- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Reload does not free up RAM
by Evan Rempel 05 Oct '08

05 Oct '08

Balazs Scheidler wrote: > On Thu, 2008-10-02 at 08:43 -0700, Evan Rempel wrote: >> Balazs Scheidler wrote: >>> On Wed, 2008-10-01 at 09:54 -0700, Evan Rempel wrote: >>>> We have cases where a syslog-ng buffers quite a bit of data (2GB or so) before >>>> it is able to flush the data to the destination. Currently, the only way to "free up" that RAM >>>> is to restart syslog-ng, which means that some log messages are lost during the restart >>>> window. >>>> >>>> I open for discussion the idea that on a reload that syslog-ng flush and free all buffer >>>> space and essentially start from a "just started" state again. >>> Well, this is currently a PE feature, and BalaBit decided not to open >>> source it this time with 3.0 as that's one of the primary incentives to >>> buy the commercial version. >>> >>> PE with its persistent disk buffers is saving queue contents upon >>> restart right into the disk buffer file. And also, syslog-ng does not >>> buffer so much data in memory as it first uses the disk. >> The disk buffering offers a lot more than this. >> >> Persistent buffers around a syslog restart >> Persistent buffers around a system restart (think power outage) >> Much larger buffering (potentially hundreds of GBytes) with minimal >> system impact. >> >> I would hope that PE version would shrink its disk buffers once they >> are flushed, just like I am hoping that OSE would shrink its RAM buffers >> once they are flushed. >> >> I don't think that RAM usage AFTER buffers are flushed is much of an >> incentive to purchase the PE. The persistence and size of the buffers >> is the incentive. >> > > E.g. you want to throw away the buffer contents but without restarts? > that should be doable. Just to verify the points. 1. I don't want to drop/loose messages with this change. 2. The buffer space should be thrown away only after the message has been delivered to the destination. 3. This should be done at least on a reload as a minimum. Since all of the sources are closed during a reload, I thought that the buffers could be flushed and all buffer space thrown away at that time. This is really an implementation decision that is really your choice, and does not matter to me. 4. Freeing and allocating memory is an expensive operation, so I don't want it done for each message, but doing it without the need for a reload would be ideal. Algorithms that allocate memory in blocks, and free one block when two are unused always keeps 1 block available for use and you don't get into a busy allocate/drop that repeats because one message comes and goes. Thanks for entertaining this discussion. Evan.

2 1

Re: [syslog-ng] escaping \[ not respected
by Evan Rempel 05 Oct '08

05 Oct '08

Balazs Scheidler wrote: > On Thu, 2008-10-02 at 09:12 +1300, chris packham wrote: >> One option would be to use the kind quotes ' vs " to determine whether to >> escape or not. I believe bash (and maybe perl) does this kind of thing when >> handling strings. > > Yeah, the problem is with compatibility, ' and " style quoting has been > working this way for about a decade, changing that would break a lot of > configurations. > > I should have made this decision back then, but changing this now is not > really possible I think. Perhaps adding a new config keyword match_pcre(/no syslog-ng escape codes, all escapes are handled by the pcre evaluation/) The down side to this is that you really need to have program_pcre and any other additions along those lines. Things get a little messy. Hopefully in a later version the normal match, program directives could be made to work this way, and the match_pcre etc would become backwards compatible aliases to the non_pcre commands. I don't really like that solution, but I thought I would "throw it out there". Another option is to an something like is already present for the templates where there is a template_escape(no) option. If you add a regex_escape(yes/no) directive and default to yes, then all of the current expressions would work. If you do not need to have quotes in your expression, then you can use regex_escape(no) and do away with the escapes for the escapes. Just a couple of thoughts. -- Evan Rempel

3 2

Re: [syslog-ng] Reload does not free up RAM
by Evan Rempel 04 Oct '08

04 Oct '08

Balazs Scheidler wrote: > On Wed, 2008-10-01 at 09:54 -0700, Evan Rempel wrote: >> We have cases where a syslog-ng buffers quite a bit of data (2GB or so) before >> it is able to flush the data to the destination. Currently, the only way to "free up" that RAM >> is to restart syslog-ng, which means that some log messages are lost during the restart >> window. >> >> I open for discussion the idea that on a reload that syslog-ng flush and free all buffer >> space and essentially start from a "just started" state again. > > Well, this is currently a PE feature, and BalaBit decided not to open > source it this time with 3.0 as that's one of the primary incentives to > buy the commercial version. > > PE with its persistent disk buffers is saving queue contents upon > restart right into the disk buffer file. And also, syslog-ng does not > buffer so much data in memory as it first uses the disk. The disk buffering offers a lot more than this. Persistent buffers around a syslog restart Persistent buffers around a system restart (think power outage) Much larger buffering (potentially hundreds of GBytes) with minimal system impact. I would hope that PE version would shrink its disk buffers once they are flushed, just like I am hoping that OSE would shrink its RAM buffers once they are flushed. I don't think that RAM usage AFTER buffers are flushed is much of an incentive to purchase the PE. The persistence and size of the buffers is the incentive. Thanks for the background. -- Evan Rempel

2 1

Re: [syslog-ng] Message suppression not working
by Balazs Scheidler 02 Oct '08

02 Oct '08

On Thu, 2008-10-02 at 10:57 -0400, Kevin Cruse wrote: > That's what I thought. I downloaded 2.1.1 for evaluation but cannot > figure out how to load the license.txt file. hmm, the open source version does not need a license file. only the premium edition does. to evaluate the latter, ask for an eval license on mybalabit. > > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: Thursday, October 02, 2008 10:45 AM > To: Kevin Cruse > Cc: Syslog-ng users' and developers' mailing list > Subject: RE: Message suppression not working > > On Thu, 2008-10-02 at 10:11 -0400, Kevin Cruse wrote: > > Bazsi, > > > > Thanks for the quick response, I should have been more clear. When I > > use the suppress() option I get a syntax error when running the > > syslog-ng binary. My apologies. > > > > it is only supported by syslog-ng 2.1.1 and later. > -- Bazsi

