- syslog-ng - lists.balabit.hu

RE: [syslog-ng]Syslog-ng 1.6.0rc1 and AIX 4.3.3
by robertmg＠WellsFargo.COM 12 Mar '03

12 Mar '03

From: Gehring, Andrew x66132 >I'm trying to compiling 1.60rc1 on AIX 4.3.3 >I've tried both gcc-2.95 and gcc-3.2 both with make-3.80 >Not matter what I've tried it always fails to find libol 0.3.9 which I've >successfully compiled and installed in /usr/local >as a note I successfully compiled 1.5.26 on the same box, and it found libol-0.3.9 >all by itself... :-) <from_archive> > From: EDL.Essed(a)belastingdienst.nl > Sent: Monday, February 24, 2003 2:33 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]syslog-ng 1.6.0rc1 available > > > > Hi, > > I'm having problems building, checking for libol fails. > > ./configure --with-libol=/home/essee05/logging/src/libol-0.3.9 > checking libol version >= 0.3.9... no > configure: error: Required libol version not found > > Looking at configure.in, I see the sed part has changed. > Changing it back > to the 3 lines from 1.5.26 makes it work again. <snip> </from_archive>

1 0

Syslog-ng 1.6.0rc1 and AIX 4.3.3
by Gehring, Andrew x66132 11 Mar '03

11 Mar '03

I'm trying to compiling 1.60rc1 on AIX 4.3.3 I've tried both gcc-2.95 and gcc-3.2 both with make-3.80 Not matter what I've tried it always fails to find libol 0.3.9 which I've successfully compiled and installed in /usr/local as a note I successfully compiled 1.5.26 on the same box, and it found libol-0.3.9 all by itself... :-) Thanks for any help, Andrew

1 0

Separate log messages
by Hong Tian 11 Mar '03

11 Mar '03

Hi, We have a Red Hat 7.3 Log server (using default syslogd) which are receiving all log messages from Linux and Solaris syslogd clients. I want syslogd to separate the log message file automatically based on each syslogd client hostname. Anyone knows how to do it? Could I change the name of log file to each_host_message. Thanks, Hong

2 1

RE: [syslog-ng]ERROR on installing
by Michael Breton 11 Mar '03

11 Mar '03

>-----Original Message----- >From: Adnan [mailto:adnanm@gerrys.net] >Sent: Tuesday, March 11, 2003 9:08 AM >To: syslog-ng(a)lists.balabit.hu >Subject: [syslog-ng]ERROR on installing >... >checking for gcc... no >checking for cc... no >configure: error: no acceptable cc found in $PATH Apparently you do not have cc or gcc in your path. the configure script cannot find your compiler. Do this: find / -name gcc and this: find / -name cc If it didn't find either one, then you have to install an RPM of a compiler first. The best one is gcc. If it found gcc, then make a note of the path to it, and add it to your PATH statement. Then try again... Good luck, Michael Breton Commtel

1 0

ERROR on installing
by Adnan 11 Mar '03

11 Mar '03

I am installing this on linux 6.2 i am getting this error !!!!! oading cache ./config.cache checking for a BSD compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... no checking for working aclocal... missing checking for working autoconf... missing checking for working automake... missing checking for working autoheader... missing checking for working makeinfo... missing checking for gcc... no checking for cc... no configure: error: no acceptable cc found in $PATH

