- syslog-ng - lists.balabit.hu

ULP - Universal Logging Protocol
by Ken Garland 11 Oct '05

11 Oct '05

I'm not terribly familiar with ULP, just recently having heard of it. Though I was wondering if Syslog-NG plans, or currently is, implementing this protocol? Any links or information regarding this would be helpful. Thanks, Ken

1 0

2 questions
by CIKALA Frederic ROSI/DOSI 11 Oct '05

11 Oct '05

Hello everyone 1- I'm just wondering if the encryption support is now available for syslog NG. I've checked google, but did not find information about the encryption of the syslogNG flows. I've just found this paper, but it's out of date i think (it has been written five years ago) https://lists.balabit.hu/pipermail/syslog-ng/2000-December/001100.html I just want to securize the data that are send to the syslogNG central server ... I've got another question : 2- Do you know if there exist a syslogNG version for OS's like VMS or WMS ? thanks :) *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

1 0

phpsyslogng 2.8 trouble
by Robert Cole 10 Oct '05

10 Oct '05

When I try to login to php-syslog-ng I get "Username and password combination does not exist!". I can login as those users I try at a mysql -u prompt. Any ideas? Thanks, Robert

1 0

RE: [syslog-ng] Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin Nipper 10 Oct '05

10 Oct '05

> I've added a simple configure check on tm_gmtoff and if it does not > exist I fall back to the global "timezone" variable. > > It should be available in the yesterday's snapshot. > > -- > Bazsi I downloaded the latest snapshot and gave this a try on my Solaris 8 system. I see the check being made in the configure script, but it still errored off when trying to compile misc.c. It looks like there may also be a reference (in the code) to another non-existent variable (tm_isdst). Anyway, that execution stream follows. Let me know if there's something that I can send you that would help you to figure this out. I'm glad to do so. THANKS for your help! ./configure checking for a BSD-compatible install... ./install-sh -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... no checking for nawk... nawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc option to accept ANSI C... none needed checking for bison... no checking for byacc... no checking for flex... no checking for lex... lex checking for yywrap in -lfl... no checking for yywrap in -ll... yes checking lex output file root... lex.yy checking whether yytext is a pointer... no checking whether make sets $(MAKE)... (cached) yes checking for ranlib... ranlib checking how to enable static linking for certain libraries... GNU or Solaris checking how to run the C preprocessor... gcc -E checking for egrep... egrep checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... no checking for unistd.h... yes checking dmalloc.h usability... no checking dmalloc.h presence... no checking for dmalloc.h... no checking for strings.h... (cached) yes checking openssl/ssl.h usability... no checking openssl/ssl.h presence... no checking for openssl/ssl.h... no checking getopt.h usability... no checking getopt.h presence... no checking for getopt.h... no checking whether struct tm is in sys/time.h or time.h... time.h checking for struct tm.tm_gmtoff... no checking for door_create in -ldoor... yes checking for socket in -lsocket... yes checking for gethostbyname in -lnsl... yes checking for regexec in -lregex... no checking for strdup... yes checking for strtol... yes checking for inet_aton... no checking for inet_ntoa... yes checking for getopt_long... no checking for global timezone variable... yes checking for pkg-config... /usr/local/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB_CFLAGS... -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include checking for GLIB_LIBS... -L/usr/local/lib -lglib-2.0 -liconv checking for EVTLOG_CFLAGS... -I/usr/local/include/eventlog checking for EVTLOG_LIBS... -L/usr/local/lib -levtlog checking for static GLib libraries... yes configure: creating ./config.status config.status: creating dist.conf config.status: creating Makefile config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating doc/docvars.xml config.status: creating contrib/Makefile config.status: creating tests/Makefile config.status: creating tests/unit/Makefile config.status: creating tests/functional/Makefile config.status: creating config.h config.status: executing depfiles commands secdevrsn01 # make make all-recursive Making all in src if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT misc.o -MD -MP -MF ".deps/misc.Tpo" \ -c -o misc.o `test -f 'misc.c' || echo './'`misc.c; \ then mv -f ".deps/misc.Tpo" ".deps/misc.Po"; \ else rm -f ".deps/misc.Tpo"; exit 1; \ fi misc.c: In function `get_local_timezone_ofs': misc.c:86: error: request for member `tm_isdst' in something not a structure or union *** Error code 1 make: Fatal error: Command failed for target `misc.o' Current working directory /var/opt/packages/syslog-ng-1.9.5+20051010/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /var/opt/packages/syslog-ng-1.9.5+20051010 *** Error code 1 make: Fatal error: Command failed for target `all'

