- syslog-ng - lists.balabit.hu

Re:[syslog-ng]file() versus pipe() for kernel logging
by Amodiovalerio Verde 01 Mar '04

01 Mar '04

It seems the only difference between file() and pipe() is the way files are opened. file() open files in read only , while pipe() open them in read-write. There's also defined a source and a destination fifo() that is just another name for pipe(). Amodiovalerio [Hypo] Verde ---------- Initial Header ----------- From : syslog-ng-admin(a)lists.balabit.hu To : syslog-ng(a)lists.balabit.hu Cc : Date : Sun, 29 Feb 2004 12:11:34 +1100 Subject : [syslog-ng]file() versus pipe() for kernel logging > I was just wondering if anyone could explain the differences between pip() > and file() when used as kernel log sources. > > For example the documentation suggests you would use the following statement > to collect kernel logs: > > source s_file { file("/proc/kmsg"); }; > > Most examples of syslog-ng.conf files I have seen have the following > statement: > > source s_pipe { pipe("/proc/kmsg"); }; > > Is there any difference between the two? Is one better than the other? > > Any help much appreciated. > > Thanks > > James Turnbull > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

1 0

sylog-ng file() options
by Coward, Robert (Contractor) 29 Feb '04

29 Feb '04

Are there any plans to implement the compress() and encrypt() options for the file() driver? Roberto

2 1

RE: [syslog-ng]$HOST $YEAR, etc not working correctly..
by Kelly, Chuck 26 Feb '04

26 Feb '04

My point being try separating the lines out, I do a similar thing with no issues, but keep destinations within their own set of {} -- Chuck -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Doug Peterson Sent: Tuesday, February 24, 2004 2:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]$HOST $YEAR, etc not working correctly.. Howdy, I recently installed the same config file I had in 1.6.0rc1(or rc2?) on redhat 7.3 to a system with syslog-ng 1.6.2 with redhat 9... My log files are not being written in the format that I would expect (or that they WERE on the old box).. I would expect the following rule to write to the file: /var/log/hosts/webserver1/2004/02/24/webserver1_messages_2004_02_24 Instead I get: /var/log/hosts/webserver1/2004/02/24/messsages_24 The rule: destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH _$DAY" owner(root) group(sysadmin) perm(0640) dir_perm(0700) create_dirs(yes) ); }; This happens with all similar destination rules. The $year, $month, $host, etc work fine in the first portion of the destination, but they don't all work in the filename.. but $day does for some strange reason. I can provide my full 164 line config file on request, but all destinations are setup the same as this one, and all get the same result. What am I missing here? :) __________________________________ Do you Yahoo!? Yahoo! Mail SpamGuard - Read only the mail you want. http://antispam.yahoo.com/tools _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

RE: [syslog-ng]syslog duplicate entries
by Hamilton Andrew 25 Feb '04

25 Feb '04

Yep. Drew -----Original Message----- From: Dylan Bouterse [mailto:dbouterse@globalcardservices.com] Sent: Tuesday, February 24, 2004 5:46 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]syslog duplicate entries Should I be able to remove all of the destination lines following std and still get the localhost's log information to it's host directory based on the "destination std" line? Dylan -----Original Message----- From: Hamilton Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Tuesday, February 24, 2004 12:33 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog duplicate entries Look at your filter, f_syslog, destination d_syslog, and your log line that includes d_syslog. Your filter f_syslog includes everything except facilities auth, and authpriv. If you are confident that you don't need your syslog line you can comment that out as well to keep you from getting duplicates in you /var/log/syslog file. Regards, Drew -----Original Message----- From: Dylan (FHMS) [ mailto:dhbouterse@fhmsi.com <mailto:dhbouterse@fhmsi.com> ] Sent: Tuesday, February 24, 2004 12:25 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog duplicate entries I have my syslog-ng setup so that external syslog hosts are creating their own dir and log file (see conf file below). One problem I'm having is that all of the hosts' logs are being written to /var/log/syslog as well...creating a 6Gig file or larger per week. Can someone please point out what I can change with my conf file to eliminate the duplicate entries? Thank you! Dylan ############################################# ### syslog-ng.conf file ############################################# options { check_hostname(yes); chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; # # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { # file("/var/log/HOSTS/$YEAR/$HOST/$MONTH/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(nagios) group(nagios) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/var/log/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/var/log/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/var/log/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/var/log/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/var/log/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/var/log/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/var/log/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/var/log/uucp.log" owner("root") group("adm") perm(0640)); }; # This files are the log come from the mail subsystem. # destination mailinfo { file("/var/log/mail.info" owner("root") group("adm") perm(0640)); }; destination mailwarn { file("/var/log/mail.warn" owner("root") group("adm") perm(0640)); }; destination mailerr { file("/var/log/mail.err" owner("root") group("adm") perm(0640)); }; # Logging for INN news system # destination newscrit { file("/var/log/news/news.crit" owner("root") group("adm") perm(0640)); }; destination newserr { file("/var/log/news/news.err" owner("root") group("adm") perm(0640)); }; destination newsnotice { file("/var/log/news/news.notice" owner("root") group("adm") perm(0640)); }; # Some `catch-all' logfiles. # #destination debug { file("/var/log/debug" owner("root") group("adm") #perm(0640)); }; #destination messages { file("/var/log/messages" owner("root") group("adm") #perm(0640)); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination xconsole { pipe("/dev/xconsole"); }; destination ppp { file("/var/log/ppp.log" owner("root") group("adm") perm(0640)); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter ppp { facility(local2); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; #log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; #log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_cnews); destination(console_all); }; #log { source(src); filter(f_cother); destination(console_all); }; ####log { source(src); filter(f_cnews); destination(xconsole); }; ###log { source(src); filter(f_cother); destination(xconsole); }; log { source(src); filter(ppp); destination(ppp); }; log { source(src); destination(std); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

