- syslog-ng - lists.balabit.hu

typo? changelog
by Pavel Urban 27 Dec '04

27 Dec '04

Hello, I've tried to rebuild our local RPM for syslog-ng and was somewhat confused by 1.6.5 ChangeLog claiming that the required libol version is 0.3.15. It seems to me that it should be 0.3.14, am I right? Or am I wrong as usual? ;-) -- *********************************************************************** Pavel Urban (pavel.urban(a)imaginet.cz) IOL system disaster Internet OnLine, owned by Cesky Telecom, a.s. (www.ct.cz) *********************************************************************** Vegetables should not operate electronic equipment. Computer Stupidities, http://rinkworks.com/stupid/ ***********************************************************************

2 1

Problem with TCP connection not timing out
by ARGEXT-HIDALGO, FRANCISCO 27 Dec '04

27 Dec '04

I'm really not sure what the problem is, I'm logging with a server in different countries and they send through TCP the logs to a central server. The problem I'm having is that the central server is not dropping TCP connections that no longer exist. As an example: CENTRAL SERVER: TCP Local Address Remote Address Swind Send-Q Rwind Recv-Q State -------------------- -------------------- ----- ------ ----- ------ ------- CENTRAL.shell syslogA.33969 5840 0 10136 0 ESTABLISHED CENTRAL.shell syslogB.4930 5840 0 10136 0 ESTABLISHED CENTRAL.shell syslogC.33924 24820 0 8760 0 ESTABLISHED CENTRAL.shell syslogC.33925 24820 0 8760 0 ESTABLISHED CENTRAL.shell syslogD.44925 5840 0 10136 0 ESTABLISHED CENTRAL.shell syslogE.32783 24820 0 8760 0 ESTABLISHED CENTRAL.shell syslogC.33926 24820 0 8760 0 ESTABLISHED CENTRAL.22 host.1624 51968 0 10136 0 ESTABLISHED CENTRAL.shell syslogD.44934 5840 0 10136 0 ESTABLISHED SYSLOGC: TCP: IPv4 Local Address Remote Address Swind Send-Q Rwind Recv-Q State -------------------- -------------------- ----- ------ ----- ------ ------- syslogC.33926 CENTRAL.shell 8760 0 24820 0 ESTABLISHED SyslogC.22 host.4663 57920 0 24616 0 ESTABLISHED Notice that the active conection is the one from SyslogC port 33926, but CentralSyslog has 3 established connections (33924, 33925 and 33926), 33924 is active since some days ago, but doesn't exist in the original server. The problem is that my total connections allowed start to fill up and then I can no longer connect. Any ideas on what could this be? Thank you.

2 1

syslog2ng not working on Solaris10
by Majumdar, Anamitra 23 Dec '04

23 Dec '04

Hello, I need to convert some existing syslog.conf files to the syslog-ng configuration. There is an utility syslog2ng which is packaged with syslog-ng. But does not work on solaris 10. I am having the folowing error ./syslog2ng <syslog.conf> syslog-ng.conf ./syslog2ng: BEGIN: not found ./syslog2ng: getline: not found ./syslog2ng: syntax error at line 9: `close' unexpected Anamitra X4696

3 2

RE: [syslog-ng]syslog2ng not working on Solaris10
by Stew Redfield 23 Dec '04

23 Dec '04

on Solaris10 (s10_63 at least) /usr/bin/awk || /usr/bin/nawk Usually that error means a missing ' in the script or sourced in config. Happy non-religious merry generic holiday greetings... -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Ed Ravin Sent: Wednesday, December 22, 2004 9:46 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog2ng not working on Solaris10 On Wed, Dec 22, 2004 at 05:40:31PM -0800, Majumdar, Anamitra wrote: > There is an utility syslog2ng which is packaged with syslog-ng. > But does not work on solaris 10. > > I am having the folowing error > > ./syslog2ng <syslog.conf> syslog-ng.conf > ./syslog2ng: BEGIN: not found > ./syslog2ng: getline: not found > ./syslog2ng: syntax error at line 9: `close' unexpected Look at the first few lines of syslog2ng: #!/usr/bin/awk -f # # syslog2ng # # Translator from syslog.conf to syslog-ng.conf # by Jonathan W. Marks <j-marks(a)uiuc.edu> You probably don't have /usr/bin/awk - maybe Sun keeps it in /bin, /usr/ucb, or some other directory? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]pipe destination and HPUX
by Stephan Hendl 21 Dec '04

