- syslog-ng - lists.balabit.hu

RE: [syslog-ng] freebsd syslog-ng error
by William Bell 20 Sep '05

20 Sep '05

The problem you are having is in attempting to use linux conventions in freebsd. You will need to use /var/run/log in place of /dev/log and instead of /proc/kmsg you will most likely have to use file("/dev/klog"); Changing these two will get you the results you need. -William B -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of fico gid Sent: Tuesday, September 20, 2005 2:10 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] freebsd syslog-ng error Hi there, im trying to setup a syslogng server to collect logs from a few of my routers. I have installed syslogng and modified the script as below : --start-- ## syslog-ng source remote { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); udp(ip(158.0.1.1) port(514)); tcp(ip(158.0.1.1) port(514) keep-alive(yes)); }; destination std { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; log { source(remote); destination(std); }; destination authlog { file("/var/log/auth.log"); }; destination cron { file("/var/log/cron.log"); }; destination debug { file("/var/log/debug.log"); }; destination kern { file("/var/log/kern.log"); }; destination user { file("/var/log/userlog"); }; --end-- somehow when i start the syslog-ng , it doesnt work and gives the error below : io.c: bind_unix_socket(): bind failed /dev/log (Operation not supported) Error initializing configuration, exiting. The syslog-ng by default config works fine. What am i doing wrong here ? fico _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

freebsd syslog-ng error
by fico gid 20 Sep '05

20 Sep '05

Hi there, im trying to setup a syslogng server to collect logs from a few of my routers. I have installed syslogng and modified the script as below : --start-- ## syslog-ng source remote { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); udp(ip(158.0.1.1) port(514)); tcp(ip(158.0.1.1) port(514) keep-alive(yes)); }; destination std { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; log { source(remote); destination(std); }; destination authlog { file("/var/log/auth.log"); }; destination cron { file("/var/log/cron.log"); }; destination debug { file("/var/log/debug.log"); }; destination kern { file("/var/log/kern.log"); }; destination user { file("/var/log/userlog"); }; --end-- somehow when i start the syslog-ng , it doesnt work and gives the error below : io.c: bind_unix_socket(): bind failed /dev/log (Operation not supported) Error initializing configuration, exiting. The syslog-ng by default config works fine. What am i doing wrong here ? fico

1 0

feature request: Priority remap
by Evan Rempel 16 Sep '05

16 Sep '05

It would be nice to be able to use syslong-ng as a filter from the syslog sources to a final syslog server, but in doing so, change the priority of a message based on some filter expressions. As an example, I have an application that does not support syslog. It can log all of its messages to its standard out, so it is easy to use application | logger -p user.info -t application but this assigns the same priority to all messages. I would like to run this through a syslong-ng server to match expressions for -t application and then regular expressions and send them on to the production syslog server with level of error, critical, warning, info and debug. An option for a TCP/UDP destination that would set the facility/level of the messages would be nice. Thanks, -- Evan Rempel erempel(a)uvic.ca Senior Programmer Analyst 250.721.7691 Computing Services University of Victoria

2 5

Re: FW: [syslog-ng] syslog-ng 1.6.8 bug: not maintaining priority
by SheBang 15 Sep '05

15 Sep '05

-----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Rempel > Sent: Thursday, September 15, 2005 10:51 AM > To: Syslog-ng users' and developers' mailing list > Subject: [syslog-ng] syslog-ng 1.6.8 bug: not maintaining priority > > > If I use the template option for TCP or UDP destinations, the priority > of a message is always user.notice. > > <snip> > > and I got the following in the /var/log/syslog-ng file > > Sep 15 10:38:51 cashmere.comp.uvic.ca <http://cashmere.comp.uvic.ca> user > notice ftp alert From > cashmere.comp.uvic.ca <http://cashmere.comp.uvic.ca>: sysprog: everything > is wrong > > Notice that the udp sent message contains the original ftp.alert > priority, but when the message is received via UDP, the message has > priority user.notice. > > Am I doing something wrong? > > Check out the detailed syslog explanation at: http://www.campin.net/syslog-ng/syslog.html Since your message isn't "<PRI>HEADER MSG" it's being rewriten in accordance with standard syslog practice and RFC3164. I didn't know syslog-ng doesn't put a <PRI> field in the beginning no matter what, but it makes sense that it wouldn't when you're specifying the format yourself. You'll have to add it. Problem is, I don't know that you can. Going by what's on the FAQ: $TAG Hex representaiton of the 32-bit priority/facility pair (see /usr/include/sys/syslog.h) 1f You can't use a hex number there, it needs to be decimal. I don't see a macro that we can use to properly set the decimal <PRI> in the beginning of a templated message. Bazsi, can you shed any light on this? BTW, I think most formatting questions can be answered by people on their own after they read that syslog explanation page.

