- syslog-ng - lists.balabit.hu

'filter(DEFAULT)' depreciated?
by Til Schubbe 09 Jan '05

09 Jan '05

Hi, having this in my config-file (like the FAQ says)... <QUOTE> log { source(s_all); filter(DEFAULT); destination(df_rest); }; </QUOTE> ... I get this: /etc# syslog-ng -d [...] unresolved reference: DEFAULT ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Error initializing configuration, exiting. Is 'filter(DEFAULT)' depreciated? How can I catch the remaining messages? TIA Til

2 2

RE: [syslog-ng]no logging
by Michael Di Martino 09 Jan '05

09 Jan '05

Thanks for all your help. Syslog-ng is running and collected all my log info. BTW I have been to that bar many times. -----Original Message----- From: Dave Johnson [mailto:davejjohnson@gmail.com] Sent: Saturday, January 08, 2005 5:04 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]no logging Try removing the filter in the log{} line for troubleshooting purposes. Anything logging to udp 514 on that box should be logged to the 60HUDSONST file. Then from there you can spend some time getting the filters just right. Make sure your dirs are setup [/var/syslog-ng/host] as create_dirs is set to no in your optoins. Oh, also FYI--Theres a small dive bar across the street if you start to get too frusterated. ;) (I've spent a few nights in 60 hudson [~7-9 years ago].) On Fri, 7 Jan 2005 17:50:26 -0500, Michael Di Martino <mdm(a)telx.com> wrote: > I was able to get syslog-ng running however nothing is being logged. > I have verified that syslog-ng is running and listing on udp 514 > Here is a copy of my syslog-ng.conf file. > > #----------------------------------------------------------------------- > - > #General > #----------------------------------------------------------------------- > - > options > { > chain_hostnames(no); > create_dirs (no); > dir_perm(0755); > keep_hostname(yes); > log_fifo_size(1024); > long_hostnames(on); > perm(0644); > sync(0); > time_reopen (10); > use_dns(no); > use_fqdn(no); > }; > > #----------------------------------------------------------------------- > #log sources > #----------------------------------------------------------------------- > source network { udp(); }; > #----------------------------------------------------------------------- > #Log Destinations > #----------------------------------------------------------------------- > destination 60HUDSONST > {file("/var/syslog-ng/host/60HUDSONST.log"); }; > > #_______________________________________________________________________ > #host based filters > #----------------------------------------------------------------------- > filter 60HUDSONST { host(192.168.11.1$); }; > > #_______________________________________________________________________ > #put it all together > #----------------------------------------------------------------------- > log { source(network); filter(60HUDSONST); destination(60HUDSONST); > }; > > And Here is a the router syslog commands > logging trap notifications > logging facility local6 > logging 192.168.11.28 > > Any ideas why nothing is being logged on the syslog-ng server > > Any help would be greatly appreciated. > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

no logging
by Michael Di Martino 08 Jan '05

08 Jan '05

I was able to get syslog-ng running however nothing is being logged. I have verified that syslog-ng is running and listing on udp 514 Here is a copy of my syslog-ng.conf file. #----------------------------------------------------------------------- - #General #----------------------------------------------------------------------- - options { chain_hostnames(no); create_dirs (no); dir_perm(0755); keep_hostname(yes); log_fifo_size(1024); long_hostnames(on); perm(0644); sync(0); time_reopen (10); use_dns(no); use_fqdn(no); }; #----------------------------------------------------------------------- #log sources #----------------------------------------------------------------------- source network { udp(); }; #----------------------------------------------------------------------- #Log Destinations #----------------------------------------------------------------------- destination 60HUDSONST {file("/var/syslog-ng/host/60HUDSONST.log"); }; #_______________________________________________________________________ #host based filters #----------------------------------------------------------------------- filter 60HUDSONST { host(192.168.11.1$); }; #_______________________________________________________________________ #put it all together #----------------------------------------------------------------------- log { source(network); filter(60HUDSONST); destination(60HUDSONST); }; And Here is a the router syslog commands logging trap notifications logging facility local6 logging 192.168.11.28 Any ideas why nothing is being logged on the syslog-ng server Any help would be greatly appreciated.

