- syslog-ng - lists.balabit.hu

libol compile error in Solaris 10 Intel
by nawirb 21 Jul '05

21 Jul '05

I am sorry, It's working after I put /usr/ccs/bin in PATH thank you __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

libol compile error in Solaris 10 Intel
by nawirb 21 Jul '05

21 Jul '05

Dear expert, I got error during make command when compiling libol 0.3.16 in sol10 x86. I am using gcc 3.36 from sunfreeware Any idea how to solve the problem # crle /lib:/usr/lib:/usr/sfw/lib:/usr/sfw/lib/amd64:/usr/local/lib # cat /.profile PATH=/usr/local/bin:/usr/local/sbin:/bin:/sbin:/usr/bin:/usr/sbin;export PATH # pkginfo|grep SMC SMCautoc SMCautom SMCdb SMCexpat SMCflex SMCgcc336 SMCgd SMCgdbm SMCglib SMCiconv SMClibt SMClpng SMCm4 SMCmake SMCzlib bash-3.00# make Making all in utils make[1]: Entering directory `/export/home/nawir/libol-0.3.16/utils' sed -e "s,_SCSH_,/usr/bin/scsh," make_class.in >make_class chmod +x make_class make[1]: Leaving directory `/export/home/nawir/libol-0.3.16/utils' Making all in src make[1]: Entering directory `/export/home/nawir/libol-0.3.16/src' make all-am make[2]: Entering directory `/export/home/nawir/libol-0.3.16/src' if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT format.lo -MD -MP -MF ".deps/format.Tpo" \ -c -o format.lo `test -f 'format.c' || echo '/export/home/nawir/libol-0.3.16/src/'`format.c; \ then mv -f ".deps/format.Tpo" ".deps/format.Plo"; \ else rm -f ".deps/format.Tpo"; exit 1; \ fi mkdir .libs gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT format.lo -MD -MP -MF .deps/format.Tpo -c format.c -fPIC -DPIC -o .libs/format.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT format.lo -MD -MP -MF .deps/format.Tpo -c format.c -o format.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT io.lo -MD -MP -MF ".deps/io.Tpo" \ -c -o io.lo `test -f 'io.c' || echo '/export/home/nawir/libol-0.3.16/src/'`io.c; \ then mv -f ".deps/io.Tpo" ".deps/io.Plo"; \ else rm -f ".deps/io.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT io.lo -MD -MP -MF .deps/io.Tpo -c io.c -fPIC -DPIC -o .libs/io.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT io.lo -MD -MP -MF .deps/io.Tpo -c io.c -o io.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT werror.lo -MD -MP -MF ".deps/werror.Tpo" \ -c -o werror.lo `test -f 'werror.c' || echo '/export/home/nawir/libol-0.3.16/src/'`werror.c; \ then mv -f ".deps/werror.Tpo" ".deps/werror.Plo"; \ else rm -f ".deps/werror.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT werror.lo -MD -MP -MF .deps/werror.Tpo -c werror.c -fPIC -DPIC -o .libs/werror.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT werror.lo -MD -MP -MF .deps/werror.Tpo -c werror.c -o werror.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT queue.lo -MD -MP -MF ".deps/queue.Tpo" \ -c -o queue.lo `test -f 'queue.c' || echo '/export/home/nawir/libol-0.3.16/src/'`queue.c; \ then mv -f ".deps/queue.Tpo" ".deps/queue.Plo"; \ else rm -f ".deps/queue.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT queue.lo -MD -MP -MF .deps/queue.Tpo -c queue.c -fPIC -DPIC -o .libs/queue.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT queue.lo -MD -MP -MF .deps/queue.Tpo -c queue.c -o queue.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT abstract_io.lo -MD -MP -MF ".deps/abstract_io.Tpo" \ -c -o abstract_io.lo `test -f 'abstract_io.c' || echo '/export/home/nawir/libol-0.3.16/src/'`abstract_io.c; \ then mv -f ".deps/abstract_io.Tpo" ".deps/abstract_io.Plo"; \ else rm -f ".deps/abstract_io.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT abstract_io.lo -MD -MP -MF .deps/abstract_io.Tpo -c abstract_io.c -fPIC -DPIC -o .libs/abstract_io.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT abstract_io.lo -MD -MP -MF .deps/abstract_io.Tpo -c abstract_io.c -o abstract_io.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT gc.lo -MD -MP -MF ".deps/gc.Tpo" \ -c -o gc.lo `test -f 'gc.c' || echo '/export/home/nawir/libol-0.3.16/src/'`gc.c; \ then mv -f ".deps/gc.Tpo" ".deps/gc.Plo"; \ else rm -f ".deps/gc.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT gc.lo -MD -MP -MF .deps/gc.Tpo -c gc.c -fPIC -DPIC -o .libs/gc.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT gc.lo -MD -MP -MF .deps/gc.Tpo -c gc.c -o gc.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT list.lo -MD -MP -MF ".deps/list.Tpo" \ -c -o list.lo `test -f 'list.c' || echo '/export/home/nawir/libol-0.3.16/src/'`list.c; \ then mv -f ".deps/list.Tpo" ".deps/list.Plo"; \ else rm -f ".deps/list.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT list.lo -MD -MP -MF .deps/list.Tpo -c list.c -fPIC -DPIC -o .libs/list.