- syslog-ng - lists.balabit.hu

Resolve hostnames for some destinations only
by ARGEXT-HIDALGO, FRANCISCO 04 Mar '05

04 Mar '05

Is this possible?, I have everything logged as IP's because we need it that way, but for php-syslog-ng I would like to see it as hostnames. Any solutions? Thank you. Francisco

1 0

Syslog-NG 1.6.6 memory leak when sending UDP logs
by henry＠shoelacecity.com 04 Mar '05

04 Mar '05

I'm running 1.6.6 on Linux Redhat ES 3.0 logging Cisco router logs to local files and it's been running just fine for over a week. I just enabled forwarding for local4 and local7 (with spoof UDP) to 2 additional hosts via UDP and noticed, within a day, that it syslog-NG has consumed all available memory. It continues to log, however, the system starts killing processes off unless I restart syslog-ng. I checked the list, it seems like the closest similar problem I could find was back in 2000. Any advice for fixing/identifying the problem?

4 18

Fedora Core configuration files
by José Pedro Oliveira 04 Mar '05

04 Mar '05

Balazs, Could you add the four attached files to the contrib directory? They will be needed by the new specfile. Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B * # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 10 Aug 2002 # - for Red Hat 7.3 # - totally do away with klogd # - add message "kernel:" as is done with klogd. # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 22 Aug 2002 # - use the log_prefix option as per Balazs Scheidler's email # # Updated by Jose Pedro Oliveira (<jpo at di.uminho.pt>) - 05 Apr 2003 # - corrected filters 'f_filter2' and 'f_filter6' # these filters were only allowing messages of one specific # priority level; they should be allowing messages from that # priority and upper levels. # # Updated by Jose Pedro Oliveira (<jpo at di.uminho.pt>) - 25 Jan 2005 # - Don't sync the d_mail destination # # Updated by Jose Pedro Oliveira (<jpo at di.uminho.pt>) - 01 Feb 2005 # - /proc/kmsg is a file not a pipe. # (https://lists.balabit.hu/pipermail/syslog-ng/2005-February/006963.html) # options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; #filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; #!/bin/sh # # syslog-ng This starts and stops syslog-ng # # chkconfig: 2345 12 88 # description: reads and logs messages to the system console, log \ # files, other machines and/or users as specified by \ # its configuration file. # processname: /sbin/syslog-ng # config: /etc/syslog-ng/syslog-ng.conf # config: /etc/sysconfig/syslog-ng # pidfile: /var/run/syslog-ng.pid # ### BEGIN INIT INFO # Provides: $syslog ### END INIT INFO # Source function library. . /etc/rc.d/init.d/functions exec="/sbin/syslog-ng" prog=$(basename $exec) [ -f $exec ] || exit 0 # Source config [ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog lockfile=/var/lock/subsys/$prog umask 077 start() { echo -n $"Starting $prog: " daemon $exec $SYSLOGNG_OPTIONS retval=$? echo [ $retval -eq 0 ] && touch $lockfile return $retval } stop() { echo -n $"Stopping $prog: " killproc $prog retval=$? echo [ $retval -eq 0 ] && rm -f $lockfile return $retval } restart() { stop start } reload() { echo -n $"Reloading syslog-ng.conf file: " killproc $prog -HUP retval=$? echo return $retval } force_reload() { restart } fdr_status() { status $prog } case "$1" in start|stop|restart|reload) $1 ;; force-reload) force_reload ;; status) fdr_status ;; condrestart|try-restart) [ ! -f $lockfile ] || restart ;; *) echo $"Usage: $0 {start|stop|status|restart|try-restart|reload|force-reload}" exit 2 esac /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron { sharedscripts postrotate /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true endscript } #--- # Syslog-ng command line options # See syslog-ng(8) for more details #--- SYSLOGNG_OPTIONS=""