1 0

Re: syslog-ng Digest, Vol 6, Issue 10
by Jason Pepas 09 Oct '05

09 Oct '05

On Thu, Oct 06, 2005 at 09:10:41PM +0200, syslog-ng-request(a)lists.balabit.hu wrote: > >+ if (left && *src >= '0' && *src <= '9') { > > Consider isdigit(3) This was done to remain consistent with the existing code. Do you want me to enlarge the scope of the patch to change the existing instances of this as well? > >+ while (left && *src >= '0' && *src <= '9') { > > Consider isdigit(3) or parse up to *src == ']' I avoided parsing up to ']' to avoid the unlikely situation where someone sends us a mal formatted log entry. If for some reason I get a message like "foo[135xyz]", I don't want the xyz part, even though the 135 part is probably garbage anyway. > > self->msg = c_format_cstring("syslog-ng[%i]: %s", getpid(), >length, > data); > > self->program = c_format_cstring("syslog-ng"); > >+ self->pid = c_format_cstring("%i", getpid()); > > This is wrong! You most certainly don't want to add the pid of the > receiving syslog-ng process. seen out of context, that part of the patch is deceptive and misleading at first glance, but I am pretty certain it is correct. This is part of the make_internal_message() function. Notice the existing call to getpid() a few lines up where self->msg is being constructed. > Whitespace/tab damage. oops! I probably have broken .vimrc settings. Also, is macros.gperf an automatically generated file? I wasn't sure if I needed to patch that part. -jason pepas

3 6

dropping
by Ferenc Wagner 07 Oct '05

07 Oct '05

Hi, Using Debian Sarge I set up a configuration where some 160 machines log by TCP to a single central server. When the machines boot (all at the same time) they obviously put quite some load on the server, which results in lines like Oct 6 20:55:18 bigyo syslog-ng[24969]: STATS: dropped 1303 after the client connected messages. Also there is a constant periodic loss (the clients run synchronised, so cron jobs fire simultaneously) amounting to Oct 7 06:35:27 bigyo syslog-ng[24969]: STATS: dropped 9 Is there a way to overcome this? In average the log traffic is fairly low, but huge bursts do happen as described above. Setting log_fifo_size on the server didn't help much; it logs straight onto disk: [stock Debian Sarge part distributing local logs elided] options { keep_hostname (yes); }; source s_cl { tcp (max_connections (255)); }; destination d_cl { file ("/var/log/cluster/$HOST" template ("$DATE $MSG\n") group ("adm") perm (0640) create_dirs (yes) dir_perm (750)); }; log { source (s_cl); destination (d_cl); }; The clients are configured like this (full file): options { use_dns (no); }; source s_all { internal (); unix-stream ("/dev/log"); file ("/proc/kmsg" log_prefix ("kernel: ")); }; destination bigyo { tcp ("bigyo"); }; log { source (s_all); destination (bigyo); }; Stock Sarge syslog-ng 1.6.5 with Debian patches on all machines. -- Thanks, Feri.

