- syslog-ng - lists.balabit.hu

Re:[syslog-ng]regex question
by Amodiovalerio Verde 28 Mar '04

28 Mar '04

Setting a level(debug..emerg) is unuseful, cause you want all level. If you want to get all message from local7 and that match %ETH-5 or %CLEAR-5 you have to write it like this : filter f_local7 { facility(local7) and ( match("%ETHC-5") or match("%CLEAR-5") ) ; } ; Hope it will help Amodiovalerio [Hypo] Verde ---------- Initial Header ----------- From : syslog-ng-admin(a)lists.balabit.hu To : syslog-ng(a)lists.balabit.hu Cc : Date : Fri, 26 Mar 2004 11:02:14 -0600 Subject : [syslog-ng]regex question > When regexing in syslog-ng, does this stament below do: > > get all local7 ( all levels ) and _/ALSO/_ match %ETHC-5 / %CLEAR-5 ? > Its not just matching those is it ? Im kinda confused on this syntax. > > filter f_local7 { > facility(local7) and level(debug..emerg) and > match("%ETHC-5") and match("%CLEAR-5"); > }; > > I just want to make shure that is what this is doing... . > > Thanks all. > > ~!>D > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

1 0

Re:[syslog-ng]Process ID
by Amodiovalerio Verde 28 Mar '04

28 Mar '04

Actually RFC3164 doesn't consider the PID as a special field of the syslog message. The TAG part that is the part that actually contain the program name, is defined as a string of alphanumeric chars that cannot exceed 32 characters. Quoting RFC : "The TAG is a string of ABNF alphanumeric characters that MUST NOT exceed 32 characters. Any non-alphanumeric character will terminate the TAG field and will be assumed to be the starting character of the CONTENT field." So a message like "Dec 12 11:11:11 hostname programname[1234]: message", will have the TAG field set to "programname" and the CONTENT field set to "[1234]: message" If you want to retrieve the PID you have to parse on your own the content part. It's not syslog-ng configuration matter, if there is a PID displayed or not in the message, and again, PID is not part of the RFC3164. Hope it will help. Amodiovalerio [Hypo] Verde ---------- Initial Header ----------- From : syslog-ng-admin(a)lists.balabit.hu To : syslog-ng(a)lists.balabit.hu Cc : Date : Sun, 28 Mar 2004 09:42:38 +0200 Subject : [syslog-ng]Process ID > Hello, > > I am a new-comer to syslog-ng, and there one configuration issue that I was unable to > resolve, and did not see any reference to it in the internet: > How can I configure syslog-ng to display the PID of the program (that submits the syslog command)? > > Thanks, > Menny > >

1 0

Process ID
by Menny Hamburger 28 Mar '04

28 Mar '04

Hello, I am a new-comer to syslog-ng, and there one configuration issue that I was unable to resolve, and did not see any reference to it in the internet: How can I configure syslog-ng to display the PID of the program (that submits the syslog command)? Thanks, Menny

1 0

Loads of STATS: dropped > 0 messages
by MH - Entwicklung 26 Mar '04

26 Mar '04

Hello out there, I get loads of STATS: dropped: >0 and don't know why. I've got syslog-ng running on a central log host. Each host also has syslog-ng running. syslog-ng ist configured to use tcp instead of udp. In syslog-ng.conf I have right at the moment: options { long_hostnames(off); sync(10); log_fifo_size(1000); Playing around with sync and log_fifo_size doesn't change anything. syslog-ng is 1.6.0rc4 from Debian Testing. Has anybody any idea about this? Best Regards Manfred extract from syslog: Mar 9 10:02:10 www syslog-ng[302]: STATS: dropped 3 Mar 9 10:02:18 dns syslog-ng[31655]: STATS: dropped 7 Mar 9 10:02:26 bugzilla syslog-ng[31212]: STATS: dropped 3 Mar 9 10:02:27 proxy syslog-ng[32443]: STATS: dropped 3 Mar 9 10:02:38 mail syslog-ng[32293]: STATS: dropped 18 Mar 9 10:06:53 tux syslog-ng[1020]: STATS: dropped 178 Mar 9 10:05:07 brutus syslog-ng[23681]: STATS: dropped 61 Mar 9 10:12:18 dns syslog-ng[31655]: STATS: dropped 27 Mar 9 10:12:28 proxy syslog-ng[32443]: STATS: dropped 27 Mar 9 10:12:38 mail syslog-ng[32293]: STATS: dropped 84 Mar 9 10:16:54 tux syslog-ng[1020]: STATS: dropped 219 Mar 9 10:15:07 brutus syslog-ng[23681]: STATS: dropped 112 Mar 9 10:22:28 bugzilla syslog-ng[31212]: STATS: dropped 28 Mar 9 10:22:38 mail syslog-ng[32293]: STATS: dropped 60 Mar 9 10:26:54 tux syslog-ng[1020]: STATS: dropped 121 Mar 9 10:25:07 brutus syslog-ng[23681]: STATS: dropped 97 Mar 9 10:32:12 www syslog-ng[302]: STATS: dropped 27 Mar 9 10:32:38 mail syslog-ng[32293]: STATS: dropped 29 Mar 9 10:36:54 tux syslog-ng[1020]: STATS: dropped 248 Mar 9 10:35:07 brutus syslog-ng[23681]: STATS: dropped 80 Mar 9 10:42:38 mail syslog-ng[32293]: STATS: dropped 74 Mar 9 10:46:54 tux syslog-ng[1020]: STATS: dropped 92 Mar 9 10:45:08 brutus syslog-ng[23681]: STATS: dropped 15 Mar 9 10:52:38 mail syslog-ng[32293]: STATS: dropped 85 Mar 9 10:56:54 tux syslog-ng[1020]: STATS: dropped 201 Mar 9 10:55:09 brutus syslog-ng[23681]: STATS: dropped 135 -- manfred heubach edv und neue medien Hindenburgstr. 47 D-73728 Esslingen Tel. +49 711 9315824 Fax +49 711 9315825 www.heubach-edv.de Informationstechnologie und Telekommunikation fÃ¼r Unternehmen

5 7

RE: [syslog-ng]Syslog-ng Installation Problem
by Hamilton, Andrew 26 Mar '04

26 Mar '04

Well you can do that but it still won't work as you are using 0.3.9. The configure clearly is looking for something equal to or better than 0.3.13. Drew -----Original Message----- From: Rule, Ted [mailto:Ted_Rule@flextech.co.uk] Sent: Friday, March 26, 2004 6:13 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Syslog-ng Installation Problem I think you'll find you need: ./configure --with-libol=/usr/local/bin for the syslog-ng ./configure, coz that's where libol make install puts /usr/local/bin/libol-config by default. Ted **************************************************************************** ******************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. **************************************************************************** ******************** _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Syslog-ng Installation Problem
by Rule, Ted 26 Mar '04

26 Mar '04

I think you'll find you need: ./configure --with-libol=/usr/local/bin for the syslog-ng ./configure, coz that's where libol make install puts /usr/local/bin/libol-config by default. Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Syslog-ng Installation Problem
by Hagans, John 25 Mar '04

