March 2006 - syslog-ng - lists.balabit.hu

AIX 5.2, AIX 5.3 libol compile problems "
by Mike Harvey 13 Mar '06

13 Mar '06

I get this error during make on libol 0.3.17 io.c:493: `MSG_DONTWAIT' undeclared (first use in this function) I saw a related thread for HP-UX. https://lists.balabit.hu/pipermail/syslog-ng/2006-January/008352.html Details were posted to make a download of a January 2006 patch of io.c, but I can't track down where to download this new file from. Thanks <syslog-ng(a)lists.balabit.hu>

3 2

AIX: Syslog NG 1.6.9 (tcp) send logmessages to central log server
by Jochen Kirn 13 Mar '06

13 Mar '06

Hi all, logmessages are being written to the AIX default syslog daemon which forwards certain messages to syslog ng via a named pipe "/var/adm/syslog.pipe" The log messages are being written to the destination "localfile" but not to the remote syslog ng logging server. Any idea what's going wrong here ? the exact same "syslog-ng.conf" works with a HP-UX or Solaris based Syslog NG Installation without any problem. Setup: Syslog NG: 1.6.9 with libol 0.3.17 System: AIX 5.1 ML8 and AIX 5.3 ML 3 central logging server is a linux based syslog NG 1.6.9 which can successfully receive log messages from other (non aix) hosts. syslog-ng.conf: ############## # Log sources # source src { pipe ("/var/adm/syslog.pipe"); }; ############## # filters # filter f_sshd {program("sshd"); }; ############## # Log destinations destination mylogserver{ tcp("logserver" port(514)); }; destination localfile{ file("/var/tmp/messages" template("$YEAR.$MONTH.$DAY $HOUR:$MIN:$SEC $HOST $MSG\n") template-escape(yes )); }; ############## # Perform the logging log { source(src); filter(f_sshd); destination(mylogserver); }; log { source(src); filter(f_sshd); destination(localfile); }; regards Jochen

3 3

DNS hostnames vs. /etc/hosts?
by micah milano 13 Mar '06

13 Mar '06

Hi, I'm doing remote logging from one client, whose actual hostname is "ibis", however the logs are being sent through an openVPN tunnel so the receiving log server has this in /etc/hosts: 127.0.0.1 localhost emu 10.8.0.5 ibis-vpn What I cannot figure out is why a log directory is created for both "ibis" and "ibis-vpn", I want all the logs from that host to appear in one directory. On the client I have: destination server { tcp("10.8.0.1" port(514)); }; On the server I have: options { long_hostnames(off); sync(1); stats(0); log_fifo_size(2048); dns_cache(yes); keep_hostname(yes); bad_hostname("gconfd"); create_dirs(yes); }; source tcp_src { tcp(max-connections(1000) tcp-keep-alive(yes)); }; destination remote_servers { file("/whopper/logs/$HOST/$FACILITY.log" owner(root) group(adm) perm(0640) dir_perm(0755) create_dirs(yes)); }; log { source(tcp_src); destination(remote_servers); flags(final); };

1 0

syslog-ng with samba
by Dev Anand 10 Mar '06

10 Mar '06

Hi All , Well I have a good and working version of syslog-ng with phpsyslog enabled and reports properly generated. There is only one issue . I have three different samba servers which are not sending their logs but I get other logs from the same servers like cron and logins and other stuff. Please advise. Thanks in advance. Regards Deva

2 2

RE: [syslog-ng] Splitting a single source to multiple mysql tables
by Dukes Clayton 08 Mar '06

08 Mar '06

nope... ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Dukes Clayton Sent: Tuesday, March 07, 2006 5:00 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Splitting a single source to multiple mysql tables I think this fixed it, can someone confirm? destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") INSERT INTO host (host) VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") INSERT IGNORE INTO facility (facility) VALUES ( '$FACILITY' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Dukes Clayton Sent: Tuesday, March 07, 2006 4:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Splitting a single source to multiple mysql tables Hiya, Here's what I have, why doesn't it work? destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") template-esc destination d_host { pipe("/var/log/mysql.pipe" template("INSERT INTO host (host) VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") template-escape(yes)); }; destination d_mysql_facility { pipe("/var/log/mysql.pipe" template("INSERT IGNORE INTO facility (facility) VALUES ( '$FACILITY' );\n") template-escape(yes)); }; # This doesn't work #log { source(net); destination(d_mysql); destination(d_host); destination(d_mysql_facility); }; # This works log { source(net); destination(d_mysql); };

1 0

RE: [syslog-ng] Splitting a single source to multiple mysql tables
by Dukes Clayton 07 Mar '06

