November 2009 - syslog-ng - lists.balabit.hu

first post - newbie question
by Christopher Barry 03 Nov '09

03 Nov '09

Hi All, Looking for good config example that: sets up syslog-ng as the central log server catching standard remote syslog hosts logs, placing them in hostname dirs, with all of the remotes hosts logfiles intact in the hostname dirs. Creating 'date' dirs above the hostname dirs would be sweet too. I've been googling around, but can't really find what I'm after. Did see this, which is essentially what I want, but it seemed to be left unanswered. http://www.syslog.org/forum/syslog-ng/individual-files/ Thanks for any pointers to docs/samples you can give me. Cheers, -C

3 4

syslog-ng3 with SQL on FreeBSD
by Michael W. Lucas 03 Nov '09

03 Nov '09

Hi, I'm working on getting syslog-ng 3.0.3 to support SQL on FreeBSD, and hopefully get it added to the FreeBSD package or port. It looks like something isn't quite right in the configure script, however. I have libdbi 0.8.3 installed, but "./configure --enable-sql=yes" still reports: checking for LIBDBI... gnome-config: not found no checking for dbi_initialize in -ldbi... no I've reviewed /usr/local/include/dbi/dbi.h, and dbi_initialize is in there. Can anyone suggest a fix? Thanks, ==ml -- Michael W. Lucas mwlucas(a)BlackHelicopters.org http://www.MichaelWLucas.com/ Latest book: Cisco Routers for the Desperate, 2nd Edition http://www.CiscoRoutersForTheDesperate.com/

2 1

can two destinations refer to the same file?
by Jason Haar 03 Nov '09

03 Nov '09

Hi there I'm wanting to configure syslog-ng so that I have two different filters that are associated with two different destinations - which have the same filename - but different templates. The issue I have is that we have a range of syslog clients, which may or may not have trustworthy clocks. So I default to ignoring their timestamps and use the syslog servers clock, except for the hosts I know to also use NTP. What I want to confirm is that syslog-ng will happily open /var/log/messages ONCE and will parse the following the way I intend? ie #clocks on unix systems (which are named 'blah-unix-number') are always configured correctly filter f_goodclock { host("-unix-") }; #can't trust everything else filter f_badclock { not host("-unix-") }; destination d_badclock_messages { file("/var/log/messages" template("$R_ISODATE $HOST $FACILITY $PRIORITY $MSG\n") }; destination d_goodclock_messages { file("/var/log/messages" template("$S_ISODATE $HOST $FACILITY $PRIORITY $MSG\n") }; log { ... filter(f_badclock); destination(d_badclock_messages);}; log { ... filter(f_goodclock); destination(d_goodclock_messages);}; Should that work as I hope? Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

3 3

HOST macro using relay
by Jason Barrett 03 Nov '09

03 Nov '09

Hi all, I'm relaying log messages from one syslog-ng server to another. At the final stop, the only way I can get the $HOST macro to work is if I enable dns resolution on server 1 (I'd like to avoid this). Is this by design? Here are the relevant configs: ---------------------------------------------------------------------- syslog-ng server 1 (relays to server 2): chain_hostnames(yes); keep_hostname(yes); use_dns(no); source s_udp { udp(port(514)); }; destination df_udpback { udp("192.168.1.157" port(514)); }; log { source(s_udp); destination(df_udpback); }; ---------------------------------------------------------------------- syslog-ng server 2: chain_hostnames(yes); keep_hostname(yes); use_dns(yes); source s_udp { udp(port(514)); }; destination df_udp { file("/var/log/ics/$HOST/$YEAR/$MONTH/$DAY"); }; log { source(s_udp); destination(df_udp); }; ---------------------------------------------------------------------- Sample log message on server 2: Oct 30 09:35:03 10.12.24.46/10.12.24.46 %ASA-5-111005: 10.28.22.55 end configuration: OK 10.12.24.46 is the correct IP address of the originating host, and $HOST resolves to this IP address. I would prefer $HOST to resolve to the hostname as it exists in the /etc/hosts file. Thanks!