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT list.lo -MD -MP -MF .deps/list.Tpo -c list.c -o list.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT read_line.lo -MD -MP -MF ".deps/read_line.Tpo" \ -c -o read_line.lo `test -f 'read_line.c' || echo '/export/home/nawir/libol-0.3.16/src/'`read_line.c; \ then mv -f ".deps/read_line.Tpo" ".deps/read_line.Plo"; \ else rm -f ".deps/read_line.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT read_line.lo -MD -MP -MF .deps/read_line.Tpo -c read_line.c -fPIC -DPIC -o .libs/read_line.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT read_line.lo -MD -MP -MF .deps/read_line.Tpo -c read_line.c -o read_line.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT xalloc.lo -MD -MP -MF ".deps/xalloc.Tpo" \ -c -o xalloc.lo `test -f 'xalloc.c' || echo '/export/home/nawir/libol-0.3.16/src/'`xalloc.c; \ then mv -f ".deps/xalloc.Tpo" ".deps/xalloc.Plo"; \ else rm -f ".deps/xalloc.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT xalloc.lo -MD -MP -MF .deps/xalloc.Tpo -c xalloc.c -fPIC -DPIC -o .libs/xalloc.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT xalloc.lo -MD -MP -MF .deps/xalloc.Tpo -c xalloc.c -o xalloc.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT alist.lo -MD -MP -MF ".deps/alist.Tpo" \ -c -o alist.lo `test -f 'alist.c' || echo '/export/home/nawir/libol-0.3.16/src/'`alist.c; \ then mv -f ".deps/alist.Tpo" ".deps/alist.Plo"; \ else rm -f ".deps/alist.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT alist.lo -MD -MP -MF .deps/alist.Tpo -c alist.c -fPIC -DPIC -o .libs/alist.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT alist.lo -MD -MP -MF .deps/alist.Tpo -c alist.c -o alist.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT stream_buffer.lo -MD -MP -MF ".deps/stream_buffer.Tpo" \ -c -o stream_buffer.lo `test -f 'stream_buffer.c' || echo '/export/home/nawir/libol-0.3.16/src/'`stream_buffer.c; \ then mv -f ".deps/stream_buffer.Tpo" ".deps/stream_buffer.Plo"; \ else rm -f ".deps/stream_buffer.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT stream_buffer.lo -MD -MP -MF .deps/stream_buffer.Tpo -c stream_buffer.c -fPIC -DPIC -o .libs/stream_buffer.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT stream_buffer.lo -MD -MP -MF .deps/stream_buffer.Tpo -c stream_buffer.c -o stream_buffer.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT pkt_buffer.lo -MD -MP -MF ".deps/pkt_buffer.Tpo" \ -c -o pkt_buffer.lo `test -f 'pkt_buffer.c' || echo '/export/home/nawir/libol-0.3.16/src/'`pkt_buffer.c; \ then mv -f ".deps/pkt_buffer.Tpo" ".deps/pkt_buffer.Plo"; \ else rm -f ".deps/pkt_buffer.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT pkt_buffer.lo -MD -MP -MF .deps/pkt_buffer.Tpo -c pkt_buffer.c -fPIC -DPIC -o .libs/pkt_buffer.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT pkt_buffer.lo -MD -MP -MF .deps/pkt_buffer.Tpo -c pkt_buffer.c -o pkt_buffer.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT resource.lo -MD -MP -MF ".deps/resource.Tpo" \ -c -o resource.lo `test -f 'resource.c' || echo '/export/home/nawir/libol-0.3.16/src/'`resource.c; \ then mv -f ".deps/resource.Tpo" ".deps/resource.Plo"; \ else rm -f ".deps/resource.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT resource.lo -MD -MP -MF .deps/resource.Tpo -c resource.c -fPIC -DPIC -o .libs/resource.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT resource.lo -MD -MP -MF .deps/resource.Tpo -c resource.c -o resource.o >/dev/null 2>&1 /bin/bash ../libtool --mode=link gcc -Wall -g -o libol.la -rpath /usr/local/lib format.lo io.lo werror.lo queue.lo abstract_io.lo gc.lo list.lo read_line.lo xalloc.lo alist.lo stream_buffer.lo pkt_buffer.lo resource.lo -lsocket -lnsl -lxnet gcc -shared -Wl,-h -Wl,libol.so.0 -o .libs/libol.so.0.0.0 .libs/format.o .libs/io.o .libs/werror.o .libs/queue.o .libs/abstract_io.o .libs/gc.o .libs/list.o .libs/read_line.o .libs/xalloc.o .libs/alist.o .libs/stream_buffer.o .libs/pkt_buffer.o .libs/resource.o -lsocket -lnsl -lxnet -lc (cd .libs && rm -f libol.so.0 && ln -s libol.so.0.0.0 libol.so.0) (cd .libs && rm -f libol.so && ln -s libol.so.0.0.0 libol.so) false cru .libs/libol.a format.o io.o werror.o queue.o abstract_io.o gc.o list.o read_line.o xalloc.o alist.o stream_buffer.o pkt_buffer.o resource.o make[2]: *** [libol.la] Error 1 make[2]: Leaving directory `/export/home/nawir/libol-0.3.16/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/export/home/nawir/libol-0.3.16/src' make: *** [all-recursive] Error 1 __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