25 Mar '04

To whom it may concern: I am having a problem installing syslog-ng and need some help. I have included installation report files from libol-0.3.9 and syslog-ng-1.6.2. I have attempted the install with various versions of syslog-ng and libol, but I have had no success. I have read the README and INSTALL files for syslog-ng, but they have not provided the assistance I need. Also, I have installed bison and flex. Those two programs installed with no errors. Are there some other dependencies that are not documented? Thanks John T. Hagans North Seattle Community College IT Services Network Supervisor Libol Installation Report ./configure creating cache ./config.cache checking for a BSD compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking whether build environment is sane... yes checking for ranlib... ranlib checking for gcc... gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... yes checking whether gcc accepts -g... yes checking whether make sets ${MAKE}... (cached) yes checking for scsh... no checking for Cygwin environment... no checking for mingw32 environment... no checking how to run the C preprocessor... gcc -E checking host system type... i586-pc-linux-gnu checking build system type... i586-pc-linux-gnu checking for ld used by GCC... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for /usr/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/bin/nm -B checking whether ln -s works... yes checking how to recognise dependant libraries... pass_all checking for object suffix... o checking for executable suffix... no checking command to parse /usr/bin/nm -B output... ok checking for dlfcn.h... yes checking for ranlib... (cached) ranlib checking for strip... strip checking for objdir... .libs checking for gcc option to produce PIC... -fPIC checking if gcc PIC flag -fPIC works... yes checking if gcc static flag -static works... yes checking if gcc supports -c -o file.o... yes checking if gcc supports -c -o file.lo... yes checking if gcc supports -fno-rtti -fno-exceptions... yes checking whether the linker (/usr/bin/ld) supports shared libraries... yes checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking dynamic linker characteristics... GNU/Linux ld.so checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes checking whether -lc should be explicitly linked in... no creating libtool checking for ANSI C header files... yes checking for fcntl.h... yes checking for sys/time.h... yes checking for syslog.h... yes checking for unistd.h... yes checking for poll.h... yes checking for sys/poll.h... yes checking for sys/socket.h... yes checking for working const... yes checking for size_t... yes checking whether time.h and sys/time.h may both be included... yes checking size of short... 2 checking size of int... 4 checking size of long... 4 checking for socklen_t... yes checking for __attribute__... yes checking for working alloca.h... yes checking for alloca... yes checking for inet_addr in -lxnet... no checking for gethostbyname in -lnsl... yes checking for setsockopt in -lsocket... no checking for select... yes checking for strerror... yes checking for syslog... yes checking for poll... yes updating cache ./config.cache creating ./config.status creating libol.spec creating Makefile creating src/Makefile creating utils/Makefile creating libol-config creating src/olconfig.h Libol Make make Making all in utils make[1]: Entering directory `/apps/syslog-ng/depend/libol/libol-0.3.9/utils' sed -e "s,_SCSH_,," make_class.in >make_class chmod +x make_class make[1]: Leaving directory `/apps/syslog-ng/depend/libol/libol-0.3.9/utils' Making all in src make[1]: Entering directory `/apps/syslog-ng/depend/libol/libol-0.3.9/src' /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c format.c mkdir .libs gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c format.c -fPIC -DPIC -o .libs/format.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c format.c -o format.o >/dev/null 2>&1 mv -f .libs/format.lo format.lo /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c io.c rm -f .libs/io.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c io.c -fPIC -DPIC -o .libs/io.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c io.c -o io.o >/dev/null 2>&1 mv -f .libs/io.lo io.lo /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c werror.c rm -f .libs/werror.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c werror.c -fPIC -DPIC -o .libs/werror.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c werror.c -o werror.o >/dev/null 2>&1 mv -f .libs/werror.lo werror.lo /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c queue.c rm -f .libs/queue.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c queue.c -fPIC -DPIC -o .libs/queue.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c queue.c -o queue.o >/dev/null 2>&1 mv -f .libs/queue.lo queue.lo /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c abstract_io.c rm -f .libs/abstract_io.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c abstract_io.c -fPIC -DPIC -o .libs/abstract_io.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c abstract_io.c -o abstract_io.o >/dev/null 2>&1 mv -f .libs/abstract_io.lo abstract_io.lo /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c gc.c rm -f .libs/gc.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c gc.c -fPIC -DPIC -o .libs/gc.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c gc.c -o gc.o >/dev/null 2>&1 mv -f .libs/gc.lo gc.lo /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c list.c rm -f .libs/list.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c list.c -fPIC -DPIC -o .libs/list.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c list.c -o list.o >/dev/null 2>&1 mv -f .libs/list.lo list.lo /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c read_line.c rm -f .libs/read_line.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c read_line.c -fPIC -DPIC -o .libs/read_line.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c read_line.c -o read_line.o >/dev/null 2>&1 mv -f .libs/read_line.lo read_line.lo /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c xalloc.c rm -f .libs/xalloc.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c xalloc.c -fPIC -DPIC -o .libs/xalloc.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c xalloc.c -o xalloc.o >/dev/null 2>&1 mv -f .libs/xalloc.lo xalloc.lo /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c alist.c rm -f .libs/alist.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c alist.c -fPIC -DPIC -o .libs/alist.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c alist.c -o alist.o >/dev/null 2>&1 mv -f .libs/alist.lo alist.lo /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c stream_buffer.c rm -f .libs/stream_buffer.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c stream_buffer.c -fPIC -DPIC -o .libs/stream_buffer.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c stream_buffer.c -o stream_buffer.o >/dev/null 2>&1 mv -f .libs/stream_buffer.lo stream_buffer.lo /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c pkt_buffer.c rm -f .libs/pkt_buffer.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c pkt_buffer.c -fPIC -DPIC -o .libs/pkt_buffer.lo pkt_buffer.c: In function `do_flush_stream': pkt_buffer.c:108: warning: implicit declaration of function `memcpy' gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c pkt_buffer.c -o pkt_buffer.o >/dev/null 2>&1 mv -f .libs/pkt_buffer.lo pkt_buffer.lo /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c resource.c rm -f .libs/resource.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c resource.c -fPIC -DPIC -o .libs/resource.lo gcc -DHAVE_CONFIG_H -I. -I/apps/syslog-ng/depend/libol/libol-0.3.9/src -I. -D_GNU_SOURCE -Wall -O2 -c resource.c -o resource.o >/dev/null 2>&1 mv -f .libs/resource.lo resource.lo /bin/sh ../libtool --mode=link gcc -Wall -O2 -o libol.la -rpath /usr/local/lib format.lo io.lo werror.lo queue.lo abstract_io.lo gc.lo list.lo read_line.lo xalloc.lo alist.lo stream_buffer.lo pkt_buffer.lo resource.lo -lnsl rm -fr .libs/libol.la .libs/libol.