- syslog-ng - lists.balabit.hu

duplicate lines
by Peter Straka 09 Jun '05

09 Jun '05

Hello, I would ask you if it is posible to write filter which remove every duplicate lines from one source usage as: log ( source; filter(duplicate); destination) parameters: number of lines which can be betwen the same line (this is becouse some messages are repeated in a block of lines) time period which will defined when the counter must be reset (before that counter will be send) and next line will be again the first one counter - to count number of droped lines and show this value every time period - like solaris syslog do duplicate line means : 1 line: aaaaa bbbbbb 2 line: cccccc 3 line: aaaaa bbbbbb 4 line: cccccc ... line: aaaaa bbbbbb ... line: cccccc 9 line: ddddd lines 1,2,9 will pass to destination lines 3-8 will be removed (droped) in the past it was a filter - DEFAULT which did this job in a "some" way and I thing now it is nothing which can be usable any idea? with regards Peter STRAKA

2 1

RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel
by Stew Redfield 09 Jun '05

09 Jun '05

Just like for cron called scripts, all environmental variables need to be either within the script itself or sourced by the script. cron and init scripts have no knowledge of the environmental settings that may be tied to your root (or any) shell. Also, it is best if you fully qualify program calls (/usr/local/bin/nawk vs. nawk) within scripts if you don't set your path in environmental settings. Bottom line, for the teams I've managed: if you need it for cron to work, explicitly state it. Stew -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Stephen Tanner Sent: Thursday, June 09, 2005 9:51 AM To: Syslog-ng users' and developers' mailing list Subject: RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel Exactly what do you mean by environment being the same? The startup script works on this box if executed manually. The only thing that could possibly change would be what is actually running at the time rc starts stunnel and syslog-ng. I have place the startup script in rc2 directly after inetd starts. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Hermann-Josef Beckers Sent: Thursday, June 09, 2005 9:47 AM To: Syslog-ng users' and developers' mailing list Subject: Antwort: RE: [syslog-ng] Syslog-ng with stunnel syslog-ng-bounces(a)lists.balabit.hu schrieb am 09.06.2005 15:32:38: > I have considered this. The only problem with this would be that I can > manually execute the script and everything starts up properly. It only > seems to barf when executed from rc on boot. > > --Stephen Did you check that the environment is exactly the same? Yours hjb _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: Antwort: RE: [syslog-ng] Syslog-ng with stunnel
by Stephen Tanner 09 Jun '05

09 Jun '05

Exactly what do you mean by environment being the same? The startup script works on this box if executed manually. The only thing that could possibly change would be what is actually running at the time rc starts stunnel and syslog-ng. I have place the startup script in rc2 directly after inetd starts. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Hermann-Josef Beckers Sent: Thursday, June 09, 2005 9:47 AM To: Syslog-ng users' and developers' mailing list Subject: Antwort: RE: [syslog-ng] Syslog-ng with stunnel syslog-ng-bounces(a)lists.balabit.hu schrieb am 09.06.2005 15:32:38: > I have considered this. The only problem with this would be that I can > manually execute the script and everything starts up properly. It only > seems to barf when executed from rc on boot. > > --Stephen Did you check that the environment is exactly the same? Yours hjb _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng] Syslog-ng with stunnel
by Stephen Tanner 09 Jun '05

09 Jun '05

I have considered this. The only problem with this would be that I can manually execute the script and everything starts up properly. It only seems to barf when executed from rc on boot. --Stephen -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Nate Campi Sent: Thursday, June 09, 2005 9:14 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng with stunnel On Wed, Jun 08, 2005 at 02:42:57PM -0400, Stephen Tanner wrote: > I have configured syslog-ng to work with stunnel, and have them starting > from the same startup script on an HP-UX server. The logs are being > written to a loghost on a Linux box. Everything works fine, including > my startup script, except for one minor issue. When the machine is > booted, I get broken pipe errors in the log stating that syslog-ng > cannot contact the loghost. Stunnel is up and running at this point but > syslog-ng seems unable to connect. The only way to resolve this is to > restart stunnel and syslog-ng. I have this startup script running from > rc2. I've been trying to avoid moving it to a later time, as I do not > wish to lose any logs of services. Does anyone have any idea of what > could be causing this, or any suggestions on where in rc I should place > the startup script to avoid this issue? You've probably already tried this, but try making the script sleep for a few seconds after stunnel is started but before syslog-ng is started. That might be all you need. -- Nate Your mantra for today is: Don't let data from the network near a shell. Bad things happen. -- Randall Schwartz _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] Default output format
by JF Suret 09 Jun '05

09 Jun '05

It is the level of your message (info debug ...) > Message du 09/06/05 00:14 > De : "Michael Laccetti" <michael(a)s2g-limited.com> > A : syslog-ng(a)lists.balabit.hu > Copie à : > Objet : [syslog-ng] Default output format > > Can anybody tell me what the default template format is? The date, host, and > message speak for themselves, but I'm not sure what the first "<xx>" is. > > Thanks, > Mike > > > > -- > ------------------------ [ SECURITY NOTICE ] ------------------------ > To: syslog-ng(a)lists.balabit.hu. > For your security, michael(a)s2g-limited.com > digitally signed this message on 08 June 2005 at 22:13:51 UTC. > Verify this digital signature at http://www.ciphire.com/verify. > ------------------- [ CIPHIRE DIGITAL SIGNATURE ] ------------------- > Q2lwaGlyZSBTaWcuAVdzeXNsb2ctbmdAbGlzdHMuYmFsYWJpdC5odQBtaWNoYWVsQHMyZ > y1saW1pdGVkLmNvbQBlbWFpbCBib2R5AIYAAAB8AHwAAAABAAAAn22nQoYAAAD4AgACAA > IAAgAghdicC/BUmddiR42qouJHlnIdErtbS2JMBhxXunW5fyYBADFOR2Yt22whsx7gUTo > GnIPH+715U3RbKhA9xYKZYPIPZfmtr8iRGhYrKbAocds1IydkK27x4YjPpgrfrDO2z1It > GBLVU2lnRW5k > --------------------- [ END DIGITAL SIGNATURE ] --------------------- > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > >

2 1

Syslog-ng Statistics
by kenneth.gullberg＠foreningssparbanken.se 09 Jun '05

09 Jun '05

Have anyone written any statistics package for syslog-ng? Id be interested in anything that would show information like number of messages received since last stats(XXXX), mb of messages received / sec, messages per prio etc etc etc :) Anything would be useful! Im looking for something similar to the output that you can get from bind and nsd for making graphs Best Regards Kenneth Gullberg

1 0

Syslog-ng with stunnel
by Stephen Tanner 09 Jun '05

09 Jun '05

I have configured syslog-ng to work with stunnel, and have them starting from the same startup script on an HP-UX server. The logs are being written to a loghost on a Linux box. Everything works fine, including my startup script, except for one minor issue. When the machine is booted, I get broken pipe errors in the log stating that syslog-ng cannot contact the loghost. Stunnel is up and running at this point but syslog-ng seems unable to connect. The only way to resolve this is to restart stunnel and syslog-ng. I have this startup script running from rc2. I've been trying to avoid moving it to a later time, as I do not wish to lose any logs of services. Does anyone have any idea of what could be causing this, or any suggestions on where in rc I should place the startup script to avoid this issue? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

2 1

Default output format
by Michael Laccetti 08 Jun '05

08 Jun '05

Can anybody tell me what the default template format is? The date, host, and message speak for themselves, but I'm not sure what the first "<xx>" is. Thanks, Mike -- ------------------------ [ SECURITY NOTICE ] ------------------------ To: syslog-ng(a)lists.balabit.hu. For your security, michael(a)s2g-limited.com digitally signed this message on 08 June 2005 at 22:13:51 UTC. Verify this digital signature at http://www.ciphire.com/verify. ------------------- [ CIPHIRE DIGITAL SIGNATURE ] ------------------- Q2lwaGlyZSBTaWcuAVdzeXNsb2ctbmdAbGlzdHMuYmFsYWJpdC5odQBtaWNoYWVsQHMyZ y1saW1pdGVkLmNvbQBlbWFpbCBib2R5AIYAAAB8AHwAAAABAAAAn22nQoYAAAD4AgACAA IAAgAghdicC/BUmddiR42qouJHlnIdErtbS2JMBhxXunW5fyYBADFOR2Yt22whsx7gUTo GnIPH+715U3RbKhA9xYKZYPIPZfmtr8iRGhYrKbAocds1IydkK27x4YjPpgrfrDO2z1It GBLVU2lnRW5k --------------------- [ END DIGITAL SIGNATURE ] ---------------------

1 0

syslog-ng 1.6.7
by Gehring, Andrew x66132 08 Jun '05

08 Jun '05

I have syslog-ng 1.6.7 running on AIX 5.3 systems. I have a signifigant number or processes starting up and, via logger, sending messages to syslog-ng They are getting "denied" write access. The is easily repeatable, and does not happen with syslogs (AIXs) utest Testing logger... . Please retry A truss shows no availailbe mbufs. Is there a setting in syslog-ng I can use to remedy this issue? Thanks, Andrew _ This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

1 0

Michael Helman is out of the office.
by Michael.Helman＠hartfordlife.com 07 Jun '05

07 Jun '05

I will be out of the office starting 06/06/2005 and will not return until 06/13/2005. If you need immediate assistance please contact the Service Desk at x36000. Thank you and have a nice day. ************************************************************************* PRIVILEGED AND CONFIDENTIAL: This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies. *************************************************************************