2 1

RE: [syslog-ng]syslog-ng
by Michael Di Martino 08 Jan '05

08 Jan '05

Dave thanks for the response However, I am not sure where to put the path to my syslog-ng.conf file. Below is a copy of my startup script. [root@traffic init.d]# cat syslog-ng init.d script #!/bin/bash # #description: syslog-ng starup script # #process name: syslog-ng #config: /etc/syslog-ng/syslog-ng.conf #pidfile: /var/run/syslog-ng.pid #source function library . /etc/rc.d/init.d/functions RETVAL=0 case "$1" in start) echo -n "Starting syslog-ng: " if [ ! -f /var/run/syslog-ng.pid ] ; then case "`type -type success`" in function) /usr/local/sbin/syslog-ng && success "syslog-ng starup" || \ failure "syslog-ng startup" RETVAL=$? ;; *) /usr/local/sbin/syslog-ng && echo -n "syslog-ng " RETVAL=$? ;; esac [ $RETVAL -eq 0 ] && echo -n "syslog-ng " fi echo ;; stop) echo -n "Shutting down syslog-ng; " if [ -f /var/run/syslog-ng.pid ] ; then killproc syslog-ng fi echo [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/syslog-ng ;; restart) $0 stop $0 start RETVAL=$? ;; status) status syslog-ng RETVAL=$? ;; *) echo "Usage: {start|stop|restart|status}" exit 1 esac [root@traffic init.d]# -----Original Message----- From: Dave Johnson [mailto:davejjohnson@gmail.com] Sent: Friday, January 07, 2005 3:21 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng 1) Does "init.d script" come before #!/bin/bash? 2) before the first case statement modify "RETVAL-0" to be "RETVAL=0" 3) in the lines that have "/usr/local/sbin/syslog-ng" add the "-f" option and give the config file location on your system; because by default its trying to find it "/usr/local/etc/syslog-ng/syslog-ng.conf" and its not there. On Fri, 7 Jan 2005 13:53:07 -0500, Michael Di Martino <mdm(a)telx.com> wrote: > > > > > I have just installed syslog-ng-1.6.5 and was looking forwarded to putting > some of its features to good use. However, I just cannot get this up > according to your install instructions. > > When I try to start "syslog-ng" I get the following errors. I have check the > startup for typos I could not find any. does anyone have any insight to this > error? > > [root@traffic syslog-ng]# /etc/rc.d/init.d/syslog-ng start > /etc/rc.d/init.d/syslog-ng: line 1: init.d: command not found > /etc/rc.d/init.d/syslog-ng: line 14: RETVAL-0: command not found > Starting syslog-ng: Cannot open configuration file > /usr/local/etc/syslog-ng/syslog-ng.conf for reading > Parse error reading configuration file, exiting. (line 1) > [FAILED] > [root@traffic syslog-ng]# > > this is my startup script > > [root@traffic syslog-ng]# vi /etc/rc.d/init.d/syslog-ng > > init.d script > #!/bin/bash > > # > #description: syslog-ng starup script > # > #process name: syslog-ng > #config: /etc/syslog-ng/syslog-ng.conf > #pidfile: /var/run/syslog-ng.pid > > #source function library > . /etc/rc.d/init.d/functions > > RETVAL-0 > > case "$1" in > start) > echo -n "Starting syslog-ng: " > if [ ! -f /var/run/syslog-ng.pid ] ; then > case "`type -type success`" in > function) > /usr/local/sbin/syslog-ng && success "syslog-ng > starup" || \ > failure "syslog-ng startup" > RETVAL=$? > ;; > *) > /usr/local/sbin/syslog-ng && echo -n "syslog-ng " > RETVAL=$? > ;; > esac > [ $RETVAL -eq 0 ] && echo -n "syslog-ng " > fi > echo > ;; > stop) > echo -n "Shutting down syslog-ng; " > if [ -f /var/run/syslog-ng.pid ] ; then > killproc syslog-ng > fi > echo > [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/syslog-ng > ;; > restart) > $0 stop > $0 start > RETVAL=$? > ;; > status) > status syslog-ng > RETVAL=$? > ;; > *) > echo "Usage: {start|stop|restart|status}" > exit 1 > esac > > exit $RETVAL > Thanks in advance. > > > Regards, > Michael DiMartino > Director of MIS > The telx Group, Inc. > 17 State St, 33rd Floor > New York, NY 10004 > T: 212.480.3300 X2022 > C: 646.207.6603 > > > > > Regards, > Michael DiMartino > Director of MIS > The telx Group, Inc. > 17 State St, 33rd Floor > New York, NY 10004 > T: 212.480.3300 X2022 > C: 646.207.6603 > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