syslog-ng and host() filters regex problem
by syslog-ng 19 Jul '05

19 Jul '05

hello, I have a problem with syslog-ng and host() filters regex. I need to sort out logs coming from different source addresses in various files, so I started with this configuration: filter f_cp_ { host("10.28.88.4"); }; [10 similar host filters] filter f_pix_1 { host("10.29.42.3"); }; for every filter I defined a file destination and a log statement like this one: log { source(s_udp); filter(f_pix_1); destination(nfs_pix_1); }; This configuration works as expected, but since logs might come from other IP addresses which don't have to get mixed up (eg 10.28.88.41 matches the first filter but shouldn't) I'd like to use a regexp in the host file; I tried just by adding a $ at the end of the IP, like this: filter f_cp_dl380 { host("10.28.88.4$"); }; [10 similar host filters] filter f_pix_1VF { host("10.29.42.3$"); }; After sending a HUP to the process syslog-ng stops writing input packets to the various log files. Just removing the $ after the ip address and sending another HUP to the server restores functionality. I also tried with a full IP regexp, as found in another post on the list (host("^10\.28\.88\.4$")) but the result is the same. I also tried upgrading my syslog-ng from 1.6.2 to 1.6.8 but nothing changed. It seems like the config parser is somehow unable to manage more than a handful of host regexps correctly. I can provide full configuration files if needed. thanks for the help, Stefania

2 1

RE: [syslog-ng] syslog-ng and host() filters regex problem
by Michael Di Martino 18 Jul '05

18 Jul '05

Si -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng Sent: Monday, July 18, 2005 5:23 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng and host() filters regex problem hello, I have a problem with syslog-ng and host() filters regex. I need to sort out logs coming from different source addresses in various files, so I started with this configuration: filter f_cp_ { host("10.28.88.4"); }; [10 similar host filters] filter f_pix_1 { host("10.29.42.3"); }; for every filter I defined a file destination and a log statement like this one: log { source(s_udp); filter(f_pix_1); destination(nfs_pix_1); }; This configuration works as expected, but since logs might come from other IP addresses which don't have to get mixed up (eg 10.28.88.41 matches the first filter but shouldn't) I'd like to use a regexp in the host file; I tried just by adding a $ at the end of the IP, like this: filter f_cp_dl380 { host("10.28.88.4$"); }; [10 similar host filters] filter f_pix_1VF { host("10.29.42.3$"); }; After sending a HUP to the process syslog-ng stops writing input packets to the various log files. Just removing the $ after the ip address and sending another HUP to the server restores functionality. I also tried with a full IP regexp, as found in another post on the list (host("^10\.28\.88\.4$")) but the result is the same. I also tried upgrading my syslog-ng from 1.6.2 to 1.6.8 but nothing changed. It seems like the config parser is somehow unable to manage more than a handful of host regexps correctly. I can provide full configuration files if needed. thanks for the help, Stefania _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng filtering db inserts
by Edward Brookhouse 18 Jul '05

