September 2010 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] [PATCH] remove auto-generated files
by chris packham 03 Sep '10

03 Sep '10

On Fri, 2010-09-03 at 13:24 +0200, Balazs Scheidler wrote: > On Fri, 2010-09-03 at 06:09 +1200, chris packham wrote: > > INSTALL is generated by the build process. If the build host has a different > > version of autotools then the contents of INSTALL can change which in turn > > causes problems for developers working from the git repository. > > > > This patch removes the INSTALL file and adds it to .gitignore. > > So, in your case autotools generates an INSTALL file? That's funny, this > is not the same as the autotools generated one (in fact it is a bit > outdated, but I wrote that to document how to install syslog-ng). > > For me automake doesn't generate this file. Why does it for you? > > autogen.sh contains: > > > aclocal > sed -i -e 's/PKG_PROG_PKG_CONFIG(\[0\.16\])/PKG_PROG_PKG_CONFIG([0.14])/g' aclocal.m4 > > autoheader > automake --foreign --add-missing > autoconf > > > as I understand automake will only be adding the INSTALL file if it doesn't exist. > Are you using -f for automake? > Actually our problem might be this $(call MESSAGE,"Running autogen.sh") $(Q)cd $(SYSLOG_NG_GIT_DIR) && $(AUTORECONF) 2> /dev/null $(Q)touch $@ So we're lying to our developers for a start. If I do run autogen.sh instead I get this error configure.in:513: warning: macro `AM_PATH_GLIB_2_0' not found in library configure.in:513: error: possibly undefined macro: AM_PATH_GLIB_2_0 which is probably the reason we didn't just use autogen.sh in the first place. Looking at the expanded $(AUTORECONF) it expands to "/usr/bin/autoreconf -f -i" (plus a lot of environment vars for our cross-compile environment). I'll try fiddling with these options to see if some of them changes the behaviour.

1 0

syslog-ng on Solaris 10
by Riaz, Javed (WW Global Network Services) 03 Sep '10

03 Sep '10

This the first time I am running syslog-ng 3.0.4 on Solaris 10. Following are the issues I am seeing: 1. Two processes of syslog-ng are running. Is this normal: root 15423 1 0 Aug 31 ? 0:00 /usr/local/sbin/syslog-ng root 15424 15423 0 Aug 31 ? 0:00 /usr/local/sbin/syslog-ng 2. I need to disable/enable syslog-ng multiple times to get syslog-ng online in Solaris SVCADM after updating conf file. 3. Also if I disable syslog-ng in Solaris SVCADM should the tw0 processes stop? Please help! # /usr/local/sbin/syslog-ng -V syslog-ng 3.0.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#1b5d618e301ad94aa20e692ffba16469dece8d10 Compile-Date: Sep 2 2009 06:15:53 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: on Enable-Sun-Door: on Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on # uname -a SunOS usplsbavisp007 5.10 Generic_118833-33 sun4u sparc SUNW,Sun-Fire-V445 Thanks,

2 1

feature request (parallel processing)
by syslogng＠feystorm.net 03 Sep '10

03 Sep '10

So, after months of work, we finally turned on our production environment for syslog collection. However, we hit one immediate snag. Currently were writing to the database, and the way the database works is that it collects enough data to fill a single block, and then it flushes out that block. Well every time it goes to flush the block out, the insert takes an extra couple milliseconds. Now when I'm doing about 220000 inserts a second, that millisecond delay is significant. So basically syslog has to pause on that log statement while it waits for the database to flush. (1 out of 10 messages was getting dropped) Now I tried to solve this by writing multiple destination drivers so that a second database thread could be processing while the first was flushing, but that didnt work as it appears syslog waits for the destination driver to complete before it hands data off to the second driver. Instead I managed to solve the problem by creating yet more syslog processes. So basically the master process listens for data from all the hosts. It then runs a match on the $PID and sends all even numbered PIDs to one syslog process, and all odd numbered PIDs to a second syslog process. This way both processes can be inserting to the database at the same time. It effectively cuts the amount of work each database thread does in half, so that when it has to pause to flush, it doesnt cause the syslog buffer to fill up. Ultimately my request is this, allow multiple destination drivers to work at the same time. I realize this is probably not a simple change, but seems like it would be a significant speed enhancement.

