- syslog-ng - lists.balabit.hu

help on DNS issue when running syslog-ng chrooted
by Arnold Wang 03 Aug '05

03 Aug '05

Hi, I'm a newbie to the syslog-ng. I just have the application installed and configured since yesterday and I like it already. However, I'm running into a problem. I hope someone on this list has done it already and can help me out. I'm running syslog-ng in chroot mode, followed the instructions in http://www.campin.net/syslog-ng/chroot-jail.html. I also enabled DNS lookup so I can show the Cisco routers in their friendly names instead of IPs. The DNS lookup works fine until I enabled chroot mode. I copied "nsswitch.conf" and "resolv.conf" files into $CHROOTDIR/etc as well, just in case. BTW, the host is RHEL4 and I set SELinux to "permissive". Will my configuration work? If so, what should I check? Thanks in advance for help.

2 1

syslog-ng starting problem
by javier rojas 02 Aug '05

02 Aug '05

hello, i'm getting an error when trying to start the syslog-ng server... here's the error: [root@monitor-2 etc]# /etc/init.d/syslog-ng start Starting system logger: parse error at 16 Parse error reading configuration file, exiting. [FAILED] Starting kernel logger: [root@monitor-2 etc]# here's the syslog-ng.conf file: # # Configuration file for syslog-ng under Debian # # attempts at reproducing default syslog behavior # the standard syslog levels are (in descending order of priority): # emerg alert crit err warning notice info debug # the aliases "error", "panic", and "warn" are deprecated # the "none" priority found in the original syslogd configuration is # only used in internal messages created by syslogd ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY',---line 16 '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; ## Log on to text file ## destination hosts { file("/var/log/$HOST.$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log {source(net); destination(hosts); }; ## Log on to text file ## destination hosts { file("/var/log/messages"); }; log {source(net); destination(hosts); }; #Then comment out this line -- # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; #Then uncomment out this line -- # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. source src { unix-dgram("/dev/log"); internal(); }; source net { udp(); }; ###### # options options { # disable the chained hostname format in logs # (default is enabled) chain_hostnames(0); # the time to wait before a died connection is re-established # (default is 60) time_reopen(10); # the time to wait before an idle destination file is closed # (default is 60) time_reap(360); # the number of lines buffered before written to file # you might want to increase this if your disk isn't catching with # all the log messages you get or if you want less disk activity # (say on a laptop) # (default is 0) #sync(0); # the number of lines fitting in the output queue log_fifo_size(2048); # enable or disable directory creation for destination files create_dirs(yes); # default owner, group, and permissions for log files # (defaults are 0, 0, 0600) #owner(root); group(adm); perm(0640); # default owner, group, and permissions for created directories # (defaults are 0, 0, 0700) #dir_owner(root); #dir_group(root); dir_perm(0755); # enable or disable DNS usage # syslog-ng blocks on DNS queries, so enabling DNS may lead to # a Denial of Service attack # (default is yes) use_dns(no); # maximum length of message in bytes # this is only limited by the program listening on the /dev/log Unix # socket, glibc can handle arbitrary length log messages, but -- for # example -- syslogd accepts only 1024 bytes # (default is 2048) #log_msg_size(2048); }; ###### # sources # all known message sources source s_all { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); # use the above line if you want to receive remote UDP logging messages # (this is equivalent to the "-r" syslogd flag) # udp(); }; ###### # destinations # some standard log files destination df_auth { file("/var/log/auth.log"); }; destination df_syslog { file("/var/log/syslog"); }; destination df_cron { file("/var/log/cron.log"); }; destination df_daemon { file("/var/log/daemon.log"); }; destination df_kern { file("/var/log/kern.log"); }; destination df_lpr { file("/var/log/lpr.log"); }; destination df_mail { file("/var/log/mail.log"); }; destination df_user { file("/var/log/user.log"); }; destination df_uucp { file("/var/log/uucp.log"); }; # these files are meant for the mail system log files # and provide re-usable destinations for {mail,cron,...}.info, # {mail,cron,...