June 2005 - syslog-ng - lists.balabit.hu

help for windows logging
by antonio 23 Jun '05

23 Jun '05

Hallo, I'm trying to configure syslog-ng to log windows client, i downloaded and installed snare agent and I added the following to the conf file: filter windows { program(MSWinEventLog); }; destination windows { file("/var/log/archive/windows/$R_YEAR/$R_MONTH/$R_YEAR-$R_MONTH-$R_DAY" template("$ISODATE <$FACILITY.$PRIORITY> $HOST $MSG\n") template_escape(no) ); }; log { source(local); filter(windows); destination(windows); flags(final); }; when i type syslog-ng -f /etc/syslog-nf.conf i get this error message: # syslog-ng -f /etc/syslog-ng.conf unresolved reference: local thank in advance for your help bye antonio

2 3

Week Number
by John Franceschina 23 Jun '05

23 Jun '05

I have tried searching the mail archives but I am unable to find anything to do with the current week number. Can anyone tell me if there is a way to get/use the current week number? I would like to use the current week number as the table name to store syslog(NG) messages. syslog-ng --version syslog-ng 1.6.8 My syslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination d_mysql_syslog { pipe("/var/lib/mysql/mysql.pipe" template("INSERT INTO $WEEKNUMBER (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(s_sys); destination(d_mysql_syslog); }; Any assistance would be greatly appreciated. -- John This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail.

2 1

syslog RPM
by Speedy Sweedy 23 Jun '05

23 Jun '05

Does anyone know of syslog-ng being available as an RPM for Fedora Core 4 anywhere? _________________________________________________________________ Powerful Parental Controls Let your child discover the best the Internet has to offer. http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*.

1 0

Oracle
by Alessandro Rocha 20 Jun '05

20 Jun '05

Hi All, Does anyone ever configured syslog-ng to redirect logs to an oracle database ? Could anyone help me ? Thanks in advance, Alessandro.

4 3

specifying hostname for unix-stream sources
by william.batt＠abnamro.com 17 Jun '05

17 Jun '05

This may sound like a strange request, but I would like to override the default hostname for messages originating from unix-stream sources. The hostname (understandably) defaults to the server hostname. For "corporate" reasons I cannot change the hostname but need the syslog-ng messages to contain the hostname of a subinterface associated with my application. Also for "corporate" reasons I cannot completely replace syslog but need to run syslog-ng in parallel with it using separate sockets (e.g., /dev/log-ng). Is this possible? --------------------------------------------------------------------------- This message (including any attachments) is confidential and may be privileged. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorised use or dissemination of this message in whole or in part is strictly prohibited. Please note that e-mails are susceptible to change. ABN AMRO Bank N.V. (including its group companies) shall not be liable for the improper or incomplete transmission of the information contained in this communication nor for any delay in its receipt or damage to your system. ABN AMRO Bank N.V. (or its group companies) does not guarantee that the integrity of this communication has been maintained nor that this communication is free of viruses, interceptions or interference. ---------------------------------------------------------------------------

