December 2004 - syslog-ng - lists.balabit.hu

Logging to from a windows host to syslog-ng
by Conrad Tiflin (CF) 10 Dec '04

10 Dec '04

Hello, I presume sys-logging is not configured in the same way for windows versus that of unix. Does anyone know were can obtain info. on setting this up? Thanks, Conrad ================================================================== This e-mail and its contents are subject to the Telkom SA Limited e-mail legal notice available at http://www.telkom.co.za/TelkomEMailLegalNotice.PDF

4 4

Syslog-ng not receiving remote logs from stock Syslogd
by Igor Gueths 10 Dec '04

10 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all. I'm running the latest version of Syslog-ng (1.6.5). I've got all manner of local logging via unix-stream working just fine. My problem comes when I try and pull remote logs from a machine that's running the stock Syslogd, as shipped with Slackware-10.0. I first made sure my Iptables rules were accepting any traffic to UDP port 514. I then set up something like this in syslog-ng.conf. Note h14me is the hostname of the remote machine. source h14me { udp(); }; destination h14melog { file("/var/log/h14me.log"); }; log { source(h14me); destination(h14melog); }; Syslog-ng -s didn't report any errors with this syntax, therefore I assumed it was correct. However, when I restart Syslog-ng I don't see an h14me.log file in /var/log. On the remote machine I did this: @24.249.27.228 That was in /etc/syslog.conf. I had this type of setup going on another machine, however the difference was that I was running stock Syslogd as well. Does anyone know what I might be doing wrong here? Shouldn't Syslog-ng/regular Syslogd be able to communicate since they can both use the UDP standard? Should I instead specify the udp driver in the source that's already working, and then write a filter rule to take anything that comes from given host and put it in its own logfile? Or should I be able to specify 2 completely seperate sources? Thanks! - -- "The answer to life, the universe, and everything is 42." -- Douglas Adams -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFBuQ4BNohoaf1zXJMRApsTAKCcODwcOdfajdKoldQVFbOf5Ew7lQCfTYYe cKJDLElWmMeJNv4FWC1+Tl0= =FsH9 -----END PGP SIGNATURE-----

1 0

Problem reading the source file("/etc/httpd/logs/access_log")
by torpedo 09 Dec '04

09 Dec '04

Hi All , I have installed the syslog-ng 1.6.5 In configuration file I have defined source as the /etc/httpd/logs/access_log and destination as the terminal : /dev/tty1 Syslog-ng get started with no problem but it doesnot logs the information from the access_log file or any other log file ... i think thr is problem reading the file (but syslog-ng does not give any error) ... Plz help me out Thanks in advance torpedo

3 5

RE: [syslog-ng]Can't receive syslog by UDP protocol
by Xiaodong Lin 08 Dec '04

08 Dec '04

I think you should use the following: udp(ip(0.0.0.0) port(514)); instead of udp(); Xiaodong ________________________________ From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of wei Sent: Tuesday, December 07, 2004 3:29 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Can't receive syslog by UDP protocol Greeting! I have set up my syslog-ng environment by the default syslog-ng.conf file. By the linux default logger command, I can generate syslog to file. But when I use a syslog client send out syslog to the syslog-ng server, I can't receive the log by UDP protocol. But I can get TCP protocol syslog. Could anyone tell me why? Thanks! My system is RedHat 9.0. The syslog client is Kiwi Syslog Gen in windows. The following is part of my syslog.conf file: source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); udp(); tcp(port(5140) keep-alive(yes)); }; log { source(src); destination(file); };

3 2

Can't receive syslog by UDP protocol
by wei 07 Dec '04

07 Dec '04

Greeting! I have set up my syslog-ng environment by the default syslog-ng.conf file. By the linux default logger command, I can generate syslog to file. But when I use a syslog client send out syslog to the syslog-ng server, I can't receive the log by UDP protocol. But I can get TCP protocol syslog. Could anyone tell me why? Thanks! My system is RedHat 9.0. The syslog client is Kiwi Syslog Gen in windows. The following is part of my syslog.conf file: source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); udp(); tcp(port(5140) keep-alive(yes)); }; log { source(src); destination(file); };

1 0

Question about file handles, programs and time_reopen
by Mike Tremaine 06 Dec '04