* .libs/libol.* gcc -shared format.lo io.lo werror.lo queue.lo abstract_io.lo gc.lo list.lo read_line.lo xalloc.lo alist.lo stream_buffer.lo pkt_buffer.lo resource.lo -lnsl -Wl,-soname -Wl,libol.so.0 -o .libs/libol.so.0.0.0 (cd .libs && rm -f libol.so.0 && ln -s libol.so.0.0.0 libol.so.0) (cd .libs && rm -f libol.so && ln -s libol.so.0.0.0 libol.so) ar cru .libs/libol.a format.o io.o werror.o queue.o abstract_io.o gc.o list.o read_line.o xalloc.o alist.o stream_buffer.o pkt_buffer.o resource.o ranlib .libs/libol.a creating libol.la (cd .libs && rm -f libol.la && ln -s ../libol.la libol.la) make[1]: Leaving directory `/apps/syslog-ng/depend/libol/libol-0.3.9/src' make[1]: Entering directory `/apps/syslog-ng/depend/libol/libol-0.3.9' make[1]: Nothing to be done for `all-am'. make[1]: Leaving directory `/apps/syslog-ng/depend/libol/libol-0.3.9' Libol Make Install make install Making install in utils make[1]: Entering directory `/apps/syslog-ng/depend/libol/libol-0.3.9/utils' make[2]: Entering directory `/apps/syslog-ng/depend/libol/libol-0.3.9/utils' /bin/sh /apps/syslog-ng/depend/libol/libol-0.3.9/mkinstalldirs /usr/local/bin /usr/bin/install -c make_class /usr/local/bin/make_class make[2]: Nothing to be done for `install-data-am'. make[2]: Leaving directory `/apps/syslog-ng/depend/libol/libol-0.3.9/utils' make[1]: Leaving directory `/apps/syslog-ng/depend/libol/libol-0.3.9/utils' Making install in src make[1]: Entering directory `/apps/syslog-ng/depend/libol/libol-0.3.9/src' make[2]: Entering directory `/apps/syslog-ng/depend/libol/libol-0.3.9/src' /bin/sh /apps/syslog-ng/depend/libol/libol-0.3.9/mkinstalldirs /usr/local/lib /bin/sh ../libtool --mode=install /usr/bin/install -c libol.la /usr/local/lib/libol.la /usr/bin/install -c .libs/libol.so.0.0.0 /usr/local/lib/libol.so.0.0.0 (cd /usr/local/lib && rm -f libol.so.0 && ln -s libol.so.0.0.0 libol.so.0) (cd /usr/local/lib && rm -f libol.so && ln -s libol.so.0.0.0 libol.so) /usr/bin/install -c .libs/libol.lai /usr/local/lib/libol.la /usr/bin/install -c .libs/libol.a /usr/local/lib/libol.a ranlib /usr/local/lib/libol.a chmod 644 /usr/local/lib/libol.a PATH="$PATH:/sbin" ldconfig -n /usr/local/lib ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `LD_LIBRARY_PATH' environment variable during execution - add LIBDIR to the `LD_RUN_PATH' environment variable during linking - use the `-Wl,--rpath -Wl,LIBDIR' linker flag - have your system administrator add LIBDIR to `/etc/ld.so.conf' See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- /bin/sh /apps/syslog-ng/depend/libol/libol-0.3.9/mkinstalldirs /usr/local/include/libol /usr/bin/install -c -m 644 abstract_io.h /usr/local/include/libol/abstract_io.h /usr/bin/install -c -m 644 alist.h /usr/local/include/libol/alist.h /usr/bin/install -c -m 644 format.h /usr/local/include/libol/format.h /usr/bin/install -c -m 644 gc.h /usr/local/include/libol/gc.h /usr/bin/install -c -m 644 io.h /usr/local/include/libol/io.h /usr/bin/install -c -m 644 jpoll.h /usr/local/include/libol/jpoll.h /usr/bin/install -c -m 644 list.h /usr/local/include/libol/list.h /usr/bin/install -c -m 644 objbase.h /usr/local/include/libol/objbase.h /usr/bin/install -c -m 644 objects.h /usr/local/include/libol/objects.h /usr/bin/install -c -m 644 objtypes.h /usr/local/include/libol/objtypes.h /usr/bin/install -c -m 644 pkt_buffer.h /usr/local/include/libol/pkt_buffer.h /usr/bin/install -c -m 644 queue.h /usr/local/include/libol/queue.h /usr/bin/install -c -m 644 read_line.h /usr/local/include/libol/read_line.h /usr/bin/install -c -m 644 resource.h /usr/local/include/libol/resource.h /usr/bin/install -c -m 644 stream_buffer.h /usr/local/include/libol/stream_buffer.h /usr/bin/install -c -m 644 werror.h /usr/local/include/libol/werror.h /usr/bin/install -c -m 644 xalloc.h /usr/local/include/libol/xalloc.h /usr/bin/install -c -m 644 command.h /usr/local/include/libol/command.h /usr/bin/install -c -m 644 io_commands.h /usr/local/include/libol/io_commands.h /usr/bin/install -c -m 644 abstract_io.h.x /usr/local/include/libol/abstract_io.h.x /usr/bin/install -c -m 644 alist.h.x /usr/local/include/libol/alist.h.x /usr/bin/install -c -m 644 io.h.x /usr/local/include/libol/io.h.x /usr/bin/install -c -m 644 list.h.x /usr/local/include/libol/list.h.x /usr/bin/install -c -m 644 read_line.h.x /usr/local/include/libol/read_line.h.x /usr/bin/install -c -m 644 resource.h.x /usr/local/include/libol/resource.h.x /usr/bin/install -c -m 644 io_commands.h.x /usr/local/include/libol/io_commands.h.x /usr/bin/install -c -m 644 command.h.x /usr/local/include/libol/command.h.x /usr/bin/install -c -m 644 queue.h.x /usr/local/include/libol/queue.h.x /usr/bin/install -c -m 644 olconfig.h /usr/local/include/libol/olconfig.h make[2]: Leaving directory `/apps/syslog-ng/depend/libol/libol-0.3.9/src' make[1]: Leaving directory `/apps/syslog-ng/depend/libol/libol-0.3.9/src' make[1]: Entering directory `/apps/syslog-ng/depend/libol/libol-0.3.9' make[2]: Entering directory `/apps/syslog-ng/depend/libol/libol-0.3.9' /bin/sh /apps/syslog-ng/depend/libol/libol-0.3.9/mkinstalldirs /usr/local/bin /usr/bin/install -c libol-config /usr/local/bin/libol-config make[2]: Nothing to be done for `install-data-am'. make[2]: Leaving directory `/apps/syslog-ng/depend/libol/libol-0.3.9' make[1]: Leaving directory `/apps/syslog-ng/depend/libol/libol-0.3.9' directory `/apps/syslog-ng/depend/libol/libol-0.3.9' Syslog-ng Installation Report ./configure -with-libol= /apps/syslog-ng/depend/libol/libol-0.3.9 configure: warning: /apps/syslog-ng/depend/libol/libol-0.3.9: invalid host type creating cache ./config.cache checking for a BSD compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal-1.4... found checking for working autoconf... found checking for working automake-1.4... found checking for working autoheader... found checking for working makeinfo... found checking whether build environment is sane... yes checking for gcc... gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for bison... bison -y checking how to run the C preprocessor... gcc -E checking for flex... flex checking for flex... (cached) flex checking for yywrap in -lfl... yes checking lex output file root... lex.yy checking whether yytext is a pointer... yes checking whether make sets ${MAKE}... (cached) yes checking for ANSI C header files... yes checking for malloc.h... yes checking for unistd.h... yes checking for door.h... no checking for stropts.h... yes checking for sys/strlog.h... no checking for stdarg.h... yes checking for sys/klog.h... yes checking for arpa/nameser.h... yes checking for tcpd.h... yes checking for working const... yes checking whether time.h and sys/time.h may both be included... yes checking for modern utmp... yes checking whether to compile klogctl... yes checking size of short... 2 checking size of int... 4 checking size of long... 4 checking for I_CONSLOG... no checking for O_LARGEFILE... yes checking for res_init in <resolv.h>... yes checking for working alloca.h... yes checking for alloca... yes checking for vprintf... yes checking for res_init in -lresolv... no checking for __res_init in -lresolv... yes checking for door_create in -ldoor... no checking for socket in -lsocket... no checking for gethostbyname in -lnsl... yes checking for select... yes checking for snprintf... yes checking for vsnprintf... yes checking for strerror... yes checking for inet_aton... yes checking for strncpy... yes checking for getutent... yes checking for getopt_long... yes checking for strcasecmp... yes checking for strptime... yes checking for TCP wrapper library... -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking libol version >= 0.3.13... configure: error: libol-config not found in the specified location Libol-config is in the specied location. #ls -l /apps/syslog-ng/depend/libol/libol-0.3.9/libol-config -rwxr-xr-x 1 root root 1318 Mar 23 17:16 /apps/syslog-ng/depend/libol/libol-0.3.9/libol-config

