- syslog-ng - lists.balabit.hu

TEMPLATE TO ANOTHER SYSLOG
by blizzards＠libero.it 23 Jul '09

23 Jul '09

Hi all. I need to send all my logs to one server with syslog-ng installed. This server write a local file and redirecd to another syslog-ng installed to another server. But when i sent this logs to the second syslog i wolud like to apply a TEMPLATE to it, appending custom words. I can send with no problem my logs via udp to 2nd syslog, but when i apply template to it, the logs does not containm custom words. I readed that template with udp/tcp destination is this is not possible, but someone know a workaround or a way to do it? Thank You. Giulius.

1 0

Compiled 3.0.3 on CentOS 5.3 with spoof source - not working
by Scott Ware 22 Jul '09

22 Jul '09

So, I complied Syslog-ng with the --enable-spoof-source option, and everything installed fine. However, when I have the spoof_source(yes) option in the config file, nothing gets re-directed to my logging destination. If I take the option out, everything gets re-directed. Can you possible help me? Thanks!

2 5

Before the basic 101 questions
by lance raymond 22 Jul '09

22 Jul '09

ok, I have tried 2ce (even using this list) and still have problems that just get dropped by the wayside, so resorting to a more basic approach. So with that, I have 8 ubunutu servers all running apache and I wish/need to have a place for all the logs to reside. I tried syslog-ng with hand updating the conf files, even tried using webmin to build, still can't get it to start, etc. So how about feedback on this. If all the webservers share an nfs mount for the web images, what if I change the log's to just point to those mounts and write them there? I don't know if syslog-ng streams them, waits till x size then copies them over, but since I can't get it working, figured the users/group here might say sure, we've seen a few posts by you, and yea, just do that, or have some really basic ideas as to why, maybe a few sample config's as all the help etc. I have yet to see a working config (both server and client) to try to undserstand why there are problems. Thanks to all Lance SFU(syslog fustrated user)

5 11

problem configuring syslog-ng with TLS
by Mohsen Alimomeni 21 Jul '09

21 Jul '09

Hi everyone, I want to configure syslog-ng with TLS, but there are problems in client connecting to server. This is the error in client side: { Jul 16 17:04:10 momeni syslog-ng[31084]: syslog-ng starting up; version='3.0.3' Jul 16 17:04:10 momeni syslog-ng[31084]: Syslog connection established; fd='7', server='AF_INET(192.168.13.39:1999)', local='AF_INET(0.0.0.0:0)' Jul 16 17:04:10 momeni syslog-ng[31084]: Certificate validation failed; subject='emailAddress=momeni(a)amnafzar.com, CN=momeni, ..to the end! ', error='invalid CA certificate', depth='1' Jul 16 17:04:10 momeni syslog-ng[31084]: SSL error while writing stream; tls_error='SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed' Jul 16 17:04:10 momeni syslog-ng[31084]: I/O error occurred while writing; fd='7', error='Broken pipe (32)' Jul 16 17:04:10 momeni syslog-ng[31084]: Syslog connection broken; fd='7', server='AF_INET(192.168.13.39:1999)', time_reopen='60' } To make sure my certificates are valid I run two commands: On server: openssl s_server -CApath CA/ -CAfile CA/cacert.pem -cert Client/clientcert.pem -key Client/clientkeye em -accept 8080 On client: openssl s_client -connect 192.168.13.39:8080 The result on the client is the server certificate and the last line is: { Verify return code: 19 (self signed certificate in certificate chain) } The client and server are both syslog-ng_3.0.2 (and 3.0.3) in ubuntu. These are the steps I configured the client and server: I used the script CA.sh to genereate X.509 certificates. I created a cacert using the command: CA.sh -newca created the ca files :cacert.pem, .. created a request: CA.sh -newreq rename the files created to syslog_cert.pem and syslog_ket.pem signed it with the ca: CA.sh -sign Then I copied the cacert.pem file to client and created it's hash as explained in syslog-ng documentation. configuration files: Client config: *destination d_tlsserver { tcp("192.168.13.39" port(1999) tls(ca_dir("/opt/syslog-ng/certs") peer_verify(required-trusted) )); };* Server config: *source rezvani_tls { tcp(ip(0.0.0.0) port(1999) max-connections(300) tls(key_file("/opt/certs/newcerts/syslogs_key.pem") cert_file("/opt/certs/newcerts/syslogs_cert.pem") peer_verify(optional-untrusted) )); }; * -- __ \ /_\\_-//_ Mohsen Alimomeni

