- syslog-ng - lists.balabit.hu

Make Error messages
by Stuart Boyle 28 Feb '06

28 Feb '06

Im getting the following errors when I run make, ./configure runs fine, no errors. I have bison and flex installed. cyblops2a:/usr/local/syslog-ng-1.9.8 # make make all-recursive make[1]: Entering directory `/usr/local/syslog-ng-1.9.8' Making all in src make[2]: Entering directory `/usr/local/syslog-ng-1.9.8/src' gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -Wl,-Bdynamic libsyslog-ng.a(cfg.o)(.text+0x5d6): In function `cfg_new': /usr/local/syslog-ng-1.9.8/src/cfg.c:247: undefined reference to `lex_init' libsyslog-ng.a(cfg-grammar.o)(.text+0x17): In function `yyerror': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:829: undefined reference to `linenum' libsyslog-ng.a(cfg-grammar.o)(.text+0x18ea): In function `yyparse': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.c:1689: undefined reference to `yylex' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/usr/local/syslog-ng-1.9.8/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/syslog-ng-1.9.8' make: *** [all] Error 2 Can anyone advise on a fix. Stuart

2 2

Make Error messages
by Stuart Boyle 28 Feb '06

28 Feb '06

I meant 2.5.31 Im running SUSE Linux. Stuart Boyle Network Engineer Cybertrust, inc . 11000 Broken Land Parkway, Suite 900 Columbia, MD 21044 Office: 443 367 7049 Cell: 410 336 3380 Fax: 443 367 7095 Email: stuart.boyle(a)cybertrust.com

1 0

RE: [syslog-ng] Make Error messages
by Stuart Boyle 28 Feb '06

28 Feb '06

Hello Bazsi I am running with flex-2.5.4, should I remove this and run 2.5.4 ?? Any help is gratefully appreciated. Stuart -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Tuesday, February 28, 2006 6:46 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Make Error messages On Mon, 2006-02-27 at 16:08 -0500, Stuart Boyle wrote: > Im getting the following errors when I run make, ./configure runs > fine, no errors. > > I have bison and flex installed. Which version of flex do you have? I have flex 2.5.31 -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Filtering on date/time
by Dean Takemori 26 Feb '06

26 Feb '06

Hello, This is on a Debian system with syslog-ng 1.6.5-2.2. Is there any way to filter on the log timestamp? For example, suppose I have a (machine|program) that reboots once a day at 0400, and I don't want to log those events. I'd like to be able to set up a filter something like this ... filter match_dailyreboot { not (match("04:0[0-1]:[0-9][0-9]") and program("foo") and (match("Starting a brand new workday") or match("*many annoying daily restart message*") ) ); }; But as I understand the rules, match() only matches on the message. Is there any way in the 1.6.* series to filter on time and other bits? -dean takemori

3 2

syslog-ng 1.9.9 released
by Balazs Scheidler 26 Feb '06

26 Feb '06

Hi, I have released syslog-ng 1.9.9, a version marking the feature freeze towards syslog-ng 2.0.0. This is still a "development" release however this is more suited for production use than previous versions. The list of user-visible changes summarizing the changes since 1.9.8 can be found below. Please note that previous snapshots (dated after 2006-02-24) contained a severe problem that might have caused crashes which I have fixed in this release, but is not in the NEWS entry as 1.9.8 did not have this problem. The release is available at the usual place: http://www.balabit.com/products/syslog-ng/ The latest documentation is not yet available on the webpage, you'll have to wait for that till tomorrow when the next snapshot will be generated. 1.9.9 Sun, 26 Feb 2006 09:49:47 +0100 Some minor new features: * Added optional() option to pipe and unix drivers to make syslog-ng start even if the required directories/files do not exist. * Added DNS name resolution to udp and tcp targets. * Added a stats() keyword for 1.6.x compatibility. * Added processed counters for source/destination groups and the log center. * Added normalize_hostnames() option which converts all hostnames to lower case. * Added PID macro. * Added kernel flag to sources to indicate that messages coming from the source should default to 'kern.notice' instead of 'user.notice' * Added frac_digits() option which controls how many digits are printed in second fractions. * Added time_sleep() option to add a fixed latency to the poll loop required in some tuning situations. * Documentation updates. Changes: * Removed stats entries for files as they never lose messages and it would only clutter the log statistics output. * The meaning of the undocumented keep_timestamp() option was changed and documented, it controls whether syslog-ng uses the time of reception or the time included in the log message. Bugfixes: * Fixed port unreachable handling for UDP destinations. * Fixed PRI macro processing as it included the local hostname in addition to the priority value because of a missing break statement. * UNIX domain sockets are kept alive across SIGHUPs by default. * Fixed a possible segmentation fault on SIGHUP. * Fixed timezone extraction from incoming messages with ISO timestamp (only this syslog-ng can send these currently) * Fixed HOST_FROM, FULLHOST_FROM, SOURCEIP, DATE, R_DATE, S_DATE macros (some were still not implemented others worked incorrectly in some circumstances) * Fixed fractions of a second processing. -- Bazsi

