- syslog-ng - lists.balabit.hu

Streams error in messages and debug mode
by Fahey Owens 04 Jun '04

04 Jun '04

I'm receiving the following error "do_stream_read: STREAMS device gave too long line" when I start syslog-ng -d -v. My config file is below, thanks in advance options { use_fqdn(yes); keep_hostname(yes); use_dns(no); long_hostnames(off); sync(0); log_fifo_size(1000); }; # # local and network sources # # + will accept udp/tcp connections on port 514 from any host # + keepalive option is for tcp only and will keep connection open # when the SIGHUP signal is seen # source local { sun-streams("/dev/log" max-connections(10) door("/etc/.syslog_doo r")); internal(); }; source network { udp(); tcp(0.0.0.0) port(514); }; # # standard destinations for local standard system messages # destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination kern { file("/var/log/kern.log"); }; destination maillog { file("/var/log/maillog"); }; --------------------------------- Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger

2 1

syslog-ng
by Michael Earls 03 Jun '04

03 Jun '04

I want to add filting based on certain domain names to create a new file for each domain name. I want to use the sql template below to create the files. # This files are the log come from the mail subsystem. # destination mail { file("/var/log/data/maillog.$YEAR.$MONTH.$DAY.$HOUR.$MIN.$SEC" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; Can someone help me out with the configuration? Thanks, michael Michael Earls Systems Analyst, Information Services Cincinnati Children's Hospital Medical Center Phone: 513-636-5882 Phone: 1-800-344-2462 Pager: 513-303-8311

1 0

RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 03 Jun '04

03 Jun '04

Balazs Scheidler wrote: > 2004-06-03, cs keltezéssel 13:12-kor > Benjamin.Zoeller(a)salt-solutions.de ezt írta: >> Hi Bazsi, >> hier the tcpdump: >> 13:13:19.293263 xxx.xxx.xxx.xx.514 > xx.xxx.x.xxx.514: udp 72 (ttl >> 28, id 41895, len 100) 13:13:19.327089 xxx.xxx.xxx.xx.514 > >> xx.xxx.x.xxx.514: [udp sum ok] udp 42 (ttl 28, id 41896, len 70) >> 13:13:21.819284 xxx.xxx.xxx.xx.514 > xx.xxx.x.xxx.514: udp 57 (ttl >> 28, id 41897, len 85) 13:13:21.945776 xxx.xxx.xxx.xx.514 > >> xx.xxx.x.xxx.514: [udp sum ok] udp 48 (ttl 28, id 41898, len 76) >> >> At the moment I am using version 1.5.26 which also works correctly. > > The problem is that I can't see the log line itself, thus I am unable > to determine why syslog-ng adds that '^@' character. > > Are you sure you were using 1.6.4 ? 1.6.0rc4 contained support for > parsing PIX timestamps and it added this additional NUL character when > PIX or PIX like stamps were received, but this was fixed in 1.6.1 Hi, here my Changelog: 2004-05-14 Balazs Scheidler <bazsi(a)bzorp.balabit> * configure.in: bumped version number to 1.6.4 here my log: May 27 10:16:25 XX.XXX.X.XXX PPP: XXX : outgoing connection established^@ May 27 10:16:25 XX.XXX.X.XXX SNMP: sent TRAP(linkUp,0) 112 bytes to XX.XXX.XXX.XXX Port 162^@ May 27 10:16:26 XX.XXX.X.XXX SNMP: sent TRAP(linkUp,0) 112 bytes to XX.XXX.XXX.XXX Port 162^@ May 27 10:19:42 XX.XXX.X.XXX PPP: XXX : outgoing connection closed, duration 197 sec, 104450 bytes received, 9237 bytes sent, 3 charging units, 0 charging amounts^@ I compiled with --enable-debug is this a problem? Our routers are from bintec. Modelname is BIANCA/BRICK.

2 1

RE: [syslog-ng]Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 03 Jun '04

03 Jun '04

Hi Bazsi, hier the tcpdump: 13:13:19.293263 xxx.xxx.xxx.xx.514 > xx.xxx.x.xxx.514: udp 72 (ttl 28, id 41895, len 100) 13:13:19.327089 xxx.xxx.xxx.xx.514 > xx.xxx.x.xxx.514: [udp sum ok] udp 42 (ttl 28, id 41896, len 70) 13:13:21.819284 xxx.xxx.xxx.xx.514 > xx.xxx.x.xxx.514: udp 57 (ttl 28, id 41897, len 85) 13:13:21.945776 xxx.xxx.xxx.xx.514 > xx.xxx.x.xxx.514: [udp sum ok] udp 48 (ttl 28, id 41898, len 76) At the moment I am using version 1.5.26 which also works correctly. Greetings Benjamin Balazs Scheidler wrote: > 2004-05-28, p keltezéssel 13:35-kor Benjamin.Zoeller(a)salt-solutions.de > ezt írta: >> Hi, >> I have a problem with syslogs from my bintec routers. >> The logs all have ^@ at the end of each line. >> This problem appears since I am using syslog-ng 1.6.4. >> Bevor I used the version 1.4.x., there were no problems. >> Please help. > > can you give me a tcpdump of the traffic (a single line is enough) ?

