- syslog-ng - lists.balabit.hu

Re: Distributed syslog architecture
by G.W. Haywood 26 May '07

26 May '07

Hi there, On Sat, 26 May 2007 Balazs Scheidler wrote: > On Fri, 2007-05-25 at 01:25 -0700, Tom Le wrote: > > > There are commercial tools you can consider as well but cost is very > > high for this type of distributed architecture (several hundred > > thousand dollars USD) > > > > Can you elaborate on these tools? I would be interested even in private, > if you think it is too off-topic here. FWIW I do't think this is off-topic. :) -- 73, Ged.

1 0

undefined reference to `libnet_init'
by Tim Boyer 25 May '07

25 May '07

I'm doing my first install on a RHEL5 virtual machine. I've successfully installed syslog-ng on RHEL3, 4, and 5 before, and have a fairly detailed idea of what I need to do - install libnet; whoops, need eventlog first; install that, install syslog-ng-2.0.3. It worked fine on the xen host. On the xen client, I get: gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/lib64 -lglib-2.0 -L/usr/local/lib -levtlog -lwrap -Wl,-Bdynamic libsyslog-ng.a(afinet.o): In function `afinet_dd_construct_ipv6_packet': /usr/src/syslog-ng-2.0.3/src/afinet.c:420: undefined reference to `libnet_clear_packet' /usr/src/syslog-ng-2.0.3/src/afinet.c:422: undefined reference to `libnet_build_udp' /usr/src/syslog-ng-2.0.3/src/afinet.c:436: undefined reference to `libnet_toggle_checksum' /usr/src/syslog-ng-2.0.3/src/afinet.c:438: undefined reference to `libnet_build_ipv6' libsyslog-ng.a(afinet.o): In function `afinet_dd_queue': /usr/src/syslog-ng-2.0.3/src/afinet.c:487: undefined reference to `libnet_write' libsyslog-ng.a(afinet.o): In function `afinet_dd_construct_ipv4_packet': /usr/src/syslog-ng-2.0.3/src/afinet.c:358: undefined reference to `libnet_clear_packet' /usr/src/syslog-ng-2.0.3/src/afinet.c:360: undefined reference to `libnet_build_udp' /usr/src/syslog-ng-2.0.3/src/afinet.c:371: undefined reference to `libnet_build_ipv4' libsyslog-ng.a(afinet.o): In function `afinet_dd_queue': /usr/src/syslog-ng-2.0.3/src/afinet.c:499: undefined reference to `libnet_geterror' libsyslog-ng.a(afinet.o): In function `afinet_dd_init': /usr/src/syslog-ng-2.0.3/src/afinet.c:332: undefined reference to `libnet_init' I've got no idea where to start looking for these - can anyone tell me what I'm missing? Thanks much, -- Tim Boyer Director IT and Engineering Projects Denman Tire Corporation

2 6

Limit filesize
by janth＠moldung.no 25 May '07

25 May '07

Hello, Is it possible to limit the size of each logfile when using the destinatin shown under? destination dst { file("/syslog/logs/$R_YEAR/$R_MONTH/$R_DAY/$HOST" ); }; I.e. destination dst { file("/syslog/logs/$R_YEAR/$R_MONTH/$R_DAY/$HOST" maxsize(5g) ); }; That way no single host could log more than 5g, and if /syslog/logs is a single filesystem, the risk of loosing logs from other hosts is minimized if a hoss logging too much or trying to ddos syslog-ng-loghost. Of course syslog-ng should log internally if the limit is reached and logging for host is stopped. -- Jan Thomas Moldung

3 2

logging from Cisco
by Grigoreva, Yelena 24 May '07

24 May '07

Hallo, I have enabled Cisco logging to my host SUSE 10.2. From the Wireshark tool I can see that I become the syslog messages and then I try to find them somewhere in /var/log/.... but w/t success. ;( Where are the syslog messages logged from external HW? I have set in my sysconf SYSLOGD_PARAMS="-rx -m 0" to enable external logging, but all the same-no effect.I have created local0, cisco files: I am not sure what file name should I give? where must it be specified? I will be grateful for any tip :) warm regards Yelena

