August 2005 - syslog-ng - lists.balabit.hu

RE: [syslog-ng] syslog-ng- filter() problem
by Kelly Pow 02 Aug '05

02 Aug '05

Hi, I am collecting traps and syslog data Yes they are being sent to the right place. Yes the destinations exist and the permissions are correct I am running Gentoo And syslog-ng version- 1.6.5-r2 The problem is: log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; if I only have : log { source(src); filter(f_snmptrap); destination(ipbb_traps); }; or log { source(src); filter(f_ipbb1); destination(ipbb_traps); }; but when I add more filters it give me nothing Why? Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca> _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Edward Brookhouse Sent: Friday, July 29, 2005 5:08 AM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] syslog-ng- filter() problem Are you collecting traps or syslog data ? Tcpdump is your friend - are the syslog speakers speaking to the right place ? Is anything else being logged on the box from other sources? Does the destination exist and permissions correct What os ? Which versions of syslog-ng _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Kelly Pow Sent: Thursday, July 28, 2005 5:55 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng- filter() problem Hi, I am trying to collect traps from these two networks. 66.163.79.0/255.255.255.128 and 64.251.65.224/255.255.255.240 I don't understand why when I do this it doesn't collect anything Any ideas/.?? ---------------------------------------------------------------------------- --------------------------- source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #filter snmptrap filter f_snmptrap { level(warn); }; #testing filters for the different networks filter f_ipbb1 {netmask("66.163.79.0/255.255.255.128"); }; filter f_ipbb2 {netmask("64.251.65.224/255.255.255.240"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; ---------------------------------------------------------------------------- ------------------------------- Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca>

1 0

problems with mysql pipe
by javier rojas 02 Aug '05

02 Aug '05

hello, i'm having trouble with the template i created to pipe to mysql (acording to php-syslog-ng), at first it was working fine but then (i started messing around) and it just stop working, i had configure syslog-ng to store logs coming from server A into mysql and on a text file, here's my syslog-ng.conf : ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; ## Log on to text file ## destination hosts { file("/var/log/$HOST.$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log {source(net); destination(hosts); }; #Then comment out this line -- # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; #Then uncomment out this line -- # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. source src { unix-dgram("/dev/log"); internal(); }; source net { udp(); }; it actually worked, but i don't know what i did, i see the logs coming from server A (#tcpdump host server A and port 514) but it doesn't store them on mysql... help please!!! -- Ciao,Javier linux user #393724

1 0

Mark problems
by Edward Brookhouse 02 Aug '05

02 Aug '05

Hi all, I am using Syslog-NG 1.9.4 on Fedora Core4 - and I am seeing -- MARK - in my logs when I should not be. To my understanding (via google and man pages) If you put the option * mark(n) in the options section you will get a -- MARK -- every N times. I have no mark option... Any thoughts on how to trouble shoot? My conf file has this for options options { # use_fqdn(yes); # use_dns(yes); # dns_cache(yes); keep_hostname(yes); long_hostnames(off); sync(1); log_fifo_size(1024); }; A search for mark in the conf returns nada ... TIA Edward Ebrooathealthydirectionsdotcomlame

1 0

ng to ng then to syslog
by Gerardo Amaya 01 Aug '05

01 Aug '05

Hello all. First thanks for all the help on first issue, it was some stupid filter. I'm configured to send syslog messages from server1 to server2 both with syslog-ng. Now what I need is to pass messages from server1 to server2 via syslog-ng(already done that) and as soon as the event gets in syslog-ng of server2 to send it to syslog daemon in server2. I have also done that but the problem is that the events appear as they are coming locally and not from server1. Is there a way to change that? thanks in advance Gerardo Amaya

2 1

Syslog running slow
by Shlomi Wexler 01 Aug '05

01 Aug '05

Hi, I'm using Syslong-ng with Postgre SQL Database. I have a problem of queries running realy slow since the Database reached about 5 million records. Cleaning the DB and vacumdb didn't work and also other programs running on the same computer are running fine. I'm using Gentoo Linux. Does anyone have an idea ? Thanks Shlomi _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

syslo-ng to mysql and to plaintext file
by javier rojas 01 Aug '05

01 Aug '05

hello, i've configure successfuly the syslog-ng server to save logs on mysql 4.0and i would like it to store the logs (just for a test) on a text file ( example.txt), so i was searching aroun and found that i should add the followin line to syslog-ng.conf: destination file_text{ file("/var/log/example.txt"); }; i don't want to mess anything and i was wondering if it's ok or if anybody has set this before, i don't want it to stop saving it on mysql i just want syslog-ng to save in both (mysql and example.txt) at the same time... thanx for the help... -- Ciao,Javier linux user #393724

3 2

Strange behaviour, Cisco, UDP & $HOST
by Jussi Tawaststjerna 01 Aug '05

01 Aug '05

Hello, Did a quick glance on the archives but didn't find an answer to this one, spent a good time googling too. Hopefully someone can help. I'm trying to build a central loghost with syslog-ng 1.9.5, for use with linux servers and cisco routers, and ran into a nice li'l problem. First some configuration: --8<-- options { chain_hostnames(no); long_hostnames(on); sync(0); keep_hostname(yes); dns_cache(yes); use_fqdn(yes); use_dns(yes); log_fifo_size(2048); log_msg_size(8192); }; source local { unix-stream("/dev/log"); internal(); }; source network { udp(ip("x.x.x.x") port(514)); }; (x.x.x.x is the interface machines are configured to use) destination hosts { file("/var/log/$HOST/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; .. .. log { source(network); destination(hosts); }; --8<-- It "works". I have two machines set up to send logs to this host, my own machine domain.org and a cisco device ciscorouter.net. When I do something on my machine to generate log, directory /var/log/domain.org is created and files appear in it, by facility. Sweet. domain.org resolves into an IP and the IP PTR is domain.org .. ciscorouter.net resolves into IP and IP PTR is ciscorouter.net .. OKAY, heart of the problem: Now I go to a Cisco device (7200 series) which is configured to send local3 to loghost, is working already with another sysklogd-host. I issue "conf t", ctrl-z and "wri", and the router sends a line to loghost, and loghost should create /var/log/<routers fqdn> and a file named local3 inside, right? Nope. The directory does not appear. No logfile is created or appended anywhere within loghost. Then I go to domain.org, exit from su and su back in again (generate a line of log) .. Now I see a new file on loghost, /var/log/domain.org/local3 .. and on one single line with no CR/LF it reads: Aug 1 11:23:53 domain.org/domain.org 915: *Aug 1 10:17:16.613: %SYS-5-CONFIG_I: Configured from console by user on vty0 (x.x.x.x)<86>su[2896]: + pts/23 user:root For the people not familiar with Cisco log entries, everything before <86> came from the Cisco, and starting from "su" is my domain.org linux. domain.org doesn't log anything using local3, this file shouldn't even exist. Can someone please immediately see what's wrong here, and what to put in syslog-ng.conf? Thank you very much. --- Jussi Tawaststjerna Nebula Oy ---

2 2