2 2

Re: ng-syslog logging in a stealth mode
by Albretch Mueller 15 Sep '05

15 Sep '05

OK, here is my 'take' on your replies. It took me a little time to go over yor points // __ SheBang >Great idea, but running in stealth mode isn't a function of syslog-ng, it's >a function of a network capture tool such as tcpdump or ngrep. : I meant 'stealth mode' in a literal way not as an option or working mode of ngsyslog // __ >dump the syslog contents to a file (need to do a little scripting here >perhaps, though not much) and have syslog-ng read from that file. : I won't have a filesystem around or say the application is botting and running off a CD-ROM (+RAM) and a ramdisk (or something similar) is NOT vorhanden // __ >An HTML attachment was scrubbed... >URL: >http://lists.balabit.hu/pipermail/syslog-ng/attachments/20050913/a8e80311/a… // __ Jens Grigel >For the kernel messages you could use the netconsole kernel module to send >any kernel messages directly via udp to a specified client as soon >as the network is available, no need for running a local syslogd/klogd. >Check kernel/Documentation/networking/Netconsole.txt for details. : I was interested in reading about but the only page I could find was in japanese. http://www.linux.or.jp/JF/JFdocs/kernel-docs-2.6/networking/netconsole.txt.… Also the idea is NOT to "send any kernel messages directly via udp to a specified client", because to send it 'directly' to an IP/client you must declare this IP somehow and I everything shoudl be stealth. The log aggregator should only gobble whatever reaches its NIC, without the log producing end being even aware of it (do you get it ;-)) // __ Bill Nash >You mean.. >Log all activity on the box and forward it off to another device, storing >nothing locally? : No, I don't. I am not trying to store it locally and then forward it ... // __ SheBang >Ah, I see. I did't read carefully past "stealth mode" it seems. I was >thinking of this: >http://www.linuxjournal.com/xstatic/articles/lj/0092/5476/5476s2.html >http://www.linuxjournal.com/article/6222 >It's a hidden syslog server that's not attackable by common methods (well >except flooding with log messages - hard to eliminate DoS risks with any >service). If you snip the send pair in its ethernet cable and hardcode MAC >addresses then it's quite a secure log receiver. : Exactly! this is the idea "log files to a non-IP-addressed" ... Thanks Albretch

2 1

ng-syslog logging in a stealth mode
by Albretch Mueller 13 Sep '05

13 Sep '05

Hi *, I would like for system logs like the ones produced by the kernel, iptable (generally in /var/log/syslog), as well as anyother applications running in a Linux-based router to be processed by an ng-syslog client and just popped as UDP packets I looked into http://www.campin.net/syslog-ng/faq.html and couldn't see any particular info on this specifically and I also search http://marc.theaimsgroup.com/?l=syslog-ng for 'stealth' and didn't get any hits (a search on 'UDP' would dump millions of hits on you ;-)) How could you do something like that? Thanks Albretch

5 5

Feature request: cleaned-up PROGRAM macro?
by Jason Haar 13 Sep '05

13 Sep '05

Hi there As part of last weeks discussion over how to scale a searchable Enterprise Syslog environment, I've been wondering how far I could get using syslog-ng's built in functions - such as the templates. So I think it could be useful to be able to filter syslog messages into the following structure - as it gives an immediate "sorted" view: destination d_dir_messages { file("/var/log/syslog/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM/raw" template("$R_ISODATE $MSGONLY\n") ...etc }; You can see you could now search quickly (well, quicker ;-) by date, syslog host and program. Symlinks could be used to create "meta directories" of related terms - e.g. an "Email/" dir could contain symlinks to all dirs containing $PROGRAM dirs called "smtpd", "qmail", "postfix", "msexchange", etc. However - there's a big nasty warning on PROGRAM - it's raw. So it could contain '/', '`' - anything. So I went to do it "the right way" and create my own "program" destination device that would clean things up and create "sanitized" directories. But it's too hard! I have to take on all the open file management that syslog-ng automatically does for me, etc. Either than or resort to "open-write-close" type thingies - yucky :-( So my feature request would be that there be a CLEANPROGRAM macro - or the like. Something that simply removes nasty chars such as "`|;'"\/}]{[&*#!" would probably do. The better option would to declare what was valid - but then you'd run into the whole Unicode/non-ASCII thing - just what is "invalid" these days? Thanks for listening -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

