- syslog-ng - lists.balabit.hu

Problem with large logfiles
by Vuorilehto Saska 16 Jun '03

16 Jun '03

Hi all, I'm quite new to this list so forgive me if this has been discussed before... Problem is that every time our logfiles grow larger than 2gb (2147483647 to be exact) syslog-ng dies and doesn't start until that specific logfile is renamed... Syslog-ng is version 1.4.16 running on a RedHat 7.3 machine and yes, we have ext3 filesystem in use, which should support files over that. At least we can merge those logfiles to one big file anyway... Any suggestions are welcome... ******* Saska

1 0

RE: [syslog-ng]Help for Filter(Match) statement
by Naman Latif 13 Jun '03

13 Jun '03

Thanks. Works great. Regards \\ Naman > -----Original Message----- > From: Amodiovalerio Verde [mailto:hypo@rtfm.it] > Sent: Friday, June 13, 2003 12:51 PM > Just escape the "" with \ > > filter test {match("access-group \"101\"");}; > > > Amodiovalerio Verde > amodiovalerio.verde(a)ags-it.com

1 0

Help for Filter(Match) statement
by Naman Latif 13 Jun '03

13 Jun '03

Hi, I am trying to match the whole expression access-group "101" How can define it in the match() statement ? As the presence of " is giving me problems and syslog-ng comes up with the parse error. I was trying Match("(access-group "101")") Regards \\ Naman

2 1

RE: [syslog-ng]Stats stop logging? - Fixed, but noticed another problem
by Glasser, Rob 13 Jun '03

13 Jun '03

Ok, if I figure this out I'll make sure I post it to the group. I'm glad at least that this problem isn't me doing something stupid. Thanks Rob Rob Glasser -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Thursday, June 12, 2003 7:27 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Stats stop logging? - Fixed, but noticed another problem On Thu, Jun 12, 2003 at 04:16:10PM -0700, Glasser, Rob wrote: > > I have no idea how to clear this so it won't show it everything I > restart syslog-ng. Any ideas on the cause of this problem? Some buffer > somewhere is storing this information and I'm not sure where. Dude Rob, if you figure this out you've attained my personal holy grail. I spent a lot of time asking on sunmanager's, reading books at home and bookstores, and asking everyone I know. Here's what I do know: I read about it in a book once how there's a kernel ring buffer used to store kernel messages, and reading from the syslog door will re-read this buffer. I remembered reading a way to turn that off, but I never found that book again. I've had swatch alarms triggered many times because of this replay issue. Please let me know if you solve it. -- Nate Campi http://www.campin.net _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Stats stop logging? - Fixed, but noticed another problem
by Glasser, Rob 13 Jun '03

13 Jun '03

Stupid mistake on my part. Looks like the issue had to do with me running the process as nobody, but nobody couldn't read the syslog-ng.conf file. Since I couldn't write anything out to the console either I decided to stop running syslog-ng as nobody for now. However I've noticed something else, on my Solaris 2.6 systems whenever I HUP or stop and restart syslog-ng it dumps a bunch of old messages from system startup and about filesystems being full into /var/adm/messages. Basically everything that shows up with 'dmesg'. Freaked me out the first time because the date information shows as current time so I was wondering how everything broke all at once. I have no idea how to clear this so it won't show it everything I restart syslog-ng. Any ideas on the cause of this problem? Some buffer somewhere is storing this information and I'm not sure where. Thanks Rob -----Original Message----- From: Glasser, Rob [mailto:rob.glasser@attws.com] Sent: Wednesday, June 11, 2003 5:31 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Stats stop logging? I currently have stats turned on for once an hour. It was running fine until I rotated my log file. I currently have all syslog-ng messages with a match(syslog-ng) filter going to /var/adm/messages. I rotated the logs, and HUP'd the syslog-ng process, it indicated in the new messages file that it was restarted and that is the last message from syslog-ng in that file. syslog-ng is logging other facilities to that file, but not stats, or any other syslog-ng messages for that matter, though I don't know if there would have been any others. Am I missing something or is this a bug? If I completely stop and restart syslog-ng everything starts working again. By the way, I rotate the log file by cat'ing it out to another filename, then cat'ing /dev/null to /var/adm/messages. Thanks Rob Glasser AT&T Wireless WNS Data Operations - Core Services UNIX Systems Administrator