syslog-ng
by Michael Di Martino 07 Jan '05

07 Jan '05

I have just installed syslog-ng-1.6.5 and was looking forwarded to putting some of its features to good use. However, I just cannot get this up according to your install instructions. When I try to start "syslog-ng" I get the following errors. I have check the startup for typos I could not find any. does anyone have any insight to this error? [root@traffic syslog-ng]# /etc/rc.d/init.d/syslog-ng start /etc/rc.d/init.d/syslog-ng: line 1: init.d: command not found /etc/rc.d/init.d/syslog-ng: line 14: RETVAL-0: command not found Starting syslog-ng: Cannot open configuration file /usr/local/etc/syslog-ng/syslog-ng.conf for reading Parse error reading configuration file, exiting. (line 1) [FAILED] [root@traffic syslog-ng]# this is my startup script [root@traffic syslog-ng]# vi /etc/rc.d/init.d/syslog-ng init.d script #!/bin/bash # #description: syslog-ng starup script # #process name: syslog-ng #config: /etc/syslog-ng/syslog-ng.conf #pidfile: /var/run/syslog-ng.pid #source function library . /etc/rc.d/init.d/functions RETVAL-0 case "$1" in start) echo -n "Starting syslog-ng: " if [ ! -f /var/run/syslog-ng.pid ] ; then case "`type -type success`" in function) /usr/local/sbin/syslog-ng && success "syslog-ng starup" || \ failure "syslog-ng startup" RETVAL=$? ;; *) /usr/local/sbin/syslog-ng && echo -n "syslog-ng " RETVAL=$? ;; esac [ $RETVAL -eq 0 ] && echo -n "syslog-ng " fi echo ;; stop) echo -n "Shutting down syslog-ng; " if [ -f /var/run/syslog-ng.pid ] ; then killproc syslog-ng fi echo [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/syslog-ng ;; restart) $0 stop $0 start RETVAL=$? ;; status) status syslog-ng RETVAL=$? ;; *) echo "Usage: {start|stop|restart|status}" exit 1 esac exit $RETVAL Thanks in advance. Regards, Michael DiMartino Director of MIS The telx Group, Inc. 17 State St, 33rd Floor New York, NY 10004 T: 212.480.3300 X2022 C: 646.207.6603 Regards, Michael DiMartino Director of MIS The telx Group, Inc. 17 State St, 33rd Floor New York, NY 10004 T: 212.480.3300 X2022 C: 646.207.6603

2 1

klogd and syslog-ng
by John Feeney 07 Jan '05

07 Jan '05

Hello, I was wondering if anyone has specifically seen a problem when syslog-ng and klogd are running together and syslog-ng has /proc/kmsg as a source. I know that they should not be configured to access /proc/kmsg at the same time but before I could remove klogd from the startup script, syslog-ng has hung at a customer site and people (my boss) want proof that this is the cause of the situation. I can only speculate. It appears as though syslog-ng is hanging on a read() system call for the file descriptor to /proc/kmsg. Only around half the number of kernel messages are retrieved from the kernel buffer. The apps logging to syslog-ng will eventually hang. If new kernel data is generated (e.g. rmmod a module) at a later time, syslog-ng will wake up and logging is normal. Any proof or experience that klogd will cause syslog-ng to hang would be greatly appreciated. Could you please send mail directly to me (jfeeney(a)broadbus.com) Thank you so much. John Feeney -------------------------------------------------------- This email message and any files transmitted with it contain confidential information intended only for the person(s) to whom this email message is addressed. If you have received this email message in error, please notify the sender immediately by telephone or email and destroy the original message without making a copy. Thank you.

2 1

binary distribution of libol-0.3.13
by Yen, Peter-HK (Hong Kong TS) 07 Jan '05

07 Jan '05

Hi syslog-ng experts, We are currently trying to install the syslog-ng on an HPUX v11.0, and whilst doing so we encountered problems trying to install libol. With reference to this thread in the syslog-ng mailing list https://lists.balabit.hu/pipermail/syslog-ng/2004-July/006249.html We see that you may have a libol-0.3.13 for hpux 11.0 available. Would you mind providing me a copy of such software, or direct me to a URL where this can be obtained? Million thanks! Best regards, Peter Yen Hewlett-Packard HK SAR Limited Tel: (852) 3559 7412 Fax: (852) 2506 3734 email: peter-hk.yen(a)hp.com _______________________________ The information transmitted is intended solely for the individual or entity to which it is addressed and may contain Hewlett-Packard Company confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you have received this email in error please contact the sender and delete the material from any computer.