1 0

Question about unix-dgram destinations
by Tom Morano 23 Feb '06

23 Feb '06

Hi all, I have an application that I would like to send all syslog messages to via an AF_UNIX/SOCK_DGRAM socket. I declared a unix-dgram destination in my syslog-ng.conf file and have configured syslog-ng so that it logs all messages to that destination. Everything works fine as long as my application is running before syslog-ng starts up. If I try to start up syslog-ng before my application, I get the following error message Re-Staring syslog servicesError connecting to AF_UNIX(/tmp/.mysock): Bad file descriptor and syslog-ng exits with an error. Is there any way I can have syslog-ng start before my application with a unix-dgram destination? Or am I just missing something obvious? BTW, I am using syslog-ng-1.6.8 Thanks in advance for any help with this... Tom

2 1

preparing for 1.9.9
by Balazs Scheidler 22 Feb '06

22 Feb '06

Hi, I have spent the last two days on hacking syslog-ng with a good number of fixes and couple of features requested a long time ago. Syslog-ng 1.9.8 got into Debian sid and apart from a couple of problems the house is not burning :) In summary syslog-ng 1.9.x is getting into shape, and slowly might be ready for some more production-like environments. I would like to ask you to give a try to these snapshot releases I've just uploaded to our website. Assuming no grave problems are found in the next day or two I'll release 1.9.9 and hopefully we can have a stable 2.0.0 in the nearfuture. I'm still not happy with the way log statistics (per source/destination dropped/processed counters) are written to the system log. I'm starting to think that the logfile is not necessarily the best medium to write this information to. I'm open to suggestions. The exact versions: eventlog-0.2.4+20060212.tar.gz syslog-ng-1.9.8+20060212.tar.gz The NEWS file entry is the longest ever in the history of 1.9.x, here it is: 1.9.9 Some minor new features: * Added optional() option to pipe and unix drivers to make syslog-ng start even if the required directories/files do not exist. * Added DNS name resolution to udp and tcp targets. * Added a stats() keyword for 1.6.x compatibility. * Added processed counters for source/destination groups and the log center. * Added normalize_hostnames() option which converts all hostnames to lower case. * Added PID macro. * Added kernel flag to sources to indicate that messages coming from the source should default to 'kern.crit' instead of 'user.notice' * Added frac_digits() option which controls how many digits are printed in second fractions. * Documentation updates. Changes: * Removed stats entries for files as they never lose messages and it would only clutter the log statistics output. * The meaning of the undocumented keep_timestamp() option was changed and documented, it controls whether syslog-ng uses the time of reception or the time included in the log message. Bugfixes: * Fixed port unreachable handling for UDP destinations. * Fixed PRI macro processing as it included the local hostname in addition to the priority value because of a missing break statement. * UNIX domain sockets are kept alive across SIGHUPs by default. * Fixed a possible segmentation fault on SIGHUP. * Fixed timezone extraction from incoming messages with ISO timestamp (only this syslog-ng can send these currently) * Fixed HOST_FROM, FULLHOST_FROM, SOURCEIP, DATE, R_DATE, S_DATE macros (some were still not implemented others worked incorrectly in some circumstances) * Fixed fractions of a second processing. -- Bazsi