2 1

Calibration of the syslog-ng server
by Loubet Jean-Michel 12 Jun '03

12 Jun '03

Hi, I want to collect about 1500 hosts. I've estimated that it represents about 8 000 000 messages (1 Gb) daily. My syslog-ng server, which will be dedicated to this, will run on solaris 8. Have you got any idea about needed cpu number and memory ? Thanks for your answers. JM Loubet

3 2

local2.debug logging incorrectly
by Keith Olmstead 12 Jun '03

12 Jun '03

Hello, Can someone help me out with this one. I am trying to log local2.debug pop logs to a central log server to a file called poplog. It is not logging to poplog but instead messages in the same dir. Here is what I have in my syslog-ng.conf. options { keep_hostname(no); long_hostnames(off); sync(1); log_fifo_size(1024); create_dirs(yes); use_dns(no); }; source src_local { unix-stream("/dev/log"); internal(); }; source src_network { udp(); }; <snip> destination messages.network { file("/opt1/log/hosts/$HOST/$YEAR/$MONTH/$DAY/messages" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; destination poplog.network { file("/opt1/log/hosts/$HOST/$YEAR/$MONTH/$DAY/poplog" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; <snip> filter f_messages { not facility(authpriv, mail, cron) and level(info, notice, warn, crit, err, alert, emerg); }; filter f_pop { facility(local2) and level(debug); }; <snip> log { source(src_network); source(src_local); filter(f_messages); destination(messages.network); }; log { source(src_network); filter(f_pop); destination(poplog.network); }; I thought that it might be reading the file from the top down, so I moved the pop filter before the messages filter, did not help. Also added local2 to the facility in messages filter and it stop logging to messages, but also stoped logging all together. Thanks, Keith

1 0

Stats stop logging?
by Glasser, Rob 12 Jun '03

12 Jun '03

I currently have stats turned on for once an hour. It was running fine until I rotated my log file. I currently have all syslog-ng messages with a match(syslog-ng) filter going to /var/adm/messages. I rotated the logs, and HUP'd the syslog-ng process, it indicated in the new messages file that it was restarted and that is the last message from syslog-ng in that file. syslog-ng is logging other facilities to that file, but not stats, or any other syslog-ng messages for that matter, though I don't know if there would have been any others. Am I missing something or is this a bug? If I completely stop and restart syslog-ng everything starts working again. By the way, I rotate the log file by cat'ing it out to another filename, then cat'ing /dev/null to /var/adm/messages. Thanks Rob Glasser AT&T Wireless WNS Data Operations - Core Services UNIX Systems Administrator desk (425)288-2562; cell (206)915-4327 rob.glasser(a)attws.com / 2069154327(a)mobile.att.net

1 0

Re: [syslog-ng]logs viewer
by Michael Earls 12 Jun '03

12 Jun '03

Also check out www.vermeer.org/syslog demo http://vw.vermeer.org/ >>> mlist(a)sanderscorner.com 06/11/03 06:17PM >>> Hi, If you're logging to a database I have a simple web viewer for it. You do need a webserver and perl for it though. Sander > Hi there, > I am looking for a tool that can manage my syslog-ng files . > where can't find a tool that allow me to view my logs files through a > browser, well organized . > thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng]logs viewer
by mlist 11 Jun '03

11 Jun '03

Hi, If you're logging to a database I have a simple web viewer for it. You do need a webserver and perl for it though. Sander > Hi there, > I am looking for a tool that can manage my syslog-ng files . > where can't find a tool that allow me to view my logs files through a > browser, well organized . > thanks