1 1

filter by date?
by scarter＠micron.com 12 Sep '05

12 Sep '05

hello, Is it possible to setup up a filter match based on variables for date? example thinking... filter f_date { match($YEAR-$MONTH-$DAY.*); }; #log the files log { source (s_udp); filter(f_date); destination(messages); }; # set it up destination hosts { file("/syslog/NT-SYSLOG/HOSTS/$HOST/$MONTH-$DAY-$YEAR" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes) ); };

2 1

Syslog-ng Server IP address change
by Gerardo Amaya 08 Sep '05

08 Sep '05

Hello all. I configured a Syslog-ng server in a local LAN to make sure all the options were working with no problem at all. Then I moved the server to a different LAN. I made all the changes needed for the linux box for the IP address change, but when syslog-ng start sessions it appear with the previous IP address, I'm sure that this session is from syslog-ng because a use a random port UDP 5002 and it appears the session as 192.168.4.2:5002 192.168.4.101:4342 where 192.168.4.2 is the previous IP address. What changes do I need to make to the syslog-ng in order to use the new IP Address? I hope reinstall is the last resource. thanks in advance Gerardo Amaya

2 1

Anyone got a well performing search interface for syslog data?
by Jason Haar 08 Sep '05

08 Sep '05

We're generating around 4Gb syslog data per week, and I'm looking for a good search interface into it. I can cut my way through it with egrep/etc, but waiting 10-15min for a result really isn't going to break any speed records. Especially when I then need to re-run it with another "grep" on the end of it! ;-) I have tried injecting it into a MySQL database using some schemas I've found on the Internet - but the performance didn't seem much better to me - and you lost the "free-text" attributes of grep (or more specifically, the sorts of searches I find I want to do aren't SQL-friendly). Has anyone come up with a good speedy way of coping with Gbytes of syslog data? Or is it time to invest in some Appliance or the like? -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

7 9

Re: [syslog-ng] expanding $HOST in 1.6.*
by t_esting＠excite.com 08 Sep '05

08 Sep '05

>> Hello, syslog-ng gurus. I have been trying unsuccessfully to replicate syslog-ng 1.5.26 behavior over to the current stable release. Specifically, here's what I can't seem to get to work from my config: >> >> destination d_ipfilters_bymin { file ("/var/logser/$HOST/$YEAR/$MONTH/$DAY/ipfilters.log.$HOUR.$MIN" >> owner(root) perm(0600) create_dirs(yes) ); }; >> >> filter f_fwsm_misc { >> match(" \%FWSM-") and >> match(": (Teardown|Translation|Built)"); >> }; >> >> log { source(s_udp); filter(f_fwsm_misc); destination(d_ipfilters_bymin); }; >> >> With syslog-ng 1.5.26 (linked against libol 0.3.10 on Solaris 8 using GCC in 64-bit mode), this config writes my FWSM messages to /var/logser correctly. I have been unable to do the same using either 1.6.8; the messages just fall through to my catchall destination. >> >> Can anyone offer some advice on how to reproduce the 1.5.x $HOST expansion behavior in 1.6.x? >I can't really understand. Do you have a problem with matching the log lines or the filename where the line is written to? I was having trouble with the filename matching. I've seen a couple of different behaviors in the 1.6.x release. At different times, I've seen $HOST expanded as the DNS name, other times as the IP address. Other times, I've seen it drop all the way through to catchall (though I'm not able to recreate that this morning with 1.6.8 for some reason). I'll continue to do testing over the next couple of days to see if I can articulate exactly what I'm seeing with a larger scope of test data. Thanks. T.E. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

