July 2005 - syslog-ng - lists.balabit.hu

RE: [syslog-ng] syslog-ng and host() filters regex problem
by Michael Di Martino 18 Jul '05

18 Jul '05

Si -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng Sent: Monday, July 18, 2005 5:23 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng and host() filters regex problem hello, I have a problem with syslog-ng and host() filters regex. I need to sort out logs coming from different source addresses in various files, so I started with this configuration: filter f_cp_ { host("10.28.88.4"); }; [10 similar host filters] filter f_pix_1 { host("10.29.42.3"); }; for every filter I defined a file destination and a log statement like this one: log { source(s_udp); filter(f_pix_1); destination(nfs_pix_1); }; This configuration works as expected, but since logs might come from other IP addresses which don't have to get mixed up (eg 10.28.88.41 matches the first filter but shouldn't) I'd like to use a regexp in the host file; I tried just by adding a $ at the end of the IP, like this: filter f_cp_dl380 { host("10.28.88.4$"); }; [10 similar host filters] filter f_pix_1VF { host("10.29.42.3$"); }; After sending a HUP to the process syslog-ng stops writing input packets to the various log files. Just removing the $ after the ip address and sending another HUP to the server restores functionality. I also tried with a full IP regexp, as found in another post on the list (host("^10\.28\.88\.4$")) but the result is the same. I also tried upgrading my syslog-ng from 1.6.2 to 1.6.8 but nothing changed. It seems like the config parser is somehow unable to manage more than a handful of host regexps correctly. I can provide full configuration files if needed. thanks for the help, Stefania _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng filtering db inserts
by Edward Brookhouse 18 Jul '05

18 Jul '05

Hi all - Anyone know how to setup the syslog-ng conf file so that certain events can be filtered from being inserted into the db ? i.e. I am setup now with various log { source(src); filter(f_mail); destination(mailwarn); }; type rules - this works great - I can filter any log message into any folder - Later in my conf I have: log { source(src); destination(d_mysql); }; Which tosses everything into the db - but how do I tell it to take everything except for given filters? Any thoughts appreciated, Edward

1 0

install syslog-ng in Solaris 10 local zone
by nawirb 18 Jul '05

18 Jul '05

Hi expert, I have some question regarding install sylog-ng in Solaris 10 local zone. Will it work. Anyone have ever tried. thanks __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Putting all sending Hosts in a File
by Philipp Durrer 18 Jul '05

18 Jul '05

Thanks for the workaround for putting the hosts in a File. Now the Second thing i would to capture all networks which sending their logs to the syslog server. So i would to lookup the Networkid and netmask (subnetmask) of the sending host. And they should again logged into a file. greets Philipp Durrer (PS: Sorry for my bad english) ___________________________________________________________ Gesendet von Yahoo! Mail - Jetzt mit 1GB Speicher kostenlos - Hier anmelden: http://mail.yahoo.de

1 0

Problem with hostnames!
by mrgenius 16 Jul '05

16 Jul '05

Hi All! I am using Syslog-ng with php-syslog-ng. to give names of my choice to different hosts IP what i did was to define hostnames against each IP of host in /etc/hosts file. It was working fine with Public IP adresses.. But I have some hosts on local network too with 192.168 IPs . The pRoblem i am now facing is that its not storing logs with HOSTNAMES of private IPs. Where as its working fine and giving names of Public IPs. Any body has any idea?? any thing to do in configuration of syslog-ng?? Regards, -Geni