1 0

Enterasys SSR syslog message date format.
by Ted_Rule＠flextech.co.uk 11 Jun '03

11 Jun '03

We noticed that the syslog traffic from our Enterasys SSR routers violates protocol slightly in its date format. Jun 07 09:56:46 ssrA %STP-I-PORT_STATUS, Port status change detected: et.2.3 - Port Down Jun 07 09:56:51 ssrA %STP-I-PORT_STATUS, Port status change detected: et.2.3 - Port Up Jun 07 09:59:10 ssrA %STP-I-PORT_STATUS, Port status change detected: et.2.3 - Port Down Jun 07 09:59:11 ssrA %STP-I-PORT_STATUS, Port status change detected: et.2.3 - Port Up i.e. it uses a leading zero on the day of month field where RFC3164 requires a leading space. It's hardly earth shattering, but it would be nice to make the field consistent for these routers. I've asked the manufacturer to fix their code, but in the meantime are there any good ways to fix this in syslog-ng - ( other than a global use_time_recvd() yes flag )? I'm currently still on a 1.5.24 syslog-ng code by the way, though more than will to go to 1.6 if need be. If no option is currently available to munge fix this, could someone give me some pointers as to where in the code I might be able to patch in a host-specific fixup? Since I would imagine a few other products also have slightly wonky date formats, is there some merit in adding some dateformat fixup code in future - maybe the development releases already address this issue? Thanks, Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

2 1

logs viewer
by Moktar KONE 11 Jun '03

11 Jun '03

Hi there, I am looking for a tool that can manage my syslog-ng files . where can't find a tool that allow me to view my logs files through a browser, well organized . thanks

1 0

AW: [syslog-ng]DNS Problem?
by Unger, Christian 11 Jun '03

11 Jun '03

May you using, Windows 2000 ADS integraded DNS Servers. Then you should look into you logfiles of the Windows box. The 2000 DNS Server dies some time on havy load. MS knows that problem and so the DNS kommt with a autorestart funktion. But you can get a dns time out during the restart. Or your ADS is in combination with Exchange 2000, so the DNS (DC Server) has some time havy load during the LDAP querys from Exchange. The DNS Respons now needs extremly long. If you have this you should need 3 DS in the primary Exchange 2000 Site and split the Exchange querys over the tree global catalog Server. Thas my 2000 knowlage ;) I hope it helps someone. -----Ursprüngliche Nachricht----- Von: Glasser, Rob [mailto:rob.glasser@attws.com] Gesendet: Mittwoch, 11. Juni 2003 00:50 An: syslog-ng(a)lists.balabit.hu Betreff: RE: [syslog-ng]DNS Problem? These are internal systems located in the same datacenter although not necessarily on the same network. reverse lookups work, in fact for any system that has a problem, it's usually only one message out of hundreds for the day that has the problem, all other messages from those systems resolve fine. Rob Glasser desk (425)288-2562; cell (206)915-4327 rob.glasser(a)attws.com / 2069154327(a)mobile.att.net -----Original Message----- From: Nicholas Bernstein [mailto:nick@docmagic.com] Sent: Tuesday, June 10, 2003 3:47 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]DNS Problem? First off, what hosts are they failing to resolve? If they are hosts from somewhere out on the internet, they might not have an in-addr.arpa address associated with the ip, and may not be reverse lookup-able. Have you tried to verify that the systems can look up the ip? E.G. 'host a.b.c.d '? On Tue, 2003-06-10 at 15:40, Glasser, Rob wrote: > I'm having some name lookup weirdness and not sure of the cause. > Thought I'd post the scenario to the group before I start tweaking my > configuration to see if it can be fixed. > > First off, I'm running syslog-ng 1.6.0rc3, and on the systems I'm > having problems, they are Sun Netra systems, dual procs, 2GB of > memory, running Solaris 8. My options look like this: > > log_fifo_size(2048); > time_reopen(10); > use_fqdn(yes); > keep_hostname(no); > use_dns(yes); > dns_cache(yes); > long_hostnames(off); > > I have 2 servers with this configuration acting as centralized > loghosts for a datacenter. They are identical boxes, running > identical syslog-ng configurations, on the same VLAN as the DNS > servers they point to. > > Both of these boxes will periodically fail to lookup a name? and log > an entry under it's IP address instead of it's fully qualified host > name. There appears to be no pattern what so ever to it, and the log > entries that get logged by IP are different on each syslog-ng server. > The load on these systems is pretty minimal. The number of messages > logged by IP address is averaging about 10 a day out of about 13000 > messages being logged. > > To make things even more interesting, I have a similar setup in > another datacenter, but they are older smaller systems, only Ultra > 1's, single proc, with only 128 MB of memory, running Solaris 2.6, > acting as centralized servers for about 3 times the number of > servers. The syslog-ng version and configuration is identical. On > these systems I can not find any entries logged by IP address, > everything appears to be working fine. > > Any ideas what might be causing this? My gut reaction is to blame it > on the DNS boxes since the problem is only happening in one data > center and not another, but wanted to see if anyone else has already > been down this road first. > > Thanks > > Rob Glasser > AT&T Wireless > UNIX Systems Administrator > -- +---------------------------------------------------------------+ | Nicholas Bernstein | nick(a)docmagic.com | | UNIX Systems Administrator | http://www.docmagic.com | | Document Systems Inc. | | | gpg: F706 8C4E 78FA DDDD 53A0 019F D983 FE28 2002 D1F3 | +---------------------------------------------------------------+ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]DNS Problem?
by Glasser, Rob 11 Jun '03

