May 2005 - syslog-ng - lists.balabit.hu

RE: [syslog-ng] Logs rotate and compress but still log to compres sed file
by Rechtorik, Keith 18 May '05

18 May '05

I was testing things out at that point. Sorry for the confusion. Even when those lines are uncommented the logs still do not rotate. I guess I do not know how to kill the process. The syslog-ng pid never 'resets' itself when issuing the kill -HUP command. -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Tuesday, May 17, 2005 12:29 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Logs rotate and compress but still log to compressed file _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

5 4

Program Filters
by Metal Gear 16 May '05

16 May '05

Hi all, i m having too much noise in my syslog-ng logs both in mysql db and in text logs. For that i tried program filters like . filter f_auth { facility(auth); }; filter f_ftp {program(ftp);}; filter f_ssh {program(pam_unix);}; log {source(stunnel); filter(f_syslog); filter(f_auth); filter(f_ftp); filter(f_ssh); destination(d_mysql);}; what actually i want to log messages from program 'vsftp', 'wsftpd' and 'sshd' for that i tried regexp like '*ftp*', *ssh*, but its not working can someone refine the filters for just logging traffic having program 'ftp' or 'ssh' in them. Thanks

2 1

help about multiple files in syslog-ng
by Sarfraz Rustam 15 May '05

15 May '05

Hi; I want some information regarding to multiple files in syslog-ng; The scenerio is that i have 4 devices normally router and i want information of each device but with same facility (local7) and this information must be in each seperate file say router1, router2 .... so on. How i can do this; I have attached a router via console and trying to access its log but not succeeded. Plz guide me to the solution. -- Sarfraz

2 1

Subsys Dead, syslog-ng and SELinux
by Anand Shankar 13 May '05

13 May '05

I recently installed syslog-ng successfully on a FC3-SELinux enabled box. Everything is fine except that: # service syslog-ng status syslog-ng dead but subsys locked # ls --context /var/lock/subsys/syslog-ng -rw------- root root root:object_r:var_lock_t syslog-ng The root:object_r:var_lock_t should have been user_u:object_r:var_lock_t, and that is what is causing syslog-ng daemon to die. Also, the file permissions generally are 666. One easy way is to switch off SELinux for syslog-ng, but is there a better way?? Why are the permissions wrong?? ---- Anand Shankar

4 3

Reliable tcp logging
by Peter Daum 12 May '05

12 May '05

I am trying to send all important messages from a bunch of other machines to a central syslog-ng server via tcp. I chose tcp partly, because the same log server gets all kinds of less important stuff via udp from other machines, which can easily be distinguished that way, but partially also because I expected tcp to be more reliable. Unfortunately, this does not seem to be the case: When the connection has died for any reason, the client will only discover this when it is trying to send the next message to the server. Only then it starts to wait until "time_reopen" is over and establishes a new connection - the message that originally triggered this and whatever comes in between is lost. Is there any way to get syslog-ng (v 1.6.5) to check more often whether a tcp connection to a log host still exists and re-establish it otherwise? I did not see any reference to this in the documentation, but this seems to happen every 2 hours. Setting "tcp-keep-alive(yes)" does not seem to make it any better. I also discovered that version 1.6.7 has a new option "log_fifo_size" which sounded promising but setting this to a higher value also does not seem to have any influence on this issue. Regards, Peter Daum

