- syslog-ng - lists.balabit.hu

What does this message mean?
by gary_tay＠platts.com 01 Sep '03

01 Sep '03

Hi List Folks, Anyone bother to explain to me what this message means? Aug 28 08:44:50 src@hostname syslog-ng[191]: pkt_buffer::do_flush(): Error flushing data OS: Solaris 8 syslog-ng: 1.6.0rc3 Pls let me know if you need more info. Rgds Gary

2 1

Re: syslog-ng digest, Vol 1 #1033 - 15 msgs (Vacation)
by TIM MOORE 29 Aug '03

29 Aug '03

FYI: I will be out on vacation from 8/28 until 9/8. Please contact the NOC if you need immediate assistance. Thanks, Tim Moore

1 0

logging to file and remote host
by Atif Ghaffar 29 Aug '03

29 Aug '03

hi all, I am not yet a syslog-ng user. I would like to know if it is possible to do what I want with standard syslogd and if not then with syslog-ng On HP-UX 11.00 I want to log messages to a file and to remote host. Is that possible with syslogd? I tried something like mail.* /var/adm/syslog/mail.log and it works I tried mail.* @LOGHOST and it works If I put both lines then only one is used. How can I log to a file and also to LOGHOST? If it is not possible with syslog and is possible with syslog-ng, then please let me know so I can continue the reading of the manuals. best regards and thanks Atif Ghaffar

3 4

Syslog-ng on NetBSD
by Axel Gerster 28 Aug '03

28 Aug '03

Hello, I got some compile errors on syslog-ng on NetBSD. Does anyone know how to fix it? ---snap---- root@blah:/tmp/syslog-ng-1.6.0rc3# gmake Making all in src gmake[1]: Entering directory `/tmp/syslog-ng-1.6.0rc3/src' gmake all-recursive gmake[2]: Entering directory `/tmp/syslog-ng-1.6.0rc3/src' Making all in . gmake[3]: Entering directory `/tmp/syslog-ng-1.6.0rc3/src' gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c cfg-lex.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c affile.c In file included from /usr/include/arpa/inet.h:65, from affile.c:77: /usr/include/sys/param.h:222: warning: `MIN' redefined /usr/pkg/include/libol/objtypes.h:82: warning: this is the location of the previous definition /usr/include/sys/param.h:223: warning: `MAX' redefined /usr/pkg/include/libol/objtypes.h:86: warning: this is the location of the previous definition gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afsocket.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afunix.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afinet.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afinter.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afuser.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c:37: stropts.h: No such file or directory afstreams.c:38: sys/strlog.h: No such file or directory gmake[3]: *** [afstreams.o] Error 1 gmake[3]: Leaving directory `/tmp/syslog-ng-1.6.0rc3/src' gmake[2]: *** [all-recursive] Error 1 gmake[2]: Leaving directory `/tmp/syslog-ng-1.6.0rc3/src' gmake[1]: *** [all-recursive-am] Error 2 gmake[1]: Leaving directory `/tmp/syslog-ng-1.6.0rc3/src' gmake: *** [all-recursive] Error 1 --snip--- Thx very much. Axel

2 1

RE: [syslog-ng]syslog-ng and logrotate
by Naman Latif 28 Aug '03

28 Aug '03

Have you tried the "copytruncate" option in logrotate.conf ? I am using it without any problems on Solaris8. ++++++++++++++++++++ copytruncate Truncate the original log file in place after creating a copy, instead of moving the old log file and option- ally creating a new one, It can be used when some pro- gram can not be told to close its logfile and thus might continue writing (appending) to the previous log file forever. Note that there is a very small time slice between copying the file and truncating it, so some logging data might be lost. When this option is used, the create option will have no effect, as the old log file stays in place. +++++++++++++++++++++++ Regards \\ Naman > My pb : > before the log rotate, all is good. After logrotate, > syslog-ng don't write in > the remote file.

