February 2005 - syslog-ng - lists.balabit.hu

syntax for escaped characters
by Mike Pepe 25 Feb '05

25 Feb '05

OK, I'm trying to figure out what the correct syntax for a match is. I'm trying to match crond(pam_unix) filter f_cron_pam { match("crond(pam_unix)"); }; Doesn't match. filter f_cron_pam { match("crond$pam_unix$"); }; Doesn't match. something about the parenthesis it doesn't like, because: filter f_cron_pam { match("crond") and match("pam_unix"); }; does match. It's just kind of an ugly way around it. Anyone know what the right way to do this is?

2 2

Syslog-ng on Fedora Core 1
by Phusion 24 Feb '05

24 Feb '05

Hi, I installed syslog-ng 1.6.6 from source on Fedora Core 1. I have it up and running but I can't seem to get kernel messages. I've included part of my syslog-ng.conf file for you to look at. source local { internal(); file("/proc/kmsg" log_prefix("kernel: ")); unix-stream("/dev/log"); }; Also, I don't have klogd running. When using the stock syslog that comes with Fedora, klogd also runs. I stopped that from running and started the syslog-ng service. I can't seem to get kernel log messages. Let me know what my problem is. Thanks.

2 1

fyi: building SyslogNG snapshot on OSX 10.3.8
by OpenMacNews 23 Feb '05

23 Feb '05

hi all, i've seen a couple of recent questions onlist re: building on Mac, so i thought i'd post my latest notes; the following works great for me. HTH, but, as always, YMMV =) note: (a) i'm building from the latest src snapshots (b) i'm using some updated build tools (c) i'm linking against an EXTERNAL bind9 build's libs (currently bind-9.3.1rc1), rather than Apple's native -lresolv ... fwiw, my ENV: % gcc --version gcc (GCC) 3.3 20030304 (Apple Computer, Inc. build 1671) % glibtool --version ltmain.sh (GNU libtool) 1.5.14 (1.1220.2.195 2005/02/12 12:12:33) % automake --version automake (GNU automake) 1.9.4 % autoconf --version autoconf (GNU Autoconf) 2.59 setenv LIBOL_LOC "http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot" setenv SYSLOGNG_LOC "http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot" setenv LIBOL_VER "libol-0.3.15+20050216" setenv SYSLOGNG_VER "syslog-ng-1.6.6+20050216" cd /usr/ports/ wget $LIBOL_LOC/$LIBOL_VER.tar.gz wget $SYSLOGNG_LOC/$SYSLOGNG_VER.tar.gz gnutar zxvf $LIBOL_VER.tar.gz gnutar zxvf $SYSLOGNG_VER.tar.gz unsetenv CFLAGS CPPFLAGS CXX CXXFLAGS LDFLAGS LDDLFLAGS LD_PREBIND EXTRA_LDFLAGS EXTRA_LIBS LC_ALL LANG LINGUAS ################ ## LIBOL # cd /usr/ports/$LIBOL_VER glibtoolize --force --copy aclocal autoconf ./configure \ --prefix=/usr/local \ --enable-shared \ --enable-static make make install ################ ## SYSLOG-NG # cd /usr/ports/$SYSLOGNG_VER unsetenv CFLAGS CPPFLAGS CXX CXXFLAGS LDFLAGS LDDLFLAGS LD_PREBIND EXTRA_LDFLAGS EXTRA_LIBS LC_ALL LANG LINGUAS setenv LDFLAGS "-bind_at_load -L/usr/local/bind9/lib -llwres -lbind9" setenv CPPFLAGS "-I/usr/local/bind9/include" # make a couple of changes ... ================================================================ (EDITOR) /usr/ports/$SYSLOGNG_VER/configure.in @164 --- AC_CHECK_LIB(resolv, res_init) +++ dnl AC_CHECK_LIB(resolv, res_init) dnl on Linux res_init is a macro --- AC_CHECK_LIB(resolv, __res_init) +++ dnl AC_CHECK_LIB(resolv, __res_init) @336 --- LIBS="$LIBS $LIBOL_LIBS -Wl,-Bstatic $LEXLIB $LIBWRAP_LIBS $LIBNET_LIBS -Wl,-Bdynamic" +++ LIBS="$LIBS $LIBOL_LIBS -Wl,-dynamic $LEXLIB $LIBWRAP_LIBS $LIBNET_LIBS -Wl,-dynamic" ================================================================ glibtoolize --force --copy aclocal autoconf ./configure \ --prefix=/usr/local \ --enable-debug \ --enable-full-static=no \ --enable-tcp-wrapper make make install ################ ## StartupItems # mkdir -p /Library/StartupItems/SyslogNG ================================================== (EDITOR) /Library/StartupItems/SyslogNG/SyslogNG #!/bin/sh ## # SyslogNG StartupItem # . /etc/rc.common RunService () { case $1 in start ) StartService ;; stop ) StopService ;; restart) RestartService ;; * ) echo "$0: unknown argument: $1";; esac } ## # SyslogNG StartupItem Handlers ## StartService () { if [ "${SYSLOGNG:=-NO-}" = "-YES-" ]; then # if [ -f "/var/run/syslog" ] ; then ConsoleMessage "Stopping SYSLOGD server" sleep 2 killall syslogd # fi ConsoleMessage "Starting SYSLOG-NG Logging Server" /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf -p /var/run/syslog-ng.pid fi } StopService () { if [ -f "/var/run/syslog-ng.pid" ] ; then ConsoleMessage "Stopping SYSLOG-NG Logging Server" sleep 2 kill -9 `cat /var/run/syslog-ng.pid` fi } RestartService () { StopService StartService } RunService "$1" ================================================================= ================================================== (EDITOR) /Library/StartupItems/SyslogNG/StartupParameters.plist { Description = "SyslogNG"; Provides = ("SyslogNG"); Requires = ("Resolver","Network Time","Disks"); Uses = ("Network"); OrderPreference = "None"; Messages = { start = "Starting SyslogNG"; stop = "Stopping SyslogNG"; }; } ================================================== ================================================== (EDITOR) /etc/hostconfig +++ SYSLOGNG=-YES- ================================================== chown -R root:wheel /Library/StartupItems/SyslogNG chmod 755 /Library/StartupItems/SyslogNG chmod 755 /Library/StartupItems/SyslogNG/SyslogNG chmod 644 /Library/StartupItems/SyslogNG/StartupParameters.plist # now let's see what we've got ... % which syslog-ng /usr/local/sbin/syslog-ng % ls -al /usr/local/sbin/syslog-ng -rwxr-xr-x 1 root wheel 453968 Feb 23 11:17 /usr/local/sbin/syslog-ng % otool -L /usr/local/sbin/syslog-ng /usr/local/sbin/syslog-ng: /usr/local/bind9/lib/liblwres.1.dylib (compatibility version 4.0.0, current version 4.2.0) /usr/local/bind9/lib/libbind9.0.dylib (compatibility version 1.0.0, current version 1.5.0) /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 71.1.1) # start it up !!! % /Library/StartupItems/SyslogNG/SyslogNG start % ps -ax | grep syslog-ng 9649 ?? Ss 0:00.02 /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf -p /var/run/syslog-ng.pid smooth sailing from here ... happy trails! richard