1 0

RE: [syslog-ng]relay host address changes source hosts ip in mess age
by Hamilton, Andrew 25 Mar '04

25 Mar '04

You need keep_hostname(yes) on both the relay host and the central host. Regards, Drew -----Original Message----- From: William Rude [mailto:wrude@gardrail.com] Sent: Wednesday, March 24, 2004 3:20 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]relay host address changes source hosts ip in message Greetings, I've been tasked to setup a syslog relay network from various pops to a centralized syslog server for insert into a database. The problem I'm running into is at the various pops, for example, lets call the first one POP-A. At POP-A, I have syslog-ng version 1.6.0rc4 setup to receive both udp and tcp syslog connections. It in turn, relays the syslog messages to the central server. When I look at the incoming data on the centralized server, the incoming data shows that the source host information is being re-written with the relay hosts ip. System stats are: Solaris 8 intel Syslog-ng 1.6.0rc4 POP-A configuration file follows: options { long_hostnames(off); use_dns(no); use_fqdn(no); dns_cache(no); check_hostname(yes); keep_hostname(no); chain_hostnames(no); # On Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(0); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(10240); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); create_dirs(yes); owner("root"); group("other"); perm(0600); use_time_recvd(yes); }; source src { # This is the source of syslog. # The default protocal port is 512 udp(); tcp(max-connections(1024)); }; source l_src { # This is the source of syslog. # This is internal messages on the local server internal(); sun-streams("/dev/log"); # This is internal messages on the local server }; destination syslogfile { file( "/var/log/syslogng/$HOST.log" ); udp("1.1.1.1"); }; filter priorityfilter { priority(debug,info,notice,warning,err,crit,alert,emerg); }; ############################################################### log { source(src); source(l_src); filter(priorityfilter); destination(syslogfile); }; ------------------------------------------------------ ------------------------------------------------------ ------------------------------------------------------ Server syslog-ng configuration follows: ------------------------------------------------------ ------------------------------------------------------ ------------------------------------------------------ options { long_hostnames(yes); use_dns(no); use_fqdn(no); dns_cache(no); # dns_cache_size(500); # dns_cache_expire(3600); # dns_cache_expire_failed(3600); # check_hostname(yes); keep_hostname(no); chain_hostnames(no); # On Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(0); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(10240); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); create_dirs(yes); owner("root"); group("other"); perm(0640); use_time_recvd(yes); }; ############################################################### source src { # This is the source of syslog. # The default protocal port is 512 udp(); # This is internal messages on the local server internal(); }; source l_src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; destination syslogfile { file( "/var/log/syslogng/$YEAR_$MONTH_$DAY_$HOST.log" ); }; destination program1 { program( /path/to/uber/syslog/program.pl template ("¡$HOST¡$FACILITY¡$PRIORITY¡$LEVEL¡$TAG¡$FULLDATE¡$PROGRAM¡$MSG\n") template-escape(yes) ); }; filter priorityfilter { priority(debug,info,notice,warning,err,crit,alert,emerg); }; filter dropsyslog { not match("syslog-ng*"); }; ############################################################### log { source(src); filter(dropsyslog); filter(priorityfilter); destination(program1); destination(syslogfile); }; ############################################################### log { source(l_src); destination(program1); destination(syslogfile); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Logging from a sun or hp unix host to syslog-ng
by Conrad Tiflin (CF) 25 Mar '04

25 Mar '04

Hi Everyone, I have setup a syslog-ng server on sun solaris 9. I now would like to log from a sun solaris box or a hp box on the network. These boxes are setup to send messages to the server. When I do a snoop on port 514 on the syslog-ng server I see that these boxes are sending messages but the server is not storing this info. into a file. The problem must lie with the syslog-ng.conf. I am able to log from cisco pix firewalls without any problem. I assume that the configuration must be Different for logging from hosts then. Does anyone have an idea?, if so what should the configuration be for logging from these boxes. Regards, Conrad ================================================================== This e-mail and its contents are subject to the Telkom SA Limited e-mail legal notice available from mailto:legalnotice@telkom.co.za or http://www.telkom.co.za/TelkomEMailLegalNotice.PDF

2 1

RE: [syslog-ng]relay host address changes source hosts ip in mess age
by "Pedroche, Raúl" 25 Mar '04