11 Jun '03

These are internal systems located in the same datacenter although not necessarily on the same network. reverse lookups work, in fact for any system that has a problem, it's usually only one message out of hundreds for the day that has the problem, all other messages from those systems resolve fine. Rob Glasser desk (425)288-2562; cell (206)915-4327 rob.glasser(a)attws.com / 2069154327(a)mobile.att.net -----Original Message----- From: Nicholas Bernstein [mailto:nick@docmagic.com] Sent: Tuesday, June 10, 2003 3:47 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]DNS Problem? First off, what hosts are they failing to resolve? If they are hosts from somewhere out on the internet, they might not have an in-addr.arpa address associated with the ip, and may not be reverse lookup-able. Have you tried to verify that the systems can look up the ip? E.G. 'host a.b.c.d '? On Tue, 2003-06-10 at 15:40, Glasser, Rob wrote: > I'm having some name lookup weirdness and not sure of the cause. > Thought I'd post the scenario to the group before I start tweaking my > configuration to see if it can be fixed. > > First off, I'm running syslog-ng 1.6.0rc3, and on the systems I'm > having problems, they are Sun Netra systems, dual procs, 2GB of > memory, running Solaris 8. My options look like this: > > log_fifo_size(2048); > time_reopen(10); > use_fqdn(yes); > keep_hostname(no); > use_dns(yes); > dns_cache(yes); > long_hostnames(off); > > I have 2 servers with this configuration acting as centralized > loghosts for a datacenter. They are identical boxes, running > identical syslog-ng configurations, on the same VLAN as the DNS > servers they point to. > > Both of these boxes will periodically fail to lookup a name? and log > an entry under it's IP address instead of it's fully qualified host > name. There appears to be no pattern what so ever to it, and the log > entries that get logged by IP are different on each syslog-ng server. > The load on these systems is pretty minimal. The number of messages > logged by IP address is averaging about 10 a day out of about 13000 > messages being logged. > > To make things even more interesting, I have a similar setup in > another datacenter, but they are older smaller systems, only Ultra > 1's, single proc, with only 128 MB of memory, running Solaris 2.6, > acting as centralized servers for about 3 times the number of > servers. The syslog-ng version and configuration is identical. On > these systems I can not find any entries logged by IP address, > everything appears to be working fine. > > Any ideas what might be causing this? My gut reaction is to blame it > on the DNS boxes since the problem is only happening in one data > center and not another, but wanted to see if anyone else has already > been down this road first. > > Thanks > > Rob Glasser > AT&T Wireless > UNIX Systems Administrator > -- +---------------------------------------------------------------+ | Nicholas Bernstein | nick(a)docmagic.com | | UNIX Systems Administrator | http://www.docmagic.com | | Document Systems Inc. | | | gpg: F706 8C4E 78FA DDDD 53A0 019F D983 FE28 2002 D1F3 | +---------------------------------------------------------------+ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

