September 2007 - syslog-ng - lists.balabit.hu

puzzled about the system resources used by syslog-ng
by liuruihong 20 Sep '07

20 Sep '07

Eenvironment : under linux 1 central log-collecting server.syslog-ng 2 client: syslog sending logs to central log-collecting server. And I have two central log-collecting servers which is logging for different clients,I call them A and B. configuration 1 The A ` configuration as follows: options { use_dns(no); create_dirs(yes);ts_format(iso); }; source src { udp(ip(0.0.0.0) port(514)); }; filter f_kern { facility(kern); }; filter f_authpriv { facility(auth,authpriv); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_boot { facility(local7); }; filter f_spooler { facility(uucp, news) and level(crit..emerg); }; filter f_messages { level(info..emerg) and not facility(authpriv, cron, mail); }; destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH"); }; destination authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); }; destination mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); }; destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); }; destination boot { file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); }; destination spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); }; destination messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_authpriv); destination(authpriv); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_boot); destination(boot); }; log { source(src); filter(f_spooler); destination(spooler); }; log { source(src); filter(f_messages); destination(messages); }; 2 The B` configuration as follows: source src { unix-stream("/dev/log");internal();udp(ip(0.0.0.0) port(514)); }; destination dsearch { file("/home/work/syslog-ng/log/$HOST"); }; log { source(src); destination(dsearch); }; QUESTIONS: A server log files: ps aux /home/syslog-ng/2007/ 10.11.100.3 / messages %MEM VSZ RSS 965 directories 3860 6.8 567772 562524 B server log files: ps aux /home/work/syslog-ng/log/10.12.55.6 % MEM VSZ RSS 4482 0.0 2232 1276 I think the MEM VSZ and RSS usage is related to the logfile numbers, A server has fewer logfiles than B server, while A server has higher usages of MEM VSZ and RSS than B server, I don`t know why ?

2 2

Timezones, daylight saving times and a lot of confusion
by Thomas Gelf 20 Sep '07

20 Sep '07

Hi list, timezones and daylight saving time are causing me a serious headache, and I hope that someone can give me a hint :-) Let's start: * I have several servers sending syslog (clients) and also several syslog servers (receivers) * Most (all) of them are running syslog-ng :o) * Local timezone is Europe/Rome (CEST), that's GMT +01:00 and +02:00 while summertime * All systems have their system clock set to UTC and correct local settings (Europe/Rome) * syslog is written to local files on each server (just to be sure to miss nothing in case of network outages etc) + local files on syslog reciever (rotation & archive) + mysql db on syslog reciever (for short history & web app) * syslog reciever is currently getting about 60 syslog entries per second, once in full production that will be something like 200 per second Even if all of my servers are (at least right now) residing in the same timezone I would like to do things the right way. Therefore in my believes timestamp should be saved as a UTC value - correct localized presentation should be up to my web application. Documentation is telling me that: > 2.6. Daylight saving changes > The syslog-ng application receives the timezone and daylight saving > information from the operating system it is installed on. If the > operating system handles daylight saving correctly, so does > syslog-ng. This is great news :-) But what exactly does it mean to me? As told before all my systems are running with UTC system clock and CEST local timezone. Should I set recv_time_zone("+01:00")? Doesn't make sense to me, as I need CEST: +01:00 and +02:00!? Should I set send_time_zone('00:00') on each syslog client? Can I trust S_UNIXTIME and / or R_UNIXTIME (instead of R_HOUR & Co)? Lot's of questions, I know :o) Thanks for your attention! Cheers, Thomas Gelf -- Thomas Gelf <thomas(a)gelf.net>

2 1

compiling Spoof address problem
by James B Horwath 20 Sep '07

20 Sep '07

I am trying to compile 2.0.5 syslog-ng without success. I am interested in compiling the code with spoof-source support, however I am running into compiler errors reference Bazsi's directory structure. Even when I try to compile without any options I receive the message below. I am running RedHat AS4. ./configure --enable-debug --enable-dynamic-linking --enable-tcp-wrapper --enable-spoof-source if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -DLIBNET_LIL_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -g -MT cfg-grammar.o -MD -MP -MF ".deps/cfg-grammar.Tpo" \ -c -o cfg-grammar.o `test -f 'cfg-grammar.c' || echo './'`cfg-grammar.c; \ then mv -f ".deps/cfg-grammar.Tpo" ".deps/cfg-grammar.Po"; \ else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:590: error: syntax error before ')' token /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:623: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/devel/jim/syslog-ng-2.0.5/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/devel/jim/syslog-ng-2.0.5' make: *** [all] Error 2 ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

