September 2005 - syslog-ng - lists.balabit.hu

syslog-ng not logging
by fico gid 30 Sep '05

30 Sep '05

hi there syslog gurus.. Is the configuration below enough for me to log some of my routers ? 157.0.1.1 is my syslog server and im suppose to get logs frm a few routers. I have added appropriate logging commands on the routers to log to the syslog server but i don't see anything. syslog-ng is started and listening on both udp/tcp . Im running on freebsd --start-- ## syslog-ng source remote { unix-stream("/var/run/log"); internal(); pipe("/dev/klog"); udp(ip(157.0.1.1) port(514)); tcp(ip(157.0.1.1) port(514) keep-alive(yes)); }; destination std { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; log { source(remote); destination(std); }; destination authlog { file("/var/log/auth.log"); }; destination cron { file("/var/log/cron.log"); }; destination debug { file("/var/log/debug.log"); }; destination kern { file("/var/log/kern.log"); }; destination user { file("/var/log/userlog"); }; destination maillog { file("/var/log/maillog"); }; destination security { file("/var/log/security"); }; destination messages { file("/var/log/messages"); }; --end-- any hints or help is much appreciated. thanks fico

2 4

Syslog compile error
by philip 29 Sep '05

29 Sep '05

Hi, I got the following error message when I run "make" Making all in src make[1]: Entering directory `/root/syslog-ng-1.6.0rc3/src' make all-recursive make[2]: Entering directory `/root/syslog-ng-1.6.0rc3/src' Making all in . make[3]: Entering directory `/root/syslog-ng-1.6.0rc3/src' gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lnsl -lresolv -lfl /usr/local/lib/libol.a -lnsl sources.o(.text+0x211): In function `do_read_line': /root/syslog-ng-1.6.0rc3/src/sources.c:91: undefined reference to `MIN' sources.o(.text+0x443): In function `make_log_reader': /root/syslog-ng-1.6.0rc3/src/sources.c:169: undefined reference to `MAX' cfg-lex.o(.text+0x4cc): In function `append_string': /root/syslog-ng-1.6.0rc3/src/cfg-lex.l:239: undefined reference to `MIN' affile.o(.text+0x59f): In function `do_init_dest_writer': /root/syslog-ng-1.6.0rc3/src/affile.c:286: undefined reference to `MAX' afinet.o(.text+0x83d): In function `do_init_afinet_dest': /root/syslog-ng-1.6.0rc3/src/afinet.c:478: undefined reference to `MAX' macros.o(.text+0x85): In function `append_string': /root/syslog-ng-1.6.0rc3/src/macros.c:84: undefined reference to `MIN' macros.o(.text+0x3e9): In function `expand_macros': /root/syslog-ng-1.6.0rc3/src/macros.c:182: undefined reference to `MIN' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/root/syslog-ng-1.6.0rc3/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/syslog-ng-1.6.0rc3/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/root/syslog-ng-1.6.0rc3/src' make: *** [all-recursive] Error 1 Any suggestion what cause it? Thanks

2 1

Changing replacing $Host characters
by Chance Ellis 29 Sep '05

29 Sep '05

A large number of my log messages come in and the $HOST variable is an IP address. I am creating a mysql table for each unique host. The problem is, mysql does not allow table names with periods in them, or at least I can't figure out how to make it. Is there a way in the syslog-ng.conf file that I can use regexp to change 10.1.1.1 <http://10.1.1.1> to 10_1_1_1 for example? Or does anyone happen to know how to make mysql accept `10.1.1.1` as a valid table name? Thanks!

