August 2003 - syslog-ng - lists.balabit.hu

How to filter XDMCP messages ?
by Gerard Breiner 12 Jan '04

12 Jan '04

Hello, I wonder how to configure syslog-ng to filtering the messages emitted by gdm_xdmcp. this type of messages pollutes my files of logs. Here is messages i don't want : "gdm[3798]: gdm_xdmcp_handle_query: Opcode 1 from ". Best regards Gerard Gerard Breiner Institut d'Astrophysique Spatiale Orsay Campus France

4 5

syslog-ng and IPSEC does anyone have any experiences eit the combination?
by Marc Spitzer 08 Sep '03

08 Sep '03

I am doing some logging infrastructure research and I am looking into syslog-ng and IPSEC, does any experience with this setup? Thanks marc -- NOTICE: If received in error, please destroy and notify sender. Sender does not waive confidentiality or privilege, and use is prohibited.

2 1

Sending mail to root?
by Florian Lindner 02 Sep '03

02 Sep '03

Hello, I try to define a destination which sends the log entry to root: destination d_mailroot { program("/usr/bin/mail -s '[syslog] Exception detected' root"); }; But this is not working. mail does not notice that it should close stdin and send the mail. I think something like a EOF or at least in single line with a dot. How can I accomplish sending the mail? Thanks, Florian

4 17

Re: syslog-ng digest, Vol 1 #1033 - 15 msgs (Vacation)
by TIM MOORE 29 Aug '03

29 Aug '03

FYI: I will be out on vacation from 8/28 until 9/8. Please contact the NOC if you need immediate assistance. Thanks, Tim Moore

1 0

logging to file and remote host
by Atif Ghaffar 29 Aug '03

29 Aug '03

hi all, I am not yet a syslog-ng user. I would like to know if it is possible to do what I want with standard syslogd and if not then with syslog-ng On HP-UX 11.00 I want to log messages to a file and to remote host. Is that possible with syslogd? I tried something like mail.* /var/adm/syslog/mail.log and it works I tried mail.* @LOGHOST and it works If I put both lines then only one is used. How can I log to a file and also to LOGHOST? If it is not possible with syslog and is possible with syslog-ng, then please let me know so I can continue the reading of the manuals. best regards and thanks Atif Ghaffar

3 4

Syslog-ng on NetBSD
by Axel Gerster 28 Aug '03

28 Aug '03

Hello, I got some compile errors on syslog-ng on NetBSD. Does anyone know how to fix it? ---snap---- root@blah:/tmp/syslog-ng-1.6.0rc3# gmake Making all in src gmake[1]: Entering directory `/tmp/syslog-ng-1.6.0rc3/src' gmake all-recursive gmake[2]: Entering directory `/tmp/syslog-ng-1.6.0rc3/src' Making all in . gmake[3]: Entering directory `/tmp/syslog-ng-1.6.0rc3/src' gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c cfg-lex.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c affile.c In file included from /usr/include/arpa/inet.h:65, from affile.c:77: /usr/include/sys/param.h:222: warning: `MIN' redefined /usr/pkg/include/libol/objtypes.h:82: warning: this is the location of the previous definition /usr/include/sys/param.h:223: warning: `MAX' redefined /usr/pkg/include/libol/objtypes.h:86: warning: this is the location of the previous definition gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afsocket.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afunix.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afinet.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afinter.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afuser.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c:37: stropts.h: No such file or directory afstreams.c:38: sys/strlog.h: No such file or directory gmake[3]: *** [afstreams.o] Error 1 gmake[3]: Leaving directory `/tmp/syslog-ng-1.6.0rc3/src' gmake[2]: *** [all-recursive] Error 1 gmake[2]: Leaving directory `/tmp/syslog-ng-1.6.0rc3/src' gmake[1]: *** [all-recursive-am] Error 2 gmake[1]: Leaving directory `/tmp/syslog-ng-1.6.0rc3/src' gmake: *** [all-recursive] Error 1 --snip--- Thx very much. Axel