1 0

Log TCP
by Darrell 28 Aug '03

28 Aug '03

I'm new to Linux and we've decided to setup syslog-ng 1.4.17 on Redhat 8 at work. I'm trying to centralize the logs using TCP for all of our Cisco routers, Nortel firewalls and switches. I need to know what lines to enter and where to enter them in my syslog-ng.conf file. Any help would be greatly appreciated. ----------------------------------- Darrell IT Support

2 1

RE: [syslog-ng]syslog-ng and logrotate
by William Rhodes 28 Aug '03

28 Aug '03

Had the same problem and found that syslog-ng has a problem with the kill -HUP that logrotate uses. I replaced that command with /etc/rc.d/init.d/syslog-ng reload and all works fine with no problems. William -----Original Message----- From: yannick.haguenier(a)tuxfamily.org [mailto:yannick.haguenier@tuxfamily.org] Sent: Thursday, July 10, 2003 3:57 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng and logrotate Hy, i have squid + syslog-ng 1.0.6.rc1 Syslog-ng look squid/access.log, and write log file (with date format) on a remote server (tcp). On squid there is a logrotate at 6 am. My pb : before the log rotate, all is good. After logrotate, syslog-ng don't write in the remote file. The last line appear in this file was create at 6am. The process run on the both server, and i have no error. If i run syslog-ng restart, syslog-ng write the ligne in remote file . the next error appear after the next logrotate. Does anyone know why this is happening? thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Forwarding unchanged Syslog messages
by Paul Jasa 28 Aug '03

28 Aug '03

I have the exact same issue with syslog-ng. I run Red Hat 7.3. Despite the claims that the syslog message can be forwarded without being modified, syslog-ng STILL modifies it. The modified syslog message has the original IP address AND the server's IP address in chain format, which is no good. I want to keep the message UNtouched when it gets forwarded. If anyone has the answer to this question I would very much appreciate it. The MAIN reason why I installed syslog-ng was due to the claim that it could forward without changing the message, but so far it just looks like a claim. pj ====================================== Paul Jasa Network Engineer ====================================== -----Original Message----- From: Harrie.van.Arragon(a)steinmuehlen-brot.de [mailto:Harrie.van.Arragon@steinmuehlen-brot.de] Sent: Tuesday, August 19, 2003 05:17 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Forwarding unchanged Syslog messages Is it possible to forward syslogmessages without modifing the Host and the messages. I thought "keep_hostname(yes)" would solve the problem, but it didn't. Normaly i use version 1.5.15 shipped with debian, but I tryed 1.5.26 too. I don't konw if its important, but our syslogserver has a load of 100% the whole day (not from syslog-ng). I tryed the following config: options { use_fqdn(yes); sync(0); use_dns(yes); chain_hostnames(yes); keep_hostname(yes); }; source net { tcp(); udp();}; destination pc1 { udp(192.168.1.1);}; destination pc2 { udp(192.168.1.2);}; destination pc3 { udp(192.168.1.3);}; log { source(net); destination(pc1);}; log { source(net); destination(pc2);}; log { source(net); destination(pc3);}; bye Harrie _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]last message repeated?
by Rule, Ted 28 Aug '03

28 Aug '03

Dear old syslogd has explicit code to save a copy of the last message received, and compare it with the current message ( less the timestamp field and it only saves 256 bytes of message(?) ), so as to throttle out such floods. It's fairly basic, however, as it imposes no time restriction on the history buffer, so duplicate messages hours apart don't cause separate messages to be logged. As far as I'm aware, syslog-ng has never had this feature, but I agree it would be highly desirable to add to future releases. On the face of it, the basic functionality provided in syslogd shouldn't be difficult thing to code. however, the tricky bells&whistles feature would be to add a separate message history/throttle/cache(?)/aging(?) for each source IP so that a server could correctly spot multiple copies of the same message within a given timeframe even if intervening messages were from a different source. Ted -----Original Message----- From: Chuck Berg <chuck(a)encinc.com>@FLEXTECH Sent: Wednesday 02 July 2003 21:53 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]last message repeated? Is there a particular reason why syslog-ng doesn't generate "last message repeated x times" messages? It's very unfortunate to have the disk on my log server fill up because of one machine flooding the logs. For example, Solaris will send one "WARNING: /tmp: File system full, swap space limit exceeded" message for every write() that fails for that reason. It's easy to get tens of thousands of these per second. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Re: syslog-ng digest, Vol 1 #1032 - 9 msgs (Vacation)
by TIM MOORE 28 Aug '03

28 Aug '03

FYI: I will be out on vacation from 8/28 until 9/8. Please contact the NOC if you need immediate assistance. Thanks, Tim Moore

