September 2004 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]Splitting up Cisco devices
by Stephen Bargon 13 Sep '04

13 Sep '04

Another way of configuring it with date is... destination messages.network { file("/export/home/ciscologs/$HOST_messages_$YEAR_$MONTH_$DAY" owner(root) group(other) perm(0644) dir_perm(0755) create_dirs(yes) ); }; Then I use a cron job to remove logs from the past so there is no rotation. I just let syslog-ng append new dates to the end of the hostnames everynight and cron remove previous log files that are backuped up nightly anyway. 0 1 * * * find /export/home/ciscologs -mtime 7 -exec /usr/bin/rm {} \; Works on Sun and Linux -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Bill Nash Sent: Monday, September 13, 2004 1:58 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Splitting up Cisco devices Your best option is to split them up by hostname. Syslog has no understanding of differing platform types. Most of the cisco devices will log to the same facility/severity anyway, so hostname is your best bet. destination by_host { file("/var/syslog/$HOST"); }; - billn On Mon, 13 Sep 2004, Rex Petersen wrote: > Hi > > > > Anyone who can show me how I split up the log files, > > so each device has it's own log file. > > > > Something like this: > > > > Devices: > > > > Cisco 3550-12G Switch: cisco3550-12.log > > Cisco 3548XL Switch #1: cisco3548_1.log > > Cisco 3548XL Switch #2: cisco3548_2.log > > Cisco PIX 515UR Firewall: cisco_515.log > > VPN3005 Concentrator: cisco_3005.log > > > > Best regards > > > > Rex Petersen > > > > > > > > > > > > > > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html The information contained in this message is proprietary of Amdocs, protected from disclosure, and may be privileged. The information is intended to be conveyed only to the designated recipient(s) of the message. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, use, distribution or copying of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you.

1 0

Splitting up Cisco devices
by Rex Petersen 13 Sep '04

13 Sep '04

Hi Anyone who can show me how I split up the log files, so each device has it's own log file. Something like this: Devices: Cisco 3550-12G Switch: cisco3550-12.log Cisco 3548XL Switch #1: cisco3548_1.log Cisco 3548XL Switch #2: cisco3548_2.log Cisco PIX 515UR Firewall: cisco_515.log VPN3005 Concentrator: cisco_3005.log Best regards Rex Petersen

2 1

Re: [syslog-ng]Dumping Core on FreeBSD 4.10
by Emre Bastuz 13 Sep '04

13 Sep '04

Hi, thanks for the quick response. Zitat von rmkml <rmkml(a)wanadoo.fr>: > Do you have compiled syslog-ng ? > or package ? > what version you have ? I use the one from the ports collection, i.e. I have compiled it on the system where it is supposed to run. The version is 1.6.5. Cheers, Emre -- http://www.emre.de UIN: 561260 PGP Key ID: 0xAFAC77FD I don't see why some people even HAVE cars. -- Calvin

1 0

Dumping Core on FreeBSD 4.10
by Emre Bastuz 13 Sep '04

13 Sep '04

Hi, I´ve installed syslog-ng on one of my FreeBSD 4.10 machines a couple of days ago. I would like to have internal log-handling being done by BSD´s own syslog and network related syslogging by syslog-ng. Though I have checked my config file over and over again for any apparent mistakes I can not find any reason why the proccess should die. The config is as follows: ---------------------------------- options { use_fqdn(yes); keep_hostname(yes); use_dns(no); long_hostnames(off); sync(0); log_fifo_size(1000); }; source network { udp(ip("192.168.0.1") port(514)); }; destination hosts { file("/var/log/myrouters/$HOST/$FACILITY.$YEAR$MONTH$DAY.log" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(network); destination(hosts); }; ---------------------------------- Doing a 'strings syslog-ng.core | more' shows me things like ... [...] io_set_nonblocking: fcntl() failed, %z Can't set close-on-exec flag for fd %i: %z io.c: connecting using fd %i io.c: listening on fd %i io.c: Preparing fd %i for reading and writing io.c: Preparing fd %i for reading io.c: Preparing fd %i for writing reopen_fd: open failedfor %S: %z Marking fd %i for closing. Internal error, too long message to werror() [...] ... which I am too dumb to understand. Does anyone have any suggestion? Any help would be greatly appreciated. Cheers, Emre -- http://www.emre.de UIN: 561260 PGP Key ID: 0xAFAC77FD I don't see why some people even HAVE cars. -- Calvin