25 Mar '04

Greetings, The problem is quite simple: you have set the option "keep_hostname(no)" on both servers, which implies that syslog-ng will not trust the hostname in the packet payload, that is, the hostname by which the original server refers to itself, and will use reverse IP resolution to set it. In this scenario, this means that central server will see packets coming from POP-A and will not use the hostname in the packet but the reverse IP resolution of the packet source IP (or the IP by itself if it can not resolve it). You should remove the option from the central server configuration. Regards, Raúl Pedroche COLT Telecom Email: raul.pedroche(a)colt-telecom.es www.colt.net -----Original Message----- From: Bill [mailto:syslog-ng@gardrail.com] Sent: Wednesday, March 24, 2004 9:28 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]relay host address changes source hosts ip in message Greetings, I've been tasked to setup a syslog relay network from various pops to a centralized syslog server for insert into a database. The problem I'm running into is at the various pops, for example, lets call the first one POP-A. At POP-A, I have syslog-ng version 1.6.0rc4 setup to receive both udp and tcp syslog connections. It in turn, relays the syslog messages to the central server. When I look at the incoming data on the centralized server, the incoming data shows that the source host information is being re-written with the relay hosts ip. System stats are: Solaris 8 intel Syslog-ng 1.6.0rc4 POP-A configuration file follows: options { long_hostnames(off); use_dns(no); use_fqdn(no); dns_cache(no); check_hostname(yes); keep_hostname(no); chain_hostnames(no); # On Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(0); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(10240); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); create_dirs(yes); owner("root"); group("other"); perm(0600); use_time_recvd(yes); }; source src { # This is the source of syslog. # The default protocal port is 512 udp(); tcp(max-connections(1024)); }; source l_src { # This is the source of syslog. # This is internal messages on the local server internal(); sun-streams("/dev/log"); # This is internal messages on the local server }; destination syslogfile { file( "/var/log/syslogng/$HOST.log" ); udp("1.1.1.1"); }; filter priorityfilter { priority(debug,info,notice,warning,err,crit,alert,emerg); }; ############################################################### log { source(src); source(l_src); filter(priorityfilter); destination(syslogfile); }; ------------------------------------------------------ ------------------------------------------------------ ------------------------------------------------------ Server syslog-ng configuration follows: ------------------------------------------------------ ------------------------------------------------------ ------------------------------------------------------ options { long_hostnames(yes); use_dns(no); use_fqdn(no); dns_cache(no); # dns_cache_size(500); # dns_cache_expire(3600); # dns_cache_expire_failed(3600); # check_hostname(yes); keep_hostname(no); chain_hostnames(no); # On Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(0); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(10240); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); create_dirs(yes); owner("root"); group("other"); perm(0640); use_time_recvd(yes); }; ############################################################### source src { # This is the source of syslog. # The default protocal port is 512 udp(); # This is internal messages on the local server internal(); }; source l_src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; destination syslogfile { file( "/var/log/syslogng/$YEAR_$MONTH_$DAY_$HOST.log" ); }; destination program1 { program( /path/to/uber/syslog/program.pl template ("¡$HOST¡$FACILITY¡$PRIORITY¡$LEVEL¡$TAG¡$FULLDATE¡$PROGRAM¡$MSG\n") template-escape(yes) ); }; filter priorityfilter { priority(debug,info,notice,warning,err,crit,alert,emerg); }; filter dropsyslog { not match("syslog-ng*"); }; ############################################################### log { source(src); filter(dropsyslog); filter(priorityfilter); destination(program1); destination(syslogfile); }; ############################################################### log { source(l_src); destination(program1); destination(syslogfile); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

relay host address changes source hosts ip in message
by Bill 24 Mar '04

24 Mar '04

Greetings, I've been tasked to setup a syslog relay network from various pops to a centralized syslog server for insert into a database. The problem I'm running into is at the various pops, for example, lets call the first one POP-A. At POP-A, I have syslog-ng version 1.6.0rc4 setup to receive both udp and tcp syslog connections. It in turn, relays the syslog messages to the central server. When I look at the incoming data on the centralized server, the incoming data shows that the source host information is being re-written with the relay hosts ip. System stats are: Solaris 8 intel Syslog-ng 1.6.0rc4 POP-A configuration file follows: options { long_hostnames(off); use_dns(no); use_fqdn(no); dns_cache(no); check_hostname(yes); keep_hostname(no); chain_hostnames(no); # On Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(0); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(10240); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); create_dirs(yes); owner("root"); group("other"); perm(0600); use_time_recvd(yes); }; source src { # This is the source of syslog. # The default protocal port is 512 udp(); tcp(max-connections(1024)); }; source l_src { # This is the source of syslog. # This is internal messages on the local server internal(); sun-streams("/dev/log"); # This is internal messages on the local server }; destination syslogfile { file( "/var/log/syslogng/$HOST.log" ); udp("1.1.1.1"); }; filter priorityfilter { priority(debug,info,notice,warning,err,crit,alert,emerg); }; ############################################################### log { source(src); source(l_src); filter(priorityfilter); destination(syslogfile); }; ------------------------------------------------------ ------------------------------------------------------ ------------------------------------------------------ Server syslog-ng configuration follows: ------------------------------------------------------ ------------------------------------------------------ ------------------------------------------------------ options { long_hostnames(yes); use_dns(no); use_fqdn(no); dns_cache(no); # dns_cache_size(500); # dns_cache_expire(3600); # dns_cache_expire_failed(3600); # check_hostname(yes); keep_hostname(no); chain_hostnames(no); # On Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(0); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(10240); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); create_dirs(yes); owner("root"); group("other"); perm(0640); use_time_recvd(yes); }; ############################################################### source src { # This is the source of syslog. # The default protocal port is 512 udp(); # This is internal messages on the local server internal(); }; source l_src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; destination syslogfile { file( "/var/log/syslogng/$YEAR_$MONTH_$DAY_$HOST.log" ); }; destination program1 { program( /path/to/uber/syslog/program.pl template ("¡$HOST¡$FACILITY¡$PRIORITY¡$LEVEL¡$TAG¡$FULLDATE¡$PROGRAM¡$MSG\n") template-escape(yes) ); }; filter priorityfilter { priority(debug,info,notice,warning,err,crit,alert,emerg); }; filter dropsyslog { not match("syslog-ng*"); }; ############################################################### log { source(src); filter(dropsyslog); filter(priorityfilter); destination(program1); destination(syslogfile); }; ############################################################### log { source(l_src); destination(program1); destination(syslogfile); };

1 0

relay host address changes source hosts ip in message
by William Rude 24 Mar '04

24 Mar '04

Greetings, I've been tasked to setup a syslog relay network from various pops to a centralized syslog server for insert into a database. The problem I'm running into is at the various pops, for example, lets call the first one POP-A. At POP-A, I have syslog-ng version 1.6.0rc4 setup to receive both udp and tcp syslog connections. It in turn, relays the syslog messages to the central server. When I look at the incoming data on the centralized server, the incoming data shows that the source host information is being re-written with the relay hosts ip. System stats are: Solaris 8 intel Syslog-ng 1.6.0rc4 POP-A configuration file follows: options { long_hostnames(off); use_dns(no); use_fqdn(no); dns_cache(no); check_hostname(yes); keep_hostname(no); chain_hostnames(no); # On Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(0); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(10240); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); create_dirs(yes); owner("root"); group("other"); perm(0600); use_time_recvd(yes); }; source src { # This is the source of syslog. # The default protocal port is 512 udp(); tcp(max-connections(1024)); }; source l_src { # This is the source of syslog. # This is internal messages on the local server internal(); sun-streams("/dev/log"); # This is internal messages on the local server }; destination syslogfile { file( "/var/log/syslogng/$HOST.log" ); udp("1.1.1.1"); }; filter priorityfilter { priority(debug,info,notice,warning,err,crit,alert,emerg); }; ############################################################### log { source(src); source(l_src); filter(priorityfilter); destination(syslogfile); }; ------------------------------------------------------ ------------------------------------------------------ ------------------------------------------------------ Server syslog-ng configuration follows: ------------------------------------------------------ ------------------------------------------------------ ------------------------------------------------------ options { long_hostnames(yes); use_dns(no); use_fqdn(no); dns_cache(no); # dns_cache_size(500); # dns_cache_expire(3600); # dns_cache_expire_failed(3600); # check_hostname(yes); keep_hostname(no); chain_hostnames(no); # On Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(0); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(10240); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); create_dirs(yes); owner("root"); group("other"); perm(0640); use_time_recvd(yes); }; ############################################################### source src { # This is the source of syslog. # The default protocal port is 512 udp(); # This is internal messages on the local server internal(); }; source l_src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; destination syslogfile { file( "/var/log/syslogng/$YEAR_$MONTH_$DAY_$HOST.log" ); }; destination program1 { program( /path/to/uber/syslog/program.pl template ("¡$HOST¡$FACILITY¡$PRIORITY¡$LEVEL¡$TAG¡$FULLDATE¡$PROGRAM¡$MSG\n") template-escape(yes) ); }; filter priorityfilter { priority(debug,info,notice,warning,err,crit,alert,emerg); }; filter dropsyslog { not match("syslog-ng*"); }; ############################################################### log { source(src); filter(dropsyslog); filter(priorityfilter); destination(program1); destination(syslogfile); }; ############################################################### log { source(l_src); destination(program1); destination(syslogfile); };

