- syslog-ng - lists.balabit.hu

RE: [syslog-ng]Can't find syslog-ng
by Jan-Peter Koopmann 01 Apr '03

01 Apr '03

Hi Paul, > I assume you mean Red Hat Linux 8 here. No. FreeBSD and we are talking about /usr/local/etc/syslog-ng/syslog-ng.conf which is the correct file. > Hope this helps... Unfortunately not... :-) Regards, JP

1 0

RE: [syslog-ng]Can't find syslog-ng
by Paul Mansmann 01 Apr '03

01 Apr '03

I assume you mean Red Hat Linux 8 here. On Red Hat Linux 8, this directory and file will be created in the /usr/local/etc directory. The easiest way to work around this little quirk is to create the directory /etc/syslog-ng and then make a link for syslog-ng.conf within that directory to the one under /usr/local/etc/syslog-ng. That way you don't spend an hour and a half editing the file under /etc/syslog-ng and pulling half your hair trying to figure out why it's not working right before remembering your editing the .conf file in the wrong location. Voice of experience here. :) Hope this helps... Paul -----Original Message----- From: Nica Smith [mailto:wanderlust27@lycos.com] Sent: Monday, March 31, 2003 6:06 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Can't find syslog-ng hi, i just installed syslog-ng in linux 8. instructions said that i should see the file syslog-ng.conf in folder /etc/syslog-ng/syslog-ng.conf, but when i type locate syslog-ng, it is in my installation folder as well as my syslog-ng. did i installed it correctly? sorry, im just new with this. thanks, - wander _____________________________________________________________ Get 25MB, POP3, Spam Filtering with LYCOS MAIL PLUS for $19.95/year. http://login.mail.lycos.com/brandPage.shtml?pageId=plus&ref=lmtplus _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Template configuration problem
by Paul Mansmann 01 Apr '03

01 Apr '03

Try this: destination test { file("test" template("$ISODATE $HOST $MSG);\n" template_escape(yes) ); }; I don't guarantee this will work. If it doesn't I recommend playing around a bit with the placement of the semicolon and parentheses. I had a similar issue with a template function I was trying to use and had to try a few different syntax variations before I could make NG happy. -paul -----Original Message----- From: Jan-Peter Koopmann [mailto:Jan-Peter.Koopmann@seceidos.de] Sent: Tuesday, April 01, 2003 6:36 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Template configuration problem Hi, I am having serious trouble with templates. This is what I have in my syslog-ng.conf destination test { file ("test" template("$ISODATE $HOST $MSG\n") template_escape(yes) ); }; I always get a parse error in the template("$ISODATE $HOST $MSG\n") line. I am running the FreeBSD port of syslog-ng version 1.6.0rc1. What is the problem? I have these options set: options { long_hostnames(on); sync(0); use_time_recvd(yes); use_dns(yes); keep_hostname(no); chain_hostnames(no); use_fqdn(yes); gc_busy_threshold(768); time_reap(12); time_reopen(10); create_dirs(yes); }; Thanks, JP _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Can't find syslog-ng
by Paul Mansmann 01 Apr '03

01 Apr '03

I assume you mean Red Hat Linux 8 here. On Red Hat Linux 8, this directory and file will be created in the /usr/local/etc directory. The easiest way to work around this little quirk is to create the directory /etc/syslog-ng and then make a link for syslog-ng.conf within that directory to the one under /usr/local/etc/syslog-ng. That way you don't spend an hour and a half editing the file under /etc/syslog-ng and pulling half your hair trying to figure out why it's not working right before remembering your editing the .conf file in the wrong location. Voice of experience here. :) Hope this helps... Paul > hi, > > i just installed syslog-ng in linux 8. instructions said that i should > see the file syslog-ng.conf in folder /etc/syslog-ng/syslog-ng.conf, but > when i type locate syslog-ng, it is in my installation folder as well as > my syslog-ng. did i installed it correctly? sorry, im just new with this. > > thanks, > > - wander

