- syslog-ng - lists.balabit.hu

Filters not working (as expected)
by Harry Hoffman 10 Apr '03

10 Apr '03

Hi All, We've got a linux client running syslog-ng 1.6 sending to a linux server running syslog-ng 1.5.17 For the client I have taken the example redhat conf file and added the following to it: destination loghost { tcp("myloghost.fq.dn" port(514)); }; filter f_filter9 { level(notice); }; log { source(s_sys); filter(f_filter9); destination(loghost); }; If I use logger to test I see the message come thru: logger -p kern.notice -t WARNING "This is a KERNEL test warning" However, if I do: logger -p kern.emerg -t WARNING "This is a KERNEL test warning" Nothing comes thru. Do I need to specify multiple prioity levels? I want anything of notice or higher to be sent to the syslog server. Any help is greatly appreciated. TIA, Harry -- Harry Hoffman ITSS Systems Team Leader University of Auckland hhoffman(a)auckland.ac.nz hhoffman(a)ip-solutions.net STANDARD DISCLAIMER: ********************************************** *This universe shipped by weight, not volume.* *Some expansion may have occured in shipping.* ********************************************* ------------------------------------------------- This mail sent through IpSolutions: http://www.ip-solutions.net/

2 2

New to syslog-ng
by Annie Chaiyakul 10 Apr '03

10 Apr '03

I am trying to setup a syslog-ng server running on redhat 7.3, Can my clients still run old syslogd?

2 1

RE: [syslog-ng]New to syslog-ng
by Dennis, Richard 10 Apr '03

10 Apr '03

Yes. Your syslog-ng server will be your central syslog server. There's a good how to in a sample chapter from the Building Secure Linux Servers on www.oreilly.com --Rick -----Original Message----- From: Annie Chaiyakul [mailto:AChaiyakul@idecpharm.com] Sent: Wednesday, April 09, 2003 8:18 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]New to syslog-ng I am trying to setup a syslog-ng server running on redhat 7.3, Can my clients still run old syslogd? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------ This message is intended only for the personal and confidential use of the designated recipient(s) named above. If you are not the intended recipient of this message you are hereby notified that any review, dissemination, distribution or copying of this message is strictly prohibited. This communication is for information purposes only and should not be regarded as an offer to sell or as a solicitation of an offer to buy any financial product, an official confirmation of any transaction, or as an official statement of Lehman Brothers. Email transmission cannot be guaranteed to be secure or error-free. Therefore, we do not represent that this information is complete or accurate and it should not be relied upon as such. All information is subject to change without notice.

1 0

long IP entry in Sun syslog
by Brian C. Hill 09 Apr '03

09 Apr '03

I am still having the problem where remote messages to syslog-ng 1.6.0rc1 are labeled with the receiving host's name instead of the IP/hostname of the sending host. I have keep_hostname set to yes and use_dns set to no. I turned on Sun's syslogd to compare some things and noticed that entries that Sun's syslog cannot resolve are labeled with the IP address (10.10.5.13) and 2 additional 'octets' in brackets like this: Apr 9 14:28:34 [10.10.5.13.224.124] venue1258 PPTP-1 down: Remote clearing Is this related to the problem I am seeing with 1.6.0rc1? Is the sun streams device sending it an address it can't interpret? I figure one of those octets is the source port, but I don't know what the last one is... Brian

1 0

Hostname - IP Address
by Chris Paalman 08 Apr '03

08 Apr '03

I am trying to log using the IP address only, yet I get the hostname instead. I would like to be able to send the syslog from multiple machines to a central server which will then log to a database. Ultimately I would like to be able to search by IP address. I have all the pieces of this working just fine, all except the hostname problem. All of the computers report the hostname instead of the IP address, even with the following options. use_dns (no); use_fqdn (no); chain_hostnames(no); keep_hostname (yes); <- I have tried no also, to no avail. long_hostnames (off); I have tried various combinations of the above with no success. Thanks in advance for any help. Chris Paalman