1 0

Digitailly signed log entries
by Asaf Maruf Ali 24 Mar '04

24 Mar '04

Hello, We are currently setting up a secure logging server for a client using Syslog 1.6.2 and PHP-Syslog 1.4.2 for event management and logging. Needless to say the setup is working very well. The customer further requests that each log entry be digitally signed before being logged. Any ideas on how to do this. I looked through the mailing archives till June 2003 but didn't find any reference. Thank you in advance. Asaf Maruf Ali PING Systems IT Consultants Linux-Networks-Security +9221-5833971

1 0

Integrating Solaris BSM audit with syslog-ng
by Olivia Leonard 23 Mar '04

23 Mar '04

Hi I am trying to set up a unified logging environment for Solaris, HP-UX and Windows NT/2000 servers. The centralized logging and reporting server will run syslog-ng and accept syslog messages (with an agent converter for NT/2000) from all the servers on the network. I will then use swatch to report against these logs, both near real-time for critical events and daily reports for events which must be monitored but are not considered critical. All Solaris boxes will configured to use the Basic Security Module and audit against events such as successful/failed logins, su and so on. Given that the auditd writes it's files in binary and a tool such as praudit must be used to report against them, I was wondering if anyone knew of a way of integrating this into syslog-ng, maybe by using local0 -7, or there is package out there that does this? We live in hope ...... Regards Olivia The Information is this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any other action taken or any views, opinions or advice contained in this email are those of the sending individual and not necessarily those of the firm. It is possible for data transmitted by e-mail to be deliberately or accidentally corrupted or intercepted. For this reason where the communication is by email, J&E Davy does not accept any responsibility for any breach of confidence which may arise from the use of this medium. If you have received this e-mail in error please notify us immediately at mailto:helpdesk@davy.ie and delete this e-mail from your system.

1 0

template() buggy for program()?
by Loic Minier 22 Mar '04

22 Mar '04

Hi, My Perl program launched by syslog-ng with a program() destination receives logs in this form: "<182>Mar 19 14:35:00 met-ixb postfix/smtpd[3234]: connect from l ocalhost[127.0.0.1]" (ie the log starts with '<', '1', '8', '2', '>'.) The *same* log line appears as: "Mar 19 14:35:00 hostname postfix/smtpd[3234]: connect from localhost[127.0.0.1]" in a file destination. My config looks like: destination dp_parse { program("/path/to/perl/program" template("$DATE $MSG\n")); }; destination df_tech { file("/path/to/file/tech.log" template("$DATE $HOST $MSG\n")); }; I am confused about this behavior, is it normal for a program() output to receive a syslog header? -- Loïc Minier <lool(a)dooz.org>

2 4

Encrypted document
by entity73＠earthlink.net 21 Mar '04

21 Mar '04

1 0

destination sockets
by Porkchop 20 Mar '04

20 Mar '04

I saw an earlier thread about syslog-ng not creating/bind()ing/socket()ing sockets when it was generating messages... it never seemed quite resolved. I am attempting to create an outbound socket for syslog-ng to write to and that multiple clients (servers?) can read from. I am attempting to: destination d-plog { unix-stream("/tmp/d-plog.sock" template("$HOST $HOUR $MIN $SEC $FACILITY $PRIORITY $PROGRAM $MSG\n") template_escape(no) ); }; I'd then have multiple clients reading /tmp/d-plog.sock. Can't use a pipe (multiple clients). Can't use a file (log storage is done in SQL). Of course... root@lostcause:/home/porkchop# syslog-ng -v binding fd 5, unixaddr: /dev/log binding fd 6, inetaddr: 10.10.10.1, port: 514 binding fd 7, inetaddr: 0.0.0.0, port: 514 connecting fd 8, unixaddr: /tmp/d-porklog.sock Error connecting to AF_UNIX(/tmp/d-porklog.sock): Bad file descriptor Error initializing configuration, exiting. root@lostcause:/home/porkchop# Am I missing something? -porkchop

2 1

File permissions not being honored
by Chris Josephes 20 Mar '04

20 Mar '04

I have the following destination directive: destination d_user { file("/var/log/user" perm(0644)); }; But, syslog-ng sets the file permissions to 0600. I'm using version 1.4.17 Is my directive formatted incorrectly? -------------------- Christopher Josephes cpj1(a)visi.com

2 1

Massive lossage with syslog-ng
by donw＠examen.com 20 Mar '04

20 Mar '04

My apologies if this has been discussed, as I haven't been able to find anything useful via google or the FM... Syoposis: Syslog-ng drops something on the order of 90% of the logs remotely flung at it. Detail: I'm using syslog-ng 1.5.15 from the Debian stable package archive. I've been tasked with setting up two remote log servers for my employer; both log servers have fairly beefy IDE raids (IOZone gives me an unbuffered write speed of about 40M/sec), and as far as I can tell with vmstat(8) and Our Friend top(1), syslog-ng isn't running into any I/O bottlenecks. The systems have insane CPUs (Athlon XP 2000) and 512M RAM a pop, which considering their intended tasks (syslog and serial console server), should be more than adequate. I've set up several systems to push their logs onto the log server; a Solaris 8 (with native syslog) box, a Debian Linux box (native syslog again), and a Debian Linux box using syslog-ng. Yet syslog-ng seems to dump between 75% and 90% of all the logs handed to it on the floor. Several of the systems we wish to have logging to syslog will throw out about a thousand lines within a second or two, and this is where most of our problems come in. I've tried both TCP and UDP; TCP barely seems to work at all -- I can throw a thousand lines in on one end, see them in the logfile, and see one line of output out on the other side. I've futzed a bit with the FIFO size and the gc_idle/gc_busy numbers, but the latter two are more-or-less undocumented in the manual, so I have no idea what they really do (no units or anything), and the code regarding them is a bit too complex for me to read. I've been googling and chomping upon the syslog-ng documentation for about the past two weeks, and have yet to find a solution. Any suggestions? An FM for me to read? A USENET article I missed? Thanks-in-advance! -- Don Werve <donw(a)examen.com> (Unix System Administrator) Yorn desh born, der ritt de gitt der gue, Orn desh, dee born desh, de umn bork! bork! bork!

2 1

Auditd
by Coward, Robert (Contractor) 19 Mar '04

19 Mar '04

Is it possible to log auditd information using syslog-ng?