18 Jul '05

Hi all - Anyone know how to setup the syslog-ng conf file so that certain events can be filtered from being inserted into the db ? i.e. I am setup now with various log { source(src); filter(f_mail); destination(mailwarn); }; type rules - this works great - I can filter any log message into any folder - Later in my conf I have: log { source(src); destination(d_mysql); }; Which tosses everything into the db - but how do I tell it to take everything except for given filters? Any thoughts appreciated, Edward

1 0

install syslog-ng in Solaris 10 local zone
by nawirb 18 Jul '05

18 Jul '05

Hi expert, I have some question regarding install sylog-ng in Solaris 10 local zone. Will it work. Anyone have ever tried. thanks __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Putting all sending Hosts in a File
by Philipp Durrer 18 Jul '05

18 Jul '05

Thanks for the workaround for putting the hosts in a File. Now the Second thing i would to capture all networks which sending their logs to the syslog server. So i would to lookup the Networkid and netmask (subnetmask) of the sending host. And they should again logged into a file. greets Philipp Durrer (PS: Sorry for my bad english) ___________________________________________________________ Gesendet von Yahoo! Mail - Jetzt mit 1GB Speicher kostenlos - Hier anmelden: http://mail.yahoo.de

1 0

Problem with hostnames!
by mrgenius 16 Jul '05

16 Jul '05

Hi All! I am using Syslog-ng with php-syslog-ng. to give names of my choice to different hosts IP what i did was to define hostnames against each IP of host in /etc/hosts file. It was working fine with Public IP adresses.. But I have some hosts on local network too with 192.168 IPs . The pRoblem i am now facing is that its not storing logs with HOSTNAMES of private IPs. Where as its working fine and giving names of Public IPs. Any body has any idea?? any thing to do in configuration of syslog-ng?? Regards, -Geni

7 11

netmask() filter
by Al Tobey 14 Jul '05

14 Jul '05

I'm trying to use the netmask filter to create a separate logfile for all of our network devices (Cisco gear) logging to our central syslog-ng log sink. The interfaces doing the syslogging are all on specific subnets, so I'd like to filter on subnet rather than by hosts. Lo, and behold, syslog-ng has a netmask() filter. It doesn't appear to work, though, since none of the variations I've tried have managed to log anything near the correct data to the destination. I either get nothing or everything. For one thing, it'd be nice to see the documentation updated to specify whether to use cidr or dot notation (/24 v.s. 255.255.255.0). Using cidr notation resulted in no apparent filtering. Using dot notation caused nothing to land in the file. Is anybody else using this successfully that can share a working example? Am I missing something silly? syslog-ng version 1.6.8, libol 0.3.16 on RHEL 3 U4 Thanks, -Al Tobey options { sync (20); time_reopen (10); log_fifo_size (1000); log_msg_size(8192); long_hostnames (off); use_dns (yes); use_fqdn (no); use_time_recvd (no); create_dirs (no); keep_hostname (yes); dns_cache (yes); dns_cache_expire (6000); dns_cache_expire_failed (6000); dns_cache_size (128); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream("/dev/log"); internal(); }; source s_net { udp(); tcp(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/syslog/syslog.log" perm(0644)); }; destination d_warn { file("/var/log/syslog/syslog.warn" perm(0644)); }; destination d_mail { file("/var/log/syslog/mail.log" perm(0644)); }; destination d_auth { file("/var/log/syslog/auth.log"perm(0644)); }; destination d_netteam { file("/var/log/network-devices.log" perm(0644)); }; destination d_local { file("/var/log/messages" perm(0644)); }; destination logsurfer { program("/bin/su -s /bin/ksh syslogd -c '/usr/local/bin/logsurfer -c /usr/local/etc/logsurfer.conf -d /var/tmp/logsurfer.dump -'"); }; filter f_console { facility(kern); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_warn { level(warn..emerg) and not ( program("sshd") and match("we do not read, but chan_read_failed for istate 8") ) and not ( program("sshd") and match("Read from socket failed: Connection reset by peer") ); }; ######################################## filter f_netteam { netmask( "10.50.191.0/255.255.255.0" ); }; ######################################## # console messages on localhost log { source(s_sys); filter(f_console); destination(d_cons); }; # /var/log/messages log { source(s_sys); destination(d_local); }; # /var/log/syslog/syslog.log log { source(s_sys); source(s_net); destination(d_mesg); }; # /var/log/netowrk-devices.log log { source(s_net); filter(f_netteam); destination(d_netteam); }; # /var/log/syslog/auth.log log { source(s_sys); source(s_net); filter(f_auth); destination(d_auth); }; # /var/log/syslog/mail.log log { source(s_sys); source(s_net); filter(f_mail); destination(d_mail); }; # /var/log/syslog/syslog.warn log { source(s_sys); source(s_net); filter(f_warn); destination(d_warn); };

