- syslog-ng - lists.balabit.hu

please help find the "parse error" in this small syslog-ng.conf...
by seberino＠spawar.navy.mil 26 Jul '04

26 Jul '04

This syslog-ng.conf: options {long_hostnames(no); keep_hostname(yes); chain_hostnames(no);}; source client_sources {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination local_dest {file("/var/log/messages");}; destination remote_dest {tcp(ip("127.0.0.1") port(514));}; log {source(client_sources); destination(local_dest);}; log {source(client_sources); destination(remote_dest);}; gives this error messages when I try to use it... [laptop root /etc/rc.d] # /usr/local/sbin/syslog-ng -f /etc/syslog-ng.conf parse error at 8 Parse error reading configuration file, exiting. (line 8) I've stared at this syslog-ng.conf for a long time and can't see what the problem is. Any help would be greatly appreciated. Sincerely, Chris

2 2

RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers
by Amaral, Angelo 24 Jul '04

24 Jul '04

Andrew, I put in my system, the hosts.allow below: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ # hosts.allow This file describes the names of the hosts which are # allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # in.tftpd: ALL :allow sshd: ALL :allow ALL: ALL :deny ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ And the configuration continue not working. May you help me, please. Thanks. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Andrew J Caines Sent: quarta-feira, 21 de julho de 2004 20:25 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers Angelo, > I compile the syslog-ng with support tcpwrappers. > I put in hosts.deny my filter and it?s not work. From reading the documentation, you and Joe should be aware that hosts.deny is depreciated and that deny statements go in hosts.allow, eg. ALL : localhost 127.0.0.1 your.server.or.IP : allow sshd : ALL : severity auth.info : allow syslog-ng : your.network : allow ALL : ALL : severity auth.notice : \ twist echo "You are not welcome to use %d from %h." You should also see any errors or warnings when you run tcpdchk. -Andrew- -- _______________________________________________________________________ | -Andrew J. Caines- Unix Systems Engineer A.J.Caines(a)halplant.com | | "They that can give up essential liberty to obtain a little temporary | | safety deserve neither liberty nor safety" - Benjamin Franklin, 1759 | _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

Sensord (lm_sensors) and Syslog-ng using "program()"
by Ann Hopkins 23 Jul '04

23 Jul '04

I was wondering if anyone sees any problem with what I am doing with the following script. I want an "Alarm" which causes an "Alert" message to actually shutdown the machine under certain circumstances, since I run a family server and I don't have a backup. 1) "sensord" (lm_sensors library) is running and I can do "sensors" command to get a result. via686a-isa-6000 Adapter: ISA adapter Algorithm: ISA algorithm CPU core: +1.73 V (min = +1.68 V, max = +2.49 V) +2.5V: +2.59 V (min = +2.24 V, max = +2.74 V) I/O: +3.40 V (min = +2.95 V, max = +3.62 V) +5V: +4.87 V (min = +4.47 V, max = +5.49 V) +12V: +11.74 V (min = +10.79 V, max = +13.18 V) CPU Fan: 0 RPM (min = 3000 RPM, div = 2) P/S Fan: 0 RPM (min = 3000 RPM, div = 2) SYS Temp: +30.0Â°C (high = +45Â°C, hyst = +40Â°C) CPU Temp: +38.5Â°C (high = +60Â°C, hyst = +55Â°C) SBr Temp: +25.1Â°C (high = +65Â°C, hyst = +60Â°C) 2) "syslog-ng" is working and logging the data under 'local5". The following is the pertinent "syslog-ng.conf" data. All the data is logged and the "Alert" data triggers input to a shell program. filter f_local5 { facility(local5); }; filter f_sensorA { level(alert) and facility(local5); }; destination sensord { file("/var/log/local5.log"); }; log { source(src); filter(f_local5); destination(sensord); }; # Sensor Alarm Messages - Programs are loaded once (email) destination sensor_alarm { program("/usr/local/sbin/sensor_alarm.sh"); }; log { source(src); filter(f_sensorA); destination(sensor_alarm); }; 3) Program "sensor_alarm.sh" will try to shutdown the machine if it reaches a too hot condition. I don't have fan sensors so it will never trigger. I am no programmer, please excuse my very primitive (and naive) coding. Is there anything wrong with calling this program? SENSOR_ALARM.SH #!/bin/sh # Make sensord do something useful with syslog-ng # -k does nothing will use a -h halt later # +2 in 2 minutes while read line; do echo $line | /usr/bin/mail -s "SENSORD Alarm" root@localhost AlarmName="" AlarmName=`echo $line | /usr/bin/awk -F":" '{ print $1 }'` case "$AlarmName" in "CPU core") /sbin/shutdown -k +2 "CPU core ALARM - bad voltage" ;; "SYS Temp") /sbin/shutdown -k +2 "SYS Temp ALARM - too hot" ;; "CPU Temp") /sbin/shutdown -k +2 "CPU Temp ALARM - too hot" ;; "CPU Fan") /sbin/shutdown -k +2 "CPU Fan ALARM - fan down" ;; "P/S Fan") /sbin/shutdown -k +2 "P/S Fan ALARM - fan down" ;; *) echo "WARNING SENSORD - Be Careful!" | /usr/bin/wall ;; esac done

