- syslog-ng - lists.balabit.hu

Send logs to upd syslog and rewrite facility
by Damien_DeVille＠discovery.com 16 Aug '05

16 Aug '05

I'm in a position where I've got a device that uses syslog-ng to filter multiple events into multiple diferent log files. I need to send the logs to a central udp syslog server and would like to have all events from this particular device show up as coming from a specific facility (say local3) so that they get put into the correct logfile on the central server. I've figured out that I have to define a destination, filter, and log in syslog-ng.conf but I haven't figured out how to mark all the logs to that destination with a specific facility. Is that possible? For reference here's what I'm looking at in terms of destination, filter, and log definitions in syslog-ng.conf: destination d_logger { udp ("xxx.xxx.xxx.xxx" port(514)); }; filter f_all_logs_net { facility(auth,authpriv,kern,user,daemon,local0 .. local7) and level(warn .. emerg); }; log { source(syslog-ng); filter (f_all_logs_net); destination(d_logger); }; Thanks in advance. -- -Damien Damien DeVille IT Network Engineer This e-mail, and any attachment, is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, re-transmission, copying, dissemination or other use of this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. The contents of this message may contain personal views which are not the views of Discovery Communications, Inc. (DCI).

2 1

Question - Spoof_source in TCP()
by Gerardo Amaya 16 Aug '05

16 Aug '05

Hello all. Is there a way to have spoof_source functionallity option in syslog-ng TCP connections? Is this a feature for future syslog-ng releases? Thanks in advance Gerardo Amaya

3 2

filter...?
by Bjørn T Johansen 15 Aug '05

15 Aug '05

I have a filter looking like this: filter f_cyrus { program("imap") or program("master") or program("lmtpunix") or program("ctl_cyrusdb"); }; But it doesn't work 100%.... I get the log from imap and lmtpunix and ctl_cyrusdb, but not for master... Why not? Regards, BTJ -- ----------------------------------------------------------------------------------------------- Bjørn T Johansen btj(a)havleik.no ----------------------------------------------------------------------------------------------- Someone wrote: "I understand that if you play a Windows CD backwards you hear strange Satanic messages" To which someone replied: "It's even worse than that; play it forwards and it installs Windows" -----------------------------------------------------------------------------------------------

1 0

Re: Antw: Re: [syslog-ng] STATS: dropped with version 1.6.8 underrh el4
by Stephan Hendl 12 Aug '05

12 Aug '05

The host 'pns1' is a - let's say a syslog repeater. It gets messages from 5 hosts via tcp (two of these five are mailservers and send the maiilog via syslog-ng) and from 2 hosts as well as an internet router/firewall via udp. The syslog-ng writes the lines into files as well as into a pipe where a third program read the lines and evaluates they according to given patterns. Additionally the syslog-ng sends all messages through a ssh tunnel to another syslog-ng. This is the whole situation.Aafter including the "log_fifo_size (128056);" parameter there were no dropped lines anymore. Stephan >>> ken.garland(a)rotech.com 11.08.2005 14:52:34 >>> Mike Tremaine wrote: >On Wed, 2005-08-10 at 07:21, Stephan Hendl wrote: > > >>the lines with values "STATS: dropped <!=0>" are very annoying. How >>can I prevent the syslog-ng from dropping lines??? I put the line >>"log_fifo_size(1000);" into the global section - hope that helps ;-))) >> >> >> > >If the hosts only job is syslog-ng go for broke and kick it up to >something higher then 1000. > >log_fifo_size (128056); > >[I used that when I was doing some testing with an old AMD-k62 500mhz >256MB and FC3, it ran with 5 hosts sending as fast as the could to it. >Didn't drop anything.] > > > > I have about 15 systems logging to my syslog-ng server and some of them are routers which send a ton of messages about up/down link state. This server is getting smashed with logs and I have not received any dropped messages other than the 'DROPPED 0' which is a good thing that the syslog-ng host is saying it has not dropped any log packets. I would think something else is going on here and the fifo would not need to be increased as my fifo setting is only at 1024. In your first message you pasted something from the host 'pns1' which was complaining about dropping multiple packets. What is this system and is it running syslog-ng, also what connection is it using? tcp/udp? Are there other hosts which are sending out dropped log messages or only pns1? - Ken _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Damien DeVille is out of the office.
by Damien_DeVille＠discovery.com 12 Aug '05

12 Aug '05

I will be out of the office starting 08/12/2005 and will not return until 08/29/2005. I will be out on vacation in 8/12. I will be in training the week of the 15th, and I will be on vacation the week of the 22nd. In my absence, please contact Chris Butler. This e-mail, and any attachment, is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, re-transmission, copying, dissemination or other use of this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. The contents of this message may contain personal views which are not the views of Discovery Communications, Inc. (DCI).

