- syslog-ng - lists.balabit.hu

syslog-ng-1.4.17 configure problem
by Treptow, Craig 19 Feb '04

19 Feb '04

Hi folks. I downloaded syslog-ng to evaluate it and ran into a problem with the configure script that was included. I already downloaded and build libol-0.3.9. When I went to configure syslog-ng, it kept complaining that the correct version of libol could not be found. I believe I tracked this down to an error in the configure script that flagged 0.3.9 as an invalid version due to the 9 < 23 (required version being at least 0.2.23). I believe I fixed this, but was not sure where to post it. I do not subscribe to this list yet, so forgive me if this has been identified before. Here is the diff: us091:syslog-ng-1.4.17 $ diff configure configure.orig 2632,2633c2632 < $ "$LIBOL_MINOR" -eq "$LIBOL_REQ_MINOR" -a \ < "$LIBOL_PATCH" -lt "$LIBOL_REQ_PATCH" $; then --- > "$LIBOL_PATCH" -lt "$LIBOL_REQ_PATCH"; then Thanks, Craig

2 1

Problem in host() filter
by Salim Pathan 19 Feb '04

19 Feb '04

hi, i'm working on a project based on syslog-ng since last one year...i'm using "host()" filter function to separate logs coming from different hosts... "use_dns()" option is set to "NO",which means the incoming logs will be filtered based on IP address in place of hostname....now the problem is that syslog-ng is unable to separate logs coming from host IP "31.2.2.5" and "31.2.2.51"..... how can i separate logs from hosts having similar IP addresses, as in above case? thanks, salim. --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.581 / Virus Database: 368 - Release Date: 2/9/2004

2 1

recording filter names
by Luigi Augello 19 Feb '04

19 Feb '04

Hi at all this is my firs messag to the list syslog-ns is a wonderful tools, but I have the necessity to record the name of the filter that I create on the configuration file. I have tried a macro for this scope but dosen't exit.anyone have a suggestion thanks Luigi

