April 2007 - syslog-ng - lists.balabit.hu

AIX startup
by Brian Loe 27 Mar '08

27 Mar '08

Okay, my syslog-ng instance died at some point last night and because I don't have it setup properly for respawning... Can anyone running syslog-ng on AIX 5.* give me some tips for this? I'm feeding pipes so i have to start instances of SEC as soon as I start syslog-ng - but the SEC scripts appear to "close" so if they're configured to respawn I'll have 2000 instances of them in an hour.

7 21

incorrect firewall logs with syslogng-2.0.0 [security error?]
by Jacek Kalinski 12 Mar '08

12 Mar '08

Hello, After upgradeing from syslogng-1.6.11 to 2.0.0 I've got a strange messages in /var/log/messages file: Nov 29 08:14:05 denise WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 11:10:19 denise PT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 16:42:16 denise W=0 RES=0x00 RST URGP=0 Nov 29 21:37:15 denise 116 ID=34901 DF PROTO=TCP SPT=3584 DPT=80 WINDOW=65535 RES=0x00 ACK FIN URGP=0 These are truncated iptables logs. Because in firewall.log file are simmilar entries to truncated one, I think full file should be: Nov 29 11:10:19 denise firewallp=INVALID:1 a=DROP IN=eth1 OUT= MAC=00:30:4f:36:2b:dc:00:04:9a:2c:7f:20:08:00 SRC=193.41.230.81 DST=xxx.xxx.xxx.x LEN=576 TOS=0x00 PREC=0x00 TTL=117 ID=3495 PROTO=TCP SPT=443 DPT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 (xxx.xxx.xxx.x is a real server IP address - one 'x' is one digit) Config file with interesting lines: options { dir_perm(0700); perm(0600); chain_hostnames(no); stats(1200); keep_hostname(yes); dir_owner(root); dir_group(root); owner(root); group(root); }; source local { unix-stream("/dev/log" max_connections(300)); file("/proc/kmsg"); # udp(ip(0.0.0.0) port(514)); internal(); }; # ..... # authpriv.none;cron.none;mail.none;news.none -/var/log/messages filter f_2 { not facility(news); }; filter f_3 { not facility(local5); }; filter f_4 { not facility(local6); }; filter f_5 { not facility(authpriv); }; filter f_6 { not facility(cron); }; filter f_7 { not facility(mail); }; filter f_notlocal7 { not facility(local7); }; filter f_notfirewall { not match("firewallp="); }; destination d_2 { file("/var/log/messages" create_dirs(yes)); }; log { source(local); filter(f_2); filter(f_4); filter(f_5); filter(f_6); filter(f_7); filter(f_notimapd); filter(f_notpopa3d); filter(f_notnamed); filter(f_notfirewall); destination(d_2); }; #..... # firewallp.* -/var/log/firewall.log filter f_16 { level(warning) and match("firewallp="); }; destination d_12 { file("/var/log/firewall.log" create_dirs(yes)); }; log { source(local); filter(f_16); destination(d_12); }; #..... Do you know where could be an error? It is a production server so I can't debug syslog-ng on this machine (sorry). NOTE: the only truncated lines I can find are iptables (AFAIR they are logged by /proc/kmesg) entries. All other lines are complete. And it is probably a critical error in security. PS: simple statistics line from syslog-ng: Nov 30 00:00:06 denise syslog-ng[32682]: Log statistics; dropped='pipe(/dev/tty12)=0', processed='center(queued)=758289', processed='center(received)=369020', processed='destination(d_maillogimapd)=4245', processed='destination(d_5)=1', processed='destination(d_4)=0', processed='destination(d_3)=14259', processed='destination(d_2)=14259', processed='destination(d_13)=0', processed='destination(d_1)=6000', processed='destination(d_12)=6000', processed='destination(d_11)=369020', processed='destination(d_10)=36', processed='destination(d_8)=0', processed='destination(d_maillogpopa3d)=103224', processed='destination(d_7)=241245', processed='destination(d_6)=0', processed='source(local)=369020' I think you see that it could be a little hard to debug (with so many messages parsed by syslog-ng) ;) Jacek

