November 2005 - syslog-ng - lists.balabit.hu

syslog-ng log processing
by Metal Gear 07 Nov '05

07 Nov '05

hi guys, would anyone recommend any log analysis and reporting tool for log files obtained through syslog-ng. I tried to use logwatcher but i was unable to properly configure that too. Thanks

1 0

Architecture redundancy
by philip 07 Nov '05

07 Nov '05

Hi, I would like to setup two syslog server so that I don't need to have outage if I need to do some update/upgrade on the system, my questions is how should I set it up? I can send all the traffic to both servers, but I can only load the data to a database on one system at a time. If I need to down the primary system, that mean I need to switch to the secondary to load the data and switch it back when primary is up again. How I can make sure I get all the data load on the database and make sure the syslog data on both servers are the same? Thanks. Hermann

3 2

big log server
by jorge severino 05 Nov '05

05 Nov '05

hi... i'am try install central log server for some squid proxy's and mail postfix's servers. i planning use syslog-ng in central server with FreeBSD 6.0, syslog-ng and Awstat for show web logs. AWstat is compatible with syslog-ng? any comments or suggeren.... thanks...

1 0

TZ DST offset problem in 1.6.8 syslog-ng using $TZOFFSET or $ISODATE....
by Peter Valdemar Mørch 04 Nov '05

04 Nov '05

Hi, I've seen the "ISODATE offset?" thread, and I seem to be seeing the exact same thing: https://lists.balabit.hu/pipermail/syslog-ng/2004-November/006633.html The problem appears only during Daylight Savings Time ("summer time"), not during standard/non-DST/"Winter" time. We just entered non-DST time this weekend (and hence the bug "stopped"). During DST the TZ offset does not include the offset due to DST. So TZ is off-by-one during DST. About this section #if HAVE_GLOBAL_TIMEZONE length = snprintf(dest, left - 1, "%c%02ld%02ld", timezone > 0 ? '-' : '+', (timezone < 0 ? -timezone : timezone) / 3600, (timezone % 3600) / 60); #else Bazsi writes in the thread: > Thanks. Either the value in timezone is not set properly, or it does not > contain the daylight-saving offset, or my code has an error. > > I'll check (I've checked DST before, and timezone should reflect it, so > it _might_ be a problem in libc) I'll see what I can do. Has there been any progress on this? After typing up this report I notice the 1.9.6 NEWS and see: "Fixes in local timezone detection, it should properly detect DSTs on Linux, Solaris and probably BSDs". Is this the same bug? Any chance of this fix being back-ported into a 1.6 maintenance release to show up automagically in debian? (There are no TZ environment variables set on this machine. Also what should it be set to? Following GNUs docs doesn't help. See below.) ************ environment ************* > cat /etc/timezone Europe/Copenhagen > ls -l /etc/localtime lrwxrwxrwx 1 root root 37 2005-10-25 07:13 /etc/localtime -> /usr/share/zoneinfo/Europe/Copenhagen syslog-ng 1.6.8-1 > set | grep -i TZ (no output - se below under "Tried setting TZ env") # I'm using 1.6.8-1 on debian (==newest in testing+unstable), # and the poster in the thread from Nov 2004 was using 1.6.4-1. > dpkg-query -W 'syslog-ng' > dpkg-query -W libc6 libc6 2.3.5-6 ************ syslog-ng.conf snippet ************* destination d_template { file("/tmp/syslog-template.log" template("\"DATE'$ISODATE'TZOFFSET'$TZOFFSET'FULLDATE'$FULLDATE'MSG'$MSG\n") template_escape(yes)); }; log { source(s_all); destination(d_template); }; ************ non-DST example - works ************ # date, perl and syslog-ng all agree with the truth that # we're +0100 during "wintertime" - non-DST. > date --rfc-2822 Mon, 31 Oct 2005 00:00:06 +0100 > perl -le 'use POSIX; print strftime ("%a, %d %b %Y %H:%M:%S %z", localtime);' Mon, 31 Oct 2005 00:00:08 +0100 > logger 'A message' > sudo tail /tmp/syslog-template.log | grep 'A message' "DATE'2005-10-31T00:00:11+0100'TZOFFSET'+0100'FULLDATE'2005 Oct 31 00:00:11'MSG'pvm: A message ************ DST example - fails ************ # Date and perl agree with the truth that # we're +0200 during "summertime" - dst. > date --rfc-2822 Tue, 25 Oct 2005 00:14:13 +0200 > perl -le 'use POSIX; print strftime ("%a, %d %b %Y %H:%M:%S %z", localtime);' Tue, 25 Oct 2005 00:14:15 +0200 # syslog-ng seems to think we're +0100 > logger 'A message' > sudo tail /tmp/syslog-template.log | grep 'A message' "DATE'2005-10-25T00:14:17+0100'TZOFFSET'+0100'FULLDATE'2005 Oct 25 00:14:17'MSG'pvm: A message *********** Tried setting TZ env **************** I tried setting the TZ environment variable as pr. http://www.gnu.org/software/libc/manual/html_node/TZ-Variable.html And notice that perl (or rather the POSIX implementation of strftime()) adheres to it: > TZ=:/usr/share/zoneinfo/Asia/Tokyo perl -le 'use POSIX; print strftime ("%a, %d %b %Y %H:%M:%S %z", localtime);' Tue, 25 Oct 2005 07:03:32 +0900 > TZ=:/usr/share/zoneinfo/Europe/Copenhagen perl -le 'use POSIX; print strftime ("%a, %d %b %Y %H:%M:%S %z", localtime);' Tue, 25 Oct 2005 00:03:39 +0200 Using Asia/Tokyo or Europe/Copenhagen does affect syslog-ng, but it still has a offset-by-one error during DST! # Not my real timezone # export TZ=:/usr/share/zoneinfo/Asia/Tokyo # /etc/init.d/syslog-ng restart # logger 'A message' # tail /tmp/syslog-template.log | grep 'A message' "DATE'2005-10-25T07:06:14+0900'TZOFFSET'+0900'FULLDATE'2005 Oct 25 07:06:14'MSG'pvm: A message # My real timezone - should be +0200 on oct 25 in # Copenhagen as strftime also knows. # # export TZ=:/usr/share/zoneinfo/Europe/Copenhagen # /etc/init.d/syslog-ng restart # logger 'A message' # tail /tmp/syslog-template.log | grep 'A message' "DATE'2005-10-25T00:06:57+0100'TZOFFSET'+0100'FULLDATE'2005 Oct 25 00:06:57'MSG'pvm: A message -- Peter Valdemar Mørch http://www.morch.com