1 0

Log formatting
by Robert.COward＠deploymenthealth.osd.mil 10 Sep '04

10 Sep '04

Why is it that syslog-ng places the program name in the message string? As in: [CODE] source shell { unix-dgram("/dev/log"); internal(); udp(); }; destination deadman { file("/var/log/deadman" template ("PROGRAM:$PROGRAM <MESSAGE:$MSG> LEVEL:$LEVEL PRIORITY:$PRIORITY FACILITY:$FACILITY\n") template_escape(no) ); }; log { source(shell); destination(deadman); }; [/CODE] [OUTPUT] PROGRAM:roberto <MESSAGE:roberto: this is a test> LEVEL:notice PRIORITY:notice FACILITY:user [/OUTPUT] I'd like to see just the words "this is a test" in the $MSG variable. I am using syslog-ng version 1.5.24, on OpenBSD 3.5. Thanks in advanced.

3 2

Syslog-ng 1.6.5/libol 0.3.14 core dump on FreeBSD 4.x
by Mike Williams 09 Sep '04

09 Sep '04

Has anyone else experienced problems with the new release on FreeBSD? I have upgraded to 1.6.5 from 1.6.2 on FreeBSD 4.8-RELEASE-p10 and and 4.10-RELEASE-p2 and in both instances I get a core dump. If you have solved this already please let me know what to do, otherwise I'll be glad to send you any information you will need to troubleshoot, but I don't know where to begin. Thanks, Mike _______________________________ Do you Yahoo!? Win 1 of 4,000 free domain names from Yahoo! Enter now. http://promotions.yahoo.com/goldrush

4 6

unsubscribe
by Roy G Davis 08 Sep '04

08 Sep '04

-----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Horváth Ákos Sent: Wednesday, September 08, 2004 6:12 AM To: syslog-ng(a)lists.balabit.hu Cc: Iulian Topliceanu Subject: Re: [syslog-ng]filtering question Hi, AFAIK you do not need a _matching_ filter, but to set up a filter on the local5 logging _facility_. bye MaXX On Wednesday 08 September 2004 12.03, Iulian Topliceanu wrote: > Hi, > > I have to following task. > > I have some messages coming from a host from local5. > > The messages look like: > > "Sep 6 17:07:21 herakles local5:meimlo.std.me herakles.tomcat8310 > 2004-09-06 17:07:21,157 [WARN] [main] [] [] > voicemail.mboxp.MboxpServlet: MboxpServlet not initialized" > > The thing I have to is to make a filter that matches the things > between 'local5:' and the first ' '. In this case the filter is > 'meimlo.std.me' but this 'meimlo.std.me' could be anything like: > 'blah.blu.admin'. > > Is there a possibility to create a filter that if that string is > different, syslog-ng will automate create a new file? Like it does > when a new host is logging and it creates the dirs/files. > > Does syslog-ng support such a function? > > Regards, > Iulian Topliceanu _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

filtering question
by Iulian Topliceanu 08 Sep '04

08 Sep '04

Hi, I have to following task. I have some messages coming from a host from local5. The messages look like: "Sep 6 17:07:21 herakles local5:meimlo.std.me herakles.tomcat8310 2004-09-06 17:07:21,157 [WARN] [main] [] [] voicemail.mboxp.MboxpServlet: MboxpServlet not initialized" The thing I have to is to make a filter that matches the things between 'local5:' and the first ' '. In this case the filter is 'meimlo.std.me' but this 'meimlo.std.me' could be anything like: 'blah.blu.admin'. Is there a possibility to create a filter that if that string is different, syslog-ng will automate create a new file? Like it does when a new host is logging and it creates the dirs/files. Does syslog-ng support such a function? Regards, Iulian Topliceanu