1 0

Re: [syslog-ng] Message suppression not working
by Balazs Scheidler 02 Oct '08

02 Oct '08

On Thu, 2008-10-02 at 10:11 -0400, Kevin Cruse wrote: > Bazsi, > > Thanks for the quick response, I should have been more clear. When I > use the suppress() option I get a syntax error when running the > syslog-ng binary. My apologies. > it is only supported by syslog-ng 2.1.1 and later. -- Bazsi

1 0

Re: [syslog-ng] Message suppression not working
by Balazs Scheidler 02 Oct '08

02 Oct '08

On Thu, 2008-10-02 at 08:39 -0400, Kevin Cruse wrote: > Bazsi, > > I am trying to suppress messages sent to the database and sendmail. I > have configured suppress(900) globally and within my destinations and it > doesn't seem to work. Does anyone have this working? I am getting > flooded with emails when there are problems on my firewalls or routers. > > destination d_mysql { > pipe("/var/log/mysql.pipe" > template("INSERT INTO logs > (host, facility, priority, level, tag, datetime, program, msg) > VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', > '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', > '$PROGRAM', '$MSG' );\n") template-escape(yes) suppress(900)); > }; > > Or > > destination mail-alert-perl { program("/usr/local/bin/mail_logger.pl" > suppress(900)); }; > > also tried > > destination mail-alert-perl { program("/usr/local/bin/mail_logger.pl") > suppress(900); }; > > Any help would be appreciated. Thanks. suppress() only filters duplicates, and is not a general ratelimit. -- Bazsi

1 0

syslog-ng craches when sending from syslog-ng to another loghost (that have syslog-ng)
by Mattias Ryrlén 02 Oct '08

02 Oct '08

Hi, Im running syslog-ng-2.1beta2-1 on 2 of my servers. i have the same configuration on both the servers except that i want server A to forward messages to server B All works fine for a couple of minutes, then server A:s syslog-ng service craches without any information. running CentOS 5.0 on both servers with syslog-ng installed as rpm packages from balabit. i have also tried with udp() instead of tcp() with the same result. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); dns_cache(yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); log_msg_size(8192); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; source s_udp { udp(); }; source s_tcp { tcp(max-connections(200)); }; destination d_loghost { tcp("192.168.1.150" port(514)); }; log { source(s_sys); source(s_tcp); source(s_udp); destination(d_loghost); }; Any sugestions? -- Vänliga hälsningar / Best Regards Mattias Ryrlén __________________________ op5 AB Första Långgatan 19 SE-413 27 Göteborg Mobil: +46 735-17 70 99 Support: +46 31-774 09 24 www.op5.com

2 2

syslog-ng OSE git tree opened
by Balazs Scheidler 02 Oct '08

02 Oct '08

Dear syslog-ng users, I'm proud to announce that I've opened the syslog-ng OSE 3.0 branch and pushed a backport of the result of the latest Premium Edition development cycle. The size of the patch is enourmous, it took me a while to integrate it back to OSE 3.0, that's why this announcement is coming so late. The diffstat is as follows: 175 files changed, 21537 insertions(+), 7377 deletions(-) The list of changes of interest are: * various performance improvements, syslog-ng can do about 120-130k messages/sec in case no destination is written to (not very useful though), and about 75k msg/sec when writing to a plain text file * TLS encrypted channels, works the same as the PE version, documentation is: http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/ch03s09.html * support for the new IETF syslog protocols, in order to use this, you need to use the syslog() driver either as a source or a destination. It behaves quiet closely to tcp/udp, except it uses the new protocol * log message classification using a database, scales up to tens of thousands of messages per second, the pattern database also serves as a means to parse variable parts of messages. No real documentation so far, there's an XML Schema file in the tarball, it can be used using the db_parser() parser. * rewrite parts of the message using regexps, and simple string search and replace. Here's a post on the syslog-ng mailing list that has some info on usage: http://marc.info/?l=syslog-ng&m=122051372205555&w=2 * parse parts of the syslog message, makes it possible to parse fields in an Apache log for instance. Also the parsed values can be used as macros. Again, the post above has some info: http://marc.info/?l=syslog-ng&m=122051372205555&w=2 * generalize the log message paths, instead of a flat list of source->destination connections, log statements can be organized into a tree, making the configuration simpler and the performance better, here is a description: http://bazsi.blogs.balabit.com/2008/02/redesigning-syslog-ng-internals.html * PCRE and glob filters (in addition to POSIX regexps), use the type("pcre") option in the filter, like this: host("something" type("pcre")) * support for capabilities under Linux, this running syslog-ng as non-root is possible, also with reload support, see the documentation of Linux capabilities in capabilities(7), for the syntax of the --caps option, see cap_from_text(3) * program sources, simply use program("cat /dev/xconsole") in your configuration, the program will be restarted automatically if that exits. * syslog-ng got the ability to restart itself if it crashes, see the --process-mode command line option * new statistics framework that can be queried using UNIX domain sockets, provides per-source-host and per-destination-host statistics. In order to use it, possibly set the stats_level() option and write "STATS\n" to /var/run/syslog-ng.ctl which is a UNIX domain socket. This mass amount of changes also mean some incompatibilities between 2.1 and 3.0, however 3.0 will work in compatibility mode unless it is told to use the 3.0 configuration file format. It'll also report warnings against your configuration file you should change in order to use all the features and best performance. The most important incompatibilities include: * the $MSG macro will not include the "program[pid]:" string anymore, you should prepent an $MSGHDR macro in order to have that, in 2.1 mode the MSG will expand as before, but please note that this value is calculated everytime you reference the macro, thus it affects performance. * some defaults were changed (chain_hostname, template-escape, follow-freq for file sources), in 2.1 mode the old defaults are used but a warning is emitted * the input path does not remove NL characters anymore by default, but you can ask for this behaviour by specifying the "no-multi-line" flag. The documentation for the new features is not yet completely finished, I hope to get a snapshot of the current state to the website soon. In the meanwhile either use the source :) or ask direct questions on the mailing list. I'll also try to make some posts on my blog about various features in more detail and configuration examples. -- Bazsi

