- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Not able to match on a field in syslog messages from a DataPower Appliance
by Salowitz, Adam (AS.) 17 Jul '08

17 Jul '08

>USER.DEBUG: Jul 15 18:23:44 DPRASSyslogAudit3 [system][debug] >trans(383): cpu usage: 57%(10 sec) 57%(1 min) 57%(10 >min) 56%(1 hour) 58%(1 day) > >In syslog wire protocol the field immediately after the >timestamp is the hostname, so this message would be >interpreted as being from a host called DPRASSyslogAudit3. >Your filters are not matching these messages because match() >only matches elements of the message body and the text you're >looking for does not appear in the message body. > >Joe. That's actually what thought (but forgot to mention in my earlier email), but when I try to match on host it doesn't catch anything either. Neither of these catch anything: filter group_syncDPextest { host("DP[:digit:]+Syslog") or host("DPRASSyslogAudit[:digit:]+") ;}; filter group_syncDPextest { host("DP") ;}; Is this because the host filter actually comes from the source host of the packet and not the message itself? Are DataPower's syslog messages just broken or non-rfc complient? Should I just give up and try to match on other strings in the message? Thanks again for all your help on this weird problem. Adam

2 2

Not able to match on a field in syslog messages from a DataPower Appliance
by Salowitz, Adam (AS.) 17 Jul '08

17 Jul '08

I am using syslog-ng 1.6.12 to collect logs from an IBM DataPower appliance. The DataPower appliance allows a certain custom string to be added to the outgoing syslogs called a Local Identifier. I am trying to use a regex to match on this Local Identifier. I have used tcpdump to capture actual packets and can see that the Local Identifier is in the Application layer Syslog message field. My question is why is match not working when I try to use a filter to grab just a particular Local ID? No logs are caught by my filter. I have tried: match ("DP\d+Syslog") match ("DPRASSyslogAudit3") match ("DPRASSyslogAudit") match ("DP") I have been able to catch other strings in the messages, such as system, debug, dpHandler, etc..." These example packets below are copy and pasted from wireshark by clicking on the Syslog message field in the packet details from and right clicking -> Copy -> Description. * Three Syslog messages from the DataPower appliance that show the Local identifier that I want to match against in the fourth field (DPRASSyslogAudit3, DP472Syslog). Syslog message: USER.DEBUG: Jul 15 18:23:44 DPRASSyslogAudit3 [system][debug] trans(383): cpu usage: 57%(10 sec) 57%(1 min) 57%(10 min) 56%(1 hour) 58%(1 day)\n Syslog message: USER.ERR: Jul 15 18:23:43 DP472Syslog [mpgw][error] trans(8152497)[19.x.x.x]: Request processing failed: Connection terminated before request headers read\n Syslog message: USER.ERR: Jul 15 18:25:11 DP474Syslog [dpHandler_prod_host474][ssl][error] valcred(pubcert): trans(8043025)[19.x.x.x]: SSL Proxy Profile 'xgtws': connection error: peer did not send a certificate\n * One syslog messsage from a Cisco device which shows the hostname in the fourth field Syslog message: LOCAL7.NOTICE: Jul 15 22:23:48 hostname 2008 Jul 15 22:23:46 %SNMP-5-SNMPAUTHFAIL:Authentication failed for message from 19.x.x.x\n Does anyone have any idea why this field might be getting missed or can anyone give me some guidance as to where in the source the incoming messages are parsed? I have tried all the macros listed in the code and never get the local ID. #DataPower Appliances Extreme Test destination syncDPextest { file("/logs/syncDPextest/$YEAR$MONTH$DAY.txt" template("$FACILITY $FACILITY_NUM $PRIORITY $LEVEL $LEVEL_NUM $TAG $PRI $HOST $DATE $FULLHOST_FROM $MESSAGE\n") ); }; user 1 err err 3 0b 11 hostname Jul 16 16:10:59 hostname [dpHandler_prod_host472][ssl][error] valcred(pubcert): trans(8320177)[19.x.x.x]: SSL Proxy Profile \'xgtws\': connection error: peer did not send a certificate Any help or suggestions whould be appreciated. Thanks, Adam

3 2

Using Regex information for destination
by James Whitt 11 Jul '08

11 Jul '08

I had asked this question about a year ago, but was told to wait for the new 2.0 version. I'm currently running the latest syslog-ng 2.0.7. What I would like to do is put the line in a specific file based on part of the hostname. For example: Hostname: subdomain.domain.tld destination customer_firewall_logs { file("/logs/$TLD/$DOMAIN/$SUBDOMAIN/$R_YEAR-$R_MONTH-$R_DAY.log"); }; WHERE $TLD is the tld of the hostname, $DOMAIN is the domain from the hostname, and $SUBDOMAIN is teh subdomain from the hostname. I would like to be able to regex this information out of the hostname to use in the destination. Is this possible and any tips on getting it to work correctly would be greatly appreciated.