2 3

Syslog logging failure only at boot (Mac OS X)
by Orth, Alan 17 Feb '06

17 Feb '06

List, I tried my best to search the archives for this information but I came up with no real answers. I've got three Mac OS X Panther servers running syslog-ng, and they run it very well. The only problem I have is when I reboot the servers syslog-ng starts from rc but fails to start logging. It's running, but it's not logging. I have to kill it and run it manually and then it runs. It's like it's choking on something by coming up too early in the boot process...? I've tried compiling 1.9.x to see if that fixes it, but I end up running into dependency problems down the line somewhere. (is 1.9.x that portable yet?). This is a drag when you go to check the logs from ssh, sudo, portsentry, mail, etc... and you find that syslog-ng never started logging after you rebooted 2 weeks ago. Yikes. Thanks for any insight, -- Alan Orth Upward Bound - Systems Administrator User Services - Field Technician California State University, Chico x6000

2 2

RE: [syslog-ng] Limit logging frequency of specific messages?
by SOLIS, ALEX 15 Feb '06

15 Feb '06

I don't understand. How might limiting be possible with a filter? Could you give a brief example? Thanks. Alex -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Wednesday, February 15, 2006 5:09 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Limit logging frequency of specific messages? it should be possible with a filter, I'll add a bugreport to our bugzilla. (maybe there's one already though) On Tue, 2006-02-14 at 15:14 -0500, Frank Myhr wrote: > Hi, > > This morning a daemon went nuts and sent enough messages to fill up my > logging partition in a few seconds. As this partition is under /var > (/var/log) this made some other parts of my system unhappy. I think I've > fixed the particular problem that led to my system's self-inflicted DOS > but got to wondering if there's a way that syslog-ng could limit the > frequency with which it logs certain user-defined messages. Something > like iptables' limit match: > > -m limit --limit 15/hour --limit-burst 30 > > I haven't found a way to do this with syslog-ng 1.6.5 (debian sarge). Is > something like this feasible (or better, planned for a future release) > (or best: already there)? > > Thanks! > Frank > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

2 1

Limit logging frequency of specific messages?
by Frank Myhr 15 Feb '06

15 Feb '06

Hi, This morning a daemon went nuts and sent enough messages to fill up my logging partition in a few seconds. As this partition is under /var (/var/log) this made some other parts of my system unhappy. I think I've fixed the particular problem that led to my system's self-inflicted DOS but got to wondering if there's a way that syslog-ng could limit the frequency with which it logs certain user-defined messages. Something like iptables' limit match: -m limit --limit 15/hour --limit-burst 30 I haven't found a way to do this with syslog-ng 1.6.5 (debian sarge). Is something like this feasible (or better, planned for a future release) (or best: already there)? Thanks! Frank

2 1

Re: [syslog-ng] RFC3339 fractional second logging
by rlott＠ivhs.com 13 Feb '06

13 Feb '06

1 0

Email Alerts from Syslog-ng
by Stuart Burgis 13 Feb '06

13 Feb '06

I am a fairly new to all this so please excuse me. I am having lots of problems getting syslog-ng to send email alerts based upon certain text based filters. I am running RedHat 9.0 with syslog-ng-1.6.2-1 installed from the rpm, I have configured the syslog-ng.conf file correctly to enable filtering with a match statement for a specific IP address in the logs and this works when using ‘destination file { file("/etc/syslog-ng/test.log"); };’ but when I point this to the perl script that I have got off of this URL HYPERLINK "http://www.campin.net/newlogcheck.html"http://www.campin.net/newlogcheck.html I get nothing. Please see below the destination statement and perl script that I have created with executable permissions. Syslog-ng.conf destination email { program("/etc/syslog-ng/mail.pl"); }; filter f_test { match(192.168.1.1); }; log { source(src); filter(f_test); destination(email); }; Mail.pl #!/usr/bin/perl -n # ## shell version # # while read line; do # echo $line | /bin/mail -s "log alert" support(a)businessfcl.com # done # strip the priority s/^<[\d]{1,2}>//; # mail the cleaned up message system("echo \"$_\" | /bin/mail -s \"log alert\" monitor"); Every time I restart the syslog-ng service I get a mail to the monitor user which would indicate that the perl script sends mail and that syslog-ng runs it during startup but it does not appear to work when the filter is applied. Can any one help with this please? Regards Stuart Burgis -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 267.15.2/252 - Release Date: 06/02/2006

