- syslog-ng - lists.balabit.hu

RE: [syslog-ng]syslog-ng template does not work
by Earls, Michael 01 Nov '04

01 Nov '04

The template() destinations are only supported by the 1.5.x and up. I would upgrade your version of syslog-ng. Michael PGP Info: KeyID 0x0DFD993C Fingerprint F903 0325 5105 2CDB 4BF4 C88B 72F7 BA7A 28CC 598A -----Original Message----- From: Sirinus [mailto:sirinus@excite.com] Sent: Monday, November 01, 2004 2:39 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng template does not work Hello, Everyone, I just installed syslog-ng on my mandrake-9.2 with the rpm package: syslog-ng-1.4.17-3mdk.src.rpm For generly log, it works fine. However, I would like to forward my logs to MySql database. So I tried to follow the tutorials of Michael Earls ( ohttp://vermeer.org/display_doc.php?doc_id=1) However, after I added the following line to my syslog-ng.conf, each time when I tried to restart syslog-ng, it tells sth is wrong. The following is what I have done: 1. Add the following to my syslog-ng.conf so that I can log to mysql database: ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; 2. stop syslog-ng [root@localhost tmp]# service syslog-ng stop Shutting down kernel logger: [ OK ] Shutting down system logger: [ OK ] 3. restart syslog-ng [root@localhost tmp]# service syslog-ng start Starting system logger: parse error at 27 Parse error reading configuration file, exiting. [FAILED] starting kernel logger: [ OK ] NOTE: line 27 is where "template ("INSERT INTO logs (host, facility, priority, level, tag, " showing the first step. I wonder to know what's wrong with this configuration? I tried to read the source code. I cannot find any thing related to "template". Does syslog-ng 1.4.17 support "template"? How could I fix the problem? THanks a lot Yours Ch Zhang _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web! _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail transmission contains information that is confidential and may be privileged. It is intended only for the addressee(s) named above. If you receive this e-mail in error, please do not read, copy or disseminate it in any manner. If you are not the intended recipient, any disclosure, copying, distribution or use of the contents of this information is prohibited. Please reply to the message immediately by informing the sender that the message was misdirected. After replying, please erase it from your computer system. Your assistance in correcting this error is appreciated.

1 0

syslog-ng template does not work
by Sirinus 01 Nov '04

01 Nov '04

Hello, Everyone, I just installed syslog-ng on my mandrake-9.2 with the rpm package: syslog-ng-1.4.17-3mdk.src.rpm For generly log, it works fine. However, I would like to forward my logs to MySql database. So I tried to follow the tutorials of Michael Earls ( ohttp://vermeer.org/display_doc.php?doc_id=1) However, after I added the following line to my syslog-ng.conf, each time when I tried to restart syslog-ng, it tells sth is wrong. The following is what I have done: 1. Add the following to my syslog-ng.conf so that I can log to mysql database: ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; 2. stop syslog-ng [root@localhost tmp]# service syslog-ng stop Shutting down kernel logger: [ OK ] Shutting down system logger: [ OK ] 3. restart syslog-ng [root@localhost tmp]# service syslog-ng start Starting system logger: parse error at 27 Parse error reading configuration file, exiting. [FAILED] starting kernel logger: [ OK ] NOTE: line 27 is where "template ("INSERT INTO logs (host, facility, priority, level, tag, " showing the first step. I wonder to know what's wrong with this configuration? I tried to read the source code. I cannot find any thing related to "template". Does syslog-ng 1.4.17 support "template"? How could I fix the problem? THanks a lot Yours Ch Zhang _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