2 1

unwanted space at the end of each line
by Bernard Brandl 07 Jan '05

07 Jan '05

hi everybody, I've a problem when syslog-ng writes remote logs, each time the log message is sent over the network, syslog-ng add a white space at the end of the line. e.g : [root@keweb01 root]# logger -d -p local3.info "nanard" at the same time, on the central log host : [kelogs01]# strace -p 27431 -s 1500 -e recvfrom,write recvfrom(3, "<158>Jan 6 14:09:45 keweb01.search.test.ke.echo root: nanard\n", 2048, 0, {sa_family=AF_INET, sin_port=htons(33594), sin_addr=inet_addr("10.234.56.130")}, [16]) = 62 write(10, "Jan 6 14:09:45 keweb01.search.test.ke.echo root: nanard \n", 58) = 58 the message "nanard\n" was changed into "nanard \n" I use the same options for all hosts : # template("$DAY/$MONTH/$YEAR $HOUR:$MIN:$SEC $HOST $MSG\n") # template_escape(off) syslog-ng version 1.6.4 any suggestions? thanks -- Bernard Brandl

2 2

RE: [syslog-ng]MYSQL pipe 2
by Robert.COward＠deploymenthealth.osd.mil 06 Jan '05

06 Jan '05

Steven, Thanks for the quick response. here is what my mysql entry looks like in /etc/rc.local: # MYSQL if [ X"${mysql}" == X"YES" ]; then if [ -x /usr/local/bin/mysqld_safe ]; then echo -n " mysql"; /usr/local/bin/mysqld_safe --socket=/var/www/var/run/mysql/mysql.sock & sleep 10 echo -n " syslog-ng2mysql"; /etc/check_syslog-ng2mysql.sh & fi fi and here is the /etc/check_syslog-ng2mysql.sh script i sent in yesterday: #!/bin/sh ps=`ps -ax | grep "\--password=x" | awk '{ print $9 }'` if [[ $ps != "" ]]; then echo "syslog-ng2mysql is alive." else if [ ! -p /tmp/mysql.pipe ]; then mkfifo /tmp/mysql.pipe kill -HUP `cat /var/run/syslog-ng.pid` fi mysql -u root --password=password syslog < /tmp/mysql.pipe fi I don't think the problem is that mysqld is not started when i issue the mysql command in the script. I think it has something to do with how openbsd starts daemons from within /etc/rc.local and /etc/rc. When i reboot this server, the /etc/check_syslog-ng2mysql.sh does nto start at all. Basically I am just looking for other ways to start /etc/check_syslog-ng2mysql.sh or more to the point the "mysql -u root --password=password syslog < /tmp/mysql.pipe" line which just dumps the data from a named pipe created by syslog-ng, over to the mysql db. Thanks for all the help. --- 5 January 2005 "We must learn to welcome and not to fear the voices of dissent. We must dare to think about "unthinkable things" because when things become unthinkable, thinking stops and action becomes mindless." (J. William Fulbright, 1905-1995) --- Robert V. Coward UNIX System Administrator Computer Science Corporation

2 1

Re: [syslog-ng]syslog-ng development release 1.9.2
by Balazs Scheidler 06 Jan '05

06 Jan '05

On Wed, 2005-01-05 at 10:56 -0800, nate(a)campin.net wrote: > Thanks a lot (sorry for the top post, using my webmail from work). > > I have a missing function again: > > test_msgparse.c:66: warning: format argument is not a pointer (arg 3) > test_msgparse.c:67: warning: format argument is not a pointer (arg 3) > test_msgparse.c:68: warning: format argument is not a pointer (arg 3) > gcc -I../src -Wall -g -o test_msgparse test_msgparse.o ../src/logmsg.o > ../src/misc.o ../src/gsockaddr.o -ll -lnsl -lsocket -ldoor -L/opt/csw/lib > -lglib-2.0 -lintl -liconv -levtlog > test_msgparse.o: In function `testcase': > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/tests/test_msgparse.c:50: > undefined reference to `__STRING' > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/tests/test_msgparse.c:53: > undefined reference to `__STRING' > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/tests/test_msgparse.c:54: > undefined reference to `__STRING' > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/tests/test_msgparse.c:55: > undefined reference to `__STRING' > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/tests/test_msgparse.c:60: > undefined reference to `__STRING' > test_msgparse.o:/export/home/ncampi/syslog-ng-1.9.2+20050105+1302/tests/test_msgparse.c:64: > more undefined references to `__STRING' follow > ./src/gsockaddr.o: In function `g_inet_aton': > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/src/gsockaddr.c:63: undefined > reference to `inet_aton' > ../src/gsockaddr.o: In function `g_sockaddr_inet_new': > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/src/gsockaddr.c:348: undefined > reference to `inet_aton' > ./src/gsockaddr.o: In function `g_sockaddr_inet_range_new': > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/src/gsockaddr.c:456: undefined > reference to `inet_aton' > collect2: ld returned 1 exit status > make[2]: *** [test_msgparse] Error 1 > make[2]: Leaving directory > `/export/home/ncampi/syslog-ng-1.9.2+20050105+1302/tests' > make[1]: *** [all-recursive] Error 1 > make[1]: Leaving directory `/export/home/ncampi/syslog-ng-1.9.2+20050105+1302' > make: *** [all] Error 2 > > > Isn't that a standard library function? Am I doing something wrong here? that is only a test program and your syslog-ng binary should have been compiled at this phase. inet_aton is a standard symbol, but it is not in stock libc under solaris, it is either in -lsocket or in -lnet. -- Bazsi

