- syslog-ng - lists.balabit.hu

Re: [syslog-ng]syslog-ng truncating pipe template output
by James Masson 22 Nov '04

22 Nov '04

Hi Nate I've tried a variety of formatting in destination_firewalls with no effect on this problem. I've inserted extra spaces and newlines in various places. The resulting output is still truncated and the extra formatting works only before this point. The current format I'm using in desination_firewalls is all on one line, and the output is all on one line. I've tried "template-escape(no)" - still the same problem ########################################### Syslog-ng.conf ########################################### # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo, v 1.4 2004/07/18 02:25:02 dragonheart Exp $ # # Syslog-ng default configuration file for Gentoo Linux # contributed by Michael Sterrett options { long_hostnames(off); sync(0); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); log_msg_size(8192); log_fifo_size(8192); }; source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; # By default messages are logged to tty12... destination console_all { file("/dev/tty12"); }; # ...if you intend to use /dev/console for programs like xconsole # you can comment out the destination line above that references /dev/tty12 # and uncomment the line below. #destination console_all { file("/dev/console"); }; log { source(src); destination(messages); }; log { source(src); destination(console_all); }; ## Log to mysql ## OUtput for unix_servers mysql database destination unix_servers { pipe("/tmp/mysql_unix_servers.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; ##### Output for firewalls mysql database destination firewalls { pipe("/tmp/mysql_firewalls.pipe" template(" INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG');\n") template-escape(yes)); }; ##### Output for appliances mysql database destination appliances { pipe("/tmp/mysql_appliances.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; ### Output for routers mysql database destination routers { pipe("/tmp/mysql_routers.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; ### filter udp stream to desitnations based on facility log { source(net); filter(f_routers); destination(routers); }; log { source(net); filter(f_firewalls); destination(firewalls); }; log { source(net); filter(f_appliances); destination(appliances); }; log { source(net); filter(f_unix_servers); destination(unix_servers); }; #### Define incoming udp logging stream source net { udp(); }; ### Define facilities filters filter f_routers { facility(local3); }; filter f_firewalls { facility(local4); }; filter f_unix_servers { facility(local5); }; filter f_appliances { facility(local6); }; ################################################# Thanks James Masson

1 0

syslog-ng truncating pipe template output
by James Masson 22 Nov '04

22 Nov '04

I've been trying to figure out an obscure problem with syslog-ng importing to a mysql database. I have various types of network devices feeding syslog-ng on local3 through local6. I can import from Cisco, UNIX servers, Windows - but not Netscreen firewalls! Each device type gets it's own mysql database. The mysql INSERT INTO statements for the Netscreen logs are truncated and hence fail to import because the mysql syntax is not correct. I chased wild geese for a while thinking the log format of the Netscreen was messing with mysql - but that's not the case. Notice it's just truncating the last few characters of each statement - including the all important ")" and "\n" newline that closes the mysql statement. I dumped an instance or two of these to a file instead of the normal fifo, added a ")" and a newline at the end of each, and it imported just fine! INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( 'X.X.X.X', 'local4', 'notice', 'notice', 'a5', '2004-11-19', '16:48:04', 'de-gw-1', 'de-gw-1: NetScreen device_id=de-gw-1 [No Name]system-notification-00257(traffic): start_time=\"2004-11-19 18:02:12\" duration=3 policy_id=2 service=NETBIOS (SSN) proto=6 src zone=Trust dst zone=Untrust action=Permit sent=1813 rcvd=5846 src=X.X.X.X dst=X.X.X.X src_port=3525 dst_port=139 src-xlated ip=X.X.X.X port=3525 INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( 'X.X.X.X', 'local4', 'notice', 'notice', 'a5', '2004-11-19', '16:48:06', 'de-gw-1', 'de-gw-1: NetScreen device_id=de-gw-1 [No Name]system-notification-00257(traffic): start_time=\"2004-11-19 18:02:14\" duration=3 policy_id=3 service=icmp proto=1 src zone=Untrust dst zone=Trust action=Permit sent=78 rcvd=78 src=X.X.X.X dst=X.X.X.X icmp type=8 INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( 'X.X.X.X', 'local4', 'notice', 'notice', 'a5', '2004-11-19', '16:48:06', 'de-gw-1', 'de-gw-1: NetScreen device_id=de-gw-1 [No Name]system-notification-00257(traffic): start_time=\"2004-11-19 18:01:15\" duration=62 policy_id=3 service=udp/port:3077 proto=17 src zone=Untrust dst zone=Trust action=Permit sent=0 rcvd=0 src=X.X.X.X dst=X.X.X.X src_port=17359 dst_port=3077 src-xlated ip=X.X.X.X port=17359 Remember that this is happening just for the Netscreen devices, using identical syslog-ng configs as for the other device types. Here's an example config: source net { udp(); }; filter f_firewalls { facility(local4); }; log { source(net); filter(f_firewalls); destination(firewalls); }; destination firewalls { pipe("/tmp/mysql_firewalls.pipe" template(" INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG ');\n") template-escape(yes)); }; This is on Gentoo Linux using Syslog-ng 1.6.4 stats(43200); log_msg_size(8192); log_fifo_size(8192); As per http://www.campin.net/syslog-ng/faq.html#message_length - is this the same issue? I could do some obscure perl filtering to fix this on the fly, but I'd rather fix the problem rather than the symptom. Thanks for your time. James Masson

