June 2011 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] syslog-ng Digest, Vol 73, Issue 37
by Frank Scalzo 04 Jun '11

04 Jun '11

Gergely, sorry after fighting with this for hours i forgot to upload. @version: 3.0 # # Syslog-ng example configuration for for Debian GNU/Linux # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.3 2003/05/20 08:57:27 asd Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # # replaced with Line below fxs options { long_hostnames(off); sync(0); }; options { long_hostnames(off); flush_lines(0); }; source src { unix-stream("/var/run/syslog"); internal(); }; source net { udp(); }; destination authlog { file("/var/log/auth.log"); }; # replaced with Line below fxs destination syslog { file("/var/log/syslog"); }; destination d_syslog { file(“/var/log/system.log”); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination ppp { file("/var/log/ppp.log"); }; destination mail { file("/var/log/mail.log"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; #destination console_all { file("/dev/tty12"); }; destination console_all { file(“/dev/console”); }; #destination loghost { udp("loghost" port(999)); }; destination xconsole { pipe("/dev/xconsole"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; #Changed it to make it filter the messages from the localO fxs filter f_syslog { not facility(authpriv, mail); }; filter f_syslog { facility(local0); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_ppp { facility(local2); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(f_authpriv); destination(authlog); }; # replaced with Line below fxs log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_syslog); destination(d_syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(f_ppp); destination(ppp); }; log { source(src); destination(console_all); };

3 2

[Fw: keep_hostname (yes); and source file]
by Steven Blatchford 04 Jun '11

04 Jun '11

There seems to be no hostname associated with file() so it uses the first word of the message. The first word of the log message is 'DEBUG'. On the central log server I added 'DEBUG' to the filter host and it worked. Is there a way to set the hostname when the source uses file() ? -steve ----- Forwarded message from Steven Blatchford <sblatchford(a)gmail.com> ----- >From: Steven Blatchford <sblatchford(a)gmail.com> >Subject: keep_hostname (yes); and source file >To: syslog-ng(a)lists.balabit.hu >Date: Fri, 27 May 2011 18:29:41 -0400 > >Hello, > >I have a file, /srv/http/foo/var/log/system.log that I would like sent >to our central log. This config was not working: > > @version: 3.0 > # > # /etc/syslog-ng.conf > # > > options { > stats_freq (0); > flush_lines (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames(off); > use_dns (no); > use_fqdn (no); > create_dirs (no); > keep_hostname (yes); > perm(0640); > group("log"); > }; > > source s_foo { file("/srv/http/foo/var/log/system.log"); }; > > log { source(s_foo); destination(d_net); }; > > destination d_net { udp("host.org"); }; > >It does work if I comment out 'keep_hostname (yes);'. Can someone >explain to me why this is? > >-steve ----- End forwarded message -----

2 1

Syslog-ng timestamp problem
by Tamas Szklenar 03 Jun '11

03 Jun '11

Hi, I configured a syslog-ng server and several clients for testing and it is working great, my only problem is with the timestamp() option. We have a lot of computer in different time zones and I would like to set up the system to keep the messages time stamps. Here is the config for the syslog-ng server: options { flush_lines(5); flush_timeout(1000); time_reopen(10); log_fifo_size(1000); long_hostnames(off); use_dns(yes); dns_cache_hosts(/etc/hosts); use_fqdn(no); create_dirs(yes); dir_perm(0700); keep_hostname(yes); keep_timestamp(yes); stats_freq(0); }; Is there something else what I have to whit this? Thanks for your help! Tamas

2 2

[git] 3.3 tree rebased
by Balazs Scheidler 03 Jun '11

03 Jun '11

Hi, I've rebased my git tree yesterday, to clean up some commit issues I made while in a hurry in the last days. And here's a question for those who use the git tree: are you bothered with rebases? I mean I know it can disrupt things a bit, but I feel the added benefit for a clean(er) history is worth the trouble. If it is indeed a problem for people then I'll refrain from rebasing in the future. Opinions? -- Bazsi

2 1

Re: [syslog-ng] libdbi too old?
by Len Conrad 02 Jun '11

02 Jun '11

---------- Original Message ---------------------------------- From: "Len Conrad" <lconrad(a)Go2France.com> Reply-To: lconrad(a)Go2France.com,Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Date: Thu, 2 Jun 2011 15:59:04 +0200 >OK. > >one of your msgs had the right IP and that's what I used at work just now. I'll see if it works from home. ========== Sorry. My webmail showed me one msg, when I replied it sent to this list.

