- syslog-ng - lists.balabit.hu

SV: [syslog-ng] Architecture Question'
by kenneth.gullberg＠foreningssparbanken.se 04 Oct '05

04 Oct '05

im afraid that the only answer you are going to get is: Depends on what kind of traffic you expect to be seeing.. 7000 machines logging 1 message every minute is nothing but if you are expected to receive 1 message / second / server then you need a different setup.. You need to be more specific! -----Ursprungligt meddelande----- Från: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] För CIKALA Frederic ROSI/DOSI Skickat: den 4 oktober 2005 09:34 Till: syslog-ng(a)lists.balabit.hu Ämne: [syslog-ng] Architecture Question' Hello everyone' I'm new to this mailing list and i do not know syslogNG yet Actually, i have to prepare a server that will centralize a lot of logs, from about 7000 other servers. I've read that syslogNG is a great tool that can do a lot of interresting things. Therefore, i chose this application for my project but i do not know if it needs big ressources to be launched ... In fact, i'm wondering about the hardware i'll have to buy in order to make this project Maybe someone of this list has got a greater opinion about what i'll have to buy for example "at least a 3gHz cpu, with 2 gig of ram ..." It could be usefull', thank you ^^ *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

1 0

RE: [syslog-ng] Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 04 Oct '05

04 Oct '05

> Exactly. Here is the full code which seems to work around > those issues > rather nicely (you're in for a good treat reading the comment block > almost at the end of the code): > > http://svn.apache.org/viewcvs.cgi/apr/apr/trunk/time/unix/time.c?view=mark up Can you say "Jump thru hoops"? > I wonder if this should be implemented in syslog-ng as well? I hope so! But that's easy for me to say, looking in from the outside. ;-) > Bazsi is > in Sevilla > enjoying the sun and giving interesting speeches at the > present time ;). Sounds well deserved! I hope that it's an enjoyable trip! > Could you grep for this tm_gmtoff and altzone as follows, > please (maybe > it's defined as __tm_gmtoff)? > > find /usr/ -type f -name "*.h" -exec grep "tm_gmtoff" /dev/null {} \; These hits: /usr/local/lib/perl5/5.8.7/sun4-solaris/CORE/config.h: * the struct tm has a tm_gmtoff field. /usr/local/lib/perl5/5.8.7/sun4-solaris/CORE/uconfig.h: * the struct tm has a tm_gmtoff field. > find /usr/ -type f -name "*.h" -exec grep "altzone" /dev/null {} \; These hits: /usr/include/time.h:extern long altzone; /usr/include/time.h:extern long timezone, altzone; Thanks for the help Roberto. You have a great week. Marvin

2 1

Architecture Question'
by CIKALA Frederic ROSI/DOSI 04 Oct '05

04 Oct '05

Hello everyone' I'm new to this mailing list and i do not know syslogNG yet Actually, i have to prepare a server that will centralize a lot of logs, from about 7000 other servers. I've read that syslogNG is a great tool that can do a lot of interresting things. Therefore, i chose this application for my project but i do not know if it needs big ressources to be launched ... In fact, i'm wondering about the hardware i'll have to buy in order to make this project Maybe someone of this list has got a greater opinion about what i'll have to buy for example "at least a 3gHz cpu, with 2 gig of ram ..." It could be usefull', thank you ^^ *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

1 0

RE: [syslog-ng] Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 03 Oct '05

03 Oct '05

> I didn't check but most probably he added the > localtime(&when) call in > get_local_timezone_ofs() to extract the seconds you are away > from UTC, > including DST handling. Unfortunately I do not understand enough of > timezone handling to be much of a help here. Time is too a difficult > subject for me to understand, so I'm glad it works most of > the time :). > ............................... > > Hmm, the "correct" file I see has shown up in Solaris 10 ;) > with the libbc: > > http://cvs.opensolaris.org/source/xref/usr/src/lib/libbc/inc/i > nclude/time.h > > Tomorrow I'll have access again to a Solaris 8 machine where > I could try > compiling the source. Bazsi seems to be very busy these days, > so we just > have to wait for a bit ... > > Regards, > Roberto Nibali, ratz Well this is depressing.... I'm googling this, and found this: http://archive.apache.org/gnats/7902 I get the distinct impression that tm_getoff doesn't exist on Solaris 8 (although it appears that Sun finally added it later on, as it's obviously there in 10). I guess the Apache guys produced a Solaris-specific chunk of code to work around that shortcoming (and that's what the web page is discussing). If anyone has any clues as to how one might add the "later" (more capable) time functionality on Solaris 8, I'd obviously love to hear it, or it looks like I'm dead in the water for using the future version of syslog-ng at this point. (i.e. a possible patch, or external component, that has this extended capability.) Thanks! Marvin

