June 2005 - syslog-ng - lists.balabit.hu

Matthew Joubert/MTSCommunications/MTS is out of the office.
by matthew.joubert＠mts.ca 27 Jun '05

27 Jun '05

I will be out of the office starting 06/27/2005 and will not return until 07/04/2005. I will respond to your message when I return.

1 0

Matthew Joubert/MTSCommunications/MTS is out of the office.
by matthew.joubert＠mts.ca 27 Jun '05

27 Jun '05

I will be out of the office starting 06/27/2005 and will not return until 07/04/2005. I will respond to your message when I return.

1 0

Syslog-ng + mysql $MSG?
by Pedro Claro 27 Jun '05

27 Jun '05

Greetings, I've installed syslog-ng and I've established the pipe with mysql with success. All the field in the table are okay, except for one. The message field (MSG) that has the value of the $MSG variable, just shows (MEMO) in it. I can't seem to get the real message to show up. Any ideas to solve this? Regards, -- Pedro Miguel Ferreira Claro email: pmclaro(a)av.it.pt Instituto de Telecomunicações Campus Universitário de Santiago P-3810-193 AVEIRO - PORTUGAL Phone: +351 234 377900 EXT 253 Fax: +351 234 377901

1 1

Matthew Joubert/MTSCommunications/MTS is out of the office.
by matthew.joubert＠mts.ca 27 Jun '05

27 Jun '05

I will be out of the office starting 06/27/2005 and will not return until 07/04/2005. I will respond to your message when I return.

1 0

Matthew Joubert/MTSCommunications/MTS is out of the office.
by matthew.joubert＠mts.ca 27 Jun '05

27 Jun '05

I will be out of the office starting 06/27/2005 and will not return until 07/04/2005. I will respond to your message when I return.

1 0

RE: [syslog-ng] Error parsing conf file?
by Zb Indelak 27 Jun '05

27 Jun '05

Thank you for such a quick turn-around on this issue. I've run into a couple more. 1) New files are being created with file permissions equal to the inverse of umask, entirely ignoring the permissions specified in the perm() option. Hardcoding the permissions in the open() call in affile.c fixes the problem (yes, I know it's not the way to do it, but I was in a hurry). In other words, it appears that the value of mode is all ones rather than whatever was specified in the perm() option. 2) Syslog-ng does not appear to be closing the log files and maintains a lock on the files until the application exits. This one is causing me no end of grief. Thanks again, ZB -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Friday, June 24, 2005 1:56 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Error parsing conf file? On Thu, 2005-06-23 at 14:42 -0600, Zb Indelak wrote: > I have been running syslog-ng 1.6.5 on a bunch of my systems for a > while, however since I'm centralizing the logs from multiple time > zones, I decided to upgrade to version 1.9.4 so that I could use the > rcvd_time_zone () option. After installing version 1.9.4 I can no > longer read the syslog-ng.conf file that worked fine with version > 1.6.5. > > Version 1.9.4 gives the error "syntax error at 23" > Version 1.9.4+20050623 gives the error "syntax error at 19" Committed this patch, it makes syslog-ng read your configuration file fine: --- orig/src/cfg-lex.l +++ mod/src/cfg-lex.l @@ -70,6 +70,7 @@ static struct keyword keywords[] = { { "pad_size", KW_PAD_SIZE }, { "mark_freq", KW_MARK_FREQ }, { "sync_freq", KW_SYNC_FREQ }, + { "sync", KW_SYNC_FREQ }, { "fsync", KW_FSYNC }, { "long_hostnames", KW_CHAIN_HOSTNAMES }, { "chain_hostnames", KW_CHAIN_HOSTNAMES }, Should be available in tomorrow's snapshot. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

SyslogNG on FC4/GCC4.
by Alf 27 Jun '05

27 Jun '05

In the process of deploying out systems, we decided to use the latest FC4. Bad idea, so far, a whole list of apps tha refuse to boot up. (We cant switch to FC3 as it refuses to install on our tyan/dual xeons) I got the following compile error on syslog-ng.1.9.4. Using standard FC4/GCC4. Anyone knows of a fix ? [root@dupre syslog-ng-1.9.4]# make make all-recursive make[1]: Entering directory `/usr/local/src/syslog-ng-1.9.4' Making all in src make[2]: Entering directory `/usr/local/src/syslog-ng-1.9.4/src' if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT affile.o -MD -MP -MF ".deps/affile.Tpo" \ -c -o affile.o `test -f 'affile.c' || echo './'`affile.c; \ then mv -f ".deps/affile.Tpo" ".deps/affile.Po"; \ else rm -f ".deps/affile.Tpo"; exit 1; \ fi affile.c: In function affile_dd_reap: affile.c:387: error: invalid storage class for function affile_dd_reap_writers make[2]: *** [affile.o] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-1.9.4/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.9.4' make: *** [all] Error 2 [root@dupre syslog-ng-1.9.4]# I'm having problem accessing syslog-ng website. Anyone have the same problem ? Thanks in advance. Elvin -

