June 2006 - syslog-ng - lists.balabit.hu

Syslog-ng not logging anything from Solaris host
by Shah, Maunir 16 Jun '06

16 Jun '06

I'm running syslog-ng 1.6.11 on Solaris 10 zone, and so far I'm able to see logs being created locally but I'm not seeing any kind of logging from other Solaris host. For my syslog-ng server I made sure that I'm using udp and for source its door. I've two test servers running Solaris 8 and 10 that I'm testing from and have changed syslog.conf to reflect the changes and point all my logs to go to syslog-ng. It's not the firewall that is blocking it as we are able to telnet to port 514 and whatever you type in the cmd prompt it records it on the syslog-ng server. I know I'm missing something in the config file but not sure what I'm doing wrong. My syslog-ng.conf file source s_dgram { sun-streams ("/dev/log" door("/etc/.syslog_door")); }; source s_internal { internal(); }; #source s_kernel # { pipe("/proc/kmsg" log_prefix("kernel: ")); }; #source s_tcp # { tcp(ip(10.1.100.84)port(514) keep-alive(yes) max_connections(100)); }; source s_udp { udp(); }; Solaris 8 box syslog.conf file #ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */ # # Copyright (c) 1991-1998 by Sun Microsystems, Inc. # All rights reserved. # # syslog configuration file. # # This file is processed by m4 so be careful to quote (`') names # that match m4 reserved words. Also, within ifdef's, arguments # containing commas must be quoted. # *.* @loghost Maunir Shah 630-285-5875 - desk 630-550-6266 - cell ******************************* IMPORTANT MESSAGE ****************************** This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you. ********************************************************************************