21 Dec '04

I've tried that out but it doesn't help me. The messages from the "syslog-clients" arrive perectly and are written into the cic.log-file but _not_ into the pipe ;-((( Stephan >>> brett.stevens(a)hubbub.com.au 12/21/04 12:02 >>> Looking at your config you seem to have specified a ip and prot for your tcp. Just try it without such as source s_tcp{();}; This is what I use to log approximately 80-100 devices to two servers (number varies as this is a development site with large amounts of vmware servers. Best of luck Brett Stevens -----Original Message----- From: Stephan Hendl [mailto:Stephan.Hendl@lds.brandenburg.de] Sent: Monday, December 20, 2004 6:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]pipe destination and HPUX Hi all, I try to get syslog messages via tcp and want to write them into a pipe with HPUX 11.11v1 and syslog-ng-1.6.5. The messages arrive perfectly (I conttrolled this via writing in a file) but the pipe is still empty. Only messages from local sources get into it. Does anybody have an idea? Ciao Stephan # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; source s_tcp { tcp(ip(10.128.8.173) port(10514) keep-alive(no)); }; destination d_cic.log { file("/var/adm/syslog/cic.$YEAR$MONTH$DAY" owner("root") group("sys") perm(0644) template( "$DATE $HOST $MESSAGE\n") template-escape(yes)); }; destination d_cic.pipe { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template( "$DATE $HOST $MESSA GE\n") template-escape(yes)); }; log { source(s_sys); destination(d_cic.log); }; log { source(s_tcp); destination(d_cic.log); }; log { source(s_sys); destination(d_cic.pipe); }; log { source(s_tcp); destination(d_cic.pipe); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]pipe destination and HPUX
by Brett Stevens 20 Dec '04

20 Dec '04

Looking at your config you seem to have specified a ip and prot for your tcp. Just try it without such as source s_tcp{();}; This is what I use to log approximately 80-100 devices to two servers (number varies as this is a development site with large amounts of vmware servers. Best of luck Brett Stevens -----Original Message----- From: Stephan Hendl [mailto:Stephan.Hendl@lds.brandenburg.de] Sent: Monday, December 20, 2004 6:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]pipe destination and HPUX Hi all, I try to get syslog messages via tcp and want to write them into a pipe with HPUX 11.11v1 and syslog-ng-1.6.5. The messages arrive perfectly (I conttrolled this via writing in a file) but the pipe is still empty. Only messages from local sources get into it. Does anybody have an idea? Ciao Stephan # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; source s_tcp { tcp(ip(10.128.8.173) port(10514) keep-alive(no)); }; destination d_cic.log { file("/var/adm/syslog/cic.$YEAR$MONTH$DAY" owner("root") group("sys") perm(0644) template( "$DATE $HOST $MESSAGE\n") template-escape(yes)); }; destination d_cic.pipe { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template( "$DATE $HOST $MESSA GE\n") template-escape(yes)); }; log { source(s_sys); destination(d_cic.log); }; log { source(s_tcp); destination(d_cic.log); }; log { source(s_sys); destination(d_cic.pipe); }; log { source(s_tcp); destination(d_cic.pipe); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

how to write efficient filters?
by Timothy Webster 20 Dec '04

20 Dec '04

Which is more efficient? filter f_pop_acc { program("pop3") and match("not have pop"); }; filter f_mail { facility(mail); }; log { source(s_sys); filter(f_mail); filter(f_pop_acc); destination(d_pop_acc); or filter f_pop_acc { facility(mail) and program("pop3") and match("not have pop"); }; log { source(s_sys); filter(f_pop_acc); destination(d_pop_acc); Sorry too lazy to look at the code :) -tim