1 0

anyone know where these are coming from?
by Mike Pepe 23 Feb '05

23 Feb '05

Hi all, My system is running fedora core 3. My /var/log/messages gets full of these: Feb 20 00:10:03 quadzilla crond(pam_unix)[29549]: session closed for user root for every cron job that runs. However these aren't cron messages, because anything from cron goes into a separate log. I'm wondering if anyone knows a way to filter these without using a match rule, or how it's possible to determine what program is sending these messages? thanks -Mike

2 3

Help on Centralized log host
by Anup Philip 22 Feb '05

22 Feb '05

Hi all, Can anyone give the steps to configure a host to send all logs to a central syslog-ng server in a Solaris environment? It will be really great if anyone can send the sample syslog-ng.conf file for centralized syslog server and client. Thanks a lot in advance. Rgds Anup

2 1

what´s wrong?
by Denis Kot 21 Feb '05

21 Feb '05

Hello to All I want to messages from smbd and nmbd to redirect to another logfile I have: source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; destination d_smbd { file("/var/log/smbd"); }; filter f_smbd { program(smbd.*) or match(smbd); }; filter f_nmbd { program(nmbd.*) or match(nmbd); }; log { source(src); filter(f_smbd); destination(d_smbd); }; log { source(src); filter(f_nmbd); destination(d_smbd); }; log { source(src); destination(messages); }; but messages like: Feb 18 15:02:57 gate smbd[1089]: [2005/02/18 15:02:57, 0] lib/util_sock.c:get_peer_addr(1000) Feb 18 15:02:57 gate smbd[1089]: getpeername failed. Error was Transport endpoint is not connected or Feb 18 15:04:14 gate nmbd[15845]: [2005/02/18 15:04:14, 0] nmbd/nmbd_incomingdgrams.c:process_get_backup_list_request(693) Feb 18 15:04:14 gate nmbd[15845]: process_get_backup_list_request: domain list requested for workgroup MASSNET and I am not a local master browser. still going to /var/log/messages... what´s wrong? -- Denis Kot denis?jabber.org.by ICQ: 13680126 Mobil: +375 29 6-1234-78

