April 2007 - syslog-ng - lists.balabit.hu

test
by Chris Nelson 10 Apr '07

10 Apr '07

Initial email

1 0

syslog-ng + rhel5 + selinux
by Jan-Frode Myklebust 10 Apr '07

10 Apr '07

(Reposting now that I'm subscribed) I've created an RPM package of syslog-ng that installs the necessary selinux module to work on RHEL5. This is not creating a whole new selinux domain for syslog-ng (like I expect the reference policy to do), but rather a small extention of the RHEL5 provided syslogd domain to allow syslogd_t opening /dev/kmsg, 514/tcp and creating some files under /var. http://tanso.net/yum/repodata/repoview/syslog-ng-0-2.0.3-1.el5.html http://tanso.net/selinux/ The selinux rules installed by this RPM is http://tanso.net/selinux/syslog_ng.te and can be installed separately by saving that file to /root/syslog_ng.te and running: checkmodule -M -m -o syslog_ng.mod syslog_ng.te semodule_package -o syslog_ng.pp -m syslog_ng.mod restorecon ./syslog_ng.pp semodule -i ./syslog_ng.pp It can later be removed by "semodule --remove=syslog_ng". -jf

1 0

Compressing syslog traffic across a WAN?
by K K 09 Apr '07

09 Apr '07

Has anybody found a good way to take a high-volume stream of UDP syslog packets, aggregate and compress the packets, and then recreate them, with the original source IPs, at the other end of a WAN circuit? Looks like Riverbed cannot optimize UDP syslog?. Encapsulating the packets in an IPSEC tunnel with compression would make the packets smaller, but not reduce the packets-per-second. Tolstoy Version: I have a number of 'appliance' hosts on the west coast which generate high volumes of syslog events, which I need to forward to an 'appliance' log analysis server (EIQ) in the midwest. The version of EIQ we're stuck with only supports UDP, and uses the source IP of the packet to decide which host the event occurred on -- it cannot take the embedded hostname in the packet and use that. What we're doing right now is configuring all the west coast appliances send their syslog events to a syslog-ng server locally on the same network, which then filters out the junk events and uses spoof-source to forward these UDP packets across the slow WAN circuit to the EIQ appliances in the Midwest: Source \ Source --UDP-- syslog-ng --UDP-over-WAN-- EIQ Source / I could consider sending these events via TCP syslog to a syslog-ng server in the Midwest, and that would then send a copy of the packets via UDP to EIQ, but in this approach, I gather that we wouldn't be able to use spoof-source to regenerate the UDP packet with the original source IP? Thanks, Kevin

3 3

RE: [syslog-ng] More then one application on same server
by ashish talati 09 Apr '07

09 Apr '07

Hi, below are the few logs generated in my local machine. In that first 2 logs are generated through one application and last log generated through second application. But as you can see all logs have the originating source as the pc196070/pc196070 which is the last 5 digits of my machine's ip address. I want to differentiate the logs coming from different application!! How can it possible?? ..You suggest me program filter...So is that a solution??...if yes then please let me know how to use it exactly...I am blank in how to use it.. 05/Apr/2007 11:18:36 pc196070/pc196070 DEBUG: - [Thread- 62/Client-0] Response: RESP:0; 05/Apr/2007 11:18:36 pc196070/pc196070 Thread-62/Client-0] received: Enter command 05/Apr/2007 11:18:36 pc196070/pc196070 INFO: -NpiListener.Listener - Port 12346 successfully opened. Waiting for connecti... Thank you. B.R. Ash. --------------------------------- From: syslog-ng-bounces(a)lists.balabit.hu on behalf of Geller, Sandor (IT) Sent: Wed 4/4/2007 11:37 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] More then one application on same server > Hi, > Thank you very much for your reply. > But as I am new in this so can you please be more specific > that how can I use the Program() filter?? > Let me again tell you my specific issue- I have a Tomcat > server running and in that server I have 3 application or > nodes that generates the logs and dump into tomcat > server....Now when I use the syslog it gives me all the logs > mix with the generating source name as the hostname (tomcat > server)....but I want that syslog should give me the logs > which has the field in it from which I can identify that this > log is generated in this application and this is in other... > So I hope I describe the problem to give you exact idea!! > I will be thankful to you if you help me in this. Could you show some lines from your log originating from different programs? I'm not familiar with tomcat, so I don't understand your issue exactly... Maybe the logs have a field which could be used to differentiate between your tomcat apps. Regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

Re: tailing real files
by G.W. Haywood 08 Apr '07

08 Apr '07

Hi there, On Sat, 7 Apr 2007 Balazs Scheidler wrote: > source s_tail { file("/var/log/apache/access.log" follow_freq(1) flags(no-parse)); }; > ... > * reads the access.log file (starting with the first line), > * checks every 1 second to see if there are new records > * notices when access.log gets renamed ... > * remembers the last file position across restarts Oh, cool! Thanks!! -- 73, Ged.