1 0

Syslog-ng Event Parsing Question
by Stringfellow, William G 12 Aug '05

12 Aug '05

I am running syslog-ng version 1.6.4 in place of syslogd on Solaris 8. Getting the following results when receiving syslog events with an embedded dash '-': Actual Event Aug 10 04:15:22 <Device Name A>.<Domain Name> 4844: Aug 10 05:15:21.204 R: %AAA-3-BUFFER_OVERFLOW: Radius I/O buffer has overflowed -Traceback= 253274 253414 252B98 2524FC E97CC E75D4 E9974 124DDC Shows up in Syslog log as Aug 10 04:15:22 <Device Name A>.<Domain Name> 4844: Aug 10 05:15:21.204 R: %AAA-3-BUFFER_OVERFLOW: Radius I/O buffer has overflowed Aug 10 04:15:22 <Device Name A>.<Domain Name> 4845: -Traceback= 253274 253414 252B98 2524FC E97CC E75D4 E9974 124DDC Actual Event May 6 10:04:45 <Device Name B>.<Domain Name> 40: May 6 07:04:44: %TCP-2-INVALIDTCPENCAPS: Invalid TCB encaps pointer: 0x61180434 -Process= \"DLSw msg proc\", ipl= 0, pid= 62 -Traceback= 6035CF34 6035E4A8 60709AE0 607067DC 60706370 607359A0 6072BDB8 6072911C 60716EE4 607147A8 602616E4 602616D0 Shows up in Syslog log as May 6 10:04:45 <Device Name B>.<Domain Name> 40: May 6 07:04:44: %TCP-2-INVALIDTCPENCAPS: Invalid TCB encaps pointer: 0x61180434 May 6 10:04:45 <Device Name B>.<Domain Name> 41: -Process= \"DLSw msg proc\", ipl= 0, pid= 62 May 6 10:04:45 <Device Name B>.<Domain Name> 42: -Traceback= 6035CF34 6035E4A8 60709AE0 607067DC 60706370 607359A0 6072BDB8 6072911C 60716EE4 607147A8 602616E4 602616D0 Anyone have an answer as to why it is splitting up the Syslog events this way, and if so, how do you correct it? Also, is there a search function for the archives? Visually looking through month after month put me to sleep pretty quickly! Thanks Bill

2 1

Last Message Repeated XX times...
by Ken Garland 11 Aug '05

11 Aug '05

I would like to receive all messages on a syslog server, is there any way to have syslog stop gathering messages in a 'last message repeated' cluster. The host is running Syslog 1.4.1 - I know this is not syslog-ng but I can't install that onto this host. Everything is remotely logging to my Central Syslog-NG server, but it's getting nothing but junk 'last message repeated X times' messages which are useless to me. - Ken

1 1

Antw: Re: [syslog-ng] STATS: dropped with version 1.6.8 under rh el4
by Stephan Hendl 11 Aug '05

11 Aug '05

the lines with values "STATS: dropped <!=0>" are very annoying. How can I prevent the syslog-ng from dropping lines??? I put the line "log_fifo_size(1000);" into the global section - hope that helps ;-))) - Stephan >>> ken.garland(a)rotech.com 10.08.2005 15:48:59 >>> Yes, receiving those lines are annoying and I drop this line into the client syslog-ng.conf: filter f_syslog { not facility(auth, authpriv, kern) and not match("STATS: dropped 0"); }; Then just use that filter in your log line. - Ken Stephan Hendl wrote: >Hi all, > >recently I upgraded one of my central syslog servers from hpux to redhat el4 with syslog-ng-1.6.8-1 and get from time to time messages like > >Aug 10 11:43:57 pns1 syslog-ng[10542]: STATS: dropped 19 >Aug 10 11:48:57 pns1 syslog-ng[10542]: STATS: dropped 45 >Aug 10 11:53:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 11:58:57 pns1 syslog-ng[10542]: STATS: dropped 36 >Aug 10 12:03:57 pns1 syslog-ng[10542]: STATS: dropped 7 >Aug 10 12:08:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:13:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:18:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:23:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:28:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:33:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:38:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:43:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:48:57 pns1 syslog-ng[10542]: STATS: dropped 37 >Aug 10 12:53:57 pns1 syslog-ng[10542]: STATS: dropped 52 >Aug 10 12:58:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 13:03:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 13:08:57 pns1 syslog-ng[10542]: STATS: dropped 51 >Aug 10 13:13:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 13:18:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 13:23:57 pns1 syslog-ng[10542]: STATS: dropped 11 >Aug 10 13:28:57 pns1 syslog-ng[10542]: STATS: dropped 1 >Aug 10 13:33:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 13:38:57 pns1 syslog-ng[10542]: STATS: dropped 0 > >There are 5 servers who are sending their syslog messages via tcp an one 2 servers who are sending via udp to that central server. The load of the machine (2xXenon CPU, 3 GHz, 1 GB RAM) is really low. For revison purposes (maillogdata) I have to keep _all_ syslog lines!!! What can I change in order to avoid dropped lines? > >Stephan > >top - 15:39:06 up 36 days, 1:49, 2 users, load average: 0.10, 0.09, 0.04 >Tasks: 194 total, 1 running, 193 sleeping, 0 stopped, 0 zombie >Cpu(s): 0.3% us, 0.2% sy, 0.0% ni, 99.2% id, 0.4% wa, 0.0% hi, 0.0% si >Mem: 1034692k total, 1018520k used, 16172k free, 141372k buffers >Swap: 2096440k total, 144k used, 2096296k free, 602228k cached > > PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND > 690 root 16 0 43644 4784 2180 S 0.7 0.5 129:42.96 nco_p_syslog > 779 root 16 0 43644 4784 2180 S 0.3 0.5 254:33.32 nco_p_syslog >10542 root 15 0 1876 1048 776 S 0.3 0.1 6:59.31 syslog-ng > 1 root 16 0 3236 548 472 S 0.0 0.1 0:00.96 init > 2 root RT 0 0 0 0 S 0.0 0.0 0:04.37 migration/0 > 3 root 34 19 0 0 0 S 0.0 0.0 0:00.06 ksoftirqd/0 > 4 root RT 0 0 0 0 S 0.0 0.0 0:03.11 migration/1 > 5 root 34 19 0 0 0 S 0.0 0.0 0:00.02 ksoftirqd/1 > >My syslog-ng.conf looks like: > >root@pns1:~# vi /etc/syslog-ng/syslog-ng.conf ># syslog-ng configuration file. ># ># This should behave pretty much like the original syslog on RedHat Linux 9. ># But it could be configured a lot smarter. ># ># See syslog-ng(8) and syslog-ng.conf(5) for more information. > >options {sync (0); > time_reopen (10); > long_hostnames (off); > use_dns (yes); > use_fqdn (no); > create_dirs (no); > keep_hostname (yes); > stats (300); >}; > >source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; >source s_tcp { tcp(ip(a.b.c.d) port(10514) keep-alive(no)); }; >source s_udp { udp(ip(a.b.c.d) port(514)); }; > ># Log all kernel messages to the console. ># Logging much else clutters up the screen. >#destination d_cons { file("/dev/console"); }; >#filter f_cons { facility(kern); }; >#log { source(s_sys); filter(f_cons); destination(d_cons); }; > ># Log anything (except mail) of level info or higher. ># Don't log private authentication messages! >destination d_mesg { file("/var/log/messages"); }; >filter f_mesg { not facility(mail,news,authpriv,cron) and level(emerg..info); }; >log { source(s_sys); filter(f_mesg); destination(d_mesg); }; > ># The authpriv file has restricted access. >destination d_auth { file("/var/log/secure"); }; >filter f_auth { facility(authpriv); }; >log { source(s_sys); filter(f_auth); destination(d_auth); }; > ># Log all the mail messages in one place. >destination d_mail { file("/var/log/maillog" template( "$DATE $HOST $MESSAGE\n")); }; >filter f_mail { facility(mail); }; >log { source(s_sys); filter(f_mail); destination(d_mail); }; > ># Log cron stuff. >destination d_cron { file("/var/log/cron"); }; >filter f_cron { facility(cron); }; >log { source(s_sys); filter(f_cron); destination(d_cron); }; > ># Everybody gets emergency messages. >destination d_mlal { usertty("*"); }; >filter f_mlal { level(emerg); }; >log { source(s_sys); filter(f_mlal); destination(d_mlal); }; > ># Save news errors of level crit and higher in a special file. >destination d_spol { file("/var/log/spooler"); }; >filter f_spol {facility(uucp) or facility(news) and level(emerg..crit); }; >log { source(s_sys); filter(f_spol); destination(d_spol); }; > ># Save boot messages also to boot.log. >destination d_boot { file("/var/log/boot.log"); }; >filter f_boot { facility(local7); }; >log { source(s_sys); filter(f_boot); destination(d_boot); }; > ># Save all mesages to syslog.lvnbb.de >destination d_tcp { tcp("localhost" port(10514)); }; >log { source(s_sys); destination(d_tcp); }; >log { source(s_tcp); destination(d_tcp); }; >log { source(s_udp); destination(d_tcp); }; > ># Save all messages to pipe /tmp/cic.pipe >destination d_cic { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template("$DATE $HOST $MESSAGE\n") template-escape(yes)); }; >log { source(s_sys); destination(d_cic); }; >log { source(s_tcp); destination(d_cic); }; >log { source(s_udp); destination(d_cic); }; > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

