November 2006 - syslog-ng - lists.balabit.hu

Need help with having Syslog-ng import a log file into syslog-ng
by Steven Meacham 21 Nov '06

21 Nov '06

Need help with having Syslog-ng import a log file into Syslog-ng. I have a proxy server that will not syslog but will log to a file than can ftp of the server. I am wondering how I can take the ftped file and send it to the Syslog-ng so It can be sysloged to our database server for review? Any help would be great? Thanks.

4 4

syslog-ng and chroot'ed bind
by Patrick Topping 21 Nov '06

21 Nov '06

All, I have just installed bind in a chtoot'ed environment. What I am not able to get set up properly is the logging through syslog-ng. Does anyone have a "HOW TO" on this or a web site that I could be directed to in order to get this going....??? Thanks in advance. -Patrick

2 1

Any non-commercial Windows tcp clients?
by Alejandro Sierra 17 Nov '06

17 Nov '06

Hi, i'm interested in the same. The solution i've thought by now is using NTSyslog and Kiwi Together. NTSyslog sends messages gotten from the EventViewer in UDP to localhost where are recived by Kiwi who has the ability to send over TCP in the SSH Tunnel (I use plink) . By this moment i have a problem. Kiwi uses '\r' as separator for TCP messages and Syslog-ng uses '\n', so when syslog-ng recives 5 messages in one TCP message from a Kiwi, he only gets the syslog header from the 1st message, and sees all the rest as part of the first one. Cya. I accept critics(very welcolme). PD: Sorry for my english.

1 0

Syslog-ng 2.0 contrib/redhat conf file problem
by King, John (Greg) (LMIT-HOU) 17 Nov '06

17 Nov '06

I have copied the syslog.conf file from syslog-ng-2.0.0/contrib/rhel-packaging to /etc/syslog-ng.conf When I try running syslog-ng I get the following error "/usr/local/sbin/syslog-ng -f /etc/syslog-ng.conf syntax error at 17" Line 17 is file("/proc/kmsg" log_prefix "kernel:"); Which is in this script block # source s_local { unix-dgram("/dev/log"); file("/proc/kmsg" log_prefix "kernel:"); }; Did something change in version 2.0 that was not updated in the example? Or should I use the contrib app syslog2ng? I would like to create a config that will allow me to disable klogd and syslogd on RHES4. Then set syslog-ng up to listen for tcp syslog packets from remote systems and then separate those logs like this destination d_separatedbyhosts { file("/var/log/syslog-ng/$HOST/messages" owner("root") group("root") perm(0640) dir_perm(0750) create_dirs(yes)); }; Any help would be great, Thanks - Greg

1 0

timestamp in log files
by Gustavo Mendes de Carvalho 13 Nov '06

13 Nov '06

He All, Does anybody knows any idea to include a date in unix timestamp format into a log file, together with a message ? Something like Nov 11 05:15:34 *1163214934 *s_sys(a)10.9.8.7 sshd[13037]: Accepted publickey for ROOT from 10.0.0.2 port 1355 ssh2 Regards -- Gustavo Mendes de Carvalho gmcarvalho(a)gmail.com

2 5

syslog-ng droping events
by Arya, Manish Kumar 10 Nov '06

10 Nov '06

Hi, I have 3 syslog listeners (solaris 10 ) collecting log events from about 20,000 devices and fwding them on a central syslog box (solaris 10, 16 gb RAM and 3TB SAN storage) . the central syslog box stores them in oracle db and on filesystem. I notice that events from many devices are being droped on central syslog box. I thought it might be because of udp protocol, but even after enabling tcp its droping events. I can see that events come on listeners boxes (I created temp file logs there) please tell me what could be missing. Regards, -Manish ____________________________________________________________________________________ Want to start your own business? Learn how on Yahoo! Small Business. http://smallbusiness.yahoo.com/r-index

