November 2005 - syslog-ng - lists.balabit.hu

RE: [syslog-ng] Apache Syslog-ng/Syslog-ng newbie
by Esquivel, Vicente 22 Nov '05

22 Nov '05

Thanks for responding. So let me make sure I am understanding what you suggested. You said that I could run SnareApache on the servers running apache, then let Snare send the Apache access logs to the local syslog on that same server then have the syslogd on that server send them to the centralized syslog server that is logging via syslog-ng? So I take it that Apache can't do it any other way without something like Snare? How much of a load does it add to a server and how difficult is it to implement? Thanks! Vince ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Brian Bemis Sent: Monday, November 21, 2005 2:39 PM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] Apache Syslog-ng/Syslog-ng newbie For the error logs, logging to syslog (or syslog-ng) is built into Apache. For the access logs, try SNARE for Apache: http://www.intersectalliance.com/projects/SnareApache/index.html You can use this in conjunction with syslog-ng. It will send you're apache logs to the syslog daemon on the local system, then all you have to do it set up syslog-ng to forward the logs to a central server and separate them according to the server sending the logs. This is all built into syslog-ng. b ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Esquivel, Vicente Sent: Monday, November 21, 2005 8:39 AM To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] Apache Syslog-ng/Syslog-ng newbie Hello all, I am new to this list, I am seeking some help on how to setup syslog-ng as a central log server. More importantly I am wanting to know how to log all of my Apache servers to the central log server, but also create separate logs for each of the systems. For example I am looking to do something like this: Apache1 /var/log/Apache1/httpd/access.log /var/log/Apache1/httpd/error.log Apache2 /var/log/Apache2/httpd/access.log /var/log/Apache2/httpd/error.log Apache3 /var/log/Apache3/httpd/access.log /var/log/Apache3/httd/error.log and so on. Thanks all in advance Vince

3 2

avoid
by Atif Munir 22 Nov '05

22 Nov '05

How can i avoid "syslog-ng[24047]: STATS: dropped 0" As there are many more messages which are being captured by the syslog-ng and are published on the web.. Thanks

1 0

Apache Syslog-ng/Syslog-ng newbie
by Esquivel, Vicente 21 Nov '05

21 Nov '05

Hello all, I am new to this list, I am seeking some help on how to setup syslog-ng as a central log server. More importantly I am wanting to know how to log all of my Apache servers to the central log server, but also create separate logs for each of the systems. For example I am looking to do something like this: Apache1 /var/log/Apache1/httpd/access.log /var/log/Apache1/httpd/error.log Apache2 /var/log/Apache2/httpd/access.log /var/log/Apache2/httpd/error.log Apache3 /var/log/Apache3/httpd/access.log /var/log/Apache3/httd/error.log and so on. Thanks all in advance Vince

2 1

syslog-ng and logwatch
by kevin_herald 17 Nov '05

17 Nov '05

Hello, Anyone use syslog-ng with logwatch-7.1? I was wondering how to set it up to scan the proper log files. Right now I have multiple servers writing to the main syslog-ng server. It creates directories such as: /var/log/HOSTS/<ip of clients>/2005/11/14/<logfile-name> logwatch.pl looks like it scans for /var/log or whatever you want, but I'm not sure how to scan the multiple directories of the syslog-ng server client logs. Thanks, Kevin

5 7

Remove informations out of the destination
by GCA-FRITZ＠web.de 16 Nov '05

16 Nov '05

Hi, I habe a question about removing the informations like Nov 16 12:40:50 xxxx.xxx.xxx.xxx logger: out of my destination file. Is there somewhere a flag in syslog-ng witch disable this information. Thx for your help. br Daniel ______________________________________________________________ Verschicken Sie romantische, coole und witzige Bilder per SMS! Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193

1 0

Measure throughput and events-per-second
by Scott, Joshua 15 Nov '05

15 Nov '05

Can someone provide some information or tips on how to measure the performance and usage of syslog-ng? I'm looking into purchasing some new hardware for my syslog-ng server and I want to be able to determine the average number of events-per-second/minute/etc as well as the average number of bytes written to disk per second/minute/etc. Any assistance provided is greatly appreciated. Joshua Scott ============================================================================== NOTICE - This communication may contain confidential and privileged information that is for the sole use of the intended recipient. Any viewing, copying or distribution of, or reliance on this message by unintended recipients is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer. ==============================================================================