7 11

Syslog-ng remove logs
by lukasz_bryl＠o2.pl 23 May '07

23 May '07

Can anybody tell me the thing: Is it possible in syslog-ng to remove set logs? If so, please explain me how to do that. Thanks in advance. LukB

1 0

Don't log process PID or timestamp
by Martin Stabenfeldt 23 May '07

23 May '07

Hi, I'm running syslog-ng on my log-server. I don't want it to include the PID, timestamp or hostname in the log it captures. Is it possible to strip this on the server-side, or must this be done on the client that sends the syslog messages? use Net::Syslog; my $s=new Net::Syslog(Facility=>'local1',Priority=>'info',SyslogHost=>'loghost.com'); $s->send('see this in syslog',Priority=>'info'); Generates: May 16 10:15:06 webserver apache-syslogger.pl[14490]: see this in syslog I only want to see "see this in syslog". All advice is highly appreciated! :) -- Martin Stabenfeldt

1 0

RE: [syslog-ng] ArcSight Server As Destination?
by Ivey, Chris 22 May '07

22 May '07

As I was discussing this issue with a colleague this AM, the question arose as to whether or not the restamping of messages from syslog-ng can be turned on and off for selected destinations, or if that was a global option. Anyone know? Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Tom Le Sent: Friday, May 18, 2007 12:09 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] ArcSight Server As Destination? Arcsight requires a specific format, but that is not say it is incompatible with syslog forwarding. They just need to give you the config options that they support for a forwarded syslog message. On 5/18/07, Ivey, Chris <Chris.ivey(a)acs-inc.com> wrote: > Many thanks to those of you who responded to this question already. I have > decided to "raise the B.S. flag" with ArcSight on this one. The more I talk > to the person here who is acting as the middle-man between myself and > ArcSight, the more I think that ArcSight has an issue on their side. I will > more than likely be re-posting after talking directly to ArcSight next week. > Thanks all! > > Chris Ivey > > Affiliated Computer Services > Enterprise Management Integration Services > Infrastructure Management Senior Analyst > > chris.ivey(a)acs-inc.com > > "I have not failed, I have simply found 10,000 ways which do not work!" -- > Thomas Edison > "When you find yourself in a hole, the best thing to do is stop digging!" -- > Nick Stokes > "I reject your reality, and substitute my own!" -- Adam Savage > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler > Sent: Thursday, May 17, 2007 3:45 PM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] ArcSight Server As Destination? > > On Thu, 2007-05-17 at 08:38 -0700, Evan Rempel wrote: > > Balazs Scheidler wrote: > > > Syslog-ng forwards messages in the same > > > format as it receives it, it does not prepend headers, only replaces > > > values if it is configured to do so. > > > > Really? My experience is one where syslong-ng receives a syslog message > that does NOT > > contain a timestamp, and syslog-ng forwards it with a timestamp because > the receiver > > portion of syslog-ng has added a timestamp. > > I meant that syslog messages are forwarded as syslog messages. If your > incoming messages lack a header, then those are not syslog messages. > > You can remove outgoing headers by using a custom template and not > adding the $DATE and $HOST portions. > > You can also prevent syslog-ng to try to parse a message as syslog > message by using the flags(no-parse) option for the source. > > -- > Bazsi > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