DNS Problem?
by Glasser, Rob 10 Jun '03

10 Jun '03

I'm having some name lookup weirdness and not sure of the cause. Thought I'd post the scenario to the group before I start tweaking my configuration to see if it can be fixed. First off, I'm running syslog-ng 1.6.0rc3, and on the systems I'm having problems, they are Sun Netra systems, dual procs, 2GB of memory, running Solaris 8. My options look like this: log_fifo_size(2048); time_reopen(10); use_fqdn(yes); keep_hostname(no); use_dns(yes); dns_cache(yes); long_hostnames(off); I have 2 servers with this configuration acting as centralized loghosts for a datacenter. They are identical boxes, running identical syslog-ng configurations, on the same VLAN as the DNS servers they point to. Both of these boxes will periodically fail to lookup a name? and log an entry under it's IP address instead of it's fully qualified host name. There appears to be no pattern what so ever to it, and the log entries that get logged by IP are different on each syslog-ng server. The load on these systems is pretty minimal. The number of messages logged by IP address is averaging about 10 a day out of about 13000 messages being logged. To make things even more interesting, I have a similar setup in another datacenter, but they are older smaller systems, only Ultra 1's, single proc, with only 128 MB of memory, running Solaris 2.6, acting as centralized servers for about 3 times the number of servers. The syslog-ng version and configuration is identical. On these systems I can not find any entries logged by IP address, everything appears to be working fine. Any ideas what might be causing this? My gut reaction is to blame it on the DNS boxes since the problem is only happening in one data center and not another, but wanted to see if anyone else has already been down this road first. Thanks Rob Glasser AT&T Wireless UNIX Systems Administrator

2 1

RE: [syslog-ng]What means "dropped" ?
by Loubet Jean-Michel 10 Jun '03

10 Jun '03

> the relevant part is what kind of destinations you have. (e.g. the rest of > the config) destination std { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/syslog" owner(admsys) group(system) perm(0600) dir_perm(0700) create_dirs(yes) template ("$DATE $FULLHOST $FACILITY.$PRIORITY $MSG\n") ); }; log { source(src); destination(std); }; destination std_syslog_collector { file("/var/log/syslog_collector" owner(admsys) group(system) perm(0600) dir_perm(0700) create_dirs(yes) template ("LOG $FULLHOST $FACILITY.$PRIORITY $DATE $MSG\n") ); }; log { source(src); destination(std_syslog_collector); }; JM Loubet

2 1

Re:[syslog-ng]How do I adjust logging for "foreign" facilites?
by Wayne Sweatt 10 Jun '03

10 Jun '03

Balasz, I'm not sure how much of your reply is use of a built-in methods or just examples. Is the "process" keyword an undocumented method, or just very new? I've solved the problem with the CRON logs, by using the match() method. Every log I received consistently had one of three keywords. The only remaining facilities I need to deal with are the Darwin - "netinfo", and Linux, etc - "authpriv". I am not able to filter by OS Type, since the host names are irrelevant to OS. From the logs that I've collected, I can see that I can safely translate all incoming hex "c" facility values to "netinfo" and could also safely replace all hex "a" facilities to "authpriv". No Solaris systems/apps are using those values anywhere on our network. I am able to use the pipe() method, but that means running a dedicated, non-syslog-ng process in the background to write to the logs. I'm not crazy about that convaluted scheme. I haven't tried the program() method yet. Would that be the ticket for me if I want to just replace strings? Could I write a simple Perl loop that replaces the priority string on <STDIN> and then writes out to the desired log file? You use a "facility_rewrite_hack" in your example. How/where would that be defined? Thanks, -Wayne On Mon, Jun 02, 2003 at 05:03:45PM -0600, Wayne Sweatt wrote: > I am running syslog-ng-1.6.0rc2+20030423 on Solaris 8. > I see a problem with the udp logging of facilities from non-Solaris > clients. > For example, syslog-ng is storing the authpriv facility from Linux > clients as "a" as the $FACILITY value, and cron as "9". > It also sets the value of "a" for MacOS X client's netinfo facility. > I can understand strange values for the "non_Solaris" facilites - > authpriv and netinfo, but . the cron value is set correctly from Solaris > clients while not for Linux clients. I thought these numeric Facility > codes were "standard' between OSes. > Any explanations? It should be, however it is not the case. Syslog-ng uses the values whatever platform it was compiled for. The table on Linux is: #define LOG_KERN (0<<3) /* kernel messages */ #define LOG_USER (1<<3) /* random user-level messages */ #define LOG_MAIL (2<<3) /* mail system */ #define LOG_DAEMON (3<<3) /* system daemons */ #define LOG_AUTH (4<<3) /* security/authorization messages */ #define LOG_SYSLOG (5<<3) /* messages generated internally by syslogd */ #define LOG_LPR (6<<3) /* line printer subsystem */ #define LOG_NEWS (7<<3) /* network news subsystem */ #define LOG_UUCP (8<<3) /* UUCP subsystem */ #define LOG_CRON (9<<3) /* clock daemon */ #define LOG_AUTHPRIV (10<<3) /* security/authorization messages (private) */ #define LOG_FTP (11<<3) /* ftp daemon */ /* other codes through 15 reserved for system use */ #define LOG_LOCAL0 (16<<3) /* reserved for local use */ #define LOG_LOCAL1 (17<<3) /* reserved for local use */ #define LOG_LOCAL2 (18<<3) /* reserved for local use */ #define LOG_LOCAL3 (19<<3) /* reserved for local use */ #define LOG_LOCAL4 (20<<3) /* reserved for local use */ #define LOG_LOCAL5 (21<<3) /* reserved for local use */ #define LOG_LOCAL6 (22<<3) /* reserved for local use */ #define LOG_LOCAL7 (23<<3) /* reserved for local use */ > > Is there a suggested way to convert these values at runtime using > filters(?), or maybe there an easy way to re-compile this functionality > in for Solaris? > The logs are arriving and being stored just fine, it's just the > $FACILITY value that I would like to translate back to it's native > "name" for clean parsing reasons. It is not currently possible. It is not difficult to translate facility values, the difficult thing is to select which translation table to apply (as each message might origin from a different platform) Using a hack like: filter f_solaris { host("^sol$") and facility_rewrite_hack(0x3, 0x9); }; this would result in facility_rewrite_hack() called in case the first part of the filter matches. A more elegant solution would be to introduce the process keyword: filter f_solaris { host("^sol$"); }; process p_remap_sol_fac { facility_map(0x3, 0x9); }; log { source(s_net); filter(f_solaris); process(p_remap_sol_fac); destination(d_files); }; Wayne Sweatt Sr. UNIX System Administrator Comforce Technical Services LANL SCC Team