1 0

syslog-ng 1.6.4 and tcp_wrappers
by Amaral, Angelo 22 Jul '04

22 Jul '04

My name is Angelo, And I have equal problem of Joe Geek I compile the syslog-ng with support tcpwrappers. I put in hosts.deny my filter and it´s not work. Thanks. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Joe Geek Sent: quinta-feira, 15 de julho de 2004 18:41 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers I've got syslog-ng v 1.6.4 compiled with tcp_wrapper support and tried to block a particular ipaddress in hosts.deny Does the syslog-ng daemon have to be started from inetd for this to work? Does syslog-ng use tcp_wrappers for UDP traffic also? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

How to get sure if a remote syslog-ng is down?
by julius 21 Jul '04

21 Jul '04

Hi, at the moment my remote syslog-ng prints every 10 minutes a message, theres a message when the remote syslog-ng disconnected, but what happens when the remote host boots up and syslog-ng cant be started?

2 1

syslog-ng and mysql
by Deepu George 19 Jul '04

19 Jul '04

I am trying to configure syslog-ng to write to mysql. I have already installed mysql and created the database and tables. When I am enabling the syslog-ng to mysql using the following script in syslog-ng.conf , I get a parse error when staring syslog-ng destination d_mysql { pipe("/tmp/mysql.pipe" template ("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST','$FACILITY','$PRIORITY','$LEVEL','$TAG','$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n")template-escape(yes)); }; log { source(net); destination(d_mysql); }; Best regards Deepu

1 0

[Q]Syslog-ng 1.6.4 compile help
by Martin Raines (mraines) 16 Jul '04

16 Jul '04

Team, I have Solaris 8 and syslog-ng 1.6.4 and libol 3.13 I would appreciate some clear intructions on how to get them compliled on my system please. I have them installed OK using pkgadd but cannot find any info about getting them compliled. Many thanks Martin

1 0

RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers
by Amaral, Angelo 16 Jul '04

16 Jul '04

My name is Angelo, And I have equal problem of Joe Geek I compile the syslog-ng with support tcpwrappers. I put in hosts.deny my filter and log come in. Thanks. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Joe Geek Sent: quinta-feira, 15 de julho de 2004 18:41 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers I've got syslog-ng v 1.6.4 compiled with tcp_wrapper support and tried to block a particular ipaddress in hosts.deny Does the syslog-ng daemon have to be started from inetd for this to work? Does syslog-ng use tcp_wrappers for UDP traffic also? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers
by Rule, Ted 16 Jul '04