installing syslog-ng
by Majumdar, Anamitra 30 Oct '04

30 Oct '04

Hello, I am trying to install syslog-ng on a Solaris 8 box. I am able to configure Libol and syslog-ng. When I am trying to run make I am receiving the following error for syslog-ng $ make Making all in src make all-recursive Making all in . source='main.c' object='main.o' libtool=no \ depfile='.deps/main.Po' tmpdepfile='.deps/main.TPo' \ depmode=none /bin/bash /export/home/amajumda/syslog-ng-1.6.5/depcomp \ cc -DHAVE_CONFIG_H -I. -I/export/home/amajumda/syslog-ng-1.6.5/src -I. -g -Wall -I/export/home/amajumda/libol-0.3.14/src -D_GNU_SOURCE -c `test -f 'main.c' || echo '/export/home/amajumda/syslog-ng-1.6.5/src/'`main.c cc: illegal option -Wall *** Error code 1 make: Fatal error: Command failed for target `main.o' Current working directory /export/home/amajumda/syslog-ng-1.6.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /export/home/amajumda/syslog-ng-1.6.5/src *** Error code 1 make: Fatal error: Command failed for target `all' Current working directory /export/home/amajumda/syslog-ng-1.6.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' I am receiving a similar error while trying to install libol-0.3.14 $ make Making all in utils Making all in src make all-am source='format.c' object='format.lo' libtool=yes \ depfile='.deps/format.Plo' tmpdepfile='.deps/format.TPlo' \ depmode=none /bin/bash /export/home/amajumda/libol-0.3.14/depcomp \ /bin/bash ../libtool --mode=compile cc -DHAVE_CONFIG_H -I. -I/export/home/amajumda/libol-0.3.14/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -g -Wall -O2 -c -o format.lo `test -f 'format.c' || echo '/export/home/amajumda/libol-0.3.14/src/'`format.c cc -DHAVE_CONFIG_H -I. -I/export/home/amajumda/libol-0.3.14/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -g -Wall -O2 -c format.c -KPIC -DPIC -o .libs/format.o cc: illegal option -Wall *** Error code 1 make: Fatal error: Command failed for target `format.lo' Current working directory /export/home/amajumda/libol-0.3.14/src *** Error code 1 make: Fatal error: Command failed for target `all' Current working directory /export/home/amajumda/libol-0.3.14/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Can you help with a solution of overcoming this problem. Thanks Anamitra X4696

2 1

PIX 2 MySQL
by Cary, Kim 29 Oct '04

29 Oct '04

I just got logging going with syslog-ng in the last couple weeks (first client is our PIX 520). We can have up to 20Gb/day from our PIX. When compressed, the logs are up to 2Gb/day. We do want a record of all sessions for forensics & troubleshooting (already saved us hours of time) but the log format is quite verbose. Because of that verbosity, I was thinking of writing just key fields to a MySQL database as you suggest. However, I don't want to get into a situation where the only reporting is whatever report script I have time to write... If Joseph or someone else has a suggestion for fields to insert into the db and a reporting package to use, I'd appreciate it. Kim Cary InfraSec Admin Pepperdine University On Oct 29, 2004, at 5:43 AM, syslog-ng-request(a)lists.balabit.hu wrote: >> server. The central server is currently piping the information to a >> Mysql >> database. Each incoming device writes to its own table in the >> database. A >> modification to this we would like to accomplish is to key various >> pieces >> of information stored in the "message" field. >> >> For example, syslog messages sent from the mail servers will contain >> the >> sender, recipient, delivery status in the "message" field. Our >> thought is >> to key these pieces of information for quick lookup. Some of the >> systems >> (Cisco Pix) are sending up to 5G of information a day. Another reason >> to >> key the information.

3 2

Re:
by DTrammell 29 Oct '04

29 Oct '04

1 0

Re: Syslog-ng reply script for centralized syslog data
by LEROY ISAAC 29 Oct '04

29 Oct '04

Thanks a lot for both of your suggestions. It is an assumption that QOS will be on the network link, but this still doesn't account for a continually backed up host trying to send data. We are planning to utilize TCP as the transport. I figured TCP, QOS, and adjustments in the size of the log_fifo_size (num - The number of lines fitting to the output queue) might solve the issue. It is my understanding that the log_fifo_size, which does not have flow control, can be used to buffer data bound for destinations (either local disk or remote). I might be wrong in this understanding. I need the replay script to feed into the syslog data stream on the central syslog-ng server, since the central syslog-ng server feeds other applications. LeRoy