1 0

syslog-ng 1.6.0 insists on log files with 600 permissions
by nate 08 Apr '03

08 Apr '03

I upgraded to freebsd 4.8 from 4.7 last week and portupgrade reported it upgraded syslog-ng from syslog-ng-1.4.17 to syslog-ng-1.6.0.r1 and libol-0.2.23 to libol-0.3.9 (libol is required by syslog-ng) and while syslog-ng is working I cannot get it to store files that are group readable. In the past this has been no problem, but now syslog-ng seems to insist upon permissions of 600. I even went sofar as to set a umask of 137, in the syslog-ng init script, which sets permissions on newly created files to 640, but that seems to have no effect, syslog-ng randomly(?) changes permissions back to 600 even after I set them to 640 myself. I have logrotate run weekly and create files that are 640: /var/log-ng/* { create 0640 root wheel notifempty errors my(a)email.address rotate 26 weekly compress delaycompress olddir /var/log-ng/archive missingok } but syslog-ng again changes it back to 600. driving me crazy :) I don't see anything in the syslog-ng manpage that can set file permissions..so I'm at a loss! I have been running syslog-ng on freebsd 4.7 with no problems since about september 2002. anyone else experience this? thanks nate

1 0

RE: [syslog-ng]Redhat 8 problem
by Hamilton, Andrew 08 Apr '03

08 Apr '03

What is really strange is that I go back and do a make distclean and rerun the script just like it came out of the box and it worked. Why it didn't work before and does now is beyond me. Regards, Drew -----Original Message----- From: Carl Davis [mailto:cdavis@technology-specialists.com] Sent: Tuesday, April 08, 2003 2:10 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Redhat 8 problem I could not get what you described to work, but I did change these, which seemed to make it work: LIBOL_REQ_MAJOR=0 LIBOL_REQ_MINOR=3 LIBOL_REQ_PATCH=9 Thanks for the help!! On Tue, 2003-04-08 at 12:53, Hamilton, Andrew wrote: > That reminded me of what I had to do to get it to compile on Redhat 8.0. I > had completely forgotten. I edited the configure script and set these > vaules: > > LIBOL_MAJOR="0" > LIBOL_MINOR="3" > LIBOL_PATCH="9" > > There a some lines that actually set them using a sed command that doesn't > seem to work on RH8.0 Not sure why and I haven't had time to figure it out. > I just commented those lines out and set these and Voila! it worked. > > Regards, > > Drew > > -----Original Message----- > From: Carl Davis [mailto:cdavis@technology-specialists.com] > Sent: Tuesday, April 08, 2003 1:42 PM > To: syslog-ng(a)lists.balabit.hu > Subject: RE: [syslog-ng]Redhat 8 problem > > > Well, I was trying to run it to determine what the problem was. I came > to that conclusion because I cannot get syslog-ng to compile. It keeps > failing at: > > checking libol version >= 0.2.23... no > configure: error: Required libol version not found > > But I have ./configure, make, make install, for libol-0.3.9. > > Carl > > On Tue, 2003-04-08 at 09:12, Hamilton, Andrew wrote: > > You aren't trying to run the make_class utility are you? I'm running > > syslog-ng on a dozen RH8 boxes without problem. I had no problems > building > > it either. > > > > -----Original Message----- > > From: cdavis(a)technology-specialists.com > > [mailto:cdavis@technology-specialists.com] > > Sent: Tuesday, April 08, 2003 8:59 AM > > To: syslog-ng(a)lists.balabit.hu > > Subject: Re: [syslog-ng]Redhat 8 problem > > > > > > I did not modify the files at all. I simply untared, ./configure, make. > > Then ./utils/make_class gives me the error described. > > > On Mon, Apr 07, 2003 at 10:14:03PM -0500, > > > cdavis(a)technology-specialists.com wrote: > > >> I cannot seem to get things to work correctly on my system. I think > > >> the problem is with the make_class file. I don't get any errors when > > >> I configure or make libol-0.3.9. But when trying to run make_class I > > >> get ./make_class > > >> -bash: ./make_class: \: bad interpreter: No such file or directory > > > > > > if you modify files in libol itself you will need scsh to rebuild the > > > .x files. if you did not modify them you should be just fine without > > > scsh. > > > > > >> > > >> I am no programmer so I don't know what else you may need to see. I > > >> tried searching through the list archives, but that is quite a task > > >> considereing it is just big NASTY file. > > > > > > the archives can be searched using google: > > > > > > site:lists.balabit.hu <search expression> > > > > > > -- > > > Bazsi > > > _______________________________________________ > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Redhat 8 problem
by Hamilton, Andrew 08 Apr '03