1 0

Template configuration problem
by Jan-Peter Koopmann 01 Apr '03

01 Apr '03

Hi, I am having serious trouble with templates. This is what I have in my syslog-ng.conf destination test { file ("test" template("$ISODATE $HOST $MSG\n") template_escape(yes) ); }; I always get a parse error in the template("$ISODATE $HOST $MSG\n") line. I am running the FreeBSD port of syslog-ng version 1.6.0rc1. What is the problem? I have these options set: options { long_hostnames(on); sync(0); use_time_recvd(yes); use_dns(yes); keep_hostname(no); chain_hostnames(no); use_fqdn(yes); gc_busy_threshold(768); time_reap(12); time_reopen(10); create_dirs(yes); }; Thanks, JP

1 0

Can't find syslog-ng
by Nica Smith 01 Apr '03

01 Apr '03

hi, i just installed syslog-ng in linux 8. instructions said that i should see the file syslog-ng.conf in folder /etc/syslog-ng/syslog-ng.conf, but when i type locate syslog-ng, it is in my installation folder as well as my syslog-ng. did i installed it correctly? sorry, im just new with this. thanks, - wander _____________________________________________________________ Get 25MB, POP3, Spam Filtering with LYCOS MAIL PLUS for $19.95/year. http://login.mail.lycos.com/brandPage.shtml?pageId=plus&ref=lmtplus

1 0

syslog-ng keeps erasing my log file - I don't know why
by seberino＠spawar.navy.mil 01 Apr '03

01 Apr '03

I made a little syslog-ng.conf as follows and tried running syslog-ng. I just checked after a few days and now my /var/log/messages is wiped out. Why did syslog-ng wipe out my /var/log/messages?? Is the fault my syslog-ng.conf below?? options {chain_hostnames(off);}; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

1 0

latest stable version of libol?
by Burv 31 Mar '03

31 Mar '03

Can someone tell me what the latest _stable_ version of libol is? I'm installing syslog-ng, and need to install libol.. __________________________________________________ Do you Yahoo!? Yahoo! Platinum - Watch CBS' NCAA March Madness, live on your desktop! http://platinum.yahoo.com

1 0

RE: [syslog-ng]$MSG into different variables?
by McNutt, Justin M. 31 Mar '03

31 Mar '03

> > Is this possible to do in syslog-ng? Or is there any other method of > > getting the values from the $MSG variable? > > > > I could of course read it from the pipe with some awk or > perl script and > > build the sql-syntax from there. But since I will have quite a few > > different table formats it would then need a perl > interpreter running for > > each table. Not very pretty IMO. > > something similar is available in 1.9.x but that is still not > ready for > production environments. > > the syntax is to use $1 .. $9 in place of $MSG[13] Excellent! We will be waiting anxiously for this. In fact... If you want a server or two to test, I think I could swing that. I have at least one machine here that runs named (hence gets a fair number of log messages) that is just a test box if you want to try it out. RedHat 7.3 (fully patched). --J

1 0

$MSG into different variables?
by m＠ervius.net 29 Mar '03

29 Mar '03

Hi, I'm trying to insert a variety of different logs into a MySql database from syslog-ng. The logs are coming from cisco routers, squid proxys, FW1 etc. and have a varying number of fields. The database tables are created with fields that match the different log formats, - src IP, dest IP, protocol etc. Since I can match the incoming logs with regexps, it is possible to be absolutely sure that a given log message will fit into a given table. What I then would like to do is to split the $MSG into its different columns (separated by whitespace) and call the corresponding destination which would look something like this: destination cisco_icmp { pipe("/tmp/icmp.pipe" template("INSERT INTO router_icmp (host, priority, date, time, program, access_list, if, type_code ) VALUES ( '$HOST', '$PRIORITY', '$YEAR-$MONTH-$DAY', $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG[6]', '$MSG[8]', '$MSG[13]' );\n") template-escape(yes)); }; Is this possible to do in syslog-ng? Or is there any other method of getting the values from the $MSG variable? I could of course read it from the pipe with some awk or perl script and build the sql-syntax from there. But since I will have quite a few different table formats it would then need a perl interpreter running for each table. Not very pretty IMO. Any suggestions? Have I missed something? Thanks! // Martin