2 1

please unsubcribe me form the list
by anil saka 12 Feb '06

12 Feb '06

1 0

Re: [syslog-ng] RFC3339 fractional second logging
by rlott＠ivhs.com 12 Feb '06

12 Feb '06

2 3

Newbie
by Adrian 12 Feb '06

12 Feb '06

ajc80, Sunday, January 29, 2006, 3:30:27 PM, you wrote: > Hello, > I'm a newbie to syslog-ng, I have followed the instructions and used and > altered the necessary examples to suit my directory structures, so my syslog > messages are dumped in to mysql database. > When starting syslog-ng I get the following messages: > # /etc/init.d/syslog-ng start > Starting MySQL pipe... > Starting syslog-ng... > Warning: No source refers to internal messages, they'll go to /dev/null > unresolved reference: inputs > Error initializing configuration, exiting. > The "No source refers to internal messages...." message I understand. > The "unresolved reference: inputs" I don't and can't seem to find anything > in the archives. Looking through your conf file I don't see an inputs source - except the commented out Solaris one. > I've included the syslog-ng.conf file and the mysql.pipe file below. > Any help would be appreciated. > Thanks, > Adrian. > ##################################################################### > # Define syslog input stream > # This is specific to Solaris 9 > # source inputs { internal(); > # sun-streams("/dev/log" door("/var/run/syslog_door")); > # tcp(max_connections(1000)); }; > # For newer versions of Linux (Debian GNU/Linux woody, > # and RedHat Linux post 7.0) > # > source stdlog { unix-dgram("/dev/log"); }; >As above. I am a newbie myself so I am probably talking through my >hat anyway ;) > -- > Best regards, > David mailto:dma at pern.co.uk ####################################################################### Hi David, I'm still none the wiser. I have hashed out the three lines which start source inputs: > # source inputs { internal(); > # sun-streams("/dev/log" door("/var/run/syslog_door")); > # tcp(max_connections(1000)); }; As it suggests that this is for Solaris systems only, and Redhat should use the following line: > # For newer versions of Linux (Debian GNU/Linux woody, > # and RedHat Linux post 7.0) > # > source stdlog { unix-dgram("/dev/log"); }; Which I un-hashed. Where would I places the inputs and what would they look like?? Any help very much appreciated. Kind regards, Adrian.

2 1

Re: [syslog-ng] RFC3339 fractional second logging
by rlott＠ivhs.com 10 Feb '06

10 Feb '06

2 1

RFC3339 fractional second logging
by rlott＠ivhs.com 09 Feb '06

09 Feb '06

2 1

(no subject)
by rlott＠ivhs.com 08 Feb '06

08 Feb '06

1 0

problem to log fetcmail logs
by Thierry B 03 Feb '06

03 Feb '06

Hello, I'd like to use syslog-ng to log fetchmail logs. For the moment, fetcmail logs are in /var/log/fetchmail.log and I'd like to put it in /var/log/$YEAR:$MONTH$DAY, to have a separate log file for each day. I try to add that: source fetchmail { file("/var/log/fetchmail.log"); }; destination df_fetchmail { file("/var/log/$YEAR/$MONTH/$DAY/fetchmail.log"); }; log { source(fetchmail); filter(f_fetchmail); destination(df_fetchmail); }; But it dosn't works. Do you have an idea? Thanks :-) Bye