2 1

central log server not working
by Ed Davison 04 Mar '05

04 Mar '05

I am trying to setup a central log host and am having trouble getting events registered on the central server. It looks like the remote host does register with the central host but nothing shows in a log anywhere for it. I really need another set of eyes on this as I cannot figure this out for the life of me and I need to get this going. Here is the excerpt from /var/log/messages (cleaned on the ip numbers): --------8<--------8<--------8<-------- Feb 18 14:19:45 sec5 syslog-ng[27866]: syslog-ng version 1.6.5 starting Feb 18 14:19:45 sec5 syslog-ng[27866]: Changing permissions on special file /dev/tty12 Feb 18 14:24:00 sec5 syslog-ng[27866]: AF_INET client connected from 1.2.3.4, port 50378 --------8<--------8<--------8<-------- Here is the central loghost config file: --------8<--------8<--------8<-------- options { long_hostnames(off); sync(0); stats(43200); dns_cache(yes); use_fqdn(no); keep_hostname(yes); use_dns(yes); }; source gateway { unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; source tcpgateway { unix-stream("/dev/log"); internal(); tcp(ip(0.0.0.0) port(514) max_connections(1000)); }; destination hosts { file("/var/log/syslogs/$HOST/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(gateway); destination(hosts); }; log { source(tcpgateway); destination(hosts); }; --------8<--------8<--------8<-------- The remote host config file is: --------8<--------8<--------8<-------- options { long_hostnames(off); sync(0); stats(43200); }; source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; source gateway { unix-stream("/dev/log" max_connections(1000)); internal(); }; destination messages { file("/var/log/messages"); }; # By default messages are logged to tty12... destination console_all { file("/dev/tty12"); }; destination shell { tcp("1.2.3.1" port(514)); }; log { source(src); destination(messages); }; log { source(src); destination(console_all); }; log { source(gateway); destination(shell); }; --------8<--------8<--------8<-------- -- -------------------------- Ed Davison Sr. Systems Analyst McCombs School of Business 512-232-6620 voice

2 5

changed macro to $R_YEAR/$YEAR.$MONTH.$DAY
by Deras, Angel R./Information Systems 04 Mar '05

04 Mar '05

Joerg, I was able to start logging again after your pointer. I am still not able to create a dir with the $MONTH (nor $R_MONTH) macro, but am getting around the problem by using the macro "$R_YEAR/$YEAR.$MONTH.$DAY", which should be enough to distinguish each day's log. thank you very much, ard ===================================================================== Please note that this e-mail and any files transmitted with it may be privileged, confidential, and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any reading, dissemination, distribution, copying, or other use of this communication or any of its attachments is strictly prohibited. If you have received this communication in error, please notify the sender immediately by replying to this message and deleting this message, any attachments, and all copies and backups from your computer.

1 0

MySQL-Syntax error
by Hermann-Josef Beckers 03 Mar '05

03 Mar '05

HI, I have the same problem as someone else in November. I'm trying to pipe data into MySQL, but Mysql complains about syntax. The proposed solution in November (upgrade von 1.6.4 to 1.6.5) doesn't fit, as I'm using 1.9.3 Here is the generated input for MySQL: ls0003INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '', 'kern', 'notice', 'notice', '05', '2005-03-03', '16:26:07', 'kernel', 'syslog-ng[10686]: syslog-ng starting up; version=\'1.9.3\' ' ); ls0003INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '', 'kern', 'notice', 'notice', '05', '2005-03-03', '16:26:07', 'kernel', 'syslog-ng[10686]: Initializing destination file writer; filename=\'/tmp/mysql.pipe\', template=\'/tmp/mysql.pipe\' ' ); 0.0.0.0INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '', 'daemon', 'err', 'err', '1b', '2005-03-03', '16:27:01', 'Security', 'Security: NT-AUTORIT\37777777704T\\SYSTEM: Fehlgeschlagene Anmeldung: Grund: Unbekannter Benutzername oder falsches Kennwort Benutzername: ANONYMOUS Dom\37777777744ne: KST Anmeldetyp: 3 Anmeldevorgang: NtLmSsp Authentifizierungspaket: NTLM Name der Arbeitsstation: \\\\LS0002 <78>CROND[2516]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg) ' ); Seems that the value for HOST is printed before the INSERT-string. "ls0003" is the host running syslog-ng. Another point: How do I keep the hostname for remote hosts? The string with "0.0.0.0" at the beginning is from a windows 2000 client. Here is my syslog-ng.conf: options { keep_hostname(yes); chain_hostnames(yes); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(src); destination(d_mysql); }; # source src { unix-dgram("/etc/log/log"); internal(); }; source src { unix-dgram("/dev/log"); internal(); udp(); }; # source src { unix-dgram("/dev/log"); internal(); }; # source net { udp(); }; Yours hjb _________________________________________ Diese E-Mail wurde geprüft von Symantec Antivirus

