April 2013 - syslog-ng - lists.balabit.hu

insider 2013-04: syslog-ng presentation at LOADays; New maintenance releases; Comment the Adminguide online
by Peter Czanik 18 Apr '13

18 Apr '13

Dear syslog-ng users, This is the 23th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. FEATURED NEWS syslog-ng presentation at LOADays --------------------------------- Peter Czanik of BalaBit gave a presentation at LOADays, a conference focusing on system administrators. It was about the major new features of the syslog-ng 3.X series including a few short demos of these features. Participants were most interested in patterndb, correlation and AMQP and asked about upcoming features. The conference page is available at: http://loadays.org/ Blog about the event: https://czanik.blogs.balabit.com/2013/04/czp-loadays/ New maintenance releases ------------------------ While most people are interested in new features, the syslog-ng team is also working on maintenance releases which fix problems in already released software. A new maintenance version was released for the 3.3 series a few days ago and an other one is expected to arrive soon for the 3.4 series. Announcement: https://lists.balabit.hu/pipermail/syslog-ng-announce/2013-April/000157.html Comment the Adminguide online! ------------------------------ As you might know, we publish The syslog-ng Open Source Edition Administrator guide in three format: PDF, single-page HTML, and many-page HTML. The many-page HTML version of the OSE 3.3 and 3.4 guides have a new feature: online commenting. That means that you can easily give us feedback on any section of the adminguide. For example, you did not understand how X feature works? Let us know! You have found a typo? Please add a comment at the bottom of the page so we can correct it! You have a better, real-life configuration example instead of the one in the guide? Add it as a comment! Or even worse, there are no examples where it would be needed? If you already got a working example, please share it with us! Try it at http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-guid… BOOK OFFERING: Logging and Log Management: The Authoritative Guide to Understanding the Concepts Surrounding Logging and Log Management --------------------------------------------------- Effectively analyzing large volumes of diverse logs can pose many challenges. The recently published /Logging and Log Management /book helps to simplify this complex process using practical guidance and real-world examples. Packed with information you need to know for system, network and security logging. Log management and log analysis methods are covered in detail, including approaches to creating useful logs on systems and applications, log searching and log review. Chapter 5 describes you what is syslog-ng, and you also find some useful examples for deployment and configuration. http://www.amazon.com/Logging-Log-Management-Authoritative-Understanding/dp… SHORT NEWS: * A few thoughts about why logging is important: https://czanik.blogs.balabit.com/2013/04/why-logging-is-important/ NEW RELEASES: * syslog-ng 3.3.9: https://lists.balabit.hu/pipermail/syslog-ng-announce/2013-April/000157.html Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

High availability for syslog-ng
by Abhijeet Rastogi 16 Apr '13

16 Apr '13

Hi, Currently, I've just one syslog-ng server which receives messages from hundreds of rsyslog instances. I'm sending logs via UDP so if syslog-ng machine dies, logs will be missed. How can I make the system more redundant? I want to achieve something like if the current syslog-ng machine goes down, some other machine should be able to take it's role. Any kind of help is highly appreciated. Thanks -- Regards, Abhijeet Rastogi (shadyabhi) http://blog.abhijeetr.com

5 6

Passing args to blocks gives error in v.3.4.1
by Anton Koldaev 16 Apr '13

16 Apr '13

After an upgrade from 3.3.7 to 3.4.1: ... block root mylogs(log()) { }; mylogs(log(123)) ... Gives: Unknown argument; context='root block mylogs', arg='log', value='123' Error parsing config, syntax error, unexpected LL_ERROR, expecting $end in /etc/syslog-ng/syslog-ng.conf at line 11, column 1: mylogs(log(123)) ^^^^^^ Am I doing anything wrong? -- Best regards, Koldaev Anton

2 4

missing hostname from solaris client
by Lucas, Sascha 12 Apr '13

12 Apr '13

Hi, I have the following settings in my syslog-ng.conf: options { chain_hostnames(off); keep_hostname(yes); normalize_hostnames(yes); use_dns(no); }; mostly to get the original (case insensitive) hostname from the client. Solaris (10,11) clients don't send their hostname over the wire (check with tcpdump/wireshark). syslog-ng sets the client IP address to the hostname. Can someone tell me if solaris can be tweaked to send the hostname? Thanks, Sascha. Vorsitzender des Aufsichtsrates: Ralf Hiltenkamp Geschäftsführung: Michael Krüger (Sprecher), Stephan Drescher Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

