June 2008 - syslog-ng - lists.balabit.hu

Problem in source file driver
by 広瀬真作 30 Jun '08

30 Jun '08

Hello all, I use syslog-ng 2.0.9. I am troubled in how to use the source file driver. The trouble is that a log message is output in duplicate after syslog-ng restart. I made following syslog-ng.conf. ------------------------------------------------------------ options { long_hostnames(off); sync(0); stats(0); time_reopen(10); dir_perm(0755); perm(0644); }; source s_test1 { internal(); file("/tmp/test_app_log" follow_freq(1) flags(no-parse) keep_timestamp(no)); }; destination d_test1 { file("/var/log/test.log"); }; log { source(s_test1); destination(d_test1); }; ------------------------------------------------------------ Next I tested syslog-ng action with following operation. ------------------------------------------------------------ # echo "test message `date`" >> /tmp/test_app_log # cat /var/log/test.log Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:54 testserv2 test message Mon Jun 30 10:58:53 JST 2008 # /etc/init.d/syslog-ng restart Stopping syslog-ng: [ OK ] Starting syslog-ng: [ OK ] # cat /var/log/test.log Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:54 testserv2 test message Mon Jun 30 10:58:53 JST 2008 Jun 30 10:59:05 testserv2 syslog-ng[17216]: Termination requested via signal, terminating; Jun 30 10:59:05 testserv2 syslog-ng[17216]: syslog-ng shutting down; version='2.0.9' Jun 30 10:59:05 testserv2 syslog-ng[17292]: syslog-ng starting up; version='2.0.9' Jun 30 10:59:05 testserv2 test message Mon Jun 30 10:58:53 JST 2008 ------------------------------------------------------------ The message "testserv2 test message Mon Jun 30 10:58:53 JST 2008" was output in duplicate after syslog-ng retart. I hope the message is not output in duplicate after syslog-ng restart. Is my hope readily achievable? Please advise me.

2 2

clearing /var/log/syslog file - its becoming bigger
by janskey 28 Jun '08

28 Jun '08

Hi Guys, I installed syslog-ng and php-syslog-ng. As what I know, php-syslog-ng will get all logs files in /varlog/syslog file to mysql db. Is it possible to clear /var/log/syslog file because its getting bigger? Since all logs are been copied to the db, is it safe to clear syslog? Is this possible? Thanks! cheers, janskey

1 0

Syslog-ng and Switch Catalyst Cisco 3750
by Rodrigo Fernandes 27 Jun '08

27 Jun '08

Hello all, I´d like to know how to config my switch Catalyst 3750 to log messages into my syslog-ng server. My syslog-ng is working fine with other clients. This switch work with the facility local6, or local7 in syslog-ng. The switch is logging only this line in my syslog-ng: Jun 26 01:54:29 xx.xx.xx.xx 53: 000053: 1d09h: %SYS-5-CONFIG_I: Configured from console by vty0 (xxx.xxx.xxx.xxx). I need to receive more information about this switch. Somebody help me in this issue? Thanks a lot, Rodrigo

2 1

problem in remote logging
by Gemi 27 Jun '08

27 Jun '08

Hi, I am facing problem in remote logging though is working very fine locally. please advise me what to do and where I am missing something. the details I am giving below. I have one target linux system (set top box) and one host Linux Desktop Machine. the syslogd and logging working fine on both target as well as on PC(host) machine individually . I have scenario, I have to run program on target machine. And I have to collect the log on PC(host) console as well as in some file say /tmp/log. I have started $syslogd -r on both the machines. the syslog.conf file on the machines are like this. target >> syslong.conf local0.* @ip.address (PC-Host machine) PC(host) >> syslog.conf local0.err /dev/console local0.* /tmp/log in process list syslogd shows like "syslogd -r" I have already run many times $ kill -SIGHUP /var/run/syslog.pid on both machine. even though it is not working -Gemi _________________________________________________________________ Post free property ads on Yello Classifieds now! www.yello.in http://ss1.richmedia.in/recurl.asp?pid=219

2 1

Problem in remote logging
by Gemi 27 Jun '08

27 Jun '08

Hi, I am facing problem in remote logging though is working very fine locally. please advise me what to do and where I am missing something. the details I am giving below. I have one target linux system (set top box) and one host Linux Desktop Machine. the syslogd and logging working fine on both target as well as on PC(host) machine individually . I have scenario, I have to run program on target machine. And I have to collect the log on PC(host) console as well as in some file say /tmp/log. I have started $syslogd -r on both the machines. the syslog.conf file on the machines are like this. target >> syslong.conf local0.* @ip.address PC(host) >> syslog.conf local0.err /dev/console local0.* /tmp/log in process list syslogd shows like "syslogd -r" I have already run many times $ kill -SIGHUP /var/run/syslog.pid on both machine. even though it is not working -Gemi _________________________________________________________________ Tried the new MSN Messenger? It’s cool! Download now. http://messenger.msn.com/Download/Default.aspx?mkt=en-in

