January 2005 - syslog-ng - lists.balabit.hu

preparing syslog-ng 1.6.6
by Balazs Scheidler 03 Feb '05

03 Feb '05

Hi, As there are some changes since syslog-ng 1.6.5, I'd like to release a new version. Before doing so I'd like to ask you to test the latest snapshot a little bit. The most important and risky change seems to be this one: 2005-01-20 Balazs Scheidler <bazsi(a)bzorp.balabit> * src/main.c: fix possible log message losing during HUP as syslog-ng was not accepting messages for 1 second and these messages were dropped, processing changed so we still wait 1 second to flush buffers but also accept messages in this interval, so the window of losing messages becomes much smaller. (fixes: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=282771) Everything else is minor, and although they might cause build problems on some platforms, I doubt they'd cause real problems. The latest snapshot is here: http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot/ The summary of changes can be found in the file named ChangeLog within the tarball. If no show-stopper bugs are found, I'm going to release syslog-ng 1.6.6 this week. Thanks in advance. -- Bazsi

4 11

syslog-ng 1.6.5: manpage patch
by Jose Pedro Oliveira 03 Feb '05

03 Feb '05

Balazs, This patch adds the missing command line options to the syslog-ng.8 manpage. The patch also applies to syslog-ng 1.9.x (he default syslog-ng.conf location still has to be corrected). Regards, jpo -- José Pedro Oliveira mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo diff -ruN syslog-ng-1.6.5-orig/doc/syslog-ng.8 syslog-ng-1.6.5/doc/syslog-ng.8 --- syslog-ng-1.6.5-orig/doc/syslog-ng.8 1999-07-10 16:58:32.000000000 +0100 +++ syslog-ng-1.6.5/doc/syslog-ng.8 2005-01-30 00:05:48.906523000 +0000 @@ -7,7 +7,7 @@ .B syslog-ng [ -.B \-dvV +.B \-dFsvV ] [ .B \-f <\fIconfig-filename\fP> @@ -17,6 +17,12 @@ ] [ .B \-C <\fIchroot-dir\fP> +] [ +.B \-u +<\fIuser\fP> +] [ +.B \-g +<\fIgroup\fP> ] .SH DESCRIPTION .PP @@ -64,38 +70,72 @@ \fBsyslog-ng\fP will also save all the current values as a "checkpoint". .SH OPTIONS .TP -.B \-d +.B \-C \0<directory>, \-\-chroot=<directory> +Chroot to directory. +.TP +.B \-d, \-\-debug Set "debug mode". Prints out various messages to aid in debugging and stops it from becoming a daemon. To activate debugging in the yacc parser, either use this option twice or combine with \fB-v\fP. .TP -.B \-f \0<filename> +.B \-F, \-\-foreground +Don't fork into background. +.TP +.B \-f \0<filename>, \-\-cfgfile=<filename> Instead of reading the normal \fB/etc/syslog-ng/syslog-ng.conf\fP file for configuration information, use the filename given instead. .TP -.B \-p \0<filename> +.B \-g \0<group>, \-\-group=<group> +Switch to group. +.TP +.B \-p \0<filename>, \-\-pidfile=<filename> Write the current PID information to the specified file. +Defaults to \fB/var/run/syslog-ng.pid\fP. +.TP +.B \-s, \-\-syntax\-only +Only read and parse the configuration file. See also the option \fB-f\fP. .TP -.B \-v +.B \-u \0<user>, \-\-group=<user> +Switch to user. +.TP +.B \-v, \-\-verbose Enable verbose mode. Process will not become a daemon. Prints out fewer messages, compared to \fB-d\fP. .TP -.B \-V +.B \-V, \-\-version Print the version number. .SH DIAGNOSTICS It is expected that \fBsyslog-ng\fP will run as root, however, if not running on a priviledged port of it it owned its own log directories, etc, it might run as a non-root user. .SH SEE ALSO -logger(1), syslog(3), services(5), syslog.conf(5), syslog-ng.conf(5) +.BR syslog-ng.conf (5), +.BR logger (1), +.BR syslog (2), +.BR syslog (3), +.BR services (5), +.BR syslog.conf (5), +.BR klogd (8), +.BR syslogd (8), +.BR sysklogd (8) .SH FILES -/etc/syslog-ng/syslog-ng.conf -/etc/syslog-ng/filename.sha1 -/etc/syslog-ng/filename.H0 -/etc/syslog-ng/filename.salt -.br -/var/run/syslog.pid -.br +.TP +.I /etc/syslog-ng/syslog-ng.conf +Configuration file for +.BR syslog\-ng . +See +.BR syslog\-ng.conf (5) +for more information. +.TP +.I /etc/syslog-ng/filename.sha1 +.TP +.I /etc/syslog-ng/filename.H0 +.TP +.I /etc/syslog-ng/filename.salt +.TP +.I /var/run/syslog-ng.pid +The file containing the process id of +.BR syslog-ng . .SH BUGS .PP If you find any, please send email to me at bazsi(a)balabit.hu

