January 2004 - syslog-ng - lists.balabit.hu

sylog-ng file() options
by Coward, Robert (Contractor) 29 Feb '04

29 Feb '04

Are there any plans to implement the compress() and encrypt() options for the file() driver? Roberto

2 1

$YEAR/$MONTH/$DAY generates always 2002/12/31
by Piotr Woliński 22 Feb '04

22 Feb '04

Hello, I have PLD Linux kernel 2.4.20 and syslog-ng-1.6.0-0.rc3.2 I put into into syslog-ng.conf lines (for test purpose): source net { udp(); }; destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log {source(net); destination(hosts); }; Now i can see directiories like that: /var/log/hosts/localhost/2003/2003/12/01 /var/log/hosts/localhost/2003/2003/12/02 that's OK. But also: /var/log/hosts/localhost/2002/12/31 Inside that dir files: auth, authpriv, local7. Dates inside above 3 files are OK. Anyone could help me? What's going on? Piotr Wolinski

6 12

parse error on configuration file
by Laurent Mesuré 19 Feb '04

19 Feb '04

Hi, I'm using syslog-ng 1.6 on a Mandrake Linux server. I have the follosing error while starting: parse error reading configuration file, exiting. (line 42) I can't find the error. Here is my configuration file: ------------------------START OF FILE------------------------ # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 10 Aug 2002 # - for Red Hat 7.3 # - totally do away with klogd # - add message "kernel:" as is done with klogd. # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 22 Aug 2002 # - use the log_prefix option as per Balazs Scheidler's email # options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_tty12 { file("/dev/tty12"); }; destination d_mesg { file("/var/log/messages"); }; destination d_secure { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron_info { file("/var/log/cron/info"); }; destination d_cron_warnings { file("/var/log/cron/warnings"); }; destination d_cron_errors { file("/var/log/cron/errors"); }; destination d_syslog { file("/var/log/syslog"); }; destination d_user { file("/var/log/user.log"); }; destination d_auth { file("/var/log/auth.log"); ); <-------- here is line 42 destination d_mail_info { file("/var/log/mail/info"); ); destination d_mail_warnings { file("/var/log/mail/warnings"); ); destination d_mail_errors { file("/var/log/mail/errors"); ); destination d_kernel_info { file("/var/log/kernel/info"); ); destination d_kernel_warnings { file("/var/log/kernel/warnings"); ); destination d_kernel_errors { file("/var/log/kernel/errors"); ); destination d_lpr_info { file("/var/log/lpr/info"); ); destination d_lpr_warnings { file("/var/log/lpr/warnings"); ); destination d_lrp_errors { file("/var/log/lpr/errors"); ); destination d_news_notice { file("/var/log/news/notice"); ); destination d_news_crit { file("/var/log/news/crit"); ); destination d_news_err { file("/var/log/news/err"); ); destination d_daemon_info { file("/var/log/daemons/info"); ); destination d_daemon_warnings { file("/var/log/daemons/warnings"); ); destination d_daemon_errors { file("/var/log/daemons/errors"); ); destination d_spooler { file("/var/log/spooler"); ); destination d_explain { file("/var/log/explainations"); ); destination d_postgresql { file("/var/log/postgresql"); ); destination d_mlal { usertty("*"); }; filter f_auth { facility(auth,authpriv); }; filter f_syslog { not facility(auth,authpriv); }; filter f_user { facility(user); }; filter f_messages { level(info) or not facility(mail,news,authpriv); }; filter f_secure { facility(authpriv); }; filter f_mail_info { facility(mail) and (level(debug,info,notice)); }; filter f_mail_warnings { facility(mail) and (level(warn)); }; filter f_mail_errors { facility(mail) and (level(err)); }; filter f_cron_info { facility(cron) and (level(debug,info,notice)); }; filter f_cron_warnings { facility(cron) and (level(warn)); }; filter f_cron_errors { facility(cron) and (level(err)); }; filter f_kernel_info { facility(kern) and (level(debug,info,notice)); }; filter f_kernel_warnings { facility(kern) and (level(warn)); }; filter f_kernel_errors { facility(kern) and (level(err)); }; filter f_lpr_info { facility(lpr) and (level(debug,info,notice)); }; filter f_lpr_warnings { facility(lpr) and (level(warn)); }; filter f_lpr_errors { facility(lpr) and (level(err)); }; filter f_news_info { facility(news) and (level(debug,info,notice)); }; filter f_news_crit { facility(news) and (level(crit)); }; filter f_news_err { facility(news) and (level(err)); }; filter f_daemon_info { facility(daemon) and (level(debug,info,notice)); }; filter f_daemon_crit { facility(daemon) and (level(warn)); }; filter f_daemon_err { facility(daemon) and (level(err)); }; filter f_emerg { level(emerg); }; filter f_spooler { facility(uucp) or (facility(news) and level(crit)); }; filter f_boot { facility(local7); }; filter f_explanation { facility(local1); }; filter f_postgresql { facility(local0); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_auth); destination (d_auth); }; log { source(s_sys); destination(d_syslog); }; log { source(s_sys); filter(f_user); destination (d_user); }; log { source(s_sys); filter(f_messages); destination(d_mesg); }; log { source(s_sys); filter(f_secure); destination(d_secure); }; log { source(s_sys); filter(f_mail_info,f_mail_warnings,f_mail_errors); destination(d_mail); }; log { source(s_sys); filter(f_emerg); destination(d_mlal); }; log { source(s_sys); filter(f_spooler); destination(d_spooler); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_mail_info); destination(d_mail_info); }; log { source(s_sys); filter(f_mail_warnings); destination(d_mail_warnings); }; log { source(s_sys); filter(f_mail_errors); destination(d_mail_errors); }; log { source(s_sys); filter(f_cron_info); destination(d_cron_info); }; log { source(s_sys); filter(f_cron_warnings); destination(d_cron_warnings); }; log { source(s_sys); filter(f_cron_errors); destination(d_cron_errors); }; log { source(s_sys); filter(f_kernel_info); destination(d_kernel_info); }; log { source(s_sys); filter(f_kernel_warnings); destination(d_kernel_warnings); }; log { source(s_sys); filter(f_kernel_errors); destination(d_kernel_errors); }; log { source(s_sys); filter(f_lpr_info); destination(d_lpr_info); }; log { source(s_sys); filter(f_lpr_warnings); destination(d_lpr_warnings); }; log { source(s_sys); filter(f_lpr_errors); destination(d_lpr_errors); }; log { source(s_sys); filter(f_news_info); destination(d_news_info); }; log { source(s_sys); filter(f_news_crit); destination(d_news_crit); }; log { source(s_sys); filter(f_news_err); destination(d_news_err); }; log { source(s_sys); filter(f_daemon_info); destination(d_daemon_info); }; log { source(s_sys); filter(f_daemon_warnings); destination(d_daemon_warnings); }; log { source(s_sys); filter(f_daemon_errors); destination(d_daemon_errors); }; log { source(s_sys); filter(f_postgresql); destination(d_postgresql); }; -------------------------END OF FILE-------------------------

