- syslog-ng - lists.balabit.hu

RE: [syslog-ng]src/tests/testall failed!
by Wang, Zhenyu Z 19 Aug '03

19 Aug '03

Can you tell me why the script does not work? On my RH7.3, syslog-ng.conf.Redhat is not working fine. source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; $syslog-ng Error opening file /proc/kmsg for reading (No such file or directory) Error initializing configuration, exiting. Is there something in system I should tune? zhen -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, August 18, 2003 9:21 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]src/tests/testall failed! On Mon, Aug 18, 2003 at 05:19:20PM +0800, Wang, Zhenyu Z wrote: > After I have successfully compiled syslog-ng-1.0.6rc3, I run > src/tests/testall script but it failed. that script was written years ago and may not function correctly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Reliable syslog and network outages
by Roland Turner 18 Aug '03

18 Aug '03

I'm trying to work out whether syslog-ng can deliver syslog messages reliably in the face of client reboots during network partitions. From reading the documentation, it is not clear where log_fifo stores its data (disk or memory) and therefore whether or not log entries on a remote syslog client that queue up during a partition of the network which seperates syslog client from loghost will remain queued if the syslog client host reboots. If my approach is unworkable, pointers or aid on how to solve the general problem another way would be greatly appreciated. Here are the details: 1. Several administered machines are located at diverse locations, generally where they are used primarily/entirely by local users. 2. Local users can ordinarily continue to do useful work even if they lose external network connectivity for a while; consequently HA network connectivity is not a user requirement. 3. The machines do not generally require direct intervention very often, so from an administration standpoint, 100% reachability is also not a requirement. 4. As a result of points 2 and 3, highly reliable connectivity is not available; outages of minutes or hours really do occur. 5. Pre-syslog-ng implementations of syslog using UDP will simply lose all log entries during the time that a network is partitioned. This is definitely not OK. 6. Syslog-ng appears to offer TCP-based delivery which certainly solves one issue; normal network paket loss is not an issue. 7. Syslog-ng appears to maintain an internal FIFO which, if sized large enough on a syslog relay host at the remote location(s), could collect all log information generated during a partition and then successfully deliver it when connectivity is restored. 8. If, however, syslog-ng's internal FIFO is memory-based then if the remote location's syslog relay host is rebooted during the network partition then all that it has accumulated and not yet transferred will be lost. (Similarly if the death of the TCP connection is treated as reason to give up, rather than continually retry.) 9. What information I have found on dealing with this appears to deal with loghost unreliability rather than network unreliability, and thus recommends providing HA through additional, redundant, loghosts. Setting aside the problems in reconcilliation of logs that this implies, it takes away the reason for having syslog deliver via IP directly (rather than, say, email) entirely. Does syslog-ng provide a means to deal with this problem? Does some other solution exist? Thanks in advance. - Raz

3 5

src/tests/testall failed!
by Wang, Zhenyu Z 18 Aug '03

18 Aug '03

After I have successfully compiled syslog-ng-1.0.6rc3, I run src/tests/testall script but it failed. Config file is syslog-ng.conf.eval. source src { unix-stream("input"); }; destination d1 { file("d1"); }; destination d2 { file("d2"); }; destination d3 { file("d3"); }; destination d4 { file("d4"); }; destination d5 { file("d5"); }; destination d6 { file("d6"); }; destination d7 { file("d7"); }; filter f1 { facility(local0); }; filter f2 { facility(local1) and level(debug); }; filter f3 { facility(local2) and not level(debug); }; filter f4 { not (facility(local3) and level(debug)); }; filter f5 { facility(local4) or level(info); }; filter f6 { facility(local4) or not level(info); }; filter f7 { not (facility(local4) or level(info)); }; log { source(src); filter(f1); destination(d1); }; log { source(src); filter(f2); destination(d2); }; log { source(src); filter(f3); destination(d3); }; log { source(src); filter(f4); destination(d4); }; log { source(src); filter(f5); destination(d5); }; log { source(src); filter(f6); destination(d6); }; log { source(src); filter(f7); destination(d7); }; Error message is like: + rm 'd?' rm: cannot remove `d?': No such file or directory + ../syslog-ng -f syslog-ng.conf.eval -p syslog-ng.pid Warning: No source refers to internal messages, they'll go to /dev/null + logger -u input -p local0.debug 'msg: local0.debug' + logger -u input -p local1.debug 'msg: local1.debug' + logger -u input -p local1.info 'msg: local1.info' + logger -u input -p local2.debug 'msg: local2.debug' + logger -u input -p local2.info 'msg: local2.info' + logger -u input -p local3.debug 'msg: local3.debug' + logger -u input -p local4.info 'msg: local4.info' + logger -u input -p local6.info 'msg: local6.info' + logger -u input -p local4.debug 'msg: local4.debug' + logger -u input -p local6.info 'msg: local6.info' ++ cat syslog-ng.pid + pid= + kill -TERM ./test.eval: kill: : no such pid + sleep 2 + kill -TERM ./test.eval: kill: : no such pid + rm syslog-ng.pid ++ wc -l 'd?' wc: d?: No such file or directory + result= + rm 'd?' rm: cannot remove `d?': No such file or directory + '[' '' '!=' ' 1 d1 1 d2 1 d3 10 d4 6 d5 7 d6 5 d7 31 total' ']' + echo 'evaluation test failed' evaluation test failed + exit 1 I appreciate somebody tell me why. I have also found some "?" files in the direcotory starting syslog-ng daemon. What can these "?" be used? Zhen Not speaking for my employer -- all opinions are my own (and my fault)