1 0

Re: [syslog-ng] Log to postgres
by ml＠bortal.de 02 Oct '08

02 Oct '08

Hello, I just tried to get syslog-ng 2.1.1 working by doing: #/usr/local/src/libdbi8-0.8.2bb2# make install --> Libraries have been installed in: /usr/local/lib #/usr/local/src/libdbi8-drivers-0.8.2bb3# ./configure --with-pgsql --with-dbi-libdir=/usr/local/lib --disable-docs --> configure: error: Invalid libdbi directory - include files not found. What am i doing wrong? Thanks, Mario

2 1

Log to postgres
by ml＠bortal.de 02 Oct '08

02 Oct '08

Hello List, is there a open-source way to log to a postgres database nativly? We have problems using a pipe. Is is beeing described on page 107 of the syslog-ng Admin Guid but i am not sure if this is only available for the commercial version. Thanks, Mario

2 1

Reload does not free up RAM
by Evan Rempel 02 Oct '08

02 Oct '08

We have cases where a syslog-ng buffers quite a bit of data (2GB or so) before it is able to flush the data to the destination. Currently, the only way to "free up" that RAM is to restart syslog-ng, which means that some log messages are lost during the restart window. I open for discussion the idea that on a reload that syslog-ng flush and free all buffer space and essentially start from a "just started" state again. Comments?

2 1

Re: [syslog-ng] escaping \[ not respected
by Len Conrad 02 Oct '08

02 Oct '08

>Hello, > >> targeted string is "unknown[a.b.c.d]" >> >> my filter: >> >> filter f_conn_from_unk_private { not match >> ("unknown\[(10\.1\.|10\.2\.|10\.10\.5\.|192\.168\.200)"); }; >> >> error: >> >> Error compiling regular expression; >> re='[(10.1.|10.2.|10.10.5.|192.168.200)', error='brackets ([ >]) not balanced' > >I can't confirm this behaviour, as the following does work for me: > >filter f_internal_statistics { > match("^syslog-ng\[[[:digit:]]+.: STATS") or match ("^syslog-ng\[[[:digit:]]+\]: Log statistics"); >}; > >What syslog-ng version are you using? Mine is 2.0.9 Installed with FreeBSD pkg_add from freshports.org, pkg_info shows: "syslog-ng2-2.0.9_1 A powerful syslogd replacement" I conclude that I've found a bug in the parsing of the escape sequence "\[" , and will look for a work around. thanks, Len ______________________________________________ IMGate OpenSource Mail Firewall www.IMGate.net

5 5

$MSGONLY bad output
by Steven 01 Oct '08

01 Oct '08

Hi there, As I can't find this on the web, I'm asking here : I'm receiving the IIS servers logs through my LAN and syslog-ng writes everything to a local files, that is parsed during the night by awstats. The only thing is I can't have syslog-ng to write raw logs to files, it absolutely has to write something (either with $MSG or $MESSAGE). I even tried with $MSGONLY but now I get the opposite problem, it truncates data ! $MSG : IISWebLog 0 2008-09-30 14:02:40 GET /Localized/fr/Images/New2/tlogo.gif - 95.35.41.243 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.0;+SLCC1;+.NET+CLR+2.0.50727 ;+Media+Center+PC+5.0;+.NET+CLR+3.0.04506;+InfoPath.2) http://mypublicwebsite/home/regf 200 2185 With $MSGONLY, I'll get : 02:40 GET /Localized/fr/Images/New2/tlogo.gif - 95.35.41.243 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.0;+SLCC1;+.NET+CLR+2.0.50727 ;+Media+Center+PC+5.0;+.NET+CLR+3.0.04506;+InfoPath.2) http://mypublicwebsite/home/regf 200 2185 Here is my very simple template : template t_IIS { template("$MESSAGE\n"); template_escape(no); }; Destination and filter : destination df_ mypublicwebsite _IISWebLog { file("/data/syslog/mypublicwebsite/IISWebLog" template(t_IIS)); }; filter f_ mypublicwebsite _IISWebLog {(host("^192\.168\.117\.131$") or host("^192\.168\.117\.132$") or host("^192\.168\.117\.133$") or host("^192\.168\.117\.134$") or host("^192\.168\.117\.135$") ) and facility(local4) and program("IISWebLog"); }; log { source(s_net); filter(f_ mypublicwebsite _IISWebLog); destination(df_ mypublicwebsite _IISWebLog); }; # uname -a Linux TR-ADM 2.6.18-4-amd64 #1 SMP Fri May 4 00:37:33 UTC 2007 x86_64 GNU/Linux Anything I'm missing ? Any help would be greatly appreciated. Best regards Steven

