- syslog-ng - lists.balabit.hu

Syslog relay : keep facility and level
by Thibaud Desodt 10 Sep '08

10 Sep '08

Hi, I am trying to setup a syslog-ng architecture with a relay. Here is an example : Linux Host1 logs messages to syslog with facility user.info on Host1, syslog-ng is set up to forward these messages (with a filter based on the facility) to Host2 via UDP Linux Host2(log collector)'s syslog-ng is configured to listen for incoming udp packets, and forward them to a Windows Host3 after changing the message's format thanks to a template (add the Source IP at the beginning of the message) Windows Host3 processes the incoming udp messages. I have managed to make it work, that is, messages generated on Host1 with the logger command are successfully received on Host3. Nevertheless, it looks like all the messages reaching my Host3 have the facility/priority User.notice, instead of the original one. Here are some parts of my configuration : -------on Host1: #filter for user facility - for tests filter f_user {facility(user); }; destination host2 {udp("IP.Address.of.Host2");}; log{ source(src); filter(f_user);destination( host2 ); }; ------on Host2 # syslog full redirection to Thibaud's machine destination host3 { udp("IP.ADDRESSE:OF:HOST" template("$SOURCEIP $MSG\n")); }; source s_udp {udp();}; log { source(s_udp); destination ( host3 ); }; I generate messages on host1 with the command logger -p user.warning "message warning test" Is there anything I am doing wrong? Could changing the template make the message lose information about Facility and Level? Thanks in advance

2 2

Problem with syslog-ng 1.6.8 and HUP
by Tessier.Marc.2＠hydro.qc.ca 10 Sep '08

10 Sep '08

Hi, I have been working on an issue for the last few days with one of our main centralized syslog servers which is a SPARC Solaris 9 box. It is running syslog-ng 1.6.8. Our log rotation script moves, compresses and then touches a new file depending on size. Then script then sends an HUP to syslog-ng in the following way : /usr/bin/pkill -HUP syslog-ng > /dev/null 2>&1 I have added some debugging to the script to make sure it grabs the proper PID, and logs it independantly : Sep 10 07:58:01 machine01 syslogmgr[8304]: info: signaling Syslog/Syslog-ng (HUP) at PID 4362. And it is : root@spdmze21# ps -ef | grep syslog-ng root 4362 1 2 Sep 07 ? 160:38 /usr/sbin/syslog-ng Now in the log files, it seems syslog-ng isn't always reacting to the kill. This is what I get as far as syslog-ng noticing the signal in the last 2 days : root@machine01# grep syslog-ng complete.log | grep restarting Sep 9 09:58:06 machine01 syslog-ng[4362]: SIGHUP received, restarting syslog-ng Sep 9 15:58:03 machine01 syslog-ng[4362]: SIGHUP received, restarting syslog-ng Sep 9 19:58:07 machine01 syslog-ng[4362]: SIGHUP received, restarting syslog-ng Sep 10 01:58:04 machine01 syslog-ng[4362]: SIGHUP received, restarting syslog-ng Sep 10 03:58:05 machine01 syslog-ng[4362]: SIGHUP received, restarting syslog-ng However, it was signaled everyhour : Sep 10 00:58:02 machine01 syslogmgr[20532]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Sep 10 01:58:04 machine01 syslogmgr[26686]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Sep 10 02:58:02 machine01 syslogmgr[3702]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Sep 10 03:58:05 machine01 syslogmgr[9935]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Sep 10 04:58:04 machine01 syslogmgr[17262]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Sep 10 05:58:02 machine01 syslogmgr[24178]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Sep 10 06:58:02 machine01 syslogmgr[1748]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Sep 10 07:58:01 machine01 syslogmgr[8304]: [ID 702911 daemon.info] info: signaling Syslog/Syslog-ng (HUP) at PID 4362. Now the problem this creates for me is that it leaves a bunch of open file descriptors which don't point to a file anymore : root@machine01# lsof -p 4362 -s | grep d80 syslog-ng 4362 root 7w VREG 85,80 9699746 40 /var/adm/log (/dev/md/dsk/d80) syslog-ng 4362 root 17w VREG 85,80 3223056 500412 /var/adm/log (/dev/md/dsk/d80) syslog-ng 4362 root 18w VREG 85,80 11604669 612873 /var/adm/log (/dev/md/dsk/d80) syslog-ng 4362 root 20w VREG 85,80 8617243 90 /var/adm/log (/dev/md/dsk/d80) syslog-ng 4362 root 23w VREG 85,80 11698446 612889 /var/adm/log (/dev/md/dsk/d80) ... This causes our rotation to mess up and thus the filesystem to eventually become filled. If I fire pkill manually, it works : root@machine01# /usr/bin/pkill -HUP syslog-ng > /dev/null 2>&1 root@machine01# lsof -p 4362 -s | grep d80 root@machine01# The script itself is called every hour from root's crontab. At this point, I am completely stumped. Even looking at the changelog from 1.6.8 to 1.6.12 (latest 1.6 tree version) I don't see anything that addresses this issue. Now since I have not been able to reproduce a non-working HUP, I don't have a truss output of when it happens. Thank you for any help! Marc Tessier Analyste Support Technique Support Technique des Infrastructures courriel : tessier.marc.2(a)hydro.qc.ca <mailto:tessier.marc.2@hydro.qc.ca> Tel: (514) 840-3000 Poste #6467