syslog-ng 1.9.5 under Solaris 10 (sparc)
by Andrea.DAlessandro＠esa.int 10 Aug '05

10 Aug '05

I know that release 1.9.5 is in development phase. Maybe the below is useful to "our" developers. FYI - I have installed 1.6.8 with no troubles (up to now...) Regards, Andrea # /usr/local/bin/make /usr/local/bin/make all-recursive make[1]: Entering directory `/lhome/esacom96/admest/packages/Sol10/balabit/syslog-ng-1.9.5' Making all in src make[2]: Entering directory `/lhome/esacom96/admest/packages/Sol10/balabit/syslog-ng-1.9.5/src' if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT misc.o -MD -MP -MF ".deps/misc.Tpo" \ -c -o misc.o `test -f 'misc.c' || echo './'`misc.c; \ then mv -f ".deps/misc.Tpo" ".deps/misc.Po"; \ else rm -f ".deps/misc.Tpo"; exit 1; \ fi if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT utils.o -MD -MP -MF ".deps/utils.Tpo" \ -c -o utils.o `test -f 'utils.c' || echo './'`utils.c; \ then mv -f ".deps/utils.Tpo" ".deps/utils.Po"; \ else rm -f ".deps/utils.Tpo"; exit 1; \ fi if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT messages.o -MD -MP -MF ".deps/messages.Tpo" \ -c -o messages.o `test -f 'messages.c' || echo './'`messages.c; \ then mv -f ".deps/messages.Tpo" ".deps/messages.Po"; \ else rm -f ".deps/messages.Tpo"; exit 1; \ fi In file included from messages.c:24: messages.h:49: error: parse error before "EVTTAG" messages.c:40: error: parse error before '*' token messages.c:40: warning: type defaults to `int' in declaration of `evt_context' messages.c:40: warning: data definition has no type or storage class messages.c: In function `msg_send_internal_message': messages.c:56: warning: int format, pid_t arg (arg 5) messages.c: At top level: messages.c:63: error: parse error before "EVTTAG" messages.c: In function `msg_event': messages.c:69: error: `prio' undeclared (first use in this function) messages.c:69: error: (Each undeclared identifier is reported only once messages.c:69: error: for each function it appears in.) messages.c:69: error: `desc' undeclared (first use in this function) messages.c:69: warning: passing arg 1 of `evt_rec_init' from incompatible pointer type messages.c:69: warning: assignment makes pointer from integer without a cast messages.c:70: error: `tag1' undeclared (first use in this function) messages.c:72: warning: implicit declaration of function `evt_rec_add_tag' messages.c:74: warning: implicit declaration of function `evt_rec_add_tagsv' messages.c:80: error: `EVT_PRI_DEBUG' undeclared (first use in this function) messages.c:84: warning: implicit declaration of function `evt_rec_get_syslog_pri' messages.c:73: error: `va_start' used in function with fixed args messages.c: In function `msg_log_func': messages.c:94: error: `EVT_PRI_INFO' undeclared (first use in this function) messages.c:97: error: `EVT_PRI_DEBUG' undeclared (first use in this function) messages.c:99: error: `EVT_PRI_WARNING' undeclared (first use in this function) messages.c:101: error: `EVT_PRI_ERR' undeclared (first use in this function) messages.c:103: error: `EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c: In function `msg_init': messages.c:119: warning: implicit declaration of function `evt_ctx_init' messages.c:119: error: `EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c:119: warning: assignment makes pointer from integer without a cast messages.c: In function `msg_deinit': messages.c:130: warning: implicit declaration of function `evt_ctx_free' make[2]: *** [messages.o] Error 1 make[2]: Leaving directory `/lhome/esacom96/admest/packages/Sol10/balabit/syslog-ng-1.9.5/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/lhome/esacom96/admest/packages/Sol10/balabit/syslog-ng-1.9.5' make: *** [all] Error 2