3 4

separe files question
by Mártha Csaba 01 Oct '08

01 Oct '08

Hello I have a question, i get logfiles from facility0, with these matter: AppID(0-9a-Z)-ThreadID(0-9a-Z)-DATE-TIME-MESSAGE i created a filter, with this content: filter f_flash_msg { match ("[0-9a-zA-Z]+-[0-9a-zA-Z]-*"); }; and destination destination df_out { file("/var/log/client/flashlog/$1/$2/$YEAR/$MONTH/ $DAY/$TIME.txt"); }; i need separate folders/files. the log line contains these datas: 1234-ABCD-2008-09-30-16-20-35-FatalError AppID-Thread-Date-Time-MSG i need this structure: /var/log/syslog-ng/flashlogs/1234/ABCD/2008/09/30/16.txt what is my mistake? Best Regards Csaba

2 2

escaping \[ not respected
by Len Conrad 01 Oct '08

01 Oct '08

targeted string is "unknown[a.b.c.d]" my filter: filter f_conn_from_unk_private { not match ("unknown\[(10\.1\.|10\.2\.|10\.10\.5\.|192\.168\.200)"); }; error: Error compiling regular expression; re='[(10.1.|10.2.|10.10.5.|192.168.200)', error='brackets ([ ]) not balanced' Len ______________________________________________ IMGate OpenSource Mail Firewall www.IMGate.net

2 1

Trouble with logging to mysql
by Stallmann, Andreas 30 Sep '08

30 Sep '08

Hi there, I'm trying to let syslog-ng log to a mysql database, which is somehow not working (anymore). All my network traffic is supposed to be written into a separate logfile as well as into a mysql database. I followed the HowTo on http://gentoo-wiki.com/HOWTO_setup_PHP-Syslog-NG#Syslog-ng_INIT_Script, and altered the configuration to fit my needs. Here it comes: ############################################ source net { udp(ip("0.0.0.0") port(514)); }; destination d_mysql { program("/usr/bin/mysql --reconnect -f -T --user=syslogfeeder --password=PASSWORD syslog >> /var/log/db_log.log 2>&1" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n") template-escape(yes)); }; destination netmessages { file("/var/log/net.log"); }; log { source(net); destination(netmessages); }; log { source(net); destination(d_mysql); }; ############################################## Thing is, logging to the file works nicely. Logging to the database worked up to some date, but since a while (and no one knows exactly since when, because nobody had a look at the database for some time) it doesn't. This might be connected with a system update. I can provide you with information on the versions (the OS is SLES 10.0, all packages come from the standard source; no self-compiled packages installed) of syslog and mysql as soon as I have access to the customers machine again. I'm looking for a sensible way to debug syslog. Running syslog-ng in the foreground didn't help, I can't see any messages related to logging to mysql. It seems that the destination is never touched. Isn't it possible to log on source to two destinations (anymore)? (I think commented out logging to netmessages, but it still didn't work.) Any comments and hints will be helpful. Even RTFM if you point me to a comprehendible one. :-) TNX, Andreas -- CONET Solutions GmbH Andreas Stallmann, Senior Berater Theodor-Heuss-Allee 19, 53773 Hennef Tel.: +49 2242-939-677, Fax: +49 2242-939-393 Internet: http://www.conet.de, mailto: astallmann(a)conet.de ----------------------------------- CONET Solutions GmbH, Theodor-Heuss-Allee 19, 53773 Hennef Registergericht/Registration Court: Amtsgericht Siegburg (HRB Nr. 9136) Geschaftsfuhrer/Managing Directors: Dipl.-Inform. Rudiger Zeyen (Sprecher/Chairman), Dipl.-Betriebsw. Wilfried Putz und Dipl.-Inform. Jurgen Zender Vorsitzender des Aufsichtsrates/Chairman of the Supervisory Board: Dipl.-Math. Hans-Jurgen Niemeier

4 9

problems doing host based logging with local facility
by Daniel I. Didier 30 Sep '08

30 Sep '08

Hello, I've been working on setting up a syslog to do some event per second calculations. I'm trying to log all information from a host such as AIX or Linux to a single file. I can do this with the 'host' option but I am having problems combining this with the local facility option. I've been working with various iterations but here are the major components: options { sync(0); time_reopen(10); log_fifo_size(1000); long_hostnames(off); use_dns(no); use_fqdn(no); create_dirs(yes); keep_hostname(yes); owner(root); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; source s_net { udp(); }; And here is an example of the log definitions: destination sw-089 { file("/var/log/sw-089.log"); }; destination adm1r2 { file("/var/log/adm1r2.log"); }; filter f_adm1r2 { host("172.16.148.60"); }; filter f_sw-089 { facility(local4); }; log { source(s_sys); filter(f_sw-089); destination(sw-089); }; log { source(s_net); filter(f_adm1r2); destination (adm1r2); }; The facility locals seem to be working at all times, but the host does not... any ideas or suggestions? Thanks, Dan

1 0

Syslog-ng - UDP templates
by Thibaud Desodt 26 Sep '08

26 Sep '08

Hi, I am trying to configure syslog-ng (running on OpenSUSE 11.0) to forward a message to another server through UDP. I would like to modify the message's format, therefore I tried to use "template()" without success. (parsing error while restarting the syslog) The version installed with this distribution is 1.6.12, and from what I understood, the feature is available in later versions (1.6rc3 ?) . Is it available in the OpenSource Edition or only in the Premium Edition ? and where can I find it ? Thanks in advance Thibaud

