March 2004 - syslog-ng - lists.balabit.hu

AW: [syslog-ng]Matching Empty Syslog Lines
by stefan.schaefers＠bhf.ing.com 11 Mar '04

11 Mar '04

Hi Juergen, try this match("^\s$")..... may be that works ^ means begin of line \s space/newline/tab $ end of line greetings Stefan -----Ursprüngliche Nachricht----- Von: Juergen Wolf [mailto:wolf@idmt.fhg.de] Gesendet: Donnerstag, 11. März 2004 16:52 An: syslog-ng(a)lists.balabit.hu Betreff: [syslog-ng]Matching Empty Syslog Lines Hoi, I get loads of empty lines in my syslog like: Mar 11 16:38:29 il062 dm: Mar 11 16:38:35 il062 sshd: Mar 11 16:37:19 il062 alsa: So I am looking for a Match-Expression to omit these lines. Unfortunately match("^$") and match("\A\z") did no good at all. Any idea how to get rid of these lines? Regards, Juergen -- email: wolf(a)idmt.fhg.de gilb: Fraunhofer-Institut fuer Digitale Medientechnologie IDMT 98693 Ilmenau, Helmholtzring 1 Tel.: +49 3677 69-4882 Fax: +49 3677 69-4399 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Matching Empty Syslog Lines
by Juergen Wolf 11 Mar '04

11 Mar '04

Hoi, I get loads of empty lines in my syslog like: Mar 11 16:38:29 il062 dm: Mar 11 16:38:35 il062 sshd: Mar 11 16:37:19 il062 alsa: So I am looking for a Match-Expression to omit these lines. Unfortunately match("^$") and match("\A\z") did no good at all. Any idea how to get rid of these lines? Regards, Juergen -- email: wolf(a)idmt.fhg.de gilb: Fraunhofer-Institut fuer Digitale Medientechnologie IDMT 98693 Ilmenau, Helmholtzring 1 Tel.: +49 3677 69-4882 Fax: +49 3677 69-4399

1 0

(no subject)
by Harry Hambi 09 Mar '04

09 Mar '04

Hi is there anybody out there who could take me through the steps ( keeping the steps newbie size) needed to install & configure syslog-ng on redhat linux.I have some cisco switches I would like to moniter ie attempted logons, changes made to config, etc would like to be able to view the logs on a web browswer.my linux experience is 2 weeks.....very keen to learn more. Rgds. Harry. BBCi at http://www.bbc.co.uk/ This e-mail (and any attachments) is confidential and may contain personal views which are not the views of the BBC unless specifically stated. If you have received it in error, please delete it from your system. Do not use, copy or disclose the information in any way nor act in reliance on it and notify the sender immediately. Please note that the BBC monitors e-mails sent or received. Further communication will signify your consent to this.

1 0

RE: [syslog-ng]'debug' priority?
by Hamilton Andrew 09 Mar '04

09 Mar '04

I may not be reading this right and forgive me if this is the case, but syslog-ng will only log debug when the message is sent with level debug. It doesn't work like regular syslog in that it records up to that particular level. If you want everything from emerg to debug you use level(emerg..debug). Have you tried to send something like logger -p local1.debug "testing" to it to see what happens? Again I apologize if I misread this. Regards, Drew -----Original Message----- From: Pavel Urban [mailto:urbanp@mlp.cz] Sent: Monday, March 08, 2004 1:59 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]'debug' priority? That's really strange. Here is some additional info: root@dev-ims1 # /sbin/syslog-ng -V syslog-ng 1.6.2 root@dev-ims1 # uname -a SunOS dev-ims1 5.8 Generic_108528-23 sun4u sparc SUNW,Ultra-60 root@dev-ims1 # gcc --version gcc (GCC) 3.2.1 Copyright (C) 2002 Free Software Foundation, Inc. compilation: ./configure --enable-sun-streams --enable-sun-door --with-libol=/usr/local/bin; make; make install Complete truss output is available here: http://www.marvin.cz/ng . It shows start of syslog-ng under truss utility, some restarts (kill -HUP) and activity after 'logger' command. If I can deliver more info, just tell me what you need. I really like syslog-ng, but there are some problems that cause us trouble... and I really want them to go away. Balazs Scheidler wrote: > 2004-03-08, h keltezéssel 15:41-kor Pavel Urban ezt írta: > >>I cannot confirm this. Here is an output from truss utility (only >>relevant part): <snip> > > Reading the source I still cannot see how it would create the file > during initialization. -- *********************************************************************** Pavel Urban (pavel.urban(a)hq.iol.cz) IOL system disaster Internet OnLine, www.iol.cz *********************************************************************** Vegetables should not operate electronic equipment. Computer Stupidities, http://rinkworks.com/stupid/ *********************************************************************** _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