2 1

Re: [syslog-ng] HP-UX
by Michael Di Martino 13 Jul '05

13 Jul '05

Kkgk Regards, Michael Di Martino Director of MIS The telx Group Office: 212 480 3300 X.2022 Cell: 646 207 6603 mdm(a)telx.com -------------------------- Sent from my BlackBerry Wireless Handheld -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu <syslog-ng-bounces(a)lists.balabit.hu> To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Sent: Mon Jul 11 09:24:46 2005 Subject: RE: [syslog-ng] HP-UX Alessandro, I currently have version 1.6.6 running on multiple HP-UX 11i machines. I have not, however, attempted to upgrade to 1.6.8. Does it dump core during compilation or during execution once compiled? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alessandro Rocha Sent: Monday, July 11, 2005 9:14 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] HP-UX Hi All, I've tried to install the syslog-ng 1.6.8 on a HP-UX 11i server but it causes core dump during the initialization. Do you know if this version work with HP ? Thanks in advance. Alessandro. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Putting all sending Hosts in a File
by Philipp Durrer 13 Jul '05

13 Jul '05

Hi I'm new to syslog-ng and i would like to put all hosts which sending thier logs to the server in one file without the logs. So i got only the hostnames and/or Ip's in the file as a list (each line a new host ?). And the second list should contain all IP Networks of the senders. greets Nexus2k ___________________________________________________________ Gesendet von Yahoo! Mail - Jetzt mit 1GB Speicher kostenlos - Hier anmelden: http://mail.yahoo.de

1 0

syslog-ng keeps logging the same...
by Michael Mannsberger 12 Jul '05

12 Jul '05

I installed the following: libol-0.3.16 syslog-ng-1.6.8 I want to log to a loghost. If I specify udp as follows in the source statement udp(ip("0.0.0.0") port(514)); syslog-ng keeps logging the same entry over and over again. Without it it works fine for the loghost but clients will not be able to connect of course.

2 2

Problems with syslog-ng and filters-
by Ville Leinonen 12 Jul '05

12 Jul '05

Hi all, I have created 2 filters. There is check if there is link up/down text in msg field. If its match then there comes N else there should be comes N. My problem is now that i syslog-ng puts double in sql-table one is Y and one is N. Any suggestion what is wrong? Here comes also configuration. source net { udp(ip("0.0.0.0") port(514)); }; filter f_link_downup { match(LINK-3-UPDOWN) or match(LINEPROTO-5-UPDOWN) or match(off-line) or match(on-line); }; filter f_others { not match(LINK-3-UPDOWN) or not match(LINEPROTO-5-UPDOWN) or not match(off-line) or not match(on-line); }; log { source(net); filter(f_link_downup); destination(d_mysql_downup); }; log { source(net); filter(f_others); destination(d_mysql_others); }; destination d_mysql_downup { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg, showdata) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG', 'N' );\n") template-escape(yes)); }; destination d_mysql_others { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg, showdata) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG', 'Y' );\n") template-escape(yes)); }; Br, Ville Leinonen

