May 2007 - syslog-ng - lists.balabit.hu

Re: syslog server and windows
by Alejandro Sierra 15 May '07

15 May '07

Hi, 2 Options for sending eventviewer events to a syslog-ng server Lasso (http://www.loglogic.com/logforge/) supports TCP and I have proved it with syslog-ng with good results. You can choose the log (Application, System, Security), the polling interval, .. NTSyslog( http://ntsyslog.sourceforge.net/) another option that uses UDP, that makes better use of the syslog protocol(facility, severity). PD: Sorry for my english. > Hello list, > > I have mounted a syslog-ng server and I need to also send data to it > from Windows servers. Said log's of Windows they would have to be of > eventlog, ISS, exchange, etc. Some program that do it? I proved epiloj > (snare) but it does not serve to me. > > Thanks for all. > > -- > Power by Debian. > > A greeting, > > Javier. >

1 0

syslog-ng 2.0.0 and "-- MARK --" messages
by Mick Ohrberg 15 May '07

15 May '07

Hello! I'm wondering about the MARK messages that show up in my logs. While I have deduced that the default value is 1200 seconds, I can't seem to turn it off. Adding a "mark(86400);" stanza gets me a syntax error that the mark() keyword isn't valid. Am I missing something very basic here, or is there more to this? Thank you in advance. -- A: Because it's counterintuitive to the way we read. Q: Why is top-posting bad?

2 2

syslog server and windows
by Javier Terceiro 15 May '07

15 May '07

Hello list, I have mounted a syslog-ng server and I need to also send data to it from Windows servers. Said log's of Windows they would have to be of eventlog, ISS, exchange, etc. Some program that do it? I proved epiloj (snare) but it does not serve to me. Thanks for all. -- Power by Debian. A greeting, Javier.

1 0

Logging a file to another syslog-ng server for indexing
by Corey Bobb 14 May '07

14 May '07

Sorry about the reply when I should have created a new msg. Hello all, I am trying to add a specific file for syslog to pickup and log remotely but have been unable to make it work. The file I am trying to get over to another syslog-ng server is an audit log. What has to happen is from 1 server the log file gets read/moved over to the other Log server . . .which will then be indexed by splunk. I am learning syslog-ng and am not sure exactly how to make what I am trying to do work. If anyone has any ideas or suggestions please drop me a note! Thanks cygnus_logo Corey M. Bobb System Administrator 850 South Concourse Parkway Maitland, FL 32851 Office - 321-455-2150 Cell - 407-947-7832