06 Dec '04

I was doing a little experimenting on syslog-ng [syslog-ng-1.6.5-6 from rpm package] and was curious what happens if the destination object is destroyed. I read the configs option "time_reopen" [mine is set to 10, I assume that is secs], does this control all output options or just network connections? 2 examples. If you have a log file that is removed while syslog-ng is running is there a way to have syslog-ng re-create the file. I tried it and the file didn't not come back even though there was more data. Same experiment with a program. Syslog-ng forks a child program at start-up but what happens if that child dies. I did a kill -9 just to see if it would detect the absence and try to re-fork. If I want these features do I need to look outside of syslog-ng [some sort of daemon watcher that will throw a HUP]. Thanks, Mike Tremaine

3 3

UNSUBSCRIBE.
by Conrad Tiflin (CF) 06 Dec '04

06 Dec '04

================================================================== This e-mail and its contents are subject to the Telkom SA Limited e-mail legal notice available at http://www.telkom.co.za/TelkomEMailLegalNotice.PDF

1 0

UNSUBSCRIBE.
by Virgil 06 Dec '04

06 Dec '04

1 0

FYI: Performance
by Jay Guerette 03 Dec '04

03 Dec '04

( I hope I don't offend anyone with an attachment, it's only 8k. ) My largest single-server syslog-ng implementation currently handles over 13M lines per day, totalling about 1.8Gb per day. I've only recently been able to gather this data by creating a process to count incoming lines, sum their lengths, and report via syslog at 1 minute intervals. See attached graph ( if the attachment survived ). I added this configuration before all other entries to make sure it sees everything: <syslog-ng.conf> destination syslog-perf { program(syslog-perf); }; log { source(syslog); destination(syslog-perf); }; </syslog-ng.conf> I originally tried this in Perl, then Bash, but neither could keep up with the incoming messages. This works like a champ. It compiles on Linux. The output format is specific to my syslog-to-rrd implementation, but you get the idea. It is suitable for an installation that is assured of at least 1 message for each reporting interval! <syslog-perf.c> #include <stdio.h> #include <time.h> #include <syslog.h> #define BUFFER_SIZE 8192 #define REPORT_INTERVAL 60 void main(void) { char buf[BUFFER_SIZE]; long count, bytes; time_t lastupdate; lastupdate = time(NULL); while (fgets(buf, BUFFER_SIZE, stdin)) { count++; bytes += (strlen(buf) - 1); if (time(NULL) > (lastupdate + REPORT_INTERVAL)) { openlog("127.0.0.1", LOG_NDELAY, LOG_LOCAL3); syslog(LOG_INFO, "Syslog-ng\\Lines=%d Syslog-ng\\Bytes=%d", count, bytes); closelog(); lastupdate += REPORT_INTERVAL; count = 0; bytes = 0; } } } </syslog-perf.c>

7 12

Separator for $MSGONLY
by Thomas Lohschmidt 03 Dec '04

03 Dec '04

Hi folks, I've got a small feature request regarding the $MSGONLY macro. I've noticed there is a colon ':' hard coded in macros.c as separator between preamble and the message content. I would like to have this character configurable. We use a lot of solaris boxes sending messages using the logger command and it puts some additional information in brackets in front of the message which I don't want to see in my logfiles. So I hardcoded the closing bracket ']' into macros.c as a workaroung to achieve the desired result. It would be nice to have a parameter in the config file, say "msgonly_sep" or something like that, so I don't have to patch new releases of syslog-ng. Regards Thomas Der Inhalt dieser E-Mail ist vertraulich. Falls Sie nicht der angegebene Empfänger sind oder falls diese E-Mail irrtümlich an Sie adressiert wurde, verständigen Sie bitte den Absender sofort und löschen Sie die E-Mail sodann. Das unerlaubte Kopieren sowie die unbefugte Übermittlung sind nicht gestattet. Die Sicherheit von Übermittlungen per E-Mail kann nicht garantiert werden. Falls Sie eine Bestätigung wünschen, fordern Sie bitte den Inhalt der E-Mail als Hardcopy an. The contents of this e-mail are confidential. If you are not the named addressee or if this transmission has been addressed to you in error, please notify the sender immediately and then delete this e-mail. Any unauthorized copying and transmission is forbidden. E-Mail transmission cannot be guaranteed to be secure. If verification is required, please request a hard copy version.

2 1