.... > > > > > > configure;make;make install of syslog-ng source did not create > > /etc/syslog-ng directory with > > /etc/syslog-ng.conf ready to go. > > > > I assume I must create this directory and file > > myself??? > > > > syslog-ng has *tons* of features. Please tell > > me how I can just throw everything into /var/log/messages. > > I don't require fancy stuff just yet. > > > > In old syslog.conf this would be: > > > > *.info /var/log/messages > > > > Will syslog-ng recognize a one line syslog-ng.conf > > containing this old style config??? > > > > thanks, > > > > Chris > > -- > > _______________________________________ > > > > Dr. Christian Seberino > > SPAWAR Systems Center San Diego > > Code 2363 > > 49590 Lassing Road, Room A339 > > San Diego, CA 92152-6147 > > U.S.A. > > > > Phone: (619) 553-7940 > > Fax: (619) 553-1269 > > Email: seberino(a)spawar.navy.mil > > _______________________________________ > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > -- > _______________________________________ > > Dr. Christian Seberino > SPAWAR Systems Center San Diego > Code 2872 > San Diego, CA 92152-6147 > U.S.A. > > Phone: (619) 553-9973 > Fax: > Email: seberino(a)spawar.navy.mil > _______________________________________ -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-9973 Fax: Email: seberino(a)spawar.navy.mil _______________________________________

1 0

RE: [syslog-ng]Some Boxes Refuse to Write to syslog-ng host
by Paul Thomas 04 Feb '03

04 Feb '03

At 11:00 AM 2/4/2003, you wrote: > > There is a firewall between the 2 machines but it isn't blocking this > > port. I know that because there are other machines are the > > same subnet > > that are able to get to the loghost and nothing is showing up in my > > firewall logs. > > > > Any more suggestions? > >Now check of the receiving system with tcpdump to see if they are received. Well, looks like my firewall was blocking them. There must be some difference between the way solaris and linux send the syslog messages on the client port side. Thanks for your time guys! Paul

1 0