4 3

Issues logging into MySQL
by Ronnie Clark 20 Nov '04

20 Nov '04

Hello all, I have a system loaded with FreeBSD 4.10 STABLE and syslog-ng, logging into MySQL. I have used the templates for syslog-ng and syslog-ng2. The issue is that now the time and machine name fields are correct, but the first few characters of the actual message are being chopped off. Examples: yslog-ng version 1.6.5 going down eboot by rclark: AD SU rclark to root on /dev/ttyv0 TATS: dropped 0 Is there a fix for this? I also have tried to compile and load the same sqlsyslogd for syslog-ng on FreeBSD 5.3, but get the following errors: sqlsyslogd.c: In function `usage': sqlsyslogd.c:38: error: missing terminating " character sqlsyslogd.c:39: error: stray '\' in program sqlsyslogd.c:39: error: syntax error before "n" sqlsyslogd.c:39: error: stray '\' in program sqlsyslogd.c:39: error: missing terminating " character sqlsyslogd.c: In function `main': sqlsyslogd.c:162: error: missing terminating " character sqlsyslogd.c:163: error: syntax error before '%' token sqlsyslogd.c:163: error: stray '\' in program sqlsyslogd.c:163: error: missing terminating " character sqlsyslogd.c:191: error: missing terminating " character sqlsyslogd.c:192: error: syntax error before '%' token sqlsyslogd.c:192:42: warning: character constant too long for its type sqlsyslogd.c:192:54: warning: multi-character character constant sqlsyslogd.c:192: error: missing terminating " character *** Error code 1 Anyone else have this running on FreeBSD 5.3 Release or STABLE? Thanks in advance, Ron Clark __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Michael J. Bock/NetServ/DST/US is out of the office.
by MJBock＠dstsystems.com 20 Nov '04

20 Nov '04

I will be out of the office starting 11/18/2004 and will not return until 11/22/2004. I will respond to your message when I return. ----------------------------------------- This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.