3 2

Re: syslog-ng Digest, Vol 14, Issue 11
by wayne yu 16 Jun '06

16 Jun '06

Hi Alex: How can I configure the logdog to send e-mail, through logdog.conf? Can you show me an example? I configured logdog.conf file, but when I started with logdog.pl -d , and went back to look at logdog.conf, it was back to its original form. Thanks Wayne --- syslog-ng-request(a)lists.balabit.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, > visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body > 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it > is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. RE: Re: syslog-ng Digest, Vol 14, Issue 9 > (SOLIS, ALEX) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 15 Jun 2006 08:44:42 -0500 > From: "SOLIS, ALEX" <asolis(a)oppd.com> > Subject: RE: [syslog-ng] Re: syslog-ng Digest, Vol > 14, Issue 9 > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > > <3E061654BA925846A7FAFE98BA3603B71714C7E9(a)SEPEX04.oppd.oppd-ds.com> > Content-Type: text/plain; charset="us-ascii" > > Wyane, > > Of course logdog.pl works with syslog-ng. > > The config file example sent in the tarball is > generously commented. If > you need more help, let me know where in the > installation you are at and > what you want logdog to do and Ill try to help. > > Alex > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On > Behalf Of wayne yu > Sent: Wednesday, June 14, 2006 2:30 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Re: syslog-ng Digest, Vol 14, > Issue 9 > > Hi Alex: > The logdog works for the syslogd, does also > working > with syslog-ng? How do I configure it? > > Thanks > > Wayne Yu > > --- syslog-ng-request(a)lists.balabit.hu wrote: > > > Send syslog-ng mailing list submissions to > > syslog-ng(a)lists.balabit.hu > > > > To subscribe or unsubscribe via the World Wide > Web, > > visit > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > or, via email, send a message with subject or body > > 'help' to > > syslog-ng-request(a)lists.balabit.hu > > > > You can reach the person managing the list at > > syslog-ng-owner(a)lists.balabit.hu > > > > When replying, please edit your Subject line so it > > is more specific > > than "Re: Contents of syslog-ng digest..." > > > > > > Today's Topics: > > > > 1. Losing TAG information (SOLIS, ALEX) > > 2. how to send alert throuth e-mail with > > syslog-ng (wayne yu) > > 3. RE: how to send alert throuth e-mail with > > syslog-ng (SOLIS, ALEX) > > 4. Re: how to send alert throuth e-mail with > > syslog-ng (sawall) > > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Tue, 13 Jun 2006 10:07:33 -0500 > > From: "SOLIS, ALEX" <asolis(a)oppd.com> > > Subject: [syslog-ng] Losing TAG information > > To: "Syslog-ng users' and developers' mailing > list" > > <syslog-ng(a)lists.balabit.hu> > > Message-ID: > > > > > <3E061654BA925846A7FAFE98BA3603B71714C401(a)SEPEX04.oppd.oppd-ds.com> > > Content-Type: text/plain; charset="us-ascii" > > > > > > I have about 20 or so AIX 4.3 servers that are > > sending syslog messages > > to a Linux desktop running syslog-ng 1.6.5. Every > > now and then I get a > > message that does not contain the TAG information > or > > process ID > > information. When I check the local > > /var/adm/messages file on the AIX > > server, the TAG information is intact. > > > > An example of an intact message on an AIX server > is: > > > > Jun 13 09:57:11 myhost dbc4 : 3 TRANSACT > > > 0 0 > > 33686 57:11.60 > > > > > > An example of the same message on my syslog server > > after syslog-ng gets > > a hold of it: > > > > Jun 13 09:57:11 myhost : 3 TRANSACT 0 > > > 0 33686 > > 57:11.60 > > > > > > As you can see I am losing the dbc4, why? Could > it > > be because of the > > spaces after the dbc4 string? According to RFC > > 3164, a space should > > simply terminate the TAG field and begin the > content > > portion of the > > message. Am I misunderstanding how this works? > > > > > > Thanks > > > > > > Alex > > > > > > This e-mail contains Omaha Public Power District's > > confidential and proprietary information and is > for > > use only by the intended recipient. Unless > > explicitly stated otherwise, this e-mail is not a > > contract offer, amendment, nor acceptance. If you > > are not the intended recipient you are notified > that > > disclosing, copying, distributing or taking any > > action in reliance on the contents of this > > information is strictly prohibited. > > > > > > > > ------------------------------ > > > > Message: 2 > > Date: Tue, 13 Jun 2006 12:19:46 -0700 (PDT) > > From: wayne yu <zwyu7319(a)yahoo.com> > > Subject: [syslog-ng] how to send alert throuth > > e-mail with syslog-ng > > To: syslog-ng(a)lists.balabit.hu > > Message-ID: > > > <20060613191946.39833.qmail(a)web35910.mail.mud.yahoo.com> > > Content-Type: text/plain; charset=iso-8859-1 > > > > Hi everyone: > > > > I like to thank those who helped me on the > > syslog-ng > > earlier, and my syslog-ng is finally working, > > except I don't know how to send alerts from system > > to > > my yahoo mail. Can any one give me some hints. > === message truncated === __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

