- syslog-ng - lists.balabit.hu

HP-UX syslog_ng server configfile
by Ola.Fjallman＠adb.ds.sll.se 05 Feb '03

05 Feb '03

Hello, I have some problems. I run version 1.5.8 on HP-UX 11.11 The problem is with the unix-stream in syslog_ng.conf file. I have added the following configuration for test purposes : __________________________________________________ options { sync(0); time_reopen(10); log_fifo_size(100); }; source src { unix-stream("/dev/log"); udp(); tcp(ip("192.168.0.1") port(514)); tcp(); internal(); }; destination everything { udp("127.0.0.1" port(999)); tcp("127.0.0.1" port(999)); pipe("/dev/xconsole"); file("/tmp/logfile" compress(on) sync(0) log_fifo_size(10)); }; log { source(src); destination(everything); }; __________________________________________________ When trying to start syslog_ng I get this error message : "io.c: bind_unix_socket(): /dev/log not a socket Error initializing configuration, exiting." Does anyone have any idea what this means? As I have understood /dev/log is correct unix-stream on HP-UX. Regards, Ola

2 1

Re: [syslog-ng]Changing Permissions on /dev/null
by Ted_Rule＠flextech.co.uk 05 Feb '03

05 Feb '03

An utterly kludgy fix suggestion .... Instead of a /dev/null 'file' destination, have a 'program' destination which merely runs a script to call "cat >/dev/null", and leave sync() settings fairly big so that the pipe isn't flushed very often. Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

2 1

Changing Permissions on /dev/null
by Brian E. Seppanen 05 Feb '03

05 Feb '03

Hi Folks: I've just installed 1.5.26 and for some reason I get the following errors Feb 4 12:23:01 host syslog-ng[15522]: Changing permissions on special file /dev/null permissions are then listed as crw------- 1 root root 1, 3 Apr 11 2002 /dev/null cronjobs that redirect output to dev null for ordinary admin accounts are failing because they no longer have permissions to write to /dev/null When did syslog-ng start changing the permissions on /dev/null, so what release do I need to backpeddle to. Thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

3 4

RE: [syslog-ng]Changing Permissions on /dev/null
by pothier, brian 04 Feb '03

04 Feb '03

You could also create another /dev/null for syslog to use.. > ls -lL /dev/null crw------- 1 root root 1, 3 Apr 11 2002 /dev/null major^ ^minor > mknod usage: mknod name [ b/c major minor ] [ p ] > mknod /dev/null.syslog-ng c 1 3 The major/minor numbers will vary from Unix to Unix. (i.e. Solaris is 13 and 2) Brian -----Original Message----- From: Brian E. Seppanen [mailto:seppy@chartermi.net] Sent: Tuesday, February 04, 2003 2:32 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Changing Permissions on /dev/null On Tue, 4 Feb 2003, Nate Campi wrote: > On Tue, Feb 04, 2003 at 01:09:39PM -0500, Brian E. Seppanen wrote: > > Hi Folks: > > > > I've just installed 1.5.26 and for some reason I get the following errors > > Feb 4 12:23:01 host syslog-ng[15522]: Changing permissions on special > > file /dev/null > > > > permissions are then listed as > > crw------- 1 root root 1, 3 Apr 11 2002 /dev/null > > > > cronjobs that redirect output to dev null for ordinary admin accounts are > > failing because they no longer have permissions to write to /dev/null > > > > When did syslog-ng start changing the permissions on /dev/null, so what > > release do I need to backpeddle to. > > You need to modify your syslog-ng conf file to not use /dev/null as a > destination. Is there some way to have it leave the permissions of /dev/null as it previously was? I toss messages for a page queue run that is done every 10 seconds. I don't want to drown in those messages, and I don't want to waste the disk space. I also want the queue processed as fast and as often possible. Thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Please help with simple syslog-ng.conf creation qu estions....
by Hamilton, Andrew 04 Feb '03