1 0

Re: [syslog-ng]installing on solaris 9
by searsrf＠comcast.net 19 Nov '04

19 Nov '04

Thanks, Reading the INSTALL doc that states; "Syslog-ng uses a different configuration scheme than the original syslogd, which sits at /etc/syslog-ng/syslog-ng.conf" I though that the installation of syslog-ng would create /etc/syslog-ng/syslog-ng.cong and then I would just edit the file. Thanks for the help, I will create the directory and file. > no default configuration is installed, you need to create one based on > the documentation and the examples under contrib. > > On Fri, 2004-11-19 at 15:07, searsrf(a)comcast.net wrote: > > Greetings, > > > > I have installed libol-0.3.14 and syslog-ng-1.6.5 on my Solaris 9 host with a > bit of trouble with libol-0.3.14 going the smoothest. After installing > syslog-ng-1.6.5 I did notice that /usr/local/sbin/syslog-ng was created but the > /etc/syslog-ng/syslog-ng.conf was not. Are the config files created at install > or do they need to be manually copied from within the install directory? > > > > Thanks for any help > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > -- > Bazsi > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >

1 0

installing on solaris 9
by searsrf＠comcast.net 19 Nov '04

19 Nov '04

Greetings, I have installed libol-0.3.14 and syslog-ng-1.6.5 on my Solaris 9 host with a bit of trouble with libol-0.3.14 going the smoothest. After installing syslog-ng-1.6.5 I did notice that /usr/local/sbin/syslog-ng was created but the /etc/syslog-ng/syslog-ng.conf was not. Are the config files created at install or do they need to be manually copied from within the install directory? Thanks for any help

2 1

program destination on OpenBSD
by Balazs Scheidler 18 Nov '04

18 Nov '04

hi, I was reported a reload with program() destinations on OpenBSD. As it seems the OpenBSD shell kills the whole process group it is part of when the shell receives a SIGTERM. As it currently stands syslog-ng is part of the shell's process group, which means that syslog-ng will be terminated upon the receipt of a SIGHUP: 1) syslog-ng gets a SIGHUP, 2) it terminates all its children (which includes a /bin/sh -c) 3) the OpenBSD shell issues kill -TERM 0, which sends a TERM signal to syslog-ng This patch should fix the issue, and will be included in tomorrow's snapshot: diff -u syslog-ng/src/afprogram.c:1.7.4.1 syslog-ng/src/afprogram.c:1.7.4.2 --- syslog-ng/src/afprogram.c:1.7.4.1 Mon Mar 22 12:56:33 2004 +++ syslog-ng/src/afprogram.c Thu Nov 18 10:57:27 2004 @@ -109,6 +109,7 @@ dup2(fd, 2); close(fd); close(msgpipe[1]); + setsid(); execl("/bin/sh", "/bin/sh", "-c", self->progname->data, NULL); _exit(127); } -- Bazsi

1 0

log to database and storage (urgent)
by Jeremy Doe 17 Nov '04

17 Nov '04

Hello list I compiled syslog-ng version 1.6.5 on Red Hat 3.0. The remote logging mechanism works (for example it fills my database) but he dont logs to the filesystem (storage). It means I shoud have two copies of log: one in database and one on filesystem for save. From my configuratioon I excpect to make directories and files with logs. For example /mnt/syslog/hosts/192.168.21.15/auth/200410 shoud be there. With lsof and ls I see no transaction to filesystem (I SIGHUPED syslog-ng) # Globale Optionen options { use_fqdn(no); use_dns(no); dns_cache(no); keep_hostname(yes); create_dirs(yes); long_hostnames(off); sync(1); log_fifo_size(1024); }; # Quellen/Sources source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); # auf UDP 514 listening udp(); }; source network { udp(); }; # Log syslog-ng zu mysql database destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(src); destination(d_mysql); }; # Log syslog-ng zu shared Storage destination std { file("/mnt/syslog/hosts/$HOST/$FACILITY/$YEAR_$MONTH" owner(root) group(root) perm(0601) dir_perm(0700) create_dirs(yes) ); }; log { source(network); destination(std); }; I also tried with the configuration from friendly campin (http://www.campin.net/syslog-ng/expanded-syslog-ng.conf) with minimal modifcation (we dont use dns). Please share ur knowledge with me (tried serveral days without luck) kind regards Jeremy

2 1

file compression
by Timothy Webster 15 Nov '04

15 Nov '04

I noticed that file compression is not currently implemented in syslog-ng 1.6.5. Is file compression expected in the near future. I need integrated file compression because writing from syslog, then reading to compress then writing the compressed data is killing my disk io. 1 write, 1 read, ~1/3 write If anybody has got something in cvs let me know. I am interested in lzo compression rather then bz2 or z(gzip). lzo it is about 1/2 space efficient as z, but it is also about 4 times faster. Which suits my needs of realtime compression better. -tim.