2 1

missing logs when forwarded from one syslog-ng to another syslog-ng
by Arnold Wang 09 Aug '05

09 Aug '05

I have two syslog-ng servers configured, one in the DMZ for devices outside firewall send logs to and another one in the LAN. The logs send to the DMZ one will be forwarded to the LAN one, at least that's my original idea. However, it seems very unstable on the forwarding. Some of the logs appeared in the DMZ one were not shown up in the LAN one. For example, I just did a test from two routers outside the firewall and there were two logs generated in DMZ log server: [root@rcarhlp01 qwestdia1]# tail -1 qwestdia1.log Aug 9 13:30:25 qwestdia1 128: *Apr 28 06:56:48: %SYS-5-CONFIG_I: Configured from console by vty0 (204.146.209.151) [root@rcarhlp01 qwestdia1]# tail -1 ../qwestdia2/qwestdia2.log Aug 9 13:30:59 qwestdia2 46: *Apr 28 06:57:24: %SYS-5-CONFIG_I: Configured from console by vty0 (204.146.209.151) However, I only saw one in the LAN log server: [root@rcarhlp02 qwestdia1]# tail -1 qwestdia1.log Aug 8 16:18:39 qwestdia1 127: *Apr 27 09:35:42: %SYS-5-CONFIG_I: Configured from console by vty0 (204.146.209.248) ** This is still the one from last night ** [root@rcarhlp02 qwestdia1]# tail -1 ../qwestdia2/qwestdia2.log Aug 9 13:30:59 qwestdia2 46: *Apr 28 06:57:24: %SYS-5-CONFIG_I: Configured from console by vty0 (204.146.209.151) My configurations on both machines are like the following: ---- Configuration for LAN server -------- [root@rcarhlp02 syslog-ng]# more syslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_slng { internal(); }; source s_tcp { tcp(port (5140) tcp-keep-alive(yes)); }; source s_udp { udp(port (514)); }; destination d_slng { file("/var/syslog-ng/syslog-ng.log"); }; destination d_file { file("/var/syslog-ng/HOSTS/$HOST/$HOST.log" owner (root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; destination d_mysql { pipe("/var/syslog-ng/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(s_slng); destination(d_slng); }; log { source(s_tcp); source(s_udp); destination(d_file); destination (d_mysql); }; #log { source(s_tcp); destination(d_mysql); }; #log { source(s_udp); destination(d_file); }; #log { source(s_udp); destination(d_mysql); }; # vim: syntax=syslog-ng [root@rcarhlp02 syslog-ng]# ----- Configuration for DMZ server --------- [root@rcarhlp01 syslog-ng]# more syslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_udp { udp(port(514)); }; source s_slng { internal(); }; destination d_slng { file("/var/syslog-ng/syslog-ng.log"); }; destination d_local { file("/var/syslog-ng/HOSTS/$HOST/$HOST.log" owner (root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; destination d_remote { tcp("10.17.2.146" port(5140) tcp-keep-alive (yes)); }; log { source(s_udp); destination(d_local); destination(d_remote); }; #log { source(s_udp); destination(d_remote); }; log { source(s_slng); destination(d_slng); }; # vim: syntax=syslog-ng [root@rcarhlp01 syslog-ng]#

1 0

streams log driver on AIX
by Michael Mannsberger 09 Aug '05

09 Aug '05

What streams log driver is syslog using on AIX besides /dev/log?

