- syslog-ng - lists.balabit.hu

log reporting
by Brian Loe 28 Sep '06

28 Sep '06

Anyone using scripts (like cislog) for reporting on your logs? Anyone using cislog 1.2? If so, can you help me with getting my log format to match up with what is expected? I have SEC running against pipes but wouldn't mind something like cislog to run against yesterday's logs counting and reporting on what is found. Possibly catching things my SEC rules aren't accounting for...

1 0

Syslog IP information is incorrect
by Tom Valdes 28 Sep '06

28 Sep '06

I have some machines behind a firewall VLAN of 10.0.240.0 sending logs to a Linux Syslog server on the 10.0.230.0 network. The 2 machines are 10.0.240.71 and 10.0.240.72 and the Syslog server is 10.0.230.222. They are Windows and I am using the Eventlog to Syslog utility from Purdue University ( https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys) to convert the Windows event logs to Syslog. Syslog is getting the information, however, any information from the 2 machines are coming in as 10.0.230.1. ------- Sep 28 11:37:54 10.0.230.1 Service Control ....... <---- This machine is actually 10.0.240.71 ------- Is there a way to get Syslog to read the correct IP information? or does Syslog simply not pass correct host information through a router? thanks, tom

3 3

RE: [syslog-ng] Syslog-ng load testing
by Vaibhav Goel 28 Sep '06

28 Sep '06

Thanks Nate, I am on a similar path. Already hacked out a perl script and I will share it with the world when its more meaningful. So far its just generically opening a socket to syslog-ng and sending messages to it like crazy. Already seeing some interesting results.... -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Nate Campi Sent: September 28, 2006 10:12 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng load testing On Thu, Sep 28, 2006 at 09:36:10AM -0700, Vaibhav Goel wrote: > > I am planning to do some capacity and load testing our syslog-ng servers > over TCP. Towards that end, I will be writing a script to send packets > to a syslog-ng host. Has anyone done anything similar? I was just > thinking of writing a simple script that will open multiple sockets to > the server and send a message (based upon our current calculated average > message size). Any other suggestions are appreciated. The graphs here: http://www.campin.net/syslog-ng/faq.html#perf Are from a perl script that simply looks in syslog-ng logs for a particular "starting test" string that includes how many test messages are going to be sent, then looks for that many messages all with a sequence number appended to real-world syslog messages (a collection of about 50 messages I grabbed), then reports any numbers missing from the sequence when it gets near the total number of messages (doesn't depend on the actual last log making it in case it's lost), and reports on the time period between when the first and last message were logged to the file. Pretty simple. I did the log scraper in perl to generate those graphs via gd::graph or something like that, but you could just spit out CSV and graph it with something like (*gasp*) Excel. I can't share those scripts since they were written while working for a large, evil corporation, but the logic is quite simple. I had it measure CPU and also network stats (network stats were a separate graph not pictured on the site) but that's certainly not mandatory. Just make sure that if you measure CPU that you also see how much CPU the testing/analysis script uses - might be more than you'd think. -- Nate There are two ways to write error-free programs. Only the third one works. -Anon. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

DNS and hosts
by Hari Sekhon 28 Sep '06

28 Sep '06

I have a logserver with a mysql back-end and php-syslog-ng front-end. I was doing some work on DNS (migration to another machine, another version) yesterday and it was down for a little while. I noticed today that in the logserver interface I have loads of ip addresses instead of hostnames. So I had to go through and change the fields for all those hosts manually, which was quite annoying. In order to stop this from happening again I was wondering what steps I could take. My logserver conf options section is as follows: options { chain_hostnames(off); sync(10); stats(43200); keep_hostname(no); use_dns(yes); dns_cache(yes); create_dirs(yes); log_fifo_size(5000); }; If I change keep_hostname() to yes will I still get validation via dns or not? I think not judging from the docs. I was wondering if perhaps it would use dns and if unavailable it would use the name from the logs. Wishful thinking? On a DNS front, I was wondering if I could just copy a hosts file with all the dns names in it to the /etc/hosts of the linux system running the logserver. Would this work? Would syslog-ng obey the nsswitch of the linux system and use the hosts file first? Or does it have to do a dns request when use_dns(yes) is the options{}; ? This way, I'll never have this problem again if I need to fiddle the DNS server. I already have a hosts file generated when I update my dns server records so this is ready to go if it will work... All feedback welcome. -h -- Hari Sekhon

3 4

Forwarding to a Loglogic device
by Dukes Clayton 28 Sep '06

28 Sep '06

Argh... Can someone tell me why a sniffer shows no traffic passing to the destination when using this config? I've tried everything I can think of...what am I doing wrong? ############################## # Loglogic dump ############################## options { sync(0); log_fifo_size(1024); chain_hostnames(no); use_fqdn(yes); use_dns(yes); dns_cache(yes); dns_cache_expire(300); dns_cache_expire_failed(10); dns_cache_size(1024); keep_hostname(yes); }; source snet { tcp(); udp(); }; filter f_loglogic { level(debug..emerg) and facility(local0, local1, local2, local3, local4, local6, local7); }; destination LogLogic { tcp("10.24.2.39" port(514) log_fifo_size(60000) template("<$PRI> $R_DATE $SOURCEIP $MSG\n") ); }; log { source(snet); filter(f_loglogic); destination(LogLogic); }; ############################## # END Loglogic dump ############################## When I telnet to my router and generate a SYS-5-CONFIG, I see the packet come into the server: #----Start capture tcpdump dst port 514 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 10:17:33.211813 IP 10.26.31.2.52935 > syslog.net.syslog: SYSLOG local7.notice, length: 105 148 packets captured 297 packets received by filter 0 packets dropped by kernel #----End capture But when I try to sniff packets going to the destination server, I see nothing: /etc/init.d/syslog-ng restart * Stopping syslog-ng ... [ ok ] * Starting syslog-ng ... #----Start capture - note that the entries below are from syslog-ng restarting, so I know it establishes a connection... tcpdump dst host 10.24.2.39 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 10:24:40.401037 IP syslog.net.56631 > .shell: F 1487912722:1487912722(0) ack 91904650 win 1460 <nop,nop,timestamp 866281169 157842259> 10:24:40.407670 IP syslog.net.56631 > .shell: . ack 2 win 1460 <nop,nop,timestamp 866281177 158151244> 10:24:43.014989 IP syslog.net.42848 > .shell: S 1805017512:1805017512(0) win 5840 <mss 1460,sackOK,timestamp 866283785 0,nop,wscale 2> 10:24:43.015885 IP syslog.net.42848 > .shell: . ack 425051406 win 1460 <nop,nop,timestamp 866283786 158153852> #----End capture What am I missing here? Thanks! Clayton

