- syslog-ng - lists.balabit.hu

incoming message stats
by Jim 01 Apr '05

01 Apr '05

Hello, I would like to get some stats on the number of incoming messages I am receiving on a central log server. I am running syslog-ng 1.6.6, built with libol 0.3.15. From what I can see, I will need to modify libol in order for syslog-ng to count these messages, and tell me at a regular interval. Does this sound right, or am I missing another simple way to do this? assuming I have to modify source, it looks like I can just add a counter to the do_write_str() function in pkt_buffer.c that looks something like this: if (self->queue_size == self->queue_max) { /* fifo full */ pktbuf_dropped_pkts++; ol_string_free(string); return ST_FAIL | ST_OK; } else { struct buffer_node *item; --> pktbuf_recved_pkts++; NEW_SPACE(item); item->packet = string; ol_queue_add_tail(&self->queue, &item->header); if (++self->queue_size == self->queue_max && self->super.writable) (*self->super.writable) = 0; } the "-->" indicates the new line. Pretty much all I did was copy where the "pktbuf_dropped_pkts" was, and added in my variable. The numbers that I get when I run with this don't appear to totally match up with what I expect, but is fairly close. Is this the right place to insert a counter to count total syslog messages recieved over the network (from both TCP and UDP sources). If not, can someone point me in a different direction? thanks! Mike

1 0

RE: [syslog-ng]ld: cannot find -levtlog
by Philipp Snizek 01 Apr '05

01 Apr '05

> > gcc -g -O2 -Wall -g -o syslog-ng main.o misc.o utils.o > messages.o > > gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o > logpipe.o driver.o > > sgroup.o dgroup.o center.o filter.o logsource.o logreader.o > > logwriter.o affile.o afunix.o afinet.o afsocket.o > afstreams.o afuser.o > > afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o > > memtrace.o templates.o children.o -lnsl -Wl,-static -lfl > > -L/usr/local/lib -lglib-2.0 -levtlog -Wl,-call_shared > > > /usr/lib/gcc-lib/i486-slackware-linux/3.3.4/../../../../i486-slackware > > -linux/bin/ld: cannot find -levtlog > > collect2: ld returned 1 exit status > > > hmm. for some reason eventlog did not install a static > library which it should. my version certainly installs a > static version, and it is dubbed 0.2.3, upgrading might solve > your problem. I just have tried 0.2.3. I'm getting this when running 'make' in the syslog-ng src dir. gcc -g -O2 -Wall -g -o syslog-ng main.o misc.o utils.o messages.o gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o driver.o sgroup.o dgroup.o center.o filter.o logsource.o logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o afstreams.o afuser.o afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o children.o -lnsl -Wl,-static -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -Wl,-call_shared afinter.o(.text+0x16): In function `afinter_source_prepare': /root/syslog-ng-1.9.3/src/afinter.c:35: undefined reference to `g_queue_get_length' afinter.o(.text+0x3e): In function `afinter_source_check': /root/syslog-ng-1.9.3/src/afinter.c:41: undefined reference to `g_queue_get_length' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/root/syslog-ng-1.9.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/syslog-ng-1.9.3' make: *** [all] Error 2 > ps: be sure to use the latest snapshot as 1.9.3 is known to > be broken in macro expansion I'm using the latest snapshot. Thank you Philipp

1 0

ld: cannot find -levtlog
by Philipp Snizek 01 Apr '05

01 Apr '05

When compiling syslog-1.9.3 I get "ld: cannot find -levtlog" If evtlog means the eventlog libraries from eventlog-0.2.2, they're located in /usr/local/lib (that's what the installation rouine sais). /usr/local/lib is in /etc/ld.so.conf and I ran ldconfig. I could install eventlog-0.2.2 without problems. The exact error message: gcc -g -O2 -Wall -g -o syslog-ng main.o misc.o utils.o messages.o gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o driver.o sgroup.o dgroup.o center.o filter.o logsource.o logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o afstreams.o afuser.o afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o children.o -lnsl -Wl,-static -lfl -L/usr/local/lib -lglib-2.0 -levtlog -Wl,-call_shared /usr/lib/gcc-lib/i486-slackware-linux/3.3.4/../../../../i486-slackware -linux/bin/ld: cannot find -levtlog collect2: ld returned 1 exit status Thanks again Philipp

2 1

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Ryan McCain 01 Apr '05

01 Apr '05

Final question (for now). Should i use "unix_stream" or "unix_dgram" w/in the source setting? I read in the Linux Server Security book that I should use unix_dgram on newer kernels. I'm on kernel 2.6.x Thanks, Ryan >>>billn(a)billn.net 03/31 10:55 am >>> On Thu, 31 Mar 2005, Ryan McCain wrote: >source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); >unix_stream("/dev/log"); internal(); }; > >destination hosts { >file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" >owner(root) group(root) perm(0755) dir_perm(0755) create_dirs(yes)); >}; > >log { source(s_sys); destination(hosts); }; > Yup. Should work like a champ. It's very similiar to a larger deployment I'm using. - billn syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]ld: cannot find -levtlog
by Philipp Snizek 01 Apr '05