4 3

RE: [syslog-ng] Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 07 Oct '05

07 Oct '05

> The latest snapshot having the fix is always at most 24 hours > later. So > you might want to download the latest snapshot again today and verify > your findings. I don't have time to do it right now but it would be > perfect if you could spare some minutes and try again with the newest > snapshot drop. > > Best regards, > Roberto Nibali, ratz I tried the latest snapshot of syslog-ng, but it fails to compile the initial module. I get: misc.c: In function `get_local_timezone_ofs': misc.c:83: error: structure has no member named `tm_gmtoff' Bottom line... I'm unable to test the facility/level fix because I can't get a clean compilation on the latest version. Sorry. Marvin

3 5

RE: [syslog-ng] - Syslog not logging
by Marvin.Nipper＠Stream.com 07 Oct '05

07 Oct '05

> -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > kevin(a)herald.ca > Sent: Tuesday, October 04, 2005 11:21 AM > To: Syslog-ng users' and developers' mailing list > Subject: [syslog-ng] - Syslog not logging > > However, I see no logging in any of the destination files. Is > there some > type of debugging switch to help determine why the logs are not being > written to? > > Thanks for any help, > > Kevin What version of 1.9.5 are you using? I recently reported a problem with facility/level filtering in the original (July) 1.9.5 version, and that was supposed to be fixed in the latest snapshot. However, I'm having a problem compiling that snapshot on Solaris 8, so I can't test it (but I'd bet it probably will work!). Your configuration appears to look a lot like mine did, with respect to facility/level filtering. It wouldn't surprise me that you might be having exactly the same problem. You might try the latest snapshot to see if it resolves your issue. All, FWLIW..... Marvin

4 4

modifying $host in the distination
by Terry 06 Oct '05

06 Oct '05

Hello, The $HOST variable in cases contains the IP address of the host. This makes perfect sense but I want it to be the hostname. Can I have a mapping of some sorts in the config: 10.10.0.1 == foorouter Thanks!

2 1

Syslog 1.6.8 compile error
by Rohald van Baars 06 Oct '05

06 Oct '05

Hi, can someone please help me to get the compile right. OS: RHEL ES 3 update 4 The ./configure went well no errrors. But the make did not go so well: Error message(s) : >> snip gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afpr gram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lnsl -lresolv / sr/local/lib/libol.a -lnsl -Wl,-Bstatic -Wl,-Bdynamic cfg-lex.o(.text+0x45f): In function `yylex': /root/rpm/syslog-ng/syslog-ng-1.6.8/src/cfg-lex.c:1123: undefined reference to yywrap' cfg-lex.o(.text+0xb33): In function `input': /root/rpm/syslog-ng/syslog-ng-1.6.8/src/cfg-lex.c:1450: undefined reference to yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make: *** [all-recursive] Error 1 << snap Can someone plz explain what went wrong? Rohald van Baars Digitenne B.V. The netherlands WWW: www.digitenne.nl ############################################################################ Attention: The information contained in this message and or attachments is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any system and destroy all copies. ############################################################################

4 3

Re: [syslog-ng] Syslog-ng configuration.
by Adams, Russell L. 06 Oct '05

06 Oct '05

See the syslog-ng FAQ on campin.net, and also: http://www.adamsinfoserv.com/central_syslog.pdf Russell On Fri, Oct 07, 2005 at 12:28:47AM +0530, Krishnakumar Menon wrote: > > > > > Hi , > > I am new to this group. Just recently felt a need to centralize all my > /var/adm/messages for my 12 different machines. > > The job is I have 12 Solaris machines. > > I want to make one server as central syslog server. The rest 12 servers > will send their messages file to this central syslog server where the > activities will be logged. > > Few queries. > > a. How will syslog-ng will help me to achieve this? > b. Which is the latest software and patch to be downloaded ? > c. What activities i.e. installation/configuration needs to be done > at Server side and client side ? > d. How to monitor and administer these files. i.e. is their any > GUI's or CLI's in place ? > > > > Thanks and regards > > Krishna > > > > > > **************** CAUTION - Disclaimer ***************** > This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended > solely for the use of the addressee(s). If you are not the intended > recipient, please notify the sender by e-mail and delete the original > message. Further, you are not to copy, disclose, or distribute this > e-mail or its contents to any other person and any such actions are > unlawful. This e-mail may contain viruses. Infosys has taken every > reasonable precaution to minimize this risk, but is not liable for any > damage you may sustain as a result of any virus in this e-mail. You > should carry out your own virus checks before opening the e-mail or > attachment. Infosys reserves the right to monitor and review the content > of all messages sent to or from this e-mail address. Messages sent to or > from this e-mail address may be stored on the Infosys e-mail system. > ***INFOSYS******** End of Disclaimer ********INFOSYS*** > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >

1 0

Syslog-ng configuration.
by Krishnakumar Menon 06 Oct '05

06 Oct '05

Hi , I am new to this group. Just recently felt a need to centralize all my /var/adm/messages for my 12 different machines. The job is I have 12 Solaris machines. I want to make one server as central syslog server. The rest 12 servers will send their messages file to this central syslog server where the activities will be logged. Few queries. a. How will syslog-ng will help me to achieve this? b. Which is the latest software and patch to be downloaded ? c. What activities i.e. installation/configuration needs to be done at Server side and client side ? d. How to monitor and administer these files. i.e. is their any GUI's or CLI's in place ? Thanks and regards Krishna **************** CAUTION - Disclaimer ***************** This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message. Further, you are not to copy, disclose, or distribute this e-mail or its contents to any other person and any such actions are unlawful. This e-mail may contain viruses. Infosys has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Infosys reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infosys e-mail system. ***INFOSYS******** End of Disclaimer ********INFOSYS***

1 0

syslog-ng on AIX 5.3
by Michael Mannsberger 06 Oct '05

06 Oct '05

Does not log at all. Anybody got this working on AIX?

2 1

RE: [syslog-ng] Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 06 Oct '05

06 Oct '05

> I've added a simple configure check on tm_gmtoff and if it does not > exist I fall back to the global "timezone" variable. > > It should be available in the yesterday's snapshot. > > -- > Bazsi THANKS so much. Really appreciated!

1 0

RE: [syslog-ng] Centralize different kind of logs ...
by Marvin.Nipper＠Stream.com 06 Oct '05

06 Oct '05

> -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > CIKALA Frederic ROSI/DOSI > Sent: Thursday, October 06, 2005 2:27 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Centralize different kind of logs ... > > Hello, i haven't received my second mail for this ML, so i re send it > > I'm wondering if i'll use syslog-ng in order to centralize a > lot of logs that are from different kind of machines. > > Actually i've to centralize logs that are from Active > Directory, Exchange .... > > For example, those others machines have UNIX, Solaris, > Windows and VMS for OS ... > > In fact, i don't know if it exists a tool that can do this > thing for my several servers ... > > Thanks for help :) Take a look at SNARE. You can find it here: http://www.intersectalliance.com/projects/index.html It's a good way to get Windows Event Logs fed upstream to syslog-ng.

1 0

patch for $PID support
by Jason Pepas 06 Oct '05

06 Oct '05

Hurray for insomnia! I have implemented $PID macro support in syslog-ng 1.6.8, and have tested it out on gentoo linux. http://www.ices.utexas.edu/~cell/gentoo/syslog-ng/ -jason pepas

2 1

Centralize different kind of logs ...
by CIKALA Frederic ROSI/DOSI 06 Oct '05

06 Oct '05

Hello, i haven't received my second mail for this ML, so i re send it I'm wondering if i'll use syslog-ng in order to centralize a lot of logs that are from different kind of machines. Actually i've to centralize logs that are from Active Directory, Exchange .... For example, those others machines have UNIX, Solaris, Windows and VMS for OS ... In fact, i don't know if it exists a tool that can do this thing for my several servers ... Thanks for help :) *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