1 1

RE: [syslog-ng] Re: question regarding program name logs
by Justin Randall 27 Sep '06

27 Sep '06

Is it maybe possible that this is a new issue not related to the initial one outlined in this thread? It occurred to me that the messages that are "disappearing" are clearly not behaving in the same way as in 2.0rc1, where they simply went to the wrong place because of an angle bracket tag with digits inside. In this case it simply seems like the first message in a burst of UDP messages is being completely lost. Since I've downgraded back to 2.0rc2, the problem no longer exists. Anything else I can do to help? Regards, Justin. -----Original Message----- From: Justin Randall Sent: Wednesday, September 27, 2006 10:10 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Re: question regarding program name logs Sorry I pasted the wrong "log" statement, here it is: log { source(src_udp); source(src_tcp); filter(fltr_PROGRAM); destination(dst_ PROGRAM); flags(final, flow-control); }; -----Original Message----- From: Justin Randall Sent: Wednesday, September 27, 2006 10:07 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Re: question regarding program name logs Hi and thanks for the response. This is actually relating to UDP logging. I have devices sending Syslog messages via UDP to a central Syslog-NG server. Usually the devices log messages to Syslog-NG via UDP in bursts (about 20-25 message within a couple seconds). The source, filter, destination, log statements for the handling are as follows: source src_udp { udp( ip(IPADDRESS) port(PORT) ); }; filter fltr_PROGRAM { program("PROGRAM") or match("PROGRAM"); }; destination dst_PROGRAM { file( "/var/log/PROGRAM/messages" owner(root) group(tomcat) perm(0640) ); }; log { source(src_udp); source(src_tcp); destination(dst_remote_system); flags(final, flow-control); }; What ends up happening when a host falls into this flow, the first log message is missed. The format of the bursts of messages are exactly the same. This did not happen in 2.0rc2, I have downgraded and verified this. Let me know if there's any other info I can provide that would help out. Regards, Justin. -----Original Message----- From: G.W. Haywood [mailto:ged@jubileegroup.co.uk] Sent: Wednesday, September 27, 2006 7:42 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Re: question regarding program name logs Hi there, On Wed, 27 Sep 2006 Justin Randall wrote: > Can anyone confirm if the patch that was to fix this issue was included > in 2.0rc3? Yes, it was. Note that it only affects logging via UDP. -- 73, Ged. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] Re: question regarding program name logs
by Justin Randall 27 Sep '06

27 Sep '06

Hi and thanks for the response. This is actually relating to UDP logging. I have devices sending Syslog messages via UDP to a central Syslog-NG server. Usually the devices log messages to Syslog-NG via UDP in bursts (about 20-25 message within a couple seconds). The source, filter, destination, log statements for the handling are as follows: source src_udp { udp( ip(IPADDRESS) port(PORT) ); }; filter fltr_PROGRAM { program("PROGRAM") or match("PROGRAM"); }; destination dst_PROGRAM { file( "/var/log/PROGRAM/messages" owner(root) group(tomcat) perm(0640) ); }; log { source(src_udp); source(src_tcp); destination(dst_remote_system); flags(final, flow-control); }; What ends up happening when a host falls into this flow, the first log message is missed. The format of the bursts of messages are exactly the same. This did not happen in 2.0rc2, I have downgraded and verified this. Let me know if there's any other info I can provide that would help out. Regards, Justin. -----Original Message----- From: G.W. Haywood [mailto:ged@jubileegroup.co.uk] Sent: Wednesday, September 27, 2006 7:42 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Re: question regarding program name logs Hi there, On Wed, 27 Sep 2006 Justin Randall wrote: > Can anyone confirm if the patch that was to fix this issue was included > in 2.0rc3? Yes, it was. Note that it only affects logging via UDP. -- 73, Ged. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