3 4

strange logging behaviour
by stucky 02 Feb '06

02 Feb '06

guys I've setup a central syslog-ng based server on RHEL4 using version 1.6.6. I have the central server set to log things to 2 destinations. Once to the regular logfile and again to an archive file. I open 2 terminals to it and tail -f both /var/log/messages and the appropriate archive file. Then I go to one of the clients and do : '/usr/bin/logger test' and watch. What is weird is this: /var/log/messages shows 'test' right away but the archive log takes about a minute to show it. Then on the client I do: /usr/bin/logger test2 now it doesn't show up on either log then on the client i do: /usr/bin/logger test3 and all of a sudden all 3 testlogs show up in both logs. This is not al all consistens though. I can repeat the test and this time it's the arcive log that shows the log first and /var/log/messages takes sweet time, or both take time. I understand that it may take a little to send the stuff over the net but once it has reached the logserver why isn't it sent to both destinations at the same time ? INTERESTING NOTE: If I run the stresstest.sh script that comes with the syslog-ng source on the client I ALWAYS see ALL logs immediately in both destinations on the log server. I had noticed before that sending a couple of logs seems to help. As if syslog-ng decides to send logs in bulk so if there is only one tiny log it appears to wait till there are more logs - then it catches up. However, sometimes even a small log show up right away. Again - i can't see consistency. Here is my log server syslog-ng.conf. ############################################################### # First, set some global options. options { use_fqdn(no); use_dns(yes); dns_cache(yes); keep_hostname(yes); long_hostnames(off); sync(1); stats(0); create_dirs(yes); perm(0640); dir_perm(0750); }; source src { file("/proc/kmsg"); unix-stream("/dev/log"); internal(); udp (ip("10.152.1.67")); tcp(ip("0.0.0.0") port(5000) max-connections(1000) keep-alive(yes)); }; destination authlog { file("/var/log/auth"); }; destination cron { file("/var/log/cron"); }; destination uucp { file("/var/log/uucp"); }; destination mail { file("/var/log/mail"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty8"); }; destination console_file { file("/var/log/console"); }; destination arch { file("/usr/local/var/log_archive/$HOST/$YEAR/$MONTH/$DAY/archive"); }; filter f_auth { facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_mail { facility(mail); }; filter f_uucp { facility(cron); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, mail, news); }; filter f_emergency { level(emerg); }; filter f_notcron { not match("cron.minute)"); }; filter f_auth_junk { not ( match("Accepted publickey for nagios from 10.152.48.42") or match("Accepted publickey for nagios from 127.0.0.1") or match("Accepted publickey for oracle from ********") or match("Accepted publickey for oracle from ********") or match("Accepted publickey for stucky from ********") or match("Accepted publickey for cfengine from **********") or match("COMMAND=/usr/local/nagios/home/check_duplex") or match("reconnecting to LDAP server.+sleeping") or match("session opened for user nagios") or match("session closed for user nagios") or match("session opened for user root")); }; filter f_junk { not ( match("]: AF_INET client connected from")); }; log { source(src); filter(f_auth); filter(f_auth_junk); destination(authlog); }; log { source(src); filter(f_cron); filter(f_notcron); destination(cron); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_messages); filter(f_junk); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(f_emergency); destination(console_file); }; log { source(src); filter(f_auth_junk); filter(f_notcron); destination(arch); }; and here my syslog-ng.conf from the client: ############################################################### # First, set some global options. options { use_fqdn(no); use_dns(yes); dns_cache(yes); keep_hostname(yes); long_hostnames(off); sync(1); stats(0); create_dirs(yes); }; source src { file("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; destination authlog { file("/var/log/auth"); }; destination cron { file("/var/log/cron"); }; destination kern { file("/var/log/kernel"); }; destination uucp { file("/var/log/uucp"); }; destination mail { file("/var/log/mail"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty8"); }; destination console_file { file("/var/log/console"); }; destination loghost { tcp("logger" port(5000)); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv) and not facility(mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter f_nagios { not ( match("Accepted publickey for nagios from *********") or match("COMMAND=/usr/local/nagios/home/check_duplex") or match("session opened for user nagios") or match("session closed for user nagios")); log { source(src); filter(f_authpriv); filter(f_nagios); destination(authlog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(messages); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_kern); destination(messages); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(messages); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(f_cnews); destination(console_all); }; log { source(src); filter(f_cother); destination(console_all); }; log { source(src); filter(f_emergency); destination(console_file); }; log { source(src); filter(f_cnews); destination(console_file); }; log { source(src); filter(f_cother); destination(console_file); }; log { source(src); filter(f_nagios); destination(loghost); }; This may also be a good opportunity to have someone check whether my configs are sane at all. I'm not 100% sure about them. I don't really want to log to all kinds of different files, rather I want to have mail stuff go to mail, cron stuff to cron, auth stuff to auth and the rest to messages. help would be appreciated. -- stucky

