June 2006 - syslog-ng - lists.balabit.hu

Growing log files (i.e. access.log) and regex.
by Robert.Becker＠motoristsgroup.com 08 Mar '07

08 Mar '07

Here's the scenario. We have a JBoss server that outputs to *.log files. After doing all the research I could, I found out the only way to get these logs sent to syslog-ng was through a tail & logger command. The problem with that is logger appends the date and some other information to that logged message. When attempting to put that information in a mysql database I'm getting errors. So, what I would like to do is use some form of regex to alter the statement so it can be inserted into a database. There are basically two things that need to be changed. First, logger appends the date/time it receives the message and it also says it is coming from logger. I would like to remove that date and switch logger to jboss or something similar. Here is an example of what I am doing. This is a line from the jboss log file: 2005-10-11 13:14:15,848 DEBUG [org.jboss.resource.connectionmanager.IdleRemover] run: IdleRemover notifying pools, interval: 450000 Then I send the log through logger to syslog-ng: #!/bin/sh tail -f /opt/jboss/server/default/log/boot.log | logger -p local7.info The log gets turned into this: Oct 11 13:14:15 src@linuxp17 logger: 2005-10-11 13:14:15,848 DEBUG [org.jboss.resource.connectionmanager.IdleRemover] run: IdleRemover notifying pools, interval: 450000 What I need is: Oct 11 13:14:15 src@linuxp17 jboss: DEBUG [org.jboss.resource.connectionmanager.IdleRemover] run: IdleRemover notifying pools, interval: 450000 Now, I've thought of using awk in the tail/logger script to remove the date, but that does not take care of the logger/jboss substitution. Anyone have any ideas? Can syslog-ng do this with the match() function? -Rob Becker Systems Engineer Motorists Insurance ********************************************************************** The information contained in this message is confidential and is intended for the addressee(s) only. If you have received this message in error or there are any problems please notify the originator immediately. The unauthorized use, disclosure, copying or alteration of this message is strictly forbidden. Motorists Insurance Group will not be liable for direct, special, indirect or consequential damages arising from the alteration of the contents of this message by a third party or as a result of any virus being passed on. **********************************************************************

6 5

Analysis of logs and alerting
by Muath Al Khalaf 11 Feb '07

11 Feb '07

Hi, I am implementing a syslog-ng centralized correlation server. The server receives the log entries from some servers, apps and devices. Is there any good product (commercial or open-source) with GUI or web interface to analyze these logs and give real time alerts with strong data mining tools? I need a tool which could be used by both help desk non-technical staff and technical engineers. It should give basic alerting on applications' or devices' failures first for help desk, and then engineers could dig deeper into these alerts to understand the problem. Kind regards

4 3

ignore src{}; contents at startup?
by Brian A. Seklecki 25 Oct '06

25 Oct '06

All: On FreeBSD, /dev/klog provides for output from the kernel (normally redirected to /dev/console before syslog starts). At startup, /etc/rc.d/dmesg copies the kernel boot hardware paramters to /var/run/dmesg.boot. If I have my src(); set to: source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; ...at starup, syslog-ng drains the contents of /dev/klog. By default it tsends to them to user.notice. I like to log{} these to an SMS pager (so I know if a RAID is failing or other hardware problem). However, I'd like to avoid duplication of the efforts of /etc/rc.d/dmesg on behalf of syslog-ng(8) ...especially since I route user.notice to my pager, and kernel boot dmesg(8) can grow over 50 lines. /dev/klog really isn't a socket. It's a special char device. Is there anyway to tell syslog-ng(8) to ignore it's contents at startup? If it was tail(1), i'd say "tail -0 -f /file". Perhaps clear out the contents of /dev/klog somehow? TIA, ~BAS