2 1

Concatenated syslog messages
by Vladislav Bogdanov 03 Jun '04

03 Jun '04

Hi all, It looks like syslog-ng 1.6.4 sometimes concatenates two messages into one. Here are samples from my maillog Jun 2 04:50:43 master sendmail[14615]: i521o1jN014615: <isqva(a)nsys.by>... User unknown Jun 2 04:50:46 master sendmail[14615]: i521o1jN014615: <ehmgcfrou(a)nsys.by>... User unknown Jun 2 04:50:50 master sendmail[14615]: i521o1jN014615: <tenjwdldmctu(a)nsys.by>... User unknown Jun 2 04:50:57 master sendmail[14743]: i521oiYS014743: <triunph(a)nsys.by>... User unknown<21>Jun 2 04:51:00 sendmail[14743]: i521oiYS014743: lost input cha nnel from [213.228.74.36] to MTA after rcpt Jun 2 04:51:07 master sendmail[14794]: i521p4pU014794: <triunph(a)nsys.by>... User unknown<21>Jun 2 04:51:07 sendmail[14794]: i521p4pU014794: lost input cha nnel from w425-02.ehs.emd.b19.tpu.edu.ru [195.208.183.82] (may be forged) to MTA after rcpt Any ideas? I use redhat enterprise linux 3, syslog-ng 1.6.4 and libol 0.3.13 Best, Vladislav

2 4

Re: Document
by Kaans 03 Jun '04

03 Jun '04

1 0

Site changes
by Kaans 03 Jun '04

03 Jun '04

1 0

Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 01 Jun '04

01 Jun '04

Hi, I have a problem with syslogs from my bintec routers. The logs all have ^@ at the end of each line. This problem appears since I am using syslog-ng 1.6.4. Bevor I used the version 1.4.x., there were no problems. Please help. Thx and Greetings Benjamin

2 1

Cisco Devices
by Evan Himmel 01 Jun '04

01 Jun '04

I am trying to log debugging messages from 3 Cisco 7206 VXR's. Anyone have any suggestions on how to do this? Evan

3 2

How to get IP addresses ONLY in the syslog file
by Markus Foerster 28 May '04

28 May '04

Hi, I want to get IP addresses only (not hostnames) in the files written by syslog-ng. I set the relevant options as: options { long_hostnames (off); use_dns (no); use_fqdn (no); keep_hostname (no); use_time_recvd (yes); }; It works for remote connections, however localhost still appears with its device name. Can I get it to log as "127.0.0.1" instead? Ideally I don't want to have the host name in the config file (I know I could define a different template for the local host name or something). Thanks Markus

1 0

You are sending visruses in your e-mails. Please fix it.
by Davis, Jay 28 May '04

28 May '04

The item GSEBODY_691125_3712_1085713249.txt, from syslog-ng-admin(a)lists.balabit.hu, addressed to syslog-ng(a)lists.balabit.hu, with subject line syslog-ng digest, Vol 1 #1107 - 3 msgs, has been replaced because it was infected by the W32/Bagle.aa@MM virus.

1 0

created dirs problem
by Dian HiWi 28 May '04

28 May '04

Hi all! Here is a part from my .conf file: #################################################################### source udp_mesg { udp( port(514));}; destination d_locals{ file("/var/log/test/$HOST/$FACILITY_$LEVEL/$DAY.$MONTH.$YEAR.log" owner("root") group("adm") perm (0640) dir_perm(0740) create_dirs(yes));}; log { source(udp_mesg);filter(f_messages);destination(d_locals);}; #################################################################### It logs fine, still without facilities, but the problem comes perhaps from my devices, not from syslog-ng. The strange what happend is: As I listed the directories in my log-directory, I found out, that there are about hundred hidden dierectories. I log from tho devices, and there were, as it should be, two dirs for their logs. But in the hidden directories(.00 to .99) there were logs from the devices, most from severity 'notice'. Has anyone idea, what could be the problem? cheers Dian P.S. How can I get ------------------------------------------------------------- Windows 95/NT - 32 bit extensions and a graphical shell for a 16 bit patch to an 8 bit operating system originally coded for a 4 bit microprocessor, written by a 2 bit company that can't stand 1 bit of competition.