syslog-ng 2.0.4 has been released
by Balazs Scheidler 19 May '07

19 May '07

Dear syslog-ng users, A new stable version of syslog-ng has been released. The list of user-visible changes are summarized below. For more information, visit our just-updated website at http://www.balabit.com/products/syslog-ng/ 2.0.4 Mon, 14 May 2007 11:47:48 +0200 IMPORTANT NOTES: * This version of syslog-ng fixes a bug in enforcing the max-connections() limit for various stream-like sources (unix-stream and tcp). Previously this limit was not enforced, thus production environments may use an inadequate value. Validate your max-connection() settings before upgrading and check your logs for rejected connections. Bugfixes: * Fixed configuration parsing of the localport() and port() parameters. * Fixed template_escape() for non-ASCII characters. * Fixed facility() filter evaluation problems. * Fixed a possible segmentation fault during shutdown, when pending messages were still present in the destination queue of a flow-controlled destination. * Fixed sign of timezone when parsed from the configuration file. * Fixed counting the number of established connections, the value used when comparing against the max-connections() parameter. Features: * Added support for rotated source files. * Added support for perl-like regexp flags to make it possible to specify case-insensitive regular expressions. -- Bazsi

2 1

RE: [syslog-ng] ArcSight Server As Destination?
by Ivey, Chris 18 May '07

18 May '07

Many thanks to those of you who responded to this question already. I have decided to "raise the B.S. flag" with ArcSight on this one. The more I talk to the person here who is acting as the middle-man between myself and ArcSight, the more I think that ArcSight has an issue on their side. I will more than likely be re-posting after talking directly to ArcSight next week. Thanks all! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Thursday, May 17, 2007 3:45 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] ArcSight Server As Destination? On Thu, 2007-05-17 at 08:38 -0700, Evan Rempel wrote: > Balazs Scheidler wrote: > > Syslog-ng forwards messages in the same > > format as it receives it, it does not prepend headers, only replaces > > values if it is configured to do so. > > Really? My experience is one where syslong-ng receives a syslog message that does NOT > contain a timestamp, and syslog-ng forwards it with a timestamp because the receiver > portion of syslog-ng has added a timestamp. I meant that syslog messages are forwarded as syslog messages. If your incoming messages lack a header, then those are not syslog messages. You can remove outgoing headers by using a custom template and not adding the $DATE and $HOST portions. You can also prevent syslog-ng to try to parse a message as syslog message by using the flags(no-parse) option for the source. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Duplicate Host paths for destination
by William B Carlson 17 May '07

17 May '07

Running syslog-ng 1.6.12 on Fedora 6 (2.6.20-1.2933.fc6) I'm running into a weird problem that I can't seem to figure out. When my logs from syslog-ng write out the $FULLHOST path seems to repeat itself by nesting another level. So instead of getting what I want: /var/log/syslog-ng/server.msu.edu I get: /var/log/syslog-ng/server.msu.edu/server.msu.edu Not sure what is going on here, I've included my configuration which is pretty simple. Thanks for any assistance to this, I'm sure I overlooked something so very simple. Ben Carlson options { sync (20); log_fifo_size (1000); perm (0600); dir_perm (0755); check_hostname (yes); keep_hostname (yes); use_fqdn (yes); use_dns (yes); dns_cache (yes); dns_cache_size (1000); dns_cache_expire (43200); }; source s_internal { internal(); }; source s_network { tcp(max-connections(5000)); udp(); }; destination d_internal { file( "/var/log/syslog-ng/syslog-ng.log" owner(daemon) group(bin) perm(0600) dir_perm(0755) create_dirs(yes) ); }; destination d_general { file( "/var/log/syslog-ng/$FULLHOST/$FACILITY.$YEAR-$MONTH-$DAY.log" owner(daemon) group(bin) perm(0600) dir_perm(0755) create_dirs(yes) ); }; log { source(s_internal); destination(d_internal); flags(final); }; log { source(s_network); destination(d_general); };

2 1

ArcSight Server As Destination?
by Ivey, Chris 17 May '07

17 May '07

Folks, Does anyone have any experience with using syslog-ng to forward messages along to an ArcSight server? I set it up for a support group here, but apparently they are having issues. Per ArcSight support: <quote> "I looked over the information you had uploaded already, and is actually a common issue. When syslog events are forwarded from one syslog server to another syslog server, or pipe, or file, the forwarding syslog server prepends timestamp and other information, which makes the message unusable. We require syslog message to adhere to the standard RFC syslog format for the connector to read them, and when forwarding syslog messages that is not the case and we are unable to support that configuration." </quote> Does anyone have any insight they can share with me for this issue? The group is now asking that I install their agent on my server, which I am VERY loath to do since the box is about at it's limit as it is. Thanks all! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