2 1

syslog-ng-1.6.0rc3 crashes after some hours
by Rudolfs Osins 15 Aug '03

15 Aug '03

Hello everyone, I have the folloving problem: After some hours as daemon (~1 - 2h) syslog-ng crashes, leaving no info on what happened in the logs or elsewhere. I run the daemon with syslog-ng -u syslog-ng -g syslog-ng and the user and group exists in the system. The config file I use is attached. Compile options are following: libol-0.3.10 ./configure --prefix=/usr/local/opt/libol make syslog-ng-1.6.0rc3 ./configure --prefix=/usr/local/opt/syslog-ng --with-libol=/usr/src/libol-0.3.10 make make install The system is a celeron 1700Mhz with 128Mb ram and there are just 2 other proccesses beside syslog-ng - fcron and ntpd. Another question is: when I delete a logfile when syslog-ng is still running for the first time, syslog-ng recreates the file, when it recives a message thats destination is the deleted file, but when I delete the same file a second time, it's not being recreated. Is there a way to make syslog-ng recreate the file everytime ? And the last question is, when could the message encryption feature be implemented ? Btw. great work ! Syslog-ng is a really good product ! best regards, Rudolfs

1 1

Behaviour on comm failure.
by Erik Ivanenko 14 Aug '03

14 Aug '03

Does syslog-ng guarantee delivery of messages when communcations to the logging host is lost? ie. are syslog-ng messages buffered until the communcations are re-established? Thank you!

1 0

half open connections.
by Erik Ivanenko 14 Aug '03

14 Aug '03

Hello, I don't know if this has been implemented, but I think not yet... Our intended usage of syslog-ng is for remote devices to annunciate alarms as part of a building automation system as folows: When a remote devices detects an alarm in a building system, a message is issued to the host via a syslog-ng TCP connection. The syslog-ng daemon on the host uses a FIFO to pass the message to a waiting task to dump that message into a database and add further formatting to the message for delivery to our alarms terminals. My problem is that if the remote devices is powered off, a 1/2 open connected will result on the server, that necessitates a SIGHUP to remove (or the syslog-ng to be restarted.) Is there a version of syslog-ng that will test each connection at a timed interval and close if the remote device is not present? Thank you for a great piece of work! Cheers.

1 0

RE: [syslog-ng]IETF Syslog Draft
by Clemson, Chris 13 Aug '03

13 Aug '03

Interesting. There's also http://www.ietf.org/internet-drafts/draft-ietf-syslog-sign-11.txt for security stuff. I know it's dated May but did anyone see it? > For those interested in where the standard is going: > > http://www.ietf.org/internet-drafts/draft-ietf-syslog-internat > ional-00.txt > > If you are interested in features and option, now is the time to speak > up. > > > Richard -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

2 2

RE: [syslog-ng]syslog-ng&logrotate
by Hamilton, Andrew 13 Aug '03

13 Aug '03

When you rotate the logs you have to send syslog-ng a SIGHUP to make it look at your new file. If you are using Linux if you look in /etc/logrotate.d there is a file called syslog, make sure it is picking up the correct pid file so that it is HUPing the right process on log rotation. Regards, Drew -----Original Message----- From: yannick.haguenier(a)tuxfamily.org [mailto:yannick.haguenier@tuxfamily.org] Sent: Thursday, July 10, 2003 7:03 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng&logrotate Hy, i have squid + syslog-ng 1.0.6.rc1 Syslog-ng look squid/access.log, and write log file (with date format) on a remote server (tcp). On squid there is a logrotate at 6 am. My pb : before the log rotate, all is good. After logrotate, syslog-ng don't write in the remote file. The last line appear in this file was create at 6am. The process run on the both server, and i have no error. If i run syslog-ng restart, syslog-ng write the ligne in remote file . the next error appear after the next logrotate. Does anyone know why this is happening? thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

resolve IP addresses
by Madhvi Gokool 12 Aug '03

12 Aug '03

> Hello > Can syslog-ng resolve IP addresses using the /etc/hosts file? We do not have > an internal dns at the moment. Currently , the filenames that are created > are the IP addresses of the routers that are pushing their syslog onto the > syslog server. > > Regards > Madhvi >

3 2

end of line character
by Franky Van Liedekerke 08 Aug '03

08 Aug '03

Hi all, I'm using syslog-ng for quite a while now, and I'm a happy user. However, there's one thing that I can't seem to be getting right: how to filter out messages ending on a specific word, e.g. I would like to ignore all messages that have the string "admin: $" in it (the dollar-sign indicating end-of-line). But the match expression doesn't seem to recognize this end-of-line character, so can anybody tell me how to achieve this? thanx already! Franky