5 6

Problems compiling syslog-ng 2.0.6 on Solaris 10
by Don Neufeld 26 Sep '08

26 Sep '08

Hi, I'm getting the following error while making syslog: [fhkfauaa@fhkfauaa ~/syslog-ng-2.0.6]$ make gmake all-recursive gmake[1]: Entering directory `/home/fhkfauaa/syslog-ng-2.0.6' Making all in src gmake[2]: Entering directory `/home/fhkfauaa/syslog-ng-2.0.6/src' gcc -g -O2 -Wall -o syslog-ng main.o libsyslog-ng.a -lpthread -lresolv -lnsl -lrt -lsocket -ldoor -Wl,-Bstatic -ll -Wl,-R/opt/local/lib -L/opt/local/lib -lglib-2.0 -lintl -liconv -L/usr/local/lib -levtlog -lwrap -Wl,-Bdynamic ld: fatal: library -ll: not found ld: fatal: File processing errors. No output written to syslog-ng collect2: ld returned 1 exit status gmake[2]: *** [syslog-ng] Error 1 gmake[2]: Leaving directory `/home/fhkfauaa/syslog-ng-2.0.6/src' gmake[1]: *** [all-recursive] Error 1 gmake[1]: Leaving directory `/home/fhkfauaa/syslog-ng-2.0.6' gmake: *** [all] Error 2 As far as I can see, it's not finding libl. Here are all the libl's on the system: [fhkfauaa@fhkfauaa ~/syslog-ng-2.0.6]$ find / -name libl.\* 2> /dev/null /usr/ccs/lib/amd64/libl.so /usr/ccs/lib/libl.so /usr/lib/amd64/libl.so /usr/lib/amd64/libl.so.1 /usr/lib/libl.so /usr/lib/libl.so.1 /usr/share/man/man3lib/libl.3lib Any ideas?

2 1

Re: [syslog-ng] Syslog relay tag
by Evan Rempel 24 Sep '08

24 Sep '08

I will need to see the rest of your config file. Specifically, the "template" that you are using on all of the systems. Gault Stephane wrote: > Well doesn't work for me here's the detail : > > BOX1: 192.168.5.80 : hostname= APP_80 > BOX2: 192.168.5.65 : hostname= APP_65 > Syslog server: 192.168.5.203 > > config file : > > BOX1: APP_80 > > options { > chain_hostnames(yes); > keep_hostname(no) > long_hostnames(off); > sync(0); > stats(43200); > perm(0640); > create_dirs(yes); > use_fqdn(yes); > }; > > destination syslog_server { tcp("192.168.5.65" port(514)); }; > > BOX2: APP_65 > > options { > chain_hostnames(yes); > keep_hostname(yes); > long_hostnames(off); > sync(0); > stats(43200); > perm(0640); > create_dirs(yes); > use_fqdn(yes); > }; > > destination syslog_server { tcp("192.168.5.203" port(514)); }; > > And My syslog server: 203: > > options { > chain_hostnames(yes); > keep_hostname(yes); > long_hostnames(off); > sync(0); > stats(43200); > perm(0640); > create_dirs(yes); > use_fqdn(yes); > }; > > And i get those king of logs when i generate some log on APP_880: > > > Sep 18 12:41:37 App_65 192.168.5.52 - - [18/Sep/2008:12:41:36 +0200] "GET /tutorial4/java/javaOO/lifecycle.html HTTP/1.1" 200 2620 > Sep 18 12:41:37 App_65 192.168.5.52 - - [18/Sep/2008:12:41:36 +0200] "GET /tutorial4/java/javaOO/objectcreation.html HTTP/1.1" 200 8047 > Sep 18 12:41:39 App_65 192.168.5.52 - - [18/Sep/2008:12:41:37 +0200] "GET /tutorial4/java/javaOO/usingobject.html HTTP/1.1" 200 10133 > > It see the hostname of the relay box and my IP as the generator of the logs, but doesn't indicate de real source of logs : APP_80 ou 192.168.5.80. > > Any clue of what an i doing wrong ? > > S.Gault > > ________________________________ > Discutez sur Messenger où que vous soyez ! Mettez Messenger sur votre mobile !<http://www.messengersurvotremobile.com/> > -- Evan Rempel erempel(a)uvic.ca Senior Programmer Analyst 250.721.7691 University Systems, University of Victoria

2 1

syslog-ng won't log to syslog server
by Azizul 18 Sep '08

18 Sep '08

Hi, I have install syslog-ng on my remote server. I need to centralized my pflog (firewall log) and snort alert to the syslog server. For your info i have successfully log all log except the pflog and snort alert. I have define the snort alert as local0.info and pflog as local1.info. Can you all give me the sample of configuration? I have tcpdump for and grep the local1.info and local0.info and its show on console. I'm confuse why the system not write to destination that i specify. Below is some configuration that i do on syslog-ng.conf (destination): destination local0 { file("/var/log/remote/local0.log"); }; destination local1 { file("/var/log/remote/local1.log"); }; TQ -- MUHAMMAD AZIZUL DARUS http://www.foodmalaysia.net http://www.myfelis.com http://yourubuntulinux.blogspot.com http://opensource-2u.blogspot.com http://photograph2u.blogspot.com http://malaysiataste.blogspot.com http://jomshopping.blogspot.com http://jahitan-manik.blogspot.com http://nissan-maniac.blogspot.com http://narutoslash.blogspot.com/

5 11

Problem with syslog-ng 1.6.8 and HUP - More information
by Tessier.Marc.2＠hydro.qc.ca 16 Sep '08