file issues
by Brian Loe 27 Sep '06

27 Sep '06

I'm running into all kinds of problems running syslog-ng. It won't create the files in subdirectories like I want, it won't feed the named pipes I want... The following is my configuration (and I'm running sec against the pipes - since I need a reader before I start the writer on AIX): # cat /etc/syslog-ng/syslog-ng.conf options { sync (0); chain_hostnames (no); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); dir_owner(syslog); dir_group(syslog); dir_perm(0660); owner(syslog); group(syslog); perm(0660); }; source s_cron { unix-dgram("/dev/cron"); internal(); }; source s_snmp { unix-dgram("/dev/snmp"); internal(); }; source s_sys { unix-dgram("/dev/log"); internal(); }; source s_udp { udp(ip("0.0.0.0") port(514)); }; source s_udp_s { udp(ip("0.0.0.0") port(601)); }; source s_tcp { tcp(ip("0.0.0.0") port(601)); }; source s_tcp1 { tcp(ip("0.0.0.0") port(1026)); }; source s_tcp2 { tcp(ip("0.0.0.0") port(5140)); }; destination d_cons { file("/data/logs/console" perm(0660)); }; destination d_mesg { file("/data/logs/syslog.log" perm(0660)); }; destination d_mail { file("/data/logs/mail.log" perm(0660)); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; destination allmessages { file("/data/logs/$YEAR$MONTH$DAY.allmessages.log" owner(syslog) group(syslog) perm(0660)); }; destination netmessages { file("/data/logs/$YEAR$MONTH$DAY.netmessages.log" owner(syslog) group(syslog) perm(0660)); }; destination d_vpn { file("/data/logs/vpn/$YEAR$MONTH$DAY.vpn.log" owner(syslog) group(syslog) perm(0660)); }; destination d_switch { file("/data/logs/switch/$YEAR$MONTH$DAY.switch.log" owner(syslog) group(syslog) perm(0660)); }; destination d_router { file("/data/logs/router/$YEAR$MONTH$DAY.router.log" owner(syslog) group(syslog) perm(0660)); }; destination d_pixen { file("/data/logs/pixen/$YEAR$MONTH$DAY.pixen.log" owner(syslog) group(syslog) perm(0660)); }; destination d_ids { file("/data/logs/ids/$YEAR$MONTH$DAY.ids.log" owner(syslog) group(syslog) perm(0660)); }; destination vpn_pipe { pipe("/data/pipes/vpn_pipe"); }; # destination net_pipe { pipe("/data/pipes/net_pipe"); }; destination fire_pipe { pipe("/data/pipes/fire_pipe"); }; filter f_filter1 { facility(mail) and level(debug); }; filter f_filter2 { (facility(mail) and level(debug)) or level(info); }; filter f_filter3 { level(alert); }; filter f_filter4 { level(emerg); }; filter f_fl2r16 { netmask(1.1.253.5/255.255.255.255); }; filter f_fl2r17 { netmask(1.1.253.6/255.255.255.255); }; filter f_fl2f12 { netmask(1.1.253.2/255.255.255.255); }; filter f_fl2f1 { netmask(1.1.253.2/255.255.255.255); }; filter f_fl2f2 { netmask(1.1.62.10/255.255.255.255); }; filter f_fl2f11 { netmask(1.1.193.10/255.255.255.255); }; filter f_fl1f1 { netmask(1.1.253.212/255.255.255.255); }; log { source(s_sys); filter(f_filter1); destination(d_mail); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_cons); destination(d_mlrt); }; log { source(s_sys); filter(f_filter4); destination(d_mlal); }; # log { source(s_sys); source(s_cron); source(s_snmp); destination (allmessages); }; log { source(s_sys); source(s_cron); destination (allmessages); }; log { source(s_udp); source (s_udp_s); source (s_tcp); source (s_tcp1); source (s_tcp2); destination(netmessages); }; # log { source(s_udp); source (s_udp_s); source (s_tcp); source (s_tcp1); source (s_tcp2); destination(net_pipe); }; log { source(s_udp); filter(f_fl2r16); filter(f_fl2r17); filter(f_fl2f12); destination(vpn_pipe); }; log { source(s_udp); filter(f_fl2r16); filter(f_fl2r17); filter(f_fl2f12); destination(d_vpn); }; log { source(s_udp); filter(f_fl2f1); filter(f_fl2f2); filter(f_fl2f11); filter(f_fl2f12); filter(f_fl1f1); destination(fire_pipe); }; log { source(s_udp); filter(f_fl2f1); filter(f_fl2f2); filter(f_fl2f11); filter(f_fl2f12); filter(f_fl1f1); destination(d_pixen); }; The command I'm running (and I'm TRYING to run it from inittab): syslog-ng:23456789:respawn:/usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf -u syslog -g <me> -p /etc/syslog-ng.pid

2 10

RE: [syslog-ng] Re: question regarding program name logs
by Justin Randall 26 Sep '06

26 Sep '06

Can anyone confirm if the patch that was to fix this issue was included in 2.0rc3? Justin -----Original Message----- From: Justin Randall Sent: Monday, September 25, 2006 11:46 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Re: question regarding program name logs After upgrading and monitoring, the logs which would previously get logged incorrectly due to the angle bracket prefixing are now not being logged at all. These logs don't come in with any peculiarity about them. The only thing if interest to note is that it is always the first log message in a group of log messages (i.e. host sends 5 Syslog messages, the first one is missed). What kind of logs, information would be helpful to diagnose? I'm currently running on 2.0rc3. Regards, Justin. -----Original Message----- From: G.W. Haywood [mailto:ged@jubileegroup.co.uk] Sent: Tuesday, September 12, 2006 6:27 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Re: question regarding program name logs Hi there, On Tue, 12 Sep 2006 Justin Randall wrote: > I am currently using Syslog-NG version 2.0rc1. > > I've noticed that sometimes when Syslog-NG is logging messages, it > prefixes something onto the program name which disrupts filters > while matching against a program name. For example, in some logs > for a program named "foo" I'll see logs in the form of "<15>foo" > which fail to be matched against a filter of 'program("foo") '. > This seems to only be noticed on logs which originate from remote > hosts. > > Could anyone provide an explanation for what is going on with this? I reported this problem a couple of weeks ago, and Balazs kindly provided a patch which fixed it. I imagine the patch is in .rc2, try upgrading. -- 73, Ged. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

template-escape option and tabs problem
by Manuel Mora 22 Sep '06

22 Sep '06

Hi, I'm using syslog-ng as a central logging server, we are redirectioning some machine's logs to a FIFO pipe that is connected to a MySQL DB via a bash script (the typical syslog-ng , MySQL and php-syslog-ng scenario). destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; Our Windows machines are forwarding logs to the central logging server using SNARE and SNARE uses horizontal tabs as field separator. Early we started to notice that the messages had a strange format in our DB so we redirectioned logs to a file using the same template to check for problems. In the field corresponding to '$MSG' we obtained the next message (with \011\ instead of tabs) : 'EMGDCW502.esp.e-corpnet.org\011MSWinEventLog\0111\011Security\01111688642\011Wed Sep 06 11:20:06 2006\011540\011Security\011ANONYMOUS LOGON\011Well Known Group\011Success Audit\011EMGDCW502\011Logon/Logoff\011\011Successful Network Logon: User Name: Domain: Logon ID: (0x1,0xFAC17236) Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: EMCANW501 Logon GUID: - Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: 10.210.32.230 Source Port: 0 \01111688641' If we use template-escape(no) the message was received correctly so there is a problem with the parsing when template-escape is set to yes, it affects tab characters and it should affect only to ' and " characters. Are there any solutions for this? Best Regards. Manuel Mora