Connection broken, line before lose
by Benoit DOLEZ 25 Feb '04

25 Feb '04

Hi, When a connection broken is detected (error when writing a line to an invalid socket), the line that make the "connection broken" to be detected is definitly lost. In a local file Feb 24 22:09:47 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Feb 24 22:09:48 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Feb 24 22:09:48 src@loki syslog-ng[18900]: Connection broken to AF_INET(127.0.0.1:40000), reopening in 60 seconds Feb 24 22:09:49 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 In the remote process # nc -l -p 40000 (...) Feb 24 22:09:47 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 <Ctrl-C> # nc -l -p 40000 <43>Feb 24 22:09:48 src@loki syslog-ng[18900]: Connection broken to AF_INET(127.0.0.1:40000), reopening in 60 seconds <13>Feb 24 22:09:49 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 le log line at Feb 24 22:09:48 is definitly lost, is it normal? B DOLEZ -- Benoit DOLEZ, EXOSEC (http://www.exosec.fr/) 12 av des Pres - BL233, 78059 St Quentin en Yvelines cedex Tel: +33 1 61 37 05 35 - Fax: +33 1 61 38 10 65 GSM: +33 6 21 05 91 69 - mailto:bdolez@exosec.fr

2 1

RE: [syslog-ng]$HOST $YEAR, etc not working correctly..
by Kelly, Chuck 24 Feb '04

24 Feb '04

I left off something on the end as well. destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH _$DAY"); }; -- Chuck -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Doug Peterson Sent: Tuesday, February 24, 2004 2:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]$HOST $YEAR, etc not working correctly.. Howdy, I recently installed the same config file I had in 1.6.0rc1(or rc2?) on redhat 7.3 to a system with syslog-ng 1.6.2 with redhat 9... My log files are not being written in the format that I would expect (or that they WERE on the old box).. I would expect the following rule to write to the file: /var/log/hosts/webserver1/2004/02/24/webserver1_messages_2004_02_24 Instead I get: /var/log/hosts/webserver1/2004/02/24/messsages_24 The rule: destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH _$DAY" owner(root) group(sysadmin) perm(0640) dir_perm(0700) create_dirs(yes) ); }; This happens with all similar destination rules. The $year, $month, $host, etc work fine in the first portion of the destination, but they don't all work in the filename.. but $day does for some strange reason. I can provide my full 164 line config file on request, but all destinations are setup the same as this one, and all get the same result. What am I missing here? :) __________________________________ Do you Yahoo!? Yahoo! Mail SpamGuard - Read only the mail you want. http://antispam.yahoo.com/tools _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]$HOST $YEAR, etc not working correctly..
by Kelly, Chuck 24 Feb '04

