May 2010 - syslog-ng - lists.balabit.hu

[Bug 42] New: capabilities, chown, chmod
by bugzilla＠bugzilla.balabit.com 20 Dec '12

20 Dec '12

https://bugzilla.balabit.com/show_bug.cgi?id=42 Summary: capabilities, chown, chmod Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: zbyniu(a)pld-linux.org Type of the Report: bug Estimated Hours: 0.0 Let's take a look at syslog-ng-3.0.1/src/affile.c lines 60-83 1. CAP_SYS_ADMIN is needed only for /proc/kmsg, it is added w/o check 2. CAP_DAC_READ_SEARCH should be added only if open fail with errno 13 2a. CAP_DAC_OVERRIDE should be added only if open fail with errno 13 and with CAP_DAC_READ_SEARCH set 3. fchown needs CAP_CHOWN unconditionaly 4. fchmod needs CAP_FOWNER if file owner != euid (root here) 5. all caps should be restored summary: - CAP_SYS_ADMIN and CAP_DAC_OVERRIDE are set always even if unnecessary, and permanently - owner, group and perm doesn't work -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 10

[Bug 14] New: Maintain symlinks to current and previous log output files...
by bugzilla＠bugzilla.balabit.com 28 Sep '11

28 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=14 Summary: Maintain symlinks to current and previous log output files... Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=218688 OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I'm hoping that upstream might consider adding functionality to syslog-ng to allow it to track current and previous log files and maintain symlinks to them, as a user option. This replicates one of the options that I (and others) find useful in cronolog. This has been previously discussed on the syslog-ng mailing list, though apparently nothing fully came of it. The archive of that discussion is at: https://lists.balabit.hu/pipermail/syslog-ng/2002-June/003452.html Obviously, it's probably somewhat of a low priority, but it would be nice. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

filter/parse based on certificate attributes?
by Christian Tramnitz 22 Feb '11

22 Feb '11

With syslog 3.0 and ssl support using mutual certificate authentication is it possible to parse/filter/tag based on attributes in the certificate? I'd like to have a common listener and then relay or append messages based on client-cert attribute values... (Sorry if this message is arriving more than once, I seem to have problems with posting through Gmane.) Regards, Christian

4 4

FreeBSD 8 LOG_SECURITY and LOG_AUTH confused
by Brian A. Seklecki 23 Jun '10

23 Jun '10

Guys something shit the bed with 3.0.3 on 8.0-PL: ----- config ---------------- source src { unix-dgram("/var/run/log"); filter f_security { facility(security); }; filter f_auth { facility(auth); }; destination security { file("/var/log/security" template(cfi_template)); }; destination authlog { file("/var/log/auth.log" template(cfi_template)); }; log { source(src); filter(f_security); destination(security); flags(final); }; log { source(src); filter(f_auth); destination(authlog); flags(final); }; ------------------------- # /usr/local/sbin/syslog-ng -p /var/run/syslog.pid -tevdF Syslog connection established; fd='5', server='AF_INET(192.168.128.XXX:514)', local='AF_INET(0.0.0.0:0)' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.0.3' ^Z [5]+ Stopped /usr/local/sbin/syslog-ng -p /var/run/syslog.pid -tevdF [root@cfi-db-corp ~]# bg [root@cfi-db-corp ~]# echo test | logger -p auth.info Incoming log entry; line='<38>Mar 18 15:57:40 bseklecki: test' Filter rule evaluation begins; filter_rule='f_ams' Filter node evaluation result; filter_result='not-match', filter_type='level' Filter node evaluation result; filter_result='not-match', filter_type='AND' Filter node evaluation result; filter_result='not-match', filter_type='AND' Filter rule evaluation result; filter_result='not-match', filter_rule='f_ams' Filter rule evaluation begins; filter_rule='f_auth' Filter node evaluation result; filter_result='match', filter_type='facility' Filter rule evaluation result; filter_result='match', filter_rule='f_auth' Filter rule evaluation begins; filter_rule='f_ams' Filter node evaluation result; filter_result='not-match', filter_type='level' Filter node evaluation result; filter_result='not-match', filter_type='AND' Filter node evaluation result; filter_result='not-match', filter_type='AND' Filter rule evaluation result; filter_result='not-match', filter_rule='f_ams' Filter rule evaluation begins; filter_rule='f_authpriv' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_authpriv' Filter rule evaluation begins; filter_rule='f_kern' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_kern' Filter rule evaluation begins; filter_rule='f_user' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_user' Filter rule evaluation begins; filter_rule='f_mail' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_mail' Filter rule evaluation begins; filter_rule='f_security' Filter node evaluation result; filter_result='match', filter_type='facility' Filter rule evaluation result; filter_result='match', filter_rule='f_security' Initializing destination file writer; template='/var/log/security', filename='/var/log/security' The two fixes I can find are: - Move: "log { source(src); filter(f_security);.." below "log { source(src); filter(f_auth);..." ...wait, what?! - Remove reference to LOG_SECURITY /usr/include/syslog.h defines for Facility->index mappings haven't changed since RELENG_6, so I'm not sure what to make of this. Very strange, ~BAS