2 2

$MSG parsing question
by Hubert Lang 08 Aug '06

08 Aug '06

Hello, i have a few questions about the message parser, basically i want to parse/split up the MESSAGE field itself and write the splitted up message in a mysql database, i cant find any documents about how this can be done, do i need an external parser (perl or whatever) or can this be done within syslog-ng.conf? right now i just can write the whole message to the mysqldb syslog-ng.conf template("INSERT INTO logs (host, facility, priority, level, tag, date,time, program, msg) VALUES ( '$HOST', '$FACILITY','$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); so it gets written to the database in this way: INSERT INTO logs (host, facility, priority, level, tag, date,time, program, msg) VALUES ( '10.44.10.253', 'local4','notice', 'notice', 'a5', '2006-06-29', '14:39:46', 'NS25', 'NS25: NetScreen device_id=NS25 [Root]system-notification-00257(traffic): start_time=\"2006-06-29 14:38:38\" duration=0 policy_id=95 service=http proto=6 src zone=Untrust dst zone=Untrust action=Deny sent=0 rcvd=0 src=10.10.10.225 dst=208.174.52.61 src_port=2042 dst_port=80 session_id=0' ); now i want to split up the message part itself system-notification traffic, insert the start_time/duration/policy_id/service/proto/src-zone etc etc in a different table this perl script http://www.optekconsulting.com/tools/nstf.pl has every field i need, Any Help is really welcome Cheers Hubert -- Die e-Mail-Boxes von Brennercom sind Virus-gesichert und Spam-gefiltert. Le caselle e-Mail di Brennercom sono protette da sistemi antivirus e antispam. http://www.brennercom.it

5 5

filter on level don't work with kernel source
by Olleg Samoylov 14 Jul '06

14 Jul '06

$ syslog-ng --version syslog-ng 1.9.9 subj from syslog-ng.conf: source s_all { # message generated by Syslog-NG internal(); # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); }; filter f_at_least_crit { level(crit..emerg); }; log { source(s_all); filter(f_at_least_crit); destination(d_email2root); }; And I get emails like: Date: 2006-04-05T14:59:23+04:00 Facility: kern Level: debug Program: kernel ISO 9660 Extensions: Microsoft Joliet Level 3 Date: 2006-04-05T14:59:23+04:00 Facility: kern Level: debug Program: kernel ISO 9660 Extensions: Microsoft Joliet Level 3 -- Olleg Samoylov

2 2

Problems compiling syslog-ng 1.6.11 on sparc running Solaris 10
by Stuart_Weaver＠ElementK.com 10 Jul '06

10 Jul '06

Hello. I am trying to build syslog-ng version 1.6.11 (I have also tried version 1.6.8 with the same results) on a sparc running Solaris 10 ( SunOS frylock 5.10 Generic_118833-17 sun4u sparc SUNW,Sun-Fire-V890 ). The output leads me to believe I may be missing a library. If anyone could help me out I would be very thankful. I am building with the following .... PATH=$PATH:/usr/elmk/bin:/usr/sfw/bin:/usr/ccs/bin:/usr/ucb export PATH CC=/usr/elmk/bin/gcc export CC cd libol-0.3.18 && ./configure && gmake && cd .. && ./configure --prefix=/usr/local --with-libol=./libol-0.3.18 -with-as=/usr/sfw/bin/gas --with-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld && gmake && gmake install The runtime linking environment looks as follows.... Default Library Path (ELF): /lib:/usr/lib:/usr/sfw/lib Trusted Directories (ELF): /lib/secure:/usr/lib/secure (system default) The build stops while trying to compile syslog-ng with the following output.... /usr/elmk/bin/gcc -g -O2 -Wall -I/src/solaris10/syslog-ng/syslog-ng-1.6.8/libol-0.3.18/src -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lpthread -lnsl -lsocket -ldoor -lresolv /src/solaris10/syslog-ng/syslog-ng-1.6.8/libol-0.3.18/src/.libs/libol.a -lsocket -lnsl -lxnet -Wl,-Bstatic -ll -Wl,-Bdynamic ld: fatal: library -ll: not found ld: fatal: File processing errors. No output written to syslog-ng collect2: ld returned 1 exit status gmake[3]: *** [syslog-ng] Error 1 gmake[3]: Leaving directory `/src/solaris10/syslog-ng/syslog-ng-1.6.8/src' gmake[2]: *** [all-recursive] Error 1 gmake[2]: Leaving directory `/src/solaris10/syslog-ng/syslog-ng-1.6.8/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/src/solaris10/syslog-ng/syslog-ng-1.6.8/src' gmake: *** [all-recursive] Error 1 gcc version is ... Using built-in specs. Target: sparc-sun-solaris2.10 Configured with: ./configure --prefix=/usr/elmk -with-as=/usr/sfw/bin/gas --with-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld --enable-languages=c,c++ --enable-shared Thread model: posix gcc version 4.1.1