3 6

syslog-ng 1.9.2/eventlog 0.2.2: packaging notes
by Jose Pedro Oliveira 03 Feb '05

03 Feb '05

Balazs, I have a couple of requests to make regarding the packaging of the above packages (for Red Hat/Fedora systems). 1) copyright information I believe both packages are being distributed under the GPL license. Could you mention this in the README files and maybe include the COPYING file in the tarballs? 2) the CFLAGS aren't being inherited The CFLAGS generated by the configure files don't honour the environment CFLAGS variable. Small patches are attached to this email. 3) eventlog static lib Would it be possible to also generate the eventlog static library by default? 4) syslog-ng 1.9.2 Would it be possible to also generate a static linked syslog-ng? Right know it only uses dynamic libraries (glib2.so and libevtlog.so). It would be nice to avoid any dynamic libraries located under /usr as the content of this directory can not yet be available (mounted) at the time the daemon syslog-ng is loaded. Best regards, jpo -- José Pedro Oliveira diff -ruN syslog-ng-1.9.2+20050112+1424-orig/configure.in syslog-ng-1.9.2+20050112+1424/configure.in --- syslog-ng-1.9.2+20050112+1424-orig/configure.in 2005-01-05 12:00:11.000000000 +0000 +++ syslog-ng-1.9.2+20050112+1424/configure.in 2005-01-15 03:22:25.989658032 +0000 @@ -71,7 +71,7 @@ PKG_CHECK_MODULES(GLIB, glib-2.0) PKG_CHECK_MODULES(EVTLOG, eventlog) -CFLAGS="-Wall -g" +CFLAGS="$CFLAGS -Wall -g" DEPS_CPPFLAGS="$CPPFLAGS $GLIB_CFLAGS $EVTLOG_CFLAGS" CPPFLAGS="$DEPS_CPPFLAGS -D_GNU_SOURCE" DEPS_LIBS="$LIBS $GLIB_LIBS $EVTLOG_LIBS" diff -ruN eventlog-0.2.2-orig/configure.in eventlog-0.2.2/configure.in --- eventlog-0.2.2-orig/configure.in 2005-01-05 12:02:18.000000000 +0000 +++ eventlog-0.2.2/configure.in 2005-01-15 03:21:00.591640504 +0000 @@ -5,7 +5,7 @@ AM_CONFIG_HEADER(config.h) AM_DISABLE_STATIC -CFLAGS="-Wall -g" +CFLAGS="$CFLAGS -Wall -g" CPPFLAGS="-D_GNU_SOURCE" AC_ARG_ENABLE(dlsym-wrapper,

5 14

making syslog_NG redundant / NFS / HA possibilities
by Oliver Tönsmann 31 Jan '05

