March 2005 - syslog-ng - lists.balabit.hu

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Ryan McCain 31 Mar '05

31 Mar '05

I will be logging from 10 firewalls, 20 linux boxes, 2 routers and a handful of workstations. Will this configuration file do the trick? source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix_stream("/dev/log"); internal(); }; destination hosts { file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" owner(root) group(root) perm(0755) dir_perm(0755) create_dirs(yes)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; log { source(s_sys); destination(hosts); }; Thanks, Ryan >>>Bill Nash <billn(a)billn.net> 03/31 10:26 am >>> You'll need a log() directive that includes the destination. The basic path is: Log Source -> Optional Filter -> Destination. - billn On Thu, 31 Mar 2005, Ryan McCain wrote: >Bill, > >So I can simply add this to my conf. file (modifying owner, group, perm, >dir_perm of course) and it will start accepting logs from remote >servers? > > >Where do I specify which hosts to accept logs from (I'd prefer not to >use tcp wrappers)? > >Thanks again, >Ryan > >>>>Bill Nash <billn(a)billn.net> 03/31 10:15 am >>> >On Thu, 31 Mar 2005, Ryan McCain wrote: > >>I'm starting to understand the syntax. However, what part of this >>statement tells syslog-ng to create a file for each host its receiving >>logs from? > >>destination hosts { >>file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" > >>owner(bob) group(llamafood) perm(0755) dir_perm(0755) >create_dirs(yes)); > > >If the file doesn't exist, it will be created. If the directory doesn't >exist, you need the create_dirs directive. > >- billn >

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Bill Nash 31 Mar '05

31 Mar '05

You'll need a log() directive that includes the destination. The basic path is: Log Source -> Optional Filter -> Destination. - billn On Thu, 31 Mar 2005, Ryan McCain wrote: > Bill, > > So I can simply add this to my conf. file (modifying owner, group, perm, > dir_perm of course) and it will start accepting logs from remote > servers? > > > Where do I specify which hosts to accept logs from (I'd prefer not to > use tcp wrappers)? > > Thanks again, > Ryan > >>>> Bill Nash <billn(a)billn.net> 03/31 10:15 am >>> > On Thu, 31 Mar 2005, Ryan McCain wrote: > >> I'm starting to understand the syntax. However, what part of this >> statement tells syslog-ng to create a file for each host its receiving >> logs from? > >> destination hosts { >> file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" > >> owner(bob) group(llamafood) perm(0755) dir_perm(0755) > create_dirs(yes)); > > > If the file doesn't exist, it will be created. If the directory doesn't > exist, you need the create_dirs directive. > > - billn >

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Ryan McCain 31 Mar '05

31 Mar '05

What is the destination? This syntax is wickedly confusing to me. Thanks, Ryan >>>Bill Nash <billn(a)billn.net> 03/31 10:26 am >>> You'll need a log() directive that includes the destination. The basic path is: Log Source -> Optional Filter -> Destination. - billn On Thu, 31 Mar 2005, Ryan McCain wrote: >Bill, > >So I can simply add this to my conf. file (modifying owner, group, perm, >dir_perm of course) and it will start accepting logs from remote >servers? > > >Where do I specify which hosts to accept logs from (I'd prefer not to >use tcp wrappers)? > >Thanks again, >Ryan > >>>>Bill Nash <billn(a)billn.net> 03/31 10:15 am >>> >On Thu, 31 Mar 2005, Ryan McCain wrote: > >>I'm starting to understand the syntax. However, what part of this >>statement tells syslog-ng to create a file for each host its receiving >>logs from? > >>destination hosts { >>file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" > >>owner(bob) group(llamafood) perm(0755) dir_perm(0755) >create_dirs(yes)); > > >If the file doesn't exist, it will be created. If the directory doesn't >exist, you need the create_dirs directive. > >- billn >