1 0

'make fails' @ conflicting types for 'affile_dd_set_file_perm'
by OpenMacNews 08 Aug '05

08 Aug '05

hi, moving (finally) to bldg syslog-ng 1.9-snapshot on OSX 10.4.2 prereqs of glib 2.7.7 & eventlog-snapshot are built/installed. syslog-ng-1.9-snapshot fails on 'make' @: ... if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/bind9/include -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT affile.o -MD -MP -MF ".deps/affile.Tpo" -c -o affile.o affile.c; \ then mv -f ".deps/affile.Tpo" ".deps/affile.Po"; else rm -f ".deps/affile.Tpo"; exit 1; fi affile.c:305: error: conflicting types for 'affile_dd_set_file_perm' affile.c:305: note: an argument type that has a default promotion can't match an empty parameter name list declaration affile.h:75: error: previous declaration of 'affile_dd_set_file_perm' was here affile.c:329: error: conflicting types for 'affile_dd_set_dir_perm' affile.c:329: note: an argument type that has a default promotion can't match an empty parameter name list declaration affile.h:78: error: previous declaration of 'affile_dd_set_dir_perm' was here affile.c: In function 'affile_dd_init': affile.c:422: warning: comparison is always false due to limited range of data type affile.c:428: warning: comparison is always false due to limited range of data type make[2]: *** [affile.o] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 % checking the declarations for 'affile_dd_set_file_perm' ... % grep affile_dd_set_file_perm `grep -rln affile_dd_set_file_perm .` ./src/affile.c:affile_dd_set_file_perm(LogPipe *s, mode_t file_perm) ./src/affile.h:void affile_dd_set_file_perm(); ./src/cfg-grammar.c: { affile_dd_set_file_perm(last_driver, yyvsp[-1].num); } ./src/cfg-grammar.c: { affile_dd_set_file_perm(last_driver, yyvsp[-1].num); } ./src/cfg-grammar.y: | KW_PERM '(' NUMBER ')' { affile_dd_set_file_perm(last_driver, $3); } ./src/cfg-grammar.y: | KW_PERM '(' NUMBER ')' { affile_dd_set_file_perm(last_driver, $3); } it's not immediately clear which is the conflict. ideas? richard

2 3

eventlog snap missing AUTHORS
by OpenMacNews 07 Aug '05

07 Aug '05

hi, the eventlog snapshot src tree is missing "AUTHORS" which causes "autoreconf -i -f" to complain/choke ... a simple % touch AUTHORS fixes the prob, so you might wish to add it to the distro ... cheers, richard

1 0

messages when I restart syslog-ng
by Thierry B 07 Aug '05

07 Aug '05

Hello, When I restart syslog-ng, he tells me that: debian:/home/thierry# /etc/init.d/syslog-ng restart CONSOLE_LOG_LEVEL is of unaccepted value. KERNEL_RINGBUF_SIZE is of unaccepted value. Thanks :-) Bye

2 1

exemple for logging with a regexp
by Thierry B 07 Aug '05

07 Aug '05

Hello, I'd like to ask you a queqtion about syslog-ng. I'd like to log for example, all mails from postfix in mail.log and for example all mails from courier imap to /var/log/imapd. I already manage to do that with syslog using facility like that: local0.* -/var/log/imapd.log mail.* -/var/log/mail.log But I'd like to add a regexp, so he didn't log all things. For example, for postfix, I'd like to add a blank line each time he find a line called "disconnect" or "removed". Is it possible to do that easyly with syslog-ng? Or I can also do that with my actual syslog? Because if I pass to syslog-ng instead of syslog, I'd like to keep my syslog config, except for those logs, that I want to filter with regexp. Thanks :-)

1 0

RE: [syslog-ng] syslog-ng- filter() problem
by Kelly Pow 05 Aug '05

05 Aug '05

HI, Am currently using Syslog-ng to collect snmptraps. My problem is that I amcurrently receiving traps from three different networks and I have to filter them out. I am receiving traps from 64.251.65.224/255.255.255.240 66.163.79.0/255.255.255.128 204.209.214.0/255.255.254.0 Where I want traps from 64.251.65.224/255.255.255.240 and 66.163.79.0/255.255.255.128 to be stored in one file While traps from 204.209.214.0/255.255.254.0 in another. Currently this is what my syslog-ng.conf looks like And I am receiving nothing :-( I am very frustrated with this. Please help. Thank you. options { long_hostnames(yes); keep_hostname(yes); use_fqdn(on); create_dirs(yes); owner(nmadmin); group(users); perm(0755); dir_owner(nmadmin); dir_group(users); dir_perm(0755); sync(0); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #for SNMPTRAP destination ipbb_lab_traps { file("/store/ipbb_lab/traps/$YEAR-$MONTH-$DAY"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; #filter snmptrap filter f_testA { level(warn)and netmask(64.251.65.224/255.255.255.240); }; filter f_testB { level(warn)and netmask(66.163.79.0/255.255.255.128); }; log { source(src); filter(f_testA); destination(ipbb_traps); }; log { source(src); filter(f_testB); destination(ipbb_traps); }; filter f_test2 { level(warn)and netmask(204.209.214.0/255.255.254.0); }; log { source(src); filter (f_test2); destination(ipbb_lab_traps); }; Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca> _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Frans Stekelenburg Sent: Wednesday, August 03, 2005 5:27 AM To: Syslog-ng users' and developers' mailing list; ebroo(a)healthydirections.com Subject: RE: [syslog-ng] syslog-ng- filter() problem try making another filter first with the three filters and 'or' statements. Sounds like your config creates an and-and-and situation for you, leading in nothing beeing logged. I think I came across this situation on one of the helpful pages around (google), but unfortunatly don't remember where, so I can't refer you to it. regards, frans _____ From: Kelly Pow [mailto:kelly.pow@sjrb.ca] Sent: dinsdag 2 augustus 2005 18:55 To: Syslog-ng users' and developers' mailing list; ebroo(a)healthydirections.com Subject: RE: [syslog-ng] syslog-ng- filter() problem Hi, I am collecting traps and syslog data Yes they are being sent to the right place. Yes the destinations exist and the permissions are correct I am running Gentoo And syslog-ng version- 1.6.5-r2 The problem is: log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; if I only have : log { source(src); filter(f_snmptrap); destination(ipbb_traps); }; or log { source(src); filter(f_ipbb1); destination(ipbb_traps); }; but when I add more filters it give me nothing Why? Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca> _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Edward Brookhouse Sent: Friday, July 29, 2005 5:08 AM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] syslog-ng- filter() problem Are you collecting traps or syslog data ? Tcpdump is your friend - are the syslog speakers speaking to the right place ? Is anything else being logged on the box from other sources? Does the destination exist and permissions correct What os ? Which versions of syslog-ng _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Kelly Pow Sent: Thursday, July 28, 2005 5:55 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng- filter() problem Hi, I am trying to collect traps from these two networks. 66.163.79.0/255.255.255.128 and 64.251.65.224/255.255.255.240 I don't understand why when I do this it doesn't collect anything Any ideas/.?? ---------------------------------------------------------------------------- --------------------------- source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #filter snmptrap filter f_snmptrap { level(warn); }; #testing filters for the different networks filter f_ipbb1 {netmask("66.163.79.0/255.255.255.128"); }; filter f_ipbb2 {netmask("64.251.65.224/255.255.255.240"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; ---------------------------------------------------------------------------- ------------------------------- Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca>

