- syslog-ng - lists.balabit.hu

Compiling libol and syslog-ng with Solaris Compiler.
by Jay Davis 16 Apr '03

16 Apr '03

GCC is not supported here. Has anyone gotten libol and syslog-ng compiled using the C++ compiler that comes with a full install of Solaris8? -- Jay Davis Cell: 443-253-0469

1 0

syslog-ng on Mac OSX
by Dan Siff 16 Apr '03

16 Apr '03

Is anyone successfully running syslog-ng on OSX/Darwin? I've seen posts concerning compilation and interfacing with libol, but nothing concerning configuring running/operating syslog-ng on OSX. I've gotten syslog-ng to compile (v 1.6.0rc1) with libol v. 0.3.9, but whenever I try and start the process, it is crashing with : Command: syslog-ng PID: 24210 Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_INVALID_ADDRESS (0x0001) at 0xbff7ff30 I'm trying to run this on OSX/Darwin 10.2.5. If anyone has experience with this, I'd also want to know what your syslog-ng.conf file looks like, since I can't find any references to replacing OSX's syslogd configs with syslog-ng. Thanks!

1 0

Problem with IP "don't fragment" flag?
by Ruecker, Rainer 16 Apr '03

16 Apr '03

Hello list, the following problem occured when trying to filter messages generated by the program NT-syslog running on several win2k-servers and some Cisco-Routers with syslog-ng on a central loghost: - The messages from the cisco devices are logged accordingly to the log path in syslog-ng.conf. - The messages from NT-syslog end up in the "catch-all" destination and the destination in the log path is "ignored". Checking the arriving udp-packets with tcp-dump on loghost the following was observed: - Packets coming from cisco-devices have source port 514 and the IP "don't fragment" flag is not set. - Packets coming from NT-syslog have source ports above 1024 and the IP "don't fragment" flag is not set. A "handcrafted" UDP syslog-message packet with Source-Port !=514 and a source adress of one of the NT-hosts and the IP "don't fragment" flag set will be logged according to the log path in syslog-ng.conf !! If IP "don't fragment" is not set, the message will end up in the fallback- destination. Has anyone else noticed a similar behaviour of syslog-ng? Maybe someone has a hint where to start debugging this problem? The problem is observed with syslog-ng version 1.6.0rc1 / libol 0.3.9 syslog-ng version 1.4.17 / libol 0.2.23 running on NetBSD-1.6 (i686) gcc-2.95.3 20010315 NetBSD linux-2.4.20 (stock source) / glibc-2.2.5 (i686) gcc 2.96 20000731 RedHat linux-2.4.20-pre4 (kernel.org) / glibc-2.3.1 (i686) gcc 3.2.1 Gentoo Relevant excerpt from syslog-ng.conf: =============<snip>================= # source source s_net { udp(); }; # destinations # cisco destination d_cons_pix { file("/dev/tty3"); }; # for special reasons ... destination d_pix { file("/var/log/pixlog_$YEAR_$MONTH_$DAY"); }; destination d_liss { file("/var/log/lisslog_$YEAR_$MONTH_$DAY"); }; destination d_router { file("/var/log/routerlog_$YEAR_$MONTH_$DAY"); }; # NT-syslog test destination d_rrwk { file("/var/log/rrwk_$YEAR_$MONTH_$DAY"); }; destination d_prt2 { file("/var/log/prt2_$YEAR_$MONTH_$DAY"); }; destination d_neko { file("/var/log/neko_$YEAR_$MONTH_$DAY"); }; # fallback destination d_netrest { file("/var/log/netrest"); }; # filters # cisco filter f_pix { host("192.168.10.1"); }; filter f_liss { host("192.168.10.3"); }; filter f_router { host(192.168.201.5) or host(192.168.250.10); }; # NT-syslog test filter f_rrwk { host(192.168.100.192); }; filter f_neko { host(192.168.100.190); }; filter f_prt2 { host(192.168.110.22); }; # log sentences # cisco log { source(s_net); filter(f_pix); destination(d_pix); destination(d_cons_pix); log { source(s_net); filter(f_liss); destination(d_liss); }; log { source(s_net); filter(f_router); destination(d_router); }; # NT-syslog test log { source(s_net); filter(f_rrwk); destination(d_rrwk); }; log { source(s_net); filter(f_prt2); destination(d_prt2); }; log { source(s_net); filter(f_neko); destination(d_neko); }; # fallback log { source(s_net); destination(d_netrest); flags(fallback); }; ==================<snip>================ Any help will be much appreciated. Kind regards Raine Ruecker

1 0

Macros don't expand
by Peter Österberg 15 Apr '03

15 Apr '03

Hi there I've problems with macros. I've tried a few different config files now and macros don't seem to work in any of them. Here's a short sample: source src { unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("$HOST\n") ); }; destination console { usertty("root" template("HELLO $HOST\n")); }; log { source(src); destination(d_mysql); destination(console); }; Since I don't get anything in my mysql server at the moment I run this to check the fifo 'cat < /tmp/mysql.pipe' All that I get is the linefeed from \n And on my console I only get HELLO \n The macros don't seem to expand not just $HOST. I run syslog-ng 1.6.0rc2 on a Slackware 9.0 box. Thank you! /peter