1 0

Many errors when running make install
by Ryan McCain 07 Jun '05

07 Jun '05

This is on SLES 9. bison, flex and m4 are all installed. make and configure went smoothly. Can someone interpret what this is telling me? The server has a minimal amount of packages installed so this might be related to a missing package, but I didn't see any that I'm missing that are called for in the INSTALL file.. Thanks!! -------------------------------- serverA:~/syslog-ng-1.6.7 # make install Making install in src make[1]: Entering directory `/root/syslog-ng-1.6.7/src' Making install in . make[2]: Entering directory `/root/syslog-ng-1.6.7/src' if gcc -DHAVE_CONFIG_H -I. -I/root/syslog-ng-1.6.7/src -I. -g -O2 -Wall -D_GNU_SOURCE -MT main.o -MD -MP -MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo '/root/syslog-ng-1.6.7/src/'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:39: error: parse error before "UINT32" log.h:39: warning: no semicolon at end of struct or union log.h:43: error: parse error before "pri" log.h:43: warning: type defaults to `int' in declaration of `pri' log.h:43: warning: data definition has no type or storage class log.h:44: error: parse error before "flags" log.h:44: warning: type defaults to `int' in declaration of `flags' log.h:44: warning: data definition has no type or storage class log.h:51: error: parse error before '}' token In file included from log.h:54, from sources.h:32, from cfgfile.h:29, from main.c:27: log.h.x:4: error: field `super' has incomplete type In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:93: error: parse error before "length" log.h:94: error: parse error before "pri" In file included from cfgfile.h:29, from main.c:27: sources.h:33:18: list.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:64: error: parse error before "dgram" In file included from filters.h:33, from cfgfile.h:30, from main.c:27: filters.h.x:4: error: field `super' has incomplete type filters.h.x:40: error: field `super' has incomplete type In file included from cfgfile.h:30, from main.c:27: filters.h:63: error: parse error before "valid" filters.h:64: error: parse error before "valid" In file included from center.h:32, from cfgfile.h:32, from main.c:27: center.h.x:4: error: field `super' has incomplete type center.h.x:39: error: field `super' has incomplete type center.h.x:40: error: parse error before "UINT32" center.h.x:40: warning: no semicolon at end of struct or union center.h.x:45: error: parse error before '}' token In file included from cfgfile.h:32, from main.c:27: center.h:69: error: parse error before "UINT32" center.h:81: warning: `struct resource_node' declared inside parameter list center.h:81: warning: its scope is only this definition or declaration, which is probably not what you want In file included from cfgfile.h:35, from main.c:27: cfgfile.h.x:4: error: field `super' has incomplete type cfgfile.h.x:10: error: parse error before "UINT32" cfgfile.h.x:10: warning: no semicolon at end of struct or union cfgfile.h.x:11: warning: type defaults to `int' in declaration of `keep_hostname' cfgfile.h.x:11: warning: data definition has no type or storage class cfgfile.h.x:12: error: parse error before "mark_freq" cfgfile.h.x:12: warning: type defaults to `int' in declaration of `mark_freq' cfgfile.h.x:12: warning: data definition has no type or storage class cfgfile.h.x:13: error: parse error before "sync_freq" cfgfile.h.x:13: warning: type defaults to `int' in declaration of `sync_freq' cfgfile.h.x:13: warning: data definition has no type or storage class cfgfile.h.x:14: error: parse error before "stats_freq" cfgfile.h.x:14: warning: type defaults to `int' in declaration of `stats_freq' cfgfile.h.x:14: warning: data definition has no type or storage class cfgfile.h.x:15: error: parse error before "time_reopen" cfgfile.h.x:15: warning: type defaults to `int' in declaration of `time_reopen' cfgfile.h.x:15: warning: data definition has no type or storage class cfgfile.h.x:16: error: parse error before "time_reap" cfgfile.h.x:16: warning: type defaults to `int' in declaration of `time_reap' cfgfile.h.x:16: warning: data definition has no type or storage class cfgfile.h.x:18: error: parse error before "use_time_recvd" cfgfile.h.x:18: warning: type defaults to `int' in declaration of `use_time_recvd' cfgfile.h.x:18: warning: data definition has no type or storage class cfgfile.h.x:19: error: parse error before "use_fqdn" cfgfile.h.x:19: warning: type defaults to `int' in declaration of `use_fqdn' cfgfile.h.x:19: warning: data definition has no type or storage class cfgfile.h.x:20: error: parse error before "use_dns" cfgfile.h.x:20: warning: type defaults to `int' in declaration of `use_dns' cfgfile.h.x:20: warning: data definition has no type or storage class cfgfile.h.x:21: error: parse error before "check_hostname" cfgfile.h.x:21: warning: type defaults to `int' in declaration of `check_hostname' cfgfile.h.x:21: warning: data definition has no type or storage class cfgfile.h.x:22: error: parse error before '*' token cfgfile.h.x:23: warning: type defaults to `int' in declaration of `create_dirs' cfgfile.h.x:23: warning: data definition has no type or storage class cfgfile.h.x:24: error: parse error before "sanitize_filenames" cfgfile.h.x:24: warning: type defaults to `int' in declaration of `sanitize_filenames' cfgfile.h.x:24: warning: data definition has no type or storage class cfgfile.h.x:31: error: parse error before "dns_cache" cfgfile.h.x:31: warning: type defaults to `int' in declaration of `dns_cache' cfgfile.h.x:31: warning: data definition has no type or storage class cfgfile.h.x:32: error: parse error before "dns_cache_size" cfgfile.h.x:32: warning: type defaults to `int' in declaration of `dns_cache_size' cfgfile.h.x:32: warning: data definition has no type or storage class cfgfile.h.x:33: error: parse error before "dns_cache_expire" cfgfile.h.x:33: warning: type defaults to `int' in declaration of `dns_cache_expire' cfgfile.h.x:33: warning: data definition has no type or storage class cfgfile.h.x:34: error: parse error before "dns_cache_expire_failed" cfgfile.h.x:34: warning: type defaults to `int' in declaration of `dns_cache_expire_failed' cfgfile.h.x:34: warning: data definition has no type or storage class cfgfile.h.x:36: error: parse error before "gc_busy_threshold" cfgfile.h.x:36: warning: type defaults to `int' in declaration of `gc_busy_threshold' cfgfile.h.x:36: warning: data definition has no type or storage class cfgfile.h.x:37: error: parse error before "gc_idle_threshold" cfgfile.h.x:37: warning: type defaults to `int' in declaration of `gc_idle_threshold' cfgfile.h.x:37: warning: data definition has no type or storage class cfgfile.h.x:38: error: parse error before "log_msg_size" cfgfile.h.x:38: warning: type defaults to `int' in declaration of `log_msg_size' cfgfile.h.x:38: warning: data definition has no type or storage class cfgfile.h.x:40: error: conflicting types for `sources' center.h.x:41: error: previous declaration of `sources' cfgfile.h.x:41: error: conflicting types for `filters' center.h.x:42: error: previous declaration of `filters' cfgfile.h.x:42: error: conflicting types for `destinations' center.h.x:43: error: previous declaration of `destinations' cfgfile.h.x:45: error: parse error before '}' token cfgfile.h.x:75: error: field `super' has incomplete type cfgfile.h.x:110: error: field `super' has incomplete type In file included from main.c:27: cfgfile.h:114: error: parse error before "UINT32" main.c:29:20: format.h: No such file or directory main.c:30:20: werror.h: No such file or directory main.c:31:19: queue.h: No such file or directory main.c:32:24: pkt_buffer.h: No such file or directory In file included from main.c:51: main.c.x:4: error: field `super' has incomplete type main.c.x:19: error: variable `reread_config_class' has initializer but incomplete type main.c.x:20: error: `STATIC_HEADER' undeclared here (not in a function) main.c.x:20: warning: excess elements in struct initializer main.c.x:20: warning: (near initialization for `reread_config_class') main.c.x:21: error: `callback_class' undeclared here (not in a function) main.c.x:21: warning: excess elements in struct initializer main.c.x:21: warning: (near initialization for `reread_config_class') main.c.x:21: warning: excess elements in struct initializer main.c.x:21: warning: (near initialization for `reread_config_class') main.c.x:21: warning: excess elements in struct initializer main.c.x:21: warning: (near initialization for `reread_config_class') main.c.x:22: warning: excess elements in struct initializer main.c.x:22: warning: (near initialization for `reread_config_class') main.c.x:24: warning: excess elements in struct initializer main.c.x:24: warning: (near initialization for `reread_config_class') main.c.x:30: error: field `super' has incomplete type main.c.x:45: error: variable `report_stats_class' has initializer but incomplete type main.c.x:46: error: `STATIC_HEADER' undeclared here (not in a function) main.c.x:46: warning: excess elements in struct initializer main.c.x:46: warning: (near initialization for `report_stats_class') main.c.x:47: error: `callback_class' undeclared here (not in a function) main.c.x:47: warning: excess elements in struct initializer main.c.x:47: warning: (near initialization for `report_stats_class') main.c.x:47: warning: excess elements in struct initializer main.c.x:47: warning: (near initialization for `report_stats_class') main.c.x:47: warning: excess elements in struct initializer main.c.x:47: warning: (near initialization for `report_stats_class') main.c.x:48: warning: excess elements in struct initializer main.c.x:48: warning: (near initialization for `report_stats_class') main.c.x:50: warning: excess elements in struct initializer main.c.x:50: warning: (near initialization for `report_stats_class') main.c.x:56: error: field `super' has incomplete type main.c.x:76: error: variable `syslog_backend_class' has initializer but incomplete type main.c.x:77: error: `STATIC_HEADER' undeclared here (not in a function) main.c.x:77: warning: excess elements in struct initializer main.c.x:77: warning: (near initialization for `syslog_backend_class') main.c.x:78: error: `io_backend_class' undeclared here (not in a function) main.c.x:78: warning: excess elements in struct initializer main.c.x:78: warning: (near initialization for `syslog_backend_class') main.c.x:78: warning: excess elements in struct initializer main.c.x:78: warning: (near initialization for `syslog_backend_class') main.c.x:78: warning: excess elements in struct initializer main.c.x:78: warning: (near initialization for `syslog_backend_class') main.c.x:79: warning: excess elements in struct initializer main.c.x:79: warning: (near initialization for `syslog_backend_class') main.c.x:81: warning: excess elements in struct initializer main.c.x:81: warning: (near initialization for `syslog_backend_class') main.c: In function `do_reread_config': main.c:68: warning: implicit declaration of function `CAST' main.c:68: error: `reread_config' undeclared (first use in this function) main.c:68: error: (Each undeclared identifier is reported only once main.c:68: error: for each function it appears in.) main.c:68: error: `self' undeclared (first use in this function) main.c:82: warning: implicit declaration of function `io_callout' main.c:91: error: `debug_flag' undeclared (first use in this function) main.c:95: warning: implicit declaration of function `notice' main.c:119: warning: implicit declaration of function `exit' main.c: In function `do_report_stats': main.c:137: error: `report_stats' undeclared (first use in this function) main.c:137: error: `self' undeclared (first use in this function) main.c:139: error: `pktbuf_dropped_pkts' undeclared (first use in this function) main.c: In function `main_loop': main.c:186: warning: braces around scalar initializer main.c:186: warning: (near initialization for `s.super') main.c:186: error: `STATIC_HEADER' undeclared (first use in this function) main.c:186: error: initializer element is not constant main.c:186: error: (near initialization for `s.super') main.c:186: warning: excess elements in scalar initializer main.c:186: warning: (near initialization for `s.super') main.c:186: error: initializer element is not constant main.c:186: error: (near initialization for `s.super') main.c:186: confused by earlier errors, bailing out make[2]: *** [main.o] Error 1 make[2]: Leaving directory `/root/syslog-ng-1.6.7/src' make[1]: *** [install-recursive] Error 1 make[1]: Leaving directory `/root/syslog-ng-1.6.7/src' make: *** [install-recursive] Error 1 dss-cs99la31:~/syslog-ng-1.6.7 # clear