1 0

Re: [syslog-ng] Problem with hostnames!
by mrgenius 05 Aug '05

05 Aug '05

phewww.. Its been over a month i am trying different things ..but its not giving me desired result... i have even switched my os from mandrake to RHEL 4 .. still no sucess. i am again explaining my issue.. i've syslog-ng-1.6.8-1 running on RHEL 4 AS. This Server is on public IP 202.163.x.x . And Its receving Logs from Different Devices on network. (basically i run own isp). In Order to give friendly name to IPs of devices what i have done is to enter hostnames against IPs in /etc/hosts file. So as a result of it.. All logs i get gets name of my desire. however Problem arises when i enabled syslog on certain devices which have Prive IP of 192.168.x.x I entered hostnames in /etc/hosts for these private Ips as i did in case of public iP hosts .. but what i am getting in database is not the names of these Hosts.. instead i am getting PRIVATE IPs. I tried running local DNS on machine and make even reserve zones.. still result remained same.. then i entered these hosts names in my ISP's DNS .. but even then same result.. Can Some one tell me Why this is happening?? why in the world syslog-ng is not giving hostnames to PRIVATE IPs. Please help me out :( On 7/15/05, Edward Brookhouse <ebroo(a)healthydirections.com> wrote: > > About the last thing I can think of would be to run syslog-ng in a debug > window (or attach to it with gdb) and see exactly which system calls are > made when an entry arrives. This will tell you which function is being used > to do name resolution – > > So just to make sure I understand whats happening – no matter how hosts > file or use_dns is set you have hosts that are not being resolved? > > > Oh – did you check reverse dns ? > > ------------------------------ > > *From:* mrgenius [mailto:mrgenius420@gmail.com] > *Sent:* Friday, July 15, 2005 3:01 AM > *To:* Edward Brookhouse > *Cc:* Syslog-ng users' and developers' mailing list > *Subject:* Re: [syslog-ng] Problem with hostnames! > > Well if set use_dns(off) then it stops reading /etc/hosts file and start > storing hosts as IP addresses. > > I am using Mandrake 10.1 Official...... > > In nsswitch.conf i have tried by giving DNS, file and file,dns both > combination.. but it doesn't make any difference... its still neither > picking private Ips from /etc/hosts nor from local cache dns server. > > > > On 7/14/05, *Edward Brookhouse* <*ebroo(a)healthydirections.com*<ebroo(a)healthydirections.com>> > wrote: > > What happens if you set use_dns (off); does your hosts file get read then? > What OS is this? How is the system nsswitch.conf setup for resolution? > > Also maybe double check your resolv.conf what is the domain listing and > search order listed in there? > > ------------------------------ > > *From:* *syslog-ng-bounces(a)lists.balabit.hu*<syslog-ng-bounces(a)lists.balabit.hu>[mailto: > *syslog-ng-bounces(a)lists.balabit.hu* <syslog-ng-bounces(a)lists.balabit.hu>] > *On Behalf Of *mrgenius > *Sent:* Thursday, July 14, 2005 12:53 AM > *To:* Ken Garland > *Cc:* Syslog-ng users' and developers' mailing list > *Subject:* Re: [syslog-ng] Problem with hostnames! > > Yes here is the portion of my syslog-ng.cong > > ##################################### > > options { sync (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames (yes); > use_dns (yes); > use_fqdn (yes); > create_dirs (no); > keep_hostname (no); > }; > > source sys { unix-stream ("/dev/log"); internal(); }; > source net { > udp(ip(* 0.0.0.0* <http://0.0.0.0/>) port(514) ); > }; > > > destination d_mysql { > pipe("/tmp/mysql.pipe" > template("INSERT INTO logs > (host, facility, priority, level, tag, datetime, program, msg) > VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', > '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', > '$PROGRAM', '$MSG' );\n") template-escape(yes)); > }; > log { source(net); destination(d_mysql); > > ############################################## > > But if you say that syslog-ng first queries DNS Server ... then why it > is resolving names for all public Ips which i defined in /etc/hosts and > those public Ips have no entries in my defined DNS Servers. > > i am quite confused how this thing is actually working?? > > Regards, > > -Geni > > > > On 7/14/05, *Ken Garland* <* ken.garland(a)rotech.com*<ken.garland(a)rotech.com>> > wrote: > > paste the relevant parts of your .conf file. > > mrgenius wrote: > > > > > Hi All! > > > > I am using Syslog-ng with php-syslog-ng. to give names of my choices > > to different hosts IP what i did was to define hostnames against each > > IP of host in /etc/hosts file. > > > > It was working fine with Public IP adresses.. But I have some hosts on > > local network too with 192.168 IPs . The pRoblem i am now facing is > > that its not storing logs with HOSTNAMES of private IPs. Where as its > > working fine and giving names of Public IPs. > > > > For example In My /etc/hosts file i have these 2 entries > > > > *202.164.1.1* <http://202.164.1.1/> <* http://202.164.1.1*<http://202.164.1.1/>> > broadband-router > > *192.168.77.1* <http://192.168.77.1/> <* http://192.168.77.1*<http://192.168.77.1/>> > primary-router > > > > For 1st entry Logs in database will come with name broadband-router, > > which is what i want > > For 2nd Entry Logs in database will come with name *192.168.77.1*<http://192.168.77.1/> > > <* http://192.168.77.1* <http://192.168.77.1/>>, which is what i Don't > want > > > > > > Any body has any idea?? any thing to do in configuration of syslog-ng?? > > > > Regards, > > > > -Geni > > > >------------------------------------------------------------------------ > > > >_______________________________________________ > >syslog-ng maillist - *syslog-ng(a)lists.balabit.hu*<syslog-ng(a)lists.balabit.hu> > *** * > >*https://lists.balabit.hu/mailman/listinfo/syslog-ng*<https://lists.balabit.hu/mailman/listinfo/syslog-ng> > >Frequently asked questions at *http://www.campin.net/syslog-ng/faq.html*<http://www.campin.net/syslog-ng/faq.html> > > > > > > > >