1 0

Catch All Statement
by Doug Peterson 15 Apr '03

15 Apr '03

Howdy -- I am a syslog-ng newbie, and am setting it up for the first time. I would like to have logs for all my machines end up in the same files they have always ended up in (messages, cron, maillog, etc), so I have setup rules, that so far seem to be handling this quite well :) However, I want to make sure that there aren't any unlogged requests coming through, so I tried setting up a catchall statement. However when I log something to local5.debug using logger (which there is no filter for), it doesn't end up in my "other" logfile. it just disappears as far as I can tell. I tried pasting the whole config file inline, however yahoo's editor screws up the formatting. SO, I've posted the config file at http://www.muck.net/syslog-ng/syslog-ng-conf.txt and I will paste the relevent lines below (note I do not have a filter statement for catchall, should I? I wouldn't know how to do that). destination other { file("/var/log/other" owner(root) group(root) perm(0600) ); }; log { source(src_local); source(src_network); destination(other); flags(fallback); }; Any help is greatly appreciated. :) __________________________________________________ Do you Yahoo!? Yahoo! Tax Center - File online, calculators, forms, and more http://tax.yahoo.com

5 11

RE: [syslog-ng]permission denied on syslog-ng
by Clausing, James A (Jim), SOLCM 15 Apr '03

15 Apr '03

As root run # sh -x /etc/init.d/syslog-ng start This will show the script executing. Respond back to the list and let us know where in the script the error is being generated (the last few lines with '+' in front of them). Then also give us the complete error message. We don't have enough info to troubleshoot this. -----Original Message----- From: Nica Smith [mailto:wanderlust27@lycos.com] Sent: Tuesday, April 15, 2003 04:30 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]permission denied on syslog-ng my syslog-ng.conf is located at usr/local/etc/syslog-ng/syslog-ng.conf then i copied init.d.RedHat-7.3 /etc/init.d (from contrib) to /etc/init.d/syslog-ng when i do /etc/init.d/syslog-ng start, i received an error "permission denied". what did i miss? need ur help. tnx. - wander ____________________________________________________________ Get advanced SPAM filtering on Webmail or POP Mail ... Get Lycos Mail! http://login.mail.lycos.com/r/referral?aid=27005 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

segfault signal 11, core dump, 1.5.26, 1.6.0rc1
by narancs 15 Apr '03

15 Apr '03

Hi all folks! I have a debian woody with kernel 2.4.20 on i386. it is a network log collector server with several udp and tcp sources. also some sources come from behind firewalls. it was working for weeks w/o problems with the 1.5.26-1.deb downloaded directly from balabit site. before that it was working for months with the 1.5.1x woody default pkg. which doesn't really work well with tcp connections. (that's why the upgrade happened) since some days the daemon segfaults each 2-5 minutes and dumps core. I have compiled on a woody machine the 1.6.0rc1 but that acts the same. I've tried with different config modifications, but it acts the same. Now after debugging it for days/hours I am really angry not finding the root of the problem. Also memtest86 found the memory clean and all other services on the machine are working fine. How should I fix this situation and get this working again? we have critical bussiness apps related to this service. thanks

2 4

permission denied on syslog-ng
by Nica Smith 15 Apr '03

15 Apr '03

my syslog-ng.conf is located at usr/local/etc/syslog-ng/syslog-ng.conf then i copied init.d.RedHat-7.3 /etc/init.d (from contrib) to /etc/init.d/syslog-ng when i do /etc/init.d/syslog-ng start, i received an error "permission denied". what did i miss? need ur help. tnx. - wander ____________________________________________________________ Get advanced SPAM filtering on Webmail or POP Mail ... Get Lycos Mail! http://login.mail.lycos.com/r/referral?aid=27005

1 0

RE: [syslog-ng]syslog-ng solaris clients
by Hamilton, Andrew 14 Apr '03

14 Apr '03

Are you using syslogd? What does your syslog.conf look like? Are you running old syslog on the linux servers? Regards, Drew -----Original Message----- From: Hong Tian [mailto:htian@ias.edu] Sent: Monday, April 14, 2003 11:41 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng solaris clients Hi, I set up a central syslog-ng server (syslog-ng-1.6.0rc1) on Redhat 7.3. It works good for all remote Linux clients, but it didn't work with remote Sun Solaris clients. The central syslog-ng server couldn't receive any log messages from solaris machines. Does anyone knows what is the problem? Should I do something more or different on remote Solaris clients than remote Linux clients? Thanks for your help. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng solaris clients
by Hong Tian 14 Apr '03

14 Apr '03

Hi, I set up a central syslog-ng server (syslog-ng-1.6.0rc1) on Redhat 7.3. It works good for all remote Linux clients, but it didn't work with remote Sun Solaris clients. The central syslog-ng server couldn't receive any log messages from solaris machines. Does anyone knows what is the problem? Should I do something more or different on remote Solaris clients than remote Linux clients? Thanks for your help.

