- syslog-ng - lists.balabit.hu

Silence syslog-ng upon connection reopening?
by Wolfram Schlich 24 Nov '06

24 Nov '06

Hi, is it possible to silence syslog-ng running on a log client when it reopens a TCP connection to the syslog-ng log server? For example, when you restart syslog-ng on the server due to some configuration change or whatever other reason, syslog-ng on the log client logs this to syslog.err: syslog-ng[13214]: io.c: do_write: write() failed, EOF detected syslog-ng[13214]: pkt_buffer::do_flush(): Error flushing data syslog-ng[13214]: Connection broken to AF_INET(log-server:514), reopening in 10 seconds Can I make syslog-ng NOT log those messages until, let's say, the reopening failed at least N times? The reason is I am using tenshi to monitor the remote logs on the log server in order to alert me about messages with the severities err, crit and emerg. I can, however, add special trash patterns to my tenshi config to disregard the above messages, but I don't feel comfortable about it (for example, when there was a real problem, like a network outage for, let's say, more than 60 seconds). Switching to UDP does not look like a brilliant alternative either ;) Best regards -- Wolfram Schlich

2 4

syslg-ng hangs on damnsmalllinux boot
by Heiko Blume 23 Nov '06

23 Nov '06

Hello, i try to run syslog-ng 2.0.0 compiled with eventlog-0.25 and glib-2.12.4 on damnsmalllinux 3.0.1 (knoppix variant based on linux 2.4.26). It is started in a script like this which is called from bootlocal.sh sudo /opt/syslog-ng/sbin/syslog-ng \ --cfgfile=/opt/syslog-ng/etc/syslog-ng.conf \ --chroot=/data/var/log \ --user=65534 \ --group=65534 unfortunately it will hang causing mischief, like programs blocking on it, so the boot script does not complete and no login is possible at all. it can only be killed with "-9". The "messages" and "syslog" logfiles look like this, so the chroot etc has worked correctly, the config is valid etc etc: Nov 22 00:19:22 s_all@box syslog-ng[682]: syslog-ng starting up; version='2.0.0' Nov 22 00:19:22 s_all@box kernel: Linux version 2.4.26 (root@Knoppix) (gcc versi on 2.95.4 20011002 (Debian prerelease)) #1 SMP Sa Apr 17 19:33:42 CEST 2004 [blaaaaaaaaaaaaah] Nov 22 00:19:22 s_all@box kernel: Linux agpgart interface v0.99 (c) Jeff Hartmann But hereafter nothing happens anymore :-((( If it is started manually later on it seems to work. I tried starting it with --debug, but that didn't say anything at all, although i ran configure with --enable-debug (is that relevant?) I applied the patch from http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg265412.html to prevent blocking on tty's but that didn't help. In the config file i then set use_dns(no) and commented out the usertty() destination, so it is only logging to files. no external programs, pipes etc are used. the only source used is this: source s_all { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-dgram("/dev/log"); unix-dgram("/data/tftpboot/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); # use the next line if you want to receive remote UDP logging messages # (this is equivalent to the "-r" syslogd flag) udp(); tcp(); }; any help would be appreciated!!! regards, -- Heiko(a)Blume.AG

2 8

comm method with clients
by Constantine Kousoulos 23 Nov '06

23 Nov '06

Hello, From what i read in the reference manual, there is a fixed number of available source drivers (internal, file, tcp, etc) in syslog-ng. I would like to develope a new kind of driver (communication method) to collect messages from clients. Is syslog-ng customizable enough to accomplish something like that relatively easy? :) I am a newbie in this mailing list so please forgive me if my question sounds too naive. Thanks, Constantine

2 1

Syslog-ng load testing
by Vaibhav Goel 22 Nov '06

22 Nov '06

Hi all I am planning to do some capacity and load testing our syslog-ng servers over TCP. Towards that end, I will be writing a script to send packets to a syslog-ng host. Has anyone done anything similar? I was just thinking of writing a simple script that will open multiple sockets to the server and send a message (based upon our current calculated average message size). Any other suggestions are appreciated. Thanks,

4 15

Need help with having Syslog-ng import a log file into syslog-ng
by Steven Meacham 21 Nov '06

21 Nov '06

Need help with having Syslog-ng import a log file into Syslog-ng. I have a proxy server that will not syslog but will log to a file than can ftp of the server. I am wondering how I can take the ftped file and send it to the Syslog-ng so It can be sysloged to our database server for review? Any help would be great? Thanks.