1 0

strange problem when use "_" in the destination log file name
by Arnold Wang 05 Aug '05

05 Aug '05

Hi, I'm running into a strange problem with syslog-ng 1.6.8 on RHEL 4. In my configuration file, I have the following local log file defined: destination d_file { file("/var/syslog- ng/HOSTS/$HOST/$YEAR/$MONTH/$HOST_$MONTH$DAY.log" owner(root) group (root) perm(0600) dir_perm(0700) create_dirs(yes)); }; However, the log file generated by the syslog-ng for today is named "0803.log", which is different than "hostname_0803.log" as I expected. I tried using escape "\" so it looks like "$HOST\_$MONTH$DAY.log" and it didn't help at all. This problem actually doesn't bother me that much. I changed "_" to "-" or ".", it worked. I'm just curious about this.

4 9

Spoof-source issue
by Jose Gerardo Amaya Giron 05 Aug '05

05 Aug '05

Hello all. I'm using the spoof source feature to centralize my logs to a server. I was hoping that the server will receive the IP message with the source IP address from the source(spoofed of course), but it get it as the source address the syslog-ng server and the spoofed IP address in the message content. Is there a way I can generate the message not with the original source IP as a description, but to have it actually as the IP message. Thanks in advance Gerardo Amaya ---------------------------------------------------------------- Servicio de correo - Universidad Galileo - Guatemala

2 1

How to make syslog to write to a new file every 10 mins
by Hermann Tse 04 Aug '05

04 Aug '05

Hi, I can make it to write to a new file every hour by the following destination firewall {file ("var/log/firewall/firewall_$YEAR_$MONTH_$DAY_$HOUR")} but how I can make it to write to a new file every 5 minutes or 10 minutes? Thanks __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

FW: Mark from 1.9.4 to 1.9.5
by Edward Brookhouse 04 Aug '05

04 Aug '05

I was mistaken - the - MARK - is back - My only option left is to hack the source and remove the function and the reference to it - Anyone have any other suggestions for getting rid of the Mark ??? Is there a compile time option to turn this off??? Even stranger is that the source declares: cfg.c: self->mark_freq = 1200; /* 20 minutes */ but I am seeing a mark once an hour TIA EB _____ From: Edward Brookhouse [mailto:ebroo@healthydirections.com] Sent: Wednesday, August 03, 2005 9:58 AM To: 'Syslog-ng users' and developers' mailing list' Subject: Mark from 1.9.4 to 1.9.5 Hi all, Using 1.9.4 I experienced the -Mark-being inserted although no mark() option was specified in the config - I just upgraded to the 1.9.5 source and the behavior of mark seems to be back to normal - Just FYI E

3 3

RE: [syslog-ng] FW: Mark from 1.9.4 to 1.9.5
by Frans Stekelenburg 04 Aug '05

04 Aug '05

Are you absolutly sure it isn't a setting somewhere in /etc? You may set the interval to anything you like on Debian by editing /etc/init.d/sysklogd. This sets it to 60 minutes: SYSLOGD="-m 60" (Then restart the syslog daemon: # /etc/init.d/sysklogd restart ) On Red Hat and derivatives, edit /etc/sysconfig/syslog : SYSLOGD_OPTIONS="-m 60" Must come from somewhere, right? ;-) ________________________________ From: Edward Brookhouse [mailto:ebroo@healthydirections.com] Sent: woensdag 3 augustus 2005 18:56 To: 'Syslog-ng users' and developers' mailing list' Subject: [syslog-ng] FW: Mark from 1.9.4 to 1.9.5 I was mistaken - the - MARK - is back - My only option left is to hack the source and remove the function and the reference to it - Anyone have any other suggestions for getting rid of the Mark ??? Is there a compile time option to turn this off??? Even stranger is that the source declares: cfg.c: self->mark_freq = 1200; /* 20 minutes */ but I am seeing a mark once an hour TIA EB ________________________________ From: Edward Brookhouse [mailto:ebroo@healthydirections.com] Sent: Wednesday, August 03, 2005 9:58 AM To: 'Syslog-ng users' and developers' mailing list' Subject: Mark from 1.9.4 to 1.9.5 Hi all, Using 1.9.4 I experienced the -Mark-being inserted although no mark() option was specified in the config - I just upgraded to the 1.9.5 source and the behavior of mark seems to be back to normal - Just FYI E