2 1

parse error on configuration file
by Laurent Mesuré 19 Feb '04

19 Feb '04

Hi, I'm using syslog-ng 1.6 on a Mandrake Linux server. I have the follosing error while starting: parse error reading configuration file, exiting. (line 42) I can't find the error. Here is my configuration file: ------------------------START OF FILE------------------------ # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 10 Aug 2002 # - for Red Hat 7.3 # - totally do away with klogd # - add message "kernel:" as is done with klogd. # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 22 Aug 2002 # - use the log_prefix option as per Balazs Scheidler's email # options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_tty12 { file("/dev/tty12"); }; destination d_mesg { file("/var/log/messages"); }; destination d_secure { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron_info { file("/var/log/cron/info"); }; destination d_cron_warnings { file("/var/log/cron/warnings"); }; destination d_cron_errors { file("/var/log/cron/errors"); }; destination d_syslog { file("/var/log/syslog"); }; destination d_user { file("/var/log/user.log"); }; destination d_auth { file("/var/log/auth.log"); ); <-------- here is line 42 destination d_mail_info { file("/var/log/mail/info"); ); destination d_mail_warnings { file("/var/log/mail/warnings"); ); destination d_mail_errors { file("/var/log/mail/errors"); ); destination d_kernel_info { file("/var/log/kernel/info"); ); destination d_kernel_warnings { file("/var/log/kernel/warnings"); ); destination d_kernel_errors { file("/var/log/kernel/errors"); ); destination d_lpr_info { file("/var/log/lpr/info"); ); destination d_lpr_warnings { file("/var/log/lpr/warnings"); ); destination d_lrp_errors { file("/var/log/lpr/errors"); ); destination d_news_notice { file("/var/log/news/notice"); ); destination d_news_crit { file("/var/log/news/crit"); ); destination d_news_err { file("/var/log/news/err"); ); destination d_daemon_info { file("/var/log/daemons/info"); ); destination d_daemon_warnings { file("/var/log/daemons/warnings"); ); destination d_daemon_errors { file("/var/log/daemons/errors"); ); destination d_spooler { file("/var/log/spooler"); ); destination d_explain { file("/var/log/explainations"); ); destination d_postgresql { file("/var/log/postgresql"); ); destination d_mlal { usertty("*"); }; filter f_auth { facility(auth,authpriv); }; filter f_syslog { not facility(auth,authpriv); }; filter f_user { facility(user); }; filter f_messages { level(info) or not facility(mail,news,authpriv); }; filter f_secure { facility(authpriv); }; filter f_mail_info { facility(mail) and (level(debug,info,notice)); }; filter f_mail_warnings { facility(mail) and (level(warn)); }; filter f_mail_errors { facility(mail) and (level(err)); }; filter f_cron_info { facility(cron) and (level(debug,info,notice)); }; filter f_cron_warnings { facility(cron) and (level(warn)); }; filter f_cron_errors { facility(cron) and (level(err)); }; filter f_kernel_info { facility(kern) and (level(debug,info,notice)); }; filter f_kernel_warnings { facility(kern) and (level(warn)); }; filter f_kernel_errors { facility(kern) and (level(err)); }; filter f_lpr_info { facility(lpr) and (level(debug,info,notice)); }; filter f_lpr_warnings { facility(lpr) and (level(warn)); }; filter f_lpr_errors { facility(lpr) and (level(err)); }; filter f_news_info { facility(news) and (level(debug,info,notice)); }; filter f_news_crit { facility(news) and (level(crit)); }; filter f_news_err { facility(news) and (level(err)); }; filter f_daemon_info { facility(daemon) and (level(debug,info,notice)); }; filter f_daemon_crit { facility(daemon) and (level(warn)); }; filter f_daemon_err { facility(daemon) and (level(err)); }; filter f_emerg { level(emerg); }; filter f_spooler { facility(uucp) or (facility(news) and level(crit)); }; filter f_boot { facility(local7); }; filter f_explanation { facility(local1); }; filter f_postgresql { facility(local0); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_auth); destination (d_auth); }; log { source(s_sys); destination(d_syslog); }; log { source(s_sys); filter(f_user); destination (d_user); }; log { source(s_sys); filter(f_messages); destination(d_mesg); }; log { source(s_sys); filter(f_secure); destination(d_secure); }; log { source(s_sys); filter(f_mail_info,f_mail_warnings,f_mail_errors); destination(d_mail); }; log { source(s_sys); filter(f_emerg); destination(d_mlal); }; log { source(s_sys); filter(f_spooler); destination(d_spooler); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_mail_info); destination(d_mail_info); }; log { source(s_sys); filter(f_mail_warnings); destination(d_mail_warnings); }; log { source(s_sys); filter(f_mail_errors); destination(d_mail_errors); }; log { source(s_sys); filter(f_cron_info); destination(d_cron_info); }; log { source(s_sys); filter(f_cron_warnings); destination(d_cron_warnings); }; log { source(s_sys); filter(f_cron_errors); destination(d_cron_errors); }; log { source(s_sys); filter(f_kernel_info); destination(d_kernel_info); }; log { source(s_sys); filter(f_kernel_warnings); destination(d_kernel_warnings); }; log { source(s_sys); filter(f_kernel_errors); destination(d_kernel_errors); }; log { source(s_sys); filter(f_lpr_info); destination(d_lpr_info); }; log { source(s_sys); filter(f_lpr_warnings); destination(d_lpr_warnings); }; log { source(s_sys); filter(f_lpr_errors); destination(d_lpr_errors); }; log { source(s_sys); filter(f_news_info); destination(d_news_info); }; log { source(s_sys); filter(f_news_crit); destination(d_news_crit); }; log { source(s_sys); filter(f_news_err); destination(d_news_err); }; log { source(s_sys); filter(f_daemon_info); destination(d_daemon_info); }; log { source(s_sys); filter(f_daemon_warnings); destination(d_daemon_warnings); }; log { source(s_sys); filter(f_daemon_errors); destination(d_daemon_errors); }; log { source(s_sys); filter(f_postgresql); destination(d_postgresql); }; -------------------------END OF FILE-------------------------

2 1

Is my default location broken?
by Madziarczyk, Jonathan 19 Feb '04

19 Feb '04

I just migrated to a new box for syslog-ng and I'm trying to get the "default" location to work for messages that don't meet any of my rules yet. I've sent multiple syslog messages to the box but they don't seem to be showing up. Any ideas? I do know that the "rules" messages are working so udp is binding. Thanks, JonM options { dir_perm(0755); perm(0644); chain_hostnames(no); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); dns_cache (yes); create_dirs (yes); keep_hostname(yes); }; source local { unix-dgram("/dev/log"); internal(); }; source s_udpmessages { udp(ip(0.0.0.0) port(514)); }; destination unsorted { file("/logs/unsorted.log" perm(0777)); }; log { source(s_udpmessages); destination(unsorted); flags(final, fallback); };