1 0

performance test questions
by Roberto Nibali 10 Mar '03

10 Mar '03

Hi, I'm conducting syslog-ng performance tests. I've deployed a central loghost environment and three clients trying to send messages which should end up on the central loghost with as few losses as possible. The whole thing is currently done over UDP and the clients have either syslogd or syslog-ng as daemons. If I deploy syslog-ng as a client to send messages from /dev/log via UDP to the central loghost I experience a rather high message loss starting on a threshold of about 1000 messages sent in the least amount of time possible. If I do the same thing with syslogd the threshold is up to 35000 from the same machine. That means I can send 35000 messages to /dev/log as fast as possible and they still get reliably transferred to the central loghost and written to disk there. A little stunned over this strange occurrance I've started to narrow the problem down and I ended up with following question: Why does syslog-ng not send a UDP packet per message sent via syslog() and an ending '\n'? And is there a mean to configure this odd behaviour? To illustrate what I mean I provide you with two sample dumps from a tcpdump session where I sent 3 messages. The first one is the tcpdump snipped of syslogd processing the messages and the second one is the result when syslog-ng processes the logs: 16:01:09.210645 x.y.z.6.514 > x.y.z.117.514: udp 71 0x0000 4500 0063 ca2c 0000 4011 87aa ac1b e806 E..c.,..@....... 0x0010 ac1b e875 0202 0202 004f 3a51 3c31 313e ...u.....O:Q<11> 0x0020 6c6f 6774 6573 7420 3a20 5b31 5d20 4920 logtest.:.[1].I. 0x0030 6c69 6b65 2074 6f20 6c6f 6720 6661 7374 like.to.log.fast 0x0040 2062 7574 206d 6f73 7420 696d 706f 7274 .but.most.import 0x0050 616e 746c 7920 6163 6375 7261 7465 2121 antly.accurate!! 0x0060 2120 0a !.. 16:01:09.210820 x.y.z6.514 > x.y.z.117.514: udp 71 0x0000 4500 0063 ca2d 0000 4011 87a9 ac1b e806 E..c.-..@....... 0x0010 ac1b e875 0202 0202 004f 3a50 3c31 313e ...u.....O:P<11> 0x0020 6c6f 6774 6573 7420 3a20 5b32 5d20 4920 logtest.:.[2].I. 0x0030 6c69 6b65 2074 6f20 6c6f 6720 6661 7374 like.to.log.fast 0x0040 2062 7574 206d 6f73 7420 696d 706f 7274 .but.most.import 0x0050 616e 746c 7920 6163 6375 7261 7465 2121 antly.accurate!! 0x0060 2120 0a !.. 16:01:09.211064 x.y.z.6.514 > x.y.z.117.514: udp 71 0x0000 4500 0063 ca2e 0000 4011 87a8 ac1b e806 E..c....@....... 0x0010 ac1b e875 0202 0202 004f 3a4f 3c31 313e ...u.....O:O<11> 0x0020 6c6f 6774 6573 7420 3a20 5b33 5d20 4920 logtest.:.[3].I. 0x0030 6c69 6b65 2074 6f20 6c6f 6720 6661 7374 like.to.log.fast 0x0040 2062 7574 206d 6f73 7420 696d 706f 7274 .but.most.import 0x0050 616e 746c 7920 6163 6375 7261 7465 2121 antly.accurate!! 0x0060 2120 0a !.. ------ 16:01:53.458412 x.y.z.6.1031 > x.y.z.117.514: udp 306 0x0000 4500 014e ca6c 0000 4011 867f ac1b e806 E..N.l..@....... 0x0010 ac1b e875 0407 0202 013a b8e8 3c31 313e ...u.....:..<11> 0x0020 4a61 6e20 3330 2031 373a 3137 3a31 3920 Jan.30.17:17:19. 0x0030 735f 696e 7440 6d69 6c6b 2d6e 6574 5f6f s_int@milk-net_o 0x0040 7665 7266 6c6f 7720 3a20 5b31 5d20 4920 verflow.:.[1].I. 0x0050 6c69 6b65 2074 6f20 6c6f 6720 6661 7374 like.to.log.fast 0x0060 2062 7574 206d 6f73 7420 696d 706f 7274 .but.most.import 0x0070 616e 746c 7920 6163 6375 7261 7465 2121 antly.accurate!! 0x0080 210a 3c31 313e 4a61 6e20 3330 2031 373a !.<11>Jan.30.17: 0x0090 3137 3a31 3920 735f 696e 7440 6d69 6c6b 17:19.s_int@milk 0x00a0 2d6e 6574 5f6f 7665 7266 6c6f 7720 3a20 -net_overflow.:. 0x00b0 5b32 5d20 4920 6c69 6b65 2074 6f20 6c6f [2].I.like.to.lo 0x00c0 6720 6661 7374 2062 7574 206d 6f73 7420 g.fast.but.most. 0x00d0 696d 706f 7274 616e 746c 7920 6163 6375 importantly.accu 0x00e0 7261 7465 2121 210a 3c31 313e 4a61 6e20 rate!!!.<11>Jan. 0x00f0 3330 2031 373a 3137 3a31 3920 735f 696e 30.17:17:19.s_in 0x0100 7440 6d69 6c6b 2d6e 6574 5f6f 7665 7266 t@milk-net_overf 0x0110 6c6f 7720 3a20 5b33 5d20 4920 6c69 6b65 low.:.[3].I.like 0x0120 2074 6f20 6c6f 6720 6661 7374 2062 7574 .to.log.fast.but 0x0130 206d 6f73 7420 696d 706f 7274 616e 746c .most.importantl 0x0140 7920 6163 6375 7261 7465 2121 210a y.accurate!!!. ------ The configuration file for syslogd is: --------------------------------------------------------- user.err @x.y.z.117 --------------------------------------------------------- The configuration file for syslog-ng is: --------------------------------------------------------- options { sync (0); time_reopen (10); log_fifo_size (1024); long_hostnames (on); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_int { internal(); unix-stream("/dev/log" max-connections(256)); }; filter f_test { facility(user) and level(err); }; destination d_test { udp("x.y.z.117" port(514)); }; log { source(s_int); filter(f_test); destination(d_test); flags(final); }; --------------------------------------------------------- Please enlighten me with an explanation to this problem. As an example take following verified numbers for a syslog() storm of 50000 messages where I do a 50ms sleep every 250 messages sent. All in all this results in a 14332ms log burst (usleep() syscall overhead). Message lines lost with syslog-ng (average): ~6300 Message lines lost with syslogd (average): 0 !!!! I've also attached the test tool which I use to conduct my tests. It's extremely simple so I don't expect any problems with this. It has sequence numbers so one is able to track down the losses (something which should be in syslog-ng too IMHO). I currently have no explanation for this observation because I haven't read the whole source code yet. I suspect you have a read buffer on sources (/dev/log in this example) which overrides the '\n' -> fflush() semantics to be able to send less UDP packets with more content per packet. So I hope this is tunable somewhere or one can even disable it to mimic the old syslogd behavior. Another question: Why is there no message sent when a buffer reaches its maximum size? This would help debugging and tuning a lot IMHO. Sorry if this has been discussed before. Best regards, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc #include <stdio.h> #include <stdlib.h> #include <syslog.h> #include <unistd.h> #include <sys/time.h> /* logtest.c: RTSL! Copyright 2003, Roberto Nibali, terreActive AG Published under the GPLv2 license. */ #define DEF_STRING "I like to log fast but most importantly accurate!!!" #define DEF_IDENT "logtest " #define DEF_FACILITY LOG_KERN #define DEF_PRIO LOG_ERR #define DEF_NUM 10 #define DEF_INT -1 #define DEF_MOD 1 void flood_log(const char *message, unsigned int num, unsigned int seq, long int interval, unsigned int mod) { int i; for (i=1; i<=num; i++, seq++) { syslog(DEF_PRIO, "[%d] %s\n", seq, message); if (interval != DEF_INT && ((seq % mod) == 0)) { usleep(interval*1000); } } } int main(int argc, char *argv[]) { unsigned int seq = 1; unsigned int num = DEF_NUM; long int interval= DEF_INT; unsigned int mod = DEF_MOD; struct timeval start; struct timeval end; unsigned long diff; if (argc < 2) { printf("\n"); printf("Usage: %s [<num>][<int>{ms}][<mod>]\n\n", argv[0]); printf("<num>: Amount of log messages\n"); printf("<int>: Sleep time in miliseconds\n"); printf("<mod>: Every <mod> do sleep for <int> miliseconds\n\n"); printf("Example: %s 1000 700 250\n", argv[0]); printf("--------\n"); printf("This will send 1000 messages and do a 0.7s delay "); printf("for every 250 messages sent.\n"); printf("It should approximately take 2.8sec plus syscall "); printf("overhead which depends on the\n"); printf("CPU, thus it effectively takes roughly 3s.\n"); printf("\n"); exit(1); } else if (argc == 2) { num=atoi(argv[1]); } else if (argc == 3) { num=atoi(argv[1]); interval=strtoul(argv[2], NULL, 10); } else if (argc == 4) { num=atoi(argv[1]); interval=strtoul(argv[2], NULL, 10); mod=atoi(argv[3]); } printf("Estimated time: %ld msecs\n",num*(interval==-1?1:interval)/mod); openlog(DEF_IDENT, 0, DEF_FACILITY); gettimeofday(&start, NULL); flood_log(DEF_STRING, num, seq, interval, mod); gettimeofday(&end, NULL); closelog(); diff = (end.tv_sec - start.tv_sec) * 1000000 + (end.tv_usec - start.tv_usec); printf("Message string: %s\n", DEF_STRING); printf("Sent messages : %d\n", num); printf("Elapsed time : %ld msecs\n", diff/1000); printf("Bytes written : %d Bytes\n", num*sizeof(DEF_STRING)); printf("Interval : %ld msecs\n", interval == -1 ? 0 : interval); printf("Modulus : %d\n", mod); return(0); }

