- syslog-ng - lists.balabit.hu

Reliable tcp logging
by Peter Daum 12 May '05

12 May '05

I am trying to send all important messages from a bunch of other machines to a central syslog-ng server via tcp. I chose tcp partly, because the same log server gets all kinds of less important stuff via udp from other machines, which can easily be distinguished that way, but partially also because I expected tcp to be more reliable. Unfortunately, this does not seem to be the case: When the connection has died for any reason, the client will only discover this when it is trying to send the next message to the server. Only then it starts to wait until "time_reopen" is over and establishes a new connection - the message that originally triggered this and whatever comes in between is lost. Is there any way to get syslog-ng (v 1.6.5) to check more often whether a tcp connection to a log host still exists and re-establish it otherwise? I did not see any reference to this in the documentation, but this seems to happen every 2 hours. Setting "tcp-keep-alive(yes)" does not seem to make it any better. I also discovered that version 1.6.7 has a new option "log_fifo_size" which sounded promising but setting this to a higher value also does not seem to have any influence on this issue. Regards, Peter Daum

5 6

"above message repeats"
by Andrew Morris 11 May '05

11 May '05

One of the messages I'm getting (I'm sorting messages by hostname) is the "above message repeats n times" message, but syslog-ng is logging this under the host "above". Shouldn't syslog-ng decide what the hostname is by the ip address it is connected from? eg: host A connects, syslog-ng looks up the host by it's connecting ip address and uses that name resolution as the $HOST variable? (Note, in this case all hosts are in a local hosts file) So, why would it ever write to the file "above"? Is this a bug, or am I missing something? As per my previous messages, here's a quick rundown of the config: (used with 1.6.7) options { # Don't trust the sender to supply a hostname. keep_hostname(no); # Don't track relayed messages. chain_hostnames(no); # Make sure the hostnames have valid characters. check_hostname(yes); # Since we're only tracking local hosts, don't worry about the fqdn. use_fqdn(no); # As soon as we get the log entry, write it to disk. sync(0); # Set the fifo size to 1024 lines. log_fifo_size(1024); # Increase the log_msg_size to 8192 bytes. log_msg_size(8192); # If we need a directory and it doesn't exist, create it and use # the permissions shown below. create_dirs(yes); perm(0644); dir_perm(0755); # Use an internal dns cache, but don't use any dns lookups. dns_cache(yes); use_dns(no); }; source localsyslog {unix-stream("/dev/log");}; source kernellog {file("/proc/kmsg");}; source intsyslog {internal();}; source extsyslog {udp();}; destination syslog-ng {file("/logs/syslog-ng");}; destination messages {file("/var/log/messages");}; destination kernmessages {file("/var/log/kernel");}; destination hosts { file("/logs/hosts/$YEAR-$MONTH/$HOST" template("$DATE $HOST $MESSAGE\n") template_escape(yes) ); } ; destination services { file("/logs/services/$YEAR-$MONTH/$PROGRAM" template("$DATE $HOST $MESSAGE\n") template_escape(yes) ); }; filter levelfilter { level(info..emerg); }; log { source(intsyslog); destination(syslog-ng); }; log { source(localsyslog); filter(levelfilter); destination(messages);}; log { source(kernellog); destination(kernmessages);}; log { source(extsyslog); source(localsyslog); destination(hosts); }; log { source(extsyslog); source(localsyslog); destination(services); };

2 2

Minor Compile Issue
by Andrew Morris 11 May '05

11 May '05

Just a minor compiling issue for version 1.6.7 (actually it's been there for a while...). If I want to put the syslog-ng.conf file in a different location, I use the --sysconfdir option to configure. The problem is the configure.in file automatically adds "/syslog-ng" on to the end of whatever I put in. I have no problem with it doing this by default, but if I go through the effort of using --sysconfdir, then the configure script should do what it's told (even if that's thought to be wrong by some). Since syslog-ng only uses one conf file, I'd rather put it directly under /etc... My fix so far is to go and comment out that line before I run configure, but that's just a quick hack. Oh, and just before someone says otherwise, configure modifies some .h files and there's no way (that I know of anyways - please correct me if I'm wrong) to override those settings via make. I'm not asking anyone to change the defaults, but is it possible to either: 1) Add another option to configure to handle the subdirectory? eg: --sysconfsubdir or something like this? (eg: the default would end up being $PREFIX/$SYSCONFDIR/$SYSCONFSUBDIR/syslog-ng.conf) 2) If --sysconfdir is specified, use whatever it is set to. Otherwise use $PREFIX/etc/syslog-ng

