July 2004 - syslog-ng - lists.balabit.hu

Hostname Problem
by phusion 10 Jul '04

10 Jul '04

I've been having a problem with the $HOST macro. My setup is as follows: message gets sent from HostA through HostB and finally to the log server HostC. HostA is a Windows box running Snare for Windows, HostB is a FreeBSD box running syslog-ng, and HostC is a FreeBSD box running syslog-ng. HostA doesn't have a config file, it's a GUI app, but here are parts of the syslog-ng config files: HostB Config ------------ # Options options { keep_hostname(yes); long_hostnames(off); sync(0); }; HostC Config ------------ # Options options { keep_hostname(yes); long_hostnames(off); sync(0); }; HostA - moon-a, 10.10.2.2 HostB - moon, 10.10.1.7, 10.10.2.1 HostC - mars, 10.10.1.2 On the log server I have files from HostA go to $HOST.log. It then puts it as 10.10.1.7.log instead of moon-a.log. Also, here is a line from the file where it puts the IP address of HostB and hostname of HostA. Jul 8 10:57:00 10.10.1.7 moon-a MSWinEventLog 1 Application 675 Thu Jul 08 10:56:08 2004 0 sshd SYSTEM User Information MOON-A None sshd : PID 1808 : Server listening on 0.0.0.0 port 22. 1 Let me know what you think the problem is? Phusion __________________________________ Do you Yahoo!? Yahoo! Mail Address AutoComplete - You start. We finish. http://promotions.yahoo.com/new_mail

1 0

syslog-ng on OSX 10.3.4
by OpenMacNews 09 Jul '04

09 Jul '04

hi all, i'm new to syslog-ng. i've installed 1.7x on OSX 10.3.4; now, starting to deal with the config file. i dl'd and searched thru the list archives for pointers, etc. and found the last relevant, post by Kim Cary, but nothing further. i contacted Kim -- not yet finished/successful. soooooo, to ask: has anyone here got syslog-ng up/running on OSX, and would you be willing to share your conf file? thx! richard

1 0

regex support
by Joe.Reeves＠Regions.com 09 Jul '04

09 Jul '04

I am trying to use syslog-ng to reduce certain types of logging. I have scoured the web looking for information on the supposed regex support in syslog-ng, but the only thing I have really found mention of is the "match" keyword that matches a simple string. What I wanted to know is if syslog-ng supports either posix or perl style regular expressions. If not, has anyone found any other effective method of reducing logs using regex with an external program? (that could be used with the "program" keyword perhaps?) Thanks in advance, -- ____________________________________________ Joe Reeves Security Engineer II, IDS Regions Technology Risk Management Office: 334-956-6189 joe.reeves(a)regions.com ____________________________________________ "Wisdom is knowing what to do with what you know." -- J. Winter Smith

3 2

syslog-ng sighup problem
by jayesh 08 Jul '04

08 Jul '04

Hi , I want to know how should I re-read my syslog-ng configuration file without restarting syslog-ng. I found out solution by sending sighup signal to syslog-ng but its not re-reading it i.e when I give kill command with sighup signal to syslog-ng pid it does nothing what is the problem or any other solution. With regards, Jayesh shah

2 1

compression question
by Dave Patterson 07 Jul '04

07 Jul '04

hello all, how do you evoke compression of recently rotated files from within syslog-ng.conf ? Thanks, Dave Patterson Open LabNet Staff

1 0

syslog-ng conf confusion
by Chet Harvey 07 Jul '04

07 Jul '04

Hi all, I am trying to change a box from syslog to syslog-ng but I cant quite get the syntax down. Here is my current syslog.conf: local0.* %/var/log/filter.log local7.* %/var/log/dhcpd.log *.notice;kern.debug;lpr.info;mail.crit;news.err;local0.none;local7.none %/var/log/system.log security.* %/var/log/system.log auth.info;authpriv.info;daemon.info %/var/log/system.log *.emerg * This is how I did my syslog-ng.conf: # # This sample configuration file is essentially equilivent to the stock # FreeBSD /etc/syslog.conf file. # # # options options { long_hostnames(off); sync(0); }; source src { unix-stream("/var/run/log"); pipe("/dev/klog"); internal(); }; destination dest { file("/var/log/filter.log"); }; destination stunnel { tcp("127.0.0.1" port(514)); }; log { source(src);destination(dest); }; log { source(src);destination(stunnel); }; # # destinations # destination messages { file("/var/log/system.log"); }; destination firewall { file("/var/log/filter.log"); }; destination dhcp { file("/var/log/dhcp.log"); }; # log facility filters # filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_console { facility(console); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # # log level filters # filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info..emerg); }; filter f_debug { level(debug..emerg); }; # # *.err;kern.debug;auth.notice;mail.crit /dev/console # # # *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages # log { source(src); filter(f_notice); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # # security.* /var/log/security # log { source(src); filter(f_security); destination(messages); }; ## firewall specific log { source(src); filter(f_local0); destination(firewall); }; log { source(src); filter(f_local7); destination(dhcp); }; Hopelessly lost......thanks for any insight/education... -- Chet

