July 2004 - syslog-ng - lists.balabit.hu

?? Connection broken to AF_INET(127.0.0.1:514), reopening in 60 seconds
by seberino＠spawar.navy.mil 27 Jul '04

27 Jul '04

I don't know what is the trouble with my remote syslog-ng/stunnel setup since I turned off packet filtering. Any guidance would be greatly appreciated. Here is error message in log: Jul 26 11:06:47 seberino3 syslog-ng[3245]: Connection broken to AF_INET(127.0.0.1:514), reopening in 60 seconds Here is my syslog-ng.conf: options {long_hostnames(no); keep_hostname(yes); chain_hostnames(no);}; source client_sources {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination local_dest {file("/var/log/messages");}; destination remote_dest {tcp("127.0.0.1" port(514));}; log {source(client_sources); destination(local_dest);}; log {source(client_sources); destination(remote_dest);}; Chris

3 4

logging messages from Netscreen to syslog-ng - need to pipe to MySQL db now
by Brandon Rodak 26 Jul '04

26 Jul '04

This might be a basic question but I am missing something. I believe I am successfully sending the Netscreen firewall messages to a remote syslog server (running syslog-ng) as I have them stored in an appropriate log file. What I want to do now is pipe this file to a MySQL database so that I can retrieve the data later for analysis and to post to a web interface. I have even tried the simple syslong-ng.conf example below (unrelated to my Netscreen logs) in an attempt to pipe data. destination database { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY','$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; Nothing ever appears in the mysql.pipe file. Also I need advice on what fields I should be extrapolating out of the log for use in the Database; I realize the fields above are not the ones I would need from my Netscreen log but any information or leads on how to use the Netscreen logs correctly with a database would be awesome. Thanks for any and all help! It is greatly appreciated! Brandon -- Brandon Rodak Web Services Computer Marketing Corporation http://www.cmcflex.com

1 0

Re: syslog-ng on OSX 10.3.4
by Ken Toney 26 Jul '04

26 Jul '04

Richard, I haven't gotten syslog-ng installed on OS X 10.3.4 yet, but can share with you some resources I have for information. You might try reading <http://sial.org/howto/logging/> <http://www.campin.net/newlogcheck.html> I'd be happy to share my conf file with you once I get syslog-ng running, but I am one step behind you. I am trying to install syslog-ng 1.6.4 on OS X 10.3.4 and can't. Did you run into any problems installing syslog-ng? Thanks, Ken On Jul 14, 2004, at 3:53 AM, syslog-ng-request(a)lists.balabit.hu wrote: > Message: 4 > Date: Fri, 09 Jul 2004 12:26:26 -0700 > From: OpenMacNews <syslog-ng.20.openmacnews(a)spamgourmet.com> > To: syslog-ng <syslog-ng(a)lists.balabit.hu> > Subject: [syslog-ng]syslog-ng on OSX 10.3.4 > Reply-To: syslog-ng(a)lists.balabit.hu > > hi all, > > i'm new to syslog-ng. > > i've installed 1.7x on OSX 10.3.4; now, starting to deal with the > config file. > > i dl'd and searched thru the list archives for pointers, etc. and > found the last relevant, post by Kim Cary, but nothing further. > > i contacted Kim -- not yet finished/successful. > > soooooo, to ask: has anyone here got syslog-ng up/running on OSX, and > would you be willing to share your conf file? > > thx! > > richard

