- syslog-ng - lists.balabit.hu

persistent link to current file
by Gainey, Joe (AT-Atlanta) 14 Jan '04

14 Jan '04

Is there any way to link the current version of a file to a standard location. If not would it be possible to add this functionality. Here is an example of what i have: destination d_default { file("/var/adm/messages.$YEAR.$MONTH.$DAY") ; } ; However, I have to recreate the symlink in cron every day: ln -s /var/adm/messages.2004.01.13 /var/adm/messages it would be nice if there was an option: destination d_default { file("/var/adm/messages.$YEAR.$MONTH.$DAY" soft_link("/var/adm/messages")) ; } ; if this or something like this has been implemented please let me know. Joe Gainey

4 5

RE: [syslog-ng]funny character is being inserted into each log li ne + perm(-1) n ot working
by Clemson, Chris 14 Jan '04

14 Jan '04

> On Wed, 2004-01-07 at 11:50, Rule, Ted wrote: > > The ^@ isn't really 'funny', per se; it's a representation of Ctrl-@ > > which in turn is actually the null character. > > Correct, this has been fixed by a patch posted to this list > earlier, and > in the last 1.6.1 syslog-ng release (which has the posted > patch merged) oh, thanks for the reply! i must have missed that, i'll check it out cheers, chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

Re: [syslog-ng]1.5.26 vs 1.6.x and destination selection
by T. 14 Jan '04

14 Jan '04

Interesting point. I tried with check_hostnames() set to either yes or no but with little success. I also tried use_fqdn() as well as taking out my bad_hostname() restrictions. I'll try to document some of the different use cases if I get a few moments free. --- On Mon 01/12, Balazs Scheidler < bazsi(a)balabit.hu > wrote: From: Balazs Scheidler [mailto: bazsi(a)balabit.hu] To: syslog-ng(a)lists.balabit.hu Date: Mon, 12 Jan 2004 21:41:11 +0100 Subject: Re: [syslog-ng]1.5.26 vs 1.6.x and destination selection On Mon, 2004-01-12 at 21:00, T. wrote: > Hi, Baszi. Thanks for writing back. Here's what I'm seeing: > > 0: 0003 ba10 8f5b 0001 81ff d8ad 0800 4500 .....[........E. > 16: 00a5 8018 0000 fc11 7b85 0a64 6303 0a40 .......{..dc..@ > 32: 4b03 042d 0202 0091 0736 3c31 3636 3e4a K..-.....6<166>J > 48: 616e 2031 3220 3230 3034 2031 393a 3336 an 12 2004 19:36 > 64: 3a35 313a 2025 4657 534d 2d36 2d33 3032 :51: %FWSM-6-302 > 80: 3030 363a 2054 6561 7264 6f77 6e20 5544 006: Teardown UD > 96: 5020 636f 6e6e 6563 7469 6f6e 2066 6f72 P connection for > 112: 2066 6164 6472 2031 302e 3130 302e 3832 faddr 10.100.82 > 128: 2e39 2f33 3738 3638 2067 6164 6472 2031 .9/37868 gaddr 1 > 144: 302e 3230 2e33 302e 3631 2f35 3320 6c61 0.20.30.61/53 la > 160: 6464 7220 3130 2e32 302e 3330 2e36 312f ddr 10.20.30.61/ > 176: 3533 0a 53. > > In this case, the filter that I expect to pick it up is: > > filter f_fwsm_misc { > match(" \%FWSM-") and > match(": (Teardown|Translation|Built)"); > }; > log { source(s_udp); filter(f_fwsm_misc); destination(d_netfilt); }; > log { destination(d_messages); flags(fallback, catchall); }; > > > This works OK in 1.5.26 (i.e. the message above gets written to d_netfilt) but not 1.6.0rc4 or 1.6.1 (it's written to d_messages). I wouldn't always expect program() to work well for remote hosts but the match() filter seems like it should. Also, I can't tell if $HOST is now being correctly interpreted in 1.6.1 because the message is being written to the wrong place :-) I can say that it does seem to work correctly for other syslog-ng hosts (which I have set up to use TCP), it's primarily the UDP transport that seems to be having problems. I don't understand how this might work differently than 1.5.26, though I think the problem is that you have to enable the check_hostname() option as '%FWSM-6-302' is taken as the hostname (if you enable check_hostname it will be interpreted as the part of the message as '%' is not a valid hostname. I can't remember any changes in this area though. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

