- syslog-ng - lists.balabit.hu

Compilation Problems!
by Vijayant J Singh 17 Nov '03

17 Nov '03

Hi, I'm Getting following messege while performing 'make' after './configure' ... Root@stonegate ~/syslog-ng-1.9.1 # make make all-recursive make[1]: Entering directory `/root/syslog-ng-1.9.1' Making all in src make[2]: Entering directory `/root/syslog-ng-1.9.1/src' make[2]: *** No rule to make target `fdread.h', needed by `logreader.o'. Stop. make[2]: Leaving directory `/root/syslog-ng-1.9.1/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/syslog-ng-1.9.1' make: *** [all-recursive-am] Error 2 please help me out! Thanks VJS Get Your Private, Free E-mail from Indiatimes at http://email.indiatimes.com Buy The Best In BOOKS at http://www.bestsellers.indiatimes.com Bid for for Air Tickets @ Re.1 on Air Sahara Flights. Just log on to http://airsahara.indiatimes.com and Bid Now!

1 0

Compilation Problems!
by Vijayant J Singh 17 Nov '03

17 Nov '03

Hi, I'm Getting following messege while performing 'make' after './configure' ... Root@stonegate ~/syslog-ng-1.9.1 # make make all-recursive make[1]: Entering directory `/root/syslog-ng-1.9.1' Making all in src make[2]: Entering directory `/root/syslog-ng-1.9.1/src' make[2]: *** No rule to make target `fdread.h', needed by `logreader.o'. Stop. make[2]: Leaving directory `/root/syslog-ng-1.9.1/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/syslog-ng-1.9.1' make: *** [all-recursive-am] Error 2 please help me out! Thanks VJS Get Your Private, Free E-mail from Indiatimes at http://email.indiatimes.com Buy The Best In BOOKS at http://www.bestsellers.indiatimes.com Bid for for Air Tickets @ Re.1 on Air Sahara Flights. Just log on to http://airsahara.indiatimes.com and Bid Now!

1 0

Filter postfix log messages
by Florian Lindner 14 Nov '03

14 Nov '03

Hello, I want to filter out all log messages from postfix. They look like these: Nov 9 14:16:28 s_sys@bastet postfix/pickup[24484]: 4D92C4580B7: uid=30 from=<wwwrun> Nov 9 14:16:28 s_sys@bastet postfix/cleanup[24510]: 4D92C4580B7: message-id=<20031109131628.4D92C4580B7(a)bastet.centershock.net> How can I do that? I tried: filter f_postfix { match(".{16,16}s_sys@bastet postfix"); }; But it doesn't work... Thanks, Florian

2 1

GUI Monitoring tool ?
by Tom McGee 13 Nov '03

13 Nov '03

Hi, I'm a real newbie to syslog-ng so sorry if this has been asked before. I'm looking for something that will allow me to keep an eye on syslog via some GUI. Ideally via a browser... Any suggestions ? Thanks Tom. _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

2 1

RE: [syslog-ng]GUI Monitoring tool ?
by Hamilton Andrew 13 Nov '03

13 Nov '03

What do you mean by "keep an eye on"? Do you want logging stats, or just "is it running"? There are a number of system monitoring tools out there that will let "watch" various processes including syslog-ng. I use Big Brother(http://www.bb4.com). I wrote a couple of scripts that monitor the syslog-ng process and plugged them into Big Brother so I could ensure that it was alive and kicking. The BB results are posted on a series of web pages, all of which are customizable. I know there are several others out there and some of the other folks here use them so perhaps they will respond as well. Regards, Drew -----Original Message----- From: Tom McGee [mailto:tom_mcgee_2@hotmail.com] Sent: Wednesday, November 12, 2003 4:00 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]GUI Monitoring tool ? Hi, I'm a real newbie to syslog-ng so sorry if this has been asked before. I'm looking for something that will allow me to keep an eye on syslog via some GUI. Ideally via a browser... Any suggestions ? Thanks Tom. _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3

Backslash-escaped quotes in message strings
by Jos Vos 11 Nov '03

11 Nov '03

Hi, When a single (') or double (") quote appears in a syslog message, this quote gets escaped with a backslash by syslog-ng, which results in pretty ugly output, different from what the standard Linux sysklogd does (this doesn't change the message). Can this be considered a bug (or is it a feature)? Thanks, -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204

3 5

RE: [syslog-ng]Use template() for Program()
by Kenneth Webber 10 Nov '03

10 Nov '03

>the template() function applies to file destination too in syslog-ng 1.6. >( and if i'm not wrong it applies to all destination now even udp() and >tcp() ) >I cannot remember when syslog-ng starts to apply template function to file >but there is a patch for 1.5.20. Thanks, I was on syslog-ng 1.5.26. I am now upgraded to 1.6.0rc4 and it works great. _________________________________________________________________ Crave some Miles Davis or Grateful Dead? Your old favorites are always playing on MSN Radio Plus. Trial month free! http://join.msn.com/?page=offers/premiumradio