RE: [syslog-ng] Re: syslog-ng Digest, Vol 14, Issue 9
by SOLIS, ALEX 15 Jun '06

15 Jun '06

Wyane, Of course logdog.pl works with syslog-ng. The config file example sent in the tarball is generously commented. If you need more help, let me know where in the installation you are at and what you want logdog to do and Ill try to help. Alex -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of wayne yu Sent: Wednesday, June 14, 2006 2:30 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Re: syslog-ng Digest, Vol 14, Issue 9 Hi Alex: The logdog works for the syslogd, does also working with syslog-ng? How do I configure it? Thanks Wayne Yu --- syslog-ng-request(a)lists.balabit.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, > visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body > 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it > is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Losing TAG information (SOLIS, ALEX) > 2. how to send alert throuth e-mail with > syslog-ng (wayne yu) > 3. RE: how to send alert throuth e-mail with > syslog-ng (SOLIS, ALEX) > 4. Re: how to send alert throuth e-mail with > syslog-ng (sawall) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 13 Jun 2006 10:07:33 -0500 > From: "SOLIS, ALEX" <asolis(a)oppd.com> > Subject: [syslog-ng] Losing TAG information > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > > <3E061654BA925846A7FAFE98BA3603B71714C401(a)SEPEX04.oppd.oppd-ds.com> > Content-Type: text/plain; charset="us-ascii" > > > I have about 20 or so AIX 4.3 servers that are > sending syslog messages > to a Linux desktop running syslog-ng 1.6.5. Every > now and then I get a > message that does not contain the TAG information or > process ID > information. When I check the local > /var/adm/messages file on the AIX > server, the TAG information is intact. > > An example of an intact message on an AIX server is: > > Jun 13 09:57:11 myhost dbc4 : 3 TRANSACT > 0 0 > 33686 57:11.60 > > > An example of the same message on my syslog server > after syslog-ng gets > a hold of it: > > Jun 13 09:57:11 myhost : 3 TRANSACT 0 > 0 33686 > 57:11.60 > > > As you can see I am losing the dbc4, why? Could it > be because of the > spaces after the dbc4 string? According to RFC > 3164, a space should > simply terminate the TAG field and begin the content > portion of the > message. Am I misunderstanding how this works? > > > Thanks > > > Alex > > > This e-mail contains Omaha Public Power District's > confidential and proprietary information and is for > use only by the intended recipient. Unless > explicitly stated otherwise, this e-mail is not a > contract offer, amendment, nor acceptance. If you > are not the intended recipient you are notified that > disclosing, copying, distributing or taking any > action in reliance on the contents of this > information is strictly prohibited. > > > > ------------------------------ > > Message: 2 > Date: Tue, 13 Jun 2006 12:19:46 -0700 (PDT) > From: wayne yu <zwyu7319(a)yahoo.com> > Subject: [syslog-ng] how to send alert throuth > e-mail with syslog-ng > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <20060613191946.39833.qmail(a)web35910.mail.mud.yahoo.com> > Content-Type: text/plain; charset=iso-8859-1 > > Hi everyone: > > I like to thank those who helped me on the > syslog-ng > earlier, and my syslog-ng is finally working, > except I don't know how to send alerts from system > to > my yahoo mail. Can any one give me some hints. > > Thanks for the help. > > Wayne Yu > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam > protection around > http://mail.yahoo.com > > > ------------------------------ > > Message: 3 > Date: Tue, 13 Jun 2006 14:53:28 -0500 > From: "SOLIS, ALEX" <asolis(a)oppd.com> > Subject: RE: [syslog-ng] how to send alert throuth > e-mail with > syslog-ng > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > > <3E061654BA925846A7FAFE98BA3603B71714C508(a)SEPEX04.oppd.oppd-ds.com> > Content-Type: text/plain; charset="us-ascii" > > I use a perl script called logdog to alert on > specific syslog events. > You can find the script here: > http://caspian.dotconf.net/menu/Software/LogDog/ > > Works good for me, check it out. > > Alex > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On > Behalf Of wayne yu > Sent: Tuesday, June 13, 2006 2:20 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] how to send alert throuth > e-mail with syslog-ng > > Hi everyone: > > I like to thank those who helped me on the > syslog-ng > earlier, and my syslog-ng is finally working, > except I don't know how to send alerts from system > to > my yahoo mail. Can any one give me some hints. > > Thanks for the help. > > Wayne Yu > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam > protection around > http://mail.yahoo.com > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > This e-mail contains Omaha Public Power District's > confidential and proprietary information and is for > use only by the intended recipient. Unless > explicitly stated otherwise, this e-mail is not a > contract offer, amendment, nor acceptance. If you > are not the intended recipient you are notified that > disclosing, copying, distributing or taking any > action in reliance on the contents of this > information is strictly prohibited. > > > > ------------------------------ > > === message truncated === __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Re: syslog-ng Digest, Vol 14, Issue 9
by wayne yu 14 Jun '06