2 1

Re: syslog-ng Digest, Vol 4, Issue 5
by Arnold Wang 03 Aug '05

03 Aug '05

Thanks for your help, Valdis. I run the strace and found the missing library files. My current $CHROOTDIR looks like this: ./ ./lib ./lib/libnss_dns.so.2 ./etc ./etc/ld.so.cache ./etc/resolv.conf ./etc/localtime ./etc/host.conf ./etc/hosts ./etc/syslog-ng ./etc/syslog-ng/syslog-ng.conf ./etc/nsswitch.conf ./dev ./dev/zero ./dev/null ./var ./var/log ./var/log/syslogng.log ./var/log/HOSTS I guess I'll need more files once I start logging to MYSQL, however it should be a easy task now with the help of strace and the kind people of this list, I hope. On Wed, 2005-08-03 at 12:00 +0200, syslog-ng-request(a)lists.balabit.hu wrote: > On Tue, 02 Aug 2005 15:28:01 PDT, Arnold Wang said: > > > I'm running syslog-ng in chroot mode, followed the instructions in > > http://www.campin.net/syslog-ng/chroot-jail.html. I also enabled DNS > > lookup so I can show the Cisco routers in their friendly names instead > > of IPs. The DNS lookup works fine until I enabled chroot mode. I copied > > "nsswitch.conf" and "resolv.conf" files into $CHROOTDIR/etc as well, > > just in case. > > You'll also need any shared libs your syslog-ng binary needs (use ldd to find them), > and probably stuff in $CHROOT/dev as well (dev/null and dev/zero come to mind). > > I'm probably missing something here - 'strace -f chroot $CHROOT bin/syslog-ng' will > show you if you're missing anything else... > > > BTW, the host is RHEL4 and I set SELinux to "permissive". > > 'permissive' will probably throw a whole lot of AVC messages unless you label > the contexts for the files in the chroot tree (fortunately, there's hopefully > not a lot, so hand-labelling is probably feasible). Sorry, the inability to > use 'restorecon' to label a chroot tree is a known deficiency in the current > tools... > > Fortunately, in permissive mode, each avc message is only printed once, so you'll > get spammed with a bunch of messages at startup (and probably one/two more logmsgs > for each logfile it opens). > > > Will my configuration work? If so, what should I check? Thanks in > > advance for help. > > Shared libs.. /dev entries. The strace command I gave should help find > other stuff that's missing. Good luck. ;)

1 0

Mark from 1.9.4 to 1.9.5
by Edward Brookhouse 03 Aug '05

03 Aug '05

Hi all, Using 1.9.4 I experienced the -Mark-being inserted although no mark() option was specified in the config - I just upgraded to the 1.9.5 source and the behavior of mark seems to be back to normal - Just FYI E

1 0

RE: [syslog-ng] syslog-ng- filter() problem
by Frans Stekelenburg 03 Aug '05

03 Aug '05

try making another filter first with the three filters and 'or' statements. Sounds like your config creates an and-and-and situation for you, leading in nothing beeing logged. I think I came across this situation on one of the helpful pages around (google), but unfortunatly don't remember where, so I can't refer you to it. regards, frans _____ From: Kelly Pow [mailto:kelly.pow@sjrb.ca] Sent: dinsdag 2 augustus 2005 18:55 To: Syslog-ng users' and developers' mailing list; ebroo(a)healthydirections.com Subject: RE: [syslog-ng] syslog-ng- filter() problem Hi, I am collecting traps and syslog data Yes they are being sent to the right place. Yes the destinations exist and the permissions are correct I am running Gentoo And syslog-ng version- 1.6.5-r2 The problem is: log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; if I only have : log { source(src); filter(f_snmptrap); destination(ipbb_traps); }; or log { source(src); filter(f_ipbb1); destination(ipbb_traps); }; but when I add more filters it give me nothing Why? Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Edward Brookhouse Sent: Friday, July 29, 2005 5:08 AM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] syslog-ng- filter() problem Are you collecting traps or syslog data ? Tcpdump is your friend - are the syslog speakers speaking to the right place ? Is anything else being logged on the box from other sources? Does the destination exist and permissions correct What os ? Which versions of syslog-ng _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Kelly Pow Sent: Thursday, July 28, 2005 5:55 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng- filter() problem Hi, I am trying to collect traps from these two networks. 66.163.79.0/255.255.255.128 and 64.251.65.224/255.255.255.240 I don't understand why when I do this it doesn't collect anything Any ideas/.?? ------------------------------------------------------------------------ ------------------------------- source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #filter snmptrap filter f_snmptrap { level(warn); }; #testing filters for the different networks filter f_ipbb1 {netmask("66.163.79.0/255.255.255.128"); }; filter f_ipbb2 {netmask("64.251.65.224/255.255.255.240"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; ------------------------------------------------------------------------ ----------------------------------- Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca

1 0