- syslog-ng - lists.balabit.hu

Moving from syslog -> syslog-ng - not logging
by Mark Robinson 16 Apr '04

16 Apr '04

I'm trying to move to syslog-ng but I can't get anything other than system messages to write to the log. Here's the syslog.conf file that woks: ---------------------------------------------------------------------------- ---- *.err;kern.notice;auth.notice /dev/console *.err;kern.debug;daemon.info;daemon.notice;mail.crit /var/adm/messages *.alert;kern.err;daemon.err operator *.alert root *.emerg * mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost) ifdef(`LOGHOST', , *.err /var/adm/messages user.err /dev/console user.err /var/adm/messages user.alert `root, operator' user.emerg * ) local7.debug /data1/syslogs/nd.log auth.debug /data1/syslogs/nd.log local3.err /data1/syslogs/nd.log *.err;*.debug;*.crit;*.warning;*.info;*.notice /data1/syslogs/mcs.log local2.notice @sudosyslog.ca.company.com ---------------------------------------------------------------------------- ---- How should a very basic syslog-ng.conf file be written?

2 1

syslog-ng + stunnel
by lbw＠free.fr 15 Apr '04

15 Apr '04

hello, i am trying to securize the transmission of logs to my server via stunnel. syslog-ng without stunnel goes on but if i run stunnel it returns an error "connecting fd 6 to inetadr 127.0.0.1, port 514" when syslog-ng tries to send logs. i try the way described at http://www.stunnel.org/examples/syslog-ng.html and i also try to change the number of the port to no avail (i don't have firewall which could deny the connection). In fact, i wonder if stunnel may run as a demon because when i make "#stunnel /etc/stunnel/stunnel.conf" as it's said, "#ps aux" don't show it. Is it normal? so, i think my error of connection comes from the fact that nothing is listening on port 514 (i have try to connect on it via telnet and obtained "connection refused"). how can i check if stunnel is well running? --- configuration of the client: #syslog-ng destination stunnel { tcp("127.0.0.1" port(514)); }; #stunnel client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 [5140] accept = 127.0.0.1:514 connect = 10.1.1.200:5140 --- any suggestions? thanks, olivier

1 0

syslog-ng + stunnel
by lbw＠free.fr 15 Apr '04

15 Apr '04

hello, i am trying to securize the transmission of logs to my server via stunnel. syslog-ng without stunnel goes on but if i run stunnel it returns an error "connecting fd 6 to inetadr 127.0.0.1, port 514" when syslog-ng tries to send logs. i try the way described at http://www.stunnel.org/examples/syslog-ng.html and i also try to change the number of the port to no avail (i don't have firewall which could deny the connection). In fact, i wonder if stunnel may run as a demon because when i make "#stunnel /etc/stunnel/stunnel.conf" as it's said, "#ps aux" don't show it. Is it normal? so, i think my error of connection comes from the fact that nothing is listening on port 514 (i have try to connect on it via telnet and obtained "connection refused"). how can i check if stunnel is well running? --- configuration of the client: #syslog-ng destination stunnel { tcp("127.0.0.1" port(514)); }; #stunnel client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 [5140] accept = 127.0.0.1:514 connect = 10.1.1.200:5140 --- any suggestions? thanks, olivier

1 0

Moving from syslog -> syslog-ng - not logging
by Mark Robinson 15 Apr '04

15 Apr '04

I'm trying to move to syslog-ng but I can't get anything other than system messages to write to the log. Here's the syslog.conf file that woks: -------------------------------------------------------------------------------- *.err;kern.notice;auth.notice /dev/console *.err;kern.debug;daemon.info;daemon.notice;mail.crit /var/adm/messages *.alert;kern.err;daemon.err operator *.alert root *.emerg * mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost) ifdef(`LOGHOST', , *.err /var/adm/messages user.err /dev/console user.err /var/adm/messages user.alert `root, operator' user.emerg * ) local7.debug /data1/syslogs/nd.log auth.debug /data1/syslogs/nd.log local3.err /data1/syslogs/nd.log *.err;*.debug;*.crit;*.warning;*.info;*.notice /data1/syslogs/mcs.log local2.notice @sudosyslog.ca.company.com -------------------------------------------------------------------------------- How should a very basic syslog-ng.conf file be written? _________________________________________________________________ STOP MORE SPAM with the MSN Premium and get 2 months FREE* http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht…