2 1

Re: [syslog-ng]Cisco CSS Logging
by Gary.Metelitsa＠us.hsbc.Com 19 Feb '04

19 Feb '04

Here are some syslog message examples and a snoop I ran: CSS syslog-ng message: 2004.02.18 17:32:05 7 local7 info 7264 NETMAN-6: CLMcmd: sho run service ,gmetelitsa@local Router syslog-ng message: 2004.02.18 17:37:07 NYPRRT10 local7 info 1354469: SLOT 1:Feb 18 17:37:05.268 EST: %SEC-6-IPACCESSLOGP: list 112 denied tcp 127.0.0.1(80) -> 205.241.15.99 When I snoop the line I get this: I didn't include the IP header and UDP header as I don't think its pertinent. CSS syslog payload message: SYSLOG: "<190>FEB 18 11:04:23 7/1 7187 NETMAN-6: CLMcmd: show run own" Router payload message: SYSLOG: "<190>1341226: SLOT 1:Feb 18 11:12:43.016 EST: %SEC-6-IPACCES" The payload does not contain the source IP address for either the CSS or for a router, however, syslog-ng gets the source address/hostname of the router but not the CSS. Also, I see that the message payload structure is quite different between a router and CSS. Nate Campi <nate(a)campin.net>@lists.balabit.hu on 18 Feb 2004 15:04 Please respond to syslog-ng(a)lists.balabit.hu Sent by: syslog-ng-admin(a)lists.balabit.hu To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Cisco CSS Logging **************************************************************************** This message originated from the Internet. Its originator may or may not be who they claim to be and the information contained in the message and any attachments may or may not be accurate. **************************************************************************** On Wed, Feb 18, 2004 at 01:21:19PM -0500, Gary.Metelitsa(a)us.hsbc.Com wrote: > I'm running syslog-ng 1.6.0rc.1 It is not able to pick up the IP address > coming from a Cisco Content Switch (formerly Arrowpoint) generated syslog > message. All other routers and switches have their ip address. Regular > syslog picks up the IP address field. Has anyone come across this? Gary, Please supply a log example, I'm not sure what you mean. -- Nate IMHO one should have to pass a test on DNS before publishing a CNAME. ;) - Greg White _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ************************************************************************ This E-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return E-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. ************************************************************************

2 1

Cisco CSS Logging
by Gary.Metelitsa＠us.hsbc.Com 18 Feb '04

18 Feb '04

I'm running syslog-ng 1.6.0rc.1 It is not able to pick up the IP address coming from a Cisco Content Switch (formerly Arrowpoint) generated syslog message. All other routers and switches have their ip address. Regular syslog picks up the IP address field. Has anyone come across this? Thanks, Gary ************************************************************************ This E-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return E-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. ************************************************************************

2 1

Bug in unix_stream/dgram() dest drivers 1.6.0rc4
by Andreas Schulze 18 Feb '04

18 Feb '04

Hi Bazi, it seems I've found a bug in the unix_stream/unix_dgram destination drivers. The problem is, that running sysng with something like destination d_stream { unix-stream("/tmp/stream_sock"); }; or destination d_dgram { unix-dgram("/tmp/dgram_sock"); }; it doesn't create the socket in the file system, so the connect() fails. Seems that bind_unix_socket() is never called. The appended trace shows, that there isn't a bind() between so_socket() = 4 and connect(4) As far as I know, bind() must be called before connect() to create the socket in the local filesys. It should be removed via unlink() after all work is done. Feedback or a hot-fix is very wellcome. Thanks a lot --Andreas Debug message: > syslog-ng -d -v > io.c: connecting using fd 4 > connecting fd 4, unixaddr: /tmp/dgram_sock > Error connecting to AF_UNIX(/tmp/dgram_sock): Bad file number > Error initializing configuration, exiting. Strace: > 18128: so_socket(1, 1, 0, "", 1) = 4 > 18128: fcntl(4, F_GETFL, 0x00000000) = 2 > 18128: fstat64(4, 0xFFBEF348) = 0 > 18128: getsockopt(4, 65535, 8192, 0xFFBEF448, 0xFFBEF440, 0) = 0 > 18128: fstat64(4, 0xFFBEF348) = 0 > 18128: getsockopt(4, 65535, 8192, 0xFFBEF448, 0xFFBEF444, 0) = 0 > 18128: setsockopt(4, 65535, 8192, 0xFFBEF448, 4, 0) = 0 > 18128: fcntl(4, F_SETFL, 0x00000082) = 0 > 18128: fcntl(4, F_SETFD, 0x00000001) = 0 > io.c: connecting using fd 4 > 18128: write(2, " i o . c : c o n n e c".., 28) = 28 > connecting fd 4, unixaddr: /tmp/dgram_sock > 18128: write(2, " c o n n e c t i n g f".., 47) = 47 > 18128: connect(4, 0xFFBEF4A8, 110, 1) Err#2 ENOENT > 18128: close(4) = 0 > 18128: close(4) Err#9 EBADF > Error connecting to AF_UNIX(/tmp/dgram_sock): Bad file number > 18128: write(2, " E r r o r c o n n e c".., 66) = 66 > Error initializing configuration, exiting. > 18128: write(2, " E r r o r i n i t i a".., 43) = 43 > 18128: llseek(0, 0, SEEK_CUR) = 41406 > 18128: lwp_mutex_wakeup(0xFF3E7CB0) = 0 > 18128: lwp_mutex_lock(0xFF3E7CB0) = 0 > 18128: lwp_sigredirect(0, SIGWAITING, 0x00000000) Err#22 EINVAL > 18128: _exit(2) -- Best regards --Andreas Schulze [phone: +49.5246.80.1275, fax: +49.5246.80.2275] | I believe, it was Dennis Ritchie who said something like: | "C is rarely the best language for a given task, | but it's often the second-best". | The implication being that: "[...]" | http://www.ioccc.org/1990/dds.c