31 Jan '05

Hi, we like to setup a central logging service for our distributed datacenter environment. Our idea is to use syslog_ng as an HA (high available) service running on two separate servers. The syslog clients (Solaris machines, network components, firewall appliances) should post the log data via UDP to a loadbalancer which will forward the log data to the two syslog_ng hosts. Now we have the problem how to merge the log data from the two syslog_ng hosts to one location. Most of our data is stored on centralised storage subsystems and this storage is distributed via NFS (NetApp file server). We like to store the logdata also into nfs directories. Following figure describes a possible dataflow: syslog clients --> LB --> --> syslog_ng host1 --> syslog_ng host2 --> NFS:/.../log/$HOST/$FACILITY/$PRIORITY/one_logfile_for_both_syslog_hosts Performance and nfs overhead is not a problem in our environment and nfs works very reliable due to our HA structures; logdata per day ~2-3 GB. Is there a possibilty to let syslog_ng hosts write the logdata simultaenously into the same logfile (NFS)? What are the disadvantages? What are your experiences in using syslog_ng as an HA service? What would be a good practice to setup syslog_ng and to make it high available? Ideas and helpful suggestions are welcome - Thanxx. Oliver ------------------------------------------------ Oliver Toensmann Universitaet Bielefeld - Hochschulrechenzentrum Email: Oliver.Toensmann(a)uni-bielefeld.de

2 1

Re: [syslog-ng] re-inserting syslog messages for testing
by Ed Ravin 31 Jan '05

31 Jan '05

On Tue, Jan 18, 2005 at 11:29:07AM -0500, Ed Ravin wrote: > I've written a perl script that takes as input a file with syslog > I use this for test environments, especially when I'm testing things > results when parsed by logsurfer. > > My tool does two things logger doesn't - (1) it trims off the existing > timestamps from the input before logging it, and more interestingly, (2) > can parse those timestamps and replay the log messages at the same rate > that they were originally logged. Or you can tell it to "time warp" > and play the messages back 2x 3x, 1/5x as fast, etc. This is why it's > good for testing logsurfer files, since you can test whether your > timeouts work. > > I have to spruce it up slightly (get rid of the XXX comments :-) before > I release it, will do so Real Soon. OK, here it is, as an attachment. With perldoc documentation, too. One possible bug not mentioned in the doc is that sleeping between messages to simulate the original delivery times seems to be getting rounded to the nearest second, a problem I thought using Time::HiRes would fix, but could conceivably be limited to my local environment. If anyone uses this, please let me know what you think. It's still in the beta stage, but since it's only a tool for testing rather than production, that should be sufficient for most purposes :-) -- Ed

2 3

Re: [syslog-ng]Entries being logged to /var/log/messages aswellas/var/log/HOSTS//$MONTH/$DAY/$HOS
by Fred Turner 29 Jan '05