1 0

Config file parsing inconsistencies
by John Kristoff 15 Apr '04

15 Apr '04

I seem to have discovered some discrepancies in the parsing of config file statements. I'm using syslog-ng 1.6.2. For example, the following: destination test { udp("10.0.0.1" port(514) localport(0)); }; results in a segfault upon startup, whereas the following: destination test { udp("10.0.0.1" port(514) localport("0")); }; works fine. I haven't gone searching through the code yet, but it seems that parsing of options is inconsisent (note 514 is not in quotes). A brief grep of some source files seems to suggest that there might be a inconsistencies on when to parse the option as a number versus a string. John

2 1

syslog-ng-announce mailing list ?
by José Pedro Oliveira 15 Apr '04

15 Apr '04

Hi, In the past message https://lists.balabit.hu/pipermail/syslog-ng/2004-January/005701.html there is a reference to the creation of a syslog-ng announcement list. Does it exists? At least it isn't mentioned in the following web pages: http://www.balabit.com/products/syslog-ng/ https://lists.balabit.hu/mailman/listinfo/ Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

8 8

$MSG contains $PROGRAM
by Loic Minier 14 Apr '04

14 Apr '04

Hey, When expanding the template macro $MSG, it will result in "program: message" when a program part is present. I think this shouldn't be. It is easy to fix with attached patch (remove a couple of lines at the end of parse_msg in log.c). Regards, -- Loïc Minier <lool(a)dooz.org>

1 1

syslog-ng email alerts
by Agnelo dsouza 14 Apr '04

14 Apr '04

Hi, I've configured syslog-ng for receiving alerts from remote system( /var/log/messages). I've configured 2 destinations 1. A file snort.log , i'm getting alerts in this file 2. email alerts, i'm unable to receive email alerts I've tested the script alert_mail.sh externally and it works.(i'm able to get mails, so sendmail is working) can someone help in solving this problem. Regards, Agnelo syslog-ng.conf ================== source sensors { internal(); tcp(ip(10.0.41.175) port(514) max-connections(7)); unix-stream("/dev/log"); }; destination localhost { file("/var/log/snort.log"); }; destination email_alert_script {program ("/usr/local/bin/alert_mail.sh"); }; log { source(sensors); destination(localhost); }; log {source(sensors); destination(email_alert_script); }; ========================== alert_mail.sh ==================== #!/bin/sh while read line; do echo $line |mail -s "Snort Alert" idsalert(a)xxxx.com done --------------------------------- Do you Yahoo!? Yahoo! Small Business $15K Web Design Giveaway - Enter today

2 1

Scaling for a central loghost ?
by Michael Arndt 13 Apr '04

13 Apr '04

Hello *, Question: does syslog-ng scale well on a central syslog_Server collecting messages from about 200 unix hosts ? I have read old threads about this issue and found infos about a fixed bug and mention about one list member planning measurements with respect to scaling / message dropping. I am still a bit insecure: Can the receive buffer in syslog-ng made large enough to handle incomming syslog messages from about 200 hosts without dropping messages ? Can i take measures on client side (syslog-ng sender to avoid that sent informations are dropped either client side or server side) TIA Micha

3 2

Syslog-ng snapshots
by José Pedro Oliveira 13 Apr '04

13 Apr '04

Hi, The syslog-ng snapshots aren't being created any more. Is it possible to start generating them again? Snapshots location: http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot/ Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