2 2

segfaults with 1.9.x series syslog-ng and stream socket
by func tionate 30 Jun '06

30 Jun '06

I have written a sql stream socket daemon that for now is listening on /var/tmp/syslog-socket and passes inserts to child processes. Starting syslog-ng up with this socket as a destination on both the latest beta release and today's cvs of 1.9.x (2.0rc1) cause it to bomb out with a segfault. I have tested this both on an x86_64 linux gentoo amd64 box and a centos 4 i386 xeon box. I have used the same stream socket daemon with the latest 1.6 release and it has been reliable. I have configured syslog-ng and built it with stock ./configure. also, when i pull out the stream socket and associated config and start the daemon, everything works as expected. Below I've included the only deviations from the syslog-ng.conf RedHat config from the contrib directory (and the source definition for clarity), and an strace. Please let me know if there is any further info i can provide. (some cleansing of node names was done for obvious reasons) Regards, Chris source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination syslog-stream { unix-stream("/var/tmp/syslog-socket" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template_escape(yes) ) ; }; log { source(s_sys); destination(syslog-stream); }; root@host-1 [/usr/local/sbin] # /usr/bin/strace syslog-ng execve("/usr/local/sbin/syslog-ng", ["syslog-ng"], [/* 20 vars */]) = 0 uname({sys="Linux", node="host-1.domain.com", ...}) = 0 brk(0) = 0x934f000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=50262, ...}) = 0 old_mmap(NULL, 50262, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7ff3000 close(3) = 0 open("/lib/libnsl.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\320dH\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=95148, ...}) = 0 old_mmap(0x483000, 88064, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x483000 old_mmap(0x495000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x11000) = 0x495000 old_mmap(0x497000, 6144, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x497000 close(3) = 0 open("/lib/tls/librt.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\320P,\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=47671, ...}) = 0 old_mmap(0x2c3000, 81656, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2c3000 old_mmap(0x2cb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x2cb000 old_mmap(0x2cd000, 40696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2cd000 close(3) = 0 open("/lib/tls/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\20_\24"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1454546, ...}) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ff2000 old_mmap(0x131000, 1219772, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x131000 old_mmap(0x255000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x124000) = 0x255000 old_mmap(0x259000, 7356, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x259000 close(3) = 0 open("/lib/tls/libpthread.so.0", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0P\350)\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=93985, ...}) = 0 old_mmap(0x29a000, 70108, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x29a000 old_mmap(0x2a8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xd000) = 0x2a8000 old_mmap(0x2aa000, 4572, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2aa000 close(3) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ff1000 mprotect(0x255000, 4096, PROT_READ) = 0 mprotect(0x12d000, 4096, PROT_READ) = 0 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7ff16c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 munmap(0xb7ff3000, 50262) = 0 set_tid_address(0xb7ff1708) = 31245 rt_sigaction(SIGRTMIN, {0x29e380, [], SA_RESTORER|SA_SIGINFO, 0x2a5880}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {0x29e3f0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x2a5880}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM_INFINITY}) = 0 _sysctl({{CTL_KERN, KERN_VERSION, 0, 20d91, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, 2, 0xbfe4743c, 34, (nil), 0}) = 0 brk(0) = 0x934f000 brk(0x9370000) = 0x9370000 open("/etc/localtime", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=1267, ...}) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=1267, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fff000 read(3, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0"..., 4096) = 1267 close(3) = 0 munmap(0xb7fff000, 4096) = 0 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0 rt_sigaction(SIGHUP, {0x804a814, [], SA_RESTORER, 0x1588e8}, NULL, 8) = 0 rt_sigaction(SIGTERM, {0x804a824, [], SA_RESTORER, 0x1588e8}, NULL, 8) = 0 rt_sigaction(SIGINT, {0x804a824, [], SA_RESTORER, 0x1588e8}, NULL, 8) = 0 rt_sigaction(SIGCHLD, {0x804a84c, [], SA_RESTORER, 0x1588e8}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {0x804a834, [], SA_RESTORER|SA_ONESHOT, 0x1588e8}, NULL, 8) = 0 open("/etc/eventlog.conf", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/etc/syslog-ng.conf", O_RDONLY) = 3 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfe473f8) = -1 ENOTTY (Inappropriate ioctl for device) fstat64(3, {st_mode=S_IFREG|0644, st_size=3080, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fff000 read(3, "# syslog-ng configuration file.\n"..., 8192) = 3080 read(3, "", 4096) = 0 read(3, "", 8192) = 0 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfe46eb8) = -1 ENOTTY (Inappropriate ioctl for device) close(3) = 0 munmap(0xb7fff000, 4096) = 0 open("/proc/kmsg", O_RDONLY|O_NONBLOCK|O_NOCTTY|O_LARGEFILE) = 3 fcntl64(3, F_GETFD) = 0 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 4 fcntl64(4, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 stat64("/dev/log", {st_mode=S_IFSOCK|0666, st_size=0, ...}) = 0 unlink("/dev/log") = 0 bind(4, {sa_family=AF_FILE, path="/dev/log"}, 11) = 0 listen(4, 255) = 0 chmod("/dev/log", 0666) = 0 --- SIGSEGV (Segmentation fault) @ 0 (0) --- kill(31245, SIGSEGV) = 0 sigreturn() = ? (mask now []) --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 31245 detached root@host-1 [/usr/local/sbin] # ./syslog-ng --version syslog-ng 2.0rc1 root@host-1 [/usr/local/sbin] # uname -a Linux host-1.domain.com 2.6.9-11.ELsmp #1 SMP Wed Jun 8 17:54:20 CDT 2005 i686 i686 i386 GNU/Linux

