April 2006 - syslog-ng - lists.balabit.hu

service syslog-ng does not support chkconfig
by wayne yu 27 Apr '06

27 Apr '06

Hi: I'm new to syslog-ng, and I really need help for the error message [root@localhost init.d]# chkconfig --add syslog-ng service syslog-ng does not support chkconfig thanks in advance for any help --------------------------------- Love cheap thrills? Enjoy PC-to-Phone calls to 30+ countries for just 2¢/min with Yahoo! Messenger with Voice.

2 1

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 26 Apr '06

26 Apr '06

Here you go: 1 # syslog-ng configuration file.$ 2 #$ 3 # This should behave pretty much like the original syslog on RedHat Linux 9.$ 4 # But it could be configured a lot smarter.$ 5 #$ 6 # See syslog-ng(8) and syslog-ng.conf(5) for more information.$ 7 $ 8 options {$ 9 sync (0);$ 10 time_reopen (10);$ 11 log_fifo_size (1000);$ 12 long_hostnames (on);$ 13 use_dns (yes);$ 14 use_fqdn (no);$ 15 create_dirs (no);$ 16 owner(mdirect);$ 17 group(mdirect);$ 18 keep_hostname (yes);$ 19 log_msg_size(20480);$ 20 time_sleep(30);$ 21 };$ 22 $ 23 $ 24 #source s_sys {$ 25 # pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal();$ -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Roberto Nibali Sent: April 26, 2006 10:41 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() Vaibhav Goel wrote: > Still can't figure this one out. So far, I have compiled and installed > 1.6.9 and 1.6.10 and keep getting the same error. > > Anyone?!?!? One thing that sometimes bites people is a stupid control character inside a config file. Could you post the output of following command, please? cat -An mpt-status.c | head -25 Reducing the config file to a bare reproducable set of entries would help us as well. Regards, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 2

Any non-commercial Windows tcp clients?
by Davis, Jacob 26 Apr '06

26 Apr '06

I've been doing some digging around and have found references to several windows syslog clients (snare, ntsyslog, kiwi, etc..) but nothing I have found is both capable of using TCP ports instead of the standard UDP, and also non-commercial. The reason I ask is that I am intent on using SSL or SSH to tunnel connections to the log host and I don't think that UDP is an option in that case. Does such a solution exist? Thanks, -Jake

1 0

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 26 Apr '06

26 Apr '06

I cannot locate the mpt-status.c file in the 1.6.10 source tree. Syslog-ng gives a syntax error in a config file which has just this: options { time_sleep(30); }; (it works fine if you replace sleep with reap though) -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Roberto Nibali Sent: April 26, 2006 10:41 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() Vaibhav Goel wrote: > Still can't figure this one out. So far, I have compiled and installed > 1.6.9 and 1.6.10 and keep getting the same error. > > Anyone?!?!? One thing that sometimes bites people is a stupid control character inside a config file. Could you post the output of following command, please? cat -An mpt-status.c | head -25 Reducing the config file to a bare reproducable set of entries would help us as well. Regards, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 26 Apr '06

26 Apr '06

Still can't figure this one out. So far, I have compiled and installed 1.6.9 and 1.6.10 and keep getting the same error. Anyone?!?!? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of John Morrissey Sent: April 25, 2006 2:13 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() On Tue, Apr 25, 2006 at 01:52:30PM -0700, Vaibhav Goel wrote: > The rest of the file is just a bunch of source, destination, filter and > log entries for various stuff > > Also: > [root@clxd01md syslog-ng]# strings /sbin/syslog-ng | grep time_sleep > time_sleep > > So looks like there could be some time_sleep code in the binary at > least... True. You posted the output of syslog-ng -V before (1.6.10), and I definitely see the code in the final 1.6.10 tarball. strings(1) shows time_sleep text on my working syslog-ng binaries, and I can't find any reason it wouldn't be compiled in. Sorry, I'm not sure what to say. Baszi? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

FQDN based on destination
by Chris Whipple 25 Apr '06

25 Apr '06

Is there a way to change the use_fqdn() option based on the destination so that one receives the short host name an the other receives the FQ name? I'm using version 1.6.10. example: options { use_fqdn (yes) ... }; destination d_logfile { file("somelogfile") ; }; destination d_rmtserver { tcp("rmtserver.domain.com" port(514)); use_fqdn(no); }; Thank you, Chris Whipple Sr. Security Analyst Unix Security Group The Hertz Corporation 5601 NW Expressway Oklahoma City, OK 73132, USA cwhipple(a)hertz.com --------------- This message (including attachments) may contain information that is privileged, confidential or protected from disclosure. If you are not the intended recipient, you are hereby notified that dissemination, disclosure, copying, distribution or use of this message or any information contained in it is strictly prohibited. If you have received this message in error, please immediately notify the sender by reply e-mail and delete this message from your computer. Although we have taken steps to ensure that this e-mail and attachments are free from any virus, we advise that in keeping with good computing practice the recipient should ensure they are actually virus free. ---------------