2 2

klogctl: Invalid argument
by micah milano 11 May '05

11 May '05

Hello, Whenever I stop/start/restart syslog-ng, I see the entirity of my kernel buffer spit onto the screen, as well as the following message sent to STDERR: klogctl: Invalid argument I cannot figure out where this comes from, I do not have a program called klogctl on my system, and I've looked through the syslog-ng sources to see if I could find anything there, and I can only find an item in the NEWS file: ChangeLog: * utils/klogctl.c: New file to control kernel log level NEWS: * Added klogctl program to control kernel logging level on Linux but there is no utils/ folder at all, nor is there anything else related to klogctl. Thanks! micah

2 2

Re: [syslog-ng]Pix problem
by Ben Whittaker 11 May '05

11 May '05

This is from my config. # PIX # source network { udp () ; tcp (); }; log{source(net);filter(f_pix);destination(pixlog);}; destination pixlog { file("/var/log/pix.log"); }; filter f_pix { facility(local4); }; And on my PIX logging on logging timestamp logging buffered notifications logging trap notifications logging queue 1024 logging host inside 10.x.x.x no logging message 106001 no logging message 106023 --- Damien Michau <d.michau(a)ag.com> wrote: > Hi All ! > I have some probleme ta log my pix's log into my > syslog-ng server . > i have mounted a Syslog-ng server to store my pix's > log . But there is nothing in my pix.log > i'have put this lines in my syslog-ng.conf > > > source pix { udp(ip(10.60.10.111) port());}; > destination pix { file("/var/log/pix.log"); }; > log { source(pix);destination(pix); }; > > > Have you one idea ? > > Thx > > Damien Michau > Paris Discover Yahoo! Use Yahoo! to plan a weekend, have fun online and more. Check it out! http://discover.yahoo.com/

3 5

More fun with hostnames....
by Andrew Morris 10 May '05

10 May '05

I've been using syslog-ng for a little while and so far I like what I see, but I'm confused over the hostname options in the config file. Yes, I've read the man pages/FAQ, but I guess I'm still not getting it. I'm going to send each issue as a separate message so the answers can easily be tracked in the archives for others...

1 0

Logging to Oracle - Quoting issue
by André Bonhôte 10 May '05

10 May '05

Hi! I have already written a mail to info(a)balabit.hu today, but I am impatient. Forgive me please! We have an issue when logging to Oracle. Obviously, Oracle requires a single quote to be quoted by a single quote. I have found this [1] article about it. Since it's 2005 now, I'd like to know whether this one is fixed in the latest version or not. I have 1.6.2 running in production now on a few machines. I didn't find anything in the Changelog about this, unfortunately. Could someone give me a hint? Thanks IA André [1] https://lists.balabit.hu/pipermail/syslog-ng/2003-November/ 005510.html ___ ___ ___ ___ \C/ \O/ \L/ \T/ Andre Bonhote t: +41 (0)44 5 600 600 V V V V Platform Infrastructure f: +41 (0)44 5 630 501 we make business Senior IP Engineer straight.forward COLT Telecom e: andre(a)colt.net

2 3

Re: Re: [syslog-ng]Syntax error in default config?
by jbrunke＠ctsgi.com 06 May '05

