April 2004 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]syslog-ng 1.6.1
by Andrews, Glenn J (Glenn) 22 Apr '04

22 Apr '04

Well the local1.info works to /var/log/network when I do # logger -p local1.info -t local1 "This is a test for local1.info" but when I do ... # logger -p local1.warning -t local1 "this is a test on local1.warning" I get vvvv in /var/log/syslog Apr 22 16:33:57 10.100.40.20 syslog-ng[874]: io.c: do_write: write() failed (errno 32), Broken pipe Apr 22 16:33:57 10.100.40.20 syslog-ng[874]: pkt_buffer::do_flush(): Error flushing data Apr 22 16:33:57 10.100.40.20 syslog-ng[874]: Connection broken to AF_INET(10.100.40.1:514), reopening in 10 seconds Glenn -----Original Message----- From: Coward, Robert (Contractor) [mailto:Robert.Coward@deploymenthealth.osd.mil] Sent: Thursday, April 22, 2004 2:47 PM To: syslog-ng(a)lists.balabit.hu Cc: Andrews, Glenn J (Glenn) Subject: RE: [syslog-ng]syslog-ng 1.6.1 Looks fine to me. Although, I do not know what this line does: source network { udp(); tcp(); }; Since you do not have a log line that references the "network" source, I don't know wht its there. Maybe more stuff in your config, I can't see. Everything else looks okay. --- 22 April 2004 "As nightfall does not come all at once, neither does oppression. In both instances, there is a twilight. And it is in such twilight that we all must be aware of change in the air, however slight, lest we become unwitting victims of darkness." (William O. Douglas, 1939-1975) --- Robert V. Coward UNIX System Administrator Computer Science Corporation "Andrews, Glenn J (Glenn)" <gjandrews(a)lucent.com> on 04/22/2004 02:33:01 PM To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> cc: "'Coward, Robert (Contractor)'" <Robert.Coward(a)deploymenthealth.osd.mil> Subject: RE: [syslog-ng]syslog-ng 1.6.1 Excellent. So just to be sure I understand ya.. **************************************************** options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (no); }; source local { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source network { udp(); tcp(); }; destination networklog { file("/var/log/network"); }; destination syslog(a)10.100.40.1 { tcp("10.100.40.1" port(514)); }; filter f_network_logs { facility(local1) and level(info); }; filter f_network_logs2 { facility(local1) and level(warning); }; log { source(local); filter(f_network_logs); destination(networklog); }; log { source(local); filter(f_network_logs2); destination(syslog(a)10.100.40.1); }; **************************************************** Is this correct ? Glenn -----Original Message----- From: Coward, Robert (Contractor) [mailto:Robert.Coward@deploymenthealth.osd.mil] Sent: Thursday, April 22, 2004 1:15 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog-ng 1.6.1 Glenn, What you need is a filter, I think. Heres how: source src { unix-stream ("/dev/log"); internal (); }; destination network_logs { file("/var/log/network.log"); }; filter f_network_logs { facility(local1) and level(info); }; Now do the logging: log { source(src); destination(network_logs); filter(f_network_logs); }; I think that should work for the first one. For the second one i think you will need to set a filter like the first but set the destination like so: destination syslog(a)10.100.40.1 { tcp("10.100.40.1" port(514)); }; I think thats about it. --- 22 April 2004 "Allow the President to invade a neighboring nation whenever he shall deem it necessary to repel an invasion and you allow him to do so whenever he may choose to say he deems it necessary for such purpose, and you allow him to make war at pleasure.... If today he should choose to say he thinks it necessary to invade Canada to prevent the British from invading us, how could you stop him? You may say to him, "I see no probability of the British invading us," but he will say to you, "Be silent; I see it, if you don't." (Abrham Lincoln, 1809-1865) --- Robert V. Coward UNIX System Administrator Computer Science Corporation _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]syslog-ng 1.6.1
by Coward, Robert (Contractor) 22 Apr '04

