July 2006 - syslog-ng - lists.balabit.hu

Rick Daoust is out of the office - Rick Daoust est hors du bureau
by Rick.Daoust＠borealc.on.ca 24 Jul '06

24 Jul '06

I will be out of the office starting 24/07/2006 and will not return until 31/07/2006. Je serai hors du bureau à partir de lundi le 24 juillet 2006 et retournerai que lundi le 31 juillet 2006!

1 0

Re: syslog-ng Digest, Vol 15, Issue 18
by dwarnock＠harbrook.net 24 Jul '06

24 Jul '06

I am on holiday from the 17th August returning on Monday the 31st August. If your query is urgent please contact the office on +44 (0)1423 508060 or Neil Harvey on +44 (0)15395 64734 (nharvey(a)harbrook.net) Regards David Warnock

1 0

Re: syslog-ng Digest, Vol 15, Issue 17
by dwarnock＠harbrook.net 23 Jul '06

23 Jul '06

I am on holiday from the 17th August returning on Monday the 31st August. If your query is urgent please contact the office on +44 (0)1423 508060 or Neil Harvey on +44 (0)15395 64734 (nharvey(a)harbrook.net) Regards David Warnock

1 0

Re: syslog-ng Digest, Vol 15, Issue 16
by dwarnock＠harbrook.net 22 Jul '06

22 Jul '06

I am on holiday from the 17th August returning on Monday the 31st August. If your query is urgent please contact the office on +44 (0)1423 508060 or Neil Harvey on +44 (0)15395 64734 (nharvey(a)harbrook.net) Regards David Warnock

1 0

Re: syslog-ng Digest, Vol 15, Issue 14
by dwarnock＠harbrook.net 21 Jul '06

21 Jul '06

I am on holiday from the 17th August returning on Monday the 31st August. If your query is urgent please contact the office on +44 (0)1423 508060 or Neil Harvey on +44 (0)15395 64734 (nharvey(a)harbrook.net) Regards David Warnock

1 0

Logrotate Questions And Solicitation For Ideas...
by Vadim Pushkin 20 Jul '06

20 Jul '06

Hello All; I've got a syslog-1.6.9 server running quite well with phpsyslog-ng. I am trying to rotate my logs and maintain just 14 days worth of logs within my MySql DB, an issue that I am having and will hopefully get fixed within the phpSyslog-NG group. With regards to flat file logs, the issue that I am writing here for, I wish to have 30 days worth of data within my log files (flat files under /var/log). The problem that I am having is rotating under syslog-ng, *NOT* MySql. Can anyone please provide me with a good method for rotating logs, where my logs are kept under various subdirs, depending on source address? Attached is my syslog-ng.conf, in case anyone cares to read it to determine what my dir-layouts are, also I am looking for help on why some of my source hosts are getting into two locations, I am sure that it is bacause of the "filter" rules in my config. Does the below make sense? # Trying to make all hosts that start with sw or contain sw1, or sw2, # get placed where filter F_switch should go. filter F_switch { host("sw*") or host("sw1") or host("sw2"); }; # Trying to place logs for all hosts that start with fw to go to where filter F_firewall should go. filter F_firewall { host("^fw*"); }; Please, I am sorry for this question if it is in the FAQ, I am having problem finding this info. Thank you all! .vp

7 12

Feature Request: conf.d-like folders or include statement
by JP Senior 19 Jul '06

19 Jul '06

I'm finding that I'm in need of a recursive conf.d-like configuration folder for syslog-ng. The reason I'm asking this is because I have many hosts, each requiring a separate configuration from the other, and my syslog-ng.conf file is getting pretty large, messy, and unmanageable. If it could iterate/enumerate /etc/syslog-ng/conf.d and add each of those to the 'running' config, that would be amazing. I think this could also work, in a less versatile function, by an 'include' statement in syslog-ng.conf. Ie: include { includefile(/etc/syslog-ng/extra/hostname.conf); }; Am I on the right track, or is there a function to do this? :) -JP Senior

2 1

Re: syslog-ng Digest, Vol 15, Issue 10
by dwarnock＠harbrook.net 19 Jul '06

19 Jul '06

I am on holiday from the 17th August returning on Monday the 31st August. If your query is urgent please contact the office on +44 (0)1423 508060 or Neil Harvey on +44 (0)15395 64734 (nharvey(a)harbrook.net) Regards David Warnock

1 0

why this messages from syslog?
by Maurizio B 18 Jul '06

18 Jul '06

why I get this messages from syslog-ng 2.0rc1? Log statistics; processed='source(s_local)=19', processed='source(s_remote)=0', processed='destination(dsl_console)=0', processed='destination(dsl_maillog)=0', processed='destination(ds_emerg)=0', processed='destination(ds_alert)=0', processed='destination(df_uucp)=0', processed='destination(ds_err)=0', processed='destination(dfs_err)=0', processed='destination(dsl_messages)=16', processed='destination(dfs_crit)=0', is it a misconfiguration? thanks in advance

2 1

Re: Logging to program destinations has odd prefix?
by John Caruso 16 Jul '06

16 Jul '06

At Friday 11:14 AM 9/17/2004, Balazs Scheidler wrote: >On Thu, 2004-09-16 at 19:36, Lars Kellogg-Stedman wrote: >> Text logged to a program via the program() destination has a prefix of the >> form <nnn>, which I'm assuming is the encoding of the syslog level and >> facility. Great! But I don't want it :). >> >> Is there any way to prevent this text from being logged? Sure, I can write >> a "wrapper" program to edit these messages before they reach the intended >> destination, but my template doesn't ask for this information, so I'm not >> sure it should be there. > >I think this was fixed in one of the recent versions. I just ran into this bug while using syslog-ng 1.6.0rc1 with a program destination on a Solaris system. After finding the above discussion from 2004 I upgraded to 1.6.11...but the bug is still there. Here are some samples of lines handed off from syslog-ng to the external program: <6>Jul 7 14:53:50 sys1 kernel: SysRq : Emergency Sync <4>Jul 7 14:53:50 sys1 kernel: Emergency Sync complete <6>Jul 7 14:53:51 sys2 kernel: SELinux: initialized (dev 0:15, type nfs), uses genfs_contexts I'm getting around this by editing out the prefix, but it would be good if this were fixed in syslog-ng itself. - John

2 7