3 6

syslog-ng 2.0.3 is released
by Balazs Scheidler 14 Nov '07

14 Nov '07

Dear syslog-ng users, I've uploaded syslog-ng 2.0.3, the latest stable release in the syslog-ng 2.0 branch to our webserver. The list of changes is summarized below. The source is available at the usual places at http://www.balabit.com/products/syslog-ng/ 2.0.3 Mon, 26 Mar 2007 14:10:00 +0200 Bugfixes: * Fixed a possible segmentation fault in the usertty() destination driver when it was referenced on a log path with disabled flow-control. * Fixed various usertty() functionality problems. * Removed the 1024 byte limitation of internally generated messages. * Clarified the text of various internal messages, consistency updates for message severities. * Increased the minimum value for log_fifo_size to 1000 elements. * HP-UX portability fixes. * Some minor documentation fixes. Features: * Added spoof-source support for IPv4 & IPv6 to match 1.6.x functionality. * Added support for remembering the last posistion of file sources across restarts. * Added tcp-wrapper support. * Added support for more than 9 regexp matches. -- Bazsi

3 8

RE: [syslog-ng] Syslog-ng 2.0.3 make error
by Justin Randall 02 May '07

02 May '07

Hello, I am also experiencing this compile error when building Syslog-NG-2.0.3 on a CentOS (Linux) 4.4 host. Regards, Justin. -----Original Message----- From: Ravi Papisetti -X (rpapiset - HCL at Cisco) [mailto:rpapiset@cisco.com] Sent: Wednesday, April 25, 2007 3:34 PM To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] Syslog-ng 2.0.3 make error Hi, I see below error when I run make && make install make all-recursive make[1]: Entering directory `/usr/local/syslog-ng/syslog-ng-2.0.3' Making all in src make[2]: Entering directory `/usr/local/syslog-ng/syslog-ng-2.0.3/src' if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -g -MT cfg-grammar.o -MD -MP -MF ".deps/cfg-grammar.Tpo" \ -c -o cfg-grammar.o `test -f 'cfg-grammar.c' || echo './'`cfg-grammar.c; \ then mv -f ".deps/cfg-grammar.Tpo" ".deps/cfg-grammar.Po"; \ else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:30:20: libnet.h: No such file or directory In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:592: error: syntax error before ')' token /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:626: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/usr/local/syslog-ng/syslog-ng-2.0.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/syslog-ng/syslog-ng-2.0.3' make: *** [all] Error 2 Some one could tell me the reason. Thanks, Ravi Kumar P. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

turn off case sensitivity for match regex filter
by stucky 30 Apr '07

30 Apr '07

Guys Playing around with ng 2 and I started looking at the match filter again. Simple question that I cannot find an answer to anywhere on the net. How do I turn off case sensitivity for the match target ? I'd like the following line to match "error' or 'ERROR' or 'Error' filter logparse { match("error"); }; but of course it only matches 'error' since by default regex is case sensitive. Basically I'm trying to emulate 'grep -i' I guess I could do this : filter logparse { match("[Ee][Rr][Rr][Oo][Rr]"); }; but it'd be soo much simpler to turn off case sensitivity. And while we're talking regex. Shouldn't the above line actually read like this : filter logparse { match(".+error.+"); }; ? meaning "anything followed by 'error' followed by anything" Both appear to work so I assume the first line is interpreted by syslog-ng like the second line correct ? Help is appreciated stucky