16 Jul '04

In /etc/hosts.allow you need something like this listing all the permitted clients and denying anything else. syslog-ng: 172.22.2.13: allow syslog-ng: 172.18.112.3: allow syslog-ng: ALL: deny It doesn't need any inetd configuration. I don't believe it works for UDP, but I wouldn't lockout UDP syslog traffic that way anyway; better to block it at the layer beneath with ipchains/iptables/ipfilter or similar. For extra resilience where a firewall separates the syslog-ng client and server, I added some TCP Keepalive code to ensure a relatively quiet syslog-ng TCP stream is always kept alive in the face of Firewall-1/iptables idling out the connection, but it's not essential, and it may even have been included in later releases anyway. Ted $ diff -u afinet.c-1.6.0rc3.orig afinet.c-1.6.0rc3.patched --- afinet.c-1.6.0rc3.orig Sat Feb 28 11:42:50 2004 +++ afinet.c-1.6.0rc3.patched Sat Feb 28 11:42:50 2004 @@ -28,6 +28,8 @@ #include "cfgfile.h" #include "pkt_buffer.h" +#include <sys/socket.h> +#include <sys/types.h> #include <errno.h> #include <string.h> #include <assert.h> @@ -217,8 +219,13 @@ CAST(afinet_source, self, c); struct afsocket_source_connection *conn; UINT32 res; + int socklen,sockval; + + socklen=sizeof(sockval); + if ( ( getsockopt(client->super.fd, SOL_SOCKET, SO_TYPE, &sockval, &socklen) == 0 ) && + ( sockval == SOCK_STREAM ) ) { #if ENABLE_TCP_WRAPPER - { + { struct request_info req; request_init(&req, RQ_DAEMON, "syslog-ng", RQ_FILE, client->super.fd, 0); @@ -230,9 +237,19 @@ close_fd(&client->super, 0); return ST_OK | ST_GOON; } + } +#endif + +#ifdef SO_KEEPALIVE + sockval=1; socklen=sizeof(sockval); + if ( setsockopt(client->super.fd, SOL_SOCKET, SO_KEEPALIVE, &sockval, socklen) < 0 ) { + notice("setsockopt SO_KEEPALIVE failure during do_open_afinet_connection()"); + } else { + notice("setsockopt SO_KEEPALIVE Ok in do_open_afinet_connection()"); } - #endif + } + if (c->num_connections >= c->max_connections) { CAST(inet_address_info, inet_addr, client_addr); @@ -250,8 +267,6 @@ } return res; } - - } static int @@ -488,6 +503,17 @@ if (self->conn_fd) { return ST_OK | ST_GOON; +#ifdef SO_KEEPALIVE + if ( (self->super.flags & 0x0003) == AFSOCKET_STREAM ) { + int sockval=1; + + if ( setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &sockval, sizeof(sockval)) < 0 ) { + notice("setsockopt SO_KEEPALIVE failure during do_init_afinet_dest()"); + } else { + notice("setsockopt SO_KEEPALIVE Ok in do_init_afinet_dest()"); + } + } +#endif } else { io_callout(self->cfg->backend, $ Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

syslog-ng 1.6.4 and tcp_wrappers
by Joe Geek 15 Jul '04

15 Jul '04

I've got syslog-ng v 1.6.4 compiled with tcp_wrapper support and tried to block a particular ipaddress in hosts.deny Does the syslog-ng daemon have to be started from inetd for this to work? Does syslog-ng use tcp_wrappers for UDP traffic also?

1 0

syslog-ng NOT Reading source file, which grows. HELP!
by alex 15 Jul '04

15 Jul '04

Hello, I have compiled syslog-ng (latest ver syslog-ng 1.6.4) on AIX 5.1 and have configured the client to send sudo logs to the centrilized server. The Network part is working fine, and I know my binary compiled OK. In addition to sudo activity logging I was going to send logs, produced by the other daemon--sudoscriptd--which logs all root shell activities to some predefined file on the same server (for testing) and later I will send it too. In my case: var/log/sudoscript. I was going to centrilized this one as well, but for now I can't figured out why syslog-ng is NOT READING from the source file. Also, I was trying: source sudo_scr {pipe("/var/log/sudoscript"); }; - with no success. PLEASE HELP! ##HERE IS MY syslon-ng.conf#### #cat syslog-ng.conf options { sync (0); mark (10); time_reopen (10); log_fifo_size (2000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source sys { unix-dgram("/dev/log" ); internal(); }; #STANDARD staff. This works. source sudo_scr {file("/var/log/sudoscript"); }; # THIS IS FILE WHICH GROWS as sudoscript writes to it. #syslog-ng CAN"T READ from it. destination internal_1 { file("/var/log/sudologs/sudolog"); }; #THIS IS TEMP. DESTINATION FILE (EMPTY?) destination host01 { tcp(1.5.7.15 port(514)); }; #THIS IS WORKING PART TOO filter f_sudo { facility(local2); }; log { source(sudo_scr); destination(internal_1); }; # THIS IS NOT WORKING PART log { source(sys); filter(f_sudo); destination(host01); }; # THIS PART IS WORKING