04 Feb '03

Chris, Names don't matter much to syslog-ng. You just don't want to use any of the keywords. I'm not sure that syslog-ng even cares about that but it could confuse the reader. To add a network source, use udp, tcp or both. Like this: source src { unix-stream("/dev/log"); pipe("/proc/kmsg"); tcp(); udp(); internal(); }; by default you get the installed interface and port 514. Both of which can be specified: tcp(ip("192.168.0.2") port(555)); You might check the syntax of that in the docs, I haven't used it in a while. It may be slightly different, but that is the principal. udp is the same. Regards, Drew -----Original Message----- From: seberino(a)spawar.navy.mil To: Hamilton, Andrew Cc: syslog-ng(a)lists.balabit.hu Sent: 2/3/2003 3:23 PM Subject: Re: [syslog-ng]Please help with simple syslog-ng.conf creation qu estions.... Andrew Thanks again for all your help. I combined all your tips to make a simple "just put everything in /var/log/messages for now" version of /etc/syslog-ng/syslog-ng.conf.... ---- source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internel();}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; ---- Can I ask you a few more questions about this? I called my identifiers "src" and "dest". I assume it does not matter what I call these as long as I use those same identifiers in log line??? Since Red Hat is not set up to use syslog-ng by default, I assume I must remove syslogd and klogd from startup "things to do list" and start /usr/local/sbin/syslog-ng from /etc/rc.d/rc.local myself??? If I want syslog-ng to accept remote messages from remote syslog-ng daemons, must I add something else to syslog-ng.conf above such as item regarding port #514 UDP??? (syslog is tied to this port). I need to ask this because the word "remote" is NOT even mentioned in the syslog-ng docs???!?!? Thanks again, Chris On Mon, Feb 03, 2003 at 08:28:32AM -0500, Hamilton, Andrew wrote: > It depends on what you want to do. I think it is a good idea to run kernel > messages through syslog-ng. I have less overhead and less to worry about. > The source you have is correct. > > Regards, > > Drew > > -----Original Message----- > From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] > Sent: Friday, January 31, 2003 6:59 PM > To: Hamilton, Andrew > Cc: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Please help with simple syslog-ng.conf creation > qu estions.... > > > Andrew > > Thanks! There is lots to learn since config file much > more complicated now. > > Do you run syslog-ng daemon AND klogd too??? > > FAQ says to have syslog-ng handle kernel messages I must > kill klogd and add this to syslog-ng.conf.... > > source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internel(); }; > > I assume this is a good idea. Perhaps that is what you do??? > > Thanks again, > > Chris > > > On Thu, Jan 30, 2003 at 02:14:27PM -0500, Hamilton, Andrew wrote: > > Nope. But you can do this: > > > > source s_all{ unix-stream("/dev/log"); internal(); }; > > destination d_messages { file("/var/log/messages"); }; > > > > log { source(s_all); destination(d_messages); }; > > > > That should do it. If you are using Solaris you should use > > > > source local { sun-streams("/dev/log" door("/etc/.syslog_door")); > > internal(); }; > > > > Look in the syslog-ng/doc directory for sample configs. > > > > > > Regards, > > > > Drew > > > > -----Original Message----- > > From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] > > Sent: Thursday, January 30, 2003 2:01 PM > > To: syslog-ng(a)lists.balabit.hu > > Subject: [syslog-ng]Please help with simple syslog-ng.conf creation > > questions.... > > > > > > configure;make;make install of syslog-ng source did not create > > /etc/syslog-ng directory with > > /etc/syslog-ng.conf ready to go. > > > > I assume I must create this directory and file > > myself??? > > > > syslog-ng has *tons* of features. Please tell > > me how I can just throw everything into /var/log/messages. > > I don't require fancy stuff just yet. > > > > In old syslog.conf this would be: > > > > *.info /var/log/messages > > > > Will syslog-ng recognize a one line syslog-ng.conf > > containing this old style config??? > > > > thanks, > > > > Chris > > -- > > _______________________________________ > > > > Dr. Christian Seberino > > SPAWAR Systems Center San Diego > > Code 2363 > > 49590 Lassing Road, Room A339 > > San Diego, CA 92152-6147 > > U.S.A. > > > > Phone: (619) 553-7940 > > Fax: (619) 553-1269 > > Email: seberino(a)spawar.navy.mil > > _______________________________________ > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > -- > _______________________________________ > > Dr. Christian Seberino > SPAWAR Systems Center San Diego > Code 2872 > San Diego, CA 92152-6147 > U.S.A. > > Phone: (619) 553-9973 > Fax: > Email: seberino(a)spawar.navy.mil > _______________________________________ -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-9973 Fax: Email: seberino(a)spawar.navy.mil _______________________________________

