April 2003 - syslog-ng - lists.balabit.hu

Issue with Macros & 1.6.0rc2
by Dan Edwards 17 Apr '03

17 Apr '03

I am having some strange problems that I can not seem to resolve with syslog-ng and macro use. I am sure it is simple and I am just over looking it. When I try and use the $YEAR, $MONTH, $DAY, $FACILITY, $LEVEL and several other macros nothing is outputted. Example: destination d_cisco { file("/var/log/cisco-$YEAR.$MONTH.$DAY.log"); } The file that it creates is: "/var/log/cisco-.log" This holds true for usage of template command in the file call. If I format it with those macros a blank space is all that is entered. If I put a "\n" on the end of the last macro it erases all the output for the line and makes the entire line blank. Example: destination d_cisco { file("/var/log/cisco.log" template("$YEAR-$MONTH-$DAY $LEVEL $MSG\n")); } The output is " " If I do not put the \n on the end only the MSG macro will output. Any input is greatly appreciated. Debian 3.0r1 Syslog-ng-1.6.0rc2 Libol-0.3.9 Dan Edwards Network Specialist A. Duda & Sons, Inc.

1 0

Compiling libol and syslog-ng with Solaris Compiler.
by Jay Davis 16 Apr '03

16 Apr '03

GCC is not supported here. Has anyone gotten libol and syslog-ng compiled using the C++ compiler that comes with a full install of Solaris8? -- Jay Davis Cell: 443-253-0469

1 0

syslog-ng on Mac OSX
by Dan Siff 16 Apr '03

16 Apr '03

Is anyone successfully running syslog-ng on OSX/Darwin? I've seen posts concerning compilation and interfacing with libol, but nothing concerning configuring running/operating syslog-ng on OSX. I've gotten syslog-ng to compile (v 1.6.0rc1) with libol v. 0.3.9, but whenever I try and start the process, it is crashing with : Command: syslog-ng PID: 24210 Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_INVALID_ADDRESS (0x0001) at 0xbff7ff30 I'm trying to run this on OSX/Darwin 10.2.5. If anyone has experience with this, I'd also want to know what your syslog-ng.conf file looks like, since I can't find any references to replacing OSX's syslogd configs with syslog-ng. Thanks!

1 0

Problem with IP "don't fragment" flag?
by Ruecker, Rainer 16 Apr '03

16 Apr '03

Hello list, the following problem occured when trying to filter messages generated by the program NT-syslog running on several win2k-servers and some Cisco-Routers with syslog-ng on a central loghost: - The messages from the cisco devices are logged accordingly to the log path in syslog-ng.conf. - The messages from NT-syslog end up in the "catch-all" destination and the destination in the log path is "ignored". Checking the arriving udp-packets with tcp-dump on loghost the following was observed: - Packets coming from cisco-devices have source port 514 and the IP "don't fragment" flag is not set. - Packets coming from NT-syslog have source ports above 1024 and the IP "don't fragment" flag is not set. A "handcrafted" UDP syslog-message packet with Source-Port !=514 and a source adress of one of the NT-hosts and the IP "don't fragment" flag set will be logged according to the log path in syslog-ng.conf !! If IP "don't fragment" is not set, the message will end up in the fallback- destination. Has anyone else noticed a similar behaviour of syslog-ng? Maybe someone has a hint where to start debugging this problem? The problem is observed with syslog-ng version 1.6.0rc1 / libol 0.3.9 syslog-ng version 1.4.17 / libol 0.2.23 running on NetBSD-1.6 (i686) gcc-2.95.3 20010315 NetBSD linux-2.4.20 (stock source) / glibc-2.2.5 (i686) gcc 2.96 20000731 RedHat linux-2.4.20-pre4 (kernel.org) / glibc-2.3.1 (i686) gcc 3.2.1 Gentoo Relevant excerpt from syslog-ng.conf: =============<snip>================= # source source s_net { udp(); }; # destinations # cisco destination d_cons_pix { file("/dev/tty3"); }; # for special reasons ... destination d_pix { file("/var/log/pixlog_$YEAR_$MONTH_$DAY"); }; destination d_liss { file("/var/log/lisslog_$YEAR_$MONTH_$DAY"); }; destination d_router { file("/var/log/routerlog_$YEAR_$MONTH_$DAY"); }; # NT-syslog test destination d_rrwk { file("/var/log/rrwk_$YEAR_$MONTH_$DAY"); }; destination d_prt2 { file("/var/log/prt2_$YEAR_$MONTH_$DAY"); }; destination d_neko { file("/var/log/neko_$YEAR_$MONTH_$DAY"); }; # fallback destination d_netrest { file("/var/log/netrest"); }; # filters # cisco filter f_pix { host("192.168.10.1"); }; filter f_liss { host("192.168.10.3"); }; filter f_router { host(192.168.201.5) or host(192.168.250.10); }; # NT-syslog test filter f_rrwk { host(192.168.100.192); }; filter f_neko { host(192.168.100.190); }; filter f_prt2 { host(192.168.110.22); }; # log sentences # cisco log { source(s_net); filter(f_pix); destination(d_pix); destination(d_cons_pix); log { source(s_net); filter(f_liss); destination(d_liss); }; log { source(s_net); filter(f_router); destination(d_router); }; # NT-syslog test log { source(s_net); filter(f_rrwk); destination(d_rrwk); }; log { source(s_net); filter(f_prt2); destination(d_prt2); }; log { source(s_net); filter(f_neko); destination(d_neko); }; # fallback log { source(s_net); destination(d_netrest); flags(fallback); }; ==================<snip>================ Any help will be much appreciated. Kind regards Raine Ruecker