2 1

the filter doesn`t work for the remote log
by liuruihong 19 Sep '07

19 Sep '07

I use the syslog-ng to receive remote log, The syslog-ng is running under linux ,the remote client is sending log by syslog, and the syslog-ng configure fie is as follows: options { use_dns(yes); create_dirs(yes); }; source src { udp(ip(0.0.0.0) port(514)); }; filter f_cron { facility(cron); }; filter f_messages { not facility(cron); }; destination messages { file("/home/liuruihong/syslog-ng/log/$HOST/$YEAR/messages-$MONTH"); }; destination cron { file("/home/liuruihong/syslog-ng/log/$HOST/$YEAR/cron-$MONTH"); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_messages); destination(messages); }; but the log files "messages-$MONTH" still include the crond information, I don't know why?

2 2

Messages not going to logs
by David H. Lynch Jr. 18 Sep '07

18 Sep '07

I am running syslog-ng under OpenBSD 4.1. I am using it as a debugging tool for driver/application development. I have used it similarly for Linux driver application development without problem. Normal system logging is working correctly But syslog messages sent from inside applications are only going to the console. I have tried different permutations of openlog openlog("pico", LOG_PERROR, LOG_LOCAL0); syslog("(%s, %d)", path, readonly); results in a message on the console but grep -rl pico /var/log returns nothing. Any ideass how to debug/trace/chase this down would be greatly appreciated.

2 1

Re: [syslog-ng] ArcSight (Again)
by Ivey, Chris 17 Sep '07

17 Sep '07

Concatenate, you are a life saver. I appreciate your insight into this issue, and I will forward your thoughts on the ArcSight/RFC/Cisco Messages over to the ArcSight support folks here and ask that they get with ArcSight and see what they think. I went online and looked at docs, figured out the template deal on my local linux box, then changed their destination to come in with template("$MSG\n"). I think that will give them what they need. Thanks again for your insight on this issue! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Concatenate Sent: Friday, September 14, 2007 10:58 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] ArcSight (Again) OBTW, use a template for that destination. IIRC the $MSG macro sent over to them will be exactly what you need. Just change the destination to a file for testing and see what your template does, easy to test that way. When it's all good change it back. ...... Original Message ....... On Fri, 14 Sep 2007 15:49:02 -0500 "Ivey, Chris" <Chris.ivey(a)acs-inc.com> wrote: > > >OK folks, this has come up (again). Seems that the ArcSight parser is not intelligent enough to handle messages coming from syslog-ng after being forwarded along. So I need some advice on how to handle this issue. First, some background... > >I added our ArcSight server as a syslog-ng target some time ago. The folks who use the ArcSight stuff emailed me and said that the parser for ArcSight could not handle parsing the messages coming from syslog-ng, because of the prepending of the server time to the syslog-ng message. Here is an excerpt from one of the emails from their support folks: > >In looking through all the information, I see that there are lot of parsing issues, all due to what look like malformed syslog messages. > >For example: >Apr 25 22:54:24 x.x.x.x router/router 99228: Apr 25 22:54:23.474 UTC: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on GigabitEthernet1/0/1 (not full duplex), with switch FastEthernet0/1 (full duplex). > >This is a raw event from the export. Notice that the second timestamp forward is the actual message, which is CDP, so from a cisco switch or some layer 2 device. > >The actual event from the cisco device should look like as follows, which is what our parser is designed to work with: >Apr 25 22:54:23.474 UTC: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on GigabitEthernet1/0/1 (not full duplex), with switch FastEthernet0/1 (full duplex). > >Another excerpt... > >I looked over the information you had uploaded already, and is actually a common issue. When syslog events are forwarded from one syslog server to another syslog server, or pipe, or file, the forwarding syslog server prepends timestamp and other information, which makes the message unusable. > >We require syslog message to adhere to the standard RFC syslog format for the connector to read them, and when forwarding syslog messages that is not the case and we are unable to support that configuration. > >So, the question is what to do about it. I apparently need to send this information on to the ArcSight server without the prepended data (the "Apr 25 22:54:24 x.x.x.x router/router 99228:" portion of the message from the first email excerpt), but I need to keep it in place for EVERY other target I am sending to. Can anyone tell me what are my options here, please? Thanks a LOT in advance!!! > >(Bazsi, please feel free to chime in on this one! LOL) > >Chris Ivey > >Affiliated Computer Services >Enterprise Management Integration Services >Infrastructure Management Senior Analyst > >chris.ivey(a)acs-inc.com > >"I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison >"When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes >"I reject your reality, and substitute my own!" -- Adam Savage > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng] non standard syslog message!
by Wilson Lai 17 Sep '07