4 4

syslog-ng and chroot'ed bind
by Patrick Topping 21 Nov '06

21 Nov '06

All, I have just installed bind in a chtoot'ed environment. What I am not able to get set up properly is the logging through syslog-ng. Does anyone have a "HOW TO" on this or a web site that I could be directed to in order to get this going....??? Thanks in advance. -Patrick

2 1

Any non-commercial Windows tcp clients?
by Alejandro Sierra 17 Nov '06

17 Nov '06

Hi, i'm interested in the same. The solution i've thought by now is using NTSyslog and Kiwi Together. NTSyslog sends messages gotten from the EventViewer in UDP to localhost where are recived by Kiwi who has the ability to send over TCP in the SSH Tunnel (I use plink) . By this moment i have a problem. Kiwi uses '\r' as separator for TCP messages and Syslog-ng uses '\n', so when syslog-ng recives 5 messages in one TCP message from a Kiwi, he only gets the syslog header from the 1st message, and sees all the rest as part of the first one. Cya. I accept critics(very welcolme). PD: Sorry for my english.

1 0

Syslog-ng 2.0 contrib/redhat conf file problem
by King, John (Greg) (LMIT-HOU) 17 Nov '06

17 Nov '06

I have copied the syslog.conf file from syslog-ng-2.0.0/contrib/rhel-packaging to /etc/syslog-ng.conf When I try running syslog-ng I get the following error "/usr/local/sbin/syslog-ng -f /etc/syslog-ng.conf syntax error at 17" Line 17 is file("/proc/kmsg" log_prefix "kernel:"); Which is in this script block # source s_local { unix-dgram("/dev/log"); file("/proc/kmsg" log_prefix "kernel:"); }; Did something change in version 2.0 that was not updated in the example? Or should I use the contrib app syslog2ng? I would like to create a config that will allow me to disable klogd and syslogd on RHES4. Then set syslog-ng up to listen for tcp syslog packets from remote systems and then separate those logs like this destination d_separatedbyhosts { file("/var/log/syslog-ng/$HOST/messages" owner("root") group("root") perm(0640) dir_perm(0750) create_dirs(yes)); }; Any help would be great, Thanks - Greg

1 0

timestamp in log files
by Gustavo Mendes de Carvalho 13 Nov '06

13 Nov '06

He All, Does anybody knows any idea to include a date in unix timestamp format into a log file, together with a message ? Something like Nov 11 05:15:34 *1163214934 *s_sys(a)10.9.8.7 sshd[13037]: Accepted publickey for ROOT from 10.0.0.2 port 1355 ssh2 Regards -- Gustavo Mendes de Carvalho gmcarvalho(a)gmail.com

2 5

syslog-ng droping events
by Arya, Manish Kumar 10 Nov '06

10 Nov '06

Hi, I have 3 syslog listeners (solaris 10 ) collecting log events from about 20,000 devices and fwding them on a central syslog box (solaris 10, 16 gb RAM and 3TB SAN storage) . the central syslog box stores them in oracle db and on filesystem. I notice that events from many devices are being droped on central syslog box. I thought it might be because of udp protocol, but even after enabling tcp its droping events. I can see that events come on listeners boxes (I created temp file logs there) please tell me what could be missing. Regards, -Manish ____________________________________________________________________________________ Want to start your own business? Learn how on Yahoo! Small Business. http://smallbusiness.yahoo.com/r-index