2 2

[Bug 227] New: Feature request – Linux /dev/kmsg support
by bugzilla＠bugzilla.balabit.com 12 Apr '13

12 Apr '13

https://bugzilla.balabit.com/show_bug.cgi?id=227 Summary: Feature request – Linux /dev/kmsg support Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: grawity(a)gmail.com Type of the Report: enhancement Estimated Hours: 0.0 Starting with Linux 3.5 (commits [1], [2]), there is a new kmsg interface "/dev/kmsg", which allows multiple readers, is able to export some structured data (such as device name and subsystem), avoids some other problems /proc/kmsg had, such as the ones described in syslog-ng's FAQ [3]. Are there any plans to support this in syslog-ng? The format is explained in Documentation/ABI/testing/dev-kmsg.txt [4]. [1]: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… [2]: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… [3]: http://www.balabit.com/wiki/syslog-ng-faq-kmsg-klogd [4]: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/plain/Docum… -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

syslog-ng v3.3.4 on Ubuntu 12.04.2 LTS x_64 has a memory leak
by Clayton Dukes 11 Apr '13

11 Apr '13

Hi Guys, We have some folks doing an audit and they found that syslog-ng is leaking memory. This server is processing a steady 8000 events/second, 24 hours a day. syslog-ng is currently using 20GB of memory. Here is their comment: ===================== I've been watching syslog-ng memory usage and this looks like leaking to me (5MB growth every minute): root@logzilla:/etc/syslog-ng# while sleep 60; do ps auxw | grep /usr/sbin/syslog-ng | grep -v grep; done root 14004 26.4 20.6 20831384 20462180 ? Ssl Apr08 1024:00 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20467152 ? Ssl Apr08 1024:17 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20472132 ? Ssl Apr08 1024:33 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20477136 ? Ssl Apr08 1024:49 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20481932 ? Ssl Apr08 1025:06 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20486956 ? Ssl Apr08 1025:22 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20491700 ? Rsl Apr08 1025:39 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20496688 ? Ssl Apr08 1025:55 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20501576 ? Ssl Apr08 1026:11 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20506788 ? Ssl Apr08 1026:28 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20512480 ? Ssl Apr08 1026:44 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20518272 ? Ssl Apr08 1026:59 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20522940 ? Ssl Apr08 1027:16 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20528268 ? Ssl Apr08 1027:32 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20533184 ? Ssl Apr08 1027:49 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20538016 ? Ssl Apr08 1028:05 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20543132 ? Ssl Apr08 1028:22 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20548200 ? Ssl Apr08 1028:37 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20553124 ? Rsl Apr08 1028:54 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20557940 ? Ssl Apr08 1029:10 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20563312 ? Ssl Apr08 1029:26 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20568080 ? Ssl Apr08 1029:43 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20573176 ? Ssl Apr08 1029:59 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20578104 ? Rsl Apr08 1030:16 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20583076 ? Ssl Apr08 1030:32 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20588856 ? Ssl Apr08 1030:48 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20831384 20594296 ? Ssl Apr08 1031:03 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20831384 20599116 ? Ssl Apr08 1031:20 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20831384 20604028 ? Ssl Apr08 1031:36 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20608844 ? Ssl Apr08 1031:52 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20613796 ? Ssl Apr08 1032:08 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20618956 ? Ssl Apr08 1032:25 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20624292 ? Ssl Apr08 1032:41 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20629372 ? Ssl Apr08 1032:57 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20634284 ? Ssl Apr08 1033:13 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20639608 ? Ssl Apr08 1033:29 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20644384 ? Rsl Apr08 1033:45 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20649440 ? Rsl Apr08 1034:02 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20962456 20654116 ? Ssl Apr08 1034:18 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20962456 20659368 ? Rsl Apr08 1034:34 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20962456 20665300 ? Ssl Apr08 1034:50 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20962456 20671644 ? Ssl Apr08 1035:05 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 21027992 20676440 ? Rsl Apr08 1035:22 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 21027992 20681116 ? Ssl Apr08 1035:38 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 21027992 20686220 ? Ssl Apr08 1035:54 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20691032 ? Ssl Apr08 1036:11 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20696044 ? Ssl Apr08 1036:27 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20700944 ? Rsl Apr08 1036:43 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20705760 ? Ssl Apr08 1037:00 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20710540 ? Rsl Apr08 1037:18 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20715696 ? Ssl Apr08 1037:34 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20720316 ? Ssl Apr08 1037:51 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20725632 ? Ssl Apr08 1038:07 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20730196 ? Ssl Apr08 1038:24 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20735636 ? Ssl Apr08 1038:39 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20741476 ? Ssl Apr08 1038:56 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20749860 ? Ssl Apr08 1039:10 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20755808 ? Ssl Apr08 1039:24 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20761004 ? Ssl Apr08 1039:40 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20766152 ? Ssl Apr08 1039:57 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20771220 ? Ssl Apr08 1040:14 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20776268 ? Ssl Apr08 1040:30 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20781116 ? Ssl Apr08 1040:47 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20786176 ? Ssl Apr08 1041:03 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 21.0 21159192 20791412 ? Ssl Apr08 1041:19 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 21.0 21159192 20796124 ? Ssl Apr08 1041:36 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 21.0 21159192 20801112 ? Ssl Apr08 1041:53 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 21.0 21159192 20805952 ? Rsl Apr08 1042:10 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid ______________________________________________________________ Clayton Dukes ______________________________________________________________

