January 2004 - syslog-ng - lists.balabit.hu

persistent link to current file
by Gainey, Joe (AT-Atlanta) 14 Jan '04

14 Jan '04

Is there any way to link the current version of a file to a standard location. If not would it be possible to add this functionality. Here is an example of what i have: destination d_default { file("/var/adm/messages.$YEAR.$MONTH.$DAY") ; } ; However, I have to recreate the symlink in cron every day: ln -s /var/adm/messages.2004.01.13 /var/adm/messages it would be nice if there was an option: destination d_default { file("/var/adm/messages.$YEAR.$MONTH.$DAY" soft_link("/var/adm/messages")) ; } ; if this or something like this has been implemented please let me know. Joe Gainey

4 5

RE: [syslog-ng]funny character is being inserted into each log li ne + perm(-1) n ot working
by Clemson, Chris 14 Jan '04

14 Jan '04

> On Wed, 2004-01-07 at 11:50, Rule, Ted wrote: > > The ^@ isn't really 'funny', per se; it's a representation of Ctrl-@ > > which in turn is actually the null character. > > Correct, this has been fixed by a patch posted to this list > earlier, and > in the last 1.6.1 syslog-ng release (which has the posted > patch merged) oh, thanks for the reply! i must have missed that, i'll check it out cheers, chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

Re: [syslog-ng]1.5.26 vs 1.6.x and destination selection
by T. 14 Jan '04

14 Jan '04

Interesting point. I tried with check_hostnames() set to either yes or no but with little success. I also tried use_fqdn() as well as taking out my bad_hostname() restrictions. I'll try to document some of the different use cases if I get a few moments free. --- On Mon 01/12, Balazs Scheidler < bazsi(a)balabit.hu > wrote: From: Balazs Scheidler [mailto: bazsi(a)balabit.hu] To: syslog-ng(a)lists.balabit.hu Date: Mon, 12 Jan 2004 21:41:11 +0100 Subject: Re: [syslog-ng]1.5.26 vs 1.6.x and destination selection On Mon, 2004-01-12 at 21:00, T. wrote: > Hi, Baszi. Thanks for writing back. Here's what I'm seeing: > > 0: 0003 ba10 8f5b 0001 81ff d8ad 0800 4500 .....[........E. > 16: 00a5 8018 0000 fc11 7b85 0a64 6303 0a40 .......{..dc..@ > 32: 4b03 042d 0202 0091 0736 3c31 3636 3e4a K..-.....6<166>J > 48: 616e 2031 3220 3230 3034 2031 393a 3336 an 12 2004 19:36 > 64: 3a35 313a 2025 4657 534d 2d36 2d33 3032 :51: %FWSM-6-302 > 80: 3030 363a 2054 6561 7264 6f77 6e20 5544 006: Teardown UD > 96: 5020 636f 6e6e 6563 7469 6f6e 2066 6f72 P connection for > 112: 2066 6164 6472 2031 302e 3130 302e 3832 faddr 10.100.82 > 128: 2e39 2f33 3738 3638 2067 6164 6472 2031 .9/37868 gaddr 1 > 144: 302e 3230 2e33 302e 3631 2f35 3320 6c61 0.20.30.61/53 la > 160: 6464 7220 3130 2e32 302e 3330 2e36 312f ddr 10.20.30.61/ > 176: 3533 0a 53. > > In this case, the filter that I expect to pick it up is: > > filter f_fwsm_misc { > match(" \%FWSM-") and > match(": (Teardown|Translation|Built)"); > }; > log { source(s_udp); filter(f_fwsm_misc); destination(d_netfilt); }; > log { destination(d_messages); flags(fallback, catchall); }; > > > This works OK in 1.5.26 (i.e. the message above gets written to d_netfilt) but not 1.6.0rc4 or 1.6.1 (it's written to d_messages). I wouldn't always expect program() to work well for remote hosts but the match() filter seems like it should. Also, I can't tell if $HOST is now being correctly interpreted in 1.6.1 because the message is being written to the wrong place :-) I can say that it does seem to work correctly for other syslog-ng hosts (which I have set up to use TCP), it's primarily the UDP transport that seems to be having problems. I don't understand how this might work differently than 1.5.26, though I think the problem is that you have to enable the check_hostname() option as '%FWSM-6-302' is taken as the hostname (if you enable check_hostname it will be interpreted as the part of the message as '%' is not a valid hostname. I can't remember any changes in this area though. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