01 Apr '05

> When compiling syslog-1.9.3 I get "ld: cannot find -levtlog" > > If evtlog means the eventlog libraries from eventlog-0.2.2, > they're located in /usr/local/lib (that's what the > installation rouine sais). > /usr/local/lib is in /etc/ld.so.conf and I ran ldconfig. I > could install eventlog-0.2.2 without problems. > > The exact error message: > > gcc -g -O2 -Wall -g -o syslog-ng main.o misc.o utils.o messages.o > gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o > driver.o sgroup.o dgroup.o center.o filter.o logsource.o > logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o > afstreams.o afuser.o afprog.o afinter.o cfg-lex.o > cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o > children.o -lnsl -Wl,-static -lfl > -L/usr/local/lib -lglib-2.0 -levtlog -Wl,-call_shared > /usr/lib/gcc-lib/i486-slackware-linux/3.3.4/../../../../i486-slackware > -linux/bin/ld: cannot find -levtlog > collect2: ld returned 1 exit status in /usr/local/lib I have: -rwxr-xr-x 1 root root 807 2005-04-01 09:18 libevtlog.la* lrwxrwxrwx 1 root root 18 2005-04-01 09:18 libevtlog.so -> libevtlog.so.0.0.0* lrwxrwxrwx 1 root root 18 2005-04-01 09:18 libevtlog.so.0 -> libevtlog.so.0.0.0* -rwxr-xr-x 1 root root 93600 2005-04-01 09:18 libevtlog.so.0.0.0* When running ./configure in the syslog-ng source dir I get for evtlog checking EVTLOG_CFLAGS... -I/usr/local/include/eventlog checking EVTLOG_LIBS... -levtlog the libs are in /usr/local/lib is this the problem? If yes, how can I change this? Thanks PHilipp

