February 2007 - syslog-ng - lists.balabit.hu

minor patch (maybe)
by Dhawal Doshy 07 Feb '07

07 Feb '07

Hello List, Am currently testing 2.0.2.. while building the RPM i noticed a broken dependency i.e. that of libevtlog-devel (which i though should be eventlog-devel). Here is a small patch, i would appreciate if the developers think this is not appropriate. [me@myhost rpms]# diff -u syslog-ng-2.0.2/syslog-ng.spec.bb syslog-ng.spec.bb --- syslog-ng-2.0.2/syslog-ng.spec.bb 2007-01-29 14:22:23.000000000 +0530 +++ syslog-ng.spec.bb 2007-02-03 18:23:30.000000000 +0530 @@ -12,7 +12,7 @@ Packager: Tamas Pal <folti(a)balabit.com> Vendor: Balabit IT Ltd. BuildRoot: %{_tmppath}/%{name}-root -BuildRequires: bison, flex, gcc-c++, pkgconfig, glib2-devel, libevtlog-devel +BuildRequires: bison, flex, gcc-c++, pkgconfig, glib2-devel, eventlog-devel Provides: syslog #BuildConflicts: #Exclusivearch: i386 - dhawal

2 2

problems compiling syslog-ng
by javier rojas 06 Feb '07

06 Feb '07

hello im trying to install syslog-ng, i installed the latest libol-0.3.9, but when i try to compile syslog-ng i get this error: ./configure --with-libol=/usr/local/bin/ checking libol version >= 0.3.16... no configure: error: Required libol version not found, make sure that your libol version is in the 0.3.x branch on the config.log i get the same.... i saw that somebody got the same error, but he didnt post how to resolve it... https://lists.balabit.hu/pipermail/syslog-ng/2004-August/006332.html can somebody help me? -- Ciao, Javier linux counter #393724 GPG Key Fingerprint = 46B76CFEDB0161089D9ECB22FEFDE7EBA8C2007E

3 5

RE: [syslog-ng] Need Log Time in UTC/GMT Format.
by Padmanabhan, Rajeesh (GE Healthcare) 06 Feb '07

06 Feb '07

Hi Bazsi, As per my understanding, I need to add ts_format(unix) in syslog.ng.conf file(Solaris) while defining destination. Is that correct? Thanks a lot for your help. -Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Tuesday, February 06, 2007 8:08 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Need Log Time in UTC/GMT Format. On Tue, 2007-02-06 at 19:19 +0530, Padmanabhan, Rajeesh (GE Healthcare) wrote: > Thanks a lot for ur response. > If I use the parameter as 'unix' log time will be exactly equal to > UTC/GMT right? Yes. (however I noticed that you also mention syslog-ng 1.6 which did not support this option, you need to change the destination template there). -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] Need Log Time in UTC/GMT Format.
by Padmanabhan, Rajeesh (GE Healthcare) 06 Feb '07

06 Feb '07

Thanks a lot for ur response. If I use the parameter as 'unix' log time will be exactly equal to UTC/GMT right? -Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Tuesday, February 06, 2007 6:47 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Need Log Time in UTC/GMT Format. On Tue, 2007-02-06 at 17:12 +0530, Padmanabhan, Rajeesh (GE Healthcare) wrote: > Hi All, > > I need log format with time in UTC or GMT both in Solaris & Linux. How > do I set this in syslog-ng.conf file. Basically all the logs should > have time converted from local machine to GMT/UTC (Universal > Coordinated Time). > > Syslog-ng versions used are 2.0.1 for Linux & 1.6 for Solaris 8. > using the ts_format(unix) option. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Need Log Time in UTC/GMT Format.
by Padmanabhan, Rajeesh (GE Healthcare) 06 Feb '07

06 Feb '07

Hi All, I need log format with time in UTC or GMT both in Solaris & Linux. How do I set this in syslog-ng.conf file. Basically all the logs should have time converted from local machine to GMT/UTC (Universal Coordinated Time). Syslog-ng versions used are 2.0.1 for Linux & 1.6 for Solaris 8. Please help. Thanks in advance. -Rajeesh

2 1

spoof-source implemented
by Balazs Scheidler 05 Feb '07

05 Feb '07

hi, I have implemented spoof_source() support in my 2.0.x tree, as I described it in my blog article (at http://bazsi.blogspot.com) I'd appreciate some feedback, both an IPv4 and IPv6 environment would be interesting. I'd be grateful for positive feedback as well, so please tell me even if it works for you :) Thanks. -- Bazsi

1 0

command line option documentation
by bryanh＠giraffe-data.com 05 Feb '07

05 Feb '07

syslog-ng.8 says it is not up to date and to refer to the HTML documentation instead. But I don't find any HTML documentation of syslog-ng command options. The reference manual doc/syslog-ng.html.tar.gz is the only HTML documentation I see. syslog-ng.8 does appear to be out of date, at least with respect to --verbose, --debug, and --foreground. -- Bryan Henderson San Jose, California