2 1

RE: [syslog-ng]syslog-ng and logrotate
by Naman Latif 28 Aug '03

28 Aug '03

Have you tried the "copytruncate" option in logrotate.conf ? I am using it without any problems on Solaris8. ++++++++++++++++++++ copytruncate Truncate the original log file in place after creating a copy, instead of moving the old log file and option- ally creating a new one, It can be used when some pro- gram can not be told to close its logfile and thus might continue writing (appending) to the previous log file forever. Note that there is a very small time slice between copying the file and truncating it, so some logging data might be lost. When this option is used, the create option will have no effect, as the old log file stays in place. +++++++++++++++++++++++ Regards \\ Naman > My pb : > before the log rotate, all is good. After logrotate, > syslog-ng don't write in > the remote file.

1 0

Log TCP
by Darrell 28 Aug '03

28 Aug '03

I'm new to Linux and we've decided to setup syslog-ng 1.4.17 on Redhat 8 at work. I'm trying to centralize the logs using TCP for all of our Cisco routers, Nortel firewalls and switches. I need to know what lines to enter and where to enter them in my syslog-ng.conf file. Any help would be greatly appreciated. ----------------------------------- Darrell IT Support

2 1

RE: [syslog-ng]syslog-ng and logrotate
by William Rhodes 28 Aug '03

28 Aug '03

Had the same problem and found that syslog-ng has a problem with the kill -HUP that logrotate uses. I replaced that command with /etc/rc.d/init.d/syslog-ng reload and all works fine with no problems. William -----Original Message----- From: yannick.haguenier(a)tuxfamily.org [mailto:yannick.haguenier@tuxfamily.org] Sent: Thursday, July 10, 2003 3:57 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng and logrotate Hy, i have squid + syslog-ng 1.0.6.rc1 Syslog-ng look squid/access.log, and write log file (with date format) on a remote server (tcp). On squid there is a logrotate at 6 am. My pb : before the log rotate, all is good. After logrotate, syslog-ng don't write in the remote file. The last line appear in this file was create at 6am. The process run on the both server, and i have no error. If i run syslog-ng restart, syslog-ng write the ligne in remote file . the next error appear after the next logrotate. Does anyone know why this is happening? thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Forwarding unchanged Syslog messages
by Paul Jasa 28 Aug '03

28 Aug '03

I have the exact same issue with syslog-ng. I run Red Hat 7.3. Despite the claims that the syslog message can be forwarded without being modified, syslog-ng STILL modifies it. The modified syslog message has the original IP address AND the server's IP address in chain format, which is no good. I want to keep the message UNtouched when it gets forwarded. If anyone has the answer to this question I would very much appreciate it. The MAIN reason why I installed syslog-ng was due to the claim that it could forward without changing the message, but so far it just looks like a claim. pj ====================================== Paul Jasa Network Engineer ====================================== -----Original Message----- From: Harrie.van.Arragon(a)steinmuehlen-brot.de [mailto:Harrie.van.Arragon@steinmuehlen-brot.de] Sent: Tuesday, August 19, 2003 05:17 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Forwarding unchanged Syslog messages Is it possible to forward syslogmessages without modifing the Host and the messages. I thought "keep_hostname(yes)" would solve the problem, but it didn't. Normaly i use version 1.5.15 shipped with debian, but I tryed 1.5.26 too. I don't konw if its important, but our syslogserver has a load of 100% the whole day (not from syslog-ng). I tryed the following config: options { use_fqdn(yes); sync(0); use_dns(yes); chain_hostnames(yes); keep_hostname(yes); }; source net { tcp(); udp();}; destination pc1 { udp(192.168.1.1);}; destination pc2 { udp(192.168.1.2);}; destination pc3 { udp(192.168.1.3);}; log { source(net); destination(pc1);}; log { source(net); destination(pc2);}; log { source(net); destination(pc3);}; bye Harrie _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0