May 2003 - syslog-ng - lists.balabit.hu

failover
by Joxn 21 May '03

21 May '03

Hi everybody, I log messages to a remote server. But what happens if that server is not reachable? Is there a way to implement a failover to second server? Thanks very much in advance. bye Joxn

2 2

100% newbie match question
by Michael Hare 19 May '03

19 May '03

Guys- I know a little bit about syslog-ng, and a little bit about regular expressions. I haven't been able to put the two together to come up with a match expression that has the following behavior; match lines that do -not- contain word FOO. The thing I tried that I thought would work, but didn't, was "^[FOO]". Help? Thanks- -Michael /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ Michael Hare UW-Madison/WiscNet Network Engineering My phone: 608-262-5236 24-Hour NOC: 608-263-4188 WiscNet: 608-265-6761

2 1

Running syslong-ng from init?
by Jonathon Ross 19 May '03

19 May '03

syslog-ng seems to die on me from time to time. (I whish I had more info on why to share with you, but there doesn't seem to be anyting in the logs). I'd like to run syslog-ng out of init, but I can't seem to find a way to keep it from fork()-ing. Could anyone offer some advice? Thanks, -Jon ------------------------------------------------------------------------ This message is for the designated recipient only and may contain privileged or confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email is prohibited. -----------------------------------------------------------------------!

3 2

Can I add "chain_hostnames(no)" to source?
by Jason Haar 16 May '03

16 May '03

Well, under 1.6.0rc3 I know I can't :-) I'm trying to do: source s_local { internal(); tcp(ip("1.2.3.4") chain_hostnames(yes)); udp( chain_hostnames(no)); } ...so that UDP-based client get records with their DNS PTR hostnames, whereas TCP-based clients (which are other "collector" servers) are allowed to present the hostname as part of the record. Is this possible? I'm hoping I just have the format wrong. -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 1

RE: [syslog-ng]syslog-ng macros did not work
by Christian Osbahr 14 May '03

14 May '03

Hi, The macro expansion didn't seem to work right in 1.6rc2. Download 1.6rc3 and you should be fine. Best regards, Christian -----Original Message----- From: Hoffmann, Mathias [mailto:Mathias.Hoffmann@access-7.de] Sent: 14. maj 2003 11:54 To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng macros did not work Hi, I'm new to syslog-ng and set up syslog-ng-1.6.0rc2 on a Solaris 2.6 box as central logging station (of sure - testing). Meanwhile it collect data from two other hosts and itself. I use the following statements found at syslog-ng FAQ or examples: source src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); udp(ip(192.168.77.20) port(514)); udp(ip(192.168.76.20) port(514)); }; destination hosts { file("/var/net/hosts/$HOST/$YEAR/$MONTH/$DAY/$YEAR$MONTH$DAY" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; What happend is, syslog-ng creates the hosts dir in /var/net and a file $DAY with all the logged data in hosts: no $HOST dir, no $YEAR, $MONTH or $DAY directory. Even if I omit $HOST (assuming any problems resolving the hostnames of the two senders), no additional directoryy is created. Also commenting use_dns or use_fqdn made noch change. Maybe I made some simple mistakes - so any help is welcome Mathias complete config: ========== options { long_hostnames(off); # doesn't actually help on Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(1); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(2048); # I hate Vignette StoryServer bad_hostname("^(ctld.|cmd|tmd|last)$"); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); use_fqdn(yes); use_dns(yes); dns_cache(yes); keep_hostname(yes); owner(root); group(root); perm(0644); dir_perm(0755); create_dirs(yes); use_time_recvd(yes); }; source src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); udp(ip(192.168.77.20) port(514)); udp(ip(192.168.76.20) port(514)); }; destination hosts { file("/vol_a/var/net/hosts/$HOST/$YEAR/$MONTH/$DAY/$YEAR$MONTH$DAY" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; log { source(src); destination(hosts); }; destination loghost { tcp("192.168.77.20" port(514)); tcp("192.168.77.20" port(514)); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng macros did not work
by Hoffmann, Mathias 14 May '03

14 May '03

Hi, I'm new to syslog-ng and set up syslog-ng-1.6.0rc2 on a Solaris 2.6 box as central logging station (of sure - testing). Meanwhile it collect data from two other hosts and itself. I use the following statements found at syslog-ng FAQ or examples: source src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); udp(ip(192.168.77.20) port(514)); udp(ip(192.168.76.20) port(514)); }; destination hosts { file("/var/net/hosts/$HOST/$YEAR/$MONTH/$DAY/$YEAR$MONTH$DAY" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; What happend is, syslog-ng creates the hosts dir in /var/net and a file $DAY with all the logged data in hosts: no $HOST dir, no $YEAR, $MONTH or $DAY directory. Even if I omit $HOST (assuming any problems resolving the hostnames of the two senders), no additional directoryy is created. Also commenting use_dns or use_fqdn made noch change. Maybe I made some simple mistakes - so any help is welcome Mathias complete config: ========== options { long_hostnames(off); # doesn't actually help on Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(1); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(2048); # I hate Vignette StoryServer bad_hostname("^(ctld.|cmd|tmd|last)$"); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); use_fqdn(yes); use_dns(yes); dns_cache(yes); keep_hostname(yes); owner(root); group(root); perm(0644); dir_perm(0755); create_dirs(yes); use_time_recvd(yes); }; source src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); udp(ip(192.168.77.20) port(514)); udp(ip(192.168.76.20) port(514)); }; destination hosts { file("/vol_a/var/net/hosts/$HOST/$YEAR/$MONTH/$DAY/$YEAR$MONTH$DAY" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; log { source(src); destination(hosts); }; destination loghost { tcp("192.168.77.20" port(514)); tcp("192.168.77.20" port(514)); };