22 Apr '04

Looks fine to me. Although, I do not know what this line does: source network { udp(); tcp(); }; Since you do not have a log line that references the "network" source, I don't know wht its there. Maybe more stuff in your config, I can't see. Everything else looks okay. --- 22 April 2004 "As nightfall does not come all at once, neither does oppression. In both instances, there is a twilight. And it is in such twilight that we all must be aware of change in the air, however slight, lest we become unwitting victims of darkness." (William O. Douglas, 1939-1975) --- Robert V. Coward UNIX System Administrator Computer Science Corporation "Andrews, Glenn J (Glenn)" <gjandrews(a)lucent.com> on 04/22/2004 02:33:01 PM To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> cc: "'Coward, Robert (Contractor)'" <Robert.Coward(a)deploymenthealth.osd.mil> Subject: RE: [syslog-ng]syslog-ng 1.6.1 Excellent. So just to be sure I understand ya.. **************************************************** options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (no); }; source local { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal (); }; source network { udp(); tcp(); }; destination networklog { file("/var/log/network"); }; destination syslog(a)10.100.40.1 { tcp("10.100.40.1" port(514)); }; filter f_network_logs { facility(local1) and level(info); }; filter f_network_logs2 { facility(local1) and level(warning); }; log { source(local); filter(f_network_logs); destination(networklog); }; log { source(local); filter(f_network_logs2); destination(syslog(a)10.100.40.1); }; **************************************************** Is this correct ? Glenn -----Original Message----- From: Coward, Robert (Contractor) [mailto:Robert.Coward@deploymenthealth.osd.mil] Sent: Thursday, April 22, 2004 1:15 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog-ng 1.6.1 Glenn, What you need is a filter, I think. Heres how: source src { unix-stream ("/dev/log"); internal (); }; destination network_logs { file("/var/log/network.log"); }; filter f_network_logs { facility(local1) and level(info); }; Now do the logging: log { source(src); destination(network_logs); filter(f_network_logs); }; I think that should work for the first one. For the second one i think you will need to set a filter like the first but set the destination like so: destination syslog(a)10.100.40.1 { tcp("10.100.40.1" port(514)); }; I think thats about it. --- 22 April 2004 "Allow the President to invade a neighboring nation whenever he shall deem it necessary to repel an invasion and you allow him to do so whenever he may choose to say he deems it necessary for such purpose, and you allow him to make war at pleasure.... If today he should choose to say he thinks it necessary to invade Canada to prevent the British from invading us, how could you stop him? You may say to him, "I see no probability of the British invading us," but he will say to you, "Be silent; I see it, if you don't." (Abrham Lincoln, 1809-1865) --- Robert V. Coward UNIX System Administrator Computer Science Corporation _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]syslog-ng 1.6.1
by Andrews, Glenn J (Glenn) 22 Apr '04

22 Apr '04

Excellent. So just to be sure I understand ya.. **************************************************** options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (no); }; source local { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source network { udp(); tcp(); }; destination networklog { file("/var/log/network"); }; destination syslog(a)10.100.40.1 { tcp("10.100.40.1" port(514)); }; filter f_network_logs { facility(local1) and level(info); }; filter f_network_logs2 { facility(local1) and level(warning); }; log { source(local); filter(f_network_logs); destination(networklog); }; log { source(local); filter(f_network_logs2); destination(syslog(a)10.100.40.1); }; **************************************************** Is this correct ? Glenn -----Original Message----- From: Coward, Robert (Contractor) [mailto:Robert.Coward@deploymenthealth.osd.mil] Sent: Thursday, April 22, 2004 1:15 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog-ng 1.6.1 Glenn, What you need is a filter, I think. Heres how: source src { unix-stream ("/dev/log"); internal (); }; destination network_logs { file("/var/log/network.log"); }; filter f_network_logs { facility(local1) and level(info); }; Now do the logging: log { source(src); destination(network_logs); filter(f_network_logs); }; I think that should work for the first one. For the second one i think you will need to set a filter like the first but set the destination like so: destination syslog(a)10.100.40.1 { tcp("10.100.40.1" port(514)); }; I think thats about it. --- 22 April 2004 "Allow the President to invade a neighboring nation whenever he shall deem it necessary to repel an invasion and you allow him to do so whenever he may choose to say he deems it necessary for such purpose, and you allow him to make war at pleasure.... If today he should choose to say he thinks it necessary to invade Canada to prevent the British from invading us, how could you stop him? You may say to him, "I see no probability of the British invading us," but he will say to you, "Be silent; I see it, if you don't." (Abrham Lincoln, 1809-1865) --- Robert V. Coward UNIX System Administrator Computer Science Corporation _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]syslog-ng 1.6.1
by Coward, Robert (Contractor) 22 Apr '04