}.notice, etc. destination df_facility_dot_info { file("/var/log/$FACILITY.info"); }; destination df_facility_dot_notice { file("/var/log/$FACILITY.notice"); }; destination df_facility_dot_warn { file("/var/log/$FACILITY.warn"); }; destination df_facility_dot_err { file("/var/log/$FACILITY.err"); }; destination df_facility_dot_crit { file("/var/log/$FACILITY.crit"); }; # these files are meant for the news system, and are kept separated # because they should be owned by "news" instead of "root" destination df_news_dot_notice { file("/var/log/news/news.notice" owner("news")); }; destination df_news_dot_err { file("/var/log/news/news.err" owner("news")); }; destination df_news_dot_crit { file("/var/log/news/news.crit" owner("news")); }; # some more classical and useful files found in standard syslog configurations destination df_debug { file("/var/log/debug"); }; destination df_messages { file("/var/log/messages"); }; # pipes # a console to view log messages under X destination dp_xconsole { pipe("/dev/xconsole"); }; # consoles # this will send messages to everyone logged in destination du_all { usertty("*"); }; ###### # filters # all messages from the auth and authpriv facilities filter f_auth { facility(auth, authpriv); }; # all messages except from the auth and authpriv facilities filter f_syslog { not facility(auth, authpriv); }; # respectively: messages from the cron, daemon, kern, lpr, mail, news, user, # and uucp facilities filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; # some filters to select messages of priority greater or equal to info, warn, # and err # (equivalents of syslogd's *.info, *.warn, and *.err) filter f_at_least_info { level(info..emerg); }; filter f_at_least_notice { level(notice..emerg); }; filter f_at_least_warn { level(warn..emerg); }; filter f_at_least_err { level(err..emerg); }; filter f_at_least_crit { level(crit..emerg); }; # all messages of priority debug not coming from the auth, authpriv, news, and # mail facilities filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; # all messages of info, notice, or warn priority not coming form the auth, # authpriv, cron, daemon, mail, and news facilities filter f_messages { level(info,notice,warn) and not facility(auth,authpriv,cron,daemon,mail,news); }; # messages with priority emerg filter f_emerg { level(emerg); }; # complex filter for messages usually sent to the xconsole filter f_xconsole { facility(daemon,mail) or level(debug,info,notice,warn) or (facility(news) and level(crit,err,notice)); }; ###### # logs # order matters if you use "flags(final);" to mark the end of processing in a # "log" statement # these rules provide the same behavior as the commented original syslogd rules # auth,authpriv.* /var/log/auth.log log { source(s_all); filter(f_auth); destination(df_auth); }; # *.*;auth,authpriv.none -/var/log/syslog log { source(s_all); filter(f_syslog); destination(df_syslog); }; # this is commented out in the default syslog.conf # cron.* /var/log/cron.log #log { # source(s_all); # filter(f_cron); # destination(df_cron); # daemon.* -/var/log/daemon.log log { source(s_all); filter(f_daemon); destination(df_daemon); }; # kern.* -/var/log/kern.log log { source(s_all); filter(f_kern); destination(df_kern); }; # lpr.* -/var/log/lpr.log log { source(s_all); filter(f_lpr); destination(df_lpr); }; # mail.* -/var/log/mail.log log { source(s_all); filter(f_mail); destination(df_mail); }; # user.* -/var/log/user.log log { source(s_all); filter(f_user); destination(df_user); }; # uucp.* /var/log/uucp.log log { source(s_all); filter(f_uucp); destination(df_uucp); }; # mail.info <http://mail.info> -/var/log/mail.info log { source(s_all); filter(f_mail); filter(f_at_least_info); destination(df_facility_dot_info); }; # mail.warn -/var/log/mail.warn log { source(s_all); filter(f_mail); filter(f_at_least_warn); destination(df_facility_dot_warn); }; # mail.err /var/log/mail.err log { source(s_all); filter(f_mail); filter(f_at_least_err); destination(df_facility_dot_err); }; # news.crit /var/log/news/news.crit log { source(s_all); filter(f_news); filter(f_at_least_crit); destination(df_news_dot_crit); }; # news.err /var/log/news/news.err log { source(s_all); filter(f_news); filter(f_at_least_err); destination(df_news_dot_err); }; # news.notice /var/log/news/news.notice log { source(s_all); filter(f_news); filter(f_at_least_notice); destination(df_news_dot_notice); }; # *.=debug;\ # auth,authpriv.none;\ # news.none;mail.none -/var/log/debug log { source(s_all); filter(f_debug); destination(df_debug); }; # *.=info;*.=notice;*.=warn;\ # auth,authpriv.none;\ # cron,daemon.none;\ # mail,news.none -/var/log/messages log { source(s_all); filter(f_messages); destination(df_messages); }; # *.emerg * log { source(s_all); filter(f_emerg); destination(du_all); }; # daemon.*;mail.*;\ # news.crit;news.err;news.notice;\ # *.=debug;*.=info;\ # *.=notice;*.=warn |/dev/xconsole log { source(s_all); filter(f_xconsole); destination(dp_xconsole); }; does anybody know why?.... thanx...!!! -- Ciao,Javier linux user #393724