1 0

I can't force syslog-ng works with multihomed PC
by Alexander Chernyh 13 May '03

13 May '03

Hello I need that syslog-ng listen internal and external interface of my log-server See part of my syslog-ng.conf #more syslog-ng.conf options { use_time_recvd(yes); use_dns(yes); keep_hostname(no); long_hostnames(off); sync(0); }; source src { unix-dgram("/var/run/log"); internal(); file("/dev/klog"); udp(ip(0.0.0.0) port(514)); }; #/usr/local/etc/rc.d/syslog-ng.sh start #sockstat -4 | grep syslog-ng root syslog-n 59796 6 udp4 *:514 *:* root syslog-n 59796 9 ? ? ? #sockstat -4 | grep syslog-ng root syslog-n 59796 6 udp4 *:514 *:* root syslog-n 59796 9 udp4 *:1445 *:* #sockstat -4 | grep syslog-ng root syslog-n 59796 6 udp4 *:514 *:* root syslog-n 59796 9 udp4 *:1448 *:* #sockstat -4 | grep syslog-ng root syslog-n 59796 6 udp4 *:514 *:* root syslog-n 59796 9 udp4 *:1449 *:* syslog-ng listen on 514 port for all interfaces (multihomed PC with internal and external interface), but why does syslog-ng dynamicaly listen other ports, not typed in syslog-ng.conf file??? It is too bad because logs from other hosts partially lost. If syslog-ng listen on internat interface only - all works OK. FreeBSD 4.8 Syslog-ng 1.6.0.rc3 Alexander

2 1

I can't force syslog-ng works with multihomed PC
by Alexander Chernyh 13 May '03

13 May '03

Hello I need that syslog-ng listen internal and external interface of my log-server See part of my syslog-ng.conf #more syslog-ng.conf options { use_time_recvd(yes); use_dns(yes); keep_hostname(no); long_hostnames(off); sync(0); }; source src { unix-dgram("/var/run/log"); internal(); file("/dev/klog"); udp(ip(0.0.0.0) port(514)); }; #/usr/local/etc/rc.d/syslog-ng.sh start #sockstat -4 | grep syslog-ng root syslog-n 59796 6 udp4 *:514 *:* root syslog-n 59796 9 ? ? ? #sockstat -4 | grep syslog-ng root syslog-n 59796 6 udp4 *:514 *:* root syslog-n 59796 9 udp4 *:1445 *:* #sockstat -4 | grep syslog-ng root syslog-n 59796 6 udp4 *:514 *:* root syslog-n 59796 9 udp4 *:1448 *:* #sockstat -4 | grep syslog-ng root syslog-n 59796 6 udp4 *:514 *:* root syslog-n 59796 9 udp4 *:1449 *:* syslog-ng listen on 514 port for all interfaces (multihomed PC with internal and external interface), but why does syslog-ng dynamicaly listen other ports, not typed in syslog-ng.conf file??? It is too bad because logs from other hosts partially lost. If syslog-ng listen on internat interface only - all works OK. FreeBSD 4.8 Syslog-ng 1.6.0.rc3 Alexander

1 0

remote logging from syslog to syslog-ng
by Joxn 12 May '03

12 May '03

Hi everybody, I am new to this list and don't use syslog-ng yet, but it all sounds very promising - and I will switch immediately if syslog-ng can do the following: We have a couple (50 - 100) clients that use syslog. Some (but not all) could be switched to use syslog-ng (on OpenBSD 3.3). We want to set up a central logging server running syslog-ng. Here we want to create directories based on the remote-client's MAC address and also add the information to a Postgres database. I already saw that it is possible to log to the DB. However, most important is that the syslog-clients could report to the syslog-ng server. How would I do that, if possible? Thank you very much in advance, Joxn

1 0

I can't force syslog-ng works with multihomed PC
by Alexander Chernyh 12 May '03

12 May '03

Hello I need that syslog-ng listen internal and external interface of my log-server See part of my syslog-ng.conf #more syslog-ng.conf options { use_time_recvd(yes); use_dns(yes); keep_hostname(no); long_hostnames(off); sync(0); }; source src { unix-dgram("/var/run/log"); internal(); file("/dev/klog"); udp(ip(0.0.0.0) port(514)); }; #/usr/local/etc/rc.d/syslog-ng.sh start #sockstat -4 | grep syslog-ng root syslog-n 59796 6 udp4 *:514 *:* root syslog-n 59796 9 ? ? ? #sockstat -4 | grep syslog-ng root syslog-n 59796 6 udp4 *:514 *:* root syslog-n 59796 9 udp4 *:1445 *:* #sockstat -4 | grep syslog-ng root syslog-n 59796 6 udp4 *:514 *:* root syslog-n 59796 9 udp4 *:1448 *:* #sockstat -4 | grep syslog-ng root syslog-n 59796 6 udp4 *:514 *:* root syslog-n 59796 9 udp4 *:1449 *:* syslog-ng listen on 514 port for all interfaces (multihomed PC with internal and external interface), but why does syslog-ng dynamicaly listen other ports, not typed in syslog-ng.conf file??? It is too bad because logs from other hosts partially lost. If syslog-ng listen on internat interface only - all works OK. FreeBSD 4.8 Syslog-ng 1.6.0.rc3 Alexander

1 0