2 2

RE: [syslog-ng] HP-UX
by Stephen Tanner 11 Jul '05

11 Jul '05

Alessandro, Did you install the libol from the HP Porting Archive? http://hpux.cs.utah.edu/ Stephen -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alessandro Rocha Sent: Monday, July 11, 2005 2:24 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] HP-UX Stephen, I´m still having problems. Any other idea ? Thanks. Alessandro. On 7/11/05, Stephen Tanner <stanner(a)leeclerk.org> wrote: > Alessandro, > I'm currently running libol 0.3.15 > > Stephen > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alessandro > Rocha > Sent: Monday, July 11, 2005 9:36 AM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] HP-UX > > Stephen, > > I intalled 1.6.6 but I got the same problem. > Do you know which libol version your servers are running ? > > Alessandro. > > On 7/11/05, Stephen Tanner <stanner(a)leeclerk.org> wrote: > > Alessandro, > > I currently have version 1.6.6 running on multiple HP-UX 11i > > machines. I have not, however, attempted to upgrade to 1.6.8. Does > it > > dump core during compilation or during execution once compiled? > > > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > Stephen Tanner > > HP-UX Systems Administrator > > Network Support Services > > Lee County Clerk of Courts > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > > > -----Original Message----- > > From: syslog-ng-bounces(a)lists.balabit.hu > > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alessandro > > Rocha > > Sent: Monday, July 11, 2005 9:14 AM > > To: syslog-ng(a)lists.balabit.hu > > Subject: [syslog-ng] HP-UX > > > > Hi All, > > > > I've tried to install the syslog-ng 1.6.8 on a HP-UX 11i server but it > > causes core dump during the initialization. Do you know if this > > version work with HP ? > > > > Thanks in advance. > > > > Alessandro. > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] HP-UX
by Stephen Tanner 11 Jul '05

11 Jul '05

Alessandro, I'm currently running libol 0.3.15 Stephen -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alessandro Rocha Sent: Monday, July 11, 2005 9:36 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] HP-UX Stephen, I intalled 1.6.6 but I got the same problem. Do you know which libol version your servers are running ? Alessandro. On 7/11/05, Stephen Tanner <stanner(a)leeclerk.org> wrote: > Alessandro, > I currently have version 1.6.6 running on multiple HP-UX 11i > machines. I have not, however, attempted to upgrade to 1.6.8. Does it > dump core during compilation or during execution once compiled? > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > Stephen Tanner > HP-UX Systems Administrator > Network Support Services > Lee County Clerk of Courts > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alessandro > Rocha > Sent: Monday, July 11, 2005 9:14 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] HP-UX > > Hi All, > > I've tried to install the syslog-ng 1.6.8 on a HP-UX 11i server but it > causes core dump during the initialization. Do you know if this > version work with HP ? > > Thanks in advance. > > Alessandro. > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Shiming Yang/OCIO_CorpDataSecurity/Planning_Office/HQ_for_the_Americas/BTMNA is out of the office.
by Shiming Yang 11 Jul '05

11 Jul '05

I will be out of the office starting 07/11/2005 and will not return until 07/30/2005. I will respond to your message when I return. If there is problem about Proxy or IBM web hosting facility, please call my backup Will at 8380 or Rich Maer at 5744. ----------------------------------------- The information contained in this electronic mail message, and any and all accompanying documents, constitutes confidential information. If you are not the intended recipient of this information, any disclosure, copying, distribution, or the taking of any action in reliance on it is strictly prohibited. If you received this information in error, please notify the sender immediately and destroy this communication. Messages sent via this medium may be subject to delays and/or unauthorized alteration. Neither The Bank of Tokyo-Mitsubishi, Ltd. nor any of its affiliates shall be held liable for the contents of this message.

1 0

RE: [syslog-ng] HP-UX
by Stephen Tanner 11 Jul '05

11 Jul '05

Alessandro, I currently have version 1.6.6 running on multiple HP-UX 11i machines. I have not, however, attempted to upgrade to 1.6.8. Does it dump core during compilation or during execution once compiled? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alessandro Rocha Sent: Monday, July 11, 2005 9:14 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] HP-UX Hi All, I've tried to install the syslog-ng 1.6.8 on a HP-UX 11i server but it causes core dump during the initialization. Do you know if this version work with HP ? Thanks in advance. Alessandro. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

HP-UX
by Alessandro Rocha 11 Jul '05

11 Jul '05

Hi All, I've tried to install the syslog-ng 1.6.8 on a HP-UX 11i server but it causes core dump during the initialization. Do you know if this version work with HP ? Thanks in advance. Alessandro.