2 2

program filters
by Metal Gear 17 Jun '05

17 Jun '05

Hi, I m trying to log only specific type of program alerts in a mysql db at remote syslog-ng server. Till now i m able to get exactly the messages that i wanted but i m also getting some annoying messages in mysql db. I did researched the problem but was unable to find any satified answer. These messages are *host* *facility* *priority* *level* *tag* *date* *time* *program* *msg* * seq* abc kern warning warning 04 2005-06-16 08:58:35 On node 0 total On node 0 totalpages: 65088 3572 abc kern warning warning 04 2005-06-16 08:58:35 Processors Processors: 1 3573 abc kern warning warning 04 2005-06-16 08:58:35 ESR value after ESR value after enabling vector: 00000000 3574 abc kern info info 06 2005-06-16 08:59:29 parport0 parport0: PC-style at 0x378 (0x778) [PCSPP,TRISTATE] 3575 abc kern info info 06 2005-06-16 08:59:29 parport0 parport0: irq 7 detected 3576 I m also attaching my syslog-ng.conf file any help would be greatly appreciated. options { long_hostnames(off); sync(0); keep_hostname(yes); chain_hostnames(no); use_time_recvd(yes); }; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; source stunnel {tcp(ip("127.0.0.1 <http://127.0.0.1/>") port(514) keep-alive(yes));}; source netscreen {udp(ip("192.168.1.6 <http://192.168.1.6/>") port(514) );}; destination remoteclient {file("/var/log/HOSTS/$HOST/ $DAY.$MONTH.$YEAR.loggedmessages" create_dirs(yes));}; destination dest {file("/var/log/HOSTS/$HOST/$DAY.$MONTH.$YEAR.loggedmessages" create_dirs(yes));}; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; filter f_syslog {not match("STATS: dropped");}; filter f_auth { facility(auth) or program(".*ftp*.") or program(".*ssh*.") or program(".*pam*."); }; log {source(src); filter(f_syslog); filter(f_auth); destination(d_mysql);}; log {source(stunnel); filter(f_syslog); filter(f_auth); destination(d_mysql);}; log {source(netscreen); destination(d_mysql);}; log {source(src); filter(f_syslog); destination(dest);}; log {source(stunnel); filter(f_syslog); destination(remoteclient);}; log {source(netscreen); destination(remoteclient);};

2 3

syslog-n 1.6.8 crash and backtrace on FreeBSD 4.10
by Steve Shorter 16 Jun '05

16 Jun '05

Howdy! I want to setup syslog-ng on a large server farm and set up a test system on FreeBSD 4.10. The syslog-ng package from the ports collection would crash... so I got the latest sources of libio and syslog-ng and built it. It still crashes and dumps core. Here is a backtrace. Script started on Wed Jun 15 12:26:12 2005 bash-2.05b# gdb -c syslog-ng.core /usr/local/sbin/syslog-ng [cut out the GNU preamble] Core was generated by `syslog-ng'. Program terminated with signal 6, Abort trap. Reading symbols from /usr/lib/libc.so.4...done. Reading symbols from /usr/libexec/ld-elf.so.1...done. #0 0x480b2fc4 in kill () from /usr/lib/libc.so.4 (gdb) bt #0 0x480b2fc4 in kill () from /usr/lib/libc.so.4 #1 0x480f493e in abort () from /usr/lib/libc.so.4 #2 0x480d08d3 in __assert () from /usr/lib/libc.so.4 #3 0x80540be in io_iter (b=0x8062000) at io.c:283 #4 0x8049e5f in main_loop (backend=0x8062000) at main.c:256 #5 0x804a557 in main (argc=4, argv=0xbfbffc24) at main.c:549 (gdb) quit bash-2.05b# exit Script done on Wed Jun 15 12:26:40 2005 Looks like the libio call io_iter does an assert() in line 283 and it kills/abort's the process Any more info required? I can test patches if you like. Ideas? thanx - steve The config file is simple like this # # options # options { # gc_idle_threshold(); # gc_busy_threshold(); log_fifo_size(1000); long_hostnames(off); use_dns(yes); dns_cache(yes); dns_cache_size(1000); sync(0); }; # # sources # source src { unix-dgram("/var/run/log"); udp(ip(0.0.0.0.) port(515)); tcp(ip(10.1.3.4) port(515) max-connections(30)); internal(); # file("/dev/klog"); }; # # destinations # destination d_logfiles { file("/var/syslog-ng/$HOST/$FACILITY" template("$DATE <$FACILITY.$LEVEL>: $MSG\n") template_escape(no) remove_if_older(86400) create_dirs(yes) ); }; destination d_console { file("/dev/console"); }; destination d_root { usertty("root"); }; # # log facility filters # #filter f_user { facility(user); }; # # log level filters # filter f_emerg { level(emerg); }; # # program filters # #filter f_ppp { program("ppp"); }; log { source(src); destination(d_logfiles); }; log { source(src); filter(f_emerg); destination(d_root); };