1 0

Re: syslog-ng digest, Vol 1 #1031 - 10 msgs (Vacation)
by TIM MOORE 28 Aug '03

28 Aug '03

FYI: I will be out on vacation from 8/28 until 9/8. Please contact the NOC if you need immediate assistance. Thanks, Tim Moore

1 0

template_escape character not valid for oracle
by Matt Scifo 27 Aug '03

27 Aug '03

Hello I just started using syslog-ng with an oracle database as my destination. I have discovered that Oracle does not accept a backslash as an escape character (I thought backslash was a standard). The following query does not work in Oracle... INSERT INTO messages (ID, TIMESTAMP, HOST ,FACILITY, PRIORITY, TAG, PROGRAM, MESSAGE) VALUES ('', to_date('2003-08-26 11:51:00', 'yyyy-mm-dd hh24:mi:ss'), 'host1', 'local0', 'warning', '84', '1', 'STOP: \'edrasmu\' message') It will only accept a single quote for escaping a single quote... INSERT INTO messages (ID, TIMESTAMP, HOST ,FACILITY, PRIORITY, TAG, PROGRAM, MESSAGE) VALUES ('', to_date('2003-08-26 11:51:00', 'yyyy-mm-dd hh24:mi:ss'), 'host1', 'local0', 'warning', '84', '1', 'STOP: ''edrasmu'' message') How hard would it be to change the escape character that syslog-ng is looking for, or even better, make a template_escape(string) option which accepts a custom escape string? Where is the code that handles the escaping of characters located in the source? Matt Scifo mscifo(a)o1.com

2 2

newbie linux/syslog-ng server question...
by Matt Miller 25 Aug '03

25 Aug '03

When running syslog-ng on linux, do I still need to run klogd... or does syslog-ng replace syslogd and klogd? matt -- Matt Miller IT Infrastructure Team Duke University - Fuqua School of Business

2 1

RE: [syslog-ng]$DAY in
by Jérôme Fenal 25 Aug '03

25 Aug '03

It seems that syslog-ng thinks you're looking for $DAY_ and not $DAY. Try to replace the underscore by a dot, or RTFM to see if syslog-ng supports specifying variables that way : ${DAY}. Regards, J. -----Original Message----- From: William Pope [mailto:pope.william@epa.gov] Sent: Mon 8/25/2003 20:43 To: syslog-ng(a)lists.balabit.hu Cc: Subject: [syslog-ng]$DAY in I recently upgraded syslog-ng from version 1.4.17 to 1.6.0rc3. After the upgrade, the system logs do not include the DAY when sent to the following destination. destination hosts { file("/var/adm/logs/$HOST/$YEAR/$MONTH/$DAY_$FACILITY"); }; I get logs like /var/logs/HOST/2003/08/kern.log instead of /var/logs/HOST/2003/08/25_kern.log like I did with version 1.4.17. The day and the underscore are missing. I am using the same conf file as 1.4.17. Any help would be greatly appreciated! I am sure I am missing something stupid. Thank you, Will ------------------------------------------------------------------- This is a PRIVATE message, intended for the designated recipient(s) only and may contain privileged or confidential information. If you have received this message in error, please notify me immediately, delete the original, and destroy any paper copies. Any other use of the email by you is prohibited. NOTE: Regardless of content, this e-mail shall not operate to bind the sender to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

1 0

$DAY in
by William Pope 25 Aug '03

25 Aug '03

I recently upgraded syslog-ng from version 1.4.17 to 1.6.0rc3. After the upgrade, the system logs do not include the DAY when sent to the following destination. destination hosts { file("/var/adm/logs/$HOST/$YEAR/$MONTH/$DAY_$FACILITY"); }; I get logs like /var/logs/HOST/2003/08/kern.log instead of /var/logs/HOST/2003/08/25_kern.log like I did with version 1.4.17. The day and the underscore are missing. I am using the same conf file as 1.4.17. Any help would be greatly appreciated! I am sure I am missing something stupid. Thank you, Will ------------------------------------------------------------------- This is a PRIVATE message, intended for the designated recipient(s) only and may contain privileged or confidential information. If you have received this message in error, please notify me immediately, delete the original, and destroy any paper copies. Any other use of the email by you is prohibited. NOTE: Regardless of content, this e-mail shall not operate to bind the sender to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose.