4 7

logic and duplicate suppression
by John Kristoff 03 Sep '10

03 Sep '10

I have a couple of scenarios where I'm looking to enhance how I handle and process some logs. I'm looking for suggestions on what my options are, but maybe these are potential feature requests? 1. In using a parser (cvs or the patterndb), I'd like to use some conditionals based on a resultant macro value. So for example, if I have an sshd authentication log message with a source address in a macro and that address is contained w/in a specific prefix, I'd like to handle that message differently. Perhaps not log it all or set another MACRO to a certain value. 2. I'd like to be able to suppress duplicate messages even if they are not necessarily contiguous at the destination. So for example, if I have a SSH client that generates a log of its SSH client protocol and software, I don't need to see that over and over again (e.g. as you might commonly see today in SSH brute force attacks). John

4 10

Insert hostname instead of overwrite ?
by stucky 03 Sep '10

03 Sep '10

Guys I'm trying to log to a loadbalanced VIP. It seems to work ok except that the loadbalancer uses SNAT so I loose my source IP. This means I cannot use dns or even the source ip to get the source host as all logs appear to come from the same source (the loadbalancer). This means I have no choice but to rely on the hostname field which works about 98% of the time but some stuff like Dell OpenManage skips the hostname field. So I'd get logs like this on host "cage" f.e. Aug 16 21:47:22 Server Administrator: Storage Service EventID: 2242 The Patrol Read has started.: Controller 0 (PERC 5/i Integrated) I fixed that by telling the syslog-ng client to force itself to figure out a proper hostname and now the log looks like this Aug 17 13:51:10 cage Administrator[]: Instrumentation Service EventID: 1000 Server Administrator starting I thought syslog-ng inserts the hostname but by the looks of it it simply replaces whatever is in the expected field with the hostname it has just figured out. As you can see it overwrote the entry "Server". No biggie in the above case but what if this field contained valuable information ? I'd loose that. Any way to squeeze in the hostname so to speak ? -- stucky