2 1

unsubscribe
by Brown, Donna Jeanne 03 Oct '05

03 Oct '05

Please unsubscribe me from this list. Donna Brown (djbrown(a)sandia.gov)

1 0

Re: [syslog-ng] match text within message
by Roberto Nibali 03 Oct '05

03 Oct '05

> Thanks Roberto, > I am trying to do exactly what you presumed. Ok. >>So you write: >> >>match PIX and not A and not B >> >>> Any suggestions? >> >>filter f_pix { >> match("PIX") and match("987.65.4.[34]"); >>}; > > > So, in order to exclude ip address 987.65.4.3 and ip address 987.65.4.4 > would the sytax be as follows? Well, I'm a bit unsure about your use of the term "ip address", since the noted dotted decimals are not valid ip addresses. > filter f_pix { > match("PIX") and not match("987.65.4.[34]"); > }; I would say so. > Thanks again!!! Tell us if it works and if not, we're more than happy to help you out further. Don't forget to cc the list since other people might want to know this as well and could potentially help you out better then I can. Best regards, Roberto Nibali, ratz -- ------------------------------------------------------------- addr://Kasinostrasse 30, CH-5001 Aarau tel://++41 62 823 9355 http://www.terreactive.com fax://++41 62 823 9356 ------------------------------------------------------------- terreActive AG Wir sichern Ihren Erfolg -------------------------------------------------------------

1 0

Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 03 Oct '05

03 Oct '05

Balazs... I didn't know if you'd seen this (original) thread (I won't repeat all of it here, but did repeat Peter's suggested fix below). I applied this fix, and it did resolve my problems, as it did Peter's. I looked at the latest snapshot, and didn't see this particular change applied, so I figured that I'd ask whether this is something that should be applied(?) Or... Possibly... It's resolved through some other means, or worse (for me) maybe it implies that I've got something else misconfigured, that is actually the root cause of my (and maybe Peter's) problem. If there's any information that you need from me, I'd be happy to supply it. Thanks for your good work and efforts! Marvin -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of pnahas(a)mrv.com Sent: Friday, September 30, 2005 2:27 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Ver 1.9.5 problems with facility/level filtering I too have experienced this problem and decided to investigate the source code. Unless I'm missing something, it appears that 1.9.5 simply does not set the correct variable internally, regardless of configuration. The following patch solved the problem for me: --- /home/pnahas/syslog-ng-1.9.5/src/filter.c 2005-01-05 06:40:50.000000000 -0500 +++ filter.c 2005-09-30 16:23:29.000000000 -0400 @@ -162,6 +162,7 @@ { FilterPri *self = g_new0(FilterPri, 1); + self->valid = facilities; self->super.eval = filter_facility_eval; return &self->super; } @@ -180,6 +181,7 @@ { FilterPri *self = g_new0(FilterPri, 1); + self->valid = levels; self->super.eval = filter_level_eval; return &self->super; } Hope that helps! -Peter Nahas

2 1

match text within message
by Antonio Brown 03 Oct '05

03 Oct '05

Below are a couple of message samples: "Message: %PIX-51-100908: Teardown UDP connection 30292827 for THEFORCEVPN: 123.45.678.91/3130 to inside:987.65.4.3/53 duration.......etc.." "Message: %PIX-51-070605: Teardown UDP connection 26252423 for ISSTRONGVPN: 111.21.314.15/3130 to inside:987.65.4.4/53 <http://210.65.4.4/53>duration.......etc.." I am trying to match 987.65.4.3 or 987.65.4.3/53 and 987.65.4.4<http://210.65.4.4>. Here is my syntax: filter f_pix { match(PIX) and not match("987.65.4.3") and not match(" 987.65.4.4 <http://210.65.4.4>"); }; Any suggestions? Thank You for your assistance! >match() matches the message part only, which does not include the >hostname part in the message header. If you actually copied a sample >message it would be easier to help out, and you have a much better >chance to receive messages on the syslog-ng mailing list. Lots of >helpful folks there, I'm sometimes unable to respond for days. :) > >-- > Bazsi >> Hello! >> >> I am trying to filter an IP by using match in the syslog-ng.conf file. >> Below (in bold) is a portion of the thread that sort of describes my problem. >> However the IP address that I am attempting to match is not the sender. >> >>It is actually located within the message. >> >> I am using the following syntax: >> >> filter f_pix { match(PIX) and not match("xxx\.xx\.x\.x"); }; >> >> Did not work. I've attempted many other variations and still no go. >> >> >> again the address that I am attempting to match is not the sender. It is located >> within the message.