3 2

syslog-ng-1.9.6 template bug patch
by Peter Nahas 03 Nov '05

03 Nov '05

I have stumbled upon a bug in syslog-ng-1.9.6 caused by an un-cleared buffer in logwriter.c which causes templated messages to be output improperly. Up until a certain point (not certain why it stops, perhaps due to a buffer size?), for each message output, all previous messages are output. For example, if the messages "One" "Two" and "Three" are sent to syslog-ng, the destination will receive "One" "One" "Two" "One" "Two" "Three". I have included a patch which solves the issue, but there may be a better solution. If you want a syslog-ng.conf which will produce this issue, let me know. Thanks, Peter Nahas Software Engineer MRV Communications - InReach Division --- 1.9.6/logwriter.c 2005-10-26 09:59:09.000000000 -0400 +++ mine/logwriter.c 2005-10-26 09:59:58.000000000 -0400 @@ -160,7 +160,8 @@ { LogTemplate *template = NULL; - + g_string_assign(result, ""); + if (self->options->template) { template = self->options->template;

2 1

hostname
by Atif Munir 03 Nov '05

03 Nov '05

mysql logs shows that information is stored in the db on the basis of IP.....:-( which sucks. mysql> select * from logs; | 172.16.2.4 <http://172.16.2.4> | auth | crit | crit | 22 | 2005-11-02 | 22:30:27 | su | su: [ID 810491 auth.crit] 'su root' failed for atifmun on /dev/pts/1 | 13115 | +-------------+----------+----------+---------+------+------------+----------+-------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------+ 13115 rows in set (0.11 sec) Please help....thanks in advance. atif

2 1

syslog-ng changing permission on /dev/klog
by hammy 02 Nov '05

02 Nov '05

I hope someone can help me out with this problem b.c. I'm butting my head against the wall... I have installed and configured syslog-ng to my (preliminary) satisfaction and have been able to run it from a terminal without any problems. Syslog-ng creates logs and is generally happy. But when I run it, I get one line that says syslog-ng is changing the permissions on /dev/klog. I am running syslog-ng on a Mac OS 10.3.9. When I edit /etc/rc to remove the startup for syslog and enter the folowing: /path/to/syslog-ng -f /path/to/syslog-ng.conf -p /path/to/syslog.pid and reboot the machine spins and does not finish booting. If I boot the machine verbosely I can see that it is hanging while trying to change the permissions for /dev/klog. Any suggestions on what is going wrong?

2 1

hostname
by Atif Munir 02 Nov '05

02 Nov '05

Thanks for the reply....I have the /etc/hosts like this 172.16.2.4 server1 172.16.2.7 server2 but still I am unable to get the hostnames on the web......All clients are there with their IP address. Thanks a lot for those who replied my question. Atif

1 0

hostname
by Atif Munir 01 Nov '05

01 Nov '05

I am getting the messages on my syslog-ng server but the hostname is not there .......The messages are there on the IP address based .....Is there a way to replace IP with the hostname.......... Thanks in advance. Atif

3 2

host_cache.txt and date_cache.txt
by javier rojas 01 Nov '05

01 Nov '05

hello, i have a simple question, i'm trying to make a manual for the instalation of php syslog-ng (for documentation) but i don't know what exactly are host_cache.txt and date_cache.txt for... can anyone explain me what are they for? -- Ciao,Javier linux user #393724

1 0