October 2004 - syslog-ng - lists.balabit.hu

filter host and regex
by Stefan Schluppeck 26 Oct '04

26 Oct '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I use syslog-ng as a central logserver for 90 Linux Servers und 150 Network machines (router switches) I have to write a filter for matching hosts: The Filter looks like this: filter f_network { host("^ch4-*") or host("^bu.1-*"); }; but this filter does not match this lines: Oct 26 14:04:16 bu21-flur2-c3548-1 197791: %LINEPROTO-5-UPDOWN Oct 26 14:24:10 bu19-r151-c3548-3 32761: %LINEPROTO-5-UPDOWN Question: waht ist the right regex to match the hostnames: bu21-flur2-c3548-1 bu19-r151-c3548-3 pleace give me some tipps, thx - -- Mit freundlichen Grüßen / With regards Stefan Schluppeck Bauer Publishinggroup - Brieffach 6200 - Burchard.11 - D-20077 Hamburg Publishing Support Center - Server & Development - Stefan Schluppeck Fon:+49-40-3019-5519 - Fax:+49-40-3019-5668 - eMail:sschluppeck@hbv.de ~ <°)))))>< ><)))))°> <°)))))>< ><)))))°> <°)))))>< ><)))))°> PGP-Fingerabdruck = 7DC1 E4B4 056C 5380 8C68 4B5F 5E87 227D 5632 E45F Key-ID = 81B7CD29 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBfkP5XocifVYy5F8RAhyGAJ9c2ysTKQ9ihX9tgYTjgoJai+t6GQCgldk3 NBOaJFgZxnhSvQU9vrzWlNo= =bRz8 -----END PGP SIGNATURE-----

1 0

[patch] fixing: no static libol problem
by Enrico Weigelt 25 Oct '04

25 Oct '04

hi folks, at my site the latest libol doensnt produce a static library, which breaks syslog-ng build. here's a patch that fixes this by linking dynamically. cu -- --------------------------------------------------------------------- Enrico Weigelt == metux IT service phone: +49 36207 519931 www: http://www.metux.de/ fax: +49 36207 519932 email: contact(a)metux.de cellphone: +49 174 7066481 --------------------------------------------------------------------- -- DSL ab 0 Euro. -- statische IP -- UUCP -- Hosting -- Webshops -- ---------------------------------------------------------------------

1 0

[patch] fixing MIN/MAX bug
by Enrico Weigelt 25 Oct '04

25 Oct '04

hi folks, here's a patch that fixes the missing MIN/MAX macros on certain environments (probably libc-dependent ?) cu -- --------------------------------------------------------------------- Enrico Weigelt == metux IT service phone: +49 36207 519931 www: http://www.metux.de/ fax: +49 36207 519932 email: contact(a)metux.de cellphone: +49 174 7066481 --------------------------------------------------------------------- -- DSL ab 0 Euro. -- statische IP -- UUCP -- Hosting -- Webshops -- ---------------------------------------------------------------------

1 0

[patch] fixing missing depcomp
by Enrico Weigelt 25 Oct '04

25 Oct '04

Hi folks, I'm currently trying to build current syslog-ng. 'depcomp' seems to be missing, so I had to add it manually. Here's a patch which should fix it. All of my patches for syslog-ng can be found at rsync://sources.metux.de/metux-patches/syslog-ng/ cu -- --------------------------------------------------------------------- Enrico Weigelt == metux IT service phone: +49 36207 519931 www: http://www.metux.de/ fax: +49 36207 519932 email: contact(a)metux.de cellphone: +49 174 7066481 --------------------------------------------------------------------- -- DSL ab 0 Euro. -- statische IP -- UUCP -- Hosting -- Webshops -- ---------------------------------------------------------------------

1 0

RE: [syslog-ng]bind_inet_socket() error
by Walt Rich 24 Oct '04

24 Oct '04

Response to a) shows: # ifconfig -a | grep 172 inet 172.16.100.202 netmask ffffff00 broadcast 172.16.100.255 all of which is correct. Response to b) is nothing: # netstat -an | grep 514 # I've turned off regular syslog on this box.. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu on behalf of Dave Johnson Sent: Sat 10/23/2004 11:15 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]bind_inet_socket() error a) ifconfig -a |grep 172 this shows you have that ip address on that machine? b) netstat -an |grep 514 is there something already listening on 514 tcp? On Fri, 22 Oct 2004 17:54:39 -0500, Walt Rich <walt.rich(a)parago.com> wrote: > > > I'm getting the following error when attempting to start syslog-ng: > > # ./S74syslog start > io.c: bind_inet_socket() bind failed 172.16.65.61:514 Cannot assign > requested address > Error initializing configuration, exiting. > > here is the line in the syslog-ng.conf file that is setting up a the > corresponcidg source: > > source net_tcp { tcp( ip(172.16.65.61) port(514) ); }; > > Does anyone know what the error means and how I can get around it? > > I appreciate any help you can provide. > > Thanks! _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

syslog-ng and snmptrapd keep original hostnames
by Dirk Laan 24 Oct '04

24 Oct '04

Hello, We have 2 syslog-ng relay servers and 1 syslog-ng server. We also use mysql. So the 2 relay server sending al messages to the syslog-ng server So when a switch sends a snmtrap to the relay server it forwards the message to the syslog-ng server. When I look at the messages I don't see the hostname of the switch in the Table HOST. Instead I see the name of the relay server. Is there a solution for this ? Dirk

2 1

bind_inet_socket() error
by Walt Rich 23 Oct '04

23 Oct '04

I'm getting the following error when attempting to start syslog-ng: # ./S74syslog start io.c: bind_inet_socket() bind failed 172.16.65.61:514 Cannot assign requested address Error initializing configuration, exiting. here is the line in the syslog-ng.conf file that is setting up a the corresponcidg source: source net_tcp { tcp( ip(172.16.65.61) port(514) ); }; Does anyone know what the error means and how I can get around it? I appreciate any help you can provide. Thanks!