4 4

Re: syslog server and windows
by Alejandro Sierra 15 May '07

15 May '07

Hi, 2 Options for sending eventviewer events to a syslog-ng server Lasso (http://www.loglogic.com/logforge/) supports TCP and I have proved it with syslog-ng with good results. You can choose the log (Application, System, Security), the polling interval, .. NTSyslog( http://ntsyslog.sourceforge.net/) another option that uses UDP, that makes better use of the syslog protocol(facility, severity). PD: Sorry for my english. > Hello list, > > I have mounted a syslog-ng server and I need to also send data to it > from Windows servers. Said log's of Windows they would have to be of > eventlog, ISS, exchange, etc. Some program that do it? I proved epiloj > (snare) but it does not serve to me. > > Thanks for all. > > -- > Power by Debian. > > A greeting, > > Javier. >

1 0

syslog-ng 2.0.0 and "-- MARK --" messages
by Mick Ohrberg 15 May '07

15 May '07

Hello! I'm wondering about the MARK messages that show up in my logs. While I have deduced that the default value is 1200 seconds, I can't seem to turn it off. Adding a "mark(86400);" stanza gets me a syntax error that the mark() keyword isn't valid. Am I missing something very basic here, or is there more to this? Thank you in advance. -- A: Because it's counterintuitive to the way we read. Q: Why is top-posting bad?

2 2

syslog server and windows
by Javier Terceiro 15 May '07

15 May '07

Hello list, I have mounted a syslog-ng server and I need to also send data to it from Windows servers. Said log's of Windows they would have to be of eventlog, ISS, exchange, etc. Some program that do it? I proved epiloj (snare) but it does not serve to me. Thanks for all. -- Power by Debian. A greeting, Javier.

1 0

Logging a file to another syslog-ng server for indexing
by Corey Bobb 14 May '07

14 May '07

Sorry about the reply when I should have created a new msg. Hello all, I am trying to add a specific file for syslog to pickup and log remotely but have been unable to make it work. The file I am trying to get over to another syslog-ng server is an audit log. What has to happen is from 1 server the log file gets read/moved over to the other Log server . . .which will then be indexed by splunk. I am learning syslog-ng and am not sure exactly how to make what I am trying to do work. If anyone has any ideas or suggestions please drop me a note! Thanks cygnus_logo Corey M. Bobb System Administrator 850 South Concourse Parkway Maitland, FL 32851 Office - 321-455-2150 Cell - 407-947-7832