17 Sep '07

Dear Balazs, Could you please give me some information about the script which could convert the non syslog message into syslog standard syslog format? Thanks. Regards, Wilson Lai System Engineer IT Dept., SJM Office ( : (853)2978585 Mobile ( : (853)66506709 Email +: : wilsonlai(a)macausjm.com -----Original Message----- From: syslog-ng-request(a)lists.balabit.hu [mailto:syslog-ng-request@lists.balabit.hu] Sent: Friday, September 14, 2007 6:00 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 29, Issue 11 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: Compiling on HP/UX 11.11 (Balazs Scheidler) 2. Re: Compiling on HP/UX 11.11 (C Wells) 3. Mysql Syslog Data (John Hala) 4. Re: non standard syslog messgae! (Wilson Lai) 5. Re: Mysql Syslog Data (Paul Robert Marino) 6. Re: Compiling on HP/UX 11.11 (Balazs Scheidler) 7. Re: non standard syslog messgae! (Balazs Scheidler) ---------------------------------------------------------------------- Message: 1 Date: Thu, 13 Sep 2007 19:04:10 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] Compiling on HP/UX 11.11 To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1189703050.15286.20.camel(a)bzorp.balabit> Content-Type: text/plain On Mon, 2007-09-10 at 10:34 -0700, C Wells wrote: > This glib listed below worked fine (thanks), but then > it asked for eventlog version >= 0.2, which I found at > balabit and installed and then it asked for libnet, > for which I found the binary, so finally the configure > worked. Make asked for flex, which I had renamed > because it made configure die. I put flex back and it > passed that point but dies on this > > gcc -g -O2 -Wall -g -o syslog-ng main.o > libsyslog-ng.a -lnsl -lrt -L/usr/local/lib > -lglib-2.0 -lintl -liconv -L/usr/local/lib -levtlog > -lnet > /usr/ccs/bin/ld: Unsatisfied symbols: > linenum (first referenced in > libsyslog-ng.a(cfg-grammar.o)) (data) > lookup_parse_flag (first referenced in > libsyslog-ng.a(cfg-grammar.o)) (code) > strtoll (first referenced in > libsyslog-ng.a(affile.o)) (code) > yylex (first referenced in > libsyslog-ng.a(cfg-grammar.o)) (code) > lex_init (first referenced in > libsyslog-ng.a(cfg.o)) (code) > collect2: ld returned 1 exit status your ld is fine. As it seems cfg-lex.c was regenerated and probably empty, that's why it does not contain the lookup_parse_flag() function. Try removing cfg-lex.c, and rerun make. It should regenerate cfg-lex.c using flex. As I see the configure test did not find libfl.a (or libfl.so) for some reason. Try adding that to your link command line. What's the error message of configure that you get if you have flex installed and not renamed? -- Bazsi ------------------------------ Message: 2 Date: Thu, 13 Sep 2007 11:16:31 -0700 (PDT) From: C Wells <s2audi(a)yahoo.com> Subject: Re: [syslog-ng] Compiling on HP/UX 11.11 To: syslog-ng(a)lists.balabit.hu Message-ID: <663351.40801.qm(a)web60422.mail.yahoo.com> Content-Type: text/plain; charset=iso-8859-1 > What's the error message of configure that you get if you have flex installed and not renamed? 'checking lex output file root... configure: error: cannot find output from flex; giving up' I guess I can try a newer flex maybe, not sure Thanks ________________________________________________________________________ ____________ Tonight's top picks. What will you watch tonight? Preview the hottest shows on Yahoo! TV. http://tv.yahoo.com/ ------------------------------ Message: 3 Date: Thu, 13 Sep 2007 22:24:02 -0400 From: John Hala <john.hala(a)villanova.edu> Subject: [syslog-ng] Mysql Syslog Data To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <294949F5411DFC418D1DEC84BE825AE11DA3CFEA66(a)VUEX2.vuad.villanova.ed u> Content-Type: text/plain; charset="us-ascii" So I have my syslogs going to a mysql database. What are some recommended ways to make this data useful? Here's how I created the table: CREATE TABLE syslog ( host varchar(32) default NULL, facility varchar(10) default NULL, priority varchar(10) default NULL, level varchar(10) default NULL, tag varchar(10) default NULL, date date default NULL, time time default NULL, program varchar(15) default NULL, msg text, seq int(10) unsigned NOT NULL auto_increment, PRIMARY KEY (seq), KEY host (host), KEY seq (seq), KEY program (program), KEY time (time), KEY date (date), KEY priority (priority), KEY facility (facility) ) TYPE=MyISAM; ------------------------------ Message: 4 Date: Fri, 14 Sep 2007 12:03:46 +0800 From: "Wilson Lai" <wilsonlai(a)macausjm.com> Subject: Re: [syslog-ng] non standard syslog messgae! To: syslog-ng <syslog-ng(a)lists.balabit.hu> Message-ID: <H000006e0084a3d0.1189742625.mail.macausjm.com@MHS> Content-Type: text/plain; charset="US-ASCII" Hi, The message is not generated from a Cisco device. It is a third party application log which has the format as follow ; " Error Browser (Service 14) Thu May 10 01:52:15 2007 [OM 0] Pid of