2 1

re: [syslog-ng]OpenBSD
by T. 28 Mar '03

28 Mar '03

By the way, if anyone has OpenBSD configs that they would like to post, I'd still be interested in sharing info. It's looking like source s_dgram { unix-dgram("/dev/log"); }; is the way to go, but I've only done some scant preliminary testing. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

OpenBSD
by T. 28 Mar '03

28 Mar '03

I have enjoyed syslog-ng on Solaris for several years so I'm now suffering from a bit of withdrawal having built my fresh, new OpenBSD 3.3 system. I am able to get libol and syslog-ng built just fine. However, I'm noticing that BSD's syslogd creates /dev/log upon initiation and tears it down during shutdown. I saw the patch for casting (void *) NULL in af_program.c in the ports tree but, besides that, I can't seem to find any other patches that would cause syslog-ng to behave similarly. Does anyone have recommendations for the proper set of source() statements to use on OpenBSD? Much thanks in advance. T.E. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1

RE: [syslog-ng]OpenBSD
by T. 28 Mar '03

28 Mar '03

I should have known that, as soon as I posted a question, I'd find the answer myself. D'OHHHHH!!!!! RTFM! RTFM! RTFM! http://www.campin.net/syslog-ng/faq.html Much apologies in advance :-) T.E. --- On Fri 03/28, T. < t_esting(a)excite.com > wrote: From: T. [mailto: t_esting(a)excite.com] To: syslog-ng(a)lists.balabit.hu Date: Fri, 28 Mar 2003 13:59:33 -0500 (EST) Subject: [syslog-ng]OpenBSD I have enjoyed syslog-ng on Solaris for several years so I'm now suffering from a bit of withdrawal having built my fresh, new OpenBSD 3.3 system. I am able to get libol and syslog-ng built just fine. However, I'm noticing that BSD's syslogd creates /dev/log upon initiation and tears it down during shutdown. I saw the patch for casting (void *) NULL in af_program.c in the ports tree but, besides that, I can't seem to find any other patches that would cause syslog-ng to behave similarly. Does anyone have recommendations for the proper set of source() statements to use on OpenBSD? Much thanks in advance. T.E. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web! _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.c ampin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

file/directory permissions
by netsec novice 27 Mar '03

27 Mar '03

I am a linux newbie so please don't blast me for my ignorance. I have set up syslog-ng on my SUSE box and even managed to configure the syslog-ng.conf so that any newcoming syslog messages are organized by IP address as a directory and a new file is created for each day. I now need to allow others to view these logs but default privileges are for owner=root and group=root. I need all newly created directories and files to allow access to a group named syslog that I created. Is it a matter of starting the syslog service with different privileges or 'owner'. Currently, I'm having to go into the syslog file structure and chgrp and chmod to my desired settings on a daily basis. I'm open to any suggestions.... Nicole _________________________________________________________________ MSN 8 helps eliminate e-mail viruses. Get 2 months FREE*. http://join.msn.com/?page=features/virus

2 1

OpenBSD configuration
by T. 27 Mar '03

27 Mar '03

I'm a bit new to OpenBSD but have been a big syslog-ng fan on Solaris. Can anyone give me a quick pointer on the proper source() statements to use on OpenBSD? I can get syslog-ng compiled and started up but I'm not quite sure which log device to get it to listen on or which input driver to select. Much thanks in advance. t_esting(a)excite.com _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

reference manual - problem with tcp example
by Martin Pala 27 Mar '03

27 Mar '03

Hi, i read used example from syslog-ng reference manual - there's extra semi-colon, which causes syslog-ng to fail during startup: Reference manual part: Example 3-9. Using the tcp() driver destination d_tcp { tcp("10.1.2.3" port(1999); localport(999)); }; ^^^ Correct is: destination d_tcp { tcp("10.1.2.3" port(1999) localport(999)); }; Cheers, Martin Pala

