March 2003 - syslog-ng - lists.balabit.hu

Re: syslog-ng
by garvald＠bluemail.ch 13 Mar '03

13 Mar '03

> >You might have noticed that I still had trouble believing that the >packets are making it to the loghost, despite your 'netstat -a'. Just >run 'netstat -t' on linux to see the TCP connections and see if you see >the other box actually connected. Try the telnet test that I mentioned >in the earlier post. Cover the lower layers of the stack before you >concentrate on the app layer. That was exactly my problem, there were no packages going anywhere, neither locally or remote. However if syslog-ng is runnin smoothly on the linux side of things, I assume tcp-wrappers has been installed and configured correctly. If the hosts.allow entry is correct then there's no reason it shouldnt accept the logs Anyway, I have now solved the problem. I tried installing 1.6.0rc1 (on solaris) however it wouldnt accept the fact that libol-0.3.9 really was that version. So I tried 1.5.26 and it runs smoothly, which 1.5.25 never did. next thing was on the linux side, I had to downgrade from a _very_ buggy 1.6.0_rc1-r1 syslog-ng gentoo release to (a still unstable) 1.5.26-r1. Now things seems to be working the way they should...logging locally and remotely seems to be working. Syslog-ng = a very touchy, senstive, but capable logger (once its runnin) cheers -AlanCB

2 1

Spec files...
by Blaise St-Laurent 13 Mar '03

13 Mar '03

I've been talking to Robert, and we were wondering if the spec file and associated files he created could be in the main distribution of syslog-ng. If there's any work that needs to be done (such as creating a patch file for it all) please let me know, and i'll get it done. BTW Any news on a new rc of syslog-ng?

2 1

syslog-ng 1.4.17 on Solaris 8
by enelson＠FLEETCC.COM 13 Mar '03

13 Mar '03

Hi all, I am having a problem with syslog-ng 1.4.17 on solaris 8. When I start syslog-ng I get parse errors at my firs "log" statement. Here is a shortened syslog-ng.conf file I'm using. All destination files are created and owned by root. Like I said, it dies at that first log statement (or any log statement) with a "Parse error at line (line number), Parse error reading configuration file, exiting. I have checked this over and over again, I'm just not seeing it. Thanks in advance for any information! Oh, I know I should upgrade to the 1.5.x tree, I am fighting that battle with our software maintainter now, I asked for "latest stable" and got 1.4.17. Eric Nelson enelson(a)fleetcc.com -------------------- source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source network { tcp(); udp(); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination kern { file("/var/log/kern.log"); }; destination maillog { file("/var/log/maillog"); }; destination console { file("/dev/sysmesg"); }; destination switch { file("/data/logs/switch.log"); }; destination test { file("/data/logs/test.log"); }; destination debug { file("/var/log/debug"); }; destination messages { file("var/log/messages"); }; filter f_authpriv { facility(auth); }; filter f_syslog { not facility(auth) and not facility(mail); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; filter f_switch { facility(local6, local7); }; filter f_debug { not facility(kern, auth, mail, local6, local7, local4, local0); }; filter f_messages { level(info .. warn) and not facility(kern, auth, mail, local6, local7, local4, local0); } log { source(local); filter(f_authpriv); destination(authlog); };

2 1

Macro question
by McNutt, Justin M. 12 Mar '03

12 Mar '03

Hey all, I'm new to the list, and fairly new to syslog-ng, so I hope I'm not asking a VFAQ (although a perusal of the documentation and the mailing list archives suggests that I'm not, so here goes). I have a server (dnps-linux2) that is set up as an SNMP trap receiver (Net-SNMP 5.0.3). Traps are then reformatted and sent to the local host's syslog service (via logger(2), I think). They arrive using facility local0. This part works. The part that sucks is that the IP address of the original trap sender is embedded in the $MSG portion of the entry. Here's an example: Mar 12 15:33:47 dnps-linux2 snmptrapd[797]: 128.206.169.240: Enterprise Specific Trap (blah blah blah) I'm trying to set up a destination that will split these up by sender, but $HOST always returns "dnps-linux2". $PROGRAM will return snmptrapd. I need to do something like this: source s_sys { (all the usual sources) }; filter f_snmptrap { facility(local0) and program(snmptrapd); }; destination d_snmptrap { file("/usr/log/traps/$SENDER/$YEAR.$MONTH.$DAY.traps"); }; log { source(s_sys); filter(f_snmptrap); destination(d_snmptrap); }; In the examples above, $SENDER should resolve to "128.206.169.240", perhaps by somehow matching $MSG against "^(\d+\.\d+\.\d+\.\d+):". Is this possible in any version of syslog-ng? I'm currently running 1.5.25 (on RedHat 7.3), but I don't have any qualms about upgrading if I can get this function (which I assume would go in the filter{} clause?). Any help is appreciated. Thanks! Justin McNutt Network Systems Analyst DNPS, Mizzou Telecom (573) 882-5183 In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds

1 0

RE: [syslog-ng]syslog-ng 1.4.17 on Solaris 8
by Hamilton, Andrew 12 Mar '03

12 Mar '03

You are missing a semicolon on the last filter statement at the end. -----Original Message----- From: enelson(a)FLEETCC.COM [mailto:enelson@FLEETCC.COM] Sent: Wednesday, March 12, 2003 2:54 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.4.17 on Solaris 8 Hi all, I am having a problem with syslog-ng 1.4.17 on solaris 8. When I start syslog-ng I get parse errors at my firs "log" statement. Here is a shortened syslog-ng.conf file I'm using. All destination files are created and owned by root. Like I said, it dies at that first log statement (or any log statement) with a "Parse error at line (line number), Parse error reading configuration file, exiting. I have checked this over and over again, I'm just not seeing it. Thanks in advance for any information! Oh, I know I should upgrade to the 1.5.x tree, I am fighting that battle with our software maintainter now, I asked for "latest stable" and got 1.4.17. Eric Nelson enelson(a)fleetcc.com -------------------- source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source network { tcp(); udp(); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination kern { file("/var/log/kern.log"); }; destination maillog { file("/var/log/maillog"); }; destination console { file("/dev/sysmesg"); }; destination switch { file("/data/logs/switch.log"); }; destination test { file("/data/logs/test.log"); }; destination debug { file("/var/log/debug"); }; destination messages { file("var/log/messages"); }; filter f_authpriv { facility(auth); }; filter f_syslog { not facility(auth) and not facility(mail); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; filter f_switch { facility(local6, local7); }; filter f_debug { not facility(kern, auth, mail, local6, local7, local4, local0); }; filter f_messages { level(info .. warn) and not facility(kern, auth, mail, local6, local7, local4, local0); } log { source(local); filter(f_authpriv); destination(authlog); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Who can help a newbie?
by Martijn Koopsen 12 Mar '03

12 Mar '03

All, As a relative newbie in the world syslog-ng i tried a few things. I am able to split all the information that comes into the logging-server into seperate files. Now i would like to change the config in a way that when a specific message comes in it is written to a file but at the same time triggers a shell script that starts running. Who can help me with this? Regards, Martijn Koopsen

2 1

solaris linux
by garvald＠bluemail.ch 12 Mar '03

12 Mar '03

Hi all trying to log from solaris 8 to Linux (gentoo). I'm using 1.5.26 on the linux side and 1.5.25 on the solaris. I've tried several linux versions ranging from 1.4x to current with no luck. Logging from linux -> linux is no problem. I've tried googling and newsgroups etc and writing mails but nobody can help. If nobody replies to this i'll be switching to another logger ;c] here's the configuration I'm using, its very basic and according to an earlier post from the "maintainer" it should work: solaris: source s_all { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; destination d_tcp { tcp("1.2.3.4"); }; log { source(s_all); destination(d_tcp); }; linux: source s_all { internal(); unix-stream("/dev/log"); tcp(); }; destination d_messages { file("/var/log/HOSTS/$HOST/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(s_all); destination(d_messages); }; ## why is nothing logged from the solaris box ? ##

2 2

Re: [syslog-ng]Syslog-ng 1.6.0rc1 and AIX 4.3.3
by EDL.Essed＠belastingdienst.nl 12 Mar '03