1 0

Macros don't expand
by Peter Österberg 15 Apr '03

15 Apr '03

Hi there I've problems with macros. I've tried a few different config files now and macros don't seem to work in any of them. Here's a short sample: source src { unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("$HOST\n") ); }; destination console { usertty("root" template("HELLO $HOST\n")); }; log { source(src); destination(d_mysql); destination(console); }; Since I don't get anything in my mysql server at the moment I run this to check the fifo 'cat < /tmp/mysql.pipe' All that I get is the linefeed from \n And on my console I only get HELLO \n The macros don't seem to expand not just $HOST. I run syslog-ng 1.6.0rc2 on a Slackware 9.0 box. Thank you! /peter

1 0

Catch All Statement
by Doug Peterson 15 Apr '03

15 Apr '03

Howdy -- I am a syslog-ng newbie, and am setting it up for the first time. I would like to have logs for all my machines end up in the same files they have always ended up in (messages, cron, maillog, etc), so I have setup rules, that so far seem to be handling this quite well :) However, I want to make sure that there aren't any unlogged requests coming through, so I tried setting up a catchall statement. However when I log something to local5.debug using logger (which there is no filter for), it doesn't end up in my "other" logfile. it just disappears as far as I can tell. I tried pasting the whole config file inline, however yahoo's editor screws up the formatting. SO, I've posted the config file at http://www.muck.net/syslog-ng/syslog-ng-conf.txt and I will paste the relevent lines below (note I do not have a filter statement for catchall, should I? I wouldn't know how to do that). destination other { file("/var/log/other" owner(root) group(root) perm(0600) ); }; log { source(src_local); source(src_network); destination(other); flags(fallback); }; Any help is greatly appreciated. :) __________________________________________________ Do you Yahoo!? Yahoo! Tax Center - File online, calculators, forms, and more http://tax.yahoo.com

5 11

RE: [syslog-ng]permission denied on syslog-ng
by Clausing, James A (Jim), SOLCM 15 Apr '03

15 Apr '03

As root run # sh -x /etc/init.d/syslog-ng start This will show the script executing. Respond back to the list and let us know where in the script the error is being generated (the last few lines with '+' in front of them). Then also give us the complete error message. We don't have enough info to troubleshoot this. -----Original Message----- From: Nica Smith [mailto:wanderlust27@lycos.com] Sent: Tuesday, April 15, 2003 04:30 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]permission denied on syslog-ng my syslog-ng.conf is located at usr/local/etc/syslog-ng/syslog-ng.conf then i copied init.d.RedHat-7.3 /etc/init.d (from contrib) to /etc/init.d/syslog-ng when i do /etc/init.d/syslog-ng start, i received an error "permission denied". what did i miss? need ur help. tnx. - wander ____________________________________________________________ Get advanced SPAM filtering on Webmail or POP Mail ... Get Lycos Mail! http://login.mail.lycos.com/r/referral?aid=27005 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

segfault signal 11, core dump, 1.5.26, 1.6.0rc1
by narancs 15 Apr '03

15 Apr '03

Hi all folks! I have a debian woody with kernel 2.4.20 on i386. it is a network log collector server with several udp and tcp sources. also some sources come from behind firewalls. it was working for weeks w/o problems with the 1.5.26-1.deb downloaded directly from balabit site. before that it was working for months with the 1.5.1x woody default pkg. which doesn't really work well with tcp connections. (that's why the upgrade happened) since some days the daemon segfaults each 2-5 minutes and dumps core. I have compiled on a woody machine the 1.6.0rc1 but that acts the same. I've tried with different config modifications, but it acts the same. Now after debugging it for days/hours I am really angry not finding the root of the problem. Also memtest86 found the memory clean and all other services on the machine are working fine. How should I fix this situation and get this working again? we have critical bussiness apps related to this service. thanks

2 4

permission denied on syslog-ng
by Nica Smith 15 Apr '03

15 Apr '03

my syslog-ng.conf is located at usr/local/etc/syslog-ng/syslog-ng.conf then i copied init.d.RedHat-7.3 /etc/init.d (from contrib) to /etc/init.d/syslog-ng when i do /etc/init.d/syslog-ng start, i received an error "permission denied". what did i miss? need ur help. tnx. - wander ____________________________________________________________ Get advanced SPAM filtering on Webmail or POP Mail ... Get Lycos Mail! http://login.mail.lycos.com/r/referral?aid=27005

1 0

RE: [syslog-ng]syslog-ng solaris clients
by Hamilton, Andrew 14 Apr '03

14 Apr '03

Are you using syslogd? What does your syslog.conf look like? Are you running old syslog on the linux servers? Regards, Drew -----Original Message----- From: Hong Tian [mailto:htian@ias.edu] Sent: Monday, April 14, 2003 11:41 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng solaris clients Hi, I set up a central syslog-ng server (syslog-ng-1.6.0rc1) on Redhat 7.3. It works good for all remote Linux clients, but it didn't work with remote Sun Solaris clients. The central syslog-ng server couldn't receive any log messages from solaris machines. Does anyone knows what is the problem? Should I do something more or different on remote Solaris clients than remote Linux clients? Thanks for your help. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0