3 6

TCP Wrappers
by Mike 11 Jul '08

11 Jul '08

hello all, it seems that TCP Wrappers can be enabled by default when compiling syslog-ng 2.0.9, despite what the documentation says. >From what I can see, the configure script looks for the existance of the libwrap libraries, and if they exist it will enable support (added in syslog-ng 2.0.3). would it be possible to either update the documents to mention that libwrap is not disabled by default, or maybe make it so you do actually have to manually enable libwrap? (compiling on RedHat ES4, which has the libwrap devel libraries) thanks! Mike

2 3

Using regexp in match()
by Jan Kreps 09 Jul '08

09 Jul '08

Hi All. I'm trying to setup central syslog-ng server for my Exchange servers. On windows servers I use Epilog agent (brother of Snare) forwarding tracking logs to central syslog. And I want to feed the logs into MySQL. Problem is that event sended by Epilog consists from four fields: Date, System, Type and Strings. But I don't need them. Actual content of tracking log -- some 20 fileds -- is hidden in the String. So I need to parse the String to obtain the fields I'm interested in. According to syslog-ng admin guide: The host(), match(), and program() filter functions accept extended regular expressions (also called POSIX modern regular expressions) as parameters. The regular expressions can use up to 255 regexp matches ($1 ... $255). For case-insensitive searches, start the expression with the (?i) string. So I tried regexps to do this, but without success. My idea was to use grouping regexp, which would remmember matches in $1 .. $20 and use these in template section. Say the format is: filed1\011field2\011, so fields in String are separated by '\011'. I tried: filter f_parse { match("([^\\011]*)\\011([^\\011]*)\\011"); }; but when i try use $1 and $2 afterwards in template they seem empty Am I completely wrong with this approach, or I missed something? Thanks in advance Jan