expanding $HOST in 1.6.*
by t_esting＠excite.com 08 Sep '05

08 Sep '05

Hello, syslog-ng gurus. I have been trying unsuccessfully to replicate syslog-ng 1.5.26 behavior over to the current stable release. Specifically, here's what I can't seem to get to work from my config: destination d_ipfilters_bymin { file ("/var/logser/$HOST/$YEAR/$MONTH/$DAY/ipfilters.log.$HOUR.$MIN" owner(root) perm(0600) create_dirs(yes) ); }; filter f_fwsm_misc { match(" \%FWSM-") and match(": (Teardown|Translation|Built)"); }; log { source(s_udp); filter(f_fwsm_misc); destination(d_ipfilters_bymin); }; With syslog-ng 1.5.26 (linked against libol 0.3.10 on Solaris 8 using GCC in 64-bit mode), this config writes my FWSM messages to /var/logser correctly. I have been unable to do the same using either 1.6.8; the messages just fall through to my catchall destination. Can anyone offer some advice on how to reproduce the 1.5.x $HOST expansion behavior in 1.6.x? Thanks in advance. T.E. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1

Cisco boxes and syslog-ng
by Joost greene 07 Sep '05

07 Sep '05

Hello, I have different sets of devices, dslams, nas, core routers, customer routers,... i want to syslog them all, i want to make each device log to a file separately to ease it up for NOC, someone suggested syslog-ng, frankly, i got quickly lost in its docs, the syntax isnt clear, how can i just easily specify to let it log per source into different files ? Regards, Joost

2 1

RE : How do I force syslog-ng to create an empty log file ??
by Eggart, Gerhard 07 Sep '05

07 Sep '05

Hi, We are currently using syslog-ng (syslog-ng 1.6.0rc4) to log for local log messages on a device. We have the following in the config file to store local auth messages. destination local_auth { file("/var/log/local/auth.$YEAR$MONTH$DAY"); }; We have the following in the config file to store local error messages. destination local_err { file("/var/log/local/errors.$YEAR$MONTH$DAY"); }; The problem I have is that sometimes for a day there are no error or auth messages and because of this the log file is not generated, a log file is only created if there is log data to put into it. I require syslog-ng to force the creation of a log file for the day even if it is empty. I have also just tried the stats(600) option in the configuration and stopped and started the dameon and this does not write any information to a log file - therefore no errors log file is created for the day. Does anyone know if this can be done on syslog-ng ??? Thanks > Gerhard Eggart > > >

2 1

Equivalent to syslog.conf -
by Tony Earnshaw 05 Sep '05

05 Sep '05

Hi list, Read all the docs (time and time again) and Googled, but still have no answer. Red Hat RHAS3, syslog-ng 1.6.8 (self-compiled on system, installed as an rpm) on this test server. I've come to appreciate syslog-ng and would not willingly go back to the original. But. My OpenLDAP 2.3.7 slapd log needs a "do not synchronize" possibility, similar to the syslog.conf - possibility, I *think* I've solved this by buffering output with sync: destination d_slapd { file("/var/log/slapd" sync(10)); }; Is this it, or could I do something better? Thanks! --Tonni -- mail: tonye(a)billy.demon.nl http://www.billy.demon.nl

2 2

Shiming Yang/OCIO_CorpDataSecurity/Planning_Office/HQ_for_the_Americas/BTMNA is out of the office.
by Shiming Yang 30 Aug '05

30 Aug '05

I will be out of the office starting 08/30/2005 and will not return until 09/03/2005. I will respond to your message when I return. If there is problem about Proxy or IBM web hosting facility, please call my backup Will at 8380 or Rich Maer at 5744. ----------------------------------------- The information contained in this electronic mail message, and any and all accompanying documents, constitutes confidential information. If you are not the intended recipient of this information, any disclosure, copying, distribution, or the taking of any action in reliance on it is strictly prohibited. If you received this information in error, please notify the sender immediately and destroy this communication. Messages sent via this medium may be subject to delays and/or unauthorized alteration. Neither The Bank of Tokyo-Mitsubishi, Ltd. nor any of its affiliates shall be held liable for the contents of this message.