1 0

RE: [syslog-ng]Some Boxes Refuse to Write to syslog-ng host
by Paul Thomas 04 Feb '03

04 Feb '03

At 11:00 AM 2/4/2003, you wrote: > > There is a firewall between the 2 machines but it isn't blocking this > > port. I know that because there are other machines are the > > same subnet > > that are able to get to the loghost and nothing is showing up in my > > firewall logs. > > > > Any more suggestions? > >Now check of the receiving system with tcpdump to see if they are received. Well, looks like my firewall was blocking them. There must be some difference between the way solaris and linux send the syslog messages on the client port side. Thanks for your time guys! Paul

1 0

syslog-ng web-based monitoring tool
by Matthew C Valites 04 Feb '03

04 Feb '03

I'm currently logging a bunch of machines remotely over stunnel via syslog-ng. All loggin on the loghost goes to a mysql database. Does anybody know of a web-app to parse the entries from the database in a nice format? Re-coding is not a problem. Anything that comes close to this would be beneficial, as long as it's open sourced. Thanks in advance, ~Matt

2 1

Re: [syslog-ng]Some Boxes Refuse to Write to syslog-ng host
by Paul Thomas 04 Feb '03

04 Feb '03

The loghost is resolving correctly. I get the following in tcpdump which tells me that the packets are being set to the syslog-ng loghost. root@advil:/tmp# tcpdump dst host plague.anc.net tcpdump: listening on eth0 10:44:39.856806 advil.anc.net.syslog > plague.anc.net.syslog: udp 47 (DF) 10:44:39.856851 advil.anc.net.syslog > plague.anc.net.syslog: udp 37 (DF) 10:45:03.885048 advil.anc.net.syslog > plague.anc.net.syslog: udp 47 (DF) 10:45:03.885090 advil.anc.net.syslog > plague.anc.net.syslog: udp 37 (DF) 10:45:05.334610 advil.anc.net.syslog > plague.anc.net.syslog: udp 47 (DF) 10:45:05.334650 advil.anc.net.syslog > plague.anc.net.syslog: udp 37 (DF) 10:45:06.516617 advil.anc.net.syslog > plague.anc.net.syslog: udp 47 (DF) 10:45:06.516815 advil.anc.net.syslog > plague.anc.net.syslog: udp 37 (DF) 8 packets received by filter 0 packets dropped by kernel There is a firewall between the 2 machines but it isn't blocking this port. I know that because there are other machines are the same subnet that are able to get to the loghost and nothing is showing up in my firewall logs. Any more suggestions? Paul At 11:25 PM 2/3/2003, you wrote: >Message: 7 >To: syslog-ng(a)lists.balabit.hu >Cc: Leonard_Mills(a)corpnet.sel.sony.com >Subject: Re: [syslog-ng]Some Boxes Refuse to Write to syslog-ng host ><5.2.0.9.0.20030203161839.022feaf0(a)127.0.0.1> >Date: Mon, 03 Feb 2003 22:25:54 +0000 >From: Leonard Mills <Leonard_Mills(a)corpnet.sel.sony.com> >Reply-To: syslog-ng(a)lists.balabit.hu > > >You might get a good idea by using > >dig @localhost loghost.domain.com > >If that gives you what you need, then try using >tcpdump from one of the failing hosts after a >kill -HUP on syslogd. > >Hope this helps, > >Len

2 1

syslog-ng 1.5.23 is running but not saving any log entries
by Kai Wang 04 Feb '03

04 Feb '03

In the log file, it showes: Feb 4 09:28:15 lcomm5 syslog-ng[23965]: STATS: dropped 0 Feb 4 09:38:15 lcomm5 syslog-ng[23965]: STATS: dropped 0 Feb 4 09:48:15 lcomm5 syslog-ng[23965]: STATS: dropped 0 Thanks Kai

2 1

RE: [syslog-ng]Some Boxes Refuse to Write to syslog-ng host
by Michael Breton 04 Feb '03