2 2

Re: [syslog-ng] Syslog-ng - UDP templates
by Thibaud Desodt 10 Sep '08

10 Sep '08

Hi, thanks for your replies. Actually, this morning, restarting syslog-ng doesn't throw an error anymore. I guess my configuration file was incorrect and I must have corrected it without noticing... I may have forgotten a semi-colon somewhere, and the error message was not very clear about the details. UDP-forwarding with a template now works as expected. Regards, Thibaud

1 0

Re: [syslog-ng] Syslog-ng - UDP templates
by Paul Robert Marino 10 Sep '08

10 Sep '08

Its avalible in the open source version. There is probably an error in your configuration can you please attach a copy so we can help you. You may replace the ip addresses with xxx.xxx.xxx.xxx if you are concerned with keeping the ip addresses off the list. Also please give us an example of how you would like the message formated. -----Original Message----- From: "Shlayen, Yakov (CAT)" <Yakov.Shlayen(a)AutoTraderPub.com> Subj: Re: [syslog-ng] Syslog-ng - UDP templates Date: Tue Sep 9, 2008 1:24 pm Size: 1K To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Hello, I'm new user for syslog-ng product. I cannot found libdbi8* pkg for Solaris 10. Are you can help me with this? Best regards, Yakov (Jake) Shlayen Unix System Administrator Cox AutoTrader/AutoMart 5909 Peachtree Dunwoody Road Atlanta, GA 30328 Email:yakov.shlayen@autotraderpub.com Phone: 678-645-8227 Mobile: 404-643-3169 -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Thibaud Desodt Sent: Tuesday, September 09, 2008 11:40 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Syslog-ng - UDP templates Hi, I am trying to configure syslog-ng (running on OpenSUSE 11.0) to forward a message to another server through UDP. I would like to modify the message's format, therefore I tried to use "template()" without success. (parsing error while restarting the syslog) The version installed with this distribution is 1.6.12, and from what I understood, the feature is available in later versions (1.6rc3 ?) . Is it available in the OpenSource Edition or only in the Premium Edition ? and where can I find it ? Thanks in advance Thibaud ________________________________________________________________________ ______ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html --- message truncated ---

1 0

Anyone Using Mailgraph (an RRD based Tool) for Postfix Mail Logs???
by wiskbroom＠hotmail.com 08 Sep '08