08 Apr '03

That reminded me of what I had to do to get it to compile on Redhat 8.0. I had completely forgotten. I edited the configure script and set these vaules: LIBOL_MAJOR="0" LIBOL_MINOR="3" LIBOL_PATCH="9" There a some lines that actually set them using a sed command that doesn't seem to work on RH8.0 Not sure why and I haven't had time to figure it out. I just commented those lines out and set these and Voila! it worked. Regards, Drew -----Original Message----- From: Carl Davis [mailto:cdavis@technology-specialists.com] Sent: Tuesday, April 08, 2003 1:42 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Redhat 8 problem Well, I was trying to run it to determine what the problem was. I came to that conclusion because I cannot get syslog-ng to compile. It keeps failing at: checking libol version >= 0.2.23... no configure: error: Required libol version not found But I have ./configure, make, make install, for libol-0.3.9. Carl On Tue, 2003-04-08 at 09:12, Hamilton, Andrew wrote: > You aren't trying to run the make_class utility are you? I'm running > syslog-ng on a dozen RH8 boxes without problem. I had no problems building > it either. > > -----Original Message----- > From: cdavis(a)technology-specialists.com > [mailto:cdavis@technology-specialists.com] > Sent: Tuesday, April 08, 2003 8:59 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Redhat 8 problem > > > I did not modify the files at all. I simply untared, ./configure, make. > Then ./utils/make_class gives me the error described. > > On Mon, Apr 07, 2003 at 10:14:03PM -0500, > > cdavis(a)technology-specialists.com wrote: > >> I cannot seem to get things to work correctly on my system. I think > >> the problem is with the make_class file. I don't get any errors when > >> I configure or make libol-0.3.9. But when trying to run make_class I > >> get ./make_class > >> -bash: ./make_class: \: bad interpreter: No such file or directory > > > > if you modify files in libol itself you will need scsh to rebuild the > > .x files. if you did not modify them you should be just fine without > > scsh. > > > >> > >> I am no programmer so I don't know what else you may need to see. I > >> tried searching through the list archives, but that is quite a task > >> considereing it is just big NASTY file. > > > > the archives can be searched using google: > > > > site:lists.balabit.hu <search expression> > > > > -- > > Bazsi > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]Redhat 8 problem
by Hamilton, Andrew 08 Apr '03

08 Apr '03

You aren't trying to run the make_class utility are you? I'm running syslog-ng on a dozen RH8 boxes without problem. I had no problems building it either. -----Original Message----- From: cdavis(a)technology-specialists.com [mailto:cdavis@technology-specialists.com] Sent: Tuesday, April 08, 2003 8:59 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Redhat 8 problem I did not modify the files at all. I simply untared, ./configure, make. Then ./utils/make_class gives me the error described. > On Mon, Apr 07, 2003 at 10:14:03PM -0500, > cdavis(a)technology-specialists.com wrote: >> I cannot seem to get things to work correctly on my system. I think >> the problem is with the make_class file. I don't get any errors when >> I configure or make libol-0.3.9. But when trying to run make_class I >> get ./make_class >> -bash: ./make_class: \: bad interpreter: No such file or directory > > if you modify files in libol itself you will need scsh to rebuild the > .x files. if you did not modify them you should be just fine without > scsh. > >> >> I am no programmer so I don't know what else you may need to see. I >> tried searching through the list archives, but that is quite a task >> considereing it is just big NASTY file. > > the archives can be searched using google: > > site:lists.balabit.hu <search expression> > > -- > Bazsi > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Redhat 8 problem
by cdavis＠technology-specialists.com 08 Apr '03

08 Apr '03

I cannot seem to get things to work correctly on my system. I think the problem is with the make_class file. I don't get any errors when I configure or make libol-0.3.9. But when trying to run make_class I get ./make_class -bash: ./make_class: \: bad interpreter: No such file or directory I am no programmer so I don't know what else you may need to see. I tried searching through the list archives, but that is quite a task considereing it is just big NASTY file.