1 0

RE: [syslog-ng]config file
by Ryan McCain 31 Mar '05

31 Mar '05

Im about to lose my mind. I've been starting at this config file all day. I now get an error on line 41 when trying to run syslog. Here is line 41: source net_hosts {tcp(port(5140) keep-alive(yes)); }; I also source this in my config file. Not sure if it makes a difference or not: source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; ...What am I missing?? Ryan >>>JMSmith(a)newcorp.com 03/31 1:45 pm >>> This is my server config file: # # Syslog-ng configuration file. Originally written by anonymous (I can't find # his name) Revised, and rewrited by me (SZALAY Attila <sasa(a)debian.org>) # revised again by Nate Campi <nate at campin dot net> ############################################################### # First, set some global options. options { #use_fqdn(yes); #use_dns(yes); #dns_cache(yes); create_dirs (yes); keep_hostname(yes); long_hostnames(on); sync(1); log_fifo_size(1024); use_dns (yes); }; ############################################################### # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-stream("/dev/log"); internal(); }; source src { #don't read from /proc/kmsg and run klogd also (Linux) #pipe("/proc/kmsg"); #file("/proc/kmsg") log_prefix("kernel: "); sun-streams("/dev/log" door("/etc/.syslog_door")); #unix-stream("/dev/log"); #unix-stream("/chroot/named/dev/log"); internal(); #udp(); #udp(ip("10.0.5.8") port(514)); #tcp(port(5140) keep-alive(yes)); #tcp(ip("10.9.9.3") port(5140) keep-alive(yes)); }; source net { tcp(port(5140) keep-alive(yes) max_connections(100)); }; ############################################################### # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log"); }; destination bootlog { file("/var/log/boot.log"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination debug { file("/var/log/debug"); }; destination explan { file("/var/log/explanations"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination messages { file("/var/adm/messages"); }; destination routers { file("/var/log/routers.log"); }; destination secure { file("/var/log/secure"); }; destination spooler { file("/var/log/spooler"); }; destination syslog { file("/var/log/syslog"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination mail { file("/var/log/mail.log"); }; destination maillog { file("/var/log/maillog"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty8"); }; filter f_attack_alert { match("attackalert"); }; filter f_ssh_login_attempt { program("sshd.*") and match("(Failed|Accepted)") and not match("Accepted (hostbased|publickey) for (root|zoneaxfr) from (10.4.3.1)"); }; #filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth) and not facility(mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; #filter f_general { facility(*); }; #filter f_news { facility(news); }; filter f_debug { not facility(auth, mail); }; filter f_messages { level(info .. warn) and not facility(auth, cron, daemon, mail); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; #filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; ############################################################### # # log statements actually send logs somewhere, to a file, across the network, etc # #log { source(src); filter(f_authpriv); destination(authlog); }; #log { source(src); filter(f_authpriv); destination(syslog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_daemon); destination(messages); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_kern); destination(messages); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_user); destination(messages); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); destination(maillog); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; #log { source(src); filter(f_news); filter(f_err); destination(newserr); }; #log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_general); destination(messages); }; log { source(src); filter(f_cother); destination(messages); }; destination net_authlog { file("/uag/HOSTS/$HOST/auth.log"); }; destination net_bootlog { file("/uag/HOSTS/$HOST/boot.log"); }; destination net_cron { file("/uag/HOSTS/$HOST/cron.log"); }; destination net_daemon { file("/uag/HOSTS/$HOST/daemon.log"); }; destination net_debug { file("/uag/HOSTS/$HOST/debug"); }; destination net_explan { file("/uag/HOSTS/$HOST/explanations"); }; destination net_kern { file("/uag/HOSTS/$HOST/kern.log"); }; destination net_lpr { file("/uag/HOSTS/$HOST/lpr.log"); }; destination net_messages { file("/uag/HOSTS/$HOST/messages"); }; destination net_routers { file("/uag/HOSTS/$HOST/routers.log"); }; destination net_secure { file("/uag/HOSTS/$HOST/secure"); }; destination net_spooler { file("/uag/HOSTS/$HOST/spooler"); }; destination net_syslog { file("/uag/HOSTS/$HOST/syslog"); }; destination net_user { file("/uag/HOSTS/$HOST/user.log"); }; destination net_uucp { file("/uag/HOSTS/$HOST/uucp.log"); }; # This files are the log come from the mail subsystem. # destination net_mail { file("/uag/HOSTS/$HOST/mail.log"); }; destination net_maillog { file("/uag/HOSTS/$HOST/maillog"); }; destination net_mailinfo { file("/uag/HOSTS/$HOST/mail.info"); }; destination net_mailwarn { file("/uag/HOSTS/$HOST/mail.warn"); }; destination net_mailerr { file("/uag/HOSTS/$HOST/mail.err"); }; destination net_console { usertty("root"); }; destination net_console_all { file("/dev/tty8"); }; destination net_dump { file("/uag/HOSTS/dump2/syslog"); }; filter net_f_attack_alert { match("attackalert"); }; filter net_f_ssh_login_attempt { program("sshd.*") and match("(Failed|Accepted)") and not match("Accepted (hostbased|publickey) for (root|zoneaxfr) from (10.4.3.1)"); }; filter net_f_syslog { not facility(auth) and not facility(mail); }; filter net_f_cron { facility(cron); }; filter net_f_daemon { facility(daemon); }; filter net_f_kern { facility(kern); }; filter net_f_lpr { facility(lpr); }; filter net_f_mail { facility(mail); }; filter net_f_user { facility(user); }; filter net_f_uucp { facility(cron); }; #filter net_f_general { facility(*); }; filter net_f_debug { not facility(auth, mail); }; filter net_f_messages { level(info .. warn) and not facility(auth, cron, daemon, mail); }; filter net_f_emergency { level(emerg); }; filter net_f_info { level(info); }; filter net_f_notice { level(notice); }; filter net_f_warn { level(warn); }; filter net_f_crit { level(crit); }; filter net_f_err { level(err); }; filter net_f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; ############################################################### # # log statements actually send logs somewhere, to a file, across the network, etc # #log { source(net); filter(net_f_authpriv); destination(net_authlog); }; #log { source(net); filter(net_f_authpriv); destination(net_syslog); }; log { source(net); filter(net_f_syslog); destination(net_syslog); }; log { source(net); filter(net_f_cron); destination(net_cron); }; log { source(net); filter(net_f_daemon); destination(net_daemon); }; log { source(net); filter(net_f_daemon); destination(net_messages); }; log { source(net); filter(net_f_kern); destination(net_kern); }; log { source(net); filter(net_f_kern); destination(net_messages); }; log { source(net); filter(net_f_lpr); destination(net_lpr); }; log { source(net); filter(net_f_mail); destination(net_mail); }; log { source(net); filter(net_f_user); destination(net_user); }; log { source(net); filter(net_f_user); destination(net_messages); }; log { source(net); filter(net_f_uucp); destination(net_uucp); }; log { source(net); filter(net_f_mail); destination(net_maillog); }; log { source(net); filter(net_f_mail); filter(net_f_info); destination(net_mailinfo); }; log { source(net); filter(net_f_mail); filter(net_f_warn); destination(net_mailwarn); }; log { source(net); filter(net_f_mail); filter(net_f_err); destination(net_mailerr); }; #log { source(net); filter(net_f_news); filter(net_f_crit); destination(net_newscrit); }; #log { source(net); filter(net_f_news); filter(net_f_err); destination(net_newserr); }; #log { source(net); filter(net_f_news); filter(net_f_notice); destination(net_newsnotice); }; #log { source(net); filter(net_f_debug); destination(net_debug); }; log { source(net); filter(net_f_messages); destination(net_messages); }; log { source(net); filter(net_f_emergency); destination(net_console); }; log { source(net); filter(net_f_cother); destination(net_messages); }; # send everything to loghost, too log { source(net); destination(net_dump); }; syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]config file
by Smith, James 31 Mar '05