1 0

Version question
by Tony Earnshaw 30 Aug '05

30 Aug '05

Hi, first post. Red Hat RHAS3 update 4. Saturday I downloaded libol 0.3.16 and syslog-ng 1.6.8 tarballs, saw immediately that there were rpm spec files and made rpms (not without an initial couple of barfs about missing MySQL stuff), which I installed. Took me Sunday and Monday till 10:00 am to get my head round it, but it's fantastic, thanks a lot:) So then I downloaded 1.9.5 and eventlog-0.2.3+20050116+1856. There were no rpm spec files, so I wrote my own (half a morning on the basis of the above ones, anyone who wants them's welcome to them), installed them and syslog-ng 1.9.5 crashed without trace. Used strace and couldn't for the life of me see what was happening. I couldn't be bothered to begin with gdb and back traces, so I put the good rpm back, all's back to normal. If anyone wants me to go ahead with debugging, I will (dilettantishly to say the least, I'm not a C programmer), but would rather not - 1.6.8 works fine for me. Just thought I'd let people know :) Best, --Tonni -- mail: tonye(a)billy.demon.nl http://www.billy.demon.nl

5 6

syslog-ng 1.9.5 segfaults on many platforms
by Paul Krizak 30 Aug '05

30 Aug '05

I've built both the daily snapshot from 2005-08-19 as well as the "stable" (I know it's not really stable) 1.9.5 on three platforms: RHEL4.1 x86_64 RHEL3.5 x86_64 Red Hat 7.3 2.4.29 i686 All three builds were with the default settings to ./configure. The build finishes without a hiccup but segfaults when syslog-ng tries to start. I've attached an strace (it's not very long...) to help show where it's segfaulting. The reason I need this to work is for the enhanced program() destination driver that will respawn programs that die. If somebody has a patch that backports this functionality to 1.6, that would be preferred, but a working 1.9.5 I could live with as well. Any ideas? -- Paul Krizak 5900 E. Ben White Blvd. MS 625 Advanced Micro Devices Austin, Tx 78741 CAD Systems Engineering Phone: (512) 602-8775 Paul.Krizak(a)amd.com Cell: (512) 791-0686

3 4

syslog-ng rpm spec files ...
by Tony Earnshaw 29 Aug '05

29 Aug '05

... need working on. Apart from anything else, the Source files syslog-ng.conf, syslog-ng.init and syslog-ng.sysconfig, as well as syslog-ng.conf for syslog-ng were simply copied from 1.6.8. Especially syslog-ng.conf should probably be that from the 1.9.5 tarball, but i didn't want to muck up my SOURCES directory, it was just a test. Feedback please - but preferably to the list, so that others may profit ;) Best, --Tonni -- mail: tonye(a)billy.demon.nl http://www.billy.demon.nl

1 0

tcp logging drops messages
by Stephen Harris 26 Aug '05

26 Aug '05

I was attempting to test the resiliency of syslog-ng to TCP server outages and notice that 2 messages can get lost. I have a simple configuration: Sending machine: Solaris 8, syslog-ng-1.6.8+20050826 Receiving machine: Linux (or Solaris, doesn't matter), ncat syslog-ng.conf: options { time_reopen(1); }; source from_file { pipe("/var/run/auth_log"); }; destination loghost { tcp("dest" port(1234)); }; log { source(from_file); destination(loghost);}; Sending machine: syslog-ng -F -d Receiving machine: ncat :1234 So far, so good; "echo msg1 > /var/run/auth_log" and I see the message on the receiving machine. Now kill ncat. Do "echo msg2 > /var/run/auth_log". No errors are seen. Now do a "echo msg3 > /var/run/auth_log". Now we see an error... io.c: do_write: write() failed (errno 32), Broken pipe pkt_buffer::do_flush(): Error flushing dataMarking fd 5 for closing. Connection broken to AF_INET(swharrislx1:1234), reopening in 1 seconds Closing fd 5. So far so good! Now another... "echo msg4 > /var/run/auth_log" Now another ... "echo msg5 > /var/run/auth_log". Now restart ncat. The ncat will show "msg4" and "msg5" happily. "msg2" and "msg3" are lost. Any ideas? -- rgds Stephen

