May 2004 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]min options needed for logserver?
by Hamilton, Andrew 10 May '04

10 May '04

Unfortunately, optimizing it is really particular to your setup and what you are trying to do. You can use no options and take just defaults or you can have 15 different ones. It is difficult to tell what minimum you need without knowing how your system is configured and what you want it to do. A start might be just to use no options and work from there. Regards, Drew -----Original Message----- From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] Sent: Monday, May 10, 2004 1:09 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]min options needed for logserver? To aid in understanding and minimize complexity I'd like to use the minimum options in syslog-ng.conf possible. Different examples I've seen use lots of different options so I'm not sure which ones are crucial. What is a good smallest set of vital options for a log server? Chris _______________________________________ Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax : (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

min options needed for logserver?
by seberino＠spawar.navy.mil 10 May '04

10 May '04

To aid in understanding and minimize complexity I'd like to use the minimum options in syslog-ng.conf possible. Different examples I've seen use lots of different options so I'm not sure which ones are crucial. What is a good smallest set of vital options for a log server? Chris _______________________________________ Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax : (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

1 0

how to push sulogs/utmp/wtmp to central logserver
by Nilesh Naik 10 May '04

10 May '04

Hello All is it possible to push sulogs/wtmp/utmp etc logfiles from the hosts running solaris 7/8/9, to the redhat linux box running syslog-ng ? if this is possible kindly guide me how can i configure the same and how to rotate the sulog/wtmp/utmp etc log files on solaris regards Prashant __________________________________ Do you Yahoo!? Win a $20,000 Career Makeover at Yahoo! HotJobs http://hotjobs.sweepstakes.yahoo.com/careermakeover

1 0

Re: [syslog-ng]How to log into mysql database - help required
by Michael Earls 10 May '04

10 May '04

I would use if statement in cron to check to see if this is running if not running start it. ## Mysql insert run the check 0-55/1 * * * * root if [ -x /bin/bash ] && [ -r /etc/syslog-ng/mysql_pipe.sh ]; then /bin/bash /etc/syslog-ng/mysql_pipe.sh >> /var/log/syslog-ng/mysql_pipe.log 2>&1; fi Michael >>> gjg(a)sltnet.lk 5/10/2004 8:13:02 AM >>> I require to log syslogs into a mysql database. I used syslog-ng (downloaded the rpm for syslog-ng - ver 1.6 and libol from rpmseek.com and installed it) and used the information available in the site http://www.vermeer.org/display_doc.php?doc_id=1 for this purpose. As given in this website (1) First I made the pipe file using the following command # mkfifo /tmp/mysql.pipe (2) Then I used the following command to log into mysql (first tried with local logging) # mysql -u root --password=passwd syslog < /tmp/mysql.pipe This command gets stuck But when syslog-ng is stopped and started it logs and the contenets in /tmp/mysql.pipe gets loaded into the database table. The following commands were used to stop and start syslog-ng /etc/init.d/syslog-ng stop # Stop syslog-ng /etc/ini.d/syslog-ng start # Start syslog-ng (3) The site states about an initialization script like this one which needs to be started at start up. The script given is provided below. #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u theuserid --password=thepassword syslogdb < /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi Where should I put this script and how to start it up at initialization? Could you explain the working pricipal of this script?

1 0

Eventog to syslog
by Edwards, Thomas 10 May '04

10 May '04

Has anyone ever used the Eventlog to syslog program found here. https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys I was trying to decipher their input as to how to word the filters and am coming up short other than putting a direct match for the host name I am using. Any help would be greatly appreciated. Tom ******************************************** This message is intended only for the use of the Addressee and may contain information that is PRIVILEGED and CONFIDENTIAL. If you are not the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please erase all copies of the message and its attachments and notify us immediately. Thank you. ********************************************

4 3

RE: [syslog-ng]How to log into mysql database - help required
by Hamilton, Andrew 10 May '04

10 May '04

Try going here: <http://www.campin.net/syslog-ng/faq.html> http://www.campin.net/syslog-ng/faq.html Regards. -----Original Message----- From: Gayathri J. Gunawardena [mailto:gjg@sltnet.lk] Sent: Monday, May 10, 2004 8:13 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]How to log into mysql database - help required I require to log syslogs into a mysql database. I used syslog-ng (downloaded the rpm for syslog-ng - ver 1.6 and libol from rpmseek.com and installed it) and used the information available in the site http://www.vermeer.org/display_doc.php?doc_id=1 <http://www.vermeer.org/display_doc.php?doc_id=1> for this purpose. As given in this website (1) First I made the pipe file using the following command # mkfifo /tmp/mysql.pipe (2) Then I used the following command to log into mysql (first tried with local logging) # mysql -u root --password=passwd syslog < /tmp/mysql.pipe This command gets stuck But when syslog-ng is stopped and started it logs and the contenets in /tmp/mysql.pipe gets loaded into the database table. The following commands were used to stop and start syslog-ng /etc/init.d/syslog-ng stop # Stop syslog-ng /etc/ini.d/syslog-ng start # Start syslog-ng (3) The site states about an initialization script like this one which needs to be started at start up. The script given is provided below. #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u theuserid --password=thepassword syslogdb < /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi Where should I put this script and how to start it up at initialization? Could you explain the working pricipal of this script?