2 1

hostname is replaced by the relay server's name
by Rich Armstrong 06 Apr '04

06 Apr '04

I have two logging servers. One is logging data from lots of clients, using syslog-ng 1.6.0rc3 - lets call that Host1. I want to forward the data via tcp/udp to the other host as well - lets call that Host2 using 1.6.2. At the moment, the $HOST field in data logged on Host2 contains Host1, instead of Client1, or Client2, etc. On both Host1 and Host2, I have set :- options { use_fqdn(yes); keep_hostname(yes); }; but the $HOST variable (in the destination variable, and in the message) on Host2 is still being replaced, so I line I know is from Client1, appears to come from Host1. Host1 transfers data to Host2 using :- destination d_netmon { udp("195.215.3.7"); }; log { source(net); destination(d_netmon); }; Am I using the wrong version of syslog-ng ? It seems that many on the list have had this problem before, and used keep_hostname(yes) to fix it. Is this a bug in the latest version ? -- Richard Armstrong

1 0

RE: [syslog-ng]remote log server
by Schernau, Ed 06 Apr '04

06 Apr '04

http://www.campin.net/syslog-ng/faq.html -----Original Message----- From: Rick S. [mailto:rsheppar@midnight.ecet.vtc.edu] Sent: Thursday, April 01, 2004 10:58 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]remote log server What do I need to put in the .conf file to have the logs sent over the net work to another machine? Rick S. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ----------------------------------------- Use of email is inherently insecure. Confidential information, including account information, and personally identifiable information, should not be transmitted via email, or email attachment. In no event shall Citizens or any of its affiliates accept any responsibility for the loss, use or misuse of any information including confidential information, which is sent to Citizens or its affiliates via email, or email attachment. Citizens does not guarantee the accuracy of any email or email attachment, that an email will be received by Citizens or that Citizens will respond to any email. This email message is confidential and/or privileged. It is to be used by the intended recipient only. Use of the information contained in this email by anyone other than the intended recipient is strictly prohibited. If you have received this message in error, please notify the sender immediately and promptly destroy any record of this email.

2 1

Re: [syslog-ng]maximum config file size
by Scooter T 05 Apr '04

05 Apr '04

There are 272 log statements in the "large" config file, 243 in the pared down version. What's the magic number? 256? 2004-03-31, sze keltezéssel 21:13-kor Scooter T ezt írta: > Has anyone encountered any problems with a fairly large syslog-ng.conf > file? I am seeing substantial UDP packet loss with a file that is > roughly 1300 lines (about 70k). If I pare it down to around 1200 > lines (about 60k), all is well. Is this a known limitation? the log routing might be the culprit here, do you have many log statements in your file? can you reduce those? -- Bazsi --------------------------------- Do you Yahoo!? Yahoo! Small Business $15K Web Design Giveaway - Enter today

2 1

Could offline-mode be done with TCP option?
by Jason Haar 05 Apr '04

05 Apr '04

Hi there We're running a multi-country network of syslog-ng with centralized logging (via TCP). However, due to the possibility of network failure, I am not willing to rely on the central server for triggering alerts - so we do that on the actual leaf syslog servers instead. However, it would be much better if we could actually centralize our alerting system (due to what we are alerting about). So I was wondering if syslog-ng's TCP transport layer could be turned into something like MySQL's master-slave mode: write to a cache file first, then write to remote server, and if that succeeds, remove from cache file. That way if a network outage occurred, the cache file would just get larger and larger, then when the network came up again, it would flow through without any records being lost. [I know the fifo option allows this in RAM - I guess all that I'm wondering about is could that be done on disk instead?. A cache file would survive restarts/etc.] -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 1

