March 2010 - syslog-ng - lists.balabit.hu

problem with filtering in syslog-ng
by Evan Baer 06 Mar '10

06 Mar '10

Hello, I'm trying to exclude ntpd update messages from /var/log/messages. I have created a filter like so: filter not_ntpd { not program("ntpd*"); }; And implemented it in my log lines: log { source(src); filter(not_ntpd); destination(messages); }; log { source(src); filter(f_notice); filter(f_not_authpriv); filter(not_ntpd); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); filter(not_ntpd); destination(messages); }; log { source(src); filter(f_lpr); filter(f_info); destination(messages); }; log { source(src); filter(f_mail); filter(f_crit); destination(messages); }; Yet the lines for ntpd still seem to pass through to the logfile. Feb 23 09:20:48 magpie-shn1e1324 ntpd[37397]: synchronized to 10.2.253.22, stratum 1 Feb 23 09:20:49 magpie-shn1f1318 ntpd[729]: kernel time sync status change 2001 Any thoughts? -- Evan

6 11

what is the 'supervising syslog-ng' process?
by Tim Edwards 06 Mar '10

06 Mar '10

We have syslog-ng-client-3.0.5-1.rhel5 installed on several machines. However on 2 of those Nagios has flagged that there's an extra process with the command 'supervising syslog-ng'. Both machine1 and machine2 are Scientific Linux 5.4 (a RHEL clone) x86_64 Xen virtual machines with the exact same syslog-ng.conf: [root@machine1 ~]# ps -ef | grep syslog-ng root 24891 1 0 09:26 ? 00:00:00 supervising syslog-ng root 24892 24891 0 09:26 ? 00:00:00 /opt/syslog-ng/sbin/syslog-ng --no-caps [root@machine2 ~]# ps -ef | grep syslog root 1718 1695 0 09:38 pts/0 00:00:00 grep syslog root 2137 1 0 Feb01 ? 00:00:09 /opt/syslog-ng/sbin/syslog-ng --no-caps Can someone explain what this 'supervising' process is? Thanks Tim Edwards

3 3

composing file names with system varible
by peceka 06 Mar '10

06 Mar '10

Hi, i've on my machine file with some name, for example: # cat /var/hostname smeagol now i want to have log files like this: /var/log/smeagol-all.log if i change content of /var/hostname and then restart syslog-ng, syslog-ng shoud start logging to files with new name. is it possible? mabye no directly but with some workaround? regards, p.

3 4

RFC3339 timestamp parsing
by Ian Wienand 06 Mar '10

06 Mar '10

Hi, I notice that in the syslog-ng from my Debian install (2.0.9) log_msg_parse_date has p = strptime(self->date.str, "%Y-%m-%dT%H:%M:%S", &tm); and in 3.1beta2 I see p = (guchar *) strptime((gchar *) date, "%Y-%m-%d T%H:%M:%S", &tm); Is the extra space intended? I'm also wondering about a seeming ambiguity in RFC3339 [1] In 5.6 it says NOTE: ISO 8601 defines date and time separated by "T". Applications using this syntax may choose, for the sake of readability, to specify a full-date and full-time separated by (say) a space character. However in Appendix A it says ISO 8601 states that the "T" may be omitted under some circumstances. This grammar requires the "T" to avoid ambiguity. So is the T required or not? Should syslog-ng be able to parse either format? -i [1] http://www.ietf.org/rfc/rfc3339.txt

2 1

pcre matches
by Patrick H. 06 Mar '10

06 Mar '10

How do you use pcre named pattern matches with store-matches? I've been trying to do things like message("IP: (?<ip>\S+)" flags(store-matches) type("pcre")) and then insert into a database with things like values("$ip") or values("$+{ip}") and nothing works. I cant seem to find any examples of usage through google either.

2 2