1 0

RE: [syslog-ng]Program destination never executes
by Chris Robertson 08 Aug '03

08 Aug '03

Checked that, it works fine from the command line. :( Chris -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Thursday, August 07, 2003 3:33 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Program destination never executes On Thu, Aug 07, 2003 at 02:10:26PM -0700, Chris Robertson wrote: > I hoping that someone can point out what I'm doing wrong here. I have the > following configuration in my syslog-ng.conf file but the program referenced > in d_mysql_prog is never executed (I've tried a simple version that just > outputs to a file as well). Note the file gets all the messages properly > and I've cut out the non-relevant sections of the config. I don't see anything wrong here, I'd make sure the script isn't just dying as soon as it starts. -- Nate Windows is the answer, but only if the question was 'what is the intellectual equivalent of being a galley slave?' _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Program destination never executes
by Chris Robertson 07 Aug '03

07 Aug '03

I hoping that someone can point out what I'm doing wrong here. I have the following configuration in my syslog-ng.conf file but the program referenced in d_mysql_prog is never executed (I've tried a simple version that just outputs to a file as well). Note the file gets all the messages properly and I've cut out the non-relevant sections of the config. source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; source net { udp(ip("0.0.0.0") port(514)); }; destination d_file { file ("/tmp/syslog"); }; destination d_mysql_prog { program ("/root/syslog2.pl"); }; log { source(net);destination(d_mysql_prog); }; log { source(src);destination(d_mysql_prog); }; log { source(src);destination(d_file); }; log { source(net);destination(d_file); }; Thanks, Chris

2 1

RE: [syslog-ng]2 quick (i hope!) libol questions
by Clemson, Chris 07 Aug '03

07 Aug '03

ah, ok, thanks! > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: 07 August 2003 11:19 > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]2 quick (i hope!) libol questions > > > On Thu, Aug 07, 2003 at 11:13:16AM +0100, Clemson, Chris wrote: > > I'm just about to upgrade to syslog-ng to try and see if it > stops the > > problem with dropping stats that we are having at the moment. > > > > in the docs it mentions that i need libol 0.3.x, which i am about to > > compile. > > however, searching on my system, i cant see any version of > libol, even > > though v1.2 of syslog-ng seems to need 0.2.8. > > > > My questions are, what does libol actually do, and why > wouldn't my machine > > already have a copy of it somewhere? > > libol is compiled into syslog-ng statically (by default), > therefore there's > no shared lib in the system. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD > 804E C82C 8EB1 > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

2 quick (i hope!) libol questions
by Clemson, Chris 07 Aug '03

07 Aug '03

I'm just about to upgrade to syslog-ng to try and see if it stops the problem with dropping stats that we are having at the moment. in the docs it mentions that i need libol 0.3.x, which i am about to compile. however, searching on my system, i cant see any version of libol, even though v1.2 of syslog-ng seems to need 0.2.8. My questions are, what does libol actually do, and why wouldn't my machine already have a copy of it somewhere? thanks! chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

2 1

RE: [syslog-ng]Redhat 7.2, syslog-ng 1.6 and logger, and no loggi ng
by Weidner, Erich 04 Aug '03

04 Aug '03

Just a typo, I can't seem to paste into cxoffice running IE (outlook web <sigh>). But I'm getting farther. In spite of the fact that "which syslog-ng" returned /usr/local/sbin/syslog-ng" which when I executed with "-V" reported as version 6rc3, I just noticed the start stop entries in the log file was still version stamped 1.5(somthing). Somehow the redhat init script is calling the wrong one, but I deleted the old one from whereever else it was, then I found that it was failing to start due to looking for it's config file in /usr/local/etc/sysconfig-ng/ not in /etc/sysconfig-ng/ I found the switch for the configure file reconfigured and recompiled and now it's working! The man page indicates that w/o the -f param it looks in /etc/syslog-ng, but if that was the intent, shouldn't hte configure script be changed to actually reflect this? Anyway thanks for the help! -Erich -----Original Message----- From: Hamilton Andrew To: syslog-ng(a)lists.balabit.hu Sent: 8/4/03 2:04 PM Subject: RE: [syslog-ng]Redhat 7.2, syslog-ng 1.6 and logger, and no logging It may be a typo on the message but your filter line says f_fileter2 and your log line says f_filter2. Could this be your problem? Regards -----Original Message----- From: Weidner, Erich [mailto:eweidner@ciber.com] Sent: Monday, August 04, 2003 3:56 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Redhat 7.2, syslog-ng 1.6 and logger, and no logging I'm unable to get messages into /var/log/messages with logger. I've compiled and installed syslog-ng 1.6rc3, I've the following config. (modified the contrib/syslong-ng.conf.Redhat) config file. Relavent lies of it are: source s_sys { pipe ("proc/kmsg" log_prefix"kernel: ")); unix-dgram ("/dev/log"); internal(); }; filter f_fileter2 { level(info .. emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; I've tried the following: logger -p daemon.crit "Testing, Hello?" and various others such as user.crit user.warn, etc. Nothing. Syslog-ng does however log the fact that it starts and stops (at least after I edited the default filter to be (info .. emerg) instead of just (info) I also see a few entries for STATS: dropped 0. Help! -Erich

1 0

RE: [syslog-ng]Redhat 7.2, syslog-ng 1.6 and logger, and no loggi ng
by Hamilton Andrew 04 Aug '03