4 4

timezones
by Szeti, Balazs 10 Nov '06

10 Nov '06

Hello! I'm trying to log messages with ISO timestamps from different timezones. Example through TCP: <140>2006-11-05T05:15:15+01:00 1 2 3 <140>2006-11-05T05:15:15+02:00 1 2 3 <140>2006-11-05T05:15:15+03:00 1 2 3 The syslog-ng's node is in +01:00 timzone. I left all the time_zone() on default. Template used: template t_year { template("$S_ISODATE $R_ISODATE $S_HOUR: $MSGONLY\n"); }; Result in the log: 2006-11-05T05:15:15.000000+01:00 2006-11-09T16:12:10+01:00 05: 2 3 2006-11-05T07:15:15.000000+02:00 2006-11-09T16:11:41+01:00 07: 2 3 2006-11-05T09:15:15.000000+03:00 2006-11-09T16:12:37+01:00 09: 2 3 There's nothing wrong with the R_ISODATE, but I don't understand the S_ISODATE. When I log with the syslog-ng node timezone it writes the right value, but when I change the timezone in the TCP message the S_HOUR increases! I would like to see the original timestamp from the message and the R_ISODATE right next to each other. Why is the S_ISODATE increased? Can S_HOUR now be used in file name templates??? Thanks in advance, Balazs Szeti

2 5

syslog-ng to MySQL: write decimal code of severity level in column
by Tadej Bregar 10 Nov '06

10 Nov '06

Hello, I'm using syslog-ng 2.0 rc4 with Php-Syslog-NG 2.9.2a on RHEL4 with MySQL 5.0.24a. I'm feeding MySQL server through UNIX pipe and everything goes well - BUT I've got a few questions. This is not strictly syslog-ng problem, as I'm also using php-syslog-ng in my setup (php-syslog-ng database schema for MySQL), but I'll ask here on this list anyway: 1.How can I configure syslog-ng to write decimal code of severity (see RFC3164) in column "level" (or "priority") of table "logs" in database "syslog"? Is this possible to achieve somehow? 2. Why are we logging the same information twice (the same data gets written in column "priority" and "level")? The ideal setup would be to write decimal code of severity level in column "level" and corresponding word string (eg. info or warning or crit ...) in column "priority". Using php-syslog-ng in this case, we could order syslog messages by priority properly (sql query ... ORDER BY level ASC .... orders our messages by alphabetical order) Now we can't (!!) because in ascending mode we get alert (character A) first and warning (character W) last, but we should get nice progression like: debug, info, notice, warning, error, crit, alert, emerg. Just in case, I'm attaching a part of syslog-ng.conf file: --------------------- destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$R_YEAR-$R_MONTH-$R_DAY $R_HOUR:$R_MIN:$R_SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; --------------------- Thanks for any info, Tadej

1 0

Alternate logging destination
by Szeti, Balazs 06 Nov '06

06 Nov '06

Hello! I would like to design a centralized logging system with 50 edge nodes and one center. It's quiet important to have all the logs even if the center is unreachable. Is there a way to configure syslog-ng to use an alternate destination? For example if the centralized TCP destionation server is down, the edge node syslog-ng may log in to a local file, so the logs can be reached later manually. When the center server in online again syslog-ng may log online again. Any ideas? Thanks in advance: Balazs

5 8

2.0.0 : make install doesn't install anything?
by Rob Munsch 06 Nov '06

06 Nov '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, i was reasonably sure that earlier versions make an /etc/syslog-ng and put a syslog-ng.conf in there as well as installing basic initscripts. My configure and make seem to exit cleanly, but make install doesn't... install. Yes, i am root. This is on a debian linux box with 2.6.16.29. I guess i could be misremembering, but i don't *think* i did that all by hand last time..? And yes, i see the scripts in debian/ as well. I'm just making sure there's nothing Odd about make install's behaviour before i move them manually. Thanks, - -- Rob Munsch Solutions For Progress IT www.solutionsforprogress.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFT18YBvBcJFK6xYURAoZsAJ43DCm3UI21VyRXGYyHOFqQcuABRwCdEx3w xpY/T1qymgA+skAdx+Nu/6E= =2UrK -----END PGP SIGNATURE-----

1 1