08 Sep '08

Hello; I am in search for a way to graph my logs for four separate mailservers, since all four are logging onto the same syslog-ng host, I figured I'd use mailgraph, a tool which creates graphs using RRDtools. I got rrdtools installed and ran mailgraph, and after not receiving any graph data at all in my database (mailgraph.rrd file), I ran strace and saw: write(2, "WARNING: line not in syslog form"..., 209) = 209 write(2, "WARNING: line not in syslog form"..., 167) = 167 write(2, "WARNING: line not in syslog form"..., 172) = 172 write(2, "WARNING: line not in syslog form"..., 173) = 173 write(2, "WARNING: line not in syslog form"..., 194) = 194 write(2, "WARNING: line not in syslog form"..., 172) = 172 My syslog-ng.conf has the following relevant data for this particular source: options { chain_hostnames(no); create_dirs (yes); dir_perm(0755); use_dns (yes); dns_cache(yes); dns_cache_size(1000); dns_cache_expire(604800); keep_hostname(yes); log_fifo_size(10000); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(yes); }; log { source(S_udp); filter(F_mailservers); destination(D_mailservers); flags(final); }; destination D_mailservers { file("/var/log/Acme-Hosts/MailServers/$FULLHOST.log" perm(0644)); }; My logs look like: Sep 5 16:31:45 mailserver.example.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 597816CB1E: from=<203176.549962556(a)abc.exampletest.com>, size=14602, nrcpt=1 (queue active) Sep 5 16:31:45 mailserver.mailserver.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 3081A6CB1C: removed Sep 5 16:31:45 mailserver.mailserver.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 1C0426CB1D: removed Is there a way that I can tel syslog-ng to output to two locations, on e in the format above, which I need, and another in the format that mailgraph expexts to see? I assume that mailgraph is not setup to see the HOSTNAME/HOSTNAME entries shown above. I am using syslog-ng, latest, and am purposely stuffing my data into files named after the host, into a directory named after the same. I am also using a FIFO to redirect all logged data into a mysql DB, but the script mailgraph is receiving it's data from the flat files above. Any help appreciated, especially in a way that would not require rewriting the way the data looks now. Thanks all, .vp

2 5

Oracle logging into syslog-ng?
by Surlow, Jim 08 Sep '08

08 Sep '08

Please provide thoughts and comments - I'm not a DBA and I'm having our DBAs do further research here, but ... I infer from the Oracle documentation, that Oracle logs to a single syslog facility+level per instance, if configured. And the information in the Oracle log cannot be configured/altered. The downside that I'm seeing is that there is no information in regards to the Oracle instance. So, if I have a box with 20+ instances and I wish to relay this to a central server, all this is going to end up as noise. My kludge for this, would be to setup the following on each Oracle server: Instance #1 -> local0.debug Instance #2 -> local0.info Instance #3 -> local0.warn Instance #4 -> local1.debug Instance #5 -> local1.info Instance #6 -> local1.warn Etc. Then, setup syslog-ng on that Oracle server to use templates (one per instance), to route the data to a single facility & level on our centralized syslog-ng log server and imbed an instance name into the log. This config sounds really cumbersome. I'm also trying to avoid using Oracle to send the logs to a different instance which would do the consolidation. Does anyone else have a better solution? Am I right in that Oracle will only send to a single facility+level combo regardless of criticality? Thanks, Jim

2 1

Connection failed; error='Connection refused (111)'
by n r 05 Sep '08

05 Sep '08

hi, I intalled syslog-ng on server (debian etch) and on a client (ubuntu) i have this message on the both ??? syslog-ng[2959]: Connection failed; error='Connection refused (111)', time_reopen='10' any help? thanks nr _________________________________________________________________ Découvrez Windows Live Spaces et créez votre site Web perso en quelques clics ! http://spaces.live.com/signup.aspx

1 0

apache logs over syslog-ng sychronized
by Eli Shemer 04 Sep '08

04 Sep '08

Hey there, I would like to know if this configuration sounds viable to you. Right now it's not really operational performance wise. What I'm basically trying to do is to have my syslog server completely synchronized to the apache access logs of my other servers. On a client I have this configured: source s_apachelogs { file("/etc/apache2/logs/test/2008-09-02-test.log"); }; destination df_apachelogs { tcp("192.168.200.4" port(1999)); }; log { source(s_apachelogs); destination(df_apachelogs); }; and on the server: source s_apachelogs { tcp(ip(192.168.200.4) port(1999)); }; destination df_apachelogs { file("/var/log/apachelogs.log"); }; log { source(s_apachelogs); destination(df_apachelogs); }; This is just a sample case. Later on I would like to have my server keep an /var/log/apachelogs/ directory completely identical to the logs of the other servers. For some reason I don't see any traffic passed over the line unless I run a /etc/init.d/syslog-ng reload which is really bizzar. Thanks!