2 1

RE: [syslog-ng] Resolving Hostnames for Syslog Source IPs
by Sawall, Christopher L 06 Jun '05

06 Jun '05

Thanks for the suggestions. It seems that about 10 out of 50 of the devices did not have the proper PTR records. Adding this has resolved my problem. Thanks, chris -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Valdis.Kletnieks(a)vt.edu Sent: Wednesday, June 01, 2005 3:53 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Resolving Hostnames for Syslog Source IPs On Wed, 01 Jun 2005 09:33:58 PDT, Jarrod Manzer said: > I had this same problem. I resolved it by logging by IP and then doing > reverse DNS lookups with a script and creating symbolic links to those > IP based directories. The end result was people who like to use IP or > DNS were happy. Gotta make sure your reverse is set up properly though. > > But I never did find out why syslog-ng couldn't resolve the same names > that the host command on the same box could. The most common cause for things like this is semi-borked DNS that *appears* to work, but in fact is subtly misconfigured. A few things to check: 1) Take the IP address, and look up the PTR, which should give you a hostname (this is where most 'host' commands stop). Then actually check that hostname in the DNS, and make sure the IP is listed in an A record (some resolvers do this additional sanity checking). 2) You may have a "lame delegation". Look at the SOA and NS entries for your DNS zones, both PTR and A, and double-check that all machines listed in NS are in fact serving up correct data for the zones (a quick double-check is if all the DNS servers show the correct zone serial number in the SOA). It often happens that if there are multiple NS records, a daemon will "lock in" on asking one NS first, and if it returns an authoritative NXDOMAIN because it's a lame delegation, the daemon won't ask other NS. However, when you use the 'host' command, it may check some *other* NS entry first and magically appear to work. 3) Double-check /etc/resolv.conf to make sure it points 'nameserver' entries at DNS servers that pass the sanity checks in (1) and (2).... ******************************* The information contained in this message may be privileged and/or confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. Note that any views or opinions presented in this message are solely those of the author and do not necessarily represent those of Ameren. All emails are subject to monitoring and archival. Finally, the recipient should check this message and any attachments for the presence of viruses. Ameren accepts no liability for any damage caused by any virus transmitted by this email. If you have received this in error, please notify the sender immediately by replying to the message and deleting the material from any computer. Ameren Corporation *******************************