2 1

Timezone problem with syslog-ng
by "Pedroche, Raúl" 04 Feb '04

04 Feb '04

Greetings. First of all, hello to everybody as this is my first post. I am not too sure if this falls into the "problems" or "feature requests" section. The matter is I have noticed that syslog-ng is using UTC instead of local time, as I'd like it to do. I am using the "use_time_recv" option and server is configured for MET timezone (BTW it is Solaris 9). This is affecting both filenames (I am using variations of .../$WEEKDAY/$HOST and yesterday files have a timestamp of "dec 19 00:59" local time) and the file contents (i.e. first columns). syslog-ng version is 1.6.0rc4. I must, anyway, congratulate the authors: we have been running syslog-ng for quite a while (in a server configured with UTC :>) and it has been proved being very effective (it is a very dated host being log server for a lot of networking devices, some of them generating more than 1GB logs/day and has a 0.05-0.08 load). Regards, Raúl Pedroche COLT Telecom Av. Manoteras, 42 - Calle 3, 28050 Madrid Teléfono de soporte técnico: 901 88 99 88 Para llamadas desde el extranjero: +34 91 320 60 18 Email: raul.pedroche(a)colt-telecom.es www.colt.net ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

3 3

syslog-ng daemon meltdown
by vj23x＠netscape.net 29 Jan '04

29 Jan '04

Ran into this meltdown, thought it would be interesting to the list. Running Syslog-ng 1.6RC3 on Solaris 2.8. 400 mHz dual processor Sun box. This is a somewhat sanitized version of the actual messages. From /var/adm/messages: Jan 27 15:23:44 nms1 syslog-ng[5651]: STATS: dropped 0 Jan 27 16:06:09 nms1 syslog-ng[5651]: io.c: do_write: write() failed (errno 28), No space left on device Jan 27 16:06:09 nms1 syslog-ng[5651]: pkt_buffer::do_flush(): Error flushing data Jan 27 16:06:09 nms1 ufs: [ID 845546 kern.notice] NOTICE: alloc: /data: file system full Jan 27 16:06:09 nms1 syslog-ng[5651]: io.c: do_write: write() failed (errno 28), No space left on device Jan 27 16:06:09 nms1 syslog-ng[5651]: pkt_buffer::do_flush(): Error flushing data ... [These messages repeat for a few minutes, until suddenly massive drops] [This was strange to me, because the /data filesystem did not appear to actually fill up. I never did anything to clear it, and I had a few hundred MB free space when I looked at the server after the failure the next day.] Jan 27 16:23:44 nms1 syslog-ng[5651]: STATS: dropped 525887 Jan 27 17:23:44 nms1 syslog-ng[5651]: STATS: dropped 1897106 Jan 27 18:23:44 nms1 syslog-ng[5651]: STATS: dropped 1915287 ... [about 2M drops every hour until midnight] Jan 28 00:23:44 nms1 syslog-ng[5651]: STATS: dropped 46122 [syslog-ng continues dropping messages at our "normal" rate. I.e. the flood is over at around midnight.] From the network device syslogs: [this is the critter that was flooding us] Jan 27 14:19:09 content1 US/Eastern:%SYS-2-CE: SCSI I/O error: POSSIBLE BAD DISK -- device 0x807, sector 4672 Jan 27 14:19:09 content1 US/Eastern:%SYS-2-CE: SCSI I/O error: POSSIBLE BAD DISK -- device 0x808, sector 768 ... [this continues for almost 3 more hours, hundreds of various sector errors per second] Finally, syslog-ng "freezes up" with these last two/three messages: (After 17:06:09, syslog-ng dropped all messages. Syslog-ng logged nothing more to the files until I stopped and restarted syslog-ng daemon.) Jan 27 17:06:09 content1 US/Eastern:%SYS-2-CE: SCSI I/O error: POSSIBLE BAD DISK -- device 0x807, sector 537872 Jan 27 17:06:09 conJan 28 10:09:17 content2 US/Eastern:%OVERLOAD-5-CE: %CE-BYPS-5-130007: OVERLOAD: Preload did not receive overload message. Preload may not be running The last message from content1 device is interrupted in mid-stream. __________________________________________________________________ New! Unlimited Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Act now to get a personalized email address! Netscape. Just the Net You Need.

1 0

syslog-ng do not work....
by Alessandro Fiorenzi 28 Jan '04

28 Jan '04

Hi, I have set this configuration on central logserver options { long_hostnames(off); sync(0); log_fifo_size(1000); dnscache(yes); use_fqdn(yes); use_time_recvd(true); }; source src { internal(); file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.52.100) port(514) max-connections(1000)); udp(ip(0.0.0.0) port(514)); }; but it does not work. The fist errore is on dnscache(yes);, if i remove this I get the second on use_time_recvd(true);, remove this one I get errore on file("/proc/kmsg" log_prefix("kernel: ")); .... why? Thanks Fiorenzi A. ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio CLUSIT, ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" -------------------------------------------------------------------------

3 2

fallback behaviour
by Andrew Culver 28 Jan '04

28 Jan '04

If I have some log paths, then a log path using the fallback flag, then some more log paths... will that path with the fallback flag not capture message that the log paths after it capture? For example, can I do the following: log { source(src); filter(filt_a); desintation(dest_a); }; log { source(src); destination(dest_b); flags(fallback); }; log { source(src); filter(filt_b); destination(dest_c); }; Will messages not filtered by filt_a be captured by the second log path and then again by the third? If not, is there any way to do this? My understanding was the old filter(DEFAULT) would behave like this, but flags(fallback) would not. Can the same effect still be accomplished? TIA, Andrew