4 4

ISODATE offset?
by scott 15 Nov '04

15 Nov '04

syslog-ng is recording the date as > 2004-11-05T14:21:17+1000 Which is wrong; it should be > 2004-11-05T14:21:37+1100 as `date --iso-8601` returns. What gives?

3 10

How do I discard a message with syslog-ng?
by Ed Ravin 15 Nov '04

15 Nov '04

I want syslog-ng to discard a message that matches a particular string. There doesn't seem to be an easy way to do that, so I came up with this scheme instead: [...] filter unwanted { program("noisy-daemon") and match("unwanted alarm"); }; [...] destination discard { file("/dev/null" perm(0666) dir_perm(0755) create_dirs(no)); }; [...] log { source(remote); filter(unwanted); destination(discard); flags(final); }; In spite of the "flags(final)" in the log path, the unanted message still shows up in my other log paths. Have I misunderstood how to use "final"? Is there some other way to discard a message? My environment is NetBSD 1.5 and NetBSD 2.0. Thanks, -- Ed

3 7

MySQL client dying
by Peterson, Lars 11 Nov '04

11 Nov '04

Hello, I've followed the how-to (the one at the very top) here: http://vermeer.org/display_doc.php?doc_id=1 <http://vermeer.org/display_doc.php?doc_id=1> in order to set up a syslog to MySQL pipe using syslog-ng. syslog-ng: 1.6.5 libol-0.3.14 MySQL: 4.1.7 OS: HP-UX 11.11 All seems to be working great, except for the fact that occasionally the mysql client seems to die. When I do a 'ps' to look for the client process, I still see it running. Tracing the client processes using 'tusc' shows that it is writing the 'INSERT INTO' commands to the named pipe (/tmp/mysql.pipe). Nothing is being inserted into the DB though. I have observed that each time it has died, there seems to have been a large burst of syslog messages coming in. Last time it died I saw about 50 messages within one second... Any ideas? I'm looking to isolate the problem so that I can either: 1) auto restart syslog-ng when this happens 2) find a fix, so that this doesn't keep happening! TIA, Lars Peterson ********************************************************************** Robert W. Baird & Co. is required by regulation to review and store both outgoing and incoming electronic correspondence. Baird may be required to produce e-mail records for the SEC or other regulators in a criminal investigation. E-mail transmission cannot be guaranteed to be secure, timely or error-free. Baird therefore recommends that you do not send confidential information to us via electronic mail, including account numbers, social security numbers or any personal identification numbers. This is not an offer, or solicitation of an offer to buy or sell any security investment or other product. Any information regarding specific investment products is subject to change without notice. Any review, forwarding, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer on which it exists.

