January 2006 - syslog-ng - lists.balabit.hu

Syslog-ng & pipe question
by syslogyk 26 Jan '06

26 Jan '06

Hi! Could you please help me with this question? I have the following strings in my syslog-ng.conf: source src { internal(); unix-dgram("/dev/log"); unix-dgram("/var/lib/named/dev/log"); }; ... skipped ... filter f_debug { level(debug); }; destination d_yuri { pipe("/dev/yuri_pipe"); }; log { source(src); filter(f_debug); destination(d_yuri); }; With this configuration, I execute the following commands in the first console: mkfifo /dev/yuri_pipe cat /dev/yuri_pipe On the other console I generate an event (for instance, "logger blablabla"). And cat /dev/yuri_pipe on the first console outputs nothing. What's wrong in my syslog-ng.conf? Can I get events in my pipe? Thank you in advance, Yuri P.S. Sorry, if you receive this message twice.

3 3

RE: [syslog-ng] Xserve sending to Syslog-NG
by William Bell 26 Jan '06

26 Jan '06

Yes the syslog feed off the xserve is most likely UDP based and it will just continue to stream syslog messages to the unresponsive destination. There may or may not be a way to setup a backup syslog server in the Xserve admin functions. WilliamB -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Ken Garland Sent: Wednesday, January 25, 2006 2:30 PM To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] Xserve sending to Syslog-NG I have a question regarding setting up an Xserve to send to our central log server. If the Syslog-NG server goes down, will the Xserve continuously retry to send the logs until the Syslog-NG server is available? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

4 3

Xserve sending to Syslog-NG
by Ken Garland 25 Jan '06

25 Jan '06

I have a question regarding setting up an Xserve to send to our central log server. If the Syslog-NG server goes down, will the Xserve continuously retry to send the logs until the Syslog-NG server is available?

1 0

Best way to keep up with security alerts for syslog-ng?
by Cary, Kim 25 Jan '06

25 Jan '06

I was checking on securityfocus website & they have no vulns listed for syslog-ng for the versions we use. What is the best way to be alerted should there be a security advisory for the product?

2 1

Syslog-ng 1.9.8 unable to resolve hostnames
by Laurent CARON 25 Jan '06

25 Jan '06

Hi, I upgraded syslog-ng to the latest debian build (1.9.8). In /etc/syslog-ng/syslog-ng.conf i have this line to redirect logs to a particular host. log { source(s_all); filter(f_attncr); destination(buckrogers.lan); }; Unfortunately my logs are hitting 2Gb in only a few mins. Why? It seems according to Szalay Attila that this build is unable to resolve hostnames properly. It is a new feature, a bug, a misunderstanding on my side...? Thanks Laurent

2 1

Problem installing syslog-ng
by Hubert Edward kIYIMBA 25 Jan '06

25 Jan '06

I am having problems installing syslog-ng1.9.8. The ./configure works fine. However the make gives an error. Below is the log. I am using redhat 9. Please advise [root@localhost syslog-ng-1.9.8+20060117]# make make all-recursive make[1]: Entering directory `/home/hkiyimba/syslog-ng-1.9.8+20060117' Making all in src make[2]: Entering directory `/home/hkiyimba/syslog-ng-1.9.8+20060117/src' gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog libsyslog-ng.a(filter.o)(.text+0x1f8): In function `filter_facility__eval': /home/hkiyimba/syslog-ng-1.9.8+20060117/src/filter.c:142: undefined reference to `G_UNLIKELY' libsyslog-ng.a(filter.o)(.text+0x242):/home/hkiyimba/syslog-ng-1.9.8+20060117/src/filter.c:157: undefined reference to `G_LIKELY' libsyslog-ng.a(filter.o)(.text+0x303): In function `filter_level__eval': /home/hkiyimba/syslog-ng-1.9.8+20060117/src/filter.c:202: undefined reference to `G_LIKELY' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/home/hkiyimba/syslog-ng-1.9.8+20060117/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/hkiyimba/syslog-ng-1.9.8+20060117' make: *** [all] Error 2 [root@localhost syslog-ng-1.9.8+20060117]# --------------------------------- Bring words and photos together (easily) with PhotoMail - it's free and works with Yahoo! Mail.