1 0

Syntax error in default config?
by J. Meub 04 Jun '05

04 Jun '05

Hello, i'm new to syslog-ng and recently compiled and installed it (version 1.9.4) on my system (LFS, Kernel 2.6.11.7). The problem i have is that even with the default configuiration file it claims to have syntax errors. The lines causing the errors are: destination user { file("/var/log/user.log"); }; and filter f_auth { facility(auth); }; Whereas the first problem is generated due to the fact the the identifier is called "user". If i call it "user_" it works fine. With the second line the problem is "auth" because facility(authpriv) is accepted. But why not auth?! I'm really at a loss with that. I hope someone here has an idea what might be the problem. Thanks in advance. Regards, J. Meub

3 10

syslog-ng anon patch
by micah milano 03 Jun '05

03 Jun '05

Hello, The attached patch comes from http://dev.riseup.net/patches/syslog-ng what it does is provide a simple filter to strip out unwanted regular expressions from logs, as well as an IP alias that enables you to strip out IP addresses from your logs. This patch has been applied to the Debian package of syslog-ng, I am writing here to let people know about it and submit it for consideration into syslog-ng. >From the README: This patch adds the capability to syslog-ng that allows you to strip out any given regexp or all IP addresses from log messages before they are written to disk. The goal is to give the system administrator the means to implement site logging policies, by allowing them easy control over exactly what data they retain in their logfiles, regardless of what a particular daemon might think is best. Background: Data retention has become a hot legal topic for ISPs and other Online Service Providers (OSPs). There are many instances where it is preferable to keep less information on users than is collected by default on many systems. In the United States it is not currently required to retain data on users of a server, but you may be required to provide all data on a user which you have retained. OSPs can protect themselves from legal hassles and added work by choosing what data they wish to retain. >From "Best Practices for Online Service Providers" (http://www.eff.org/osp) As an intermediary, the OSP finds itself in a position to collect and store detailed information about its users and their online activities that may be of great interest to third parties. The USA PATRIOT Act also provides the government with expanded powers to request this information. As a result, OSP owners must deal with requests from law enforcement and lawyers to hand over private user information and logs. Yet, compliance with these demands takes away from an OSP's goal of providing users with reliable, secure network services. In this paper, EFF offers some suggestions, both legal and technical, for best practices that balance the needs of OSPs and their users' privacy and civil liberties. Rather than scrubbing the information you don't want in logs, this patch ensures that the information is never written to disk. Also, for those daemons which log through syslog facilities, this patch provides a convenient single configuration to limit what you wish to log. Here are some related links: Best Practices for Online Service Providers http://www.eff.org/osp http://www.eff.org/osp/20040819_OSPBestPractices.pdf EPIC International Data Retention Page http://www.epic.org/privacy/intl/data_retention.html Working Paper on Usage Log Data Management (from Computer, Freedom, and Privacy conference) http://cryptome.org/usage-logs.htm How to use it This patch adds the filter "strip". For example: filter f_strip {strip(<regexp>);}; This will strip out all matches of the regular expression on logs to which the filter is applied and replaces all matches with the fixed length four dashes ("----"). In place of a regular expression, you can put "ips", which will replace all internet addresses with 0.0.0.0 <http://0.0.0.0>. For example: filter f_strip {strip(ips);}; You can alter what the replacement strings are by using replace: replace(ips,"0.0.0.0 <http://0.0.0.0>") <--- this is the same as strip(ips) replace(<regex>,"----") <--- this is the same as strip(regex) We provide a debian package of 1.6.7 with this patch added (the repository is http://deb.riseup.net/debian unstable main), or you can retrieve the patch yourself from http://dev.riseup.net/websvn/listing.php?repname=syslog-ng-anon&path=%2F&sc… apply it with: # patch -p1 < syslog-ng-anon.diff

6 7

Re: Assessing reliability - did we get all messages?
by Cary, Kim 02 Jun '05

02 Jun '05

Thanks to Mike for the tip on checking whether we're having problems taking on our UDP data from our solaris 9 syslog server. On Jun 1, 2005, at 1:52 PM, syslog-ng-request(a)lists.balabit.hu wrote: > For Solaris: > netstat -s -P udp > I am pretty sure that "udpInErrors" will represent packets dropped from > teh UDP buffer, but am unsure.. > > I don't think I would use syslog over TCP from a PIX for the exact > reason > you said..the PIX will stop until the syslog server is ready..instead, > maybe just increase your UDP buffer size. Depending on what else your > syslog server is doing..crank it up to 64MBytes or more..RAM is pretty > cheap. Here's what it looks like (uptime like 2 days): netstat -s -P udp UDP udpInDatagrams =101638801 udpInErrors = 0 udpOutDatagrams = 8151 udpOutErrors = 0 ndd -get /dev/udp udp_max_buf 262144 ndd -get /dev/udp udp_recv_hiwat 8192 Since this system will only get more logs sent to it, I think increasing these parameters might be good. On consultation with: http://docs.sun.com/app/docs/doc/806-7009/6jftnqskc?a=view ndd -set /dev/udp udp_recv_hiwat 65536 ndd -get /dev/udp udp_max_buf 524288 And I'm considering adding these to startup. However, I'm wondering, since apps can set their own buffers, should I even worry about this? I'm not enough of a C reader to find this out from the source code. Does syslog-ng accept the defaults or set its own buffers? Am I on the right track here? The implementation seems very solid so far, just planning for the future. Kim (thanks to Bill for his test idea as well)

1 0

Shiming Yang/OCIO_CorpDataSecurity/Planning_Office/HQ_for_the_Americas/BTMNA is out of the office.
by Shiming Yang 02 Jun '05

02 Jun '05

I will be out of the office starting 06/02/2005 and will not return until 06/07/2005. I will respond to your message when I return. If there is problem about Proxy or IBM web hosting facility, please call my backup Will at 8380. ----------------------------------------- The information contained in this electronic mail message, and any and all accompanying documents, constitutes confidential information. If you are not the intended recipient of this information, any disclosure, copying, distribution, or the taking of any action in reliance on it is strictly prohibited. If you received this information in error, please notify the sender immediately and destroy this communication. Messages sent via this medium may be subject to delays and/or unauthorized alteration. Neither The Bank of Tokyo-Mitsubishi, Ltd. nor any of its affiliates shall be held liable for the contents of this message.