24 Feb '04

Try this. destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH _$DAY"); I added paren and semni-colon to end -- Chuck -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Doug Peterson Sent: Tuesday, February 24, 2004 2:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]$HOST $YEAR, etc not working correctly.. Howdy, I recently installed the same config file I had in 1.6.0rc1(or rc2?) on redhat 7.3 to a system with syslog-ng 1.6.2 with redhat 9... My log files are not being written in the format that I would expect (or that they WERE on the old box).. I would expect the following rule to write to the file: /var/log/hosts/webserver1/2004/02/24/webserver1_messages_2004_02_24 Instead I get: /var/log/hosts/webserver1/2004/02/24/messsages_24 The rule: destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH _$DAY" owner(root) group(sysadmin) perm(0640) dir_perm(0700) create_dirs(yes) ); }; This happens with all similar destination rules. The $year, $month, $host, etc work fine in the first portion of the destination, but they don't all work in the filename.. but $day does for some strange reason. I can provide my full 164 line config file on request, but all destinations are setup the same as this one, and all get the same result. What am I missing here? :) __________________________________ Do you Yahoo!? Yahoo! Mail SpamGuard - Read only the mail you want. http://antispam.yahoo.com/tools _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]syslog duplicate entries
by Dylan Bouterse 24 Feb '04

24 Feb '04

Should I be able to remove all of the destination lines following std and still get the localhost's log information to it's host directory based on the "destination std" line? Dylan -----Original Message----- From: Hamilton Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Tuesday, February 24, 2004 12:33 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog duplicate entries Look at your filter, f_syslog, destination d_syslog, and your log line that includes d_syslog. Your filter f_syslog includes everything except facilities auth, and authpriv. If you are confident that you don't need your syslog line you can comment that out as well to keep you from getting duplicates in you /var/log/syslog file. Regards, Drew -----Original Message----- From: Dylan (FHMS) [ mailto:dhbouterse@fhmsi.com <mailto:dhbouterse@fhmsi.com> ] Sent: Tuesday, February 24, 2004 12:25 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog duplicate entries I have my syslog-ng setup so that external syslog hosts are creating their own dir and log file (see conf file below). One problem I'm having is that all of the hosts' logs are being written to /var/log/syslog as well...creating a 6Gig file or larger per week. Can someone please point out what I can change with my conf file to eliminate the duplicate entries? Thank you! Dylan ############################################# ### syslog-ng.conf file ############################################# options { check_hostname(yes); chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; # # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { # file("/var/log/HOSTS/$YEAR/$HOST/$MONTH/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(nagios) group(nagios) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/var/log/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/var/log/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/var/log/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/var/log/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/var/log/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/var/log/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/var/log/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/var/log/uucp.log" owner("root") group("adm") perm(0640)); }; # This files are the log come from the mail subsystem. # destination mailinfo { file("/var/log/mail.info" owner("root") group("adm") perm(0640)); }; destination mailwarn { file("/var/log/mail.warn" owner("root") group("adm") perm(0640)); }; destination mailerr { file("/var/log/mail.err" owner("root") group("adm") perm(0640)); }; # Logging for INN news system # destination newscrit { file("/var/log/news/news.crit" owner("root") group("adm") perm(0640)); }; destination newserr { file("/var/log/news/news.err" owner("root") group("adm") perm(0640)); }; destination newsnotice { file("/var/log/news/news.notice" owner("root") group("adm") perm(0640)); }; # Some `catch-all' logfiles. # #destination debug { file("/var/log/debug" owner("root") group("adm") #perm(0640)); }; #destination messages { file("/var/log/messages" owner("root") group("adm") #perm(0640)); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination xconsole { pipe("/dev/xconsole"); }; destination ppp { file("/var/log/ppp.log" owner("root") group("adm") perm(0640)); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter ppp { facility(local2); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; #log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; #log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_cnews); destination(console_all); }; #log { source(src); filter(f_cother); destination(console_all); }; ####log { source(src); filter(f_cnews); destination(xconsole); }; ###log { source(src); filter(f_cother); destination(xconsole); }; log { source(src); filter(ppp); destination(ppp); }; log { source(src); destination(std); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

$HOST $YEAR, etc not working correctly..
by Doug Peterson 24 Feb '04

24 Feb '04

Howdy, I recently installed the same config file I had in 1.6.0rc1(or rc2?) on redhat 7.3 to a system with syslog-ng 1.6.2 with redhat 9... My log files are not being written in the format that I would expect (or that they WERE on the old box).. I would expect the following rule to write to the file: /var/log/hosts/webserver1/2004/02/24/webserver1_messages_2004_02_24 Instead I get: /var/log/hosts/webserver1/2004/02/24/messsages_24 The rule: destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH_$DAY" owner(root) group(sysadmin) perm(0640) dir_perm(0700) create_dirs(yes) ); }; This happens with all similar destination rules. The $year, $month, $host, etc work fine in the first portion of the destination, but they don't all work in the filename.. but $day does for some strange reason. I can provide my full 164 line config file on request, but all destinations are setup the same as this one, and all get the same result. What am I missing here? :) __________________________________ Do you Yahoo!? Yahoo! Mail SpamGuard - Read only the mail you want. http://antispam.yahoo.com/tools