6 26

about syslog
by Moktar KONE 10 Mar '03

10 Mar '03

hi , I have three machines A B and C which run syslog (not syslog-ng) and they send now their logs toward a remote host S. How is it possible with syslogd (running over S) to manage differents logs from A, B and C according to the log source (i.e create a file for log coming from A , an other file for log coming from B and an other file for C). the machine S, which receive logs is running syslogd , how can it manage the logs coming from the others machines according to their source. If syslog is not able to manage this , can syslog-ng do it?how? thanks

2 1

sorting messages with no HOSTNAME in HEADER
by Lars Erik Gullerud 10 Mar '03

10 Mar '03

Is there any way to make syslog-ng understand that messages it receives from my external hosts will _never_ have a HOSTNAME portion in its HEADER, as according to the terms used in RFC3164? I.e. my syslog-packets, regardless of the type of equipment generating them, always contain just a PRI, a TIMESTAMP and then the MSG. No HOSTNAME and no TAG. syslog-ng seems to always want to parse the first word of the received MSG as a hostname (although it is always in the format %SOMESYSLOGMESSAGE with a leading %, for all the hardware platforms I am trying to log), so keep_hostnames(yes) will sort based on this as the hostname, while keep_hostnames(no) will correctly sort, but replace the actual message I want to keep with a hostname. Now, i _know_ my packets will never have a HOSTNAME portion, so i always want syslog-ng to add that, but i do NOT want it to fiddle around with what it wrongly perceives to be a HOSTNAME in the received message. I.e. I want the hostname _added_, not rewritten. Is there any way I get syslog-ng to understand this? My normal FreeBSD-syslogd handles this problem beautifully by default, but it's a pain to have to run cron-jobs periodically to sort the logs into per-host logfiles. Surely it's just me who is being stupid here, this must be possible with syslog-ng? /leg