06 May '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

1 0

Re: [syslog-ng]Syntax error in default config?
by jbrunke＠ctsgi.com 05 May '05

05 May '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

1 0

RE: Issues with HP-UX
by Jenny-Lou Sequeira 05 May '05

05 May '05

I have used the following syslog-ng config file on HP-UX 11.23 (syslog-ng 1.6.6) and have not seen any problem : options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; # Source source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; # Destination destination d_mesg { file("/var/adm/syslog/syslog-ng/syslog.log"); }; destination d_mail { file("/var/adm/syslog/syslog-ng/mail.log"); }; destination d_cons { file("/dev/console"); }; destination d_mail { file("/var/adm/syslog/syslog-ng/mail.log"); }; destination d_cons { file("/dev/console"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; # Filter filter f_filter1 { facility(mail) and level(debug .. emerg); }; filter f_filter2 { level(info .. emerg) and not facility(mail); }; filter f_filter3 { level(alert .. emerg); }; filter f_filter4 { level(emerg); }; # Log log { source(s_sys); filter(f_filter1); destination(d_mail); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_cons); destination(d_mlrt); }; log { source(s_sys); filter(f_filter4); destination(d_mlal); }; Note : If your destination directories do not exist you need the "create_dirs (yes);" in the options. Also, make sure that syslogd is stopped. I used the following test program, and all messages show up in /var/adm/syslog-ng/mail.log and /var/adm/syslog/syslog.log resp. ( #!/usr/bin/sh echo "Testing mail" logger -p mail.debug "test mail debug" logger -p mail.info "test mail info" logger -p mail.notice "test mail notice" logger -p mail.warning "test mail warning" logger -p mail.err "test mail err" logger -p mail.crit "test mail crit" logger -p mail.alert "test mail alert" logger -p mail.emerg "test mail emerg" echo "Testing syslog" logger -p auth.debug "test syslog debug" logger -p user.info "test syslog info" logger -p auth.notice "test syslog notice" logger -p news.warning "test syslog warning" logger -p daemon.err "test syslog err" logger -p lpr.crit "test syslog crit" logger -p cron.alert "test syslog alert" logger -p kern.emerg "test syslog emerg" Jenny-Lou Sequeira

1 0

Multi-line log entries
by yesenia_rincon＠bankone.com 04 May '05

04 May '05

Are you aware of any issues where on the local host the multi-line messages include the hostname and syslog-ng does not include the hostname, is there a configuration option to resolve this problem ? Apr 23 00:00:05 img4s012.svr.bankone.net/img4s012.svr.bankone.net scsi: [ID 107833 kern.warning] WARNING: /pci@8,700000/pci@2/ lpfc@5/sd@0,de (sd98): Apr 23 00:00:05 img4s012.svr.bankone.net/img4s012.svr.bankone.net corrupt label - wrong magic number This is how the event shows in syslog-ng: Apr 23 00:00:05 img4s012.svr.bankone.net/img4s012.svr.bankone.net scsi: [ID 107833 kern.warning] WARNING: /pci@8,700000/pci@2/ lpfc@5/sd@0,de (sd98): Apr 23 00:00:05 corrupt label - wrong magic number Regards, Jessie This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you.

2 1

Shiming Yang/OCIO_CorpDataSecurity/Planning_Office/HQ_for_the_Americas/BTMNA is out of the office.
by Shiming Yang 04 May '05

04 May '05

I will be out of the office starting 05/03/2005 and will not return until 05/05/2005. I will respond to your message when I return. If there is problem about Proxy or IBM web hosting facility, please call my backup Will at 8380. ----------------------------------------- The information contained in this electronic mail message, and any and all accompanying documents, constitutes confidential information. If you are not the intended recipient of this information, any disclosure, copying, distribution, or the taking of any action in reliance on it is strictly prohibited. If you received this information in error, please notify the sender immediately and destroy this communication. Messages sent via this medium may be subject to delays and/or unauthorized alteration. Neither The Bank of Tokyo-Mitsubishi, Ltd. nor any of its affiliates shall be held liable for the contents of this message.