1 0

RE: [syslog-ng] Mark problems
by Frans Stekelenburg 02 Aug '05

02 Aug '05

I think it is (also) something that can be turned on on a SYSLOG client (sending host) with an extra option to the syslog daemon, and in it's local syslog.conf. The fact that you don't have mark in your conf, explains perhaps why it is not filtered out;-) Regards, Frans Some info from our internal KB: Add mark.debug to the syslog.conf # Selector Action Comment mark.debug;*.debug @centrallog # 10.20.30.40 Mark Messages ------------- Make use of mark messages (time stamps). Mark messages can be turned on to make it easier to analyze the timeline of messages and to identify possible gaps within the log archives. Mark messages are generated by syslogd after a predefined time period. Other periods can be specified during the syslogd startup. To activate mark messages, the script file that starts syslogd needs to be to edited. The file "/etc/init.d/syslog" (solaris) must be edited within the "start" section. In the following example, syslogd is called to set a mark interval of 10 minutes, as follows: /usr/sbin/syslog -m 10 1>/dev/console 2>&1 If only -m is stated, the default interval is 20 minutes. > -----Original Message----- > From: Edward Brookhouse [mailto:ebroo@healthydirections.com] > Sent: dinsdag 2 augustus 2005 13:33 > To: 'Syslog-ng users' and developers' mailing list' > Subject: [syslog-ng] Mark problems > > Hi all, > > I am using Syslog-NG 1.9.4 on Fedora Core4 - and I am seeing -- > MARK - in my logs when I should not be. > > To my understanding (via google and man pages) If you put the option * > mark(n) in the options section you will get a -- MARK -- > every N times. > > I have no mark option... > > Any thoughts on how to trouble shoot? > > > My conf file has this for options > > options { > # use_fqdn(yes); > # use_dns(yes); > # dns_cache(yes); > keep_hostname(yes); > long_hostnames(off); > sync(1); > log_fifo_size(1024); > }; > > > A search for mark in the conf returns nada ... > > > TIA > > Edward > Ebrooathealthydirectionsdotcomlame > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

3 2

RE: [syslog-ng] ng to ng then to syslog
by Frans Stekelenburg 02 Aug '05

02 Aug '05

I agree with the previous poster, why indeed use another (lesser) syslog ;-) But if you insist: Try with the 'spoof_source(yes)' as option in your tcp(... <options>). I also learned that localip() can be used to force a certain local ip, but I don't think that applies to your setup. Ref: http://www.balabit.com/products/syslog_ng/reference-2.0/syslog-ng.html/i ndex.html#destinations 'luck! Frans -----Original Message----- From: Gerardo Amaya [mailto:joseg@galileo.edu] Sent: Friday, July 29, 2005 11:10 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] ng to ng then to syslog Hello all. First thanks for all the help on first issue, it was some stupid filter. I'm configured to send syslog messages from server1 to server2 both with syslog-ng. Now what I need is to pass messages from server1 to server2 via syslog-ng(already done that) and as soon as the event gets in syslog-ng of server2 to send it to syslog daemon in server2. I have also done that but the problem is that the events appear as they are coming locally and not from server1. Is there a way to change that? thanks in advance Gerardo Amaya _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3

RE: [syslog-ng] syslog-ng- filter() problem
by Kelly Pow 02 Aug '05

02 Aug '05

Hi, I am collecting traps and syslog data Yes they are being sent to the right place. Yes the destinations exist and the permissions are correct I am running Gentoo And syslog-ng version- 1.6.5-r2 The problem is: log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; if I only have : log { source(src); filter(f_snmptrap); destination(ipbb_traps); }; or log { source(src); filter(f_ipbb1); destination(ipbb_traps); }; but when I add more filters it give me nothing Why? Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca> _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Edward Brookhouse Sent: Friday, July 29, 2005 5:08 AM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] syslog-ng- filter() problem Are you collecting traps or syslog data ? Tcpdump is your friend - are the syslog speakers speaking to the right place ? Is anything else being logged on the box from other sources? Does the destination exist and permissions correct What os ? Which versions of syslog-ng _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Kelly Pow Sent: Thursday, July 28, 2005 5:55 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng- filter() problem Hi, I am trying to collect traps from these two networks. 66.163.79.0/255.255.255.128 and 64.251.65.224/255.255.255.240 I don't understand why when I do this it doesn't collect anything Any ideas/.?? ---------------------------------------------------------------------------- --------------------------- source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #filter snmptrap filter f_snmptrap { level(warn); }; #testing filters for the different networks filter f_ipbb1 {netmask("66.163.79.0/255.255.255.128"); }; filter f_ipbb2 {netmask("64.251.65.224/255.255.255.240"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; ---------------------------------------------------------------------------- ------------------------------- Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca>