1 0

is connection broken logged?
by Richard Legault 11 Jul '05

11 Jul '05

We are using version 1.6.0rc4 As part of our regression testing we attempt to send a log message to a host that is non-existent (123.124.125.126) We expect to see in our log the error message Connection Broken, we are not seeing that. here is the parts of our conf file that are relevant destination tcsvlogfile { file("/var/log/svlogtc"); }; destination badsyslogsrvr { udp("123.124.125.126" port(514)); }; filter f_ic17 { match( "ic_17 test message" ); }; log { source(src); filter(f_ic17); destination(badsyslogsrvr); }; log { source(src); destination(tcsvlogfile); }; Now when I send the command logger "ic_17 test message" I see the corresponding "ic_17 test message" message in /var/log/svlogtc but I do not see the error that it could not send the message to badsyslogsrvr. i.e. Connection Broken ... Are error messages from syslog-ng not logged ( I could understand this as it could end up in a nasty recursion loop) Thanks. Richard Legault Senior Engineer 519-880-2400 ext 2722 www.sandvine.com

4 3

Hosts aren't logging to my log host
by Ryan McCain 07 Jul '05

07 Jul '05

I'm wanting all routers to log to their respective directories. I'm running this on SLES 9. Let me know if there is any debug output I need to provide. I'm new to syslog-ng, so I'm assuming, I'm missing something in the config file. Thanks, Ryan ---- #Options options { mark(600); sync(0); use_dns(yes); create_dirs(yes); }; # Source dirvers source src_int { internal(); }; source src { unix-stream("/dev/log"); }; source tcp { tcp(); }; # Destinations drivers; use macro expansion to make seperating logs easier destination d_facility { file("/var/log/syslog-ng/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" perm(0600)); }; destination d_program { file("/var/log/syslog-ng/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM" perm(0600)); }; # Finally, actually log everything to its appropriate place log { source("src"); destination("d_facility"); }; log { source("src"); destination("d_program"); }; log { source("tcp"); destination("d_facility"); }; # Log all internal() stuff to seperate log destination d_int { file("/var/log/syslog-ng/internal.log" perm(0600)); }; log { source("src_int"); destination("d_int"); }; # log everything remote/local to a console tty #destination d_tty { file("/dev/tty11"); }; #log { source("src"); source("src_int"); destination("d_tty"); };

1 0

SV: [syslog-ng] libol + syslog-ng
by kenneth.gullberg＠foreningssparbanken.se 07 Jul '05

07 Jul '05

Your libol is too old, it even says so in the error message :) // Kenneth -----Ursprungligt meddelande----- Från: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] För Chris Neitzert Skickat: den 7 juli 2005 12:11 Till: Syslog-ng users' and developers' mailing list Ämne: [syslog-ng] libol + syslog-ng heya I tried googling this up prior to sending but no luck I'm using a recently installed and yum-updated copy of fedora core 4, libol-0.3.9, and syslog-ng-1.6.8. ld sees libol but any variation of the syslog-ng ./configure --with-libol=/path/to/libol including to the source directory replies with: checking libol version >= 0.3.16... no configure: error: Required libol version not found, make sure that your libol version is in the 0.3.x branch even --without-libol returns the same. any clue what i'm doing wrong? chris _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3

libol + syslog-ng
by Chris Neitzert 07 Jul '05

07 Jul '05

heya I tried googling this up prior to sending but no luck I'm using a recently installed and yum-updated copy of fedora core 4, libol-0.3.9, and syslog-ng-1.6.8. ld sees libol but any variation of the syslog-ng ./configure --with-libol=/path/to/libol including to the source directory replies with: checking libol version >= 0.3.16... no configure: error: Required libol version not found, make sure that your libol version is in the 0.3.x branch even --without-libol returns the same. any clue what i'm doing wrong? chris