logging process: 1029 Last Msg ID : JavaMail.root(a).scalix.x.y.com Last Msg DirectRef: 000a4beace41e153 " " How could I convert it into a standard syslog format? Thanks. Regards, Wilson Lai System Engineer IT Dept., SJM Office ( : (853)2978585 Mobile ( : (853)66506709 Email +: : wilsonlai(a)macausjm.com -----Original Message----- From: syslog-ng-request(a)lists.balabit.hu [mailto:syslog-ng-request@lists.balabit.hu] Sent: Thursday, September 13, 2007 6:00 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 29, Issue 10 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: syslog-ng Digest, Vol 28, Issue 21 (Balazs Scheidler) ---------------------------------------------------------------------- Message: 1 Date: Wed, 12 Sep 2007 17:06:49 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] syslog-ng Digest, Vol 28, Issue 21 To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1189609609.7181.4.camel(a)bzorp.balabit> Content-Type: text/plain On Fri, 2007-09-07 at 07:26 -0700, Nate Campi wrote: > On Fri, Sep 07, 2007 at 05:26:02PM +0800, Wilson Lai wrote: > > Dear all, > > What happen if the log message is not a standard syslog message? > > Thanks. > > If a Cisco switch sends a message like this: > 2005 Aug 23 03:04:05 UTC +00:00 %PAGP-5-PORTFROMSTP:Port 4/16 left bridge port 4/16 > > ...it'll be written to disk like this: > > Aug 23 03:04:05 switch.company.com 2005 Aug 23 03:04:05 UTC +00:00 %PAGP-5-PORTFROMSTP:Port 4/16 left bridge port 4/16 > > syslog servers put in a proper syslog formatted header. > > The behavior is documented here: > > http://www.faqs.org/rfcs/rfc3164.html > > It's not syslog-ng specific behavior. In fact I've added some Cisco date stamp support, so date stamps of some of the Cisco gear are properly recognized. But Cisco is not using consistent timestamps in their different product lines. -- Bazsi ------------------------------ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng End of syslog-ng Digest, Vol 29, Issue 10 ***************************************** ------------------------------ Message: 5 Date: Fri, 14 Sep 2007 03:08:47 -0400 From: Paul Robert Marino <prmarino1(a)gmail.com> Subject: Re: [syslog-ng] Mysql Syslog Data To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Message-ID: <1189753731.9CBEB49(a)di12.dngr.org> Content-Type: text/plain; charset="us-ascii"; format="flowed" Have you looked at the phpsyslog-ng project on source forge its quite nice and usefull my only complaint about it is it only works with mysql. ___________________________________________ The average person does a lot of work in the name of laziness! Save youre self the effort by doing it right the first time. Do it with free speech software. ------------------------------ Message: 6 Date: Fri, 14 Sep 2007 10:28:04 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] Compiling on HP/UX 11.11 To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1189758484.7167.3.camel(a)bzorp.balabit> Content-Type: text/plain On Thu, 2007-09-13 at 11:16 -0700, C Wells wrote: > > What's the error message of configure that you get > if you have flex installed and not renamed? > > 'checking lex output file root... configure: error: > cannot find output from flex; giving up' > I guess I can try a newer flex maybe, not sure The config.log file might have more details. The error basically says that the output for flex was not found. Are you sure it is using flex and not the system installed lex? Again, the config.log file has more details. The flex/lex commands generate their output as a fixed named file (usually lex.yy.c) and the makefiles cannot find this file. Try running the flex command line by hand and check whether the file gets generated. -- Bazsi ------------------------------ Message: 7 Date: Fri, 14 Sep 2007 10:29:48 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] non standard syslog messgae! To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1189758588.7167.6.camel(a)bzorp.balabit> Content-Type: text/plain On Fri, 2007-09-14 at 12:03 +0800, Wilson Lai wrote: > Hi, > The message is not generated from a Cisco device. It is a third > party application log which has the format as follow ; > " Error Browser (Service 14) Thu May 10 01:52:15 > 2007 > [OM 0] > Pid of logging process: 1029 > Last Msg ID : JavaMail.root(a).scalix.x.y.com > Last Msg DirectRef: 000a4beace41e153 " " > How could I convert it into a standard syslog format? > Thanks. Is this a log file currently? Syslog-ng would convert this multi-line log message as individual log entries, which is probably not what you want. You can use a script or something that makes this look like syslog and then write it to a named pipe or something and have syslog-ng read that. -- Bazsi ------------------------------ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng End of syslog-ng Digest, Vol 29, Issue 11 *****************************************