2 2

Quick Questions
by Dyne Lai 04 Jun '10

04 Jun '10

Hi Syslog-ng Developers, I have a few general questions regarding syslog-ng as below. 1) What is the type of transmission (Asynchronous/Synchronous) used for the transfer of log messages between server and remote client? 2) I understand that Syslog-ng is able to store unsent messages from remote client to server in the local hardisk during network/system outrage. Will syslog-ng be able to resume with the unsent messages upon the revive of the network/system? If possible, how can we configure/setup to achieve that? 3) In view of security, how can we configure remote client and server to perform authentication (using X.509 certificates) during log message forwarding? 4) Is the forwarding of log message between remote client and server consider real-time? (assume syn=0) Do pardon if the questions appears ignorant.Thanks for the time! Best Regards, Dyne Lai

5 7

mis-claimed features: network link compression w/ TLS
by Robin H. Johnson 04 Jun '10

04 Jun '10

The comparison table: http://www.balabit.com/network-security/syslog-ng/comparing/detailed/ Lists: "Support for network link compression when using TLS" But I can't find it in the OSE at all. There are NO calls to the OpenSSL COMP* functions, nor any usage of compression functions that I can find. The Flex and Yacc grammar DO include a 'compress' keyword, but data from it is not actually used. I'm looking for some reasonable compression to cut down on network traffic one some Gentoo boxes where there is a very limited upstream network connection. Traffic is about 2.4GiB/day, over a 1Mbit link. Plain gzip after the fact gets >90% compression, but I'd like the logs in near-realtime to the remote logging destinations (multiple). I do also realize that we're going to be limited by packet compression, unless we keep some form of running dictionary, but I think even with that, we should get a good size reduction. -- Robin Hugh Johnson Gentoo Linux: Developer, Trustee & Infrastructure Lead E-Mail : robbat2(a)gentoo.org GnuPG FP : 11AC BA4F 4778 E3F6 E4ED F38E B27B 944E 3488 4E85

2 1

Re: [syslog-ng] Help
by Chaitanya Sangawar 28 May '10

28 May '10

I tried to use init.d script from a rpm version on solaris but for some reason it doesn't execute as is n I can't get it started as daemon. When I run syslog-ng, it works one time. I will go through the site also. Where can I get pre compiled version aren't they vad only for a month? Thanks, Chaitanya S Sent from HTC ________________________________ From: Patrick H. <syslogng(a)feystorm.net> Sent: Thursday, 27 May 2010 1:15 AM To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Help I loathe compiling on solaris, and try to avoid it wherever possible. If the only reason youre not using the pre-compiled package is the lack of init script, then it'd be easier to get an init script than compile a new syslog-ng. If anything, you can just yank the init script from the source and use it with the pre-compiled version. If youre using solaris 10, then the proper way is to use the SMF manifests. A good source is http://hub.opensolaris.org/bin/view/Community+Group+smf/manifests and there's one for syslog-ng listed there. Sent: Wednesday, May 26, 2010 1:30:25 PM From: Chaitanya Sangawar <CS0048029(a)TechMahindra.com><mailto:CS0048029@TechMahindra.com> To: syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu> <syslog-ng(a)lists.balabit.hu><mailto:syslog-ng@lists.balabit.hu> Subject: [syslog-ng] Help Hello All, I am not sure if this is a forum where I can post some help I would require but would appreciate if it is. I have been trying to install syslog-ng open source on Solaris since quite sometime and now I am almost giving up. After installing I would have presumed to have /etc/init.d/syslog-ng file created but it wasn’t. Also now I am not able to do “make” to syslog-ng , observing the following error. Can anyone help me why this is happening? Is it related to PATH / PKG_CONFIG_PATH or something ? Something or the other is happening and always ending up not able to complete the installation. # echo $PATH /usr/bin:/usr/sbin:/usr/ccs/bin:/usr/sbin:/usr/bin:/usr/bin:/usr/sbin:/opt/local/bin:/usr/local/bin:/opt/local/scripts/common:/usr/dt/bin:/usr/openwin/bin:/usr/ucb:/usr/bin/nsr:/usr/sbin/nsr:/usr/ccs/bin:/usr/local/bin:/usr/sfw/bin:/usr/lib:/usr/lib:/usr/local/lib:/usr/local/bin:/usr/sfw/bin:/usr/sfw/bin echo $PKG_CONFIG_PATH /usr/local/lib/pkgconfig/:/usr/lib/pkgconfig/:/usr/sfw/bin make make all-recursive Making all in src lex cfg-lex.l "cfg-lex.l":line 263: Error: missing translation value *** Error code 1 make: Fatal error: Command failed for target `cfg-lex.c' Current working directory /opt/syslog-ng-3.0.4/src *** Error code 1 The following command caused the error: failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src tests doc contrib debian tgz2build'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /opt/syslog-ng-3.0.4 *** Error code 1 make: Fatal error: Command failed for target `all' ============================================================================================================================Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at http://www.techmahindra.com/Disclaimer.html externally and http://tim.techmahindra.com/Disclaimer.html internally within Tech Mahindra.============================================================================================================================ ________________________________ ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html ============================================================================================================================Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra.============================================================================================================================