2 1

parsing the message field
by Joseph Deck 29 Oct '04

29 Oct '04

All, We have installed syslog-ng on our unix systems pointing them, some network devices, and some Windows systems events to a central syslog-ng server. The central server is currently piping the information to a Mysql database. Each incoming device writes to its own table in the database. A modification to this we would like to accomplish is to key various pieces of information stored in the "message" field. For example, syslog messages sent from the mail servers will contain the sender, recipient, delivery status in the "message" field. Our thought is to key these pieces of information for quick lookup. Some of the systems (Cisco Pix) are sending up to 5G of information a day. Another reason to key the information. Our current thought is to send the output of syslog-ng to a Perl script which will parse the message field based upon the source. The Perl script would then write it to the database. Is there a better approach? Any suggestions would be appreciated. Joseph G. Deck Director of Computing Services Wittenberg University Phone: (937) 525-3800 Fax: (937) 327-7372

2 1

Re: Syslog-ng reply script for centralized syslog data
by LEROY ISAAC 28 Oct '04

28 Oct '04

Thanks a lot for both of your suggestions. It is an assumption that QOS will be on the network link, but this still doesn't account for a continually backed up host trying to send data. We are planning to utilize TCP as the transport. I figured TCP, QOS, and adjustments in the size of the log_fifo_size (num - The number of lines fitting to the output queue) might solve the issue. It is my understanding that the log_fifo_size, which does not have flow control, can be used to buffer data bound for destinations (either local disk or remote). I might be wrong in this understanding. I need the replay script to feed into the syslog data stream on the central syslog-ng server, since the central syslog-ng server feeds other applications. LeRoy

1 0

Syslog-ng replay script for centralized syslog data
by LEROY ISAAC 28 Oct '04

28 Oct '04

I have a need to retrieve syslog data from various remote nodes, and the smallest network link to the remote nodes is 19K. The syslog traffic for the link cannot exceed 9K. I plan to setup a configuration which generates new log files every 10 minutes. These files are then compressed, zipped, and transfered to a centralized loghost. The files are then unzipped, uncompressed, and the data is inserted into the syslog-ng data stream on the central syslog-ng host. Is there a script or utility which will accomplish this task? If not, then does any one have any suggestions on products which may accomplish this same task. LeRoy Isaac --- DTrinh71(a)aol.com wrote: > OK. Thanks. > > So, what does Ray want? Suggestions? > > David >

3 6

Perl for log analysis
by beproj beproj 28 Oct '04

28 Oct '04

Subject: 1. Perl for log analysis 2. Specimen logs hello 1. I am pursuing a project in log analysis(mainly attacklogs..security) and i have a doubt regarding general log analyis. I would like to know why generally Perl, Python etc. are used for log analysis. The SYSLOG MODULE support in Perl is one reason. But a similar library in GNU C lib is available. viz:- syslog.h Why then do programmers go for Perl? Is it due to simpler pattern matching techniques available. Same are then available in C viz:- strtok(). Since i am new to perl and have to decide which of C and Perl is better for syslog log analysis, kindly sugegst the advantages of perl over C wrt log analysis. 2. I want specimen syslog logs esp security...for Red Hat Linux 8.0 Server. Any idea where can i get them? Thank you in advance. bye beproj