1 0

Resolving Hostnames for Syslog Source IPs
by Sawall, Christopher L 01 Jun '05

01 Jun '05

I used to only log by IP and was fine with it. But with a recent acquistion and to make things easier, I turned on the use of DNS by Syslog-NG. However, it doesn't appear to resolve every source host. For example, I am sending syslogs from about 50 sets of Cisco PIX firewalls, 5 VPN Concentrators and 2 Cisco Cache Engines. Only about 80% of the PIX firewalls are being resolved when they show up in the syslog file, 2 of the concentrators and none of the cache engines. I have verified that all of the firewalls are in DNS and PINGable from the syslog server itself. I'm not sure what else to check. I saw an old post from September 2003, but I don't think it's the same issue. This appears to be a consistent problem, some hosts are always resolved and some are not. Below are the options that are set in my syslog-ng.conf file. options { sync (1); time_reopen (10); log_fifo_size (2048); long_hostnames (off); dns_cache(yes); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source src { unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) port (514)); }; Let me know if any other info would be benenficial. Thanks, Chris Sawall, GSEC, GSNA Ameren Information Security ******************************* The information contained in this message may be privileged and/or confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. Note that any views or opinions presented in this message are solely those of the author and do not necessarily represent those of Ameren. All emails are subject to monitoring and archival. Finally, the recipient should check this message and any attachments for the presence of viruses. Ameren accepts no liability for any damage caused by any virus transmitted by this email. If you have received this in error, please notify the sender immediately by replying to the message and deleting the material from any computer. Ameren Corporation *******************************

3 2

RE: [syslog-ng] Resolving Hostnames for Syslog Source IPs
by Sawall, Christopher L 01 Jun '05

01 Jun '05

Only problem is I'm letting Syslog-NG create a new file for each host, so Syslog-NG needs to be able to resolve the host before creating the file. This is a very odd problem. Chris -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Jarrod Manzer Sent: Wednesday, June 01, 2005 11:34 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Resolving Hostnames for Syslog Source IPs I had this same problem. I resolved it by logging by IP and then doing reverse DNS lookups with a script and creating symbolic links to those IP based directories. The end result was people who like to use IP or DNS were happy. Gotta make sure your reverse is set up properly though. But I never did find out why syslog-ng couldn't resolve the same names that the host command on the same box could. Sawall, Christopher L wrote: >I used to only log by IP and was fine with it. But with a recent >acquistion and to make things easier, I turned on the use of DNS by >Syslog-NG. However, it doesn't appear to resolve every source host. > >For example, I am sending syslogs from about 50 sets of Cisco PIX >firewalls, 5 VPN Concentrators and 2 Cisco Cache Engines. Only about >80% of the PIX firewalls are being resolved when they show up in the >syslog file, 2 of the concentrators and none of the cache engines. I >have verified that all of the firewalls are in DNS and PINGable from >the syslog server itself. > >I'm not sure what else to check. I saw an old post from September >2003, but I don't think it's the same issue. This appears to be a >consistent problem, some hosts are always resolved and some are not. > >Below are the options that are set in my syslog-ng.conf file. > >options { sync (1); > time_reopen (10); > log_fifo_size (2048); > long_hostnames (off); > dns_cache(yes); > use_dns (yes); > use_fqdn (no); > create_dirs (no); > keep_hostname (yes); > }; > >source src { unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) port >(514)); }; > >Let me know if any other info would be benenficial. > >Thanks, >Chris Sawall, GSEC, GSNA >Ameren >Information Security > > > > >******************************* >The information contained in this message may be privileged and/or >confidential and >protected from disclosure. If the reader of this message is not the intended recipient, >or an employee or agent responsible for delivering this message to the intended recipient, >you are hereby notified that any dissemination, distribution or copying of this >communication is strictly prohibited. Note that any views or opinions presented in this >message are solely those of the author and do not necessarily represent those of Ameren. >All emails are subject to monitoring and archival. Finally, the recipient should check >this message and any attachments for the presence of viruses. Ameren accepts no liability >for any damage caused by any virus transmitted by this email. If you have received this in >error, please notify the sender immediately by replying to the message and deleting the >material from any computer. Ameren Corporation >******************************* > > > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > -- .Jarrod Manzer. .Network Team. .Go Daddy Group. .(480) 366 3631. .AIM: nejarrod. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ******************************* The information contained in this message may be privileged and/or confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. Note that any views or opinions presented in this message are solely those of the author and do not necessarily represent those of Ameren. All emails are subject to monitoring and archival. Finally, the recipient should check this message and any attachments for the presence of viruses. Ameren accepts no liability for any damage caused by any virus transmitted by this email. If you have received this in error, please notify the sender immediately by replying to the message and deleting the material from any computer. Ameren Corporation *******************************