3 5

delimiters
by Dylan Bouterse 17 Feb '04

17 Feb '04

Is there a way to insert a delimiter into the incoming message between major fields, preferably on a per host basis? Dylan

1 0

host() filter not working properly
by Salim Pathan 17 Feb '04

17 Feb '04

hi , host() filter do not differentiate between logs coming from "31.1.4.5" and "31.1.4.51"...i'm using use_dns(NO).... any help? regds, salim --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.581 / Virus Database: 368 - Release Date: 2/9/2004

1 0

missing flex?
by Christoph.Eckart＠COMPUTACENTER.COM 17 Feb '04

17 Feb '04

hi, i'm trying to install syslog-ng1.6.2 with libol0.3.13. libol works fine - my problem is syslog-ng. i get the error below after 'make'. i thought flex was missing but after installing flex i got the same error. i read in the syslog-ng archive about a similar problem and someone wrote that the problem ist the line "LEXLIB" in the "src/Makefile" which should be set to "-lfl" but i don't know what i have to change the line to. my line looks like: "LEX = /usr/local/src/syslog-ng/missing flex" any suggestions? "./configure" loading cache ./config.cache checking for a BSD compatible install... (cached) /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... (cached) yes checking for working aclocal-1.4... missing checking for working autoconf... missing checking for working automake-1.4... missing checking for working autoheader... missing checking for working makeinfo... missing checking whether build environment is sane... yes checking for gcc... (cached) gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ANSI C... (cached) none needed checking for bison... (cached) bison -y checking how to run the C preprocessor... (cached) gcc -E checking for flex... (cached) /usr/local/src/syslog-ng/missing flex checking for flex... (cached) /usr/local/src/syslog-ng/missing flex checking for yywrap in -ll... (cached) no checking lex output file root... (cached) lex.yy checking whether yytext is a pointer... (cached) no checking whether make sets ${MAKE}... (cached) yes checking for ANSI C header files... (cached) yes checking for malloc.h... (cached) yes checking for unistd.h... (cached) yes checking for door.h... (cached) no checking for stropts.h... (cached) yes checking for sys/strlog.h... (cached) no checking for stdarg.h... (cached) yes checking for sys/klog.h... (cached) yes checking for arpa/nameser.h... (cached) yes checking for tcpd.h... (cached) yes checking for working const... (cached) yes checking whether time.h and sys/time.h may both be included... (cached) yes checking for modern utmp... (cached) yes checking whether to compile klogctl... yes checking size of short... (cached) 2 checking size of int... (cached) 4 checking size of long... (cached) 4 checking for I_CONSLOG... (cached) no checking for O_LARGEFILE... (cached) yes checking for res_init in <resolv.h>... (cached) yes checking for working alloca.h... (cached) yes checking for alloca... (cached) yes checking for vprintf... (cached) yes checking for res_init in -lresolv... (cached) no checking for __res_init in -lresolv... (cached) yes checking for door_create in -ldoor... (cached) no checking for socket in -lsocket... (cached) no checking for gethostbyname in -lnsl... (cached) yes checking for select... (cached) yes checking for snprintf... (cached) yes checking for vsnprintf... (cached) yes checking for strerror... (cached) yes checking for inet_aton... (cached) yes checking for strncpy... (cached) yes checking for getutent... (cached) yes checking for getopt_long... (cached) yes checking for strcasecmp... (cached) yes checking for strptime... (cached) yes checking for TCP wrapper library... (cached) -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking libol version >= 0.3.13... ok creating ./config.status creating Makefile creating src/Makefile creating src/tests/Makefile creating doc/Makefile creating doc/sgml/Makefile creating contrib/Makefile creating syslog-ng.spec creating src/config.h src/config.h is unchanged "make" Making all in src make[1]: Entering directory `/usr/local/src/syslog-ng/src' make all-recursive make[2]: Entering directory `/usr/local/src/syslog-ng/src' Making all in . make[3]: Entering directory `/usr/local/src/syslog-ng/src' gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lnsl -lresolv /usr/local/lib/libol.a -lnsl cfg-lex.o(.text+0x3ba): In function `yylex': /usr/local/src/syslog-ng/src/lex.yy.c:1054: undefined reference to `yywrap' cfg-lex.o(.text+0xa07): In function `input': /usr/local/src/syslog-ng/src/lex.yy.c:1403: undefined reference to `yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng/src' make: *** [all-recursive] Error 1 Best regards Christoph Eckart