2 2

Problem with syslog-ng-1.6.0rc1 configure script on Solaris 8
by John Caruso 07 Apr '03

07 Apr '03

FYI, I just ran into a problem with the syslog-ng-1.6.0rc1 configure script on Solaris 8. The problem is this set of sed commands: LIBOL_MAJOR=`echo $LIBOL_VERSION | sed -e 's/^$[0-9]\+$\.[0-9]\+\.[0-9]\+$+[0-9]*$\?$/\1/'` LIBOL_MINOR=`echo $LIBOL_VERSION | sed -e 's/^[0-9]\+\.$[0-9]\+$\.[0-9]\+$+[0-9]*$\?$/\1/'` LIBOL_PATCH=`echo $LIBOL_VERSION | sed -e 's/^[0-9]\+\.[0-9]\+\.$[0-9]\+$$+[0-9]*$\?$/\1/'` These do not work correctly with stock Solaris sed--they simply leave LIBOL_VERSION unchanged, so that LIBOL_MAJOR/_MINOR/_PATCH are all set to 0.3.9. Of course, this causes the subsequent version test to fail, and the configure script to stop. These sed commands work fine with GNU sed, however, so I was able to work around this by installing GNU sed into /usr/local/bin and putting /usr/local/bin before /usr/bin on the PATH. So this appears to be just a hidden dependency on GNU sed. This dependency should probably either be 1) removed in a future release by altering the sed commands, 2) documented in the INSTALL file, or at least 3) mentioned in the configure script error message. - John

1 0

Losing 25% of messages using UDP
by Bill Graham 07 Apr '03

07 Apr '03

I have syslog-ng-1.6.0rc1 compiled on Solaris 9 and I am intend to use the system as a central log server and I need to log every message that makes it to the system. I am testing it out with Kiwi Syslog Message generator with bursts of 100 messages every 10 seconds. Syslog-ng is only logging about 20-25% of the messages. I have verified that the messages are getting to the system. Is there some additional tuning that I have to do to get this to work. Here is a copy of my syslog-ng: options { use_fqdn(yes); keep_hostname(yes); use_dns(no); long_hostnames(off); sync(0); gc_idle_threshold(5000); gc_busy_threshold(1000); log_fifo_size(10240); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source network { udp();}; destination all { file("/var/log/messages"); }; log { source(local); destination(all); }; log { source(network); destination(all); }; Thanks, Bill

1 0

Expression match problem in filters
by Rodrigo Borges Pereira 06 Apr '03

06 Apr '03

Hello, I can't match anything with parenthesis, for use in my filters. I tried escaping, but same result. My filter looks something like: filter f_xpto { match("something") and not match("other(xyz)"); }; I get that "other(xyz)" logged anyway.. "other$xyz$" does not work either. Is this an issue with syslog-ng or am i missing something? I'm using syslog-ng 1.5.23. Thanks in advance

3 2

syslog-ng 1.6 - how to preserve the sender's IP address
by Brian C. Hill 06 Apr '03

06 Apr '03

I am having a strange problem. Events that come from A through B finally to C, get labeled with A's address, but events that come from A to C directly get labeled with C's address. I always want the address to be A's address. Note that B is running syslog-ng 1.4 (not for any good reason - it is just the state of things right now). Is there something wrong with my options? Brian ====================================================================== options { dir_perm(0755); perm(0644); sync(1); use_dns(no); use_fqdn(no); chain_hostnames(yes); long_hostnames(no); keep_hostname(yes); };

1 0

Problem with options
by TIM MOORE 03 Apr '03

03 Apr '03

I have tried two options in the config file that don't seem to work properly. I have many devices logging to this box creating a file for each day. When one month is up, I hope that they will begin to write over the previous months file. Here is how I was attempting to do this: First I have tried to set the log_fifo_size to 12288 lines. According to the extended sample syslog-ng conf file this setting will set the number of lines for the output file. However, I have many files that are way over this line amount. Does this option work? However, an even better solution seemed to set the remove_if_older option to say 172800 (2 days). This way when it comes back around to the first day of the month (01) then it would see that this file is older than 2 days and wack it and start with a new "01" file. Any ideas how to get this to work with syslog-ng. I have a fix for it, but would rather not leave it to external scripts to fix the problem. Any suggestions? Tim

1 0

syslog-ng sample config
by Nica Smith 03 Apr '03

03 Apr '03

hello people.. its me again. can anyone give me a samplg syslog-conf so that i'll have a better idea of how it is confgure? what ill be needing is to log all the telnet sessions from our 3com Total Control Ras. please.... please.. thanks. - nica _____________________________________________________________ Get 25MB, POP3, Spam Filtering with LYCOS MAIL PLUS for $19.95/year. http://login.mail.lycos.com/brandPage.shtml?pageId=plus&ref=lmtplus