1 0

Logging timezone info in each message for V 1.6.8
by Manju Ramanathpura (mramanat) 27 Jun '08

27 Jun '08

Hello, Wondering if there is a way to print timezone with each message in the Version 1.6.8 ? Currently my message looks something like below Jan 21 12:22:12 <rest of the message> Instead I would like to see something like below Jan 21 12:22:12 PDT 2008 <rest of the message> or something in that line where I can see the timezone info. I have come across some timezone handling documents from - http://www.syslog.org/syslog-ng/v2/#timezone_handling But only for the Version 2.x and not for version 1.6.X I'd appreciate if you can share any tips for printing timezone ( or perhaps ISO format timestamp ) in each message for V 1.6.8 Thanks, -Manju

2 1

suitability of syslog-ng with long messages
by Joe Shaw 24 Jun '08

24 Jun '08

Hi, I am working on a project in which we will have many gigabytes of data logged per day. The log producers themselves were mostly developed in house and presently are simply logging to a file, but as we build out the system we'll obviously need some centralization. I've been thinking about using syslog-ng for this. While most of the messages are relatively small -- on the order of hundreds of bytes or a couple kilobytes -- there are some exceptional cases where we are generating messages that could be as large as two megabytes and need these to be kept in tact. We'll be using the tcp() destination driver. Are there any performance considerations, gotchas, etc. in setting log_msg_size(2097152)? Would that have a bad interaction memory usage-wise, for example, with log_fifo_size() if it were set to 1000? I am trying to get a feel if syslog-ng is the right tool for the problem here, or if something else would be more suitable. Thanks for any info you can provide, Joe

2 3

Help on syslog-ng
by FELLMANN Eric (EXT) 20 Jun '08

20 Jun '08

Hello, I have install syslog-ng on solaris 10(machine A],it configured as log proxy server more /etc/syslog-ng/syslog-ng.conf options { chain_hostnames(no); keep_hostname(yes); use_fqdn(yes); log_fifo_size(1000); }; source local { sun-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; filter notdebug { level(info...emerg); }; destination ercmas13.eurocontrol.fr{ udp("ercmas13.eurocontrol.fr" port (514)); }; log { source(local); filter (notdebug); destination(ercmas13.eurocontrol.fr); }; A client (Machine C) on solaris 10 send logs on (Machine A) I say the log on ercmas13 (logs server) A client (Machine B) on redhat 4 send log on (Machine B) I have nothing on the log server I change this information in this files syslog-ng.conf on log proxy server Each possible communication mechanism has a corresponding source driver in syslog-ng. For example, to open a unix socket with SOCK_DGRAM style communication use the driver unix-dgram. The same socket using the SOCK_STREAM style - as used under Linux - is called unix-stream. source local { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; But when i restart le syslog-ng on log proxy server /etc/init.d/syslog-ng start syslog-ng service starting. Error binding socket; addr='AF_UNIX(/dev/log)', error='Address already in use (125)' Error initializing source driver; source='local' What is the problem ? Best regards Eric FELLMANN ____ This message and any files transmitted with it are legally privileged and intended for the sole use of the individual(s) or entity to whom they are addressed. If you are not the intended recipient, please notify the sender by reply and delete the message and any attachments from your system. Any unauthorised use or disclosure of the content of this message is strictly prohibited and may be unlawful. Nothing in this e-mail message amounts to a contractual or legal commitment on the part of EUROCONTROL, unless it is confirmed by appropriately signed hard copy. Any views expressed in this message are those of the sender.

2 1

Syslog-ng on Mac OS X Leopard 10.5.3
by James Lay 19 Jun '08

19 Jun '08

Hey all! Been trying like crazy just to get a simple setup going and I am having a REALLY tough time. Just to test I¹m wanting to make it easy and have EVERYTHING log to /var/log/messages (my line in syslog.conf is ³*.* /var/log/messages² which works quite well). I¹ve gone through and looked online and found one example for OS X ( http://sial.org/howto/logging/syslog-ng/) but it¹s not working..I don¹t get anything in my log files. Can any kind soul help me out here? Thank you. James

2 1

Syslog-ng 2.1 OSE rpm on Suse 10
by Raffaele 13 Jun '08

13 Jun '08

Hi, I'm trying to install syslog-ng 2.1 OSE from balabit precompiled packages and I get this output: #~/syslog-ng # rpm -ivh syslog-ng-2.1beta1-1.i586.rpm error: Failed dependencies: libdbi8.so.0 is needed by syslog-ng-2.1beta1-1.i586 #~/syslog-ng # cat /etc/issue Welcome to SUSE Linux Enterprise Server 10 (i586) - Kernel \r (\l). #~/syslog-ng # uname -a Linux 2.6.16.27-0.9-smp #1 SMP Tue Feb 13 09:35:18 UTC 2007 i686 athlon i386 GNU/Linux Searching on docs seems that libdbi8 is required for PE and not for OSE, am I wrong? Best regards Raffaele

2 3