1 0

RE: [syslog-ng]syslog duplicate entries
by Dylan Bouterse 24 Feb '04

24 Feb '04

Should I be able to remove all of the destination lines following std and still get the localhost's log information to it's host directory based on the "destination std" line? Dylan -----Original Message----- From: Hamilton Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Tuesday, February 24, 2004 12:33 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog duplicate entries Look at your filter, f_syslog, destination d_syslog, and your log line that includes d_syslog. Your filter f_syslog includes everything except facilities auth, and authpriv. If you are confident that you don't need your syslog line you can comment that out as well to keep you from getting duplicates in you /var/log/syslog file. Regards, Drew -----Original Message----- From: Dylan (FHMS) [ mailto:dhbouterse@fhmsi.com <mailto:dhbouterse@fhmsi.com> ] Sent: Tuesday, February 24, 2004 12:25 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog duplicate entries I have my syslog-ng setup so that external syslog hosts are creating their own dir and log file (see conf file below). One problem I'm having is that all of the hosts' logs are being written to /var/log/syslog as well...creating a 6Gig file or larger per week. Can someone please point out what I can change with my conf file to eliminate the duplicate entries? Thank you! Dylan ############################################# ### syslog-ng.conf file ############################################# options { check_hostname(yes); chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; # # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { # file("/var/log/HOSTS/$YEAR/$HOST/$MONTH/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(nagios) group(nagios) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/var/log/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/var/log/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/var/log/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/var/log/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/var/log/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/var/log/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/var/log/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/var/log/uucp.log" owner("root") group("adm") perm(0640)); }; # This files are the log come from the mail subsystem. # destination mailinfo { file("/var/log/mail.info" owner("root") group("adm") perm(0640)); }; destination mailwarn { file("/var/log/mail.warn" owner("root") group("adm") perm(0640)); }; destination mailerr { file("/var/log/mail.err" owner("root") group("adm") perm(0640)); }; # Logging for INN news system # destination newscrit { file("/var/log/news/news.crit" owner("root") group("adm") perm(0640)); }; destination newserr { file("/var/log/news/news.err" owner("root") group("adm") perm(0640)); }; destination newsnotice { file("/var/log/news/news.notice" owner("root") group("adm") perm(0640)); }; # Some `catch-all' logfiles. # #destination debug { file("/var/log/debug" owner("root") group("adm") #perm(0640)); }; #destination messages { file("/var/log/messages" owner("root") group("adm") #perm(0640)); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination xconsole { pipe("/dev/xconsole"); }; destination ppp { file("/var/log/ppp.log" owner("root") group("adm") perm(0640)); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter ppp { facility(local2); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; #log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; #log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_cnews); destination(console_all); }; #log { source(src); filter(f_cother); destination(console_all); }; ####log { source(src); filter(f_cnews); destination(xconsole); }; ###log { source(src); filter(f_cother); destination(xconsole); }; log { source(src); filter(ppp); destination(ppp); }; log { source(src); destination(std); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