Re: [syslog-ng]1.5.26 vs 1.6.x and destination selection
by T. 12 Jan '04

12 Jan '04

Hi, Baszi. Thanks for writing back. Here's what I'm seeing: 0: 0003 ba10 8f5b 0001 81ff d8ad 0800 4500 .....[........E. 16: 00a5 8018 0000 fc11 7b85 0a64 6303 0a40 ......�.{..dc..@ 32: 4b03 042d 0202 0091 0736 3c31 3636 3e4a K..-.....6<166>J 48: 616e 2031 3220 3230 3034 2031 393a 3336 an 12 2004 19:36 64: 3a35 313a 2025 4657 534d 2d36 2d33 3032 :51: %FWSM-6-302 80: 3030 363a 2054 6561 7264 6f77 6e20 5544 006: Teardown UD 96: 5020 636f 6e6e 6563 7469 6f6e 2066 6f72 P connection for 112: 2066 6164 6472 2031 302e 3130 302e 3832 faddr 10.100.82 128: 2e39 2f33 3738 3638 2067 6164 6472 2031 .9/37868 gaddr 1 144: 302e 3230 2e33 302e 3631 2f35 3320 6c61 0.20.30.61/53 la 160: 6464 7220 3130 2e32 302e 3330 2e36 312f ddr 10.20.30.61/ 176: 3533 0a 53. In this case, the filter that I expect to pick it up is: filter f_fwsm_misc { match(" \%FWSM-") and match(": (Teardown|Translation|Built)"); }; log { source(s_udp); filter(f_fwsm_misc); destination(d_netfilt); }; log { destination(d_messages); flags(fallback, catchall); }; This works OK in 1.5.26 (i.e. the message above gets written to d_netfilt) but not 1.6.0rc4 or 1.6.1 (it's written to d_messages). I wouldn't always expect program() to work well for remote hosts but the match() filter seems like it should. Also, I can't tell if $HOST is now being correctly interpreted in 1.6.1 because the message is being written to the wrong place :-) I can say that it does seem to work correctly for other syslog-ng hosts (which I have set up to use TCP), it's primarily the UDP transport that seems to be having problems. Thanks again for any help you might be able to offer. --- On Mon 01/12, Balazs Scheidler < bazsi(a)balabit.hu > wrote: From: Balazs Scheidler [mailto: bazsi(a)balabit.hu] To: syslog-ng(a)lists.balabit.hu Date: Mon, 12 Jan 2004 13:54:10 +0100 Subject: Re: [syslog-ng]1.5.26 vs 1.6.x and destination selection Please try checking how those messages are formatted. syslog-ng might have problems identifying the program part in those messages. either a tcpdump or an strace with large strings (-s 512) might help to find the problem. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1

RE: [syslog-ng]Re: syslog-ng and log viewer
by Schernau, Ed 12 Jan '04

12 Jan '04

I second this, however I find that heavy DB usage causes NG to drop messages. However, I'm running MySQL on an old Sun Ultra 2, maybe this has something to do with it. -----Original Message----- From: Jérôme Fenal [mailto:jerome.fenal@logicacmg.com] Sent: Monday, January 12, 2004 10:49 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Re: syslog-ng and log viewer Gerard Breiner wrote: > Hello, > > I installed and configured syslog-ng. It works very fine ! Now, I'm > seeking a free application to visualize the logs files into a > navigator. An idea ? we use a home brew version of what can be found here : http://vermeer.org/syslog/ We log to mysql, then use a heavily modified of an early version of the php script found here : http://www.vermeer.org/projects/php-syslog-ng/ Cordialement, Jérôme -- Jérôme Fenal - Consultant Unix/SAN/Logiciel Libre Groupe Expert & Managed Services - LogicaCMG France http://www.logicacmg.com/fr/ - <mailto:jerome.fenal AT logicacmg.com> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html *****This information may be confidential and/or privileged. Use of this information by anyone other than the intended recipient is prohibited. If you received this in error, please inform the sender and remove any record of this message.*****