2 1

RE: [syslog-ng] file permissions
by Andrews, Glenn J (Glenn) 28 Jan '04

28 Jan '04

Now for some reason I am getting these messages in /var/log/syslog Jan 27 18:31:34 ma106068-nm01 syslog-ng[2603]: Cannot open file /var/log/HOSTS/10.140.20.12/20040127/ for writing (Is a directory) I have deleted the entire tree from HOSTS on down and killed and restarted syslog-ng. But I still get this error. This is my destination line in syslog-ng.conf destination hosts { file("/var/log/HOSTS/$HOST/$YEAR$MONTH$DAY/$FACILTY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; and options... options { sync (0); perm (0644); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (no); }; Glenn Andrews N.E. Premise Operations Data / Voice Networking Services gjandrews(a)lucent.com <<mailto:gjandrews@lucent.com>>

2 1

file permissions
by Andrews, Glenn J (Glenn) 27 Jan '04

27 Jan '04

Is there a way to set file permssions on the logs syslog-ng creates ? It seems to create them with 600 root:root which makes them read/write by root only. Can I set them to 644 ? Glenn Andrews N.E. Premise Operations Data / Voice Networking Services gjandrews(a)lucent.com <mailto:gjandrews@lucent.com> << mailto:gjandrews@lucent.com <mailto:gjandrews@lucent.com> >> -----Original Message----- From: Andrew Culver [mailto:aculver@uwo.ca] Sent: Tuesday, January 27, 2004 12:45 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng do not work.... Maybe this is too simple but.. is that your entire config file? Do you not have destination and log directives? ----- Original Message ----- From: Alessandro Fiorenzi <mailto:a.fiorenzi@infogroup.it> To: Syslog-ng <mailto:syslog-ng@lists.balabit.hu> Sent: Tuesday, January 27, 2004 10:52 AM Subject: [syslog-ng]syslog-ng do not work.... Hi, I have set this configuration on central logserver options { long_hostnames(off); sync(0); log_fifo_size(1000); dnscache(yes); use_fqdn(yes); use_time_recvd(true); }; source src { internal(); file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.52.100) port(514) max-connections(1000)); udp(ip(0.0.0.0) port(514)); }; but it does not work. The fist errore is on dnscache(yes);, if i remove this I get the second on use_time_recvd(true);, remove this one I get errore on file("/proc/kmsg" log_prefix("kernel: ")); .... why? Thanks Fiorenzi A. ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio <file:///home/fiore/signature/www.clusit.it> CLUSIT, <file:///home/fiore/signature/www.alsi.it> ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" -------------------------------------------------------------------------

2 1

RE: [syslog-ng]syslog-ng do not work....
by Hamilton Andrew 27 Jan '04

27 Jan '04

I would, at the very least, get the latest, which is, I believe, 1.6.1. The 1.4.x line is very old and not nearly as feature rich as 1.6.x. Drew -----Original Message----- From: Alessandro Fiorenzi [mailto:a.fiorenzi@infogroup.it] Sent: Tuesday, January 27, 2004 11:41 AM To: Syslog-ng Subject: RE: [syslog-ng]syslog-ng do not work.... Well I have syslog-ng version 1.4.17, perhaps could be that, infact dns_cache(yes) use_time_recvd(yes) does not go . Alessandro On Tue, 2004-01-27 at 17:01, Hamilton Andrew wrote: What version of syslog-ng are you using? dnscache(yes) should be dns_cache(yes) use_time_recvd(true) should be use_time_recvd(yes) try pipe("/proc/kmsg" log_prefix("kernel: ")); instead of file(... Regards, Drew -----Original Message----- From: Alessandro Fiorenzi [mailto:a.fiorenzi@infogroup.it] Sent: Tuesday, January 27, 2004 10:53 AM To: Syslog-ng Subject: [syslog-ng]syslog-ng do not work.... Hi, I have set this configuration on central logserver options { long_hostnames(off); sync(0); log_fifo_size(1000); dnscache(yes); use_fqdn(yes); use_time_recvd(true); }; source src { internal(); file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.52.100) port(514) max-connections(1000)); udp(ip(0.0.0.0) port(514)); }; but it does not work. The fist errore is on dnscache(yes);, if i remove this I get the second on use_time_recvd(true);, remove this one I get errore on file("/proc/kmsg" log_prefix("kernel: ")); .... why? Thanks Fiorenzi A. ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio <file:///home/fiore/signature/www.clusit.it> CLUSIT, <file:///home/fiore/signature/www.alsi.it> ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" ------------------------------------------------------------------------- ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio <file:///home/fiore/signature/www.clusit.it> CLUSIT, <file:///home/fiore/signature/www.alsi.it> ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" -------------------------------------------------------------------------

1 0