4 4

timezones
by Szeti, Balazs 10 Nov '06

10 Nov '06

Hello! I'm trying to log messages with ISO timestamps from different timezones. Example through TCP: <140>2006-11-05T05:15:15+01:00 1 2 3 <140>2006-11-05T05:15:15+02:00 1 2 3 <140>2006-11-05T05:15:15+03:00 1 2 3 The syslog-ng's node is in +01:00 timzone. I left all the time_zone() on default. Template used: template t_year { template("$S_ISODATE $R_ISODATE $S_HOUR: $MSGONLY\n"); }; Result in the log: 2006-11-05T05:15:15.000000+01:00 2006-11-09T16:12:10+01:00 05: 2 3 2006-11-05T07:15:15.000000+02:00 2006-11-09T16:11:41+01:00 07: 2 3 2006-11-05T09:15:15.000000+03:00 2006-11-09T16:12:37+01:00 09: 2 3 There's nothing wrong with the R_ISODATE, but I don't understand the S_ISODATE. When I log with the syslog-ng node timezone it writes the right value, but when I change the timezone in the TCP message the S_HOUR increases! I would like to see the original timestamp from the message and the R_ISODATE right next to each other. Why is the S_ISODATE increased? Can S_HOUR now be used in file name templates??? Thanks in advance, Balazs Szeti

2 5

syslog-ng to MySQL: write decimal code of severity level in column
by Tadej Bregar 10 Nov '06

10 Nov '06

Hello, I'm using syslog-ng 2.0 rc4 with Php-Syslog-NG 2.9.2a on RHEL4 with MySQL 5.0.24a. I'm feeding MySQL server through UNIX pipe and everything goes well - BUT I've got a few questions. This is not strictly syslog-ng problem, as I'm also using php-syslog-ng in my setup (php-syslog-ng database schema for MySQL), but I'll ask here on this list anyway: 1.How can I configure syslog-ng to write decimal code of severity (see RFC3164) in column "level" (or "priority") of table "logs" in database "syslog"? Is this possible to achieve somehow? 2. Why are we logging the same information twice (the same data gets written in column "priority" and "level")? The ideal setup would be to write decimal code of severity level in column "level" and corresponding word string (eg. info or warning or crit ...) in column "priority". Using php-syslog-ng in this case, we could order syslog messages by priority properly (sql query ... ORDER BY level ASC .... orders our messages by alphabetical order) Now we can't (!!) because in ascending mode we get alert (character A) first and warning (character W) last, but we should get nice progression like: debug, info, notice, warning, error, crit, alert, emerg. Just in case, I'm attaching a part of syslog-ng.conf file: --------------------- destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$R_YEAR-$R_MONTH-$R_DAY $R_HOUR:$R_MIN:$R_SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; --------------------- Thanks for any info, Tadej

1 0

Alternate logging destination
by Szeti, Balazs 06 Nov '06

06 Nov '06

Hello! I would like to design a centralized logging system with 50 edge nodes and one center. It's quiet important to have all the logs even if the center is unreachable. Is there a way to configure syslog-ng to use an alternate destination? For example if the centralized TCP destionation server is down, the edge node syslog-ng may log in to a local file, so the logs can be reached later manually. When the center server in online again syslog-ng may log online again. Any ideas? Thanks in advance: Balazs

5 8

2.0.0 : make install doesn't install anything?
by Rob Munsch 06 Nov '06

06 Nov '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, i was reasonably sure that earlier versions make an /etc/syslog-ng and put a syslog-ng.conf in there as well as installing basic initscripts. My configure and make seem to exit cleanly, but make install doesn't... install. Yes, i am root. This is on a debian linux box with 2.6.16.29. I guess i could be misremembering, but i don't *think* i did that all by hand last time..? And yes, i see the scripts in debian/ as well. I'm just making sure there's nothing Odd about make install's behaviour before i move them manually. Thanks, - -- Rob Munsch Solutions For Progress IT www.solutionsforprogress.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFT18YBvBcJFK6xYURAoZsAJ43DCm3UI21VyRXGYyHOFqQcuABRwCdEx3w xpY/T1qymgA+skAdx+Nu/6E= =2UrK -----END PGP SIGNATURE-----

1 1

Re: [syslog-ng] sysutils/syslog-ng/files/syslong-ng.sh.in patch
by Valdis.Kletnieks＠vt.edu 06 Nov '06

06 Nov '06

On Mon, 06 Nov 2006 09:21:43 EST, "Brian A. Seklecki" said: > Yep. I sent about 75 messages the other night well under the influence > of a *LOT* of alcohol. >:} Ahh. That explains the jpeg of you and the llamas. :)