1 0

RE: [syslog-ng]syslog-ng
by Hamilton, Andrew 14 Apr '03

14 Apr '03

See embedded remarks... Regards, Drew -----Original Message----- From: Hong Tian [mailto:htian@ias.edu] Sent: Friday, April 11, 2003 5:51 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng Hi, Our purpose is to set up a syslog-ng server to receive the log messages from other unix servers (linux and solaris) based on each hostname. I am setting syslog-ng 1.6 on Red Hat 7.3 for the first time. The compiling installation looks ok (./configure, make, and make install) on both libol-0.3.9 and syslog-ng-1.6.0rc1. After compiling I copied a starup script and a syslog-ng.conf as followings: # cp syslog-ng-1.6.0rc1/contrib/syslog-ng.conf.RedHat /etc/syslog-ng/syslog-ng.conf # cp syslog-ng-1.6.0rc1/contrib/init.d.RedHat-7.3 /etc/init.d/syslog-ng # /etc/init.d/syslog stop # /etc/init.d/syslog-ng start Starting syslog-ng: Cannot open configuration file /usr/local/etc/syslog-ng/syslog-ng.conf for reading Parse error reading configuration file, exiting. (line 1) [Failed] Only after I moved syslog-ng.conf to /usr/local/etc/syslog-ng, syslog-ng could start. # mv /etc/syslog-ng/syslog-ng.conf /usr/local/etc/syslog-ng # /etc/init.d/syslog-ng start Starting syslog-ng: [ OK ] (1) My question is why it forced me to use /usr/local/etc/syslog-ng instead of default location of /etc/syslog-ng/syslog-ng.conf? **** /usr/local/etc/syslog-ng is the default not /etc/syslog-ng, you can either **** modify this at compile time or start syslog-ng with the -f flag and point **** it to /etc/syslog-ng/syslog-ng.conf (2) After starting syslog-ng, I am trying to set up a basic config file to receive log messages from each Unix servers based on hostname. I am look for the good examples of a basic config file for my requirments. Could anyone provide some information? **** You can use a destination with a predfined macro called $HOST i.e. **** destination d_hosts { file("/var/log/hosts/$HOST.log"); }; (3) I think that I only need to install syslog-ng on the central log server. I don't need to install syslog-ng on every Unix servers, am I right? If I don't need to install syslog-ng on each syslog-ng client, should I do anything on each syslog-ng client? **** This is correct. You don't have to use syslog-ng on the clients. **** Unless you want to use something like tcp. Thanks, Hong _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

feature request - adding template functonality to program()
by email lists 13 Apr '03

13 Apr '03

Hi All, Such functionality already exists for pipe() and file() destination types so extending this to the program() destination type I imagine would not be too difficult nor time consuming. The following scenarios would benefit from this: - move logic to e-mail type notifications (and othe custom scripts) back into syslog-ng.conf - adds flexibility of formating sql statements and passing the sql statements directly into the database (having the near real time advantages of using pipe(), but having a reliability closer to a db buffer file as the process in not likely to die unexpectedly). tia, Darren Mackay

2 1

Syslog-ng 1.6.0rc2 specfile (20030412 snapshot)
by Jose Pedro Oliveira 12 Apr '03