3 5

[PATCH (3.4)] cfg_lexer: Drop quotes when expanding a backtick, and already quoted
by Gergely Nagy 09 Apr '13

09 Apr '13

In case we're expanding a backtick while we're already in a quoted string, and the backtick starts with a '"', drop the extra quotes. This allows blocks like: block source s_logfile (filename("messages")) { file("/var/log/`filename`"); }; source s_example { s_logfile(filename("logfile.log")); }; To work properly, and result in file("/var/log/logfile.log"); Reported-by: Eric Berggren <eric_berggren(a)apple.com> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/cfg-lexer.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/lib/cfg-lexer.c b/lib/cfg-lexer.c index fbce432..b1c7c93 100644 --- a/lib/cfg-lexer.c +++ b/lib/cfg-lexer.c @@ -156,12 +156,18 @@ gchar * cfg_lexer_subst_args(CfgArgs *globals, CfgArgs *defs, CfgArgs *args, gchar *cptr, gsize *length) { gboolean backtick = FALSE; + gboolean in_string = FALSE; gchar *p, *ref_start = cptr; GString *result = g_string_sized_new(32); p = cptr; while (*p) { + if (!backtick && (*p) == '"') + { + in_string = !in_string; + } + if (!backtick && (*p) == '`') { /* start of reference */ @@ -195,7 +201,12 @@ cfg_lexer_subst_args(CfgArgs *globals, CfgArgs *defs, CfgArgs *args, gchar *cptr arg = NULL; *p = '`'; - g_string_append(result, arg ? arg : ""); + if (in_string && arg && arg[0] == '"') + { + g_string_append_len(result, &arg[1], strlen(arg) - 2); + } + else + g_string_append(result, arg ? arg : ""); } } else if (!backtick) -- 1.7.10.4

1 0

[PATCH 0/3]: Support systemd notifications
by Gergely Nagy 09 Apr '13

09 Apr '13

The patchset coming after this implements support for Type=notify units, and support for the STATUS notifications in systemd. This means that syslog-ng becomes able to signal systemd upon startup when it finished starting up, and thanks to the STATUS notifications, an administrator will be able to check syslog-ng's status with systemctl. If a reload fails for example, that will be shown there. -- |8]