16 Sep '08

Hi, This is a Solaris 9 (SunOS spdmze21 5.9 Generic_122300-13 sun4u sparc SUNW,Sun-Fire-V240), running syslog-ng 1.6.8. After my previous posts to the list, I managed to get 2 truss outputs, once showing the signal being received and processed and one showing the signal being received and nothing happening at all. Here is what happens when the signal isn't processed : /1: Received signal #1, SIGHUP, in poll() [caught] /1: poll(0xFFBFEC78, 329, 100) Err#4 EINTR /1: sigprocmask(SIG_SETMASK, 0xFFBFE81C, 0x00000000) = 0 /1: sigaction(SIGHUP, 0xFFBFE5E0, 0xFFBFE700) = 0 /1: sigprocmask(SIG_SETMASK, 0xFF0AA094, 0xFFBFE5D0) = 0 /1: lwp_unpark(1, 1) = 0 /1: setcontext(0xFFBFE5E0) /1: so_socket(PF_INET, SOCK_DGRAM, IPPROTO_IP, "", 1) = 296 /1: ioctl(296, 0xC00C6982, 0xFFBFF6C4) = 0 /1: close(296) = 0 /1: sysinfo(SI_SRPC_DOMAIN, "", 256) = 1 /1: open("/etc/resolv.conf", O_RDONLY|O_LARGEFILE) = 296 /1: read(296, " ; - - - - - - - - - - -".., 1024) = 1024 /1: read(296, " a m e s e r v e r 1 2".., 1024) = 515 /1: read(296, 0x0013D638, 1024) = 0 /1: close(296) = 0 /1: write(2, " S I G H U P r e c e i".., 38) = 38 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1522 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1661 /1: write(210, " S e p 1 0 1 6 : 0 2".., 3091) = 3091 /1: write(209, " S e p 1 0 1 6 : 0 2".., 3091) = 3091 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(294, " < 2 2 > S e p 1 0 1".., 8192) = 3253 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: read(294, " < 2 3 > S e p 1 0 1".., 8192) = 3284 /1: write(16, " S e p 1 0 1 6 : 0 2".., 4096) = 4096 /1: write(16, " o u n d a r y = " = _ r".., 2121) = 2121 /1: write(15, " S e p 1 0 1 6 : 0 2".., 4096) = 4096 /1: write(15, " o u n d a r y = " = _ r".., 2121) = 2121 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 3045 /1: read(294, " < 2 3 > S e p 1 0 1".., 8192) = 552 /1: read(166, " < 1 6 6 > S e p 1 0 ".., 8192) = 312 /1: poll(0xFFBFEC78, 329, 100) = 5 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1584 /1: write(210, " S e p 1 0 1 6 : 0 2".., 4096) = 4096 /1: write(210, " 5 5 3 m a i l . i n f".., 421) = 421 /1: write(209, " S e p 1 0 1 6 : 0 2".., 4096) = 4096 /1: write(209, " 5 5 3 m a i l . i n f".., 421) = 421 /1: write(16, " S e p 1 0 1 6 : 0 2".., 528) = 528 /1: write(15, " S e p 1 0 1 6 : 0 2".., 528) = 528 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1533 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1489) = 1489 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1489) = 1489 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1484 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1444) = 1444 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1444) = 1444 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1526 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1498) = 1498 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1498) = 1498 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1799 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1771) = 1771 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1771) = 1771 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1643 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1569 /1: write(210, " S e p 1 0 1 6 : 0 2".., 3168) = 3168 /1: write(209, " S e p 1 0 1 6 : 0 2".., 3168) = 3168 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1814 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: read(294, " < 2 3 > S e p 1 0 1".., 8192) = 1481 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1794) = 1794 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1794) = 1794 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(16, " S e p 1 0 1 6 : 0 2".., 1438) = 1438 /1: write(15, " S e p 1 0 1 6 : 0 2".., 1299) = 1299 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1496 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1456) = 1456 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1456) = 1456 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1537 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1485) = 1485 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1485) = 1485 /1: read(166, " < 1 6 6 > S e p 1 0 ".., 8192) = 796 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(37, " S e p 1 0 1 6 : 0 2".., 1088) = 1088 /1: write(36, " S e p 1 0 1 6 : 0 2".., 1088) = 1088 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1618 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1598) = 1598 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1598) = 1598 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1720 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1795 /1: write(210, " S e p 1 0 1 6 : 0 2".., 3447) = 3447 /1: write(209, " S e p 1 0 1 6 : 0 2".., 3447) = 3447 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1580 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1532) = 1532 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1532) = 1532 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(294, " < 2 2 > S e p 1 0 1".., 8192) = 1155 /1: poll(0xFFBFEC78, 329, 100) = 4 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 2980 /1: write(50, " S e p 1 0 1 6 : 0 2".., 278) = 278 /1: write(16, " S e p 1 0 1 6 : 0 2".., 1128) = 1128 /1: write(15, " S e p 1 0 1 6 : 0 2".., 989) = 989 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 2900) = 2900 /1: write(209, " S e p 1 0 1 6 : 0 2".., 2900) = 2900 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(294, " < 2 2 > S e p 1 0 1".., 8192) = 1542 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(16, " S e p 1 0 1 6 : 0 2".., 1510) = 1510 /1: write(15, " S e p 1 0 1 6 : 0 2".., 1510) = 1510 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1263 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1223) = 1223 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1223) = 1223 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1508 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1460) = 1460 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1460) = 1460 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(51, " < 