April 2009 - syslog-ng - lists.balabit.hu

Regex and Syslog-ng
by Julien Vermet 16 Apr '09

16 Apr '09

Hello I have a problem with syslog-ng using match() in my filters. Here is the part of my syslog-ng.cong: " ###### # sources # all known message sources source s_all { file("/etc/syslog-ng/logtest" follow_freq(1)); }; ###### # destinations destination d_apache { file("/etc/syslog-ng/logapache"); }; destination d_system { file("/etc/syslog-ng/logsystem"); }; destination d_autres { file("/etc/syslog-ng/logautres"); }; ###### # filters filter f_apache { match(apache); }; filter f_system { match(system); }; filter f_autres { match((?!apache)); }; ###### # logs log { source(s_all); filter(f_apache); destination(d_apache); }; log { source(s_all); filter(f_system); destination(d_system); }; log { source(s_all); filter(f_autres); destination(d_autres); " As you can see, I want to search in lines if the string apache is present, if system is present or if apache is not present. The first two filters are OK, but the third doesn't work. Can you help me to solve the problem? Thanks.

2 1

Re: [syslog-ng] problem in writing to database 2
by Hahusseau, Thomas 14 Apr '09

14 Apr '09

Add a « & » at the end of the line with « mysql » to run the mysql client as a background task. _____ De : syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] De la part de gatfi sami Envoyé : dimanche 5 avril 2009 02:31 À : Syslog-ng users' and developers' mailing list Objet : [syslog-ng] problem in writing to database 2 i succefully added the folowing script to /etc/profile it recreates the pilpline but when i get access to the virtual machine by ssh it is blocked like this: Password: Last login: Sun Apr 5 03:08:51 2009 from linux-ux35.lan Have a lot of fun... i have to tape ctrl + c to have linux-test1:~ # i have to tape ctrl +c to get access to it here is the script #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u root --password= syslog< /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi i think the problem is from mysql -u root --password= syslog< /tmp/mysql.pipe 2009/4/4 gatfi sami <pfegatfi.sami(a)gmail.com <mailto:pfegatfi.sami@gmail.com> > hi i am configuring a centralised syslog server and when i arrived to the writing into the database there is some thing wrong because when i use a file as destination i see incoming logs when i restart apache2 or mysql in the client "tail - f /" i use syslog -ng 2.0 here is the client source my_src{ file("/var/log/apache2/error_log" follow_freq(1) ); file("/var/lib/mysql/mysqld.log" follow_freq(1) ); }; destination loghost { tcp("192.168.1.69" port(514)); }; log { source(my_src); destination(loghost); }; here is the server source mysrc{ tcp(ip(0.0.0.0) port(514) keep-alive(yes)); #udp(); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(mysrc); destination(d_mysql); }; note that a databes names syslog is already created and contain a table logs; if itry the following command : syslog-ng -f /etc/syslog-ng/syslog-ng.conf Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already in use (98)' Error initializing source driver; source='mysrc' ps i used to use the server as relai and send by udp using the same port 514 but now everinthing is commented like this # need help i added the following script to the file

3 2

match with value() never matches
by srainville＠videotron.ca 14 Apr '09

14 Apr '09

2 1

Installer feedback
by srainville＠videotron.ca 14 Apr '09

14 Apr '09

2 3

[Bug 41] New: make check uses non random tcp ports for testing
by bugzilla＠bugzilla.balabit.com 14 Apr '09

14 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=41 Summary: make check uses non random tcp ports for testing Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: enhancement Estimated Hours: 0.0 make check uses hardcoded/static tcp port numbers which means that make check will fail if building two syslog-ng in parallel. We have such situation here where two builder accounts are located on the same machine. Would be nice to see some PID-based randomness introduced there. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[PATCH] Cygwin: missing colon in default syslog-ng.conf
by Corinna Vinschen 14 Apr '09

14 Apr '09

Hi, The Cygwin service installer script creates a version entry without a colon, which leads to warnings. The below patch fixes that. Please apply. Thanks, Corinna --- contrib/cygwin-packaging/syslog-ng-config.ORIG 2009-03-25 17:08:34.000000000 +0100 +++ contrib/cygwin-packaging/syslog-ng-config 2009-03-19 19:21:34.000000000 +0100 @@ -205,7 +205,7 @@ if [ ! -f "${SYSCONFDIR}/syslog-ng.conf" then echo "Creating default ${SYSCONFDIR}/syslog-ng.conf file" cat > ${SYSCONFDIR}/syslog-ng.conf << EOF -@version 3.0 +@version: 3.0 options { keep_hostname(yes); owner("system"); -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