1 0

Any one ported syslog-ng for IRIX system
by Shah, Sanjay T [FI] 22 Aug '03

22 Aug '03

Has any one ported syslog-ng for IRIX system? Can you please provide some info on source ? Thanks sanjay

1 0

syslog-ng failed on Coosbay server,succeeded on Langley
by Wang, Zhenyu Z 22 Aug '03

22 Aug '03

After receiving your answer, I have tried a lot of configuration ways to make my syslog-ng to run on Coosbay server. But it failed at last. Then I compile and install syslog-ng-1.6rc3 on Langley server with RH7.3. Put sample config file into use. Everything seems so fine. I am now happy with syslog-ng. I am not sure about the difference between Coosbay and Langley. But syslog-ng does have some problems running on coosbay server. I don't know why. thanks zhen -----Original Message----- From: Hamilton Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Tuesday, August 19, 2003 8:20 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]src/tests/testall failed! I have 8 Redhat 7.3 systems running syslog-ng with that very source statement, except I use unix-dgram, and it works fine. Have you stopped klogd? Are you chroot-ing? Why don't you post your entire config file? That may help us help you more. Regards, Drew -----Original Message----- From: Wang, Zhenyu Z [mailto:zhenyu.z.wang@intel.com] Sent: Tuesday, August 19, 2003 1:33 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]src/tests/testall failed! Can you tell me why the script does not work? On my RH7.3, syslog-ng.conf.Redhat is not working fine. source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; $syslog-ng Error opening file /proc/kmsg for reading (No such file or directory) Error initializing configuration, exiting. Is there something in system I should tune? zhen -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, August 18, 2003 9:21 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]src/tests/testall failed! On Mon, Aug 18, 2003 at 05:19:20PM +0800, Wang, Zhenyu Z wrote: > After I have successfully compiled syslog-ng-1.0.6rc3, I run > src/tests/testall script but it failed. that script was written years ago and may not function correctly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Power fail restart
by Erik Ivanenko 21 Aug '03

21 Aug '03

I am running version 1.5.13. All but 2 of 60 remote devices FAILED to reconnect when the power returned in Ontario. The cental logging host did not go off-line, as it was on emergency power. I use the standard /etc/init.d/syslog-ng start scripts for the remote devices. They are all Linux machines. After issuing HUP to the central host, 9 of 60 connections are working. Running "snoop" shows that the remote daemons have stopped trying to connect. I thought that syslog-ng was supposed to reconnect after such events? Can anyone tell me what I can do to make these remote devices reconnect? Must I manually restart syslog-ng on each remote client? Thanks in advance...