1 0

Syslog-ng 1.6.4 adds ^@ to each line
by Benjamin.Zoeller＠salt-solutions.de 28 May '04

28 May '04

Hi, I have a problem with syslogs from my bintec routers. The logs all have ^@ at the end of each line. This problem appears since I am using syslog-ng 1.6.4. Bevor I used the version 1.4.x., there were no problems. Please help. Thx and Greetings Benjamin

1 0

Re: Hi
by Kaans 28 May '04

28 May '04

1 0

solaris 9 problem, no logging
by Oscar Knight 27 May '04

27 May '04

Hello All, Running Solaris 9. I installed syslog-ng. I kill solaris syslogd and then start syslog-ng. I get nothing. I even tried "syslog-ng -d -d" It says it started, nothing else. I use logger to test, nothing. Any suggestions? Some details: I've installed syslog-ng from sunfreeware.com packages: libol-0.3.13-sol9-sparc-local.gz syslogng-1.6.4-sol9-sparc-local.gz /etc/syslog-ng/syslog-ng.conf: # # Syslog-ng example configuration file for Solaris # # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.solaris,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Solaris 2.5.1 and below uses the STREAMS driver, above extends it # with doors. For 2.5.1 remove the door() option from the source declaration. # source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; #destination all { file("/var/log/messages"); }; destination all { file("/var/log/syslog"); }; log { source(local); destination(all); }; Thanks in advance, odk -- Oscar D. Knight knightod at appstate dot edu Voice: 828-262-6946 Appalachian State University, Boone, NC 28608 FAX: 828-262-2236

2 2

Site changes
by Kaans 27 May '04

27 May '04

1 0

Re: Msg reply
by Kaans 27 May '04

27 May '04

1 0

RE : [syslog-ng]solaris 9 problem, no logging
by Le_Duy.Tam＠hydro.qc.ca 26 May '04

26 May '04

Have to check your path to syslog-ng.conf And you must use option -f when starting syslog-ng, For ex. /etc/init.d/syslog-ng -f $PATH_TO_SYSLOG_CONF/syslog-ng.conf Good luck. -----Message d'origine----- De : Oscar Knight [mailto:knightod@appstate.edu] Envoyé : 26 mai, 2004 16:58 À : syslog-ng(a)lists.balabit.hu Objet : [syslog-ng]solaris 9 problem, no logging Hello All, Running Solaris 9. I installed syslog-ng. I kill solaris syslogd and then start syslog-ng. I get nothing. I even tried "syslog-ng -d -d" It says it started, nothing else. I use logger to test, nothing. Any suggestions? Some details: I've installed syslog-ng from sunfreeware.com packages: libol-0.3.13-sol9-sparc-local.gz syslogng-1.6.4-sol9-sparc-local.gz /etc/syslog-ng/syslog-ng.conf: # # Syslog-ng example configuration file for Solaris # # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.solaris,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Solaris 2.5.1 and below uses the STREAMS driver, above extends it # with doors. For 2.5.1 remove the door() option from the source declaration. # source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; #destination all { file("/var/log/messages"); }; destination all { file("/var/log/syslog"); }; log { source(local); destination(all); }; Thanks in advance, odk -- Oscar D. Knight knightod at appstate dot edu Voice: 828-262-6946 Appalachian State University, Boone, NC 28608 FAX: 828-262-2236 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Error compiling 1.6.4 on OpenBSD 3.5-stable
by Steven J. Surdock 25 May '04

25 May '04

$ ./configure ... $ make ... gcc -DHAVE_CONFIG_H -I. -I/home/ssurdock/syslog-ng-1.6.4/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c macros.c macros.c: In function `format_tzofs': macros.c:118: error: `tm' undeclared (first use in this function) macros.c:118: error: (Each undeclared identifier is reported only once macros.c:118: error: for each function it appears in.) *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4/src. *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4/src (line 253 of Makefile). *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4/src (line 418 of Makefile). *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4 (line 168 of Makefile). $ Which seems to stem from the GLOBAL_TIMEZONE not being detected and tm not being defined in the "else" part of the #if: format_tzofs(char *dest, size_t left) { size_t length; #if HAVE_GLOBAL_TIMEZONE length = snprintf(dest, left - 1, "%c%02ld%02ld", timezone > 0 ? '-' : '+', (timezone < 0 ? -timezone : timezone) / 3600, (timezone % 3600) / 60); #else length = strftime(dest, left -1, "%z", tm); #endif return length; } And possibly the relevant config.log ... configure:1876: checking for global timezone variable configure:1895: gcc -c -g -O2 conftest.c 1>&5 configure: In function `foo': configure:1889: error: invalid lvalue in assignment configure: failed program was: #line 1881 "configure" ... Interestingly the following seems to work: #else length = strftime(dest, left -1, "%z", localtime(time(NULL))); #endif

