April 2006 - syslog-ng - lists.balabit.hu

RE: [syslog-ng] Syslog file to Mysql
by Dukes Clayton 25 Apr '06

25 Apr '06

Just use perl... Take a look at my php-syslog-ng package, there's a script in scripts/dbgen.pl that you could probably start with. My package is available at http://phlog.gdd.net -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Nick Sent: Tuesday, April 25, 2006 9:39 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog file to Mysql I am currently using the php-syslog-ng but am in need to find a way to take a local file and "inject" it into the local database. If php-syslog-ng can do this I have missed it and would be appreciative if you could point that out to me. THanks for the help On 4/25/06, Dukes Clayton <Clayton.Dukes(a)hcahealthcare.com> wrote: > Take a look at php-syslog-ng > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Nick > Carstensen > Sent: Monday, April 24, 2006 9:52 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Syslog file to Mysql > > Hello All, > > Have a question I hope someone can help with. > > Currently I have Syslog-ng running logging to a mysql db along with > keeping files. This is working well. I have a situation where I can > not log to the box directly. I need to "pull" the logs to the central > log server and import them into the db. As syslogd and syslog-ng do > not log all the needed fields by default like facility:level and year, > when they are writing them local I need a way to add that to the file. > > The second problems is how to import them to the db. Is there any > tool that will do this for me automatically? > > Thanks for the assistance. > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Syslog file to Mysql
by Nick Carstensen 25 Apr '06

25 Apr '06

Hello All, Have a question I hope someone can help with. Currently I have Syslog-ng running logging to a mysql db along with keeping files. This is working well. I have a situation where I can not log to the box directly. I need to "pull" the logs to the central log server and import them into the db. As syslogd and syslog-ng do not log all the needed fields by default like facility:level and year, when they are writing them local I need a way to add that to the file. The second problems is how to import them to the db. Is there any tool that will do this for me automatically? Thanks for the assistance.

5 4

HP-UX pipe read errors
by Andy G. 25 Apr '06

25 Apr '06

Hello, I'm new to syslog-ng and am trying to configure it to run on HP-UX 10.20 and 11.11. It seems to have problems reading from the /dev/log pipe. Each time a message is received on the pipe, syslog-ng hits an I/O error and closes the filehandle, and no more messages are received. However, the first message is always processed correctly. Here is my syslog-ng.conf: source src { pipe("/dev/log" pad_size(2048)); internal(); }; destination d_file { file("/var/adm/syslog-ng/messages" owner(root) group(systaff) perm(0640) ); }; destination d_net { tcp(testy port(1514)); }; log { source(src); destination(d_file); destination(d_net); }; When I run syslog-ng in the foreground with debug and verbose options, this is what I see: io.c: Preparing fd 3 for reading io.c: connecting using fd 6 connecting fd 6 to inetaddr testy, port 1514 syslog-ng version 1.6.10 starting io.c: Preparing fd 6 for writing io.c: Preparing fd 7 for writing io.c: do_read: read() failed (errno 11), Resource temporarily unavailable fd = 3, buffer = 00098b0, length = 2048 Marking fd 3 for closing. Closing fd 3. The do_read line is when the message is received. syslog-ng continues to run, and internal messages (e.g. STATS) continue to show up on the local host and the remote loghost. Any thoughts would be greatly appreciated. -Andy

1 0

RE: [syslog-ng] Syslog file to Mysql
by Dukes Clayton 25 Apr '06

25 Apr '06

Take a look at php-syslog-ng -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Nick Carstensen Sent: Monday, April 24, 2006 9:52 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Syslog file to Mysql Hello All, Have a question I hope someone can help with. Currently I have Syslog-ng running logging to a mysql db along with keeping files. This is working well. I have a situation where I can not log to the box directly. I need to "pull" the logs to the central log server and import them into the db. As syslogd and syslog-ng do not log all the needed fields by default like facility:level and year, when they are writing them local I need a way to add that to the file. The second problems is how to import them to the db. Is there any tool that will do this for me automatically? Thanks for the assistance. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] Configuring syslog-ng to broadcast
by Kevin 24 Apr '06

24 Apr '06

On 4/23/06, Jim Schuyler <sky(a)red7.com> wrote: > Did we ever establish that syslog-ng cannot do a broadcast? > Sounds like it can not. It should be trivial to enable, a one-line change to the source, when creating a UDP transmit socket you also call setsockopt with SO_BROADCAST. Maybe a few more lines if the approach taken is to create a new option for udp destinations such as 'so_broadcast(yes)', just like a file destination can have 'create_dirs(yes)' set. There's no harm done in setting SO_BROADCAST and then sending packets to a unicast address -- the option won't change anything for regular packets, it just gives the program permission to send to local broadcast addresses. Kevin