2 1

Malformed Messages FRom syslogd
by Keith Resar 03 Apr '03

03 Apr '03

I'm running a syslog-ng process which is receiving messages from Solaris 6, 7, and 8 machines generated by the native Solaris syslogd, some of which originate from routers and other networking infrastructure. Occasionally I get radically malformed messages, which syslog-ng places in the wrong locations. The file destination writes these messages to $HOST/$PRIORITY, etc., but these varibales consist of this munged data. Unfortunately, this forces me to manually clean out and remove the directory structure the messages created. Any ideas on how to prevent this from happening in the first place? I'm also concerned that a maliciously formed syslog packet could cause syslog-ng to inadvertedly overwrite system files. For example, if the file destination was: /var/log/$HOST/$PROCESS And the expansion was: $HOST = "../../etc" $PROCESS = "passwd"; This system file could be overwritten. Any comments or information on internal syslog-ng checks to reassure me from worrying about this? Thanks, Keith Resar. --

2 1

How about a "passive" syslog server?
by Jason Haar 03 Apr '03

03 Apr '03

Hi there I'm wanting to put up a syslog server that runs on an IDS. As such the "sniffed" interfaces don't have (or want) IP addresses. So what I need is a syslog server that can sniff syslog packets as they come across the interfaces in promiscous mode. There is a product called passlogd that supposedly does this - but it has always crashed on startup for me. However I was wondering if this could be a feature request for syslog-ng. Linux's netfilter has the REDIRECT rulesets which could be used to do this as well. I mean, right now we use REDIRECT so that our Squid proxy server can act as a transparent proxy server, so what about syslog-ng? As Squid requires you to enable it - I suppose syslog-ng would still need to be altered to support that option too? Anyone else tried to do this? The security advantage is that you could enable syslog in your DMZes, point them at a non-existant IP address, and your IDS could pick up those messages as they flow pass it. Any server compromise leads the hackers to believe there is a syslog server - but it's down... -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 1

assigning host ip to syslog
by Nica Smith 03 Apr '03

03 Apr '03

hi all, i dont know if this has been asked, but can somebody tell me on how to assign an ip of a host to log to a central remote syslog server? thanks for the help - nica _____________________________________________________________ Get 25MB, POP3, Spam Filtering with LYCOS MAIL PLUS for $19.95/year. http://login.mail.lycos.com/brandPage.shtml?pageId=plus&ref=lmtplus

1 0

RE: [syslog-ng]Can't find syslog-ng
by Nica Smith 03 Apr '03

03 Apr '03

thanks... ill try that. ;) -- On Tue, 1 Apr 2003 10:08:45 Paul Mansmann wrote: >I assume you mean Red Hat Linux 8 here. On Red Hat Linux 8, this directory and file will be created in the /usr/local/etc >directory. The easiest way to work around this little quirk is to create the directory /etc/syslog-ng and then make a link for >syslog-ng.conf within that directory to the one under /usr/local/etc/syslog-ng. That way you don't spend an hour and a half editing >the file under /etc/syslog-ng and pulling half your hair trying to figure out why it's not working right before remembering your >editing the .conf file in the wrong location. Voice of experience here. :) > >Hope this helps... >Paul > >-----Original Message----- >From: Nica Smith [mailto:wanderlust27@lycos.com] >Sent: Monday, March 31, 2003 6:06 PM >To: syslog-ng(a)lists.balabit.hu >Subject: [syslog-ng]Can't find syslog-ng > > >hi, > >i just installed syslog-ng in linux 8. instructions said that i should see the file syslog-ng.conf in folder >/etc/syslog-ng/syslog-ng.conf, but when i type locate syslog-ng, it is in my installation folder as well as my syslog-ng. did i >installed it correctly? sorry, im just new with this. > >thanks, > >- wander > > >_____________________________________________________________ >Get 25MB, POP3, Spam Filtering with LYCOS MAIL PLUS for $19.95/year. >http://login.mail.lycos.com/brandPage.shtml?pageId=plus&ref=lmtplus >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _____________________________________________________________ Get 25MB, POP3, Spam Filtering with LYCOS MAIL PLUS for $19.95/year. http://login.mail.lycos.com/brandPage.shtml?pageId=plus&ref=lmtplus