1 0

splitting logs on central log host?
by Jeffrey Forman 16 Feb '04

16 Feb '04

I have just setup syslog-ng to log about 15 machines to a central log host, and i absolutely love it, but i have a question. right now i'm splitting the logs like this on the loghost destination hosts { file("/mnt/backups/logs/$HOST/$YEAR/$MONTH/$FACILITY$YEAR$MONTH" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; but that only splits the logs via facility. there are more logs being written on the client log machines, which are configured like this destination messages { file("/var/log/messages"); }; destination ssh { file("/var/log/ssh.log"); }; destination cron { file("/var/log/cron.log"); }; destination auth { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog.log"); }; destination xinetd { file("/var/log/xinetd.log"); }; destination rsync { file("/var/log/rsync.log"); }; destination cfengine { file("/var/log/cfengine.log"); }; filter f_ssh { program("sshd"); }; filter f_cron { program("cron"); }; filter f_auth { program("su") or program("sudo"); }; filter f_syslog { program("syslog-ng"); }; filter f_xinetd { program("xinetd"); }; filter f_rsync { program("rsyncd"); }; filter f_cfengine { program("cfengine"); }; filter f_messages { ...}; // with messages getting everything else log { source(src); filter(f_ssh); destination(ssh); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_auth); destination(auth); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_xinetd); destination(xinetd); }; log { source(src); filter(f_rsync); destination(rsync); }; log { source(src); filter(f_cfengine); destination(cfengine); }; log { source(src); filter(f_messages); destination(messages); }; what i would like to do is log the files as they are being logged locally on the client machines, the same way on the loghost. do i have to change the destination? how do i get the same file names, etc, that are being logged, but on the loghost? any help is greatly appreciated. -Jeffrey -- -------------------------- Jeffrey Forman Gentoo Infrastructure Team jforman(a)gentoo.org --------------------------

3 3

splitting logs on central log host?
by Jeffrey Forman 14 Feb '04

14 Feb '04

I have just setup syslog-ng to log about 15 machines to a central log host, and i absolutely love it, but i have a question. right now i'm splitting the logs like this on the loghost destination hosts { file("/mnt/backups/logs/$HOST/$YEAR/$MONTH/$FACILITY$YEAR$MONTH" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; but that only splits the logs via facility. there are more logs being written on the client log machines, which are configured like this destination messages { file("/var/log/messages"); }; destination ssh { file("/var/log/ssh.log"); }; destination cron { file("/var/log/cron.log"); }; destination auth { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog.log"); }; destination xinetd { file("/var/log/xinetd.log"); }; destination rsync { file("/var/log/rsync.log"); }; destination cfengine { file("/var/log/cfengine.log"); }; filter f_ssh { program("sshd"); }; filter f_cron { program("cron"); }; filter f_auth { program("su") or program("sudo"); }; filter f_syslog { program("syslog-ng"); }; filter f_xinetd { program("xinetd"); }; filter f_rsync { program("rsyncd"); }; filter f_cfengine { program("cfengine"); }; filter f_messages { ...}; // with messages getting everything else log { source(src); filter(f_ssh); destination(ssh); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_auth); destination(auth); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_xinetd); destination(xinetd); }; log { source(src); filter(f_rsync); destination(rsync); }; log { source(src); filter(f_cfengine); destination(cfengine); }; log { source(src); filter(f_messages); destination(messages); }; what i would like to do is log the files as they are being logged locally on the client machines, the same way on the loghost. do i have to change the destination? how do i get the same file names, etc, that are being logged, but on the loghost? any help is greatly appreciated. -Jeffrey -- -------------------------- Jeffrey Forman Gentoo Infrastructure Team jforman(a)gentoo.org --------------------------

1 0

test tool: split/forward syslog from production old-syslogd to syslog-ng?
by David Carmean 12 Feb '04

12 Feb '04

I'm trying to figure out how to configure/test a new syslog-ng system without disrupting my current old-style syslogd on a Solaris central logserver. The challenges are: preserving level/facility and perserving the originating host IP/name; thus a simple "*.debug @newserver" doesn't work. I *think* I can come up with a perl script to take nc (netcat) -l -v output, re-write the messages to contain the original hostname, and use netcat again to forward it off to the new server under development. e.g.: > sudo ./nc -l -u -p 514 -v listening on [any] 514 ... connect to [172.19.248.122] from eponymous.lab.netapp.com [172.19.248.40] 3357 <0>foofdsasdfasdf and rewrite that to <0>${timedate} 172.19.248.40 foofdsasdfasdf and ship it off. But I was wondering if anyone had already built such a tool....?