1 0

Re: [syslog-ng] Re : flags(final)
by Michael J. Bauer 03 Nov '09

03 Nov '09

I've upgraded from syslog-ng 2.1.4 to 3.0.4, in case flags(final) was somehow broken in that version. The upgrade has made no difference: flags(final) still appears to have no effect. I am attempting to shunt all entries containing FWNAT into a separate file (network-address-translation), and keep them out of the default destination (default). The configuration, below, writes the entries to both, despite the presence of flags(final) in a prior log{} statement. My understanding based on reading the documentation and various sample configurations is that flags(final) in one log{} statement should preclude the log entry in question from going to any subsequent log{} statement. Am I misunderstanding how flags(final) works, or should I submit a bug report? If I'm misunderstanding, please let me know if there is a way to get the behavior I'm describing. Thanks, MJB My syslog-ng 3-ified configuration: @version:3.0 options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" program_override("kernel")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination d_network_address_translation { file("/var/log/network-address-translation" flush_lines(10) flush_timeout(1000)); }; destination d_default { file("/var/log/default" flush_lines(10) flush_timeout(1000)); }; filter f_network_address_translation { host("hlgn-crtr-01-service") and priority(info) and facility(local2) and match("FWNAT"); }; log { source(s_sys); filter(f_network_address_translation); destination(d_network_address_translation); flags(final); }; log { source(s_sys); destination(d_default); }; Michael J. Bauer wrote: > That flags(final) is in fact part of the log{} line. The destination() > is also part of the log{} line, and appears on a line of its own because > of line wrap. The log{} line is, in one line (and hoping to avoid wrap): > > log { source(s_sys); filter(f_network_address_translation); > destination(d_network_address_translation); flags(final); }; > > The terminating }; is after flags(final);. Neither of the real > destination{} lines contain flags(final). > > MJB > > srainville(a)videotron.ca wrote: > >> The flags(final) goes at the end of the log statement, not the >> destination. >> >> Cheers, >> >> Steve >> ----- Message d'origine ----- >> De: "Michael J. Bauer" <mjbauer(a)eecs.tufts.edu> >> Date: Jeudi, 24 Septembre 2009, 23:00 >> Objet: [syslog-ng] flags(final) >> À: syslog-ng(a)lists.balabit.hu >> >> >>> I think I am misunderstanding what flags(final) is supposed to >>> do. I'm >>> running syslog-ng 2.1.4 on RHEL 5.4 (Tikanga). >>> >>> I have a fairly simple syslog-ng configuration, which I've >>> attached >>> below. I'm trying to pick off individual groups of log >>> entries and put >>> them in their own individual files. I want to ensure that >>> each gets >>> logged exactly once, so I'm using flags(final). I also >>> have a catch-all >>> at the end in case I've missed something, but the ultimate goal >>> is to >>> have that file present, but empty. >>> >>> However, with this configuration, the log entries that appear in >>> d_network_address_translation (/var/log/network-address- >>> translation) >>> also appear in d_default (/var/log/default) despite the presence >>> of >>> flags(final) on an earlier log() line. Should it work this >>> way? If so, >>> what can I do to get the desired behavior? >>> >>> Thanks, >>> MJB >>> >>> options { >>> sync (0); >>> time_reopen (10); >>> log_fifo_size (1000); >>> long_hostnames (off); >>> use_fqdn (no); >>> create_dirs (no); >>> keep_hostname (yes); >>> }; >>> >>> source s_sys { >>> file ("/proc/kmsg" >>> log_prefix("kernel: ")); >>> unix-stream ("/dev/log"); >>> internal(); >>> udp(ip(0.0.0.0) port(514)); >>> }; >>> >>> destination >>> d_network_address_translation { >>> file("/var/log/network-address-translation"); }; >>> destination >>> d_default { file("/var/log/default"); }; >>> >>> filter f_network_address_translation { host("router-service- >>> interface") and >>> priority(info) and >>> facility(local2) and >>> match("FWNAT"); }; >>> >>> log { source(s_sys); >>> filter(f_network_address_translation); >>> >>> destination(d_network_address_translation); flags(final); }; >>> log { source(s_sys); >>> destination(d_default); }; >>> >>> >>> >> ______________________________________________________________________________ >> >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation: >>> http://www.balabit.com/support/documentation/?product=syslog-ng >>> FAQ: http://www.campin.net/syslog-ng/faq.html >>> >>> >> ------------------------------------------------------------------------ >> >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.campin.net/syslog-ng/faq.html >> >> >> > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > >

2 1

syslon-ng temote logging
by Vasiliy G Tolstov 02 Nov '09

02 Nov '09

Hello. I have some trouble - all my mail logs send to local syslog-ng on server, that put it into file /var/log/maillog and send to remote logger by udp, then remote logging server dies, local syslog-ng buffers logs some time, after that - system has very big lavg. Is that possible to drops some logs if the destination server not available? -- Vasiliy G Tolstov <v.tolstov(a)selfip.ru> Selfip.Ru

2 1