2 3

Jailing syslog-ng on OpenBSD 3.5
by markzero＠logik.ath.cx 26 Jul '04

26 Jul '04

Hello. I'm having difficulty jailing syslog-ng under OpenBSD 3.5. My exact steps so far (after having added group _syslogng and user _syslogng): # mkdir -p /jail/sysng # mkdir -p /jail/sysng/usr/local/sbin # mkdir -p /jail/sysng/usr/lib # mkdir -p /jail/sysng/usr/libexec # mkdir -p /jail/sysng/dev # mkdir -p /jail/sysng/var/log # mkdir -p /jail/sysng/etc/syslog-ng # cp /usr/local/sbin/syslog-ng /jail/sysng/usr/local/sbin # cp /usr/lib/libc.so.30.3 /jail/sysng/usr/lib # cp /usr/libexec/ld.so /jail/sysng/usr/libexec # cp /etc/syslog-ng/syslog-ng.conf /jail/sysng/etc/syslog-ng/ # chown -R _syslogng._syslogng /jail/sysng # ln /dev/log /jail/sysng/dev/log I should explain that I installed syslog-ng from a package, as I have no access to a compiler on this machine (and my other machine is currently in pieces being repaired) - therefore I just moved the binaries into the jail. Running the command: # chroot -g _syslogng -u _syslogng /jail/sysng /usr/local/sbin/syslog-ng Does not give any errors, and log files are indeed created in /jail/var/log (as per the configuration file) - HOWEVER, nothing on the system is actually logged. Syslog-ng logs its own 'birth and death' but does not, for example, log mail or even the reboot command. Is there some glaring error here? The debugging output from syslog-ng gives no errors either, I'm lost as to where to go next to track down the problem. mark ps: I excluded my config as it's pretty much the stock sample config with uccp and ppp removed. If this is relevant, I will attach it to my next email.

1 1

please help find the "parse error" in this small syslog-ng.conf...
by seberino＠spawar.navy.mil 26 Jul '04

26 Jul '04

This syslog-ng.conf: options {long_hostnames(no); keep_hostname(yes); chain_hostnames(no);}; source client_sources {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination local_dest {file("/var/log/messages");}; destination remote_dest {tcp(ip("127.0.0.1") port(514));}; log {source(client_sources); destination(local_dest);}; log {source(client_sources); destination(remote_dest);}; gives this error messages when I try to use it... [laptop root /etc/rc.d] # /usr/local/sbin/syslog-ng -f /etc/syslog-ng.conf parse error at 8 Parse error reading configuration file, exiting. (line 8) I've stared at this syslog-ng.conf for a long time and can't see what the problem is. Any help would be greatly appreciated. Sincerely, Chris

2 2

RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers
by Amaral, Angelo 24 Jul '04

24 Jul '04

Andrew, I put in my system, the hosts.allow below: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ # hosts.allow This file describes the names of the hosts which are # allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # in.tftpd: ALL :allow sshd: ALL :allow ALL: ALL :deny ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ And the configuration continue not working. May you help me, please. Thanks. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Andrew J Caines Sent: quarta-feira, 21 de julho de 2004 20:25 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers Angelo, > I compile the syslog-ng with support tcpwrappers. > I put in hosts.deny my filter and it?s not work. From reading the documentation, you and Joe should be aware that hosts.deny is depreciated and that deny statements go in hosts.allow, eg. ALL : localhost 127.0.0.1 your.server.or.IP : allow sshd : ALL : severity auth.info : allow syslog-ng : your.network : allow ALL : ALL : severity auth.notice : \ twist echo "You are not welcome to use %d from %h." You should also see any errors or warnings when you run tcpdchk. -Andrew- -- _______________________________________________________________________ | -Andrew J. Caines- Unix Systems Engineer A.J.Caines(a)halplant.com | | "They that can give up essential liberty to obtain a little temporary | | safety deserve neither liberty nor safety" - Benjamin Franklin, 1759 | _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