1 0

problems with mysql pipe
by javier rojas 02 Aug '05

02 Aug '05

hello, i'm having trouble with the template i created to pipe to mysql (acording to php-syslog-ng), at first it was working fine but then (i started messing around) and it just stop working, i had configure syslog-ng to store logs coming from server A into mysql and on a text file, here's my syslog-ng.conf : ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; ## Log on to text file ## destination hosts { file("/var/log/$HOST.$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log {source(net); destination(hosts); }; #Then comment out this line -- # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; #Then uncomment out this line -- # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. source src { unix-dgram("/dev/log"); internal(); }; source net { udp(); }; it actually worked, but i don't know what i did, i see the logs coming from server A (#tcpdump host server A and port 514) but it doesn't store them on mysql... help please!!! -- Ciao,Javier linux user #393724

1 0

Mark problems
by Edward Brookhouse 02 Aug '05

02 Aug '05

Hi all, I am using Syslog-NG 1.9.4 on Fedora Core4 - and I am seeing -- MARK - in my logs when I should not be. To my understanding (via google and man pages) If you put the option * mark(n) in the options section you will get a -- MARK -- every N times. I have no mark option... Any thoughts on how to trouble shoot? My conf file has this for options options { # use_fqdn(yes); # use_dns(yes); # dns_cache(yes); keep_hostname(yes); long_hostnames(off); sync(1); log_fifo_size(1024); }; A search for mark in the conf returns nada ... TIA Edward Ebrooathealthydirectionsdotcomlame

1 0

ng to ng then to syslog
by Gerardo Amaya 01 Aug '05

01 Aug '05

Hello all. First thanks for all the help on first issue, it was some stupid filter. I'm configured to send syslog messages from server1 to server2 both with syslog-ng. Now what I need is to pass messages from server1 to server2 via syslog-ng(already done that) and as soon as the event gets in syslog-ng of server2 to send it to syslog daemon in server2. I have also done that but the problem is that the events appear as they are coming locally and not from server1. Is there a way to change that? thanks in advance Gerardo Amaya

2 1

Syslog running slow
by Shlomi Wexler 01 Aug '05

01 Aug '05

Hi, I'm using Syslong-ng with Postgre SQL Database. I have a problem of queries running realy slow since the Database reached about 5 million records. Cleaning the DB and vacumdb didn't work and also other programs running on the same computer are running fine. I'm using Gentoo Linux. Does anyone have an idea ? Thanks Shlomi _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

syslo-ng to mysql and to plaintext file
by javier rojas 01 Aug '05

01 Aug '05

hello, i've configure successfuly the syslog-ng server to save logs on mysql 4.0and i would like it to store the logs (just for a test) on a text file ( example.txt), so i was searching aroun and found that i should add the followin line to syslog-ng.conf: destination file_text{ file("/var/log/example.txt"); }; i don't want to mess anything and i was wondering if it's ok or if anybody has set this before, i don't want it to stop saving it on mysql i just want syslog-ng to save in both (mysql and example.txt) at the same time... thanx for the help... -- Ciao,Javier linux user #393724

3 2

Strange behaviour, Cisco, UDP & $HOST
by Jussi Tawaststjerna 01 Aug '05

01 Aug '05

Hello, Did a quick glance on the archives but didn't find an answer to this one, spent a good time googling too. Hopefully someone can help. I'm trying to build a central loghost with syslog-ng 1.9.5, for use with linux servers and cisco routers, and ran into a nice li'l problem. First some configuration: --8<-- options { chain_hostnames(no); long_hostnames(on); sync(0); keep_hostname(yes); dns_cache(yes); use_fqdn(yes); use_dns(yes); log_fifo_size(2048); log_msg_size(8192); }; source local { unix-stream("/dev/log"); internal(); }; source network { udp(ip("x.x.x.x") port(514)); }; (x.x.x.x is the interface machines are configured to use) destination hosts { file("/var/log/$HOST/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; .. .. log { source(network); destination(hosts); }; --8<-- It "works". I have two machines set up to send logs to this host, my own machine domain.org and a cisco device ciscorouter.net. When I do something on my machine to generate log, directory /var/log/domain.org is created and files appear in it, by facility. Sweet. domain.org resolves into an IP and the IP PTR is domain.org .. ciscorouter.net resolves into IP and IP PTR is ciscorouter.net .. OKAY, heart of the problem: Now I go to a Cisco device (7200 series) which is configured to send local3 to loghost, is working already with another sysklogd-host. I issue "conf t", ctrl-z and "wri", and the router sends a line to loghost, and loghost should create /var/log/<routers fqdn> and a file named local3 inside, right? Nope. The directory does not appear. No logfile is created or appended anywhere within loghost. Then I go to domain.org, exit from su and su back in again (generate a line of log) .. Now I see a new file on loghost, /var/log/domain.org/local3 .. and on one single line with no CR/LF it reads: Aug 1 11:23:53 domain.org/domain.org 915: *Aug 1 10:17:16.613: %SYS-5-CONFIG_I: Configured from console by user on vty0 (x.x.x.x)<86>su[2896]: + pts/23 user:root For the people not familiar with Cisco log entries, everything before <86> came from the Cisco, and starting from "su" is my domain.org linux. domain.org doesn't log anything using local3, this file shouldn't even exist. Can someone please immediately see what's wrong here, and what to put in syslog-ng.conf? Thank you very much. --- Jussi Tawaststjerna Nebula Oy ---