4 5

Re:
by Bazsi 20 Feb '05

20 Feb '05

1 0

The right way for kmsg: file or pipe and where is /proc/kmsg if proc is deprecated in 2.6?
by Peter 20 Feb '05

20 Feb '05

Hello. I would like to ask two questions. 1. There is some strange difference between examples and documentation. In reference there is written that /proc/kmsg is file, but in all examples I found it is pipe. What is it pipe or a file in Linux (2.6)? 2. Proc is deprecated in linux kernel 2.6. What is the substitution for /proc/kmsg from the point of kernel logging? BTW. There is a small bug in reference manual. Example 3-9. Using the tcp() is broken and is not working. I think it should look like: destination d_tcp { tcp("10.1.2.3" port(1999) localport(999)); }; instead of: destination d_tcp { tcp("10.1.2.3" port(1999); localport(999)); }; A least this works for me. And on pages of reference manual link on "Note" picture is broken. :) Thank you for your attention, Peter.

1 0

Logrotate ?
by Brian Ipsen 18 Feb '05

18 Feb '05

Hi, The re-occurring question... How com that logrotate isn't working on my logs ?? I have a file in /etc/logrotate.d like this: /var/log/snmp/*.log { weekly notifempty compress sharedscripts missingok prerotate /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true /etc/init.d/syslog-ng restart endscript postrotate /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true /etc/init.d/syslog-ng restart touch /var/log/snmp/network.log /var/log/snmp/snmptrapd.log /var/log/snmp/ups.log /var/log/snmp/vpn.log /var/log/snmp/witraz.log endscript } I did the kill -HUP both as pre- and post-rotate because there seems to a problem, I've even tried to restart the daemon - nothing helps... Checking my /var/log/snmp dir gives me: -rw-r--r-- 1 root root 2935158 Feb 18 20:12 network.log -rw------- 1 root root 1106 Nov 18 23:44 network.log.1.gz -rw------- 1 root root 7981 Aug 24 21:19 network.log.2.gz -rw------- 1 root root 1664 Jul 31 2004 network.log.3.gz -rw------- 1 root root 7012 Jul 23 2004 network.log.4.gz -rw-r--r-- 1 root root 70908362 Feb 18 20:14 snmptrapd.log -rw------- 1 root root 28929 Nov 19 04:00 snmptrapd.log.1.gz -rw------- 1 root root 4591 Aug 25 02:58 snmptrapd.log.2.gz -rw------- 1 root root 3366 Aug 1 2004 snmptrapd.log.3.gz -rw------- 1 root root 4729 Jul 25 2004 snmptrapd.log.4.gz -rw-r--r-- 1 root root 767 Feb 3 09:43 ups.log -rw------- 1 root root 467 Aug 24 14:36 ups.log.1.gz -rw------- 1 root root 220 Jul 15 2004 ups.log.2.gz -rw-r--r-- 1 root root 36442477 Feb 18 20:10 vpn.log -rw-r--r-- 1 root root 1045305 Dec 30 10:35 vpn.log.1.gz -rw------- 1 root root 36723 Nov 21 03:56 vpn.log.2.gz -rw-r--r-- 1 root root 104 Nov 4 09:40 vpn-trap.log.1.gz -rw-r--r-- 1 root root 1533667 Feb 17 17:17 witraz.log -rw------- 1 root root 553 Nov 19 17:49 witraz.log.1.gz -rw------- 1 root root 187 Aug 24 15:56 witraz.log.2.gz -rw------- 1 root root 620 Jul 31 2004 witraz.log.3.gz -rw------- 1 root root 703 Jul 24 2004 witraz.log.4.gz I've rotated some of the logfiles manually - but check e.g. network.log - it's been 3 months since last rotate ?? I'm running on a RHEL 3.0 Any idea why this logrotate isn't working ?? /Brian

1 0

FAQ entries wanted for performance tuning
by Nate Campi 18 Feb '05

18 Feb '05

Everyone please send me your syslog-ng performance tuning tips from the real world. I added something to the end of the FAQ, but I know there's much much more we can add from our collective experience. Email directly to me is appropriate for this. I'm happy to include OS-level stuff, since the focus here is to build a fast loghost. This includes everything along the path from the NIC through the filesystem and onto some kind of final storage. Of course the focus is on syslog-ng, though. :) -- Nate "It is good sportsmanship to not pick up lost golf balls while they are still rolling." - Samuel Clemens

1 0