3 3

pipe destination and HPUX
by Stephan Hendl 20 Dec '04

20 Dec '04

Hi all, I try to get syslog messages via tcp and want to write them into a pipe with HPUX 11.11v1 and syslog-ng-1.6.5. The messages arrive perfectly (I conttrolled this via writing in a file) but the pipe is still empty. Only messages from local sources get into it. Does anybody have an idea? Ciao Stephan # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; source s_tcp { tcp(ip(10.128.8.173) port(10514) keep-alive(no)); }; destination d_cic.log { file("/var/adm/syslog/cic.$YEAR$MONTH$DAY" owner("root") group("sys") perm(0644) template( "$DATE $HOST $MESSAGE\n") template-escape(yes)); }; destination d_cic.pipe { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template( "$DATE $HOST $MESSA GE\n") template-escape(yes)); }; log { source(s_sys); destination(d_cic.log); }; log { source(s_tcp); destination(d_cic.log); }; log { source(s_sys); destination(d_cic.pipe); }; log { source(s_tcp); destination(d_cic.pipe); };

1 0

Christmas
by Jay Guerette 19 Dec '04

19 Dec '04

Although 10 days too late, I was thinking: "What can Mikulás bring Balázs for Christmas?" After all, giving us syslog-ng and 5 years of support on this list deserves *something*. Then it hit me; "I'll buy a syslog-ng support contract!" I'm reasonably sure I can get my company to go for it; so how can I get prices on the various support packs available?

3 5

iptables syslog-ng logs way to big
by garvald＠bluemail.ch 19 Dec '04

19 Dec '04

hi there bit of a problem with too many logs being generated and i'm not sure what to do. I'm using a iptables firewall setup like this: $IPTABLES -t filter -N ACCEPTLOG $IPTABLES -t filter -A ACCEPTLOG -j LOG --log-prefix "iptables:" --log-level\ debug $IPTABLES -t filter -A ACCEPTLOG -j ACCEPT the firewall is also a masquerading NAT gateway for about 50 clients. I want to record all traffic flowing through the gateway, so along with the firewall rules stated above i have this in my syslog-ng.conf : destination iptables { file("/var/log/iptables"); }; filter iptables { match("^iptables:"); }; log { source(src); filter(iptables); destination(iptables); }; all very nice, except for the fact that within 24 hours the log grew to 500MB's, which is a little too big. Of course i've configured logrotate to g-zip the file every day which greatly reduces the size, but i'd much prefer to have smaller logs but with the necessary information still there. Here's an example from one client just for a simple request to port 445: Dec 17 11:33:18 iptables:IN=eth1 OUT=eth0 SRC=192.168.1.220 DST=213.220.xxx.xxx LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=974 DF PROTO=TCP SPT=32900 DPT=445 WINDOW=10136 RES=0x00 ACK URGP=0 this entry is repeated 10 times per second !! i've tried different log levels in my firewall but it doesnt seem to change anything. Would be grateful for any help. cheers, garvald

4 3

-v and -p parameters not working as advertised
by syslogng＠sanitarium.net 16 Dec '04

16 Dec '04

Excerpts from man syslog-ng: -p <filename> Write the current PID information to the specified file. -v Enable verbose mode. Process will not become a daemon. Prints out fewer messages, compared to -d. Despite what that says, syslog-ng forks into the background when -v is used. Also, when -d is used to force syslog-ng to run in the foreground it does not create a pid file even when -p is used. I need the pidfile to be created even when running in the foreground. I am running syslog-ng with: syslog-ng -d -p /var/run/syslog-ng.pid -- Kevin

1 0

repost: line truncation with spamd
by scott 15 Dec '04

15 Dec '04

Is anyone looking into this issue? To refresh your memory, all five of these entries appear on the same line: 2004-12-09T01:09:35+1000 chloe spamd[704]: connection from localhost [127.0.0.1] at port 40811 2004-12-09T01:09:35+1000 chloe spamd[13558]: info: setuid to slittle succeeded 2004-12-09T01:09:35+1000 chloe spamd[13558]: processing message <35089309.09501@cbuki@getherbalnow.info> for slittle:1000. 2004-12-09T01:09:36+1000 chloe spamd[13558]: identified spam (20.8/5.0) for slittle:1000 in 0.8 seconds, 1475 bytes. 2004-12-09T01:09:36+1000 chloe qmail: 1102514976.416174 new msg 12808775