4 5

build problem on FreeBSD 7.2
by ko 18 Jul '09

18 Jul '09

Hi all, I'm trying to build v3.0.3 from source (with sql support) on a fresh install of FreBSD 7.2, and I have the following error when I lauch the make : "afsql.c:36:21: error: dbi/dbi.h: No such file or directory" I think I miss a library, something nedded for database support but I don't know what ? Could anymone help me ? Thanks a lot. Karl.

3 2

syslog-ng premium "$HOST" issue
by Arya, Manish Kumar 17 Jul '09

17 Jul '09

Hi, I am using syslog-ng opensource version 1.6.5 on central syslog server. which is receiving logs from 4 collectors and some individual hosts. To evaluate syslog-ng premium I got 30 day license of "syslog-ng-premium-edition 3.0.2a" and installed it on a new box. and forward events coming on central syslog server to this new box using a file template template("'$HOST'|'$FACILITY'|'$PRIORITY'|'$PROGRAM'|'$MONTH $DAY$ $YEAR $HOUR:$MIN:$SEC'|'$MSGONLY'\n")); but here in $HOST I am getting name of central syslog server instead of actual host. While in ver 1.6.5 it appears correct using same template on events coming from 4 collectors. is there version incompatibility or some bug in ver 3.0.2a Regards, -Manish

2 3

syslog-ng OSE 3.1 changes pushed
by Balazs Scheidler 16 Jul '09

16 Jul '09

Hi, I'm posting here to let you know that I've pushed the following patches to the 3.1 repository: a4d7533d9c826dcf405d94aa6644587feacf9e96 [patterndb] fixed parser node first char match handling 9e7a729f6b450c7ef5bf0b22943771f040fd110e [patterndb] Consider the value of the parameter when checking if two parser nodes are equal 73fe61c0dccd0453cb18d41e3bdca54a2525fba1 [patterndb] use strcmp instead of prefix match when looking up parser name 8c9e4099477866829b9de8dbdbcca97806856f00 [patterndb] added FLOAT radix parser ae1b7fd8f386c141056247264ccd06da78614136 On error r_insert_node displays more information about the node that caused the problem in logpatterns.c for rules, the rule_id is di 6be05a55fcfd55b4efa106e5c507ad3fad9cbdbc [patterndb] adapted db_parser configuration loader to new syntax with rulesets b0869709f98566d39b5b3d8bd793cdf12ccc1996 [patterndb] db_parser NUMBER parser now handles hexadecimal numbers in 0xXXXXX form 60dc446418bcb9e41436d5ab287f66a604172a6f [unit tests] white space cleanup 32e346803c04c8454ae7f9313ebf5f9fdac83553 [patterndb] added IPv6 and IPvANY parsers to db_parser a2b156f67a4cb7c5ee9438864c6d93870e668ac1 fixed a memory leak around parser match storing, check for parser node name length 53c07dc8bba32dab918d6ab782e0e1dfc6b210ff fixed a memory leak in db-parser() dynamic value handling 1c31f647245df4e6f8773d49c04ca32deb9d9bfc added testcase for real log radix parsing This contains a couple of patterndb bugfixes, some new parsers and the support for the v2 patterndb format. This code currently only supports v2, I'm going to publish a script that converts v1 to v2 automatically. Otherwise this also means that from now it is possible to use the syslog-ng Store Box patterns compiled by BalaBit directly from syslog-ng OSE: http://www.balabit.com/downloads/files/patterndb/1.0-20081117/patterndb/ If anyone asks, I'm willing to create an "alpha" release from the current state of affairs. The alpha sign only means that we still haven't reached all goals for 3.1 (as per the syslog-ng roadmap published on the website). I don't expect to have stability problems with the above changes, those are mostly trivial and have associated automatic testcases. -- Bazsi