RE: [syslog-ng]syslog duplicate entries
by Hamilton Andrew 24 Feb '04

24 Feb '04

Look at your filter, f_syslog, destination d_syslog, and your log line that includes d_syslog. Your filter f_syslog includes everything except facilities auth, and authpriv. If you are confident that you don't need your syslog line you can comment that out as well to keep you from getting duplicates in you /var/log/syslog file. Regards, Drew -----Original Message----- From: Dylan (FHMS) [mailto:dhbouterse@fhmsi.com] Sent: Tuesday, February 24, 2004 12:25 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog duplicate entries I have my syslog-ng setup so that external syslog hosts are creating their own dir and log file (see conf file below). One problem I'm having is that all of the hosts' logs are being written to /var/log/syslog as well...creating a 6Gig file or larger per week. Can someone please point out what I can change with my conf file to eliminate the duplicate entries? Thank you! Dylan ############################################# ### syslog-ng.conf file ############################################# options { check_hostname(yes); chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; # # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { # file("/var/log/HOSTS/$YEAR/$HOST/$MONTH/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(nagios) group(nagios) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/var/log/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/var/log/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/var/log/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/var/log/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/var/log/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/var/log/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/var/log/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/var/log/uucp.log" owner("root") group("adm") perm(0640)); }; # This files are the log come from the mail subsystem. # destination mailinfo { file("/var/log/mail.info" owner("root") group("adm") perm(0640)); }; destination mailwarn { file("/var/log/mail.warn" owner("root") group("adm") perm(0640)); }; destination mailerr { file("/var/log/mail.err" owner("root") group("adm") perm(0640)); }; # Logging for INN news system # destination newscrit { file("/var/log/news/news.crit" owner("root") group("adm") perm(0640)); }; destination newserr { file("/var/log/news/news.err" owner("root") group("adm") perm(0640)); }; destination newsnotice { file("/var/log/news/news.notice" owner("root") group("adm") perm(0640)); }; # Some `catch-all' logfiles. # #destination debug { file("/var/log/debug" owner("root") group("adm") #perm(0640)); }; #destination messages { file("/var/log/messages" owner("root") group("adm") #perm(0640)); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination xconsole { pipe("/dev/xconsole"); }; destination ppp { file("/var/log/ppp.log" owner("root") group("adm") perm(0640)); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter ppp { facility(local2); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; #log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; #log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_cnews); destination(console_all); }; #log { source(src); filter(f_cother); destination(console_all); }; ####log { source(src); filter(f_cnews); destination(xconsole); }; ###log { source(src); filter(f_cother); destination(xconsole); }; log { source(src); filter(ppp); destination(ppp); }; log { source(src); destination(std); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog duplicate entries
by Dylan (FHMS) 24 Feb '04

24 Feb '04

I have my syslog-ng setup so that external syslog hosts are creating their own dir and log file (see conf file below). One problem I'm having is that all of the hosts' logs are being written to /var/log/syslog as well...creating a 6Gig file or larger per week. Can someone please point out what I can change with my conf file to eliminate the duplicate entries? Thank you! Dylan ############################################# ### syslog-ng.conf file ############################################# options { check_hostname(yes); chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; # # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { # file("/var/log/HOSTS/$YEAR/$HOST/$MONTH/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(nagios) group(nagios) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/var/log/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/var/log/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/var/log/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/var/log/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/var/log/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/var/log/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/var/log/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/var/log/uucp.log" owner("root") group("adm") perm(0640)); }; # This files are the log come from the mail subsystem. # destination mailinfo { file("/var/log/mail.info" owner("root") group("adm") perm(0640)); }; destination mailwarn { file("/var/log/mail.warn" owner("root") group("adm") perm(0640)); }; destination mailerr { file("/var/log/mail.err" owner("root") group("adm") perm(0640)); }; # Logging for INN news system # destination newscrit { file("/var/log/news/news.crit" owner("root") group("adm") perm(0640)); }; destination newserr { file("/var/log/news/news.err" owner("root") group("adm") perm(0640)); }; destination newsnotice { file("/var/log/news/news.notice" owner("root") group("adm") perm(0640)); }; # Some `catch-all' logfiles. # #destination debug { file("/var/log/debug" owner("root") group("adm") #perm(0640)); }; #destination messages { file("/var/log/messages" owner("root") group("adm") #perm(0640)); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination xconsole { pipe("/dev/xconsole"); }; destination ppp { file("/var/log/ppp.log" owner("root") group("adm") perm(0640)); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter ppp { facility(local2); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; #log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; #log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_cnews); destination(console_all); }; #log { source(src); filter(f_cother); destination(console_all); }; ####log { source(src); filter(f_cnews); destination(xconsole); }; ###log { source(src); filter(f_cother); destination(xconsole); }; log { source(src); filter(ppp); destination(ppp); }; log { source(src); destination(std); };