1 0

Problems with Netscreen log entries
by Paul Mindeman 06 Jan '05

06 Jan '05

Running sylog-ng 1.6.4 on Solaris 9 Log entries from my UNIX devices log fine. Log entries from my Netscreen devices seem to be missing the end of line terminator, as the entries run together in the log file. The default syslog daemon was able to handle these entries fine. Any ideas on how to fix this? The options in the syslog-ng.conf file are: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; Thanks -- Paul Mindeman BTInet Systems Administrator 701-355-5587 mindeman(a)btinet.net

3 2

syslog-ng development release 1.9.2
by Balazs Scheidler 05 Jan '05

05 Jan '05

Hi, It is my pleasure to announce the availability of the latest development release for syslog-ng, and a related library called eventlog. This release is actually usable, and although it is still not recommended to be used on production systems, running it on a spare system with a real log feed would be very useful indeed, to see how it behaves with various real life configurations. The major differences between syslog-ng 1.9.2 and the releases in the 1.6.x branch are outlined in the NEWS file attached to the end of this message. A couple of NEWS News for the 1.9.2 release Mon, 03 Jan 2005 22:03:02 +0100 Well, it's been a long time since the last syslog-ng development release simply because I was involved in too many things in parallel. Good news that the release is actually quite usable, I've been running it on my laptop for a week now and I think it is now time to gather some real life experience. * Fixed a couple of memory leaks. * Fixed SIGHUP support. * Fixed program startup to make sure all important error information is logged. * Fixed program destinations by adding setsid() call after forking. * Fixed flow controlled log path support. * Added the possibility to use braces around macro references (like in '${MSG}\n') * Added macros missing from this branch added to 1.6.x since the last release (PRI and MSGONLY). News for the 1.9.1 release Wed, 22 Jan 2003 12:13:44 +0100 This release is still not intended for production use. It has a good number of new features and a couple of them may not be stable enough. New features: * template declarations, the possibility to define a template once and refer to it * flow controlled log paths work, and they are also configurable * supports RFC3339 timestamps with second fractions and time zones, time zone conversion & source time zone specification * MARK messages are generated * keep alive for connections as well as listeners * the ability to follow log files as they are written to * the possibility to mark parts of a message using standard '(' and ')' regexp operators and refer to matches within templates (either filenames or content) This program is still ALPHA. News for the 1.9.0 release Thu, 9 May 2002 20:01:11 +0200 This release is the first release of the new reimplementation of syslog-ng. I moved to using glib instead of libol, as glib is more mature and provides several nice & easy to use features. Here's a bunch of nice things about 1.9.0: * supports flow controlled log paths (still not possible to configure it, but the code exists in the core) * better support for macros (macro support is moved out of affile, thus any other drivers may use it) * more robust detection of closed destination sockets (a closed channel is immediately detected, not at the first write) This avoids losing a log message when the connection is broken. * supports respawning destination programs (should be used with care to avoid DoS situations). This makes it easier to integrate third party extensions to syslog-ng. (SQL backends, on-line log analysis etc) * performance improvements, instead of using linear lookup in linked lists, I use hashtables everywhere. * the ability to define unparsed sources, makes it easier to integrate things like Apache logs * many internal reorganizations to make it easier to implement things like hashed log files, SSL protected TCP sessions and so on. Things still missing: * there are some new features with no configuration interface * internal messages always go to /dev/stderr * Sun's STREAMS is not yet supported 1.9.0 is currently in an ALPHA state, it's been tested only on my development computer, and not real-life traffic. -- Bazsi

