April 2003 - syslog-ng - lists.balabit.hu

syslog-ng solaris clients
by Hong Tian 14 Apr '03

14 Apr '03

Hi, I set up a central syslog-ng server (syslog-ng-1.6.0rc1) on Redhat 7.3. It works good for all remote Linux clients, but it didn't work with remote Sun Solaris clients. The central syslog-ng server couldn't receive any log messages from solaris machines. Does anyone knows what is the problem? Should I do something more or different on remote Solaris clients than remote Linux clients? Thanks for your help.

1 0

RE: [syslog-ng]syslog-ng
by Hamilton, Andrew 14 Apr '03

14 Apr '03

See embedded remarks... Regards, Drew -----Original Message----- From: Hong Tian [mailto:htian@ias.edu] Sent: Friday, April 11, 2003 5:51 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng Hi, Our purpose is to set up a syslog-ng server to receive the log messages from other unix servers (linux and solaris) based on each hostname. I am setting syslog-ng 1.6 on Red Hat 7.3 for the first time. The compiling installation looks ok (./configure, make, and make install) on both libol-0.3.9 and syslog-ng-1.6.0rc1. After compiling I copied a starup script and a syslog-ng.conf as followings: # cp syslog-ng-1.6.0rc1/contrib/syslog-ng.conf.RedHat /etc/syslog-ng/syslog-ng.conf # cp syslog-ng-1.6.0rc1/contrib/init.d.RedHat-7.3 /etc/init.d/syslog-ng # /etc/init.d/syslog stop # /etc/init.d/syslog-ng start Starting syslog-ng: Cannot open configuration file /usr/local/etc/syslog-ng/syslog-ng.conf for reading Parse error reading configuration file, exiting. (line 1) [Failed] Only after I moved syslog-ng.conf to /usr/local/etc/syslog-ng, syslog-ng could start. # mv /etc/syslog-ng/syslog-ng.conf /usr/local/etc/syslog-ng # /etc/init.d/syslog-ng start Starting syslog-ng: [ OK ] (1) My question is why it forced me to use /usr/local/etc/syslog-ng instead of default location of /etc/syslog-ng/syslog-ng.conf? **** /usr/local/etc/syslog-ng is the default not /etc/syslog-ng, you can either **** modify this at compile time or start syslog-ng with the -f flag and point **** it to /etc/syslog-ng/syslog-ng.conf (2) After starting syslog-ng, I am trying to set up a basic config file to receive log messages from each Unix servers based on hostname. I am look for the good examples of a basic config file for my requirments. Could anyone provide some information? **** You can use a destination with a predfined macro called $HOST i.e. **** destination d_hosts { file("/var/log/hosts/$HOST.log"); }; (3) I think that I only need to install syslog-ng on the central log server. I don't need to install syslog-ng on every Unix servers, am I right? If I don't need to install syslog-ng on each syslog-ng client, should I do anything on each syslog-ng client? **** This is correct. You don't have to use syslog-ng on the clients. **** Unless you want to use something like tcp. Thanks, Hong _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

feature request - adding template functonality to program()
by email lists 13 Apr '03

13 Apr '03

Hi All, Such functionality already exists for pipe() and file() destination types so extending this to the program() destination type I imagine would not be too difficult nor time consuming. The following scenarios would benefit from this: - move logic to e-mail type notifications (and othe custom scripts) back into syslog-ng.conf - adds flexibility of formating sql statements and passing the sql statements directly into the database (having the near real time advantages of using pipe(), but having a reliability closer to a db buffer file as the process in not likely to die unexpectedly). tia, Darren Mackay

2 1

Syslog-ng 1.6.0rc2 specfile (20030412 snapshot)
by Jose Pedro Oliveira 12 Apr '03