14 Jun '06

Hi: I got Jun 13 22:30:58 bestball3 syslog-ng[17783]: STATS: dropped 0 in my in my log , I don't know what is mean. ALso, How could I set up a central log file, insteas i have to open 20 directory(name after node name) . Thanks for reply. Wayne Yu syslog-ng-request(a)lists.balabit.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, > visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body > 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it > is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Losing TAG information (SOLIS, ALEX) > 2. how to send alert throuth e-mail with > syslog-ng (wayne yu) > 3. RE: how to send alert throuth e-mail with > syslog-ng (SOLIS, ALEX) > 4. Re: how to send alert throuth e-mail with > syslog-ng (sawall) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 13 Jun 2006 10:07:33 -0500 > From: "SOLIS, ALEX" <asolis(a)oppd.com> > Subject: [syslog-ng] Losing TAG information > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > > <3E061654BA925846A7FAFE98BA3603B71714C401(a)SEPEX04.oppd.oppd-ds.com> > Content-Type: text/plain; charset="us-ascii" > > > I have about 20 or so AIX 4.3 servers that are > sending syslog messages > to a Linux desktop running syslog-ng 1.6.5. Every > now and then I get a > message that does not contain the TAG information or > process ID > information. When I check the local > /var/adm/messages file on the AIX > server, the TAG information is intact. > > An example of an intact message on an AIX server is: > > Jun 13 09:57:11 myhost dbc4 : 3 TRANSACT > 0 0 > 33686 57:11.60 > > > An example of the same message on my syslog server > after syslog-ng gets > a hold of it: > > Jun 13 09:57:11 myhost : 3 TRANSACT 0 > 0 33686 > 57:11.60 > > > As you can see I am losing the dbc4, why? Could it > be because of the > spaces after the dbc4 string? According to RFC > 3164, a space should > simply terminate the TAG field and begin the content > portion of the > message. Am I misunderstanding how this works? > > > Thanks > > > Alex > > > This e-mail contains Omaha Public Power District's > confidential and proprietary information and is for > use only by the intended recipient. Unless > explicitly stated otherwise, this e-mail is not a > contract offer, amendment, nor acceptance. If you > are not the intended recipient you are notified that > disclosing, copying, distributing or taking any > action in reliance on the contents of this > information is strictly prohibited. > > > > ------------------------------ > > Message: 2 > Date: Tue, 13 Jun 2006 12:19:46 -0700 (PDT) > From: wayne yu <zwyu7319(a)yahoo.com> > Subject: [syslog-ng] how to send alert throuth > e-mail with syslog-ng > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <20060613191946.39833.qmail(a)web35910.mail.mud.yahoo.com> > Content-Type: text/plain; charset=iso-8859-1 > > Hi everyone: > > I like to thank those who helped me on the > syslog-ng > earlier, and my syslog-ng is finally working, > except I don't know how to send alerts from system > to > my yahoo mail. Can any one give me some hints. > > Thanks for the help. > > Wayne Yu > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam > protection around > http://mail.yahoo.com > > > ------------------------------ > > Message: 3 > Date: Tue, 13 Jun 2006 14:53:28 -0500 > From: "SOLIS, ALEX" <asolis(a)oppd.com> > Subject: RE: [syslog-ng] how to send alert throuth > e-mail with > syslog-ng > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > > <3E061654BA925846A7FAFE98BA3603B71714C508(a)SEPEX04.oppd.oppd-ds.com> > Content-Type: text/plain; charset="us-ascii" > > I use a perl script called logdog to alert on > specific syslog events. > You can find the script here: > http://caspian.dotconf.net/menu/Software/LogDog/ > > Works good for me, check it out. > > Alex > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On > Behalf Of wayne yu > Sent: Tuesday, June 13, 2006 2:20 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] how to send alert throuth > e-mail with syslog-ng > > Hi everyone: > > I like to thank those who helped me on the > syslog-ng > earlier, and my syslog-ng is finally working, > except I don't know how to send alerts from system > to > my yahoo mail. Can any one give me some hints. > > Thanks for the help. > > Wayne Yu > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam > protection around > http://mail.yahoo.com > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > This e-mail contains Omaha Public Power District's > confidential and proprietary information and is for > use only by the intended recipient. Unless > explicitly stated otherwise, this e-mail is not a > contract offer, amendment, nor acceptance. If you > are not the intended recipient you are notified that > disclosing, copying, distributing or taking any > action in reliance on the contents of this > information is strictly prohibited. > > > > ------------------------------ > > === message truncated === __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Re: syslog-ng Digest, Vol 14, Issue 9
by wayne yu 14 Jun '06