1 0

Fulldate in log files
by Gustavo Mendes de Carvalho 02 Feb '06

02 Feb '06

Hi All, Actually, I have my syslog-ng configured as shown bellow. Jan 29 12:17:01 linux1 CRON[31468]: message itself My conf file has this statements # begin of log conf file source s_all { unix-stream("/dev/log"); internal(); }; destination d_auth { file("/var/log/auth.log"); }; destination d_syslog { file("/var/log/syslog"); }; destination d_cron { file("/var/log/cron.log"); }; filter f_auth { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; log { source(s_all); filter(f_auth); destination(d_auth); }; log { source(s_all); filter(f_syslog); destination(d_syslog); }; log { source(s_all); filter(f_cron); destination(d_cron); }; log { source(s_all); filter(f_daemon); destination(d_daemon); }; # end of log conf file How can I do to put a full date (including year) in this logfile ? Thanks in advance Gustavo

1 0

strange message handling in syslog-ng
by BURRUSS, RICHARD S (ASI) 02 Feb '06

02 Feb '06

Hello all, I am trying to set up a new central syslogd server. I want to keep logging locally as well as on the new server. I have my syslogd.conf from the local machines and my syslog-ng.conf from the central server listed below. The problem I am having is that some messages being sent to the log server are not being sorted by their hostname field. They are instead being broken down into many different directories as shown in the example below. So, instead of the message going to the correct directory for that hostname it is creating numerous new directories with the name of that part of the message beginning with a ".". Odd. I can't figure out why it is these messages are being handled this way. Can anyone help please? Example of the directories being created. The first seven entries should not be there. # cd /var/log/HOSTS # ls -la total 28 drwx------ 14 root root 512 Jan 26 22:31 . drwxr-xr-x 6 root sys 512 Jan 11 10:44 .. drwx------ 3 root root 512 Jan 26 22:31 .Cmd drwx------ 3 root root 512 Jan 26 22:31 .Disconnected drwx------ 3 root root 512 Jan 26 22:29 .SCSI drwx------ 3 root root 512 Jan 26 22:31 .got drwx------ 3 root root 512 Jan 26 22:31 .pkt_flags=0x4000 drwx------ 3 root root 512 Jan 26 22:31 .pkt_scbp=0x0 drwx------ 3 root root 512 Jan 26 00:02 SRS drwx------ 3 root root 512 Jan 11 15:18 dbln-jumpstart drwx------ 3 root root 512 Jan 25 15:33 eight drwx------ 3 root root 512 Jan 11 11:23 ndpsunray1 drwx------ 3 root root 512 Jan 11 13:27 ndpsunray2 drwx------ 3 root root 512 Jan 25 15:26 nine # syslogd.conf #ident "@(#)syslog.conf 1.4 96/10/11 SMI" /* SunOS 5.0 */ # # Copyright (c) 1991-1993, by Sun Microsystems, Inc. # # syslog configuration file. # # This file is processed by m4 so be careful to quote (`') names # that match m4 reserved words. Also, within ifdef's, arguments # containing commas must be quoted. # # *.err;kern.notice;auth.notice /dev/console kern.notice;user.err /dev/console kern.notice @loghost auth.info /var/adm/messages auth.info @loghost *.err;daemon.none;kern.info;mail.crit /var/adm/messages *.err;daemon.none;kern.info;mail.crit @loghost daemon.crit /var/adm/messages daemon.crit @loghost daemon.notice /var/adm/messages daemon.notice @loghost *.alert;kern.err;daemon.err operator *.alert root *.emerg * mail.info /var/adm/messages mail.debug @loghost user.alert @loghost user.alert /var/adm/messages syslogd-ng.conf # # syslog-ng package built by Nate Campi <nate(a)campin.net> # # This should behave pretty much like the original syslog on SunOS. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { sun-stream ("/dev/log" door("/etc/.syslog_door")); }; source net { udp(); }; source s_internal { internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/adm/messages"); }; destination d_mail { file("/var/log/syslog"); }; destination d_auth { file("/var/log/authlog"); }; destination d_mlop { usertty("operator"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; destination std { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$FACILITY$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) );}; filter f_filter1 { level(err) or (level(notice) and facility (auth, kern)); }; filter f_filter2 { level(err) or (facility(kern) and level(notice)) or (facility(daemon) and level(notice)) or (facility(mail) and level(crit)); }; filter f_filter3 { level(alert) or (facility(kern) and level(err)) or (facility(daemon) and level(err)); }; filter f_filter4 { level(alert); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(kern) and level(notice); }; filter f_filter7 { facility(mail) and level(debug); }; filter f_filter8 { facility(user) and level(err); }; filter f_filter9 { facility(user) and level(alert); }; log { source(net); destination(std); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_mlop); }; log { source(s_sys); filter(f_filter4); destination(d_mlrt); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_auth); }; log { source(s_sys); filter(f_filter7); destination(d_mail); }; log { source(s_sys); filter(f_filter8); destination(d_cons); destination(d_mesg); }; log { source(s_sys); filter(f_filter9); destination(d_mlop); destination(d_mlrt); }; log { source(s_internal); destination(d_mesg); }; Thanks for looking,