1 0

Re: [syslog-ng] non standard syslog messgae!
by Wilson Lai 14 Sep '07

14 Sep '07

Hi, The message is not generated from a Cisco device. It is a third party application log which has the format as follow ; " Error Browser (Service 14) Thu May 10 01:52:15 2007 [OM 0] Pid of logging process: 1029 Last Msg ID : JavaMail.root(a).scalix.x.y.com Last Msg DirectRef: 000a4beace41e153 " " How could I convert it into a standard syslog format? Thanks. Regards, Wilson Lai System Engineer IT Dept., SJM Office ( : (853)2978585 Mobile ( : (853)66506709 Email +: : wilsonlai(a)macausjm.com -----Original Message----- From: syslog-ng-request(a)lists.balabit.hu [mailto:syslog-ng-request@lists.balabit.hu] Sent: Thursday, September 13, 2007 6:00 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 29, Issue 10 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: syslog-ng Digest, Vol 28, Issue 21 (Balazs Scheidler) ---------------------------------------------------------------------- Message: 1 Date: Wed, 12 Sep 2007 17:06:49 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] syslog-ng Digest, Vol 28, Issue 21 To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1189609609.7181.4.camel(a)bzorp.balabit> Content-Type: text/plain On Fri, 2007-09-07 at 07:26 -0700, Nate Campi wrote: > On Fri, Sep 07, 2007 at 05:26:02PM +0800, Wilson Lai wrote: > > Dear all, > > What happen if the log message is not a standard syslog message? > > Thanks. > > If a Cisco switch sends a message like this: > 2005 Aug 23 03:04:05 UTC +00:00 %PAGP-5-PORTFROMSTP:Port 4/16 left bridge port 4/16 > > ...it'll be written to disk like this: > > Aug 23 03:04:05 switch.company.com 2005 Aug 23 03:04:05 UTC +00:00 %PAGP-5-PORTFROMSTP:Port 4/16 left bridge port 4/16 > > syslog servers put in a proper syslog formatted header. > > The behavior is documented here: > > http://www.faqs.org/rfcs/rfc3164.html > > It's not syslog-ng specific behavior. In fact I've added some Cisco date stamp support, so date stamps of some of the Cisco gear are properly recognized. But Cisco is not using consistent timestamps in their different product lines. -- Bazsi ------------------------------ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng End of syslog-ng Digest, Vol 29, Issue 10 *****************************************

2 1

Re: [syslog-ng] Compiling on HP/UX 11.11
by C Wells 14 Sep '07

14 Sep '07

> What's the error message of configure that you get if you have flex installed and not renamed? 'checking lex output file root... configure: error: cannot find output from flex; giving up' I guess I can try a newer flex maybe, not sure Thanks ____________________________________________________________________________________ Tonight's top picks. What will you watch tonight? Preview the hottest shows on Yahoo! TV. http://tv.yahoo.com/

2 1

IP forwarding
by James B Horwath 14 Sep '07

14 Sep '07

Is it possible to forward only certain IP ranges in syslog-ng when it is running in server mode? If I have 10.10.10.0\24 10.10.20.0\24 10.20.10.0\0 and I want to forward 10.20.10.0\0 and 10.10.10.0\24 and nothing else is this possible. Regards, Jim ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

4 3