2 1

Log Rotation
by Jim Gifford 10 Jun '03

10 Jun '03

I tried searching google for this information. How can I setup syslog-ng to rotate logs by date??

2 1

sending e-mail
by netsec novice 10 Jun '03

10 Jun '03

I am using postfix and did have it running when I originally set up my Linux box almost a year ago but I am now attempting to send e-mails as a destination with no luck. My brain has obviously archived the details of my original struggle. I don't need a full SMTP server - just something that will relay to our internal SMTP host. Anyone have suggestions for resources on how to setup and test postfix. Thanks in advance, Nicole _________________________________________________________________ MSN 8 helps eliminate e-mail viruses. Get 2 months FREE*. http://join.msn.com/?page=features/virus

2 1

time() system calls slow down syslog-ng
by Loubet Jean-Michel 10 Jun '03

10 Jun '03

Hi, truss -c on syslog-ng 1.6.0rc3 indicates there are about 5 "time()" calls for 1 received message. I've tried to change "use_time_received" but there was so many "time()" calls. The problem is that this call was responsible for the high cpu load on my host (and for my messages losing ...) After replacing time() calls in libol and syslog-ng with a constant, my syslog-ng accepted much more messages with lower cpu usage. Is there any way to reduce time system calls ? Here are my options, if you need them : keep_hostname(yes); long_hostnames(no); log_fifo_size(8192); log_msg_size (2048); sync(1024); use_time_recvd(no); use_dns(no); use_fqdn(no); dns_cache(no); stats (0); (I also set udp recv_hiwat to 65536). Thanks for your answers, JM Loubet

1 0

Re: [syslog-ng]Log Rotation
by Dan Edwards 10 Jun '03

10 Jun '03

Add a destination using macros. Here is an example destination. destination d_example { file("/var/logs/$HOST/$HOST.$YEAR-$MONTH-$DAY.txt"); }; That would put the data in a file based on the name of the device sending it and the current date. Example ("/var/logs/device1/device1.2003-06-07.txt"). It doesn't per say rotate the log but it will give you new logs based off day/month etc.. ---------- Original Message ---------------------------------- From: "Jim Gifford" <maillist(a)jg555.com> Reply-To: syslog-ng(a)lists.balabit.hu Date: Mon, 9 Jun 2003 19:22:58 -0700 >I tried searching google for this information. > >How can I setup syslog-ng to rotate logs by date?? >