3 4

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 25 Apr '06

25 Apr '06

BTW I just removed the time_sleep(30); from the file below to restart syslog-ng. But as soon as I put it in there, I get the syntax error... syntax error at 20 Parse error reading configuration file, exiting. (line 20) options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); owner(mdirect); group(mdirect); keep_hostname (yes); log_msg_size(20480); time_sleep(30); }; -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Vaibhav Goel Sent: April 25, 2006 1:53 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] time_sleep() I can't post the whole thing since its too big but I am posting the relevant portion of it: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); owner(mdirect); group(mdirect); keep_hostname (yes); log_msg_size(20480); }; The rest of the file is just a bunch of source, destination, filter and log entries for various stuff Also: [root@clxd01md syslog-ng]# strings /sbin/syslog-ng | grep time_sleep time_sleep So looks like there could be some time_sleep code in the binary at least... -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of John Morrissey Sent: April 25, 2006 1:48 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() On Tue, Apr 25, 2006 at 01:00:17PM -0700, Vaibhav Goel wrote: > I did exactly that... > > [root@clxd01md syslog-ng]# /etc/init.d/syslog-ng restart > Shutting down system logger: [ OK ] > Starting system logger: syntax error at 20 > Parse error reading configuration file, exiting. (line 20) > [FAILED] > [root@clxd01md syslog-ng]# cat /etc/syslog-ng/syslog-ng.conf | grep time > time_reopen (10); > time_sleep(30); > > [root@clxd01md syslog-ng]# /sbin/syslog-ng -V > syslog-ng 1.6.10 > > > Am I doing something wrong? Strange. I backported the time_sleep change to the Debian package I'm running (1.6.9) so I can't speak for the pristine 1.6.10 source, but it's been working fine for us. I glanced at the 1.6.10 tarball and see some time_sleep code there. Could you post your entire syslog-ng.conf? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 25 Apr '06

25 Apr '06

Hi John... I did exactly that... [root@clxd01md syslog-ng]# /etc/init.d/syslog-ng restart Shutting down system logger: [ OK ] Starting system logger: syntax error at 20 Parse error reading configuration file, exiting. (line 20) [FAILED] [root@clxd01md syslog-ng]# cat /etc/syslog-ng/syslog-ng.conf | grep time time_reopen (10); time_sleep(30); [root@clxd01md syslog-ng]# /sbin/syslog-ng -V syslog-ng 1.6.10 Am I doing something wrong? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of John Morrissey Sent: April 25, 2006 12:38 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() On Tue, Apr 25, 2006 at 11:44:29AM -0700, Vaibhav Goel wrote: > I just installed syslog-ng 1.6.10 and cannot figure out how to use the > time_sleep() option in the conf file. Any ideas? We are having some > nasty cpu spikes because of lots of parallel connections to syslog-ng > and hoping this will solve the issue. It's just an option, i.e.: options { time_sleep(30); } john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

time_sleep()
by Vaibhav Goel 25 Apr '06

25 Apr '06

Hi all I just installed syslog-ng 1.6.10 and cannot figure out how to use the time_sleep() option in the conf file. Any ideas? We are having some nasty cpu spikes because of lots of parallel connections to syslog-ng and hoping this will solve the issue. Thanks!

2 1

RE: [syslog-ng] Syslog file to Mysql
by Dukes Clayton 25 Apr '06

25 Apr '06

Yep, that would certainly work for ya :-) -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Mario Gzuk Sent: Tuesday, April 25, 2006 12:20 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog file to Mysql Hi, one line should do the work for you: zcat mygnuziplogfile.gz | awk '{print "INSERT INTO tablename VALUES("$1 $2 $3","$4","$5");"}' > sqlcommands.sql You have to rewrite the awk stuff because I dont know how your table layout locks like and I also dont know how your logfile locks like. Sorry for the english.... it is a work in progress! Am Dienstag, den 25.04.2006, 11:48 -0500 schrieb Nick: > Michael, > > Thanks for the reply, > > I did not describe my situation very well, but your solution will help > with other needs. I have multiple boxes where I can not directly > syslog to the central server. What I do is, scp the files back to the > central log server. From here I would like to uncompress them and > then import the files into the database. > > Hope that is a bit clearer. > > Nick > > On 4/25/06, Michael Redinger <Michael.Redinger(a)uibk.ac.at> wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > Hi, > > > > regarding adding information to the local log, you could add this to > > the log destination definition, eg.: > > > > destination d_local { > > file("/var/log/mylogfile.log" template("$DATE $HOST > > [$FACILITY.$PRIORITY] $MSG\n")); }; > > > > The result looks something like this: > > > > Apr 25 16:59:09 myhost [local1.info] syslog message follows > > > > Greetings, > > Michael > > > > Nick Carstensen wrote: > > > Hello All, > > > > > > Have a question I hope someone can help with. > > > > > > Currently I have Syslog-ng running logging to a mysql db along > > > with keeping files. This is working well. I have a situation > > > where I can not log to the box directly. I need to "pull" the > > > logs to the central log server and import them into the db. As > > > syslogd and syslog-ng do not log all the needed fields by default > > > like facility:level and year, when they are writing them local I need a way to add that to the file. > > > > > > The second problems is how to import them to the db. Is there any > > > tool that will do this for me automatically? > > > > > > Thanks for the assistance. > > > _______________________________________________ > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at > > > http://www.campin.net/syslog-ng/faq.html > > > > > > > > > > > > - -- > > Michael Redinger > > Zentraler Informatikdienst (Central IT Services) Universitaet > > Innsbruck > > Technikerstrasse 13 Tel.: ++43 512 507 2335 > > 6020 Innsbruck Fax.: ++43 512 507 2944 > > Austria Mail: Michael.Redinger(a)uibk.ac.at > > BB98 D2FE 0F2C 2658 3780 3CB1 0FD7 A9D9 65C2 C11D > > http://homepage.uibk.ac.at/~c102mr/mred-pubkey.asc > > -----BEGIN PGP SIGNATURE----- > > Version: GnuPG v1.4.2.2 (GNU/Linux) > > Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org > > > > iD8DBQFETjoyD9ep2WXCwR0RAoo+AKCKxQrcmNfDhCj5MPa+XzcSZbKKegCgpzti > > +BssjXgkZbz0OATuDUajyoY= > > =FrIc > > -----END PGP SIGNATURE----- > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at > > http://www.campin.net/syslog-ng/faq.html > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0