14 Jun '06

Hi Alex: The logdog works for the syslogd, does also working with syslog-ng? How do I configure it? Thanks Wayne Yu --- syslog-ng-request(a)lists.balabit.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, > visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body > 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it > is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Losing TAG information (SOLIS, ALEX) > 2. how to send alert throuth e-mail with > syslog-ng (wayne yu) > 3. RE: how to send alert throuth e-mail with > syslog-ng (SOLIS, ALEX) > 4. Re: how to send alert throuth e-mail with > syslog-ng (sawall) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 13 Jun 2006 10:07:33 -0500 > From: "SOLIS, ALEX" <asolis(a)oppd.com> > Subject: [syslog-ng] Losing TAG information > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > > <3E061654BA925846A7FAFE98BA3603B71714C401(a)SEPEX04.oppd.oppd-ds.com> > Content-Type: text/plain; charset="us-ascii" > > > I have about 20 or so AIX 4.3 servers that are > sending syslog messages > to a Linux desktop running syslog-ng 1.6.5. Every > now and then I get a > message that does not contain the TAG information or > process ID > information. When I check the local > /var/adm/messages file on the AIX > server, the TAG information is intact. > > An example of an intact message on an AIX server is: > > Jun 13 09:57:11 myhost dbc4 : 3 TRANSACT > 0 0 > 33686 57:11.60 > > > An example of the same message on my syslog server > after syslog-ng gets > a hold of it: > > Jun 13 09:57:11 myhost : 3 TRANSACT 0 > 0 33686 > 57:11.60 > > > As you can see I am losing the dbc4, why? Could it > be because of the > spaces after the dbc4 string? According to RFC > 3164, a space should > simply terminate the TAG field and begin the content > portion of the > message. Am I misunderstanding how this works? > > > Thanks > > > Alex > > > This e-mail contains Omaha Public Power District's > confidential and proprietary information and is for > use only by the intended recipient. Unless > explicitly stated otherwise, this e-mail is not a > contract offer, amendment, nor acceptance. If you > are not the intended recipient you are notified that > disclosing, copying, distributing or taking any > action in reliance on the contents of this > information is strictly prohibited. > > > > ------------------------------ > > Message: 2 > Date: Tue, 13 Jun 2006 12:19:46 -0700 (PDT) > From: wayne yu <zwyu7319(a)yahoo.com> > Subject: [syslog-ng] how to send alert throuth > e-mail with syslog-ng > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <20060613191946.39833.qmail(a)web35910.mail.mud.yahoo.com> > Content-Type: text/plain; charset=iso-8859-1 > > Hi everyone: > > I like to thank those who helped me on the > syslog-ng > earlier, and my syslog-ng is finally working, > except I don't know how to send alerts from system > to > my yahoo mail. Can any one give me some hints. > > Thanks for the help. > > Wayne Yu > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam > protection around > http://mail.yahoo.com > > > ------------------------------ > > Message: 3 > Date: Tue, 13 Jun 2006 14:53:28 -0500 > From: "SOLIS, ALEX" <asolis(a)oppd.com> > Subject: RE: [syslog-ng] how to send alert throuth > e-mail with > syslog-ng > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > > <3E061654BA925846A7FAFE98BA3603B71714C508(a)SEPEX04.oppd.oppd-ds.com> > Content-Type: text/plain; charset="us-ascii" > > I use a perl script called logdog to alert on > specific syslog events. > You can find the script here: > http://caspian.dotconf.net/menu/Software/LogDog/ > > Works good for me, check it out. > > Alex > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On > Behalf Of wayne yu > Sent: Tuesday, June 13, 2006 2:20 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] how to send alert throuth > e-mail with syslog-ng > > Hi everyone: > > I like to thank those who helped me on the > syslog-ng > earlier, and my syslog-ng is finally working, > except I don't know how to send alerts from system > to > my yahoo mail. Can any one give me some hints. > > Thanks for the help. > > Wayne Yu > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam > protection around > http://mail.yahoo.com > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > This e-mail contains Omaha Public Power District's > confidential and proprietary information and is for > use only by the intended recipient. Unless > explicitly stated otherwise, this e-mail is not a > contract offer, amendment, nor acceptance. If you > are not the intended recipient you are notified that > disclosing, copying, distributing or taking any > action in reliance on the contents of this > information is strictly prohibited. > > > > ------------------------------ > > === message truncated === __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