29 Jan '05

Works great! Thanks... >>> Bill Nash <billn(a)billn.net> 1/29/2005 2:01:52 PM >>> On Sat, 29 Jan 2005, Fred Turner wrote: > Here is my source.. How would I go about doing that? Sorry I'm still pretty new with syslog0ng (3 hrs)... > No worries =) > > > > source src { > unix-stream("/dev/log"); > internal(); > udp(); > tcp(port(5140) keep-alive(yes)); > > Grab the udp and tcp entries, and create a new source. source src { unix-stream("/dev/log"); internal; }; source remote_hosts { tcp(port(5140) keep-alive(yes); udp()); log { source(remotes_hosts); destination(std); } Changing just the 'src' source, and adding the other two entries, will keep your existing config working as I described, local logging from your loghost processes to /var/log/messages where you'd expect them, and all your remote hosts logging to your 'dst' directory structure. Make sense? =) - billn >>>> Bill Nash <billn(a)billn.net> 1/29/2005 1:46:15 PM >>> > > Syslog will log to multiple destinations if you set them. As below, you > have multiple facilities still logging to messages. > > Does your 'src' source include your network ports, for receiving data from > remote hosts? If it does, separate it to a new source and pair it with > your 'std' destination, exclusively. This will keep your local logs > separate from your remote logs. > > - billn > > On Sat, 29 Jan 2005, Fred Turner wrote: > >> Sure, it's as follows. >> >> destination debug { file("/var/log/debug"); }; >> destination messages { file("/var/log/messages"); }; >> >> >> log { source(src); filter(f_daemon); destination(messages); }; >> log { source(src); filter(f_kern); destination(messages); }; >> log { source(src); filter(f_lpr); destination(lpr); }; >> log { source(src); filter(f_mail); destination(mail); }; >> log { source(src); filter(f_user); destination(messages); }; >> log { source(src); filter(f_uucp); destination(uucp); }; >> log { source(src); filter(f_mail); destination(maillog); }; >> log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; >> log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; >> log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; >> log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; >> log { source(src); filter(f_news); filter(f_err); destination(newserr); }; >> log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; >> log { source(src); filter(f_messages); destination(messages); }; >> log { source(src); filter(f_emergency); destination(console); }; >> >> >> >> >>>>> Bill Nash <billn(a)billn.net> 1/29/2005 1:15:26 PM >>> >> >> Can you include your log directive? Chances are, that's the culprit. >> >> - billn >> >> >> On Sat, 29 Jan 2005, Fred Turner wrote: >> >>> Hi, I'm new to syslog-ng and have configured it to be a loghost for many different firewall appliances. So I setup an automatic sorting entry as per the faq as follows: >>> >>> destination std { >>> file("/var/log/HOSTS/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY" >>> owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) >>> ); >>> >>> >>> Which works prefect The only problem is that it's also putting them in the /var/log/messages log. >>> >>> How Can I stop the behavior as it's creating a huge /var/log/messages log. >>> >>> >>> Thanks >>> >>> >>> ================================================================== >>> >>> NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. >>> Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. >>> >>> >>> _______________________________________________ >>> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >>> https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >>> >>> >> _______________________________________________ >> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >> https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >> >> >> >> ================================================================== >> >> NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. >> Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. >> >> >> _______________________________________________ >> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >> https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >> >> > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > ================================================================== > > NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. > Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.huhs that it's also putting them in the https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ================================================================== NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.

1 0

Re: [syslog-ng]Entries being logged to /var/log/messages as wellas/var/log/HOSTS//$MONTH/$DAY/$HOS
by Fred Turner 29 Jan '05

29 Jan '05

Here is my source.. How would I go about doing that? Sorry I'm still pretty new with syslog0ng (3 hrs)... source src { unix-stream("/dev/log"); internal(); udp(); tcp(port(5140) keep-alive(yes)); >>> Bill Nash <billn(a)billn.net> 1/29/2005 1:46:15 PM >>> Syslog will log to multiple destinations if you set them. As below, you have multiple facilities still logging to messages. Does your 'src' source include your network ports, for receiving data from remote hosts? If it does, separate it to a new source and pair it with your 'std' destination, exclusively. This will keep your local logs separate from your remote logs. - billn On Sat, 29 Jan 2005, Fred Turner wrote: > Sure, it's as follows. > > destination debug { file("/var/log/debug"); }; > destination messages { file("/var/log/messages"); }; > > > log { source(src); filter(f_daemon); destination(messages); }; > log { source(src); filter(f_kern); destination(messages); }; > log { source(src); filter(f_lpr); destination(lpr); }; > log { source(src); filter(f_mail); destination(mail); }; > log { source(src); filter(f_user); destination(messages); }; > log { source(src); filter(f_uucp); destination(uucp); }; > log { source(src); filter(f_mail); destination(maillog); }; > log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; > log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; > log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; > log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; > log { source(src); filter(f_news); filter(f_err); destination(newserr); }; > log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; > log { source(src); filter(f_messages); destination(messages); }; > log { source(src); filter(f_emergency); destination(console); }; > > > > >>>> Bill Nash <billn(a)billn.net> 1/29/2005 1:15:26 PM >>> > > Can you include your log directive? Chances are, that's the culprit. > > - billn > > > On Sat, 29 Jan 2005, Fred Turner wrote: > >> Hi, I'm new to syslog-ng and have configured it to be a loghost for many different firewall appliances. So I setup an automatic sorting entry as per the faq as follows: >> >> destination std { >> file("/var/log/HOSTS/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY" >> owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) >> ); >> >> >> Which works prefect The only problem is that it's also putting them in the /var/log/messages log. >> >> How Can I stop the behavior as it's creating a huge /var/log/messages log. >> >> >> Thanks >> >> >> ================================================================== >> >> NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. >> Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. >> >> >> _______________________________________________ >> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >> https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >> >> > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > ================================================================== > > NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. > Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ================================================================== NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.