22 Apr '04

Glenn, What you need is a filter, I think. Heres how: source src { unix-stream ("/dev/log"); internal (); }; destination network_logs { file("/var/log/network.log"); }; filter f_network_logs { facility(local1) and level(info); }; Now do the logging: log { source(src); destination(network_logs); filter(f_network_logs); }; I think that should work for the first one. For the second one i think you will need to set a filter like the first but set the destination like so: destination syslog(a)10.100.40.1 { tcp("10.100.40.1" port(514)); }; I think thats about it. --- 22 April 2004 "Allow the President to invade a neighboring nation whenever he shall deem it necessary to repel an invasion and you allow him to do so whenever he may choose to say he deems it necessary for such purpose, and you allow him to make war at pleasure.... If today he should choose to say he thinks it necessary to invade Canada to prevent the British from invading us, how could you stop him? You may say to him, "I see no probability of the British invading us," but he will say to you, "Be silent; I see it, if you don't." (Abrham Lincoln, 1809-1865) --- Robert V. Coward UNIX System Administrator Computer Science Corporation

1 0

Avoid multiple, repeated Logmessage flooding ?
by Michael Arndt 22 Apr '04

22 Apr '04

Hello * is there any practicable solution with syslog-ng to avoid the following problem: 40 hosts have the same problem and flood the central loghost with the identical, many times repeated message to avoid this ideally one would need an equivalent to : "last message repeated n times" Questions: is there any possibility on the receiver (central loghost) to filter or drop multiple identical messages ? E.g. each hosts entry enters a centarl log only once or n times ? On sender side a ringbuffer filter perl script could be a solution: ringbuffer flushes identical messages in buffer and forwards it only one time for each count of messages. Has anyone more efficient solutions ? thanks Micha

1 0

syslog-ng 1.6.1
by Andrews, Glenn J (Glenn) 21 Apr '04

21 Apr '04

I have been asked to add some entries to /etc/syslog.conf. (They don't know I am using syslog-ng 1.6.1 :-) ). I am uncertain as to what the entries would translate to in syslog-ng 'language'. Here are the entries.. local1.info /var/log/network.log local1.warning @10.100.40.1 Glenn.

1 0

Patch for mysql destination in syslog-ng 1.6.2
by Steven Van Acker 20 Apr '04

20 Apr '04

Hi, I have added a new log destination to syslog-ng. The patch can be found here: http://deepstar.ekonomika.be/Projects/patches/syslog-ng-1.6.2-with.mysql.de… More information here: http://deepstar.ekonomika.be/Projects/patches/syslog-ng-1.6.2-with.mysql.de… greets, -- Steven

2 1

STATS: dropped > 0 messages on centralized syslog
by Luigi Augello 20 Apr '04

20 Apr '04

Hello at all I have a problem with a message STATS dropped actually I test a syslog server that I would use to register the logs of all administrative machines and I use a databases. The log go to databases through a pipe. I have read of this problem resolved by Manfred but I dont have understand which operations are necessary Tank a lot Luigi

1 0

Moving from syslog -> syslog-ng - not logging
by Mark Robinson 16 Apr '04

16 Apr '04

I'm trying to move to syslog-ng but I can't get anything other than system messages to write to the log. Here's the syslog.conf file that woks: ---------------------------------------------------------------------------- ---- *.err;kern.notice;auth.notice /dev/console *.err;kern.debug;daemon.info;daemon.notice;mail.crit /var/adm/messages *.alert;kern.err;daemon.err operator *.alert root *.emerg * mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost) ifdef(`LOGHOST', , *.err /var/adm/messages user.err /dev/console user.err /var/adm/messages user.alert `root, operator' user.emerg * ) local7.debug /data1/syslogs/nd.log auth.debug /data1/syslogs/nd.log local3.err /data1/syslogs/nd.log *.err;*.debug;*.crit;*.warning;*.info;*.notice /data1/syslogs/mcs.log local2.notice @sudosyslog.ca.company.com ---------------------------------------------------------------------------- ---- How should a very basic syslog-ng.conf file be written?

2 1

syslog-ng + stunnel
by lbw＠free.fr 15 Apr '04

15 Apr '04

hello, i am trying to securize the transmission of logs to my server via stunnel. syslog-ng without stunnel goes on but if i run stunnel it returns an error "connecting fd 6 to inetadr 127.0.0.1, port 514" when syslog-ng tries to send logs. i try the way described at http://www.stunnel.org/examples/syslog-ng.html and i also try to change the number of the port to no avail (i don't have firewall which could deny the connection). In fact, i wonder if stunnel may run as a demon because when i make "#stunnel /etc/stunnel/stunnel.conf" as it's said, "#ps aux" don't show it. Is it normal? so, i think my error of connection comes from the fact that nothing is listening on port 514 (i have try to connect on it via telnet and obtained "connection refused"). how can i check if stunnel is well running? --- configuration of the client: #syslog-ng destination stunnel { tcp("127.0.0.1" port(514)); }; #stunnel client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 [5140] accept = 127.0.0.1:514 connect = 10.1.1.200:5140 --- any suggestions? thanks, olivier

1 0