12 Apr '03

Balazs Scheidler, The attached patch does the following: - creates two new files in the contrib directory * a logrotate file for Red Hat systems * a sysconfig file also for Red Hat systems - reorganizes the spec file - corrects the %post, %postun, and %preun scripts - pumps the libol version to 0.3.10 - creates an option for future inclusion of mysql related files (commented all the files containing references Requirements: Apply first the patch in this email (still not included in the latest snapshots) https://lists.balabit.hu/pipermail/syslog-ng/2003-April/004896.html Regards, jpo -- José Pedro Oliveira mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo diff -ruN syslog-ng-1.6.0rc2+20030412manual-original/contrib/syslog-ng.logrotate syslog-ng-1.6.0rc2+20030412manual-modified/contrib/syslog-ng.logrotate --- syslog-ng-1.6.0rc2+20030412manual-original/contrib/syslog-ng.logrotate Thu Jan 1 01:00:00 1970 +++ syslog-ng-1.6.0rc2+20030412manual-modified/contrib/syslog-ng.logrotate Tue Mar 18 20:51:55 2003 @@ -0,0 +1,6 @@ +/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron { + sharedscripts + postrotate + /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true + endscript +} diff -ruN syslog-ng-1.6.0rc2+20030412manual-original/contrib/syslog-ng.sysconfig syslog-ng-1.6.0rc2+20030412manual-modified/contrib/syslog-ng.sysconfig --- syslog-ng-1.6.0rc2+20030412manual-original/contrib/syslog-ng.sysconfig Thu Jan 1 01:00:00 1970 +++ syslog-ng-1.6.0rc2+20030412manual-modified/contrib/syslog-ng.sysconfig Tue Mar 18 21:42:33 2003 @@ -0,0 +1,15 @@ +#---------------------------------------------------------------------- +# Options +#---------------------------------------------------------------------- +# -C - <chroot-dir> +# -d - Set "debug mode". Prints out various messages to aid in +# debugging and stops it from becoming a daemon. To activate +# debugging in the yacc parser, either use this option twice or +# combine with -v. +# -p - <filename> Write the current PID information to the specified +# file. +# -v - Enable verbose mode. Process will not become a daemon. Prints +# out fewer messages, compared to -d. +# -V - Print the version number. +#---------------------------------------------------------------------- +SYSLOGNG_OPTIONS="" diff -ruN syslog-ng-1.6.0rc2+20030412manual-original/syslog-ng.spec.in syslog-ng-1.6.0rc2+20030412manual-modified/syslog-ng.spec.in --- syslog-ng-1.6.0rc2+20030412manual-original/syslog-ng.spec.in Thu Apr 10 11:51:00 2003 +++ syslog-ng-1.6.0rc2+20030412manual-modified/syslog-ng.spec.in Sat Apr 12 18:40:15 2003 @@ -1,44 +1,31 @@ -#-------------------------------------------------------------------------------- -# Program: syslog-ng.spec -# -# Purpose: This is the data file user to genertae RPM files so that we can -# distrbute 'canned' versions of what we have done more easily. -#-------------------------------------------------------------------------------- -# 08-Dec-02 - REP - Initial version - -#-------------------------------------------------------------------------------- -# Some basic definitions for use to use later in the file. We really only want -# to define things once, and have to change things in only one place. -#-------------------------------------------------------------------------------- -%define name syslog-ng -%define version @VERSION@ -%define release 1 -%define libver 0.3.9 -%define mandir /usr/share/man -%define sbindir /sbin - -#-------------------------------------------------------------------------------- -# Basic package information -#-------------------------------------------------------------------------------- +%define libver 0.3.10 +%define sbindir /sbin + +%define con_mysql 0 + +# Overriding default with --define: +# rpm -ba --define 'with_mysql 1' +%{?with_mysql:%define