2 1

Syslog-ng 2.0.3 make error
by Diana Orrick 14 May '07

14 May '07

Would really like to be able to use this tool... Red Hat 2.6.9-55.ELsmp i686 i386 GNU/Linux On Mon, 2007-04-30 at 10:02 -0400, Justin Randall wrote: > Hello, > > I am also experiencing this compile error when building Syslog-NG-2.0.3 > on a CentOS (Linux) 4.4 host. Install libnet or disable spoof-source support. -- Bazsi I installed libnet, both an older version (to get libnet-config) and the CPAN perl module... Have updated and hand-installed glib (and all its flavors...) have tried with/without " --with-dynamic-linking " with libnet I get the odd syntax errors (would prefer to be able to use this version, and enable spoof sourcing, code update coming?) In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:592: error: syntax error before ')' token /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:626: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/tmp/syslog-ng-2.0.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/tmp/syslog-ng-2.0.3' make: *** [all] Error 2 after disabling enable-spoof_source, I get different errors (these seem to relate to glib issues noted earlier): gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -lwrap -Wl,-Bdynamic libsyslog-ng.a(misc.o)(.text+0x3a9): In function `resolve_hostname': /tmp/syslog-ng-2.0.3/src/misc.c:191: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x6a): In function `log_stamp_format': /tmp/syslog-ng-2.0.3/src/logmsg.c:110: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x2b6): In function `log_msg_ref': /tmp/syslog-ng-2.0.3/src/logmsg.c:498: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x342): In function `log_msg_unref': /tmp/syslog-ng-2.0.3/src/logmsg.c:512: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0xe2a): In function `log_msg_ack_block_end': /tmp/syslog-ng-2.0.3/src/logmsg.c:648: undefined reference to `g_return_if_fail_warning' libsyslog-ng.a(logpipe.o)(.text+0x4f): In function `log_pipe_ref': /tmp/syslog-ng-2.0.3/src/logpipe.c:38: undefined reference to `g_assert_warning' libsyslog-ng.a(logpipe.o)(.text+0x9b): In function `log_pipe_unref': /tmp/syslog-ng-2.0.3/src/logpipe.c:47: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x7d): In function `log_endpoint_free': /tmp/syslog-ng-2.0.3/src/center.c:90: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x175): In function `log_connection_new': /tmp/syslog-ng-2.0.3/src/center.c:132: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x2de): In function `log_template_ref': /tmp/syslog-ng-2.0.3/src/templates.c:180: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x346):/tmp/syslog-ng-2.0.3/src/templates.c:191: more undefined references to `g_assert_warning' follow collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/tmp/syslog-ng-2.0.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/tmp/syslog-ng-2.0.3' make: *** [all] Error 2 even tried installing syslog-ng-2.0.2, thinking it more 'stable' suggestions welcome, I'd like to get this working... ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Diana Mayer Orrick email: orrick(a)fsu.edu University Computing Services ph: (850) 645-8009 Florida State University fax: (850) 644-8722 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

5 7

Starting syslog_ng daemon with chkconfig on Linux
by Shamim 14 May '07

14 May '07

Hi, When I try to start syslog_ng daemon with chkconfig it says. Syslog_ng-2.0.2 service syslog_ng does not support chkconfig Am I missing something ? or how to start syslog_ng daemon with chkconfig on Linux. Please advise. Thanks --------------------------------- Yahoo! Answers - Got a question? Someone out there knows the answer. Tryit now.

3 2

syslog-ng stats
by Jason Qualkenbush 11 May '07

11 May '07

Can someone explain what the difference is between "queued" and "received"? I'm looking at the difference between two different syslog-ng servers. On the light server, the queued and received counter always match. On the heavily loaded server the queued and received differ quite a bit: processed='center(queued)=4988110' processed='center(received)=1103080' Am I losing messages? -Jason

2 1

RE: [syslog-ng] mount syslog server
by Alejandro Sierra 10 May '07

10 May '07

Hi, Lasso (http://www.loglogic.com/logforge/) is a good option for sending eventlog messages to syslog-ng. It supports TCP, u can choose the logs to be forwarded, the polling interval and it behaves as a service. One thing i didn`t like is that it doesn't use the facility and severity, like NTSyslog( http://ntsyslog.sourceforge.net/) another option that uses UDP, that makes better use of the syslog protocol. So it depends on ur needs. If u want to use TCP Lasso, otherwise NTSyslog. PD: Sorry for my english.

1 0

RE: mount syslog server (Javier Terceiro)
by Gregory Zill 10 May '07

10 May '07

Snare for windows Sourceforge.net/projects/snare gregory w zill systems engineer II -----Original Message----- Date: Thu, 10 May 2007 11:47:57 +0200 From: "Javier Terceiro" <correolista(a)gmail.com> Subject: [syslog-ng] mount syslog server To: syslog-ng(a)lists.balabit.hu Message-ID: <602eb19e0705100247v4be883cfo96ebf4b08aeddb21(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hello list, I'm mounting a syslog-ng server for centralize the log's of my net. The servers with linux is ok, but for windows server's, I need a tool for send the messages. What can I use? Some idea? Thanks. -- Power by Debian. A greeting, Javier. ------------------------------

1 0

mount syslog server
by Javier Terceiro 10 May '07

10 May '07

Hello list, I'm mounting a syslog-ng server for centralize the log's of my net. The servers with linux is ok, but for windows server's, I need a tool for send the messages. What can I use? Some idea? Thanks. -- Power by Debian. A greeting, Javier.