12 Apr '03

Balazs Scheidler, The attached patch does the following: - creates two new files in the contrib directory * a logrotate file for Red Hat systems * a sysconfig file also for Red Hat systems - reorganizes the spec file - corrects the %post, %postun, and %preun scripts - pumps the libol version to 0.3.10 - creates an option for future inclusion of mysql related files (commented all the files containing references Requirements: Apply first the patch in this email (still not included in the latest snapshots) https://lists.balabit.hu/pipermail/syslog-ng/2003-April/004896.html Regards, jpo -- José Pedro Oliveira mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo diff -ruN syslog-ng-1.6.0rc2+20030412manual-original/contrib/syslog-ng.logrotate syslog-ng-1.6.0rc2+20030412manual-modified/contrib/syslog-ng.logrotate --- syslog-ng-1.6.0rc2+20030412manual-original/contrib/syslog-ng.logrotate Thu Jan 1 01:00:00 1970 +++ syslog-ng-1.6.0rc2+20030412manual-modified/contrib/syslog-ng.logrotate Tue Mar 18 20:51:55 2003 @@ -0,0 +1,6 @@ +/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron { + sharedscripts + postrotate + /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true + endscript +} diff -ruN syslog-ng-1.6.0rc2+20030412manual-original/contrib/syslog-ng.sysconfig syslog-ng-1.6.0rc2+20030412manual-modified/contrib/syslog-ng.sysconfig --- syslog-ng-1.6.0rc2+20030412manual-original/contrib/syslog-ng.sysconfig Thu Jan 1 01:00:00 1970 +++ syslog-ng-1.6.0rc2+20030412manual-modified/contrib/syslog-ng.sysconfig Tue Mar 18 21:42:33 2003 @@ -0,0 +1,15 @@ +#---------------------------------------------------------------------- +# Options +#---------------------------------------------------------------------- +# -C - <chroot-dir> +# -d - Set "debug mode". Prints out various messages to aid in +# debugging and stops it from becoming a daemon. To activate +# debugging in the yacc parser, either use this option twice or +# combine with -v. +# -p - <filename> Write the current PID information to the specified +# file. +# -v - Enable verbose mode. Process will not become a daemon. Prints +# out fewer messages, compared to -d. +# -V - Print the version number. +#---------------------------------------------------------------------- +SYSLOGNG_OPTIONS="" diff -ruN syslog-ng-1.6.0rc2+20030412manual-original/syslog-ng.spec.in syslog-ng-1.6.0rc2+20030412manual-modified/syslog-ng.spec.in --- syslog-ng-1.6.0rc2+20030412manual-original/syslog-ng.spec.in Thu Apr 10 11:51:00 2003 +++ syslog-ng-1.6.0rc2+20030412manual-modified/syslog-ng.spec.in Sat Apr 12 18:40:15 2003 @@ -1,44 +1,31 @@ -#-------------------------------------------------------------------------------- -# Program: syslog-ng.spec -# -# Purpose: This is the data file user to genertae RPM files so that we can -# distrbute 'canned' versions of what we have done more easily. -#-------------------------------------------------------------------------------- -# 08-Dec-02 - REP - Initial version - -#-------------------------------------------------------------------------------- -# Some basic definitions for use to use later in the file. We really only want -# to define things once, and have to change things in only one place. -#-------------------------------------------------------------------------------- -%define name syslog-ng -%define version @VERSION@ -%define release 1 -%define libver 0.3.9 -%define mandir /usr/share/man -%define sbindir /sbin - -#-------------------------------------------------------------------------------- -# Basic package information -#-------------------------------------------------------------------------------- +%define libver 0.3.10 +%define sbindir /sbin + +%define con_mysql 0 + +# Overriding default with --define: +# rpm -ba --define 'with_mysql 1' +%{?with_mysql:%define con_mysql 1} + + Summary: Syslog replacement daemon -Name: %{name} -Version: %{version} -Release: %{release} -Group: System/Kernel and hardware +Name: syslog-ng +Version: @VERSION@ +Release: 1 +Group: System Environment/Daemons License: GPL Url: http://www.balabit.com/products/syslog_ng/ -Source0: %{name}-%{version}.tar.gz -Source1: syslog-ng.conf -Source2: syslog-ng.init -Source3: mysql-syslog.pipe -Source4: mysql-syslog.buffer -Source5: syslog-ng.sysconfig -Requires: libol >= %{libver} -Buildroot: %{_tmppath}/%{name}-buildroot - -#-------------------------------------------------------------------------------- -# Description of the package -#-------------------------------------------------------------------------------- +Source: http://www.balabit.hu/downloads/syslog-ng/1.6/%{name}-%{version}.tar.gz +#Source1: mysql-syslog.pipe +#Source2: mysql-syslog.buffer +Buildroot: %{_tmppath}/%{name}-%{version}-buildroot +BuildRequires: libol-devel >= %{libver} +BuildRequires: tcp_wrappers +Requires(post,preun): chkconfig +Requires(postun,preun): initscripts +Conflicts: sysklogd + + %description syslog-ng, as the name shows, is a syslogd replacement, but with new functionality for the new generation. The original syslogd allows @@ -48,95 +35,88 @@ Forwarding logs over TCP and remembering all forwarding hops makes it ideal for firewalled environments. -#-------------------------------------------------------------------------------- -# What things to do in preperation of making the package -#-------------------------------------------------------------------------------- %prep -%setup +%setup -q -#-------------------------------------------------------------------------------- -# The build process for the package -#-------------------------------------------------------------------------------- %build - -#-------------------------------------------------------------------------------- -# Configuration