1 0

Re: [syslog-ng] libdbi too old?
by Len Conrad 02 Jun '11

02 Jun '11

OK. one of your msgs had the right IP and that's what I used at work just now. I'll see if it works from home. ---------- Original Message ---------------------------------- From: John Kristoff <jtk(a)cymru.com> Reply-To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Date: Thu, 2 Jun 2011 08:38:27 -0500 >On Sun, 22 May 2011 13:32:31 +0200 >Balazs Scheidler <bazsi(a)balabit.hu> wrote: > >> It's not difficult to compile from sources however, and the exact >> libdbi version that we use in PE binary packages can be found on >> git.balabit.hu/bazsi/libdbi.git and libdbi-drivers.git. > >>From my notes, here are the steps used to build a recent version of >syslog-ng on a CentOS box with libdbi and specifically pgsql support. > > # ld.so.conf might need to contain: > /usr/local/lib > /usr/local/lib/dbd > /usr/local/pgsql/lib > > sudo yum install gtk2-devel > sudo yum install libdbi-devel > sudo yum install libdbi-dbd-pgsql > > cd ~/workdir > wget http://www.balabit.com/downloads/files/eventlog/0.2/eventlog_0.2.12.tar.gz > tar zxvf eventlog_0.2.12.tar.gz > cd eventlog-0.2.12 > ./configure > make > sudo make install > > cd ~/workdir > # syslog-ng 3.2.x needs newer libdbi than what CentOS has, build from source > # get http://sourceforge.net/projects/libdbi/files/libdbi/libdbi-0.8.3/ > cd libdb-0.8.3 > ./configure --disable-docs && make && sudo make install > make > sudo make install > > cd ~/workdir > # syslog-ng 3.2.x needs newer libdbi-drivers than what CentOS has, build from source > # get http://sourceforge.net/projects/libdbi-drivers/files/libdbi-drivers/libdbi-… > tar zxvf libdb-drivers-0.8.3-1.tar.gz > cd libdbi-drivers-0.8.3-1 > ./configure --with-dbi-incdir=/usr/local/include/dbi --with-dbi-libdir=/usr/local/lib --with-pgsql-dir=/usr/local/pgsql --with-pgsql --disable-docs > make > sudo make install > > cd ~/workdir > PKG_CONFIG_PATH=/usr/lib64/pkgconfig:/usr/local/lib/pkgconfig:/usr/local/ssl/lib/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig > export PKG_CONFIG_PATH > wget http://www.balabit.com/downloads/files/syslog-ng/sources/3.2.4/source/syslo… > tar zxvf syslog-ng_3.2.4.tar.gz > cd syslog-ng-3.2.4 > LIBDBI_LIBS="-L/usr/local/lib -ldbi" LIBDBI_CFLAGS="-I/usr/local/include -I/usr/local/include/dbi" ./configure --enable-ssl --enable-sql > # NOTE: there is a bug in syslog-ng 3.2.4 and below and it should be patched. For details, see this bug_id: https://bugzilla.balabit.com/show_bug.cgi?id=120 > make > sudo make install > >John >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

1 0

libdbi too old?
by John Kristoff 02 Jun '11

02 Jun '11

I ran into a problem upgrading from an OSE syslog-ng 3.1.1 to OSE syslog 3.2.4 on a CentOS 64-bit box running under a VM. When starting 3.2.4, here is what I got: Starting syslog-ng... /usr/lib64/dbd/libdbdpgsql.so: undefined symbol: _dbd_parse_datetime libdbi: Failed to load driver: /usr/lib64/dbd/libdbdpgsql.so The database access library (DBI) reports no usable SQL drivers, perhaps DBI drivers are not installed properly; Error initializing dest driver; dest='d_foo', id='d_foo#0' Error initializing message pipeline; The following relevant packages are installed: libdbi-dbd-pgsql.x86_64 0.8.1a-1.2.2 libdbi-devel.i386 0.8.1-2.1 libdbi-devel.x86_64 0.8.1-2.1 It looks like I have an libdbi that is probably just too old? Not an unheard of issue when using CentOS and RedHat, but if there is an easy work around, I'd be interested in hearing about any ideas. Thanks, John