Sensord (lm_sensors) and Syslog-ng using "program()"
by Ann Hopkins 23 Jul '04

23 Jul '04

I was wondering if anyone sees any problem with what I am doing with the following script. I want an "Alarm" which causes an "Alert" message to actually shutdown the machine under certain circumstances, since I run a family server and I don't have a backup. 1) "sensord" (lm_sensors library) is running and I can do "sensors" command to get a result. via686a-isa-6000 Adapter: ISA adapter Algorithm: ISA algorithm CPU core: +1.73 V (min = +1.68 V, max = +2.49 V) +2.5V: +2.59 V (min = +2.24 V, max = +2.74 V) I/O: +3.40 V (min = +2.95 V, max = +3.62 V) +5V: +4.87 V (min = +4.47 V, max = +5.49 V) +12V: +11.74 V (min = +10.79 V, max = +13.18 V) CPU Fan: 0 RPM (min = 3000 RPM, div = 2) P/S Fan: 0 RPM (min = 3000 RPM, div = 2) SYS Temp: +30.0Â°C (high = +45Â°C, hyst = +40Â°C) CPU Temp: +38.5Â°C (high = +60Â°C, hyst = +55Â°C) SBr Temp: +25.1Â°C (high = +65Â°C, hyst = +60Â°C) 2) "syslog-ng" is working and logging the data under 'local5". The following is the pertinent "syslog-ng.conf" data. All the data is logged and the "Alert" data triggers input to a shell program. filter f_local5 { facility(local5); }; filter f_sensorA { level(alert) and facility(local5); }; destination sensord { file("/var/log/local5.log"); }; log { source(src); filter(f_local5); destination(sensord); }; # Sensor Alarm Messages - Programs are loaded once (email) destination sensor_alarm { program("/usr/local/sbin/sensor_alarm.sh"); }; log { source(src); filter(f_sensorA); destination(sensor_alarm); }; 3) Program "sensor_alarm.sh" will try to shutdown the machine if it reaches a too hot condition. I don't have fan sensors so it will never trigger. I am no programmer, please excuse my very primitive (and naive) coding. Is there anything wrong with calling this program? SENSOR_ALARM.SH #!/bin/sh # Make sensord do something useful with syslog-ng # -k does nothing will use a -h halt later # +2 in 2 minutes while read line; do echo $line | /usr/bin/mail -s "SENSORD Alarm" root@localhost AlarmName="" AlarmName=`echo $line | /usr/bin/awk -F":" '{ print $1 }'` case "$AlarmName" in "CPU core") /sbin/shutdown -k +2 "CPU core ALARM - bad voltage" ;; "SYS Temp") /sbin/shutdown -k +2 "SYS Temp ALARM - too hot" ;; "CPU Temp") /sbin/shutdown -k +2 "CPU Temp ALARM - too hot" ;; "CPU Fan") /sbin/shutdown -k +2 "CPU Fan ALARM - fan down" ;; "P/S Fan") /sbin/shutdown -k +2 "P/S Fan ALARM - fan down" ;; *) echo "WARNING SENSORD - Be Careful!" | /usr/bin/wall ;; esac done

1 0

syslog-ng 1.6.4 and tcp_wrappers
by Amaral, Angelo 22 Jul '04

22 Jul '04

My name is Angelo, And I have equal problem of Joe Geek I compile the syslog-ng with support tcpwrappers. I put in hosts.deny my filter and it´s not work. Thanks. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Joe Geek Sent: quinta-feira, 15 de julho de 2004 18:41 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers I've got syslog-ng v 1.6.4 compiled with tcp_wrapper support and tried to block a particular ipaddress in hosts.deny Does the syslog-ng daemon have to be started from inetd for this to work? Does syslog-ng use tcp_wrappers for UDP traffic also? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

How to get sure if a remote syslog-ng is down?
by julius 21 Jul '04

21 Jul '04

Hi, at the moment my remote syslog-ng prints every 10 minutes a message, theres a message when the remote syslog-ng disconnected, but what happens when the remote host boots up and syslog-ng cant be started?

2 1

syslog-ng and mysql
by Deepu George 19 Jul '04

19 Jul '04

I am trying to configure syslog-ng to write to mysql. I have already installed mysql and created the database and tables. When I am enabling the syslog-ng to mysql using the following script in syslog-ng.conf , I get a parse error when staring syslog-ng destination d_mysql { pipe("/tmp/mysql.pipe" template ("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST','$FACILITY','$PRIORITY','$LEVEL','$TAG','$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n")template-escape(yes)); }; log { source(net); destination(d_mysql); }; Best regards Deepu

1 0