4 9

incorrect port number in stats
by Joe Shaw 04 Sep '08

04 Sep '08

Hi, Another minor thing I've noticed in 2.1.1... the port number in the log statistics for a remote destination is wrong: dropped='tcp(dest-host:514)=0 [...] The syslog-ng daemon is running on port 2000, and the data is correctly being sent there. In 2.0.9, it said instead: dropped='tcp(AF_INET(10.1.73.18:2000))=0' Joe

2 1

syslog-ng 2 nics
by Hubert Kupper 03 Sep '08

03 Sep '08

Hi, we run a SLES10 SP2 server as a syslog-ng server for a couple of month without errors. Now I added a secondary nic in the server an binded a subnet to the nic. The first switch from this subnet logs to syslog-ng fine, but every switch else in this subnet don't create a log-directory on the server. I've run ethereal an see that all switches send their packets to port 514 on the server, but syslog-ng do nothing with this packets. What can be wrong? Regards, Boert -- GMX startet ShortView.de. Hier findest Du Leute mit Deinen Interessen! Jetzt dabei sein: http://www.shortview.de/wasistshortview.php?mc=sv_ext_mf@gmx

2 4

No output to file with 2.1.1
by Joe Shaw 03 Sep '08

03 Sep '08

Hi, I just tried updating to 2.1.1 on my test instance and none of the incoming data is being written out to disk. It worked for me with 2.0.9. The problem is with the log_iw_size() parameter in my tcp source. Without it, the data is being logged to disk. My configuration file is below. Anything obviously amiss? Thanks, Joe -- # General Options options { sync(0); time_reopen(10); log_fifo_size(131072); long_hostnames(off); use_dns(yes); dns_cache(yes); use_fqdn(no); keep_hostname(yes); use_time_recvd(no); #log_msg_size(65536); log_msg_size(16384); stats_freq(180); #time_sleep(20); }; # Remote source source s_tcp { tcp(port(2000) log_iw_size(131072) log_fetch_limit(1024) max_connections(128)); }; # syslog-ng statistics source s_internal { internal(); }; destination d_file { file("/ita/syslog-messages" perm(0644)); }; destination d_stats { file("/ita/syslog-stats" perm(0644)); }; # Save stats separately log { source(s_internal); destination(d_stats); }; # Take all remote data and save it locally log { source(s_tcp); destination(d_file); flags(flow-control); };

2 1

syslog-ng 2.1.1 has been released
by devel＠balabit.hu 02 Sep '08

02 Sep '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.1.1 SUMMARY : new stable release DATE : Sep 2, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.1.1) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.1 Thu, 28 Aug 2008 09:26:30 +0200 Bugfixes: * Fixed a possible crash in stats message generation. * Fixed compilation problem in loggen on FreeBSD. Other changes: * The netmask filter was changed to assume that local messages are received from 127.0.0.1. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.1 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.1 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.1 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.1 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.1 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/

1 0

a question about dns
by liuruihong 02 Sep '08

02 Sep '08

I use syslog-ng to receive remote logs. In the conf of syslog-ng I use 'use_dns(yes)' option . My question is : there is a remote host which has one ip 10.23.245.158,and two dns: build-la21.com and lrh- build-la21.com, which dns will syslog-ng choose when receive logs from the remote host?

1 0

Filtre empty program
by G R 29 Aug '08

29 Aug '08

Hi! I'm trying to filter some logs that have no program field. kind of "logger -t '' " logs. I've try to use program(""); or program(NULL); as filter but none of them works. How can I filter this empty program field logs ? Thanks! Gaël.

4 7

Re: [syslog-ng] destination program is killed due to broken pipe
by prmarino1＠gmail.com 28 Aug '08