3 4

[PATCH] syslog-ng-1.6.5+20041206 fixes missing facility/priority in afinet.c
by Roberto Nibali 15 Dec '04

15 Dec '04

Hello, Somehow we either forgot this piece or it dropped out of the CVS again ;). The inlined patch fixes a missing facility/priority addition for template expansion over the network in afinet.c The goal is to be able to send the node name in each syslog message in order to distinguish the two systems: unfortunately when using templates in destination files, the facility/priority is lost. This fixes it I hope: --- syslog-ng-1.6.5+20041206/src/afinet.c 2004-08-05 13:35:12.000000000 +0200 +++ syslog-ng-1.6.5+20041206-fixed/src/afinet.c 2004-12-08 20:44:15.000000000 +0100 @@ -595,7 +595,8 @@ struct ol_string *msg_line; if (self->template_output) { - msg_line = c_format("%fS", + msg_line = c_format("<%i>%fS", + msg->pri, expand_macros( self->cfg, self->template_output, I'm under the distinct impression that something like that has already been addressed in the past. Maybe it was a copy'n'paste error or so ... Take care, Roberto Nibali, ratz -- ------------------------------------------------------------- addr://Rathausgasse 31, CH-5001 Aarau tel://++41 62 823 9355 http://www.terreactive.com fax://++41 62 823 9356 ------------------------------------------------------------- terreActive AG Wir sichern Ihren Erfolg -------------------------------------------------------------

2 9

Using logger with syslog-ng
by Vaibhav Goel 15 Dec '04

15 Dec '04

Hi all, I am new syslog-ng user. I am trying to figure out how to get a loghost going and taking baby steps with the documentation available :-) I got syslog-ng configured on a Linux server as such: source s_test { tcp(ip(0.0.0.0) port(514)); }; destination d_test { file("/var/log/test.log"); }; log { source(s_test); destination(d_test); }; I can connect to localhost on 514 fine: telnet localhost 514 Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. So it appears that syslog-ng is at least running fine. I would like to use logger to send a test log message to syslog-ng. I googled and looked at the FAQ and docs but cannot find a way. Can anyone help or point me to a relevant document I could read? :-) Thanks!

2 3

Re: [syslog-ng]How can I stop syslog-ng by command
by 童永昇 15 Dec '04

15 Dec '04

In FreeBSD ,you may can use /usr/local/etc/rc.d/syslog-ng.sh \ [start|stop] -----Original message----- From:wei<wei00(a)126.com> To:syslog-ng<syslog-ng(a)lists.balabit.hu> Date: Mon, 13 Dec 2004 17:56:51 +0800 Subject: [syslog-ng]How can I stop syslog-ng by command Hello everyone: I have a simple question to ask you. Could you tell me a command to stop/start my syslog-ng server? In my Syslog-ng 1.6.5, I can’t use “syslog-ng stop” to stop my syslog-ng. I can only use kill, but I don’t think it is a good idea. Thx!! _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3

How can I stop syslog-ng by command
by wei 13 Dec '04

13 Dec '04

Hello everyone: I have a simple question to ask you. Could you tell me a command to stop/start my syslog-ng server? In my Syslog-ng 1.6.5, I can't use "syslog-ng stop" to stop my syslog-ng. I can only use kill, but I don't think it is a good idea. Thx!!