04 Aug '03

It may be a typo on the message but your filter line says f_fileter2 and your log line says f_filter2. Could this be your problem? Regards -----Original Message----- From: Weidner, Erich [mailto:eweidner@ciber.com] Sent: Monday, August 04, 2003 3:56 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Redhat 7.2, syslog-ng 1.6 and logger, and no logging I'm unable to get messages into /var/log/messages with logger. I've compiled and installed syslog-ng 1.6rc3, I've the following config. (modified the contrib/syslong-ng.conf.Redhat) config file. Relavent lies of it are: source s_sys { pipe ("proc/kmsg" log_prefix"kernel: ")); unix-dgram ("/dev/log"); internal(); }; filter f_fileter2 { level(info .. emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; I've tried the following: logger -p daemon.crit "Testing, Hello?" and various others such as user.crit user.warn, etc. Nothing. Syslog-ng does however log the fact that it starts and stops (at least after I edited the default filter to be (info .. emerg) instead of just (info) I also see a few entries for STATS: dropped 0. Help! -Erich

1 0

Redhat 7.2, syslog-ng 1.6 and logger, and no logging
by Weidner, Erich 04 Aug '03

04 Aug '03

I'm unable to get messages into /var/log/messages with logger. I've compiled and installed syslog-ng 1.6rc3, I've the following config. (modified the contrib/syslong-ng.conf.Redhat) config file. Relavent lies of it are: source s_sys { pipe ("proc/kmsg" log_prefix"kernel: ")); unix-dgram ("/dev/log"); internal(); }; filter f_fileter2 { level(info .. emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; I've tried the following: logger -p daemon.crit "Testing, Hello?" and various others such as user.crit user.warn, etc. Nothing. Syslog-ng does however log the fact that it starts and stops (at least after I edited the default filter to be (info .. emerg) instead of just (info) I also see a few entries for STATS: dropped 0. Help! -Erich

1 0

new member
by Ravi shetkar 02 Aug '03

02 Aug '03

Hi My name is Shetkar Ravi and AS i am new to syslog-ng I am interested to become a new syslog-ng member to learn more about syslog-ng. I am currently working on logging server project. I searched the web and found lot of good things and recommendations about the syslog-ng and decided install and test in my solaris/HP/Aix environment. I down loaded libol-0.3.9 and syslog-ng-1.6.0rc3 and installed and compiled on solaris 8 server. I added /etc/syslog-ng/syslog-ng.conf file and modified the /etc/init.d/syslog file, but when try to start the syslog-ng (/etc/init.d/syslog start) it giving me following error on the console.. io.c: bind_inet_socket() bind failed 0.0.0.0:514 Address already in use Need your help and suggestion for syslog-ng configuration...to make it work on my syslog -ng centralize logging server. Do i need to install syslog-ng on all the clients also or the default syslog will work.? and then what will be the syslog.conf file on clients. Follwing are my configuration files.. /etc/syslog-ng/syslog-ng.conf file.. # more syslog-ng.conf # # Syslog-ng example configuration file for Solaris # #use_fqdn() add FQDN instead of short hostname #use_dns() use DNS (may cause DOS) #sync() number of lines buffered before written to file #log_fifo_size() number of lines fitting to the output queue # #options { use_fqdn(no); # keep_hostname(yes); # use_dns(no); # long_hostnames(off); # sync(0); # log_fifo_size(1000); }; options { sync(0); keep_hostname(yes); chain_hostnames(no); log_fifo_size(30000); }; source s_local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_net_udp { udp(); }; destination d_local { file("/logs/messages"); }; log { source(s_local); source(s_net_udp); destination(d_local); }; # # local and network sources # # + will accept udp/tcp connections on port 514 from any host # + keepalive option is for tcp only and will keep connection open # when the SIGHUP signal is seen # #source s_stream { sun-streams("/dev/log" door("/etc/.syslog_door"); }; #source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal();}; #source network { udp(); tcp(); }; #source