May 2005 - syslog-ng - lists.balabit.hu

Logging to Oracle - Quoting issue
by André Bonhôte 10 May '05

10 May '05

Hi! I have already written a mail to info(a)balabit.hu today, but I am impatient. Forgive me please! We have an issue when logging to Oracle. Obviously, Oracle requires a single quote to be quoted by a single quote. I have found this [1] article about it. Since it's 2005 now, I'd like to know whether this one is fixed in the latest version or not. I have 1.6.2 running in production now on a few machines. I didn't find anything in the Changelog about this, unfortunately. Could someone give me a hint? Thanks IA André [1] https://lists.balabit.hu/pipermail/syslog-ng/2003-November/ 005510.html ___ ___ ___ ___ \C/ \O/ \L/ \T/ Andre Bonhote t: +41 (0)44 5 600 600 V V V V Platform Infrastructure f: +41 (0)44 5 630 501 we make business Senior IP Engineer straight.forward COLT Telecom e: andre(a)colt.net

2 3

Re: Re: [syslog-ng]Syntax error in default config?
by jbrunke＠ctsgi.com 06 May '05

06 May '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

1 0

Re: [syslog-ng]Syntax error in default config?
by jbrunke＠ctsgi.com 05 May '05

05 May '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

1 0

RE: Issues with HP-UX
by Jenny-Lou Sequeira 05 May '05

05 May '05

I have used the following syslog-ng config file on HP-UX 11.23 (syslog-ng 1.6.6) and have not seen any problem : options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; # Source source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; # Destination destination d_mesg { file("/var/adm/syslog/syslog-ng/syslog.log"); }; destination d_mail { file("/var/adm/syslog/syslog-ng/mail.log"); }; destination d_cons { file("/dev/console"); }; destination d_mail { file("/var/adm/syslog/syslog-ng/mail.log"); }; destination d_cons { file("/dev/console"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; # Filter filter f_filter1 { facility(mail) and level(debug .. emerg); }; filter f_filter2 { level(info .. emerg) and not facility(mail); }; filter f_filter3 { level(alert .. emerg); }; filter f_filter4 { level(emerg); }; # Log log { source(s_sys); filter(f_filter1); destination(d_mail); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_cons); destination(d_mlrt); }; log { source(s_sys); filter(f_filter4); destination(d_mlal); }; Note : If your destination directories do not exist you need the "create_dirs (yes);" in the options. Also, make sure that syslogd is stopped. I used the following test program, and all messages show up in /var/adm/syslog-ng/mail.log and /var/adm/syslog/syslog.log resp. ( #!/usr/bin/sh echo "Testing mail" logger -p mail.debug "test mail debug" logger -p mail.info "test mail info" logger -p mail.notice "test mail notice" logger -p mail.warning "test mail warning" logger -p mail.err "test mail err" logger -p mail.crit "test mail crit" logger -p mail.alert "test mail alert" logger -p mail.emerg "test mail emerg" echo "Testing syslog" logger -p auth.debug "test syslog debug" logger -p user.info "test syslog info" logger -p auth.notice "test syslog notice" logger -p news.warning "test syslog warning" logger -p daemon.err "test syslog err" logger -p lpr.crit "test syslog crit" logger -p cron.alert "test syslog alert" logger -p kern.emerg "test syslog emerg" Jenny-Lou Sequeira

1 0

Multi-line log entries
by yesenia_rincon＠bankone.com 04 May '05

04 May '05

Are you aware of any issues where on the local host the multi-line messages include the hostname and syslog-ng does not include the hostname, is there a configuration option to resolve this problem ? Apr 23 00:00:05 img4s012.svr.bankone.net/img4s012.svr.bankone.net scsi: [ID 107833 kern.warning] WARNING: /pci@8,700000/pci@2/ lpfc@5/sd@0,de (sd98): Apr 23 00:00:05 img4s012.svr.bankone.net/img4s012.svr.bankone.net corrupt label - wrong magic number This is how the event shows in syslog-ng: Apr 23 00:00:05 img4s012.svr.bankone.net/img4s012.svr.bankone.net scsi: [ID 107833 kern.warning] WARNING: /pci@8,700000/pci@2/ lpfc@5/sd@0,de (sd98): Apr 23 00:00:05 corrupt label - wrong magic number Regards, Jessie This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you.