2 1

client couldn't reconnect to loghost after failure
by Ed Ravin 03 Mar '05

03 Mar '05

We're using syslog-ng 1.5.13 (yes, I know) on a bunch of diskless clients to send log messages to a central host. The main switch in our machine room had a hardware problem, and refused to pass packets for 20 minutes or so until we rebooted it. On two of my clients, syslog-ng subsequently stopped sending log messages to the central host after the switch recovered. Here's what was in the log: Mar 1 08:55:38 syslog-ng[13050]: io.c: do_write: write() failed (errno 9), Broken pipe Mar 1 08:55:38 syslog-ng[13050]: pkt_buffer::do_flush(): Error flushing data Mar 1 08:55:38 syslog-ng[13050]: Connection broken to AF_INET(loghost.example.com:514), reopening in 60 seconds Mar 1 08:57:53 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:00:08 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:02:24 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:04:39 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:05:38 syslog-ng[13050]: STATS: dropped 0 Mar 1 09:06:54 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:09:10 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:25:39 syslog-ng[13050]: STATS: dropped 0 Mar 1 09:35:39 syslog-ng[13050]: STATS: dropped 0 The other host has a remarkably similar log. After 9:25:39, the only messages that made it to the central host are the "STATS: dropped 0" messages. Is this a bug that has been fixed in more recent versions? We've been meaning to upgrade the clients for a while (the central server is using a current syslog-ng), but haven't gotten to it yet.

1 0

RE : [syslog-ng]Installation problem on Fedora C3
by Marquis Thibodeau 03 Mar '05

03 Mar '05

Hi, Thanks for your quick answer... I didn't find the version I need.. the 1.5.x because I want to store the log in MySQL and it says that only 1.5.x is working with template (MySQL) Any other idea?? Thanks Marquis ________________________________ De: syslog-ng-admin(a)lists.balabit.hu de la part de Viper sec Date: mer. 2005-03-02 13:01 À: syslog-ng(a)lists.balabit.hu Objet : Re: [syslog-ng]Installation problem on Fedora C3 Hi I installed on FC3, it was ok. I used rpm from rpm.pbone.net. Regards, Viper$ec On Wed, 2 Mar 2005 12:53:03 -0500, Marquis Thibodeau <mthibodeau(a)avance.info> wrote: > Hi, > > I tried to install syslog-ng on my Fedora Core3 server and I get a bunch of > error in the compilation... > > Is someone can help me out... > > What thing do I need to provide here to get better help...??? > > Thanks > > Marquis _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng stopped logging at beginning of month (March 1)
by Deras, Angel R./Information Systems 03 Mar '05

03 Mar '05

Hi Friends, For some reason, syslog-ng did not create a new dir and destination file after it closed the last log on February 28 @ 23:59. It should have created a new dir in the form: <path>/2005/03/ and a file named "2005-03-01". However, this did not happen and I am still not able to get logging going. I am using syslog-ng version 1.6.6, running on FreeBSD 5.3. I installed it recently and it worked great from Feb 17 to Feb 28, each day creating that day's file; but it not create the March directory nor any other file. tcpdump sessions show that the udp packets to port 514 are arriving at the log server. Any help will be greatly appreciated. thanks, ard ===================================================================== Please note that this e-mail and any files transmitted with it may be privileged, confidential, and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any reading, dissemination, distribution, copying, or other use of this communication or any of its attachments is strictly prohibited. If you have received this communication in error, please notify the sender immediately by replying to this message and deleting this message, any attachments, and all copies and backups from your computer.

2 1

Installation problem on Fedora C3
by Marquis Thibodeau 02 Mar '05

02 Mar '05

Hi, I tried to install syslog-ng on my Fedora Core3 server and I get a bunch of error in the compilation... Is someone can help me out... What thing do I need to provide here to get better help...??? Thanks Marquis

2 1

1.9.3 bug proposal : resolving $HOSTS in destination
by Gilles Demarty 02 Mar '05