2 1

Re: [syslog-ng] loop caused by syslog-ng filter
by JUNG, Christian 07 Jul '08

07 Jul '08

Okay. Don't know if I get the things right, but: All scripts you've mailed to the list write something to a file or send a mail if they're called and terminate directly after that action. syslog-ng will respawn (neu starten) them directly. The program started by the program destination should not terminate itself. It has to listen on STDIN for a log message given from syslog-ng. Afterwards it can do something useful and then it has to listen for the next message. In a shell script you can do this with a "while read LINE; do ...; done". Try this: ---8<--- #!/bin/bash while read LINE; do echo $(date) $LINE >> /tmp/schrott done ---8<--- Execute this script on the command line, enter some random stuff and look into /tmp/schrott: user@box:~> ./test-script bla bla bla bla Terminate this script by pressing CTRL-D. You should see something like this in /tmp/schrott: Thu Mar 20 15:13:16 CET 2008 bla bla bla Thu Mar 20 15:13:18 CET 2008 bla If not your script doesn't work :-) See for typos. If this works, put it in your syslog-ng conf. It should do the same (only prio 1 messages should be visible with the date prepended). If this works well, try this script first on the command line: ---8<--- #!/bin/bash while read LINE; do mail -s "High Priority Snort Alert" Sub-Zero(a)xxx.de <<-EOF Alert, Priority 1 $LINE EOF done ---8<--- You should receive for every given input line exactly one mail. If this works put it in your syslog-ng.conf. Now you should be done. The thread you mentioned is about two running scripts where only one should run. This shouldn't be the case here. But you can have a look at the output of "ps fax". If you see multiple processes under syslog-ng then you might have the problem. bye Chris > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of Adam Richter > Sent: Thursday, March 20, 2008 2:46 PM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] loop caused by syslog-ng filter > > > Hi! > > Not working! Syslog-ng filters for exactly the string: [Priority: 1] > and not as it is piped by the mail script: #priority 1# note the ":" ! > Anyway I used your script --> same fault!!! > I have also used following script: > > > #!/bin/sh > > echo AAA >> /tmp/schrott > date >> /tmp/schrott > > There is no output like [Priority: 1]!!! > Then I did following: tail -f /tmp/schrott and got a loop > too! The loop starts when syslog-ng recognices the first > machting string [Priority: 1] and loops till I stop syslog-ng!!! > > > Sensor1:~# /etc/init.d/syslog-ng stop > Stopping system logging: syslog-ng. > Sensor1:~# tail -f /tmp/schrott > AAA > Do 20. MÃ¤r 14:29:12 CET 2008 > AAA > Do 20. MÃ¤r 14:29:12 CET 2008 > AAA > Do 20. MÃ¤r 14:29:12 CET 2008 > AAA > Do 20. MÃ¤r 14:29:12 CET 2008 > AAA > Do 20. MÃ¤r 14:29:12 CET 2008 > > > I think it has something in common with this thread: > > https://lists.balabit.hu/pipermail/syslog-ng/2006-October/009454.html > > Any other ideas? It´s very important! > > German: Es handelt sich hier um meine Abschlussprüfung, und > dies ist der letzte Fehler der Auftritt, ansonsten läuft das Projekt. > > bye, Adam / Sub-Zero ! > > > -------- Original-Nachricht -------- > > Datum: Thu, 20 Mar 2008 10:32:31 +0100 > > Von: "JUNG, Christian" <christian.jung(a)saarstahl.com> > > An: "Syslog-ng users\' and developers\' mailing list" > <syslog-ng(a)lists.balabit.hu> > > Betreff: Re: [syslog-ng] loop caused by syslog-ng filter > > > Hi Adam, > > > > syslog-ng does the right thing :-). > > > > It starts the program/script once and pipes on STDIN every > log-message > > which matches the filter. > > > > If your script is started, it will call mail and pipe > "Alert, priority 1" > > to its STDIN and then exits. syslog-ng sees this and > restarts it (version > > 2.0 or higher behave that way, see > > > <http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/ > ch09s02.html#reference_destination_program>). > > > > For you purpose this would be better: > > > > ---8<--- > > #!/bin/bash > > > > while read LINE; do > > cat <<-EOF | mail -s "High Priority Snort Alert" > Sub-Zero(a)xxx.de > > Alert, Priority 1 > > $LINE > > EOF > > done > > ---8<--- > > > > > > bye > > Chris > > > > > > > > -----Original Message----- > > > From: syslog-ng-bounces(a)lists.balabit.hu > > > [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of > Adam Richter > > > Sent: Thursday, March 20, 2008 9:23 AM > > > To: syslog-ng(a)lists.balabit.hu > > > Subject: [syslog-ng] loop caused by syslog-ng filter > > > > > > > > > Hi! > > > > > > First off, sorry for my poor english! > > > I have a problem with a loop caused by syslog-ng v. 2.0.8. I > > > have set up Snort as an IDS System. Snort writes its messages > > > in unified-format to /var/log/snort/snort.alert and > > > /var/log/snort/snort.log. There are two Barnyard processes > > > which read the unified files and convert it to messages that > > > syslog and MySQL understand. Syslog-ng writes the messages > > > to /var/log/auth.log. All this is working fine. Now, I want > > > to set up a filter for Priority 1 alerts. This alert should > > > be send to the Administrator. > > > > > > I used following filter for syslog-ng: > > > > > > source src {unix-stream("/dev/log"); internal();}; > > > destination email{program("/usr/local/bin/alert_mail.sh");}; > > > filter high {match("[Priority: 1]");}; > > > log {source(src);filter(high); destination(email);}; > > > > > > > > > The alert_mail.sh: > > > > > > #!/bin/sh > > > cat << EOF | mail -s "High Priority Snort Alert" Sub-Zero(a)xxx.de > > > Alert, Priority 1 > > > EOF > > > > > > > > > Then I use Nessus to cause some alerts with Priority 1. I can > > > see 4 alerts with the Priority 1 with BASE and in > /var/log/auth.log. > > > > > > Syslog-ng recognises the alert with Priority 1 and activates > > > the script /usr/local/bin/alert_mail.sh > > > > > > All this is working, but the script is restarted by syslog-ng > > > again an again. > > > > > > Extract from /var/log/messages: > > > > > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program > > > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > > > status='0' > > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination > > > program; cmdline='/usr/local/bin/alert_mail.sh ' > > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Closing log writer > > > fd; fd='11' > > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program > > > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > > > status='0' > > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination > > > program; cmdline='/usr/local/bin/alert_mail.sh ' > > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program > > > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > > > status='0' > > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination > > > program; cmdline='/usr/local/bin/alert_mail.sh ' > > > … > > > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program > > > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > > > status='256' > > > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Starting > > > destination program; cmdline='/usr/local/bin/alert_mail.sh ' > > > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program > > > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > > > status='256' > > > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Starting > > > destination program; cmdline='/usr/local/bin/alert_mail.sh ' > > > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program > > > exited, restarting; > > > > > > … > > > > > > > > > I get thousands of mails per minute till I stop syslog-ng. > > > > > > Output of /var/log/auth.log(so y see that syslog-ng writes > > > snort/barnyard messages correctly to auth.log): > > > > > > Mar 19 13:56:54 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > > > x86 NOOP [Classification: Executable code was detected] > > > [Priority: 1] {UDP} 172.25.1.152:4758 -> 172.28.100.10:137 > > > Mar 19 13:57:13 src@Sensor1 barnyard: [1:1446:8] SMTP vrfy > > > root [Classification: Attempted Information Leak] [Priority: > > > 2] {TCP} 172.25.1.152:1085 -> 172.28.100.10:25 > > > Mar 19 13:57:13 src@Sensor1 barnyard: [1:660:11] SMTP expn > > > root [Classification: Attempted Information Leak] [Priority: > > > 2] {TCP} 172.25.1.152:1085 -> 172.28.100.10:25 > > > Mar 19 13:57:22 src@Sensor1 barnyard: [1:12626:2] Snort Alert > > > [1:12626:0] [Classification: Decode of an RPC Query] > > > [Priority: 2] {UDP} 172.25.1.152:1146 -> 172.28.100.10:111 > > > Mar 19 13:57:22 src@Sensor1 barnyard: [1:585:9] RPC portmap > > > sadmind request UDP [Classification: Decode of an RPC Query] > > > [Priority: 2] {UDP} 172.25.1.152:1146 -> 172.28.100.10:111 > > > Mar 19 13:57:24 src@Sensor1 barnyard: [1:566:6] POLICY > > > PCAnywhere server response [Classification: Misc activity] > > > [Priority: 3] {UDP} 172.25.1.152:1155 -> 172.28.100.10:5632 > > > Mar 19 15:11:27 src@Sensor1 barnyard: [122:1:0] portscan: TCP > > > Portscan [Classification: Unknown] [Priority: 3] {PROTO255} > > > 172.25.1.152 -> 172.28.100.10 > > > Mar 19 15:11:58 src@Sensor1 barnyard: [1:1420:13] SNMP trap > > > tcp [Classification: Attempted Information Leak] [Priority: > > > 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:162 > > > Mar 19 15:11:58 src@Sensor1 barnyard: [1:1418:13] SNMP > > > request tcp [Classification: Attempted Information Leak] > > > [Priority: 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:161 > > > Mar 19 15:12:05 src@Sensor1 barnyard: [1:1421:13] SNMP > > > AgentX/tcp request [Classification: Attempted Information > > > Leak] [Priority: 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:705 > > > Mar 19 15:12:16 src@Sensor1 barnyard: [122:1:0] portscan: TCP > > > Portscan [Classification: Unknown] [Priority: 3] {PROTO255} > > > 172.25.1.152 -> 172.28.100.10 > > > Mar 19 15:12:19 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > > > x86 NOOP [Classification: Executable code was detected] > > > [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 > > > Mar 19 15:12:20 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > > > x86 NOOP [Classification: Executable code was detected] > > > [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 > > > Mar 19 15:12:22 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > > > x86 NOOP [Classification: Executable code was detected] > > > [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 > > > > > > > > > I think it has something in common with this topic: > > > > > > https://lists.balabit.hu/pipermail/syslog-ng/2006-October/009454.html > > > > Thanks in advance! > > > > Sub-Zero > > > > > > -- > > GMX startet ShortView.de. Hier findest Du Leute mit Deinen Interessen! > > Jetzt dabei sein: http://www.shortview.de/?mc=sv_ext_mf@gmx > > ______________________________________________________________ > > ________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > -- Psst! Geheimtipp: Online Games kostenlos spielen bei den GMX Free Games! http://games.entertainment.gmx.net/de/entertainment/games/free ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