5 12

[PATCH] remove auto-generated files
by chris packham 03 Sep '10

03 Sep '10

INSTALL is generated by the build process. If the build host has a different version of autotools then the contents of INSTALL can change which in turn causes problems for developers working from the git repository. This patch removes the INSTALL file and adds it to .gitignore. --- Hi Bazsi, This has been causing us a little bit of a hassle with rebasing our syslog-ng clone against the upstream one. Hopefully it doesn't cause problems for your build processes. .gitignore | 1 + INSTALL | 182 ------------------------------------------------------------ 2 files changed, 1 insertions(+), 182 deletions(-) delete mode 100644 INSTALL diff --git a/.gitignore b/.gitignore index b2bfbec..b5e59f6 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,4 @@ stamp-h ylwrap .*.swp *.pyc +INSTALL diff --git a/INSTALL b/INSTALL deleted file mode 100644 index 47bbab8..0000000 --- a/INSTALL +++ /dev/null @@ -1,182 +0,0 @@ - -Installation instructions for SYSLOG-NG -======================================= - -Welcome. This is syslog-ng, which stands for syslog-new-generation, a new, -enhanced system logging daemon. - -Unpacking the distribution -========================== - -The distribution arrives in .tar.gz format though OS/distribution packaging -is possible. The file is named: - - syslog-ng-x.xx.tar.gz - -where x.xx stands for the version number. You must have tar and gzip to -unpack the distribution (sorry, compress is not supported). If you have GNU -tar simply execute the following command: - - tar xvfz syslog-ng-x.xx.tar.gz - -If your version of tar doesn't support z (most non-GNU tars), you should -execute this one: - - gunzip -c syslog-ng-x.xx.tar.gz | tar xvf - - -After this, you'll get a directory named syslog-ng-x.xx, where the source for -syslog-ng will be unpacked. - -Compiling the program: -====================== - -syslog-ng requires gcc as a C compiler (at least version 2.7.2), GNU flex as -a lex, and bison as a parser generator. Some GNU C and GNU flex extensions -are used, porting to other compilers/lex/yacc combination is welcome. - -Syslog-ng relies on a number of third party libraries in order to be -compiled, these are: - * libnet if spoof-source support is enabled in configure - (--enable-spoof-source) - * libwrap (aka TCP wrappers) if their use is enabled in configure - (--enable-tcp-wrapper) - * Glib a generic I/O library used by a wide variety of applications - * EventLog a generic event logging library developed by BalaBit - -Once these libraries are installed, you can start compiling syslog-ng: - -cd to the syslog-ng-x.xx directory, and execute the following commands: - - ./configure - make - -After the make cycle finishes, you'll get an executable in the src -directory: - - syslog-ng - the main binary - -Now do a "make install" and you are done. - -Compile time options -==================== -A couple of features must be enabled in compile time using one of the ---enable-<feature> option to the configure script. - -Currently the following compile time features exist: - - --enable-debug include debug info - --enable-sun-streams enable Sun STREAMS support even if not detected (autodetected by default) - --enable-sun-door enable Sun door support even if not detected (autodetected by default) - --enable-tcp-wrapper enable using /etc/hosts.deny & /etc/hosts.allow for TCP access (disabled by default) - --enable-spoof-source enable spoof_source feature (also requires libnet) (disabled by default) - --enable-ipv6 enable support for IPv6 - --enable-static-linking compile syslog-ng as a static binary - --disable-dynamic-linking compile syslog-ng against system libraries - dynamically, and statically against everything else - -NOTE: if you intend to use an NFS mounted /usr you might need to configure -syslog-ng with either --enable-static-linking or with ---disable-dynamic-linking as syslog-ng needs to start _before_ your -networking is up. - -Platform specific compilation issues -==================================== - - HP-UX with gcc 4.x - ------------------ - - The gcc available for HP-UX gives an error message in sys/socket.h, as a - function is defined as static and extern at the same time. Earlier gcc - versions and the HP compiler only gives a warning, gcc4 issues an error. - - The solution is to copy sys/socket.h to your gcc-private include - directory and fix the offending declaration. - -Configuration file: -=================== - -Syslog-ng uses a different configuration scheme than the original syslogd, -which sits at /etc/syslog-ng/syslog-ng.conf (or at a different location -depending the value passed to the --sysconfdir configure parameter). - -The manpage for syslog-ng.conf(5) or the documentation under doc contains a -/reference about keywords and syntax which can be used in the -config file. For now I only explain system dependencies. - -Every unix version has a slightly different way of sending log messages, and -since syslog-ng gives you the power of choosing your log-sources, you have to -be aware some of the internals. - - Linux: - ------ - Linux has a dedicated unix socket called /dev/log, where log messages are - written to, and read from. It is of type SOCK_STREAM. So the correct source - statement for standard linux log messages is: - - source stdlog { unix-stream("/dev/log"); }; - - Some newer Linux distributions (Debian GNU/Linux woody, and RedHat Linux - post 7.0) switched over to using SOCK_DGRAM in their sysklogd installation - by default. The libc autodetects which socket type is in use, but some - programs (like klogd) log directly to the log device bypassing libc. So if - you have logging problems you might want to switch log unix-dgram like - this: - - source stdlog { unix-dgram("/dev/log"); }; - - BSDi: - ----- - BSD is similar to Linux (or vice-versa Linux is similar to BSD, but this is - another issue), so BSD has also a unix socket for log communication, but - it's of type SOCK_DGRAM, and it is located at /var/run/log. So the source - statement you are looking for is: - - source stdlog { unix-dgram("/var/run/log"); }; - - Solaris (2.5.1 or below): - ------------------------- - - SunOS/Solaris has a universal means of communications called STREAMS. It is - used as both an in-kernel and kernel-user interface. You'll need to feed the - following statement to syslog-ng to accept all messages: - - source stdlog { sun-stream("/dev/log"); }; - - Solaris (2.6 - Solaris8) - ------------------- - - In addition to the STREAMS device used in earlier versions, a door is used to - make sure after each message that the system logging daemon is still running. - To create that door, you'll need the door() option of the sun-stream driver: - Sun has added a new method to the pool of possible IPC mechanisms, and it - is called door. syslog-ng supports this method with the sun-door keyword. A - door is a special file in the filesystem, and is called /etc/.syslog_door. - So your correct source statement would be: - - source stdlog { sun-streams("/dev/log" door("/etc/.syslog_door")); }; - - Solaris 9 - --------- - - The name of the door file has been changed from /etc/.syslog_door to - /var/run/syslog_door, the correct configuration needs to be: - - source stdlog { sun-streams("/dev/log" door("/var/run/syslog_door")); }; - - AIX (unknown revision) - ---------------------- - - AIX does support STREAMS, but its log transport doesn't use it. As it - seems /dev/log is a simple SOCK_DGRAM type unix socket, so it works using: - - source stdlog { unix-dgram("/dev/log"); }; - - HP-UX (HP-UX 11.0) - ------------------ - - HP-UX uses a named pipe called /dev/log for log transport, and you - can use this with the pipe() driver with an additional option. HP-UX pads - all incoming messages to 2048 bytes by default, so you need to specify - this: - - source stdlog { pipe("/dev/log" pad_size(2048)); }; -- 1.7.2.2