1 0

nested entries?
by scott 11 Nov '04

11 Nov '04

Anyone using SpamAssassin? Somehow, I'm getting nested entries in the log. WTF? Heres two examples (one per line in the log file, obviously). 2004-11-11T16:39:02+1000 chloe spamd[704]: connection from localhost [127.0.0.1] at port 41701 2004-11-11T16:39:02+1000 chloe qmail-smtpd: 1100151542.380171 tcpserver: end 2373 status 0 and 2004-11-11T16:39:02+1000 chloe spamd[2381]: info: setuid to slittle succeeded 2004-11-11T16:39:02+1000 chloe spamd[2381]: processing message <fb1301c4c7a3$99512e23$b7b0ab10(a)arrakis.es> for slittle:1000. 2004-11-11T16:39:02+1000 chloe spamd[2381]: identified spam (10.4/5.0) for slittle:1000 in 0.2 seconds, 3493 bytes. 2004-11-11T16:39:02+1000 chloe qmail: 1100151542.681701 new msg 12805507 I thought maybe the trailing \n was getting broken somehow, so I tried dumping SQL statements to file, and they're nested too (there's no closing quotes, brackets or semicolon before the next INSERT statement). INSERT INTO logs (host, facility, priority, level, tag, date, program, msg) VALUES ( 'chloe', 'mail', 'info', 'info', '16', unix_timestamp('2004-11-11T16:39:02+1000'), 'spamd', 'spamd[704]: connection from localhost [127.0.0.1] at port 41701 INSERT INTO logs (host, facility, priority, level, tag, date, program, msg) VALUES ( 'chloe', 'mail', 'info', 'info', '16', unix_timestamp('2004-11-11T16:39:02+1000'), 'qmail-smtpd', 'qmail-smtpd: 1100151542.380171 tcpserver: end 2373 status 0'); and INSERT INTO logs (host, facility, priority, level, tag, date, program, msg) VALUES ( 'chloe', 'mail', 'info', 'info', '16', unix_timestamp('2004-11-11T16:39:02+1000'), 'spamd', 'spamd[2381]: info: setuid to slittle succeeded INSERT INTO logs (host, facility, priority, level, tag, date, program, msg) VALUES ( 'chloe', 'mail', 'info', 'info', '16', unix_timestamp('2004-11-11T16:39:02+1000'), 'spamd', 'spamd[2381]: processing message <fb1301c4c7a3$99512e23$b7b0ab10(a)arrakis.es> for slittle:1000. INSERT INTO logs (host, facility, priority, level, tag, date, program, msg) VALUES ( 'chloe', 'mail', 'info', 'info', '16', unix_timestamp('2004-11-11T16:39:02+1000'), 'spamd', 'spamd[2381]: identified spam (10.4/5.0) for slittle:1000 in 0.2 seconds, 3493 bytes. INSERT INTO logs (host, facility, priority, level, tag, date, program, msg) VALUES ( 'chloe', 'mail', 'info', 'info', '16', unix_timestamp('2004-11-11T16:39:02+1000'), 'qmail', 'qmail: 1100151542.681701 new msg 12805507');

1 0

RE: [syslog-ng]problem compiling under sunOS 7
by ARGEXT-HIDALGO, FRANCISCO 10 Nov '04

10 Nov '04

It worked, thank you very much. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Balazs Scheidler Sent: Martes, 09 de Noviembre de 2004 01:00 p.m. To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]problem compiling under sunOS 7 Try compiling with GNU as instead of the system supplied one. On Tue, 2004-11-09 at 16:10, ARGEXT-HIDALGO, FRANCISCO wrote: > I have the following compilation error and no clue on what could the problem be. I never had this problem on other systems (Linux). Does anyone know whats the problem? > Thank you. > > Making all in src > make all-recursive > Making all in . > if gcc -DHAVE_CONFIG_H -I. -I/home/fhidalgo/syslog-ng-1.6.5/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -MT main.o -MD -MP -MF ".deps/main.Tpo" \ > -c -o main.o `test -f 'main.c' || echo '/home/fhidalgo/syslog-ng-1.6.5/src/'`main.c; \ > then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ > else rm -f ".deps/main.Tpo"; exit 1; \ > fi > /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 1210: error: unknown opcode ".subsection" > /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 1210: error: statement syntax > /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 1218: error: unknown opcode ".previous" [snipped] -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

FQDN does not work
by Stephan Hendl 10 Nov '04

10 Nov '04

Hi list, I try to get FQDN in my /var/log/messages but it doesn't work. The option part of my syslog-ng.conf is like: options { sync (0); time_reopen (10); log_fifo_size (10000); long_hostnames (no); use_fqdn (yes); use_dns (yes); dns_cache (yes); create_dirs (yes); keep_hostname (yes); }; Version: syslog-ng-1.6.4 What do I wrong? Thanks! Stephan