2 1

Fwd: [syslog-ng] syslog-ng not logging
by catenate 03 Oct '05

03 Oct '05

Frowarding to the list, wish gmail used the reply-to header. :( ---------- Forwarded message ---------- From: catenate <infosec(a)gmail.com> Date: Sep 29, 2005 7:54 PM Subject: Re: [syslog-ng] syslog-ng not logging To: fico gid <ficohertz(a)gmail.com> On 9/29/05, fico gid <ficohertz(a)gmail.com> wrote: > > Hi Again, > > Below is the whole syslog-ng.conf file . Yes, it is not separating as > in /host/somehost/year/month/day .. > > <SNIP> > > Let me know if you need more info, Thanks Fico, This has to be the first time I've ever seen someone completely omit an options{}; block. Now I know that syslog-ng will gladly use defaults for all the options if/when you leave that out. Anyways, I'm still not completely clear on how exactly your installation is logging. Are you saying that you have logs going to /var/log/kern.log and the other NON-MACRO destinations, or are you saying that your macro filenames in /var/log/hosts/HOST/YEAR/... are being logged but incorrectly, like /var/log/hosts/YEAR/... ? Please be specific. I did a syntax check on your config file, and it looks fine to me. What version are you using?

3 3

syslog-ng 1.6.8 and dns cache issue
by Ketan Vankawala 02 Oct '05

02 Oct '05

I have currently installed Syslog-ng ver 1.6.8. Here is a snippet of my syslog-ng config file.So accordingly when a syslog message comes in, depending on the ip address, it does a lookup in /etc/hosts, creates an appropriate host name folder and forwards the message there. If the hostname does not exists, it creates a folder named with the ip address. Here is my question: 1) How often does syslog-ng refreshes its dns /hosts cache? Because I have run into issues that even after the /etc/hosts file is updated syslog still keeps logging to the folder created with the ip address. If I restart syslog-ng service it immediately starts forwarding the messages correctly to hostname folder. 2) How can I reduce the dns cache timeout, so it checks /etc/hosts more frequently for any changes? Thanks in advance. Ketan destination hostslocal { file("/var/log/HOSTS/$HOST/$YEAR-$MONTH-$DAY.log" owner(root) group(xxx) perm(0740) dir_perm(0740) create_dirs(yes) template("$R_DATE $FULLHOST $MONTH $S_DAY $S_YEAR $S_HOUR:$S_MIN:$S_SEC: $MESSAGE\n") template-escape(no)); }; log { source(src); destination(hostslocal); };

2 2

RE: [syslog-ng] Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 01 Oct '05

01 Oct '05

>>On Mon, Sep 26, 2005 at 12:30:23PM -0600, Marvin.Nipper(a)Stream.com wrote: >> >> So. I'm looking for any input as to what might be a potential root >> problem. Obviously, there are a whole set of different pre-req components >> for the 1.9.5 world. I'm not sure if I'm dealing with some compatibility >> problem amongst the component versions that I've selected(?), or if the >> problem lies elsewhere. > >There's no obvious cause going by your description, but maybe if we saw >your config we'd notice something. Please post your complete config >file, if you don't mind. > >Thanks. >-- >Nate Here's my current configuration: options { dir_perm(0755); perm(0600); chain_hostnames(no); keep_hostname(yes); log_fifo_size(1000); }; # Catch everything coming from other sysloggers source any_udp { udp(); }; # Pipe used by SEC (Simple Event Correlation) destination SEC {pipe("/tmp/sec"); }; # Various segregated logging files destination routers_log { file("/var/adm/log/routers.log" create_dirs(yes)); }; destination ravlin_log { file("/var/adm/log/ravlin.log" create_dirs(yes)); }; destination windows_log { file("/var/adm/log/windows.log" create_dirs(yes)); }; destination catch-all_log { file("/var/adm/log/catch-all.log" create_dirs(yes)); }; destination test { file("/var/adm/log/test.log" create_dirs(yes)); }; # Some place to dump noise destination dev_null { file("/dev/null" ); }; ######## Logging commands ############# # Send a copy of everything to SEC #log { source(any_udp); destination(SEC); }; # syslog.info /var/adm/log/windows.log filter f_4 { facility(syslog) and level(info..emerg); }; log { source(any_udp); filter(f_4); destination(windows_log); flags(final); }; # local5.debug /var/adm/log/routers.log filter f_1 { facility(local5) and level(debug..emerg); }; log { source(any_udp); filter(f_1); destination(routers_log); flags(final); }; # Kill SonicWall Noise first filter SonicWallNoise { match("id=firewall") and filter(SonicWallMsgs); }; filter SonicWallMsgs { match("m=97") or match("m=98") or match("m=537"); }; log { source(any_udp); filter(SonicWallNoise); destination(dev_null); flags(fina l); }; # local0.debug /var/adm/log/ravlin.log filter f_3 { facility(local0) and level(debug..emerg); }; log { source(any_udp); filter(f_3); destination(ravlin_log); flags(final); }; # (catch all) /var/adm/log/catch-all.log log { source(any_udp); destination(catch-all_log); flags(final); }; Again, this configuration works just fine with my 1.6.8 compilation. Output is properly distributed to all of the listed files. With my 1.9.5 compilation, the final (unfiltered) file gets everything. In short, I know that the inbound syslog packets are fine (i.e. that they have the correct facility/level information), or 1.6.8 would be broken as well. THANKS for any and all help! Marvin