1 0

Re: Backslash-escaped quotes in message strings
by Jos Vos 09 Nov '03

09 Nov '03

Hi, Earlier I wrote: > When a single (') or double (") quote appears in a syslog message, > this quote gets escaped with a backslash by syslog-ng, which results > in pretty ugly output, different from what the standard Linux > sysklogd does (this doesn't change the message). I have made a patch (attached) to solve this - at least in my specific situation - but the question is: does this maybe break something else? Cheers, -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204 --- syslog-ng-1.6.0rc4/src/macros.c.orig 2003-04-16 12:15:02.000000000 +0200 +++ syslog-ng-1.6.0rc4/src/macros.c 2003-11-09 17:42:54.000000000 +0100 @@ -348,7 +348,7 @@ } case M_MESSAGE: { /* message */ - length = append_string(dest, left, msg->msg->data, msg->msg->length, escape); + length = append_string(dest, left, msg->msg->data, msg->msg->length, 0); break; } default:

2 1

Use template() for Program()
by Kenneth Webber 08 Nov '03

08 Nov '03

I dont want to reinvent the wheal. I like the functionality of the template () function. Is there a way to apply the template () to a program destination or is template only good for file ()? -Ken _________________________________________________________________ From Beethoven to the Rolling Stones, your favorite music is always playing on MSN Radio Plus. No ads, no talk. Trial month FREE! http://join.msn.com/?page=offers/premiumradio

2 1

Logging options in XML?
by Forrest Aldrich 07 Nov '03

07 Nov '03

I understand that the logging function(s) of syslog-ng can be customized/modified, and I saw some mention of enabling syslog-ng to log into XML - is this possible, and if so I'd be interested in the nuances or hearing any experience with it.

1 0

1.6.0rc3 dumps core on gc when listening on TCP?
by Michaelmas 07 Nov '03

07 Nov '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Is there a known issue with syslog-ng-1.6.0rc3 dumping core when reaping an idle TCP listener? I've had a high-volume syslog-ng server installed and running fine for a couple of months now with rc3, I just started to install syslog-ng on client hosts recently, so I added TCP listener options on the server. If TCP is enabled, syslog-ng dies (dumps core with signal 6) apparently when doing gc on an idle TCP listener. The problem does not happen if I comment out the TCP line: # source s_tcp { tcp( ip(192.168.192.92)); }; I don't see anything in the ChangeLog for rc4 to suggest upgrading would fix this? $ gdb /usr/local/sbin/syslog-ng ./syslog-ng.core . . . Core was generated by `syslog-ng'. Program terminated with signal 6, Abort trap. Reading symbols from /usr/libexec/ld.so...done. Reading symbols from /usr/lib/libc.so.29.0...done. #0 0x400a4fcf in _thread_sys_kill () (gdb) bt #0 0x400a4fcf in _thread_sys_kill () #1 0x400a48bb in abort () #2 0x11014 in do_object_queue_mark () #3 0x120a5 in dont_free_live_resource () #4 0x11f7c in do_resource_free () #5 0x11625 in gc_sweep () #6 0x116fd in gc () #7 0x117a4 in gc_maybe () #8 0xeebe in io_iter () #9 0x1e1a in main_loop (backend=0x1b000) at main.c:255 #10 0x2b7b in main (argc=2, argv=0xcfbfd994) at main.c:545 (gdb) quit $ exit I run "syslog-ng -F" under DJB's daemontools, so when the application dies I get an alert message and svscan restarts it immediately, but in the interim I lose some (UDP) log data... mas -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.3 wkYEARECAAYFAj+q9O0ACgkQKo6Jkwn+K0gNvQCeNfzvOSzM0aaI+YENoQSTC1dqvwYA njjCWIFA1klWjZHDvyZWFozJr6sm =38xg -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

FW: parse error on Template (
by KELLY,THOMAS (HP-Boise,ex1) 06 Nov '03

06 Nov '03

Attached is my syslog-ng.conf file <<syslog-ng.conf>> _____________________________________________ From: KELLY,THOMAS (HP-Boise,ex1) Sent: Tuesday, November 04, 2003 11:39 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: parse error on Template ( Hello, I am using syslog-ng-1.6.0rc4 on RH 9. I just migrated to using mysql for syslog-ng. After I added in the support for mysql in my syslog-ng.conf, when I try starting syslog-ng is gives me a parse error on the line that specifies the template: template("INSERT INTO logs (host, facility, priority, level, tag, date, Does anyone know how to resolve this error? Thanks, Tom Kelly