2 1

Shiming Yang/OCIO_CorpDataSecurity/Planning_Office/HQ_for_the_Americas/BTMNA is out of the office.
by Shiming Yang 04 May '05

04 May '05

I will be out of the office starting 05/03/2005 and will not return until 05/05/2005. I will respond to your message when I return. If there is problem about Proxy or IBM web hosting facility, please call my backup Will at 8380. ----------------------------------------- The information contained in this electronic mail message, and any and all accompanying documents, constitutes confidential information. If you are not the intended recipient of this information, any disclosure, copying, distribution, or the taking of any action in reliance on it is strictly prohibited. If you received this information in error, please notify the sender immediately and destroy this communication. Messages sent via this medium may be subject to delays and/or unauthorized alteration. Neither The Bank of Tokyo-Mitsubishi, Ltd. nor any of its affiliates shall be held liable for the contents of this message.

1 0

a weird configuration
by Julio Kriger 04 May '05

04 May '05

Hi! I a need to setup a weird configuration of syslog-ng and I don't know how to do it. Please help me!!! So, here is my problem. I have 2 programs, say A and B. I have metalog configure so that program A write logs a file called log_A, and program B write logs to log_B. This is the easy part. Now the real problem. I have a kernel module K that is used by both programs that also write some logs. I want that the logs written by kernel module K when used by program A go to log_A file. The same with program B, logs should go log_B. How can I do this? TIA. Regards, Julio -- ------------------------ Julio Kriger mailto:julio@cwazy.co.uk

2 7

Cisco formatting
by Erwin Middelberg 04 May '05

04 May '05

Hi All, I'm rather new to syslog-ng and have a question I couldn't find answers for, searching on the web. We're using syslog-ng (1.5.15) as a central relay server for several Cisco devices, were the devices sent their syslogs to the syslog-ng server and syslog-ng forwards them to my Netcool monitoring environment. A problem I'm running into, is that some Cisco messages contain carriage returns, splitting one message over 2 or more lines. I could do some tricks on the Netcool side, but it would be much cleaner if I could filter those CR's within syslog-ng. Is this possible ? TIA, Erwin

1 0

Re: Re: [syslog-ng]a weird configuration
by jbrunke＠ctsgi.com 04 May '05

04 May '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

1 0

Possible segmentation fault in syslog-ng
by Balazs Scheidler 03 May '05

03 May '05

Hi, I have finally been able to track down a nasty segmentation fault/abort problem. The fix can be found in libol 0.3.16, which is statically linked into syslog-ng. Therefore to grab the fix, you need to recompile syslog-ng with the new libol. The problem occurs when: * internal() messages were directed to a file which had a name with macros in it * you had one or more TCP sources which close their connections from time to time (Kiwi syslogd is such a program) * the volume of the log messages is very low in this destination, in fact it might be required that nothing else but TCP connection close messages are received here, and less often than the interval time_reap() specifies. How to reproduce: * Use the following configuration: options { time_reap(1); gc_idle_threshold(1); }; source src { unix-stream("log"); internal(); }; source net { tcp(port(2000)); }; destination d_local { file("logs/messages.$YEAR.$HOST.$DAY"); }; destination d_net { file("logs/net.log"); }; log { source(src); destination(d_local); }; log { source(net); destination(d_net); }; * Create the directory containing the log files "logs" * Start syslog-ng * Connect to port 2000 using telnet, wait somewhat more than 1 second * Wait while garbage collection starts (should be immediately as gc_idle_threshold() is set to 1) Syslog-ng will crash with Segmentation fault or an Abort. Thanks go to Janos Lajos who has reported and helped me to track down the issue. Libol 0.3.16 is available at: http://www.balabit.hu/downloads/syslog-ng/libol/0.3/libol-0.3.16.tar.gz PGP signature: http://www.balabit.hu/downloads/syslog-ng/libol/0.3/libol-0.3.16.tar.gz.asc -- Bazsi

1 0