1 3

Re: [syslog-ng] syslog-ng Digest, Vol 96, Issue 6
by Yarick Tsagoyko 09 Apr '13

09 Apr '13

Dear Ramon, the config looks ok, What is the issue you are having ? --Yarick. On Mon, Apr 8, 2013 at 3:25 PM, <syslog-ng-request(a)lists.balabit.hu> wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: Syslog-ng 3.1.4 on OpenBSD 5.2 (Ramon F McDougall) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 8 Apr 2013 15:25:25 -0400 > From: Ramon F McDougall <cyberjet(a)live.com> > Subject: Re: [syslog-ng] Syslog-ng 3.1.4 on OpenBSD 5.2 > To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> > Message-ID: <BAY148-W654AE36D7E7FB13020FC85B7C50(a)phx.gbl> > Content-Type: text/plain; charset="windows-1252" > > Greetings > to All, > > > > I > need your help, I recently installed Syslog-ng on an OpenBSD 5.2 and > decided to > try syslog-ng to work under this environment. I?m not 100% sure(trying to > learn about all these things) that it?s > working the way it?s supposed to. I followed an example detailed in this > link: > http://kimiushida.com/bitsandpieces/articles/openbsd_syslog-ng/index.html > > It?s my hope that someone with much more expertise than I share > some of their knowledge so that I can get this working. I have configured > the > firewall to send to my syslog server v3.1.4. Does anyone have this working > on > OpenBSD and can share their config files? > > > > $ cd syslog-ng > > syslog-ng.conf > syslog-ng.conf.original > > $ more syslog-ng.conf > > # syslog-ng configuration file for OpenBSD. > > # This should provide the same behavior as OpenBSD's > syslog.conf(5). > > # 2010-07-18 steven(a)openbsd.org > > > > @version: 3.0 > > > > options { > > use_dns(no); > > > create_dirs(no); > > > keep_hostname(yes); > > }; > > > > source s_local { > > unix-dgram > ("/dev/log"); > > unix-dgram > ("/var/empty/dev/log"); > > internal(); > > }; > > #source s_local_all { > > # unix-dgram > ("/dev/log"); > > # unix-dgram > ("/var/empty/dev/log"); > > # unix-dgram > ("/var/www/dev/log"); > > # internal(); > > #}; > > #source s_net { > > # > udp(port(514)); > > #}; > > > > destination d_console > { file("/dev/console"); > }; > > destination d_messages > { file("/var/log/messages" owner(root) group(wheel) > perm(0644)); }; > > destination d_authlog > { file("/var/log/authlog" owner(root) group(wheel) > perm(0640)); }; > > destination d_secure > { file("/var/log/secure" owner(root) group(wheel) > perm(0600)); }; > > destination d_cronlog > { file("/var/cron/log" owner(root) group(wheel) > perm(0600)); }; > > destination d_daemon > { file("/var/log/daemon" owner(root) group(wheel) > perm(0640)); }; > > destination d_xferlog > { file("/var/log/xferlog" owner(root) group(wheel) > perm(0640)); }; > > destination d_lpderrs > { file("/var/log/lpd-errs" owner(root) group(wheel) > perm(0640)); }; > > destination d_maillog > { file("/var/log/maillog" owner(root) group(wheel) > perm(0600)); }; > > destination d_uucplog > { file("/var/log/uucp" owner(uucp) group(dialer) > perm(0660)); }; > > destination d_sudolog > { file("/var/log/sudo"); > }; > > destination d_chatlog > { file("/var/log/chat"); > }; > > destination d_ttyall > { usertty("*"); > }; > > destination d_ttyroot > { usertty("root"); > }; > > destination d_loghost > { udp("loghost" port(514)); > }; > > > > destination d_network_hosts { file > ("/var/log/bcm/$HOST.log"); }; > > > > filter f_notice { > > level(notice > .. emerg) > > and > not(facility(auth,authpriv,cron,ftp,kern,lpr,mail,user)); > > }; > > filter f_kerndebug { > > level(debug .. > emerg) and facility(kern); > > }; > > filter f_msginfo { > > level(info .. > emerg) and facility(syslog,user); > > }; > > filter f_authinfo { > > level(info .. > emerg) and facility(auth); > > }; > > filter f_authprivdebug { > > level(debug .. > emerg) and facility(authpriv); > > }; > > filter f_croninfo { > > level(info .. > emerg) and facility(cron); > > }; > > filter f_daemoninfo { > > level(info .. > emerg) and facility(daemon); > > }; > > filter f_ftpinfo { > > level(info .. > emerg) and facility(ftp); > > }; > > filter f_lprdebug { > > level(debug .. > emerg) and facility(lpr); > > }; > > filter f_mailinfo { > > level(info .. > emerg) and facility(mail); > > }; > > filter f_uucpinfo { > > level(info .. > emerg) and facility(uucp); > > }; > > filter f_emerg { > > level(emerg); > > }; > > filter f_to_console { > > not > (facility(authpriv)) and > > ((level(notice > .. emerg) and facility(auth)) > > or > (level(debug .. emerg) and facility(kern)) > > or (level(crit > .. emerg) and facility(mail)) > > or level(err > .. emerg)); > > }; > > filter f_to_root { > > (level(debug > .. emerg) and facility(auth)) > > or (level(notice .. emerg)); > > }; > > filter f_to_loghost { > > (level(notice > .. emerg) and > > not > (facility(auth,authpriv,cron,ftp,kern,lpr,mail,user))) > > or (level(info > .. emerg) and facility(auth,daemon,syslog,user)) > > or > (level(debug .. emerg) and facility(authpriv,kern)); > > }; > > filter f_prog_sudo { > > > program("sudo"); > > }; > > filter f_prog_chat { > > > program("chat"); > > }; > > > > log { source(s_local); filter(f_notice); destination(d_messages);}; > > log { source(s_local); filter(f_kerndebug); destination(d_messages);}; > > log { source(s_local); filter(f_msginfo); destination(d_messages);}; > > log { source(s_local); filter(f_authinfo); destination(d_authlog); }; > > log { source(s_local); filter(f_authprivdebug); > destination(d_secure); }; > > log { source(s_local); filter(f_croninfo); destination(d_cronlog); }; > > log { source(s_local); filter(f_daemoninfo); destination(d_daemon); }; > > log { source(s_local); filter(f_ftpinfo); destination(d_xferlog); }; > > log { source(s_local); filter(f_lprdebug); destination(d_lpderrs); }; > > log { source(s_local); filter(f_mailinfo); destination(d_maillog); }; > > #log { source(s_local); filter(f_uucpinfo); destination(d_uucplog); }; > > > > # Uncomment this line to send "important" messages > to the system > > # console: be aware that this could create lots of output. > > #log { source(s_local); filter(f_to_console); destination(d_console); }; > > > > # Uncomment this to have all messages of notice level and > higher > > # as well as all authentication messages sent to root. > > #log { source(s_local); filter(f_to_root); destination(d_ttyroot); }; > > > > # Everyone gets emergency messages. > > log { source(s_local); filter(f_emerg); destination(d_ttyall); }; > > > > # Uncomment to log to a central host named > "loghost". > > #log { source(s_local); filter(f_to_loghost); destination(d_loghost); }; > > > > # Uncomment to log messages from sudo(8) and chat(8) to > their own > > # respective log files. > Matches are done based on the program name. > > # Program-specific logs: > > #log { source(s_local); filter(f_prog_sudo); destination(d_sudolog); }; > > #log { source(s_local); filter(f_prog_chat); destination(d_chatlog); }; > > > > # Uncomment to log messages from the network. > > # Note: it is recommended to specify a different destination > here. > > #log { source(s_net); destination(d_messages); }; > > $ syslog-ng-ctl > > Syntax: syslog-ng-ctl <command> [options] > > Possible commands are: > > stats Dump syslog-ng statistics > > verbose Enable/query verbose messages > > debug Enable/query debug messages > > trace Enable/query trace messages > > > > # syslog-ng-ctl stats > > SourceName;SourceId;SourceInstance;State;Type;Number > > center;;received;a;processed;0 > > destination;d_lpderrs;;a;processed;0 > > destination;d_messages;;a;processed;6 > > src.internal;s_local#2;;a;processed;5 > > src.internal;s_local#2;;a;stamp;1365446582 > > destination;d_daemon;;a;processed;0 > > destination;d_secure;;a;processed;0 > > center;;queued;a;processed;0 > > global;payload_reallocs;;a;processed;0 > > global;sdata_updates;;a;processed;0 > > destination;d_xferlog;;a;processed;0 > > destination;d_authlog;;a;processed;2 > > destination;d_cronlog;;a;processed;0 > > destination;d_maillog;;a;processed;0 > > global;msg_clones;;a;processed;0 > > source;s_local;;a;processed;7 > > destination;d_ttyall;;a;processed;0 > > # syslog-ng-ctl verbose --set=on > > # syslog-ng-ctl stats > > SourceName;SourceId;SourceInstance;State;Type;Number > > center;;received;a;processed;0 > > destination;d_lpderrs;;a;processed;0 > > destination;d_messages;;a;processed;9 > > src.internal;s_local#2;;a;processed;8 > > src.internal;s_local#2;;a;stamp;1365446909 > > destination;d_daemon;;a;processed;0 > > destination;d_secure;;a;processed;0 > > center;;queued;a;processed;0 > > global;payload_reallocs;;a;processed;0 > > global;sdata_updates;;a;processed;0 > > destination;d_xferlog;;a;processed;0 > > destination;d_authlog;;a;processed;2 > > destination;d_cronlog;;a;processed;0 > > destination;d_maillog;;a;processed;0 > > global;msg_clones;;a;processed;0 > > source;s_local;;a;processed;10 > > destination;d_ttyall;;a;processed;0 > > # > Please let me know what more information you need to be able to help. > Regards and Thank you,?Ramon > > > >