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Ryan McCain 31 Mar '05

31 Mar '05

Bill, So I can simply add this to my conf. file (modifying owner, group, perm, dir_perm of course) and it will start accepting logs from remote servers? Where do I specify which hosts to accept logs from (I'd prefer not to use tcp wrappers)? Thanks again, Ryan >>>Bill Nash <billn(a)billn.net> 03/31 10:15 am >>> On Thu, 31 Mar 2005, Ryan McCain wrote: >I'm starting to understand the syntax. However, what part of this >statement tells syslog-ng to create a file for each host its receiving >logs from? >destination hosts { >file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" >owner(bob) group(llamafood) perm(0755) dir_perm(0755) create_dirs(yes)); If the file doesn't exist, it will be created. If the directory doesn't exist, you need the create_dirs directive. - billn

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Bill Nash 31 Mar '05

31 Mar '05

On Thu, 31 Mar 2005, Ryan McCain wrote: > I'm starting to understand the syntax. However, what part of this > statement tells syslog-ng to create a file for each host its receiving > logs from? > destination hosts { > file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" > owner(bob) group(llamafood) perm(0755) dir_perm(0755) create_dirs(yes)); If the file doesn't exist, it will be created. If the directory doesn't exist, you need the create_dirs directive. - billn

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Ryan McCain 31 Mar '05

31 Mar '05

This is the base config file I'm working with.. Note: i'm using unix_stream. Should I be using unix_dgram since im on a 2.6x kernel? I'm reading through the section on syslog-ng in the book "Building Secure Server with Linux", and it mentions soemthing about using "unix-dgram" .. note the "-" instead of "_". I'm assuming its a type and should be "_". ------ source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix_stream("/dev/log"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; >>>billn(a)billn.net 03/31 10:00 am >>> On Thu, 31 Mar 2005, Ryan McCain wrote: >Where can I find documentation that will give me information on how to >accept logs from remote hosts and have each of the hosts log to their >own file? > destination hosts { file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" owner(bob) group(llamafood) perm(0755) dir_perm(0755) create_dirs(yes)); }; - billn syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Configure syslog-ng to act as a central loggingserver
by Vaibhav Goel 31 Mar '05

31 Mar '05

The $HOST macro... -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Ryan McCain Sent: March 31, 2005 8:08 AM To: billn(a)billn.net; syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Configure syslog-ng to act as a central loggingserver I'm starting to understand the syntax. However, what part of this statement tells syslog-ng to create a file for each host its receiving logs from? Thanks, Ryan >>>billn(a)billn.net 03/31 10:00 am >>> On Thu, 31 Mar 2005, Ryan McCain wrote: >Where can I find documentation that will give me information on how to >accept logs from remote hosts and have each of the hosts log to their >own file? > destination hosts { file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$D AY" owner(bob) group(llamafood) perm(0755) dir_perm(0755) create_dirs(yes)); }; - billn syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Ryan McCain 31 Mar '05

31 Mar '05

I'm starting to understand the syntax. However, what part of this statement tells syslog-ng to create a file for each host its receiving logs from? Thanks, Ryan >>>billn(a)billn.net 03/31 10:00 am >>> On Thu, 31 Mar 2005, Ryan McCain wrote: >Where can I find documentation that will give me information on how to >accept logs from remote hosts and have each of the hosts log to their >own file? > destination hosts { file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" owner(bob) group(llamafood) perm(0755) dir_perm(0755) create_dirs(yes)); }; - billn syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Configure syslog-ng to act as a central logging server
by Ryan McCain 31 Mar '05

31 Mar '05

Where can I find documentation that will give me information on how to accept logs from remote hosts and have each of the hosts log to their own file? I've read the man file and looked at the web page, but can't find anything to substantial. Thanks, Ryan

3 2

problem with syslog-ng fork & exec
by niraj 31 Mar '05

31 Mar '05

I m facing problem with this code . When I execute this program it forks 2 process A zombie syslog-ng process on the forked ID syslog-ng on the next pid but without while loop every thing is working properly TIA niraj #include<iostream> #include<unistd.h> using namespace std; int main() { int cpid; cpid=fork(); if(cpid==0) { if(execv( "/usr/local/sbin/syslog-ng" ,NULL)==-1) { cout<<"hello"<<endl; } cout<<"ok"<<endl; } while(1) { ; } return 0; } ~ ~

1 0