February 2006 - syslog-ng - lists.balabit.hu

Email Alerts from Syslog-ng
by Stuart Burgis 13 Feb '06

13 Feb '06

I am a fairly new to all this so please excuse me. I am having lots of problems getting syslog-ng to send email alerts based upon certain text based filters. I am running RedHat 9.0 with syslog-ng-1.6.2-1 installed from the rpm, I have configured the syslog-ng.conf file correctly to enable filtering with a match statement for a specific IP address in the logs and this works when using ‘destination file { file("/etc/syslog-ng/test.log"); };’ but when I point this to the perl script that I have got off of this URL HYPERLINK "http://www.campin.net/newlogcheck.html"http://www.campin.net/newlogcheck.html I get nothing. Please see below the destination statement and perl script that I have created with executable permissions. Syslog-ng.conf destination email { program("/etc/syslog-ng/mail.pl"); }; filter f_test { match(192.168.1.1); }; log { source(src); filter(f_test); destination(email); }; Mail.pl #!/usr/bin/perl -n # ## shell version # # while read line; do # echo $line | /bin/mail -s "log alert" support(a)businessfcl.com # done # strip the priority s/^<[\d]{1,2}>//; # mail the cleaned up message system("echo \"$_\" | /bin/mail -s \"log alert\" monitor"); Every time I restart the syslog-ng service I get a mail to the monitor user which would indicate that the perl script sends mail and that syslog-ng runs it during startup but it does not appear to work when the filter is applied. Can any one help with this please? Regards Stuart Burgis -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 267.15.2/252 - Release Date: 06/02/2006

2 1

please unsubcribe me form the list
by anil saka 12 Feb '06

12 Feb '06

1 0

Re: [syslog-ng] RFC3339 fractional second logging
by rlott＠ivhs.com 12 Feb '06

12 Feb '06

2 3

Newbie
by Adrian 12 Feb '06

12 Feb '06

ajc80, Sunday, January 29, 2006, 3:30:27 PM, you wrote: > Hello, > I'm a newbie to syslog-ng, I have followed the instructions and used and > altered the necessary examples to suit my directory structures, so my syslog > messages are dumped in to mysql database. > When starting syslog-ng I get the following messages: > # /etc/init.d/syslog-ng start > Starting MySQL pipe... > Starting syslog-ng... > Warning: No source refers to internal messages, they'll go to /dev/null > unresolved reference: inputs > Error initializing configuration, exiting. > The "No source refers to internal messages...." message I understand. > The "unresolved reference: inputs" I don't and can't seem to find anything > in the archives. Looking through your conf file I don't see an inputs source - except the commented out Solaris one. > I've included the syslog-ng.conf file and the mysql.pipe file below. > Any help would be appreciated. > Thanks, > Adrian. > ##################################################################### > # Define syslog input stream > # This is specific to Solaris 9 > # source inputs { internal(); > # sun-streams("/dev/log" door("/var/run/syslog_door")); > # tcp(max_connections(1000)); }; > # For newer versions of Linux (Debian GNU/Linux woody, > # and RedHat Linux post 7.0) > # > source stdlog { unix-dgram("/dev/log"); }; >As above. I am a newbie myself so I am probably talking through my >hat anyway ;) > -- > Best regards, > David mailto:dma at pern.co.uk ####################################################################### Hi David, I'm still none the wiser. I have hashed out the three lines which start source inputs: > # source inputs { internal(); > # sun-streams("/dev/log" door("/var/run/syslog_door")); > # tcp(max_connections(1000)); }; As it suggests that this is for Solaris systems only, and Redhat should use the following line: > # For newer versions of Linux (Debian GNU/Linux woody, > # and RedHat Linux post 7.0) > # > source stdlog { unix-dgram("/dev/log"); }; Which I un-hashed. Where would I places the inputs and what would they look like?? Any help very much appreciated. Kind regards, Adrian.

2 1

Re: [syslog-ng] RFC3339 fractional second logging
by rlott＠ivhs.com 10 Feb '06

10 Feb '06

2 1

RFC3339 fractional second logging
by rlott＠ivhs.com 09 Feb '06

09 Feb '06

2 1

(no subject)
by rlott＠ivhs.com 08 Feb '06

08 Feb '06

1 0

problem to log fetcmail logs
by Thierry B 03 Feb '06

03 Feb '06

Hello, I'd like to use syslog-ng to log fetchmail logs. For the moment, fetcmail logs are in /var/log/fetchmail.log and I'd like to put it in /var/log/$YEAR:$MONTH$DAY, to have a separate log file for each day. I try to add that: source fetchmail { file("/var/log/fetchmail.log"); }; destination df_fetchmail { file("/var/log/$YEAR/$MONTH/$DAY/fetchmail.log"); }; log { source(fetchmail); filter(f_fetchmail); destination(df_fetchmail); }; But it dosn't works. Do you have an idea? Thanks :-) Bye