28 Aug '08

well the script on the surface sounds like a good simple idea, the simple way is not always the best or most relyable way. There are several better options open to you that should work better and shouldn't be too hard to impliment. The first is to write to a log file then use something like a "tail -f" in your script. Another option open to you is if you know how to write unix network program's in any languages (I use perl for this kind of thing my self) it wouldn't be difficult to write a simple application read from a socket, or even udp syslog on an alternitive port on the loopback address. Syslog is a relitivly simple protocal to write a listener for and there are several perl modules that can do most of the work for you. ----------------------- Sent from my Treo(r) smartphone -----Original Message----- From: "midnight codder" <midnight.codder(a)gmail.com> Date: Tuesday, Aug 19, 2008 5:08 pm Subject: [syslog-ng] destination program is killed due to broken pipe To: syslog-ng(a)lists.balabit.huReply-To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> I am trying to redirect all log messages to a destination program (written in java). This did not do much so I redirected all messages to a single catch-all log file AND also to a bash shell script that runs an endless loop, reads a line and spit it out to a text file. The shell script is killed by syslog-ng after the 5th message. The catch-all file, however, keeps getting all of the messages (that's how I know who is killing who). Here is the config file for syslog-ng: options { ts_format(iso); frac_digits(3); }; template bds_template{ template('<pri=$PRI> <date=$ISODATE> <host=$HOST> <msg=$MSG>\n'); template_escape(no); }; source src{ internal(); unix_stream('/dev/log'); unix-dgram('/dev/log'); file('/proc/kmsg' log_prefix('kernel:')); udp(); tcp(); }; destination test_adapter{ program('bash /usr/local/bds/logger/syslogAdapterTest.sh' template(bds_template)); }; log { source(src); destination(test_adapter); }; destination catchAll{ file('/var/log/syslog-ng-catch-all.log', template(bds_template)); }; log { source(src); destination(catchAll); }; Here is the bash script: #!/bin/bash file='/root/syslogAdapterTest' counter=1 limit=3 while true do read line echo '$line' > $file.$counter ((counter++)) done and finally the content of the catch-all file, in blue are the log messages that the shell script still captures and spits to text files, in red are the messages are the messages the shell does not get: <priE> <date 08-08-19T15:13:56.191-05:00> <host=oracle-test> <msg=syslog-ng[27971]: Server license found, starting in server mode; customer='University of Illinois', serial='49544f30-573e-11dd-9892-0007e9195011', limit='25'> <priF> <date 08-08-19T15:13:56.191-05:00> <host=oracle-test> <msg=syslog-ng[27971]: Starting destination program; cmdline='bash /usr/local/bds/logger/syslogAdapterTest.sh'> <priE> <date 08-08-19T15:13:56.193-05:00> <host=oracle-test> <msg=syslog-ng[27971]: syslog-ng starting up; version='2.1.11a'> <priF> <date 08-08-19T15:13:56.193-05:00> <host=oracle-test> <msg=syslog-ng[27971]: Initializing destination file writer; template='/var/log/syslog-ng-catch-all.log', filename='/var/log/syslog-ng-catch-all.log'> <priE> <date 08-08-19T15:13:56.193-05:00> <host=oracle-test> <msg=syslog-ng[27971]: License validity expires in one week, logging service will terminate at that point; error='License outside the validity period (option=syslog-ng, not-before 08/07/21, not-after 08/08/21)'> <priC> <date 08-08-19T15:13:56.198-05:00> <host=oracle-test> <msg=syslog-ng[27971]: I/O error occurred while writing; fd='11', error='Broken pipe (32)'> <priF> <date 08-08-19T15:13:56.198-05:00> <host=oracle-test> <msg=syslog-ng[27971]: Sending child a TERM signal; child_pid='27972'> Any idea?

3 6

Can syslog-ng support TCP and UDP simultaneously?
by Guy Fleegman 28 Aug '08

28 Aug '08

Hello: Currently we have all of our devices sending syslog data to a 2.05 syslog-ng server. However... there is one instance where we need to use TCP as a delivery mechanism Can syslog-ng support having both TCP and UDP sources simultaneously? If so ..where might I find a configuration example? Please advise and thanks, -Guy