1 0

RE: [syslog-ng] Syslog 1.6.8 compile error
by William Bell 27 Sep '05

27 Sep '05

I have seen this before with bad version of byacc/flex/lex you might want to install a new version of each, link your new libraries and try again. William -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Rohald van Baars Sent: Tuesday, September 27, 2005 7:30 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Syslog 1.6.8 compile error Hi, can someone please help me to get the compile right. OS: RHEL ES 3 update 4 The ./configure went well no errrors. But the make did not go so well: Error message(s) : >> snip gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afpr gram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lnsl -lresolv / sr/local/lib/libol.a -lnsl -Wl,-Bstatic -Wl,-Bdynamic cfg-lex.o(.text+0x45f): In function `yylex': /root/rpm/syslog-ng/syslog-ng-1.6.8/src/cfg-lex.c:1123: undefined reference to yywrap' cfg-lex.o(.text+0xb33): In function `input': /root/rpm/syslog-ng/syslog-ng-1.6.8/src/cfg-lex.c:1450: undefined reference to yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make: *** [all-recursive] Error 1 << snap Can someone plz explain what went wrong? Rohald van Baars Digitenne B.V. The netherlands WWW: www.digitenne.nl ######################################################################## #### Attention: The information contained in this message and or attachments is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any system and destroy all copies. ######################################################################## #### _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng 1.6.8 and dns cache issue
by Ketan Vankawala 22 Sep '05

22 Sep '05

I have currently installed Syslog-ng ver 1.6.8. Here is a snippet of my syslog-ng config file: destination hostslocal { file("/var/log/HOSTS/$HOST/$YEAR-$MONTH-$DAY.log" owner(root) group(xxx) perm(0740) dir_perm(0740) create_dirs(yes) template("$R_DATE $FULLHOST $MONTH $S_DAY $S_YEAR $S_HOUR:$S_MIN:$S_SEC: $MESSAGE\n") template-escape(no)); }; log { source(src); destination(hostslocal); }; So accordingly when a syslog message comes in, depending on the ip address, it does a lookup in /etc/hosts, creates an appropriate host name folder and forwards the message there. If the hostname does not exists, it creates a folder named with the ip address. Here is my question: 1) How often does syslog-ng refreshes its dns /hosts cache? Because I have run into issues that even after the /etc/hosts file is updated syslog still keeps logging to the folder created with the ip address. If I restart syslog-ng service it immediately starts forwarding the messages correctly to hostname folder. 2) How can I reduce the dns cache timeout, so it checks /etc/hosts more frequently for any changes? Any help will be highly appreciated. thx. Ketan

1 0

encrypt syslog-ng messages
by shaun.hofer＠altcall.com 21 Sep '05

21 Sep '05

I've setup syslog-ng on a log server and it's successfully receiving log messages from various clients. I want to encrypt the messages, so I used SSH tunnels and stunnel. However, in both of those cases, syslog-ng sees the message as having originated from itself, rather than from the real sender. Is there a way to fix this, or is there a different way to encrypt the messages? Thanks for your help, syslog-ng's awesome. -Shaun

2 1

I have a question
by 赵武 21 Sep '05

21 Sep '05

I am a chinese, my english is not good . ^_^ I used syslog-ng_1.6.x , there has a startup script (maybe init.d.RedHat-7.3 )in install directory . So I can start or stop it very easy . But in syslog-ng_1.9.5 , I haven't found the startup script , there is not convenience. I used logrotate.d separate log files . when the logrotate.d finished , it will restart the syslog-ng service . if there haven't startup script , I must added a script in logrotate.conf : postrotate /usr/bin/killall -HUP /usr/local/syslog-ng/sbin/syslog-ng 2> /dev/null || true endscript above script always killed the syslog-ng process and not startup syslog-ng process .I don't know the reason. when i used syslog-ng_1.6.x , I can use a easy script instead of above script : postrotate service syslog-ng restart endscript that is ok ! Could you give me a suggestion ! thanks . john 　　　　　　　　john.zw(a)263.net 　　　　　　　　　　2005-09-20