1 6 6 > S e p 1 0 ".., 8192) = 256 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(294, " < 2 3 > S e p 1 0 1".., 8192) = 1149 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(16, " S e p 1 0 1 6 : 0 2".., 1117) = 1117 /1: write(15, " S e p 1 0 1 6 : 0 2".., 1117) = 1117 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(294, " < 2 2 > S e p 1 0 1".., 8192) = 1541 /1: poll(0xFFBFEC78, 329, 100) = 3 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1496 /1: write(16, " S e p 1 0 1 6 : 0 2".., 1493) = 1493 /1: write(15, " S e p 1 0 1 6 : 0 2".., 1493) = 1493 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1452) = 1452 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1452) = 1452 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(294, " < 2 3 > S e p 1 0 1".., 8192) = 1488 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(16, " S e p 1 0 1 6 : 0 2".., 1436) = 1436 /1: write(15, " S e p 1 0 1 6 : 0 2".., 1436) = 1436 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(51, " < 1 6 6 > S e p 1 0 ".., 8192) = 504 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(57, " S e p 1 0 1 6 : 0 1".., 745) = 745 /1: write(56, " S e p 1 0 1 6 : 0 1".., 745) = 745 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1592 /1: poll(0xFFBFEC78, 329, 100) = 2 /1: write(210, " S e p 1 0 1 6 : 0 2".., 1556) = 1556 /1: write(209, " S e p 1 0 1 6 : 0 2".., 1556) = 1556 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(242, " < 2 2 > S e p 1 0 1".., 8192) = 125 /1: poll(0xFFBFEC78, 329, 100) = 1 /1: read(294, " < 2 2 > S e p 1 0 1".., 8192) = 938 /1: poll(0xFFBFEC78, 329, 100) = 2 It continues on and on with reads, writes and polls as if the signal was never received at all (though it did catch it). When it does work, you see that it opens its config file and starts to close FD (I cut it after a couple of closes, there are 3 dozens since this server is a central logging server) : /1: Received signal #1, SIGHUP, in poll() [caught] /1: poll(0xFFBFEC58, 333, 100) Err#4 EINTR /1: sigprocmask(SIG_SETMASK, 0xFFBFE7FC, 0x00000000) = 0 /1: sigaction(SIGHUP, 0xFFBFE5C0, 0xFFBFE6E0) = 0 /1: sigprocmask(SIG_SETMASK, 0xFF0AA094, 0xFFBFE5B0) = 0 /1: lwp_unpark(1, 1) = 0 /1: setcontext(0xFFBFE5C0) /1: so_socket(PF_INET, SOCK_DGRAM, IPPROTO_IP, "", 1) = 77 /1: ioctl(77, 0xC00C6982, 0xFFBFF6C4) = 0 /1: close(77) = 0 /1: sysinfo(SI_SRPC_DOMAIN, "", 256) = 1 /1: open("/etc/resolv.conf", O_RDONLY|O_LARGEFILE) = 77 /1: fcntl(77, F_DUPFD, 0x00000100) = 315 /1: close(77) = 0 /1: read(315, " ; - - - - - - - - - - -".., 1024) = 1024 /1: read(315, " a m e s e r v e r 1 2".., 1024) = 515 /1: read(315, 0x0009B5E0, 1024) = 0 /1: close(315) = 0 /1: write(2, " S I G H U P r e c e i".., 38) = 38 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(192, " < 1 6 6 > S e p 1 0 ".., 8192) = 243 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1761 /1: poll(0xFFBFEC58, 333, 100) = 4 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1481 /1: read(54, " < 1 6 6 > S e p 1 0 ".., 8192) = 1257 /1: write(55, " S e p 1 0 1 5 : 0 6".., 3142) = 3142 /1: write(53, " S e p 1 0 1 5 : 0 6".., 3142) = 3142 /1: poll(0xFFBFEC58, 333, 100) = 4 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1742 /1: read(264, " < 1 6 6 > S e p 1 0 ".., 8192) = 357 /1: write(143, " S e p 1 0 1 5 : 1 1".., 1568) = 1568 /1: write(142, " S e p 1 0 1 5 : 1 1".., 1568) = 1568 /1: poll(0xFFBFEC58, 333, 100) = 2 /1: write(55, " S e p 1 0 1 5 : 0 6".., 1694) = 1694 /1: write(53, " S e p 1 0 1 5 : 0 6".., 1694) = 1694 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(250, " < 2 3 > S e p 1 0 1".., 8192) = 88 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(264, " < 2 2 > S e p 1 0 1".., 8192) = 1463 /1: poll(0xFFBFEC58, 333, 100) = 3 /1: read(84, " < 2 3 > S e p 1 0 1".., 8192) = 1574 /1: write(23, " S e p 1 0 1 5 : 0 6".., 1419) = 1419 /1: write(18, " S e p 1 0 1 5 : 0 6".., 1771) = 1771 /1: poll(0xFFBFEC58, 333, 100) = 2 /1: write(55, " S e p 1 0 1 5 : 0 6".., 1526) = 1526 /1: write(53, " S e p 1 0 1 5 : 0 6".., 1526) = 1526 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1809 /1: poll(0xFFBFEC58, 333, 100) = 2 /1: write(53, " S e p 1 0 1 5 : 0 6".., 1780) = 1780 /1: write(52, " S e p 1 0 1 5 : 0 6".., 1692) = 1692 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(192, " < 1 6 6 > S e p 1 0 ".., 8192) = 478 /1: poll(0xFFBFEC58, 333, 100) = 2 /1: write(71, " S e p 1 0 1 5 : 0 6".., 706) = 706 /1: write(69, " S e p 1 0 1 5 : 0 6".., 706) = 706 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(84, " < 2 2 > S e p 1 0 1".., 8192) = 1549 /1: poll(0xFFBFEC58, 333, 100) = 2 /1: write(55, " S e p 1 0 1 5 : 0 6".., 1589) = 1589 /1: write(53, " S e p 1 0 1 5 : 0 6".., 1501) = 1501 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(120, " < 1 6 6 > S e p 1 0 ".., 8192) = 325 /1: poll(0xFFBFEC58, 333, 100) = 1 /1: read(250, " < 2 2 > S e p 1 0 1".., 8192) = 137 /1: open("/etc/syslog-ng.conf", O_RDONLY) = 77 /1: ioctl(77, TCGETA, 0xFFBFF53C) Err#25 ENOTTY /1: fstat64(77, 0xFFBFEF20) = 0 /1: fstat64(77, 0xFFBFEDC8) = 0 /1: ioctl(77, TCGETA, 0xFFBFEEAC) Err#25 ENOTTY /1: read(77, " # - - - - - - - - - - -".., 8192) = 7404 /1: read(77, 0x0006AB94, 8192) = 0 /1: door_info(6, 0xFFBFEC20) = 0 /1: door_call(6, 0xFFBFEC08) = 0 /1: door_info(6, 0xFFBFD020) = 0 /1: door_call(6, 0xFFBFD008) = 0 /1: door_info(6, 0xFFBFEC20) = 0 /1: door_call(6, 0xFFBFEC08) = 0 /1: door_info(6, 0xFFBFD020) = 0 /1: door_call(6, 0xFFBFD008) = 0 /1: ioctl(77, TCGETA, 0xFFBFEFA4) Err#25 ENOTTY /1: llseek(77, 0, SEEK_CUR) = 7404 /1: close(77) = 0 /1: poll(0xFFBFF6C8, 0, 0) = 0 /1: door_revoke(13) = 0 /1: close(13) Err#9 EBADF /1: close(59) = 0 /1: close(344) = 0 /1: close(316) = 0 I guess there's something in there that indicates what the problem is exactly, but I'm not qualified enough in system call tracing to say what it could be. Maybe one of you guys has an idea ? Thank you for any help! Marc Tessier Analyste Support Technique Support Technique des Infrastructures courriel : tessier.marc.2(a)hydro.qc.ca <mailto:tessier.marc.2@hydro.qc.ca> Tel: (514) 840-3000 Poste #6467