4 10

migrate over to PCRE?
by Balazs Scheidler 04 Jul '08

04 Jul '08

Dear syslog-ng users, The following text was written on my blog, but I'm reposting it here for a wider audience to read: As of now the development of the generic rewrite feature has been completed in one of my private git repositories. The new code uses PCRE and I'm somewhat undecided how to move forward with PCRE. For those who might not know PCRE is an implementation of regular expressions and is an acronym for "Perl Compatible Regular Expressions". PCRE adds a lot more features and seems to perform better than its POSIX equivalent. So the situation is as follows: * various filters use POSIX regexps * rewrite uses PCRE This is not a very consistent combination, thus I'm planning to add PCRE support for filters too. The only question is whether it is needed to have two independent regexp styles in syslog-ng in the long run. If I decide that one of them is enough, then I'd deprecate POSIX style regexps in filters and wouldn't implement POSIX in rewrite rules. This combination would yield a syslog-ng that would give warnings when POSIX-style regular expressions are in use and in a forthcoming release I'd change the default regexp style to PCRE, and yet another syslog-ng release later, I'd phase out POSIX completely. If the decision is to keep them both in the long run, it would mean that I'd need to implement POSIX style regexps for rewrite rules as well. This would probably the least intrusive for users, but also a lot more work. Also, this would allow adding other filtering options like globbing or prefix search. What do you think? Is the addition of modular search algorithms worth it? -- Bazsi

3 3

NetScreen Statistics
by lists＠grounded.net 04 Jul '08

04 Jul '08

Anyone using syslog-ng to gather NetScreen log information? Specifically, I'd like to have real time information along with statistical information, analysis of the logs. I would guess some others are doing this. So far, I've not been able to send the logs to syslog-ng, perhaps it's using udp, I need to find more information. Mike

3 9

Re: [syslog-ng] Multi-line Logs
by jrhendri＠maine.rr.com 03 Jul '08

03 Jul '08

Hi, I have been following this thread somewhat. I am facing a similar problem with how to handle logs from OpenVMS OPCOM messages. They are also multi-line. We are having a fowarder written for the VMS side that will send these messages across (still looking at TVP v. UDP and whether or not to place syslog headers in the messages). The goal is to be able to (at minimum) retain them on the NG box (for log retention) and also forward them as-is to a remote system (for processing by a security operations center). Currently, one possibility we are considering is to send the messages as UDP without stripping out the newlines (essentially defining a terminal that will receive the messages, and tying this to an outbound UDP socket pointed at the NG logserver. If you have any thoughts/suggestions, I would appreciate hearing them. If not, I apologize for wasting bandwidth :-) Thanks!! Jim Hendrick GCFW, GCIA, GCIH, GCWN, GCUX jrhendri(a)maine.rr.com

2 1

Multi-line Logs
by Enigma 03 Jul '08

03 Jul '08

I have a host that sends mult-line messages (embedded newlines, not separate syslog messages) from what I can tell syslog-ng strips out all the newlines and replaces them with a space. Is there anyway to disable or modify (replace them with something else that can be easily s/// in post-processing) this functionality without changing the code and compiling from source? I have been through the syslog-ng manual and asked Mr. Google and I cannot find anything on this topic. Thanks...

2 4

weird "program name:" shortening to just "name:"
by Hari Sekhon 03 Jul '08

03 Jul '08

Hi, I've just noticed something very odd in syslog-ng. It shortens the program name without my consent. When I try something like this: logger -t 'Oracle Test Version' testing I get in the logs: Jul 3 10:37:08 hostname Version: testing so it has reduced 'Oracle Test Version' to just 'Version' without my permission... I've done this same test on another server using the classic version of syslog and it works as expected: Jul 3 10:49:06 hostname2 Oracle Test Version: testing I have verified this looks broken across 2 syslog-ng servers and my workstation, but I have no idea why. Does syslog-ng have some specific reason for mangling this? Is there a workaround? (other than just changing to Oracle_Test_Version which I have verified works since it's one word) -h -- Hari Sekhon

3 2

Re: [syslog-ng] syslog-ng-2.1beta1 on NetBSD 3.0, duplicate suppression docs?
by chris packham 02 Jul '08

02 Jul '08

Hi Ed, On Tue, 2008-07-01 at 18:19 -0400, Ed Ravin wrote: > 4) I'm looking for info on how to use the duplicate suppression > option - it doesn't seem to be in the docs included in the source. > Can someone give me a quick summary? This was (IMHO) the only > extant flaw in syslog-ng and I'm looking forward to trying it out! You just need to add suppress(<seconds>) to your destination config. e.g. to suppress duplicate messages that occur within 60 seconds destination d_file { file("/var/log/messages" template(t_logfile) suppress(60)); };

1 0

Latest RHEL5 build doesn't contains fix for PID
by Kostyantyn Gushtin 01 Jul '08

01 Jul '08

Hi, I just download and try latest build 2.1beta2 (syslog-ng-2.1beta1-1.i386.rpm , libdbi8-0.8.2bb2-2.i386.rpm). But I have the same problem with PID macro as before, it contains non valid integer values(some text). I try syslog-ng rpm's for RHEL5. -- Kostyantyn Gushtin Software engineer N-iX LLC Solutions for Your success http://www.n-ix.com