1 0

syslog-ng sending to pipe
by shaun.hofer＠altcall.com 06 Oct '05

06 Oct '05

Hi all Syslog-ng is set to write to a pipe. Syslog-ng starts very early on in the boot process, nothing is reading from the pipe yet. Later on, mysql script starts reading from the pipe, but by that time, it seems as though syslog isn't bothering to write to the pipe anymore. 'ps axf' shows this for the mysql init script: '2023 /etc/init.d/sqlsyslogd start' The mysql init script thinks the pipe is blocked. If you restart syslog-ng at this point the mysql script starts reading from the pipe. Do you have any ideas as to how to get this working? Heres the script: case "$1" in start) # If the pipe does not exist, create it if [ ! -e /tmp/mysql.pipe ] ; then mkfifo /tmp/mysql.pipe fi mysql -u sys --password=xxxx syslog< /tmp/mysql.pipe & ;; stop ) if [ -e /tmp/mysql.pipe ]; then rm -f /tmp/mysql.pipe fi ;; *) echo "Usage: sqlsyslogd {start|stop}" exit 1; esac exit 0; >From the syslog-ng.conf: destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG','$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") templ ate-escape(yes)); }; log { source(s_all); source(tcpgateway); destination(d_mysql); }; Thanks in advance Shaun

2 3

no $PID macro?
by Jason Pepas 05 Oct '05

05 Oct '05

Hi, The log format macro system is a great idea. However, I didn't see $PID as an option. Is there a reason for this? Should I wade through the source and create a patch, or is this an unsolveable problem? thanks, jason pepas

3 4

RE: [syslog-ng] Architecture Question'
by CIKALA Frederic ROSI/DOSI 05 Oct '05

05 Oct '05

Yes, i know it is not specific enough ... But nobody here can tell me exactly the frequency of the logs that will be sent :-/ One thing is sure : it wont be 1 message per server per day, but something like 500 /server /days ... Do you want to know something else ? -----Message d'origine----- De : syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu]De la part de kenneth.gullberg(a)foreningssparbanken.se Envoyé : mardi 4 octobre 2005 10:00 À : syslog-ng(a)lists.balabit.hu Objet : SV: [syslog-ng] Architecture Question' im afraid that the only answer you are going to get is: Depends on what kind of traffic you expect to be seeing.. 7000 machines logging 1 message every minute is nothing but if you are expected to receive 1 message / second / server then you need a different setup.. You need to be more specific! -----Ursprungligt meddelande----- Från: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] För CIKALA Frederic ROSI/DOSI Skickat: den 4 oktober 2005 09:34 Till: syslog-ng(a)lists.balabit.hu Ämne: [syslog-ng] Architecture Question' Hello everyone' I'm new to this mailing list and i do not know syslogNG yet Actually, i have to prepare a server that will centralize a lot of logs, from about 7000 other servers. I've read that syslogNG is a great tool that can do a lot of interresting things. Therefore, i chose this application for my project but i do not know if it needs big ressources to be launched ... In fact, i'm wondering about the hardware i'll have to buy in order to make this project Maybe someone of this list has got a greater opinion about what i'll have to buy for example "at least a 3gHz cpu, with 2 gig of ram ..." It could be usefull', thank you ^^ *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. *********************************** *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

3 2

message parsing help
by blenox＠gmx.net 05 Oct '05

05 Oct '05

Hello All, i have a few questions about syslog-ng message parsing is it possible to scan each syslog message for system-notification*(traffic) once this matches, to insert the values !splitted! into a database with the the following fields: device_id start_time duration policy_id service ip_proto src_zone dst_zone action sent rcvd src_ip dst_ip src_port dst_port src_xlated_ip dst_xlated_ip port session_id the whole message looks like this: Oct 3 15:35:32 172.10.0.10 NS50: NetScreen device_id=NS50 [No Name]system-notification-00257(traffic): start_time="2005-10-03 15:01:37" duration=21 policy_id=1 service=https proto=6 src zone=Trust dst zone=Untrust action=Permit sent=2454 rcvd=1601 src=172.18.12.10 dst=172.17.10.24 src_port=1458 dst_port=443 src-xlated ip=172.18.12.113 port=1458 session_id=63649 i was able to filter certain messages, but never to split up the real "message field". Any help with examples would be great im using syslog-ng 1.6.8 Cheers and thank's in advance Marco -- GMX DSL = Maximale Leistung zum minimalen Preis! 2000 MB nur 2,99, Flatrate ab 4,99 Euro/Monat: http://www.gmx.net/de/go/dsl