2 2

RE: [syslog-ng]Newbie question
by Vilmos Branyik 09 Mar '03

09 Mar '03

Nate, Thanks for the response. I'm going to combine the answer from both your emails in this one. I took out the duplicate "source src" line but that didn't help. I changed the filter f_messages line as well, also no help. **Note below for those that may find this in a search some day in the future** I had changed that from the original in the example file (from the FAQ): filter f_messages { level(info..emerg) and not facility(mail,lpr); } To: filter f_messages { level(info.emerg) and not facility(mail,lpr); } I should have known it would be a comma. syslog-ng starts just fine and shows no errors. I tried the syslog-ng -s -f command in your message but the -s parameter is not supported , I get an error. I was starting to suspect that my problem may be with stunnel. When I boot I see an OK on load but the very last thing that is loaded is stunnel and I finally was able to catch this message on the console: SSL_CTX_useRSAPRivateKey_file: error: 0906D06C: PEM routines: PEM_read_bio: no start line I took out the stunnel start line in rc.local and still no logging. I'm wondering if I should just run syslog-ng without stunnel. I'm not planning on having this server on a public IP address anyway. My plan was to run my public servers with a 2 NIC cards. On card to the public IP and one on a private network. The syslog-ng server would be on the private network behind all the other servers. I think I would have a pretty good chance of catching anything before it gets to the logging server. Any thoughts/suggestions? And not related: Nice site, I found it early on and got a lot of good information from it. Even so, you're not giving Great Lakes it's due, are you getting any grief for that :). Vilmos -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Sunday, March 09, 2003 1:46 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Newbie question On Fri, Mar 07, 2003 at 08:31:12PM -0700, Vilmos Branyik wrote: > > source src { unix-stream("/dev/log"); internal(); }; > source src { unix-stream("/dev/log"); internal(); }; You have two source lines, remove one and see if that helps. Also is syslog-ng actually running or does it quit after parsing the config file? -- Nate Campi http://www.campin.net _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 2

Newbie question
by Vilmos Branyik 09 Mar '03

09 Mar '03

Hello, I'm setting up syslog-ng for the first time. I used the Central Loghost Mini-HOWTO. I followed the instructions step by step but there are no local messages being logged to the system. I haven't tried remote logging yet. I have posted my config file below this message. If someone could point out my error, I would appreciate it. I'm using: syslog-ng 1.4.15 RedHat 7.2 Thanks for any help you can give me. Vilmos ***** Configuration file ***** options { sync (3); log_fifo_size (300); long_hostnames (off); use_dns (yes); use_fqdn (yes); keep_hostname (yes); }; source src { unix-stream("/dev/log"); internal(); }; source remote { tcp(ip("127.0.0.1") port(514) keep-alive(yes)); }; source src { unix-stream("/dev/log"); internal(); }; destination lpr { file("/var/log/lpr.log"); }; destination mail { file("/var/log/mail.log"); }; destination messages { file("/var/log/messages"); }; destination console_all { file("/dev/tty8"); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { level(info.emerg) and not facility(mail,lpr); }; filter f_emergency { level(emerg); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(maillog); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; destination hosts { file("/var/log/HOSTS/$HOST/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(remote); destination(hosts); };

3 3

RE: [syslog-ng]Newbie question
by Vilmos Branyik 09 Mar '03

09 Mar '03

Dale, Thanks for the response. The configs you pointed me to are the ones that I am using. The program starts just fine but nothing from the server logs. Any other suggestions? Vilmos -----Original Message----- From: Dale B. Sorry [mailto:io@hypodermic.net] Sent: Friday, March 07, 2003 11:33 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: Re: [syslog-ng]Newbie question you got the right idea, but the log parsing/filtering is all done on the server side. some great examples can be found here: http://venus.ece.ndsu.nodak.edu/~jezerr/linux/secure-remote-logging.html#sys log-ng-config On Fri, 7 Mar 2003, Vilmos Branyik wrote: > Hello, > > I'm setting up syslog-ng for the first time. I used the Central Loghost > Mini-HOWTO. > > I followed the instructions step by step but there are no local messages > being logged to the system. I haven't tried remote logging yet. > > I have posted my config file below this message. If someone could point out > my error, I would appreciate it. > > I'm using: > > syslog-ng 1.4.15 > RedHat 7.2 > > Thanks for any help you can give me. > > > Vilmos > > ***** Configuration file ***** > > options { sync (3); > log_fifo_size (300); > long_hostnames (off); > use_dns (yes); > use_fqdn (yes); > keep_hostname (yes); > }; > > source src { unix-stream("/dev/log"); internal(); }; > source remote { tcp(ip("127.0.0.1") port(514) keep-alive(yes)); }; > > source src { unix-stream("/dev/log"); internal(); }; > > destination lpr { file("/var/log/lpr.log"); }; > destination mail { file("/var/log/mail.log"); }; > > destination messages { file("/var/log/messages"); }; > > destination console_all { file("/dev/tty8"); }; > > filter f_lpr { facility(lpr); }; > filter f_mail { facility(mail); }; > filter f_messages { level(info.emerg) and not facility(mail,lpr); }; > filter f_emergency { level(emerg); }; > > log { source(src); filter(f_lpr); destination(lpr); }; > log { source(src); filter(f_mail); destination(maillog); }; > log { source(src); filter(f_messages); destination(messages); }; > log { source(src); filter(f_emergency); destination(console); }; > > destination hosts { file("/var/log/HOSTS/$HOST/$FACILITY" owner(root) > group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; > > log { source(remote); destination(hosts); }; > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > -- Daniel Simonton Hypodermic.NET Owner/Admin _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Block syslogd
by Hong Tian 08 Mar '03