1 0

How to filter XDMCP messages ?
by Gerard Breiner 12 Jan '04

12 Jan '04

Hello, I wonder how to configure syslog-ng to filtering the messages emitted by gdm_xdmcp. this type of messages pollutes my files of logs. Here is messages i don't want : "gdm[3798]: gdm_xdmcp_handle_query: Opcode 1 from ". Best regards Gerard Gerard Breiner Institut d'Astrophysique Spatiale Orsay Campus France

4 5

1.5.26 vs 1.6.x and destination selection
by T. 12 Jan '04

12 Jan '04

I am trying to get the 1.6 branch of syslog-ng to create log files based on a naming convention that worked (sort of) in 1.5.26 but no longer does. Specifically, I have the following in my syslog-ng.conf: destination d_netfilt { file ("/var/logser/$HOST/$YEAR/$MONTH/$DAY/netfilt.log" owner(root) perm(0600) create_dirs(yes) ); }; destination d_messages { file ("/var/adm/messages.$YEAR.$MONTH" owner(root) perm(0644) ); }; filter f_netfilt { match(" netfilt\[0-9]+\]") or program("netfilt"); }; source s_udp { udp( port(514) ); }; log { source(s_udp); filter(f_netfilt); destination(d_netfilt); }; log { destination(d_messages); flags(fallback, catchall); }; With syslog-ng 1.5.26, this sends messages matching "netfilt" received on UDP port 514 into /var/logser (albeit it doesn't correctly expand $HOST into the source of the message - it fills this in as the hostname of the machine on which syslog-ng is running). With the 1.6 branch, however, running with the same config file and receiving messages from the same sources winds up dropping the logs down into the d_messages block. This happened both with the release candidates and with the recent 1.6.1 branch. I'm using libol 0.3.11 and running on Solaris 8 on Netra V120; both libol and syslog-ng were compiled using GCC 3.1 in 64-bit mode (-m64 -mcpu=ultrasparc -O3). Can anyone help point me in the right direction of getting 1.6.1 to correctly match the source of the message and, perhaps, also identify $HOST properly? Thanks in advance. T. E. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1

compiling syslog-ng (latest version) on solrais 9 - no error
by Markus Reger 11 Jan '04

11 Jan '04

This is the same problem on IRIX. You have to use the flex library like this: gcc ... -L(flex directory path) -lfl Gabor sorry to say but Gabor's advice didn't bring me any further. What I chose then was to set export LEXLIB="/opt/sfw/libfl.a" since this file holds yywrap. I made a make disclean ./configure make and everything went fine (at least there were no errors, warnings, notices or other complaints reported) and binaries were ceated. fyi we use: gcc 3.3 flex 2.5.4 libol 0.3.11 syslog-ng 1.6.0rc4 now the config will begin. kr

1 0

"last message repeated NN times"?
by Ed Ravin 10 Jan '04

10 Jan '04

I recall someone pointing out last year that syslogd has a feature where it can compress a burst of messages into a note like: Jan 10 17:01:06 loghost last message repeated 24 times While syslog-ng didn't have that. Is that still the case? I just ran into this with a mongo runaway program that logged several hundred messages a second, which filled up my log partition. If this feature still isn't in syslog-ng, is it one that we want? I could see it as a source option like "suppress-repeats", where it would spit out the original message followed by a tag, like this: Jan 10 17:25:39 loghost inetd[7729]: Connection from 10.24.1.168 [REPEATED 1024 TIMES] and maybe arguments to "suppress-repeats" like how many repeats should be printed before kicking in, or perhaps even a regex describing which parts of the log message to ignore before comparing it to the previous one. Thanks, -- Ed

2 3

Getting rid of --
by Al Banard 10 Jan '04

10 Jan '04

How do I get rid of the two dashes between syslog-ng output and the actual message? I've tried this: template("$ISODATE $MESSAGE\n") but I still get "--" between the date and my message. current message output: 2004-01-10T09:18:52+0100 -- my_lovely_message desired message output: 2004-01-10T09:18:52+0100 my_lovely_message _________________________________________________________________ E-mail just got a whole lot better. New ninemsn Premium. Click here http://ninemsn.com.au/premium/landing.asp

1 0

RE: [syslog-ng]funny character is being inserted into each log line + perm(-1) n ot working
by Rule, Ted 09 Jan '04