31 Mar '05

This is my server config file: # # Syslog-ng configuration file. Originally written by anonymous (I can't find # his name) Revised, and rewrited by me (SZALAY Attila <sasa(a)debian.org>) # revised again by Nate Campi <nate at campin dot net> ############################################################### # First, set some global options. options { # use_fqdn(yes); # use_dns(yes); # dns_cache(yes); create_dirs (yes); keep_hostname(yes); long_hostnames(on); sync(1); log_fifo_size(1024); use_dns (yes); }; ############################################################### # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-stream("/dev/log"); internal(); }; source src { # don't read from /proc/kmsg and run klogd also (Linux) # pipe("/proc/kmsg"); # file("/proc/kmsg") log_prefix("kernel: "); sun-streams("/dev/log" door("/etc/.syslog_door")); # unix-stream("/dev/log"); # unix-stream("/chroot/named/dev/log"); internal(); # udp(); # udp(ip("10.0.5.8") port(514)); # tcp(port(5140) keep-alive(yes)); # tcp(ip("10.9.9.3") port(5140) keep-alive(yes)); }; source net { tcp(port(5140) keep-alive(yes) max_connections(100)); }; ############################################################### # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log"); }; destination bootlog { file("/var/log/boot.log"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination debug { file("/var/log/debug"); }; destination explan { file("/var/log/explanations"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination messages { file("/var/adm/messages"); }; destination routers { file("/var/log/routers.log"); }; destination secure { file("/var/log/secure"); }; destination spooler { file("/var/log/spooler"); }; destination syslog { file("/var/log/syslog"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination mail { file("/var/log/mail.log"); }; destination maillog { file("/var/log/maillog"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty8"); }; filter f_attack_alert { match("attackalert"); }; filter f_ssh_login_attempt { program("sshd.*") and match("(Failed|Accepted)") and not match("Accepted (hostbased|publickey) for (root|zoneaxfr) from (10.4.3.1)"); }; #filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth) and not facility(mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; #filter f_general { facility(*); }; #filter f_news { facility(news); }; filter f_debug { not facility(auth, mail); }; filter f_messages { level(info .. warn) and not facility(auth, cron, daemon, mail); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; #filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; ############################################################### # # log statements actually send logs somewhere, to a file, across the network, etc # #log { source(src); filter(f_authpriv); destination(authlog); }; #log { source(src); filter(f_authpriv); destination(syslog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_daemon); destination(messages); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_kern); destination(messages); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_user); destination(messages); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); destination(maillog); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; #log { source(src); filter(f_news); filter(f_err); destination(newserr); }; #log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_general); destination(messages); }; log { source(src); filter(f_cother); destination(messages); }; destination net_authlog { file("/uag/HOSTS/$HOST/auth.log"); }; destination net_bootlog { file("/uag/HOSTS/$HOST/boot.log"); }; destination net_cron { file("/uag/HOSTS/$HOST/cron.log"); }; destination net_daemon { file("/uag/HOSTS/$HOST/daemon.log"); }; destination net_debug { file("/uag/HOSTS/$HOST/debug"); }; destination net_explan { file("/uag/HOSTS/$HOST/explanations"); }; destination net_kern { file("/uag/HOSTS/$HOST/kern.log"); }; destination net_lpr { file("/uag/HOSTS/$HOST/lpr.log"); }; destination net_messages { file("/uag/HOSTS/$HOST/messages"); }; destination net_routers { file("/uag/HOSTS/$HOST/routers.log"); }; destination net_secure { file("/uag/HOSTS/$HOST/secure"); }; destination net_spooler { file("/uag/HOSTS/$HOST/spooler"); }; destination net_syslog { file("/uag/HOSTS/$HOST/syslog"); }; destination net_user { file("/uag/HOSTS/$HOST/user.log"); }; destination net_uucp { file("/uag/HOSTS/$HOST/uucp.log"); }; # This files are the log come from the mail subsystem. # destination net_mail { file("/uag/HOSTS/$HOST/mail.log"); }; destination net_maillog { file("/uag/HOSTS/$HOST/maillog"); }; destination net_mailinfo { file("/uag/HOSTS/$HOST/mail.info"); }; destination net_mailwarn { file("/uag/HOSTS/$HOST/mail.warn"); }; destination net_mailerr { file("/uag/HOSTS/$HOST/mail.err"); }; destination net_console { usertty("root"); }; destination net_console_all { file("/dev/tty8"); }; destination net_dump { file("/uag/HOSTS/dump2/syslog"); }; filter net_f_attack_alert { match("attackalert"); }; filter net_f_ssh_login_attempt { program("sshd.*") and match("(Failed|Accepted)") and not match("Accepted (hostbased|publickey) for (root|zoneaxfr) from (10.4.3.1)"); }; filter net_f_syslog { not facility(auth) and not facility(mail); }; filter net_f_cron { facility(cron); }; filter net_f_daemon { facility(daemon); }; filter net_f_kern { facility(kern); }; filter net_f_lpr { facility(lpr); }; filter net_f_mail { facility(mail); }; filter net_f_user { facility(user); }; filter net_f_uucp { facility(cron); }; #filter net_f_general { facility(*); }; filter net_f_debug { not facility(auth, mail); }; filter net_f_messages { level(info .. warn) and not facility(auth, cron, daemon, mail); }; filter net_f_emergency { level(emerg); }; filter net_f_info { level(info); }; filter net_f_notice { level(notice); }; filter net_f_warn { level(warn); }; filter net_f_crit { level(crit); }; filter net_f_err { level(err); }; filter net_f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; ############################################################### # # log statements actually send logs somewhere, to a file, across the network, etc # #log { source(net); filter(net_f_authpriv); destination(net_authlog); }; #log { source(net); filter(net_f_authpriv); destination(net_syslog); }; log { source(net); filter(net_f_syslog); destination(net_syslog); }; log { source(net); filter(net_f_cron); destination(net_cron); }; log { source(net); filter(net_f_daemon); destination(net_daemon); }; log { source(net); filter(net_f_daemon); destination(net_messages); }; log { source(net); filter(net_f_kern); destination(net_kern); }; log { source(net); filter(net_f_kern); destination(net_messages); }; log { source(net); filter(net_f_lpr); destination(net_lpr); }; log { source(net); filter(net_f_mail); destination(net_mail); }; log { source(net); filter(net_f_user); destination(net_user); }; log { source(net); filter(net_f_user); destination(net_messages); }; log { source(net); filter(net_f_uucp); destination(net_uucp); }; log { source(net); filter(net_f_mail); destination(net_maillog); }; log { source(net); filter(net_f_mail); filter(net_f_info); destination(net_mailinfo); }; log { source(net); filter(net_f_mail); filter(net_f_warn); destination(net_mailwarn); }; log { source(net); filter(net_f_mail); filter(net_f_err); destination(net_mailerr); }; #log { source(net); filter(net_f_news); filter(net_f_crit); destination(net_newscrit); }; #log { source(net); filter(net_f_news); filter(net_f_err); destination(net_newserr); }; #log { source(net); filter(net_f_news); filter(net_f_notice); destination(net_newsnotice); }; #log { source(net); filter(net_f_debug); destination(net_debug); }; log { source(net); filter(net_f_messages); destination(net_messages); }; log { source(net); filter(net_f_emergency); destination(net_console); }; log { source(net); filter(net_f_cother); destination(net_messages); }; # send everything to loghost, too log { source(net); destination(net_dump); };