1 0

Antw: [syslog-ng]syslog on HP-UX 11
by Stephan Hendl 10 Nov '04

10 Nov '04

Hi, your source-line should be like source s_sys { pipe(/dev/log pad_size(2048)); internal(); }; The pad_size is important (see manual and faq) Stephan >>>Olivia.Leonard(a)davy.ie 11/04 12:13 pm >>> Hi I have set up a central logging server using syslog-ng (on solaris 8) - all the solaris servers, windows servers, and routers are logging to it with no big issues. I want to get a HP-UX box logging to it and it's proving difficult. Initially In installed syslog-ng 1.5.8 from a depot and it sent only a startup message to the central server but none of the other messages such as logins, su and so on. So I tried getting it to log to it using it's own native syslog - it just won't log anything. It resolves loghost and gives no errors on startup/restart but it just doesn't log anything (eventhough my central server listens on UDP 514 and gets messages from routers/switches) Could anyone help me out with this?? Attached are both my syslog.conf and my syslog-ng.conf. Thanks Olivia ********************************************************************************************************************************************************************** /etc/syslog.conf # mail.debug /var/adm/syslog/mail.log #*.info;mail.none /var/adm/syslog/syslog.log #*.alert /dev/console #*.alert root #*.emerg * *.emerg;*.alert;*.crit;*.err;*.warning;*.notice;*.info;*.debug @loghost # *********************************************************************************************************************************************************************** /opt/syslog_ng/etc/syslog-ngsyslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source src {unix-stream(/dev/log); internal(); }; destination everything {file(/home/leonarol/logfile); }; ## set up logging to loghost destination loghost { tcp(172.16.117.170 port(5140)); }; filter f_ssh_login_attempt { program(sshd.*) and match((Failed|Accepted)) and not match(Accepted (hostbased|publickey)); }; filter f_emergency { level(emerg); }; filter f_alert { level(alert); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_warn { level(warn); }; filter f_notice { level(notice); }; filter f_info { level(info); }; log { source(src); filter(f_emergency); destination(everything); }; log { source(src); filter(f_alert); destination(everything); }; log { source(src); filter(f_crit); destination(everything); }; log { source(src); filter(f_err); destination(everything); }; log { source(src); filter(f_warn); destination(everything); }; log { source(src); filter(f_notice); destination(everything); }; log { source(src); filter(f_info); destination(everything); }; log { source(src); filter(f_emergency); destination(loghost); }; log { source(src); filter(f_alert); destination(loghost); }; log { source(src); filter(f_crit); destination(loghost); }; log { source(src); filter(f_err); destination(loghost); }; log { source(src); filter(f_warn); destination(loghost); }; log { source(src); filter(f_notice); destination(loghost); }; log { source(src); filter(f_info); destination(loghost); }; The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any other action taken or any views, opinions or advice contained in this e-mail are those of the sending individual and not necessarily those of the firm. It is possible for data transmitted by e-mail to be deliberately or accidentally corrupted or intercepted. For this reason where the communication is by e-mail, J&E Davy does not accept any responsibility for any breach of confidence which may arise from the use of this medium. If you have received this e-mail in error please notify us immediately at mailto:helpdesk@davy.ie and delete this e-mail from your system.

1 0

problem compiling under sunOS 7
by ARGEXT-HIDALGO, FRANCISCO 09 Nov '04

09 Nov '04

I have the following compilation error and no clue on what could the problem be. I never had this problem on other systems (Linux). Does anyone know whats the problem? Thank you. Making all in src make all-recursive Making all in . if gcc -DHAVE_CONFIG_H -I. -I/home/fhidalgo/syslog-ng-1.6.5/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -MT main.o -MD -MP -MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo '/home/fhidalgo/syslog-ng-1.6.5/src/'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 1210: error: unknown opcode ".subsection" /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 1210: error: statement syntax /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 1218: error: unknown opcode ".previous" /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 1218: error: statement syntax /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 2776: error: unknown opcode ".subsection" /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 2776: error: statement syntax /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 2831: error: unknown opcode ".previous" /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 2831: error: statement syntax *** Error code 1 make: Fatal error: Command failed for target `main.o' Current working directory /home/fhidalgo/syslog-ng-1.6.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /home/fhidalgo/syslog-ng-1.6.5/src *** Error code 1 make: Fatal error: Command failed for target `all' Current working directory /home/fhidalgo/syslog-ng-1.6.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive'