2 2

OSX 10.6.7 not logging and has errors
by Frank Scalzo 01 Jun '11

01 Jun '11

thanks scott, i saw the errors that was my fault for being tired and a little lazy that night made adjustments to file now i get no errors when doing the syslog-ng --syntax-only but I am not getting any logging of the normal items like login attempt and failures and such the only log i got was below looks like its just the stats and this was in messages and debug not the main log Jun 1 11:48:05 mcm-001 syslog-ng[120]: syslog-ng starting up; version='3.0.8' Jun 1 11:58:06 mcm-001 syslog-ng[120]: Log statistics; processed='destination(user)=0', processed='destination(mailwarn)=0', processed='destination(uucp)=0', processed='destination(lpr)=0', processed='destination(daemon)=0', processed='destination(debug)=1', processed='center(received)=0', processed='destination(mailerr)=0', processed='destination(d_syslog)=1', processed='destination(kern)=0', processed='source(src)=1', processed='destination(mailinfo)=0', processed='destination(newsnotice)=0', processed='destination(newserr)=0', processed='destination(messages)=1', processed='destination(authlog)=0', processed='destination(ppp)=0', processed='center(queued)=0', processed='destination(mail)=0', processed='destination(newscrit)=0', processed='destination(cron)=0', processed='src.internal(src#1)=1', stamp='src.internal(src#1)=1306943285', processed='destination(console)=0', processed='destination(console_all)=1' here is the revised latest config @version: 3.0 # # Syslog-ng example configuration for for Debian GNU/Linux # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.3 2003/05/20 08:57:27 asd Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # # replaced with Line below fxs options { long_hostnames(off); sync(0); }; options { long_hostnames(off); flush_lines(0); }; source src { unix-stream("/var/run/syslog"); internal(); }; source net { udp(); }; destination authlog { file("/var/log/auth.log"); }; # replaced with Line below fxs destination syslog { file("/var/log/syslog"); }; destination d_syslog { file("/var/log/syslog.log"); }; #destination d_syslog { file("/var/log/system.log"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination ppp { file("/var/log/ppp.log"); }; destination mail { file("/var/log/mail.log"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; #destination console_all { file("/dev/tty12"); }; destination console_all { file("/dev/console"); }; #destination loghost { udp("loghost" port(999)); }; destination xconsole { pipe("/dev/xconsole"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; #Changed it to make it filter the messages from the localO fxs filter f_syslog { not facility(authpriv, mail); }; filter f_syslog { facility(local0); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_ppp { facility(local2); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(f_authpriv); destination(authlog); }; # replaced with Line below fxs log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_syslog); destination(d_syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(f_ppp); destination(ppp); }; log { source(src); destination(console_all); }; On Wed, Jun 1, 2011 at 6:00 AM, <syslog-ng-request(a)lists.balabit.hu> wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: syslog-ng Digest, Vol 73, Issue 37 (Frank Scalzo) > 2. [Bug 122] [3.2.4]: mixed linking broken for > libsyslog-ng.so.* (bugzilla(a)bugzilla.balabit.com) > 3. [Bug 122] [3.2.4]: mixed linking broken for > libsyslog-ng.so.* (bugzilla(a)bugzilla.balabit.com) > 4. Re: syslog-ng Digest, Vol 73, Issue 37 (Scott Rochford) > 5. [Bug 122] [3.2.4]: mixed linking broken for > libsyslog-ng.so.* (bugzilla(a)bugzilla.balabit.com) > 6. [Bug 122] [3.2.4]: mixed linking broken for > libsyslog-ng.so.