08 Mar '03

Hi, We have a log server built on RedHat 7.3. We allow some specific Unix servers (Solaris and Linux) to send the log messages to this log server remotely. My question is how to only allow the specific Unix machines to send log messages to this log server and deny all other machines sending syslog messages to this log server. Thanks, Hong

2 1

Kernel logging stops on reload
by Paul Chambers 07 Mar '03

07 Mar '03

I saw some discussion on a similar subject on the list a while back, but I don't think it dealt with this specifically. I run logrotate nightly, and it executes '/usr/bin/killall -HUP syslog-ng' after rotating the logs. After that, I get no more logging from the kernel until I manually restart syslog-ng ('service syslog-ng restart'). I realize I could ditch klogd and use syslog-ng exclusively, but I'm reluctant to drop support for kernel symbols. Any insights? Paul __________________________ Versions: syslog-ng 1.6.0rc1 (also seen with 1.5.26) klogd 1.4.1 linux kernel 2.4.18-15clx (Celestix distro, mandrake-based) killall (psmisc v19) __________________________ Here's my syslog-ng.conf. I've tried the unix-dgram statement with and without 'keep-alive(yes) max-connections(512)' just to be sure (I don't think those options apply to unix-dgram?). I'll be changing the 'logall' target to feed logsurfer, once I've got that working the way I'd like. # syslog-ng configuration file. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source sys { unix-dgram ("/dev/log" keep-alive(yes) max-connections(512)); internal(); }; source remote { udp(); }; destination auth { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination user { file("/var/log/user.log"); }; destination mesg { file("/var/log/messages"); }; destination secure { file("/var/log/secure"); }; destination mailinfo { file("/var/log/mail/info"); }; destination mailwarn { file("/var/log/mail/warnings"); }; destination mailerr { file("/var/log/mail/errors"); }; destination croninfo { file("/var/log/cron/info"); }; destination cronwarn { file("/var/log/cron/warnings"); }; destination cronerr { file("/var/log/cron/error"); }; destination kerninfo { file("/var/log/kernel/info"); }; destination kernwarn { file("/var/log/kernel/warnings"); }; destination kernerr { file("/var/log/kernel/error"); }; destination lprinfo { file("/var/log/lpr/info"); }; destination lprwarn { file("/var/log/lpr/warnings"); }; destination lprerr { file("/var/log/lpr/error"); }; destination newsinfo { file("/var/log/news/info"); }; destination newswarn { file("/var/log/news/warnings"); }; destination newserr { file("/var/log/news/error"); }; destination daemoninfo { file("/var/log/daemons/info"); }; destination daemonwarn { file("/var/log/daemons/warnings"); }; destination daemonerr { file("/var/log/daemons/errors"); }; destination spool { file("/var/log/spooler"); }; destination boot { file("/var/log/boot.log"); }; destination logall { file("/var/log/everything.log"); }; destination mailall { usertty("*"); }; # Generic filters filter f_info { level(debug,info,notice); }; filter f_warn { level(warn); }; filter f_error { level(error); }; filter f_emergency { level(emerg); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_kernel { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_news { facility(news); }; filter f_daemon { facility(daemon); }; # Specific filters filter f_authonly { facility(auth,authpriv); }; filter f_user { facility(user); }; # Log anything (except mail) of level info or higher # Don't log private authentication messages filter f_mesgs { level(info..warn) and not facility(mail,authpriv); }; # authpriv logging (restricted) filter f_secure { facility(authpriv); }; filter f_spool { facility(uucp) or (facility(news) and level(crit)); }; filter f_boot { facility(local7); }; filter f_syslog { not facility(auth, authpriv); }; # Log to logfiles log { source(sys); destination(logall); }; log { source(sys); filter(f_spool); destination(spool); }; log { source(sys); filter(f_boot); destination(boot); }; log { source(sys); filter(f_user); destination(user); }; log { source(sys); filter(f_secure); destination(secure); }; log { source(sys); filter(f_syslog); destination(syslog); }; log { source(sys); filter(f_mesgs); destination(mesg); }; log { source(sys); filter(f_authonly); destination(auth); }; log { source(sys); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(sys); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(sys); filter(f_mail); filter(f_error); destination(mailerr); }; log { source(sys); filter(f_cron); filter(f_info); destination(croninfo); }; log { source(sys); filter(f_cron); filter(f_warn); destination(cronwarn); }; log { source(sys); filter(f_cron); filter(f_error); destination(cronerr); }; log { source(sys); filter(f_kernel); filter(f_info); destination(kerninfo); }; log { source(sys); filter(f_kernel); filter(f_warn); destination(kernwarn); }; log { source(sys); filter(f_kernel); filter(f_error); destination(kernerr); }; log { source(sys); filter(f_lpr); filter(f_info); destination(lprinfo); }; log { source(sys); filter(f_lpr); filter(f_warn); destination(lprwarn); }; log { source(sys); filter(f_lpr); filter(f_error); destination(lprerr); }; log { source(sys); filter(f_news); filter(f_info); destination(newsinfo); }; log { source(sys); filter(f_news); filter(f_warn); destination(newswarn); }; log { source(sys); filter(f_news); filter(f_error); destination(newserr); }; log { source(sys); filter(f_daemon); filter(f_info); destination(daemoninfo); }; log { source(sys); filter(f_daemon); filter(f_warn); destination(daemonwarn); }; log { source(sys); filter(f_daemon); filter(f_error); destination(daemonerr); }; # Log to console log { source(sys); filter(f_emergency); destination(mailall); }; __________________________ Here's my logrotate.conf: # see "man logrotate" for details # rotate log files weekly weekly # keep 4 weeks worth of backlogs rotate 4 # send errors to root errors root # create new (empty) log files after rotating old ones create # uncomment this if you want your log files compressed compress # don't archive if the log is empty notifempty # RPM packages drop log rotation information into this directory include /etc/logrotate.d # no packages own wtmp -- we'll rotate it here /var/log/wtmp { monthly create 0664 root utmp rotate 1 } # system-specific logs may be configured here # catchall that will rotate anything with the normal naming convention /var/log/*log { weekly notifempty sharedscripts prerotate /usr/local/etc/logcheck.sh endscript postrotate /usr/bin/killall -HUP syslog-ng endscript }