1 0

db-parser
by Jacopo Cappelli 16 Jul '09

16 Jul '09

I can't understand how work db-parser, i want to parse a string: m-56767-1333854 79.127.28.54 <mfdesigner(a)diggitgraphics.com> MessageScore is now 30, after adding 30 (Suspicious HELO - contains IP: '[79.127.28.54]') I wanto to have m-56767-1333854 on $ID_MESSAGE and 79.127.28.54 <mfdesigner(a)diggitgraphics.com> MessageScore is now 30, after adding 30 (Suspicious HELO - contains IP: '[79.127.28.54]') on $MSG i try with: <patterndb> <ruleset name='assp'> <pattern>assp</pattern> <rules> <rule provider='balabit' id='1' class='system'> <patterns> <pattern>@QSTRING:id_message: @ @QSTRING:msg@</pattern> </patterns> </rule> </rules> </ruleset> </patterndb> But i have the field on db empty. I read link about db-parser usage but i can't resolve... Thanks, Jacopo -- Linux, Windows Xp ed MS-DOS (anche conosciuti come il Bello, il Brutto ed il Cattivo). -- Matt Welsh

4 9

Syslog-ng with --enable-spoof-source, does it work for anyone?
by Scott Ware 16 Jul '09

16 Jul '09

I have been trying to figure out why I can't seem to get this option to work? Everything complies ok, but in the syslog-ng.conf file, when I have the spoof_source(yes) option, my syslog messages don't get forwarded on to my destination. But if I remove the spoof_source(yes) option, then they do. I just want to know if anyone has had this option work for them before. Thanks!

1 0

Another beginners problem
by Andy Kannberg 16 Jul '09

16 Jul '09

Hi folks, I'm new to syslog-ng. I'm trying to get it running on a bunch of Ubuntu 8.04 LTS and OEL 5.3 systems. For a start, I'm trying to get it working on 2 Ubuntu 8.04 LTS boxes. What I want is that all logging of all systems is sent to a central loghost. Systems do not need to keep a local logfile. So, I've shamelesly copied over a (as said working) config from another thread a few days ago on this list. The client part works, at least, the reload goed ok. However, on the server, the reload fails, giving no kind of warning or message whatsoever to hint where the problem lies. The configuration is as follows (With thanks to Siem Korteweg, from whom I copied the config over). Client & server: source s_internal { internal(); }; destination d_syslogng_log { file("/var/log/syslog-ng.log"); }; source s_local { unix-dgram("/dev/log"); file("/proc/kmsg" program_override("kernel:")); }; destination d_remote { tcp("10.0.13.152" port(514) ) ; }; destination d_local { file("/var/log/messages"); }; log { source( s_internal ); destination( d_remote ); }; log { source( s_internal ); destination( d_syslogng_log ); }; log { source( s_local ); destination( d_remote ); }; log { source( s_local ); destination( d_local ); }; On the central loghost, adittional lines are added: source s_network { tcp (ip("10.0.13.152") port(514)); }; destination d_network { file("/var/log/syslog-ng/hosts/$HOST_FROM/$R_YEAR/$R_MONTH/$R_YEAR-$R_MONTH-$R_DAY" create_dirs(yes)); }; log { source( s_network ); destination( d_network ); }; But, as said, a reload fails. Can someone help me out a little ? Oh, I am running syslog-ng 3.03, installed from the .deb package available on the website of Balabit. cheers and thanks in advance. Andy

4 5

[Fwd: Re: iptables logging in a separate logfile works not properly]
by Ralf Heidenreich 14 Jul '09

14 Jul '09

Hello, if I use the final flag, postfix loggs to /var/log/messages, not to /var/log/maillog. What I am doing wrong? regards ralf Here my config: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; destination iptables { file("/var/log/firewall.log"); }; filter iptables { match("INPUT:"); }; log { source(s_sys); filter(iptables); destination(iptables);flags(final); }; #log { source(s_sys); filter(iptables); destination(iptables); }; filter noiptables { not match("INPUT:"); }; log { source(s_sys); filter(noiptables); destination(d_kern); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/messages"); }; destination d_mlal { usertty("*"); }; # direct iptables logs into /var/log/firewall.log filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; #log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; Ralf Heidenreich schrieb: > Hello, > > can you give me an example, how to use the final flag? > thanks in advance. > > regards > Ralf > > Szalay Attila schrieb: >> Hi, >> >> On Fri, 2009-05-29 at 14:15 +0200, Ralf Heidenreich wrote: >>> Hello, >>> >>> I have the following line in iptables: >>> iptables -A INPUT -j LOG --log-prefix "INPUT: " >>> In syslog-ng (/etc/syslog-ng/syslog-ng.conf) I have the following config: >> [...] >>> filter iptables { match("INPUT:"); }; >>> log { source(s_sys); filter(iptables); destination(iptables); }; >> [...] >>> filter f_default { level(info..emerg) and >>> not (facility(mail) >>> or facility(authpriv) >>> or facility(cron)); }; >> [...] >>> log { source(s_sys); filter(f_default); destination(d_mesg); }; >> syslog-ng do not stop the evaluation when a destination is found. And >> because of this and because the second log statement is matching to the >> line the syslog-ng store it to the message too. >> >> If you want to order the syslog-ng to stop you can use the final >> directive. >> >> >> >> ------------------------------------------------------------------------ >> >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.campin.net/syslog-ng/faq.html >> > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