s_tcp { tcp(ip(127.0.0.1) port(19990) max-connections(10)); }; #Source s_udp { udp(); }; # # standard destinations for local standard system messages # destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination kern { file("/var/log/kern.log"); }; destination maillog { file("/var/log/maillog"); }; # # special log destinations for our remote hosts # (pixlog, switchlog) and for our IP Filter firewall (ipflog) # #destination ipflog { file("/var/log/ipf.log"); }; #destination pixlog { file("/var/log/pix.log"); }; #destination switchlog { file("/var/log/switch.log"); }; # # Some log files used to catch remaining messages # destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; # # console destination # destination console { file("/dev/sysmsg"); }; # # filters for standard local system messages which come # in on non-local facilities # filter f_authpriv { facility(auth) ; }; filter f_syslog { not facility(auth) and not facility(mail); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; # # filters for IPFilter and the Cisco equipment # #filter f_ipf { facility(local0); }; #filter f_pix { facility(local4); }; #filter f_switch { facility(local6, local7); }; # # catch the rest # filter f_debug { not facility(kern, auth, mail, local6, local7, local4, local0); }; filter f_messages { level(info .. warn) and not facility(auth, mail, local0, local4 , local6, local7); }; # # filters for various emergency level messages # filter f_emergency { level(emerg); }; # # log emergency level messages out to console # log { source(local); filter(f_emergency); destination(console); }; # # log messages from local machine # log { source(local); filter(f_authpriv); destination(authlog); }; log { source(local); filter(f_syslog); destination(syslog); }; log { source(local); filter(f_kern); destination(kern); }; log { source(local); filter(f_mail); destination(maillog); }; # # log IP Filter messages to the ipf.log # #log { source(local); filter(f_ipf); destination(ipflog); }; # # log switch and pix messages # #log { source(network); filter(f_pix); destination(pixlog); }; #log { source(network); filter(f_switch); destination(switchlog); }; # # catch the rest of the messages # log { source(local); source(network); filter(f_debug); destination(debug); }; log { source(local); source(network); filter(f_messages); destination(messages); }; # # Automatic sorting of host messages by $HOST and $YEAR$MONTH$DAY # # + will automatically create a directory structure for all messages # sorted first by host, then by date, then by facility. # + with use_dns(no) we will have files based on ip address not hostname # destination hosts { file("/var/log/HOSTS/$HOST/$YEAR$MONTH$DAY/$FACILITY" owner(roo t) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; # # logs all incoming messages from network source to the sorted # destination # log { source(network); destination(hosts); }; My /etc/init.d/syslog file is # more syslog #!/sbin/sh # # script to start syslog-ng on boot up for a Solaris machine. # This script replaces /etc/init.d/syslog on a Solaris machine. # case "$1" in 'start') if [ -f /etc/syslog-ng.conf -a -f /usr/local/sbin/syslog-ng ]; then echo 'syslog-ng service starting.' # # Before syslogd starts, save any messages from previous # crash dumps so that messages appear in chronological order. # /usr/bin/savecore -m if [ -r /etc/dumpadm.conf ]; then . /etc/dumpadm.conf [ "x$DUMPADM_DEVICE" != xswap ] && \ /usr/bin/savecore -m -f $DUMPADM_DEVICE fi if [ ! -f /var/adm/messages ]; then /usr/bin/cp /dev/null /var/adm/messages /usr/bin/chmod 0644 /var/adm/messages fi /usr/local/sbin/syslog-ng >/dev/msglog 2>&1 & fi ;; 'stop') echo 'syslog-ng service stopping.' if [ -f /var/run/syslog-ng.pid ]; then syspid=`/usr/bin/cat /var/run/syslog-ng.pid` [ "$syspid" -gt 0 ] && kill -15 $syspid fi ;; *) echo "Usage: $0 { start | stop }" exit 1 ;; esac my daemon is in /usr/loca/sbin/syslog-ng thanks for your help. Shetkar Ravi Unix systel Administrator. WebMD rshetkar(a)webmd.net rshetkar88(a)yahoo.com --------------------------------- Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software