1 0

tcp_keepalive and tcp_wrapper patch
by Rule, Ted 24 Feb '04

24 Feb '04

As part of preparing to glue a pair of syslog-ng servers together via a TCP connection, I've made some slight tweaks to the afinet.c code on my running system. This is all for a 1.6.0rc3 code version. Because I can't find any reference to the option elsewhere in the libol or syslog-ng code, I've forced the SO_KEEPALIVE socket on for both sender and receiver in a TCP connection. The issue here is mainly where the client mysteriously disappears, and the server seemingly never bothers to close down the half-open socket. Forcing the SO_KEEPALIVE flag on the socket should, I believe, tidy this up in the worst case scenario. I know that the socket can remain half-open, because I've seen TCP connections from a PIX in ESTABLISHED state, even when the PIX only has one live connection to the syslog-ng server. The other tweak is to enforce tcp_wrapper operation on TCP connections only. This may be redundant code, but I honestly can't follow the source sufficiently to know whether the tcp_wrapper code is called for a udp connection. Since logging the fault condition for a udp connection uses up almost as many resources as actually processing the packet, and performing the tcp_wrapper call is overkill for every successful udp connection, it seemed not worth the bother to call the wrapper code for udp connections and only enforce TCP lockdowns. It's also probably possible to avoid the getsockopt() call by determining socket type from client->super somehow, but I wasn't sure exactly how to do this. Patch diff below. Comments welcome. Ted $ sudo diff -u afinet.c-1.6.0rc3.orig afinet.c-1.6.0rc3.patched --- afinet.c-1.6.0rc3.orig Tue Feb 24 09:20:01 2004 +++ afinet.c-1.6.0rc3.patched Tue Feb 24 10:10:09 2004 @@ -28,6 +28,8 @@ #include "cfgfile.h" #include "pkt_buffer.h" +#include <sys/socket.h> +#include <sys/types.h> #include <errno.h> #include <string.h> #include <assert.h> @@ -217,8 +219,13 @@ CAST(afinet_source, self, c); struct afsocket_source_connection *conn; UINT32 res; + int socklen,sockval; + + socklen=sizeof(sockval); + if ( ( getsockopt(client->super.fd, SOL_SOCKET, SO_TYPE, &sockval, &socklen) == 0 ) && + ( sockval == SOCK_STREAM ) ) { #if ENABLE_TCP_WRAPPER - { + { struct request_info req; request_init(&req, RQ_DAEMON, "syslog-ng", RQ_FILE, client->super.fd, 0); @@ -230,9 +237,19 @@ close_fd(&client->super, 0); return ST_OK | ST_GOON; } + } +#endif + +#ifdef SO_KEEPALIVE + sockval=1; socklen=sizeof(sockval); + if ( setsockopt(client->super.fd, SOL_SOCKET, SO_KEEPALIVE, &sockval, socklen) < 0 ) { + notice("setsockopt SO_KEEPALIVE failure during do_open_afinet_connection()"); + } else { + notice("setsockopt SO_KEEPALIVE Ok in do_open_afinet_connection()"); } - #endif + } + if (c->num_connections >= c->max_connections) { CAST(inet_address_info, inet_addr, client_addr); @@ -250,8 +267,6 @@ } return res; } - - } static int @@ -488,6 +503,17 @@ if (self->conn_fd) { return ST_OK | ST_GOON; +#ifdef SO_KEEPALIVE + if ( (self->super.flags & 0x0003) == AFSOCKET_STREAM ) { + int sockval=1; + + if ( setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &sockval, sizeof(sockval)) < 0 ) { + notice("setsockopt SO_KEEPALIVE failure during do_init_afinet_dest()"); + } else { + notice("setsockopt SO_KEEPALIVE Ok in do_init_afinet_dest()"); + } + } +#endif } else { io_callout(self->cfg->backend, $ ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

embedded newlines
by Chuck Berg 24 Feb '04

24 Feb '04

A message with an embedded newline will cause the next message to be mangled. For example: dream:~$ echo -ne '<27>test: test: foo\nfoo' | nc -u loghost 514 Produces this: Feb 17 12:38:53 dream test: foo Feb 17 12:38:54 xyzzy foo<38>Feb 17 12:38:54 sshd[18588]: Accepted publickey for nobody from 10.1.2.3 port 48651 ssh2 Where xyzzy is an innocent victim who just happened to send the next message. I see that this has been discussed on the list several times over the past few years. Is there no proper solution possible? Can't we just end the message at the end of the packet (as if it was always null/newline terminated)? It seems to me that no matter what the content of a message, it should not cause another message to be mangled.

2 1

Re:[syslog-ng]Logging not matched to filters
by Amodiovalerio Verde 24 Feb '04

24 Feb '04

Try reading http://www.balabit.com/products/syslog_ng/reference/logpath.html You can use a log statement with the fallback flag to achieve what you need. i.e. source ext { tcp(port(514) max-connections(1024)); udp(port(514));}; ...your destination statements... destination unmatched { file("/var/log/unmatched");}; ...your log statements... log { source(ext);destination(unmatched);flags(fallback);}; The last log statements will log all 'unmatched by a previous rule' to the file /var/log/unmatched. Hope it helps. Amodiovalerio [Hypo] Verde ---------- Initial Header ----------- From : syslog-ng-admin(a)lists.balabit.hu To : syslog-ng(a)lists.balabit.hu Cc : Date : Mon, 23 Feb 2004 14:27:52 +0100 Subject : [syslog-ng]Logging not matched to filters > Hi > > I have a lot of filters and they log fine. > > I was wounding if it possible to make a logging that matches the rest, > that isn't caught in a filter. > So that if syslog-ng receives a log and it doesn't match any of the > filters, it will log it into a file. > > That way i don't miss a logging from a device, it would simple be in this > separate file. > > - Henning > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