3 2

Install 1.6 on RedHat 8.0
by Virgil 28 Oct '04

28 Oct '04

Please excuse my ignorance - I am trying to install syslog-ng on RH 8.0 and have read the INSTALL document. I have the necessary dependancies from what I can tell (I'm also pretty new to RH / Linux); I have done the ./confgure, which seemed to go smooth. Following the ./configure, the INSTALL doc says to do a "make" - this is where I get hung up. I don't understand what the errors below are telling me; some of the files that are reported as missing are actually not present. However I have done everything exactly as the documentation specifies. What am I missing? root@RedHat8 syslog-ng-1.6.5]# make Making all in src make[1]: Entering directory `/misc/downloads/syslog-ng-1.6.5/src' make all-recursive make[2]: Entering directory `/misc/downloads/syslog-ng-1.6.5/src' Making all in . make[3]: Entering directory `/misc/downloads/syslog-ng-1.6.5/src' if gcc -DHAVE_CONFIG_H -I. -I/misc/downloads/syslog-ng-1.6.5/src -I. -g -O2 -Wall -D_GNU_SOURCE -MT main.o -MD -MP -MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo '/misc/downloads/syslog-ng-1.6.5/src/'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:39: parse error before "UINT32" log.h:39: warning: no semicolon at end of struct or union log.h:43: parse error before "pri" log.h:43: warning: type defaults to `int' in declaration of `pri' log.h:43: warning: data definition has no type or storage class log.h:44: parse error before "flags" log.h:44: warning: type defaults to `int' in declaration of `flags' log.h:44: warning: data definition has no type or storage class log.h:51: parse error before '}' token In file included from log.h:54, from sources.h:32, from cfgfile.h:29, from main.c:27: log.h.x:4: field `super' has incomplete type log.h.x:9: confused by earlier errors, bailing out make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/misc/downloads/syslog-ng-1.6.5/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/misc/downloads/syslog-ng-1.6.5/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/misc/downloads/syslog-ng-1.6.5/src' make: *** [all-recursive] Error 1 [root@RedHat8 syslog-ng-1.6.5]#

3 2

Syslog-ng reply script for centralized syslog data
by LEROY ISAAC 28 Oct '04

28 Oct '04

I have a need to retrieve syslog data from various remote nodes, and the smallest network link to the remote nodes is 19K. The syslog traffic for the link cannot exceed 9K. I plan to setup a configuration which generates new log files every 10 minutes. These files are then compressed, zipped, and transfered to a centralized loghost. The files are then unzipped, uncompressed, and the data is inserted into the syslog-ng data stream on the central syslog-ng host. Is there a script or utility which will accomplish this task? If not, then does any one have any suggestions on products which may accomplish this same task. LeRoy Isaac

1 0

STATS: dropped 74625 and very high Load
by Stefan Schluppeck 28 Oct '04

28 Oct '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I have running a central syslog-ng under SLES9 (SuSE Linux Enterprice Server). ca. 90 Servers and 150 Network copunents are logging to this server I have some times "STATS: dropped 74625" and i have high load round about 11. What can i do, that no loglines are lost and the load is not so high? My global config: options { ~ long_hostnames(off); ~ sync(1024); ~ log_fifo_size(300000); ~ gc_busy_threshold(1000); ~ gc_idle_threshold(30000); ~ }; - -- Mit freundlichen Grüßen / With regards Stefan Schluppeck Bauer Publishinggroup - Brieffach 6200 - Burchard.11 - D-20077 Hamburg Publishing Support Center - Server & Development - Stefan Schluppeck Fon:+49-40-3019-5519 - Fax:+49-40-3019-5668 - eMail:sschluppeck@hbv.de ~ <°)))))>< ><)))))°> <°)))))>< ><)))))°> <°)))))>< ><)))))°> PGP-Fingerabdruck = 7DC1 E4B4 056C 5380 8C68 4B5F 5E87 227D 5632 E45F Key-ID = 81B7CD29 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBgOsCXocifVYy5F8RAivMAJ9NUFcNBN4pkvxB3WXJuK7eKGEhcQCfdckM Co0jZoRGSfJejuhQsOxx89U= =S+pY -----END PGP SIGNATURE-----