2 1

Why does this not work in 1.6.x?
by t_esting＠excite.com 09 Nov '04

09 Nov '04

Hello, syslog-ng gurus. I have a question about a config that works for me in 1.5.26 but not in 1.6.x (up to 1.6.5/libol 0.3.14). Here are (what I hope are) the pertinent bits: source s_udp { udp( port(514) ); }; filter f_fwsm_block { match(" \%FWSM-") and not match(": (Teardown|Translation|Built)"); }; filter f_fwsm_misc { match(" \%FWSM-") and match(": (Teardown|Translation|Built)"); }; log { source(s_udp); filter(f_fwsm_misc); destination(d_ipfilters_bymin); }; log { source(s_udp); filter(f_fwsm_block); destination(d_ipmon); }; ## fallthrough log { destination(d_messages); flags(fallback, catchall); }; With syslog-ng 1.5.26, messages matching "%FWSM-Teardown", etc., are written (correctly) to the d_ipmon destination. With syslog-ng 1.6.x, they drop through to d_messages. Can anyone on the list please help me decipher what changes I might need to make to my config (either compiling syslog-ng itself or to my syslog-ng.conf file) to make my logs write to the same place once I upgrade? Thanks in advance. t_esting(a)excite.com _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1

Syslog-ng and mysql
by Chris Vaughan 07 Nov '04

07 Nov '04

Greetings, I am currently trying to get syslog-ng to map to mysql so that it can then be reported by way of php-syslog-ng. However, the destination keeps giving me syntax errors. I am running syslog-ng 1.6.5 and I have tried to follow the documentation in the source code and at www.vermeer.org. Any Suggestions? Chris Vaughan *************************************************************** This message is intended for the addressee named and may contain confidential information. If you are not the intended recipient, please delete it and notify the sender. Views expressed in this message are those of the individual sender, and are not necessarily the views of the Department of Lands. This email message has been swept by MIMEsweeper for the presence of computer viruses. ***************************************************************

1 0

A nice manual
by Martin Schröder 05 Nov '04

05 Nov '04

http://www.cert-in.org.in/knowledgebase/guidelines/CISG-2004-03.pdf This should end up in the FAQ. Best regards Martin -- Martin Schröder, ms(a)artcom-gmbh.de ArtCom GmbH, Lise-Meitner-Str 5, 28359 Bremen, Germany Voice +49 421 20419-44 / Fax +49 421 20419-10 http://www.artcom-gmbh.de

1 0

Problem with logrotation in RedHat installation!?
by Jörgen Ekstedt 04 Nov '04

04 Nov '04

Hi everyone! Got a problem with logrotation in RedHat9 when using syslog-ng. We are using the "logrotate" command, and we dont get syslog-ng to change files. I have included a "postrotate" command in the logrotate.conf file that sends a -HUP signal to the syslog-ng process, and syslog-ng reports in the logs that it got received and it is restarting. But anyway, it still writes its logs to the rotated logfile? For example logging messages to file "message.log" Perform the logrotate command and we get 2 files, "message.log" and message.log.1" BUT now syslog-ng writes its logs to message.log.1, and I want it to start over on the message.log file? Any clues? BR

3 2

Where to put in startup scripts?
by Jörgen Ekstedt 04 Nov '04

04 Nov '04

Hi everyone! Got a nice working installation of syslog-ng in our computers. But I have aquestion about the startup script. We are running a mixed environment with RedHat Linux and IRIX, and for now we have the startupscript for syslog-ng located at S99, ie we start it last of all services. Now where should we start it? Is there any recommendations? BR