2 3

syslog-ng-2.0rc2 terminates if network connection is down
by Bruce Penrod 22 Sep '06

22 Sep '06

I don't think this is the way it should work... If I have a destination configured over a network path, say udp, and the ethernet device is misconfigured, or deliberately not configured, syslog-ng terminates immediate after start-up with these messages to the console: syslog-ng Connection failed; error='Network is unreachable (101)', reconnect='60' This happens even though other destinations are configured as well, like the local log files. Unfortunately, it doesn't manage to log this termination message in these local logs before it stops. I would think that the inability to reach any of the destinations, local or remote, would not cause the logger to die, if there is still some place it can log. -- Bruce Penrod

1 0

Re: NewBe syslog-ng and fedora core 5 64+bit
by G.W. Haywood 21 Sep '06

21 Sep '06

Hi there, On Thu, 21 Sep 2006 Gregory Machin wrote: > unresolved reference: inputs This tells you the problem. > this is my config file > ... > #source inputs { internal(); ... This 'source' line is commented out, so it doesn't exist, so you can't use the source 'inputs'. That will be a problem when you try to use it. Also the internal() source is required so you MUST include it. If you don't include it, that will be a problem whatever you do. > ... > log { source(inputs); > ... > log { source(inputs); > ... > log { source(inputs); > ... Here are three places where you try to use it. Why was it necessary to ask? If something isn't clear about any of that I'm sure people here would like to know, so that the clarity might be improved. > How should this be defined for fedora core ? > source stdlog { unix-dgram("/dev/log"); }; I don't use Fedora. I would think that's fine, but others here will know for sure. You might want to try log { source(stdlog); ... somewhere instead of one of your log { source(inputs); so that you actually use your 'stdlog' source. FWIW if you're having trouble understanding the syntax of syslog-ng's configuration file then I think you're going to run into difficulty if you try to log to MySQL as a first step. Why not try logging to files to start with, things will probably be a lot clearer for you. You can add database logging later, when you have things under control. -- 73, Ged.

2 1

NewBe syslog-ng and fedora core 5 64+bit
by Gregory Machin 21 Sep '06

21 Sep '06

Hi This is the first time I'm using syslog-ng and I'm trying to log all data to a mysql database ... when I start the service I get the following errors .. [root@greg syslog-ng]# service syslog-ng restart Stopping syslog-ng: [FAILED] Starting syslog-ng: Warning: No source refers to internal messages, they'll go to /dev/null unresolved reference: inputs Error initializing configuration, exiting. [FAILED] [root@greg syslog-ng]# this is my config file # syslog-ng central log host configuration file # # # ##################################################################### # General options options { check_hostname(yes); keep_hostname(yes); chain_hostnames(no); }; # Other important general options # use_fqdn(yes); # sync(0); # keep_hostname(yes); # chain_hostnames(no); # create_dirs(yes); ##################################################################### # Define syslog input stream # This is specific to Solaris 9 #source inputs { internal(); # sun-streams("/dev/log" door("/var/run/syslog_door")); # tcp(max_connections(1000)); }; # For newer versions of Linux (Debian GNU/Linux woody, # and RedHat Linux post 7.0) # source stdlog { unix-dgram("/dev/log"); }; <<<<<<<<<<<<<<<< How should this be defined for fedora core ? ##################################################################### # Define filters # Level Filters filter f_emerg { level (emerg); }; filter f_alert { level (alert .. emerg); }; filter f_crit { level (crit .. emerg); }; filter f_err { level (err .. emerg); }; filter f_warning { level (warning .. emerg); }; filter f_notice { level (notice .. emerg); }; filter f_info { level (info .. emerg); }; filter f_debug { level (debug .. emerg); }; # Facility Filters filter f_kern { facility (kern); }; filter f_user { facility (user); }; filter f_mail { facility (mail); }; filter f_daemon { facility (daemon); }; filter f_auth { facility (auth); }; filter f_syslog { facility (syslog); }; filter f_lpr { facility (lpr); }; filter f_news { facility (news); }; filter f_uucp { facility (uucp); }; filter f_cron { facility (cron); }; filter f_local0 { facility (local0); }; filter f_local1 { facility (local1); }; filter f_local2 { facility (local2); }; filter f_local3 { facility (local3); }; filter f_local4 { facility (local4); }; filter f_local5 { facility (local5); }; filter f_local6 { facility (local6); }; filter f_local7 { facility (local7); }; # syslog-ng stats filter filter f_n_stats { not match("STATS: dropped 0"); }; # syslog-ng "connect from filter filter f_n_connected { not match("AF_INET client connected from"); }; ##################################################################### # Define where the logs can be stored # Log log files destination logpile { file("/var/syslog-ng/$HOST/$YEAR/$MONTH/$FACILITY.$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) create_dirs(yes) dir_perm(0700)); }; # Console log destination console { file("/dev/sysmsg"); }; # Linux Console # destination console { file("/dev/console"); }; # MySQL Database destination d_mysql { pipe("/var/run/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; ##################################################################### # Define logging # Local log log { source(inputs); filter(f_n_stats); filter(f_notice); filter(f_n_connected); destination(logpile); }; # Console log { source(inputs); filter(f_n_stats); filter(f_err); filter(f_n_connected); destination(console); }; # MySQL Database log { source(inputs); filter(f_n_stats); filter(f_notice); filter(f_n_connected); destination(d_mysql); }; -- Gregory Machin gregory.machin(a)gmail.com www.linuxpro.co.za