2 3

solaris -> linux
by garvald＠bluemail.ch 07 Mar '03

07 Mar '03

Hallo Im experiencing severe problems in logging from solaris 8 (client) to Linux (server). Linux to linux is working well, absolutely no problem there. I have the following (basic) config setup on the 1 boxes: Solaris Client: source s_all { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal();};destination d_tcp { tcp("192.168.1.2"); }; log { source(s_all); destination(d_tcp); }; Linux: source s_all { internal(); unix-stream("/dev/log"); tcp(); }; destination d_messages { file("/var/log/HOSTS/$HOST/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(s_all); destination(d_messages); }; the result of this config is that absolutely nothing gets logged from the solaris box. A netstat -a shows that the client is connected to the server on the correct port. As already mentioned, logs from a linux client are successfully collected. Ideas anyone ? any help/tips would be appreciated. Cheers AlanCB

1 0

Writing a custom filter
by Rohit Dewan 03 Mar '03

03 Mar '03

What is the best way to write a custom filter for syslog-ng? Any pointers would be most appreciated. Thanks, Rohit

2 2

Strange Directories created [I have read the listserv to no avail]
by Harry Hoffman 01 Mar '03

01 Mar '03

Hi All, My syslog-ng server reports various directories based off of kernel-messages instead of hostnames. I've read the listserv and tried the various options suggested by to no avail. Perhaps someone can help with a suggestion as to what is going wrong here? Info: syslog-ng-1.5.17-1 config file looks like options { use_fqdn(yes); keep_hostname(no); use_dns(yes); long_hostnames(on); sync(3); log_fifo_size(1000); }; ... destination hosts { file("/var/log/HOSTS/$HOST/$FACILITY/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; ... log { source(src); destination(hosts); }; Directories look like this: /var/log/HOSTS ?for ?set host.auckland.ac.nz Any help would be greatly appreciated. I can't figure out where to go next. Thanks, Harry -- Harry Hoffman ITSS Systems Team Leader University of Auckland hhoffman(a)auckland.ac.nz hhoffman(a)ip-solutions.net STANDARD DISCLAIMER: ********************************************** *This universe shipped by weight, not volume.* *Some expansion may have occured in shipping.* ********************************************* ------------------------------------------------- This mail sent through IpSolutions: http://www.ip-solutions.net/

2 4

syslog-ng 1.5.26 dies after remote logging host goes down
by Peter Bieringer 28 Feb '03