* (bugzilla(a)bugzilla.balabit.com) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 31 May 2011 08:51:17 -0400 > From: Frank Scalzo <fscalzo(a)gmail.com> > Subject: Re: [syslog-ng] syslog-ng Digest, Vol 73, Issue 37 > To: syslog-ng(a)lists.balabit.hu > Message-ID: <BANLkTikpWETLmnTSzSDL_4Cx4p0=gPT+6w(a)mail.gmail.com> > Content-Type: text/plain; charset="windows-1252" > > Gergely, > > sorry after fighting with this for hours i forgot to upload. > > @version: 3.0 > # > # Syslog-ng example configuration for for Debian GNU/Linux > # > # Copyright (c) 1999 anonymous > # Copyright (c) 1999 Balazs Scheidler > # $Id: syslog-ng.conf.sample,v 1.3 2003/05/20 08:57:27 asd Exp $ > # > # Syslog-ng configuration file, compatible with default Debian syslogd > # installation. > # > > > # replaced with Line below fxs options { long_hostnames(off); sync(0); }; > options { long_hostnames(off); flush_lines(0); }; > > source src { unix-stream("/var/run/syslog"); internal(); }; > source net { udp(); }; > > destination authlog { file("/var/log/auth.log"); }; > # replaced with Line below fxs destination syslog { > file("/var/log/syslog"); > }; > destination d_syslog { file(?/var/log/system.log?); }; > destination cron { file("/var/log/cron.log"); }; > destination daemon { file("/var/log/daemon.log"); }; > destination kern { file("/var/log/kern.log"); }; > destination lpr { file("/var/log/lpr.log"); }; > destination user { file("/var/log/user.log"); }; > destination uucp { file("/var/log/uucp.log"); }; > destination ppp { file("/var/log/ppp.log"); }; > destination mail { file("/var/log/mail.log"); }; > > destination mailinfo { file("/var/log/mail.info"); }; > destination mailwarn { file("/var/log/mail.warn"); }; > destination mailerr { file("/var/log/mail.err"); }; > > destination newscrit { file("/var/log/news/news.crit"); }; > destination newserr { file("/var/log/news/news.err"); }; > destination newsnotice { file("/var/log/news/news.notice"); }; > > destination debug { file("/var/log/debug"); }; > destination messages { file("/var/log/messages"); }; > destination console { usertty("root"); }; > #destination console_all { file("/dev/tty12"); }; > destination console_all { file(?/dev/console?); }; > #destination loghost { udp("loghost" port(999)); }; > > > destination xconsole { pipe("/dev/xconsole"); }; > > filter f_auth { facility(auth); }; > filter f_authpriv { facility(auth, authpriv); }; > #Changed it to make it filter the messages from the localO fxs filter > f_syslog { not facility(authpriv, mail); }; > filter f_syslog { facility(local0); }; > filter f_cron { facility(cron); }; > filter f_daemon { facility(daemon); }; > filter f_kern { facility(kern); }; > filter f_lpr { facility(lpr); }; > filter f_mail { facility(mail); }; > filter f_user { facility(user); }; > filter f_uucp { facility(cron); }; > filter f_ppp { facility(local2); }; > filter f_news { facility(news); }; > filter f_debug { not facility(auth, authpriv, news, mail); }; > filter f_messages { level(info..warn) > and not facility(auth, authpriv, mail, news); }; > filter f_emergency { level(emerg); }; > > filter f_info { level(info); }; > filter f_notice { level(notice); }; > filter f_warn { level(warn); }; > filter f_crit { level(crit); }; > filter f_err { level(err); }; > > log { source(src); filter(f_authpriv); destination(authlog); }; > # replaced with Line below fxs log { source(src); filter(f_syslog); > destination(syslog); }; > log { source(src); filter(f_syslog); destination(d_syslog); }; > log { source(src); filter(f_cron); destination(cron); }; > log { source(src); filter(f_daemon); destination(daemon); }; > log { source(src); filter(f_kern); destination(kern); }; > log { source(src); filter(f_lpr); destination(lpr); }; > log { source(src); filter(f_mail); destination(mail); }; > log { source(src); filter(f_user); destination(user); }; > log { source(src); filter(f_uucp); destination(uucp); }; > log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); > }; > log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); > }; > log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; > log { source(src); filter(f_news); filter(f_crit); destination(newscrit); > }; > log { source(src); filter(f_news); filter(f_err); destination(newserr); }; > log { source(src); filter(f_news); filter(f_notice); > destination(newsnotice); }; > log { source(src); filter(f_debug); destination(debug); }; > log { source(src); filter(f_messages); destination(messages); }; > log { source(src); filter(f_emergency); destination(console); }; > log { source(src); filter(f_ppp); destination(ppp); }; > log { source(src); destination(console_all); }; >

1 0