March 2004 - syslog-ng - lists.balabit.hu

maximum config file size
by Scooter T 01 Apr '04

01 Apr '04

Has anyone encountered any problems with a fairly large syslog-ng.conf file? I am seeing substantial UDP packet loss with a file that is roughly 1300 lines (about 70k). If I pare it down to around 1200 lines (about 60k), all is well. Is this a known limitation? --------------------------------- Do you Yahoo!? Yahoo! Finance Tax Center - File online. File on time.

2 1

syslog-ng and net devices.
by cdowns 31 Mar '04

31 Mar '04

Morning, I have all cisco devices coming in on priority local7, and for some reason im not getting them all. I grep'd though all logs and they truly dont exist. Does anyone see anything wrong with my config ? TIA. ~!>D # # Syslog-ng example configuration for for Debian GNU/Linux # Too bad this wasnt debian ;( # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # options { long_hostnames(off); sync(1); }; # added /proc/kmsg for replace of klogd - syslogd source src { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log"); }; source net { udp(); }; ## dest destination authlog { file("/log/auth.log"); }; destination syslog { file("/log/syslog"); }; destination cron { file("/log/cron.log"); }; destination daemon { file("/log/daemon.log"); }; destination kern { file("/log/kern.log"); }; destination lpr { file("/log/lpr.log"); }; destination user { file("/log/user.log"); }; destination uucp { file("/log/uucp.log"); }; destination mail { file("/log/mail.log"); }; destination mailinfo { file("/log/mail.info"); }; destination mailwarn { file("/log/mail.warn"); }; destination mailerr { file("/log/mail.err"); }; destination newscrit { file("/log/news/news.crit"); }; destination newserr { file("/log/news/news.err"); }; destination newsnotice { file("/log/news/news.notice"); }; destination debug { file("/log/debug"); }; destination messages { file("/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; #destination loghost { udp("loghost" port(999)); }; ## Custon Log Destiniations destination pix { file("/log/Net/pix.log"); }; destination iss { file("/log/Net/iss.log"); }; destination snmp { file("/log/Net/snmp.log"); }; ## Incoming routers and switches with perms destination local7 { file("/log/j1comm1/logs/local7.info" owner(j1comm1) group(j1comm1) perm(0644) dir_perm(0755) create_dirs(yes) ); }; destination std { file("/log/Net/$FACILITY.log" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; destination xconsole { pipe("/dev/xconsole"); }; ## Filters for local machine filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; ## UDP Hosts filter f_net_auth { facility(auth); }; filter f_net_authpriv { facility(auth, authpriv); }; filter f_net_syslog { not facility(authpriv, mail); }; filter f_net_cron { facility(cron); }; filter f_net_daemon { facility(daemon); }; filter f_net_kern { facility(kern); }; filter f_net_lpr { facility(lpr); }; filter f_net_mail { facility(mail); }; filter f_net_user { facility(user); }; filter f_net_uucp { facility(cron); }; filter f_net_news { facility(news); }; filter f_net_debug { not facility(auth, authpriv, news, mail); }; filter f_net_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_net_emergency { level(emerg); }; filter f_net_info { level(info); }; filter f_net_notice { level(notice); }; filter f_net_warn { level(warn); }; filter f_net_crit { level(crit); }; filter f_net_err { level(err); }; ### get all cisco local7.info messages ## filter f_local7 { facility(local7) and level(debug..emerg); }; filter f_pixm { match("PIX"); }; filter f_misclocal7 { filter (f_local7) and not filter(f_pixm); }; filter f_iss { match("issDaemon"); }; filter f_snmp { match("ucd-snmp"); }; ## Local logs log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); destination(console_all); }; ## Custom Logs log { source(net); filter(f_pixm); destination(pix); }; log { source(net); filter(f_misclocal7); destination(local7); }; log { source(net); filter(f_iss); destination(iss); }; log { source(net); filter(f_snmp); destination(snmp); }; ## CatchAll Net log log { source(net); filter(f_net_authpriv); destination(std); }; log { source(net); filter(f_net_syslog); destination(std); }; log { source(net); filter(f_net_cron); destination(std); }; log { source(net); filter(f_net_daemon); destination(std); }; log { source(net); filter(f_net_kern); destination(std); }; log { source(net); filter(f_net_lpr); destination(std); }; log { source(net); filter(f_net_mail); destination(std); }; log { source(net); filter(f_net_user); destination(std); }; log { source(net); filter(f_net_uucp); destination(std); }; log { source(net); filter(f_net_mail); filter(f_net_info); destination(std); }; log { source(net); filter(f_net_mail); filter(f_net_warn); destination(std); }; log { source(net); filter(f_net_mail); filter(f_net_err); destination(std); }; log { source(net); filter(f_net_news); filter(f_net_crit); destination(std); }; log { source(net); filter(f_net_news); filter(f_net_err); destination(std); }; log { source(net); filter(f_net_news); filter(f_net_notice); destination(std); }; log { source(net); filter(f_net_debug); destination(std); }; log { source(net); filter(f_net_messages); destination(std); }; log { source(net); filter(f_net_emergency); destination(std); }; log { source(net); destination(console_all); }; ## EOF

