October 2008 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] Log to postgres
by ml＠bortal.de 02 Oct '08

02 Oct '08

Hello, I just tried to get syslog-ng 2.1.1 working by doing: #/usr/local/src/libdbi8-0.8.2bb2# make install --> Libraries have been installed in: /usr/local/lib #/usr/local/src/libdbi8-drivers-0.8.2bb3# ./configure --with-pgsql --with-dbi-libdir=/usr/local/lib --disable-docs --> configure: error: Invalid libdbi directory - include files not found. What am i doing wrong? Thanks, Mario

2 1

Log to postgres
by ml＠bortal.de 02 Oct '08

02 Oct '08

Hello List, is there a open-source way to log to a postgres database nativly? We have problems using a pipe. Is is beeing described on page 107 of the syslog-ng Admin Guid but i am not sure if this is only available for the commercial version. Thanks, Mario

2 1

Reload does not free up RAM
by Evan Rempel 02 Oct '08

02 Oct '08

We have cases where a syslog-ng buffers quite a bit of data (2GB or so) before it is able to flush the data to the destination. Currently, the only way to "free up" that RAM is to restart syslog-ng, which means that some log messages are lost during the restart window. I open for discussion the idea that on a reload that syslog-ng flush and free all buffer space and essentially start from a "just started" state again. Comments?

2 1

Re: [syslog-ng] escaping \[ not respected
by Len Conrad 02 Oct '08

02 Oct '08

>Hello, > >> targeted string is "unknown[a.b.c.d]" >> >> my filter: >> >> filter f_conn_from_unk_private { not match >> ("unknown\[(10\.1\.|10\.2\.|10\.10\.5\.|192\.168\.200)"); }; >> >> error: >> >> Error compiling regular expression; >> re='[(10.1.|10.2.|10.10.5.|192.168.200)', error='brackets ([ >]) not balanced' > >I can't confirm this behaviour, as the following does work for me: > >filter f_internal_statistics { > match("^syslog-ng\[[[:digit:]]+.: STATS") or match ("^syslog-ng\[[[:digit:]]+\]: Log statistics"); >}; > >What syslog-ng version are you using? Mine is 2.0.9 Installed with FreeBSD pkg_add from freshports.org, pkg_info shows: "syslog-ng2-2.0.9_1 A powerful syslogd replacement" I conclude that I've found a bug in the parsing of the escape sequence "\[" , and will look for a work around. thanks, Len ______________________________________________ IMGate OpenSource Mail Firewall www.IMGate.net

5 5

$MSGONLY bad output
by Steven 01 Oct '08

01 Oct '08

Hi there, As I can't find this on the web, I'm asking here : I'm receiving the IIS servers logs through my LAN and syslog-ng writes everything to a local files, that is parsed during the night by awstats. The only thing is I can't have syslog-ng to write raw logs to files, it absolutely has to write something (either with $MSG or $MESSAGE). I even tried with $MSGONLY but now I get the opposite problem, it truncates data ! $MSG : IISWebLog 0 2008-09-30 14:02:40 GET /Localized/fr/Images/New2/tlogo.gif - 95.35.41.243 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.0;+SLCC1;+.NET+CLR+2.0.50727 ;+Media+Center+PC+5.0;+.NET+CLR+3.0.04506;+InfoPath.2) http://mypublicwebsite/home/regf 200 2185 With $MSGONLY, I'll get : 02:40 GET /Localized/fr/Images/New2/tlogo.gif - 95.35.41.243 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.0;+SLCC1;+.NET+CLR+2.0.50727 ;+Media+Center+PC+5.0;+.NET+CLR+3.0.04506;+InfoPath.2) http://mypublicwebsite/home/regf 200 2185 Here is my very simple template : template t_IIS { template("$MESSAGE\n"); template_escape(no); }; Destination and filter : destination df_ mypublicwebsite _IISWebLog { file("/data/syslog/mypublicwebsite/IISWebLog" template(t_IIS)); }; filter f_ mypublicwebsite _IISWebLog {(host("^192\.168\.117\.131$") or host("^192\.168\.117\.132$") or host("^192\.168\.117\.133$") or host("^192\.168\.117\.134$") or host("^192\.168\.117\.135$") ) and facility(local4) and program("IISWebLog"); }; log { source(s_net); filter(f_ mypublicwebsite _IISWebLog); destination(df_ mypublicwebsite _IISWebLog); }; # uname -a Linux TR-ADM 2.6.18-4-amd64 #1 SMP Fri May 4 00:37:33 UTC 2007 x86_64 GNU/Linux Anything I'm missing ? Any help would be greatly appreciated. Best regards Steven

3 4

separe files question
by Mártha Csaba 01 Oct '08

01 Oct '08

Hello I have a question, i get logfiles from facility0, with these matter: AppID(0-9a-Z)-ThreadID(0-9a-Z)-DATE-TIME-MESSAGE i created a filter, with this content: filter f_flash_msg { match ("[0-9a-zA-Z]+-[0-9a-zA-Z]-*"); }; and destination destination df_out { file("/var/log/client/flashlog/$1/$2/$YEAR/$MONTH/ $DAY/$TIME.txt"); }; i need separate folders/files. the log line contains these datas: 1234-ABCD-2008-09-30-16-20-35-FatalError AppID-Thread-Date-Time-MSG i need this structure: /var/log/syslog-ng/flashlogs/1234/ABCD/2008/09/30/16.txt what is my mistake? Best Regards Csaba

2 2

escaping \[ not respected
by Len Conrad 01 Oct '08

01 Oct '08

targeted string is "unknown[a.b.c.d]" my filter: filter f_conn_from_unk_private { not match ("unknown\[(10\.1\.|10\.2\.|10\.10\.5\.|192\.168\.200)"); }; error: Error compiling regular expression; re='[(10.1.|10.2.|10.10.5.|192.168.200)', error='brackets ([ ]) not balanced' Len ______________________________________________ IMGate OpenSource Mail Firewall www.IMGate.net

2 1