1 0

sysutils/syslog-ng/files/syslong-ng.sh.in patch
by Brian A. Seklecki 06 Nov '06

06 Nov '06

This is a nice little patch we use to purge out /dev/klog after /etc/rc.d/dmesg and before /usr/local/etc/rc.d/syslog-ng.sh. It's useful for shops that translate user.info facility/priority syslog messages into SMS/E-Mail via a log{} mechanism (i.e., hardware error messages from the kernel, like some flunky in the NOC plugging a keyboard into your system). It lets you avoid 200 lines of boot messages in log(9) making their way into your log{} mechanism or into your pager. We want to feed it upstream because we think others will find it useful. ~BAS $ diff -u /usr/ports/sysutils/syslog-ng/files/syslog-ng.sh.in syslog-ng.sh.in --- /usr/ports/sysutils/syslog-ng/files/syslog-ng.sh.in Wed Mar 29 16:20:19 2006 +++ syslog-ng.sh.in Fri Nov 3 20:32:59 2006 @@ -14,6 +14,8 @@ #syslog_ng_enable="YES" # +syslog_ng_purgeklog=${syslog_ng_purgeklig-"NO"} + . %%RC_SUBR%% name=syslog_ng @@ -23,6 +25,11 @@ required_files=%%PREFIX%%/etc/syslog-ng/syslog-ng.conf pidfile=/var/run/syslog.pid extra_commands=reload + +if checkyesno syslog_ng_purgeklog; then + start_precmd="echo \"Purging klog(9)\" && sysctl -w kern.msgbuf_clear=1 $start_precmd"; +fi + stop_postcmd=stop_postcmd load_rc_config $name ---- l8* -lava (Brian A. Seklecki - Pittsburgh, PA, USA) http://www.spiritual-machines.org/ "...from back in the heady days when "helpdesk" meant nothing, "diskquota" meant everything, and lives could be bought and sold for a couple of pages of laser printout - and frequently were."

2 1

syslog-ng 2.0.0 released
by Balazs Scheidler 03 Nov '06

03 Nov '06

Hi, I'm proud to announce that the first stable version in the 2.0.x series, with a version number of 2.0.0 has been released and uploaded to our website. Those following the 1.9.x and 2.0rcX releases should not expect much changes between 2.0rc4 and 2.0.0, a few fixes here and there. >From now on, syslog-ng 1.6.x is strictly in maintenance mode, my efforts on syslog-ng will concentrate on the 2.0.x branch. The list of user-visible changes in 2.0.0 since 2.0rc4: 2.0.0 Sat, 28 Oct 2006 17:32:50 +0200 Bugfixes: * Fixed some compilation warnings when using gcc4 * Fixed a problem in restarting program destinations, that could cause several instance of the program to run. * Fixed a UNIX domain socket format issue that sometimes caused a memory dump to be displayed in place of the socket name. * Fixed a bug in handling broken destination connections. Other changes: * Documentation updates. -- Bazsi

1 0

Re: logs written twice
by G.W. Haywood 03 Nov '06

03 Nov '06

Hi there, Damn. Too much of a hurry, missed the subject line the first time. On Wed, 1 Nov 2006 Nick Baronian wrote: > 2. logs written twice (Nick Baronian) > I setup a syslog-ng server to get logs from various boxes and devices. > I think I am a little confused about the correct way to set this up. > I am seeing a lot of logs getting written twice. > Is there a way I can duplicate the name schema the remote box is using I don't know exactly what you mean by that, and I do't think I'd know the answer if I did. :) > [snip] > filter pump_renewal { not program("pumpd") or not level(info,debug); }; > filter imap_debug { not program("imapd") or not level(info,debug); }; > filter ipop3_debug { not program("ipop3d") or not level(info,debug); }; > filter sshd_debug { not program("sshd") or not level(debug); }; > filter f_attack_alert { match("attackalert"); }; > filter f_ssh_login_attempt { > program("sshd.*") > and match("(Failed|Accepted)") > and not match("Accepted (hostbased|publickey) for > (root|zoneaxfr) from (10.4.3.1)"); }; > [snip] If I understand what you're trying to so, I don't think you're approaching this the right way at all. Think of a filter as being like a sieve. You keep what's filtered because you want it, you don't throw it away by 'filter'ing it out. Your filter 'sshd_debug' isn't being referenced at all, so it won't give you any output. If I wanted to see ssh debug messages (assuming that the ssh daemon was logging anything at the DEBUG level) then the filter I would use would be something like filter f_sshd_debug { program("sshd") and level(debug); }; log { source(src); filter(f_sshd_debug); destination(whatever); }; The problem with using 'or' is that not program("sshd") or not level(debug) will give you stuff that ISN'T sshd if it also ISN'T debug. Check out deMorgan's theorem on the Web. If I've got the wrong end of the stick here, a flame to my personal email address is in order but one to the list isn't. :) -- 73, Ged.

