June 2012 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] issue with rewrite. Please help.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 19 Jun '12

19 Jun '12

Hi Balint and all, Can you guide us here on what might be the issue ? Thanks Hithendra -----Original Message----- From: Balla, Hithendra (EXT-Other - IN/Bangalore) Sent: Monday, June 18, 2012 6:53 PM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] issue with rewrite. Please help. Hi Balint, Thanks for the reply. I tried the below rewrite rewrite r_solaris { subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") type("pcre") flags(dont-store-matches)); }; It works for auth.info, but it does not work with local7.info or local6.info as the regex does not handle numerals in the facility field. I tried changing it as follows (i.e. added [0-9] before .)., but with this, this dumps core. Addition of any numeral in this position results in a core dump subst("\[ID [0-9]* [a-z]*[0-9]\.[a-z]*\]\ " "" value("MESSAGE") We have tried the following. logger -p local7.info "HELLO|KUAAA" --> Did not work logger -p local6.info "HELLO|KUAAA" --> Did not work logger -p auth.info "Accepted password for root" --> Worked. Thanks Hithendra -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu on behalf of ext Balint Kovacs Sent: Fri 6/15/2012 10:26 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] issue with rewrite. Please help. Hi Hithendra, I came across this problem just recently, I guess that you want to handle Solaris logs with the standard Unix analysis ruleset, but the these tags are in the way. The only difference is, that I moved the tag to the end of the message (as patterndb does prefix matching, these don't bother my patterns but are still there). My rewrite rule is the following: rewrite r_solaris { #move the solaris header to the end of the message #to work with linux patterndb subst("(\[ID [0-9]* [a-z]*\.[a-z]*\])\ " "" value("MESSAGE") type("pcre") flags(store-matches)); subst("$" " $1" value("MESSAGE") type("pcre")); }; If you don't want to move it (backreferencing is quite slow and resource-intensive), you could just use this untested version: rewrite r_solaris { subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") type("pcre") flags(dont-store-matches)); }; HTH, Balint On 06/15/2012 05:39 AM, Balla, Hithendra (EXT-Other - IN/Bangalore) wrote: > > Hi all, > > We have the followinglog > > 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6*[ID 800047 > auth.info]*Accepted publickey for xyz > > We wanted to replace*[ID 800047 auth.info]*with*empty > string*(i.e."")and print the following > > 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 Accepted publickey for xyz > > So we have used the below re-write with subst. But this is not > workingin*syslog-ng 3.4.0alpha2*. > > rewrite rw_msg{*subst*("\\[.*\\]", "", value("MESSAGE"));}; > > Can somebody help out here? > > Thanks > > Hithendra > > > > ________________________________________________________________________ ______ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq >

1 0

Writes garbled kernel messages to logs
by shih dane 18 Jun '12

18 Jun '12

Hi All Lately I've setup syslog server on Fedora 12 l want to get iscsi connection log but get some garbled kernel messages like this Jun 8 09:56:12 F12DANE kernel: 6MxusadnRT 1 Jun 8 09:56:12 F12DANE kernel: 6DtPUnre: Ys<>aaeunenre: e Jun 8 09:56:12 F12DANE kernel: 6Erreoeyee: 0<>esoTp: oml<>---------------------------------<>AGTCR[SS] eitrdfbi_espr ff82d810<>SS oi ucsflo I:1fo 7.66.4 o121.51736, Jun 8 09:56:12 F12DANE kernel: 6IceetdiCICneto on o1fo oe q.910.o.irsf:aep Jun 8 09:56:12 F12DANE kernel: 6EtbihdiCIssinfo oe q.910.o.irsf:aep Jun 8 09:56:12 F12DANE kernel: 6Iceetdnme fatv SS esost niCITre otlGop Jun 8 09:56:15 F12DANE kernel: Received iSCSI login reques rm121.419o C ewr otl121.51736 Jun 8 09:56:15 F12DANE kernel: tfo 7.66.4 nTPNtokPra 7.66.7:20<>---------------------------------<>uhehd oe<>edriet oe<>aaiet oe<>aRcDtSgetegh 53 Jun 8 09:56:15 F12DANE kernel: 6--------------------------------- Jun 8 09:56:15 F12DANE kernel: 6--------------------------------- Jun 8 09:56:15 F12DANE kernel: 6Iiitrae in19-5cmmcootdn-c<>agtla: I agt<>agtotlruTg Jun 8 09:56:15 F12DANE kernel: 6DfutieWi: 2<>ealTm2ean 0<>esoTp: icvr Jun 8 09:56:15 F12DANE kernel: 6--------------------------------- Jun 8 09:56:15 F12DANE kernel: 6TRE_OEiCI:Rgsee arcss_t:ff800208 Jun 8 09:56:15 F12DANE kernel: 6iCILgnscesu nCD rm121.419t 7.66.7:201<>nrmne SS oncincutt rmnd:in19-5cmmcootdn-c<>salse SS eso rmnd:in19-5cmmcootdn-c<>nrmne ubro cieiCIssin o1o SS agtPra ru:1<>ermne SS onci syslog-ng version : syslog-ng 3.3.1 syslog-ng.conf @version: 3.3 @include "scl.conf" options { stats_freq(0); create_dirs(yes); dir_perm(0777); perm(0644); }; source src { system(); internal(); udp(); }; destination information { file("/raid/syslog/information"); }; destination error { file("/raid/syslog/error"); }; destination warning { file("/raid/syslog/warning"); }; filter f_info { level(info); }; filter f_error { level(error); }; filter f_warning { level(warning); }; log { source(src); filter(f_info); destination(information); }; log { source(src); filter(f_error); destination(error); }; log { source(src); filter(f_warning); destination(warning); }; Thanks for any advice Best Regard Dane