3 2

Lots of dropped=tcp(AF_INET(
by Ivan Lezhnjov Jr. 27 Aug '08

27 Aug '08

Hello I have two hosts on my LAN running syslog-ng. Host A acts as central loghost and host B sends its log messages via tcp/ip network connection to host A to store. The issue is that I've got a lot of messages like this one (and almost no normal ones) generated by host B: Aug 19 19:25:23 xerxes syslog-ng[20806]: Log statistics; dropped='tcp(AF_INET(217.117.75.2:1999))=0', processed='center(queued)=112', processed='center(receive d)=23', processed='destination(newsnotice)=0', processed='destination(console)=0', processed='destination(debug)=23', processed='destination(mailinfo)=0', proc essed='destination(mail)=0', processed='destination(user)=0', processed='destination(newserr)=0', processed='destination(newscrit)=0', processed='destination(u ucp)=0', processed='destination(messages)=19', processed='destination(mailwarn)=0', processed='destination(ppp)=1', processed='destination(loghost)=23', proces sed='destination(lpr)=0', processed='destination(cron)=0', processed='destination(syslog)=23', processed='destination(authlog)=0', processed='destination(maile rr)=0', processed='destination(kern)=0', processed='destination(daemon)=0', processed='destination(xconsole)=0', processed='destination(console_all)=23', proce ssed='source(net)=0', processed='s While it is obvious that dropped tcp speaks of network issues it isn't really clear to me (being a novice syslog-ng user) what exactly goes wrong here. So, could you please explain what's wrong with host B and how I can fix that? -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

5 9

Re: [syslog-ng] syslog-ng Digest, Vol 40, Issue 16
by vadi 27 Aug '08

27 Aug '08

Hi Joe, Thanks for your replay. I am not able to understand the regular expression statement with are there in the internet. For example: \s(\S+)\s(\S+)\[\d+\]\:\s\[ID \d+ (\S+)\.(\S+)\]\s \S+\s+\d+\s+(\d+)\:\d+\:\d+\s I want to know what exactly text of this pattern? Is there any tool will convert RegExp to text?. So that it will helps for me to understand better. Regards, Vadiraj On Mon, Aug 25, 2008 at 3:30 PM, <syslog-ng-request(a)lists.balabit.hu> wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: tool to convert regular expression to text (Fegan, Joe) > 2. Re: syslog-ng 2 nics (Balazs Scheidler) > 3. Re: [patch] Add follow_freq_ms option (Balazs Scheidler) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 24 Aug 2008 23:34:59 +0000 > From: "Fegan, Joe" <Joe.Fegan(a)hp.com> > Subject: Re: [syslog-ng] tool to convert regular expression to text > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: > < > 0E6222894DE49B40A3A9FD929C630BCB379EB5A2EF(a)GVW1121EXC.americas.hpqcorp.net > > > > Content-Type: text/plain; charset="us-ascii" > > Hi Vadiraj, > > Your question doesn't really make sense. Can you please elaborate. That > might help. > > Joe. > > ________________________________ > From: syslog-ng-bounces(a)lists.balabit.hu [mailto: > syslog-ng-bounces(a)lists.balabit.hu] On Behalf Of vadi > Sent: 22 August 2008 22:15 > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] tool to convert regular expression to text > > Dear All, > > Do we have any tool to convert regular expression to text?. Please let me > know about it. > > Thanking u, > > Regards, > Vadiraj > >

2 1

Re: [syslog-ng] FreeBSD dist syslog-ng.conf-sample dumps mail.info to maillog & messages
by Len Conrad 26 Aug '08

26 Aug '08

> > > > postfix is sending only warnings to messages > >Well, this rings a bell. When you run a chrooted postfix then it >could fall back using /dev/log (or its FreeBSD equivalent) in the >chroot when syslog-ng is restarted. A commonly used workaround on >linux is to create the /var/spool/postfix/dev directory by hand >and add /var/spool/postfix/dev/log to the sources of syslog-ng. Interesting point, thanks. We aren't running chroot, but noted for the future. To the "log" directives feeding stuff into destination file "messages", I added a NOT filter for "postfix.*warning" and for "postgrey". >I don't see any problems with your config, although I did only >a quick check. fixed my error: filter f_conn_from_unk { match(": connection from unknown"); }; to filter f_conn_from_unk { match(": connect from unknown"); }; thanks, Len

1 0

FreeBSD dist syslog-ng.conf-sample dumps mail.info to maillog & messages
by Len Conrad 26 Aug '08

26 Aug '08

I can't see how this is happening. I can stop the mail.info to maillog, but I can't stop it to messages since I can't find any destination (messages) being fed by mail.info I found this and commented it out, but no change: #log { source(src); filter(f_mail); filter(f_crit); destination(messages); }; I'm looking for : log { source(src); filter(f_mail); filter(f_info); destination(messages); }; or anything similar but can't find it. It's weird that this is the vanilla syslog-ng.conf-sample with the FreeBSD 6 package. thanks, Len