1 0

RE: [syslog-ng]config file
by Smith, James 31 Mar '05

31 Mar '05

This is my client side config file: # # Syslog-ng configuration file. Originally written by anonymous (I can't find # his name) Revised, and rewrited by me (SZALAY Attila <sasa(a)debian.org>) # revised again by Nate Campi <nate at campin dot net> ############################################################### # First, set some global options. options { # use_fqdn(yes); # use_dns(yes); # dns_cache(yes); create_dirs (yes); keep_hostname(yes); long_hostnames(on); sync(1); log_fifo_size(1024); use_dns (yes); }; ############################################################### # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-stream("/dev/log"); internal(); }; source src { # don't read from /proc/kmsg and run klogd also (Linux) # pipe("/proc/kmsg"); # file("/proc/kmsg") log_prefix("kernel: "); sun-streams("/dev/log" door("/etc/.syslog_door")); # unix-stream("/dev/log"); # unix-stream("/chroot/named/dev/log"); internal(); # udp(); # udp(ip("10.0.5.8") port(514)); # tcp(port(5140) keep-alive(yes)); # tcp(ip("10.9.9.3") port(5140) keep-alive(yes)); }; ############################################################### # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log"); }; destination bootlog { file("/var/log/boot.log"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination debug { file("/var/log/debug"); }; destination explan { file("/var/log/explanations"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination messages { file("/var/adm/messages"); }; destination routers { file("/var/log/routers.log"); }; destination secure { file("/var/log/secure"); }; destination spooler { file("/var/log/spooler"); }; destination syslog { file("/var/log/syslog"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; # This files are the log come from the mail subsystem. # destination mail { file("/var/log/mail.log"); }; destination maillog { file("/var/log/maillog"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; # Logging for INN news system # #destination newscrit { file("/var/log/HOSTS/news.crit"); }; #destination newserr { file("/var/log/HOSTS/news.err"); }; #destination newsnotice { file("/var/log/HOSTS/news.notice"); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination xconsole { pipe("/dev/xconsole"); }; # # scripts that accept syslog messages and mail them out # #destination mail-alert { program("/usr/local/bin/syslog-mail"); }; #destination mail-alert-perl { program("/usr/local/bin/syslog-mail-perl"); }; # # hack to get swatch to read from stdin # destination swatch { program("/usr/bin/swatch --read-pipe=\"cat /dev/fd/0\""); }; # # destination database # #destination sqlsyslogd { # program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); #}; ########################################## # Here's the filter options. With this rules, we can set which # message go where. filter f_attack_alert { match("attackalert"); }; filter f_ssh_login_attempt { program("sshd.*") and match("(Failed|Accepted)") and not match("Accepted (hostbased|publickey) for (root|zoneaxfr) from (10.4.3.1)"); }; #filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth) and not facility(mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_general { facility(*); }; #filter f_news { facility(news); }; filter f_debug { not facility(auth, mail); }; filter f_messages { level(info .. warn) and not facility(auth, cron, daemon, mail); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; #filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; ############################################################### # # log statements actually send logs somewhere, to a file, across the network, etc # #log { source(src); filter(f_authpriv); destination(authlog); }; #log { source(src); filter(f_authpriv); destination(syslog); }; log { source(src); filter(f_syslog); destination(syslog); }; #log { source(src); filter(f_cron); destination(cron); }; #log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_daemon); destination(messages); }; #log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_kern); destination(messages); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; #log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_user); destination(messages); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); destination(maillog); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; #log { source(src); filter(f_news); filter(f_err); destination(newserr); }; #log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(f_general); destination(messages); }; #log { source(src); filter(f_cnews); destination(console_all); }; #log { source(src); filter(f_cother); destination(console_all); }; #log { source(src); filter(f_cnews); destination(xconsole); }; log { source(src); filter(f_cother); destination(messages); }; destination loghost { tcp("10.200.200.84" port(5140)); }; # send everything to loghost, too log { source(src); destination(loghost); };