1 0

Re: sysnlog-ng lock whole machine ...
by Pawel Dziekonski 18 Mar '04

18 Mar '04

On śro, 17 mar 2004 at 08:25:57 -0800, Nate Campi wrote: > On Wed, Mar 17, 2004 at 02:32:49PM +0100, Pawel Dziekonski wrote: > > > > 1st: please confirm how do I log kernel messages (assuming klogd is NOT > > running): > > I use this pipe("/proc/kmsg"); more answeres? also, should it be: source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; or: source src { unix-dgram("/dev/log"); internal(); pipe("/proc/kmsg"); }; stream or dgram ??? I'm asking those questions, bacause different documentation sources say different things fir linux, or debian specyfically. > > 2nd: the machine "hangs" from time to time - cron is hanging, login is > > not spawning shell, sshd too. i have pinpointed it so i'm pretty sure > > that all those processes hang on socket connection to /dev/log. killing > > syslog-ng cures that. > > I am also a debian user, I don't know if this problem is specific to > debian or not, but I used to have lockups all the time when two things > would happen at once: syslog log rotation and postfix reloads. The HUP > of syslog-ng when rotating logs and postfix writing to /dev/log would > hang up the whole machine, cron processes would pile up and eventually > you couldn't even log into the machine, presumably because syscalls for > logging would hang. If I already had a shell and killed postfix most of > the processes would un-freeze, but cron would never recover. I always > had to reboot or power cycle if init got screwed. this is it!! please, see also (old bug, what the same problem): http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=95480 regrads, P -- Pawel Dziekonski <pawel.dziekonski|(a)|pwr.wroc.pl>, KDM WCSS avatar:0:0: Wroclaw Networking & Supercomputing Center, HPC Department -> See message headers for privacy policy and S/MIME info.

2 1

sysnlog-ng lock whole machine ...
by Pawel Dziekonski 17 Mar '04

17 Mar '04

hi, the machine is Linux 2.4.25 on i686, debian woody. it's a log-host for about 30 other machines also. 1st: please confirm how do I log kernel messages (assuming klogd is NOT running): with this: source ksrc { file("/proc/kmsg"); }; or this: source ksrc { pipe("/proc/kmsg"); }; 2nd: the machine "hangs" from time to time - cron is hanging, login is not spawning shell, sshd too. i have pinpointed it so i'm pretty sure that all those processes hang on socket connection to /dev/log. killing syslog-ng cures that. what can I do? thanks in advance, P PS. my config: options { long_hostnames(off); sync(0)}; source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; source net { udp(); }; filter f_auth { facility(auth, authpriv) and not match("cron"); }; filter f_NOauth { not facility(auth, authpriv); }; filter f_cron { facility(cron) or match("cron"); }; filter f_NOcron { not facility(cron) and not match("cron"); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mailnews { facility(mail, news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter p_debug { level(debug); }; filter p_info { level(info); }; filter p_notice { level(notice); }; filter p_warn { level(warn); }; filter p_err { level(err); }; filter p_crit { level(crit); }; filter p_alert { level(alert); }; filter p_emergency { level(emerg); }; filter f_all { level(debug..emerg); }; filter f_iptables { facility(kern) and match("IN=[A-Za-z0-9]* OUT=[A-Za-z0-9]*"); }; filter f_NOiptables { not match("IN=[A-Za-z0-9]* OUT=[A-Za-z0-9]*"); }; filter f_named { level(debug..emerg) and match("named"); }; filter f_NOnamed { not match("named"); }; filter f_dhcpd { level(debug..emerg) and match("dhcpd"); }; filter f_NOdhcpd { not match("dhcpd"); }; destination authlog { file("/var/log/syslog/auth.log"); }; destination cron { file("/var/log/syslog/cron.log"); }; destination syslog { file("/var/log/syslog/syslog.log"); }; destination iptables { file("/var/log/syslog/iptables.log"); }; destination named { file("/var/log/syslog/named.log"); }; destination dhcpd { file("/var/log/syslog/dhcpd.log"); }; destination tty11 { file("/dev/tty11"); }; destination tty12 { file("/dev/tty12"); }; log { source(src); filter(f_auth); destination(authlog); }; log { source(src); filter(f_auth); destination(tty11); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_all); filter(f_NOcron); filter(f_NOauth); filter(f_NOiptables); filter(f_NOnamed); filter(f_NOdhcpd); destination(syslog); }; log { source(src); filter(f_all); filter(f_NOcron); filter(f_NOauth); filter(f_NOiptables); filter(f_NOnamed); filter(f_NOdhcpd); destination(tty12); }; log { source(src); filter(f_iptables); destination(iptables); }; log { source(src); filter(f_named); destination(named); }; log { source(src); filter(f_dhcpd); destination(dhcpd); }; filter f_pix { host("pix"); }; destination pix { file("/var/log/syslog/pix.log"); }; log { source(net); filter(f_pix); destination(pix); }; filter f_lit { host("lit"); }; destination lit { file("/var/log/syslog/lit.log"); }; log { source(net); filter(f_lit); destination(lit); }; filter f_beryl { host("beryl"); }; destination beryl { file("/var/log/syslog/beryl.log"); }; log { source(net); filter(f_beryl); destination(beryl); }; filter f_bor { host("bor"); }; destination bor { file("/var/log/syslog/bor.log"); }; log { source(net); filter(f_bor); destination(bor); }; filter f_wegiel { host("wegiel"); }; destination wegiel { file("/var/log/syslog/wegiel.log"); }; log { source(net); filter(f_wegiel); destination(wegiel); }; filter f_azot { host("azot"); }; destination azot { file("/var/log/syslog/azot.log"); }; log { source(net); filter(f_azot); destination(azot); }; filter f_tlen { host("tlen"); }; destination tlen { file("/var/log/syslog/tlen.log"); }; log { source(net); filter(f_tlen); destination(tlen); }; filter f_fluor { host("fluor"); }; destination fluor { file("/var/log/syslog/fluor.log"); }; log { source(net); filter(f_fluor); destination(fluor); }; filter f_neon { host("neon"); }; destination neon { file("/var/log/syslog/neon.log"); }; log { source(net); filter(f_neon); destination(neon); }; filter f_hel { host("hel"); }; destination hel { file("/var/log/syslog/hel.log"); }; log { source(net); filter(f_hel); destination(hel); }; filter f_sod { host("sod"); }; destination sod { file("/var/log/syslog/sod.log"); }; log { source(net); filter(f_sod); destination(sod); }; filter f_magnez { host("magnez"); }; destination magnez { file("/var/log/syslog/magnez.log"); }; log { source(net); filter(f_magnez); destination(magnez); }; filter f_glin { host("glin"); }; destination glin { file("/var/log/syslog/glin.log"); }; log { source(net); filter(f_glin); destination(glin); }; filter f_krzem { host("krzem"); }; destination krzem { file("/var/log/syslog/krzem.log"); }; log { source(net); filter(f_krzem); destination(krzem); }; filter f_fosfor { host("fosfor"); }; destination fosfor { file("/var/log/syslog/fosfor.log"); }; log { source(net); filter(f_fosfor); destination(fosfor); }; filter f_siarka { host("siarka"); }; destination siarka { file("/var/log/syslog/siarka.log"); }; log { source(net); filter(f_siarka); destination(siarka); }; filter f_chlor { host("chlor"); }; destination chlor { file("/var/log/syslog/chlor.log"); }; log { source(net); filter(f_chlor); destination(chlor); }; filter f_argon { host("argon"); }; destination argon { file("/var/log/syslog/argon.log"); }; log { source(net); filter(f_argon); destination(argon); }; filter f_potas { host("potas"); }; destination potas { file("/var/log/syslog/potas.log"); }; log { source(net); filter(f_potas); destination(potas); }; filter f_wapn { host("wapn"); }; destination wapn { file("/var/log/syslog/wapn.log"); }; log { source(net); filter(f_wapn); destination(wapn); }; filter f_gal { host("gal"); }; destination gal { file("/var/log/syslog/gal.log"); }; log { source(net); filter(f_gal); destination(gal); }; filter f_german { host("german"); }; destination german { file("/var/log/syslog/german.log"); }; log { source(net); filter(f_german); destination(german); }; filter f_arsen { host("arsen"); }; destination arsen { file("/var/log/syslog/arsen.log"); }; log { source(net); filter(f_arsen); destination(arsen); }; filter f_selen { host("selen"); }; destination selen { file("/var/log/syslog/selen.log"); }; log { source(net); filter(f_selen); destination(selen); }; filter f_brom { host("brom"); }; destination brom { file("/var/log/syslog/brom.log"); }; log { source(net); filter(f_brom); destination(brom); }; filter f_krypton { host("krypton"); }; destination krypton { file("/var/log/syslog/krypton.log"); }; log { source(net); filter(f_krypton); destination(krypton); }; filter f_rubid { host("rubid"); }; destination rubid { file("/var/log/syslog/rubid.log"); }; log { source(net); filter(f_rubid); destination(rubid); }; filter f_stront { host("stront"); }; destination stront { file("/var/log/syslog/stront.log"); }; log { source(net); filter(f_stront); destination(stront); }; filter f_ind { host("ind"); }; destination ind { file("/var/log/syslog/ind.log"); }; log { source(net); filter(f_ind); destination(ind); }; filter f_cyna { host("cyna"); }; destination cyna { file("/var/log/syslog/cyna.log"); }; log { source(net); filter(f_cyna); destination(cyna); }; filter f_antymon { host("antymon"); }; destination antymon { file("/var/log/syslog/antymon.log"); }; log { source(net); filter(f_antymon); destination(antymon); }; filter f_tellur { host("tellur"); }; destination tellur { file("/var/log/syslog/tellur.log"); }; log { source(net); filter(f_tellur); destination(tellur); }; -- Pawel Dziekonski <pawel.dziekonski|(a)|pwr.wroc.pl>, KDM WCSS avatar:0:0: Wroclaw Networking & Supercomputing Center, HPC Department -> See message headers for privacy policy and S/MIME info.