04 Feb '03

> -----Original Message----- > From: Paul Thomas [mailto:pwthoma@anc.net] > Sent: Tuesday, February 04, 2003 11:55 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Some Boxes Refuse to Write to syslog-ng host > > > The loghost is resolving correctly. > > I get the following in tcpdump which tells me that the > packets are being > set to the syslog-ng loghost. > > root@advil:/tmp# tcpdump dst host plague.anc.net > tcpdump: listening on eth0 > 10:44:39.856806 advil.anc.net.syslog > plague.anc.net.syslog: > udp 47 (DF) > 10:44:39.856851 advil.anc.net.syslog > plague.anc.net.syslog: > udp 37 (DF) > 10:45:03.885048 advil.anc.net.syslog > plague.anc.net.syslog: > udp 47 (DF) > 10:45:03.885090 advil.anc.net.syslog > plague.anc.net.syslog: > udp 37 (DF) > 10:45:05.334610 advil.anc.net.syslog > plague.anc.net.syslog: > udp 47 (DF) > 10:45:05.334650 advil.anc.net.syslog > plague.anc.net.syslog: > udp 37 (DF) > 10:45:06.516617 advil.anc.net.syslog > plague.anc.net.syslog: > udp 47 (DF) > 10:45:06.516815 advil.anc.net.syslog > plague.anc.net.syslog: > udp 37 (DF) > > 8 packets received by filter > 0 packets dropped by kernel Good. That means they are being sent. > There is a firewall between the 2 machines but it isn't blocking this > port. I know that because there are other machines are the > same subnet > that are able to get to the loghost and nothing is showing up in my > firewall logs. > > Any more suggestions? Now check of the receiving system with tcpdump to see if they are received. Michael Breton Commtel

1 0

Increase accepting AF_UNIX connection value
by Serge Leschinsky 04 Feb '03

04 Feb '03

Dear Sirs. I have been having a lot of messages in log file for last time: > Feb 4 13:07:37 lapa syslog-ng[231]: Error accepting AF_UNIX connection, opened connections: 100, max: 100 > Feb 4 13:07:38 lapa syslog-ng[231]: Error accepting AF_UNIX connection, opened connections: 100, max: 100 > Feb 4 13:08:05 lapa syslog-ng[231]: Error accepting AF_UNIX connection, opened connections: 100, max: 100 > Feb 4 13:08:05 lapa syslog-ng[231]: Error accepting AF_UNIX connection, opened connections: 100, max: 100 > Feb 4 13:08:05 lapa syslog-ng[231]: Error accepting AF_UNIX connection, opened connections: 100, max: 100 If I understand correctly, processes try to open too many sockets. So, I want to ask the community about typical value of this parameter, the reason of lack of socket and where I can increase this value (100) for resolving this problem. Thank you in advance. -- Yours sincerely Serge Leschinsky mailto:fish@artlife.tomsknet.ru Tuesday, February 4, 2003

2 2

Some Boxes Refuse to Write to syslog-ng host
by Paul Thomas 03 Feb '03

03 Feb '03

I've got about 15 solaris 8 boxes and 5 slackware linux boxes. For some reason 4 of the solaris and 2 of the linux boxes will not write to the syslog-ng loghost. All the remotes are exactly the same setup and port 514/udp isn't blocked between any of the remotes and the loghost. Here is the syslog.conf for the host machines *.err;kern.notice;auth.notice @loghost.domain.com *.err;kern.debug;daemon.notice;mail.crit @loghost.domain.com *.alert;kern.err;daemon.err operator *.alert root *.emerg *, @loghost.domain.com If anyone has any idea why these logs are being transferred to the loghost I'm open for ideas. I'm running syslog-ng 1.5.26 Thanks Paul

2 1

Re: [syslog-ng]Please help with simple syslog-ng.conf creation qu estions....
by seberino＠spawar.navy.mil 03 Feb '03