2 1

RE: syslog daemon
by Chance, Larry 11 Feb '04

11 Feb '04

I guess I should have categorized that and said 'any Windows based Syslog Daemon ?'. We don't any Unix here. Thanks.

1 0

Syslog Daemon Vendors
by Chance, Larry 11 Feb '04

11 Feb '04

Can anyone recommend a Syslog Daemon that works with the Computer Associates Unicenter products for network management? Thanks.

1 0

Sending Email via syslog-ng
by Wilhelm.Greiner＠vaps.de 11 Feb '04

11 Feb '04

Hi, im trying to send email with syslog-ng, i have configurations like this: destination ruf_mich_an { program("/usr/local/sbin/log_to_mail.pl"); }; filter ruf_mich_an2 { facility(cron); }; log { source(net); filter(ruf_mich_an2); destination(ruf_mich_an); }; or things like: destination d_cachos_dns_ldap_errors2 { program("/usr/local/sbin/log_to_mail.pl"); }; filter f_cachos_dns_error { match("Connection refused on DNS lookup to"); }; log { source(net); filter(f_cachos_dns_error); destination(d_cachos_dns_ldap_errors2); }; But there comes no mail, that perl script (see below) works correkt on the Console (takes input for the body from stdin). But, when i restart syslog-ng, i become 4 Mails, but with only "761" inside... Is there any "buffer" available? Means: will i receive a Mail for _every_ LogEntry, or can i say, all logentries in a defined time (minute or so). But i also can do that in the Mail Script. ##################################################### #!/usr/bin/perl #s/^<[\d]{1,2}>//; use Socket; $proto = getprotobyname('tcp'); $port = 25; $address = 192.168.3.12; socket(Socket_Handle, PF_INET, SOCK_STREAM, $proto); $sin = sockaddr_in($port,$address); connect(Socket_Handle,$sin) || die ("Failed $!:"); select(Socket_Handle); $|=1; select(STDOUT); print Socket_Handle "ehlo test\n"; print Socket_Handle "mail from: me\(a)myhouse.net\n"; print Socket_Handle "rcpt to: irgendwer\(a)myhouse.net\n"; print Socket_Handle "data\n"; print Socket_Handle "subject: $_\n\n"; print Socket_Handle "$_\r\n"; print Socket_Handle ".\r\n"; print Socket_Handle "quit\n"; while(<Socket_Handle>) { print $_; } close(Socket_Handle);

3 2

RE: [syslog-ng]Syslog-ng, Mysql, and Cisco routers
by Michael Earls 07 Feb '04

07 Feb '04

Can you email the rest of your syslog-ng config, All I see is a log file called /var/log/cisco, How do you import this into the mysql database? When you issue show logging on the cisco you should see how many message were sent to the log server and type of message sent. ibr01>sh logg Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns) Console logging: level debugging, 1126 messages logged Monitor logging: level debugging, 2 messages logged Buffer logging: level debugging, 1126 messages logged Exception Logging: size (8192 bytes) Trap logging: level debugging, 481 message lines logged Logging to 192.168.1.11, 481 message lines logged The other thing is to run tdpdump on the log server with a filter for only that router. tcpdump host 'router_ip' You could also debug ip packets on the router, instead of a debug all, ! ip access-list 199 permit ip host 'log server ip' host 'router ip' ip access-list 199 permit ip host 'router ip' host 'log server ip' ! deb ip packet 199 detail ! term mon ! undebug all michael Michael Earls Systems Analyst, Information Services Cincinnati Children's Hospital Medical Center Phone: 513-636-5882 Phone: 1-800-344-2462 PGP Info: KeyID 0x5EB59708 Fingerprint 108B A1D8 76F5 08A8 501A F28C 86F4 4BC5 5EB5 9708 >>> dedelman(a)iname.com 02/06/04 09:19PM >>> This may be a problem of somewhat different semantics between Cisco IOS and syslog-ng configuration speak. In IOS logging trap debug says send all messages of priority debug (the lowest possible) and higher to the logging host (10.1.1.91 in this case.) Syslog-ng syntax says if you say priority debug you mean only that priority. I suspect that if you enable yourself on a *test* router and turn on some debugging you will see the messages in the log file. BTW, unless you are attached directly to the router console port, you will need to issue the IOS command term monitor in order to see the debug output locally. Be real careful about debugging a router under a heavy load since it can quickly turn into a self-eating doughnut and disappear into its own hole :( --Dave -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Kevin Rothwell Sent: Friday, February 06, 2004 2:03 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Syslog-ng, Mysql, and Cisco routers Hello, I have syslog-ng installed on all of my Linux boxes, logging to a mysql database. (This works) I would like to configure one of my Cisco routers to send syslog messages to this database as well. I have modified my syslog-ng.conf file on the mysql database box to include the following lines: Facility filters filter f_cisco { facility(local7) and priority(debug); }; destination d_cisco {file(" file("/var/log/cisco")' }; log { source(net); filter(f_cisco); destination(d_cisco); }; I have issued the following commands on my router: logging 10.1.1.91 logging facility local7 logging trap debug logging on Needless to say, it isn't working. Why else would I be sending this message. Is there anyone logging their Cisco syslog messages to a mysql database? If so, how can I do it on Redhat Linux? Any help would be greatly appreciated. Thanks. Kevin Rothwell _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html --- [This E-mail scanned for viruses by ezaccess.net] _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Syslog-ng, Mysql, and Cisco routers
by Kevin Rothwell 07 Feb '04