2 2

problem receiving non-NULL terminated UDP messages
by e09f6a7593f8ae3994ea57e1117f67ec 30 Jul '05

30 Jul '05

Hi, I have the same problem as someone 2 years ago (https://lists.balabit.hu/pipermail/syslog-ng/2003-September/005414.html) with UDP messages. Problem: My OpenWRT based wifi router messages are not recognized and written to file via syslog-ng-1.9.5. The configuration file constsits of single udp() source and destination to single file. Symptoms: I am running `./syslog-ng -F -v -d -e` and after receiving an UDP log message I get a log_reader_fd_prepare(); messages in console window, so that means that the packet has arrived. (also checked with tcpdump for that). Despite packet arrival nothing is written to log file. The udp message does not end with NULL character as expected in logreader.c/log_reader_iterate_buf() function. I scanned the RFC for that but there is not defined that the message must terminate with a NULL character. Workaround: (needs testing for side-efects) Replace in afsocket.c:425 line with self->reader = log_reader_new(... (self->flags & AFSOCKET_LOCAL) ? LR_LOCAL|LR_PKTTERM : LR_PKTTERM,...); (Insert fixed LR_PKTTERM flag) Debugging process and toughts: After a while debugging with gdb I noticed that logreader.c/log_reader_iterate_buf() does not recognise the incoming message because it is not terminated by a NULL or NL character. I noticed that there exists a flag LR_PKTTERM which is supposed to be used in UDP sources so I went after LR_PKTTERM flag. The only place that flag is set is in afsocket.c/afsocket_sc_init() function and only if socket is a DGRAM type. If you trace back you see that afsocket_sc_init() is used from afsocket_sc_new() which is used from afsocket_sd_process_connection() which is used from afsocket_sd_accept() which is used from afsocket_sd_init(). Let's stop now at afsocket_sd_init() function: If you look carefully you can notice that afsocket_sd_accept() function is used as callback _only_ if used in STREAM sockets and not DGRAM! For DGRAM sockets the reader is creaded by log_reader_new() and with flags set as `(self->flags & AFSOCKET_LOCAL) ? LR_LOCAL : 0`. That means that log_reader_iterate_buf() does not have LR_PKTTERM flag set and thus not extracting UDP message from my router. As I can see afsocket.c/afsocket_sc_init() function is not used by DGRAM connections at all thus LR_PKTTERM is never set. Thanks for patience :) Pinky

2 3

compiling on Redhat Linux ES 4 with Solaris support
by Jeff Wilson 29 Jul '05

29 Jul '05

Ok I can compile and configure syslog-ng with out Solaris support but when I add --enable-sun-streams to the configure command and then run make I get an error. I have searched every where I can for an answer but can not find one. Any help would be appreciated. here is the out put. [syslog-ng-1.6.8]# make Making all in src make[1]: Entering directory `/root/jeff/syslog-ng-1.6.8/src' make all-recursive make[2]: Entering directory `/root/jeff/syslog-ng-1.6.8/src' Making all in . make[3]: Entering directory `/root/jeff/syslog-ng-1.6.8/src' if gcc -DHAVE_CONFIG_H -I. -I/root/jeff/syslog-ng-1.6.8/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -MT afstreams.o -MD -MP -MF ".deps/afstreams.Tpo" \ -c -o afstreams.o `test -f 'afstreams.c' || echo '/root/jeff/syslog-ng-1.6.8/src/'`afstreams.c; \ then mv -f ".deps/afstreams.Tpo" ".deps/afstreams.Po"; \ else rm -f ".deps/afstreams.Tpo"; exit 1; \ fi afstreams.c:38:24: sys/strlog.h: No such file or directory afstreams.c: In function `do_stream_read': afstreams.c:95: error: storage size of 'lc' isn't known afstreams.c:95: warning: unused variable `lc' afstreams.c: In function `do_init_afstreams_source': afstreams.c:238: error: `I_CONSLOG' undeclared (first use in this function) afstreams.c:238: error: (Each undeclared identifier is reported only once afstreams.c:238: error: for each function it appears in.) make[3]: *** [afstreams.o] Error 1 make[3]: Leaving directory `/root/jeff/syslog-ng-1.6.8/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/jeff/syslog-ng-1.6.8/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/root/jeff/syslog-ng-1.6.8/src'