1 0

config file
by Ryan McCain 31 Mar '05

31 Mar '05

Could someone post their config file or email it to me if you are using syslog-ng as a central logging facility? Something is wrong w/ my configuration file and I can't put a finger on it. Thanks, Ryan

1 0

config syntax error
by Ryan McCain 31 Mar '05

31 Mar '05

When attempting to start syslog, i get an error in line 41 of the config file.. Here is line 41. Am i overlooking a paren, semicolon, etc? I cant seem to find it? thanks. destination hosts { file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" owner(root) group(root) perm(0755) dir_perm(0755) create_dirs(yes)); };

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Bill Nash 31 Mar '05

31 Mar '05

On Thu, 31 Mar 2005, Ryan McCain wrote: > source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); > unix_stream("/dev/log"); internal(); }; > > destination hosts { > file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" > owner(root) group(root) perm(0755) dir_perm(0755) create_dirs(yes)); > }; > > log { source(s_sys); destination(hosts); }; > Yup. Should work like a champ. It's very similiar to a larger deployment I'm using. - billn

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Ryan McCain 31 Mar '05

31 Mar '05

I will be logging from 10 firewalls, 20 linux boxes, 2 routers and a handful of workstations. Will this configuration file do the trick? source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix_stream("/dev/log"); internal(); }; destination hosts { file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" owner(root) group(root) perm(0755) dir_perm(0755) create_dirs(yes)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; log { source(s_sys); destination(hosts); }; Thanks, Ryan >>>Bill Nash <billn(a)billn.net> 03/31 10:26 am >>> You'll need a log() directive that includes the destination. The basic path is: Log Source -> Optional Filter -> Destination. - billn On Thu, 31 Mar 2005, Ryan McCain wrote: >Bill, > >So I can simply add this to my conf. file (modifying owner, group, perm, >dir_perm of course) and it will start accepting logs from remote >servers? > > >Where do I specify which hosts to accept logs from (I'd prefer not to >use tcp wrappers)? > >Thanks again, >Ryan > >>>>Bill Nash <billn(a)billn.net> 03/31 10:15 am >>> >On Thu, 31 Mar 2005, Ryan McCain wrote: > >>I'm starting to understand the syntax. However, what part of this >>statement tells syslog-ng to create a file for each host its receiving >>logs from? > >>destination hosts { >>file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" > >>owner(bob) group(llamafood) perm(0755) dir_perm(0755) >create_dirs(yes)); > > >If the file doesn't exist, it will be created. If the directory doesn't >exist, you need the create_dirs directive. > >- billn >

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Bill Nash 31 Mar '05

31 Mar '05

You'll need a log() directive that includes the destination. The basic path is: Log Source -> Optional Filter -> Destination. - billn On Thu, 31 Mar 2005, Ryan McCain wrote: > Bill, > > So I can simply add this to my conf. file (modifying owner, group, perm, > dir_perm of course) and it will start accepting logs from remote > servers? > > > Where do I specify which hosts to accept logs from (I'd prefer not to > use tcp wrappers)? > > Thanks again, > Ryan > >>>> Bill Nash <billn(a)billn.net> 03/31 10:15 am >>> > On Thu, 31 Mar 2005, Ryan McCain wrote: > >> I'm starting to understand the syntax. However, what part of this >> statement tells syslog-ng to create a file for each host its receiving >> logs from? > >> destination hosts { >> file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" > >> owner(bob) group(llamafood) perm(0755) dir_perm(0755) > create_dirs(yes)); > > > If the file doesn't exist, it will be created. If the directory doesn't > exist, you need the create_dirs directive. > > - billn >

