January 2004 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]syslog-ng do not work....
by Hamilton Andrew 27 Jan '04

27 Jan '04

What version of syslog-ng are you using? dnscache(yes) should be dns_cache(yes) use_time_recvd(true) should be use_time_recvd(yes) try pipe("/proc/kmsg" log_prefix("kernel: ")); instead of file(... Regards, Drew -----Original Message----- From: Alessandro Fiorenzi [mailto:a.fiorenzi@infogroup.it] Sent: Tuesday, January 27, 2004 10:53 AM To: Syslog-ng Subject: [syslog-ng]syslog-ng do not work.... Hi, I have set this configuration on central logserver options { long_hostnames(off); sync(0); log_fifo_size(1000); dnscache(yes); use_fqdn(yes); use_time_recvd(true); }; source src { internal(); file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.52.100) port(514) max-connections(1000)); udp(ip(0.0.0.0) port(514)); }; but it does not work. The fist errore is on dnscache(yes);, if i remove this I get the second on use_time_recvd(true);, remove this one I get errore on file("/proc/kmsg" log_prefix("kernel: ")); .... why? Thanks Fiorenzi A. ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio <file:///home/fiore/signature/www.clusit.it> CLUSIT, <file:///home/fiore/signature/www.alsi.it> ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" -------------------------------------------------------------------------

2 1

RE: [syslog-ng]syslog-ng do not work....
by Schernau, Ed 27 Jan '04

27 Jan '04

FYI, use_time_recvd only works if you are logging with a template. Or has this been fixed in the latest? -----Original Message----- From: Alessandro Fiorenzi [mailto:a.fiorenzi@infogroup.it] Sent: Tuesday, January 27, 2004 10:53 AM To: Syslog-ng Subject: [syslog-ng]syslog-ng do not work.... Hi, I have set this configuration on central logserver options { long_hostnames(off); sync(0); log_fifo_size(1000); dnscache(yes); use_fqdn(yes); use_time_recvd(true); }; source src { internal(); file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.52.100) port(514) max-connections(1000)); udp(ip(0.0.0.0) port(514)); }; but it does not work. The fist errore is on dnscache(yes);, if i remove this I get the second on use_time_recvd(true);, remove this one I get errore on file("/proc/kmsg" log_prefix("kernel: ")); .... why? Thanks Fiorenzi A. ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio <file:///home/fiore/signature/www.clusit.it> CLUSIT, <file:///home/fiore/signature/www.alsi.it> ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" ------------------------------------------------------------------------- *****This information may be confidential and/or privileged. Use of this information by anyone other than the intended recipient is prohibited. If you received this in error, please inform the sender and remove any record of this message.*****

1 0

Anyone have syslog-ng running on Darwin/Mac OS X?
by Cary, Kim 26 Jan '04

26 Jan '04

Hi All, The libol & syslog-ng compile with no fuss on Mac OS X (10.3.2/GCC 3.3). However, it exits when I kill syslogd and try to run syslog-ng. Any success stories, tips for fixing? Any pointers so I can figure out what the issue is? Thanks for any reply. ksc

2 1

syslog-ng 1.4.17 netzwerk logging
by julius 26 Jan '04

26 Jan '04

i used the example Debian GNU/Linux config and added these options on the log host(192.168.0.1): source s_tcp { tcp(ip(0.0.0.0) port(514) max-connections(10)); }; log { source(s_tcp); destination(messages); }; and on the "source host" (192.168.0.3): destination d_tcp { tcp(192.168.0.1); }; log { source(src); filter(f_messages); destination(d_tcp); }; now i get name queries from my bind thats running on the source host, but syslog queries the bind without stopping, the name server uses nearly 100% from the 133mhz... whats wrong?

2 1

receiving external events
by Wang, Philip R. 25 Jan '04

25 Jan '04

I am new to syslog-ng. I used the following config file to test it out under Solaris. Then I used a pc application to generate udp message to port 514. I started the process using "syslog-ng -f filename". I can see log message in "messages" indicating the process started. However, when I send the simulated message from my PC app. It does not show up in the log file. I was reading some Linux syslog-ng document: an chapter from a book. It mentioned using the '-r' option to allow accepting remote message. I have syslog 1.6.1 and it does not have this option. Not sure if I missed anything? Philip --------------------------------------------------------------------- source local { internal(); udp();}; destination all { file("/opt/syslog-ng/messages"); }; log { source(local); destination(all); }; -----------------------------------------------------------------------

2 1

filter(DEFAULT)
by Andrew Culver 25 Jan '04

25 Jan '04

I have the following defined in my config: log { source(s_main); filter(DEFAULT); destination(d_default); }; But syslog-ng gives the following error: Starting syslog-ng: unresolved reference: DEFAULT Error initializing configuration, exiting. Anyone know why this might be and what I can do to fix it? TIA Andrew

2 1

Priorities
by Andrew Culver 25 Jan '04

25 Jan '04

Does the filter option: level(debug) filter messages of level debug _and higher_ or only messages of that level? Andrew

2 1

dir creation with IP/Host
by Dylan H. Bouterse 23 Jan '04

23 Jan '04

I have successfully installed syslog-ng and have it doing most of what I want it to do, with the exception of one thing. I have a host that is not reporting it's IP in a standard format (or I guess that's what's happening) because syslog-ng is creating a new directory based on what looks to be command types. See below: %SYS-I-INITSYS, %SSH-W-IDLE_TIMEOUT, %CLI-E-NOFACINST, So my question is, is there a way to force a specific host to a specific log file before the auto-creation of directories happens? Below is a snipped of my log file. Hopefully I am including all the info I need to help figure this out, but if I'm not, please let me know. options { chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; Dylan Bouterse Network Manager Global Card Services (407) 206-7714 office dhbouterse(a)fhmsi.com Note: This e-mail and any attachments may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of this e-mail and any attachments is strictly prohibited. If you have received this e-mail in error, please notify us immediately by returning it to the sender and deleting it from your computer system. Thank you for your cooperation. First Horizon Merchant Services.

2 1

receiving udp from remote servers
by Wang, Philip R. 23 Jan '04

23 Jan '04

I am new to syslog-ng. I used the following config file to test it out under Solaris. Then I used a pc application to generate udp message to port 514. I started the process using "syslog-ng -f filename". I can see log message in "messages" indicating the process started. However, when I send the simulated message from my PC app. It does not show up in the log file. I was reading some Linux syslog-ng document: an chapter from a book. It mentioned using the '-r' option to allow accepting remote message. I have syslog 1.6.1 and it does not have this option. Not sure if I missed anything? Philip --------------------------------------------------------------------- source local { internal(); udp();}; destination all { file("/opt/syslog-ng/messages"); }; log { source(local); destination(all); }; -----------------------------------------------------------------------

2 1

multiple listen port for centralized syslog-ng
by Alessandro Fiorenzi 23 Jan '04

23 Jan '04

Hi, I would like to setup a very customized version centralize syslog-ng. I would like to divide out server into tree areas - General Porpouse Server - IDS - Firewall for wich I would like to have multiple istance of syslog-ng listening each one on different port like: - General Porpouse Server: port 10000 - IDS : port 10001 - Firewall : port 10002 Is it possible to do? or how can I do to distinguish ? Thanks

2 1