2 1

Apache Syslog-ng/Syslog-ng newbie
by Esquivel, Vicente 15 Nov '05

15 Nov '05

Hello all, I am new to this list, I am seeking some help on how to setup syslog-ng as a central log server. More importantly I am wanting to know how to log all of my Apache servers to the central log server, but also create separate logs for each of the systems. For example I am looking to do something like this: Apache1 /var/log/Apache1/httpd/access.log /var/log/Apache1/httpd/error.log Apache2 /var/log/Apache2/httpd/access.log /var/log/Apache2/httpd/error.log Apache3 /var/log/Apache3/httpd/access.log /var/log/Apache3/httd/error.log and so on. Thanks all in advance Vince

1 0

Problem with source File and destination File
by Daniel Fritz 14 Nov '05

14 Nov '05

Hello, I wrote for testing a small shell script witch put every second a line with the same information into a file called "imperator.log". I would like to take the file thrue syslog-ng and write it into a destination file but it did not work ... has somebody a hint ? This is my configfile : options { sync (256); time_reopen (10); log_fifo_size (4096); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_test { file ("/tmp/imperator.log"); internal(); }; destination d_test { file("/var/tmp/testreceive.log"); }; destination d_msg { file("/tmp/$HOST-messages-$MONTH-$YEAR" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; # log { source(s_sys); filter(f_filter2); destination(d_mesg); }; # log { source(s_sys); filter(f_filter3); destination(d_auth); }; # log { source(s_sys); filter(f_filter4); destination(d_mail); }; # log { source(s_sys); filter(f_filter5); destination(d_mlal); }; # log { source(s_sys); filter(f_filter6); destination(d_spol); }; # log { source(s_sys); filter(f_filter7); destination(d_boot); }; # log { source(s_sys); filter(f_filter8); destination(d_cron); }; log { source(s_test); destination(d_msg); }; Thx Daniel ______________________________________________________________ Verschicken Sie romantische, coole und witzige Bilder per SMS! Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193

3 2

syslog-ng incorrectly parsing some messages
by Crayola 08 Nov '05

08 Nov '05

I am running syslog-ng 1.8.6 on my central syslog server. The syslog clients run standard syslog daemons that come with the operating systems. Solaris, Cisco, etc. I have noticed in my syslog-ng database (mysql) that there are many entries like these. (two separate rows) | 192.168.11.27 | kern | info | info | 06 | 2005-11-05 | 22:37:20 | scsi | scsi: [ID 365881 kern.info] /sbus@2,0/QLGC,isp@1,10000 (isp0): | 512925 | ------------------------------------------------------------------------- | Firmware | kern | info | info | 06 | 2005-11-05 | 22:37:20 | Version | Version: v1.37.5, Customer: 15, Product: 0 | 512926 | These seem to be the result of syslog-ng incorrectly (or the remote client) parsing the syslog message. This is the original syslog messages that the Solaris 9 client logs to its logs. Nov 5 22:37:20 lefou scsi: [ID 365881 kern.info] /sbus@a,0/QLGC,isp@1,10000 (isp1): Nov 5 22:37:20 lefou Firmware Version: v1.37.5, Customer: 15, Product: 0 As you can see the original is two separate messages as well but what gets logged to syslog-ng's database doesn't contain the hostname for the second message. In the second entry.. the hostname is listed as "Firmware" I have found many examples of these multiline messages being parsed incorrectly if you need more. Any ideas? Thanks, Mike Another example... Nov 5 22:37:20 lefou scsi: [ID 365881 kern.info] /sbus@3,0/SUNW,fas@3,8800000 (fas0): Nov 5 22:37:20 lefou rev 2.2 FEPS chip | 192.168.11.27 | kern | info | info | 06 | 2005-11-05 | 22:37:20 | scsi | scsi: [ID 365881 kern.info] /sbus@3,0/SUNW,fas@3,8800000 (fas0): | 512932 | | rev | kern | info | info | 06 | 2005-11-05 | 22:37:20 | | 2.2 FEPS chip | 512933 |

2 1

filter based on IP - catching other IPs?
by crayola＠optonline.net 08 Nov '05

08 Nov '05

I am running syslog-ng 1.6.8 as a central log host. everything is working great.. except for my filters. I want to filter all messages from 192.168.10.1 and 192.168.10.2 into other locations. Unfortunatly I seem to be catching other IP addresses in the filter below. Examples: 192.168.10.151, 192.168.10.197, 192.168.10.22 Is there anything I can do to make this filter more specific without resorting to regex. filter fw_only { ( host("192.168.10.1") or host("192.168.10.2") ); }; Thanks, Mike

4 3