2 1

Re: [syslog-ng]FW: parse error on Template (
by Michael Earls 04 Nov '03

04 Nov '03

The only thing i see missing on your config is the " source net { udp(); }; ". I know template version does work on syslog-ng 1.6.0rc1. I would assume it would work on the next version up. Can any one else verify that template versions work on versions 1.6.0rc4. michael PGP Info: KeyID 0x5EB59708 Fingerprint 108B A1D8 76F5 08A8 501A F28C 86F4 4BC5 5EB5 9708 >>> tom.kelly(a)hp.com 11/04/03 03:31PM >>> Attached is my syslog-ng.conf file <<syslog-ng.conf>> _____________________________________________ From: KELLY,THOMAS (HP-Boise,ex1) Sent: Tuesday, November 04, 2003 11:39 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: parse error on Template ( Hello, I am using syslog-ng-1.6.0rc4 on RH 9. I just migrated to using mysql for syslog-ng. After I added in the support for mysql in my syslog-ng.conf, when I try starting syslog-ng is gives me a parse error on the line that specifies the template: template("INSERT INTO logs (host, facility, priority, level, tag, date, Does anyone know how to resolve this error? Thanks, Tom Kelly

1 0

Re: [syslog-ng]parse error on Template (
by Michael Earls 04 Nov '03

04 Nov '03

Can you past the rest of the config. michael >>> tom.kelly(a)hp.com 11/04/03 01:39PM >>> Hello, I am using syslog-ng-1.6.0rc4 on RH 9. I just migrated to using mysql for syslog-ng. After I added in the support for mysql in my syslog-ng.conf, when I try starting syslog-ng is gives me a parse error on the line that specifies the template: template("INSERT INTO logs (host, facility, priority, level, tag, date, Does anyone know how to resolve this error? Thanks, Tom Kelly

1 0

parse error on Template (
by KELLY,THOMAS (HP-Boise,ex1) 04 Nov '03

04 Nov '03

Hello, I am using syslog-ng-1.6.0rc4 on RH 9. I just migrated to using mysql for syslog-ng. After I added in the support for mysql in my syslog-ng.conf, when I try starting syslog-ng is gives me a parse error on the line that specifies the template: template("INSERT INTO logs (host, facility, priority, level, tag, date, Does anyone know how to resolve this error? Thanks, Tom Kelly

1 0

chain_hostnames = long_hostnames option?
by seberino＠spawar.navy.mil 30 Oct '03

30 Oct '03

-- _______________________________________ Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax : (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

2 2

Syslog-ng Apache and Samba logs
by Rui Teixeira 30 Oct '03

30 Oct '03

Can someone indicate me the way so i can catch the logs of Samba and Apache with Syslog-ng?? I can't find a way to do this... Thanks in advance Rui Teixeira

2 1

re-writing hostnames before sending over TCP
by nate 30 Oct '03

30 Oct '03

I am tryin to configure a semi-secure syslog setup. The primary program that will be logging to it is java via log4j. log4j apparently cannot log to a socket with syslog(as far as I can tell?) only to a udp source, so I configured syslog-ng to bind to 127.0.0.1 on port 514 tcp/udp and it recives the messages fine but the 'host' that is being logged is localhost. I can re-write the log entries using a template for local files but I can't seem to get it workin for sending to a remote syslog server. No matter what options I use it always ends up either localhost or 127.0.0.1 for the hostname. One thing I haven't tried is setting up a filter on the remote server using the host() option but I don't think it would work because the host there would be localhost too not the host of the server sending the message ? is there a way to get syslog-ng to ignore the hostname that's in the message itself and use the hostname/ip of the system that is actually sending the message? or is there another way to accomplish this while keeping syslog-ng bound to the loopback interface? on the local server I also have syslog-ng logging everything to a file, and without using the template all log entries from log4j also appear as being from the host 'localhost'. I suppose I could have log4j log directly to the remote server but rather would use the local one as a buffer incase there is a network problem or something. using ssyslog-ng 1.5.26(on both systems). If I need to upgrade I could .. thanks! nate

2 3

Syslog-ng and Apache logs
by Rui Teixeira 28 Oct '03

28 Oct '03

Hi to all. Can someone tell me how can i catch the apache logs in a machine so the syslog-ng can process them? I can't find the correct facility. Thanks in advance. Rui Teixeira