5 12

Changes..
by Kaans 25 May '04

25 May '04

1 0

MacOS (Darwin) problem with dynamic file naming
by Cary, Kim 21 May '04

21 May '04

Thanks to the schooling (particulars and tools) from Jeremy Mates we now have syslog-ng running. Thanks Jeremy! destination std { file("/Volumes/syslog/syslog-ng/$HOST/$YEAR/$MONTH/$DAY/ $FACILITY_$HOST_$YEAR_$MONTH_$DAY" create_dirs(yes) owner("root") group("secsyslogs") perm(0640) dir_perm(0750) ); Produces files name after the DAY only; all the directories are present and autocreated, but facilty, host, year, month are missing from the file name. As this seems to be a common example, I'm wondering if there is a problem with the system or something in the context of the conf file that I have set wrong. May I have a pointer to investigate from the list members? Regards, Kim

2 1

syslog-ng & Directory Creation
by Philip Webster 21 May '04

21 May '04

Hello, I've just changed the owner for new files created by syslog-ng to be someone other than root, but new directories are still owned by root. The relevant configuration is: destination dst_hosts { file("/path/to/logs/$HOST/$YEAR-$MONTH-$DAY" template("$FULLDATE $FULLHOST $FACILITY.$PRIORITY $MSG\n") owner(loguser) group(loguser) perm(0600) dir_perm(0700) create_dirs(yes)); I've tried placing the create_dirs() directive before the owner() directive, but with no change in the result. The owner of the top-level directory (/path/to/logs) is also loguser. All files are created with the correct owner and group. syslog-ng version is 1.6.3. Is there anything I am doing wrong? Thanks Phil

2 2

Regex on destination/template
by Gehring, Andrew x66132 20 May '04

20 May '04

Hello, I've been looking around, and can't seem to find anything related to this... Is it possible to do a regex on a template within a destination? For example: My $MSG = "this is foo bar yadda yadda" All I want passed to the destination is the foo and anything beyond it (foo bar yadda yadda). If not in the template, with another filter? Anywhere? Thanks, Andrew _ This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

1 0

RE: [syslog-ng]Problem with "kill -HUP" on syslog-ng
by Andy Kirkpatrick 20 May '04

20 May '04

Hi, I get that too, running syslog-ng 1.5.15 on debian woody with kernel 2.4.18 SMP. I did a quick check of the source some months ago and if I recall correctly, the signal handler was quite simple and didn't mask any signals so if another one arrives while its handling the first signal, the process will terminate. This frequently happened when logrotate went to work, rotating logfiles and sending a quick volley of signals to syslog-ng. I was in a rush so rather than patch and build a custom package for our systems, I wrote a postrotate script to start syslog-ng if it wasn't running already. Let me know if I was off base with my diagnosis... Andy Kirkpatrick -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Stephane OMNES Sent: Thursday, 6 May 2004 9:17 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Problem with "kill -HUP" on syslog-ng Hi, I need some help because I encountered a problem when trying to make some automatic logrotate script with syslog-ng. My "logrotate script" is the following : /var/log/*.log { sharedscripts postrotate /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true endscript } The syslog-ng daemon never restarts when you type "kill -HUP <syslog-ng.pid>" I tried also "kill -SIGUP ..." same result (the daemon is stopped but never restarts...). Did someone ever encountered this problem ? Is there any "proper" solution ? I'm currently workin under RedHat Enterprise v3.0 Thanks in advance to answer my question. Regards. Stéphane OMNES Security Engineer ************************************************************ The contents of this email and any attachments are confidential. They are intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to anyone or make copies. * email scanned for viruses, vandals and malicious content * ************************************************************ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Most efficient way of "dropping" garbage ?
by Rich Armstrong 19 May '04

19 May '04

We have a syslog-ng server, with many clients. One of these clients is suffering from DoS attacks. Since these are being logged, the syslog-ng server is also suffering ! I have created the following, temporarily :- destination d_null { file("/dev/null"); }; filter f_null { host("dummy.name.host.net"); }; log { source(net); filter(f_null); destination(d_null); flags(final); }; This solves the problem with disk usage, but there is still some significant CPU load. So, the question is, "Is there a more efficient method of ignoring/dropping messages ?" Should I be using pipe(), instead of file() ? -- Richard Armstrong

1 1