02 Mar '05

We have an issue on syslog-ng 1.9.3 on this following case : when using the destination : destination d_tag {file("/var/log/hosts/$HOST/$FACILITY $YEAR-$MONTH-$DAY.$LEVEL");}; the following error appeared : Error opening file for writing; error='No such file or directory (2)', filename='localhost/var/log/hosts//mail 2005-02-28.notice' The resolved filename looks bugged. Here are the revelant debugging infos : Incoming log entry; line='<21>Feb 28 15:24:46 logger: test' Initializing destination file writer; filename='/var/log/messages', template='/var/log/messages' Initializing destination file writer; filename='localhost/var/log/hosts//mail 2005-02-28.notice', template='/var/log/hosts/$HOST/$FACILITY $YEAR-$MONTH-$DAY.$LEVEL' Error opening file for writing; error='No such file or directory (2)', filename='localhost/var/log/hosts//mail 2005-02-28.notice' This bug produce rapidly a 99% CPU load, mainly because all the sources are redirected to this "destination". syslog-ng 1.6.4 don't produce the bug. Attached is syslog-ng.conf that produce the bug. (ASCII \r\n format, sorry). -- Gilles DEMARTY ExaProtect Technology Tél: +33 (0) 4 26 23 25 25 Fax: +33 (0) 4 26 29 99 09 email(at)exaprotect.com www.exaprotect.com - "Be alert with your alerts" options { sync(0); create_dirs(on); time_reopen (10); log_fifo_size(1000); long_hostnames (off); keep_hostname (yes); use_dns (off); use_fqdn (off); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; source src { udp(ip(0.0.0.0)); }; destination d_tag { file("/var/log/hosts/$HOST/$FACILITY $YEAR-$MONTH-$DAY.$LEVEL"); }; destination d_dest {file("/var/log/messages"); }; log { source(s_sys); source(src); destination(d_dest); }; log { source(s_sys); source(src); destination(d_tag); };

5 6

levtlog error udring compile
by Colin O'Keeffe 01 Mar '05

01 Mar '05

Iam using suse 9.2 ive done ./configure then i do make and i get gcc -g -O2 -Wall -g -o syslog-ng main.o misc.o utils.o messages.o gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o driver.o sgroup.o dgroup.o center.o filter.o logsource.o logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o afstreams.o afuser.o afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o children.o -lnsl -Wl,-static -lfl -L/opt/gnome/lib -lglib-2.0 -levtlog -Wl,-call_shared /usr/lib/gcc-lib/i586-suse-linux/3.3.4/../../../../i586-suse-linux/bin/ld: cannot find -levtlog collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/home/cokeeffe/syslog-ng-1.9.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/cokeeffe/syslog-ng-1.9.3' make: *** [all] Error 2 whats up? -- Colin O'Keeffe

2 4

Changing what source port syslog-ng uses, when sending a syslog
by Henning Markussen 01 Mar '05

01 Mar '05

Hi Is there a way to change what source port syslog-ng uses, when it is sending a syslog ? I can see in our firewall log that it uses a high port Deny udp src inside:xxxx/32772 dst outside:xxx/514 by access-group "FromInside4" - Henning

2 2

Logs lost in the FIFO
by torpedo 01 Mar '05

01 Mar '05

Hi All, I have the confusion regarding logs which are not read by the Destination programs. In case of FIFO, if the destination program which is reading the logs from syslog-ng is slow and unable to sysnchronise with the syslog-ng and there is also a limit for the fifo buffer(amount of data it holds) then where does thoses logs goes , are those logs recoverable. In other case of FIFO, if there is no destination program reading the logs from the FIFO what happens to the logs which are collected by the syslog-ng are those logs droped. How syslog-ng handles all these situations. Please help me out. Thank you all in advance, Regards, torpedo