28 Feb '03

Hi, looks like a bug, can't be a feature... I have defined a remote destination like: destination d_remotelog { udp( "192.168.1.1" port(514) ) ;}; And use it like log { source(s_local); filter(f_emerg); destination(d_all); destination(d_remotelog); }; Today, I've rebooted "remotelog" host, and detect, that the syslog-ng daemon on the other box dies without any "die now" notice. Last log entries: Feb 28 09:12:38 host syslog-ng[28338]: STATS: dropped 0 Feb 28 09:19:47 host syslog-ng[28338]: Connection broken to AF_INET(192.168.1.1.50:514), reopening in 60 seconds Looks like it dies short after this time, because a running mailman-2.0.x cron job stops logging, too: cron-200302:Feb 28 09:18:01 host CROND[368]: (mailman) CMD (/usr/bin/python -S /var/mailman/cron/qrunner) cron-200302:Feb 28 09:19:00 host CROND[388]: (root) CMD (/usr/local/sbin/AVP_update_bases.pl) cron-200302:Feb 28 09:19:00 host CROND[389]: (mailman) CMD (/usr/bin/python -S /var/mailman/cron/qrunner) cron-200302:Feb 28 09:20:01 host CROND[407]: (root) CMD (/usr/local/sbin/ipacc-get tmplog) cron-200302:Feb 28 09:20:01 host CROND[408]: (root) CMD (/usr/lib/sa/sa1 1 1) cron-200302:Feb 28 09:20:01 host CROND[409]: (mailman) CMD (/usr/bin/python -S /var/mailman/cron/qrunner) cron-200302:Feb 28 09:20:01 host CROND[410]: (mailman) CMD (/usr/bin/python -S /var/mailman/cron/gate_news) cron-200302:Feb 28 09:21:00 host CROND[450]: (mailman) CMD (/usr/bin/python -S /var/mailman/cron/qrunner) [ no further lines :-( ] Nothing else was logged except this 5 cron lines, checked by # grep "Feb 28 09:2" * |more BTW (hopefully off-topic): "host" is IPv6 enabled in general. Runned kernel: RHL 2.4.18-18.7.x with OpenWall patch Hopefully someone can help me. Peter -- Dr. Peter Bieringer http://www.bieringer.de/pb/ GPG/PGP Key 0x958F422D mailto: pb at bieringer dot de Deep Space 6 Co-Founder and Core Member http://www.deepspace6.net/

3 4

millisecond timestamps
by tmk＠lordzork.com 28 Feb '03

28 Feb '03

Is it possible to have syslog-ng support millisecond timestamps? A look at macros.c seems to indicate that it does currently does not, but I can't imagine it would be too difficult to add. It would certainly be useful. t. -- his eye will freeze in the wood, his blood will not be traced while I live.

2 1

RE: [syslog-ng]Solaris 8 Syslog-ng not logging
by robertmg＠WellsFargo.COM 26 Feb '03

26 Feb '03

> From: Ratliff, Lonnie > <snip> > Here is my system and configuration. > > Sun V880 > Solaris 8 > syslog-ng version 1.6.0rc1 > > No errors noted during compiling and I verified it did come back with > Sun Streams and door support. > > I've carved my config file down to the following, just to get > something. I've even tried the default filter and all it logged was > Syslog-ng was starting. > > options { sync(0); > use_dns(no); > use_fqdn(no); > }; You need to use: source net { udp(); tcp(); }; > > source local { sun-streams("/dev/log" door("/etc/.syslog_door")); > internal(); }; > > filter f_host { host("10.0.0.1"); }; > > destination pix01 { file("/syslog/firewalls/pix01"); }; > > log { source(local); filter(f_host); destination(pix01); }; log { source(net); filter(f_host); destination(pix01); }; log { source(local); filter(new local filter); destination(new local dest); }; -mike

1 0

Solaris 8 Syslog-ng not logging
by Ratliff, Lonnie 26 Feb '03

26 Feb '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, I'm in the process of replacing the native syslog daemon on my Solaris 8 loghost, however syslog-ng doesn't log anything except local messages. I've searched back through the archives and have found alittle help, however its still not working. Any assistance would be greatly appreciated. Here is my system and configuration. Sun V880 Solaris 8 syslog-ng version 1.6.0rc1 No errors noted during compiling and I verified it did come back with Sun Streams and door support. I've carved my config file down to the following, just to get something. I've even tried the default filter and all it logged was Syslog-ng was starting. options { sync(0); use_dns(no); use_fqdn(no); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; filter f_host { host("10.0.0.1"); }; destination pix01 { file("/syslog/firewalls/pix01"); }; log { source(local); filter(f_host); destination(pix01); }; I've verified through tcpdump that the remote system (Cisco Pix) is actually sending me messages. What am I missing or screwing up?? Thank You Lonnie Ratliff lratliff(a)tmh.tmc.edu -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBPlzlFMflBxQ642uCEQI5mwCgvuR/BYzlVq5xuWYlZ7lacnH9wrAAoK3A tx25MqZCYAuKYV/U1tKSzfbG =ks+m -----END PGP SIGNATURE----- ----------------------------------------- ____________________________________________________________________________________ ****CONFIDENTIALITY NOTICE**** This e-mail is the property of The Methodist Hospital and/or its relevant affiliates and may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient(or authorized to receive for the recipient), please contact the sender or reply to The Methodist Hospital at datasecurity(a)tmh.tmc.edu and delete all copies of the message. Thank you.