2 3

logging facility in log file
by Jing CDL Sun 30 Jun '08

30 Jun '08

Hi, ALL I am using syslog-ng to do remote logging for facility of "local6" and priority of "warn", the log server is Linux system(SLES10 SP1), it works well with the message content, only one problem is the keyword of "local6" is not logged in the log file, please see the details below: on c890mgrs4(Linux) Jun 25 20:53:34 c890f12ec07 root: sunjing test 1 Jun 25 20:53:38 c890f12ec07 root: sunjing test 2 I did the same thing on AIX log server, while it could log the keyword of "local6" in log file: on c890mgrs3(AIX) Jun 25 20:53:34 c890f12ec07 local6:warn|warning c890f12ec07 root: sunjing test 1 Jun 25 20:53:38 c890f12ec07 local6:warn|warning c890f12ec07 root: sunjing test 2 So I am guessing that I did not enable this facility logging in syslog-ng, maybe syslog-ng has a certain configuration that could let the "facility" logged in message file, am I right? or could you point me to the correct method? I need this "facility" information to develop my applications. Thank you. Best Regards, ----------------------------- Sun Jing(孙靖) IBM China Software Development Laboratory Tel: (86-10) 82453625 E-mail: sjing(a)cn.ibm.com Address:5F Deshi Building No.9 Shangdi East Road Haidian District,Beijing City P.R.China 100085, P.R.China.

4 6

syslog-ng 2.1beta2 has been released
by devel＠balabit.hu 30 Jun '08

30 Jun '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.1beta2 SUMMARY : new stable release DATE : Jun 30, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.1beta2) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1beta2 Fri, 13 Jun 2008 14:37:08 +0200 Bugfixes: * Create /var/lib/syslog-ng directory from RPM packages. * Fixed a 100% CPU usage problem triggered by the pipe() destination. This is a regression in 2.1beta1 and does not affect earlier versions. * Removed test code that injected "Connection timed out" errors into local file writes. * Set the current directory to the root once syslog-ng daemonized itself. * Fixed the $PID macro to only extract information from the syslog message header and not from the message contents. Other changes: * Instead of using O_APPEND for file writes, add an lseek before writing which performs much better with the NFS client in BSD kernels. * Added support for suppressing duplicate messages. This feature was contributed by Chris Packham. * The default linking mode is changed to dynamic linking, as static linking is more difficult for users to cope with. Those who use NFS mounted /usr on machines where syslog-ng runs on will probably need to explicitly ask for the previous behaviour. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.1 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.1 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.1 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.1 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.1 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/