1 0

RE: syslog-ng digest, Vol 1 #1042 - 12 msgs
by Jay Davis 27 Oct '03

27 Oct '03

This may be a bit late, but I am doing exactly the same thing you need with network devices. I doubt you want chain_hostnames. This just puts the chain of hostnames with the path (hosts) that the message has passed through. We log to several (load balanced) dedicated syslog hosts, which then forward the messages to an event management system. We also use syslog-ng to then forward all messages to a central syslog system that we have simple Web apps to peruse the messages. This last part will soon be an applicance (can't mention the vendor). I have found that the syslog-ng.conf.doc file in the contrib directory will have everything you could possibly need to know about syslog-ng. Plus the very smart peeps that read this listserv. Here are my options. I certainly hope this helps. If you need to feel free to give me a shout. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); dns_cache_size(1000); dns_cache_expire_failed(5); use_fqdn (no); create_dirs (no); perm(644); keep_hostname (yes); }; ==========Christians Part. ( Cut and paste job. ) My little brainless syslog-ng.conf below NEEDS the one option you see or else the log file will refer to host as "src@myhostname" instead of just "myhostname". Please explain a little better what chain_hostnames does/means and why it fixes this problem. Is there some other simpler way to fix aforementioned problem?? options {chain_hostnames(no);}; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. ===========================

1 0

Some device doesn't write to file
by Santa Lau 27 Oct '03

27 Oct '03

Hi, I just upgrade the hardware and software of the syslog-ng server to 1.60rc4 from 1.5 to log about 30 firewalls syslog. After upgarde, I did find that nearly half of the firewalls log doesn't write to the file. I did check with tcpdump and it did receive the tons of logs but did't log into the file. The iptables/ipchains has all been disabled. Is there any way to identify the source of problem. Thanks for your help. B. Regards, Santa

2 5

John K Brooks is out of the office.
by John K Brooks 27 Oct '03

27 Oct '03

I will be out of the office starting 10/24/2003 and will not return until 10/29/2003. I will not be able to check my mail during this time. For network management issues, please contact John Oo at 973-682-4458 or Rich Molinaro at 973-682-4457. Thank you, John -- This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

1 0

syslog-ng & BSD Relay Host
by Philip Webster 27 Oct '03

27 Oct '03

Hello, I'm having some trouble with a BSD relay host, and wonder if anyone out there may have a solution. The relay picks up messages from routers, switches, PIXes, etc and sends them via UDP (standard syslog daemon) to a central syslog-ng host. The messages 'on the wire' look like this (tcpdump output): Forwarded from host.domain: Oct 27 2003 09:43:47: %PIX-4-106023: Msg ... So the hostname in the syslog message is 'Forwarded from host.domain'. This appears to be interpreted by syslog-ng as 'Forwarded', which adheres (as it should) to RFC 3164. I'm splitting up the logs based on hostname, so I'd like to be able to log to a file named after the host which sent the log. So far all of my playing around with options has resulted in either: 1) logs go to a file named relayhost with the entry: relayhost from host.domain: Oct 27 2003 09:43:47: %PIX-4-106023: Message so this is just the message on with wire with the 'relayhost' in place of 'Forwarded', 2) logs go to a file named 'Forwarded' with the entry: Forwarded from host.domain: Oct 27 2003 09:43:47: %PIX-4-106023: Message so the word 'Forwarded' is taken to be the hostname, or 3) logs go to a file named 'Forwarded' with the entry: Forwarded/relayhost from host.domain: Oct 27 2003 09:43:47: %PIX-4-106023: Message so the hostname still appears to be 'Forwarded', but the chaining options also show the relay host. What I would like is to have the logs placed in a file named after the original sender (host.domain in the tcpdump output above). Is this possible? All my attempts have relied around using global options and file templates - I haven't looked at using filters yet, so maybe this is what I need to do. This appears to be a BSD problem, as it modifies the actual message before relaying it on, but I cannot find an option to stop BSD syslog from doing this. Any thoughts? Thanks Phil

1 0

I don't understand chain_hostnames option & why it fixes this problem...
by seberino＠spawar.navy.mil 24 Oct '03

24 Oct '03

My little brainless syslog-ng.conf below NEEDS the one option you see or else the log file will refer to host as "src@myhostname" instead of just "myhostname". Please explain a little better what chain_hostnames does/means and why it fixes this problem. Is there some other simpler way to fix aforementioned problem?? options {chain_hostnames(no);}; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; -- _______________________________________ Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax : (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

2 3

syslog-ng minor tcp-wrappers bug
by Ed Ravin 23 Oct '03

23 Oct '03

test_nscache.c refuses to build on NetBSD 1.5 if --enable-tcp-wrapper is set. The patch below fixes the problem. I don't know if test_nscache actually works since I'm not clear on what it does and I've always lived without it in the past, but at least with the patch applied I don't get error messages (undefined reference allow_severity & deny_severity) when I run "make". diff -u -r1.1 test_nscache.c --- test_nscache.c 2003/10/23 21:50:13 1.1 +++ test_nscache.c 2003/10/23 21:50:16 @@ -2,6 +2,12 @@ #include "nscache.h" #include <stdio.h> +#if ENABLE_TCP_WRAPPER +#include <tcpd.h> +int allow_severity = 0; +int deny_severity = 0; +#endif + int main() { struct in_addr in;

1 0