3 4

Rick Daoust is out of the office - Rick Daoust est hors du bureau
by Rick.Daoust＠borealc.on.ca 28 Jun '06

28 Jun '06

I will be out of the office starting 26/06/2006 and will not return until 03/07/2006. Je serai hors du bureau à partir de lundi le 26 juin 2006 et retournerai que lundi le 3 juillet 2006!

1 0

using a logfile per host, with it's own name
by Jacco Rens 27 Jun '06

27 Jun '06

Hi List-members, I just started using syslog-ng, and I am still not confident with the technique to write the config files. What I basically want, is every host that send the udp syslog, to log in it's own file. Hereunder is what I have now, but that seems not to do the trick. Maybe there's an better technique for this? And I don't want the program, where '/var/log/HOSTS/$HOST/' is used. Best, Jacco options { use_dns(no); keep_hostname(yes); long_hostnames(off); sync(1); log_fifo_size(1024); create_dirs(yes); }; source src { udp(); }; # # ADSL logfiles # destination d_adsluitgeest { file("/var/log/routers/ adsluitgeest.log"); }; destination d_adslhaarlem { file("/var/log/routers/adslhaarlem.log"); }; destination d_adslbijenkorf { file("/var/log/routers/ adslbijenkorf.log"); }; destination d_adslcs { file("/var/log/routers/adslcs.log"); }; destination d_adslalkmaar { file("/var/log/routers/adslalkmaar.log"); }; # # ADSL filters # filter f_adsluitgeest { host(192.168.1.2); }; filter f_adslhaarlem { host(192.168.4.2); }; filter f_adslbijenkorf { host(192.168.3.2); }; filter f_adslcs { host(192.168.2.2); }; filter f_adslalkmaar { host(192.168.5.2); }; # # ADSL programs # log { source(src); filter(f_adsluitgeest); destination (d_adsluitgeest); }; log { source(src); filter(f_adslhaarlem); destination(d_adslhaarlem); }; log { source(src); filter(f_adslbijenkorf); destination (d_adslbijenkorf); }; log { source(src); filter(f_adslcs); destination(d_adslcs); }; log { source(src); filter(f_adslalkmaar); destination(d_adslalkmaar); };

1 0

facilities
by donjames 25 Jun '06

25 Jun '06

Hi, Where is the list of allowable facilities for use with syslog-ng? Sincerely, Don

2 1