2 3

MYSQL pipe
by Robert.COward＠deploymenthealth.osd.mil 03 Jan '05

03 Jan '05

I have syslo-ng running fine on OpenBSD 3.6. Logging works properly to file. I also have MYSQL up and running. I can get a named pipe open and get MYSQL to pickup the log entries with no problem. However I am at a lost as to how to start this process at boot up or automatically. If I call the following script, which works from the command line, from either /etc/rc or /etc/rc.local the mysql client is never kicked of, and /etc/rc hangs. If I put the same script into a cron job, cron hangs. Script: #!/bin/sh ps=`ps -ax | grep "\--password=x" | awk '{ print $9 }'` if [[ $ps != "" ]]; then echo "syslog-ng2mysql is alive." else if [ ! -p /tmp/mysql.pipe ]; then mkfifo /tmp/mysql.pipe kill -HUP `cat /var/run/syslog-ng.pid` fi mysql -u root --password=password syslog < /tmp/mysql.pipe fi I really do not know what is wrong. Can anyone provide examples on their scripts for starting syslog-ng to named pipe to mysql? --- 3 January 2005 "Hackers make toys. Crackers break them." (Peter Seebach) --- Robert V. Coward UNIX System Administrator Computer Science Corporation

2 1

which os for a central logserver?
by Tamas MEZEI 03 Jan '05

03 Jan '05

Hi, I was just wondering in these days of the big'n'mighty systems if there's a preference for the OS (more exactly Gentoo Linux or FreeBSD) of a central logserver using syslog-ng. Are there any OS-specific problems or specialities that I should be aware of if I'm using this or that OS? Or are there any syslog-ng specific things depending on the host OS? If anybody has some experience using those OSes as central logservers, would he say some words about the positive-negative sides (in private, maybe not everybody's interested in this chit-chat). The machine would receive logs from nearly 20 servers (mostly Linux and 3 Windows machines), and has the job to analyze the stuff periodically. Thanks in advance, Tamas

2 2

Reliability of various mysql logging methods
by Ed Walker 02 Jan '05

02 Jan '05

We're using syslog-ng, logging about 2million lines/day from a number of email filtering servers. We log to a new file each day. Right now we've got a perl script that runs just after midnight, and parses each file and dumps the info into a mysql database. For each domain, we have a separate database, for each month, a separate table. We're interested in moving to direct SQL injection, but are concerned about the possibility of losing logging information if the sql server goes down, or the pipe or injection script die. What's the most reliable way to do this? Named pipe? Socket? Anybody willing to share their configurations and/or scripts? Thanks- Ed

2 1

Binaries or working Makefile for sqlsyslogd ?
by Daniel Baker 02 Jan '05

02 Jan '05

Greetings. I have been looking for a working Makefile or binaries for an syslog-ng to sql source I have found at: http://www.frasunek.com/sources/security/sqlsyslogd/ Does anyone here have any good links for me? I would be most appreciative. Dan.

1 0

Playing "catchup"...
by Ed Walker 02 Jan '05

02 Jan '05

Thought of this just after sending that last message.... In the event that SQL injection dies on the central loghost, we've thought of keeping a copy in a file as well. And if, for some reason, syslog-ng on the central server dies, or connectivity is lost, we're already keeping a copy of the logging data on each remote server. So, what's the best way to play "catch up" when something dies, and making it as easy as possible to import the missed data, without accidentally introducing duplication? Any ideas? Thanks- Ed

2 1

syslog-ng stopped working yesterday
by Gorm J. Siiger 31 Dec '04

31 Dec '04

Hi, I have a wierd problem, yesterday around 14:00 CET syslog-ng just stops working. The daemon runs, but allmost nothing is writtes to the logs. I have used syslog-ng for some years now, and it never let me down. When running syslog-ng -dv the last things it tell me is: Objects alive: 203, garbage collected: 1 AF_INET client connected from 80.63.205.142, port 3630 io.c: Preparing fd 14 for reading And then it stops logging, but seeing with tcpdump that i receive tons of syslog, and even local logging with "logger" doesn't work. Installing a new syslog-ng on another machine does the same, which confuses me. Any good ideas ? -- Med venlig hilsen / Best regards Gorm J. Siiger - mail: gjs(a)sonnit.dk ------------------------------------ SonnIT, Sonnerupvej 83B, 4682 Tureby Tel. 70274777 - http://www.sonnit.dk