1 0

Documentation update: template() options added and some other stuff
by Achim Gsell 25 Feb '03

25 Feb '03

Hi, in the attachment you find a patch to update the syslog-ng documentation. The patch includes: o documentation of the template() and template_escape() options o some missing close tags the docbook parser complains about o examples for all destination driver (where missing) o some fixes Achim

3 4

Anyone using swatch with R_ISODATE set?
by Jason Haar 24 Feb '03

24 Feb '03

Hi there I'm using swatch 3.1beta and it's throttling option isn't too happy about me using R_ISODATE in my syslogs. i.e. 2003-02-24T20:21:17+0000 server.name mail info qmail: 1046118077.034427 status: local 0/10 remote 0/100 As you can see, I've put all possible information about each syslog record in: UTC timestamped, plus facility and priority. Anyway, swatch doesn't like that timestamp format and probably doesn't like the rest either. I've tried using the new perl_code option to remap how it matches, but it looks like it didn't expect anyone to be screwing around with the timestamp so much :-) Anyone else got it to work? At the moment I'm having to pump the syslogs through a prefilter to convert back into "standard" syslog format to keep swatch happy - it works, but a hack is a hack... Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

1 0

RE: [syslog-ng]syslog-ng and regex
by Hamilton, Andrew 24 Feb '03

24 Feb '03

Yes, it should. Regards, Drew -----Original Message----- From: Micha Holzmann [mailto:holzmann@mhnet.de] Sent: Monday, February 24, 2003 2:49 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng and regex Hello Andrew, Hamilton, Andrew wrote: > To match a program name you use the program function in the filter. > > filter f_antivir { program("antivir"); }; The corresponding syslog messages are: >--- cut here ---- Feb 24 14:00:02 kaliba antivir[1718]: AntiVir is up-to-date Feb 24 15:00:11 kaliba antivir[2451]: AntiVir is up-to-date Feb 24 16:00:02 kaliba antivir[2662]: AntiVir is up-to-date Feb 24 17:02:49 kaliba antivir[2979]: reloaded AntiVir mail scanner successfully Feb 24 17:02:49 kaliba antivir[2979]: AntiVir successfully updated itself (antivir.vdf) >--- cut here ---- The filter statement "filter f_antivir { program("antivir"); };" catch syslog messages like these above? Best regards, Micha Holzmann -- UNIX is user friendly, it's just picky about who its friends are

1 0

RE: [syslog-ng]syslog-ng and regex
by Hamilton, Andrew 24 Feb '03

24 Feb '03

To match a program name you use the program function in the filter. filter f_antivir { program("antivir"); }; Regards, Drew -----Original Message----- From: Micha Holzmann [mailto:holzmann@mhnet.de] Sent: Monday, February 24, 2003 12:42 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng and regex Hello, i am very new at syslog-ng and at its list. I am running two Debian GNU/Linux boxes. One as a DSL Router and the other as my workstation. Today i have installed syslog-ng via apt-get (1.5.15-1.1). I tried to setup remote logging. I want my router/firewall logging additional to my workstation. On the router i have the following entries in syslog-ng.conf Hostname of router = xenia >--- cut here ---- destination loghost {udp("192.168.1.1" port(514));}; log { source(src); destination(loghost); }; >--- cut here ---- Hostname of workstation = kaliba On my workstation i have in syslog-ng.conf: >--- cut here ---- destination rlogging { file("/var/log/syslog-ng/$HOST/syslog.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; filter f_xenia { match("xenia"); }; log { source(src); filter(f_xenia); destination(rlogging); }; >--- cut here ---- I am not sure if this setup is correct. May you can give me some advices. If it is necessary to have my configs, please tell me, i will post them afterwards. Now i have a seceond question, on my workstation runs a cron job which looks for new antivir definition file or new program version (binary file). I tried to put the syslog entries in a separate file. Can i use regex in the match()? May like this: match("antivir\[[0-9]+\]") to catch antivir[19129] >--- cut here ---- destination antivir { file("/var/log/antivir.log"); }; filter f_antivir { match("kaliba antivir"); }; log { source(src); filter(f_antivir); destination(antivir); }; >--- cut here ---- But the logfile entries does not arrive in /var/log/antivir.log. Did i anything wrong? Best regards, Micha Holzmann -- My software never has bugs. It just develops random features.

2 1

Betr.: Re: [syslog-ng]syslog-ng 1.6.0rc1 available
by EDL.Essed＠belastingdienst.nl 24 Feb '03

24 Feb '03

>can you check if the latest snapshot fixes these issues? > >http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot/syslog-ng-1.6.0… Thanks, this solved the problem compiling the lex file. No other problems occured afterwards. (The file 'configure' still has to be changed though). Esteban ___________________________________________ Esteban Essed B/CICT, Sector Continuiteit MPS/Midrange WBC-F305 Tel: (055 - 528) 3586 ___________________________________________ wok, n.: Something to thwow at a wabbit. ___________________________________________ ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

1 0