2 2

Re: [syslog-ng] FreeBSD dist syslog-ng.conf-sample dumps mail.info tomaillog & messages
by infosec＠gmail.com 26 Aug '08

26 Aug '08

Len, Go ahead and send the whole file to the list, or if it's really large post it somewhere and send us the link. Is it possible that you're still running another syslog daemon and it isn't syslog-ng sending the messages there? -----Original Message----- From: Len Conrad <LConrad(a)Go2France.com> Subj: [syslog-ng] FreeBSD dist syslog-ng.conf-sample dumps mail.info tomaillog & messages Date: Mon Aug 25, 2008 9:03 pm Size: 852 bytes To: syslog-ng(a)lists.balabit.hu I can't see how this is happening. I can stop the mail.info to maillog, but I can't stop it to messages since I can't find any destination (messages) being fed by mail.info I found this and commented it out, but no change: #log { source(src); filter(f_mail); filter(f_crit); destination(messages); }; I'm looking for : log { source(src); filter(f_mail); filter(f_info); destination(messages); }; or anything similar but can't find it. It's weird that this is the vanilla syslog-ng.conf-sample with the FreeBSD 6 package. thanks, Len ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

1 0

tool to convert regular expression to text
by vadi 25 Aug '08

25 Aug '08

Dear All, Do we have any tool to convert regular expression to text?. Please let me know about it. Thanking u, Regards, Vadiraj

2 1

lost messages with follow_freq()?
by Joe Shaw 21 Aug '08

21 Aug '08

Hi, I'm trying to use the follow_freq() option to tail a growing log file, but not all of the messages are making it from the source end to the destination end. However, according to the statistics, no messages are dropped. I am using syslog-ng 2.0.9. The file on the source side looks like this: -rw-r--r-- 1 jshaw ita 251M Aug 19 15:07 dump-file and is growing rather rapidly. (It is basically being created by replaying another stored log file.) At this same point on the destination side, this is the corresponding file: -rw-r--r-- 1 root root 30M Aug 19 15:07 syslog-messages And doing a diff on those files does show large missing chunks from this file. The source's statistics say that nothing has been dropped: Aug 19 15:07:45 source-host syslog-ng[18574]: Log statistics; dropped='tcp(AF_INET(10.1.73.18:2000))=0', processed='center(queued)=303967', processed='center(received)=304017', processed='destination(d_file)=6', processed='destination(d_remote)=303961', processed='source(s_sys)=56', processed='source(s_internal)=6', processed='source(s_file)=303955' And on the destination side: Aug 19 15:08:04 dest-host syslog-ng[21023]: Log statistics; processed='center(queued)=318524', processed='center(received)=318521', processed='destination(d_file)=318521', processed='destination(d_stats)=3', processed='source(s_tcp)=318518', processed='source(s_internal)=3' The source syslog-ng.conf file looks like this: options { sync(0); time_reopen(10); log_fifo_size(1000); long_hostnames(off); use_dns(yes); dns_cache(yes); use_fqdn(no); keep_hostname(yes); use_time_recvd(no); log_msg_size(65536); stats_freq(180); }; source s_internal { internal(); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); }; source s_file { file("/ita/dump-file" follow_freq(1) flags(no-parse)); }; # Local destination for statistics destination d_file { file("/ita/syslog-messages" perm(0644)); }; # Remote destination destination d_remote { tcp("dest-host" port(2000)); }; # Send stats locally log { source(s_internal); destination(d_file); }; # Send everything remotely log { source(s_internal); source(s_file); destination(d_remote); }; (Yes, the s_sys source is unused.) On the destination side: options { sync(0); time_reopen(10); log_fifo_size(1000); long_hostnames(off); use_dns(yes); dns_cache(yes); use_fqdn(no); keep_hostname(yes); use_time_recvd(no); log_msg_size(65536); stats_freq(180); }; # Remote source source s_tcp { tcp(port(2000) log-fetch-limit(128) max-connections(1000)); }; # syslog-ng statistics source s_internal { internal(); }; destination d_file { file("/ita/syslog-messages" perm(0644) log_fifo_size(100)); }; destination d_stats { file("/ita/syslog-stats" perm(0644)); }; # Save stats separately log { source(s_internal); destination(d_stats); }; # Take all remote data and save it locally log { source(s_tcp); source(s_internal); destination(d_file); }; Any ideas what might be going on, or how to analyze this further? Thanks, Joe