3 7

Logserver doesn't receving remote logs
by Viper sec 28 Feb '05

28 Feb '05

Hey , I have a central logserver with syslog-ng installed and configured (see above syslog-ng.conf), some clients (in conf just remotehost5) send (514/udp) their logs to this logserver; but logserver isn't receiving these logs. When I try to use local system logs, it's ok, create the log files, but with remote host doesn't. I have created /var/log/HOSTS/{nameserver}, and clients, that use syslog has in syslog.conf *.warning @logserver (/etc/hosts is ok). remotehost5 is pinging logserver. Anybody has any ideia about it? (thanks too much) logserver: linux Fedora Core 3 syslog-ng-1.6.5-6 libol-0.3.14-1 /* syslog-ng.conf logserver = = local server */ options{ sync(0); keep_hostname(no); log_fifo_size(1000); long_hostnames(off); use_dns(no); use_fqdn(no); create_dirs(yes); }; source s_sys{ unix-stream("/dev/log"); internal(); }; source s_udp{ udp(ip(192.168.100.100) ); }; #listenned interface on server filter f_remotehost5sec{ host( "web5" ) and level( warning .. emerg ) and facility( authpriv ); }; filter f_logservermesg{ level(info .. emerg) and not (facility(authpriv) and facility(mail) and facility(cron)); }; filter f_logserversec { facility(authpriv) and level(info .. emerg); }; destination d_remotehost5mesg { file("/var/log/HOSTS/remotehost5/$YEAR-$MONTH-$DAY.secure" ); }; destination d_remotehost5sec { file("/var/log/HOSTS/remotehost5/$YEAR-$MONTH-$DAY.secure" ); }; destination d_logservermesg { file("/var/log/HOSTS/logserver/$YEAR-$MONTH-$DAY.message"); }; destination d_logserversec { file("/var/log/HOSTS/logserver/$YEAR-$MONTH-$DAY.secure"); }; log { source(s_udp); filter(f_remotehost5mesg); destination(d_remotehost5mesg); }; log { source(s_sys); filter(f_logservermesg); destination(d_logservermesg); }; log { source(s_sys); filter(f_logserversec); destination(d_logserversec); };

3 3

route some messages to /dev/null
by Denis Kot 28 Feb '05

28 Feb '05

I want to route some messages to /dev/null. how to do it? -- Denis Kot denis?jabber.org.by ICQ: 13680126 Mobil: +375 29 6-1234-78

3 7

1.9.3 compatibility with glib 2.2
by Gilles Demarty 28 Feb '05

28 Feb '05

Hi all, on my way trying to compile syslog-ng 1.9.3 on a RedHat Entreprise Server 3.0 with glib 2.2, the only compiling error was the existence of g_queue_get_length() in afinter.c. g_queue_get_length() is a function introduced since glib 2.4. I wonder why you prefer using g_queue_get_length() instead of g_queue_is_empty() in that particular context, since you do a double neg of that value to get a gboolean. Therefore, I propose the following patch. This patch allow compatibility with glib 2.2, and is, i hope, more efficient (since a non empty test shoud be as efficient as an enumeration). # diff afinter.c ~/syslog-1.9.3-patched/src/afinter.c 35c35 < return !!g_queue_get_length(internal_msg_queue); --- > return !g_queue_is_empty(internal_msg_queue); 41c41 < return !!g_queue_get_length(internal_msg_queue); --- > return !g_queue_is_empty(internal_msg_queue); my €.02 -- Gilles DEMARTY ExaProtect Technology Tél: +33 (0) 4 26 23 25 25 Fax: +33 (0) 4 26 29 99 09 email(at)exaprotect.com www.exaprotect.com - "Be alert with your alerts"

2 1

syntax for escaped characters
by Mike Pepe 25 Feb '05

25 Feb '05

OK, I'm trying to figure out what the correct syntax for a match is. I'm trying to match crond(pam_unix) filter f_cron_pam { match("crond(pam_unix)"); }; Doesn't match. filter f_cron_pam { match("crond$pam_unix$"); }; Doesn't match. something about the parenthesis it doesn't like, because: filter f_cron_pam { match("crond") and match("pam_unix"); }; does match. It's just kind of an ugly way around it. Anyone know what the right way to do this is?

2 2

Syslog-ng on Fedora Core 1
by Phusion 24 Feb '05

24 Feb '05

Hi, I installed syslog-ng 1.6.6 from source on Fedora Core 1. I have it up and running but I can't seem to get kernel messages. I've included part of my syslog-ng.conf file for you to look at. source local { internal(); file("/proc/kmsg" log_prefix("kernel: ")); unix-stream("/dev/log"); }; Also, I don't have klogd running. When using the stock syslog that comes with Fedora, klogd also runs. I stopped that from running and started the syslog-ng service. I can't seem to get kernel log messages. Let me know what my problem is. Thanks.