07 Feb '04

Hello, I have syslog-ng installed on all of my Linux boxes, logging to a mysql database. (This works) I would like to configure one of my Cisco routers to send syslog messages to this database as well. I have modified my syslog-ng.conf file on the mysql database box to include the following lines: Facility filters filter f_cisco { facility(local7) and priority(debug); }; destination d_cisco {file(" file("/var/log/cisco")' }; log { source(net); filter(f_cisco); destination(d_cisco); }; I have issued the following commands on my router: logging 10.1.1.91 logging facility local7 logging trap debug logging on Needless to say, it isn't working. Why else would I be sending this message. Is there anyone logging their Cisco syslog messages to a mysql database? If so, how can I do it on Redhat Linux? Any help would be greatly appreciated. Thanks. Kevin Rothwell

3 2

Network masks
by Henning Markussen 06 Feb '04

06 Feb '04

Hi We use syslog-ng - and it is a cool tool. But we have a lot of systems that need to log to our syslog-ng server, and they don't all have to log into there own file Is it possible to make a host mask that matches ex. 10.1.1.0/28 or 10.1.1.130/28 ? The goal is to filter all 10.1.1.0/28 into one file and 10.1.1.130/28 into another file. - Henning

2 1

Syslog-File Analyser
by MGruber＠metzler.com 06 Feb '04

06 Feb '04

Hi! Perhaps it is a little bit out of topic. We are using syslog-ng in a Central-Syslog-Server environment, with very good success, recently my boss asked for an analysing-tool for syslog-Messages. He would like to have a fast browser, which searches thru our Syslog-Files, we are not logging into a Database, for specific occurences of Errormessages, perhaps with the possibility of an statistic evaluation, this should only be as forensic analysis Any clues or hints, because grep/find or exporting an searching with UltraEdit doesnt satisfy him :-( Thanx in Advance Matthias Gruber

2 1

TCP interconnection between syslog-ng Servers
by Rule, Ted 06 Feb '04

06 Feb '04

I have a requirement to interconnect a few syslog-ng Servers. The overall idea is to provide a sub-master syslog server per building, and then have all the sub-master's log up to the master syslog server in the main site. The hope is to reduce the impact on total log visibility of loss of either the master server or the master server's site. Two basic questions arise from this, though the 2nd has some sub-clauses: 1) Is there a preferred TCP port and formatting to be used on the syslog-ng interconnect? I'd like to conform as much as is practicable with RFCs and so on, but of course TCP Port 514 is already taken by rsh as noted in the syslog-ng documentation. Some of the more recent Internet Drafts make reference to XML style formatting on the syslog stream, but I don't think that's supported in syslog-ng as yet. 2) What is the overall impact on the sub-master of a sudden death of the master? Are there any deadlocks involved here where the outbound stream from the sub-master pumps TCP data to a non-existent host and the syslog-ng client hangs waiting for TCP session to complete? Does the syslog-ng client and/or the syslog-ng server set TCP_KEEPALIVE flag on the socket to ensure that the socket eventually gets closed if the master ( OR slave ) is dead for an extended period? FWIW, I'm running version 1.6.0rc3 at present. Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Timezone problem with syslog-ng
by "Pedroche, Raúl" 04 Feb '04

04 Feb '04

Greetings. First of all, hello to everybody as this is my first post. I am not too sure if this falls into the "problems" or "feature requests" section. The matter is I have noticed that syslog-ng is using UTC instead of local time, as I'd like it to do. I am using the "use_time_recv" option and server is configured for MET timezone (BTW it is Solaris 9). This is affecting both filenames (I am using variations of .../$WEEKDAY/$HOST and yesterday files have a timestamp of "dec 19 00:59" local time) and the file contents (i.e. first columns). syslog-ng version is 1.6.0rc4. I must, anyway, congratulate the authors: we have been running syslog-ng for quite a while (in a server configured with UTC :>) and it has been proved being very effective (it is a very dated host being log server for a lot of networking devices, some of them generating more than 1GB logs/day and has a 0.05-0.08 load). Regards, Raúl Pedroche COLT Telecom Av. Manoteras, 42 - Calle 3, 28050 Madrid Teléfono de soporte técnico: 901 88 99 88 Para llamadas desde el extranjero: +34 91 320 60 18 Email: raul.pedroche(a)colt-telecom.es www.colt.net ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