2 1

Syslog-NG / sqlsyslogd Date Issues
by Ronnie Clark 13 Dec '04

13 Dec '04

Hello all, I am using syslog-ng on a FreeBSD 5.3 STABLE platform with the sqlsyslogd template to log syslog messages to a MySQL 4.0.22 database. I noticed that when the date rolled from Nov 30 to Dec 1, that the actual messages were no longer being recorded. So I verified that the messages were being captured in the text files, and they were. Now, that the date is the 10th (2 full digits), messages are again being logged into the database. Is this a bug? Anyone else seen this type of behavior? I am pretty sure that it is not the OS causing the issue, since I have another syslog-ng server running on FreeBSD 4.x STABLE and saw the exact same errors on that as well. Any help is greatly appreciated. Thanks, Ron Clark __________________________________ Do you Yahoo!? Read only the mail you want - Yahoo! Mail SpamGuard. http://promotions.yahoo.com/new_mail

2 2

A remote logging problem..
by 童永昇 13 Dec '04

13 Dec '04

hi ... I am a newbie in syslog-ng I meet some problems in configure syslog-ng I have three machine, A is inside NAT, B is NAT server, C is loghost outside NAT B forward log message from A to C. A's syslog-ng.conf setting options { long_hostnames(off); sync(0); }; source src {unix-dgram("/var/run/log");udp();internal();file("/dev/klog");}; destination loghost{udp("B" port(514));}; log{ source(src);destination(loghost);}; B's syslog-ng.conf setting options { chain_hostnames(yes); keep_hostname(no); long_hostnames(off); sync(0); use_dns(yes); use_fqdn(yes); }; source src { unix-dgram("/var/run/log"); internal(); file("/dev/klog"); }; source fwd {udp( ip(10.1.1.254) port(514));}; destination loghost { udp("C" port(514)); }; log { source(src);source(fwd); destination(loghost); }; C's syslog-ng.conf setting options { chain_hostnames(yes); keep_hostname(no); create_dirs(yes); long_hostnames(off); sync(0); use_dns(yes); use_fqdn(yes); }; source src { unix-dgram("/var/run/log"); udp(); internal(); file("/dev/klog"); }; destination all { file("/var/log/all.log"); }; log { source(src); destination(all); }; three machine all are FreeBSD machine A FreeBSD is 5.3 B is FreeBSD 4.11 C is FreeBSD 4.10 syslog-ng version are the same(syslog-ng 1.6.5) the FAQ say's that.. keep_hostname(yes) keep_hostname(no) chain_hostname(yes) server server/server2 chain_hostname(no) server server2 i have see that FAQ,but i can not produce the log record like scr@host1/host2 when the root login at A machine,syslog-ng record this action,but... A ==> Dec 13 20:42:36 A login: ROOT LOGIN (root) ON ttyv0 B ==> Dec 13 20:42:36 10.1.1.11 login: login on ttyv0 as root Dec 13 20:42:36 10.1.1.11 login: ROOT LOGIN (root) ON ttyv0 Dec 13 20:42:36 10.1.1.11 login: ROOT LOGIN (root) ON ttyv0 C ==> Dec 13 20:42:36 B login: login on ttyv0 as root Dec 13 20:42:36 B login: ROOT LOGIN (root) ON ttyv0 Dec 13 20:42:36 C login: ROOT LOGIN (root) ON ttyv0 Dec 13 20:42:36 B login: ROOT LOGIN (root) ON ttyv0 (B、C is his hostname) it seems quiet strange. Can someone hlep me? thanks a lot (sorry for my poor English ^^")

1 0

Logging to from a windows host to syslog-ng
by Conrad Tiflin (CF) 10 Dec '04

10 Dec '04

Hello, I presume sys-logging is not configured in the same way for windows versus that of unix. Does anyone know were can obtain info. on setting this up? Thanks, Conrad ================================================================== This e-mail and its contents are subject to the Telkom SA Limited e-mail legal notice available at http://www.telkom.co.za/TelkomEMailLegalNotice.PDF