1 0

Syslog-NG 1.6.3/1.6.4 broken under OpenBSD 3.5.
by Gustavo Chamone 07 Jul '04

07 Jul '04

Folks, Syslog-NG 1.6.3 and 1.6.4 fails to compile on OpenBSD 3.5 -- although, 1.6.2 works 'smoothly'. Compilation stops at: In file included from macros.c:64: /usr/include/arpa/inet.h:74: warning: `struct in_addr' declared inside parameter list /usr/include/arpa/inet.h:74: warning: its scope is only this definition or declaration, which is probably not what you want. /usr/include/arpa/inet.h:75: warning: `struct in_addr' declared inside parameter list /usr/include/arpa/inet.h:75: warning: parameter has incomplete type /usr/include/arpa/inet.h:79: warning: parameter has incomplete type /usr/include/arpa/inet.h:85: warning: parameter has incomplete type macros.c: In function `format_tzofs': macros.c:118: `tm' undeclared (first use in this function) macros.c:118: (Each undeclared identifier is reported only once macros.c:118: for each function it appears in.) *** Error code 1 Stop in /root/source/syslog-ng/syslog-ng-1.6.3/src. *** Error code 1 Stop in /root/source/syslog-ng/syslog-ng-1.6.3/src (line 253 of Makefile). *** Error code 1 Stop in /root/source/syslog-ng/syslog-ng-1.6.3/src (line 418 of Makefile). *** Error code 1 Stop in /root/source/syslog-ng/syslog-ng-1.6.3 (line 168 of Makefile). Keep up the good work! Best regards, Gustavo Chamone

3 2

Syslog-ng-Mysql error
by Venkata Phani Kiran Achanta 07 Jul '04

07 Jul '04

Greetings all, Everything was going well until I got this error while loading the Mysql tables.... DBD::mysql::db do failed: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '192.168.254.250', 'auth', 'notice', 'notice', '25', '2004-07-01 at ./db-loader.pl line 19, <FH> line 1. And my line 1 in mysql.pipe looks like this INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '192.168.254.250', 'auth', 'notice', 'notice', '25', '2004-07-01', '15:26:28', 'DNS_NS25','DNS_NS25: NetScreen device_id=DNS_NS25 [No Name]system-notification-00257(traffic): start_time=\"2004-07-01 15:30:26\" duration=2 policy_id=0 service=dns proto=17 src zone=Trust dst zone=Untrust action=Permit sent=99 rcvd=274 src=192.168.254.2 dst=63.209.70.231 src_port=1116 dst_port=53 src-xlated ip=12.28.143.203 port=1116 /etc/syslog-ng/syslog-ng.conf destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM','$MSG' )\n") template-escape(no)); }; The problem obviously is with the msg field, at times the msg field wouldn't get terminated with the Single quote that is required for the SQL INSERT syntax. I am sure that atleast one of you may have already came across this problem. Is there a work around for this? Any ideas....let me know if you need more info to get me out of this error. Thanks in advance. Thanks, Venkata Achanta

1 0

Newbie - packet format
by A Ananth 06 Jul '04

06 Jul '04

Hello, After trying to find the answer in the FAQ and archives without success, I am hoping this group can answer the questions below: Q. Does syslog-ng send UDP messages formatted as per RFC3164 to port 514? If not by default, can it configured to do so? I have a syslog receiver that is able to correctly receive standard syslog messages but seems unable to receive messages from a Solaris box where syslog-ng has been installed. Thanks in advance, -- A N Ananth Prism Microsystems --------------------------------- Do you Yahoo!? New and Improved Yahoo! Mail - Send 10MB messages!

2 1

syslog-ng and sqlsyslogd
by John Jason Brzozowski 05 Jul '04

05 Jul '04

Hello, I recently setup syslog-ng to use sqlsyslogd to insert syslog information into a MySQL database. After some testing I found that the some extra data is being added to each record only when called by syslog-ng. Each record in the database has <###> where ### is some random number. Has anyone seen this? Thanks, John

3 3