March 2007 - syslog-ng - lists.balabit.hu

log statistics level
by bryanh＠giraffe-data.com 19 Mar '07

19 Mar '07

When Syslog-ng logs its hourly statistics, it uses level NOTICE. This seems like a classic case for INFO instead. NOTICE is an event of which someone might want to take notice, e.g. "nightly backup has started" or "RAID rebuild is complete." INFO is just information someone might want to refer to later. -- Bryan Henderson San Jose, California

4 7

Syslog-ng fails to listen at port 514
by Vivek Raju 19 Mar '07

19 Mar '07

Hi, I am trying to implement a centralized syslog-ng solution for testing purpose. My configuration is SLES10 on mainframe guest. I had followed the steps given in the article below. http://www.novell.com/coolsolutions/feature/18044.html I have created the configuration on server # # uncomment to process log messages from network: udp(port(514)); tcp(ip("192.168.1.42") port(5140) keep-alive(yes)); # this is for separating out network hosts into individual log files. destination std { file ("/var/log/HOSTS/$YEAR-$MONTH/$HOST/$FACILITY-$YEAR-$MONTH-$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(y\es) ); }; log { source(src); destination(std); }; I then ran SuSEconfig --module syslog-ng. After that i started the syslog service thru /etc/init.d On the client i have added these lines to /etc/syslog-ng/syslog-ng.conf.in # send everything to log host destination loghost { tcp("192.168.1.42" port(5140)); }; log { source(src); destination(loghost); My Problem is when i do netstat -an|grep 514 or netstat -an|grep 5140 nothing comes up. on the client side i see errors in the /var/log/messages stating "error connecting to remote system" I am not sure but i think the problem is because of UDP 514 or TCP 5140 not being working. I checked the /etc/services and looks fine. has anyone had same kind of problem. Would be glad if someone could help in determining the cause. Vick };

2 1

Where is the download link for 2.0 ?
by Dave Augustus 19 Mar '07

19 Mar '07

Everyplace on http://www.balabit.com I try just leads me to http://www.balabit.com/downloads/syslog-ng/2.0/ Thanks, Dave

3 2

Log rotate without log rotate.
by Bruno Vieira 17 Mar '07

17 Mar '07

Hi there. I have a question and at the same time i almost know that it must exist a way of doing this. The situation is: I want that my logs act as FIFOs. I mean.. I want my log files to have a max of 100 KB or 100 lines (the one that is most convenient to find a solution). If I use a pipe, I have the problem that if I read on one side of the pipe, it continues dumping it's content until getting empty regardless of having more messages coming in through the other end. But what I want is a pipe that that keeps it's content and only flushes a message out every time it receives a message in. Just like a FIFO.. I want this behaviour in a file... named pipe? I don't know the solution for this but I can feel that it is out there :) This way I would have a log rotation without using log rotate that normally it copies the file content to a new one and than syslog-ng starts writing on an empty one. Tell me what you think about this. Best regards, Bruno.

4 5

Re: Log rotate without log rotate.
by G.W. Haywood 16 Mar '07

16 Mar '07

Hi there, On Fri, 16 Mar 2007 Bruno Vieira wrote: > ... the problem here is that the device that will be logging have memory > restrictions. > So, I want a log that acts as a fifo. And every time a new message comes, > the oldest one gets out. > ... > I would like to have only one file per destination (ex: auth.log) and keep > that file within 100 - 120 KB or 100 lines, per example. I want it to be > circular... to be like a FIFO. Why don't you just log to a remote host? > I have a solution.. but I think there can be a better one. My solution is: > having a midlle program between syslog-ng and the destination file. And for > every message received, the program would verify if the destination file ( > p.e. auth.log) already has 100 lines. If so, deleted the last line, make all > others one ENTER down and that append the new line to the beginning of the > file. Don't do it like that. Your 'middle program' might bring the machine to its knees if syslog gets a lot of messages. You could write a script which stores 100 lines in a buffer and deletes the oldest line every time a new line comes in, and make it respond to a signal (for example SIGHUP) by writing its entire buffer to a screen or to a file. > But this seems to be a very "manual" solution... It is. -- 73, Ged.