2 1

difference between 1.6.4 & 1.7.0 branches?
by OpenMacNews 15 Jul '04

15 Jul '04

hi, can someone clarify the difference between the 1.6.4 & 1.7.0 branches? the 1.7.0 branch doesn't seem to have been touched for awhile, but the 1.6.4 branch seems current ... syslog-ng-1.6.4+20040710.tar.gz 07/10/2004 syslog-ng-1.7.0+20040514.tar.gz 05/14/2004 i'm building on OSX 10.3.4, and have read others have used 1.7.0 .... is there a reason? which branch is 'best'? thanks! richard

2 1

RE: [syslog-ng]syslog-ng on Sol8 - newbie questions
by jbrunke＠ctsgi.com 14 Jul '04

14 Jul '04

For whatever reason, my syslogd probe IS configured to listen on the UDP port by default... I confirmed this by stopping syslogd, starting syslog-ng and then trying to restart syslogd. Syslogd would not start because it could not hook to port 514... Creating the /etc/default/syslogd was the answer. There is also a "-t" option for syslogd that may also do the same thing. As for your other suggestion. I was unable to get syslogd to forward anything to @localhost. It would complain at startup it was undefined (it is not). When I put @theactualhostname, no compaints on startup, but that didn't seem to do it either. So I went back and took the @theactualhostname definition out of syslogd.conf (making syslogd.conf "stock") and put the sun-streams src back in syslog-ng. That seems to have done the trick. Both syslogd and syslog-ng "see" local system messages and take appropriate action(s). So I guess there is no issue with syslog & syslog-ng "sharing" the /dev/log stream. Can someone confirm I won't run into problems with this config? So now I believe I have the best of both worlds... The SA can have his syslog.conf file and whatever files he wants to do there. All remote syslog traffic is received and managed by syslog-ng. The SA never liked the fact that forwarded syslog messages "gummed up" /var/adm/messages anyway... ;-) Thanks, Jim Brunke ------------------------------------------------------------------------------- - From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng- admin(a)lists.balabit.hu] On Behalf Of Pedroche, Raúl Sent: Wednesday, July 14, 2004 3:52 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]syslog-ng on Sol8 - newbie questions The idea would be configuring syslogd to not to listen on UDP and send messages to it, while syslog-ng listens on UDP socket and does not read from /dev/log. You can add a line "LOG_FROM_REMOTE=NO" to /etc/default/syslogd (but it should not be necessary, as Solaris syslogd does not listen on UDP port by default) and add a line to /etc/syslog.conf alike to whatever.whatever,*.somethingelse @localhost Then create (and use) an UDP source in syslog-ng.conf and NOT a source of type sun-streams. -----Original Message----- From: jbrunke(a)ctsgi.com [mailto:jbrunke@ctsgi.com] Sent: Tuesday, July 13, 2004 10:18 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng on Sol8 - newbie questions I'm running Solaris 8. I would like to setup syslog-ng and syslogd to operate together. Reading the faq, it says: Q: I'm new to syslog-ng. Is there a way for syslog-ng and syslogd to co- exist?... A: Yes, syslog-ng can accept messages from stock syslogd using the udp() source. Can anyone give me more specifics on how to setup the source for this setup? We've got syslogs forwarded from our network gear to this box so I want to make sure syslog-ng can get those forwarded messages from syslogd. Also, can anyone give a suggested filter setup for the following syslog.conf entry: local7.notice;*.err;kern.debug;daemon.notice;mail.none /var/log/error.log Thanks, Jim _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

1 0

RE: [syslog-ng]syslog-ng on Sol8 - newbie questions
by "Pedroche, Raúl" 14 Jul '04

