March 2008 - syslog-ng - lists.balabit.hu

Mail Alert
by John Duraisw 11 Mar '08

11 Mar '08

Hello, I am doing the following intercept stuff, and everything seems to be working fine. What I want to do is, in the subject line I want to parse the hostname. Could you guys help me with this. Thanks, -john destination mail-alert { program("/usr/local/bin/syslog-mail.sh"); }; filter f_config_alert { ( ( host("host1") or host("host2") or host("host3") or host("host4") ) and match("Configured from console") ); }; # Send alert when some Genius configure something log { source(s_net); source(s_system); filter(f_config_alert); destination(mail-alert); }; [root@central-logger ~]# more /usr/local/bin/syslog-mail.sh #!/bin/sh RECIPIENTS"john(a)abc.com" while read line; do echo $line | /bin/mail -s "Config Change notification for $1" $RECIPIENTS done

1 0

syslog-ng and log4j
by Sigurður Bjarnason 10 Mar '08

10 Mar '08

Hi All My first time on this list so be gentle J I have questions about syslog-ng and log4j. I am using syslog-ng as central server with syslog-ng on clients forwarding logs to the central server and I have notice that logs from java ( log4j ) are being dropped under heavy load, so I did some investigating and found out that log4j only send on UDP rather then TCP like all other logs . Is it possible to get log4j to send logs over TCP by sending logs from java to socket or otherwise, I would guess that log4j is not capable of sending logs to TCP since I have tried to take the udp section out of the syslog-ng config and then no logs are received from java L Can please someone tell me what my options are here, I really need to get logs from java over to the central server without this drop since these are the most critical logs on my system . Regards Siggi

2 3

Leap Year
by hi ro 06 Mar '08

06 Mar '08

Hi, Do you have any problem about Leap Year? Thanks hiro _________________________________________________________________ Hotmailユーザの半数近くが使用しています。Windows Liveメッセンジャー。 http://messenger.live.jp/

3 2

Parallel Use of syslog-ng with syslogd (Linux RH ES4)
by Diffenderfer, Randy 04 Mar '08

04 Mar '08

Folks, I haven't yet done the research here by RTFS'ing, so I apologize in advance for uninformed posting... :-) I'm looking at syslog-ng as a syslogd replacement in our shop. I'd like to determine in advance if there is a reasonable way to run these in parallel. In particular, are there supplied hooks to routines equivalent to syslog(3) in the C library? I understand that I can shut down syslogd and bring up syslog-ng listening to /dev/log, and things will be transparent to production code. I envision an environment where I have the RH syslogd listening to /dev/log, and syslog-ng listening to /dev/log-ng. Using perl and C routines, can I integrate my production code with minimal alterations to selectively use the new facility? Thanks for any advice, rnd

2 1

Re: [syslog-ng] Syslog-ng 2.0.x on Fedora Core 4
by Ivey, Chris 03 Mar '08

03 Mar '08

Sandor/ScottO, Thanks for the information that it works properly on old releases. If I could trouble you guys for *how* you made it work, that would be great. I did some testing using my personal Linux machine (FC5), and I could not get the application to install (could not find all the needed preliminaries). If you want to PM me for this, that would be fine, since I am sure the rest of the list does not need to be exposed to my lack of knowledge. (( For what it's worth - I inherited these machines, had nothing to do with the original setup/configuration, and now find myself as the owner/admin of an application I don't know much about. )) Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage On Mon, Mar 3, 2008 at 4:42 AM, Geller, Sandor (IT) <Sandor.Geller(a)morganstanley.com <mailto:Sandor.Geller@morganstanley.com> > wrote: Hi, > Folks, > I need to upgrade syslog-ng running on my 2 servers, > which are running Fedora Core 4. Is it possible to put 2.0.x > onto a machine running FC4? I was looking around this morning > for this information, and can't find anything that says "yay" > or "nay". Thanks! It should just work (TM). I'm using syslog-ng 2.0 on very old OS releases, all you might need is to install its requirements: eventlog, libnet, glib and optionally tcp-wrappers. Regards, Sandor -------------------------------------------------------- Agreed, fwiw, I have it working just fine on FC3.

2 1

Syslog-ng 2.0.x on Fedora Core 4
by Ivey, Chris 03 Mar '08

03 Mar '08

Folks, I need to upgrade syslog-ng running on my 2 servers, which are running Fedora Core 4. Is it possible to put 2.0.x onto a machine running FC4? I was looking around this morning for this information, and can't find anything that says "yay" or "nay". Thanks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

3 2