2 2

syslog-ng- filter() problem
by Kelly Pow 29 Jul '05

29 Jul '05

Hi, I am trying to collect traps from these two networks. 66.163.79.0/255.255.255.128 and 64.251.65.224/255.255.255.240 I don't understand why when I do this it doesn't collect anything Any ideas/.?? ---------------------------------------------------------------------------- --------------------------- source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #filter snmptrap filter f_snmptrap { level(warn); }; #testing filters for the different networks filter f_ipbb1 {netmask("66.163.79.0/255.255.255.128"); }; filter f_ipbb2 {netmask("64.251.65.224/255.255.255.240"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; ---------------------------------------------------------------------------- ------------------------------- Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca>

3 2

syslog-ng fails to bind socket
by javier rojas 29 Jul '05

29 Jul '05

hello, im configuring syslog-ng to log on central logserver, however, when trying to start the server i get this error: jrojas:/etc/syslog-ng# /etc/init.d/syslog-ng start # Start syslog-ng CONSOLE_LOG_LEVEL is of unaccepted value. KERNEL_RINGBUF_SIZE is of unaccepted value. Starting system logging: syslog-ngio.c: bind_unix_socket(): bind failed /etc/log/log (No such file or directory) Error initializing configuration, exiting. start failed. can anyone help me out here... do i have to add the ip entry on /etc/hosts on the server side?, i allowed the entry on the client side... i'm all lost here... -- Ciao,Javier linux user #393724

2 1

syslog-ng to syslog not working
by Gerardo Amaya 29 Jul '05

29 Jul '05

Hello all. I have a syslog-ng server and I want to forward some messages to a Syslogd Server. I don't want stunnel or anything special, just send syslog-ng messages via udp(514), but right now I get the following error: Jul 22 20:10:06 s_localhost@RHTSRV syslog-ng[31406]: io.c: do_write: write() fai led (errno 111), Connection refused Jul 22 20:10:06 s_localhost@RHTSRV syslog-ng[31406]: Connection broken to AF_INE T(192.168.4.252:514), reopening in 60 seconds Jul 22 20:11:07 s_localhost@RHTSRV syslog-ng[31406]: io.c: do_write: write() fai led (errno 111), Connection refused Jul 22 20:11:07 s_localhost@RHTSRV syslog-ng[31406]: Connection broken to AF_INE T(192.168.4.252:514), reopening in 60 seconds Jul 22 20:12:07 s_localhost@RHTSRV syslog-ng[31406]: io.c: do_write: write() fai led (errno 111), Connection refused Jul 22 20:12:07 s_localhost@RHTSRV syslog-ng[31406]: Connection broken to AF_INE T(192.168.4.252:514), reopening in 60 seconds This is the definition in my syslog-ng.conf file source s_localhost { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination d_TestServer { udp ("192.168.4.252" port(514)); }; log { source(s_localhost); destination(d_localhost); destination(d_TestServer); }; Can someone help me to find the source of the problem? Thanks in advance Gerardo Amaya

3 3

syslog-ng not logging in mysql
by javier rojas 28 Jul '05

28 Jul '05

hello, i created the pipe file on /tmp (/tmp/mysql.pipe) but it doesn't write the logs into the mysql db, here's the extract from the syslog-ng.conf file: destination d_mysql {pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(20)); }; log { source(net); destination(d_mysql); }; it just doesn't work and i've followed the steps from the documentation on www.vermeer.org... so if anybody can help me... -- Ciao,Javier linux user #393724

1 0

[PATCH] [1.9.5] address flex warning and suboptimal distclean target
by Roberto Nibali 28 Jul '05

28 Jul '05

Hello, The attached patch fixes following two things: 1. #define YY_NO_UNPUT 1 is an undocumented feature of flex and has been obsoleted in recent flex versions. So this is a void operation. The correct way of dealing with the compiler warning is to add %option nounput as flex directive. 2. cfg-lex.c is autogenerated during the make compile process. However it is never removed, especially not for the distclean target. IMHO this is not so clean, so I've added cfg-lex.c to the list of the to-be-removed files. Please consider applying. Cheers, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc

2 1

ipv6 support
by Conor Svensson 28 Jul '05

28 Jul '05

What's the status of ipv6 support for syslog-ng, as far as I could tell from the doco, support does not currently exist & is not planned in the near future? I would be very grateful for any info on this. Many thanks, Conor ______________________________________________________ In the Invesment Research business? Want to improve your client offering? Production costs getting out of control? Agile Research is the answer. http://www.evolution.net/propositions/agile/index.html ______________________________________________________ Evolution is the investment banking and venture capital industry's first choice for practical advice on strategy, business process and the application of advanced technology. Evolution Tel: +44 (0) 20 7664 6640 Peninsular House Fax: +44 (0) 20 7664 6641 30-36 Monument Street London EC3R 8LJ URL: http://www.evolution.net United Kingdom ______________________________________________________ The information in this Internet e-mail is confidential and is intended solely for the addressee. Access, copying or re-use of information in it by anyone else is unauthorised. Any views or opinions presented are solely those of the author and do not necessarily represent those of Evolution or any of its affiliates. If you are not the intended recipient please contact Evolution, London, +44 (0) 20 7664 6640 _____________________________________________________

2 1

syslog starting trouble
by javier rojas 27 Jul '05

27 Jul '05

hello, i just installed syslog-ng in my debian box, but i can't seem to be able to start it, each time i get the same error: jrojas:/etc/init.d# /etc/init.d/syslog-ng stop # Stop syslog-ng CONSOLE_LOG_LEVEL is of unaccepted value. KERNEL_RINGBUF_SIZE is of unaccepted value. Stopping system logging: syslog-ng not running. does anybody knows why i-m getting this error? or even better..... does anybody knows how to fix it? i got nothing from google..... -- Ciao,Javier

2 1

Duplicate Messages in line.
by Ricardo A Reis 27 Jul '05

27 Jul '05

Hi all, I've a problem with squid and loghost saw tail |logger , apparently i have duplicate entry in the same line. Log output, -------------------- 11:42:46 arapacu.epm.br [user.notice] squid_access: 1122475366.008 220 172.16.160.185 TCP_MISS/200 437 GET http://kh.google.com/flatfile? - DIRECT/216.239.39.93 application/octet-stream squid_access: 1122475366.008 220 172.16.160.185 TCP_MISS/200 437 GET http://kh.google.com/flatfile? - DIRECT/216.239.39.93 application/octet-stream -------------------- syslog-ng resume, -------------------------------------------------------- options { sync(0); use_fqdn(yes); keep_hostname(yes); chain_hostnames(no); long_hostnames(no); create_dirs(yes); group(syslog); dir_group(syslog); perm(0640); dir_perm(0750); stats(3600); time_reopen(10); log_msg_size(10240); log_fifo_size(4096); dns_cache(yes); use_dns(yes); stats (3600); mark (600); bad_hostname("gconfd"); }; source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; source s_stunnel { tcp(ip("127.0.0.1") port(514) keep-alive(yes) max-connections(300)); }; source s_udp { udp(); }; destination r_squida { file ("/syslog/clients/$HOST/squid_access/$YEAR.$MONTH.$DAY" template("$HOUR:$MIN:$SEC $HOST [$FACILITY.$PRIORITY] $MSG $MSG\n") template_escape(no)); }; filter f_squida { match ("squid_access"); }; log { source(src); source(s_udp); source(s_stunnel); filter(f_squida); destination(r_squida); flags(final); }; Thanks for Advanced, Atenciosamente Ricardo A. Reis UNIFESP - SENAI

1 0

configuration of syslog-ng.conf
by javier rojas 27 Jul '05

27 Jul '05

hello, is there a manual or a guide on how to configure syslog-ng.conf file?, i'm having some big trouble starting the server and i guess it's because missconfiguration on the conf file... thanx...! -- Ciao,Javier linux user #393724