14 Jul '04

The idea would be configuring syslogd to not to listen on UDP and send messages to it, while syslog-ng listens on UDP socket and does not read from /dev/log. You can add a line "LOG_FROM_REMOTE=NO" to /etc/default/syslogd (but it should not be necessary, as Solaris syslogd does not listen on UDP port by default) and add a line to /etc/syslog.conf alike to whatever.whatever,*.somethingelse @localhost Then create (and use) an UDP source in syslog-ng.conf and NOT a source of type sun-streams. -----Original Message----- From: jbrunke(a)ctsgi.com [mailto:jbrunke@ctsgi.com] Sent: Tuesday, July 13, 2004 10:18 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng on Sol8 - newbie questions I'm running Solaris 8. I would like to setup syslog-ng and syslogd to operate together. Reading the faq, it says: Q: I'm new to syslog-ng. Is there a way for syslog-ng and syslogd to co- exist?... A: Yes, syslog-ng can accept messages from stock syslogd using the udp() source. Can anyone give me more specifics on how to setup the source for this setup? We've got syslogs forwarded from our network gear to this box so I want to make sure syslog-ng can get those forwarded messages from syslogd. Also, can anyone give a suggested filter setup for the following syslog.conf entry: local7.notice;*.err;kern.debug;daemon.notice;mail.none /var/log/error.log Thanks, Jim _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

1 0

syslog-ng on Sol8 - newbie questions
by jbrunke＠ctsgi.com 13 Jul '04

13 Jul '04

I'm running Solaris 8. I would like to setup syslog-ng and syslogd to operate together. Reading the faq, it says: Q: I'm new to syslog-ng. Is there a way for syslog-ng and syslogd to co- exist?... A: Yes, syslog-ng can accept messages from stock syslogd using the udp() source. Can anyone give me more specifics on how to setup the source for this setup? We've got syslogs forwarded from our network gear to this box so I want to make sure syslog-ng can get those forwarded messages from syslogd. Also, can anyone give a suggested filter setup for the following syslog.conf entry: local7.notice;*.err;kern.debug;daemon.notice;mail.none /var/log/error.log Thanks, Jim

1 0

syslog-ng conf confusion
by Chet Harvey 13 Jul '04

13 Jul '04

Hi all, I am trying to change a box from syslog to syslog-ng but I cant quite get the syntax down. I was hoping someone could steer me in the right direction. Here is my current syslog.conf: local0.* %/var/log/filter.log local7.* %/var/log/dhcpd.log *.notice;kern.debug;lpr.info;mail.crit;news.err;local0.none;local7.none %/var/log/system.log security.* %/var/log/system.log auth.info;authpriv.info;daemon.info %/var/log/system.log *.emerg * This is how I did my syslog-ng.conf: # # This sample configuration file is essentially equilivent to the stock # FreeBSD /etc/syslog.conf file. # # # options options { long_hostnames(off); sync(0); }; source src { unix-stream("/var/run/log"); pipe("/dev/klog"); internal(); }; destination dest { file("/var/log/filter.log"); }; destination stunnel { tcp("127.0.0.1" port(514)); }; log { source(src);destination(dest); }; log { source(src);destination(stunnel); }; # # destinations # destination messages { file("/var/log/system.log"); }; destination firewall { file("/var/log/filter.log"); }; destination dhcp { file("/var/log/dhcp.log"); }; # log facility filters # filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_console { facility(console); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # # log level filters # filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info..emerg); }; filter f_debug { level(debug..emerg); }; # # *.err;kern.debug;auth.notice;mail.crit /dev/console # # # *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages # log { source(src); filter(f_notice); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # # security.* /var/log/security # log { source(src); filter(f_security); destination(messages); }; ## firewall specific log { source(src); filter(f_local0); destination(firewall); }; log { source(src); filter(f_local7); destination(dhcp); }; Hopelessly lost......thanks for any insight/education... -- Chet