1 0

a weird configuration
by Julio Kriger 04 May '05

04 May '05

Hi! I a need to setup a weird configuration of syslog-ng and I don't know how to do it. Please help me!!! So, here is my problem. I have 2 programs, say A and B. I have metalog configure so that program A write logs a file called log_A, and program B write logs to log_B. This is the easy part. Now the real problem. I have a kernel module K that is used by both programs that also write some logs. I want that the logs written by kernel module K when used by program A go to log_A file. The same with program B, logs should go log_B. How can I do this? TIA. Regards, Julio -- ------------------------ Julio Kriger mailto:julio@cwazy.co.uk

2 7

Cisco formatting
by Erwin Middelberg 04 May '05

04 May '05

Hi All, I'm rather new to syslog-ng and have a question I couldn't find answers for, searching on the web. We're using syslog-ng (1.5.15) as a central relay server for several Cisco devices, were the devices sent their syslogs to the syslog-ng server and syslog-ng forwards them to my Netcool monitoring environment. A problem I'm running into, is that some Cisco messages contain carriage returns, splitting one message over 2 or more lines. I could do some tricks on the Netcool side, but it would be much cleaner if I could filter those CR's within syslog-ng. Is this possible ? TIA, Erwin

1 0

Re: Re: [syslog-ng]a weird configuration
by jbrunke＠ctsgi.com 04 May '05

04 May '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

1 0

Possible segmentation fault in syslog-ng
by Balazs Scheidler 03 May '05

03 May '05

Hi, I have finally been able to track down a nasty segmentation fault/abort problem. The fix can be found in libol 0.3.16, which is statically linked into syslog-ng. Therefore to grab the fix, you need to recompile syslog-ng with the new libol. The problem occurs when: * internal() messages were directed to a file which had a name with macros in it * you had one or more TCP sources which close their connections from time to time (Kiwi syslogd is such a program) * the volume of the log messages is very low in this destination, in fact it might be required that nothing else but TCP connection close messages are received here, and less often than the interval time_reap() specifies. How to reproduce: * Use the following configuration: options { time_reap(1); gc_idle_threshold(1); }; source src { unix-stream("log"); internal(); }; source net { tcp(port(2000)); }; destination d_local { file("logs/messages.$YEAR.$HOST.$DAY"); }; destination d_net { file("logs/net.log"); }; log { source(src); destination(d_local); }; log { source(net); destination(d_net); }; * Create the directory containing the log files "logs" * Start syslog-ng * Connect to port 2000 using telnet, wait somewhat more than 1 second * Wait while garbage collection starts (should be immediately as gc_idle_threshold() is set to 1) Syslog-ng will crash with Segmentation fault or an Abort. Thanks go to Janos Lajos who has reported and helped me to track down the issue. Libol 0.3.16 is available at: http://www.balabit.hu/downloads/syslog-ng/libol/0.3/libol-0.3.16.tar.gz PGP signature: http://www.balabit.hu/downloads/syslog-ng/libol/0.3/libol-0.3.16.tar.gz.asc -- Bazsi

1 0

RE: [syslog-ng]RE: Recommended windows event logger products to work with syslog-ng
by SOLIS, ALEX 03 May '05

03 May '05

I don't think you did anything wrong. When I installed my ntsyslog, it worked fine. You might want to try ntsyslog in debug mode. You can do this by running ntsyslog -debug at the command line. This will show what is being sent over the wire on your console. If your time-stamps are missing during the debug output then ntsyslog might be parsing incorrectly. If they show in the debug output but are missing at the syslog-ng server, then maybe the syslog-ng config should be looked at. There are patches available at the sourceforge project site. I believe one of them is specifically designed to fix "incomplete messages"; Its worth a try if you are out of ideas but like I said before, I did not experience missing timestamps when I deployed. In my experience with NTsyslog, most messages fit in the message buffer ntsyslog sets aside for transmission. I believe the buffer size is set around 1024 so it should accommodate most WinNT eventlog messages. Good luck troubleshooting! Alex -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Shane Presley Sent: Monday, May 02, 2005 8:41 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]RE: Recommended windows event logger products to work with syslog-ng I installed nt-syslog (http://ntsyslog.sorceforge.net) but it seems the messages coming from it do not contain the date/time field? Is that just somethind I did wrong? Also, in general, with these EventLog -> Syslog products, do they capture the entire event log message? For example the sometimes verbose "Description" field? Thanks Shane On 4/21/05, SOLIS, ALEX <asolis(a)oppd.com> wrote: > > I use nt-syslog (http://ntsyslog.sorceforge.net) It seems to work fine although I too get corrupt event logs on the windows boxes every now and then. I am not 100 percent convinced that it is caused by nt-syslog but it seems to be a posibility. > > Alex _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

