April 2005 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]Match macro in filename?
by Vaibhav Goel 14 Apr '05

14 Apr '05

Actually my bad...it does work...in fact writes 1 line of log entry but then no more. The script exits after that one entry (ie not running like my "cat" test in the background)... -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Vaibhav Goel Sent: April 14, 2005 2:23 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Match macro in filename? Thanks Nate. I am using (trying to) an alternate approach now...I am going to write a perl script that gets everything from STDIN and parses the log data, does some regexp matching and writes out the logs based on that....check this simple script (which does not wanna work): #!/usr/bin/perl -w my $input = <STDIN> ; if ($input =~ /xyz/) { $var = "xyz.log"; open(LOG, ">>/tmp/$var"); print LOG "$input"; close(LOG); } This does not seem to want to work using syslog-ng (it works fine from the commandline though),...any ideas anyone? -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Nate Campi Sent: April 14, 2005 2:12 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Match macro in filename? On Thu, Apr 14, 2005 at 07:55:24AM -0700, Vaibhav Goel wrote: > > Cool that it is 1.9.4. Is 1.9.4 production ready by any chance? I am > currently using 1.6.5. If not, is there any other way you can suggest > to solve this "problem"? I am not averse to writing some scripts etc.. Good news on the feature in the 1.9 branch! As for using 1.6.5, someone else just brought this up the other day, see this thread: https://lists.balabit.hu/pipermail/syslog-ng/2005-April/007260.html -- Nate "If you put a billion monkeys in front of a billion typewriters typing at random, they would reproduce the entire collected works of Usenet in about ... five minutes." -Anon. "Come to think of it, there are already a million monkeys on a million typewriters, and the Usenet is NOTHING like Shakespeare!" -Blair Houghton _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng/localhost/stunnel
by Dmitry 14 Apr '05

14 Apr '05

Nice Day. I am using syslog-ng with stunnel destination crypto2SS { tcp("127.0.0.1" port (514)); }; On central log host I have: source crypto { tcp(ip("127.0.0.1") port (514) keep-alive(yes)); }; destination r_facil {file(".../$HOST/$YEAR-$MONTH-$DAY/$FACILITY-$LEVEL.log"); }; and I have strange soft, that send to syslog throught 127.0.0.1:514 Problem: on my central host syslog-ng put logs into dir .../localhost (messages from this strange soft, other log put correct). I am trying to play with keep_hostname and chain_hostnames, but always got "localhost/localhost". Can anybody help me ? Thanx

2 1

RE: [syslog-ng]Match macro in filename?
by Vaibhav Goel 14 Apr '05

14 Apr '05

Cool that it is 1.9.4. Is 1.9.4 production ready by any chance? I am currently using 1.6.5. If not, is there any other way you can suggest to solve this "problem"? I am not averse to writing some scripts etc.. Thanks! -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: April 14, 2005 2:43 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Match macro in filename? On Wed, 2005-04-13 at 21:48 -0700, Nate Campi wrote: > On Wed, Apr 13, 2005 at 09:38:11AM -0700, Vaibhav Goel wrote: > > > > Is there any way to get a match filter in an output filename? > > > > For example: > > > > filter f_xyz { match("xyz"); }; > > > > should output to > > > > xyz.log > > There is no way to have syslog-ng remember the contents of a match and > use it later in another statement. In fact, this is possible in 1.9.4 (the future 2.0.x branch) where you can use regex's selection features in macro expansion. For example: filter f_xyz { match("(xyz)"); }; destination l_xyz { file("/var/log/$1"); }; However trusting the contents of the logs for something like filenames might not be the best solution. (although syslog-ng filters spurious filenames by checking '../' and '../' strings in filenames just before handing those over to open(). -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng]trouble configuring syslog-ng with libraries
by John Thrumston 14 Apr '05