Re: [syslog-ng] SIGHUP
by Mitja Marondini 05 Apr '04

05 Apr '04

Balasz, thank you for your help. Now it works! Mitja 2004-04-02, p keltezéssel 17:33-kor Balazs Scheidler ezt írta: > 2004-04-02, p keltezéssel 13:30-kor Mitja Marondini ezt írta: > can you paste your configuration file? you seem to have two sources with > the same name, probably you have two unix domain socket sources > (unix-stream and unix-dgram) I mean you seem to have two unix-domain sources referring to the same socket. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

SIGHUP
by Mitja Marondini 02 Apr '04

02 Apr '04

Hi, syslog-ng aborts after receiving SIGHUP. <---- SIGHUP received, restarting syslog-ng Marking fd 3 for closing. Marking fd 4 for closing. Marking fd 5 for closing. Marking fd 6 for closing. syslog-ng: cfgfile.c:166: add_persistent_info: Assertion `!p' failed. Aborted ----> I have Red Hat 7.3 with libol-0.3.13-1 and syslog-ng-1.6.2-1. Thank you for help in advance! Mitja

2 2

fallback with override?
by Mike Nerone 01 Apr '04

01 Apr '04

I want to do something very simple that should be easily configurable, but I can't figure out how to do it. Here's a greatly simplified example that illustrates my need: I want to log specific filters to specific destinations, with a fallback to catch anything non-specific, but ALSO to to log *everything* to the console (I would not do thise in practice, of course, but it should be doable). My first obvious thought was to use this (again, this is very simplified - I don't want anyone to think this would be my real syslog config - that would be embarrassing :D): log { source(src); filter(cron); destination(cron); }; # Catch cron stuff log { source(src); destination(messages); flags(fallback); }; # Everything else log { source(src); destination(console); }; # But no matter what, *everything* to console I assumed that the "fallback" would log anything not caught by a *previous* non-fallback log statement (the fact that the 'final' flag exists suggested to me that ordering was observed), but that does not appear to be the case. Everything does indeed get logged to the console with that config, but the fallback log gets *nothing* (ostensibly because all messages are caught by the console log statement). Can anyone think of a way to do this (I'm probably missing the obvious here)? Or perhaps the fallback algorithm could/should be modified to observe ordering (i.e. ignore log statements that appear after the fallback log statement in the config)? Mike Nerone /* The only secure computer is one that is unplugged from the network -- and the wall. */ <Activism>Did you know that our brilliant legislators recently (and quietly) legalized spam? The law now says that anyone who wants to *can* spam with no fear of punishment. They even named the law the "CAN SPAM" Act. Read about it at http://www.cauce.org/news/index.shtml, then talk about it with your congressman.</Activism>

1 0

Installation Help.
by Chaitanya 01 Apr '04

01 Apr '04

Hi, I was trying to install Syslogd on Redhat Linux 9, for which i am not sure of its compatibilty. I installed the following packages successfully. a. Libol, b. Stunnel. c. Logsentry. But when i couldnot able to install syslog-ng. Is syslog-ng compatible with Red hat linux. Does anybody know the development website for syslog-ng. Thanks a lot. With Regards! Chaitanya.

2 1

remote log server
by Rick S. 01 Apr '04

01 Apr '04

What do I need to put in the .conf file to have the logs sent over the net work to another machine? Rick S.

1 0

maximum config file size
by Scooter T 01 Apr '04

01 Apr '04

Has anyone encountered any problems with a fairly large syslog-ng.conf file? I am seeing substantial UDP packet loss with a file that is roughly 1300 lines (about 70k). If I pare it down to around 1200 lines (about 60k), all is well. Is this a known limitation? --------------------------------- Do you Yahoo!? Yahoo! Finance Tax Center - File online. File on time.