2 1

io.c: do_read: read( ) failed (errno 1), Operation not permitted
by Rick.Daoust＠borealc.on.ca 01 Feb '06

01 Feb '06

I installed syslog-ng version 1.6.9 on Fedora Core 4 in a chroot jail and when starting it, I receive the following message "io.c: do_read: read( ) failed (errno 1), Operation not permitted". I believe this message is the result of syslog-ng not being able to read from /proc/kmsg. However, I'm a newbie to Linux and Sylog-ng! Any suggestions would be greatly appreciated!

4 4

Inserting text in syslog messages
by Gustavo Mendes de Carvalho 31 Jan '06

31 Jan '06

Dear All, Does anybody knows how to insert some string in a message that will be apended in log files ? I mean, imagine that syslog-ng receives this message to insert in /var/log/auth.log. Jan 31 13:18:01 host sshd[6278]: Accepted keyboard-interactive/pam for user from 10.10.0.29 port 49105 ssh2 And I would like to insert some text together, resulting in some like this Jan 31 13:18:01 host sshd[6278]: Accepted keyboard-interactive/pam for root from 10.10.0.29 port 49105 ssh2 - service xyz for user root How can I include this string " - service xyz for user root" ? I know that it's possible, but I didn't find how to. Thanks in advance Gustavo

2 1

SuSE 10.0 - Changing permissions on special file /dev/xconsole
by George 30 Jan '06

30 Jan '06

Hello, I am getting the following in my /var/log/warn file at each bootup. What is it about and how do I fix it? Jan 26 06:26:52 dns1 syslog-ng[3430]: Changing permissions on special file /dev/xconsole Jan 26 06:26:52 dns1 syslog-ng[3430]: Changing permissions on special file /dev/tty10 I have SuSE 10.0 installed on a IBM X330 (8654-51Y) eserver xseries with a dual Pentium III (x84) and a S3 Savage 4 video card. Thanks, George -- George genz1968(a)fastmail.fm -- http://www.fastmail.fm - One of many happy users: http://www.fastmail.fm/docs/quotes.html

2 3