3 4

strange logging behaviour
by stucky 02 Feb '06

02 Feb '06

guys I've setup a central syslog-ng based server on RHEL4 using version 1.6.6. I have the central server set to log things to 2 destinations. Once to the regular logfile and again to an archive file. I open 2 terminals to it and tail -f both /var/log/messages and the appropriate archive file. Then I go to one of the clients and do : '/usr/bin/logger test' and watch. What is weird is this: /var/log/messages shows 'test' right away but the archive log takes about a minute to show it. Then on the client I do: /usr/bin/logger test2 now it doesn't show up on either log then on the client i do: /usr/bin/logger test3 and all of a sudden all 3 testlogs show up in both logs. This is not al all consistens though. I can repeat the test and this time it's the arcive log that shows the log first and /var/log/messages takes sweet time, or both take time. I understand that it may take a little to send the stuff over the net but once it has reached the logserver why isn't it sent to both destinations at the same time ? INTERESTING NOTE: If I run the stresstest.sh script that comes with the syslog-ng source on the client I ALWAYS see ALL logs immediately in both destinations on the log server. I had noticed before that sending a couple of logs seems to help. As if syslog-ng decides to send logs in bulk so if there is only one tiny log it appears to wait till there are more logs - then it catches up. However, sometimes even a small log show up right away. Again - i can't see consistency. Here is my log server syslog-ng.conf. ############################################################### # First, set some global options. options { use_fqdn(no); use_dns(yes); dns_cache(yes); keep_hostname(yes); long_hostnames(off); sync(1); stats(0); create_dirs(yes); perm(0640); dir_perm(0750); }; source src { file("/proc/kmsg"); unix-stream("/dev/log"); internal(); udp (ip("10.152.1.67")); tcp(ip("0.0.0.0") port(5000) max-connections(1000) keep-alive(yes)); }; destination authlog { file("/var/log/auth"); }; destination cron { file("/var/log/cron"); }; destination uucp { file("/var/log/uucp"); }; destination mail { file("/var/log/mail"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty8"); }; destination console_file { file("/var/log/console"); }; destination arch { file("/usr/local/var/log_archive/$HOST/$YEAR/$MONTH/$DAY/archive"); }; filter f_auth { facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_mail { facility(mail); }; filter f_uucp { facility(cron); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, mail, news); }; filter f_emergency { level(emerg); }; filter f_notcron { not match("cron.minute)"); }; filter f_auth_junk { not ( match("Accepted publickey for nagios from 10.152.48.42") or match("Accepted publickey for nagios from 127.0.0.1") or match("Accepted publickey for oracle from ********") or match("Accepted publickey for oracle from ********") or match("Accepted publickey for stucky from ********") or match("Accepted publickey for cfengine from **********") or match("COMMAND=/usr/local/nagios/home/check_duplex") or match("reconnecting to LDAP server.+sleeping") or match("session opened for user nagios") or match("session closed for user nagios") or match("session opened for user root")); }; filter f_junk { not ( match("]: AF_INET client connected from")); }; log { source(src); filter(f_auth); filter(f_auth_junk); destination(authlog); }; log { source(src); filter(f_cron); filter(f_notcron); destination(cron); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_messages); filter(f_junk); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(f_emergency); destination(console_file); }; log { source(src); filter(f_auth_junk); filter(f_notcron); destination(arch); }; and here my syslog-ng.conf from the client: ############################################################### # First, set some global options. options { use_fqdn(no); use_dns(yes); dns_cache(yes); keep_hostname(yes); long_hostnames(off); sync(1); stats(0); create_dirs(yes); }; source src { file("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; destination authlog { file("/var/log/auth"); }; destination cron { file("/var/log/cron"); }; destination kern { file("/var/log/kernel"); }; destination uucp { file("/var/log/uucp"); }; destination mail { file("/var/log/mail"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty8"); }; destination console_file { file("/var/log/console"); }; destination loghost { tcp("logger" port(5000)); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv) and not facility(mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter f_nagios { not ( match("Accepted publickey for nagios from *********") or match("COMMAND=/usr/local/nagios/home/check_duplex") or match("session opened for user nagios") or match("session closed for user nagios")); log { source(src); filter(f_authpriv); filter(f_nagios); destination(authlog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(messages); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_kern); destination(messages); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(messages); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(f_cnews); destination(console_all); }; log { source(src); filter(f_cother); destination(console_all); }; log { source(src); filter(f_emergency); destination(console_file); }; log { source(src); filter(f_cnews); destination(console_file); }; log { source(src); filter(f_cother); destination(console_file); }; log { source(src); filter(f_nagios); destination(loghost); }; This may also be a good opportunity to have someone check whether my configs are sane at all. I'm not 100% sure about them. I don't really want to log to all kinds of different files, rather I want to have mail stuff go to mail, cron stuff to cron, auth stuff to auth and the rest to messages. help would be appreciated. -- stucky

1 0

Fulldate in log files
by Gustavo Mendes de Carvalho 02 Feb '06

02 Feb '06

Hi All, Actually, I have my syslog-ng configured as shown bellow. Jan 29 12:17:01 linux1 CRON[31468]: message itself My conf file has this statements # begin of log conf file source s_all { unix-stream("/dev/log"); internal(); }; destination d_auth { file("/var/log/auth.log"); }; destination d_syslog { file("/var/log/syslog"); }; destination d_cron { file("/var/log/cron.log"); }; filter f_auth { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; log { source(s_all); filter(f_auth); destination(d_auth); }; log { source(s_all); filter(f_syslog); destination(d_syslog); }; log { source(s_all); filter(f_cron); destination(d_cron); }; log { source(s_all); filter(f_daemon); destination(d_daemon); }; # end of log conf file How can I do to put a full date (including year) in this logfile ? Thanks in advance Gustavo

1 0