3 3

Re: logs written twice
by G.W. Haywood 02 Nov '06

02 Nov '06

Hi there, On Thu, 2 Nov 2006 Nick Baronian wrote: > > > Is there a way I can duplicate the name schema the remote box is using > > > > I don't know exactly what you mean by that, and I do't think I'd know > > the answer if I did. :) > > What I mean is if I have two boxes I want to log to this syslog-ng > server, one is an old Unix box that is logging *.info;mail.none > locally to /var/adm/syslog/syslog.log and the other is a RH Linux box > that logs *.info;mail.none locally to /var/log/messages is there a way > the remote syslog-ng server can be configured to write the > *.info;mail.none for the Linux box to a messages file and for logs it > receives from the Unix box to a syslog.log file? That should be no problem at all, but I think you're going to have to knuckle down and read the documentation. You'd tell the two boxes to log to the logging server and create a few rules on the logging server which log to different places depending on which of the two boxes sent the log message. If I were doing it, I'd have the two boxes decide what to log and the logging server decide only where (which file) to log it in. Otherwise you might create a lot of network traffic which contained information that would be discarded by the logging server. You seem to attach some significance to the names of these logfiles. Is there a reason for that? -- 73, Ged.

2 1

RE: [syslog-ng] help- Problem with TCP Based CentralizedLogServer using Syslog-ng
by Padmanabhan, Rajeesh (GE Healthcare) 02 Nov '06

02 Nov '06

Thanks Nate. I had set the max connections to 1000 already. Still it was same issue. Now I set so_rcvbuf(500) in tcp source( Basically increased the recive buffer size). After that its not crashing that frequently. It takes 1 or 2 days to crash. Please help. -Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Nathan Campi Sent: Tuesday, October 31, 2006 11:43 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] help- Problem with TCP Based CentralizedLogServer using Syslog-ng Check the logs from syslog-ng on the central server. Could be that you need to increase the max connections to your tcp source or increase an OS limit like open file descriptors. -- Nate Campi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng] Re: logs written twice
by Nick Baronian 01 Nov '06

01 Nov '06

Thanks again Len. So I guess the standard conf (in the examples dir) logs a lot of the same stuff to multiple files, ie. messages file and syslog file. Why do this when the syslog statement catches everything the messages catches? It isn't that big of a division of types of events so I guess that was confusing me. If I understand this right in the example file snippet- filter f_syslog { not facility(authpriv, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; The messages will only log "info, notice and warning and everything but auth, authpriv, mail and news" but the syslog will log "all levels and everything but authpriv and mail"? Is that correct, if you don't specify the level, what does it default to? -Nick On 11/1/06, Leonard Mills <Leonard_Mills(a)corpnet.sel.sony.com> wrote: > Yes, you've got it exactly correct. Processing of the > incoming packet will end when a final flag is encountered. > Things that are desired in multiple places shouldn't be > allowed encounter the final flag (maybe things like > auth.crit should appear in more than one place). > > Len