3 2

RE: [syslog-ng] Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 30 Sep '05

30 Sep '05

>I too have experienced this problem and decided to investigate the >source code. Unless I'm missing something, it appears that 1.9.5 simply >does not set the correct variable internally, regardless of >configuration. The following patch solved the problem for me > >............ > >Hope that helps! > >-Peter Nahas I won't be able to give it a go to test it until next week, BUT I wanted to fire off a quick message and thank you for your QUICK response and help. I'm betting that if it worked for you, it will solve my problem as well. THANKS AGAIN for your help! Marvin

1 0

Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 30 Sep '05

30 Sep '05

Sorry (in advance) if this is a dimwitted question.. I've slurped down and compiled these components on my Solaris 8 system: pkg-config-0.19; glib-2.8.1; eventlog-0.2.3+20050116+1856; and finally the non-snapshot flavor of syslog-ng 1.9.5. Everything appears to have compiled OK, and I am able to load and execute syslog-ng, and it actually operates, albeit not exactly right (which is the driver for this email). I have a 1.6.8 version of syslog-ng that "eats" my (fairly simple) config file, and sorts thru the incoming syslog traffic, filtering it to one of three primary target files, based upon facility/level combinations. These log statements all use a flags-final setting. There is one final (fourth) log statement that feeds a catch-all file, with anything not distributed to the first three files. When using the 1.6.8 executable, these four files accumulate data, as anticipated (i.e. everything works just fine). However, when I attempt to utilize the new 1.9.5 executable (on the same system), nothing is fed to the first three files. The only file getting any input is the final, catch-all file. Essentially, the only difference between the catch-all statement, and the filtered statements, is the existence of the filters on those statements, which reference filters similar to this: filter f_1 { facility(local5) and level(debug..emerg); }; It's not clear to me why the filtering activity is failing. Again, those filters are fine in a 1.6.8 setting. So. I'm looking for any input as to what might be a potential root problem. Obviously, there are a whole set of different pre-req components for the 1.9.5 world. I'm not sure if I'm dealing with some compatibility problem amongst the component versions that I've selected(?), or if the problem lies elsewhere. Thanks for any and all input and suggestions. > Marvin Nipper Director of Security Stream > mailto:marvin.nipper@stream.com > PGP Key ID: 0xD3EB5CE5 (RSA); 0x8EE28551 (DSS/DH) >

2 1

syslog-ng not logging
by fico gid 30 Sep '05

30 Sep '05

hi there syslog gurus.. Is the configuration below enough for me to log some of my routers ? 157.0.1.1 is my syslog server and im suppose to get logs frm a few routers. I have added appropriate logging commands on the routers to log to the syslog server but i don't see anything. syslog-ng is started and listening on both udp/tcp . Im running on freebsd --start-- ## syslog-ng source remote { unix-stream("/var/run/log"); internal(); pipe("/dev/klog"); udp(ip(157.0.1.1) port(514)); tcp(ip(157.0.1.1) port(514) keep-alive(yes)); }; destination std { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; log { source(remote); destination(std); }; destination authlog { file("/var/log/auth.log"); }; destination cron { file("/var/log/cron.log"); }; destination debug { file("/var/log/debug.log"); }; destination kern { file("/var/log/kern.log"); }; destination user { file("/var/log/userlog"); }; destination maillog { file("/var/log/maillog"); }; destination security { file("/var/log/security"); }; destination messages { file("/var/log/messages"); }; --end-- any hints or help is much appreciated. thanks fico