con_mysql 1} + + Summary: Syslog replacement daemon -Name: %{name} -Version: %{version} -Release: %{release} -Group: System/Kernel and hardware +Name: syslog-ng +Version: @VERSION@ +Release: 1 +Group: System Environment/Daemons License: GPL Url: http://www.balabit.com/products/syslog_ng/ -Source0: %{name}-%{version}.tar.gz -Source1: syslog-ng.conf -Source2: syslog-ng.init -Source3: mysql-syslog.pipe -Source4: mysql-syslog.buffer -Source5: syslog-ng.sysconfig -Requires: libol >= %{libver} -Buildroot: %{_tmppath}/%{name}-buildroot - -#-------------------------------------------------------------------------------- -# Description of the package -#-------------------------------------------------------------------------------- +Source: http://www.balabit.hu/downloads/syslog-ng/1.6/%{name}-%{version}.tar.gz +#Source1: mysql-syslog.pipe +#Source2: mysql-syslog.buffer +Buildroot: %{_tmppath}/%{name}-%{version}-buildroot +BuildRequires: libol-devel >= %{libver} +BuildRequires: tcp_wrappers +Requires(post,preun): chkconfig +Requires(postun,preun): initscripts +Conflicts: sysklogd + + %description syslog-ng, as the name shows, is a syslogd replacement, but with new functionality for the new generation. The original syslogd allows @@ -48,95 +35,88 @@ Forwarding logs over TCP and remembering all forwarding hops makes it ideal for firewalled environments. -#-------------------------------------------------------------------------------- -# What things to do in preperation of making the package -#-------------------------------------------------------------------------------- %prep -%setup +%setup -q -#-------------------------------------------------------------------------------- -# The build process for the package -#-------------------------------------------------------------------------------- %build - -#-------------------------------------------------------------------------------- -# Configuration process for the package -#-------------------------------------------------------------------------------- -%configure --prefix=%{_prefix} \ - --sbindir=%{sbindir} \ - --sysconfdir=%{_sysconfdir} \ - --mandir=%{mandir} \ +%configure --sbindir=%{sbindir} \ --enable-tcp-wrapper make -#-------------------------------------------------------------------------------- -# The install process for the package -#-------------------------------------------------------------------------------- %install -[ -n "%{buildroot}" -a "%{buildroot}" != / ] && rm -rf %{buildroot} -mkdir -p %{buildroot}%{_initrddir} -mkdir -p %{buildroot}%{_sysconfdir}/%{name} -mkdir -p %{buildroot}/etc/sysconfig - -make DESTDIR=%{buildroot} mandir=%{_mandir} install-strip - -install -m644 %{SOURCE1} %{buildroot}%{_sysconfdir}/%{name}/syslog-ng.conf -install -m755 %{SOURCE2} %{buildroot}%{_initrddir}/syslog-ng -install -m700 %{SOURCE3} %{buildroot}%{_sysconfdir}/%{name}/mysql-syslog.pipe -install -m700 %{SOURCE4} %{buildroot}%{_sysconfdir}/%{name}/mysql-syslog.buffer -install -m700 %{SOURCE5} %{buildroot}/etc/sysconfig/syslog-ng - -#-------------------------------------------------------------------------------- -# Things to run after it has been installed. We will be adding syslog-ng to the -# startup, and shutting down the old syslog -#-------------------------------------------------------------------------------- +rm -rf ${RPM_BUILD_ROOT} + +#make DESTDIR=%{RPM_BUILD_ROOT} mandir=%{_mandir} install-strip +%makeinstall sbindir=$RPM_BUILD_ROOT%{sbindir} +# +# Problem: the binary RPM is being assembled with an unstripped +# version of syslog-ng. +# Solution: strip file manually. +# +strip $RPM_BUILD_ROOT%{sbindir}/%{name} + +install -d $RPM_BUILD_ROOT%{_initrddir} +install -d $RPM_BUILD_ROOT%{_sysconfdir}/%{name} +install -d $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig +install -d $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d + +install -m755 contrib/init.d.RedHat-7.3 $RPM_BUILD_ROOT%{_initrddir}/syslog-ng +install -m644 contrib/syslog-ng.conf.RedHat $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/syslog-ng.conf +install -m644 contrib/syslog-ng.sysconfig $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/syslog-ng +install -m644 contrib/syslog-ng.logrotate $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/syslog-ng +%if %{con_mysql} +#install -m700 %{SOURCE1} $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/mysql-syslog.pipe +#install -m700 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/mysql-syslog.buffer +%endif + + %post +# rpm {-i|-U|-F} /sbin/chkconfig --add syslog-ng -/sbin/chkconfig --del syslog -sed -e "s/syslogd/syslog-ng/g" /etc/logrotate.d/syslog > /tmp/syslog-ng.tmp.$$ -cp -f /tmp/syslog-ng.tmp.$$ /etc/logrotate.d/syslog -rm -f /tmp/syslog-ng.tmp.$$ - -#-------------------------------------------------------------------------------- -# Well, if we uninstall, then we need to put some syslog in place to run for -# this system. -#-------------------------------------------------------------------------------- + %preun -/sbin/chkconfig --del syslog-ng -/sbin/chkconfig --add syslog -sed -e "s/syslog-ng/syslogd/g" /etc/logrotate.d/syslog > /tmp/syslog-ng.tmp.$$ -cp -f /tmp/syslog-ng.tmp.$$ /etc/logrotate.d/syslog -rm -f /tmp/syslog-ng.tmp.$$ - -#-------------------------------------------------------------------------------- -# What files and permissions are included in the package -#-------------------------------------------------------------------------------- +# only rpm -e (not rpm {-U|-F}) +if [ $1 = 0 ]; then + /sbin/service syslog-ng stop > /dev/null 2>&1 + /sbin/chkconfig --del syslog-ng +fi + +%postun +# only rpm {-U|-F} (not rpm -e) +if [ $1 = 1 ]; then + /sbin/service syslog-ng condrestart > /dev/null 2>&1 +fi + + %files %defattr(-,root,root) %doc AUTHORS COPYING README ChangeLog INSTALL NEWS PORTS -%doc doc/sgml/syslog-ng.txt +%doc doc/sgml/syslog-ng.txt doc/sgml/syslog-ng.ps %doc doc/*.demo doc/*.sample doc/*.solaris -%config(noreplace) %{_sysconfdir}/%{name}/syslog-ng.conf -%config(noreplace) %{_sysconfdir}/%{name}/mysql-syslog.pipe -%config(noreplace) %{_sysconfdir}/%{name}/mysql-syslog.buffer +%doc contrib/syslog2ng doc/stresstest.sh %config(noreplace) %{_initrddir}/syslog-ng -%config(noreplace) /etc/sysconfig/syslog-ng +%config(noreplace) %{_sysconfdir}/%{name}/syslog-ng.conf +%config(noreplace) %{_sysconfdir}/sysconfig/syslog-ng +%config(noreplace) %{_sysconfdir}/logrotate.d/syslog-ng +%if %{con_mysql} +#%config(noreplace) %{_sysconfdir}/%{name}/mysql-syslog.pipe +#%config(noreplace) %{_sysconfdir}/%{name}/mysql-syslog.buffer +%endif %{sbindir}/syslog-ng -%{_mandir}/man5/syslog-ng.conf.5* -%{_mandir}/man8/syslog-ng.8* +%{_mandir}/man5/* +%{_mandir}/man8/* + -#-------------------------------------------------------------------------------- -# What final cleanup should occur after the package construction has been -# completed -#-------------------------------------------------------------------------------- %clean -[ -n "%{buildroot}" -a "%{buildroot}" != / ] && rm -rf %{buildroot} -rm -r $RPM_BUILD_DIR/%{name}-%{version} +rm -rf ${RPM_BUILD_ROOT} + -#-------------------------------------------------------------------------------- -# Changelog -#-------------------------------------------------------------------------------- %changelog +* Sat Apr 12 2003 Jose Pedro Oliveira <jpo(a)di.uminho.pt> 1.6.0rc2 snapshot + - Reorganized specfile + - Corrected the scripts (%post, %postun, and %preun) + - Commented the mysql related lines; create an option for future inclusion + * Thu Feb 27 2003 Richard E. Perlotto II <richard(a)perlotto.com> 1.6.0rc1-1 - Updated for new version