1 0

Syslog with epilog (for windows)
by Javier Terceiro 09 May '07

09 May '07

Hello list, I am mounting a log centralized server and for servers Windows I am using epiloj and the collector server is a syslog-ng. I have a problem with the data format that epiloj sends, I can`t correctly divide it in fields (server, date, message) in syslog-ng server. For example - The original message of epilog: GenericLog 0 2007-05-09 12:23:42 192.*.*.* - W3 ST 172.*.*.* 80 GET / - 403 5 334 174 0 HTTP/1.1 --- The format with that the data keep would have to be the following one: Program <> Date <> MSGONLY (in syslog-ng format). - The message saved by syslog-ng: GenericLog 0 2007-05-09 12 <> 2007 May 9 12:23:42 <> 3:42 192.*.*.* - W3 ST 172.*.*.* 80 GET / - 403 5 334 174 0 HTTP/1.1 --- - The message correctly: GenericLog <> 2007 May 9 12:23:42 <> 192.*.*.* - W3 ST 172.*.*.* 80 GET / - 403 5 334 174 0 HTTP/1.1 --- The problem is the fields than syslog don`t understand. Some idea of like obtaining it? Some program for obtain log's for windows server's? thanks. -- A greeting, Javier.

1 0

line of sendmail log output missing?
by Centyx Centalix 05 May '07

05 May '07

Hi, I recently switched from syslogd to syslog-ng on several servers running CentOS. While running syslogd, a usual mail delivery appeared in /var/log/maillog as follows: Apr 22 04:11:07 ws01 sendmail[32181]: l3M8B71l032181: from=<someuser(a)someremote.domain>, size=2361, class=0, nrcpts=1, msgid=<001901c784c6$9688fea0$018ab484@maison9tm8hfuv>, proto=ESMTP, relay=root@localhost Apr 22 04:11:07 ws01 sendmail[32179]: l3M8Av5T032164: to=<domain_support(a)somelocal.domain>, delay=00:00:04, xdelay=00:00:00, mailer=virthostmail, pri=121926, relay=somelocal.domain, dsn=2.0.0, stat=Sent (l3M8B71l032181 Message accepted for delivery) Apr 22 04:11:07 ws01 spamd[24594]: spamd: connection from localhost.localdomain [127.0.0.1] at port 50252 Apr 22 04:11:07 ws01 spamd[24594]: spamd: setuid to domain_admin(a)somelocal.domain succeeded Apr 22 04:11:07 ws01 spamd[24594]: spamd: processing message <001901c784c6$9688fea0$018ab484@maison9tm8hfuv> for domain_admin@somelocal.domain:22003 Apr 22 04:11:08 ws01 spamd[24594]: spamd: identified spam (18.5/4.0) for domain_admin@somelocal.domain:22003 in 1.3 seconds, 2646 bytes. Apr 22 04:11:08 ws01 spamd[24594]: spamd: result: Y 18 - BAYES_99,HELO_DYNAMIC_IPADDR2,HELO_DYNAMIC_SPLIT_IP,HTML_MESSAGE,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_NJABL_DUL,RCVD_IN_SORBS_DUL scantime=1.3,size=2646,user=domain_admin@somelocal.com,uid=22003,required_score=4.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=50252,mid=<001901c784c6$9688fea0$018ab484@maison9tm8hfuv>,bayes=1,autolearn=spam Apr 22 04:11:08 ws01 spamd[4109]: prefork: child states: BI Apr 22 04:11:08 ws01 spamd[4109]: spamd: handled cleanup of child pid 24594 due to SIGCHLD Apr 22 04:11:08 ws01 spamd[4109]: spamd: server successfully spawned child process, pid 32189 Apr 22 04:11:08 ws01 spamd[4109]: prefork: child states: II Apr 22 04:11:08 ws01 sendmail[32182]: l3M8B71l032181: to=domain_admin, delay=00:00:01, xdelay=00:00:01, mailer=local, pri=32547, dsn=2.0.0, stat=Sent Now, after replacing syslogd with syslog-ng, the last line showing the delivery by the local mailer ( in this case, procmail ) is absent from the log files. I have made sure that levels info through emergency are specified for facility mail, and have also checked to see if this message was showing up under any other facility ( although I have not explicity defined the levels for all facilities ). I am rather stumped about where this line of log output is going. Any suggestions would be greatly appreciated. -- We're all in this together.