2 1

Syslog-ng 2.0.3 make error
by Diana Orrick 14 May '07

14 May '07

Would really like to be able to use this tool... Red Hat 2.6.9-55.ELsmp i686 i386 GNU/Linux On Mon, 2007-04-30 at 10:02 -0400, Justin Randall wrote: > Hello, > > I am also experiencing this compile error when building Syslog-NG-2.0.3 > on a CentOS (Linux) 4.4 host. Install libnet or disable spoof-source support. -- Bazsi I installed libnet, both an older version (to get libnet-config) and the CPAN perl module... Have updated and hand-installed glib (and all its flavors...) have tried with/without " --with-dynamic-linking " with libnet I get the odd syntax errors (would prefer to be able to use this version, and enable spoof sourcing, code update coming?) In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:592: error: syntax error before ')' token /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:626: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/tmp/syslog-ng-2.0.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/tmp/syslog-ng-2.0.3' make: *** [all] Error 2 after disabling enable-spoof_source, I get different errors (these seem to relate to glib issues noted earlier): gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -lwrap -Wl,-Bdynamic libsyslog-ng.a(misc.o)(.text+0x3a9): In function `resolve_hostname': /tmp/syslog-ng-2.0.3/src/misc.c:191: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x6a): In function `log_stamp_format': /tmp/syslog-ng-2.0.3/src/logmsg.c:110: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x2b6): In function `log_msg_ref': /tmp/syslog-ng-2.0.3/src/logmsg.c:498: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x342): In function `log_msg_unref': /tmp/syslog-ng-2.0.3/src/logmsg.c:512: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0xe2a): In function `log_msg_ack_block_end': /tmp/syslog-ng-2.0.3/src/logmsg.c:648: undefined reference to `g_return_if_fail_warning' libsyslog-ng.a(logpipe.o)(.text+0x4f): In function `log_pipe_ref': /tmp/syslog-ng-2.0.3/src/logpipe.c:38: undefined reference to `g_assert_warning' libsyslog-ng.a(logpipe.o)(.text+0x9b): In function `log_pipe_unref': /tmp/syslog-ng-2.0.3/src/logpipe.c:47: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x7d): In function `log_endpoint_free': /tmp/syslog-ng-2.0.3/src/center.c:90: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x175): In function `log_connection_new': /tmp/syslog-ng-2.0.3/src/center.c:132: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x2de): In function `log_template_ref': /tmp/syslog-ng-2.0.3/src/templates.c:180: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x346):/tmp/syslog-ng-2.0.3/src/templates.c:191: more undefined references to `g_assert_warning' follow collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/tmp/syslog-ng-2.0.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/tmp/syslog-ng-2.0.3' make: *** [all] Error 2 even tried installing syslog-ng-2.0.2, thinking it more 'stable' suggestions welcome, I'd like to get this working... ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Diana Mayer Orrick email: orrick(a)fsu.edu University Computing Services ph: (850) 645-8009 Florida State University fax: (850) 644-8722 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

5 7

Starting syslog_ng daemon with chkconfig on Linux
by Shamim 14 May '07

14 May '07

Hi, When I try to start syslog_ng daemon with chkconfig it says. Syslog_ng-2.0.2 service syslog_ng does not support chkconfig Am I missing something ? or how to start syslog_ng daemon with chkconfig on Linux. Please advise. Thanks --------------------------------- Yahoo! Answers - Got a question? Someone out there knows the answer. Tryit now.

3 2

syslog-ng stats
by Jason Qualkenbush 11 May '07

11 May '07

Can someone explain what the difference is between "queued" and "received"? I'm looking at the difference between two different syslog-ng servers. On the light server, the queued and received counter always match. On the heavily loaded server the queued and received differ quite a bit: processed='center(queued)=4988110' processed='center(received)=1103080' Am I losing messages? -Jason

2 1

RE: [syslog-ng] mount syslog server
by Alejandro Sierra 10 May '07

10 May '07

Hi, Lasso (http://www.loglogic.com/logforge/) is a good option for sending eventlog messages to syslog-ng. It supports TCP, u can choose the logs to be forwarded, the polling interval and it behaves as a service. One thing i didn`t like is that it doesn't use the facility and severity, like NTSyslog( http://ntsyslog.sourceforge.net/) another option that uses UDP, that makes better use of the syslog protocol. So it depends on ur needs. If u want to use TCP Lasso, otherwise NTSyslog. PD: Sorry for my english.

1 0

RE: mount syslog server (Javier Terceiro)
by Gregory Zill 10 May '07

10 May '07

Snare for windows Sourceforge.net/projects/snare gregory w zill systems engineer II -----Original Message----- Date: Thu, 10 May 2007 11:47:57 +0200 From: "Javier Terceiro" <correolista(a)gmail.com> Subject: [syslog-ng] mount syslog server To: syslog-ng(a)lists.balabit.hu Message-ID: <602eb19e0705100247v4be883cfo96ebf4b08aeddb21(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hello list, I'm mounting a syslog-ng server for centralize the log's of my net. The servers with linux is ok, but for windows server's, I need a tool for send the messages. What can I use? Some idea? Thanks. -- Power by Debian. A greeting, Javier. ------------------------------

1 0

mount syslog server
by Javier Terceiro 10 May '07

10 May '07

Hello list, I'm mounting a syslog-ng server for centralize the log's of my net. The servers with linux is ok, but for windows server's, I need a tool for send the messages. What can I use? Some idea? Thanks. -- Power by Debian. A greeting, Javier.

1 0