RE: [syslog-ng]Issues with HP-UX
by Stephen Tanner 03 May '05

03 May '05

This does not work. Syslog-ng still does not log anything. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Stephan Hendl Sent: Tuesday, May 03, 2005 7:59 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Issues with HP-UX your source should look the following source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; the pad_size ist very important. BTW, it is included in the doku as well as in the faq I think. regards Stephan >>> stanner(a)leeclerk.org 05/02/05 9:23 >>> I have recently started using syslog-ng so that I can use stunnel to log to a central loghost. I have gotten syslog-ng working on a linux box, and everything works fine, but my HP-UX boxes won't even log locally, much less log to a loghost. Below, I have included the syslog-ng.conf for one of the hosts. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= options { use_fqdn(no); keep_hostname(no); use_dns(no); long_hostnames(off); sync(3); log_fifo_size(300); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # source src { unix-dgram("/dev/log.un"); internal(); }; # After that set destinations. # First some standard logfile # destination lpr { file("/var/adm/lpr.log"); }; destination mail { file("/var/adm/mail.log"); }; # Some `catch-all' logfiles. # destination syslog { file("/var/adm/syslog/syslog.log"); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { level(info .. warn)and not facility(auth, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; ############################################################### log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_messages); destination(syslog); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); destination(messages); }; ############################################################### ## set up logging to a loghost forwarded from localhost via stunnel destination loghost {tcp("127.0.0.1" port(514));}; # send everything to loghost, too log { source(src); destination(loghost); }; ############################################################### _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng 1.6.7 on solaris10
by kenneth.gullberg＠foreningssparbanken.se 03 May '05

03 May '05

Im having some compilation issues with Solaris 10: bash-3.00# ./configure --disable-tcp-wrapper --disable-spoof-source -- snip-- checking for TCP wrapper library... -lwrap checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking for pthread_create in -lpthread... yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... no checking libol version >= 0.3.14... ok configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating src/tests/Makefile config.status: creating doc/Makefile config.status: creating doc/sgml/Makefile config.status: creating contrib/Makefile config.status: creating syslog-ng.spec config.status: creating src/config.h config.status: executing depfiles commands bash-3.00# which make /usr/ccs/bin/make gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lpthread -lnsl -lsocket -ldoor -lresolv /usr/local/lib/libol.a -lsocket -lnsl -lxnet -Wl,-Bstatic -ll -lwrap -Wl,-Bdynamic ld: fatal: library -ll: not found ld: fatal: library -lwrap: not found ld: fatal: File processing errors. No output written to syslog-ng if i change where -ll and -lwrap is located on the line to: bash-3.00# gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lpthread -lnsl -lsocket -ldoor -lresolv -ll -lwrap /usr/local/lib/libol.a -lsocket -lnsl -lxnet -Wl,-Bstatic -Wl,-Bdynamic I instead get: Undefined first referenced symbol in file deny_severity /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/../../../libwrap.so allow_severity /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/../../../libwrap.so ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status I got around that with editing config.h and changed the TCP wrapper lib line to: #undef ENABLE_TCP_WRAPPER and fiddled around in the src/tests Makefile and .c file Perhaps something missing in the configure scripts?