1 0

RE: [syslog-ng]$MSG into different variables?
by email lists 26 Mar '03

26 Mar '03

ditto to this... tia -----Original Message----- From: McNutt, Justin M. [mailto:McNuttJ@missouri.edu] Sent: Friday, 21 March 2003 4:06 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]$MSG into different variables? If you find a solution to this, *please please please* post it to the list! :-) Thanks! --J

1 0

no carriage returns on logserver
by Stefan Schewczik 26 Mar '03

26 Mar '03

we are running a centralized logserver (suse 8.0) with the standard syslog daemon (version 1.4.1) and several clients (pld 1.0) with syslog-ng (version 1.4.17). the logfiles on the logserver looks like this. Mar 26 11:35:17 grz-1 grz-1 watchdog[1243]: current load is 0 0 0 <30>Mar 26 11:35:17 grz-1 watchdog[1243]: current load is 0 0 0 <30>Mar 26 11:35:17 grz-1 watchdog[1243]: was able to ping process 1617 (/var/run/syslog-ng.pid). <30>Mar 26 11:35:17 grz-1 watchdog[1243]: was able to ping process 1617 (/var/run/syslog-ng.pid). whereas the logfiles on the clients itself look ok. Mar 26 11:35:17 grz-1 watchdog[1243]: current load is 0 0 0 Mar 26 11:35:17 grz-1 watchdog[1243]: was able to ping process 1617 (/var/run/syslog-ng.pid). Mar 26 11:35:32 grz-1 watchdog[1243]: current load is 0 0 0 Mar 26 11:35:32 grz-1 watchdog[1243]: was able to ping process 1617 (/var/run/syslog-ng.pid). Mar 26 11:35:47 grz-1 watchdog[1243]: current load is 0 0 0 Mar 26 11:35:47 grz-1 watchdog[1243]: was able to ping process 1617 (/var/run/syslog-ng.pid). Mar 26 11:36:02 grz-1 watchdog[1243]: current load is 0 0 0 Mar 26 11:36:02 grz-1 watchdog[1243]: was able to ping process 1617 (/var/run/syslog-ng.pid). Mar 26 11:36:17 grz-1 watchdog[1243]: current load is 0 0 0 as you can see, there are no carriage returns in the logfiles of the logserver, so its very hard to read the logs. any help would be appreciated. /etc/syslog-ng/syslog-ng.conf: (clients) options { long_hostnames(off); sync(0); }; source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; # uncomment below line if you want setup syslog server #source net { udp(); }; destination loghost { udp("backup.domain.com"); }; destination kern { file("/var/log/kernel"); }; destination messages { file("/var/log/messages"); }; destination authlog { file("/var/log/secure"); }; destination mail { file("/var/log/maillog"); }; destination uucp { file("/var/log/spooler"); }; destination debug { file("/var/log/debug"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; destination xconsole { pipe("/dev/xconsole"); }; destination mailinfo { file("/var/log/mail/info"); }; destination mailwarn { file("/var/log/mail/warn"); }; destination mailerr { file("/var/log/mail/err"); }; destination newscrit { file("/var/log/news/news.crit" owner(news) group(news)); }; destination newserr { file("/var/log/news/news.err" owner(news) group(news)); }; destination newsnotice { file("/var/log/news/news.notice" owner(news) group(news)); }; destination cron { file("/var/log/cron"); }; destination syslog { file("/var/log/syslog"); }; destination daemon { file("/var/log/daemon"); }; destination lpr { file("/var/log/lpr"); }; destination user { file("/var/log/user"); }; destination ppp { file("/var/log/ppp"); }; # Log iptables messages to separate file destination iptables { file("/var/log/iptables"); }; filter f_syslog { not facility(authpriv, mail, news) and not match("IN=[A-Za-z0-9]* OUT=[A-Za-z0-9]*") and not match("cron") ; }; filter f_iptables { facility(kern) and match("IN=[A-Za-z0-9]* OUT=[A-Za-z0-9]*"); }; filter f_kern { facility(kern) and not match("IN=[A-Za-z0-9]* OUT=[A-Za-z0-9]*") ; }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv) and