03 Feb '03

Andrew Thanks again for all your help. I combined all your tips to make a simple "just put everything in /var/log/messages for now" version of /etc/syslog-ng/syslog-ng.conf.... ---- source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internel();}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; ---- Can I ask you a few more questions about this? I called my identifiers "src" and "dest". I assume it does not matter what I call these as long as I use those same identifiers in log line??? Since Red Hat is not set up to use syslog-ng by default, I assume I must remove syslogd and klogd from startup "things to do list" and start /usr/local/sbin/syslog-ng from /etc/rc.d/rc.local myself??? If I want syslog-ng to accept remote messages from remote syslog-ng daemons, must I add something else to syslog-ng.conf above such as item regarding port #514 UDP??? (syslog is tied to this port). I need to ask this because the word "remote" is NOT even mentioned in the syslog-ng docs???!?!? Thanks again, Chris On Mon, Feb 03, 2003 at 08:28:32AM -0500, Hamilton, Andrew wrote: > It depends on what you want to do. I think it is a good idea to run kernel > messages through syslog-ng. I have less overhead and less to worry about. > The source you have is correct. > > Regards, > > Drew > > -----Original Message----- > From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] > Sent: Friday, January 31, 2003 6:59 PM > To: Hamilton, Andrew > Cc: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Please help with simple syslog-ng.conf creation > qu estions.... > > > Andrew > > Thanks! There is lots to learn since config file much > more complicated now. > > Do you run syslog-ng daemon AND klogd too??? > > FAQ says to have syslog-ng handle kernel messages I must > kill klogd and add this to syslog-ng.conf.... > > source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internel(); }; > > I assume this is a good idea. Perhaps that is what you do??? > > Thanks again, > > Chris > > > On Thu, Jan 30, 2003 at 02:14:27PM -0500, Hamilton, Andrew wrote: > > Nope. But you can do this: > > > > source s_all{ unix-stream("/dev/log"); internal(); }; > > destination d_messages { file("/var/log/messages"); }; > > > > log { source(s_all); destination(d_messages); }; > > > > That should do it. If you are using Solaris you should use > > > > source local { sun-streams("/dev/log" door("/etc/.syslog_door")); > > internal(); }; > > > > Look in the syslog-ng/doc directory for sample configs. > > > > > > Regards, > > > > Drew > > > > -----Original Message----- > > From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] > > Sent: Thursday, January 30, 2003 2:01 PM > > To: syslog-ng(a)lists.balabit.hu > > Subject: [syslog-ng]Please help with simple syslog-ng.conf creation > > questions.... > > > > > > configure;make;make install of syslog-ng source did not create > > /etc/syslog-ng directory with > > /etc/syslog-ng.conf ready to go. > > > > I assume I must create this directory and file > > myself??? > > > > syslog-ng has *tons* of features. Please tell > > me how I can just throw everything into /var/log/messages. > > I don't require fancy stuff just yet. > > > > In old syslog.conf this would be: > > > > *.info /var/log/messages > > > > Will syslog-ng recognize a one line syslog-ng.conf > > containing this old style config??? > > > > thanks, > > > > Chris > > -- > > _______________________________________ > > > > Dr. Christian Seberino > > SPAWAR Systems Center San Diego > > Code 2363 > > 49590 Lassing Road, Room A339 > > San Diego, CA 92152-6147 > > U.S.A. > > > > Phone: (619) 553-7940 > > Fax: (619) 553-1269 > > Email: seberino(a)spawar.navy.mil > > _______________________________________ > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > -- > _______________________________________ > > Dr. Christian Seberino > SPAWAR Systems Center San Diego > Code 2872 > San Diego, CA 92152-6147 > U.S.A. > > Phone: (619) 553-9973 > Fax: > Email: seberino(a)spawar.navy.mil > _______________________________________ -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-9973 Fax: Email: seberino(a)spawar.navy.mil _______________________________________