process for the package -#-------------------------------------------------------------------------------- -%configure --prefix=%{_prefix} \ - --sbindir=%{sbindir} \ - --sysconfdir=%{_sysconfdir} \ - --mandir=%{mandir} \ +%configure --sbindir=%{sbindir} \ --enable-tcp-wrapper make -#-------------------------------------------------------------------------------- -# The install process for the package -#-------------------------------------------------------------------------------- %install -[ -n "%{buildroot}" -a "%{buildroot}" != / ] && rm -rf %{buildroot} -mkdir -p %{buildroot}%{_initrddir} -mkdir -p %{buildroot}%{_sysconfdir}/%{name} -mkdir -p %{buildroot}/etc/sysconfig - -make DESTDIR=%{buildroot} mandir=%{_mandir} install-strip - -install -m644 %{SOURCE1} %{buildroot}%{_sysconfdir}/%{name}/syslog-ng.conf -install -m755 %{SOURCE2} %{buildroot}%{_initrddir}/syslog-ng -install -m700 %{SOURCE3} %{buildroot}%{_sysconfdir}/%{name}/mysql-syslog.pipe -install -m700 %{SOURCE4} %{buildroot}%{_sysconfdir}/%{name}/mysql-syslog.buffer -install -m700 %{SOURCE5} %{buildroot}/etc/sysconfig/syslog-ng - -#-------------------------------------------------------------------------------- -# Things to run after it has been installed. We will be adding syslog-ng to the -# startup, and shutting down the old syslog -#-------------------------------------------------------------------------------- +rm -rf ${RPM_BUILD_ROOT} + +#make DESTDIR=%{RPM_BUILD_ROOT} mandir=%{_mandir} install-strip +%makeinstall sbindir=$RPM_BUILD_ROOT%{sbindir} +# +# Problem: the binary RPM is being assembled with an unstripped +# version of syslog-ng. +# Solution: strip file manually. +# +strip $RPM_BUILD_ROOT%{sbindir}/%{name} + +install -d $RPM_BUILD_ROOT%{_initrddir} +install -d $RPM_BUILD_ROOT%{_sysconfdir}/%{name} +install -d $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig +install -d $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d + +install -m755 contrib/init.d.RedHat-7.3 $RPM_BUILD_ROOT%{_initrddir}/syslog-ng +install -m644 contrib/syslog-ng.conf.RedHat $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/syslog-ng.conf +install -m644 contrib/syslog-ng.sysconfig $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/syslog-ng +install -m644 contrib/syslog-ng.logrotate $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/syslog-ng +%if %{con_mysql} +#install -m700 %{SOURCE1} $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/mysql-syslog.pipe +#install -m700 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/mysql-syslog.buffer +%endif + + %post +# rpm {-i|-U|-F} /sbin/chkconfig --add syslog-ng -/sbin/chkconfig --del syslog -sed -e "s/syslogd/syslog-ng/g" /etc/logrotate.d/syslog > /tmp/syslog-ng.tmp.$$ -cp -f /tmp/syslog-ng.tmp.$$ /etc/logrotate.d/syslog -rm -f /tmp/syslog-ng.tmp.$$ - -#-------------------------------------------------------------------------------- -# Well, if we uninstall, then we need to put some syslog in place to run for -# this system. -#-------------------------------------------------------------------------------- + %preun -/sbin/chkconfig --del syslog-ng -/sbin/chkconfig --add syslog -sed -e "s/syslog-ng/syslogd/g" /etc/logrotate.d/syslog > /tmp/syslog-ng.tmp.$$ -cp -f /tmp/syslog-ng.tmp.$$ /etc/logrotate.d/syslog -rm -f /tmp/syslog-ng.tmp.$$ - -#-------------------------------------------------------------------------------- -# What files and permissions are included in the package -#-------------------------------------------------------------------------------- +# only rpm -e (not rpm {-U|-F}) +if [ $1 = 0 ]; then + /sbin/service syslog-ng stop > /dev/null 2>&1 + /sbin/chkconfig --del syslog-ng +fi + +%postun +# only rpm {-U|-F} (not rpm -e) +if [ $1 = 1 ]; then + /sbin/service syslog-ng condrestart > /dev/null 2>&1 +fi + + %files %defattr(-,root,root) %doc AUTHORS COPYING README ChangeLog INSTALL NEWS PORTS -%doc doc/sgml/syslog-ng.txt +%doc doc/sgml/syslog-ng.txt doc/sgml/syslog-ng.ps %doc doc/*.demo doc/*.sample doc/*.solaris -%config(noreplace) %{_sysconfdir}/%{name}/syslog-ng.conf -%config(noreplace) %{_sysconfdir}/%{name}/mysql-syslog.pipe -%config(noreplace) %{_sysconfdir}/%{name}/mysql-syslog.buffer +%doc contrib/syslog2ng doc/stresstest.sh %config(noreplace) %{_initrddir}/syslog-ng -%config(noreplace) /etc/sysconfig/syslog-ng +%config(noreplace) %{_sysconfdir}/%{name}/syslog-ng.conf +%config(noreplace) %{_sysconfdir}/sysconfig/syslog-ng +%config(noreplace) %{_sysconfdir}/logrotate.d/syslog-ng +%if %{con_mysql} +#%config(noreplace) %{_sysconfdir}/%{name}/mysql-syslog.pipe +#%config(noreplace) %{_sysconfdir}/%{name}/mysql-syslog.buffer +%endif %{sbindir}/syslog-ng -%{_mandir}/man5/syslog-ng.conf.5* -%{_mandir}/man8/syslog-ng.8* +%{_mandir}/man5/* +%{_mandir}/man8/* + -#-------------------------------------------------------------------------------- -# What final cleanup should occur after the package construction has been -# completed -#-------------------------------------------------------------------------------- %clean -[ -n "%{buildroot}" -a "%{buildroot}" != / ] && rm -rf %{buildroot} -rm -r $RPM_BUILD_DIR/%{name}-%{version} +rm -rf ${RPM_BUILD_ROOT} + -#-------------------------------------------------------------------------------- -# Changelog -#-------------------------------------------------------------------------------- %changelog +* Sat Apr 12 2003 Jose Pedro Oliveira <jpo(a)di.uminho.pt> 1.6.0rc2 snapshot + - Reorganized specfile + - Corrected the scripts (%post, %postun, and %preun) + - Commented the mysql related lines; create an option for future inclusion + * Thu Feb 27 2003 Richard E. Perlotto II <richard(a)perlotto.com> 1.6.0rc1-1 - Updated for new version