2 4

Re: syslog-ng Digest, Vol 24, Issue 33
by Fabian Pucciarelli 30 Apr '07

30 Apr '07

I appreciate the help Bazsi, I receive around 600 of this messages daily, do you know when this messages are generated? I there any way to change that time to lets say one message/hour? TIA! On Sun, 2007-04-29 at 10:25 -0600, Fabian Pucciarelli wrote: > I have syslog ng writing to a mysql pipe and then a little script > reading the pipe and writing to the db. I currently receive many > messages like the following, I wonder if somenone can help me figure > out what this message is saying..... thanks. > > > | mailux | syslog | notice | notice | 2d | 2007-04-13 | 01:16:40 > | syslog-ng | syslog-ng[30548]: Log statistics; > dropped='pipe(/tmp/mysql.pipe)=0', processed='center(queued)=40295', > processed='center(received)=13206', > processed='destination(d_mysql)=40295', processed='source(net_tcp)=0', > processed='source(src)=8962', processed='source(net_udp)=4244' | > 46674 | This contains the various message counters that syslog-ng maintains internally. 'processed' counters just count how much messages were processed at the given point, 'dropped' counters indicate how much log messages were dropped by syslog-ng itself. The string in the parenthesis tell were the given counter is counting inside syslog-ng. 'center' is the main log message dispatching mechanism, it received 13206 messages from various sources and then sent 40295 messages out, e.g. you are probably sending individual messages to multiple destinations. You have two sources, one named 'src' generated 8962, the other called 'net_udp' 4244 messages. -- Bazsi On 4/30/07, syslog-ng-request(a)lists.balabit.hu < syslog-ng-request(a)lists.balabit.hu> wrote: > > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: syslog-ng Digest, Vol 24, Issue 32 (Fabian Pucciarelli) > 2. Re: turn off case sensitivity for match regex filter > (Balazs Scheidler) > 3. Re: Re: syslog-ng Digest, Vol 24, Issue 32 (Balazs Scheidler) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 29 Apr 2007 10:25:18 -0600 > From: "Fabian Pucciarelli" <fabiangp(a)gmail.com> > Subject: [syslog-ng] Re: syslog-ng Digest, Vol 24, Issue 32 > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <1e6757090704290925n541deb73t13eace5731aced3b(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > I have syslog ng writing to a mysql pipe and then a little script reading > the pipe and writing to the db. I currently receive many messages like the > following, I wonder if somenone can help me figure out what this message > is > saying..... thanks. > > > | mailux | syslog | notice | notice | 2d | 2007-04-13 | 01:16:40 | > syslog-ng | syslog-ng[30548]: Log statistics; > dropped='pipe(/tmp/mysql.pipe)=0', processed='center(queued)=40295', > processed='center(received)=13206', > processed='destination(d_mysql)=40295', > processed='source(net_tcp)=0', processed='source(src)=8962', > processed='source(net_udp)=4244' | 46674 | > > On 4/29/07, syslog-ng-request(a)lists.balabit.hu < > syslog-ng-request(a)lists.balabit.hu> wrote: > > > > Send syslog-ng mailing list submissions to > > syslog-ng(a)lists.balabit.hu > > > > To subscribe or unsubscribe via the World Wide Web, visit > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > or, via email, send a message with subject or body 'help' to > > syslog-ng-request(a)lists.balabit.hu > > > > You can reach the person managing the list at > > syslog-ng-owner(a)lists.balabit.hu > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of syslog-ng digest..." > > > > > > Today's Topics: > > > > 1. Re: turn off case sensitivity for match regex filter > > (Balazs Scheidler) > > 2. Re: turn off case sensitivity for match regex filter (stucky) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Sat, 28 Apr 2007 12:42:06 +0200 > > From: Balazs Scheidler <bazsi(a)balabit.hu> > > Subject: Re: [syslog-ng] turn off case sensitivity for match regex > > filter > > To: Syslog-ng users' and developers' mailing list > > <syslog-ng(a)lists.balabit.hu> > > Message-ID: <1177756926.14925.17.camel(a)bzorp.balabit> > > Content-Type: text/plain > > > > On Sat, 2007-04-28 at 01:52 -0700, stucky wrote: > > > Guys > > > > > > Playing around with ng 2 and I started looking at the match filter > > > again. > > > Simple question that I cannot find an answer to anywhere on the net. > > > How do I turn off case sensitivity for the match target ? > > > I'd like the following line to match "error' or 'ERROR' or 'Error' > > > > > > filter logparse { match("error"); }; > > > > > > but of course it only matches 'error' since by default regex is case > > > sensitive. > > > Basically I'm trying to emulate 'grep -i' > > > I guess I could do this : > > > > > > filter logparse { match("[Ee][Rr][Rr][Oo][Rr]"); }; but it'd be soo > > > much simpler to turn off case sensitivity. > > > > Yes, you are right. But it's not currently possible. It should be > > however, I'll try to add it in the nearfuture. > > > > > > > > And while we're talking regex. Shouldn't the above line actually read > > > like this : > > > > > > filter logparse { match(".+error.+"); }; ? > > > > > > meaning "anything followed by 'error' followed by anything" > > > Both appear to work so I assume the first line is interpreted by > > > syslog-ng like the second line correct ? > > > > syslog-ng interprets "match" the same as grep, e.g. it does not care > > where the pattern is found. if you want to match the beginning or the > > end of line, you need to use explicit ^ and $ characters. > > > > -- > > Bazsi > > > > > > > > ------------------------------ > > > > Message: 2 > > Date: Sat, 28 Apr 2007 12:44:04 -0700 > > From: stucky <stucky101(a)gmail.com> > > Subject: Re: [syslog-ng] turn off case sensitivity for match regex > > filter > > To: "Syslog-ng users' and developers' mailing list" > > <syslog-ng(a)lists.balabit.hu> > > Message-ID: > > <30997e260704281244g6f1225bfwc7da2b4e05fdfd9f(a)mail.gmail.com> > > Content-Type: text/plain; charset="utf-8" > > > > Baszi > > > > Cool. I'm in the middle of building a new infrastructure and would like > to > > use this feature. I'm not a programmer but I assume adding this feature > > shouldn't be very hard at all right ? > > If you had a rough ETA that'd help me. > > > > thx > > > > On 4/28/07, Balazs Scheidler <bazsi(a)balabit.hu> wrote: > > > > > > On Sat, 2007-04-28 at 01:52 -0700, stucky wrote: > > > > Guys > > > > > > > > Playing around with ng 2 and I started looking at the match filter > > > > again. > > > > Simple question that I cannot find an answer to anywhere on the net. > > > > How do I turn off case sensitivity for the match target ? > > > > I'd like the following line to match "error' or 'ERROR' or 'Error' > > > > > > > > filter logparse { match("error"); }; > > > > > > > > but of course it only matches 'error' since by default regex is case > > > > sensitive. > > > > Basically I'm trying to emulate 'grep -i' > > > > I guess I could do this : > > > > > > > > filter logparse { match("[Ee][Rr][Rr][Oo][Rr]"); }; but it'd be soo > > > > much simpler to turn off case sensitivity. > > > > > > Yes, you are right. But it's not currently possible. It should be > > > however, I'll try to add it in the nearfuture. > > > > > > > > > > > And while we're talking regex. Shouldn't the above line actually > read > > > > like this : > > > > > > > > filter logparse { match(".+error.+"); }; ? > > > > > > > > meaning "anything followed by 'error' followed by anything" > > > > Both appear to work so I assume the first line is interpreted by > > > > syslog-ng like the second line correct ? > > > > > > syslog-ng interprets "match" the same as grep, e.g. it does not care > > > where the pattern is found. if you want to match the beginning or the > > > end of line, you need to use explicit ^ and $ characters. > > > > > > -- > > > Bazsi > > > > > > _______________________________________________ > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > > > > > > > > > -- > > stucky > >