1 0

Filtering Large Syslog Messages
by Brian E. Seppanen 03 Feb '03

03 Feb '03

Hi Folks: I have snmptrapd running so that any trap that it receives should be logged to local1. I have a filter taking anything received via local1 to a specific file filter snmptrap {facility(local1);}; destination snmptraps { file("/var/log/snmptraps";}; Unfortunately a number of traps are getting cut off at a specific point, and the remainder of the trap ends up in syslog and not in the proper destination. I'm running syslog-ng 1.4.17, libol 0.2.24, redhat linux 7.2 Jan 29 12:34:43 hostname ts.cerent454Mib.cerent454Objects.cerent454AlarmGroup.cerent454AlarmTable.cer ent454AlarmEntry.cerent454AlarmSlotNumber.1.normalCondition = 0, enterprises.cerent.cerentProducts.c erent454Mib.cerent454Objects.cerent454AlarmGroup.cerent454AlarmTable.cerent454AlarmEntry.cerent454Al armPortNumber.1.normalCondition = 0, enterprises.cerent.cerentProducts.cerent454Mib.cerent454Objects .cerent454AlarmGroup.cerent454AlarmTable.cerent454AlarmEntry.cerent454AlarmLineNumber.1.normalCondit ion = 0 Here's the beginning of the trap that found its way to the proper file Jan 29 12:34:43 hostname snmptrapd[11851]: 192.168.0.1 [192.168.0.1]: Trap system.sysUpTime.0 = Timeticks: (2968512686) 343 days, 13:52:06.86, .iso.org.dod.internet.snmpV2.snmpModules.snmpMIB.snmpMIBObjects.snmpTrap.snmpTrapOID.0 = OID: enterprises.cerent.cerentProducts.cerent454Mib.cerent454Events.cerent454V2Events.normalCondition, enterprises.cerent.cerentProducts.cerent454Mib.cerentCommonObjects.cerentCommonObjectsGroup.cerentNodeTime.0 = 20030129123442D, enterprises.cerent.cerentProducts.cerent454Mib.cerent454Objects.cerent454AlarmGroup.cerent454AlarmTable.cerent454AlarmEntry.cerent454AlarmState.1.normalCondition = administrative(20), enterprises.cerent.cerentProducts.cerent454Mib.cerent454Objects.cerent454AlarmGroup.cerent454AlarmTable.cerent454AlarmEntry.cerent454AlarmObjectType.1.normalCondition = ne(10), enterprises.cerent.cerentProducts.cerent454Mib.cerent454Objects.cerent454AlarmGroup.cerent454AlarmTable.cerent454AlarmEntry.cerent454AlarmObjectIndex.1.normalCondition = 0, enterprises.cerent.cerentProduc All of the message would be coming in via local1 so it's not that a pattern match is failing.. Any ideas? Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

4 3

destination 'program'
by Dmitry Frolov 03 Feb '03

03 Feb '03

Hello, It seems that syslog-ng starts external program to pipe logs through only at startup. The documentation says so too and there's nothing about restart. Syslog-ng only writes error message to internal log if program is terminated. Feb 3 15:48:17 loghost syslog-ng[971]: io.c: do_write: write() failed (errno 32), Broken pipe Feb 3 15:48:17 loghost syslog-ng[971]: pkt_buffer::do_flush(): Error flushing data But, in some cases it's desirable to watch for this external filter program and restart it when nesessary. Program may die suddenly or may need full restart for reconfiguration. I know that syslog-ng restarts external filter on SIGHUP, and sure i could write watcher script for automatic SIGHUPing of syslog-ng, but automatic filter program restart, perhaps with some frequency limitations would be quite useful. Is there any considerations against that? -- Dmitry Frolov, Zenon N.S.P. (095) 250-4629, http://www.zenon.net/

2 2

Re: [syslog-ng]logs getting stomped on
by Brian Landers 02 Feb '03

02 Feb '03

Sorry to keep harping on this guys, but this is a ^%$#@ mystery! Once again, my mail log restarted at around 10:30pm tonight. Lest you think I'm just whining and not making an effort to solve this one, here's what I've come up with: 1) I've checked all of my crontabs and at jobs, and there's nothing that runs around that time. 2) Went through all the long-running processes. Nothing that would interact with syslog-ng or the log files directly. No processes started or restarted around that time in ps. No weird logins around that time that would seem to indicate operator error. 3) My /var/adm/messages file did NOT restart, just the mail logs coming in from the remote SSH tunnels. 4) I changed my syslog-ng.conf to not use macros for the filename, but rather to log to a static filename "current.log". Didn't help. 5) I added a second destination, breaking out the logs by hour: destination inboundlog { file("/system/inbound_mail/logs/current.log"); file("/system/inbound_mail/logs/$YEAR/$MONTH/$DAY/$HOUR.log"); }; current.log had the entire day's logs, and was truncated and restarted at 22:33:04, however the hourly log 2003/01/29/22.log was NOT, it kept right on ticking. 6) total size of messages logged up to 22:33:04 was approximately 29mb, so largefile issues should not be a factor. I'm at a loss here, folks. I'm ready to consult an exorcist. I seem to have a workaround in that my logs split out by hour don't appear to be getting truncated, but I'd love to track this one down. Any suggestions for things I've haven't considered or should I start shopping for goats and black candles? Thanks, Brian P.S. sorry for the threading issues, was reading through the web archives but I've now joined the list since I'm busily replacing Solaris syslog everywhere with syslog-ng! -- "We've heard that a million monkeys at a million keyboards coud produce the complete works of Shakespeare; now, thanks to the Internet, we know that is not true."