1 0

Configuring syslog-ng to broadcast
by Jim Schuyler 24 Apr '06

24 Apr '06

Although I have tried to convince my client that this isn¹t exactly the best idea, they want to configure syslog-ng to send logs by broadcast rather than to a specific address on their subnet. Previously the configuration line we used for a specific remote syslog was: destination grouplog { udp(192.168.1.14 port(514)); }; Can syslog-ng actually do udp broadcast, and if so, what would be the appropriate config line to cause this to happen? (I have tried using 192.168.1.255 and 255.255.255.255 and neither seems to do it, although I might not be properly configured on the other end to receive broadcasts...the other end is Mac OSX and it does receive messages just fine if I configure 192.168.1.14, as above.) [Jim Sky]

3 6

filtering local facilities
by Bruce Pennypacker 21 Apr '06

21 Apr '06

Hi all, I'm just starting to work with syslog-ng. We're setting up a loghost that will be collecting logs from a number of applicatoin servers, and I want to split them up based on whether they're application logs or system logs. The application is logging to local syslogs using the facility local5, but I'm having trouble filtering on that in syslog-ng. I couldn't find any documentation that indicates this can't be done so I'm wondering what I might be doing wrong. Here's the relevant part of my syslog-ng.conf file: source s_udp { udp( ip(0.0.0.0) port(514) ); }; destination d_application { file("/var/log/application.log"); }; destination d_syslog { file("/var/log/syslog"); }; filter f_my_servers { host(h-001) or host(h-002) or host(h-003); }; filter f_test1 { facility(local5) and filter(f_my_servers); }; filter f_test2 { filter(f_my_servers); }; log { source(s_udp); filter(f_test1); destination(d_application); flags(final); }; log { source(s_udp); filter(f_test2); destination(d_syslog); flags(final); }; With the above configuration anything that comes in from one of the hosts as local5.* should get written to /var/log/application.log and everything else from those hosts should get written to /var/log/syslog, right? But if I log into one of these hosts and perform a test: [root@h-001 ~]# logger -t local5.info test The test message always ends up getting logged in /var/log/syslog. Does syslog-ng allow remote filtering based on the local5 facility, or am I doing something wrong here? -Bruce

1 1

RE: [syslog-ng] how to start the syslog-ng
by Heigl Florian - Munich-MR - external 21 Apr '06

21 Apr '06

> I'm new to syslog-ng. I need help on configuring the > syslog-ng. I already installed syslog-ng pkg to my > solaris 8 computer, but I can't find syslog-ng.conf > file or demeaon. > Thanks in advance for any comments. You will have to create a configuration by hand, there is no default to start from as far as I remember. You will find a nice setup documentation at sun's bigadmin site, look at the following url: http://www.sun.com/bigadmin/features/articles/syslog_ng.html syslog-ng has a debug/verbose startup mode which You should use until You have a basic environment up and running. Florian

1 0

how to start the syslog-ng
by wayne yu 21 Apr '06

21 Apr '06

Hi: I'm new to syslog-ng. I need help on configuring the syslog-ng. I already installed syslog-ng pkg to my solaris 8 computer, but I can't find syslog-ng.conf file or demeaon. Thanks in advance for any comments. Wayne __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

RE: [syslog-ng] HUP does not work
by Lumir Unzeitig (DHL CZ) 21 Apr '06

21 Apr '06

Good idea. Thanks for your tip! -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Kevin Sent: Thursday, April 20, 2006 5:08 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] HUP does not work On 4/20/06, Lumir Unzeitig (DHL CZ) <lumir.unzeitig(a)dhl.com> wrote: > The problem is: A central syslog server logs huge number of maillog > messages from a server. HUP signal is sent to the syslog-ng in > postrotate instructions when logrotate runs. All log files are rotated > properly except maillog. The old maillog messages are in the proper > file, but no new file is created and thus nothing is logged for the > facility . When I stop/start syslog-ng daemon it's working good. Personally, instead of using 'logrotate' I configure syslog-ng to name the 'destination' file as the hour of day and day of week, and let it automatically create new files on the hour. For example: file("/var/log/mail/$WEEKDAY/$HOUR" remove_if_older(172800) ); If you only need today's log messages on hand, you could do: file("/var/log/mail/$HOUR" remove_if_older(7200) ); Kevin _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0