3 3

Recording Name filter
by Luigi Augello 24 Feb '04

24 Feb '04

OK I hope, at least, to help you with my suggest. I tried to debug the source, but I not know the source and I know the c language little. Is really so difficult to create a new macro? tanks Luigi

1 0

RE: [syslog-ng]host() regular expressions
by Treptow, Craig 23 Feb '04

23 Feb '04

>You can find something about regular expression (regexp) here >http://en.wikipedia.org/wiki/Regular_expression , >http://www.greenend.org.uk/rjk/2002/06/regexp.html , or just >search the web. > >The syslog-ng archive is browsable here : >https://lists.balabit.hu/pipermail/syslog-ng/ > >About your regexp, i have not tried it but probably you could write >something like ".*-fw-.*[13]$" Thanks. I got it working with: filter f_testnotify { (host(".*\-fw\-.*\-(1|3)")) and (match("denied")); }; I did find the link to browse the messages, but would rather have done an exhaustive search before posting my question. Thanks for your reply! Craig

1 0

host() regular expressions
by Treptow, Craig 23 Feb '04

23 Feb '04

Hi folks. I just started running syslog-ng in test mode while I work out some issues and experiment. The version is 1.6.2 running on Solaris 8. I'm attempting to match subsets of hostnames like this: corp1-fw-pbx-1 corp1-fw-pbx-2 indharrisburg1pa-fw-1 I've been trying to match firewalls with names ending in 1 or 3, but am having no success: filter f_testnotify { (host("/.*\-fw\-.*(1|3)")) and (match("denied")); }; The reference documentation doesn't seem to cover this in detail. If somebody could help me, or point me to some more detailed documentation, I would appreciate it. Also, are the archives to this list searchable? I haven't been able to find that either. Thanks, Craig

2 1

Rcording name filter III
by Luigi Augello 23 Feb '04

23 Feb '04

Tank fore the help I use a template to register through a pipe the macro's results into a Mysql Database. For me is sufficient the last Filter name . For the remote connections I use the TCP connections between client and server. Tanks Luigi

2 1

recording name filters II
by Luigi Augello 23 Feb '04

23 Feb '04

Hi at all and tanks to Bazsi for considering my suggestion interesting I think to create some different filter as some as: ... filter green { level(debug..notice); }; filter yellow { level(warning..error); }; filter red { level(alert..panic); }; ... filter auth_red{facility(auth), and filter(red) ; };(I dont have try but I think that the this syntax is right) ... I would register the name of the filter to have the immediacy of the level of thedanger I register the logs on a centralized Mysql database. Is more clear my target? Tanks Luigi

3 3

Syslog-ng & multiple "central" loghosts / HA environment
by Travis Kriza 23 Feb '04

23 Feb '04

Hi everyone, have an interesting question. Let's say I have 2 hosts, both running syslog-ng. These hosts also do a few other tasks and we want them to be highly available. We also don't want them to miss any syslog messages they will be receiving from other hosts. The one thing I can see doing is on the hosts that it is possible, to have them send their information to both syslog hosts. However, I don't think all the equipment supports this. (For instance, I think some cisco equipment supports only 1 syslog host --- please correct me if I am wrong). The other option I thought of was using heartbeat like you would with LVS. That way, you can share an ip and point all of the equipment to that ip. However, what I am trying to figure out, especially with this secondary scenario, is how do you get syslog-ng to report to the other host (for the duplicate/backup) without having syslog-ng push the messages to both of the syslog hosts "regular" ip's and, in doing so, prevent log messages from duplicating exponentially? Does this make sense? Thanks, Travis

4 3

$YEAR/$MONTH/$DAY generates always 2002/12/31
by Piotr Woliński 22 Feb '04

22 Feb '04

Hello, I have PLD Linux kernel 2.4.20 and syslog-ng-1.6.0-0.rc3.2 I put into into syslog-ng.conf lines (for test purpose): source net { udp(); }; destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log {source(net); destination(hosts); }; Now i can see directiories like that: /var/log/hosts/localhost/2003/2003/12/01 /var/log/hosts/localhost/2003/2003/12/02 that's OK. But also: /var/log/hosts/localhost/2002/12/31 Inside that dir files: auth, authpriv, local7. Dates inside above 3 files are OK. Anyone could help me? What's going on? Piotr Wolinski