2 4

Syslog compile error
by philip 29 Sep '05

29 Sep '05

Hi, I got the following error message when I run "make" Making all in src make[1]: Entering directory `/root/syslog-ng-1.6.0rc3/src' make all-recursive make[2]: Entering directory `/root/syslog-ng-1.6.0rc3/src' Making all in . make[3]: Entering directory `/root/syslog-ng-1.6.0rc3/src' gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lnsl -lresolv -lfl /usr/local/lib/libol.a -lnsl sources.o(.text+0x211): In function `do_read_line': /root/syslog-ng-1.6.0rc3/src/sources.c:91: undefined reference to `MIN' sources.o(.text+0x443): In function `make_log_reader': /root/syslog-ng-1.6.0rc3/src/sources.c:169: undefined reference to `MAX' cfg-lex.o(.text+0x4cc): In function `append_string': /root/syslog-ng-1.6.0rc3/src/cfg-lex.l:239: undefined reference to `MIN' affile.o(.text+0x59f): In function `do_init_dest_writer': /root/syslog-ng-1.6.0rc3/src/affile.c:286: undefined reference to `MAX' afinet.o(.text+0x83d): In function `do_init_afinet_dest': /root/syslog-ng-1.6.0rc3/src/afinet.c:478: undefined reference to `MAX' macros.o(.text+0x85): In function `append_string': /root/syslog-ng-1.6.0rc3/src/macros.c:84: undefined reference to `MIN' macros.o(.text+0x3e9): In function `expand_macros': /root/syslog-ng-1.6.0rc3/src/macros.c:182: undefined reference to `MIN' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/root/syslog-ng-1.6.0rc3/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/syslog-ng-1.6.0rc3/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/root/syslog-ng-1.6.0rc3/src' make: *** [all-recursive] Error 1 Any suggestion what cause it? Thanks

2 1

Changing replacing $Host characters
by Chance Ellis 29 Sep '05

29 Sep '05

A large number of my log messages come in and the $HOST variable is an IP address. I am creating a mysql table for each unique host. The problem is, mysql does not allow table names with periods in them, or at least I can't figure out how to make it. Is there a way in the syslog-ng.conf file that I can use regexp to change 10.1.1.1 <http://10.1.1.1> to 10_1_1_1 for example? Or does anyone happen to know how to make mysql accept `10.1.1.1` as a valid table name? Thanks!

1 0

RE: [syslog-ng] Syslog 1.6.8 compile error
by William Bell 27 Sep '05

27 Sep '05

I have seen this before with bad version of byacc/flex/lex you might want to install a new version of each, link your new libraries and try again. William -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Rohald van Baars Sent: Tuesday, September 27, 2005 7:30 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Syslog 1.6.8 compile error Hi, can someone please help me to get the compile right. OS: RHEL ES 3 update 4 The ./configure went well no errrors. But the make did not go so well: Error message(s) : >> snip gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afpr gram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lnsl -lresolv / sr/local/lib/libol.a -lnsl -Wl,-Bstatic -Wl,-Bdynamic cfg-lex.o(.text+0x45f): In function `yylex': /root/rpm/syslog-ng/syslog-ng-1.6.8/src/cfg-lex.c:1123: undefined reference to yywrap' cfg-lex.o(.text+0xb33): In function `input': /root/rpm/syslog-ng/syslog-ng-1.6.8/src/cfg-lex.c:1450: undefined reference to yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make: *** [all-recursive] Error 1 << snap Can someone plz explain what went wrong? Rohald van Baars Digitenne B.V. The netherlands WWW: www.digitenne.nl ######################################################################## #### Attention: The information contained in this message and or attachments is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any system and destroy all copies. ######################################################################## #### _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng 1.6.8 and dns cache issue
by Ketan Vankawala 22 Sep '05

22 Sep '05

I have currently installed Syslog-ng ver 1.6.8. Here is a snippet of my syslog-ng config file: destination hostslocal { file("/var/log/HOSTS/$HOST/$YEAR-$MONTH-$DAY.log" owner(root) group(xxx) perm(0740) dir_perm(0740) create_dirs(yes) template("$R_DATE $FULLHOST $MONTH $S_DAY $S_YEAR $S_HOUR:$S_MIN:$S_SEC: $MESSAGE\n") template-escape(no)); }; log { source(src); destination(hostslocal); }; So accordingly when a syslog message comes in, depending on the ip address, it does a lookup in /etc/hosts, creates an appropriate host name folder and forwards the message there. If the hostname does not exists, it creates a folder named with the ip address. Here is my question: 1) How often does syslog-ng refreshes its dns /hosts cache? Because I have run into issues that even after the /etc/hosts file is updated syslog still keeps logging to the folder created with the ip address. If I restart syslog-ng service it immediately starts forwarding the messages correctly to hostname folder. 2) How can I reduce the dns cache timeout, so it checks /etc/hosts more frequently for any changes? Any help will be highly appreciated. thx. Ketan