2 1

Re: [syslog-ng]Entries being logged to /var/log/messages as wellas /var/log/HOSTS//$MONTH/$DAY/$HOS
by Fred Turner 29 Jan '05

29 Jan '05

Sure, it's as follows. destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; log { source(src); filter(f_daemon); destination(messages); }; log { source(src); filter(f_kern); destination(messages); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(messages); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); destination(maillog); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; >>> Bill Nash <billn(a)billn.net> 1/29/2005 1:15:26 PM >>> Can you include your log directive? Chances are, that's the culprit. - billn On Sat, 29 Jan 2005, Fred Turner wrote: > Hi, I'm new to syslog-ng and have configured it to be a loghost for many different firewall appliances. So I setup an automatic sorting entry as per the faq as follows: > > destination std { > file("/var/log/HOSTS/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY" > owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) > ); > > > Which works prefect The only problem is that it's also putting them in the /var/log/messages log. > > How Can I stop the behavior as it's creating a huge /var/log/messages log. > > > Thanks > > > ================================================================== > > NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. > Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ================================================================== NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.

2 1

Entries being logged to /var/log/messages as well as /var/log/HOSTS//$MONTH/$DAY/$HOST-$YEAR-$MONTH
by Fred Turner 29 Jan '05

29 Jan '05

Hi, I'm new to syslog-ng and have configured it to be a loghost for many different firewall appliances. So I setup an automatic sorting entry as per the faq as follows: destination std { file("/var/log/HOSTS/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); Which works prefect The only problem is that it's also putting them in the /var/log/messages log. How Can I stop the behavior as it's creating a huge /var/log/messages log. Thanks ================================================================== NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.

2 1

Problem with program() destination
by "Stefan Günther" 26 Jan '05

26 Jan '05

Hello, I'm trying to use the destination program() to forward all dhcp-related messages to a php program. The php program runs fine when I start it on the command line. My configuration in syslog-ng.conf seems to be right because when I use the "/bin/cat/" destination all dhcp messages are written to /tmp/cat.log. filter f_dhcp { facility(daemon) and match("dhcpd");}; #destination dhcpd { program("/bin/cat > /tmp/cat.log");}; destination dhcpd { program("/tmp/dhcp2.php");}; log { source(src); filter(f_dhcp); destination(dhcpd);}; /tmp/dhcp2.php: #! /usr/bin/php <?php $std=fopen("php://stdin","r"); $line = fgets($std,1024); $file=fopen("/tmp/dhcp.log","w+"); fwrite($file,$line); fclose($file); fclose($std); Can anyone give me a hint what I'm doing wrong? Thanks in advance, Stefan -- ***************************************** in-put GbR - Das Linux-Systemhaus Stefan-Michael Günther Moltkestraße 49 D-76133 Karlsruhe Tel./Fax : +49 (0)721 / 83044 - 98/93 http://www.in-put.de ***************************************** -- GMX im TV ... Die Gedanken sind frei ... Schon gesehen? Jetzt Spot online ansehen: http://www.gmx.net/de/go/tv-spot

2 7