RE: [syslog-ng] how to send alert throuth e-mail with syslog-ng
by SOLIS, ALEX 13 Jun '06

13 Jun '06

I use a perl script called logdog to alert on specific syslog events. You can find the script here: http://caspian.dotconf.net/menu/Software/LogDog/ Works good for me, check it out. Alex -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of wayne yu Sent: Tuesday, June 13, 2006 2:20 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] how to send alert throuth e-mail with syslog-ng Hi everyone: I like to thank those who helped me on the syslog-ng earlier, and my syslog-ng is finally working, except I don't know how to send alerts from system to my yahoo mail. Can any one give me some hints. Thanks for the help. Wayne Yu __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

how to send alert throuth e-mail with syslog-ng
by wayne yu 13 Jun '06

13 Jun '06

Hi everyone: I like to thank those who helped me on the syslog-ng earlier, and my syslog-ng is finally working, except I don't know how to send alerts from system to my yahoo mail. Can any one give me some hints. Thanks for the help. Wayne Yu __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Losing TAG information
by SOLIS, ALEX 13 Jun '06

13 Jun '06

I have about 20 or so AIX 4.3 servers that are sending syslog messages to a Linux desktop running syslog-ng 1.6.5. Every now and then I get a message that does not contain the TAG information or process ID information. When I check the local /var/adm/messages file on the AIX server, the TAG information is intact. An example of an intact message on an AIX server is: Jun 13 09:57:11 myhost dbc4 : 3 TRANSACT 0 0 33686 57:11.60 An example of the same message on my syslog server after syslog-ng gets a hold of it: Jun 13 09:57:11 myhost : 3 TRANSACT 0 0 33686 57:11.60 As you can see I am losing the dbc4, why? Could it be because of the spaces after the dbc4 string? According to RFC 3164, a space should simply terminate the TAG field and begin the content portion of the message. Am I misunderstanding how this works? Thanks Alex This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

max-connections or max_connections
by Mike Jonkmans 12 Jun '06

12 Jun '06

I have noticed that 'max_connections' gets accepted by syslog-ng. But it is not working as intended. It should have a minus instead of an underscore. As it is easily overlooked, i think this is something the code should either accept or complain about. Regards, Mike Jonkmans News-Service Europe (http://www.news-service.com)

2 2

syslog-ng 1.9.11 vs RHE
by David Royer 12 Jun '06

12 Jun '06

Hi, I recently compiled syslog-ng 1.9.11, properly linked and compiled eventlog-0.2.4 and the process seems stable / properly working. Although I have seen a very weird behaviour, maybe I'm just missing something obvious (well hopefully in fact). The configuration line: filter f_filter2 { level(debug,info,notice,warning,err,crit,alert,emerg); }; works very fine, f_filter2 is used here to filter the /var/log/messages. All levels are being properly logged in the file. The configuration line: filter f_filter2 { level(debug..emerg); }; just doesn't work. I hope it's only a syntax issue, hopefully some of you encountered the problem already. Using logger I was able to test which level was logged using that config line and only these levels properly log: debug, emerg. Nothing in between. Is the (..) syntax still supported in syslog-ng 1.9+ ? Thanks in advance, -David

2 1