2 4

Help
by Chaitanya Sangawar 26 May '10

26 May '10

Hello All, I am not sure if this is a forum where I can post some help I would require but would appreciate if it is. I have been trying to install syslog-ng open source on Solaris since quite sometime and now I am almost giving up. After installing I would have presumed to have /etc/init.d/syslog-ng file created but it wasn't. Also now I am not able to do "make" to syslog-ng , observing the following error. Can anyone help me why this is happening? Is it related to PATH / PKG_CONFIG_PATH or something ? Something or the other is happening and always ending up not able to complete the installation. # echo $PATH /usr/bin:/usr/sbin:/usr/ccs/bin:/usr/sbin:/usr/bin:/usr/bin:/usr/sbin:/opt/local/bin:/usr/local/bin:/opt/local/scripts/common:/usr/dt/bin:/usr/openwin/bin:/usr/ucb:/usr/bin/nsr:/usr/sbin/nsr:/usr/ccs/bin:/usr/local/bin:/usr/sfw/bin:/usr/lib:/usr/lib:/usr/local/lib:/usr/local/bin:/usr/sfw/bin:/usr/sfw/bin echo $PKG_CONFIG_PATH /usr/local/lib/pkgconfig/:/usr/lib/pkgconfig/:/usr/sfw/bin make make all-recursive Making all in src lex cfg-lex.l "cfg-lex.l":line 263: Error: missing translation value *** Error code 1 make: Fatal error: Command failed for target `cfg-lex.c' Current working directory /opt/syslog-ng-3.0.4/src *** Error code 1 The following command caused the error: failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src tests doc contrib debian tgz2build'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /opt/syslog-ng-3.0.4 *** Error code 1 make: Fatal error: Command failed for target `all' ============================================================================================================================Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra.============================================================================================================================