09 Jan '04

The ^@ isn't really 'funny', per se; it's a representation of Ctrl-@ which in turn is actually the null character. Hence I suspect syslog-ng is safely mangling a null somewhere into a readable representation before writing it to the log file. Quite whose fault this is, is another matter. Ted. ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

2 1

Stable version?
by Andrew Culver 09 Jan '04

09 Jan '04

What is the current stable version of syslog-ng? The docs say 1.4 is the latest stable (so 1.5 would be development) but I also see 1.6 and 1.9. Just wondering if 1.6 is the latest stable since it hasn't been updated in about 8 months. TIA, Andrew

1 0

patch for log parsing bugs (log4j)
by Balazs Scheidler 09 Jan '04

09 Jan '04

hi, Attached you'll find a patch against syslog-ng 1.6.0rc4 which addresses some issues wrt log parsing. Please test if the patch fixes your problems. It might be part of a future release if it proves to interoperate with other platforms. People with not to frequent platforms (HP-UX comes to mind), please also test this patch as it might break there. Thanks. And finally the patch: Index: src/sources.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/sources.c,v retrieving revision 1.37 diff -u -r1.37 sources.c --- src/sources.c 8 Jan 2003 09:31:37 -0000 1.37 +++ src/sources.c 3 Oct 2003 14:22:32 -0000 @@ -107,23 +107,32 @@ } closure->pos += n; + /* UDP packets are complete log lines on their own */ + if (closure->dgram) { + do_handle_line(closure, closure->pos, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); + closure->pos = 0; + return ST_OK | ST_GOON; + } + eol = memchr(closure->buffer, '\0', closure->pos); - if (eol == NULL) - eol = memchr(closure->buffer, '\n', closure->pos); if (closure->pad_size && eol) { + + /* HP-UX sends chunks of pad_size in size, each containing a + * separate message, terminated by NUL */ do_handle_line(closure, eol - closure->buffer, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; } - if (!eol && (closure->dgram || closure->pos == closure->max_log_line)) { - /* we don't have a terminating nl nor \0, and our buffer is - full or we are a datagram receiver, when the message is in - its own packet. - */ + if (eol == NULL) + eol = memchr(closure->buffer, '\n', closure->pos); + if (!eol && closure->pos == closure->max_log_line) { + /* we don't have a terminating nl nor \0, and our buffer is full */ do_handle_line(closure, closure->pos, closure->buffer, salen ? (abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; } + + /* iterate through lines */ start = closure->buffer; while (eol) { /* eol points at the newline character. end points at the -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 5

compiling syslog-ng (latest version) on solaris 9 - error
by Markus Reger 09 Jan '04

09 Jan '04

hello to everybody Made several attempts to compile syslog-ng. Compilation of libol went fine. Whenever I "make" syslog-ng I encounter the error: gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o getopt.o getopt1.o -lpthread -lnsl -lsocket -ldoor -lresolv /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Has anyone ever compiled on Solaris 9 - gcc 3.3. Thanks in advance for every hint. kr

2 1

Question regarding syslog-ng filter
by Aladdin 09 Jan '04

09 Jan '04

I'm using syslog-ng 1.6rc4 Can anyone tell me what is wrong with this filter: filter f_kern { facility(kern) and (not match("IPTABLES DROP") or not match("New not SYN:")); }; I still can see lines with IPTABLES DROP in my kernel log:-( Why these messages still come through this filter? Thanks. What am I missing?