2 1

syslog-ng and net devices.
by cdowns 31 Mar '04

31 Mar '04

Morning, I have all cisco devices coming in on priority local7, and for some reason im not getting them all. I grep'd though all logs and they truly dont exist. Does anyone see anything wrong with my config ? TIA. ~!>D # # Syslog-ng example configuration for for Debian GNU/Linux # Too bad this wasnt debian ;( # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # options { long_hostnames(off); sync(1); }; # added /proc/kmsg for replace of klogd - syslogd source src { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log"); }; source net { udp(); }; ## dest destination authlog { file("/log/auth.log"); }; destination syslog { file("/log/syslog"); }; destination cron { file("/log/cron.log"); }; destination daemon { file("/log/daemon.log"); }; destination kern { file("/log/kern.log"); }; destination lpr { file("/log/lpr.log"); }; destination user { file("/log/user.log"); }; destination uucp { file("/log/uucp.log"); }; destination mail { file("/log/mail.log"); }; destination mailinfo { file("/log/mail.info"); }; destination mailwarn { file("/log/mail.warn"); }; destination mailerr { file("/log/mail.err"); }; destination newscrit { file("/log/news/news.crit"); }; destination newserr { file("/log/news/news.err"); }; destination newsnotice { file("/log/news/news.notice"); }; destination debug { file("/log/debug"); }; destination messages { file("/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; #destination loghost { udp("loghost" port(999)); }; ## Custon Log Destiniations destination pix { file("/log/Net/pix.log"); }; destination iss { file("/log/Net/iss.log"); }; destination snmp { file("/log/Net/snmp.log"); }; ## Incoming routers and switches with perms destination local7 { file("/log/j1comm1/logs/local7.info" owner(j1comm1) group(j1comm1) perm(0644) dir_perm(0755) create_dirs(yes) ); }; destination std { file("/log/Net/$FACILITY.log" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; destination xconsole { pipe("/dev/xconsole"); }; ## Filters for local machine filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; ## UDP Hosts filter f_net_auth { facility(auth); }; filter f_net_authpriv { facility(auth, authpriv); }; filter f_net_syslog { not facility(authpriv, mail); }; filter f_net_cron { facility(cron); }; filter f_net_daemon { facility(daemon); }; filter f_net_kern { facility(kern); }; filter f_net_lpr { facility(lpr); }; filter f_net_mail { facility(mail); }; filter f_net_user { facility(user); }; filter f_net_uucp { facility(cron); }; filter f_net_news { facility(news); }; filter f_net_debug { not facility(auth, authpriv, news, mail); }; filter f_net_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_net_emergency { level(emerg); }; filter f_net_info { level(info); }; filter f_net_notice { level(notice); }; filter f_net_warn { level(warn); }; filter f_net_crit { level(crit); }; filter f_net_err { level(err); }; ### get all cisco local7.info messages ## filter f_local7 { facility(local7) and level(debug..emerg); }; filter f_pixm { match("PIX"); }; filter f_misclocal7 { filter (f_local7) and not filter(f_pixm); }; filter f_iss { match("issDaemon"); }; filter f_snmp { match("ucd-snmp"); }; ## Local logs log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); destination(console_all); }; ## Custom Logs log { source(net); filter(f_pixm); destination(pix); }; log { source(net); filter(f_misclocal7); destination(local7); }; log { source(net); filter(f_iss); destination(iss); }; log { source(net); filter(f_snmp); destination(snmp); }; ## CatchAll Net log log { source(net); filter(f_net_authpriv); destination(std); }; log { source(net); filter(f_net_syslog); destination(std); }; log { source(net); filter(f_net_cron); destination(std); }; log { source(net); filter(f_net_daemon); destination(std); }; log { source(net); filter(f_net_kern); destination(std); }; log { source(net); filter(f_net_lpr); destination(std); }; log { source(net); filter(f_net_mail); destination(std); }; log { source(net); filter(f_net_user); destination(std); }; log { source(net); filter(f_net_uucp); destination(std); }; log { source(net); filter(f_net_mail); filter(f_net_info); destination(std); }; log { source(net); filter(f_net_mail); filter(f_net_warn); destination(std); }; log { source(net); filter(f_net_mail); filter(f_net_err); destination(std); }; log { source(net); filter(f_net_news); filter(f_net_crit); destination(std); }; log { source(net); filter(f_net_news); filter(f_net_err); destination(std); }; log { source(net); filter(f_net_news); filter(f_net_notice); destination(std); }; log { source(net); filter(f_net_debug); destination(std); }; log { source(net); filter(f_net_messages); destination(std); }; log { source(net); filter(f_net_emergency); destination(std); }; log { source(net); destination(console_all); }; ## EOF