1 0

RE: [syslog-ng]Log monitoring
by Marc Mamane 09 Jun '03

09 Jun '03

Try this... http://www.estpak.ee/~risto/sec/ Marc Mamane GuardedNet, Inc. -----Original Message----- From: netsec novice [mailto:netsec9@hotmail.com] Sent: Monday, June 09, 2003 1:42 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Log monitoring I am looking for a tool that would allow me to perform an action(send e-mail) when a particular event meets a threshhold. I have my IDS tuned to the point where I have a good sense of how many alerts I receive in an hour. I know I can send an alert based on matching a particular alert but what I would really like to do is send notification based on whether I receive more than 10 alerts in less than an hour. I hope my intention is clear here... I know there are products out there such as Swatch or logwatch but I haven't seen anything that alerts on thresholds rather than pattern matching only. My idea here is to set up something that watches my logs continuously and if I get more than 10 alerts within an hour or less during any part of the day - I would be paged. I am not a Perl guru so any help I can get in getting started is appreciated. My guess is that someone has already invented the wheel - I just don't know where it is. Thanks for any guidance... Nicole _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

log file permission
by Moktar KONE 09 Jun '03

09 Jun '03

I am using syslog-ng-1.6.0rc3 I want to create my log file with 777 permission i allready checked out the perm line and I had this line: perm(777); in the global options. but the file is creating with an other permission!!

1 0

Re: [syslog-ng]Log monitoring
by netsec novice 09 Jun '03

09 Jun '03

Thanks so much for sharing. That should give me a good start. Cheers, Nicole >From: Nicholas Bernstein <nick(a)docmagic.com> >Reply-To: syslog-ng(a)lists.balabit.hu >To: syslog-ng(a)lists.balabit.hu >Subject: Re: [syslog-ng]Log monitoring >Date: 09 Jun 2003 11:54:53 -0700 > >there should probably be "" around the $(date ...) in the grep now that >I think about it. > >-Nick > >On Mon, 2003-06-09 at 11:51, Nicholas Bernstein wrote: > > Ok.... > > > > something like : > > grep "Jun 9 11" messages| grep ftpd > > will get you all of the messages containing ftpd on June 9th, during the > > 11th hour. if you wanted to be inexact you can get the date by doing: > > date | awk -F : '{ print $1 }' > > so to put it all together you could do : > > grep $(date | awk -F : '{ print $1 }') <file> | <grep whatever your > > looking for> | wc -l > > > > or somesuch... > > > > If I was going to really do it, I'd probably use perl. To be accurate, > > you would want to convert the date into minutes, and then do a grep > > based only look at the entries within "Now - (Minutes)" otherwise, it > > effectivly resets the counter every hour. > > > > We aren't doing the exact same thing, otherwise I would try to be of > > more help, but I'm guessing that should be enough to get you started. > > > > > > man sed > > man awk > > man wc > > man bash (of course) > > http://www.perldoc.com > > > > > > > > On Mon, 2003-06-09 at 11:01, netsec novice wrote: > > > It sounds like what I'm looking for. Would you mind sending me more > > > details? I am a relative newbie to syslog and linux. I appreciate >anything > > > you can share. > > > > > > Nicole > > > > > > > > > >From: Nicholas Bernstein <nick(a)docmagic.com> > > > >Reply-To: syslog-ng(a)lists.balabit.hu > > > >To: syslog-ng(a)lists.balabit.hu > > > >Subject: Re: [syslog-ng]Log monitoring > > > >Date: 09 Jun 2003 10:56:57 -0700 > > > > > > > >We have a similar circumstance, where we basically have our logs > > > >filtered, and the events that we want put into a separate log file. >Then > > > >we grep the log based on time stamp & count the number of lines. The > > > >counter runs from cron every minute, and sends out an email if the > > > >number is higher than the threshold. > > > > > > > >Hope that helps! > > > >Nick > > > > > > > >On Mon, 2003-06-09 at 10:42, netsec novice wrote: > > > > > I am looking for a tool that would allow me to perform an >action(send > > > > > e-mail) when a particular event meets a threshhold. I have my IDS >tuned > > > >to > > > > > the point where I have a good sense of how many alerts I receive >in an > > > >hour. > > > > > I know I can send an alert based on matching a particular alert >but > > > >what I > > > > > would really like to do is send notification based on whether I >receive > > > >more > > > > > than 10 alerts in less than an hour. I hope my intention is clear > > > >here... > > > > > I know there are products out there such as Swatch or logwatch but >I > > > >haven't > > > > > seen anything that alerts on thresholds rather than pattern >matching > > > >only. > > > > > My idea here is to set up something that watches my logs >continuously > > > >and if > > > > > I get more than 10 alerts within an hour or less during any part >of the > > > >day > > > > > - I would be paged. I am not a Perl guru so any help I can get in > > > >getting > > > > > started is appreciated. My guess is that someone has already >invented > > > >the > > > > > wheel - I just don't know where it is. > > > > > > > > > > Thanks for any guidance... > > > > > Nicole > > > > > > > > > > _________________________________________________________________ > > > > > Add photos to your e-mail with MSN 8. Get 2 months FREE*. > > > > > http://join.msn.com/?page=features/featuredemail > > > > > > > > > > _______________________________________________ > > > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > > Frequently asked questions at >http://www.campin.net/syslog-ng/faq.html > > > >-- > > > >+---------------------------------------------------------------+ > > > >| Nicholas Bernstein | nick(a)docmagic.com | > > > >| UNIX Systems Administrator | http://www.docmagic.com | > > > >| Document Systems Inc. | | > > > >+---------------------------------------------------------------+ > > > > > > > >_______________________________________________ > > > >syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > >https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > >Frequently asked questions at >http://www.campin.net/syslog-ng/faq.html > > > > > > > > > > _________________________________________________________________ > > > Add photos to your messages with MSN 8. Get 2 months FREE*. > > > http://join.msn.com/?page=features/featuredemail > > > > > > _______________________________________________ > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >-- >+---------------------------------------------------------------+ >| Nicholas Bernstein | nick(a)docmagic.com | >| UNIX Systems Administrator | http://www.docmagic.com | >| Document Systems Inc. | | >+---------------------------------------------------------------+ > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _________________________________________________________________ Tired of spam? Get advanced junk mail protection with MSN 8. http://join.msn.com/?page=features/junkmail