4 5

RE: [syslog-ng]Problem with TCP connection not timing out
by ARGEXT-HIDALGO, FRANCISCO 30 Dec '04

30 Dec '04

You´re right, I was confusing tcp-keep-alive option with keep-alive, since tcp-keep-alive didn't work in my syslog-1.6.2 I thought you meant the keep-alive option. I compiled the last version and now the option works and my problem is solved, thank you very much. Francisco -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Balazs Scheidler Sent: Martes, 28 de Diciembre de 2004 03:17 p.m. To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Problem with TCP connection not timing out On Tue, 2004-12-28 at 10:35 -0300, ARGEXT-HIDALGO, FRANCISCO wrote: > Thanks for the response, I'll test it now, but the documentation says that > this is the default behaviour, so I'm not sure if this will change anything. > On the other hand, shouldn't the OS drop these connections?, some of them > have days there, and this monday, there where almost 40 dead connections > that where "ESTABLISHED". > I'm sorry but no, the OS does not reap these connections. Some application layer timeout could solve the issue, though at the same time it might also cause other problems like message drops. Where did you read that it was default? <row> <entry>tcp-keep-alive()</entry> <entry>yes or no</entry> <entry> Available for tcp() only, and specifies whether to enable TCP keep alive messages using the SO_KEEPALIVE socket option. </entry> <entry>no</entry> </row> Nevertheless looking at the source it seems not to be enabled by default. But if you tell me a reference I'll fix the documentation. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

testing from a remote server
by Michael Gargiullo 29 Dec '04

29 Dec '04

I have syslog-ng running, and it logs everything from the server it runs on. How can I test to make sure it logs from remote sources. I'm kind of new to syslog-ng. My server listens to UDP 514, and allows it through the firewall. I have 2 devices I really want to have log to it. A Cisco Aironet 1100, and a symantec firewall device we use on our back up connection. How can I test to make sure syslog-ng is capturing what I'd like it to. -Mike

1 1

Syslog-ng/libol: broken snapshots creation
by José Pedro Oliveira 29 Dec '04

29 Dec '04

Hi, The last syslog-ng (and libol) snapshot listed in the http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot/ is from 2004-12-06. Could someone correct the problem and, maybe, delete libol-0.3.13 and syslog-ng-1.6.4 snapshots? Thanks in advance, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

1 0

RE: [syslog-ng]Problem with TCP connection not timing out
by ARGEXT-HIDALGO, FRANCISCO 28 Dec '04

28 Dec '04

Thanks for the response, I'll test it now, but the documentation says that this is the default behaviour, so I'm not sure if this will change anything. On the other hand, shouldn't the OS drop these connections?, some of them have days there, and this monday, there where almost 40 dead connections that where "ESTABLISHED". -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Balazs Scheidler Sent: Lunes, 27 de Diciembre de 2004 05:58 p.m. To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Problem with TCP connection not timing out On Wed, 2004-12-22 at 17:16 -0300, ARGEXT-HIDALGO, FRANCISCO wrote: > I'm really not sure what the problem is, I'm logging with a server in different countries and they send through TCP the logs to a central server. The problem I'm having is that the central server is not dropping TCP connections that no longer exist. > As an example: > > CENTRAL SERVER: > TCP > Local Address Remote Address Swind Send-Q Rwind Recv-Q State > -------------------- -------------------- ----- ------ ----- ------ ------- > CENTRAL.shell syslogA.33969 5840 0 10136 0 ESTABLISHED > CENTRAL.shell syslogB.4930 5840 0 10136 0 ESTABLISHED > CENTRAL.shell syslogC.33924 24820 0 8760 0 ESTABLISHED > CENTRAL.shell syslogC.33925 24820 0 8760 0 ESTABLISHED > CENTRAL.shell syslogD.44925 5840 0 10136 0 ESTABLISHED > CENTRAL.shell syslogE.32783 24820 0 8760 0 ESTABLISHED > CENTRAL.shell syslogC.33926 24820 0 8760 0 ESTABLISHED > CENTRAL.22 host.1624 51968 0 10136 0 ESTABLISHED > CENTRAL.shell syslogD.44934 5840 0 10136 0 ESTABLISHED > > SYSLOGC: > TCP: IPv4 > Local Address Remote Address Swind Send-Q Rwind Recv-Q State > -------------------- -------------------- ----- ------ ----- ------ ------- > syslogC.33926 CENTRAL.shell 8760 0 24820 0 ESTABLISHED > SyslogC.22 host.4663 57920 0 24616 0 ESTABLISHED > > > Notice that the active conection is the one from SyslogC port 33926, but CentralSyslog has 3 established connections (33924, 33925 and 33926), 33924 is active since some days ago, but doesn't exist in the original server. The problem is that my total connections allowed start to fill up and then I can no longer connect. > Any ideas on what could this be? Maybe there were some network outages and the connection on the client timed out, but as there are no packets for established connections without traffic this connection remained in the server's connection table. A possible solution is to enable TCP keep-alive, which periodically sends probes for established connections, and reports an error if the peer does not react to a probe, you can enable this by setting tcp-keep-alive option to yes, for example: source s_tcp { tcp(port(2000) tcp-keep-alive(yes)); }; -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