2 2

Questions Again :)
by mrgenius 16 Jun '05

16 Jun '05

hi All! I am running syslog-ng logging in msyql database with phpsyslog-ng as front end. 1) Now i have 1 problem. The Devices which are sending logs don't have any hostnames associated with them nor i am running any DNS server. As a result the listing of hosts i am getting are in the form of IP addresses of hosts. Is it possible to show hostname against IP adresses?? Like x.x.x.x will be shown as ABC-ROUTER ?? if i define ABC-Router as x.x.x..x in /etc/hosts .. what configuration do i need to make in syslog-ng.conf?? 2) I want to Allow only specific hosts to send logs to loghost. But when i tried to put IP of hosts in configuration it gave me errors. Starting system logger: io.c: bind_inet_socket() bind failed 61.x.x.x:514 Cannot assign requested address I used following configuration source net { udp(ip(61.x.x.x) port(514) ); udp(ip(62.x.x.x) port(514) ); udp(ip(63.x.x.x) port(514) ); }; Do i have to allow this policy on firewall or syslog-ng also supports it?? bcause with only udp(); Every device on internet can start sending me logs and my server will be under attack. Regards, -Geni

2 1

syslog-ng 1.5.17 and tcp-keep-alive not working
by Olaf Hoyer 16 Jun '05

16 Jun '05

Hallo! I want to do a centralized sysloging, where some embedded devices, running a ppc version of linux 2.2.14, also running syslog-ng 1.5.17 shall log their data received bei some Interfaces to a central loghost. In a test scenario, with the loghost being syslog-ng 1.6.5, and running on a different port than the system syslog, everything is fine via udp and tcp with basic features. Some tests show, that when the syslog-ng on the loghost receives a -HUP, the connection is dropped, unless the option "keep-alive(yes)" is configured, like in the following example: source s_tcp { tcp(ip(0.0.0.0) port(8514) max-connections(100) keep-alive(yes)); }; with that config the loghost is working. So now I wanted to activate tcp keepalive on the client, in the hope, that whenever the syslog server closed the connection, that the client can reopen it upon new data arriving, what it is not doing in the basic config: working: destination syslog_server { tcp("10.0.0.1" port(8514)); } new line: destination syslog_server { tcp("10.0.0.1" port(8514) tcp-keep-alive(yes)); } But: [root@test /root]# syslog-ng parse error at 199 Parse error reading configuration file, exiting. (line 199) [root@test /root]# head -199 /etc/syslog-ng/syslog-ng.conf |tail -1 destination syslog_server { tcp("10.0.0.1" port(8514) tcp-keep-alive(yes)); }; Could someone enlighten me if a) syslog-ng 1.5 understands the "tcp-keep-alive" directive b) my thoughts are correct regarding the re-establishment of the tcp connection Thanks in advance Olaf -- Olaf Hoyer ohoyer(a)ohoyer.de Fuerchterliche Erlebniss geben zu raten, ob der, welcher sie erlebt, nicht etwas Fuerchterliches ist. (Nietzsche, Jenseits von Gut und Boese)

2 4

Reliability of Remote logging via TCP/Syslog-NG
by Alf 16 Jun '05

16 Jun '05

Hi Guys, (New to this list, searched the FAQ for this qn, didnt find it. So I apologize if this was repeated before on the list. It might be related to the topic on TCP timingout though as report @ https://lists.balabit.hu/pipermail/syslog-ng/2005-February/006974.html) I'm planning to deploy a syslog-ng setup. (Central logging server in Asia, and Clients will be in US/HK). The setup is actually as a backup/secure repository of log entries of the appliation we are running. Now the question is, (I know TCP is reliable vs UDP), how reliable will syslog-ng hand the log entries ? If it gets disconnected (due to timeout, reset, etc), will it hold the log entry in memory and queue it for resend ? Is there an option to set before it times out (And at least logs it in a local log that there was an error (as an internal msg i guess) I need to be certain that no messages get lost basically :P Thanks in advance. Elvin -

5 10