1 0

encrypt syslog-ng messages
by shaun.hofer＠altcall.com 21 Sep '05

21 Sep '05

I've setup syslog-ng on a log server and it's successfully receiving log messages from various clients. I want to encrypt the messages, so I used SSH tunnels and stunnel. However, in both of those cases, syslog-ng sees the message as having originated from itself, rather than from the real sender. Is there a way to fix this, or is there a different way to encrypt the messages? Thanks for your help, syslog-ng's awesome. -Shaun

2 1

I have a question
by 赵武 21 Sep '05

21 Sep '05

I am a chinese, my english is not good . ^_^ I used syslog-ng_1.6.x , there has a startup script (maybe init.d.RedHat-7.3 )in install directory . So I can start or stop it very easy . But in syslog-ng_1.9.5 , I haven't found the startup script , there is not convenience. I used logrotate.d separate log files . when the logrotate.d finished , it will restart the syslog-ng service . if there haven't startup script , I must added a script in logrotate.conf : postrotate /usr/bin/killall -HUP /usr/local/syslog-ng/sbin/syslog-ng 2> /dev/null || true endscript above script always killed the syslog-ng process and not startup syslog-ng process .I don't know the reason. when i used syslog-ng_1.6.x , I can use a easy script instead of above script : postrotate service syslog-ng restart endscript that is ok ! Could you give me a suggestion ! thanks . john 　　　　　　　　john.zw(a)263.net 　　　　　　　　　　2005-09-20

3 3

RE: [syslog-ng] encrypt syslog-ng messages
by Clemson, Chris 21 Sep '05

21 Sep '05

syslog-ng: http://www.balabit.com/products/syslog_ng/reference-1.6/syslog-ng.html/x 768.html I use it as follows: options { keep_hostname(yes); long_hostnames(off); sync(0); }; > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > shaun.hofer(a)altcall.com > Sent: 21 September 2005 10:39 > To: Syslog-ng users' and developers' mailing list > Subject: RE: [syslog-ng] encrypt syslog-ng messages > > In which program has this option? stunnel4? > > Thanks > Shaun > > Would the "keep_hostname" option help? > > > >> -----Original Message----- > >> From: syslog-ng-bounces(a)lists.balabit.hu > >> [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > >> shaun.hofer(a)altcall.com > >> Sent: 21 September 2005 09:53 > >> To: syslog-ng(a)lists.balabit.hu > >> Subject: [syslog-ng] encrypt syslog-ng messages > >> > >> I've setup syslog-ng on a log server and it's successfully > >> receiving log > >> messages from various clients. I want to encrypt the > >> messages, so I used > >> SSH tunnels and stunnel. However, in both of those cases, > >> syslog-ng sees > >> the message as having originated from itself, rather than > >> from the real > >> sender. Is there a way to fix this, or is there a different > >> way to encrypt > >> the messages? > >> > >> Thanks for your help, syslog-ng's awesome. > >> -Shaun > >> > >> _______________________________________________ > >> syslog-ng maillist - syslog-ng(a)lists.balabit.hu > >> https://lists.balabit.hu/mailman/listinfo/syslog-ng > >> Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > >> > >> > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

1 0

RE: [syslog-ng] encrypt syslog-ng messages
by Clemson, Chris 21 Sep '05

21 Sep '05

Would the "keep_hostname" option help? > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > shaun.hofer(a)altcall.com > Sent: 21 September 2005 09:53 > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] encrypt syslog-ng messages > > I've setup syslog-ng on a log server and it's successfully > receiving log > messages from various clients. I want to encrypt the > messages, so I used > SSH tunnels and stunnel. However, in both of those cases, > syslog-ng sees > the message as having originated from itself, rather than > from the real > sender. Is there a way to fix this, or is there a different > way to encrypt > the messages? > > Thanks for your help, syslog-ng's awesome. > -Shaun > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