2 1

Stats dropped
by Hari Sekhon 02 Feb '07

02 Feb '07

Hi, I've just been through a couple of threads on this, one from a couple of years back and one from last year. I am having the same issue with logs being dropped. Obviously to maintain the integrity of my audit trail I'd like to limit/stop this. Most of the stats are 0 (which are printed every 12hours). Here is the entire config which is exactly the same on all syslog clients: options { chain_hostnames(off); sync(0); stats(43200); }; source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; destination net { tcp("x.x.x.x" port(xxx)); }; log { source(src); destination(messages); }; log { source(src); destination(net); }; Most of the time the dropped stats are 0 but sometimes they are 3000 or so and occasionally 20000-50000! Usually this happens on the mail server or the log server which are both heavily used machines. One of the destinations is obviously backing up, likely the tcp destination for the mail server. On the logserver I already have log_fifo_size(20000); to try to alleviate this. I would have thought this was reasonable. I don't think this increases memory consumption too much either, at least not by today's standards, the server has the nominal 1GB of Ram. Should I increase this on the server and add it to on the agents too? I think this would allow a large buffer to hopefully stop this altogether (unless of course the thing goes over the 20000 or whatever). Perhaps I should set log_fifo_size to 50000? Any recommendations or feedback on this? Thanks -- Hari Sekhon

3 4

concatenated sendmail messages
by Fran Loehmann 02 Feb '07

02 Feb '07

Hi, I am new to syslog-ng and have set up a system using eventlog-0.2.5 and syslog-ng-2.0.1 Local sendmail messages seem to have 2 entries together. I am not sure if something is awry with the config included below, but it seems to only happen with the sendmail entries from sendmail running on the log host. I am trying to write messages to both /var/log/maillog and /var/log/archive/2007-01-25. Messages logged from the sending server seem ok but sendmail running on they log server appear to be on the same line seperated by <22>. Messages in maillog and 2007-01-25 look the same. Thanks for your help, Fran Example: --------- Jan 25 13:20:12 secmgmt-cs01 sendmail[3050]: l0PIKCSY003050: from=<root(a)secmgmt-cs02.secmgmt.pvt>, size=619, class=0, nrcpts=1, msgi d=<200701251820.l0PIKCEu004718(a)secmgmt-cs02.secmgmt.pvt>, proto=ESMTP, daemon=MTA, relay=secmgmt-cs02.secmgmt.pvt [10.200.1.5]<22>Ja n 25 13:20:12 sendmail[3051]: l0PIKCSY003050: to=<lhmn(a)secmgmt-cs01.secmgmt.pvt>, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=30856, dsn=2.0.0, stat=Sent Config: ------- #********** # Options #********** options { use_dns(persist-only); dns_cache_hosts(/etc/hosts); chain_hostnames(no); keep_hostname(yes); log_fifo_size(4096); log_msg_size(8192); stats(3600); sync(0); time_reopen(10); bad_hostname("sccp|tmm"); }; #********* # Sources #********* ## local source s_local { unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); internal(); }; ## remote source s_remote { udp(); tcp(ip(0.0.0.0) port(514) max-connections(300)); }; #********* # Filters #********* ## Local filters filter f_messages { level(info..emerg); }; filter f_secure { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_emerg { level(emerg); }; filter f_spooler { level(crit..emerg) and facility(uucp, news); }; filter f_local7 { facility(local7); }; #filter f_debug { level(debug); }; ## SEC destination d_sec { program("/usr/local/bin/sec.pl -input=\"-\" -conf=/usr/local/etc/sec.conf"); }; ## Archive - timestamped archives destination d_archive { file("/var/log/archive/$R_YEAR-$R_MONTH-$R_DAY" owner("root") group("logs") dir_group("logs") perm(0640) dir_perm(0750) create_dirs(yes)); }; #***************** # Log statements #***************** # Send all logs to sec.pl log { source(s_local); source(s_remote); destination(d_sec); }; # Send all logs to archive log { source(s_local); source(s_remote); destination(d_archive); }; # Local logs - order DOES matter ! log { source(s_local); filter(f_emerg); destination(d_console); }; log { source(s_local); filter(f_secure); destination(d_secure); flags(final); }; log { source(s_local); filter(f_mail); destination(d_maillog); flags(final); }; log { source(s_local); filter(f_cron); destination(d_cron); flags(final); }; log { source(s_local); filter(f_spooler); destination(d_spooler); }; log { source(s_local); filter(f_local7); destination(d_bootlog); }; log { source(s_local); filter(f_messages); destination(d_messages); }; #log { source(s_local); filter(f_debug); destination(d_debug); };

3 10

Re: [syslog-ng] HAVE_GETUTENT not defined
by bryanh＠giraffe-data.com 01 Feb '07

01 Feb '07

>>> >>> BTW, I recommend not using a standard function name for a local function. >>> >>> E.g. in this case, the local version of getutent is called getutent. That >>> >>> misled me for a while, because I assumed syslog-ng was actually calling >>> >>> standard getutent. ... >>> > >>> >I don't want to add #ifdefs to the calling side of things. I know I >>> >could use macros, but then the calling side would not indicate that >>> >there's a private function implemented. >>> >>> I'm with you on that, but I was suggesting something different. There >>> is today an #ifdef in utils.c like this: >>> ... > >But how would the calling site look like? Today, it's: while ((ut = getutent())) In my scheme, it's: while ((ut = my_getutent())) (on a system that has standard getutent(), my_getutent() is implemented as a call to the system's getutent()). -- Bryan Henderson San Jose, California

2 1