1 1

Missing hosts
by Christopher Bland 14 Jul '09

14 Jul '09

Hi guys, I have a problem that needs guru magic. When I first setup syslog-ng I had too many host/log entries for the system I was using to handle. I had tens of thousands of entries and each day created a 10G database table. I remedied this logging certain hosts to flat files and separating host and network equipment into different databases. I left my original catch all DB in place for comparison, to verify that all hosts were being logged properly. When I do queries I find that a number of hosts are in the catch all but not in the individual databases. Many of the missing hosts should be caught by the netmask entries but aren't. options { sync (0); time_reopen (10); log_fifo_size (10000); time_sleep(50); log_fetch_limit(100); chain_hostnames(no); long_hostnames (off); keep_hostname(no); use_dns (yes); dns_cache(yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; source s_everything { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(); }; destination d_database { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; destination d_networkdb { pipe("/tmp/mysql-network.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; destination d_hostsdb { pipe("/tmp/mysql-hosts.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; filter f_nofw { not host("fwhost"); }; filter f_hosts { netmask("10.16.5.0/255.255.255.0") or netmask("10.16.6.0/255.255.255.0") or host("hostA") or host("hostB") or host("hostC"); }; filter f_network { not host("fwhost") and ( host("host1") or host("host2") or host("host3") or netmask("10.16.57.0/255.255.255.0") or netmask("10.16.36.0/255.255.255.0") or netmask("10.16.120.0/255.255.255.0") or netmask("10.16.217.0/255.255.255.0") ); }; log { source(s_everything); filter(f_hosts); destination(d_hostsdb); }; log { source(s_everything); filter(f_network); destination(d_networkdb); }; log { source(s_everything); filter(f_nofw); destination(d_database); };

2 3

What is syslog-ng control socket?
by Subodh Nijsure 13 Jul '09

13 Jul '09

When I start syslog-ng I always get following error in the log. Jun 17 10:34:22 Node1 syslog-ng[836]: syslog-ng starting up; version='3.0.2' Jun 17 10:34:22 Node1 syslog-ng[836]: Error opening control socket, bind() faile d; socket='/home/subodh/install/syslog-ng/install//var/syslog-ng.ctl', error='N o such file or directory (2)' What is the control socket in syslog-ng? Should I be worried about this,what functionality do I loose 'cause syslog-ng is not able to create control socket? I am running version 3.0.2 on PowerPC 85xxx platform. Below is the output of syslog-ng -v syslog-ng 3.0.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#e1c8e7f086f5c5b73727cfef6d351614d87574ed Compile-Date: Jun 16 2009 16:54:10 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: off Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on /Subodh Nijsure

3 2

SEC and syslog-ng - stop the SEC process
by Clayton Dukes 12 Jul '09

12 Jul '09

Hi, Not sure if I should ask this here or in the SEC forum... Does anyone know how to stop an sec process that's called from syslog-ng? i.e: when I issue an /etc/init.d/syslog-ng stop I still have the following running: root 28202 1 1 12:34 pts/1 00:00:00 /usr/bin/perl -w ... root 28207 28202 0 12:34 pts/1 00:00:00 sh -c /usr/bin/tail -F /tmp/sec.log ... root 28208 28207 0 12:34 pts/1 00:00:00 /usr/bin/tail -F /tmp/sec.log root 28209 28202 0 12:34 pts/1 00:00:00 sh -c /usr/bin/tail -F /tmp/sec_reactive.log... root 28210 28209 0 12:34 pts/1 00:00:00 /usr/bin/tail -F... Here's my syslog-ng config: destination d_sec { program("/www/svn/php-syslog-ng/scripts/sec/sec.pl -input=\"-\" -conf=/www/svn/php-syslog-ng/scripts/sec/001_proactive.conf -conf=/www/svn/php-syslog-ng/scripts/sec/002_reactive.conf -log=/var/log/php-syslog-ng/sec_run.log -intevents" template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n") ); }; # Tell syslog-ng to log to our new destination log { source(s_all); destination(d_sec); }; -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