2 1

SNMP Traps?
by Clayton Dukes 03 Sep '10

03 Sep '10

Hey guys, A while back, I though I read that syslog-ng would process traps as well in v3.x, was I just imagining that or did it happen? ______________________________________________________________ Clayton Dukes ______________________________________________________________

2 3

TCP recv bug in syslog-ng v2.09?
by Clayton Dukes 02 Sep '10

02 Sep '10

Hey guys, Are there any known bugs for syslog-ng v2.09 that won't allow a cisco router to send logs over tcp? I can see a connection established in syslog-ng. I also see the message come in via tcpdump, but nothing in syslog-ng's output. If I change the router from tcp to udp, messages come in as expected. *Router config:* logging source-interface Loopback0 logging 172.18.224.150 <tricon:40,-1|172.18.224.150;majoshi@cisco.com> logging host 172.18.224.190 <tricon:40,-1|172.18.224.190;majoshi@cisco.com>transport tcp *syslog-ng config:* source s_all { udp(); tcp(ip(11.31.130.99) port(8002) max-connections(300)); tcp(ip(172.18.224.190) port(601) max-connections(300)); }; *debug output:* I commented out the line above for the other interface (11.31.130.99), restarted and this is all I see: Syslog connection accepted; from='AF_INET(14.3.23.50<tricon:40,-1|(14.3.23.50;majoshi@cisco.com>:63845)', to='AF_INET(172.18.224.190 <tricon:40,-1|(172.18.224.190;majoshi@cisco.com> :601)' *tcpdump:* 14:13:46.914566 IP (tos 0x0, ttl 251, id 4303, offset 0, flags [none], proto TCP (6), length 134) 14.3.23.50.63845 > xxx.com.601: Flags [.], seq 230:324, ack 1, win 4128, length 94 *Router debug:* *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:19.772<tricon:40,-1|.772;majoshi@cisco.com>: %SYS-5- <tricon:40,-1|-5-;majoshi@cisco.com>CONFIG_I: Configured from console by pnoc on vty0 (172.18.224.151) <tricon:40,-1|0 (172.18.224.151);majoshi(a)cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:20.776<tricon:40,-1|.776;majoshi@cisco.com>: Released port 15205 <tricon:40,-1|15205;majoshi@cisco.com> in Transport Port Agent for TCP IP type 1 delay 240000 <tricon:40,-1|240000;majoshi@cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:20.776<tricon:40,-1|.776;majoshi@cisco.com>: TCB 0x850 <tricon:40,-1|850;majoshi@cisco.com>F9754<tricon:40,-1|9754;majoshi@cisco.com>destroyed *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 created *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 setting property TCP_PID (8) 845083 <tricon:40,-1|(8) 845083;majoshi(a)cisco.com>E4 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 setting property TCP_NO_DELAY (1) 845083 <tricon:40,-1|(1) 845083;majoshi(a)cisco.com>E8 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 setting property TCP keepalive timeout (17) 845084 <tricon:40,-1|(17) 845084;majoshi(a)cisco.com> A0 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCP: Random local port generated 63845<tricon:40,-1|63845;majoshi@cisco.com>, network 1 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 bound to 14.3.23.50.63845<tricon:40,-1|14.3.23.50.63845;majoshi@cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: Reserved port 63845 <tricon:40,-1|63845;majoshi@cisco.com> in Transport Port Agent for TCP IP type 1 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCP: sending SYN, seq 3300233565 <tricon:40,-1|3300233565;majoshi@cisco.com>, ack 0 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCP0: Connection to 172.18.224.190<tricon:40,-1|172.18.224.190;majoshi@cisco.com>:601, advertising MSS 536 <tricon:40,-1|536;majoshi@cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCP0: state was CLOSED -> SYNSENT [63845 - <tricon:40,-1|63845 -;majoshi(a)cisco.com>> 172.18.224.190(601)<tricon:40,-1|172.18.224.190(601);majoshi@cisco.com> ] *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.779<tricon:40,-1|.779;majoshi@cisco.com>: TCP0: state was SYNSENT -> ESTAB [63845 - <tricon:40,-1|63845 -;majoshi(a)cisco.com>> 172.18.224.190(601)<tricon:40,-1|172.18.224.190(601);majoshi@cisco.com> ] *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.779<tricon:40,-1|.779;majoshi@cisco.com>: TCP: tcb 83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 connection to 172.18.224.190 <tricon:40,-1|172.18.224.190;majoshi@cisco.com>:601, peer MSS 1460 <tricon:40,-1|1460;majoshi@cisco.com>, MSS is 536<tricon:40,-1|536;majoshi@cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.779<tricon:40,-1|.779;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 connected to 172.18.224.190.601 <tricon:40,-1|172.18.224.190.601;majoshi@cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.779<tricon:40,-1|.779;majoshi@cisco.com>: %SYS-6- <tricon:40,-1|-6-;majoshi@cisco.com>LOGGINGHOST_STARTSTOP: Logging to host 172.18.224.190 <tricon:40,-1|172.18.224.190;majoshi@cisco.com> port 601 <tricon:40,-1|601;majoshi@cisco.com> started - reconnection ______________________________________________________________ Clayton Dukes ______________________________________________________________