7 11

netmask() filter
by Al Tobey 14 Jul '05

14 Jul '05

I'm trying to use the netmask filter to create a separate logfile for all of our network devices (Cisco gear) logging to our central syslog-ng log sink. The interfaces doing the syslogging are all on specific subnets, so I'd like to filter on subnet rather than by hosts. Lo, and behold, syslog-ng has a netmask() filter. It doesn't appear to work, though, since none of the variations I've tried have managed to log anything near the correct data to the destination. I either get nothing or everything. For one thing, it'd be nice to see the documentation updated to specify whether to use cidr or dot notation (/24 v.s. 255.255.255.0). Using cidr notation resulted in no apparent filtering. Using dot notation caused nothing to land in the file. Is anybody else using this successfully that can share a working example? Am I missing something silly? syslog-ng version 1.6.8, libol 0.3.16 on RHEL 3 U4 Thanks, -Al Tobey options { sync (20); time_reopen (10); log_fifo_size (1000); log_msg_size(8192); long_hostnames (off); use_dns (yes); use_fqdn (no); use_time_recvd (no); create_dirs (no); keep_hostname (yes); dns_cache (yes); dns_cache_expire (6000); dns_cache_expire_failed (6000); dns_cache_size (128); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream("/dev/log"); internal(); }; source s_net { udp(); tcp(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/syslog/syslog.log" perm(0644)); }; destination d_warn { file("/var/log/syslog/syslog.warn" perm(0644)); }; destination d_mail { file("/var/log/syslog/mail.log" perm(0644)); }; destination d_auth { file("/var/log/syslog/auth.log"perm(0644)); }; destination d_netteam { file("/var/log/network-devices.log" perm(0644)); }; destination d_local { file("/var/log/messages" perm(0644)); }; destination logsurfer { program("/bin/su -s /bin/ksh syslogd -c '/usr/local/bin/logsurfer -c /usr/local/etc/logsurfer.conf -d /var/tmp/logsurfer.dump -'"); }; filter f_console { facility(kern); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_warn { level(warn..emerg) and not ( program("sshd") and match("we do not read, but chan_read_failed for istate 8") ) and not ( program("sshd") and match("Read from socket failed: Connection reset by peer") ); }; ######################################## filter f_netteam { netmask( "10.50.191.0/255.255.255.0" ); }; ######################################## # console messages on localhost log { source(s_sys); filter(f_console); destination(d_cons); }; # /var/log/messages log { source(s_sys); destination(d_local); }; # /var/log/syslog/syslog.log log { source(s_sys); source(s_net); destination(d_mesg); }; # /var/log/netowrk-devices.log log { source(s_net); filter(f_netteam); destination(d_netteam); }; # /var/log/syslog/auth.log log { source(s_sys); source(s_net); filter(f_auth); destination(d_auth); }; # /var/log/syslog/mail.log log { source(s_sys); source(s_net); filter(f_mail); destination(d_mail); }; # /var/log/syslog/syslog.warn log { source(s_sys); source(s_net); filter(f_warn); destination(d_warn); };

2 1

Re: [syslog-ng] HP-UX
by Michael Di Martino 13 Jul '05

13 Jul '05

Kkgk Regards, Michael Di Martino Director of MIS The telx Group Office: 212 480 3300 X.2022 Cell: 646 207 6603 mdm(a)telx.com -------------------------- Sent from my BlackBerry Wireless Handheld -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu <syslog-ng-bounces(a)lists.balabit.hu> To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Sent: Mon Jul 11 09:24:46 2005 Subject: RE: [syslog-ng] HP-UX Alessandro, I currently have version 1.6.6 running on multiple HP-UX 11i machines. I have not, however, attempted to upgrade to 1.6.8. Does it dump core during compilation or during execution once compiled? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alessandro Rocha Sent: Monday, July 11, 2005 9:14 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] HP-UX Hi All, I've tried to install the syslog-ng 1.6.8 on a HP-UX 11i server but it causes core dump during the initialization. Do you know if this version work with HP ? Thanks in advance. Alessandro. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Putting all sending Hosts in a File
by Philipp Durrer 13 Jul '05

13 Jul '05

Hi I'm new to syslog-ng and i would like to put all hosts which sending thier logs to the server in one file without the logs. So i got only the hostnames and/or Ip's in the file as a list (each line a new host ?). And the second list should contain all IP Networks of the senders. greets Nexus2k ___________________________________________________________ Gesendet von Yahoo! Mail - Jetzt mit 1GB Speicher kostenlos - Hier anmelden: http://mail.yahoo.de

1 0

syslog-ng keeps logging the same...
by Michael Mannsberger 12 Jul '05

12 Jul '05

I installed the following: libol-0.3.16 syslog-ng-1.6.8 I want to log to a loghost. If I specify udp as follows in the source statement udp(ip("0.0.0.0") port(514)); syslog-ng keeps logging the same entry over and over again. Without it it works fine for the loghost but clients will not be able to connect of course.

2 2

Problems with syslog-ng and filters-
by Ville Leinonen 12 Jul '05

12 Jul '05

Hi all, I have created 2 filters. There is check if there is link up/down text in msg field. If its match then there comes N else there should be comes N. My problem is now that i syslog-ng puts double in sql-table one is Y and one is N. Any suggestion what is wrong? Here comes also configuration. source net { udp(ip("0.0.0.0") port(514)); }; filter f_link_downup { match(LINK-3-UPDOWN) or match(LINEPROTO-5-UPDOWN) or match(off-line) or match(on-line); }; filter f_others { not match(LINK-3-UPDOWN) or not match(LINEPROTO-5-UPDOWN) or not match(off-line) or not match(on-line); }; log { source(net); filter(f_link_downup); destination(d_mysql_downup); }; log { source(net); filter(f_others); destination(d_mysql_others); }; destination d_mysql_downup { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg, showdata) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG', 'N' );\n") template-escape(yes)); }; destination d_mysql_others { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg, showdata) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG', 'Y' );\n") template-escape(yes)); }; Br, Ville Leinonen

2 2