2 3

Perl: Sys::Syslog - replace hostname (host rewrite rule?)
by Clayton Dukes 12 Jul '09

12 Jul '09

Hi folks, I'm trying to write a syslog "replay" script (in perl) and was wondering if there's a way to replace the source hostname so that it logs that host to syslog instead of my local machine's hostname. For example, the logit sub below logs (to /var/log/syslog): Jul 12 12:53:53 cdukes-lnx ./logreplay.pl[29476]: %CSM_SLB-6-RSERVERSTATE: Module 9 server state changed: SLB-NETMGT: TCP health probe re-activated server 10.13.164.13:0 in serverfarm 'ACC-FNET-AE' The original message is: Jun 19 05:11:57 ecdcsrvr2-6.some.domain 5476: Jun 19 05:11:56: %CSM_SLB-6-RSERVERSTATE: Module 9 server state changed: SLB-NETMGT: TCP health probe re-activated server 10.13.164.13:0 in serverfarm 'ACC-FNET-AE' So I want it to log the originating host as "ecdcsrvr2-6.some.domain" Additionally, if possible, I'd like to be able to log the original datetime field (but not as important as the hostname). Does anyone know if I could maybe accomplish this through a syslog-ng rule? sub logit { my ($priority, $message) = @_; setlogsock('unix'); # $prog is assumed to be a global. Also log the PID # and to Console if there's a problem. Use facility 'local7' since these are (presumably) Cisco messages. openlog($0, 'pid,cons', 'local7'); syslog($priority, $message); closelog(); return 1; } -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

1 0

syslog-ng-3.0.3 for x86_64?
by John Patrick Carroll 11 Jul '09

11 Jul '09

My question involves the availability of a x86_64 version of syslog-ng 3.0.3 for Red Hat/CentOS. According to the info on the first link below, it is available, but at the actual download site at the second link below, only a version for amd64 is available. Any ideas where I can get a version for Intel (x86_64)? I have had issues in the past with running amd64 binaries on an Intel 64-bit system, so I am reluctant to try to install the amd64 version on an Intel 64-bit system. Is the x86 version there 64 bit capable, i.e. does it use the 64-bit libraries by default, and fall back to 32-bit libraries only if 64-bit libraries are not available? http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… thanks, John John Patrick Carroll | Senior Systems Administrator GovDelivery, Inc. 408 St. Peter St, Ste 600 | St Paul, MN 55102-1147 651.757.4124 or 866.276.5583 ext. 124 Resources Website: www.govdelivery.com<http://www.govdelivery.com> Blog: www.reachthepublic.com<http://www.reachthepublic.com> Twitter: www.twitter.com/govdelivery<http://www.twitter.com/govdelivery>

2 1

Syslog-ng beginners guide
by Cosmin Neagu 10 Jul '09

10 Jul '09

Hello everybody, Sorry for bothering you with a beginners question. I have a cacti implementation in my network and a want to integrate it with syslog-ng. I have mostly cisco routers, all configured to sent syslog messages to two linux boxes (Ubuntu 9.04 and FedoraCore 10) where i have installed syslog-ng. I'm not able to find where the logs are kept, so this drives me crazy. Do you know any site or resource where i can find some beginners guide about using syslog-ng with cisco routers? I mean, a guide for someone who never used syslog-ng before. Thanks. -- Cosmin Neagu NOC Team Leader Str. I. G. Duca nr 36 Otopeni, Judetul Ilfov, 075100 Romania Tel: 021 303 3159 / 0732 669 193 www.omnilogic.ro