2 1

Losing 25% of messages using UDP
by Bill Graham 12 Apr '03

12 Apr '03

I have syslog-ng-1.6.0rc1 compiled on Solaris 9 and I am intend to use the system as a central log server and I need to log every message that makes it to the system. I am testing it out with Kiwi Syslog Message generator with bursts of 100 messages every 10 seconds. Syslog-ng is only logging about 20-25% of the messages. I have verified that the messages are getting to the system. Is there some additional tuning that I have to do to get this to work. Here is a copy of my syslog-ng: options { use_fqdn(yes); keep_hostname(yes); use_dns(no); long_hostnames(off); sync(0); gc_idle_threshold(5000); gc_busy_threshold(1000); log_fifo_size(10240); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source network { udp();}; destination all { file("/var/log/messages"); }; log { source(local); destination(all); }; log { source(network); destination(all); }; Thanks, Bill

4 11

syslog-ng
by Hong Tian 11 Apr '03

11 Apr '03

Hi, Our purpose is to set up a syslog-ng server to receive the log messages from other unix servers (linux and solaris) based on each hostname. I am setting syslog-ng 1.6 on Red Hat 7.3 for the first time. The compiling installation looks ok (./configure, make, and make install) on both libol-0.3.9 and syslog-ng-1.6.0rc1. After compiling I copied a starup script and a syslog-ng.conf as followings: # cp syslog-ng-1.6.0rc1/contrib/syslog-ng.conf.RedHat /etc/syslog-ng/syslog-ng.conf # cp syslog-ng-1.6.0rc1/contrib/init.d.RedHat-7.3 /etc/init.d/syslog-ng # /etc/init.d/syslog stop # /etc/init.d/syslog-ng start Starting syslog-ng: Cannot open configuration file /usr/local/etc/syslog-ng/syslog-ng.conf for reading Parse error reading configuration file, exiting. (line 1) [Failed] Only after I moved syslog-ng.conf to /usr/local/etc/syslog-ng, syslog-ng could start. # mv /etc/syslog-ng/syslog-ng.conf /usr/local/etc/syslog-ng # /etc/init.d/syslog-ng start Starting syslog-ng: [ OK ] (1) My question is why it forced me to use /usr/local/etc/syslog-ng instead of default location of /etc/syslog-ng/syslog-ng.conf? (2) After starting syslog-ng, I am trying to set up a basic config file to receive log messages from each Unix servers based on hostname. I am look for the good examples of a basic config file for my requirments. Could anyone provide some information? (3) I think that I only need to install syslog-ng on the central log server. I don't need to install syslog-ng on every Unix servers, am I right? If I don't need to install syslog-ng on each syslog-ng client, should I do anything on each syslog-ng client? Thanks, Hong

1 0

snapshots of 1.6.0rc2 available
by Balazs Scheidler 11 Apr '03

11 Apr '03

Hi, Although not officially released, I have uploaded a test version of 1.6.0rc2 to our website: http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshots/syslog-ng-1.6.… The accompanying libol snapshot is also available. This release should fix the configure problems in 1.6.0rc1 and also adds performance improvements with the gperf based macro name resolution. If no problems are reported within a day or two I'll release syslog-ng 1.6.0rc2 officially. -- Bazsi

3 11

logrotate question (not working with syslog-ng)...
by seberino＠spawar.navy.mil 11 Apr '03

11 Apr '03

For some reason every time logrotate rotates /var/log/messages, my syslog-ng stops working. The permissions look ok.. [office root /var/log] # ls -l mess* -rw------- 1 root root 0 Apr 6 04:02 messages -rw------- 1 root root 378135 Apr 7 15:15 messages.1 -rw------- 1 root root 908864 Mar 31 15:50 messages.2 -rw------- 1 root root 1795514 Mar 25 14:06 messages.3 -rw------- 1 root root 945373 Mar 19 11:31 messages.4 -rw------- 1 root root 7 Apr 7 14:24 messages.offset Why does logrotate cause syslog-ng to not put any new stuff in /var/log/messages? Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

7 21

syslog-ng 1.6.0rc1 a bit erratic at kernel logs
by Jason Haar 11 Apr '03

11 Apr '03

Hi there We've got a central syslog-ng server here with incoming feeds from old syslog clients (HPUX,Cisco,printers,etc) as well as TCP-based feeds from syslog-ng clients. In general it all works well. However, there seems to be a problem with kernel messages on the localhost. The fact that they are processname=kernel appears to be lost on syslog-ng - instead of seeing: server kern info kernel: device eth0 left promiscuous mode I see server kern info device eth0 left promiscuous mode This is with a template of: template("$R_ISODATE $HOST $FACILITY $PRIORITY $MSG\n") As it only seems to affect kernel messages on syslog-ng hosts, I think it's more of a generation problem than a receiving problem. On all the hosts affected, then source entry is: source s_local { internal(); unix-stream("/dev/log" keep-alive(yes) max-connections(100)); pipe("/proc/kmsg"); unix-stream("/var/spool/mysqld/dev/log" keep-alive(yes) max-con nections(10)); unix-stream("/var/log/snort/dev/log" keep-alive(yes) max-connect ions(10)); tcp(ip("1.2.3.4") port(514) keep-alive(yes) max-connections( 100)); tcp(ip("127.0.0.1") port(514) keep-alive(yes) max-connections(1 00)); udp(); }; Any ideas what's wrong/bug? Thanks for a great product! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 2

Syslog-ng conf file options not working!!!!
by TIM MOORE 10 Apr '03

10 Apr '03

Thanks for the help. The syntax for the second option worked. I just have to wait to see if it will work correctly. Thanks, Tim Moore DNS/Linux/Cisco Admin ODJFS

1 0

Re: [syslog-ng]logrotate question (not working with syslog-ng)...
by Ted_Rule＠flextech.co.uk 10 Apr '03