STATS: dropped 644 ?
by Matthias Keller 28 Dec '04

28 Dec '04

Hi I'm using syslog-ng for quite a while now and finally want to resolve this problem (I suppose)... I pretty much daily get a whole bunch of dropped messages... It's not always at the same times but always for several hours! I'm logging the stats hourly so usually for about 8h a day I get drops in the hundreds....? I guess this isn't normal and shouldn't be as my system isn't really busy at all... As options I'm using: options { long_hostnames(off); sync(5); # How many lines have to be queued until a disc synch is done. use 0 for immediate stats(3600); log_fifo_size(8192); log_msg_size(1024); time_reopen(10); }; Since there are a lot of apps running on the system I dont go for a 'Application X gets localZ' approach but instead I'm filtering by application name One example entry would be: filter f_dhcpd { program("dhcpd"); }; destination dhcpd { file("/var/log/dhcpd.log"); }; log { source(src); filter(f_dhcpd); destination(dhcpd); flags(final); }; I dont know if that flags(final) does some harm as I haven't seen that much in the wild but I dont want any further rule care about dhcpd-logs so I want to stop matched entries there... I have about 10 such entries... I also have a catchall in the end: destination other { file("/var/log/other"); }; log { source(src); destination(other); }; which doesn't really catch anything at all because the messages before already catches pretty much everything I can give you the whole config if you like So I'm hoping you could give me some good advices on how to track down my problem? Thanks!! Matt

2 2

can't figure out how to convert syslog.conf entry to syslog-ng
by Philip J. Hollenback 28 Dec '04

28 Dec '04

I have the following syslog.conf entry on my linux server: *.info;mail.none;mail.err;authpriv.none;auth.none;auth.warning;cron.none;cron.warning;local0.none /var/log/messages The syslog2ng script converts it to this: destination d_mesg { file("/var/log/messages"); }; filter f_1 { level(info..emerg); }; filter f_2 { not facility(mail); }; filter f_3 { facility(mail) and level(err..emerg); }; filter f_4 { not facility(authpriv); }; filter f_5 { not facility(auth); }; filter f_6 { facility(auth) and level(warning..emerg); }; filter f_7 { not facility(cron); }; filter f_8 { facility(cron) and level(warning..emerg); }; filter f_9 { not facility(local0); }; log { source(local); filter(f_1); filter(f_2); filter(f_3); filter(f_4); filter(f_5); filter(f_6); filter(f_7); filter(f_8); filter(f_9); destination(d_mesg); }; Problem: this doesn't work; the above syslog-ng.conf entry doesn't send any messages to /var/log/messages. I know syslog-ng is working because other entries in the config file do catch messages as they should. I've narrowed it down to something with the compound filter statements. If I remove f_3, f_6, and f_8, the entry starts working. Works correctly on regular syslog. syslog-ng version 1.6.5. Thanks, P. -- Philip J. Hollenback Telemetry Investments phollenback(a)telemetry-investments.com

3 3

reading debug output
by Nate Campi 28 Dec '04

28 Dec '04

I have syslog-ng (1.6.4) running as "syslog-ng -d -v" and I happen to know that messages are buffering up, because I defined a TCP endpoint where there's nothing listening. I can't tell from the debug output what the buffer looks like (how full it is), is it possible to tell or is there no way to know? Well, no way except failed connection messages on internal() and the eventual STATS messages telling of dropped messages of course. TIA -- Nate "A computer will do what you tell it to do, but that may be much different from what you had in mind." - JOSEPH WEIZENBAUM, quoted in Time

1 0