Re: [syslog-ng]1.5.26 vs 1.6.x and destination selection
by T. 12 Jan '04

12 Jan '04

Hi, Baszi. Thanks for writing back. Here's what I'm seeing: 0: 0003 ba10 8f5b 0001 81ff d8ad 0800 4500 .....[........E. 16: 00a5 8018 0000 fc11 7b85 0a64 6303 0a40 ......�.{..dc..@ 32: 4b03 042d 0202 0091 0736 3c31 3636 3e4a K..-.....6<166>J 48: 616e 2031 3220 3230 3034 2031 393a 3336 an 12 2004 19:36 64: 3a35 313a 2025 4657 534d 2d36 2d33 3032 :51: %FWSM-6-302 80: 3030 363a 2054 6561 7264 6f77 6e20 5544 006: Teardown UD 96: 5020 636f 6e6e 6563 7469 6f6e 2066 6f72 P connection for 112: 2066 6164 6472 2031 302e 3130 302e 3832 faddr 10.100.82 128: 2e39 2f33 3738 3638 2067 6164 6472 2031 .9/37868 gaddr 1 144: 302e 3230 2e33 302e 3631 2f35 3320 6c61 0.20.30.61/53 la 160: 6464 7220 3130 2e32 302e 3330 2e36 312f ddr 10.20.30.61/ 176: 3533 0a 53. In this case, the filter that I expect to pick it up is: filter f_fwsm_misc { match(" \%FWSM-") and match(": (Teardown|Translation|Built)"); }; log { source(s_udp); filter(f_fwsm_misc); destination(d_netfilt); }; log { destination(d_messages); flags(fallback, catchall); }; This works OK in 1.5.26 (i.e. the message above gets written to d_netfilt) but not 1.6.0rc4 or 1.6.1 (it's written to d_messages). I wouldn't always expect program() to work well for remote hosts but the match() filter seems like it should. Also, I can't tell if $HOST is now being correctly interpreted in 1.6.1 because the message is being written to the wrong place :-) I can say that it does seem to work correctly for other syslog-ng hosts (which I have set up to use TCP), it's primarily the UDP transport that seems to be having problems. Thanks again for any help you might be able to offer. --- On Mon 01/12, Balazs Scheidler < bazsi(a)balabit.hu > wrote: From: Balazs Scheidler [mailto: bazsi(a)balabit.hu] To: syslog-ng(a)lists.balabit.hu Date: Mon, 12 Jan 2004 13:54:10 +0100 Subject: Re: [syslog-ng]1.5.26 vs 1.6.x and destination selection Please try checking how those messages are formatted. syslog-ng might have problems identifying the program part in those messages. either a tcpdump or an strace with large strings (-s 512) might help to find the problem. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1

RE: [syslog-ng]Re: syslog-ng and log viewer
by Schernau, Ed 12 Jan '04

12 Jan '04

I second this, however I find that heavy DB usage causes NG to drop messages. However, I'm running MySQL on an old Sun Ultra 2, maybe this has something to do with it. -----Original Message----- From: Jérôme Fenal [mailto:jerome.fenal@logicacmg.com] Sent: Monday, January 12, 2004 10:49 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Re: syslog-ng and log viewer Gerard Breiner wrote: > Hello, > > I installed and configured syslog-ng. It works very fine ! Now, I'm > seeking a free application to visualize the logs files into a > navigator. An idea ? we use a home brew version of what can be found here : http://vermeer.org/syslog/ We log to mysql, then use a heavily modified of an early version of the php script found here : http://www.vermeer.org/projects/php-syslog-ng/ Cordialement, Jérôme -- Jérôme Fenal - Consultant Unix/SAN/Logiciel Libre Groupe Expert & Managed Services - LogicaCMG France http://www.logicacmg.com/fr/ - <mailto:jerome.fenal AT logicacmg.com> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html *****This information may be confidential and/or privileged. Use of this information by anyone other than the intended recipient is prohibited. If you received this in error, please inform the sender and remove any record of this message.*****