1 0

syslog-ng suddenly stops logging
by Richard Vigeant 30 Jun '08

30 Jun '08

Hi, I have a configuration where several nodes send all log messages to a central server. The applications on remote nodes send their logs locally either via UDP or a unix socket. The syslog-ng running on remote nodes simply pick up all log messages from all sources, i.e. TCP, UDP, /proc/kmsg, /dev/log and internal, and transmit all messages to the central server uisng TCP. The remote node's config file follows. We've been having intermittent problems where the central server would suddenly stop logging messages from certain nodes. We noticed that very often restarting syslog-ng on the central server would fix the condition and logging would carry on. Howver I discovered a new rare case where restarting the central syslog-ng didn't work. I found out by doing a tcpdump that the remote syslog-ng was not sending the log messages. I have done an strace on the remote syslog-ng and it shows that nothing happens after a message has been "recvfrom()" or "read()". Then I have restarted syslog-ng and things went back to normal. In the 2nd strace we can see that there is a "write()" after the "read()". I'm using syslog-ng 2.0.9. ********************* Remote node's Config file: ********************* options { chain_hostnames(no); log_msg_size(8192); log_fifo_size(50000); log_iw_size(250); log_fetch_limit(25); flush_lines(10); flush_timeout(10); }; source local { pipe("/proc/kmsg"); unix-stream("/dev/log" max-connections(50)); internal(); }; source network { udp(localport(514)); tcp(localport(514)); }; destination spotxdeoam { tcp("spotxdeoam" destport(514)); }; destination local { tcp("localhost" destport(514)); }; # To change the local log path for modules, change the following statement. destination local_Modules { file("/opt/spotxde/software/var/SPOTxdeServer/logs/$HOST/$PROGRAM/ messages" create_dirs(yes) template("$FULLDATE, $HOST, $MSG\n") template_escape(no)); }; # To change the local log path for node, change the following statement. destination local_Nodes { file("/opt/spotxde/software/var/SPOTxdeServer/logs/$HOST/messages" create_dirs(yes) template("$FULLDATE, $HOST, $MSG\n") template_escape(no)); }; filter Modules { program("^OAM") or program("^TRX") or program("^VA1") or [root@c15 Rich]# more /opt/spotxde/software/etc/syslog_ng/syslog- ng_trx.conf options { chain_hostnames(no); log_msg_size(8192); log_fifo_size(50000); log_iw_size(250); log_fetch_limit(25); flush_lines(10); flush_timeout(10); }; source local { pipe("/proc/kmsg"); unix-stream("/dev/log" max-connections(50)); internal(); }; source network { udp(localport(514)); tcp(localport(514)); }; destination spotxdeoam { tcp("spotxdeoam" destport(514)); }; destination local { tcp("localhost" destport(514)); }; # To change the local log path for modules, change the following statement. destination local_Modules { file("/opt/spotxde/software/var/SPOTxdeServer/logs/$HOST/$PROGRAM/ messages" create_dirs(yes) template("$FULLDATE, $HOST, $MSG\n") template_escape(no)); }; # To change the local log path for node, change the following statement. destination local_Nodes { file("/opt/spotxde/software/var/SPOTxdeServer/logs/$HOST/messages" create_dirs(yes) template("$FULLDATE, $HOST, $MSG\n") template_escape(no)); }; filter Modules { program("^OAM") or program("^TRX") or program("^VA1") or program("^VA2") or program("^VA3") or program("^VA4") or program("^MM1") or program("^MM3") or program("^MM4") or program("^MM7") or program("^WAP") or program("^STI") or program("^HCA") or program("^RPT") or program("^PRF") or program("^SVW") or program("^MNG") or program("^CDR") or program("^EAIF") or program("^TEST") or program("^MMSC") or program("^SSMA") or program("^SMTP") or program("^ICAP") or program("^BIDA") or program("^SMPP") or program("^LTRX") or program("^MCDN") or program("^RMSS") or program("^EPGS"); }; log { source(local); source(network); filter(Modules); destination(spotxdeoam); # Remove the comment on the next statement to log locally on the TRX nodes the Modules related logs # destination(local_Modules); flags(final); }; log { source(local); source(network); destination(spotxdeoam); # Remove the comment on the next statement to log locally on the TRX nodes the Node relatedlogs # destination(local_Nodes); flags(fallback); }; ********************* ********************* Following is an strace of syslog-ng that doesn't work. There were 2 attemps in this one: one using UDP and on using Unix socket. ********************* [root@c15 Rich]# strace -p 8259 Process 8259 attached - interrupt to quit gettimeofday({1213891616, 539195}, NULL) = 0 gettimeofday({1213891616, 539246}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 22650) = 0 gettimeofday({1213891639, 190435}, NULL) = 0 time(NULL) = 1213891639 time(NULL) = 1213891639 gettimeofday({1213891639, 190507}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891669, 191715}, NULL) = 0 time(NULL) = 1213891669 time(NULL) = 1213891669 gettimeofday({1213891669, 191778}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 8, 30000) = 1 gettimeofday({1213891676, 326051}, NULL) = 0 recvfrom(3, "<30>Jun 19 12:07:56 RMSS: /syslo"..., 8192, 0, {sa_family=AF_INET, sin_port=htons(39166), sin_addr=inet_addr("127.0.0.1")}, [16]) = 100 gettimeofday({1213891676, 326294}, NULL) = 0 time(NULL) = 1213891676 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1252, ...}) = 0 time(NULL) = 1213891676 gettimeofday({1213891676, 326621}, NULL) = 0 recvfrom(3, 0x8131ef8, 8192, 0, 0xffffd560, 0xffffd55c) = -1 EAGAIN (Resource temporarily unavailable) gettimeofday({1213891676, 326794}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 22865) = 0 gettimeofday({1213891699, 193074}, NULL) = 0 time(NULL) = 1213891699 time(NULL) = 1213891699 gettimeofday({1213891699, 193277}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891729, 195368}, NULL) = 0 time(NULL) = 1213891729 time(NULL) = 1213891729 gettimeofday({1213891729, 195569}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891759, 196643}, NULL) = 0 time(NULL) = 1213891759 time(NULL) = 1213891759 gettimeofday({1213891759, 196842}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891789, 197931}, NULL) = 0 time(NULL) = 1213891789 time(NULL) = 1213891789 gettimeofday({1213891789, 198129}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891819, 199219}, NULL) = 0 time(NULL) = 1213891819 time(NULL) = 1213891819 gettimeofday({1213891819, 199421}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891849, 200510}, NULL) = 0 time(NULL) = 1213891849 time(NULL) = 1213891849 gettimeofday({1213891849, 200707}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN, revents=POLLIN}, {fd=3, events=POLLIN}], 8, 30000) = 1 gettimeofday({1213891867, 753947}, NULL) = 0 accept(6, {sa_family=AF_FILE, path = "??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????"}, [2 ]) = 11 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [0], 4) = 0 fcntl64(11, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(11, F_SETFL, O_RDWR|O_NONBLOCK) = 0 fcntl64(11, F_GETFD) = 0 fcntl64(11, F_SETFD, FD_CLOEXEC) = 0 brk(0) = 0x8ae1000 brk(0x8b02000) = 0x8b02000 gettimeofday({1213891867, 754658}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}, {fd=11, events=POLLIN, revents=POLLIN|POLLHUP}, {fd=6, events=POLLIN}], 9, 11446) = 1 gettimeofday({1213891867, 754830}, NULL) = 0 read(11, "<30>Jun 19 12:11:07 RMSS: /syslo"..., 8192) = 100 gettimeofday({1213891867, 755001}, NULL) = 0 time(NULL) = 1213891867 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1252, ...}) = 0 gettimeofday({1213891867, 755271}, NULL) = 0 read(11, "", 8192) = 0 close(11) = 0 gettimeofday({1213891867, 755520}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}], 8, 11445) = 0 gettimeofday({1213891879, 201791}, NULL) = 0 time(NULL) = 1213891879 time(NULL) = 1213891879 gettimeofday({1213891879, 201987}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891909, 203098}, NULL) = 0 time(NULL) = 1213891909 time(NULL) = 1213891909 gettimeofday({1213891909, 203299}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891939, 205377}, NULL) = 0 time(NULL) = 1213891939 time(NULL) = 1213891939 gettimeofday({1213891939, 205580}, NULL) = 0 poll( ******************* And now the strace sequence when it works: We can see that after the read there is a write to transmit the message to the central log server. ******************* [root@c15 Rich]# strace -p 15310 Process 15310 attached - interrupt to quit gettimeofday({1213900598, 12321}, NULL) = 0 gettimeofday({1213900598, 12361}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN}, {fd=5, events=POLLIN}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 7, 2069) = 0 gettimeofday({1213900600, 83036}, NULL) = 0 time(NULL) = 1213900600 time(NULL) = 1213900600 gettimeofday({1213900600, 83101}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN}, {fd=5, events=POLLIN}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=6, events=POLLIN, revents=POLLIN}, {fd=3, events=POLLIN}], 7, 30000) = 1 gettimeofday({1213900610, 338336}, NULL) = 0 accept(6, {sa_family=AF_FILE, path=@}, [2]) = 10 setsockopt(10, SOL_SOCKET, SO_KEEPALIVE, [0], 4) = 0 fcntl64(10, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(10, F_SETFL, O_RDWR|O_NONBLOCK) = 0 fcntl64(10, F_GETFD) = 0 fcntl64(10, F_SETFD, FD_CLOEXEC) = 0 gettimeofday({1213900610, 338937}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN}, {fd=5, events=POLLIN}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}, {fd=10, events=POLLIN, revents=POLLIN|POLLHUP}, {fd=6, events=POLLIN}], 8, 19745) = 1 gettimeofday({1213900610, 339123}, NULL) = 0 read(10, "<30>Jun 19 14:36:50 RMSS: /syslo"..., 8192) = 100 gettimeofday({1213900610, 339320}, NULL) = 0 time(NULL) = 1213900610 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1252, ...}) = 0 gettimeofday({1213900610, 339627}, NULL) = 0 read(10, "", 8192) = 0 close(10) = 0 gettimeofday({1213900610, 339888}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN}, {fd=5, events=POLLIN}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}], 7, 10) = 0 gettimeofday({1213900610, 351199}, NULL) = 0 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1252, ...}) = 0 write(8, "<30>Jun 19 14:36:50 c15 RMSS: /s"..., 103) = 103 gettimeofday({1213900610, 351494}, NULL) = 0 poll( <unfinished ...> Process 15310 detached Richard Vigeant www.vantrix.com