2 6

how to fetch logs from linux, windows, and devices (firewall, router)
by senthil kumar 21 Aug '08

21 Aug '08

hi pals i am new to syslog-ng. it is a very nice software. i want to used opensource edition of syslog-ng i want to log all linux, windows, sonicwall firewall, watchguard firewall, cisco router, dlink router, DSL router. is it possible to log all above things just using opensource edition of syslog-ng. and i want the detailed notes for "HOW TO INSTALL SYSLOG-NG SERVER IN LINUX" and i want configuration details for "GETTING LOGS FROM LINUX, WINDOWS AND DEVICES" pls help me. Regards N.Senthil Kumar Mobile +91 9787150175 Unlimited freedom, unlimited storage. Get it now, on http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html/

1 0

destination program is killed due to broken pipe
by midnight codder 19 Aug '08

19 Aug '08

I am trying to redirect all log messages to a destination program (written in java). This did not do much so I redirected all messages to a single catch-all log file AND also to a bash shell script that runs an endless loop, reads a line and spit it out to a text file. The shell script is killed by syslog-ng after the 5th message. The catch-all file, however, keeps getting all of the messages (that's how I know who is killing who). Here is the config file for syslog-ng: options { ts_format(iso); frac_digits(3); }; template bds_template{ template("<pri=$PRI> <date=$ISODATE> <host=$HOST> <msg=$MSG>\n"); template_escape(no); }; source src{ internal(); unix_stream("/dev/log"); unix-dgram("/dev/log"); file("/proc/kmsg" log_prefix("kernel:")); udp(); tcp(); }; destination test_adapter{ program("bash /usr/local/bds/logger/syslogAdapterTest.sh" template(bds_template)); }; log { source(src); destination(test_adapter); }; destination catchAll{ file("/var/log/syslog-ng-catch-all.log", template(bds_template)); }; log { source(src); destination(catchAll); }; Here is the bash script: #!/bin/bash file="/root/syslogAdapterTest" counter=1 limit=3 while true do read line echo "$line" > $file.$counter ((counter++)) done and finally the content of the catch-all file, in blue are the log messages that the shell script still captures and spits to text files, in red are the messages are the messages the shell does not get: <pri=45> <date=2008-08-19T15:13:56.191-05:00> <host=oracle-test> <msg=syslog-ng[27971]: Server license found, starting in server mode; customer='University of Illinois', serial='49544f30-573e-11dd-9892-0007e9195011', limit='25'> <pri=46> <date=2008-08-19T15:13:56.191-05:00> <host=oracle-test> <msg=syslog-ng[27971]: Starting destination program; cmdline='bash /usr/local/bds/logger/syslogAdapterTest.sh'> <pri=45> <date=2008-08-19T15:13:56.193-05:00> <host=oracle-test> <msg=syslog-ng[27971]: syslog-ng starting up; version='2.1.11a'> <pri=46> <date=2008-08-19T15:13:56.193-05:00> <host=oracle-test> <msg=syslog-ng[27971]: Initializing destination file writer; template='/var/log/syslog-ng-catch-all.log', filename='/var/log/syslog-ng-catch-all.log'> <pri=45> <date=2008-08-19T15:13:56.193-05:00> <host=oracle-test> <msg=syslog-ng[27971]: License validity expires in one week, logging service will terminate at that point; error='License outside the validity period (option=syslog-ng, not-before=2008/07/21, not-after=2008/08/21)'> *<pri=43> <date=2008-08-19T15:13:56.198-05:00> <host=oracle-test> <msg=syslog-ng[27971]: I/O error occurred while writing; fd='11', error='Broken pipe (32)'> <pri=46> <date=2008-08-19T15:13:56.198-05:00> <host=oracle-test> <msg=syslog-ng[27971]: Sending child a TERM signal; child_pid='27972'>* Any idea?

1 0