2 1

Nothing is logged
by naim abu darwish 26 Aug '05

26 Aug '05

Hi, I'm trying to setup a central logging server to get logs from many hosts on a network, and store in a mysql database. I followed the following docs:: http://gentoo-wiki.com/HOWTO_setup_PHP-Syslog-NG http://vermeer.org/docs/1 only nothing is being logged :D my syslog-ng.conf so far:: # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.c onf.gentoo,v 1.5 2005/05/12 05:46:10 mr_bones_ Exp $ # # Syslog-ng default configuration file for Gentoo Linux # contributed by Michael Sterrett options { chain_hostnames(off); keep_hostname(yes); log_fifo_size(1024); sync(0); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; source shell { unix-dgram("/dev/log"); internal(); #tcp( port(5141) keep-alive(yes) max-connections(3000)); udp(ip(0.0.0.0 <http://0.0.0.0>),port(514)); }; source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; source net {udp(); }; destination messages { file("/var/log/messages"); }; # By default messages are logged to tty12... destination console_all { file("/dev/tty12"); }; # ...if you intend to use /dev/console for programs like xconsole # you can comment out the destination line above that references /dev/tty12 # and uncomment the line below. #destination console_all { file("/dev/console"); }; log { source(src); destination(messages); }; log { source(src); destination(console_all); }; log { source(shell); filter(allstuff);destination(testfile); }; log { source(net); destination(testfile); }; filter allstuff { host("194.146.*"); }; # pipe messages to /var/log/mysql.pipe to be processed by mysql destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; #destination testfile { destination testfile { file("/var/log/test/$HOST/zab.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; i suspected something wrong with the way i setup mysql database.. thats why i added the last bit, to log to a text file, still nothing .. i cant figure out what else could be wrong. Any help appreciated. Greets, Naim

2 1

syslog-ng on cygwin
by Gerardo Amaya 23 Aug '05

23 Aug '05

Hello all. I'm trying to install syslog-ng ver 1.6.8 on a cygwin enviroment. configure work smoothly, but when I run 'make' I got the following error: ************************************************************************ Making all in . make[3]: Entering directory `/home/Administrator/packages/syslog-ng-1.6.8/src' if gcc -DHAVE_CONFIG_H -I. -I/home/Administrator/packages/syslog-ng-1.6.8/src -I . -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -MT main.o -MD -MP - MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo '/home/Administrator/packages/syslog-ng -1.6.8/src/'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi main.c:49:20: resolv.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/home/Administrator/packages/syslog-ng-1.6.8/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/Administrator/packages/syslog-ng-1.6.8/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/home/Administrator/packages/syslog-ng-1.6.8/src' make: *** [all-recursive] Error 1 *************************************************************************** I check the src/ directory and indeed there is no resolv.h file. What can I do to resolve this issue. Thanks in advance. Gerardo Amaya

2 2

logging several to one facility - parsing
by Terry 19 Aug '05

19 Aug '05

Hello, I have several routers that I want to receive logs for. Can I send all the logs from these to a single facility and have syslog-ng parse and write them to different log files based on a ruleset such as ip address, type of log, etc. ? Thanks!

3 3

Error accepting AF_INET connection from
by Johannes.Trauttmansdorff＠commerzbank.com 16 Aug '05

16 Aug '05

Hi there, I am fairly new to syslog-ng and am very please of what I have seen so far. However, in case of a network outage between a sender and syslog-ng I do experience the following error message until I restart the syslog-ng daemon. I have searched the board but only found some old messages regarding a bug. Please advice. Jul 31 17:54:22 hostname syslog-ng[18336]: Error accepting AF_INET connection from: x.x.x.x:1124, opened connections: 10, max: 10 TX in advance, Joe