not match("cron"); }; filter f_cron { facility(cron) or match("cron"); }; filter f_daemon { facility(daemon); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_ppp { facility(daemon) and program(pppd) or program(chat); }; filter f_news { facility(news); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news, daemon); }; filter p_debug { level(debug); }; filter p_info { level(info); }; filter p_notice { level(notice); }; filter p_warn { level(warn); }; filter p_err { level(err); }; filter p_alert { level(alert); }; filter p_crit { level(crit); }; filter p_emergency { level(emerg); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_ppp); destination(ppp); }; log { source(src); filter(p_debug); destination(debug); }; log { source(src); filter(p_emergency); destination(console); }; log { source(src); destination(console_all); }; log { source(src); filter(f_mail); destination(mail); }; #log { source(src); filter(f_mail); filter(p_info); destination(mailinfo); }; #log { source(src); filter(f_mail); filter(p_warn); destination(mailwarn); }; #log { source(src); filter(f_mail); filter(p_err); destination(mailerr); }; log { source(src); filter(f_news); filter(p_crit); destination(uucp); }; log { source(src); filter(f_news); filter(p_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(p_err); destination(newserr); }; log { source(src); filter(f_news); filter(p_warn); destination(newsnotice); }; log { source(src); filter(f_news); filter(p_notice); destination(newsnotice); }; log { source(src); filter(f_news); filter(p_info); destination(newsnotice); }; log { source(src); filter(f_news); filter(p_debug); destination(newsnotice); }; log { source(src); filter(f_iptables); destination(iptables); }; log { source(src); filter(f_authpriv); destination(loghost); }; log { source(src); filter(f_syslog); destination(loghost); }; log { source(src); filter(f_cron); destination(loghost); }; log { source(src); filter(f_daemon); destination(loghost); }; log { source(src); filter(f_lpr); destination(loghost); }; log { source(src); filter(f_user); destination(loghost); }; log { source(src); filter(f_uucp); destination(loghost); }; log { source(src); filter(f_messages); destination(loghost); }; log { source(src); filter(f_ppp); destination(loghost); }; log { source(src); filter(p_debug); destination(loghost); }; log { source(src); filter(p_emergency); destination(loghost); }; /etc/syslog.conf (of the logserver) # /etc/syslog.conf - Configuration file for syslogd(8) # # For info about the format of this file, see "man syslog.conf". # # # # print most on tty10 and on the xconsole pipe # *.* /dev/tty12 kern.warn;*.err;authpriv.none /dev/tty10 kern.warn;*.err;authpriv.none |/dev/xconsole *.emerg * # enable this, if you want that root is informed # immediately, e.g. of logins #*.alert root # # all email-messages in one file # mail.* -/var/log/mail # # all news-messages # # these files are rotated and examined by "news.daily" news.crit -/var/log/news/news.crit news.err -/var/log/news/news.err news.notice -/var/log/news/news.notice # enable this, if you want to keep all news messages # in one file #news.* -/var/log/news.all # # Warnings in one file # *.=warn;*.=err -/var/log/warn *.crit /var/log/warn # # save the rest in one file # *.*;mail.none;news.none -/var/log/messages # # enable this, if you want to keep all messages # in one file #*.* -/var/log/allmessages # # Some foreign boot scripts require local7 # local0,local1.* -/var/log/localmessages local2,local3.* -/var/log/localmessages local4,local5.* -/var/log/localmessages local6,local7.* -/var/log/localmessages kern.* -/var/log/firewall