2 1

RE: [syslog-ng]src/tests/testall failed!
by Wang, Zhenyu Z 20 Aug '03

20 Aug '03

I use the config file in contrib directory named syslog-ng.conf.Redhat. --begin-- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; --end-- syslogd & klogd are stopped. But syslog-ng failed to start. #service syslog status syslogd is stopped klogd is stopped #syslog-ng Error opening file /proc/kmsg for reading (No such file or directory) Error initializing configuration, exiting. Then I try to forget about kernel logging first. I use another simple configuration for test. --begin-- # Simple syslog-ng.conf file. options { use_fqdn(no); sync(0); }; source s_sys { unix-stream("/dev/log"); internal(); }; destination d_security { file("/var/log/security"); }; destination d_messages { file("/var/log/messages"); }; destination d_console { usertty("root"); }; filter f_authpriv { facility(auth, authpriv); }; filter f_messages { level(info .. emerg) and not facility(auth, authpriv); }; filter f_emergency { level(emerg); }; log { source(s_sys); filter(f_authpriv); destination(d_security); }; log { source(s_sys); filter(f_messages); destination(d_messages); }; log { source(s_sys); filter(f_emergency); destination(d_console); }; --end-- syslog-ng seems to start this time. But I find a file named '?' in the syslog-ng starting directory,it contains the exact logging messages. #syslog-ng #ls ? bin doc etc ... #logger -p local0.info "test test" #cat ? Aug 20 09:43:20 s_sys@power syslog-ng[351]: syslog-ng version 1.6.0rc3 starting Aug 20 09:43:20 s_sys@power syslog-ng[351]: syslog-ng version 1.6.0rc3 starting Aug 20 09:44:00 s_sys@power CROND[358]: (mailman) CMD (/usr/bin/python -S /var/mailman/cron/qrunner) Aug 20 09:44:00 s_sys@power CROND[358]: (mailman) CMD (/usr/bin/python -S /var/mailman/cron/qrunner) Aug 20 09:44:38 s_sys@power root: test test Aug 20 09:44:38 s_sys@power root: test test # The result is same by replace unix-stream with unix-dgram in source directive. The debug output is like: #syslog-ng -d -F io.c: listening on fd 3 syslog-ng version 1.6.0rc3 starting io.c: Preparing fd 4 for reading Read EOF on fd 4. Marking fd 4 for closing. Closing fd 4. io.c: Preparing fd 4 for reading Read EOF on fd 4. Marking fd 4 for closing. Closing fd 4. io.c: Preparing fd 4 for reading io.c: Preparing fd 5 for writing Read EOF on fd 4. Marking fd 4 for closing. Closing fd 4. io.c: Preparing fd 4 for reading Read EOF on fd 4. Marking fd 4 for closing. Closing fd 4. ... best regards zhen -----Original Message----- From: Hamilton Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Tuesday, August 19, 2003 8:20 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]src/tests/testall failed! I have 8 Redhat 7.3 systems running syslog-ng with that very source statement, except I use unix-dgram, and it works fine. Have you stopped klogd? Are you chroot-ing? Why don't you post your entire config file? That may help us help you more. Regards, Drew -----Original Message----- From: Wang, Zhenyu Z [mailto:zhenyu.z.wang@intel.com] Sent: Tuesday, August 19, 2003 1:33 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]src/tests/testall failed! Can you tell me why the script does not work? On my RH7.3, syslog-ng.conf.Redhat is not working fine. source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; $syslog-ng Error opening file /proc/kmsg for reading (No such file or directory) Error initializing configuration, exiting. Is there something in system I should tune? zhen -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, August 18, 2003 9:21 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]src/tests/testall failed! On Mon, Aug 18, 2003 at 05:19:20PM +0800, Wang, Zhenyu Z wrote: > After I have successfully compiled syslog-ng-1.0.6rc3, I run > src/tests/testall script but it failed. that script was written years ago and may not function correctly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Forwarding unchanged Syslog messages
by Hamilton Andrew 19 Aug '03

19 Aug '03

The keep_hostname is a server option really. If you are receiving messages on that host than keep_hostname is what you are looking for. The server on the other end of your connection,ie 192.168.1.1 needs to be syslog-ng and have its keep_hostname option set to on. Turn chain_hostnames off as all this does is put each hostname that it has passed through on the hostname chain. You probably don't want that. Regards, Drew -----Original Message----- From: Harrie van Arragon [mailto:harrieva@web.de] Sent: Tuesday, August 19, 2003 9:19 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Forwarding unchanged Syslog messages Is it possible to forward syslogmessages without modifing the Host and the messages. I thought "keep_hostname(yes)" would solve the problem, but it didn't. Normaly i use version 1.5.15 shipped with debian, but I tryed 1.5.26 too. I don't konw if its important, but our syslogserver has a load of 100% the whole day (not from syslog-ng). I tryed the following config: options { use_fqdn(yes); sync(0); use_dns(yes); chain_hostnames(yes); keep_hostname(yes); }; source net { tcp(); udp();}; destination pc1 { udp(192.168.1.1);}; destination pc2 { udp(192.168.1.2);}; destination pc3 { udp(192.168.1.3);}; log { source(net); destination(pc1);}; log { source(net); destination(pc2);}; log { source(net); destination(pc3);}; bye Harrie __________________________________________________________________________ Die sicherste Form der Kommunikation: E-Mails verschluesseln, Spam-Filter, Adressverifizierung, digitale Unterschrift: http://freemail.web.de _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Forwarding unchanged Syslog messages
by Harrie van Arragon 19 Aug '03

19 Aug '03

Is it possible to forward syslogmessages without modifing the Host and the messages. I thought "keep_hostname(yes)" would solve the problem, but it didn't. Normaly i use version 1.5.15 shipped with debian, but I tryed 1.5.26 too. I don't konw if its important, but our syslogserver has a load of 100% the whole day (not from syslog-ng). I tryed the following config: options { use_fqdn(yes); sync(0); use_dns(yes); chain_hostnames(yes); keep_hostname(yes); }; source net { tcp(); udp();}; destination pc1 { udp(192.168.1.1);}; destination pc2 { udp(192.168.1.2);}; destination pc3 { udp(192.168.1.3);}; log { source(net); destination(pc1);}; log { source(net); destination(pc2);}; log { source(net); destination(pc3);}; bye Harrie __________________________________________________________________________ Die sicherste Form der Kommunikation: E-Mails verschluesseln, Spam-Filter, Adressverifizierung, digitale Unterschrift: http://freemail.web.de