2 1

fyi: building SyslogNG snapshot on OSX 10.3.8
by OpenMacNews 23 Feb '05

23 Feb '05

hi all, i've seen a couple of recent questions onlist re: building on Mac, so i thought i'd post my latest notes; the following works great for me. HTH, but, as always, YMMV =) note: (a) i'm building from the latest src snapshots (b) i'm using some updated build tools (c) i'm linking against an EXTERNAL bind9 build's libs (currently bind-9.3.1rc1), rather than Apple's native -lresolv ... fwiw, my ENV: % gcc --version gcc (GCC) 3.3 20030304 (Apple Computer, Inc. build 1671) % glibtool --version ltmain.sh (GNU libtool) 1.5.14 (1.1220.2.195 2005/02/12 12:12:33) % automake --version automake (GNU automake) 1.9.4 % autoconf --version autoconf (GNU Autoconf) 2.59 setenv LIBOL_LOC "http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot" setenv SYSLOGNG_LOC "http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot" setenv LIBOL_VER "libol-0.3.15+20050216" setenv SYSLOGNG_VER "syslog-ng-1.6.6+20050216" cd /usr/ports/ wget $LIBOL_LOC/$LIBOL_VER.tar.gz wget $SYSLOGNG_LOC/$SYSLOGNG_VER.tar.gz gnutar zxvf $LIBOL_VER.tar.gz gnutar zxvf $SYSLOGNG_VER.tar.gz unsetenv CFLAGS CPPFLAGS CXX CXXFLAGS LDFLAGS LDDLFLAGS LD_PREBIND EXTRA_LDFLAGS EXTRA_LIBS LC_ALL LANG LINGUAS ################ ## LIBOL # cd /usr/ports/$LIBOL_VER glibtoolize --force --copy aclocal autoconf ./configure \ --prefix=/usr/local \ --enable-shared \ --enable-static make make install ################ ## SYSLOG-NG # cd /usr/ports/$SYSLOGNG_VER unsetenv CFLAGS CPPFLAGS CXX CXXFLAGS LDFLAGS LDDLFLAGS LD_PREBIND EXTRA_LDFLAGS EXTRA_LIBS LC_ALL LANG LINGUAS setenv LDFLAGS "-bind_at_load -L/usr/local/bind9/lib -llwres -lbind9" setenv CPPFLAGS "-I/usr/local/bind9/include" # make a couple of changes ... ================================================================ (EDITOR) /usr/ports/$SYSLOGNG_VER/configure.in @164 --- AC_CHECK_LIB(resolv, res_init) +++ dnl AC_CHECK_LIB(resolv, res_init) dnl on Linux res_init is a macro --- AC_CHECK_LIB(resolv, __res_init) +++ dnl AC_CHECK_LIB(resolv, __res_init) @336 --- LIBS="$LIBS $LIBOL_LIBS -Wl,-Bstatic $LEXLIB $LIBWRAP_LIBS $LIBNET_LIBS -Wl,-Bdynamic" +++ LIBS="$LIBS $LIBOL_LIBS -Wl,-dynamic $LEXLIB $LIBWRAP_LIBS $LIBNET_LIBS -Wl,-dynamic" ================================================================ glibtoolize --force --copy aclocal autoconf ./configure \ --prefix=/usr/local \ --enable-debug \ --enable-full-static=no \ --enable-tcp-wrapper make make install ################ ## StartupItems # mkdir -p /Library/StartupItems/SyslogNG ================================================== (EDITOR) /Library/StartupItems/SyslogNG/SyslogNG #!/bin/sh ## # SyslogNG StartupItem # . /etc/rc.common RunService () { case $1 in start ) StartService ;; stop ) StopService ;; restart) RestartService ;; * ) echo "$0: unknown argument: $1";; esac } ## # SyslogNG StartupItem Handlers ## StartService () { if [ "${SYSLOGNG:=-NO-}" = "-YES-" ]; then # if [ -f "/var/run/syslog" ] ; then ConsoleMessage "Stopping SYSLOGD server" sleep 2 killall syslogd # fi ConsoleMessage "Starting SYSLOG-NG Logging Server" /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf -p /var/run/syslog-ng.pid fi } StopService () { if [ -f "/var/run/syslog-ng.pid" ] ; then ConsoleMessage "Stopping SYSLOG-NG Logging Server" sleep 2 kill -9 `cat /var/run/syslog-ng.pid` fi } RestartService () { StopService StartService } RunService "$1" ================================================================= ================================================== (EDITOR) /Library/StartupItems/SyslogNG/StartupParameters.plist { Description = "SyslogNG"; Provides = ("SyslogNG"); Requires = ("Resolver","Network Time","Disks"); Uses = ("Network"); OrderPreference = "None"; Messages = { start = "Starting SyslogNG"; stop = "Stopping SyslogNG"; }; } ================================================== ================================================== (EDITOR) /etc/hostconfig +++ SYSLOGNG=-YES- ================================================== chown -R root:wheel /Library/StartupItems/SyslogNG chmod 755 /Library/StartupItems/SyslogNG chmod 755 /Library/StartupItems/SyslogNG/SyslogNG chmod 644 /Library/StartupItems/SyslogNG/StartupParameters.plist # now let's see what we've got ... % which syslog-ng /usr/local/sbin/syslog-ng % ls -al /usr/local/sbin/syslog-ng -rwxr-xr-x 1 root wheel 453968 Feb 23 11:17 /usr/local/sbin/syslog-ng % otool -L /usr/local/sbin/syslog-ng /usr/local/sbin/syslog-ng: /usr/local/bind9/lib/liblwres.1.dylib (compatibility version 4.0.0, current version 4.2.0) /usr/local/bind9/lib/libbind9.0.dylib (compatibility version 1.0.0, current version 1.5.0) /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 71.1.1) # start it up !!! % /Library/StartupItems/SyslogNG/SyslogNG start % ps -ax | grep syslog-ng 9649 ?? Ss 0:00.02 /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf -p /var/run/syslog-ng.pid smooth sailing from here ... happy trails! richard