3 4

RE : PHP Syslog NG error's
by Manuel Mora 19 Sep '06

19 Sep '06

Hi Stuart, I have installed php-syslog-ng on a Suse 9 with no problems but in a Suse 10 (over a VMWARE) I had the 1st problem you have, I solved it disabling the NAME CACHE. Go to <document root>/include/config.php and seek for the line define('USE_CACHE', TRUE) and set it to define('USE_CACHE', FALSE). The second problem is strange, please, set logging in mysql, when mysql daemon is started you set the --log flag, then you'll have logs stored in the same directory where your data is. This log file contains the queries the clients do against the BD, you can check it for problems. Sorry for my english, if you don't understand something I can rewrite it. Regards. On 9/19/06, Stuart Boyle <stuart.boyle(a)cybertrust.com> wrote: > > > > Im having a couple of issue's with phpsyslog-ng, I cant seen any threads or > posts that help with the problem's im having so I need to post, if im > covering old ground, I apologize. > > Im not well versed with MySQL or PHP, so if you could help please explain in > "novice language". > > 1. When I open the browser and login, I then select "search" from the menu > bar, I get the following error: > > USING TABLE:logs > > SELECT * FROM search_cache WHERE tablename='logs'Query failed: You have an > error in your SQL syntax; check the manual that corresponds to your MySQL > server version for the right syntax to use near '' at line 1 > > Im getting the error displayed this way because I have it configured to echo > the result. > In the file search.php I see the following query configured: > $sql = "SELECT * FROM ".CACHETABLENAME." WHERE tablename='".$useTable."'"; > 2. When I try to add a user I input the username and password for the new > account and then receive the following message: > > No DB Link > > Im sure these aren't difficult issues to resolve, but im done beating my > head on a wall. Any help would be appreciated. > Stuart > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > >

1 0

PHP Syslog NG error's
by Stuart Boyle 19 Sep '06

19 Sep '06

Im having a couple of issue's with phpsyslog-ng, I cant seen any threads or posts that help with the problem's im having so I need to post, if im covering old ground, I apologize. Im not well versed with MySQL or PHP, so if you could help please explain in "novice language". 1. When I open the browser and login, I then select "search" from the menu bar, I get the following error: USING TABLE:logs SELECT * FROM search_cache WHERE tablename='logs'Query failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 Im getting the error displayed this way because I have it configured to echo the result. In the file search.php I see the following query configured: $sql = "SELECT * FROM ".CACHETABLENAME." WHERE tablename='".$useTable."'"; 2. When I try to add a user I input the username and password for the new account and then receive the following message: No DB Link Im sure these aren't difficult issues to resolve, but im done beating my head on a wall. Any help would be appreciated. Stuart

2 1

rc2 segfaults under linux
by Harry Hoffman 14 Sep '06

14 Sep '06

Hi All, So I decided to upgrade to rc2 to deal with the fixes for reported memory leaks. Unfortunately, it now segfaults :-( Operating environment is Redhat AS3 update 8. eventlog and syslog-ng v2 rc2 are configured with default options. running under strace I see: poll([{fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=POLLOUT, revents=P OLLOUT}, {fd=11, events=POLLOUT, revents=POLLOUT}, {fd=12, events=POLLOUT, reven ts=POLLOUT}, {fd=13, events=POLLOUT, revents=POLLOUT}, {fd=4, events=POLLIN}, {f d=6, events=POLLIN}, {fd=8, events=POLLIN, revents=POLLIN}, {fd=3, events=POLLIN }, {fd=5, events=POLLIN}, {fd=7, events=POLLIN}], 11, 29882) = 6 write(10, "Sep 13 13:36:47 local_s(a)scribe.i"..., 105) = 105 write(10, "Sep 13 13:36:47 host.fq.dn"..., 139) = 139 write(10, "Sep 13 13:36:47 host.fq.dn"..., 195) = 195 write(10, "Sep 13 13:36:47 host.fq.dn"..., 204) = 204 write(10, "Sep 13 13:36:47 host.fq.dn"..., 97) = 97 write(10, "Sep 13 13:36:47 host.fq.dn"..., 115) = 115 --- SIGSEGV (Segmentation fault) @ 0 (0) --- getpid() = 11482 kill(11482, SIGSEGV) = 0 sigreturn() = ? (mask now []) --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 11482 detached Any thoughts? I wanted to do more debugging but I need to get a test system together for that. Cheers, Harry

2 3

Re: syslog-ng-2.0rc1 doesn't log hostaddress using ipv6
by Bruce Penrod 13 Sep '06