1 0

Re: [syslog-ng]Log monitoring
by netsec novice 09 Jun '03

09 Jun '03

It sounds like what I'm looking for. Would you mind sending me more details? I am a relative newbie to syslog and linux. I appreciate anything you can share. Nicole >From: Nicholas Bernstein <nick(a)docmagic.com> >Reply-To: syslog-ng(a)lists.balabit.hu >To: syslog-ng(a)lists.balabit.hu >Subject: Re: [syslog-ng]Log monitoring >Date: 09 Jun 2003 10:56:57 -0700 > >We have a similar circumstance, where we basically have our logs >filtered, and the events that we want put into a separate log file. Then >we grep the log based on time stamp & count the number of lines. The >counter runs from cron every minute, and sends out an email if the >number is higher than the threshold. > >Hope that helps! >Nick > >On Mon, 2003-06-09 at 10:42, netsec novice wrote: > > I am looking for a tool that would allow me to perform an action(send > > e-mail) when a particular event meets a threshhold. I have my IDS tuned >to > > the point where I have a good sense of how many alerts I receive in an >hour. > > I know I can send an alert based on matching a particular alert but >what I > > would really like to do is send notification based on whether I receive >more > > than 10 alerts in less than an hour. I hope my intention is clear >here... > > I know there are products out there such as Swatch or logwatch but I >haven't > > seen anything that alerts on thresholds rather than pattern matching >only. > > My idea here is to set up something that watches my logs continuously >and if > > I get more than 10 alerts within an hour or less during any part of the >day > > - I would be paged. I am not a Perl guru so any help I can get in >getting > > started is appreciated. My guess is that someone has already invented >the > > wheel - I just don't know where it is. > > > > Thanks for any guidance... > > Nicole > > > > _________________________________________________________________ > > Add photos to your e-mail with MSN 8. Get 2 months FREE*. > > http://join.msn.com/?page=features/featuredemail > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >-- >+---------------------------------------------------------------+ >| Nicholas Bernstein | nick(a)docmagic.com | >| UNIX Systems Administrator | http://www.docmagic.com | >| Document Systems Inc. | | >+---------------------------------------------------------------+ > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _________________________________________________________________ Add photos to your messages with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

2 2