4 6

Database field types
by Liam Kirsher 14 Apr '09

14 Apr '09

Hi -- I notice that when the database tables get created all the fields are 'text' type. That is okay. However, it might in some cases be convenient for us to have different field types. Is there any problem with that? If we create the table with the desired field types, will that take care of it (assuming the data actually matches the type)? Liam -- Liam Kirsher PGP: http://liam.numenet.com/pgp/

2 7

Solaris 10 x86 configuration not working
by mwilson＠hjf.org 09 Apr '09

09 Apr '09

Hello, I've been using version 2 for a couple of years and decided to upgrade one of my systems to version 3, but my syslog-ng.conf file doesn't seem to work. I can't figure out the error and am hoping someone can give me a hand. Here's the error: # /usr/local/sbin/syslog-ng -v -s -f /etc/syslog-ng/syslog-ng.conf Error parsing command line arguments: Conversion from character set '646' to 'UTF-8' is not supported Here's a sanitized version of my conf file: /etc/syslog-ng/syslog-ng.conf options { stats(0); sync(0); time_reopen(1); log_fifo_size(4096); long_hostnames(off); use_dns(no); use_fqdn(no); create_dirs(yes); keep_hostname(yes); }; source sys { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); tcp(ip("0.0.0.0") port(5150) max-connections(300)); }; filter notdebug { level(info...emerg); }; destination perhost { file("/var/log/perhost/$HOST.log.$YEAR$MONTH$DAY"); }; log { source(sys); filter(notdebug); destination(perhost); }; destination syslogserver { tcp("10.1.1.20" port(5150)); }; log { source(sys); filter(notdebug); destination(syslogserver); }; Any suggestions?

3 3

syslog-ng does notnwrite in the database
by gatfi sami 07 Apr '09

07 Apr '09

i use syslog-ng 2.0 Hi in my syslog-ng server i can write log comming from the client to a file > > source mysrc{ tcp(ip(0.0.0.0) port(514) keep-alive(yes)); > #udp(); > }; > > destination std { > > > file("/var/log/syslog-ng1/$HOST/messages" owner("root") group("root") > perm(0640) dir_perm(0750) create_dirs(yes)); > > }; > > > log {source(mysrc); destination(std);}; > > destination std1 { > udp("192.168.1.66" port(514)); > > }; > #filter my_filter {match("Apache"); }; > > > #log { > # source(mysrc); > # filter(my_filter); > # destination(std); > #}; > > > log { > source(mysrc); > > destination(std1); > }; > > but when i use a pipe destination d_mysql { > pipe("/tmp/mysql.pipe" > template("INSERT INTO logs (host, facility, priority, level, tag, date, > time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', > '$TAG', > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") > template-escape(yes)); > }; > log { source(mysrc); destination(d_mysql); the wired thing is that when i : 1 runed the script that binds the pipe to the database ./mysql.bash& *# !/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u root -D syslog< /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi* 2 created a test sql script request.sql *INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( 'testhost1', 'testfacility1', 'testpriority1', '0','TestTag1', '2009-04-07', '19:00:00', 'Apache', 'Test Message' );* * * ** 3 injected it into the pipe cat request.sql > /tmp/mysql.pipe* * 4 tetsted a *select * from tags; * i found the values on request.sql strange isn't it? so what can i do

1 0

Question about logStore alternative ..
by fredzy padzy 07 Apr '09

07 Apr '09

Hy everyone I'm wondering if it's could be possible to make the same thing that the logStore does (even if it's not as strong as, or as efficient as). Actually, it seems that the PreniumVersion of SyslogNG isn't ready yet for my plateform, and i just though about building a kind of 'homemade' logStore. (but of course, not declared in my syslog-ng.conf ... but acting in my txt log file, in a another directory) I'm using AIDE for a few days, but it doesn't look to handle chunks of file, which Prenium Edition seems to use Moreover, it has to be launched every time a log is written, and i'm pretty sure it will warn about a lot of false positive. any idea ???? bye :)

1 0