1 0

Assessing reliability - did we get all messages?
by Cary, Kim 01 Jun '05

01 Jun '05

Hi folks, I'm trying to figure out whether we're getting all messages from a PIX into the mysql database. I've done some tests and everything syslog-ng is writing to disk is going to our db on the application server. Now I need to figure out if syslog-ng is getting everything (or nearly) from the PIX. Specifically my questions are: - Does 'garbage collecting while busy' imply I'm dropping packets? - Any suggestions for checking my UDP buffers on the syslog server? - I'd like to use TCP from the PIX > syslog-ng. Does that work? Its a little hard to test as this is a production system on our internet gateway. My understanding is that Pix logging via TCP will STOP the transmission of packets if the syslog server goes away, so, we may not want to do that with a single syslog server. Our setup is like this: Application server (mysql log database & web-based search interface - MacOS X Panther) ^ TCP ^ Syslog server (perl script (fisq.pl) parses input and sends via perl dbi) ^fifo pipe^ Syslog server (syslog-ng 1.6.4 from sunfreeware, Solaris 9 1.5G ) > file on local disk ^UDP^ Pix 520 The network run for the PIX > Syslog server link is dedicated 100Mbps full duplex. We get about 20Gb of syslog messages a day from that source. Here's what syslog-ng says about itself: May 31 22:27:11 logsrvr syslog-ng[347]: STATS: dropped 0 May 31 22:37:11 logsrvr syslog-ng[347]: STATS: dropped 0 May 31 22:45:14 logsrvr syslog-ng[347]: Garbage collecting while busy... May 31 22:45:17 logsrvr syslog-ng[347]: Objects alive: 240, garbage collected: 2999765 May 31 22:47:11 logsrvr syslog-ng[347]: STATS: dropped 0 May 31 22:57:11 logsrvr syslog-ng[347]: STATS: dropped 0 May 31 23:04:21 logsrvr syslog-ng[347]: Garbage collecting while idle... May 31 23:04:22 logsrvr syslog-ng[347]: Objects alive: 240, garbage collected: 665611 May 31 23:07:11 logsrvr syslog-ng[347]: STATS: dropped 0 May 31 23:17:11 logsrvr syslog-ng[347]: STATS: dropped 0 Here are our tuning options from syslog-ng.conf: options { use_fqdn(yes); sync(0); keep_hostname(yes); chain_hostnames(no); create_dirs(yes); log_fifo_size(100000); gc_busy_threshold(3000000); gc_idle_threshold(300); }; BTW, syslog-ng is 'the bomb'. I love what we can do with it more easily than stock syslog. Kim

3 2

RE: [syslog-ng] syslog-ng and windows
by SOLIS, ALEX 31 May '05

31 May '05

Just curious.... What would happen if TCP transmission was not terminated with an nl or nul char? Would TCP receive buffers fill up and kill communication on the server? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Monday, May 30, 2005 6:24 AM To: tilaris(a)wanadoo.fr; Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] syslog-ng and windows On Mon, 2005-05-30 at 11:08 +0200, JF Suret wrote: > Hello, > > I'm using syslog-ng as a central log server, and I have both linux and windows clients. I know that there are some syslog windows clients ( NTsyslog, snare) but I can't find any open source syslog-ng clients. > > What I'm looking for is (at least if it does not exist) information on the TCP data format used by syslog-ng. > So I could write a little udp to tcp syslog translator that could be used on windows clients (and maybe modify NTsyslog if I have enought time...) It is basically the same as UDP, the only exception is that messages has to be translated by an NL or NUL characters as otherwise there's no way to recognize message boundary. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

2 1

Question
by Alessandro Rocha 31 May '05

31 May '05

Hi All, Do you know if it is possible to redirect syslog logs to an oracle database ? If it is possible, do you know where i can find a how to ? Thanks in advance. Alessandro.

2 1

meaning internal message
by torpedo 31 May '05

31 May '05

Hi all, syslog-ng generates internal message => May 31 10:33:39 inter@abc syslog-ng[3841]: STATS: dropped 0 What does this message means ? Where can I find,what all internal messages does the syslog-ng generates and their meanings. thanks in advance. regards, torpedo

2 1

syslog-ng and windows
by JF Suret 30 May '05

30 May '05

Hello, I'm using syslog-ng as a central log server, and I have both linux and windows clients. I know that there are some syslog windows clients ( NTsyslog, snare) but I can't find any open source syslog-ng clients. What I'm looking for is (at least if it does not exist) information on the TCP data format used by syslog-ng. So I could write a little udp to tcp syslog translator that could be used on windows clients (and maybe modify NTsyslog if I have enought time...) Thanks JF

2 1

Re: [Filter Test: C10] Re: [syslog-ng] Program Filters
by Metal Gear 30 May '05

30 May '05

Hi, thank u guys for the help actually i missed two of posts of Mr. Nate following the instructions in the post have no problem. Now i have the logs that i wanted thanks again