1 0

Filtering by time or date
by Wesolowski Michal 30 Mar '04

30 Mar '04

Hi I'm testing syslog-ng for centralized log server on Solaris 8. It acts very well and I was even able to create real-time notification mechanizm based on syslog-ng and some scripts (without any additional log analizer). The problem I've lately met is that some computers sending their messages to central system frequently perform additional maintanence tasks during nights or off days. For example they scan disks and other i/o devices and in effect produce many warnings. That messages almost always countain information which are suspicous within work hours and they cannot be filtered permanently. My question is: Is it possible or planed for future releases to include time conditions in filter functions?. The "match" statement doesn't seem to check date or time and using program as destination is quite hard due to it "destination" not filter role in log paths. In my opinion very interesting option would be including external program as filter (ie. returning filter decision as std output or exit code). Greetings Michal Wesolowski

2 1

template syntax
by John Minson 30 Mar '04

30 Mar '04

The 'template' syntax for a 'file' destination has defeated me . destination d_db { file("/var/log/ng/db.inserts" template("$MSG\n")); }; every variation of the above line gives 'parsing error' syslog-ng 1.4.17 many thanks

2 1

Not logging to the correct file
by allanwind＠lifeintegrity.com 28 Mar '04

28 Mar '04

I have been running with: file("/var/log/syslog-ng/$YEAR-$MONTH-$DAY/$HOST.log" dir_owner("root") dir_group("adm") dir_perm(0 750) owner("root") group("adm") perm(0640) create_dirs(yes)); (or $PROGRAM instead of $HOST), but still get some log events in: /var/log/syslog-ng/$YEAR-$MONTH-$DAY/$FACILITY.log?! daemon.log: Mar 28 11:48:42 log_source@pawan dhcpd: Wrote 8 leases to leases file mail.log: Mar 28 00:04:14 log_source@pawan amavis[6299]: (06299-03) Passed, <bounce-debian-devel=allanwind=lifeintegrity. com(a)lists.debian.org> -> <allanwind(a)lifeintegrity.com>, Message-ID: <87r7vdsgum.fsf(a)mrvn.homelinux.org>, Hits: -4.9 syslog.log: Mar 28 00:01:05 internal_source@pawan syslog-ng[341]: STATS: dropped 0 My syslog-ng.conf is pretty complicated as I use it to filter my logs real-time, but it looks something like this: # sources # source internal_source { internal(); }; source log_source { unix-stream("/dev/log"); }; source kmsg_source { file("/proc/kmsg" log_prefix("kernel: ")); }; destination syslog_destination { file("/var/log/syslog-ng/$YEAR-$MONTH-$DAY/$HOST.log" dir_owner("root") dir_group("adm") dir_perm(0750) owner("root") group("adm") perm(0640) create_dirs(yes)); }; # log paths # log { source(internal_source); source(log_source); source(kmsg_source); destination(syslog_destination); }; /Allan -- Allan Wind P.O. Box 2022 Woburn, MA 01888-0022 USA

1 0

regex question
by cdowns 28 Mar '04

28 Mar '04

When regexing in syslog-ng, does this stament below do: get all local7 ( all levels ) and _/ALSO/_ match %ETHC-5 / %CLEAR-5 ? Its not just matching those is it ? Im kinda confused on this syntax. filter f_local7 { facility(local7) and level(debug..emerg) and match("%ETHC-5") and match("%CLEAR-5"); }; I just want to make shure that is what this is doing... . Thanks all. ~!>D

2 2

Re:[syslog-ng]regex question
by Amodiovalerio Verde 28 Mar '04

28 Mar '04

Setting a level(debug..emerg) is unuseful, cause you want all level. If you want to get all message from local7 and that match %ETH-5 or %CLEAR-5 you have to write it like this : filter f_local7 { facility(local7) and ( match("%ETHC-5") or match("%CLEAR-5") ) ; } ; Hope it will help Amodiovalerio [Hypo] Verde ---------- Initial Header ----------- From : syslog-ng-admin(a)lists.balabit.hu To : syslog-ng(a)lists.balabit.hu Cc : Date : Fri, 26 Mar 2004 11:02:14 -0600 Subject : [syslog-ng]regex question > When regexing in syslog-ng, does this stament below do: > > get all local7 ( all levels ) and _/ALSO/_ match %ETHC-5 / %CLEAR-5 ? > Its not just matching those is it ? Im kinda confused on this syntax. > > filter f_local7 { > facility(local7) and level(debug..emerg) and > match("%ETHC-5") and match("%CLEAR-5"); > }; > > I just want to make shure that is what this is doing... . > > Thanks all. > > ~!>D > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

