January 2006 - syslog-ng - lists.balabit.hu

repeat messages
by Nichols, Nancy 11 Jan '06

11 Jan '06

We recently changed our system logging code from sysklogd to syslog-ng version 1.9.6 and seem to have lost the following functionality: When consecutively logged messages are identical, instead of seeing each individual duplicate message in the logfile, we see the message "Last message repeated # times". Syslog-ng doesn't seem to support this feature though there is code in log_msg_parse() that tests for 'repeat_msg_string' (defined as "last message repeated"). Why would this test be here if syslog-ng isn't supporting these messages? If the feature is indeed supported, what do I need to do to get it to work? If not, are there plans to add it? When? Thanks Nancy Nichols

1 0

Monitoring a syslogd file?
by Jeremiah Rothschild 11 Jan '06

11 Jan '06

Hi all, I have completely replaced syslogd with syslog-ng on my main system and it is great! Thank you much for all the work that has gone into it. I am a very grateful user and wanted to give praise where due! However, I do have another system with lesser needs that I am unsure how to correctly configure. I'm hoping someone here may be able to provide me with some insight. What I'm wanting to do is set up syslog-ng to monitor one of the files that syslogd is writing. Specifically, I have a custom application that is writing to /var/log/messages and I'd like syslog-ng to monitor that file for events generated by the application then have them re-wrote to a different log file. I have read the reference manual, and tried messing around with the file() driver, but don't seem to be getting anywhere. Additionally, I searched the last six months of the mailing list archive but saw no related threads. Any helps is greatly appreciated. Thanks again! jeremiah

2 1

Strange ... IP Address instead of the machine name ....
by fredzy padzy 10 Jan '06

10 Jan '06

Hello everyone, I'm centralizing the logs of ten servers in on central one, thanks to syslog-ng, and some syslogd on the servers (which are different OS, like AIX, Solaris, HP UX ...). I use php-syslog as a web interface, and it works great =) But i've noticed that my php-syslog has got one problem : In the 'server' comboBox, i can see some IP address and just a few name, which aren't DNS ones. I'm not sure where my central server has found thoses names ( maybe in the packets send by the clients) but i've checked the file /etc/hosts of this central server. I've written down there the ip addresses (of the comboBox) followed by a 'tab' and then, the name that i want to be displayed .... But nothing to do ... i desn't work like that. So maybe someone can help me :) thanks a lot :=)

3 2

append write mode
by Fiorenzi Alessandro 10 Jan '06

10 Jan '06

Is there any way to configure syslog-ng to write log in append mode like have chttr +a on the file ? with file system permission cannot get the same result. this should be interest for forensics because of integrity of the file. Thanks very much Alessandro Fiorenzi

1 0

Php-syslog-ng : Strange ... IP address instead of the machine name ...
by fridzy padzy 10 Jan '06

10 Jan '06

Hello everyone, I'm centralizing the logs of ten servers in on central one, thanks to syslog-ng, and some syslogd on the servers (which are different OS, like AIX, Solaris, HP UX ...). I use php-syslog as a web interface, and it works great =) But i've noticed that my php-syslog has got one problem : In the 'server' comboBox, i can see some IP address and just a few name, which aren't DNS ones. I'm not sure where my central server has found thoses names ( maybe in the packets send by the clients) but i've checked the file /etc/hosts of this central server. I've written down there the ip addresses (of the comboBox) followed by a 'tab' and then, the name that i want to be displayed .... But nothing to do ... i doesn't work like that. So maybe someone can help me :) thanks a lot :=) _________________________________________________________________ Tout savoir sur la sécurité de vos enfants sur Internet ! http://go.msn.fr/10-channel/80-security/protection/default.asp

1 0

Re: syslog-ng Digest, Vol 9, Issue 8
by dwarnock＠harbrook.net 09 Jan '06

09 Jan '06

I am on holiday from Tuesday 3rd January returning on Monday 9th January. If your query is urgent please contact the office on +44 (0) 1423 508060 or email Neil Harvey at nharvey(a)harbrook.net Regards David Warnock

1 0

Re: syslog-ng Digest, Vol 9, Issue 7
by dwarnock＠harbrook.net 08 Jan '06

08 Jan '06

I am on holiday from Tuesday 3rd January returning on Monday 9th January. If your query is urgent please contact the office on +44 (0) 1423 508060 or email Neil Harvey at nharvey(a)harbrook.net Regards David Warnock

1 0

Re: syslog-ng Digest, Vol 9, Issue 6
by dwarnock＠harbrook.net 07 Jan '06

07 Jan '06

I am on holiday from Tuesday 3rd January returning on Monday 9th January. If your query is urgent please contact the office on +44 (0) 1423 508060 or email Neil Harvey at nharvey(a)harbrook.net Regards David Warnock

1 0

Named Log Entries in the Config File
by Kenneth Kassing 06 Jan '06

06 Jan '06

Hello, I am writing a program to make updates tho the syslog-ng configuration file. To allow for easily adding and removing log entries, I updated the parser gramer to allow a name field in the log entry. The name is optional, so old log files will still work. This name is not used by syslog-ng in any way. Example: Both log entries below are valid with my grammar update. log { source(s_all); filter(f_syslog); destination(df_syslog); }; log l_syslog { source(s_all); filter(f_syslog); destination(df_syslog); }; A patch generated with the following command is attached: "diff -uprN src/cfg-grammar.y.org src/cfg-grammar.y > ~/cfg-grammar.y.diff" --- src/cfg-grammar.y.org 2006-01-04 11:04:19.000000000 -0500 +++ src/cfg-grammar.y 2006-01-04 11:06:08.000000000 -0500 @@ -113,6 +113,8 @@ LogTemplate *last_template; %type <ptr> source_stmt %type <ptr> dest_stmt %type <ptr> log_stmt +%type <ptr> log_stmt_name +%type <ptr> log_stmt_noname %type <ptr> options_stmt %type <ptr> template_stmt @@ -202,7 +204,16 @@ dest_stmt ; log_stmt - : '{' log_items log_flags '}' { $$ = log_connection_new($2, $3); } + : log_stmt_noname { $$ = $1; } + | log_stmt_name { $$ = $1; } + ; + +log_stmt_name + : string '{' log_items log_flags '}' { $$ = make_log_connection($3, $4); } + ; + +log_stmt_noname + : '{' log_items log_flags '}' { $$ = make_log_connection($2, $3); } ; options_stmt

3 4

Re: syslog-ng Digest, Vol 9, Issue 5
by dwarnock＠harbrook.net 06 Jan '06

06 Jan '06

I am on holiday from Tuesday 3rd January returning on Monday 9th January. If your query is urgent please contact the office on +44 (0) 1423 508060 or email Neil Harvey at nharvey(a)harbrook.net Regards David Warnock

1 0