2 2

RE: [syslog-ng]bind_inet_socket() error
by Walt Rich 28 Oct '04

28 Oct '04

I found the answer by filtering by hosts. Thanks! -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Walt Rich Sent: Wednesday, October 27, 2004 9:22 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]bind_inet_socket() error Is there a link that you could forward that would explain how to do this? I'm a newbie to Linux and Syslog-ng. Thanks for everyone's assistance with this. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Nate Campi Sent: Tuesday, October 26, 2004 8:00 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]bind_inet_socket() error Right, packet filter and/or compile with TCP wrappers for access control, syslog-ng itself won't do that for you. On Tue, Oct 26, 2004 at 02:11:18PM -0500, Dave Johnson wrote: > * Set you max connections to the number of connections that you anticipate. > * Otherwise-- Firewall. > > On Mon, 25 Oct 2004 10:29:08 -0500, Walt Rich <walt.rich(a)parago.com> wrote: > > OK, I see what you mean. > > > > What is the syntax for setting up a source that is an IP address > > that is not local? I'm trying to set up a centralized logging > > server and would like for it to receive logging from other servers, > > but I would like to be able to specify the IP addresses that it will accept input from. > > > > Thanks! > > > > > > > > -----Original Message----- > > From: syslog-ng-admin(a)lists.balabit.hu > > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Balazs > > Scheidler > > Sent: Sunday, October 24, 2004 3:53 AM > > To: syslog-ng(a)lists.balabit.hu > > Subject: RE: [syslog-ng]bind_inet_socket() error > > > > On Sun, 2004-10-24 at 00:36, Walt Rich wrote: > > > Response to a) shows: > > > # ifconfig -a | grep 172 > > > inet 172.16.100.202 netmask ffffff00 broadcast > > > 172.16.100.255 > > > > but you are trying to bind to 172.16.65.61, which is not local. > > (your local IP is .202) > > > > (for TCP sources you are specifying the bind IP and not the IP > > address you want to receive messages from) > > > > -- > > Bazsi > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at > > http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at > > http://www.campin.net/syslog-ng/faq.html > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > -- Nate "Usenet is distributed network anarchy at its best--or worst, depending on what is posted on any particular day." - Fiedler, David in 'Byte' _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Source IP address incorrect
by Singh, Mandeep Mr. Adnet 28 Oct '04

28 Oct '04

All, I seem to be having a common problem with forwarding syslog messages. I have read through archives and the solution that is most popular isn't working for me. I have a central server with is properly receiving messages from my PIX firewalls. On that same server I have an application from Cisco with acts like a syslogd daemon and parses PIX messages into separate categories. Syslog-ng is listening on 514 and the Cisco product is listening on 515. My problem is the source IP address that the Cisco application receives is the IP address of the server not the PIX that produced it. Any help would be greatly appreciated, below is my configuration file. Thanks in advance. Mandeep options { keep_hostname(yes); chain_hostnames(no); create_dirs(yes); use_time_recvd(yes); use_dns(no); use_fqdn(no); }; source s_external { udp(); }; destination d_firewall_file { file("/logs/$YEAR/$MONTH/$DAY/firewall.log" perm(0655) dir_perm(0655)); }; destination d_firewall_Port { udp("192.168.0.1" port(515)); }; log { source(s_external); destination(d_firewall_file); }; log { source(s_external); destination(d_firewall_Port); };

2 1

RE: [syslog-ng]bind_inet_socket() error
by Walt Rich 27 Oct '04

27 Oct '04

Is there a link that you could forward that would explain how to do this? I'm a newbie to Linux and Syslog-ng. Thanks for everyone's assistance with this. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Nate Campi Sent: Tuesday, October 26, 2004 8:00 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]bind_inet_socket() error Right, packet filter and/or compile with TCP wrappers for access control, syslog-ng itself won't do that for you. On Tue, Oct 26, 2004 at 02:11:18PM -0500, Dave Johnson wrote: > * Set you max connections to the number of connections that you anticipate. > * Otherwise-- Firewall. > > On Mon, 25 Oct 2004 10:29:08 -0500, Walt Rich <walt.rich(a)parago.com> wrote: > > OK, I see what you mean. > > > > What is the syntax for setting up a source that is an IP address > > that is not local? I'm trying to set up a centralized logging > > server and would like for it to receive logging from other servers, > > but I would like to be able to specify the IP addresses that it will accept input from. > > > > Thanks! > > > > > > > > -----Original Message----- > > From: syslog-ng-admin(a)lists.balabit.hu > > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Balazs > > Scheidler > > Sent: Sunday, October 24, 2004 3:53 AM > > To: syslog-ng(a)lists.balabit.hu > > Subject: RE: [syslog-ng]bind_inet_socket() error > > > > On Sun, 2004-10-24 at 00:36, Walt Rich wrote: > > > Response to a) shows: > > > # ifconfig -a | grep 172 > > > inet 172.16.100.202 netmask ffffff00 broadcast > > > 172.16.100.255 > > > > but you are trying to bind to 172.16.65.61, which is not local. > > (your local IP is .202) > > > > (for TCP sources you are specifying the bind IP and not the IP > > address you want to receive messages from) > > > > -- > > Bazsi > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at > > http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at > > http://www.campin.net/syslog-ng/faq.html > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > -- Nate "Usenet is distributed network anarchy at its best--or worst, depending on what is posted on any particular day." - Fiedler, David in 'Byte' _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Sending a log line via e-mail
by Csehi Andras 27 Oct '04