1 0

Re:[syslog-ng]Process ID
by Amodiovalerio Verde 28 Mar '04

28 Mar '04

Actually RFC3164 doesn't consider the PID as a special field of the syslog message. The TAG part that is the part that actually contain the program name, is defined as a string of alphanumeric chars that cannot exceed 32 characters. Quoting RFC : "The TAG is a string of ABNF alphanumeric characters that MUST NOT exceed 32 characters. Any non-alphanumeric character will terminate the TAG field and will be assumed to be the starting character of the CONTENT field." So a message like "Dec 12 11:11:11 hostname programname[1234]: message", will have the TAG field set to "programname" and the CONTENT field set to "[1234]: message" If you want to retrieve the PID you have to parse on your own the content part. It's not syslog-ng configuration matter, if there is a PID displayed or not in the message, and again, PID is not part of the RFC3164. Hope it will help. Amodiovalerio [Hypo] Verde ---------- Initial Header ----------- From : syslog-ng-admin(a)lists.balabit.hu To : syslog-ng(a)lists.balabit.hu Cc : Date : Sun, 28 Mar 2004 09:42:38 +0200 Subject : [syslog-ng]Process ID > Hello, > > I am a new-comer to syslog-ng, and there one configuration issue that I was unable to > resolve, and did not see any reference to it in the internet: > How can I configure syslog-ng to display the PID of the program (that submits the syslog command)? > > Thanks, > Menny > >

1 0

Process ID
by Menny Hamburger 28 Mar '04

28 Mar '04

Hello, I am a new-comer to syslog-ng, and there one configuration issue that I was unable to resolve, and did not see any reference to it in the internet: How can I configure syslog-ng to display the PID of the program (that submits the syslog command)? Thanks, Menny

1 0

Loads of STATS: dropped > 0 messages
by MH - Entwicklung 26 Mar '04

26 Mar '04

Hello out there, I get loads of STATS: dropped: >0 and don't know why. I've got syslog-ng running on a central log host. Each host also has syslog-ng running. syslog-ng ist configured to use tcp instead of udp. In syslog-ng.conf I have right at the moment: options { long_hostnames(off); sync(10); log_fifo_size(1000); Playing around with sync and log_fifo_size doesn't change anything. syslog-ng is 1.6.0rc4 from Debian Testing. Has anybody any idea about this? Best Regards Manfred extract from syslog: Mar 9 10:02:10 www syslog-ng[302]: STATS: dropped 3 Mar 9 10:02:18 dns syslog-ng[31655]: STATS: dropped 7 Mar 9 10:02:26 bugzilla syslog-ng[31212]: STATS: dropped 3 Mar 9 10:02:27 proxy syslog-ng[32443]: STATS: dropped 3 Mar 9 10:02:38 mail syslog-ng[32293]: STATS: dropped 18 Mar 9 10:06:53 tux syslog-ng[1020]: STATS: dropped 178 Mar 9 10:05:07 brutus syslog-ng[23681]: STATS: dropped 61 Mar 9 10:12:18 dns syslog-ng[31655]: STATS: dropped 27 Mar 9 10:12:28 proxy syslog-ng[32443]: STATS: dropped 27 Mar 9 10:12:38 mail syslog-ng[32293]: STATS: dropped 84 Mar 9 10:16:54 tux syslog-ng[1020]: STATS: dropped 219 Mar 9 10:15:07 brutus syslog-ng[23681]: STATS: dropped 112 Mar 9 10:22:28 bugzilla syslog-ng[31212]: STATS: dropped 28 Mar 9 10:22:38 mail syslog-ng[32293]: STATS: dropped 60 Mar 9 10:26:54 tux syslog-ng[1020]: STATS: dropped 121 Mar 9 10:25:07 brutus syslog-ng[23681]: STATS: dropped 97 Mar 9 10:32:12 www syslog-ng[302]: STATS: dropped 27 Mar 9 10:32:38 mail syslog-ng[32293]: STATS: dropped 29 Mar 9 10:36:54 tux syslog-ng[1020]: STATS: dropped 248 Mar 9 10:35:07 brutus syslog-ng[23681]: STATS: dropped 80 Mar 9 10:42:38 mail syslog-ng[32293]: STATS: dropped 74 Mar 9 10:46:54 tux syslog-ng[1020]: STATS: dropped 92 Mar 9 10:45:08 brutus syslog-ng[23681]: STATS: dropped 15 Mar 9 10:52:38 mail syslog-ng[32293]: STATS: dropped 85 Mar 9 10:56:54 tux syslog-ng[1020]: STATS: dropped 201 Mar 9 10:55:09 brutus syslog-ng[23681]: STATS: dropped 135 -- manfred heubach edv und neue medien Hindenburgstr. 47 D-73728 Esslingen Tel. +49 711 9315824 Fax +49 711 9315825 www.heubach-edv.de Informationstechnologie und Telekommunikation fÃ¼r Unternehmen

5 7