1 0

config help
by Nicholas Bernstein 25 Mar '03

25 Mar '03

What I think this should be doing: reads src, parses, creates file, writes to file, next. at the very least it it not doing the write. I would imagine more, but I'm not sure how I can tell. Could someone please take a look at the config file and tell me if I am doing something wrong? The examples of the type of data I'm looking for: ftp: Mar 25 14:38:22 da2 ftp(pam_unix)[12722]: session opened for user nick by (uid=0) Mar 25 14:39:45 da2 ftpd[12995]: wu-ftpd - TLS settings: control allow, client_cert allow, data allow Mar 25 14:39:49 da2 ftp(pam_unix)[12995]: session opened for user nick by (uid=0) fw: Mar 23 23:23:34 da2 kernel: IN=eth0 OUT= MAC=00:08:02:b0:67:c1:00:50:54:ff:12:6a:08:00 SRC=68.69.59.21 DST=192.168.210.13 LEN=60 TOS=0x00 PREC=0x00 TTL=42 ID=43080 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=23547 Mar 23 23:23:34 da2 kernel: IN= OUT=eth0 SRC=192.168.210.13 DST=68.69.59.21 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=55063 PROTO=ICMP TYPE=0 CODE=0 ID=512 SEQ=23547 TIA! Nick syslog-ng.conf: -------------------------------------------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); #MY ADDITIONS: create_dirs (yes); dir_owner(root); dir_group(wheel); dir_perm(775); keep_hostname (yes); owner(root); group(wheel); perm(660); }; # A LOT OF THIS IS STANDARD TO THE EXAMPLE CONFIG... SKIP TO <MY ADDITIONS> # THE REST IS PROVIDED FOR COMPLETENESS & CONTEXT source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; # <MY ADDITIONS> # FTPD RULES BELOW +++++++++++++++++++++++++++++++++ destination ftpd { file("/var/log/ftpd.log"); }; filter f_ftpd { facility(kern) and match ("ftpd"); }; log { source(s_sys); filter(f_ftpd); destination(ftpd); }; # # BELOW IS STANDARD TO THE EXAMPLE CONFIG # # FIREWALL RULES ++++++++++++++++++++++++++++++++++ destination d_fw { file("/var/log/firewall.log"); }; filter f_fw { facility(kern) and match (": IN="); }; log { source(s_sys); filter(f_fw); destination(d_fw); }; # </MY ADDITIONS> log { source(s_sys); filter(f_filter1); destination(d_cons); }; # # BELOW IS STANDARD TO THE EXAMPLE CONFIG # log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; -- +---------------------------------------------------------------+ | Nicholas Bernstein | nick(a)docmagic.com | | UNIX Systems Administrator | http://www.docmagic.com | | Document Systems Inc. | | +---------------------------------------------------------------+