1 0

Enterasys SSR syslog message date format patch fix
by Rule, Ted 31 Jul '03

31 Jul '03

As previously posted, my old v 1.5 syslog-ng daemon had a little problem with SSR syslog messages which incorrectly use "MMM 0D" format instead of "MMM D" format for days 1 to 9 of each month, against RFC3164's strictures, and unlike all other hosts and routers I've come across. As a fix, I first upgraded to 1.6.0rc3 latest snapshot, manually forced one of the SSR's into "tomorrow", and thereby forced a syslog message of the wrong format to be issued as per below: Jul 31 16:54:35 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (exit ) executed Jul 31 16:55:46 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (system show date ) executed Aug 01 01:01:01 fttv-e7D-ssr-sl1 %SYS-I-DATE_CHANGE, The system's date has been changed to: 2003-08-01 01:01:01 Aug 01 01:01:07 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (system show date ) executed Aug 01 01:01:33 fttv-e7D-ssr-sl1 %CONFIG-W-NOTSAVED, Changes made to the running system are not saved to Startup Aug 01 01:01:36 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (guest). Aug 01 01:01:36 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (logout ) executed Which goes to prove that even v1.6 code still 'fails' to auto-correct the broken date-stamp. The patch fix below corrects the problem in src/log.c - simply patch log.c and touch log.c.x and remake the syslog-ng binary. [user@host syslog-ng]$ pwd /usr/src/patches/syslog-ng [user@host syslog-ng]$ diff -u log.c-1.6.0rc3.orig log.c-1.6.0rc3.patched --- log.c-1.6.0rc3.orig Tue Jul 29 09:36:59 2003 +++ log.c-1.6.0rc3.patched Tue Jul 29 10:05:44 2003 @@ -108,6 +108,22 @@ src[9] == ':' && src[12] == ':') { /* Expected buffer format: MMM DD HH:MM:SS ... */ + /* Catcher for violation of RFC3164 para 4.1.2: + "If the day of the month is less than 10, then it MUST + be represented as a space and then the number. + For example, the 7th day of August would be represented + as "Aug 7", with two spaces between the "g" and + the "7"." + + Enterasys Expedition Routers are known to violate + this clause. + + Ted_Rule(a)flextech.co.uk: 29/07/2003 */ + if ( src[4] == '0' && isdigit(src[5]) && + isdigit(src[7]) && isdigit(src[8]) ) { + src[4] = ' '; + } + /* Just read the buffer data into a textual datestamp. */ lm->date = c_format_cstring("%s", 15, src); [user@host syslog-ng]$ Which resulted in the correct format messages appearing in the actual syslog files, after which time, I flipped the router back to "today" and re-enabled NTP. Jul 31 16:54:35 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (enabled). Jul 31 16:54:35 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (exit ) executed Jul 31 16:55:46 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (system show date ) executed Aug 01 01:01:01 fttv-e7D-ssr-sl1 %SYS-I-DATE_CHANGE, The system's date has been changed to: 2003-08-01 01:01:01 Aug 01 01:01:07 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (system show date ) executed Aug 01 01:01:33 fttv-e7D-ssr-sl1 %CONFIG-W-NOTSAVED, Changes made to the running system are not saved to Startup Aug 01 01:01:36 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (guest). Aug 01 01:01:36 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (logout ) executed Aug 1 01:10:22 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (guest). Aug 1 01:10:22 fttv-e7D-ssr-sl1 %TELNETD-A-LOGIN, Telnet user login Aug 1 01:10:24 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (enabled). Aug 1 01:10:24 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (en ) executed Jul 31 17:08:00 fttv-e7D-ssr-sl1 %SYS-I-DATE_CHANGE, The system's date has been changed to: 2003-07-31 17:08:00 Jul 31 17:08:05 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (system show date ) executed Jul 31 17:08:23 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (guest). Jul 31 17:08:23 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (logout ) executed I believe the reason that the date parsing of the original message fails to auto-correct the problem is that the write of msg->date to msg->line in src/affile.c/do_handle_dest__writer() uses the original 15 byte raw date string, rather than rebuild a date string on the fly from the tm struct which is parsed by log.c: static void do_handle_dest_writer(struct log_handler *c, struct log_info *msg) { CAST(affile_dest_writer, self, c); if (self->dest) { struct ol_string *msg_line; if (self->owner->template_output) { msg_line = expand_macros( self->owner->cfg, self->owner->template_output, self->owner->template_escape, msg); } else { msg_line = c_format("%S %S %S\n", msg->date, msg->host, msg->msg); } A_WRITE_STRING(&self->dest->buffer->super, msg_line); if (self->reap) io_callout_set_timeout(self->reap, self->time_reap); } log_info_free(msg); } Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Remote log receive
by MiikaT 30 Jul '03