14 Apr '05

thank you, that appears to have fixed that, but now I get the following. checking for glib-2.0... yes checking GLIB_CFLAGS... -I/usr/include/glib-2.0 -I/usr/lib/sparcv9/glib-2.0/include checking GLIB_LIBS... -L/usr/lib/sparcv9 -lglib-2.0 checking for eventlog... yes checking EVTLOG_CFLAGS... -I/usr/local/include/eventlog checking EVTLOG_LIBS... -L/usr/local/lib -levtlog checking for static GLib libraries... no configure: error: static GLib libraries not found, either link GLib dynamically using the --enable-dynamic-linking or install a static GLib as you can see, it found glib but for some reason errors out. I have added every directory if found thru find to the PKG_CONFIG_PATH variable but that doesn't seem to help. What should I be looking for? Thank you for the help earlier. Balazs Scheidler <bazsi(a)balabit.hu> wrote: On Thu, 2005-04-14 at 07:52 -0700, John Thrumston wrote: > I am trying to load syslog-ng for the first time. I am loading it on a > Solaris 9 box. I am using syslog-ng.1.9.4 downloaded from the host > site. > > I believe I have all the libraries needed. I am not really sure. when > I run > ./configure --enable-tcp_wrappers I get the following error at the end > of the configure. > > checking for eventlog... Package eventlog was not found in the > pkg-config search path. > Perhaps you should add the directory containing `eventlog.pc' > to the PKG_CONFIG_PATH environment variable > No package 'eventlog' found > configure: error: Library requirements (eventlog) not met; consider > adjusting the PKG_CONFIG_PATH environment va > riable if your libraries are in a nonstandard prefix so pkg-config can > find them. > > I have searched google and such for where I might find this eventlog > or the library variable event.pc put cannot locate it. I did a find on > the system and this event.pc doesn't exist. > > I am not sure what other questions you might have but I could use any > help that can be provided. eventlog is available from the same directory where you downloaded syslog-ng from. http://www.balabit.com/downloads/syslog-ng/1.9/src -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html --------------------------------- Do you Yahoo!? Yahoo! Small Business - Try our new resources site!

2 1

trouble configuring syslog-ng with libraries
by John Thrumston 14 Apr '05

14 Apr '05

I am trying to load syslog-ng for the first time. I am loading it on a Solaris 9 box. I am using syslog-ng.1.9.4 downloaded from the host site. I believe I have all the libraries needed. I am not really sure. when I run ./configure --enable-tcp_wrappers I get the following error at the end of the configure. checking for eventlog... Package eventlog was not found in the pkg-config search path. Perhaps you should add the directory containing `eventlog.pc' to the PKG_CONFIG_PATH environment variable No package 'eventlog' found configure: error: Library requirements (eventlog) not met; consider adjusting the PKG_CONFIG_PATH environment va riable if your libraries are in a nonstandard prefix so pkg-config can find them. I have searched google and such for where I might find this eventlog or the library variable event.pc put cannot locate it. I did a find on the system and this event.pc doesn't exist. I am not sure what other questions you might have but I could use any help that can be provided. Thanks --------------------------------- Do you Yahoo!? Yahoo! Small Business - Try our new resources site!

2 1

SQL Warnings (2)
by Metal Gear 14 Apr '05

14 Apr '05

Hi all, When i type http://localhost/syslog/index.php in my browser the following errors comes up Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /www/htdocs/web/index.php on line 35=20 Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /www/htdocs/web/index.php on line 53=20 All logs from syslog-ng are logged to mysql (database syslog and table logs) I have defined in db_fns.php $result =3D mysql_pconnect("", "", ""); becauz i have made a user mysql with no password and when i write mysql on shell in connects directly. Your help in this regard would highly be appreciated Thanks

1 0

Match macro in filename?
by Vaibhav Goel 14 Apr '05

14 Apr '05

Hi all Is there any way to get a match filter in an output filename? For example: filter f_xyz { match("xyz"); }; should output to xyz.log Thanks!

3 2

accept syslog from remote hosts ?
by ip.guy 13 Apr '05

13 Apr '05

hi all how does one allow remote syslog (not syslog-ng) servers currently logging to the syslog on the central log server (running vanilla syslog) access to dump syslog entires into syslog-ng when started ? if i tail /var/log/messages when syslog-ng is running and syslog is stopped, i can see local messages but nothing from remote hosts which are setup to log to the host. see below re my syslog-ng conf file. options { long_hostnames(off); sync(0); stats(43200); dns_cache(yes); use_fqdn(no); keep_hostname(yes); use_dns(yes); }; source shell { internal(); unix-stream("/dev/log"); tcp(ip(192.49.109.241) port(514) max-connections(300)); }; destination localhost { file("/var/log/messages"); }; log { source(shell); destination(localhost); };

2 1

Syslog-ng test suite
by Jenny-Lou Sequeira 13 Apr '05

13 Apr '05

Is there any test suite available for syslog-ng? Thanks, Jenny-Lou

1 0

syslog-ng 1.6.7 has been released
by Balazs Scheidler 13 Apr '05

13 Apr '05

Hi, I have incorporated the latest spoof-source specific changes and released a new stable version with the following NEWS entry: News for the 1.6.7 release Sat, 09 Apr 2005 12:46:51 +0200 * Fixed a memory leak and possible fd leak in spoof-source support. * Fixed destination port byte order on little-endian machines, triggered when a non-514 port was used. * Added fedora-core specific packaging files. I have updated the download page which is available at this URL: http://www.balabit.hu/products/syslog-ng/upgrades.bbq Happy logging, -- Bazsi

2 1