2 1

syslog-ng performance question
by Daniel Chojecki 23 Jan '06

23 Jan '06

Hi ! I have to set up central logging server for approx. 80 machines using syslog-ng with SQL DB (MySQL or PostgreSQL or Oracle db system). It is a homogeneous system so i will have to log traffic from syslog-ng-friendly servers. I will use syslog and syslog-ng for unix clients and Snare Agent or NTsyslog for windows clients. I want to use unix DB server. I want to log "normal" and sometimes debug informations. I need to choose hardware for DB server and DB server. Thanks for your help ! ps. questions are desirable :-) -- greetz Daniel

1 0

Re: [syslog-ng] RE: Removal of forwarder hostname ??
by krishna y 23 Jan '06

23 Jan '06

Hi Mike, Thanks for ur reply. It's working now with the option spoof_source It requires libnet also to use this option while compilation. Installed libnet and used the following: ./configure --with-libnet=path_of_libnet-conf --enable-spoof-source Thanks for ur help, Krishna Y On Mon, 23 Jan 2006 Michael Gehrmann wrote : >Hi, > >What you are looking for is a compiled option: --enable-spoof-source > >You can then enable it in your syslog-ng.conf using the option per destination e.g. destination syslogbox { udp("X.X.X.X" port(514) spoof_source(yes)); }; > >Regards >Mike > >Message: 1 >Date: 21 Jan 2006 14:36:50 -0000 > From: "krishna y" <krish_bvrm(a)rediffmail.com> >Subject: [syslog-ng] Removal of forwarder hostname ?? >To: syslog-ng(a)lists.balabit.hu >Message-ID: <20060121143650.19410.qmail(a)webmail8.rediffmail.com> >Content-Type: text/plain; charset="iso-8859-1" > > >Hi, > >I have configured the Syslog-ng in HPUX and forwarding the messages to Ciscoworks The original message to Syslog-NG is as following: > >Jan 20 12:44:32 SYSNG.it.net CiscoDev01 7366: Jan 20 12:44:31.526 GMT: %SYS-5-CONFIG_I: Configured from 192.168.100.10 by snmp > >While forwarding to other syslog server, Syslog-NG is adding it's own host name to the message and sending as below: > >Jan 20 12:44:32 SYSNG.it.net CiscoDev01 7366: Jan 20 12:44:31.526 GMT: %SYS-5-CONFIG_I: Configured from 192.168.100.10 by snmp > >(Note:SYSNG.it.net = HostName of Syslog-ng server, CiscoDev01=Device hostName) > >The final syslog Server(Ciscoworks) is not treating the message is as from the CiscoDev01.There's no use of running script in Ciscoworks box to remove the entry of SYSNG.it.net. It has to be done before receiving the message > >How to avoid this at Syslog-NG level? Tried the following options, but no luck: keep_hostname(yes); chain_hostnames(no); long_hostnames(no); > >Please let me know the procedure not to append the hostname of the Syslog-NG to the message. > > >Thanks in advance, >Krishna Y > >-------------------------------------------------------- > >This email and associated attachments may contain confidential and privileged CITEC information that is provided solely for the use of the intended addressee. Views and opinions expressed in this email are those of the individual sender and are not necessarily the views and opinions of CITEC unless the sender expressly states that such views and opinions are those of CITEC. The privilege and confidentiality associated with this email and attachments will not be waived, lost or rescinded by reason of mistaken delivery. Should you receive this email by mistake, please notify the sender by return email then delete the email from your computer system. You must not use, copy, modify, print, or distribute the email or the information and attachments contained within same to any third party. CITEC does not accept any liability in respect of viruses or computer problems experienced by the recipient through access gained to this email and its attachments. >-------------------------------------------------------- > >________________________________________________________________________ >This email has been scanned for viruses by the CITEC Email Anti-Virus service powered by MessageLabs. For more information on a proactive email anti-virus service working around the clock, around the globe, visit www.citec.com.au >________________________________________________________________________ >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >

1 0

Removal of forwarder hostname ??
by krishna y 23 Jan '06

23 Jan '06

Hi, I have configured the Syslog-ng in HPUX and forwarding the messages to Ciscoworks The original message to Syslog-NG is as following: Jan 20 12:44:32 SYSNG.it.net CiscoDev01 7366: Jan 20 12:44:31.526 GMT: %SYS-5-CONFIG_I: Configured from 192.168.100.10 by snmp While forwarding to other syslog server, Syslog-NG is adding it's own host name to the message and sending as below: Jan 20 12:44:32 SYSNG.it.net CiscoDev01 7366: Jan 20 12:44:31.526 GMT: %SYS-5-CONFIG_I: Configured from 192.168.100.10 by snmp (Note:SYSNG.it.net = HostName of Syslog-ng server, CiscoDev01=Device hostName) The final syslog Server(Ciscoworks) is not treating the message is as from the CiscoDev01.There's no use of running script in Ciscoworks box to remove the entry of SYSNG.it.net. It has to be done before receiving the message How to avoid this at Syslog-NG level? Tried the following options, but no luck: keep_hostname(yes); chain_hostnames(no); long_hostnames(no); Please let me know the procedure not to append the hostname of the Syslog-NG to the message. Thanks in advance, Krishna Y

2 1

RE: Removal of forwarder hostname ??
by Michael Gehrmann 22 Jan '06

22 Jan '06

Hi, What you are looking for is a compiled option: --enable-spoof-source You can then enable it in your syslog-ng.conf using the option per destination e.g. destination syslogbox { udp("X.X.X.X" port(514) spoof_source(yes)); }; Regards Mike Message: 1 Date: 21 Jan 2006 14:36:50 -0000 From: "krishna y" <krish_bvrm(a)rediffmail.com> Subject: [syslog-ng] Removal of forwarder hostname ?? To: syslog-ng(a)lists.balabit.hu Message-ID: <20060121143650.19410.qmail(a)webmail8.rediffmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi, I have configured the Syslog-ng in HPUX and forwarding the messages to Ciscoworks The original message to Syslog-NG is as following: Jan 20 12:44:32 SYSNG.it.net CiscoDev01 7366: Jan 20 12:44:31.526 GMT: %SYS-5-CONFIG_I: Configured from 192.168.100.10 by snmp While forwarding to other syslog server, Syslog-NG is adding it's own host name to the message and sending as below: Jan 20 12:44:32 SYSNG.it.net CiscoDev01 7366: Jan 20 12:44:31.526 GMT: %SYS-5-CONFIG_I: Configured from 192.168.100.10 by snmp (Note:SYSNG.it.net = HostName of Syslog-ng server, CiscoDev01=Device hostName) The final syslog Server(Ciscoworks) is not treating the message is as from the CiscoDev01.There's no use of running script in Ciscoworks box to remove the entry of SYSNG.it.net. It has to be done before receiving the message How to avoid this at Syslog-NG level? Tried the following options, but no luck: keep_hostname(yes); chain_hostnames(no); long_hostnames(no); Please let me know the procedure not to append the hostname of the Syslog-NG to the message. Thanks in advance, Krishna Y -------------------------------------------------------- This email and associated attachments may contain confidential and privileged CITEC information that is provided solely for the use of the intended addressee. Views and opinions expressed in this email are those of the individual sender and are not necessarily the views and opinions of CITEC unless the sender expressly states that such views and opinions are those of CITEC. The privilege and confidentiality associated with this email and attachments will not be waived, lost or rescinded by reason of mistaken delivery. Should you receive this email by mistake, please notify the sender by return email then delete the email from your computer system. You must not use, copy, modify, print, or distribute the email or the information and attachments contained within same to any third party. CITEC does not accept any liability in respect of viruses or computer problems experienced by the recipient through access gained to this email and its attachments. -------------------------------------------------------- ________________________________________________________________________ This email has been scanned for viruses by the CITEC Email Anti-Virus service powered by MessageLabs. For more information on a proactive email anti-virus service working around the clock, around the globe, visit www.citec.com.au ________________________________________________________________________

1 0