2 1

libol: configure.in and make_class
by José Pedro Oliveira 16 Mar '04

16 Mar '04

I have a couple of comments/questions about libol. 1) configure ignores the CFLAGS enviroment variable. This affects packagers, in particular, the ones making specfiles (%configure defines CFLAGS as "$RPM_OPT_FLAGS"). I believe the correct solution is to patch configure.in. Something like this ---------- @@ -106,7 +106,7 @@ if test $enable_debug = "yes"; then CFLAGS="-Wall -g" else - CFLAGS="-Wall -O2" + CFLAGS="$CFLAGS -Wall" fi ---------- appears to work (but I'm not an autotools expert). 2) the libol makefile install the file make_class in the directory /usr/bin. Is this file required for building syslog-ng? The main reason I asking this is that make_file is installed with no interpreter. The first three lines are: ---------- #! \ -e main -s !# ---------- The original file - make_class.in - refers to something like "_SCSH_" but this gets replaced by an empty string. Building system: Red Hat 9 Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B * diff -ruN libol-0.3.13-orig/configure.in libol-0.3.13-modified/configure.in --- libol-0.3.13-orig/configure.in 2004-01-19 13:20:13.000000000 +0000 +++ libol-0.3.13-modified/configure.in 2004-03-16 01:51:56.000000000 +0000 @@ -106,7 +106,7 @@ if test $enable_debug = "yes"; then CFLAGS="-Wall -g" else - CFLAGS="-Wall -O2" + CFLAGS="$CFLAGS -Wall" fi MAKE_CLASS="$srcdir/utils/make_class"

1 0

mysql pipe not working!
by TIM MOORE 11 Mar '04

11 Mar '04

I setup syslog-ng to pipe to a fifo (/tmp/mysql.pipe). I copied and pasted the configs exactly as was given and no data is written to the pipe. It always remains "0" in size. I have since tried the config in many different ways, but still cannot get the data to pipe to the file. Is there something wrong with the config? Has anyone else run into this problem? Here is a copy of my config. root@syslog1 ~ # cat /etc/syslog-ng/syslog-ng.conf # # Syslog-ng configuration for for ODJFS-NOC Syslog # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # options { use_fqdn(yes); use_dns(yes); keep_hostname(yes); long_hostnames(off); use_time_recvd(yes); sync(0); }; ###################################### #Source Section #source for local data source src { unix-dgram("/etc/log/log"); internal(); }; #source src { pipe("/proc/kmsg" log_prefix("kernel: ")); # unix-stream("/dev/log"); # internal(); #}; #source for PIX firewalls #source pix { # udp(ip("10.3.250.5") port (514)); # udp(ip("10.x.x.x") port (514)); # udp(ip("10.x.x.x") port (514)); # udp(ip("10.x.x.x") port (514)); # udp(ip("10.x.x.x") port (514)); #}; #source for network devices source net { udp(); }; ##################################### #Destination Section #Standard destination destination std { file("/var/log/$HOST/$FACILITY/$DAY" remove_if_older(172800) owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; #log for src log { source(src); destination(std); destination(d_mysql); }; #log for net log { source(net); destination(std); destination(d_mysql); }; ########END OF FILE######## Any ideas? Tim M. ODJFS

1 0

AW: [syslog-ng]Matching Empty Syslog Lines
by stefan.schaefers＠bhf.ing.com 11 Mar '04

11 Mar '04

Hi Juergen, try this match("^\s$")..... may be that works ^ means begin of line \s space/newline/tab $ end of line greetings Stefan -----Ursprüngliche Nachricht----- Von: Juergen Wolf [mailto:wolf@idmt.fhg.de] Gesendet: Donnerstag, 11. März 2004 16:52 An: syslog-ng(a)lists.balabit.hu Betreff: [syslog-ng]Matching Empty Syslog Lines Hoi, I get loads of empty lines in my syslog like: Mar 11 16:38:29 il062 dm: Mar 11 16:38:35 il062 sshd: Mar 11 16:37:19 il062 alsa: So I am looking for a Match-Expression to omit these lines. Unfortunately match("^$") and match("\A\z") did no good at all. Any idea how to get rid of these lines? Regards, Juergen -- email: wolf(a)idmt.fhg.de gilb: Fraunhofer-Institut fuer Digitale Medientechnologie IDMT 98693 Ilmenau, Helmholtzring 1 Tel.: +49 3677 69-4882 Fax: +49 3677 69-4399 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0