2 1

STATS: dropped with version 1.6.8 under rh el4
by Stephan Hendl 16 Aug '05

16 Aug '05

Hi all, recently I upgraded one of my central syslog servers from hpux to redhat el4 with syslog-ng-1.6.8-1 and get from time to time messages like Aug 10 11:43:57 pns1 syslog-ng[10542]: STATS: dropped 19 Aug 10 11:48:57 pns1 syslog-ng[10542]: STATS: dropped 45 Aug 10 11:53:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 11:58:57 pns1 syslog-ng[10542]: STATS: dropped 36 Aug 10 12:03:57 pns1 syslog-ng[10542]: STATS: dropped 7 Aug 10 12:08:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:13:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:18:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:23:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:28:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:33:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:38:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:43:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:48:57 pns1 syslog-ng[10542]: STATS: dropped 37 Aug 10 12:53:57 pns1 syslog-ng[10542]: STATS: dropped 52 Aug 10 12:58:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 13:03:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 13:08:57 pns1 syslog-ng[10542]: STATS: dropped 51 Aug 10 13:13:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 13:18:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 13:23:57 pns1 syslog-ng[10542]: STATS: dropped 11 Aug 10 13:28:57 pns1 syslog-ng[10542]: STATS: dropped 1 Aug 10 13:33:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 13:38:57 pns1 syslog-ng[10542]: STATS: dropped 0 There are 5 servers who are sending their syslog messages via tcp an one 2 servers who are sending via udp to that central server. The load of the machine (2xXenon CPU, 3 GHz, 1 GB RAM) is really low. For revison purposes (maillogdata) I have to keep _all_ syslog lines!!! What can I change in order to avoid dropped lines? Stephan top - 15:39:06 up 36 days, 1:49, 2 users, load average: 0.10, 0.09, 0.04 Tasks: 194 total, 1 running, 193 sleeping, 0 stopped, 0 zombie Cpu(s): 0.3% us, 0.2% sy, 0.0% ni, 99.2% id, 0.4% wa, 0.0% hi, 0.0% si Mem: 1034692k total, 1018520k used, 16172k free, 141372k buffers Swap: 2096440k total, 144k used, 2096296k free, 602228k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 690 root 16 0 43644 4784 2180 S 0.7 0.5 129:42.96 nco_p_syslog 779 root 16 0 43644 4784 2180 S 0.3 0.5 254:33.32 nco_p_syslog 10542 root 15 0 1876 1048 776 S 0.3 0.1 6:59.31 syslog-ng 1 root 16 0 3236 548 472 S 0.0 0.1 0:00.96 init 2 root RT 0 0 0 0 S 0.0 0.0 0:04.37 migration/0 3 root 34 19 0 0 0 S 0.0 0.0 0:00.06 ksoftirqd/0 4 root RT 0 0 0 0 S 0.0 0.0 0:03.11 migration/1 5 root 34 19 0 0 0 S 0.0 0.0 0:00.02 ksoftirqd/1 My syslog-ng.conf looks like: root@pns1:~# vi /etc/syslog-ng/syslog-ng.conf # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat Linux 9. # But it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. options {sync (0); time_reopen (10); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats (300); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; source s_tcp { tcp(ip(a.b.c.d) port(10514) keep-alive(no)); }; source s_udp { udp(ip(a.b.c.d) port(514)); }; # Log all kernel messages to the console. # Logging much else clutters up the screen. #destination d_cons { file("/dev/console"); }; #filter f_cons { facility(kern); }; #log { source(s_sys); filter(f_cons); destination(d_cons); }; # Log anything (except mail) of level info or higher. # Don't log private authentication messages! destination d_mesg { file("/var/log/messages"); }; filter f_mesg { not facility(mail,news,authpriv,cron) and level(emerg..info); }; log { source(s_sys); filter(f_mesg); destination(d_mesg); }; # The authpriv file has restricted access. destination d_auth { file("/var/log/secure"); }; filter f_auth { facility(authpriv); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; # Log all the mail messages in one place. destination d_mail { file("/var/log/maillog" template( "$DATE $HOST $MESSAGE\n")); }; filter f_mail { facility(mail); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; # Log cron stuff. destination d_cron { file("/var/log/cron"); }; filter f_cron { facility(cron); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; # Everybody gets emergency messages. destination d_mlal { usertty("*"); }; filter f_mlal { level(emerg); }; log { source(s_sys); filter(f_mlal); destination(d_mlal); }; # Save news errors of level crit and higher in a special file. destination d_spol { file("/var/log/spooler"); }; filter f_spol {facility(uucp) or facility(news) and level(emerg..crit); }; log { source(s_sys); filter(f_spol); destination(d_spol); }; # Save boot messages also to boot.log. destination d_boot { file("/var/log/boot.log"); }; filter f_boot { facility(local7); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; # Save all mesages to syslog.lvnbb.de destination d_tcp { tcp("localhost" port(10514)); }; log { source(s_sys); destination(d_tcp); }; log { source(s_tcp); destination(d_tcp); }; log { source(s_udp); destination(d_tcp); }; # Save all messages to pipe /tmp/cic.pipe destination d_cic { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template("$DATE $HOST $MESSAGE\n") template-escape(yes)); }; log { source(s_sys); destination(d_cic); }; log { source(s_tcp); destination(d_cic); }; log { source(s_udp); destination(d_cic); };

3 2