1 0

How to filter XDMCP messages ?
by Gerard Breiner 12 Jan '04

12 Jan '04

Hello, I wonder how to configure syslog-ng to filtering the messages emitted by gdm_xdmcp. this type of messages pollutes my files of logs. Here is messages i don't want : "gdm[3798]: gdm_xdmcp_handle_query: Opcode 1 from ". Best regards Gerard Gerard Breiner Institut d'Astrophysique Spatiale Orsay Campus France

4 5

1.5.26 vs 1.6.x and destination selection
by T. 12 Jan '04

12 Jan '04

I am trying to get the 1.6 branch of syslog-ng to create log files based on a naming convention that worked (sort of) in 1.5.26 but no longer does. Specifically, I have the following in my syslog-ng.conf: destination d_netfilt { file ("/var/logser/$HOST/$YEAR/$MONTH/$DAY/netfilt.log" owner(root) perm(0600) create_dirs(yes) ); }; destination d_messages { file ("/var/adm/messages.$YEAR.$MONTH" owner(root) perm(0644) ); }; filter f_netfilt { match(" netfilt\[0-9]+\]") or program("netfilt"); }; source s_udp { udp( port(514) ); }; log { source(s_udp); filter(f_netfilt); destination(d_netfilt); }; log { destination(d_messages); flags(fallback, catchall); }; With syslog-ng 1.5.26, this sends messages matching "netfilt" received on UDP port 514 into /var/logser (albeit it doesn't correctly expand $HOST into the source of the message - it fills this in as the hostname of the machine on which syslog-ng is running). With the 1.6 branch, however, running with the same config file and receiving messages from the same sources winds up dropping the logs down into the d_messages block. This happened both with the release candidates and with the recent 1.6.1 branch. I'm using libol 0.3.11 and running on Solaris 8 on Netra V120; both libol and syslog-ng were compiled using GCC 3.1 in 64-bit mode (-m64 -mcpu=ultrasparc -O3). Can anyone help point me in the right direction of getting 1.6.1 to correctly match the source of the message and, perhaps, also identify $HOST properly? Thanks in advance. T. E. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1

compiling syslog-ng (latest version) on solrais 9 - no error
by Markus Reger 11 Jan '04

11 Jan '04

This is the same problem on IRIX. You have to use the flex library like this: gcc ... -L(flex directory path) -lfl Gabor sorry to say but Gabor's advice didn't bring me any further. What I chose then was to set export LEXLIB="/opt/sfw/libfl.a" since this file holds yywrap. I made a make disclean ./configure make and everything went fine (at least there were no errors, warnings, notices or other complaints reported) and binaries were ceated. fyi we use: gcc 3.3 flex 2.5.4 libol 0.3.11 syslog-ng 1.6.0rc4 now the config will begin. kr

1 0

"last message repeated NN times"?
by Ed Ravin 10 Jan '04

10 Jan '04

I recall someone pointing out last year that syslogd has a feature where it can compress a burst of messages into a note like: Jan 10 17:01:06 loghost last message repeated 24 times While syslog-ng didn't have that. Is that still the case? I just ran into this with a mongo runaway program that logged several hundred messages a second, which filled up my log partition. If this feature still isn't in syslog-ng, is it one that we want? I could see it as a source option like "suppress-repeats", where it would spit out the original message followed by a tag, like this: Jan 10 17:25:39 loghost inetd[7729]: Connection from 10.24.1.168 [REPEATED 1024 TIMES] and maybe arguments to "suppress-repeats" like how many repeats should be printed before kicking in, or perhaps even a regex describing which parts of the log message to ignore before comparing it to the previous one. Thanks, -- Ed

2 3

Getting rid of --
by Al Banard 10 Jan '04

10 Jan '04

How do I get rid of the two dashes between syslog-ng output and the actual message? I've tried this: template("$ISODATE $MESSAGE\n") but I still get "--" between the date and my message. current message output: 2004-01-10T09:18:52+0100 -- my_lovely_message desired message output: 2004-01-10T09:18:52+0100 my_lovely_message _________________________________________________________________ E-mail just got a whole lot better. New ninemsn Premium. Click here http://ninemsn.com.au/premium/landing.asp

1 0