1 0

Interpretting Relayed Messages
by Keith Resar 02 Apr '03

02 Apr '03

In my current syslog setup, some messages are transferred periodically via mail to the central syslog machine, at which time they are formatted into proper syslog packets, then delivered via UDP to the syslog-ng process on the local machine. This setup works well considering the limitations of the network[1], but for the hostname field of the syslog packet, and how syslog-ng process this. The message sent to syslog-ng contains the hostname of the original machine (remote) only. After syslog-ng on the local machine (local) processes the message, the hostname field contains "remote/local". I understand why this change was made and accept it. However, the problem comes when syslog-ng filters this message by host, and the message matches for "local". When writing the message to a file destination, it is stored in the proper directory[2], so syslog-ng clearly understands that the host "remote" generated the message and it was relayed through "local". Any ideas how to avoid this? I understand that there is a configuration command which allows a message to match only one log field, but my messages must be directly both to a SWATCH process and to a file destination. I'd also prefer to rule out complex filter rules which include "remote" and exclude "local" [3]. Since $HOST expands correctly, is it possible to write a filter rule like: filter myFilter { "remote" == $HOST;}? Thanks, Keith Resar. 1: There is no way for the machine that generates the messages to connect to the central log host, unless I rig something up using stunnel, etc. I'm not interested in tackling this problem. 2: Since the message was generated by the machine "remote", $HOST expands to remote. 3: Something like: filter myFilter { host{"remote"} and !host("local"); } Assuming that this syntax is even valid. --

1 0

RE: [syslog-ng]Template configuration problem
by Jan-Peter Koopmann 01 Apr '03

01 Apr '03

Hi, > I had a problem similar to this on one of my FreeBSD servers. > There was a patch for the syslog-ng port that disabled the > template option. Make sure that you do NOT have the file > patch-cfg-lex.l in your files directory under the syslog-ng > port tree. Instead you should see patch-cfg-grammer.h (and a > couple of other valid patches) Nevertheless your hint was perfect! I have no idea why but the template keywords were indeed disabled by some kind of patch. I removed work and recompiled everything and somehow this time it worked. Maybe the port changed over night or something like that. Well anyhow... Thanks a lot! Achim: Forget my last mail. Problem appears to be solved! Regards, JP

2 1

RE: [syslog-ng]Template configuration problem
by Jan-Peter Koopmann 01 Apr '03

01 Apr '03

Hi John, thanks for the hint. > template option. Make sure that you do NOT have the file > patch-cfg-lex.l in your files directory under the syslog-ng I don't. > port tree. Instead you should see patch-cfg-grammer.h (and a > couple of other valid patches) I do. It reads --- src/cfg-grammar.h.orig Thu Mar 27 22:41:34 2003 +++ src/cfg-grammar.h Thu Mar 27 22:41:47 2003 @@ -53,7 +53,7 @@ # define KW_DIR_OWNER 296 # define KW_DIR_GROUP 297 # define KW_DIR_PERM 298 -# define KW_TEMPLATE 299 +# define KW_FILE_TEMPLATE 299 # define KW_TEMPLATE_ESCAPE 300 # define KW_OWNER 301 # define KW_GROUP 302 So this should be ok. Still doesn't work though. Regards, JP

1 0

Template configuration problem
by Jan-Peter Koopmann 01 Apr '03

01 Apr '03

Hi, I am having serious trouble with templates. This is what I have in my syslog-ng.conf destination test { file ("test" template("$ISODATE $HOST $MSG\n") template_escape(yes) ); }; I always get a parse error in the template("$ISODATE $HOST $MSG\n") line. I am running the FreeBSD port of syslog-ng version 1.6.0rc1. What is the problem? I have these options set: options { long_hostnames(on); sync(0); use_time_recvd(yes); use_dns(yes); keep_hostname(no); chain_hostnames(no); use_fqdn(yes); gc_busy_threshold(768); time_reap(12); time_reopen(10); create_dirs(yes); }; Thanks, JP

3 2

Filtering *out* logs
by Nicholas Bernstein 01 Apr '03

01 Apr '03

I get the line below, many, many times in my logs, and, really, it just clutters things up. I would like to filter this out. What is the best way to do this? I tried specifying the destination file as /dev/null, but it didn't seem to work. "wu-ftpd - TLS settings: control allow, client_cert allow, data allow" Any information would be appreciated. I took a look through all the example config files I could find, but didn't find a way to do it. TIA, Nick -- +---------------------------------------------------------------+ | Nicholas Bernstein | nick(a)docmagic.com | | UNIX Systems Administrator | http://www.docmagic.com | | Document Systems Inc. | | +---------------------------------------------------------------+

1 0