1 0

Filtering by time or date
by Wesolowski Michal 30 Mar '04

30 Mar '04

Hi I'm testing syslog-ng for centralized log server on Solaris 8. It acts very well and I was even able to create real-time notification mechanizm based on syslog-ng and some scripts (without any additional log analizer). The problem I've lately met is that some computers sending their messages to central system frequently perform additional maintanence tasks during nights or off days. For example they scan disks and other i/o devices and in effect produce many warnings. That messages almost always countain information which are suspicous within work hours and they cannot be filtered permanently. My question is: Is it possible or planed for future releases to include time conditions in filter functions?. The "match" statement doesn't seem to check date or time and using program as destination is quite hard due to it "destination" not filter role in log paths. In my opinion very interesting option would be including external program as filter (ie. returning filter decision as std output or exit code). Greetings Michal Wesolowski

2 1

template syntax
by John Minson 30 Mar '04

30 Mar '04

The 'template' syntax for a 'file' destination has defeated me . destination d_db { file("/var/log/ng/db.inserts" template("$MSG\n")); }; every variation of the above line gives 'parsing error' syslog-ng 1.4.17 many thanks

2 1

Not logging to the correct file
by allanwind＠lifeintegrity.com 28 Mar '04

28 Mar '04

I have been running with: file("/var/log/syslog-ng/$YEAR-$MONTH-$DAY/$HOST.log" dir_owner("root") dir_group("adm") dir_perm(0 750) owner("root") group("adm") perm(0640) create_dirs(yes)); (or $PROGRAM instead of $HOST), but still get some log events in: /var/log/syslog-ng/$YEAR-$MONTH-$DAY/$FACILITY.log?! daemon.log: Mar 28 11:48:42 log_source@pawan dhcpd: Wrote 8 leases to leases file mail.log: Mar 28 00:04:14 log_source@pawan amavis[6299]: (06299-03) Passed, <bounce-debian-devel=allanwind=lifeintegrity. com(a)lists.debian.org> -> <allanwind(a)lifeintegrity.com>, Message-ID: <87r7vdsgum.fsf(a)mrvn.homelinux.org>, Hits: -4.9 syslog.log: Mar 28 00:01:05 internal_source@pawan syslog-ng[341]: STATS: dropped 0 My syslog-ng.conf is pretty complicated as I use it to filter my logs real-time, but it looks something like this: # sources # source internal_source { internal(); }; source log_source { unix-stream("/dev/log"); }; source kmsg_source { file("/proc/kmsg" log_prefix("kernel: ")); }; destination syslog_destination { file("/var/log/syslog-ng/$YEAR-$MONTH-$DAY/$HOST.log" dir_owner("root") dir_group("adm") dir_perm(0750) owner("root") group("adm") perm(0640) create_dirs(yes)); }; # log paths # log { source(internal_source); source(log_source); source(kmsg_source); destination(syslog_destination); }; /Allan -- Allan Wind P.O. Box 2022 Woburn, MA 01888-0022 USA

1 0

regex question
by cdowns 28 Mar '04

28 Mar '04

When regexing in syslog-ng, does this stament below do: get all local7 ( all levels ) and _/ALSO/_ match %ETHC-5 / %CLEAR-5 ? Its not just matching those is it ? Im kinda confused on this syntax. filter f_local7 { facility(local7) and level(debug..emerg) and match("%ETHC-5") and match("%CLEAR-5"); }; I just want to make shure that is what this is doing... . Thanks all. ~!>D

2 2