3 3

RE: [syslog-ng] encrypt syslog-ng messages
by Clemson, Chris 21 Sep '05

21 Sep '05

syslog-ng: http://www.balabit.com/products/syslog_ng/reference-1.6/syslog-ng.html/x 768.html I use it as follows: options { keep_hostname(yes); long_hostnames(off); sync(0); }; > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > shaun.hofer(a)altcall.com > Sent: 21 September 2005 10:39 > To: Syslog-ng users' and developers' mailing list > Subject: RE: [syslog-ng] encrypt syslog-ng messages > > In which program has this option? stunnel4? > > Thanks > Shaun > > Would the "keep_hostname" option help? > > > >> -----Original Message----- > >> From: syslog-ng-bounces(a)lists.balabit.hu > >> [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > >> shaun.hofer(a)altcall.com > >> Sent: 21 September 2005 09:53 > >> To: syslog-ng(a)lists.balabit.hu > >> Subject: [syslog-ng] encrypt syslog-ng messages > >> > >> I've setup syslog-ng on a log server and it's successfully > >> receiving log > >> messages from various clients. I want to encrypt the > >> messages, so I used > >> SSH tunnels and stunnel. However, in both of those cases, > >> syslog-ng sees > >> the message as having originated from itself, rather than > >> from the real > >> sender. Is there a way to fix this, or is there a different > >> way to encrypt > >> the messages? > >> > >> Thanks for your help, syslog-ng's awesome. > >> -Shaun > >> > >> _______________________________________________ > >> syslog-ng maillist - syslog-ng(a)lists.balabit.hu > >> https://lists.balabit.hu/mailman/listinfo/syslog-ng > >> Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > >> > >> > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

1 0

RE: [syslog-ng] encrypt syslog-ng messages
by Clemson, Chris 21 Sep '05

21 Sep '05

Would the "keep_hostname" option help? > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > shaun.hofer(a)altcall.com > Sent: 21 September 2005 09:53 > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] encrypt syslog-ng messages > > I've setup syslog-ng on a log server and it's successfully > receiving log > messages from various clients. I want to encrypt the > messages, so I used > SSH tunnels and stunnel. However, in both of those cases, > syslog-ng sees > the message as having originated from itself, rather than > from the real > sender. Is there a way to fix this, or is there a different > way to encrypt > the messages? > > Thanks for your help, syslog-ng's awesome. > -Shaun > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

2 1

Re: [syslog-ng] freebsd syslog-ng error
by fico gid 21 Sep '05

21 Sep '05

Hi William/All, Is the configuration below enough for me to log some of my routers ? 157.0.1.1 is my syslog server and im getting logs frm a few routers. I have added appropriate logging commands on the routers to log to the syslog server. --start-- ## syslog-ng source remote { unix-stream("/var/run/log"); internal(); pipe("/dev/klog"); udp(ip(157.0.1.1) port(514)); tcp(ip(157.0.1.1) port(514) keep-alive(yes)); }; destination std { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; log { source(remote); destination(std); }; --end-- Your help is much appreciated. fico On 9/21/05, fico gid <ficohertz(a)gmail.com> wrote: > Hi William, > > Thanks a lot for the tips.. its working now. > > Fico. > > On 9/20/05, William Bell <williamb(a)cwie.net> wrote: > > The problem you are having is in attempting to use linux conventions in > > freebsd. You will need to use /var/run/log in place of /dev/log and > > instead of /proc/kmsg you will most likely have to use > > > > file("/dev/klog"); > > > > Changing these two will get you the results you need. > > > > -William B > > > > -----Original Message----- > > From: syslog-ng-bounces(a)lists.balabit.hu > > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of fico gid > > Sent: Tuesday, September 20, 2005 2:10 AM > > To: syslog-ng(a)lists.balabit.hu > > Subject: [syslog-ng] freebsd syslog-ng error > > > > Hi there, > > > > im trying to setup a syslogng server to collect logs from a few of my > > routers. I have installed syslogng and modified the script as below : > > > > --start-- > > ## syslog-ng > > > > > > source remote { > > unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); > > udp(ip(158.0.1.1) port(514)); > > tcp(ip(158.0.1.1) port(514) keep-alive(yes)); > > }; > > > > destination std { > > file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" > > owner(root) group(root) > > perm(0644) dir_perm(0755) create_dirs(yes)); > > }; > > > > log { > > source(remote); > > destination(std); > > }; > > > > destination authlog { file("/var/log/auth.log"); }; > > destination cron { file("/var/log/cron.log"); }; > > destination debug { file("/var/log/debug.log"); }; > > destination kern { file("/var/log/kern.log"); }; > > destination user { file("/var/log/userlog"); }; > > > > --end-- > > > > somehow when i start the syslog-ng , it doesnt work and gives the error > > below : > > > > io.c: bind_unix_socket(): bind failed /dev/log (Operation not supported) > > Error initializing configuration, exiting. > > > > The syslog-ng by default config works fine. > > > > What am i doing wrong here ? > > > > fico > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > >

1 0