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Ryan McCain 31 Mar '05

31 Mar '05

What is the destination? This syntax is wickedly confusing to me. Thanks, Ryan >>>Bill Nash <billn(a)billn.net> 03/31 10:26 am >>> You'll need a log() directive that includes the destination. The basic path is: Log Source -> Optional Filter -> Destination. - billn On Thu, 31 Mar 2005, Ryan McCain wrote: >Bill, > >So I can simply add this to my conf. file (modifying owner, group, perm, >dir_perm of course) and it will start accepting logs from remote >servers? > > >Where do I specify which hosts to accept logs from (I'd prefer not to >use tcp wrappers)? > >Thanks again, >Ryan > >>>>Bill Nash <billn(a)billn.net> 03/31 10:15 am >>> >On Thu, 31 Mar 2005, Ryan McCain wrote: > >>I'm starting to understand the syntax. However, what part of this >>statement tells syslog-ng to create a file for each host its receiving >>logs from? > >>destination hosts { >>file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" > >>owner(bob) group(llamafood) perm(0755) dir_perm(0755) >create_dirs(yes)); > > >If the file doesn't exist, it will be created. If the directory doesn't >exist, you need the create_dirs directive. > >- billn >

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Ryan McCain 31 Mar '05

31 Mar '05

Bill, So I can simply add this to my conf. file (modifying owner, group, perm, dir_perm of course) and it will start accepting logs from remote servers? Where do I specify which hosts to accept logs from (I'd prefer not to use tcp wrappers)? Thanks again, Ryan >>>Bill Nash <billn(a)billn.net> 03/31 10:15 am >>> On Thu, 31 Mar 2005, Ryan McCain wrote: >I'm starting to understand the syntax. However, what part of this >statement tells syslog-ng to create a file for each host its receiving >logs from? >destination hosts { >file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" >owner(bob) group(llamafood) perm(0755) dir_perm(0755) create_dirs(yes)); If the file doesn't exist, it will be created. If the directory doesn't exist, you need the create_dirs directive. - billn

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Bill Nash 31 Mar '05

31 Mar '05

On Thu, 31 Mar 2005, Ryan McCain wrote: > I'm starting to understand the syntax. However, what part of this > statement tells syslog-ng to create a file for each host its receiving > logs from? > destination hosts { > file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" > owner(bob) group(llamafood) perm(0755) dir_perm(0755) create_dirs(yes)); If the file doesn't exist, it will be created. If the directory doesn't exist, you need the create_dirs directive. - billn

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Ryan McCain 31 Mar '05

31 Mar '05

This is the base config file I'm working with.. Note: i'm using unix_stream. Should I be using unix_dgram since im on a 2.6x kernel? I'm reading through the section on syslog-ng in the book "Building Secure Server with Linux", and it mentions soemthing about using "unix-dgram" .. note the "-" instead of "_". I'm assuming its a type and should be "_". ------ source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix_stream("/dev/log"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; >>>billn(a)billn.net 03/31 10:00 am >>> On Thu, 31 Mar 2005, Ryan McCain wrote: >Where can I find documentation that will give me information on how to >accept logs from remote hosts and have each of the hosts log to their >own file? > destination hosts { file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" owner(bob) group(llamafood) perm(0755) dir_perm(0755) create_dirs(yes)); }; - billn syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Configure syslog-ng to act as a central loggingserver
by Vaibhav Goel 31 Mar '05

31 Mar '05

The $HOST macro... -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Ryan McCain Sent: March 31, 2005 8:08 AM To: billn(a)billn.net; syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Configure syslog-ng to act as a central loggingserver I'm starting to understand the syntax. However, what part of this statement tells syslog-ng to create a file for each host its receiving logs from? Thanks, Ryan >>>billn(a)billn.net 03/31 10:00 am >>> On Thu, 31 Mar 2005, Ryan McCain wrote: >Where can I find documentation that will give me information on how to >accept logs from remote hosts and have each of the hosts log to their >own file? > destination hosts { file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$D AY" owner(bob) group(llamafood) perm(0755) dir_perm(0755) create_dirs(yes)); }; - billn syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Ryan McCain 31 Mar '05

31 Mar '05

I'm starting to understand the syntax. However, what part of this statement tells syslog-ng to create a file for each host its receiving logs from? Thanks, Ryan >>>billn(a)billn.net 03/31 10:00 am >>> On Thu, 31 Mar 2005, Ryan McCain wrote: >Where can I find documentation that will give me information on how to >accept logs from remote hosts and have each of the hosts log to their >own file? > destination hosts { file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" owner(bob) group(llamafood) perm(0755) dir_perm(0755) create_dirs(yes)); }; - billn syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Configure syslog-ng to act as a central logging server
by Ryan McCain 31 Mar '05

31 Mar '05

Where can I find documentation that will give me information on how to accept logs from remote hosts and have each of the hosts log to their own file? I've read the man file and looked at the web page, but can't find anything to substantial. Thanks, Ryan

3 2

problem with syslog-ng fork & exec
by niraj 31 Mar '05

31 Mar '05

I m facing problem with this code . When I execute this program it forks 2 process A zombie syslog-ng process on the forked ID syslog-ng on the next pid but without while loop every thing is working properly TIA niraj #include<iostream> #include<unistd.h> using namespace std; int main() { int cpid; cpid=fork(); if(cpid==0) { if(execv( "/usr/local/sbin/syslog-ng" ,NULL)==-1) { cout<<"hello"<<endl; } cout<<"ok"<<endl; } while(1) { ; } return 0; } ~ ~