12 Mar '03

To make my own describtion a bit less criptic: In the file configure I changed these 3 lines: LIBOL_MAJOR=`echo $LIBOL_VERSION | sed -e 's/^$[0-9]\+$\.[0-9]\+\.[0-9] \+$+[0-9]*$\?$/\1/'` LIBOL_MINOR=`echo $LIBOL_VERSION | sed -e 's/^[0-9]\+\.$[0-9]\+$\.[0-9] \+$+[0-9]*$\?$/\1/'` LIBOL_PATCH=`echo $LIBOL_VERSION | sed -e 's/^[0-9]\+\.[0-9]\+\.$[0-9]\+$ $+[0-9]*$\?$/\1/'` to these lines: LIBOL_MAJOR=`echo $LIBOL_VERSION | sed -e 's/$[0-9]*$\.[0-9]*\.[0-9] */\1/'` LIBOL_MINOR=`echo $LIBOL_VERSION | sed -e 's/[0-9]*\.$[0-9]*$\.[0-9] */\1/'` LIBOL_PATCH=`echo $LIBOL_VERSION | sed -e 's/[0-9]*\.[0-9]*\.$[0-9] *$/\1/'` and run configure again. ___________________________________________ Esteban Essed B/CICT, Sector Continuiteit MPS/Midrange WBC-G2.36 Tel: (055 - 528) 3586 ___________________________________________ wok, n.: Something to thwow at a wabbit. ___________________________________________ |---------+--------------------------------> | | robertmg(a)WellsFargo.C| | | OM | | | Verzonden door: | | | syslog-ng-admin@lists| | | .balabit.hu | | | | | | | | | 12-03-2003 01:05 | | | Antwoord a.u.b. aan | | | syslog-ng | | | | |---------+--------------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | Aan: syslog-ng(a)lists.balabit.hu | | cc: | |Onderwerp: RE: [syslog-ng]Syslog-ng 1.6.0rc1 and AIX 4.3.3 | >-------------------------------------------------------------------------------------------------------------------------------| From: Gehring, Andrew x66132 >I'm trying to compiling 1.60rc1 on AIX 4.3.3 >I've tried both gcc-2.95 and gcc-3.2 both with make-3.80 >Not matter what I've tried it always fails to find libol 0.3.9 which I've >successfully compiled and installed in /usr/local >as a note I successfully compiled 1.5.26 on the same box, and it found libol-0.3.9 >all by itself... :-) <from_archive> > From: EDL.Essed(a)belastingdienst.nl > Sent: Monday, February 24, 2003 2:33 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]syslog-ng 1.6.0rc1 available > > > > Hi, > > I'm having problems building, checking for libol fails. > > ./configure --with-libol=/home/essee05/logging/src/libol-0.3.9 > checking libol version >= 0.3.9... no > configure: error: Required libol version not found > > Looking at configure.in, I see the sed part has changed. > Changing it back > to the 3 lines from 1.5.26 makes it work again. <snip> </from_archive> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

1 0

RE: [syslog-ng]Syslog-ng 1.6.0rc1 and AIX 4.3.3
by robertmg＠WellsFargo.COM 12 Mar '03

12 Mar '03

From: Gehring, Andrew x66132 >I'm trying to compiling 1.60rc1 on AIX 4.3.3 >I've tried both gcc-2.95 and gcc-3.2 both with make-3.80 >Not matter what I've tried it always fails to find libol 0.3.9 which I've >successfully compiled and installed in /usr/local >as a note I successfully compiled 1.5.26 on the same box, and it found libol-0.3.9 >all by itself... :-) <from_archive> > From: EDL.Essed(a)belastingdienst.nl > Sent: Monday, February 24, 2003 2:33 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]syslog-ng 1.6.0rc1 available > > > > Hi, > > I'm having problems building, checking for libol fails. > > ./configure --with-libol=/home/essee05/logging/src/libol-0.3.9 > checking libol version >= 0.3.9... no > configure: error: Required libol version not found > > Looking at configure.in, I see the sed part has changed. > Changing it back > to the 3 lines from 1.5.26 makes it work again. <snip> </from_archive>

1 0

Syslog-ng 1.6.0rc1 and AIX 4.3.3
by Gehring, Andrew x66132 11 Mar '03

11 Mar '03

I'm trying to compiling 1.60rc1 on AIX 4.3.3 I've tried both gcc-2.95 and gcc-3.2 both with make-3.80 Not matter what I've tried it always fails to find libol 0.3.9 which I've successfully compiled and installed in /usr/local as a note I successfully compiled 1.5.26 on the same box, and it found libol-0.3.9 all by itself... :-) Thanks for any help, Andrew

1 0