1 0

Error logging to MySQL
by Colin O'Keeffe 29 May '05

29 May '05

I get syntax error at 132 Parse error reading configuratin file, exiting. (line 132) when i do syslog-ng start heres my config file.... # # Configuration file for syslog-ng under Debian # # attempts at reproducing default syslog behavior # the standard syslog levels are (in descending order of priority): # emerg alert crit err warning notice info debug # the aliases "error", "panic", and "warn" are deprecated # the "none" priority found in the original syslogd configuration is # only used in internal messages created by syslogd ###### # options options { # disable the chained hostname format in logs # (default is enabled) chain_hostnames(0); # the time to wait before a died connection is re-established # (default is 60) time_reopen(10); # the time to wait before an idle destination file is closed # (default is 60) time_reap(360); # the number of lines buffered before written to file # you might want to increase this if your disk isn't catching with # all the log messages you get or if you want less disk activity # (say on a laptop) # (default is 0) #sync(0); # the number of lines fitting in the output queue log_fifo_size(2048); # enable or disable directory creation for destination files create_dirs(yes); # default owner, group, and permissions for log files # (defaults are 0, 0, 0600) #owner(root); group(adm); perm(0640); # default owner, group, and permissions for created directories # (defaults are 0, 0, 0700) #dir_owner(root); #dir_group(root); dir_perm(0755); # enable or disable DNS usage # syslog-ng blocks on DNS queries, so enabling DNS may lead to # a Denial of Service attack # (default is yes) use_dns(no); # maximum length of message in bytes # this is only limited by the program listening on the /dev/log Unix # socket, glibc can handle arbitrary length log messages, but -- for # example -- syslogd accepts only 1024 bytes # (default is 2048) #log_msg_size(2048); }; ###### # sources # all known message sources source s_all { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) #unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); # use the above line if you want to receive remote UDP logging messages # (this is equivalent to the "-r" syslogd flag) # udp(); }; ###### # destinations # some standard log files destination df_auth { file("/var/log/auth.log"); }; destination df_syslog { file("/var/log/syslog"); }; destination df_cron { file("/var/log/cron.log"); }; destination df_daemon { file("/var/log/daemon.log"); }; destination df_kern { file("/var/log/kern.log"); }; destination df_lpr { file("/var/log/lpr.log"); }; destination df_mail { file("/var/log/mail.log"); }; destination df_user { file("/var/log/user.log"); }; destination df_uucp { file("/var/log/uucp.log"); }; # these files are meant for the mail system log files # and provide re-usable destinations for {mail,cron,...}.info, # {mail,cron,...}.notice, etc. destination df_facility_dot_info { file("/var/log/$FACILITY.info"); }; destination df_facility_dot_notice { file("/var/log/$FACILITY.notice"); }; destination df_facility_dot_warn { file("/var/log/$FACILITY.warn"); }; destination df_facility_dot_err { file("/var/log/$FACILITY.err"); }; destination df_facility_dot_crit { file("/var/log/$FACILITY.crit"); }; # these files are meant for the news system, and are kept separated # because they should be owned by "news" instead of "root" destination df_news_dot_notice { file("/var/log/news/news.notice" owner("news")); }; destination df_news_dot_err { file("/var/log/news/news.err" owner("news")); }; destination df_news_dot_crit { file("/var/log/news/news.crit" owner("news")); }; # some more classical and useful files found in standard syslog configurations destination df_debug { file("/var/log/debug"); }; destination df_messages { file("/var/log/messages"); }; # pipes # a console to view log messages under X destination dp_xconsole { pipe("/dev/xconsole"); }; # consoles # this will send messages to everyone logged in destination du_all { usertty("*"); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs VALUES('$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG');\n") template-escape(yes)); }; log {source; destination(d_mysql); }; ###### # filters # all messages from the auth and authpriv facilities filter f_auth { facility(auth, authpriv); }; # all messages except from the auth and authpriv facilities filter f_syslog { not facility(auth, authpriv); }; # respectively: messages from the cron, daemon, kern, lpr, mail, news, user, # and uucp facilities filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; # some filters to select messages of priority greater or equal to info, warn, # and err # (equivalents of syslogd's *.info, *.warn, and *.err) filter f_at_least_info { level(info..emerg); }; filter f_at_least_notice { level(notice..emerg); }; filter f_at_least_warn { level(warn..emerg); }; filter f_at_least_err { level(err..emerg); }; filter f_at_least_crit { level(crit..emerg); }; # all messages of priority debug not coming from the auth, authpriv, news, and # mail facilities filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; # all messages of info, notice, or warn priority not coming form the auth, # authpriv, cron, daemon, mail, and news facilities filter f_messages { level(info,notice,warn) and not facility(auth,authpriv,cron,daemon,mail,news); }; # messages with priority emerg filter f_emerg { level(emerg); }; # complex filter for messages usually sent to the xconsole filter f_xconsole { facility(daemon,mail) or level(debug,info,notice,warn) or (facility(news) and level(crit,err,notice)); }; ###### # logs # order matters if you use "flags(final);" to mark the end of processing in a # "log" statement # these rules provide the same behavior as the commented original syslogd rules # auth,authpriv.* /var/log/auth.log log { source(s_all); filter(f_auth); destination(df_auth); }; # *.*;auth,authpriv.none -/var/log/syslog log { source(s_all); filter(f_syslog); destination(df_syslog); }; # this is commented out in the default syslog.conf # cron.* /var/log/cron.log #log { # source(s_all); # filter(f_cron); # destination(df_cron); #}; # daemon.* -/var/log/daemon.log log { source(s_all); filter(f_daemon); destination(df_daemon); }; # kern.* -/var/log/kern.log log { source(s_all); filter(f_kern); destination(df_kern); }; # lpr.* -/var/log/lpr.log log { source(s_all); filter(f_lpr); destination(df_lpr); }; # mail.* -/var/log/mail.log log { source(s_all); filter(f_mail); destination(df_mail); }; # user.* -/var/log/user.log log { source(s_all); filter(f_user); destination(df_user); }; # uucp.* /var/log/uucp.log log { source(s_all); filter(f_uucp); destination(df_uucp); }; # mail.info -/var/log/mail.info log { source(s_all); filter(f_mail); filter(f_at_least_info); destination(df_facility_dot_info); }; # mail.warn -/var/log/mail.warn log { source(s_all); filter(f_mail); filter(f_at_least_warn); destination(df_facility_dot_warn); }; # mail.err /var/log/mail.err log { source(s_all); filter(f_mail); filter(f_at_least_err); destination(df_facility_dot_err); }; # news.crit /var/log/news/news.crit log { source(s_all); filter(f_news); filter(f_at_least_crit); destination(df_news_dot_crit); }; # news.err /var/log/news/news.err log { source(s_all); filter(f_news); filter(f_at_least_err); destination(df_news_dot_err); }; # news.notice /var/log/news/news.notice log { source(s_all); filter(f_news); filter(f_at_least_notice); destination(df_news_dot_notice); }; # *.=debug;\ # auth,authpriv.none;\ # news.none;mail.none -/var/log/debug log { source(s_all); filter(f_debug); destination(df_debug); }; # *.=info;*.=notice;*.=warn;\ # auth,authpriv.none;\ # cron,daemon.none;\ # mail,news.none -/var/log/messages log { source(s_all); filter(f_messages); destination(df_messages); }; # *.emerg * log { source(s_all); filter(f_emerg); destination(du_all); }; # daemon.*;mail.*;\ # news.crit;news.err;news.notice;\ # *.=debug;*.=info;\ # *.=notice;*.=warn |/dev/xconsole log { source(s_all); filter(f_xconsole); destination(dp_xconsole); }; iam running on Debain Sarge AMD64bit any idea whats wrong? -- Colin O'Keeffe

2 1