1 0

syslog-ng /php -syslog-ng
by n r 15 Sep '08

15 Sep '08

hi, I have syslog-ng on a server (debian Etch), and a client with syslog (ubuntu) my server configuration is : source s_local { internal(); unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); }; source s_tcpmessages { tcp(ip(x.x.x.Y)port(514) max-connections(100)); }; source s_udpmessages { udp(ip(x.x.x.Y)port(514)); }; destination d_hosts { file("/log1/HOSTS/$HOST/$YEAR.$MONTH.$DAY/$FACILITY.log"); }; destination d_mysql { program("/usr/bin/mysql -usyslogadmin -p3rda!mysql syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(s_local); destination(d_hosts); }; log { source(s_tcpmessages); destination(d_hosts); }; log { source(s_udpmessages); destination(d_hosts); }; log { source(s_local); destination(d_mysql); }; my client syslog is *.* @x.x.x.Y I don't understand : 1- why i see only (auth, mail, cron,syslog,kern.log) on destination d_hosts for the server? I need to have (user,dkpg.log ,..) 2- ON the server in destination d_hosts, i have (auth, mail, cron,syslog,kern.log) for my client, but why I can't see my client this on php-syslog-ng interface ? What'is wrong? nr _________________________________________________________________ Appelez vos amis de PC à PC -- C'EST GRATUIT http://get.live.com/messenger/overview

1 0

syslog-ng config file include feature...
by Rick Coloccia 11 Sep '08

11 Sep '08

I found in list archives that back in March 2002 there was conversation about modifying syslog-ng so that the syslog-ng.conf file could be split apart. Mine is large and unwieldy - I'd like to break it into files for each file, or for each set of files, that syslog-ng creates. In my dhcpd.conf, I have include statements after my global definitions, allowing me to split the config apart, guaranteeing changes only in the places where I mean them to be. I'd like to do something like that here. Is there some behavior like this in syslog-ng somewhere? A quick google search and a read of the syslog-ng.conf man page doesn't indicate that there is... I am running 2.1.1 with the patch that came over the list on 9/2/08 on CentOS 5.2. Thanks in advance! -Rick -- Rick Coloccia, Jr. Network Manager State University of NY College at Geneseo 1 College Circle, 119 South Hall Geneseo, NY 14454 V: 585-245-5577 F: 585-245-5579

2 1

ISODATE without TZOFFSET
by Del Riesgo, Christopher D 10 Sep '08

10 Sep '08

I was going to use ISODATE in my template, but cannot have the time zone offset appended due to outside factors. This is syslog-ng v2.0.9 on vanilla CentOS v5.2. I initially thought of just making the date up from needed variables, but that raises a question about the template string. I needed this isodate output: YYYY-MM-DDThh:mm:ss So, I was trying to use this template: template t_myformat { template("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC $HOST $MSG\n"); template_escape(no); }; My issue is with the need to have the capital 't' (T) in between the $DAY and $HOUR without any spaces that ISO specifies. If I put the "T" directly after the $DAY, it will of course fail to find the variable $DAYT. I tried many variations of escaping the characters and only one worked, "\a" (bell). I ended up with this string that produces the correct output: template("$YEAR-$MONTH-$DAY\aT$HOUR:$MIN:$SEC $HOST $MSG\n"); Is this supposed to work? Is there a better or more correct method of defining the end of the $DAY variable and getting that "T" directly after the day and before the hour? Also, Is the TZOFFSET required on the ISODATE? And, Is there an easier method to change the ISODATE string, either in conf file or source code? I searched but did not see an applicable place in the code to change the ISODATE string parameters. I search the list archives and after countless other google searches, I haven't seen this issue come up before. Thanks

2 1