1 0

Re: [syslog-ng] Re: logs written twice
by Nick Baronian 01 Nov '06

01 Nov '06

Thanks Len, I am not sure I fully understand what final does. The site states "This flag means that the processing of log statements ends here. Note that this does not necessarily mean that matching messages will be stored only once, as there can be matching log statements processed prior the current one." Does this mean that anything below my syslog log line would not get anything, so basically like everything below doesn't exist or is commented out? -Nick On 11/1/06, Leonard Mills <Leonard_Mills(a)corpnet.sel.sony.com> wrote: > Nick wrote: > > >If I don't want the the same messages logged to both files I would > >need to remove one of the two filters, right? > > you could add the controls to your log entries, something > like: > > log { source(src); filter(f_syslog); destination(syslog); flags(final); }; > > That would keep the messages out of messages :-). > > Len > >

1 0

Re: syslog-ng Digest, Vol 19, Issue 1
by G.W. Haywood 01 Nov '06

01 Nov '06

Hi there, On Wed, 1 Nov 2006 Nick Baronian wrote: > 2. logs written twice (Nick Baronian) > I setup a syslog-ng server to get logs from various boxes and devices. > I think I am a little confused about the correct way to set this up. > I am seeing a lot of logs getting written twice. > Is there a way I can duplicate the name schema the remote box is using I don't know exactly what you mean by that, and I do't think I'd know the answer if I did. :) > [snip] > filter pump_renewal { not program("pumpd") or not level(info,debug); }; > filter imap_debug { not program("imapd") or not level(info,debug); }; > filter ipop3_debug { not program("ipop3d") or not level(info,debug); }; > filter sshd_debug { not program("sshd") or not level(debug); }; > filter f_attack_alert { match("attackalert"); }; > filter f_ssh_login_attempt { > program("sshd.*") > and match("(Failed|Accepted)") > and not match("Accepted (hostbased|publickey) for > (root|zoneaxfr) from (10.4.3.1)"); }; > [snip] If I understand what you're trying to so, I don't think you're approaching this the right way at all. Think of a filter as being like a sieve. You keep what's filtered because you want it, you don't throw it away by 'filter'ing it out. Your filter 'sshd_debug' isn't being referenced at all, so it won't give you any output. If I wanted to see ssh debug messages (assuming that the ssh daemon was logging anything at the DEBUG level) then the filter I would use would be something like filter f_sshd_debug { program("sshd") and level(debug); }; log { source(src); filter(f_sshd_debug); destination(whatever); }; The problem with using 'or' is that not program("sshd") or not level(debug) will give you stuff that ISN'T sshd if it also ISN'T debug. Check out deMorgan's theorem on the Web. If I've got the wrong end of the stick here, a flame to my personal email address is in order but one to the list isn't. :) -- 73, Ged.

1 0

RE: [syslog-ng] help- Problem with TCP Based Centralized LogServer using Syslog-ng
by Padmanabhan, Rajeesh (GE Healthcare) 31 Oct '06

31 Oct '06

Hi Bazsi, Im using a Red Hat Enterprise Linux AS 4.0 as Syslog-ng Server ( Centralized Log Server). I have got Syslog-ng 1.6 running on Solaris 8.0 and Syslog-ng 2.0rc1 running on Linux AS 4.0. All the logs from clients ( Both Linux & Solaris ) are transferred to Syslog-ng Server ( Centralized Log Server) on TCP Based communication(Destination). I restarted the Central Log Server after I noticed the error messages in Clients. After I restarted the server, server is able to accept the logs. Thanks a lot for your quick response. -Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Tuesday, October 31, 2006 4:29 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] help- Problem with TCP Based Centralized LogServer using Syslog-ng On Tue, 2006-10-31 at 14:52 +0530, Padmanabhan, Rajeesh (GE Healthcare) wrote: > Hi > > Im trying to setup a centralized, TCP Based Log Server using > Syslog-ng. Syslog-ng server stops accepting logs from clients > intermediatley. > It works again, once i restart the syslog-ng server. Im getting > following error messages from clients. > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Oct 18 10:29:28 System1 syslog-ng[11745]: Connection broken; > time_reopen='60' > Oct 18 15:06:26 RADIUM syslog-ng[4999]: io.c: do_write: write() failed > (errno 32), Broken pipe Oct 18 15:06:26 RADIUM syslog-ng[4999]: > pkt_buffer::do_flush(): Error flushing data Oct 18 15:06:26 RADIUM > syslog-ng[4999]: Connection broken to AF_INET(10.70.201.233:514), > reopening in 10 seconds > syslog-ng[13843]: Connection failed; error='Connection refused > (111)', time_reopen='60 > syslog-ng[302]: Error connecting to remote host > AF_INET(10.70.201.233:514), reattempting in 10 seconds > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Please help me... > I'm sorry but you need to give further details, like OS, architecture syslog-ng version that you used. When did you receive the messages above? after restarting syslog-ng or was this the reason why you restarted syslog-ng in the first place? Because restarting syslog-ng naturally breaks existing connections and there's a small race of opportunity while the port is closed and clients try to connect to it, in this case you get connection refused. So all in all we'd need more information in order to help you. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