2 4

how can i get usb and printer detailed logs with syslog-ng
by ismail başaran 18 Jun '12

18 Jun '12

Hi, İ am using ubuntu 11.04. My server machine and clients ubuntu 11.04. i am trying to get usb and printer detailed logs. i can see usb connect and disconnect logs. But i want to see what operations execute on it like copied file name or printed file name. How can i achive this. thanks -- İsmail BAŞARAN http://www.softera.com.tr

2 1

issue with rewrite. Please help.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 15 Jun '12

15 Jun '12

Hi all, We have the following log 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 [ID 800047 auth.info] Accepted publickey for xyz We wanted to replace [ID 800047 auth.info] with empty string (i.e. "") and print the following 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 Accepted publickey for xyz So we have used the below re-write with subst. But this is not working in syslog-ng 3.4.0alpha2. rewrite rw_msg{subst("\\[.*\\]", "", value("MESSAGE"));}; Can somebody help out here? Thanks Hithendra

2 1

Re: [syslog-ng] issue with rewrite. Please help.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 15 Jun '12

15 Jun '12

Can somebody help here on this issue? _____________________________________________ From: Balla, Hithendra (EXT-Other - IN/Bangalore) Sent: Friday, June 15, 2012 9:09 AM To: 'Syslog-ng users' and developers' mailing list' Subject: issue with rewrite. Please help. Hi all, We have the following log 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 [ID 800047 auth.info] Accepted publickey for xyz We wanted to replace [ID 800047 auth.info] with empty string (i.e. "") and print the following 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 Accepted publickey for xyz So we have used the below re-write with subst. But this is not working in syslog-ng 3.4.0alpha2. rewrite rw_msg{subst("\\[.*\\]", "", value("MESSAGE"));}; Can somebody help out here? Thanks Hithendra

2 1

syslog-ng 3.3.4 Coredumps on AIX 5.2
by Divya Vikraman 15 Jun '12

15 Jun '12

Hello ALL, I have compiled syslog-ng 3.3.4 version using dynamic linking. But , while trying to run syslog-ng it coredumps # /opt/soe/local/syslog-ng-3.3.4/sbin/syslog-ng -F Memory fault(coredump) # I have compiled glib-2.19.7 with the (--enable-static and --with-libiconv) option After searching over the net for some possibel solutions , i found that a possible solution for this is to use the AIX libiconv instead of the GNU one. If this is correct, then the issue is , glib-2 needs the GNU glib, if i try with the system one the make fails with the below error. "error GNU libiconv not in use but included iconv.h is from libiconv". So, I cannot use the system libiconv as glib-2 will fail to compile and if I use GNU libiconv syslog-ng coredumps. though, the configure and stages do not complaing anything. Has, anyone else faced this issue , please let me know how can I get this working. Best Regards, Divya.

2 1

syslog-ng maintenance changes
by Balazs Scheidler 15 Jun '12

15 Jun '12

Hi, I had a decreasing amount of time to work on syslog-ng in the past year, as you may have noticed by my absense on the mailing list, and the relative rarity of my blog posts. More and more is done by Algernon (aka Gergely Nagy), and I felt it to be incorrect to be the bottleneck in a number of cases. Even though Algernon is emloyed by BalaBit, his daily job didn't and doesn't mandate such close relationship with syslog-ng. That was his own motivation, and I think that is a key to maintaining or developing open source software. After talking to him in real life, we've decided to make a shift, he is going to maintain the 3.3 tree and making releases instead of myself. This will make 3.3 maintenance smoother, and free some precious time for me, which I'd use to work on the 3.4 features. The location of the syslog-ng trees will change too, they would be available at: git://github.com/balabit/syslog-ng-3.3.git git://github.com/balabit/syslog-ng-3.4.git or the web interface at: http://github.com/balabit I am certain that this change is for the better of syslog-ng, and I hope the conclusion of the community will be the same in a few months. I really thank him for helping me out. Cheers, Bazsi

4 5

Building a syslog server (syslog-ng) with GUI
by Yu Watanabe 14 Jun '12

14 Jun '12

Hi all! I am planning to build a syslog server using syslog-ng, however, not using the configuration drivers of syslog-ng. Instead, I want to use a third party GUI that has a filtering function and would be better if can set actions for each fitlering. The reason for using other GUI is that because configuration file is getting bit complex. So, the story is make syslog-ng gather the logs and send it to database ( such as mysql ). The the thrid party GUI do the filtering. Cacti - camm plugin is one of my candidates. It would be helpful if people in this mailing list can give us some recommendation for the GUI. Thanks, Yu

6 5

logstore and idx files
by Anup Shetty 13 Jun '12

13 Jun '12

Hello, When using logstore(), it writes to log files with extension .lgs. The .jor files act as buffers before the logs are written on to the disk in .lgs files. Another file that gets created are the .idx files. What are the .idx files for? Each day logs from the servers gets stored into different files as the $Date parameter is used to create the file name. When this happens, suppose on 23:59:59 hrs, the journal file does not fill up to the chunk size defined or the chuck time does not expire and the syslog writes to a new file at 00:00:00hrs then what happens to the logs? do they get written onto the .lgs files? -- Thanks and regards, Anup Shetty +91-9820784185

2 2

php as program()
by Peter Czanik 13 Jun '12

13 Jun '12

Hello, A user in the web based community forum ran into trouble running php from program(). As it on SLES running syslog-ng 2.0 which is out of support for ages, I could not find anybody around me with an answer for it. The forum thread is available at http://communities.balabit.com/balabit/topics/php_as_programm and please register / write your solution there, if you have an answer for the question! (so I don't need to become a forum/list gw :-) ) Bye, -- Peter Czanik (CzP)<czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0