1 0

How to log into mysql database - help required
by Gayathri J. Gunawardena 10 May '04

10 May '04

I require to log syslogs into a mysql database. I used syslog-ng (downloaded the rpm for syslog-ng - ver 1.6 and libol from rpmseek.com and installed it) and used the information available in the site http://www.vermeer.org/display_doc.php?doc_id=1 for this purpose. As given in this website (1) First I made the pipe file using the following command # mkfifo /tmp/mysql.pipe (2) Then I used the following command to log into mysql (first tried with local logging) # mysql -u root --password=passwd syslog < /tmp/mysql.pipe This command gets stuck But when syslog-ng is stopped and started it logs and the contenets in /tmp/mysql.pipe gets loaded into the database table. The following commands were used to stop and start syslog-ng /etc/init.d/syslog-ng stop # Stop syslog-ng /etc/ini.d/syslog-ng start # Start syslog-ng (3) The site states about an initialization script like this one which needs to be started at start up. The script given is provided below. #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u theuserid --password=thepassword syslogdb < /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi Where should I put this script and how to start it up at initialization? Could you explain the working pricipal of this script?

1 0

sample syslog-ng.conf with swatch alerts
by Nilesh Naik 09 May '04

09 May '04

Hi any one having syslog-ng.conf file , for linux loghost, getting logs from the solaris and linux servers then please mail me the same for the reference , actually i am getting logs from all the servers but unfortunately , syslog-ng is not passing the same to swatch , (i guess) so if some one can send the same then would be very helpful to me in setting up a loghost in our datacenter regards Prashant __________________________________ Do you Yahoo!? Win a $20,000 Career Makeover at Yahoo! HotJobs http://hotjobs.sweepstakes.yahoo.com/careermakeover

1 0

help required !!!! bit urgent
by Nilesh Naik 09 May '04

09 May '04

Hello Sir i have sucessfully installed 1) syslog-ng version 1.4.17 2) swatch-3.1 on my redhat 7.2 linux server , which is our central loghost system , all other server are mix of solaris 7,8,9 & redhat linux 7.x, The problem i am facing is i am not able to generate real time alerts using swatch , Following are my configuration files , syslog-ng.conf options { sync (1); time_reopen (10); log_fifo_size (2048); long_hostnames (off); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); }; source net { udp(); }; destination swatch { program("/usr/bin/swatch --read-pipe=\"cat /dev/fd/0\""); }; log { source(net); destination(swatch); }; destination hosts { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(net); destination(hosts); }; here , i am getting lots under /var/log/HOSTS directory , but not getting logs of the loghost itself , my swatchrs is small and simple coz its not working at the moment , the same is bellow swatchrc watchfor /error Authentication/ echo exec echo $0 | mail /usr/bin/mail -s \"log 11alert\" user\(a)testdomain.com throttle 10:00 watchfor /error Authentication/ echo exec echo $0 | bash-mail-alert swap_space user(a)testdomain.com ~ nighter of this is generating any alerts , nor any files is getting created under /root/swatch directory , but when i start the syslog-ng , and then give ps -ef | grep swatch , i can see swatch process i guess swatch is not getting anything from syslog-ng , no clues why ? please help me and guide me where the problem is , would be really grateful to you sir regards Prashant __________________________________ Do you Yahoo!? Win a $20,000 Career Makeover at Yahoo! HotJobs http://hotjobs.sweepstakes.yahoo.com/careermakeover

1 0

permissions
by mark 08 May '04

08 May '04

Ok, success is on the horizon. I can start syslog-ng like this: syslog-ng -d -v -f /etc/syslog-ng/syslog-ng.conf -u log -g log where "log" is an unprivileged user (with /bin/false as a shell when it's all working, to prevent logins). The config file specifies that syslog-ng writes to: /var/log/syslog-ng/local/ But the debugging output is giving "permission denied" errors. The permissions on the directories are setup like this: # ls /var drwxr-x--- 9 root root 4096 May 8 05:11 log/ # ls /var/log drwx------ 3 log log 4096 May 8 05:13 syslog-ng/ # ls /var/log/syslog-ng drwx------ 2 log log 4096 May 8 05:13 local/ So surely the user "log" and therefore syslog-ng has permission to read and write in this directory? It doesn't appear to be the case as I can $ su log and get permission denied errors whilst trying to read, write, or even cd into the directory. The permissions on /var/log need to be set as they are, however I'm guessing that this is the root of the problem (no pun intended). Can anyone suggest a fix? mark www.darklogik.org

2 2