07 Mar '06

I think this fixed it, can someone confirm? destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") INSERT INTO host (host) VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") INSERT IGNORE INTO facility (facility) VALUES ( '$FACILITY' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Dukes Clayton Sent: Tuesday, March 07, 2006 4:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Splitting a single source to multiple mysql tables Hiya, Here's what I have, why doesn't it work? destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") template-esc destination d_host { pipe("/var/log/mysql.pipe" template("INSERT INTO host (host) VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") template-escape(yes)); }; destination d_mysql_facility { pipe("/var/log/mysql.pipe" template("INSERT IGNORE INTO facility (facility) VALUES ( '$FACILITY' );\n") template-escape(yes)); }; # This doesn't work #log { source(net); destination(d_mysql); destination(d_host); destination(d_mysql_facility); }; # This works log { source(net); destination(d_mysql); };

1 0

Splitting a single source to multiple mysql tables
by Dukes Clayton 07 Mar '06

07 Mar '06

Hiya, Here's what I have, why doesn't it work? destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") template-esc destination d_host { pipe("/var/log/mysql.pipe" template("INSERT INTO host (host) VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") template-escape(yes)); }; destination d_mysql_facility { pipe("/var/log/mysql.pipe" template("INSERT IGNORE INTO facility (facility) VALUES ( '$FACILITY' );\n") template-escape(yes)); }; # This doesn't work #log { source(net); destination(d_mysql); destination(d_host); destination(d_mysql_facility); }; # This works log { source(net); destination(d_mysql); };

1 0

RE: [syslog-ng] Syslog-ng 1.6.9 just stops...
by Andreoli, Tony A. USNUNK NAVAIR B1490, R215 07 Mar '06

07 Mar '06

I had klogd off already, but this got me thinking about something else. My config file's sources are: source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); udp(); internal(); }; source t_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); tcp(); internal(); }; Could it be that both sources, attempting to read /proc/kmsg and /dev/log (and internal()?) are causing this? Thanks a lot! Tony -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Wednesday, March 01, 2006 15:25 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 1.6.9 just stops... On Wed, 2006-03-01 at 10:01 -0500, Andreoli, Tony A. USNUNK NAVAIR B1490, R215 wrote: > I'm using 1.6.9 (upgraded from 1.6.6 because I was seeing the same > problem). I have it running on 8 different servers at different > locations, some are SMP, some aren't. On these hosts, we have > anywhere from 2 to 14 devices logging to the servers, some via > 514/tcp, others via 514/udp. All of the loggers typically sit with a > load average < 1 (usually not even registering), and a cpu idle of > 99%. 7 of these remote loggers also log to our local machine, but > only 5 lines every 2 minutes (for stats). > > What I've noticed (and I've seen this on all of them at one time or > another), is that syslog-ng just stops. ps shows it running, but the > log file (/logs/messages) never changes. If I tcpdump on the > interface that it's listening on, I see traffic, and it seems that the > act of tcpdumping causes the log file to start to grow again, then a > little while later, it may stop again. It's sporadic though, on one > of my systems, it hasn't done it in over 2 months, on another, it's > done it 3 times today. > > I've pulled out my last hair and still haven't come any closer to a > solution. I've recompiled the source, loaded 3 different versions, > etc. The only thing common is that all of these systems are running > RHEL3. Don't you happen to read /proc/kmsg by both syslog-ng and klogd ? That is a known bad situation and the symptoms are exactly what you describe. (poll indicates readability but by the time syslog-ng gets to read the file the data has already been read) This is documented in the FAQ as well. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

6 8

rotating logs at 12:00 noon
by Navin Jathan 07 Mar '06

07 Mar '06

Hi, I am new to syslog-ng. I am not a programmer, but configuration of syslog-ng feels like I programming something!!! Wish I could get over this soon!! Apart from normal logging operation, I use syslog-ng to log PIX firewall logs from the network. Following is the configuration file: <..snip..> filter f_11 { facility(local0) and level(debug..emerg); }; destination d_8 { file("/var/log/pix/SyslogCatchAll-$DAY-$MONTH-$YEAR.log" create_dirs(yes)); }; log { source(local); filter(f_11); destination(d_8); }; <../snip..> This would typically rotate the logs at 12:00 at midnight daily. But I need to rotate the logs at 12:00 noon daily. Is it possible to configure syslog-ng in this manner? How do I do it? I had unsuccessfully tried to use logrotate with the native syslog utility in Linux. Do I have to use logrotate here again? Thanks in Advance, Regards, Navin Jathan. Disclaimer: Information transmitted by this e-mail is proprietary to Adventity and/ or its Customers, intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If you are not the intended recipient or it appears that this mail has been forwarded to you without proper authority, you are notified that any use or dissemination of this information in any manner is strictly prohibited. In such cases, please notify us immediately at postmaster(a)adventity.com and delete this mail from your records.

2 1

Checking for drops with netstat -s
by Cary, Kim 06 Mar '06

06 Mar '06

Syslog-ng 1.6.4 on Solaris 9: IPv4 udpInOverflows =640473547 UDP udpInDatagrams =409687632 udpInErrors = 0 udpOutDatagrams =466811 udpOutErrors = 0 Does the udpInOverflows indicate I'm losing packets?

2 1