3 3

RE: [syslog-ng]Re: Timezone problem with syslog-ng
by "Pedroche, Raúl" 04 Feb '04

04 Feb '04

Greetings. That seemed to be the problem. I was using the init.d.solaris file included in the distribution and I modified it adding a . /etc/TIMEZONE before the "$DAEMON $OPTIONS..." line. It is now working flawlessly. I assume nother alternative would be to use "TZ=whatever $DAEMON...". Anyway, sorry for not sharing this before. Regards, Raúl Pedroche COLT Telecom Systems Operations Customer Support Email: raul.pedroche(a)colt-telecom.es www.colt.net -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Tuesday, February 03, 2004 5:16 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Re: Timezone problem with syslog-ng On Tue, Feb 03, 2004 at 04:53:24PM +0100, Roberto.Re(a)cu.mi.it wrote: > [iso-8859-1] "Pedroche, Ra???l" writes: > > > The matter is I have noticed that syslog-ng is using UTC instead of local > >time, as I'd like it to do. I am using the "use_time_recv" option and > >server > >is configured for MET timezone (BTW it is Solaris 9). > > I have the same problem on linux RH9. > I dont understand how to solve it ? Any Idea? You might be starting syslog-ng from an environment where all the environmental variables are scrubbed, I've had similar things happen. How are you starting syslog-ng? -- Nate "The IBM compatible sector has not yet recognized that 95% of computer usage is devoted to experimenting with different fonts and character styles in documents." - Reiner, Ron _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

1 0

syslog-ng daemon meltdown
by vj23x＠netscape.net 29 Jan '04

29 Jan '04

Ran into this meltdown, thought it would be interesting to the list. Running Syslog-ng 1.6RC3 on Solaris 2.8. 400 mHz dual processor Sun box. This is a somewhat sanitized version of the actual messages. From /var/adm/messages: Jan 27 15:23:44 nms1 syslog-ng[5651]: STATS: dropped 0 Jan 27 16:06:09 nms1 syslog-ng[5651]: io.c: do_write: write() failed (errno 28), No space left on device Jan 27 16:06:09 nms1 syslog-ng[5651]: pkt_buffer::do_flush(): Error flushing data Jan 27 16:06:09 nms1 ufs: [ID 845546 kern.notice] NOTICE: alloc: /data: file system full Jan 27 16:06:09 nms1 syslog-ng[5651]: io.c: do_write: write() failed (errno 28), No space left on device Jan 27 16:06:09 nms1 syslog-ng[5651]: pkt_buffer::do_flush(): Error flushing data ... [These messages repeat for a few minutes, until suddenly massive drops] [This was strange to me, because the /data filesystem did not appear to actually fill up. I never did anything to clear it, and I had a few hundred MB free space when I looked at the server after the failure the next day.] Jan 27 16:23:44 nms1 syslog-ng[5651]: STATS: dropped 525887 Jan 27 17:23:44 nms1 syslog-ng[5651]: STATS: dropped 1897106 Jan 27 18:23:44 nms1 syslog-ng[5651]: STATS: dropped 1915287 ... [about 2M drops every hour until midnight] Jan 28 00:23:44 nms1 syslog-ng[5651]: STATS: dropped 46122 [syslog-ng continues dropping messages at our "normal" rate. I.e. the flood is over at around midnight.] From the network device syslogs: [this is the critter that was flooding us] Jan 27 14:19:09 content1 US/Eastern:%SYS-2-CE: SCSI I/O error: POSSIBLE BAD DISK -- device 0x807, sector 4672 Jan 27 14:19:09 content1 US/Eastern:%SYS-2-CE: SCSI I/O error: POSSIBLE BAD DISK -- device 0x808, sector 768 ... [this continues for almost 3 more hours, hundreds of various sector errors per second] Finally, syslog-ng "freezes up" with these last two/three messages: (After 17:06:09, syslog-ng dropped all messages. Syslog-ng logged nothing more to the files until I stopped and restarted syslog-ng daemon.) Jan 27 17:06:09 content1 US/Eastern:%SYS-2-CE: SCSI I/O error: POSSIBLE BAD DISK -- device 0x807, sector 537872 Jan 27 17:06:09 conJan 28 10:09:17 content2 US/Eastern:%OVERLOAD-5-CE: %CE-BYPS-5-130007: OVERLOAD: Preload did not receive overload message. Preload may not be running The last message from content1 device is interrupted in mid-stream. __________________________________________________________________ New! Unlimited Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Act now to get a personalized email address! Netscape. Just the Net You Need.

1 0