8 20

can't include externel file into syslog-ng.conf
by gatfi sami 08 Jul '09

08 Jul '09

Hi i am using syslog-ng 2.0.9-27.22 when i try to include an externel file into /etc/syslog-ng/syslog-conf options { long_hostnames(off); sync(0); perm(0640); stats(3600); #check_hostname(no); keep_hostname(yes); chain_hostnames(no); }; # # 'src' is our main source definition. you can add # more sources driver definitions to it, or define # your own sources, i.e.: # #source my_src { .... }; # source src { # # include internal syslog-ng messages # note: the internal() soure is required! # internal(); # # the default log socket for local logging: # unix-dgram("/dev/log"); }; *include "/opt/topnet/etc/client.conf";* ligne 52 But unfortunatly i have an error tarting syslog servicessyntax error at 52 > startproc: exit status of parent of /sbin/syslog-ng: 1 So how can i include an externel file into syslog-ng.conf ? need help around here gys i cant avoid including the file thks

2 1

about mysql log
by Jacopo Cappelli 08 Jul '09

08 Jul '09

Hi, it's possible to personalize mysql logging? actually i have $HOST,$FACILITY,$PRIORITY,$LEVEL,$TAG,$YEAR-$MONT-$DAY, $HOUR:$MIN:$SEC; $PROGRAM,$MSG i want to decompose $MGS in sub-level field because in $MSG i have a email-id and i use it to make web research. Thanks, Jacopo -- Linux, Windows Xp ed MS-DOS (anche conosciuti come il Bello, il Brutto ed il Cattivo). -- Matt Welsh

2 5

Forwarded messages modified by syslog-ng
by srainville＠videotron.ca 08 Jul '09

08 Jul '09

2 1

Must Restart syslog-ng to send email
by Reaky Rok 07 Jul '09

07 Jul '09

Dear friends I have a small problem with my syslog-ng server, I use a configuration to filter mail from log file and forwerd it to perl script to send it, the configuration like the following: ===================================================== source sme {file (/var/log/syslog-ng/servers/172.31.250.68/local7.log); }; destination maillog { program ("/usr/local/bin/syslog-mail-perl" ); }; log {source(sme); destination(maillog); }; ===================================================== And the perl script like the following: +++++++++++++++++++++++++++++++++++= #!/usr/bin/perl -n # thanks to Brian Dowling for an example with security in mind. $TO = 'reaky(a)domain.com'; $FROM = $TO; s/^//; open(MAIL, "|/usr/sbin/sendmail -t"); print MAIL "EOT"; To: $TO From: $FROM Subject: SME Log Alert: $_ $_ EOT close(MAIL); +++++++++++++++++++++++++++++++++++++++ It worked very fine when I send to root user in the machine, But when I tried to send to outside I found that I must restart syslog every time to send the mails to sendmail, In another word it buffer the emails tell I restart syslog-ng then It forwerd it to send mail and can see it in the mail log. Do you have any idea for that ? Thanks _________________________________________________________________ Windows Live™: Keep your life in sync. Check it out! http://windowslive.com/explore?ocid=TXT_TAGLM_WL_t1_allup_explore_012009

2 3

Send a specific log by email
by Reaky Rok 06 Jul '09

06 Jul '09

Hi friends I have syslog-ng installed in RHEL5 server, I make it as CEntral log for all servers in my network, Filtered by IP Now What I want to do is make it send to me an email for a specific log for one of my server, In other word when any log sent from this IP (192.168.1.1 ) For example to send me email with this new log value to myemail(a)mydomain.com The following is the part of configuration for my syslog-ng.conf that related with remote servers. ============================================= source s_remote { tcp(ip(0.0.0.0) port(514)); udp(ip(0.0.0.0) port(514)); }; destination d_separatedbyhosts { file("/var/log/syslog-ng/servers/$HOST/$FACILITY.log" owner("root") group("root") perm(0640) dir_perm(0750) create_dirs(yes)); }; log { source(s_remote); destination(d_separatedbyhosts); }; =============================================== Thanks Best Regards Reaky _________________________________________________________________ Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy! http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx…