13 Sep '06

> On Mon, 11 Sep 2006 12:00:09 +0200 (CEST), > syslog-ng-request(a)lists.balabit.hu > wrote: > > >On Thu, 2006-08-10 at 19:06 -0700, Bruce Penrod wrote: > >> I'm using the unpatched syslog-ng-2.0rc1. When logging messages sent > >> from another machine over udp6, the hostname of the sending machine is > >> not logged and the receiving host's name is logged instead, so that it > >> looks like the message was generated locally. When using udp, it > works > >> fine. > >> > > > >Can you check if the patch below works for you? It seems to work for me, > >however I don't have a live IPv6 environment. > > > >--- orig/src/misc.c > >+++ mod/src/misc.c > >@@ -127,37 +127,56 @@ gboolean > > resolve_hostname(GString *result, GSockAddr *saddr, gboolean usedns, > gboolean usefqdn) > > { > > static gchar local_hostname[256] = ""; > >- char *hname, *p; > >+ char *hname, *p, buf[256]; > > > >- if (saddr && saddr->sa.sa_family == AF_INET) > >+ if (saddr) > > { > >- struct sockaddr_in *inet_addr = (struct sockaddr_in *) &saddr->sa; > >- > >- /* FIXME: add nscache support here */ > >- > >- if (usedns) > >- { > >- struct hostent *hp; > >- > >- hp = gethostbyaddr((char *) &(inet_addr->sin_addr), > >- sizeof(struct in_addr), AF_INET); > >- hname = (hp && hp->h_name) ? hp->h_name : NULL; > >- } > >+ if (saddr->sa.sa_family == AF_INET || saddr->sa.sa_family == > AF_INET6) > >+ { > >+ void *addr; > >+ socklen_t addr_len; > >+ > >+ if (saddr->sa.sa_family == AF_INET) > >+ { > >+ addr = &((struct sockaddr_in *) &saddr->sa)->sin_addr; > >+ addr_len = sizeof(struct in_addr); > >+ } > >+ else > >+ { > >+ addr = &((struct sockaddr_in6 *) &saddr->sa)->sin6_addr; > >+ addr_len = sizeof(struct in6_addr); > >+ } > >+ > >+ /* FIXME: add nscache support here */ > >+ > >+ if (usedns) > >+ { > >+ struct hostent *hp; > >+ > >+ hp = gethostbyaddr(addr, addr_len, saddr->sa.sa_family); > >+ hname = (hp && hp->h_name) ? hp->h_name : NULL; > >+ } > >+ else > >+ hname = NULL; > >+ > >+ if (!hname) > >+ { > >+ inet_ntop(saddr->sa.sa_family, addr, buf, sizeof(buf)); > >+ hname = buf; > >+ } > >+ else > >+ { > >+ if (!usefqdn) > >+ { > >+ p = strchr(hname, '.'); > >+ if (p) *p = 0; > >+ } > >+ } > >+ } > > else > >- hname = NULL; > >- > >- if (!hname) > >- { > >- hname = inet_ntoa(inet_addr->sin_addr); > >- } > >- else > >- { > >- if (!usefqdn) > >- { > >- p = strchr(hname, '.'); > >- if (p) *p = 0; > >- } > >- } > >+ { > >+ g_assert_not_reached(); > >+ } > > } > > else > > { > > > > > > > > > > > >-- > >Bazsi > > > Yes, it works, but only for about a minute and terminates silently. > Prior to > that, it does indeed log an ipv6 address properly for the sending host. I > haven't scrutinized your patch yet to see if there is an obvious pointer > problem. > > Thanks for getting it this far. > > Bruce Apparently the patch to rc1 did not take well, because I am now running the rc2 code (which seems to have the same ipv6 patch included) and everything seems OK so far. -- Bruce Penrod

1 0

Re: [syslog-ng] Tracking down a failure between NG and FIFO
by Rob Munsch 13 Sep '06

13 Sep '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Antonín Faltýnek wrote: > there is option log_fifo_size(); for syslog-ng that defines size of log queue > in number o messages, couldn't be you logserver overloaded? Yah possibly; in the absence of any other changes, some Event that spiked the volume would be what I expected to find. But i can't find anything in that time frame. > for mysql I'm not using fifo that's mentioned everywhere on inet by I call > mysql as program (I've different table layout): What version does that start appearing in? I've still got 1.6.9 - i was considering upgrading to the 2.0 branch, but not until I understand what happened here. Thanks for the info. It's working now; took down stunnel, syslog, and mysql, stared hard at all the configs for a bit, brought it all back up. Started working again. I'd feel better if i knew why it is working now, even more than finding out what broke before. > Tonda Faltynek > ------------------------------------------------------------ > You can do that without any technological mambo-jumbo... - -- Rob Munsch Solutions For Progress IT www.solutionsforprogress.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFCDbhBvBcJFK6xYURAtz2AJ90qQYUQn9sgPLfYawnjk2e97C1agCaApT1 Abv2dUK1DWHHcK2e+J8KD14= =EM0z -----END PGP SIGNATURE-----

1 0

Re: [syslog-ng] syslog-ng-2.0rc1 doesn't log hostaddress using ipv6
by Bruce M. Penrod 13 Sep '06

13 Sep '06

On Mon, 11 Sep 2006 12:00:09 +0200 (CEST), syslog-ng-request(a)lists.balabit.hu wrote: >On Thu, 2006-08-10 at 19:06 -0700, Bruce Penrod wrote: >> I'm using the unpatched syslog-ng-2.0rc1. When logging messages sent >> from another machine over udp6, the hostname of the sending machine is >> not logged and the receiving host's name is logged instead, so that it >> looks like the message was generated locally. When using udp, it works >> fine. >> > >Can you check if the patch below works for you? It seems to work for me, >however I don't have a live IPv6 environment. > >--- orig/src/misc.c >+++ mod/src/misc.c >@@ -127,37 +127,56 @@ gboolean > resolve_hostname(GString *result, GSockAddr *saddr, gboolean usedns, gboolean usefqdn) > { > static gchar local_hostname[256] = ""; >- char *hname, *p; >+ char *hname, *p, buf[256]; > >- if (saddr && saddr->sa.sa_family == AF_INET) >+ if (saddr) > { >- struct sockaddr_in *inet_addr = (struct sockaddr_in *) &saddr->sa; >- >- /* FIXME: add nscache support here */ >- >- if (usedns) >- { >- struct hostent *hp; >- >- hp = gethostbyaddr((char *) &(inet_addr->sin_addr), >- sizeof(struct in_addr), AF_INET); >- hname = (hp && hp->h_name) ? hp->h_name : NULL; >- } >+ if (saddr->sa.sa_family == AF_INET || saddr->sa.sa_family == AF_INET6) >+ { >+ void *addr; >+ socklen_t addr_len; >+ >+ if (saddr->sa.sa_family == AF_INET) >+ { >+ addr = &((struct sockaddr_in *) &saddr->sa)->sin_addr; >+ addr_len = sizeof(struct in_addr); >+ } >+ else >+ { >+ addr = &((struct sockaddr_in6 *) &saddr->sa)->sin6_addr; >+ addr_len = sizeof(struct in6_addr); >+ } >+ >+ /* FIXME: add nscache support here */ >+ >+ if (usedns) >+ { >+ struct hostent *hp; >+ >+ hp = gethostbyaddr(addr, addr_len, saddr->sa.sa_family); >+ hname = (hp && hp->h_name) ? hp->h_name : NULL; >+ } >+ else >+ hname = NULL; >+ >+ if (!hname) >+ { >+ inet_ntop(saddr->sa.sa_family, addr, buf, sizeof(buf)); >+ hname = buf; >+ } >+ else >+ { >+ if (!usefqdn) >+ { >+ p = strchr(hname, '.'); >+ if (p) *p = 0; >+ } >+ } >+ } > else >- hname = NULL; >- >- if (!hname) >- { >- hname = inet_ntoa(inet_addr->sin_addr); >- } >- else >- { >- if (!usefqdn) >- { >- p = strchr(hname, '.'); >- if (p) *p = 0; >- } >- } >+ { >+ g_assert_not_reached(); >+ } > } > else > { > > > > > >-- >Bazsi Yes, it works, but only for about a minute and terminates silently. Prior to that, it does indeed log an ipv6 address properly for the sending host. I haven't scrutinized your patch yet to see if there is an obvious pointer problem. Thanks for getting it this far. Bruce Bruce Penrod EndRun Technologies LLC "Smarter Timing Solutions" www.endruntechnologies.com 1360 N. Dutton Ave. Suite 200 Santa Rosa, CA 95401 707-573-8633 TEL 707-573-8619 FAX