2 1

Losing 25% of messages using UDP
by Bill Graham 12 Apr '03

12 Apr '03

I have syslog-ng-1.6.0rc1 compiled on Solaris 9 and I am intend to use the system as a central log server and I need to log every message that makes it to the system. I am testing it out with Kiwi Syslog Message generator with bursts of 100 messages every 10 seconds. Syslog-ng is only logging about 20-25% of the messages. I have verified that the messages are getting to the system. Is there some additional tuning that I have to do to get this to work. Here is a copy of my syslog-ng: options { use_fqdn(yes); keep_hostname(yes); use_dns(no); long_hostnames(off); sync(0); gc_idle_threshold(5000); gc_busy_threshold(1000); log_fifo_size(10240); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source network { udp();}; destination all { file("/var/log/messages"); }; log { source(local); destination(all); }; log { source(network); destination(all); }; Thanks, Bill

4 11

syslog-ng
by Hong Tian 11 Apr '03

11 Apr '03

Hi, Our purpose is to set up a syslog-ng server to receive the log messages from other unix servers (linux and solaris) based on each hostname. I am setting syslog-ng 1.6 on Red Hat 7.3 for the first time. The compiling installation looks ok (./configure, make, and make install) on both libol-0.3.9 and syslog-ng-1.6.0rc1. After compiling I copied a starup script and a syslog-ng.conf as followings: # cp syslog-ng-1.6.0rc1/contrib/syslog-ng.conf.RedHat /etc/syslog-ng/syslog-ng.conf # cp syslog-ng-1.6.0rc1/contrib/init.d.RedHat-7.3 /etc/init.d/syslog-ng # /etc/init.d/syslog stop # /etc/init.d/syslog-ng start Starting syslog-ng: Cannot open configuration file /usr/local/etc/syslog-ng/syslog-ng.conf for reading Parse error reading configuration file, exiting. (line 1) [Failed] Only after I moved syslog-ng.conf to /usr/local/etc/syslog-ng, syslog-ng could start. # mv /etc/syslog-ng/syslog-ng.conf /usr/local/etc/syslog-ng # /etc/init.d/syslog-ng start Starting syslog-ng: [ OK ] (1) My question is why it forced me to use /usr/local/etc/syslog-ng instead of default location of /etc/syslog-ng/syslog-ng.conf? (2) After starting syslog-ng, I am trying to set up a basic config file to receive log messages from each Unix servers based on hostname. I am look for the good examples of a basic config file for my requirments. Could anyone provide some information? (3) I think that I only need to install syslog-ng on the central log server. I don't need to install syslog-ng on every Unix servers, am I right? If I don't need to install syslog-ng on each syslog-ng client, should I do anything on each syslog-ng client? Thanks, Hong

1 0

snapshots of 1.6.0rc2 available
by Balazs Scheidler 11 Apr '03

11 Apr '03

Hi, Although not officially released, I have uploaded a test version of 1.6.0rc2 to our website: http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshots/syslog-ng-1.6.… The accompanying libol snapshot is also available. This release should fix the configure problems in 1.6.0rc1 and also adds performance improvements with the gperf based macro name resolution. If no problems are reported within a day or two I'll release syslog-ng 1.6.0rc2 officially. -- Bazsi

3 11

logrotate question (not working with syslog-ng)...
by seberino＠spawar.navy.mil 11 Apr '03

11 Apr '03

For some reason every time logrotate rotates /var/log/messages, my syslog-ng stops working. The permissions look ok.. [office root /var/log] # ls -l mess* -rw------- 1 root root 0 Apr 6 04:02 messages -rw------- 1 root root 378135 Apr 7 15:15 messages.1 -rw------- 1 root root 908864 Mar 31 15:50 messages.2 -rw------- 1 root root 1795514 Mar 25 14:06 messages.3 -rw------- 1 root root 945373 Mar 19 11:31 messages.4 -rw------- 1 root root 7 Apr 7 14:24 messages.offset Why does logrotate cause syslog-ng to not put any new stuff in /var/log/messages? Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

7 21

syslog-ng 1.6.0rc1 a bit erratic at kernel logs
by Jason Haar 11 Apr '03

11 Apr '03

Hi there We've got a central syslog-ng server here with incoming feeds from old syslog clients (HPUX,Cisco,printers,etc) as well as TCP-based feeds from syslog-ng clients. In general it all works well. However, there seems to be a problem with kernel messages on the localhost. The fact that they are processname=kernel appears to be lost on syslog-ng - instead of seeing: server kern info kernel: device eth0 left promiscuous mode I see server kern info device eth0 left promiscuous mode This is with a template of: template("$R_ISODATE $HOST $FACILITY $PRIORITY $MSG\n") As it only seems to affect kernel messages on syslog-ng hosts, I think it's more of a generation problem than a receiving problem. On all the hosts affected, then source entry is: source s_local { internal(); unix-stream("/dev/log" keep-alive(yes) max-connections(100)); pipe("/proc/kmsg"); unix-stream("/var/spool/mysqld/dev/log" keep-alive(yes) max-con nections(10)); unix-stream("/var/log/snort/dev/log" keep-alive(yes) max-connect ions(10)); tcp(ip("1.2.3.4") port(514) keep-alive(yes) max-connections( 100)); tcp(ip("127.0.0.1") port(514) keep-alive(yes) max-connections(1 00)); udp(); }; Any ideas what's wrong/bug? Thanks for a great product! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 2

Syslog-ng conf file options not working!!!!
by TIM MOORE 10 Apr '03

10 Apr '03

Thanks for the help. The syntax for the second option worked. I just have to wait to see if it will work correctly. Thanks, Tim Moore DNS/Linux/Cisco Admin ODJFS

1 0