1 0

RE: [syslog-ng]Wild files
by Hamilton Andrew 19 Aug '03

19 Aug '03

Again, post your config file. I'm not sure what you are asking. Are you talking about wild cards in filenames? There are macros designed to help you use dynamic files. Regards, Drew -----Original Message----- From: Wang, Zhenyu Z [mailto:zhenyu.z.wang@intel.com] Sent: Tuesday, August 19, 2003 5:41 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Wild files Could you answer my question on wild files like '?' or '"'? It seems to contain the log message as well, while it failed to log message into dest like: destination d_message { file("/var/log/messages"); }; $syslog-ng -d -F binding fd 3, unixaddr: /dev/log io.c: Preparing fd 3 for reading syslog-ng version 1.6.0rc3 starting io.c: Preparing fd 4 for writing (then stopped) thanks zhen -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, August 18, 2003 9:21 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]src/tests/testall failed! On Mon, Aug 18, 2003 at 05:19:20PM +0800, Wang, Zhenyu Z wrote: > After I have successfully compiled syslog-ng-1.0.6rc3, I run > src/tests/testall script but it failed. that script was written years ago and may not function correctly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]src/tests/testall failed!
by Hamilton Andrew 19 Aug '03

19 Aug '03

I have 8 Redhat 7.3 systems running syslog-ng with that very source statement, except I use unix-dgram, and it works fine. Have you stopped klogd? Are you chroot-ing? Why don't you post your entire config file? That may help us help you more. Regards, Drew -----Original Message----- From: Wang, Zhenyu Z [mailto:zhenyu.z.wang@intel.com] Sent: Tuesday, August 19, 2003 1:33 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]src/tests/testall failed! Can you tell me why the script does not work? On my RH7.3, syslog-ng.conf.Redhat is not working fine. source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; $syslog-ng Error opening file /proc/kmsg for reading (No such file or directory) Error initializing configuration, exiting. Is there something in system I should tune? zhen -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, August 18, 2003 9:21 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]src/tests/testall failed! On Mon, Aug 18, 2003 at 05:19:20PM +0800, Wang, Zhenyu Z wrote: > After I have successfully compiled syslog-ng-1.0.6rc3, I run > src/tests/testall script but it failed. that script was written years ago and may not function correctly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Wild files
by Wang, Zhenyu Z 19 Aug '03

19 Aug '03

Could you answer my question on wild files like '?' or '"'? It seems to contain the log message as well, while it failed to log message into dest like: destination d_message { file("/var/log/messages"); }; $syslog-ng -d -F binding fd 3, unixaddr: /dev/log io.c: Preparing fd 3 for reading syslog-ng version 1.6.0rc3 starting io.c: Preparing fd 4 for writing (then stopped) thanks zhen -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, August 18, 2003 9:21 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]src/tests/testall failed! On Mon, Aug 18, 2003 at 05:19:20PM +0800, Wang, Zhenyu Z wrote: > After I have successfully compiled syslog-ng-1.0.6rc3, I run > src/tests/testall script but it failed. that script was written years ago and may not function correctly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Forwarding unchanged Syslog messages
by Harrie.van.Arragon＠steinmuehlen-brot.de 19 Aug '03

19 Aug '03

Is it possible to forward syslogmessages without modifing the Host and the messages. I thought "keep_hostname(yes)" would solve the problem, but it didn't. Normaly i use version 1.5.15 shipped with debian, but I tryed 1.5.26 too. I don't konw if its important, but our syslogserver has a load of 100% the whole day (not from syslog-ng). I tryed the following config: options { use_fqdn(yes); sync(0); use_dns(yes); chain_hostnames(yes); keep_hostname(yes); }; source net { tcp(); udp();}; destination pc1 { udp(192.168.1.1);}; destination pc2 { udp(192.168.1.2);}; destination pc3 { udp(192.168.1.3);}; log { source(net); destination(pc1);}; log { source(net); destination(pc2);}; log { source(net); destination(pc3);}; bye Harrie

1 0