1 0

anyone know where these are coming from?
by Mike Pepe 23 Feb '05

23 Feb '05

Hi all, My system is running fedora core 3. My /var/log/messages gets full of these: Feb 20 00:10:03 quadzilla crond(pam_unix)[29549]: session closed for user root for every cron job that runs. However these aren't cron messages, because anything from cron goes into a separate log. I'm wondering if anyone knows a way to filter these without using a match rule, or how it's possible to determine what program is sending these messages? thanks -Mike

2 3

Help on Centralized log host
by Anup Philip 22 Feb '05

22 Feb '05

Hi all, Can anyone give the steps to configure a host to send all logs to a central syslog-ng server in a Solaris environment? It will be really great if anyone can send the sample syslog-ng.conf file for centralized syslog server and client. Thanks a lot in advance. Rgds Anup

2 1

what´s wrong?
by Denis Kot 21 Feb '05

21 Feb '05

Hello to All I want to messages from smbd and nmbd to redirect to another logfile I have: source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; destination d_smbd { file("/var/log/smbd"); }; filter f_smbd { program(smbd.*) or match(smbd); }; filter f_nmbd { program(nmbd.*) or match(nmbd); }; log { source(src); filter(f_smbd); destination(d_smbd); }; log { source(src); filter(f_nmbd); destination(d_smbd); }; log { source(src); destination(messages); }; but messages like: Feb 18 15:02:57 gate smbd[1089]: [2005/02/18 15:02:57, 0] lib/util_sock.c:get_peer_addr(1000) Feb 18 15:02:57 gate smbd[1089]: getpeername failed. Error was Transport endpoint is not connected or Feb 18 15:04:14 gate nmbd[15845]: [2005/02/18 15:04:14, 0] nmbd/nmbd_incomingdgrams.c:process_get_backup_list_request(693) Feb 18 15:04:14 gate nmbd[15845]: process_get_backup_list_request: domain list requested for workgroup MASSNET and I am not a local master browser. still going to /var/log/messages... what´s wrong? -- Denis Kot denis?jabber.org.by ICQ: 13680126 Mobil: +375 29 6-1234-78

4 5

Re:
by Bazsi 20 Feb '05

20 Feb '05

1 0

The right way for kmsg: file or pipe and where is /proc/kmsg if proc is deprecated in 2.6?
by Peter 20 Feb '05

20 Feb '05

Hello. I would like to ask two questions. 1. There is some strange difference between examples and documentation. In reference there is written that /proc/kmsg is file, but in all examples I found it is pipe. What is it pipe or a file in Linux (2.6)? 2. Proc is deprecated in linux kernel 2.6. What is the substitution for /proc/kmsg from the point of kernel logging? BTW. There is a small bug in reference manual. Example 3-9. Using the tcp() is broken and is not working. I think it should look like: destination d_tcp { tcp("10.1.2.3" port(1999) localport(999)); }; instead of: destination d_tcp { tcp("10.1.2.3" port(1999); localport(999)); }; A least this works for me. And on pages of reference manual link on "Note" picture is broken. :) Thank you for your attention, Peter.

1 0