2 1

Re: [syslog-ng] freebsd syslog-ng error
by fico gid 21 Sep '05

21 Sep '05

Hi William/All, Is the configuration below enough for me to log some of my routers ? 157.0.1.1 is my syslog server and im getting logs frm a few routers. I have added appropriate logging commands on the routers to log to the syslog server. --start-- ## syslog-ng source remote { unix-stream("/var/run/log"); internal(); pipe("/dev/klog"); udp(ip(157.0.1.1) port(514)); tcp(ip(157.0.1.1) port(514) keep-alive(yes)); }; destination std { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; log { source(remote); destination(std); }; --end-- Your help is much appreciated. fico On 9/21/05, fico gid <ficohertz(a)gmail.com> wrote: > Hi William, > > Thanks a lot for the tips.. its working now. > > Fico. > > On 9/20/05, William Bell <williamb(a)cwie.net> wrote: > > The problem you are having is in attempting to use linux conventions in > > freebsd. You will need to use /var/run/log in place of /dev/log and > > instead of /proc/kmsg you will most likely have to use > > > > file("/dev/klog"); > > > > Changing these two will get you the results you need. > > > > -William B > > > > -----Original Message----- > > From: syslog-ng-bounces(a)lists.balabit.hu > > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of fico gid > > Sent: Tuesday, September 20, 2005 2:10 AM > > To: syslog-ng(a)lists.balabit.hu > > Subject: [syslog-ng] freebsd syslog-ng error > > > > Hi there, > > > > im trying to setup a syslogng server to collect logs from a few of my > > routers. I have installed syslogng and modified the script as below : > > > > --start-- > > ## syslog-ng > > > > > > source remote { > > unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); > > udp(ip(158.0.1.1) port(514)); > > tcp(ip(158.0.1.1) port(514) keep-alive(yes)); > > }; > > > > destination std { > > file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" > > owner(root) group(root) > > perm(0644) dir_perm(0755) create_dirs(yes)); > > }; > > > > log { > > source(remote); > > destination(std); > > }; > > > > destination authlog { file("/var/log/auth.log"); }; > > destination cron { file("/var/log/cron.log"); }; > > destination debug { file("/var/log/debug.log"); }; > > destination kern { file("/var/log/kern.log"); }; > > destination user { file("/var/log/userlog"); }; > > > > --end-- > > > > somehow when i start the syslog-ng , it doesnt work and gives the error > > below : > > > > io.c: bind_unix_socket(): bind failed /dev/log (Operation not supported) > > Error initializing configuration, exiting. > > > > The syslog-ng by default config works fine. > > > > What am i doing wrong here ? > > > > fico > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > >

1 0

Re: Re: [syslog-ng] I have a question
by 赵武 21 Sep '05

21 Sep '05

Roberto Nibali,您好！ I am glad to receive your reply . Thank you very much . I am so surprised that you know the chinese idiom " 滴水穿石 di shui chuan shi ". Are you a chinese ? hehe ======= 2005-09-20 16:36:21 您在来信中写道：======= >Dear John, > >> I used syslog-ng_1.6.x , there has a startup script (maybe init.d.RedHat-7.3 ) >> in install directory . So I can start or stop it very easy . But in syslog-ng_1.9.5 , >> I haven't found the startup script , there is not convenience. I used logrotate.d >> separate log files . when the logrotate.d finished , it will restart the syslog-ng >> service . if there haven't startup script , I must added a script in logrotate.conf : > >Why not use the syslog-ng-1.6.x startup script? > >> postrotate >> /usr/bin/killall -HUP /usr/local/syslog-ng/sbin/syslog-ng 2> /dev/null || true >> endscript >> >> above script always killed the syslog-ng process and not startup syslog-ng process .I don't know the reason. > >This indeed is a bit strange as -HUP should not kill the process per se >with regard to syslog-ng. I've just tested this and and if I do it by >hand the syslog-ng process is indeed killed by this, although not all >the time. Some short time digging reveiled following: > >webphish:~ # ulimit -c unlimited >webphish:~ # /sbin/syslog-ng-1.9.5 -v -d -d -F > >[in another terminal send a /usr/bin/killall -HUP /sbin/syslog-ng-1.9.5] > >Segmentation fault (core dumped) >webphish:~ # gdb -q /sbin/syslog-ng-1.9.5 ./core >Using host libthread_db library "/lib/tls/libthread_db.so.1". >Core was generated by `/sbin/syslog-ng-1.9.5 -v -d -d -F'. >Program terminated with signal 11, Segmentation fault. >#0 0x08065009 in g_string_truncate () >(gdb) bt >#0 0x08065009 in g_string_truncate () >#1 0x08065fbc in g_string_assign () >#2 0x0804f85e in log_source_group_queue (s=0x8116988, msg=0x810e290, > path_flags=0) at sgroup.c:110 >#3 0x0804a878 in log_pipe_forward_msg (self=0x0, msg=0x81113d8, >path_flags=0) > at logpipe.h:72 >#4 0x080533ea in log_source_queue (s=0x8116540, msg=0x81113d8, >path_flags=0) > at logpipe.h:72 >#5 0x08052dc3 in afinter_source_dispatch_msg (pipe=0x0, msg=0x81113d8) > at logpipe.h:72 >#6 0x08052df3 in afinter_source_dispatch (source=0x8116568, > callback=0x8052db0 <afinter_source_dispatch_msg>, user_data=0x8116540) > at afinter.c:51 >#7 0x08058ef8 in g_main_context_dispatch () >#8 0x0805b0e7 in g_main_context_iterate () >#9 0x0805b1ba in g_main_context_iteration () >#10 0x0804854f in main_loop_run (cfg=0x81163c0) at main.c:142 >#11 0x0804882a in main (argc=5, argv=0xbffff344) at main.c:387 >(gdb) q >webphish:~ # > >No time to further dig into this yet. > >> when i used syslog-ng_1.6.x , I can use a easy script instead of above script : >> >> postrotate >> service syslog-ng restart >> endscript > >Check out the contrib directory of the syslog-ng-1.6.x source tree and >there you'll find all the startup scripts needed. They should also work >for the 1.9.x drop of syslog-ng. > >Bazsi, do you think that copying the contrib directory from 1.6.x to >1.9.x would make sense? > >> Could you give me a suggestion ! thanks . > >Di shui chuan shi ;) and best regards, >Roberto Nibali, ratz >-- >echo >'[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > = = = = = = = = = = = = = = = = = = = = 　　　　　　　　致礼！　　　　　　　　赵武　　　　　　　　john.zw(a)263.net 　　　　　　　　　　2005-09-21