1 0

io.c read() error?
by SOLIS, ALEX 30 Mar '05

30 Mar '05

I am using syslog-ng 1.6.5 on a Gentoo Linux system running kernel 2.6.9. I have recently modified an open source utility called NTsyslog to send Windows NT style event logs via TCP to my syslog-ng server. Everything seems to work fine except I receive a io.c read() error for every event sent over the network via TCP. Anyone have any ideas of what my problem might be? Here are a few bits of info: Logs that I see when TCP syslog communication is attempted: Mar 30 10:43:48 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3038 Mar 30 10:43:48 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:43:48 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3038 Mar 30 10:43:48 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3039 Mar 30 10:43:48 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:43:48 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3039 Mar 30 10:49:05 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3066 Mar 30 10:49:05 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:49:05 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3066 Mar 30 10:49:05 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3067 Mar 30 10:49:05 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:49:05 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3067 Mar 30 10:53:59 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3077 Mar 30 10:53:59 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:53:59 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3077 Mar 30 10:53:59 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3078 Mar 30 10:53:59 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:53:59 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3078 Mar 30 10:58:53 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3092 Mar 30 10:58:53 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:58:53 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3092 Mar 30 10:59:16 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3093 Mar 30 10:59:16 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:59:16 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3093 Afinet.c in syslog-ng 1.6.6 sources where io_read() is called: /* af_inet source connection */ static int do_init_afinet_source_connection(struct log_handler *c, struct syslog_config *cfg, struct persistent_config *persistent) { CAST(afsocket_source_connection, self, c); if (self->client_addr) { CAST(inet_address_info, inet, self->client_addr); /* SOCK_STREAM */ notice("AF_INET client connected from %S, port %i\n", inet->ip, inet->port); io_read(self->client, make_log_reader(0, NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, cfg->bad_hostname, c), make_afsocket_source_close_callback(self)); } else { /* SOCK_DGRAM */ io_read(self->client, make_log_reader(1, NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, cfg->bad_hostname, c), make_afsocket_source_close_callback(self)); } return ST_OK | ST_GOON; } < -----END of CODE ---- > I have been trying to find what values are passed to io_read() and make_log_reader() but I have been unsuccessfull. Thanks in advance for any replies. Alex S. <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

2 1

RE: [syslog-ng]-linux/bin/ld: cannot find -lglib-2.0
by Philipp Snizek 30 Mar '05

30 Mar '05

> > > static glib, syslog-ng tries to link to glib statically. > > > > Thanks for your answer. > > What do I have to do ? > > the static library is in the devel package usually, you need > to look for something like libglib-2.0.a Please excuse, but I still don't understand. libglib-2.0.la is in /usr/local/lib what do I have to do? I still have /usr/lib/gcc-lib/i486-slackware-linux/3.3.4/../../../../i486-slackware -linux/bin/ld: cannot find -lglib-2.0 What lib is it exactly looking for ? in /usr/local/lib I also have the glib-2.0 directory which includes a header file. Thank you Philipp

2 1

RE: [syslog-ng]-linux/bin/ld: cannot find -lglib-2.0
by Philipp Snizek 30 Mar '05

30 Mar '05

> /usr/lib/gcc-lib/i486-slackware-linux/3.3.4/../../../../i486-slackware > > -linux/bin/ld: cannot find -lglib-2.0 > > collect2: ld returned 1 exit status > > make[2]: *** [syslog-ng] Error 1 > > make[2]: Leaving directory `/root/syslog-ng-1.9.3/src' > > make[1]: *** [all-recursive] Error 1 > > make[1]: Leaving directory `/root/syslog-ng-1.9.3' > > make: *** [all] Error 2 > > > > However, glib-2.0 is installed and the path in ld.config.so > points to > > /usr/local/lib > > static glib, syslog-ng tries to link to glib statically. Thanks for your answer. What do I have to do ? > ps: use the latest snapshot of 1.9.x as plain 1.9.3 contains > a problem in macro expansion. Thanks. I changed to the snapshot. Philipp

2 1

-linux/bin/ld: cannot find -lglib-2.0
by Philipp Snizek 29 Mar '05

29 Mar '05

Hi I have a problem with installing syslog-ng 1.9.3 gcc -g -O2 -Wall -g -o syslog-ng main.o misc.o utils.o messages.o gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o driver.o sgroup.o dgroup.o center.o filter.o logsource.o logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o afstreams.o afuser.o afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o children.o -lnsl -Wl,-static -lfl -L/usr/local/lib -lglib-2.0 -levtlog -Wl,-call_shared /usr/lib/gcc-lib/i486-slackware-linux/3.3.4/../../../../i486-slackware -linux/bin/ld: cannot find -lglib-2.0 collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/root/syslog-ng-1.9.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/syslog-ng-1.9.3' make: *** [all] Error 2 However, glib-2.0 is installed and the path in ld.config.so points to /usr/local/lib What am I missing? thanks Philipp

2 1