2 1

Re: [syslog-ng] Program destination seems to block
by Evan Rempel 17 May '10

17 May '10

OK, I finally got back to this. The strace is too large to send to this list, approx 1MB. I'm not an strace expert, but it looks like the source is polled, but once the output can not be written to, the source is no longer read, even though the poll shows data is available. 14:56:42.508034 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508067 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508099 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508133 poll([{fd=4, events=POLLIN}, {fd=5, events=0}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 4, 304) = 1 ([{fd=3, revents=POLLIN}]) <0.000005> 14:56:42.508180 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000005> 14:56:42.508214 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508246 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000005> 14:56:42.508279 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508311 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000005> 14:56:42.508344 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508376 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508416 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000005> 14:56:42.508449 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508481 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000005> 14:56:42.508514 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508546 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508579 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> This just repeats over and over again. Thanks for looking at this. Balazs Scheidler wrote: > On Wed, 2010-04-14 at 14:04 -0700, Evan Rempel wrote: >> Balazs Scheidler wrote: >>> On Wed, 2010-04-14 at 13:18 -0700, Evan Rempel wrote: >>>> A little background. >>>> >>>> There is a "server" syslog-ng process that accepts messages from the network and >>>> sends the messages to a variety of destinations. For this report, I am only interested >>>> in one destination that happens to be a pipe. >>>> >>>> There is a "slave" syslog-ng process that reads from the pipe that the "server" writes to, >>>> and writes to a program destination. >>>> >>>> The program reads the standard in, and does "something". >>>> All works well. >>>> >>>> At some point our application (we know why and don't want to discuss it) application stops >>>> reading standard in for a while (1,000,000 lines over an hour). We expect that the memory >>>> footprint of syslog-ng "slave" to grow during this time but it does not. Instead, the >>>> memory footprint of the syslog-ng "server" grows. When our application starts reading >>>> its standard in again, the memory footprint of the syslog "slave" grows very quickly, >>>> and all messages reach the destination. >>>> >>>> I think that the syslog-ng "slave" get blocked on the program destination in a way that >>>> prevents it from reading its source, resulting in the upstream syslog-ng "server" having >>>> to buffer all of the messages. >>>> >>>> There is no flow control anywhere, and both syslog-ng instances have log_fifo_size(8000000) >>>> for all of the destinations. >>>> >>>> Anyone have any suggestions? >>> Hmm, either the slave syslog-ng really blocks (but I don't know any >>> similar bugs right now), or flow control is enabled. >>> >>> There was a bug that caused flow-control to be enabled, if any of the >>> flags was used. Do you have fallback enabled? >> No, the only flags in the "slave" is no-parse. >> >> >>> Can you post the exact versions of syslog-ng you are using? >> 3.0.5 OSE >> >> >>> Also, you could confirm if the slave instance really blocks, or it has >>> just stalled one of its sources. You could do that by attaching to the >>> slave process using strace for a little while. >>> >>> 1) first check what fd is being used between master/slave (lsof -p >>> <pid>) >>> 2) then check via strace if that fd is being polled for POLLIN or not >>> >>> If it is not polled, then flow-control is somehow enabled, if syslog-ng >>> is not polling but waiting somewhere, then it might be blocked as you >>> suggest. >>> >>> Anyway, the list of open file descriptors and the strace dump could help >>> in tracking down both cases. >> >> Not to be lazy here, but I am not going to get to this for weeks, really busy >> at my site right now. >> >> Here is a program that can turn on/off the reading of standard in by using >> kill -USR1 <PID> >> kill -USR2 <PID> >> >> >> --------------- >> #!/usr/bin/perl >> >> my $read = 0; >> >> $SIG{USR1} = sub { $read = 1 }; >> $SIG{USR2} = sub { $read = 0 }; >> >> while ( not eof(STDIN)) { >> if ( $read == 1 ) { >> $line = <STDIN>; >> print $line; >> } else { >> sleep 1; >> } >> } >> --------------- >> >> So hopefully you can reproduce this this really easy at your end. >> >> If I don't hear back, in a few weeks I'll get to this. > > I've tried it with 3.1.1, 3.0.6 and finally 3.0.5 and all behaved > properly. Memory size grew until it couldn't write to the test program, > of course only until the FIFO size filled up. > > Once I let the program go with a SIGUSR1 it started sending messages, > the drop count stayed the same. Flow-control was not enabled. > > -- Evan Rempel erempel(a)uvic.ca Senior Systems Administrator 250.721.7691 Unix Services, University Systems, University of Victoria -- Evan Rempel erempel(a)uvic.ca Senior Systems Administrator 250.721.7691 Unix Services, University Systems, University of Victoria