30 Jul '03

Hi, I'm new to syslog-ng and was wondering if following scenario is possible with it. I'm sending log from remote device to syslog-ng with these facilities: local0.info local1.info local2.info Can I make all logs go into one separate log file based on the source ip, or all three log facilities to different files also based on the source ip? I tried to implement the sample configurations, with no luck so far. -MiikaT ------------------------------------------------- This mail sent through IMP: http://horde.org/imp/

2 2

RE: [syslog-ng]syslog-ng misinterpreting messages from Enterasys Routers.
by Rule, Ted 30 Jul '03

30 Jul '03

Dunno if you wanted to know, but I'll answer it anyway. My simple fix was to change this: options { chain_hostnames(no); keep_hostname (yes); to this: options { chain_hostnames(no); check_hostname(yes); # Added to fix SSR decode bug keep_hostname (yes); # Changed from yes to try and fix SSR decode bug # now changed back following use of check_hostname... in the Global Options settings... the default check_hostname code hard-wired in the source were sufficient to avoid the problem of misinterpretation, even on my old v1.5.24 code at the time. i.e. this bit of code was effectively enabled, causing it to skip over the %CONS-W-BADPASSWD string by dint of it not being deemed a valid hostname character: while (left && *src != ' ' && *src != ':' && *src != '[') { if (lm->flags & LF_CHECK_HOSTNAME && !((*src >= 'A' && *src <= 'Z') || (*src >= 'a' && *src <= 'z') || (*src >= '0' && *src <= '9') || *src == '-' || *src == '_' || *src == '.' || *src == ':' || *src == '@' || *src == '/')) { break; } src++; left--; } Ted -----Original Message----- From: "Urmas Jagomann" <urmas(a)eyp.ee>@FLEXTECH Sent: Wednesday 30 July 2003 10:06 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng misinterpreting messages from Enterasys Routers. Lugupidamisega, Urmas Jagomann 6655424 ----- Original Message ----- From: <Ted_Rule(a)flextech.co.uk> To: <syslog-ng(a)lists.balabit.hu> Sent: Thursday, January 23, 2003 2:21 PM Subject: [syslog-ng]syslog-ng misinterpreting messages from Enterasys Routers. > > > Having finally bitten the bullet and installed syslog-ng ( libol-0.3.6 / > syslog-ng-1.5.24 ), > I've only come across one problem... syslog messages from our Enterasys Routers > are being > corrupted. All Unix and Cisco messages appear Ok. > > As an example, these raw packets from an SSR and a Cisco: > > tcpdump -s 512 -x -e -l -n udp and port 514 and host fttv-gps-core-ssrA | > tcpdumpascii.pl > tcpdump: listening on eth0 > 10:29:54.111864 0:e0:63:93:25:bf 0:50:8b:f3:93:46 ip 100: 192.168.32.11.4739 > > 172.17.12.6.syslog: udp 58 > 4500 0056 73a2 0000 3f11 6f2a c0a8 200b E..Vs...?.o*.. . > ac11 0c06 1283 0202 0042 b5ba 3c31 3838 .........B..<188 > 3e4a 616e 2032 3320 3130 3a32 393a 3533 >Jan 23 10:29:53 > 2025 434f 4e53 2d57 2d42 4144 5041 5353 %CONS-W-BADPASS > 5744 2c20 696e 636f 7272 6563 7420 7061 WD, incorrect pa > 7373 776f 7264 ssword > > 1 packets received by filter > 0 packets dropped by kernel > > tcpdump -s 512 -x -e -l -n udp and port 514 and host gps-enterprise-cisco-e0 | > tcpdumpascii.pl > tcpdump: listening on eth0 > 10:30:44.037939 0:10:7b:80:f:fb 0:50:8b:f3:93:46 ip 138: 172.17.8.76.8800 > > 172.17.12.6.syslog: udp 96 > 4500 007c 29b5 0000 ff11 2547 ac11 084c E..|).....%G...L > ac11 0c06 2260 0202 0068 187a 3c31 3839 ...."`...h.z<189 > 3e31 3036 3737 3a20 4a61 6e20 3233 2031 >10677: Jan 23 1 > 303a 3330 3a34 3320 474d 543a 2025 5359 0:30:43 GMT: %SY > 532d 352d 434f 4e46 4947 5f49 3a20 436f S-5-CONFIG_I: Co > 6e66 6967 7572 6564 2066 726f 6d20 636f nfigured from co > 6e73 6f6c 6520 6279 2076 7479 3020 2831 nsole by vty0 (1 > 3732 2e31 372e 3132 2e37 3229 72.17.12.72) > > > Result in this in the log: > > Jan 23 10:29:53 %CONS-W-BADPASSWD, incorrect password > Jan 23 10:30:44 gps-enterprise-cisco-e0 10677: Jan 23 10:30:43 GMT: > %SYS-5-CONFIG_I: Configured from console by vty0 (172.17.12.72) > > > It looks as if syslog-ng is assuming %CONS-W-BADPASSWD is a hostname....and the > Cisco message picks up a hostname via DNS, which > is NOT included in the packet. > > > I note the version 1.5.25 has a bad_hostname() option. Is it possible that this > may be used to alleviate this issue, or is some other workround > needed? I'm guessing "keep_hostname(no)" might fix it, but would that > potentially lead to other problems? Is there a summary of the algorithm > which syslog-ng uses to determine whether the message contains a hostname? > > > > Current Options settings laid out below. > > > ............... > > # Global Options Settings > options { > chain_hostnames(no); > keep_hostname (yes); > use_dns (yes); > use_fqdn (no); > long_hostnames (off); > dns_cache(yes); > dns_cache_size(100); > dns_cache_expire(600); > dns_cache_expire_failed(120); > > create_dirs (no); > dir_owner(root); > dir_group(root); > dir_perm(0755); > owner(root); > group(root); > perm(0600); > > stats(120); > > sync(10); > time_reopen (10); > time_reap(20); > > use_time_recvd(no); > > log_fifo_size (1000); > log_msg_size (1024); > > gc_idle_threshold(100); ### default 100 > gc_busy_threshold(3000); ### default 3000 > }; > > ............... > > > Thanks, > > > Ted > > > > > > > > > > ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

syslog-ng misinterpreting messages from Enterasys Routers.
by Ted_Rule＠flextech.co.uk 30 Jul '03