27 Oct '04

Hi! I try it (based on the documentation), but it isn't working. The destination line look like this: destination d_ups { program("mail -s UPSlog acsehi(a)qsoft.hu"); }; the syslog-ng try to send the line(s), but the bsd mailer waits something. If I try it in command line (with pipe-line), the command works perfectly. The environment: Debian 3.0r2, Kernel: 2.4.18, syslog-ng: 1.5.15. Sincerelly, András, Csehi Csehi András acsehi(a)freemail.hu, acsehi(a)qsoft.hu (1) 209-6651, (20) 410-5343

4 4

RE: [syslog-ng]bind_inet_socket() error
by Walt Rich 27 Oct '04

27 Oct '04

OK, I see what you mean. What is the syntax for setting up a source that is an IP address that is not local? I'm trying to set up a centralized logging server and would like for it to receive logging from other servers, but I would like to be able to specify the IP addresses that it will accept input from. Thanks! -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Sunday, October 24, 2004 3:53 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]bind_inet_socket() error On Sun, 2004-10-24 at 00:36, Walt Rich wrote: > Response to a) shows: > # ifconfig -a | grep 172 > inet 172.16.100.202 netmask ffffff00 broadcast 172.16.100.255 but you are trying to bind to 172.16.65.61, which is not local. (your local IP is .202) (for TCP sources you are specifying the bind IP and not the IP address you want to receive messages from) -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

forwarding a syslog packet
by Mark McCurdy 26 Oct '04

26 Oct '04

I have three syslog machines. One sits in the DMZ and sends only. One sits on the LAN, receives traffic only and is our centralized syslog host. The 3rd sits between the above two, and it's duty is to resend incoming DMZ syslog traffic to the LAN server. My problem is that all packets being sent from the DMZ are being shown on the LAN server as being from the middle box. When I inspect the packet on the LAN machine, I see the original machine's hostname is mentioned in the packet, but that hostname is ultimately ignored. My old firewall proxy solution just udp tunneled the dmz syslog; therefore, no resending happened. Help and thanks, Mark

1 0

filter host and regex
by Stefan Schluppeck 26 Oct '04

26 Oct '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I use syslog-ng as a central logserver for 90 Linux Servers und 150 Network machines (router switches) I have to write a filter for matching hosts: The Filter looks like this: filter f_network { host("^ch4-*") or host("^bu.1-*"); }; but this filter does not match this lines: Oct 26 14:04:16 bu21-flur2-c3548-1 197791: %LINEPROTO-5-UPDOWN Oct 26 14:24:10 bu19-r151-c3548-3 32761: %LINEPROTO-5-UPDOWN Question: waht ist the right regex to match the hostnames: bu21-flur2-c3548-1 bu19-r151-c3548-3 pleace give me some tipps, thx - -- Mit freundlichen Grüßen / With regards Stefan Schluppeck Bauer Publishinggroup - Brieffach 6200 - Burchard.11 - D-20077 Hamburg Publishing Support Center - Server & Development - Stefan Schluppeck Fon:+49-40-3019-5519 - Fax:+49-40-3019-5668 - eMail:sschluppeck@hbv.de ~ <°)))))>< ><)))))°> <°)))))>< ><)))))°> <°)))))>< ><)))))°> PGP-Fingerabdruck = 7DC1 E4B4 056C 5380 8C68 4B5F 5E87 227D 5632 E45F Key-ID = 81B7CD29 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBfkP5XocifVYy5F8RAhyGAJ9c2ysTKQ9ihX9tgYTjgoJai+t6GQCgldk3 NBOaJFgZxnhSvQU9vrzWlNo= =bRz8 -----END PGP SIGNATURE-----