1 0

Re: [syslog-ng] Syslog-ng 3.1.4 on OpenBSD 5.2
by Ramon F McDougall 08 Apr '13

08 Apr '13

Greetings to All, I need your help, I recently installed Syslog-ng on an OpenBSD 5.2 and decided to try syslog-ng to work under this environment. I’m not 100% sure(trying to learn about all these things) that it’s working the way it’s supposed to. I followed an example detailed in this link: http://kimiushida.com/bitsandpieces/articles/openbsd_syslog-ng/index.html It’s my hope that someone with much more expertise than I share some of their knowledge so that I can get this working. I have configured the firewall to send to my syslog server v3.1.4. Does anyone have this working on OpenBSD and can share their config files? $ cd syslog-ng syslog-ng.conf syslog-ng.conf.original $ more syslog-ng.conf # syslog-ng configuration file for OpenBSD. # This should provide the same behavior as OpenBSD's syslog.conf(5). # 2010-07-18 steven(a)openbsd.org @version: 3.0 options { use_dns(no); create_dirs(no); keep_hostname(yes); }; source s_local { unix-dgram ("/dev/log"); unix-dgram ("/var/empty/dev/log"); internal(); }; #source s_local_all { # unix-dgram ("/dev/log"); # unix-dgram ("/var/empty/dev/log"); # unix-dgram ("/var/www/dev/log"); # internal(); #}; #source s_net { # udp(port(514)); #}; destination d_console { file("/dev/console"); }; destination d_messages { file("/var/log/messages" owner(root) group(wheel) perm(0644)); }; destination d_authlog { file("/var/log/authlog" owner(root) group(wheel) perm(0640)); }; destination d_secure { file("/var/log/secure" owner(root) group(wheel) perm(0600)); }; destination d_cronlog { file("/var/cron/log" owner(root) group(wheel) perm(0600)); }; destination d_daemon { file("/var/log/daemon" owner(root) group(wheel) perm(0640)); }; destination d_xferlog { file("/var/log/xferlog" owner(root) group(wheel) perm(0640)); }; destination d_lpderrs { file("/var/log/lpd-errs" owner(root) group(wheel) perm(0640)); }; destination d_maillog { file("/var/log/maillog" owner(root) group(wheel) perm(0600)); }; destination d_uucplog { file("/var/log/uucp" owner(uucp) group(dialer) perm(0660)); }; destination d_sudolog { file("/var/log/sudo"); }; destination d_chatlog { file("/var/log/chat"); }; destination d_ttyall { usertty("*"); }; destination d_ttyroot { usertty("root"); }; destination d_loghost { udp("loghost" port(514)); }; destination d_network_hosts { file ("/var/log/bcm/$HOST.log"); }; filter f_notice { level(notice .. emerg) and not(facility(auth,authpriv,cron,ftp,kern,lpr,mail,user)); }; filter f_kerndebug { level(debug .. emerg) and facility(kern); }; filter f_msginfo { level(info .. emerg) and facility(syslog,user); }; filter f_authinfo { level(info .. emerg) and facility(auth); }; filter f_authprivdebug { level(debug .. emerg) and facility(authpriv); }; filter f_croninfo { level(info .. emerg) and facility(cron); }; filter f_daemoninfo { level(info .. emerg) and facility(daemon); }; filter f_ftpinfo { level(info .. emerg) and facility(ftp); }; filter f_lprdebug { level(debug .. emerg) and facility(lpr); }; filter f_mailinfo { level(info .. emerg) and facility(mail); }; filter f_uucpinfo { level(info .. emerg) and facility(uucp); }; filter f_emerg { level(emerg); }; filter f_to_console { not (facility(authpriv)) and ((level(notice .. emerg) and facility(auth)) or (level(debug .. emerg) and facility(kern)) or (level(crit .. emerg) and facility(mail)) or level(err .. emerg)); }; filter f_to_root { (level(debug .. emerg) and facility(auth)) or (level(notice .. emerg)); }; filter f_to_loghost { (level(notice .. emerg) and not (facility(auth,authpriv,cron,ftp,kern,lpr,mail,user))) or (level(info .. emerg) and facility(auth,daemon,syslog,user)) or (level(debug .. emerg) and facility(authpriv,kern)); }; filter f_prog_sudo { program("sudo"); }; filter f_prog_chat { program("chat"); }; log { source(s_local); filter(f_notice); destination(d_messages);}; log { source(s_local); filter(f_kerndebug); destination(d_messages);}; log { source(s_local); filter(f_msginfo); destination(d_messages);}; log { source(s_local); filter(f_authinfo); destination(d_authlog); }; log { source(s_local); filter(f_authprivdebug); destination(d_secure); }; log { source(s_local); filter(f_croninfo); destination(d_cronlog); }; log { source(s_local); filter(f_daemoninfo); destination(d_daemon); }; log { source(s_local); filter(f_ftpinfo); destination(d_xferlog); }; log { source(s_local); filter(f_lprdebug); destination(d_lpderrs); }; log { source(s_local); filter(f_mailinfo); destination(d_maillog); }; #log { source(s_local); filter(f_uucpinfo); destination(d_uucplog); }; # Uncomment this line to send "important" messages to the system # console: be aware that this could create lots of output. #log { source(s_local); filter(f_to_console); destination(d_console); }; # Uncomment this to have all messages of notice level and higher # as well as all authentication messages sent to root. #log { source(s_local); filter(f_to_root); destination(d_ttyroot); }; # Everyone gets emergency messages. log { source(s_local); filter(f_emerg); destination(d_ttyall); }; # Uncomment to log to a central host named "loghost". #log { source(s_local); filter(f_to_loghost); destination(d_loghost); }; # Uncomment to log messages from sudo(8) and chat(8) to their own # respective log files. Matches are done based on the program name. # Program-specific logs: #log { source(s_local); filter(f_prog_sudo); destination(d_sudolog); }; #log { source(s_local); filter(f_prog_chat); destination(d_chatlog); }; # Uncomment to log messages from the network. # Note: it is recommended to specify a different destination here. #log { source(s_net); destination(d_messages); }; $ syslog-ng-ctl Syntax: syslog-ng-ctl <command> [options] Possible commands are: stats Dump syslog-ng statistics verbose Enable/query verbose messages debug Enable/query debug messages trace Enable/query trace messages # syslog-ng-ctl stats SourceName;SourceId;SourceInstance;State;Type;Number center;;received;a;processed;0 destination;d_lpderrs;;a;processed;0 destination;d_messages;;a;processed;6 src.internal;s_local#2;;a;processed;5 src.internal;s_local#2;;a;stamp;1365446582 destination;d_daemon;;a;processed;0 destination;d_secure;;a;processed;0 center;;queued;a;processed;0 global;payload_reallocs;;a;processed;0 global;sdata_updates;;a;processed;0 destination;d_xferlog;;a;processed;0 destination;d_authlog;;a;processed;2 destination;d_cronlog;;a;processed;0 destination;d_maillog;;a;processed;0 global;msg_clones;;a;processed;0 source;s_local;;a;processed;7 destination;d_ttyall;;a;processed;0 # syslog-ng-ctl verbose --set=on # syslog-ng-ctl stats SourceName;SourceId;SourceInstance;State;Type;Number center;;received;a;processed;0 destination;d_lpderrs;;a;processed;0 destination;d_messages;;a;processed;9 src.internal;s_local#2;;a;processed;8 src.internal;s_local#2;;a;stamp;1365446909 destination;d_daemon;;a;processed;0 destination;d_secure;;a;processed;0 center;;queued;a;processed;0 global;payload_reallocs;;a;processed;0 global;sdata_updates;;a;processed;0 destination;d_xferlog;;a;processed;0 destination;d_authlog;;a;processed;2 destination;d_cronlog;;a;processed;0 destination;d_maillog;;a;processed;0 global;msg_clones;;a;processed;0 source;s_local;;a;processed;10 destination;d_ttyall;;a;processed;0 # Please let me know what more information you need to be able to help. Regards and Thank you,…Ramon

1 0