logs written twice
by Nick Baronian 31 Oct '06

31 Oct '06

I setup a syslog-ng server to get logs from various boxes and devices. I think I am a little confused about the correct way to set this up. I am seeing a lot of logs getting written twice. For instance I have some old Unix boxes logging to it and some Linux boxes. The old Unix boxes log to a syslog file for most stuff and the Linux boxes log most stuff to the messages file. I have some cisco devices that I wanted to log to particular filename but it is getting written to the custom filename and being duplicated to a syslog file, plus it is writing a messages file which is not an exact duplicate for some reason. I am guessing my reason is because I have stuff like filter f_syslog { not facility(auth, authpriv) and not facility(mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail); }; destination syslog { file("/u01/log/$HOST/syslog"); }; destination messages { file("/u01/log/$HOST/messages"); }; Is there a way I can duplicate the name schema the remote box is using or do I need to say all syslog type events goto blah file and such? My conf looks like options { chain_hostnames(no); create_dirs (yes); dir_perm(0750); dns_cache(no); keep_hostname(no); log_fifo_size(2048); log_msg_size(8192); perm(0640); stats(3600); sync(0); time_reopen (10); use_dns(no); use_fqdn(yes); }; source src { unix-dgram("/dev/log"); internal(); udp(); tcp(); }; destination authlog { file("/u01/log/$HOST/auth.log"); }; destination syslog { file("/u01/log/$HOST/syslog"); }; destination cron { file("/u01/log/$HOST/cron.log"); }; destination daemon { file("/u01/log/$HOST/daemon.log"); }; destination kern { file("/u01/log/$HOST/kern.log"); }; destination lpr { file("/u01/log/$HOST/lpr.log"); }; destination user { file("/u01/log/$HOST/user.log"); }; destination uucp { file("/u01/log/$HOST/uucp.log"); }; destination debug { file("/u01/log/$HOST/debug"); }; destination messages { file("/u01/log/$HOST/messages"); }; destination bootlog { file("/u01/log/$HOST/boot.log"); }; destination mail { file("/u01/log/$HOST/mail.log"); }; destination maillog { file("/u01/log/$HOST/maillog"); }; destination mailinfo { file("/u01/log/$HOST/mail.info"); }; destination mailwarn { file("/u01/log/$HOST/mail.warn"); }; destination mailerr { file("/u01/log/$HOST/mail.err"); }; destination cisco_asa { file("/u01/log/$HOST/cisco_asa.log"); }; destination console { usertty("root"); }; filter cr_asa { facility(local5); }; filter pump_renewal { not program("pumpd") or not level(info,debug) ; }; filter imap_debug { not program("imapd") or not level(info,debug) ; }; filter ipop3_debug { not program("ipop3d") or not level(info,debug); }; filter sshd_debug { not program("sshd") or not level(debug); }; filter f_attack_alert { match("attackalert"); }; filter f_ssh_login_attempt { program("sshd.*") and match("(Failed|Accepted)") and not match("Accepted (hostbased|publickey) for (root|zoneaxfr) from (10.4.3.1)"); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv) and not facility(mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail); }; filter f_emergency { level(emerg); }; filter f_bootlog { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_daemon); destination(messages); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_kern); destination(messages); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(messages); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); destination(maillog); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(cr_asa); destination(cisco_asa); }; Thanks, Nick

1 0