2 1

Re: [syslog-ng]Problems in Solaris 2.7 with truncated message
by Hernan Cortez 21 Oct '04

21 Oct '04

Hi Angelita, Yes, indeed the "\n" is a test to break the sentence. If you see the second template the $MSG between "-" appears truncated also. Any ideas? I don't think is a configuratiion problem. The binaries are from www.sunfreeware.com, may be i need to compile instead... HC Angelita Soares de Camargos To: syslog-ng(a)lists.balabit.hu <anghelasc(a)gmail.com> cc: Sent by: Subject: Re: [syslog-ng]Problems in Solaris 2.7 with truncated message syslog-ng-admin@lists .balabit.hu 20-10-2004 17:42 Please respond to syslog-ng Hernan, did you try erase the first "\n" in this sentence? .... '$PROGRAM', \n '$MESSAGE' );\n") .... I use a template to insert into mysql and it work fine. ****** destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date,time,program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG','$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n") template-escape(yes)); }; ****** On Wed, 20 Oct 2004 14:26:10 -0300, Hernan Cortez <hcortez(a)adexus.cl> wrote: > > Opss. Wrong subject. excuse me. > > Hi, I'm trying to install syslog-ng 1.6.4 in Solaris 2.7. > The binaries install and works OK, but the messages appear to be truncated. > By example the following sentece: > > destination d_mysql { > file("/var/log/dblog/fulllog.$YEAR.$MONTH.$DAY.$HOUR.$MIN.$SEC" > template("INSERT INTO logs (host, facility, priority, level, tag, > date, time, program, msg) > VALUES ( '$HOST', '$FACILITY', > '$PRIORITY','$LEVEL', '$TAG','$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC', > '$PROGRAM', \n '$MESSAGE' );\n") > owner(root) group(root) perm(0600) > dir_perm(0700) create_dirs(yes) > template-escape(yes)); > }; > > In the log it appears without the ");\n" (last 3 characters), so the > insert in the mysql doesn't work. I do the test in with the following > destination: > > template("-$MSG--") > > In this case the last character "-" doesn't appear. > > Any idea? > Does syslog have a buffer problem? > > Thanks in advance, > > HC > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng]Problems in Solaris 2.7 with truncated message
by Hernan Cortez 20 Oct '04

20 Oct '04

Opss. Wrong subject. excuse me. Hi, I'm trying to install syslog-ng 1.6.4 in Solaris 2.7. The binaries install and works OK, but the messages appear to be truncated. By example the following sentece: destination d_mysql { file("/var/log/dblog/fulllog.$YEAR.$MONTH.$DAY.$HOUR.$MIN.$SEC" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY','$LEVEL', '$TAG','$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC', '$PROGRAM', \n '$MESSAGE' );\n") owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) template-escape(yes)); }; In the log it appears without the ");\n" (last 3 characters), so the insert in the mysql doesn't work. I do the test in with the following destination: template("-$MSG--") In this case the last character "-" doesn't appear. Any idea? Does syslog have a buffer problem? Thanks in advance, HC

2 1

Re: Welcome to the "syslog-ng" mailing list
by Hernan Cortez 20 Oct '04

20 Oct '04

Hi, I'm trying to install syslog-ng 1.6.4 in Solaris 2.7. The binaries install and works OK, but the messages appear to be truncated. By example the following sentece: destination d_mysql { file("/var/log/dblog/fulllog.$YEAR.$MONTH.$DAY.$HOUR.$MIN.$SEC" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY','$LEVEL', '$TAG','$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC', '$PROGRAM', \n '$MESSAGE' );\n") owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) template-escape(yes)); }; In the log it appears without the ");\n" (last 3 characters), so the insert in the mysql doesn't work. I do the test in with the following destination: template("-$MSG--") In this case the last character "-" doesn't appear. Any idea? Does syslog have a buffer problem? Thanks in advance, HC syslog-ng-request@lists .balabit.hu To: hcortez(a)adexus.cl Sent by: cc: syslog-ng-admin(a)lists.b Subject: Welcome to the "syslog-ng" mailing list alabit.hu 20-10-2004 14:08 Welcome to the syslog-ng(a)lists.balabit.hu mailing list! To post to this list, send your email to: syslog-ng(a)lists.balabit.hu General information about the mailing list is at: https://lists.balabit.hu/mailman/listinfo/syslog-ng If you ever want to unsubscribe or change your options (eg, switch to or from digest mode, change your password, etc.), visit your subscription page at: https://lists.balabit.hu/mailman/options/syslog-ng/hcortez%40adexus.cl You can also make such adjustments via email by sending a message to: syslog-ng-request(a)lists.balabit.hu with the word `help' in the subject or body (don't include the quotes), and you will get back a message with instructions. You must know your password to change your options (including changing the password, itself) or to unsubscribe. It is: h0e0c0i0 If you forget your password, don't worry, you will receive a monthly reminder telling you what all your lists.balabit.hu mailing list passwords are, and how to unsubscribe or change your options. There is also a button on your options page that will email your current password to you. You may also have your password mailed to you automatically from the Web page noted above.

1 0