2 1

upgraded to 2.0.3 and still time zone problems
by Guy Fleegman 30 Apr '07

30 Apr '07

Hello: I have several sources that are all reporting to a syslog-ng 2.0.3 server My source is source all_routers { udp(ip(0.0.0.0) port(514)); }; My problem is that I have one source that is isolated to a separate file I isolate the file with the following filter f_pd_snort { host(intsnort1); }; and have this destination destination d_pd_snort { file("/var/log/syslog-ng-logs/pd_snort.1" perm(0644) template(t_default)); }; then i use the following command log { source(all_routers); filter(f_pd_snort); destination(d_pd_snort); }; The problem is the format the data is arriving in. It send data in UTC time as follows Apr 30 14:04:35 2007 intsnort1 SFIMS: [119:13:1] Snort Alert [Classification: Unknown] [Priority: 3] Apr 30 14:04:35 2007 intsnort1 SFIMS: [119:4:1] Snort Alert [Classification: Unknown] [Priority: 3] Apr 30 14:04:35 2007 intsnort1 SFIMS: [122:3:0] Snort Alert [Classification: Unknown] [Priority: 3] This is UTC. It is the time that is being sent in the actual packet (I verified with wireshark) I want syslog-ng to modify the times going into this file (and this file only) to reflect EST time. Based upon the documentation The following algorithm is used. 1. The sender can specify the timezone of the messages. If the incoming message includes a timezone it is associated with the message. Otherwise, the local timezone is assumed. 2. The administrator specifies the *time_zone()* <#sourcecommonopts>parameter for the source driver that reads the message. This parameter overrides the original timezone of the message. Each source defaults to the value of the *recv_time_zone()* <#reference_options>global option. 3. The destination driver specifies the timezone via the *time_zone()* <#destcommonopts>parameter. Each destination driver might have an associated timezone value to which message timestamps are converted before they are sent to the final destination (file or network socket). Each destination defaults to the value of the *send_time_zone()* <#reference_options>global option. A message can be sent to multiple destination zones. 4. When macro expansions are used in the destination filenames, the local timezone is used So option #1 is not being done I can't use #2 because my source is defined for all devices I tried using #3..... with the line modified as destination d_pd_snort { file("/var/log/syslog-ng-logs/pd_snort.1" perm(0644) time_zone(-04:00) template(t_default)); }; However.. this does not seem to make any difference... Can you please tell me why option #3 is not working .... and also... why is it that in #1 it is not defauling to just adding the local timezone since the incoming message does not have a timezone specified. Please help and thank you :)