1 0

syslog-ng wont start on fresh gentoo
by Venkata Phani Kiran Achanta 21 Sep '05

21 Sep '05

What am I missing? Linux ematest 2.6.12-gentoo-r10 #1 SMP Thu Sep 15 14:07:53 GMT 2005 i686 Intel(R) Pentium(R) 4 CPU 2.80GHz GenuineIntel GNU/Linux /etc/init.d/syslog-ng start * Starting syslog-ng ... Error initializing configuration, exiting. ematest ~ # cat strace.info execve("/usr/sbin/syslog-ng", ["syslog-ng"], [/* 29 vars */]) = 0 uname({sys="Linux", node="ematest", ...}) = 0 brk(0) = 0x8064000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=18434, ...}) = 0 mmap2(NULL, 18434, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7f24000 close(3) = 0 open("/lib/libnsl.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0 5\0\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=76468, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f23000 mmap2(NULL, 83968, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f0e000 mmap2(0xb7f1f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x10) = 0xb7f1f000 mmap2(0xb7f21000, 6144, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f21000 close(3) = 0 open("/lib/libresolv.so.2", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\0&\0\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=69324, ...}) = 0 mmap2(NULL, 80148, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7efa000 mprotect(0xb7f09000, 18708, PROT_NONE) = 0 mmap2(0xb7f0a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xf) = 0xb7f0a000 mmap2(0xb7f0c000, 6420, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f0c000 close(3) = 0 open("/lib/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\360V\1"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1227872, ...}) = 0 mmap2(NULL, 1142148, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7de3000 mmap2(0xb7ef4000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x110) = 0xb7ef4000 mmap2(0xb7ef8000, 7556, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7ef8000 close(3) = 0 mprotect(0xb7ef4000, 4096, PROT_READ) = 0 munmap(0xb7f24000, 18434) = 0 open("/dev/urandom", O_RDONLY) = 3 read(3, "\237\317\242\334", 4) = 4 close(3) = 0 brk(0) = 0x8064000 brk(0x8085000) = 0x8085000 open("/etc/localtime", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f28000 read(3, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0"..., 4096) = 56 close(3) = 0 munmap(0xb7f28000, 4096) = 0 open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) = 3 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbf93cc4c) = -1 ENOTTY (Inappropriate ioctl for device) fstat64(3, {st_mode=S_IFREG|0644, st_size=1066, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f28000 read(3, "# $Header: /var/cvsroot/gentoo-x"..., 8192) = 1066 read(3, "", 4096) = 0 read(3, "", 8192) = 0 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbf93c6ec) = -1 ENOTTY (Inappropriate ioctl for device) close(3) = 0 munmap(0xb7f28000, 4096) = 0 pipe([3, 4]) = 0 fork() = 11240 close(4) = 0 read(3, "\1", 1) = 1 exit_group(1) = ?

2 1