6 12

syslog server do not log itself correctly
by Alessandro Fiorenzi 20 Feb '04

20 Feb '04

Hi, I have set up a wondefull log server with syslog-ng, where I record every host separately. suppose log server name is logserver.localdomain.it, the problem is that I get the logserver.localdomain.it directory but insede i get only messages and syslog file, if i fail a an authentication or what other I get no log about it. someone can help me? Thanks This is part of configuration file: options { long_hostnames(off); sync(0); # no line buffered: scriviamo subito # forse sui client si può rimuovere create_dirs(yes); log_fifo_size(30000); # aumentiamo log_fifo_size per evitare il drop dei pacchetti, use_fqdn(yes); # Inserisce gli host in formato Fully Qualified Domain Name # use_time_recvd(true); # nel caso di client con ora non sincronizzata }; source src { internal(); pipe("/proc/kmsg"); #file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.xxx.yyy) port(514) max-connections(100)); udp(ip(0.0.0.0) port(514)); }; destination authlog { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/uucp.log" owner("root") group("adm") perm(0640)); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio CLUSIT, ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" -------------------------------------------------------------------------

1 0

syslog-ng problem to added a source section
by Gerard Breiner 19 Feb '04

19 Feb '04

Hello, 1) I've just added a section source in my /etc/syslo-ng.conf . Le type de source is "hpux". its name is "vega" and ip address is : 122.167.44.35. here is the line : source vega { pipe("/dev/log"); udp(ip(122.167.44.35) port(514));}; I restart syslog-ng and the result is : Starting system logger: ..............Changing permissions on special file /dev/log Error opening file /dev/log for reading (No such device or address) I've checked the permissions of the file /dev/log on vega : ls -l /dev/log return : prw-rw-rw root root. 2) I've just added a section source in my /etc/syslo-ng.conf . Le type de source is "Linux". its name is "cerbere" and ip address is : 129.175.64.20. here is the line : source cerbere { unix-stream("/dev/log"); udp(ip(129.175.64.20) port(514)); internal(); }; I restart syslog-ng and the result is : Starting system logger: ..............io.c: bind_inet_socket() bind failed 129.175.64.17:514 Cannot assign requested address permissions is : srw-rw-rw- 1 root root. I' m wondering where is the problem. If you've a bright idea... Best regards Gérard Breiner Service Informatique Institut d'Astrophysique Spatiale 91405 Orsay Campus

1 0

RE: [syslog-ng]Is my default location broken?
by Madziarczyk, Jonathan 19 Feb '04

19 Feb '04

Ok, I see what's going on. If I have this conf: options { dir_perm(0755); perm(0644); chain_hostnames(no); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); dns_cache (yes); create_dirs (yes); keep_hostname(yes); }; source local { unix-dgram("/dev/log"); internal(); }; source s_udpmessages { udp(ip(0.0.0.0) port(514)); }; log { source(s_udpmessages); destination(d_mysql); }; *destinations removed* filter f_c4s1 { host("civic4south1"); }; log { source(s_udpmessages); filter(f_c4s1); destination(civic); }; log { source(s_udpmessages); destination(unsorted); flags(final, fallback); }; What I want to do is all messages that do not fit the host specified in filter f_c4s1 (or any other filter/log commands I put in) to be placed into the destination (unsorted) file. However my pipe to destination (my_sql) seems to be stopping that. How do I fix that so I can still log to My_Sql and my destination files without having to write rules for every item I'm logging? Thanks, JonM -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, February 19, 2004 1:12 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Is my default location broken? 2004-02-18, sze keltezéssel 19:40-kor Madziarczyk, Jonathan ezt írta: > I just migrated to a new box for syslog-ng and I'm trying to get the > "default" location to work for messages that don't meet any of my rules > yet. > > I've sent multiple syslog messages to the box but they don't seem to be > showing up. Any ideas? I do know that the "rules" messages are working > so udp is binding. > > Thanks, > JonM > > options { dir_perm(0755); perm(0644); chain_hostnames(no); > time_reopen (10); > log_fifo_size (1000); > long_hostnames (off); > use_dns (yes); > use_fqdn (no); > dns_cache (yes); > create_dirs (yes); > keep_hostname(yes); }; > > source local { unix-dgram("/dev/log"); internal(); }; > > source s_udpmessages { udp(ip(0.0.0.0) port(514)); }; > > destination unsorted { file("/logs/unsorted.log" perm(0777)); }; > log { source(s_udpmessages); destination(unsorted); flags(final, > fallback); }; what are those 'rules' messages you are referring to? try stracing the syslog-ng process to see whether it actually receives messages. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0