1 0

RE: [syslog-ng]Compile Error on Solaris 2.8
by Hamilton Andrew 08 Jan '04

08 Jan '04

Strange... Try this: In /tmp/syslog-ng/libol-0.3.9 do a 'make distclean', I don't remember if this works but if not you can do a 'make clean' and then delete config.cache and try to run the configure script again. If that doesn't work upgrade to the latest libol, which is 0.3.11, I think, and try it again, and if that still doesn't work repost and we'll try something else. Regards, Drew -----Original Message----- From: Chance Ellis [mailto:chance_ellis@yahoo.com] Sent: Wednesday, January 07, 2004 7:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Compile Error on Solaris 2.8 Trying to compile libol 0.3.9 on Solaris. Get this error on Make: Making all in utils make[1]: Entering directory `/tmp/syslog-ng/libol-0.3.9/utils' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/tmp/syslog-ng/libol-0.3.9/utils' Making all in src make[1]: Entering directory `/tmp/syslog-ng/libol-0.3.9/src' /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng/libol -0.3.9/src -I. -I/opt/gnome/include -I/usr/openwin/share/include/X11/extension s -I/usr/openwin/include -D_GNU_SOURCE -Wall -O2 -c format.c rm -f .libs/format.lo gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng/libol-0.3.9/src -I. -I/opt/gnome/includ e -I/usr/openwin/share/include/X11/extensions -I/usr/openwin/include -D_GNU_SOUR CE -Wall -O2 -c format.c -fPIC -DPIC -o .libs/format.lo In file included from objects.h:41, from format.h:27, from format.c:24: objtypes.h:36:3: #error No suitable type found to use for UINT32 objtypes.h:44:3: #error No suitable type found to use for UINT16 In my configure I noticed that when it checks the size of short, int and long they are returned Cached 0. Any ideas? Thanks! __________________________________ Do you Yahoo!? Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes http://hotjobs.sweepstakes.yahoo.com/signingbonus _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]funny character is being inserted into each log li ne + perm(-1) n ot working
by Clemson, Chris 08 Jan '04

08 Jan '04

> The ^@ isn't really 'funny', per se; it's a representation of Ctrl-@ > which in turn is actually the null character. ah, i see. i wondered what it was! > Hence I suspect syslog-ng is safely mangling a null somewhere > into a readable representation before writing it to the log file. hmm, strange. is there a way to turn this off? i dont mind that the date isn't displaying, and it's only affecting the firewall, so it's not a big deal really. it's just annoying to get alert emails that don't actually contain anything useful! > Quite whose fault this is, is another matter. :) thanks chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

Compile Error on Solaris 2.8
by Chance Ellis 08 Jan '04

08 Jan '04

Trying to compile libol 0.3.9 on Solaris. Get this error on Make: Making all in utils make[1]: Entering directory `/tmp/syslog-ng/libol-0.3.9/utils' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/tmp/syslog-ng/libol-0.3.9/utils' Making all in src make[1]: Entering directory `/tmp/syslog-ng/libol-0.3.9/src' /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng/libol -0.3.9/src -I. -I/opt/gnome/include -I/usr/openwin/share/include/X11/extension s -I/usr/openwin/include -D_GNU_SOURCE -Wall -O2 -c format.c rm -f .libs/format.lo gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng/libol-0.3.9/src -I. -I/opt/gnome/includ e -I/usr/openwin/share/include/X11/extensions -I/usr/openwin/include -D_GNU_SOUR CE -Wall -O2 -c format.c -fPIC -DPIC -o .libs/format.lo In file included from objects.h:41, from format.h:27, from format.c:24: objtypes.h:36:3: #error No suitable type found to use for UINT32 objtypes.h:44:3: #error No suitable type found to use for UINT16 In my configure I noticed that when it checks the size of short, int and long they are returned Cached 0. Any ideas? Thanks! __________________________________ Do you Yahoo!? Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes http://hotjobs.sweepstakes.yahoo.com/signingbonus

1 0

syslog-ng mysql syntax error
by Asif Iqbal 07 Jan '04

07 Jan '04

Hi All Since yesterday I am getting this syntax errors while pushing the log to the mysql database I followed the instruction exactly how it was said in http://vermeer.org/syslog/ and it was working fine until today it started complaining ERROR 1064 at line 841: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'level, tag, date, time, program, msg) VALUES ( '63.152.4.63', ' ERROR 1064 at line 1: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '/22/3 session 4612f4 Session End' ); INSERT INTO logs (host, fa ERROR 1064 at line 424: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '63.152.0.100', 'local4', 'err', 'err', 'a3', '2003-12-31', '17: Any suggestion/hint would be greatly appreciated -- Asif Iqbal http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x8B686E08 There's no place like 127.0.0.1

1 1

funny character is being inserted into each log line + perm(-1) n ot working
by Clemson, Chris 07 Jan '04