10 Apr '03

It's perfectly possible to use logrotate on RedHat with syslog-ng... here's my logrotate.conf stripped of irrelevant detail: $ cat /etc/logrotate.d/syslog-ng /var/log/secure { } /var/log/maillog { } /var/log/spooler { } ........ /var/log/messages { ....... postrotate /etc/rc.d/init.d/syslog-ng reconfig ....... endscript } $ And the corresponding tweaks to init script to allow for a reconfig option, plus some extra features relating preventing syslog-ng restart when the config is broken, emulating klogd, and handling syslog-ng startup prior to named an ipchains only central logging server with dns hostname lookup enabled.. $ cat /etc/rc.d/init.d/syslog-ng #!/bin/sh # # syslog-ng Starts syslog-ng # # chkconfig: 2345 30 99 # description: Syslog-ng is the facility by which many daemons use to log \ # messages to various system log files. It is a good idea to always \ # run syslog-ng. ################################################################################ # Source function library. if [ -d /etc/init.d ]; then . /etc/init.d/functions else . /etc/rc.d/init.d/functions fi . /etc/sysconfig/network if [ ${NETWORKING} = "no" ] then exit 0 fi # General security measures.. umask 077 ulimit -c 0 INIT_PROG="/usr/local/sbin/syslog-ng" # Full path to daemon INIT_CONF="/etc/syslog-ng/syslog-ng.conf" # Full path to config INIT_OPTS="" PRINTKLEVEL=2 # Get per-service config overrides if [ -f /etc/sysconfig/syslog-ng ]; then . /etc/sysconfig/syslog-ng fi [ -x $INIT_PROG ] || exit 1 [ -s $INIT_CONF ] || exit 1 INIT_NAME=`basename "$INIT_PROG"` # Correct the setting of raw printk kernel logging to mimic klogd behaviour printkset() { currentprintk=`awk '{print $1}' /proc/sys/kernel/printk` if [ ${PRINTKLEVEL} -ne ${currentprintk} ]; then action "Setting kernel console default printk to ${PRINTKLEVEL}" dmesg -n ${PRINTKLEVEL} fi } validconfig() { $INIT_PROG -s -f $INIT_CONF RETVAL=$? echo -n "Syslog-ng configuration check" [ $RETVAL -ne 0 ] && failure "Syslog-ng configuration check" && echo && exit 1 [ $RETVAL -eq 0 ] && success "Syslog-ng configuration check" && echo } findsyslogchain () { rulenum=`ipchains -L input --line-numbers | awk '{print $1,$2,$3,$5,$9}' | grep "DENY udp anywhere syslog" | awk '{print $1}' | sort -rn` if [ "$rulenum" = "" ]; then rulenum=0 fi #Chain input (policy ACCEPT): #num target prot opt source destination ports #1 DENY udp ------ anywhere anywhere any -> syslog } isdnsrunning () { if [ -n "`/sbin/pidof named`" ]; then dnsrunning=1 else dnsrunning=0 fi } RETVAL=0 # See how we were called. case "$1" in start) validconfig printkset isdnsrunning [ $dnsrunning -ne 1 ] && $0 local echo -n "Starting $INIT_NAME: " daemon --check $INIT_PROG "$INIT_PROG -f $INIT_CONF $INIT_OPTS" RETVAL=$? echo [ $dnsrunning -eq 1 ] && $0 remote [ $RETVAL -eq 0 ] && touch "/var/lock/subsys/${INIT_NAME}" # Warn sendmail that syslog has restarted /etc/rc.d/init.d/sendmail reconfig ;; stop) echo -n "Shutting down $INIT_NAME: " killproc $INIT_PROG RETVAL=$? echo [ $RETVAL -eq 0 ] && rm -f "/var/lock/subsys/${INIT_NAME}" ;; status) status $INIT_PROG #status klogd RETVAL=$? ;; reconfig) validconfig printkset isdnsrunning [ $dnsrunning -ne 1 ] && $0 local echo -n "Re-HUPing $INIT_NAME daemon" killproc $INIT_PROG -HUP RETVAL=$? echo [ $dnsrunning -eq 1 ] && $0 remote ;; restart|reload) $0 stop $0 start RETVAL=$? ;; local) findsyslogchain if [ "$rulenum" = "0" ]; then action "Disabling remote syslogging" ipchains -I input 1 -i eth+ --proto udp --dport syslog -j DENY RETVAL=$? fi ;; remote) findsyslogchain if [ "$rulenum" != "0" ]; then for rule in `echo $rulenum` do action "Enabling remote syslogging - remove ipchains rule $rule" ipchains -D input ${rule} RETVAL=$? done fi ;; validate) validconfig ;; printkset) printkset RETVAL=$? ;; *) echo "Usage: syslog {start|stop|status|reconfig|restartlocal|remote|validate|printkset}" exit 1 esac exit $RETVAL $ ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

syslog-ng and regex
by Micha Holzmann 10 Apr '03

10 Apr '03

Hello, i am very new at syslog-ng and at its list. I am running two Debian GNU/Linux boxes. One as a DSL Router and the other as my workstation. Today i have installed syslog-ng via apt-get (1.5.15-1.1). I tried to setup remote logging. I want my router/firewall logging additional to my workstation. On the router i have the following entries in syslog-ng.conf Hostname of router = xenia >--- cut here ---- destination loghost {udp("192.168.1.1" port(514));}; log { source(src); destination(loghost); }; >--- cut here ---- Hostname of workstation = kaliba On my workstation i have in syslog-ng.conf: >--- cut here ---- destination rlogging { file("/var/log/syslog-ng/$HOST/syslog.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; filter f_xenia { match("xenia"); }; log { source(src); filter(f_xenia); destination(rlogging); }; >--- cut here ---- I am not sure if this setup is correct. May you can give me some advices. If it is necessary to have my configs, please tell me, i will post them afterwards. Now i have a seceond question, on my workstation runs a cron job which looks for new antivir definition file or new program version (binary file). I tried to put the syslog entries in a separate file. Can i use regex in the match()? May like this: match("antivir\[[0-9]+\]") to catch antivir[19129] >--- cut here ---- destination antivir { file("/var/log/antivir.log"); }; filter f_antivir { match("kaliba antivir"); }; log { source(src); filter(f_antivir); destination(antivir); }; >--- cut here ---- But the logfile entries does not arrive in /var/log/antivir.log. Did i anything wrong? Best regards, Micha Holzmann -- My software never has bugs. It just develops random features.