5 6

"above message repeats"
by Andrew Morris 11 May '05

11 May '05

One of the messages I'm getting (I'm sorting messages by hostname) is the "above message repeats n times" message, but syslog-ng is logging this under the host "above". Shouldn't syslog-ng decide what the hostname is by the ip address it is connected from? eg: host A connects, syslog-ng looks up the host by it's connecting ip address and uses that name resolution as the $HOST variable? (Note, in this case all hosts are in a local hosts file) So, why would it ever write to the file "above"? Is this a bug, or am I missing something? As per my previous messages, here's a quick rundown of the config: (used with 1.6.7) options { # Don't trust the sender to supply a hostname. keep_hostname(no); # Don't track relayed messages. chain_hostnames(no); # Make sure the hostnames have valid characters. check_hostname(yes); # Since we're only tracking local hosts, don't worry about the fqdn. use_fqdn(no); # As soon as we get the log entry, write it to disk. sync(0); # Set the fifo size to 1024 lines. log_fifo_size(1024); # Increase the log_msg_size to 8192 bytes. log_msg_size(8192); # If we need a directory and it doesn't exist, create it and use # the permissions shown below. create_dirs(yes); perm(0644); dir_perm(0755); # Use an internal dns cache, but don't use any dns lookups. dns_cache(yes); use_dns(no); }; source localsyslog {unix-stream("/dev/log");}; source kernellog {file("/proc/kmsg");}; source intsyslog {internal();}; source extsyslog {udp();}; destination syslog-ng {file("/logs/syslog-ng");}; destination messages {file("/var/log/messages");}; destination kernmessages {file("/var/log/kernel");}; destination hosts { file("/logs/hosts/$YEAR-$MONTH/$HOST" template("$DATE $HOST $MESSAGE\n") template_escape(yes) ); } ; destination services { file("/logs/services/$YEAR-$MONTH/$PROGRAM" template("$DATE $HOST $MESSAGE\n") template_escape(yes) ); }; filter levelfilter { level(info..emerg); }; log { source(intsyslog); destination(syslog-ng); }; log { source(localsyslog); filter(levelfilter); destination(messages);}; log { source(kernellog); destination(kernmessages);}; log { source(extsyslog); source(localsyslog); destination(hosts); }; log { source(extsyslog); source(localsyslog); destination(services); };

2 2

Minor Compile Issue
by Andrew Morris 11 May '05

11 May '05

Just a minor compiling issue for version 1.6.7 (actually it's been there for a while...). If I want to put the syslog-ng.conf file in a different location, I use the --sysconfdir option to configure. The problem is the configure.in file automatically adds "/syslog-ng" on to the end of whatever I put in. I have no problem with it doing this by default, but if I go through the effort of using --sysconfdir, then the configure script should do what it's told (even if that's thought to be wrong by some). Since syslog-ng only uses one conf file, I'd rather put it directly under /etc... My fix so far is to go and comment out that line before I run configure, but that's just a quick hack. Oh, and just before someone says otherwise, configure modifies some .h files and there's no way (that I know of anyways - please correct me if I'm wrong) to override those settings via make. I'm not asking anyone to change the defaults, but is it possible to either: 1) Add another option to configure to handle the subdirectory? eg: --sysconfsubdir or something like this? (eg: the default would end up being $PREFIX/$SYSCONFDIR/$SYSCONFSUBDIR/syslog-ng.conf) 2) If --sysconfdir is specified, use whatever it is set to. Otherwise use $PREFIX/etc/syslog-ng

2 2

klogctl: Invalid argument
by micah milano 11 May '05

11 May '05

Hello, Whenever I stop/start/restart syslog-ng, I see the entirity of my kernel buffer spit onto the screen, as well as the following message sent to STDERR: klogctl: Invalid argument I cannot figure out where this comes from, I do not have a program called klogctl on my system, and I've looked through the syslog-ng sources to see if I could find anything there, and I can only find an item in the NEWS file: ChangeLog: * utils/klogctl.c: New file to control kernel log level NEWS: * Added klogctl program to control kernel logging level on Linux but there is no utils/ folder at all, nor is there anything else related to klogctl. Thanks! micah

2 2

Re: [syslog-ng]Pix problem
by Ben Whittaker 11 May '05

11 May '05

This is from my config. # PIX # source network { udp () ; tcp (); }; log{source(net);filter(f_pix);destination(pixlog);}; destination pixlog { file("/var/log/pix.log"); }; filter f_pix { facility(local4); }; And on my PIX logging on logging timestamp logging buffered notifications logging trap notifications logging queue 1024 logging host inside 10.x.x.x no logging message 106001 no logging message 106023 --- Damien Michau <d.michau(a)ag.com> wrote: > Hi All ! > I have some probleme ta log my pix's log into my > syslog-ng server . > i have mounted a Syslog-ng server to store my pix's > log . But there is nothing in my pix.log > i'have put this lines in my syslog-ng.conf > > > source pix { udp(ip(10.60.10.111) port());}; > destination pix { file("/var/log/pix.log"); }; > log { source(pix);destination(pix); }; > > > Have you one idea ? > > Thx > > Damien Michau > Paris Discover Yahoo! Use Yahoo! to plan a weekend, have fun online and more. Check it out! http://discover.yahoo.com/

3 5

More fun with hostnames....
by Andrew Morris 10 May '05

10 May '05

I've been using syslog-ng for a little while and so far I like what I see, but I'm confused over the hostname options in the config file. Yes, I've read the man pages/FAQ, but I guess I'm still not getting it. I'm going to send each issue as a separate message so the answers can easily be tracked in the archives for others...

1 0