2 1

Re: Re: [syslog-ng]Issues with HP-UX
by jbrunke＠ctsgi.com 03 May '05

03 May '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

1 0

Re: [syslog-ng]Issues with HP-UX
by Stephan Hendl 03 May '05

03 May '05

your source should look the following source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; the pad_size ist very important. BTW, it is included in the doku as well as in the faq I think. regards Stephan >>> stanner(a)leeclerk.org 05/02/05 9:23 >>> I have recently started using syslog-ng so that I can use stunnel to log to a central loghost. I have gotten syslog-ng working on a linux box, and everything works fine, but my HP-UX boxes won't even log locally, much less log to a loghost. Below, I have included the syslog-ng.conf for one of the hosts. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= options { use_fqdn(no); keep_hostname(no); use_dns(no); long_hostnames(off); sync(3); log_fifo_size(300); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # source src { unix-dgram("/dev/log.un"); internal(); }; # After that set destinations. # First some standard logfile # destination lpr { file("/var/adm/lpr.log"); }; destination mail { file("/var/adm/mail.log"); }; # Some `catch-all' logfiles. # destination syslog { file("/var/adm/syslog/syslog.log"); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { level(info .. warn)and not facility(auth, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; ############################################################### log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_messages); destination(syslog); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); destination(messages); }; ############################################################### ## set up logging to a loghost forwarded from localhost via stunnel destination loghost {tcp("127.0.0.1" port(514));}; # send everything to loghost, too log { source(src); destination(loghost); }; ###############################################################

1 0

RE: [syslog-ng]RE: Recommended windows event logger products to work with syslog-ng
by SOLIS, ALEX 03 May '05

03 May '05

I use nt-syslog (http://ntsyslog.sorceforge.net) It seems to work fine although I too get corrupt event logs on the windows boxes every now and then. I am not 100 percent convinced that it is caused by nt-syslog but it seems to be a posibility. Alex -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu on behalf of Bill Nash Sent: Thu 4/21/2005 5:46 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]RE: Recommended windows event logger products to work with syslog-ng We're using Snare. Haven't seen any problems at all with it. It provides fairly detailed logs. - billn On Thu, 21 Apr 2005, Adams, Russell L. wrote: > We're using Event Reporter. > > Only problem we've had is a corrupt event log caused it to repeatedly > send the few hours messages nonstop. > > Russell > > On Thu, Apr 21, 2005 at 10:54:32AM +0100, Stevan Popovic wrote: >> >> Hello >> >> I have configured syslog-ng to work on my linux box. >> >> I am wondering does anyone use syslog-ng to log windows event logs. If so which products from the windows side are used? >> >> TIA >> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

Issues with HP-UX
by Stephen Tanner 02 May '05

02 May '05

I have recently started using syslog-ng so that I can use stunnel to log to a central loghost. I have gotten syslog-ng working on a linux box, and everything works fine, but my HP-UX boxes won't even log locally, much less log to a loghost. Below, I have included the syslog-ng.conf for one of the hosts. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= options { use_fqdn(no); keep_hostname(no); use_dns(no); long_hostnames(off); sync(3); log_fifo_size(300); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # source src { unix-dgram("/dev/log.un"); internal(); }; # After that set destinations. # First some standard logfile # destination lpr { file("/var/adm/lpr.log"); }; destination mail { file("/var/adm/mail.log"); }; # Some `catch-all' logfiles. # destination syslog { file("/var/adm/syslog/syslog.log"); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { level(info .. warn)and not facility(auth, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; ############################################################### log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_messages); destination(syslog); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); destination(messages); }; ############################################################### ## set up logging to a loghost forwarded from localhost via stunnel destination loghost {tcp("127.0.0.1" port(514));}; # send everything to loghost, too log { source(src); destination(loghost); }; ###############################################################

1 0

Change the facility of forwarded message using syslog-ng is it possible?
by Subodh Nijsure 02 May '05

02 May '05

Hello, I have system where lot of different machines are forwarding me messages with facility of local6 what I want to do is forward them on but change the facility to say local1 when sending it to an udp destination. Is this possible using syslog-ng. I have gone through all the log but couldn't find any of doing this, is it possible to change facility of incoming message using syslog-ng? /Subodh Nijsure

2 2

Re: [syslog-ng]Change the facility of forwarded message using syslog-ng is it possible?
by jbrunke＠ctsgi.com 02 May '05

02 May '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

2 1