1 0

syslog file is empty
by Андрей 16 May '10

16 May '10

I'm using syslog-ng to collect logs from different devices and everything is Ok - all log files and directories are created and being written, except syslog log files - they are just empty (e.g. /var/log/hostname/syslog size is zero). Here is my config: monitoring:~# cat /etc/syslog-ng/syslog-ng.conf @version: 3.0 # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. Originally written by anonymous (I can't find his name) # Revised, and rewrited by me (SZALAY Attila <sasa(a)debian.org>) # First, set some global options. options { long_hostnames(off); flush_lines(0); use_dns(persist_only); dns_cache_hosts(/etc/hosts); use_fqdn(no); owner("root"); group("adm"); perm(0655); keep_hostname(yes); }; ######################## # Sources ######################## # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # source s_src { unix-dgram("/dev/log"); internal(); file("/proc/kmsg" program_override("kernel")); udp(ip(192.168.10.2) port(514)); }; # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # #source s_net { tcp(ip(127.0.0.1) port(1000) authentication(required) encrypt(allow)); }; ######################## # Destinations ######################## # First some standard logfile # destination d_auth { file("/var/log/$HOST/auth.log" suppress(15)); }; destination d_cron { file("/var/log/$HOST/cron.log" suppress(15)); }; destination d_daemon { file("/var/log/$HOST/daemon.log" suppress(15)); }; destination d_kern { file("/var/log/$HOST/kern.log" suppress(15)); }; destination d_lpr { file("/var/log/$HOST/lpr.log" suppress(15)); }; destination d_mail { file("/var/log/$HOST/mail.log" suppress(15)); }; destination d_syslog { file("/var/$HOST/log/syslog" suppress(15)); }; destination d_user { file("/var/log/$HOST/user.log" suppress(15)); }; destination d_uucp { file("/var/log/$HOST/uucp.log" suppress(15)); }; destination d_radius { file("/var/log/$HOST/radius.log" suppress(15)); }; # This files are the log come from the mail subsystem. # destination d_mailinfo { file("/var/log/$HOST/mail/mail.info" suppress(15)); }; destination d_mailwarn { file("/var/log/$HOST/mail/mail.warn" suppress(15)); }; destination d_mailerr { file("/var/log/$HOST/mail/mail.err" suppress(15)); }; # Logging for INN news system # destination d_newscrit { file("/var/log/$HOST/news/news.crit" suppress(15)); }; destination d_newserr { file("/var/log/$HOST/news/news.err" suppress(15)); }; destination d_newsnotice { file("/var/$HOST/log/news/news.notice" suppress(15)); }; # Some `catch-all' logfiles. # destination d_debug { file("/var/log/$HOST/debug" suppress(15)); }; destination d_error { file("/var/log/$HOST/error" suppress(15)); }; # The root's console. # #destination d_console { usertty("root");}; # Virtual console. # #destination d_console_all { file("/dev/tty10"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination d_xconsole { pipe("/dev/xconsole"); }; # Send the messages to an other host # #destination d_net { tcp("127.0.0.1" port(1000) authentication(on) encrypt(on) log_fifo_size(1000)); }; # Debian only #destination d_ppp { file("/var/log/ppp.log"); }; ######################## # Filters ######################## # Here's come the filter options. With this rules, we can set which # message go where. filter f_dbg { level(debug); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_err { level(err); }; filter f_crit { level(crit .. emerg); }; filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; filter f_error { level(err .. emerg) ; }; filter f_auth { facility(auth, authpriv) and not filter(f_debug); }; filter f_cron { facility(cron) and not filter(f_debug); }; filter f_daemon { facility(daemon) and not filter(f_debug); }; filter f_kern { facility(kern) and not filter(f_debug); }; filter f_lpr { facility(lpr) and not filter(f_debug); }; filter f_local { facility(local0, local1, local3, local4, local5, local6, local7) and not filter(f_debug); }; filter f_mail { facility(mail) and not filter(f_debug); }; filter f_news { facility(news) and not filter(f_debug); }; filter f_syslog3 { facility(syslog) and not filter(f_debug); }; filter f_user { facility(user) and not filter(f_debug); }; filter f_uucp { facility(uucp) and not filter(f_debug); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; #filter f_ppp { facility(local2) and not filter(f_debug); }; filter f_radius { facility(local1) and not filter(f_debug); }; #filter f_console { level(warn .. emerg); }; ######################## # Log paths ######################## log { source(s_src); filter(f_auth); destination(d_auth); }; log { source(s_src); filter(f_cron); destination(d_cron); }; log { source(s_src); filter(f_daemon); destination(d_daemon); }; log { source(s_src); filter(f_kern); destination(d_kern); }; log { source(s_src); filter(f_lpr); destination(d_lpr); }; log { source(s_src); filter(f_syslog3); destination(d_syslog); }; log { source(s_src); filter(f_user); destination(d_user); }; log { source(s_src); filter(f_uucp); destination(d_uucp); }; log { source(s_src); filter(f_radius); destination(d_radius); }; log { source(s_src); filter(f_mail); destination(d_mail); }; #log { source(s_src); filter(f_mail); filter(f_info); destination(d_mailinfo); }; #log { source(s_src); filter(f_mail); filter(f_warn); destination(d_mailwarn); }; #log { source(s_src); filter(f_mail); filter(f_err); destination(d_mailerr); }; log { source(s_src); filter(f_news); filter(f_crit); destination(d_newscrit); }; log { source(s_src); filter(f_news); filter(f_err); destination(d_newserr); }; log { source(s_src); filter(f_news); filter(f_notice); destination(d_newsnotice); }; #log { source(s_src); filter(f_cnews); destination(d_console_all); }; #log { source(s_src); filter(f_cother); destination(d_console_all); }; #log { source(s_src); filter(f_ppp); destination(d_ppp); }; log { source(s_src); filter(f_debug); destination(d_debug); }; log { source(s_src); filter(f_error); destination(d_error); }; #log { source(s_src); filter(f_console); destination(d_console_all); # destination(d_xconsole); }; #log { source(s_src); filter(f_crit); destination(d_console); }; # All messages send to a remote site # #log { source(s_src); destination(d_net); }; Everything seems to be Ok in config, what's wrong? Later I used 2.x version of syslog-ng and everything worked. -- С уважением, Андрей.

3 2