5 15

v3.0.8: How to logging messages with non-rfc timestamps?
by Sergey V. Lobanov 02 Sep '10

02 Sep '10

I'm using syslog-ng v3.0.8(OSE) for logging messages from remote devices. There is a host which sends messages with incorrect timestamp format, for example "Jan 19 15:52:7". Syslog-ng does not store the first word in timestamp via macros $MSGHDR. For example: $ echo "<134>Jan 19 15:52:7 test" | nc -u 192.168.3.142 514 ^C But log file does not contains the word 'Jan': Aug 29 16:49:10 10.147.0.202 10.147.0.202 19 15:52:7 test Configuration file: @version: 3.0 options { use_dns(yes); }; source src_remote { udp(ip("0.0.0.0") port(514) flags(store-legacy-msghdr)); tcp(ip("0.0.0.0") port(514) flags(store-legacy-msghdr)); }; template t_remote {template("$DATE $SOURCEIP $HOST_FROM $MSGHDR$MESSAGE\n"); template_escape(no); }; destination remoteall { file("/var/log/all-remote.log" template(t_remote)); }; log { source(src_remote); destination(remoteall); }; How can I store the original timestamp from the remote host? -- wbr, Sergey V. Lobanov

2 2

Syslog-ng on OpenBSD
by Joe McDonagh 02 Sep '10

02 Sep '10

Nothing is being logged except Log Processing Statistics in /var/log/debug. I am seeing a ton of dropped stuff to my loghost, but what's really alarming is that stuff isn't being logged locally? Sep 2 11:10:02 machine syslog-ng[4179]: Log statistics; dropped='tcp(localhost:61514)=48833', processed='center(queued)=52', processed='center(received)=13', processed='destination(messages)=13', processed='destination(mailinfo)=0', processed='destination(mailwarn)=0', processed='destination(console)=0', processed='destination(mailerr)=0', processed='destination(loghost)=13', processed='destination(authlog)=0', processed='destination(user)=0', processed='destination(lpr)=0', processed='destination(daemon)=0', processed='destination(cron)=0', processed='destination(kern)=0', processed='destination(mail)=0', processed='destination(debug)=13', processed='destination(syslog)=13', processed='destination(console_all)=0', processed='source(src)=13', suppressed='tcp(localhost:61514)=0' This is happening on all my OpenBSD machines I recently setup to use syslog-ng (needed TCP with stunnel in front to send to my log host). This is the config: # This file is managed by puppet as a file in the syslog::client class options { long_hostnames(off); sync(20); use_dns(no);}; source src { internal(); pipe("/dev/klog" log_prefix("kernel: ")); unix-stream("/dev/log"); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination mail { file("/var/log/mail.log"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; destination loghost { tcp("localhost" port(61514)); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_debug { not facility(auth, authpriv, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); destination(loghost); }; <<EOF>> I'm wondering if my source line is just wrong for OpenBSD. Anybody with a working OpenBSD config care to share? -- Joe McDonagh AIM: YoosingYoonickz IRC: joe-mac on freenode "When the going gets weird, the weird turn pro."

2 2