3 6

Please Help problems with timezone and stamping !!
by Guy Fleegman 04 May '07

04 May '07

Hello: I have several sources that are all reporting to a syslog-ng 2.0.3 server My source is source all_routers { udp(ip(0.0.0.0) port(514)); }; My problem is that I have one source that is isolated to a separate file I isolate the file with the following filter f_pd_snort { host(intsnort1); }; and have this destination destination d_pd_snort { file("/var/log/syslog-ng-logs/pd_snort.1" perm(0644) template(t_default)); }; then i use the following command log { source(all_routers); filter(f_pd_snort); destination(d_pd_snort); }; The problem is the format the data is arriving in. It send data in UTC time as follows Apr 30 14:04:35 2007 intsnort1 SFIMS: [119:13:1] Snort Alert [Classification: Unknown] [Priority: 3] Apr 30 14:04:35 2007 intsnort1 SFIMS: [119:4:1] Snort Alert [Classification: Unknown] [Priority: 3] Apr 30 14:04:35 2007 intsnort1 SFIMS: [122:3:0] Snort Alert [Classification: Unknown] [Priority: 3] This is UTC. It is the time that is being sent in the actual packet (I verified with wireshark) I want syslog-ng to modify the times going into this file (and this file only) to reflect EST time. Based upon the documentation The following algorithm is used. 1. The sender can specify the timezone of the messages. If the incoming message includes a timezone it is associated with the message. Otherwise, the local timezone is assumed. 2. The administrator specifies the *time_zone()* <#sourcecommonopts>parameter for the source driver that reads the message. This parameter overrides the original timezone of the message. Each source defaults to the value of the *recv_time_zone()* <#reference_options>global option. 3. The destination driver specifies the timezone via the *time_zone()* <#destcommonopts>parameter. Each destination driver might have an associated timezone value to which message timestamps are converted before they are sent to the final destination (file or network socket). Each destination defaults to the value of the *send_time_zone()* <#reference_options>global option. A message can be sent to multiple destination zones. 4. When macro expansions are used in the destination filenames, the local timezone is used So option #1 is not being done I can't use #2 because my source is defined for all devices I tried using #3..... with the line modified as destination d_pd_snort { file("/var/log/syslog-ng-logs/pd_snort.1" perm(0644) time_zone(-04:00) template(t_default)); }; However.. this does not seem to make any difference... Can you please tell me why option #3 is not working .... and also... why is it that in #1 it is not defauling to just adding the local timezone since the incoming message does not have a timezone specified. Please help and thank you :)

2 2

General syslog question
by Mark Duling 02 May '07

02 May '07

I have a general question if you don't mind. I run OS X, and I am considering replacing my built-in syslog with syslog-ng, and I have an open source NMS that has an optional syslog daemon. I know I can't run two daemons listening on the same port, but I'm not sure how to get the NMS' daemon working. It appears I can't tell my Cisco switches to do syslog to an alternate tcp port (other than 514), so I can't run the 2nd daemon on another port only because my devices wouldn't send to it. Question - Is there a way to redirect syslogs to certain facilty #'s using syslog-ng to an alternate (something other than 514) syslog port so that it could co-exist with my NMS' syslog daemon (it can listen on any port)? Or if not, how do others handler this situation, so that their NMS box has syslog services for local Unix stuff as always, and also supports another syslog daemon receiving syslogs from the network? Mark

1 0