1 0

New to the List.
by Nicholas Bernstein 25 Mar '03

25 Mar '03

First off, I wanted to say hello and introduce myself to everyone. I'm new to using syslog-ng, but from the reading I've been doing over the last day or two, it seems very nice. :) It's probably going to take me a little while to get used to it though. I do have a few questions: 1. Does anyone know of a syslog-ng rpm package that works with RedHat 7.3? I try to automate the setup of my servers and installing from an rpm only take one line in the script per package as opposed to building it from scratch which is messier. 2. I want to set up two custom filters; one for ftpd* -> seperate log file and a second where all kernel messages about iptables logged packets go. Does this look right? ** example of ftp log entry: ---------- Mar 25 11:39:33 da ftpd[6035]: FTP session closed Mar 25 11:39:35 da ftpd[6231]: FTP LOGIN FROM www2.docmagic.com [192.168.210.22], webftp --------- ** example of kernel packet log entry: --------- Mar 23 23:23:34 da2 kernel: IN=eth0 OUT= MAC=00:08:02:b0:67:c1:00:50:54:ff:12:6a :08:00 SRC=68.69.59.21 DST=192.168.210.13 LEN=60 TOS=0x00 PREC=0x00 TTL=42 ID=43 080 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=23547 Mar 23 23:23:34 da2 kernel: IN= OUT=eth0 SRC=192.168.210.13 DST=68.69.59.21 LEN= 60 TOS=0x00 PREC=0x00 TTL=64 ID=55063 PROTO=ICMP TYPE=0 CODE=0 ID=512 SEQ=23547 --------- is this correct: destination ftpd { file("/var/log/ftpd.log"); }; destination firewall { file("/var/log/firewaill.log"); }; filter f_ftpd { program("ftpd*:*") } filter f_firewall { program("kernel:*") and match("(IN=eth0|IN= )") } log { source(src); filter(f_ftpd); destination(ftpd); }; log { source(src); filter(f_firewall); destination(firewall); }; ------------------- Also, I'm using the /syslog-ng-1.6.0rc1/contrib/syslog-ng.conf.RedHat to get started. What are some of the general reccomended additions to it? ----- [nick@da2 syslog-ng]$ more syslog-ng.conf # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 10 Aug 2002 # - for Red Hat 7.3 # - totally do away with klogd # - add message "kernel:" as is done with klogd. # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 22 Aug 2002 # - use the log_prefix option as per Balazs Scheidler's email # options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/lo g"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; ------- Thanks, look forward to hearing from you all, Nick -- +---------------------------------------------------------------+ | Nicholas Bernstein | nick(a)docmagic.com | | UNIX Systems Administrator | http://www.docmagic.com | | Document Systems Inc. | | +---------------------------------------------------------------+

1 0

destination driver question
by Dave Patterson 24 Mar '03

24 Mar '03

Hi all, Im' running syslog-ng version 1.6.0rc1 on FreeBSD 4.7 I'm having great difficulty in getting the "remove_if_older" file option to work. My current syslog-ng.conf has this line which works fine: destination d_program { file("/var/syslog-ng/$HOST/$PROGRAM/$MONTH_$DAY" perm(0640)); }; I tried to add the remove_if_older option like so: destination d_program { file("/var/syslog-ng/$HOST/$PROGRAM/$MONTH_$DAY" perm(0640)); remove_if_older("604800"); }; when I add the remove option, I get a parse error. I have also tried to added it to the options line: options { long_hostnames(off); sync(0); create_dirs(yes); chain_hostnames(on); time_reopen (30); remove_if_older("604800"); }; same error, does anyone have any ideas ? Dave Patterson Open LabNet Staff patterson29(a)llnl.gov To repair, press this button: NO... NOOO NOT THAT ONE !!! ............. Fatal Exception Error: press any key to reboot

1 0

Syslog-ng and MySQL
by Madziarczyk, Jonathan 24 Mar '03

24 Mar '03

So I'm trying to log to a MySQL database with Syslog-ng. I followed the directions on "campin.net" and everything looks good. However when I try to look at the data, I get the message "[MySQL][ODBC 3.51 Driver] Access Denied for user: 'root@(IPAddr)' (Using password: YES). I'm using the odbc driver on a pc to look at the server. Is this a MySQL permissions problem or is there something else I should be looking at? If it is, what do I need to add to let this work? Thanks