2 1

spoof_source not working
by Chance Ellis 04 Oct '05

04 Oct '05

I am running syslog-ng 1.6.8 on Solaris 9. I recompiled with the --enable-spoof-source configure option. Here is my config: destination d_squelch_acl { udp("10.159.234.52 <http://10.159.234.52>" port(514) spoof_source(yes)); }; filter f_squelch_acl { match("list squelch denied"); }; log { source(net); filter(f_squelch_acl); destination(d_squelch_acl);}; source net { udp(); }; If I start syslog-ng without spoof_source(yes) option, all messages matching are forwarded to the machine in the destination. If I change to spoof_source(yes) nothing gets forwarded at all. I do not get any errors when I start syslog-ng, like "spoof-source support not compiled in" which I get on other boxes I have not recompiled on yet. Any ideas? Chance

4 10

- Syslog not logging
by kevin_herald 04 Oct '05

04 Oct '05

Hello, I've installed syslog-ng-1.9.5 on Solaris 9 and it appears to startup and be running. root 430 1 0 14:17:46 ? 0:00 /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf -p /etc/syslog-ng/sy However, I see no logging in any of the destination files. Is there some type of debugging switch to help determine why the logs are not being written to? Thanks for any help, Kevin ps. Here is a copy of my syslog-ng.conf file. # syslog-ng configuration file. # # This should behave pretty much like the original syslog on SunOS. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_remote { udp(ip(0.0.0.0) port(514)); internal(); }; destination syslog { file("/var/log/syslog"); }; destination messages { file("/var/adm/messages"); }; destination loghost { tcp("191.168.230.20" port (5140)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/adm/messages"); }; destination d_mail { file("/var/log/syslog"); }; destination d_auth { file("/var/log/authlog"); }; destination d_mlop { usertty("operator"); };filter f_filter1 { level(err) or (level(notice) and facility (auth, kern)); }; filter f_filter2 { level(err) or (facility(kern) and level(notice)) or (facility(daemon) and level(notice)) or (facility(mail) and level(crit)); }; filter f_filter3 { level(alert) or (facility(kern) and level(err)) or (facility(daemon) and level(err)); }; filter f_filter4 { level(alert); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(kern) and level(notice); }; filter f_filter7 { facility(mail) and level(debug); }; filter f_filter8 { facility(user) and level(err); }; filter f_filter9 { facility(user) and level(alert); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_mlop); }; log { source(s_sys); filter(f_filter4); destination(d_mlrt); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_auth); }; log { source(s_sys); filter(f_filter7); destination(d_mail); }; log { source(s_sys); filter(f_filter8); destination(d_cons); destination(d_mesg); }; log { source(s_sys); filter(f_filter9); destination(d_mlop); destination(d_mlrt); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); };

1 0

RE: [syslog-ng] Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 04 Oct '05

04 Oct '05

> > I tried the latest snapshot of syslog-ng, but it fails to > compile the > > initial module. I get: > > misc.c: In function `get_local_timezone_ofs': > > misc.c:83: error: structure has no member named `tm_gmtoff' > > Hmm, this is a BSD extension, and IIRC you are using a BSD system, > aren't you? Actually, this is a Solaris 8 system (with gcc 3.4.2). The (original) July 1.9.5 compiles just fine. I'm just uncertain what has changed since then, that is causing this issue. The time.h file on this system appears to have come as part of the SUNWhea package, and does not include the information shown above. Not sure if that helps(?). THANKS for your guidance. Marvin

3 2

Thomas X Hill/GIS/CSC is out of the office.
by Thomas X Hill 04 Oct '05

04 Oct '05

I will be out of the office starting 04.10.2005 and will not return until 07.10.2005. I will respond to your message when I return.

1 0