1 0

syslog-ng 1.9.5 released
by Balazs Scheidler 07 Jul '05

07 Jul '05

Hi, I'm pleased to announce syslog-ng 1.9.5 a new BETA release in the new syslog-ng 2.0 branch. Here is the NEWS entry: 1.9.5 Thu, 07 Jul 2005 11:35:25 +0200 * Documentation updates on new options. * Fixed some timezone related problems cleaned up template specific timezones. * Fixed destination file permission setting problems. * Fixed use_time_recvd() handling, added a note to the documentation that this option is deprecated. * Fixed a destination file fd/memory leak for macro expanded files. * Fixed regexp match references in macro expansion. (e.g. "/var/log/$1") * Added two new macros: STAMP which formats a timestamp according to the ts_format() option, and WEEK which refers to the current week number. * Linking fixes to support more platforms. * Changed local hostname detection to use the value of use_fqdn() and actually use a fully expanded hostname if that is true. * Fixed some configuration file parsing problems which caused user identifiers to be recognized as keywords if they had a common prefix. * Always add fractions of a second if it was received from the application. * Fixed a gcc4 compatibility problem. Please note that a daily snapshot is available from syslog-ng which might contain other, not-yet-released fixes. It is recommended to check these snapshots regularly if you are using syslog-ng 1.9.x. -- Bazsi

1 0

RE: [syslog-ng] Error parsing conf file?
by Balazs Scheidler 07 Jul '05

07 Jul '05

Hi, > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler > Sent: Tuesday, July 05, 2005 6:47 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: [syslog-ng] Error parsing conf file? > > > On Mon, 2005-07-04 at 15:56 -0600, Zb Indelak wrote: > > Any progress / clues on the multiple file-open bug? I'm using a > > multi-processor (2 CPUs) system, if that perhaps makes a difference. > > With the 20050704 snapshot I've seen a single file open over 20 times > > each. > > not yet, sorry, I was hunting down a bug for a customer, so did not have too much time lately. But I'm trying to look into this RSN. > > ps: I hate bugs that screw up the heap structure :( > I have now fixed this issue with the following patch: --- orig/src/logwriter.c +++ mod/src/logwriter.c @@ -327,7 +327,11 @@ log_writer_deinit(LogPipe *s, GlobalConf LogWriter *self = (LogWriter *) s; if (self->source) - g_source_destroy(self->source); + { + g_source_destroy(self->source); + g_source_unref(self->source); + self->source = NULL; + } return TRUE; } It will be included in tomorrow's snapshot. -- Bazsi

1 0

DB probs
by Edward Brookhouse 05 Jul '05

05 Jul '05

Hi all - I am upgrading from the syslog-ng 1.7 branch on one machine to another server using the 1.9.4 branch. Using this on the new server I am building, I can not get any data to write to a mysql database. Using mysql 4.1.11-2 and Syslogng 1.9.4 on RH Fedora Core 4 kernel 2.6.12-1 Using the syslog-ng config file and database setup from the older server that is still running does not work. So - I tried switching from using a mysql pipe file to using sqlsyslogd - same results - Log data flows in, gets written to a log file, but never gets inserted into the db - The db structure looks ok - the sqlsyslogd is running well - not much in the way of being able to debug that but ....gonna try to pass it through a debugger Here is the relevant portion of my conf destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -h localhost -u root -t logs syslog -p"); }; With the password specified in sqlsyslogd.conf (this is one word on a line by itself - is that right???) When a log entry comes in I do see an error about writing to FD 7 [root@io etc]# syslog-ng -F -e -v -d -f /etc/syslog-ng/syslog-ng.conf Starting destination program; cmdline='/usr/local/bin/syslog-mail' Starting destination program; cmdline='/usr/local/sbin/sqlsyslogd -h localhost -u root -t logs syslog -p' Starting destination program; cmdline='/usr/local/bin/syslog-mail-perl' syslog-ng starting up; version='1.9.4' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' Syslog connection accepted; to='AF_UNIX(/dev/log)', from='AF_UNIX(\xff\xff\xff\xff\x19)' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' Incoming log entry; line='<86>Jul 5 11:05:01 sshd[6703]: Accepted password for ebroo from ::ffff:172.17.17.193 port 33316 ssh2' Initializing destination file writer; filename='/var/log/syslog', template='/var/log/syslog' Initializing destination file writer; filename='/var/log/HOSTS/io/2005/07/05/05', template='/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$HOST_$YEAR_$ MONTH_$DAY' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' EOF occurred while reading; fd='7' Closing log reader fd; fd='7' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' Syslog connection accepted; to='AF_UNIX(/dev/log)', from='AF_UNIX(-)' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' Incoming log entry; line='<38>Jul 5 11:05:01 sshd(pam_unix)[6705]: session opened for user ebroo by (uid=0)' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' EOF occurred while reading; fd='7' Closing log reader fd; fd='7' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' Any thoughts appreciated!!!!!!!!!!!! Edward ebroo(a)healthydirections.com

1 1