1 0

RE: [syslog-ng]$MSG into different variables?
by McNutt, Justin M. 20 Mar '03

20 Mar '03

If you find a solution to this, *please please please* post it to the list! :-) Thanks! --J > -----Original Message----- > From: m(a)ervius.net [mailto:m@ervius.net] > Sent: Thursday, March 20, 2003 9:19 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]$MSG into different variables? > > > Hi, > > I'm trying to insert a variety of different logs into a MySql database > from syslog-ng. The logs are coming from cisco routers, squid > proxys, FW1 > etc. and have a varying number of fields. > > The database tables are created with fields that match the > different log > formats, - src IP, dest IP, protocol etc. > > Since I can match the incoming logs with regexps, it is possible to be > absolutely sure that a given log message will fit into a given table. > > What I then would like to do is to split the $MSG into its different > columns (separated by whitespace) and call the corresponding > destination > which would look something like this: > > destination cisco_icmp { > pipe("/tmp/icmp.pipe" > template("INSERT INTO router_icmp (host, priority, date, > time, program, > access_list, if, type_code ) VALUES ( '$HOST', '$PRIORITY', > '$YEAR-$MONTH-$DAY', $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG[6]', > '$MSG[8]', '$MSG[13]' );\n") template-escape(yes)); > }; > > Is this possible to do in syslog-ng? Or is there any other method of > getting the values from the $MSG variable? > > I could of course read it from the pipe with some awk or perl > script and > build the sql-syntax from there. But since I will have quite a few > different table formats it would then need a perl interpreter > running for > each table. Not very pretty IMO. > > Any suggestions? Have I missed something? > > Thanks! > > // Martin > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

1 0

Urgent: Mangled messages in pipe() destinations in version 1.5.19
by Andreas Schulze 20 Mar '03

20 Mar '03

Hello Balazs, in version 1.5.19 (and in other versions between >1.5.7 and <=1.5.19, too) we observing obscure message mangling in pipe() destinations. Imagine the config below and the scenario: syslog-ng --write(2)--> pipe() --read(2)--> application All four log paths below, writes lines to the pipe '/tmp/pipe'. With 1.5.7 we read from the pipe exactly that, what syslog-ng (using the config below) writes to it. But with all newer versions (espec. 1.5.19) we read (with the same config): message_1 message_2 messagmessage_4 !!! ... message_n if we try to let syslog-ng write: message_1 message_2 message_3 message_4 ... message_n (The numbers and terms are only examples, because of the different sources and high message load.) Seems, that write(2) to fifo skips some message ends now. (espec. the terminating newline) > # example config: > # > source sys { sun-streams ("/dev/log" door("/var/run/syslog_door")); }; > source net { udp (ip(w.x.y.z) port(n)); }; > destination d_cisco { pipe("/tmp/pipe" template("@cisco: | $MSG\n")); }; > destination d_icmp { pipe("/tmp/pipe" template("@icmpd: | $MSG\n")); }; > log { source(net); filter(fa); destination(da); destination(d_cisco); }; > log { source(net); filter(fb); destination(db); destination(d_cisco); }; > log { source(sys); filter(f1); destination(d1); destination(d_icmp); }; > log { source(sys); filter(f2); destination(d2); destination(d_icmp); }; We are running a config similar to this above, with 1.5.7 since a lot of months very successfully in production ennvironment with very high message load. Since 1.5.1? the message mangling occurs. But now, some of your newer features becomes mission critical for us. Have you any idea, what happens? Versions <= 1.5.7 works well. Thanks a lot. -- Best regards --Andreas Schulze [phone: +49.5246.80.1275, fax: +49.5246.80.2275] | I believe, it was Dennis Ritchie who said something like: | "C is rarely the best language for a given task, | but it's often the second-best". | The implication being that: "[...]" | | sh# cat>$$.c<<EOT | main(l,a,n,d)char**a;{for(d=atoi(a[1])/10*80-atoi(a[2])/5-596;n="@NK\ | ACLCCGZAAQBEAADAFaISADJABBA^SNLGAQABDAXIMBAACTBATAHDBANZcEMMCCCCAAhE\ | IJFAEAAABAfHJETBdFLDAANEfDNBPHdBcBBBEA_AL H E L L O, W O R L D! " | [l++-3];)for(;n-->64;)putchar(!d+++33^l&1);} | EOT | gcc -o$$ $$.c;clear;./$$ 52 8;rm -f $$*

6 19

rpm
by Khristopher_Klaich＠nywd.uscourts.gov 20 Mar '03

20 Mar '03

Hello does anyone know if there is an rpm for redhat 7.3 available? Thanks- K.

2 1