1 0

Hostname Problem
by phusion 10 Jul '04

10 Jul '04

I've been having a problem with the $HOST macro. My setup is as follows: message gets sent from HostA through HostB and finally to the log server HostC. HostA is a Windows box running Snare for Windows, HostB is a FreeBSD box running syslog-ng, and HostC is a FreeBSD box running syslog-ng. HostA doesn't have a config file, it's a GUI app, but here are parts of the syslog-ng config files: HostB Config ------------ # Options options { keep_hostname(yes); long_hostnames(off); sync(0); }; HostC Config ------------ # Options options { keep_hostname(yes); long_hostnames(off); sync(0); }; HostA - moon-a, 10.10.2.2 HostB - moon, 10.10.1.7, 10.10.2.1 HostC - mars, 10.10.1.2 On the log server I have files from HostA go to $HOST.log. It then puts it as 10.10.1.7.log instead of moon-a.log. Also, here is a line from the file where it puts the IP address of HostB and hostname of HostA. Jul 8 10:57:00 10.10.1.7 moon-a MSWinEventLog 1 Application 675 Thu Jul 08 10:56:08 2004 0 sshd SYSTEM User Information MOON-A None sshd : PID 1808 : Server listening on 0.0.0.0 port 22. 1 Let me know what you think the problem is? Phusion __________________________________ Do you Yahoo!? Yahoo! Mail Address AutoComplete - You start. We finish. http://promotions.yahoo.com/new_mail

1 0

syslog-ng on OSX 10.3.4
by OpenMacNews 09 Jul '04

09 Jul '04

hi all, i'm new to syslog-ng. i've installed 1.7x on OSX 10.3.4; now, starting to deal with the config file. i dl'd and searched thru the list archives for pointers, etc. and found the last relevant, post by Kim Cary, but nothing further. i contacted Kim -- not yet finished/successful. soooooo, to ask: has anyone here got syslog-ng up/running on OSX, and would you be willing to share your conf file? thx! richard

1 0

regex support
by Joe.Reeves＠Regions.com 09 Jul '04

09 Jul '04

I am trying to use syslog-ng to reduce certain types of logging. I have scoured the web looking for information on the supposed regex support in syslog-ng, but the only thing I have really found mention of is the "match" keyword that matches a simple string. What I wanted to know is if syslog-ng supports either posix or perl style regular expressions. If not, has anyone found any other effective method of reducing logs using regex with an external program? (that could be used with the "program" keyword perhaps?) Thanks in advance, -- ____________________________________________ Joe Reeves Security Engineer II, IDS Regions Technology Risk Management Office: 334-956-6189 joe.reeves(a)regions.com ____________________________________________ "Wisdom is knowing what to do with what you know." -- J. Winter Smith

3 2

syslog-ng sighup problem
by jayesh 08 Jul '04

08 Jul '04

Hi , I want to know how should I re-read my syslog-ng configuration file without restarting syslog-ng. I found out solution by sending sighup signal to syslog-ng but its not re-reading it i.e when I give kill command with sighup signal to syslog-ng pid it does nothing what is the problem or any other solution. With regards, Jayesh shah

2 1

compression question
by Dave Patterson 07 Jul '04

07 Jul '04

hello all, how do you evoke compression of recently rotated files from within syslog-ng.conf ? Thanks, Dave Patterson Open LabNet Staff

1 0

syslog-ng conf confusion
by Chet Harvey 07 Jul '04

07 Jul '04

Hi all, I am trying to change a box from syslog to syslog-ng but I cant quite get the syntax down. Here is my current syslog.conf: local0.* %/var/log/filter.log local7.* %/var/log/dhcpd.log *.notice;kern.debug;lpr.info;mail.crit;news.err;local0.none;local7.none %/var/log/system.log security.* %/var/log/system.log auth.info;authpriv.info;daemon.info %/var/log/system.log *.emerg * This is how I did my syslog-ng.conf: # # This sample configuration file is essentially equilivent to the stock # FreeBSD /etc/syslog.conf file. # # # options options { long_hostnames(off); sync(0); }; source src { unix-stream("/var/run/log"); pipe("/dev/klog"); internal(); }; destination dest { file("/var/log/filter.log"); }; destination stunnel { tcp("127.0.0.1" port(514)); }; log { source(src);destination(dest); }; log { source(src);destination(stunnel); }; # # destinations # destination messages { file("/var/log/system.log"); }; destination firewall { file("/var/log/filter.log"); }; destination dhcp { file("/var/log/dhcp.log"); }; # log facility filters # filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_console { facility(console); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # # log level filters # filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info..emerg); }; filter f_debug { level(debug..emerg); }; # # *.err;kern.debug;auth.notice;mail.crit /dev/console # # # *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages # log { source(src); filter(f_notice); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # # security.* /var/log/security # log { source(src); filter(f_security); destination(messages); }; ## firewall specific log { source(src); filter(f_local0); destination(firewall); }; log { source(src); filter(f_local7); destination(dhcp); }; Hopelessly lost......thanks for any insight/education... -- Chet