1 0

capture messages from linksys router
by Robert Buecheler 08 Apr '07

08 Apr '07

please forgive me, I'm fairly new in this and don't understand much of syslog-ng. I am trying to log messages from my linksys router (192.168.1.1) The port that linksys mentions is (514), but when I run ethereal, the destination port seems to be [snmptrap (162)] (the origin port on the router varies) this is the ethereal output of 3 messages (each "line" with its IP# and UDP ports including the "packet size" of the message): --------------------------- No. Time Source Destination Protocol Info 1 0.000000 192.168.1.1 192.168.1.150 SNMP TRAP-V1 1.3.6.1.4.1.3955.1.1.0 Frame 1 (179 bytes on wire, 179 bytes captured) Internet Protocol, Src: 192.168.1.1 (192.168.1.1), Dst: 192.168.1.150 (192.168.1.150) User Datagram Protocol, Src Port: adobeserver-1 (1102), Dst Port: snmptrap (162) No. Time Source Destination Protocol Info 2 4.000204 192.168.1.1 192.168.1.150 SNMP TRAP-V1 1.3.6.1.4.1.3955.1.1.0 Frame 2 (187 bytes on wire, 187 bytes captured) Internet Protocol, Src: 192.168.1.1 (192.168.1.1), Dst: 192.168.1.150 (192.168.1.150) User Datagram Protocol, Src Port: adobeserver-2 (1103), Dst Port: snmptrap (162) No. Time Source Destination Protocol Info 3 8.000308 192.168.1.1 192.168.1.150 SNMP TRAP-V1 1.3.6.1.4.1.3955.1.1.0 Frame 3 (181 bytes on wire, 181 bytes captured) Internet Protocol, Src: 192.168.1.1 (192.168.1.1), Dst: 192.168.1.150 (192.168.1.150) User Datagram Protocol, Src Port: xrl (1104), Dst Port: snmptrap (162) --------------------------- syslog-ng (1.6.8) is running on IP 192.168.1.150 (SUSE 10.0 linux, 2.6.13-15.15-smp kernel). from different sources, I got the following lines in the syslog-ng.conf file: ####################################### source src-linksys { internal(); unix-dgram("/dev/log"); unix-dgram("/var/lib/named/dev/log"); udp(ip("192.168.1.150") port(162)); udp(ip("192.168.1.150") port(514)); }; filter f_user { facility(user); }; destination linksys { file("/var/log/linksys.log"); }; log { source(src-linksys); filter(f_user); destination(linksys); }; ####################################### unfortunately /var/log/linksys.log doesn't exist and/or is never written can somebody help? thx, Robi

2 1

Disconnected access/tailing real files/web interface
by J Bridge 06 Apr '07

06 Apr '07

Hello. I would like to centralise logs from many different hosts into one place. It's possible that the network connectivity between the log server and the hosts is not reliable. Therefore: 1. Can I get syslog-ng to send new log entries once it can see the central log server again? I would also like to centralise logs from non-syslog programs such as some big database apps. 2. Can syslog-ng work similarly to tail -f logging to the central server? And finally (but least importantly).. 3. Does anyone know a good web interface for viewing or searching the files from a web interface? The logs must remain as files, not be put in a mysql database. Thanks, jbj

2 2

Syslog-ng version 2.0.3 memory problems
by James Long 06 Apr '07

06 Apr '07

I've installed syslog-ng-.2.0.3 on a Red Hat Enterprise Linux 5 server. I'm using eventlog-0.2.5 and libnet 1.1.2.1. I compiled syslog-ng without any problems. I've got a fairly generic config file. Whenever I start the service; the process will chew through all of the available ram on the server (2 gb) then terminate with the following error Glib-ERROR gmem.c:514: failed to allocated ### bytes. This usually takes about 15 minutes to happen. Any thoughts? Thanks Jim

2 6

problem with accents in log messages
by Nagy Daniel 05 Apr '07

05 Apr '07

Hello, syslog-ng version: 2.0.2 System: RHEL4, locale: en_US.UTF-8 Without a template in the destionation, the accented characters appear well: Using this config: source s_net { tcp(); udp(); }; destination d_nettest { file("/var/log/nettest.log"); }; filter f_nettest { host(localhost); }; log {source(s_net); filter(f_nettest); destination(d_nettest); }; Then I do a 'nc localhost 514' and type 'abbé', I properly receive 'Apr 5 10:49:59 localhost/localhost abbé' in /var/log/nettest.log. However, using this config: source s_net { tcp(); udp(); }; destination d_nettest { file("/var/log/nettest.log" template ("$YEAR.$MONTH.$DAY $HOUR:$MIN:$SEC $TZOFFSET $HOST $MSG\n")); ); }; filter f_nettest { host(localhost); }; log {source(s_net); filter(f_nettest); destination(d_nettest); }; I receive this: 2007.04.05 10:48:51 +02:00 localhost abb\37777777751 Thus, 'é' is converted to '\37777777751' Is it a known bug or am I missing something? Thanks, Daniel ps: eljenek a veszpremi infosok

2 2

Localport() & localip() cause syntax error in 2.0.2
by simonst＠wellsfargo.com 04 Apr '07

04 Apr '07

Localip() and localport() parms still causing a syntax error, after straightening out semicolons (thanks to Evan Rempel). # syslog-ng -V syslog-ng 2.0.2 # cat -n syslog-ng.test #Show syslog-ng.test without localip() & localport() 1 options { long_hostnames(off); sync(0); }; 2 source src { unix-stream("/dev/log"); internal(); }; 3 source kernsrc { file("/proc/kmsg"); }; 4 destination logger { tcp("10.11.12.13" port(5678) template("$UNIXTIME $HOST $MESSAGE\n") ); }; 5 log { source(src); source(kernsrc); destination(logger); }; # syslog-ng -dFsf syslog-ng.test # No syntax error without localip() & localport() # cat -n syslog-ng.test #Add localip() & localport() to syslog-ng.test 1 options { long_hostnames(off); sync(0); }; 2 source src { unix-stream("/dev/log"); internal(); }; 3 source kernsrc { file("/proc/kmsg"); }; 4 destination logger { tcp("10.11.12.13" port(5678) localip(10.9.8.7) localport(5678) template("$UNIXTIME $HOST $MESSAGE\n") ); }; 5 log { source(src); source(kernsrc); destination(logger); }; # syslog-ng -dFsf syslog-ng.test syntax error at 4 # SYNTAX ERROR with localip() & localport()

3 6