September 2005 - syslog-ng - lists.balabit.hu

Syslog-ng Server IP address change
by Gerardo Amaya 08 Sep '05

08 Sep '05

Hello all. I configured a Syslog-ng server in a local LAN to make sure all the options were working with no problem at all. Then I moved the server to a different LAN. I made all the changes needed for the linux box for the IP address change, but when syslog-ng start sessions it appear with the previous IP address, I'm sure that this session is from syslog-ng because a use a random port UDP 5002 and it appears the session as 192.168.4.2:5002 192.168.4.101:4342 where 192.168.4.2 is the previous IP address. What changes do I need to make to the syslog-ng in order to use the new IP Address? I hope reinstall is the last resource. thanks in advance Gerardo Amaya

2 1

Anyone got a well performing search interface for syslog data?
by Jason Haar 08 Sep '05

08 Sep '05

We're generating around 4Gb syslog data per week, and I'm looking for a good search interface into it. I can cut my way through it with egrep/etc, but waiting 10-15min for a result really isn't going to break any speed records. Especially when I then need to re-run it with another "grep" on the end of it! ;-) I have tried injecting it into a MySQL database using some schemas I've found on the Internet - but the performance didn't seem much better to me - and you lost the "free-text" attributes of grep (or more specifically, the sorts of searches I find I want to do aren't SQL-friendly). Has anyone come up with a good speedy way of coping with Gbytes of syslog data? Or is it time to invest in some Appliance or the like? -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

7 9

Re: [syslog-ng] expanding $HOST in 1.6.*
by t_esting＠excite.com 08 Sep '05

08 Sep '05

>> Hello, syslog-ng gurus. I have been trying unsuccessfully to replicate syslog-ng 1.5.26 behavior over to the current stable release. Specifically, here's what I can't seem to get to work from my config: >> >> destination d_ipfilters_bymin { file ("/var/logser/$HOST/$YEAR/$MONTH/$DAY/ipfilters.log.$HOUR.$MIN" >> owner(root) perm(0600) create_dirs(yes) ); }; >> >> filter f_fwsm_misc { >> match(" \%FWSM-") and >> match(": (Teardown|Translation|Built)"); >> }; >> >> log { source(s_udp); filter(f_fwsm_misc); destination(d_ipfilters_bymin); }; >> >> With syslog-ng 1.5.26 (linked against libol 0.3.10 on Solaris 8 using GCC in 64-bit mode), this config writes my FWSM messages to /var/logser correctly. I have been unable to do the same using either 1.6.8; the messages just fall through to my catchall destination. >> >> Can anyone offer some advice on how to reproduce the 1.5.x $HOST expansion behavior in 1.6.x? >I can't really understand. Do you have a problem with matching the log lines or the filename where the line is written to? I was having trouble with the filename matching. I've seen a couple of different behaviors in the 1.6.x release. At different times, I've seen $HOST expanded as the DNS name, other times as the IP address. Other times, I've seen it drop all the way through to catchall (though I'm not able to recreate that this morning with 1.6.8 for some reason). I'll continue to do testing over the next couple of days to see if I can articulate exactly what I'm seeing with a larger scope of test data. Thanks. T.E. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

expanding $HOST in 1.6.*
by t_esting＠excite.com 08 Sep '05

08 Sep '05

Hello, syslog-ng gurus. I have been trying unsuccessfully to replicate syslog-ng 1.5.26 behavior over to the current stable release. Specifically, here's what I can't seem to get to work from my config: destination d_ipfilters_bymin { file ("/var/logser/$HOST/$YEAR/$MONTH/$DAY/ipfilters.log.$HOUR.$MIN" owner(root) perm(0600) create_dirs(yes) ); }; filter f_fwsm_misc { match(" \%FWSM-") and match(": (Teardown|Translation|Built)"); }; log { source(s_udp); filter(f_fwsm_misc); destination(d_ipfilters_bymin); }; With syslog-ng 1.5.26 (linked against libol 0.3.10 on Solaris 8 using GCC in 64-bit mode), this config writes my FWSM messages to /var/logser correctly. I have been unable to do the same using either 1.6.8; the messages just fall through to my catchall destination. Can anyone offer some advice on how to reproduce the 1.5.x $HOST expansion behavior in 1.6.x? Thanks in advance. T.E. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1

Cisco boxes and syslog-ng
by Joost greene 07 Sep '05

07 Sep '05

Hello, I have different sets of devices, dslams, nas, core routers, customer routers,... i want to syslog them all, i want to make each device log to a file separately to ease it up for NOC, someone suggested syslog-ng, frankly, i got quickly lost in its docs, the syntax isnt clear, how can i just easily specify to let it log per source into different files ? Regards, Joost

2 1

RE : How do I force syslog-ng to create an empty log file ??
by Eggart, Gerhard 07 Sep '05

07 Sep '05

Hi, We are currently using syslog-ng (syslog-ng 1.6.0rc4) to log for local log messages on a device. We have the following in the config file to store local auth messages. destination local_auth { file("/var/log/local/auth.$YEAR$MONTH$DAY"); }; We have the following in the config file to store local error messages. destination local_err { file("/var/log/local/errors.$YEAR$MONTH$DAY"); }; The problem I have is that sometimes for a day there are no error or auth messages and because of this the log file is not generated, a log file is only created if there is log data to put into it. I require syslog-ng to force the creation of a log file for the day even if it is empty. I have also just tried the stats(600) option in the configuration and stopped and started the dameon and this does not write any information to a log file - therefore no errors log file is created for the day. Does anyone know if this can be done on syslog-ng ??? Thanks > Gerhard Eggart > > >

2 1

Equivalent to syslog.conf -
by Tony Earnshaw 05 Sep '05

05 Sep '05

Hi list, Read all the docs (time and time again) and Googled, but still have no answer. Red Hat RHAS3, syslog-ng 1.6.8 (self-compiled on system, installed as an rpm) on this test server. I've come to appreciate syslog-ng and would not willingly go back to the original. But. My OpenLDAP 2.3.7 slapd log needs a "do not synchronize" possibility, similar to the syslog.conf - possibility, I *think* I've solved this by buffering output with sync: destination d_slapd { file("/var/log/slapd" sync(10)); }; Is this it, or could I do something better? Thanks! --Tonni -- mail: tonye(a)billy.demon.nl http://www.billy.demon.nl

2 2