4 4

Syslog-ng not receiving remote logs from stock Syslogd
by Igor Gueths 10 Dec '04

10 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all. I'm running the latest version of Syslog-ng (1.6.5). I've got all manner of local logging via unix-stream working just fine. My problem comes when I try and pull remote logs from a machine that's running the stock Syslogd, as shipped with Slackware-10.0. I first made sure my Iptables rules were accepting any traffic to UDP port 514. I then set up something like this in syslog-ng.conf. Note h14me is the hostname of the remote machine. source h14me { udp(); }; destination h14melog { file("/var/log/h14me.log"); }; log { source(h14me); destination(h14melog); }; Syslog-ng -s didn't report any errors with this syntax, therefore I assumed it was correct. However, when I restart Syslog-ng I don't see an h14me.log file in /var/log. On the remote machine I did this: @24.249.27.228 That was in /etc/syslog.conf. I had this type of setup going on another machine, however the difference was that I was running stock Syslogd as well. Does anyone know what I might be doing wrong here? Shouldn't Syslog-ng/regular Syslogd be able to communicate since they can both use the UDP standard? Should I instead specify the udp driver in the source that's already working, and then write a filter rule to take anything that comes from given host and put it in its own logfile? Or should I be able to specify 2 completely seperate sources? Thanks! - -- "The answer to life, the universe, and everything is 42." -- Douglas Adams -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFBuQ4BNohoaf1zXJMRApsTAKCcODwcOdfajdKoldQVFbOf5Ew7lQCfTYYe cKJDLElWmMeJNv4FWC1+Tl0= =FsH9 -----END PGP SIGNATURE-----

1 0

Problem reading the source file("/etc/httpd/logs/access_log")
by torpedo 09 Dec '04

09 Dec '04

Hi All , I have installed the syslog-ng 1.6.5 In configuration file I have defined source as the /etc/httpd/logs/access_log and destination as the terminal : /dev/tty1 Syslog-ng get started with no problem but it doesnot logs the information from the access_log file or any other log file ... i think thr is problem reading the file (but syslog-ng does not give any error) ... Plz help me out Thanks in advance torpedo

3 5

RE: [syslog-ng]Can't receive syslog by UDP protocol
by Xiaodong Lin 08 Dec '04

08 Dec '04

I think you should use the following: udp(ip(0.0.0.0) port(514)); instead of udp(); Xiaodong ________________________________ From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of wei Sent: Tuesday, December 07, 2004 3:29 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Can't receive syslog by UDP protocol Greeting! I have set up my syslog-ng environment by the default syslog-ng.conf file. By the linux default logger command, I can generate syslog to file. But when I use a syslog client send out syslog to the syslog-ng server, I can't receive the log by UDP protocol. But I can get TCP protocol syslog. Could anyone tell me why? Thanks! My system is RedHat 9.0. The syslog client is Kiwi Syslog Gen in windows. The following is part of my syslog.conf file: source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); udp(); tcp(port(5140) keep-alive(yes)); }; log { source(src); destination(file); };

3 2

Can't receive syslog by UDP protocol
by wei 07 Dec '04

07 Dec '04

Greeting! I have set up my syslog-ng environment by the default syslog-ng.conf file. By the linux default logger command, I can generate syslog to file. But when I use a syslog client send out syslog to the syslog-ng server, I can't receive the log by UDP protocol. But I can get TCP protocol syslog. Could anyone tell me why? Thanks! My system is RedHat 9.0. The syslog client is Kiwi Syslog Gen in windows. The following is part of my syslog.conf file: source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); udp(); tcp(port(5140) keep-alive(yes)); }; log { source(src); destination(file); };

1 0

Question about file handles, programs and time_reopen
by Mike Tremaine 06 Dec '04

06 Dec '04

I was doing a little experimenting on syslog-ng [syslog-ng-1.6.5-6 from rpm package] and was curious what happens if the destination object is destroyed. I read the configs option "time_reopen" [mine is set to 10, I assume that is secs], does this control all output options or just network connections? 2 examples. If you have a log file that is removed while syslog-ng is running is there a way to have syslog-ng re-create the file. I tried it and the file didn't not come back even though there was more data. Same experiment with a program. Syslog-ng forks a child program at start-up but what happens if that child dies. I did a kill -9 just to see if it would detect the absence and try to re-fork. If I want these features do I need to look outside of syslog-ng [some sort of daemon watcher that will throw a HUP]. Thanks, Mike Tremaine

3 3

UNSUBSCRIBE.
by Conrad Tiflin (CF) 06 Dec '04

06 Dec '04

================================================================== This e-mail and its contents are subject to the Telkom SA Limited e-mail legal notice available at http://www.telkom.co.za/TelkomEMailLegalNotice.PDF

1 0