2 5

Problem in source file driver
by 広瀬真作 30 Jun '08

30 Jun '08

Hello all, I use syslog-ng 2.0.9. I am troubled in how to use the source file driver. The trouble is that a log message is output in duplicate after syslog-ng restart. I made following syslog-ng.conf. ------------------------------------------------------------ options { long_hostnames(off); sync(0); stats(0); time_reopen(10); dir_perm(0755); perm(0644); }; source s_test1 { internal(); file("/tmp/test_app_log" follow_freq(1) flags(no-parse) keep_timestamp(no)); }; destination d_test1 { file("/var/log/test.log"); }; log { source(s_test1); destination(d_test1); }; ------------------------------------------------------------ Next I tested syslog-ng action with following operation. ------------------------------------------------------------ # echo "test message `date`" >> /tmp/test_app_log # cat /var/log/test.log Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:54 testserv2 test message Mon Jun 30 10:58:53 JST 2008 # /etc/init.d/syslog-ng restart Stopping syslog-ng: [ OK ] Starting syslog-ng: [ OK ] # cat /var/log/test.log Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:54 testserv2 test message Mon Jun 30 10:58:53 JST 2008 Jun 30 10:59:05 testserv2 syslog-ng[17216]: Termination requested via signal, terminating; Jun 30 10:59:05 testserv2 syslog-ng[17216]: syslog-ng shutting down; version='2.0.9' Jun 30 10:59:05 testserv2 syslog-ng[17292]: syslog-ng starting up; version='2.0.9' Jun 30 10:59:05 testserv2 test message Mon Jun 30 10:58:53 JST 2008 ------------------------------------------------------------ The message "testserv2 test message Mon Jun 30 10:58:53 JST 2008" was output in duplicate after syslog-ng retart. I hope the message is not output in duplicate after syslog-ng restart. Is my hope readily achievable? Please advise me.

2 2

clearing /var/log/syslog file - its becoming bigger
by janskey 28 Jun '08

28 Jun '08

Hi Guys, I installed syslog-ng and php-syslog-ng. As what I know, php-syslog-ng will get all logs files in /varlog/syslog file to mysql db. Is it possible to clear /var/log/syslog file because its getting bigger? Since all logs are been copied to the db, is it safe to clear syslog? Is this possible? Thanks! cheers, janskey

1 0

Syslog-ng and Switch Catalyst Cisco 3750
by Rodrigo Fernandes 27 Jun '08

27 Jun '08

Hello all, I´d like to know how to config my switch Catalyst 3750 to log messages into my syslog-ng server. My syslog-ng is working fine with other clients. This switch work with the facility local6, or local7 in syslog-ng. The switch is logging only this line in my syslog-ng: Jun 26 01:54:29 xx.xx.xx.xx 53: 000053: 1d09h: %SYS-5-CONFIG_I: Configured from console by vty0 (xxx.xxx.xxx.xxx). I need to receive more information about this switch. Somebody help me in this issue? Thanks a lot, Rodrigo