2 1

Missing pieces of information when destination = program
by mrugan 06 Sep '04

06 Sep '04

Hy list, My goal is to log to a linux host (slackware 9) running syslog-ng 1.6.5, libol 0.3.14, libnet 1.1.2.1 information broadcasted by multiple windows hosts running MBM (mother board monitor) via syslog logging mechanism that MBM has build in. MBM is set up to broadcast via udp 514 at 300 seconds interval readings from 12 sensors. Syslog-ng message gathering setup via filters was required options { chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(16348); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(no); use_fqdn(no); }; # filter f_mbm { facility(daemon) and match("MBM"); }; # test destination to pipe destination mbm_pipe { pipe("/tmp/mbm-pipe" template("$WEEKDAY $DATE $YEAR $HOST $MESSAGE\n")); }; # wanted to be the real-time analyzer destination mbm_pipe { program("/var/rrd/test.pl" template("$WEEKDAY $DATE $YEAR $HOST $MESSAGE\n")); }; # # log setup log { source(s_udp); source(s_internal); filter(f_mbm); destination(mbm_pipe); }; # however i encountered these problems: on the typical setup destination to a fifo pipe (mkfifo ...) every 300 seconds arrive 12 lines looking like: Sat Sep 4 14:53:54 2004 TAQWA MBM[CaseTemp]: C=39 LA=5 HA=70 L=32 H=42 A=38 Sat Sep 4 14:53:54 2004 TAQWA MBM[CPUTemp]: C=35 LA=5 HA=70 L=31 H=45 A=35 Sat Sep 4 14:53:54 2004 TAQWA MBM[VCore]: C=1.60 LA=1.90 HA=2.10 L=1.57 H=1.60 A=1.59 Sat Sep 4 14:53:54 2004 TAQWA MBM[VAGP]: C=1.60 LA=1.90 HA=2.10 L=1.60 H=1.60 A=1.60 Sat Sep 4 14:53:54 2004 TAQWA MBM[VDimm]: C=2.50 LA=3.13 HA=3.46 L=2.50 H=2.50 A=2.50 Sat Sep 4 14:53:54 2004 TAQWA MBM[Vio]: C=3.26 LA=4.75 HA=5.25 L=3.23 H=3.28 A=3.26 Sat Sep 4 14:53:54 2004 TAQWA MBM[5V]: C=5.11 LA=11.40 HA=12.60 L=5.00 H=5.11 A=5.09 Sat Sep 4 14:53:54 2004 TAQWA MBM[12V]: C=12.22 LA=-11.40 HA=-12.60 L=12.10 H=12.59 A=12.27 Sat Sep 4 14:53:54 2004 TAQWA MBM[5VSB]: C=5.43 LA=4.95 HA=5.05 L=5.43 H=5.46 A=5.43 Sat Sep 4 14:53:54 2004 TAQWA MBM[VBat]: C=3.15 LA=4.75 HA=5.25 L=3.15 H=3.15 A=3.15 Sat Sep 4 14:53:54 2004 TAQWA MBM[CPUFan]: C=3013 LA=2600 HA=99999 L=2909 H=3068 A=2974 Sat Sep 4 14:53:54 2004 TAQWA MBM[CPUMHz]: C=1760 LA=0 HA=100 L=1760 H=1760 A=1760 nothing to worry, processing goes on with sucessfull results. beeing greedy, a simple perl script was written to illustrate capability of syslog-ng to log via program. open(FILE, ">> /tmp/mbm-file") or die "Can't open FILE : $!\n"; while (<>) { print FILE $_; } close (FILE); this time i noticed pieces of info missing, random lines beeing truncated, no special pattern could be distinguished, writing stops randomly while MBM logs whole 12 lines. ex: Sat Sep 4 14:53:54 2004 TAQWA MBM[CPUFan] or even Sat Sep 4 ... and so on... please advise. thanks a log. :) mrugan |_at_| softhome.net

2 1

No new snapshots since 2004-08-05
by José Pedro Oliveira 06 Sep '04

06 Sep '04

Hi, No new snapshots of libol and syslog-ng have been created since 2004-08-05 (release date of syslog-ng 1.6.5 and libol-0.3.14). Would it possible to correct this? Thanks in advance, jpo Snapshots directory: http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot/ -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

2 3