4 3

Faultfinding techniques for logging failure.
by Adam 09 Mar '04

09 Mar '04

There is a linux based testing server running syslog-ng and Nagios (redhat 7.3). There are a few NT servers that are supposed to log their backups to this server using the syslog-ng WinNT client. Logging to port 5140. They don't, however data sent via telnet to port 5140 both sent by itself and by one other machine is logged. Any ideas for further faultfinding, because I'm now stumped. Will do some further testing related to potential firewalling but there shouldn't be one in the way. Also, how is the priority passed to 3rd party programs. I get lines formatted as below, from which I can extract a time-stamp, hostname and message. But no priority. Is priority normally incorporated as a part of the message? <13>Mar 5 13:00:44 localhost TEST

2 1

'debug' priority?
by Pavel Urban 08 Mar '04

08 Mar '04

Hello, I've just tried 1.6.2 on Solaris 8 and encountered one problem. When I try to set filter f_filter_test { level(debug); }; I can see no output and no activity like opening destination file. When I try to change this priority to 'notice', the file gets opened and output is send there. What's wrong with 'debug' priority...? The rest of my text config follows. options { sync (1); time_reopen (10); log_fifo_size (2048); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; destination d_test { file("/var/log/testlog"); }; log { source(s_sys); filter(f_filter_test); destination(d_test); flags(catchall); }; Thanks for any information, including direction to TFM ;-) -- *********************************************************************** Pavel Urban (pavel.urban(a)ct.cz) IOL system disaster Internet OnLine, www.iol.cz (owned by Czech Telecom, www.ct.cz) *********************************************************************** Vegetables should not operate electronic equipment. Computer Stupidities, http://rinkworks.com/stupid/ ***********************************************************************

2 4

Perl interface to syslog under Solaris
by Loic Minier 08 Mar '04

08 Mar '04

Hi, I am using the Perl interface to syslog (called Sys::Syslog) under Solaris. A lot of people are complaining that it doesn't work, especially with the "stream" support, and I had to switch to udp(). My problem is that I am using template("$MSG\n") for logging, which seems to work for other udp sources, but produces a: "myPerlProgram: log message" instead of a simple "log message" in the logs. It is the same value as in my openlog() ident option, and if I use an empty ident, I get: "root: log message" instead. Can anyone give an example how not to insert such a prefix in my messages? I really would like to use the "stream" interface instead of udp() because Perl makes many assumptions on where and how I'd like to log. Here's my Perl init: use Sys::Syslog qw(:DEFAULT setlogsock); setlogsock('inet'); openlog('', '', 'local7'); I feel desperate, -- Loïc Minier <lool(a)dooz.org>

2 4

Help with binaries?
by Riner, Donald R (Zero Chaos) 05 Mar '04

05 Mar '04

Hello all, Can anyone point me to downloadable binaries for the accessory programs ipfilter and pfil for Sparc Solaris 8 & 9 please? I'm having a real struggle getting them to compile and would appreciate a shortcut. Thanks very much Don R. Riner UNIX System Administrator - Contractor EDS - Allison Transmission Div. GM 4700 West 10th Street Mail code H04 Indianapolis, IN 46222 Ph: 317.242.7438 Fax: 317.242.0389 mailto:donald.riner-eds@eds.com <mailto:donald.riner-eds@eds.com>

1 0

Re: [syslog-ng]What's wrong with my syntax? (Solved)
by Adam 05 Mar '04

05 Mar '04

Found the fault. I had installed syslog using the source first before I had tried using the spec file, and when I had updated it it still used the old executable. Also noted in the FAQ, missed this the other times - "Syslog-ng 1.5.3 added support for user definable log file formats.", as I was still using 1.4.13 this was the fault. Just installed 1.5.26, and used which to track down and delete the old executable. Problem solved

1 0

Re: [syslog-ng]What's wrong with my syntax?
by Adam 05 Mar '04

05 Mar '04

> Did you try $SEC instead of $SECOND? I've actually tested it with template("") to see if the mistake was in that part of the syntax. Still had the same error, also tried the same config file under syslog-ng 1.6.2 to no avail.

2 1