1 0

RE: [syslog-ng] syslog starting trouble
by Kelly Pow 26 Jul '05

26 Jul '05

Hi, Can you send you syslog.conf file please? I am suspecting that " CONSOLE_LOG_LEVEL is of unaccepted value" is not valid. The levels are: Ie level (): Debug Info Notice Warning Err Crit Alert Emerg Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of javier rojas Sent: Tuesday, July 26, 2005 12:48 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog starting trouble hello, i just installed syslog-ng in my debian box, but i can't seem to be able to start it, each time i get the same error: jrojas:/etc/init.d# /etc/init.d/syslog-ng stop # Stop syslog-ng CONSOLE_LOG_LEVEL is of unaccepted value. KERNEL_RINGBUF_SIZE is of unaccepted value. Stopping system logging: syslog-ng not running. does anybody knows why i-m getting this error? or even better..... does anybody knows how to fix it? i got nothing from google..... -- Ciao,Javier _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

syslog-ng and netfilter() problem
by Kelly Pow 26 Jul '05

26 Jul '05

Hi, . I am trying to use syslog-ng to collect syslogs from routers, but I would like the logs from the same network to be logged in one file IE: all logs from 66.163.79.0/25 and 64.251.65.224/28 --> to be stored in /ipbb All logs from 204.209.214.0/23 --> to be stored in /ipbb_lab How can I do this using syslog-ng? How do I log IP addresses of the same network into the same file? There is a filter in syslog-ng called netmask() --it checks the sender's IP address to see whether it is in the specified IP subnet Syntax: netmask(ip/mask) So I created a filter see below: filter f_ipbb { netmask("66.163.79.0/25"); }; So my logic on this was If the syslog is from an IP address in this network/subnet then it should get logged to where I specified it to.... Unfortunately: As seen below I got syslogs from the following IP addresses: root@K3 store # ls 64.251.65.229 66.163.79.2 66.163.79.37 66.163.79.42 But the file only logged one syslog : root@K3 test # cat syslogs/2005-07-25 Jul 25 13:37:52 66.163.79.2/66.163.79.2 34118: Jul 25 13:38:15.053 MDT: %BGP-4-MAXPFX: No. of prefix received from 206.223.116.11 (afi 0) reaches 5893, max 7000 Do you have any idea why? As seen below, I have tried: filter f_test { netmask("66.163.79.0/255.255.255.128"); }; <-- gives no results filter f_ipbb { netmask("66.163.79.0/25"); };<-- only give syslogs from 66.163.79.2 Any thing that I might be doing wrong that I can't see? Is there a bug with syslog-ng? Thank you very much Kelly :-) Below is my syslog-ng.conf file: Syslog-ng/conf file: ******************************************************************** options { long_hostnames(yes); keep_hostname(yes); use_fqdn(on); create_dirs(yes); owner(nmadmin); group(users); perm(0755); dir_owner(nmadmin); dir_group(users); dir_perm(0755); sync(0); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #filter for ipbb filter f_ipbb { netmask("66.163.79.0/25"); }; filter f_ipbb2 { netmask("64.251.65.224/28"); }; #test configuration for loggin cisco devices source net { udp(); }; destination ipbb_lab_syslogs { file("/store/ipbb_lab/syslogs/$YEAR-$MONTH-$DAY"); }; destination ipbb_syslogs { file("/store/test/syslogs/$YEAR-$MONTH-$DAY"); }; destination all { file("/store/$HOST"); }; log { source(net); destination(all); }; log { source(net); filter(f_ipbb); destination(ipbb_syslogs); }; <-- only collects syslogs from 66.163.79.2 log { source(net); destination(ipbb_lab_syslogs); }; #testing for stripping filter f_test { netmask("66.163.79.0/255.255.255.128"); }; destination d_test { file("/store/test1"); }; log { source(src);filter(f_test); destination(d_test); }; <--Gives no results #for SNMPTRAP destination ipbb_lab_traps { file("/store/ipbb_lab/traps/$YEAR-$MONTH-$DAY"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; #filter snmptrap filter f_snmptrap { level(warn); }; log { source(src); filter (f_snmptrap); destination(ipbb_lab_traps); }; <-- In test Mode- Traps also needs to be filtered to be stored in their network file log { source(src); filter (f_snmptrap); filter(f_ipbb); filter(f_ipbb2); destination(ipbb_traps); }; **************************************************************************** **************************************************************************** ******************************** Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca>

1 0

Sending Net-SNMP Traps w/ syslog-ng (revisited)
by Brian A. Seklecki 25 Jul '05

25 Jul '05

I want syslog-ng to call snmptrap on certain filter conditions, such as auth.warn or kern.crit, etc. I can handle the syslog-ng syntax, it's the program() arguments. See: https://lists.balabit.hu/pipermail/syslog-ng/2003-September/005432.html There hasn't been much discussion on either list since this post. 1) What are good values for "[OID TYPE VALUE]" as arguments to snmptrap(1) (either called from sendtrap.sh or directly from syslog-ng) 2) Perhaps there's a more logical way to investigate this? Using snmpwalk(1) for example? TIA || l8* -lava x.25 - minix - bitnet - plan9 - 110 bps - ASR 33 - base8

1 0