2 1

syslog on HP-UX 11
by Olivia Leonard 04 Nov '04

04 Nov '04

Hi I have set up a central logging server using syslog-ng (on solaris 8) - all the solaris servers, windows servers, and routers are logging to it with no big issues. I want to get a HP-UX box logging to it and it's proving difficult. Initially In installed syslog-ng 1.5.8 from a depot and it sent only a startup message to the central server but none of the other messages such as logins, su and so on. So I tried getting it to log to it using it's own native syslog - it just won't log anything. It resolves loghost and gives no errors on startup/restart but it just doesn't log anything (eventhough my central server listens on UDP 514 and gets messages from routers/switches) Could anyone help me out with this?? Attached are both my syslog.conf and my syslog-ng.conf. Thanks Olivia **************************************************************************** **************************************************************************** ************** /etc/syslog.conf # mail.debug /var/adm/syslog/mail.log #*.info;mail.none /var/adm/syslog/syslog.log #*.alert /dev/console #*.alert root #*.emerg * *.emerg;*.alert;*.crit;*.err;*.warning;*.notice;*.info;*.debug @loghost # **************************************************************************** **************************************************************************** *************** /opt/syslog_ng/etc/syslog-ngsyslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source src {unix-stream("/dev/log"); internal(); }; destination everything {file("/home/leonarol/logfile"); }; ## set up logging to loghost destination loghost { tcp("172.16.117.170" port(5140)); }; filter f_ssh_login_attempt { program("sshd.*") and match("(Failed|Accepted)") and not match("Accepted (hostbased|publickey)"); }; filter f_emergency { level(emerg); }; filter f_alert { level(alert); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_warn { level(warn); }; filter f_notice { level(notice); }; filter f_info { level(info); }; log { source(src); filter(f_emergency); destination(everything); }; log { source(src); filter(f_alert); destination(everything); }; log { source(src); filter(f_crit); destination(everything); }; log { source(src); filter(f_err); destination(everything); }; log { source(src); filter(f_warn); destination(everything); }; log { source(src); filter(f_notice); destination(everything); }; log { source(src); filter(f_info); destination(everything); }; log { source(src); filter(f_emergency); destination(loghost); }; log { source(src); filter(f_alert); destination(loghost); }; log { source(src); filter(f_crit); destination(loghost); }; log { source(src); filter(f_err); destination(loghost); }; log { source(src); filter(f_warn); destination(loghost); }; log { source(src); filter(f_notice); destination(loghost); }; log { source(src); filter(f_info); destination(loghost); }; The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any other action taken or any views, opinions or advice contained in this e-mail are those of the sending individual and not necessarily those of the firm. It is possible for data transmitted by e-mail to be deliberately or accidentally corrupted or intercepted. For this reason where the communication is by e-mail, J&E Davy does not accept any responsibility for any breach of confidence which may arise from the use of this medium. If you have received this e-mail in error please notify us immediately at mailto:helpdesk@davy.ie and delete this e-mail from your system.

1 0

not (x and y)
by Thomas Richter 03 Nov '04

03 Nov '04

Hi, is this correct or is there a better possibility? filter f_LCP-Echo { match("pppd") and match("EchoRe");}; filter f_not_LCP-Echo { not match("pppd") or not match("EchoRe");}; wkr Thomas Richter -- dss1://49.431.801306 Wot're we going to do tonight, Brain ? gsm://49.179.5192431 The same thing we do every night, Pinky . icq://124849926 Try to TAKE OVER THE WORLD ! mailto:richter@thomas-richter.de http://www.thomas-richter.de

1 0

group () doesn't work
by przemolicc＠poczta.fm 03 Nov '04

03 Nov '04

Hello, I am trying to allow group ('it') members to read logs. Therefore I used following lines: ... destination hosts { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$HOUR:00" owner("root") group("it") perm(0640) dir_perm(0750) create_dirs(yes) ); }; ... But it doesn't work: new files are in group 'it' but new directories aren't. What can I do to have newly created directories in group 'it' ? przemol

2 2