1 0

Syslog-NG 1.6.3/1.6.4 broken under OpenBSD 3.5.
by Gustavo Chamone 07 Jul '04

07 Jul '04

Folks, Syslog-NG 1.6.3 and 1.6.4 fails to compile on OpenBSD 3.5 -- although, 1.6.2 works 'smoothly'. Compilation stops at: In file included from macros.c:64: /usr/include/arpa/inet.h:74: warning: `struct in_addr' declared inside parameter list /usr/include/arpa/inet.h:74: warning: its scope is only this definition or declaration, which is probably not what you want. /usr/include/arpa/inet.h:75: warning: `struct in_addr' declared inside parameter list /usr/include/arpa/inet.h:75: warning: parameter has incomplete type /usr/include/arpa/inet.h:79: warning: parameter has incomplete type /usr/include/arpa/inet.h:85: warning: parameter has incomplete type macros.c: In function `format_tzofs': macros.c:118: `tm' undeclared (first use in this function) macros.c:118: (Each undeclared identifier is reported only once macros.c:118: for each function it appears in.) *** Error code 1 Stop in /root/source/syslog-ng/syslog-ng-1.6.3/src. *** Error code 1 Stop in /root/source/syslog-ng/syslog-ng-1.6.3/src (line 253 of Makefile). *** Error code 1 Stop in /root/source/syslog-ng/syslog-ng-1.6.3/src (line 418 of Makefile). *** Error code 1 Stop in /root/source/syslog-ng/syslog-ng-1.6.3 (line 168 of Makefile). Keep up the good work! Best regards, Gustavo Chamone

3 2

Syslog-ng-Mysql error
by Venkata Phani Kiran Achanta 07 Jul '04

07 Jul '04

Greetings all, Everything was going well until I got this error while loading the Mysql tables.... DBD::mysql::db do failed: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '192.168.254.250', 'auth', 'notice', 'notice', '25', '2004-07-01 at ./db-loader.pl line 19, <FH> line 1. And my line 1 in mysql.pipe looks like this INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '192.168.254.250', 'auth', 'notice', 'notice', '25', '2004-07-01', '15:26:28', 'DNS_NS25','DNS_NS25: NetScreen device_id=DNS_NS25 [No Name]system-notification-00257(traffic): start_time=\"2004-07-01 15:30:26\" duration=2 policy_id=0 service=dns proto=17 src zone=Trust dst zone=Untrust action=Permit sent=99 rcvd=274 src=192.168.254.2 dst=63.209.70.231 src_port=1116 dst_port=53 src-xlated ip=12.28.143.203 port=1116 /etc/syslog-ng/syslog-ng.conf destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM','$MSG' )\n") template-escape(no)); }; The problem obviously is with the msg field, at times the msg field wouldn't get terminated with the Single quote that is required for the SQL INSERT syntax. I am sure that atleast one of you may have already came across this problem. Is there a work around for this? Any ideas....let me know if you need more info to get me out of this error. Thanks in advance. Thanks, Venkata Achanta

1 0

Newbie - packet format
by A Ananth 06 Jul '04

06 Jul '04

Hello, After trying to find the answer in the FAQ and archives without success, I am hoping this group can answer the questions below: Q. Does syslog-ng send UDP messages formatted as per RFC3164 to port 514? If not by default, can it configured to do so? I have a syslog receiver that is able to correctly receive standard syslog messages but seems unable to receive messages from a Solaris box where syslog-ng has been installed. Thanks in advance, -- A N Ananth Prism Microsystems --------------------------------- Do you Yahoo!? New and Improved Yahoo! Mail - Send 10MB messages!

2 1