1 0

Tracking down a failure between NG and FIFO
by Rob Munsch 12 Sep '06

12 Sep '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, i've had a running central loghost server for months on end without any problems. I've noticed however that something seems to have died and i can't pinpoint any changes made to any of the involved systems. After some testing, the central logserver is getting remote messages via stunnel; syslog-ng is logging locally; and if i tell it to put everything into a file, the remote as well as local log entries appear in the file. MySQL seems to be running and that end seems OK. The point of failure seems to be that syslog-ng is no longer putting anything into the named pipe. MySQL is patiently waiting for something to appear there to read; syslog-ng will log to any other destination; but the pipe destination does not seem to be working. How can i observe this process? I can't figure out how to "see" -ng's attempts to log to the pipe destination. The destination definition in question is - ----- # Local MySQL desination destination d_mysql { pipe("/var/run/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, timestamp, program, msg, seq) VALUES ( '$HOST','$FACILITY','$PRIORITY','$LEVEL','$TAG','$ISODATE','$PROGRAM','$MSG','$SEQ' );\n") template_escape(yes) ); }; - ----- exactly as it has been for months. The log directives are - ----- # Sending everything to the MySQL table... log { source(s_all); destination(d_mysql); }; # ... and send incoming logs there as well. log { source(stunnel); destination(d_mysql); ### destination(df_messages); was testing. }; - ----- As you can see by the commented line above, i had remote logs going to local messages dest: that worked fine. Instant results. Any help would be appreciated, as i'm kind of at a loss. - -- Rob Munsch Solutions For Progress IT www.solutionsforprogress.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFBwmVBvBcJFK6xYURAuJnAJ4lKg+94OhZpOvoLsaYcoSAsKoOcgCeLies XXlL1qf/mXl/262LLXBEelg= =ajlW -----END PGP SIGNATURE-----