2 1

Error parsing conf file?
by Zb Indelak 24 Jun '05

24 Jun '05

I have been running syslog-ng 1.6.5 on a bunch of my systems for a while, however since I'm centralizing the logs from multiple time zones, I decided to upgrade to version 1.9.4 so that I could use the rcvd_time_zone () option. After installing version 1.9.4 I can no longer read the syslog-ng.conf file that worked fine with version 1.6.5. Version 1.9.4 gives the error "syntax error at 23" Version 1.9.4+20050623 gives the error "syntax error at 19" The following is my configuration file. What gives? ---syslog-ng.conf--- # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 10 Aug 2002 # - for Red Hat 7.3 # - totally do away with klogd # - add message "kernel:" as is done with klogd. # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 22 Aug 2002 # - use the log_prefix option as per Balazs Scheidler's email # options { sync (0); time_reopen (10); log_fifo_size (1000); # long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); dir_perm (0755); perm(0644); chain_hostnames(no); keep_hostname (yes); time_reap (1); }; source remote { udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); }; source local { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; # SDW Inbox destinations start here destination d_pix { tcp("154.11.193.14" port(514)); }; destination d_ios { file("/var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-$MONTH$DAY$HOUR$MIN"); }; destination d_snort { file("/var/nsm/inbox/nids/snort.org/snort/1.9/syslog/snort-$MONTH$DAY$HOUR$MIN"); }; destination d_netscreen { file("/var/nsm/inbox/fw/netscreen/netscreen/syslog/netscreen-$MONTH$DAY$HOUR$MIN"); }; destination d_neoteris { file("/var/nsm/inbox/fw/netscreen/neoteris/3.2/syslog/neoteris-$MONTH$DAY$HOUR$MIN"); }; destination d_solaris { file("/var/nsm/inbox/oslog/sun/solaris/7/syslog/solaris-$MONTH$DAY$HOUR$MIN"); }; destination d_gnu { file("/var/nsm/inbox/oslog/gnu/tools/syslog/gnu-$MONTH$DAY$HOUR$MIN"); }; destination d_tripwire { file("/var/nsm/inbox/hids/tripwire/tripwire_for_servers/3/syslog/tripwire-$MONTH$DAY$HOUR$MIN"); }; destination d_sidewinder { file("/var/nsm/inbox/fw/secure_computing/sidewinder/g2/syslog/sidewinder-$MONTH$DAY$HOUR$MIN"); }; destination d_dragon { file("/var/nsm/inbox/nids/enterasys/dragon/6.0/syslog/dragon-$MONTH$DAY$HOUR$MIN"); }; destination d_test { file("/var/log/test"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; # Filters for NSM supported products start here filter f_pix { match(PIX); }; filter f_tripwire { match(tripwire); }; filter f_snort { program(snort); }; filter f_netscreen { match(NetScreen); }; filter f_neoteris { match(Neoteris); }; # IOS filter is IP address/hostname based, customize for your network #filter f_ios { host("192\.168\.101\.1"); }; # Solaris filter is IP address/hostname based, customize for your network #filter f_solaris { host("192\.168\.101\.2"); }; # GNU filter is IP address/hostname based, customize for your network #filter f_gnu { host("192\.168\.101\.3"); }; # Sidewinder filter is IP address/hostname based, customize for your network #filter f_sidewinder { host("192\.168\.101\.4"); }; # Dragon filter is IP address/hostname based, customize for your network #filter f_dragon { host("192\.168\.101\.5"); }; # Pix configuration grep command filter being logged by daily cron job filter f_pix-config { match(pix-config); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(local); filter(f_filter2); destination(d_mesg); }; log { source(local); filter(f_filter3); destination(d_auth); }; log { source(local); filter(f_filter4); destination(d_mail); }; log { source(local); filter(f_filter5); destination(d_mlal); }; log { source(local); filter(f_filter6); destination(d_spol); }; log { source(local); filter(f_filter7); destination(d_boot); }; log { source(local); filter(f_filter8); destination(d_cron); }; # Log NSM supported devices to the correct inbox log { source(remote); filter(f_pix); destination(d_pix); }; #log { source(remote); filter(f_ios); destination(d_ios); }; log { source(remote); filter(f_snort); destination(d_snort); }; log { source(remote); filter(f_netscreen); destination(d_netscreen); }; log { source(remote); filter(f_neoteris); destination(d_neoteris); }; #log { source(remote); filter(f_solaris); destination(d_solaris); }; #log { source(remote); filter(f_gnu); destination(d_gnu); }; log { source(remote); filter(f_tripwire); destination(d_tripwire); }; #log { source(remote); filter(f_sidewinder); destination(d_sidewinder); }; #log { source(remote); filter(f_dragon); destination(d_dragon); }; log { source(local); filter(f_pix-config); destination(d_pix); }; ---end syslog-ng.conf---

3 2

Macro for Source IP
by torpedo 24 Jun '05

24 Jun '05

Hi All, Is there some macro to prepend or append the SOURCE DEVICE IP (Log source) to the logs collected at syslog-ng ? Thanks in advance, torpedo

2 2

libol bundled with syslog-ng
by Balazs Scheidler 24 Jun '05

24 Jun '05

Hi, This is just a short notice that I'm bundling the libol source from tomorrow's snapshot with syslog-ng, so it will be much easier to create packages for various distributions as there will not be a need to create a separate libol package. The reasoning behind this is nothing but syslog-ng uses libol. The syslog-ng configure script is modified to look for an installed libol first and then attempt to use the bundled libol within the tarball. This way the configure script is believed to remain compatible. This also means that the distribution tarball becomes a larger, so don't be surprised. -- Bazsi

1 0