1 0

Re: syslog-ng Digest, Vol 24, Issue 32
by Fabian Pucciarelli 29 Apr '07

29 Apr '07

I have syslog ng writing to a mysql pipe and then a little script reading the pipe and writing to the db. I currently receive many messages like the following, I wonder if somenone can help me figure out what this message is saying..... thanks. | mailux | syslog | notice | notice | 2d | 2007-04-13 | 01:16:40 | syslog-ng | syslog-ng[30548]: Log statistics; dropped='pipe(/tmp/mysql.pipe)=0', processed='center(queued)=40295', processed='center(received)=13206', processed='destination(d_mysql)=40295', processed='source(net_tcp)=0', processed='source(src)=8962', processed='source(net_udp)=4244' | 46674 | On 4/29/07, syslog-ng-request(a)lists.balabit.hu < syslog-ng-request(a)lists.balabit.hu> wrote: > > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: turn off case sensitivity for match regex filter > (Balazs Scheidler) > 2. Re: turn off case sensitivity for match regex filter (stucky) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 28 Apr 2007 12:42:06 +0200 > From: Balazs Scheidler <bazsi(a)balabit.hu> > Subject: Re: [syslog-ng] turn off case sensitivity for match regex > filter > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: <1177756926.14925.17.camel(a)bzorp.balabit> > Content-Type: text/plain > > On Sat, 2007-04-28 at 01:52 -0700, stucky wrote: > > Guys > > > > Playing around with ng 2 and I started looking at the match filter > > again. > > Simple question that I cannot find an answer to anywhere on the net. > > How do I turn off case sensitivity for the match target ? > > I'd like the following line to match "error' or 'ERROR' or 'Error' > > > > filter logparse { match("error"); }; > > > > but of course it only matches 'error' since by default regex is case > > sensitive. > > Basically I'm trying to emulate 'grep -i' > > I guess I could do this : > > > > filter logparse { match("[Ee][Rr][Rr][Oo][Rr]"); }; but it'd be soo > > much simpler to turn off case sensitivity. > > Yes, you are right. But it's not currently possible. It should be > however, I'll try to add it in the nearfuture. > > > > > And while we're talking regex. Shouldn't the above line actually read > > like this : > > > > filter logparse { match(".+error.+"); }; ? > > > > meaning "anything followed by 'error' followed by anything" > > Both appear to work so I assume the first line is interpreted by > > syslog-ng like the second line correct ? > > syslog-ng interprets "match" the same as grep, e.g. it does not care > where the pattern is found. if you want to match the beginning or the > end of line, you need to use explicit ^ and $ characters. > > -- > Bazsi > > > > ------------------------------ > > Message: 2 > Date: Sat, 28 Apr 2007 12:44:04 -0700 > From: stucky <stucky101(a)gmail.com> > Subject: Re: [syslog-ng] turn off case sensitivity for match regex > filter > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <30997e260704281244g6f1225bfwc7da2b4e05fdfd9f(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Baszi > > Cool. I'm in the middle of building a new infrastructure and would like to > use this feature. I'm not a programmer but I assume adding this feature > shouldn't be very hard at all right ? > If you had a rough ETA that'd help me. > > thx > > On 4/28/07, Balazs Scheidler <bazsi(a)balabit.hu> wrote: > > > > On Sat, 2007-04-28 at 01:52 -0700, stucky wrote: > > > Guys > > > > > > Playing around with ng 2 and I started looking at the match filter > > > again. > > > Simple question that I cannot find an answer to anywhere on the net. > > > How do I turn off case sensitivity for the match target ? > > > I'd like the following line to match "error' or 'ERROR' or 'Error' > > > > > > filter logparse { match("error"); }; > > > > > > but of course it only matches 'error' since by default regex is case > > > sensitive. > > > Basically I'm trying to emulate 'grep -i' > > > I guess I could do this : > > > > > > filter logparse { match("[Ee][Rr][Rr][Oo][Rr]"); }; but it'd be soo > > > much simpler to turn off case sensitivity. > > > > Yes, you are right. But it's not currently possible. It should be > > however, I'll try to add it in the nearfuture. > > > > > > > > And while we're talking regex. Shouldn't the above line actually read > > > like this : > > > > > > filter logparse { match(".+error.+"); }; ? > > > > > > meaning "anything followed by 'error' followed by anything" > > > Both appear to work so I assume the first line is interpreted by > > > syslog-ng like the second line correct ? > > > > syslog-ng interprets "match" the same as grep, e.g. it does not care > > where the pattern is found. if you want to match the beginning or the > > end of line, you need to use explicit ^ and $ characters. > > > > -- > > Bazsi > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > > > > -- > stucky >

2 1

Trying to define my sources
by Guy Fleegman 27 Apr '07

27 Apr '07

Let me add to what i have changed.... My config now looks like this options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); ts_format (rfc3164); recv_time_zone(+05:00); }; template t_default { template("${DATE} ${YEAR} ${HOST} ${MSG}\n"); template_escape(no); }; source all_routers { udp(ip(0.0.0.0) port(514) time_zone(+05:00)); }; Even when I add the recv_time_zone and then time_zone options the log entries are still showing up in the file as UTC? Here is an example of how they are being logged Apr 27 20:46:59 2007 intsnort1 SFIMS: [119:17:1] Snort Alert [Classification: Unknown] [Priority: 3] {TCP} Why will the date not change? This is how the date look when i sniff iton wireshark.. so i know that is how it is being sent(as UTC) please advise and thanks.

1 0

Trying to define my sources
by Guy Fleegman 27 Apr '07

27 Apr '07

Hello: I am new to syslog-ng I have multiple network devices all sending me their syslog data to a single Linux server. I break the syslog data out to individual files based upon IP addresses. My problem is that I have a few devices that are sending out data in with no timezone information. The simply assume GMT. Is there any way to define my sources so that 1) I can have a default "bucket" source that cathces all syslog data send vi IP unless defined otherwise 2) I can define out individual IP's as "sources" 3) I can have one of the sources automatically apply a timezone i specify? Please advise and thanks, This is my source definition source all_routers { udp(ip(0.0.0.0) port(514)); };

1 0