1 1

syslog-ng 2.0rc2 core
by Martin, David M 12 Sep '06

12 Sep '06

2.0rc2 compiled fine on rhel4 host. same config file as in use w/ 2.0rc1. syntax-only check returns no errors. core dumps on execute. here's the gdb output. (gdb) quit # gdb ./syslog-ng core.1584 GNU gdb Red Hat Linux (6.3.0.0-1.96rh) Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu"...Using host libthread_db library "/lib/tls/libthread_db.so.1". Core was generated by `./syslog-ng -dvy'. Program terminated with signal 11, Segmentation fault. Reading symbols from /lib/libnsl.so.1...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/tls/librt.so.1...done. Loaded symbols for /lib/tls/librt.so.1 Reading symbols from /usr/lib/libglib-2.0.so.0...done. Loaded symbols for /usr/lib/libglib-2.0.so.0 Reading symbols from /opt/sfw/eventlog/0.2.5/lib/libevtlog.so.0...done. Loaded symbols for /opt/sfw/eventlog/0.2.5/lib/libevtlog.so.0 Reading symbols from /lib/tls/libc.so.6...done. Loaded symbols for /lib/tls/libc.so.6 Reading symbols from /lib/tls/libpthread.so.0...done. Loaded symbols for /lib/tls/libpthread.so.0 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /lib/libnss_files.so.2...done. Loaded symbols for /lib/libnss_files.so.2 Reading symbols from /lib/libnss_dns.so.2...done. Loaded symbols for /lib/libnss_dns.so.2 Reading symbols from /lib/libresolv.so.2...done. Loaded symbols for /lib/libresolv.so.2 #0 0x08054b76 in log_template_format (self=0x8a58f10, lm=0x8a5dea0, macro_flags=2, ts_format=0, zone_offset=-1, frac_digits=0, result=0x8a57148) at templates.c:126 126 e = (LogTemplateElem *) p->data; (gdb) bt full #0 0x08054b76 in log_template_format (self=0x8a58f10, lm=0x8a5dea0, macro_flags=2, ts_format=0, zone_offset=-1, frac_digits=0, result=0x8a57148) at templates.c:126 p = (GList *) 0x5f646261 e = (LogTemplateElem *) 0x17b1a4 #1 0x080552df in log_writer_format_log (self=0x8a5d5a0, lm=0x8a5dea0, result=0x8a57148) at logwriter.c:228 template = (LogTemplate *) 0x8a58f10 #2 0x0805557e in log_writer_flush_log (self=0x8a5d5a0, fd=0x8a58f30) at logwriter.c:314 lm = (LogMessage *) 0x8a5dea0 path_flags = 0 line = (GString *) 0x8a57148 rc = 1305628 #3 0x08055078 in log_writer_fd_dispatch (source=0x8a5d5e0, callback=0, user_data=0x0) at logwriter.c:143 self = (LogWriterWatch *) 0x8a5d5e0 #4 0x0012474b in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 No symbol table info available. #5 0x001261d2 in g_main_context_acquire () from /usr/lib/libglib-2.0.so.0 No symbol table info available. #6 0x001266b8 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0 No symbol table info available. #7 0x0804b3e4 in main_loop_run (cfg=0x8a50ec8) at main.c:162 main_loop = (GMainLoop *) 0x8a590c0 iters = 145034952 stats_timer_id = 5 #8 0x0804baac in main (argc=2, argv=0xbfed92c4) at main.c:420 cfg = (GlobalConfig *) 0x8a50ec8 syslog_ng_options = {{name = 0x805d23b "cfgfile", has_arg = 1, flag = 0x0, val = 102}, {name = 0x805d243 "pidfile", has_arg = 1, flag = 0x0, val = 112}, {name = 0x805d24b "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x805d251 "syntax-only", has_arg = 0, flag = 0x0, val = 115}, {name = 0x805d25d "verbose", has_arg = 0, flag = 0x0, val = 118}, {name = 0x805d265 "foreground", has_arg = 0, flag = 0x0, val = 70}, {name = 0x805d270 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x805d17a "version", has_arg = 0, flag = 0x0, val = 86}, {name = 0x805d275 "chroot", has_arg = 1, flag = 0x0, val = 67}, {name = 0x805d27c "user", has_arg = 1, flag = 0x0, val = 117}, { ---Type <return> to continue, or q <return> to quit--- name = 0x805d281 "group", has_arg = 1, flag = 0x0, val = 103}, { name = 0x805d287 "stderr", has_arg = 0, flag = 0x0, val = 101}, { name = 0x805d28e "yydebug", has_arg = 0, flag = 0x0, val = 121}, { name = 0x0, has_arg = 0, flag = 0x0, val = 0}} syntax_only = 0 log_to_stderr = 0 opt = -1 rc = 134520085 The information transmitted (including attachments) is covered by the Electronic Communications Privacy Act, 18 U.S.C. 2510-2521, is intended only for the person(s) or entity/entities to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient(s) is prohibited. If you received this in error, please contact the sender and delete the material from any computer.

2 1

Re: question regarding program name logs
by G.W. Haywood 12 Sep '06

12 Sep '06

Hi there, On Tue, 12 Sep 2006 Justin Randall wrote: > I am currently using Syslog-NG version 2.0rc1. > > I've noticed that sometimes when Syslog-NG is logging messages, it > prefixes something onto the program name which disrupts filters > while matching against a program name. For example, in some logs > for a program named "foo" I'll see logs in the form of "<15>foo" > which fail to be matched against a filter of 'program("foo") '. > This seems to only be noticed on logs which originate from remote > hosts. > > Could anyone provide an explanation for what is going on with this? I reported this problem a couple of weeks ago, and Balazs kindly provided a patch which fixed it. I imagine the patch is in .rc2, try upgrading. -- 73, Ged.

1 0

question regarding program name logs
by Justin Randall 11 Sep '06

11 Sep '06

Hello, I am currently using Syslog-NG version 2.0rc1. I've noticed that sometimes when Syslog-NG is logging messages, it prefixes something onto the program name which disrupts filters while matching against a program name. For example, in some logs for a program named "foo" I'll see logs in the form of "<15>foo" which fail to be matched against a filter of 'program("foo") '. This seems to only be noticed on logs which originate from remote hosts. Could anyone provide an explanation for what is going on with this? Regards, Justin Randall

2 1

syslog-ng 2.0rc2 released
by Balazs Scheidler 11 Sep '06

11 Sep '06

Hi, I'm proud to announce that syslog-ng 2.0rc2 has been released. Hopefully this is the last rc before 2.0.0 final. Here's the list of changes: 2.0rc2 Mon, 11 Sep 2006 12:06:30 +0200 Bugfixes: * Fixed a filter evaluation bug on platforms that have unsigned characters by default. * Fixed a denial of service problem when a zero sized UDP packet is received (was taken as an EOF and the input channel was closed). * Fixed NL handling for datagram transports. * Fixed IPv6 name resolution. * Fixed "Duplicate stats counter" message upon reload for program() destinations. * Fixed various memory leaks. -- Bazsi

2 1

Need Information on installing syslog-ng on Solaris 10
by Swenson, Jim 11 Sep '06

11 Sep '06

Hello. I am trying to find information on how to install syslog-ng on Solaris 10. I have been able to build syslog-ng 2.0rc1 from scratch and am now in the process of attempting to replace the Solaris syslog system with the syslog-ng I have built. The instructions for installing syslog-ng on Solaris 8 and Solaris 9 do not suffice since some of the files mentioned in these documents do not exist on Solaris 10 (specifically the start-up script for syslog). I have seen some mention in the archives of some people who have solved this Problem, but since the archives do not seem to have a search function, I cannot find the beginning of the threads so I can piece together what I ned to do. Also I am not a Solaris SysAdmin, although I have access to one. I have to build and deploy syslog-ng from source since if syslog-ng generates RFC3164 syslog message that cam be forwarded to a centralized syslog server, I will have to deploy it on machines running various flavors of Solaris (8 and 9), Linux, and FreeBSD. I thank you in advance for the help. -------------------------------------------------- James R. Swenson Information Technology Services The Pennsylvania State University jrs40(a)psu.edu, 814.863.1348

2 1