07 Jan '04

I am having a problem with logging from a Cisco PIX firewall to a syslog-ng file. For months it has been working fine, but something happened on 18th december: Dec 18 16:08:25 BPFpix-int Dec 18 2003 08:53:15: %PIX-3-313001: Denied ICMP type=8, code=0 from 217.81.176.93 on interface 0 Dec 18 09:46:50^@ BPFpix-int %PIX-3-313001: Denied ICMP type=8, code=0 from 217.79.97.90 on interface 0 all the lines logged since "Dec 18 09:46:50" have all had that ^@ code after it, and no date. i don't know why the times on the previous line are different, but the syslog server now has our "official" time, so i'm not that bothered. Around this time i was trying to sort out the permissions problems with /dev/ files i was having when syslog-ng restarted, so i guess this could be connected. This ^@ character is only in the PIX firewall log (which is saved to a different file than most of the other syslog messages). The pertinent config lines are as follows: destination null { file("/dev/null" perm(0666)); }; source BPFpix { udp(ip ("192.168.1.2") port(514)); }; filter f_bpfpixpingdrop { host ("BPFpix") and match("Denied ICMP"); }; # BPFpix messages # destination BPFpixlog { file ("/var/log/BPFpix"); }; log { source(BPFpix); destination(BPFpixlog); }; # drop ping attempts log { source(BPFpix); filter (f_bpfpixpingdrop); destination(null); flags(final);}; # log the rest log { source(BPFpix); destination(lanmon); }; the "lanmon" destination is a machine that emails certain syslog messages, and because the PIX messages have a ^@ in them, the messages are mainly blank! Can anyone tell me where this ^@ is coming from, and could it be permissions related? i am running syslog-ng 1.6.0rc4. also, i really want that first line to read: destination null { file("/dev/null" perm(-1)); }; so that no permissions are changed on that file, but syslog-ng complains about it when i start it up. What am i doing wrong? thank you! chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

Syslog-ng and Oracle
by Coward, Robert (Contractor) 05 Jan '04

05 Jan '04

Hey all, I just got syslog-ng installed and cofigured properly, and I was wondering is there any way to get oracle to log to it? I know that by default Oracle logs to its alert.log in $ORACLE_HOME, but I am unsure as to whether this behaivour can be overridden to use the syslog protocol. Any help would be greatly appreciated. Roberto

1 0

syslog-ng hast no more facilities than old syslog?
by Ekkard Gerlach 04 Jan '04

04 Jan '04

Is it right that syslog-ng hat no more facilities than sylog-old? I hoped that I could take any name: root@rex2:~>logger -p 'hello.err' hello logger: unknown facility name: hallo. thx ekkard

3 3

syslog-ng spec file
by Aladdin 31 Dec '03

31 Dec '03

Hello , I want to make RPM file for my RedHat system from spec file which is included in source tarball. Syslog-ng is 1.6.0rc4 version. I stucked with the following part: Source2: syslog-ng.init Source3: mysql-syslog.pipe Source4: mysql-syslog.buffer Source5: syslog-ng.sysconfig So my question is - where can I get the following files mentioned as sources. I was unable to find them anywhere in the tarball:( Thanks. -- Best regards, Aladdin mailto:aladdin@antakalnis.lt

1 0

central syslog server
by Asif Iqbal 31 Dec '03

31 Dec '03

Hi All I am trying to setup a central syslog server. Server A will push all its data to Server B (central syslog server, ip 1.2.3.4) Server A: ********* options { dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname(yes); }; source src { sun-streams("/dev/log"); udp(); internal(); }; destination d_server_B { udp("1.2.3.4" port(514)); }; log { source(src); destination(d_server_B); }; Server B: ********** options { dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname(yes); }; source local { sun-streams("/dev/log"); udp(); internal(); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(local); destination(d_mysql); }; But It does not seem to fully working. I get lots of logs in Server A from the routers. However only logs that Server B (central syslog server) gets from Server A are internal logs, nothing about the routers Am I missing something ? Thanks -- Asif Iqbal http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x8B686E08 There's no place like 127.0.0.1

1 2

Old Syslog Data
by Asif Iqbal 23 Dec '03

23 Dec '03

Hi All I am using syslog-ng which pipes the log to mysql database in this format host, facility, priority, level, tag, date, time, program, msg I installed the php plugin and now I can browse through the web real fast. Is there a way I can push all the previous logs in the database in the same format ? That way users can also look at the previous datam Thanks -- Asif Iqbal http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x8B686E08 There's no place like 127.0.0.1

3 3