2 1

problem in remote logging
by Gemi 27 Jun '08

27 Jun '08

Hi, I am facing problem in remote logging though is working very fine locally. please advise me what to do and where I am missing something. the details I am giving below. I have one target linux system (set top box) and one host Linux Desktop Machine. the syslogd and logging working fine on both target as well as on PC(host) machine individually . I have scenario, I have to run program on target machine. And I have to collect the log on PC(host) console as well as in some file say /tmp/log. I have started $syslogd -r on both the machines. the syslog.conf file on the machines are like this. target >> syslong.conf local0.* @ip.address (PC-Host machine) PC(host) >> syslog.conf local0.err /dev/console local0.* /tmp/log in process list syslogd shows like "syslogd -r" I have already run many times $ kill -SIGHUP /var/run/syslog.pid on both machine. even though it is not working -Gemi _________________________________________________________________ Post free property ads on Yello Classifieds now! www.yello.in http://ss1.richmedia.in/recurl.asp?pid=219

2 1

Problem in remote logging
by Gemi 27 Jun '08

27 Jun '08

Hi, I am facing problem in remote logging though is working very fine locally. please advise me what to do and where I am missing something. the details I am giving below. I have one target linux system (set top box) and one host Linux Desktop Machine. the syslogd and logging working fine on both target as well as on PC(host) machine individually . I have scenario, I have to run program on target machine. And I have to collect the log on PC(host) console as well as in some file say /tmp/log. I have started $syslogd -r on both the machines. the syslog.conf file on the machines are like this. target >> syslong.conf local0.* @ip.address PC(host) >> syslog.conf local0.err /dev/console local0.* /tmp/log in process list syslogd shows like "syslogd -r" I have already run many times $ kill -SIGHUP /var/run/syslog.pid on both machine. even though it is not working -Gemi _________________________________________________________________ Tried the new MSN Messenger? It’s cool! Download now. http://messenger.msn.com/Download/Default.aspx?mkt=en-in

1 0

Logging timezone info in each message for V 1.6.8
by Manju Ramanathpura (mramanat) 26 Jun '08

26 Jun '08

Hello, Wondering if there is a way to print timezone with each message in the Version 1.6.8 ? Currently my message looks something like below Jan 21 12:22:12 <rest of the message> Instead I would like to see something like below Jan 21 12:22:12 PDT 2008 <rest of the message> or something in that line where I can see the timezone info. I have come across some timezone handling documents from - http://www.syslog.org/syslog-ng/v2/#timezone_handling But only for the Version 2.x and not for version 1.6.X I'd appreciate if you can share any tips for printing timezone ( or perhaps ISO format timestamp ) in each message for V 1.6.8 Thanks, -Manju

2 1

suitability of syslog-ng with long messages
by Joe Shaw 24 Jun '08

24 Jun '08

Hi, I am working on a project in which we will have many gigabytes of data logged per day. The log producers themselves were mostly developed in house and presently are simply logging to a file, but as we build out the system we'll obviously need some centralization. I've been thinking about using syslog-ng for this. While most of the messages are relatively small -- on the order of hundreds of bytes or a couple kilobytes -- there are some exceptional cases where we are generating messages that could be as large as two megabytes and need these to be kept in tact. We'll be using the tcp() destination driver. Are there any performance considerations, gotchas, etc. in setting log_msg_size(2097152)? Would that have a bad interaction memory usage-wise, for example, with log_fifo_size() if it were set to 1000? I am trying to get a feel if syslog-ng is the right tool for the problem here, or if something else would be more suitable. Thanks for any info you can provide, Joe

2 3

Help on syslog-ng
by FELLMANN Eric (EXT) 20 Jun '08

20 Jun '08

Hello, I have install syslog-ng on solaris 10(machine A],it configured as log proxy server more /etc/syslog-ng/syslog-ng.conf options { chain_hostnames(no); keep_hostname(yes); use_fqdn(yes); log_fifo_size(1000); }; source local { sun-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; filter notdebug { level(info...emerg); }; destination ercmas13.eurocontrol.fr{ udp("ercmas13.eurocontrol.fr" port (514)); }; log { source(local); filter (notdebug); destination(ercmas13.eurocontrol.fr); }; A client (Machine C) on solaris 10 send logs on (Machine A) I say the log on ercmas13 (logs server) A client (Machine B) on redhat 4 send log on (Machine B) I have nothing on the log server I change this information in this files syslog-ng.conf on log proxy server Each possible communication mechanism has a corresponding source driver in syslog-ng. For example, to open a unix socket with SOCK_DGRAM style communication use the driver unix-dgram. The same socket using the SOCK_STREAM style - as used under Linux - is called unix-stream. source local { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; But when i restart le syslog-ng on log proxy server /etc/init.d/syslog-ng start syslog-ng service starting. Error binding socket; addr='AF_UNIX(/dev/log)', error='Address already in use (125)' Error initializing source driver; source='local' What is the problem ? Best regards Eric FELLMANN ____ This message and any files transmitted with it are legally privileged and intended for the sole use of the individual(s) or entity to whom they are addressed. If you are not the intended recipient, please notify the sender by reply and delete the message and any attachments from your system. Any unauthorised use or disclosure of the content of this message is strictly prohibited and may be unlawful. Nothing in this e-mail message amounts to a contractual or legal commitment on the part of EUROCONTROL, unless it is confirmed by appropriately signed hard copy. Any views expressed in this message are those of the sender.

2 1

Syslog-ng on Mac OS X Leopard 10.5.3
by James Lay 19 Jun '08

19 Jun '08

Hey all! Been trying like crazy just to get a simple setup going and I am having a REALLY tough time. Just to test I¹m wanting to make it easy and have EVERYTHING log to /var/log/messages (my line in syslog.conf is ³*.* /var/log/messages² which works quite well). I¹ve gone through and looked online and found one example for OS X ( http://sial.org/howto/logging/syslog-ng/) but it¹s not working..I don¹t get anything in my log files. Can any kind soul help me out here? Thank you. James

2 1