4 15

Question about reopening sockets
by Zoltan HERPAI 06 Jul '09

06 Jul '09

Hi all, I'm writing a small script that would be fed with data via pipe by syslog-ng 2.0.9. The script itself is responsible for creating the socket into which syslog-ng would be writing to. I'm looking for an option within syslog-ng that would allow for reopening the socket in case the script dies, quits, or it gets removed for some reason (like an epic admin fail). I did some testing, and as per that, checking with lsof, syslog-ng opens the socket only on the first time it would be writing to that destination, which is good. After the socket gets removed, it shows up as... syslog-ng 31666 root 17u FIFO 253,2 24624 /tmp/pw.sock (deleted) ... in lsof, and the deleted flag does not go away after the socket gets recreated (f.e. the script is restarted), and a test message is sent into the given destination. Is there a config option available for reopening sockets? Thanks, Zoltan HERPAI

3 4

Unable to set PRIORITY and LEVEL in rewrite
by Siem Korteweg 06 Jul '09

06 Jul '09

Hi, with the central logging of syslog in place, I moved on to the file /var/log/httpd/ssl_error_log to explore the syslog-ng (3.0.2-1 OSE on CentOS 5.3) capabilities with logfiles from other applications. The contents of this file are rather straightforward: [Wed Jun 24 12:14:49 2009] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Wed Jun 24 12:14:49 2009] [error] [client 192.168.3.178] PHP Notice: Undefined offset: 2 I want to skip the date/time (assuming there is no delay before syslog-ng processes the data) and to set the PRIORITY and LEVEL attributes to "warning" and "err". The following config file (included in the main config) should do the job. source s_http_ssl_error { file ( "/var/log/httpd/ssl_error_log" flags(no-parse) follow_freq(1) ); }; # Split the message. parser p_http_ssl_error { csv-parser( columns( "HTTP.TIMESTAMP", "HTTP.SEVERITY", "HTTP.MSG" # Match the remainder of the message (greedy). ) delimiters( " " ) flags( greedy, escape-double-char, strip-whitespace ) quote-pairs( '""[]' ) ); }; filter f_http_ssl_error_warn{ match( "warn" value( "HTTP.SEVERITY" ) ); }; rewrite r_http_ssl_error_warn{ set( "warning" value( "LEVEL" ) ); set( "warning" value( "PRIORITY" ) ); }; filter f_http_ssl_error_error{ match( "error" value( "HTTP.SEVERITY" ) ); }; rewrite r_http_ssl_error_error{ set( "err" value( "LEVEL" ) ); set( "err" value( "PRIORITY" ) ); }; # Eliminate the severity as soon as PRIORITY and LEVEL are set! # Set the attribute program to "http_ssl_error". template t_http_ssl_error{ template( "http_ssl_error ${HTTP.SEVERITY} ${HTTP.MSG}\n" ); }; # Send the message to the regular syslog in order to transfer it to the syslog-ng collector. destination d_http_ssl_error{ unix-dgram( "/dev/log" template( t_http_ssl_error ) ); }; # Handle the warnings. log { source( s_http_ssl_error ); parser( p_http_ssl_error ); filter( f_http_ssl_error_warn ); rewrite( r_http_ssl_error_warn ); destination( d_http_ssl_error ); flags( final ); }; # Handle the errors. log { source( s_http_ssl_error ); parser( p_http_ssl_error ); filter( f_http_ssl_error_error ); rewrite( r_http_ssl_error_error ); destination( d_http_ssl_error ); flags( final ); }; # Handle the other messages. log { source( s_http_ssl_error ); parser( p_http_ssl_error ); destination( d_http_ssl_error ); }; Inserting [warn], [error] and [other] lines in the logfile, results in the proper number of syslog-ng messages with the desired MSG-contents. However, the priority and level attributes are unchanged ("notice"). What is wrong? kind regards, Siem Korteweg

2 5

Syslog-ng on Ubuntu and OEL
by Andy Kannberg 06 Jul '09

06 Jul '09

Hi, In our environment we are thinking of using syslog-ng for logging purposes. We use Ubuntu 8.04 and OEL 5.3 Ubuntu 8.04 has a version of syslog-ng in it's repository. However, that is version 2.09, which I cannot find on the site of Balabit, only version 2.010 OEL has no syslog-ng in it's default repo's. I would like to use one version, to prevent compatibility-issues and to keep the environment as clean as possible. I saw that there are binary packages available for Debian and RedHat. However, as said, I would like to keep the environment as clean as possible. So if possible, no individual package installed outside of the package manager. Does anyone know if there are repositories available where I can get a recent version of syslog-ng for Ubuntu as well as OEL ?? cheers, Andy

3 3