30 Jul '03

Having finally bitten the bullet and installed syslog-ng ( libol-0.3.6 / syslog-ng-1.5.24 ), I've only come across one problem... syslog messages from our Enterasys Routers are being corrupted. All Unix and Cisco messages appear Ok. As an example, these raw packets from an SSR and a Cisco: tcpdump -s 512 -x -e -l -n udp and port 514 and host fttv-gps-core-ssrA | tcpdumpascii.pl tcpdump: listening on eth0 10:29:54.111864 0:e0:63:93:25:bf 0:50:8b:f3:93:46 ip 100: 192.168.32.11.4739 > 172.17.12.6.syslog: udp 58 4500 0056 73a2 0000 3f11 6f2a c0a8 200b E..Vs...?.o*.. . ac11 0c06 1283 0202 0042 b5ba 3c31 3838 .........B..<188 3e4a 616e 2032 3320 3130 3a32 393a 3533 >Jan 23 10:29:53 2025 434f 4e53 2d57 2d42 4144 5041 5353 %CONS-W-BADPASS 5744 2c20 696e 636f 7272 6563 7420 7061 WD, incorrect pa 7373 776f 7264 ssword 1 packets received by filter 0 packets dropped by kernel tcpdump -s 512 -x -e -l -n udp and port 514 and host gps-enterprise-cisco-e0 | tcpdumpascii.pl tcpdump: listening on eth0 10:30:44.037939 0:10:7b:80:f:fb 0:50:8b:f3:93:46 ip 138: 172.17.8.76.8800 > 172.17.12.6.syslog: udp 96 4500 007c 29b5 0000 ff11 2547 ac11 084c E..|).....%G...L ac11 0c06 2260 0202 0068 187a 3c31 3839 ...."`...h.z<189 3e31 3036 3737 3a20 4a61 6e20 3233 2031 >10677: Jan 23 1 303a 3330 3a34 3320 474d 543a 2025 5359 0:30:43 GMT: %SY 532d 352d 434f 4e46 4947 5f49 3a20 436f S-5-CONFIG_I: Co 6e66 6967 7572 6564 2066 726f 6d20 636f nfigured from co 6e73 6f6c 6520 6279 2076 7479 3020 2831 nsole by vty0 (1 3732 2e31 372e 3132 2e37 3229 72.17.12.72) Result in this in the log: Jan 23 10:29:53 %CONS-W-BADPASSWD, incorrect password Jan 23 10:30:44 gps-enterprise-cisco-e0 10677: Jan 23 10:30:43 GMT: %SYS-5-CONFIG_I: Configured from console by vty0 (172.17.12.72) It looks as if syslog-ng is assuming %CONS-W-BADPASSWD is a hostname....and the Cisco message picks up a hostname via DNS, which is NOT included in the packet. I note the version 1.5.25 has a bad_hostname() option. Is it possible that this may be used to alleviate this issue, or is some other workround needed? I'm guessing "keep_hostname(no)" might fix it, but would that potentially lead to other problems? Is there a summary of the algorithm which syslog-ng uses to determine whether the message contains a hostname? Current Options settings laid out below. ............... # Global Options Settings options { chain_hostnames(no); keep_hostname (yes); use_dns (yes); use_fqdn (no); long_hostnames (off); dns_cache(yes); dns_cache_size(100); dns_cache_expire(600); dns_cache_expire_failed(120); create_dirs (no); dir_owner(root); dir_group(root); dir_perm(0755); owner(root); group(root); perm(0600); stats(120); sync(10); time_reopen (10); time_reap(20); use_time_recvd(no); log_fifo_size (1000); log_msg_size (1024); gc_idle_threshold(100); ### default 100 gc_busy_threshold(3000); ### default 3000 }; ............... Thanks, Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

3 2

All messages logging to all files
by Brian Foran 29 Jul '03

29 Jul '03

Hello I am having a problem where anytime I point a new host to my Syslog-ng server, it seems to write to all logfiles located in the syslog-ng.conf file. Thanks for your response in advance. Here is my configuration file: options { sync (0); time_reopen (10); log_fifo_size (1000); check_hostname(yes); long_hostnames (off); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); }; filter f_borderpix { host("525edgepixpair") or match ("*.*.*.*"); }; destination d_borderpix { file("/var/log/logfiles/borderpix/borderpix.log"); }; log { source(s_net); destination(d_borderpix); }; filter f_stelt_hurricane { host("hurricane") or match ("*.*.*.*"); }; destination d_stelt_hurricane { file("/var/log/logfiles/stelt/hurricane.log"); }; log { source(s_net); destination(d_stelt_hurricane); }; filter f_stelt_cyclone { host("cyclone") or match ("*.*.*.*"); }; destination d_stelt_cyclone { file("/var/log/logfiles/stelt/cyclone.log"); }; log { source(s_net); destination(d_stelt_cyclone); }; Thanks, Brian

1 0

syslog-ng
by Shetkar, Ravishankar 28 Jul '03

28 Jul '03

Hi All, I am working on a log centralization project in a Solaris environment and my initial search led me to syslog-ng. It seems like syslog-ng is a good product which is recommended by a lot of people. . If you are running syslog-ng in a Solaris environment (especially Solaris 8/9) I would very much be interested hearing about your experiences. I would really be interested in positive comments from someone who is successfully employing syslog-ng. I noticed there are frequent releases of syslog-ng. How easy/difficult/time consuming is it to upgrade an operational environment? It will be grate if some one give me a sample syslog-ng.conf files on syslog server and clients.And some hits about how to use and configure mysql with syslog-ng. thanks Ravi

1 0

syslog-ng under Solaris 5.6
by Martynas Buozis 24 Jul '03

24 Jul '03

Hello I have syslog-ng 1.6.0rc3 compiled with gcc 2.95.2. Every time I stop/start syslog-ng or send HUP to daemon I get logged by syslog-ng (but not with native for OS syslogd) same old messages (kernel facility) that comes since last system boot. Same messages I see when issue dmesg command. This is an example for first lines that comes out in logged messaged file : Jul 24 19:18:45 local@dev cpu0: SUNW,UltraSPARC-II (upaid 0 impl 0x11 ver 0x20 clock 296 MHz) Jul 24 19:18:45 local@dev cpu1: SUNW,UltraSPARC-II (upaid 1 impl 0x11 ver 0x20 clock 296 MHz) Jul 24 19:18:45 local@dev SunOS Release 5.6 Version Generic_105181-33 [UNIX(R) System V Release 4.0] Jul 24 19:18:45 local@dev Copyright (c) 1983-1997, Sun Microsystems, Inc. Jul 24 19:18:45 local@dev mem = 1048576K (0x40000000) Jul 24 19:18:45 local@dev avail mem = 1039056896 This behavious is same on all Solaris 5.6 machines, while no problems with Solaris 7 and 8 (same binary). Does anyone know how to get rid of these messages after HUP ? Thank you for any tips according this matter. With best regards Martynas

4 4