6 14

Syslog-ng conf file options not working!!!!
by TIM MOORE 10 Apr '03

10 Apr '03

Here is what I am trying to do. We have all of our network monitoring devices logging to a central linux syslog-ng server. The files write to the log server as the day of the week (eg. 01, 02, 03). I am trying to make sure that when the month rolls over and starts writing to file 01 that they old file is blown away. I don't need logs older than one month. I can't seem to get syslog-ng to handle this on its own. I have tried two options from syslog-ng that are given in the extended sample syslog-ng conf files from the website. Neither have worked the way they said they should. First, I tried limiting the number of lines that can be written to a file. I set the log_fifo_size to (12288). The sample config says that this setting is for the number of lines that can be written to the log files. However, I have some log files that are over 1,000,000 lines. So, unless I misunderstood this option it isn't working. Second, I tried to set the option remove_if_older to (172800) or 2 days. The expanded sample config says that this option checks a file to see whether or not it is older than the number of seconds specified. If it is older then it removes the existing file and writes to a new file with the same name. This option would work perfectly, if it worked! When I put it in the config file, it barfs when trying to load syslog-ng and says it is an error. Any ideas on how to do this (without writing a script to blank out each days file at midnight). Attached is a copy of our conf file. Thanks, Tim # Syslog-ng configuration for for ODJFS-NOC Syslog # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # options { #remove_if_older(172800); use_fqdn(yes); use_dns(yes); dns_cache(yes); keep_hostname(yes); long_hostnames(off); use_time_recvd(yes); #log_fifo_size=number of lines logged log_fifo_size(12288); sync(0); }; ###################################### #Source Section #source for local data source src { pipe("/proc/kmsg" log_prefix("kernel: ")); unix-stream("/dev/log"); internal(); }; #source for network devices source net { udp(); }; ##################################### #Destination Section #Standard destination destination std { file("/var/log/$HOST/$FACILITY/$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; #Forward Destination destination noc-web { udp("10.3.8.100" port(514)); }; ##################################### #log for src log { source(src); destination(std); }; #log for net log { source(net); destination(std); }; ########END OF FILE########

2 1

Include functionality - is there a way to do it?
by Klun, Jim 10 Apr '03

10 Apr '03

Here is a snippet from I question I received today: Quote: I am currently researching the following, but wanted to run it by you to make sure you weren't already aware of a solution: Does syslog-ng support 'include' type statements in the config file to make the config modular? Here is the problem. The new syslog-ng server runs on a production Solaris 8 box and portions of the syslog-ng.conf file (not the device filters) are not the same as their linux counterparts running on xxxx and yyyyy. An easy way to maintain sync on the phos and Solaris syslog-ng configs would be to simply sync the config file as a whole. For example, we might make changes on phos, then scp the file to the production Solaris box. If the config file were modular, we could break it into 2 pieces/files, 1 specific to Solaris or Linux, and 1 for all of the device filters. ? Close quote I know of no include function in syslog-ng. Is there one?

1 0

host labels with version 1.6
by Brian C. Hill 10 Apr '03

10 Apr '03

Hello, How do I make sure that syslog-ng labels an entry with the host that is came from and NOT the host that received it? None of the options, except possibly keep_hostname seem to be involved with that, and setting/unsetting that option seems to have no effect. Do I need to go back to 1.4? Thanks! Brian

2 1

RE: [syslog-ng]syslog-ng 1.6.0 insists on log files with 600 perm issions
by Hamilton, Andrew 10 Apr '03

10 Apr '03

Have you tried: destination all { file("/var/log/messages" perm(0640) ); }; This works for me on 1.6.0. Regards, Drew -----Original Message----- From: nate [mailto:syslog-ng@aphroland.org] Sent: Tuesday, April 08, 2003 4:08 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.6.0 insists on log files with 600 permissions I upgraded to freebsd 4.8 from 4.7 last week and portupgrade reported it upgraded syslog-ng from syslog-ng-1.4.17 to syslog-ng-1.6.0.r1 and libol-0.2.23 to libol-0.3.9 (libol is required by syslog-ng) and while syslog-ng is working I cannot get it to store files that are group readable. In the past this has been no problem, but now syslog-ng seems to insist upon permissions of 600. I even went sofar as to set a umask of 137, in the syslog-ng init script, which sets permissions on newly created files to 640, but that seems to have no effect, syslog-ng randomly(?) changes permissions back to 600 even after I set them to 640 myself. I have logrotate run weekly and create files that are 640: /var/log-ng/* { create 0640 root wheel notifempty errors my(a)email.address rotate 26 weekly compress delaycompress olddir /var/log-ng/archive missingok } but syslog-ng again changes it back to 600. driving me crazy :) I don't see anything in the syslog-ng manpage that can set file permissions..so I'm at a loss! I have been running syslog-ng on freebsd 4.7 with no problems since about september 2002. anyone else experience this? thanks nate _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2