1 0

[patch] fixing: no static libol problem
by Enrico Weigelt 25 Oct '04

25 Oct '04

hi folks, at my site the latest libol doensnt produce a static library, which breaks syslog-ng build. here's a patch that fixes this by linking dynamically. cu -- --------------------------------------------------------------------- Enrico Weigelt == metux IT service phone: +49 36207 519931 www: http://www.metux.de/ fax: +49 36207 519932 email: contact(a)metux.de cellphone: +49 174 7066481 --------------------------------------------------------------------- -- DSL ab 0 Euro. -- statische IP -- UUCP -- Hosting -- Webshops -- ---------------------------------------------------------------------

1 0

[patch] fixing MIN/MAX bug
by Enrico Weigelt 25 Oct '04

25 Oct '04

hi folks, here's a patch that fixes the missing MIN/MAX macros on certain environments (probably libc-dependent ?) cu -- --------------------------------------------------------------------- Enrico Weigelt == metux IT service phone: +49 36207 519931 www: http://www.metux.de/ fax: +49 36207 519932 email: contact(a)metux.de cellphone: +49 174 7066481 --------------------------------------------------------------------- -- DSL ab 0 Euro. -- statische IP -- UUCP -- Hosting -- Webshops -- ---------------------------------------------------------------------

1 0

[patch] fixing missing depcomp
by Enrico Weigelt 25 Oct '04

25 Oct '04

Hi folks, I'm currently trying to build current syslog-ng. 'depcomp' seems to be missing, so I had to add it manually. Here's a patch which should fix it. All of my patches for syslog-ng can be found at rsync://sources.metux.de/metux-patches/syslog-ng/ cu -- --------------------------------------------------------------------- Enrico Weigelt == metux IT service phone: +49 36207 519931 www: http://www.metux.de/ fax: +49 36207 519932 email: contact(a)metux.de cellphone: +49 174 7066481 --------------------------------------------------------------------- -- DSL ab 0 Euro. -- statische IP -- UUCP -- Hosting -- Webshops -- ---------------------------------------------------------------------

1 0

RE: [syslog-ng]bind_inet_socket() error
by Walt Rich 24 Oct '04

24 Oct '04

Response to a) shows: # ifconfig -a | grep 172 inet 172.16.100.202 netmask ffffff00 broadcast 172.16.100.255 all of which is correct. Response to b) is nothing: # netstat -an | grep 514 # I've turned off regular syslog on this box.. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu on behalf of Dave Johnson Sent: Sat 10/23/2004 11:15 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]bind_inet_socket() error a) ifconfig -a |grep 172 this shows you have that ip address on that machine? b) netstat -an |grep 514 is there something already listening on 514 tcp? On Fri, 22 Oct 2004 17:54:39 -0500, Walt Rich <walt.rich(a)parago.com> wrote: > > > I'm getting the following error when attempting to start syslog-ng: > > # ./S74syslog start > io.c: bind_inet_socket() bind failed 172.16.65.61:514 Cannot assign > requested address > Error initializing configuration, exiting. > > here is the line in the syslog-ng.conf file that is setting up a the > corresponcidg source: > > source net_tcp { tcp( ip(172.16.65.61) port(514) ); }; > > Does anyone know what the error means and how I can get around it? > > I appreciate any help you can provide. > > Thanks! _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

syslog-ng and snmptrapd keep original hostnames
by Dirk Laan 24 Oct '04

24 Oct '04

Hello, We have 2 syslog-ng relay servers and 1 syslog-ng server. We also use mysql. So the 2 relay server sending al messages to the syslog-ng server So when a switch sends a snmtrap to the relay server it forwards the message to the syslog-ng server. When I look at the messages I don't see the hostname of the switch in the Table HOST. Instead I see the name of the relay server. Is there a solution for this ? Dirk

2 1