1 0

Syslog-ng and network failover
by Jonathon Blumenthal 16 Mar '07

16 Mar '07

I need to have a highly available centralized log server (all Linux). Is there a way to configure syslog-ng to automatically detect when the remote syslog server has gone down so that it can redirect messages elsewhere? Something like this: destination d_tcp1 { tcp("192.168.1.1"); failover(d_tcp2); }; destination d_tcp2 { tcp("192.168.1.2"); }; If not, anyone know of any Linux loggers that will do this? -Jon ----------------------------------------- The information contained in this email message and its attachments is intended only for the private and confidential use of the recipient(s) named above, unless the sender expressly agrees otherwise. Transmission of email over the Internet is not a secure communications medium. If you are requesting or have requested the transmittal of personal data, as defined in applicable privacy laws by means of email or in an attachment to email, you must select a more secure alternate means of transmittal that supports your obligations to protect such personal data. If the reader of this message is not the intended recipient and/or you have received this email in error, you must take no action based on the information in this email and you are hereby notified that any dissemination, misuse or copying or disclosure of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by email and delete the original message.

6 5

Re: log statistics level
by G.W. Haywood 11 Mar '07

11 Mar '07

Hi there, FWIW I'd be happy if nothing changed. I use syslog-ng to pipe messages to scripts and I'd hate for things to break because of some log message getting into the wrong file. Besides, I'm used to looking at things the way they are. Just my 0.02p -- 73, Ged.

1 0

RE: [syslog-ng] Syslog-ng log file overwrite
by Justin Randall 09 Mar '07

09 Mar '07

You can have logrotate entries like the following: # rotate some Logs /logdirectory/messages { weekly rotate 12 compress postrotate /usr/bin/pkill -HUP syslog endscript } What this does is simply rotate the log, and then send HUP to Syslog-NG to stop it from writing to the current inode which points to the recently rotated logfile. This specific configuration will rotate weekly, keeping 12 compressed revisions using GZIP. I hope this helps, Justin. _____ From: Padmanabhan, Rajeesh (GE Healthcare) [mailto:Rajeesh.Padmanabhan@ge.com] Sent: Friday, March 09, 2007 6:16 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Syslog-ng log file overwrite Basically what i am trying to configure is log rotation of Syslog-ng files.. _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Padmanabhan, Rajeesh (GE Healthcare) Sent: Friday, March 09, 2007 3:52 PM To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] Syslog-ng log file overwrite Hi Bazsi, Do syslog-ng overwrites log file by default? If yes, what is the process/strategy done by syslog-ng to overwrite the file? Thanks, Rajeesh

1 0

RE: [syslog-ng] Syslog-ng log file overwrite
by Padmanabhan, Rajeesh (GE Healthcare) 09 Mar '07

09 Mar '07

Hi Valdis, Thanks for the help. Could you please explain below questons? 1. Will the below format overwrites existing log file? file("/logs/$HOST/$YEAR/$MONTH/messages-$YEAR-$MONTH$DAY"); 2. Is there a way to roate log file based on the size? Idea is I don't want my log partition gets filled & alerts due to lacks of space :) Please help. -Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Valdis.Kletnieks(a)vt.edu Sent: Saturday, March 10, 2007 12:22 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng log file overwrite On Fri, 09 Mar 2007 16:46:18 +0530, "Padmanabhan, Rajeesh (GE Healthcare)" said: > Basically what i am trying to configure is log rotation of Syslog-ng > files. You can always cheat, like this: file("/logs/$HOST/$YEAR/$MONTH/messages-$YEAR-$MONTH$DAY"); Voila! instant auto-magic rotation at midnight. :)

2 1

RE: [syslog-ng] Syslog-ng log file overwrite
by Padmanabhan, Rajeesh (GE Healthcare) 09 Mar '07

09 Mar '07

Basically what i am trying to configure is log rotation of Syslog-ng files.. _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Padmanabhan, Rajeesh (GE Healthcare) Sent: Friday, March 09, 2007 3:52 PM To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] Syslog-ng log file overwrite Hi Bazsi, Do syslog-ng overwrites log file by default? If yes, what is the process/strategy done by syslog-ng to overwrite the file? Thanks, Rajeesh

2 1