2 2

messages with newlines
by Dmitry Frolov 01 Feb '03

01 Feb '03

Hello! I encountered some problems with syslog-ng 1.5.25, while trying to separate logs by program name. Our developers often use multiline log messages, stack traces for example. The problem is that when multiline message received via network (udp) it is logged as several lines, and only first line has program name in it. So, when i configure 'program' filter, it only catches first line. Example: We are logging this message and it is sent to loghost (in one udp packet, tested with snoop). <30>Jan 31 13:51:30 Yadda yadda[17245]: Time to die. die now! Loghost writes it in this way: Jan 31 13:42:29 host yadda[17231]: Time to die. Jan 31 13:42:29 host die now! The second line "die now!" will not match 'program' filter. I suppose it would be correct to replace all '\n', '\r', etc in log messages and log them as single line as common syslogd does in any case and as syslog-ng does when source is unix domain socket. Another problem is that first word of program name disappears. if program name is missing, the first word of log msg disappears instead. Here's script to send log message used in my example. #!/usr/bin/perl -w use strict; use Sys::Syslog; # all except setlogsock, or: use Sys::Syslog qw(:DEFAULT setlogsock); # default set, plus setlogsock my $ident = 'Yadda yadda'; my $logopt = 'pid,ndelay'; my $facility = 'daemon'; my $priority = 'info'; my $format = "Time to die.\ndie now!"; my @args; setlogsock 'unix'; openlog $ident, $logopt, $facility; syslog $priority, $format, @args; closelog; -- Dmitry Frolov, Zenon N.S.P. (095) 250-4629, http://www.zenon.net/

3 4

Writers wanted, readers needed
by Zachie 01 Feb '03

01 Feb '03

Poetrylist is a literary journal based in Maryland whose goal is to give writers of poetry, both beginners and professionals, exposure. Through our efforts we hope to bring more diversity to the online literary world. Poetrylist at this time reaches 400 subscribers from over 24 different nations. The newsletter is sent out on the fifteenth of every month. To subscribe, email poetrylist_editor(a)yahoo.com for more information. Poetrylist is currently looking for staff members, both editorial and technical, email us your résumé for consideration. Email Zach back for more info. Please mention ID# 121 To be remove please type remove me in the subject line.

1 0

RE: [syslog-ng]Please help with simple syslog-ng.conf creation qu estions....
by Hamilton, Andrew 31 Jan '03

31 Jan '03

Nope. But you can do this: source s_all{ unix-stream("/dev/log"); internal(); }; destination d_messages { file("/var/log/messages"); }; log { source(s_all); destination(d_messages); }; That should do it. If you are using Solaris you should use source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; Look in the syslog-ng/doc directory for sample configs. Regards, Drew -----Original Message----- From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] Sent: Thursday, January 30, 2003 2:01 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Please help with simple syslog-ng.conf creation questions.... configure;make;make install of syslog-ng source did not create /etc/syslog-ng directory with /etc/syslog-ng.conf ready to go. I assume I must create this directory and file myself??? syslog-ng has *tons* of features. Please tell me how I can just throw everything into /var/log/messages. I don't require fancy stuff just yet. In old syslog.conf this would be: *.info /var/log/messages Will syslog-ng recognize a one line syslog-ng.conf containing this old style config??? thanks, Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2363 49590 Lassing Road, Room A339 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-7940 Fax: (619) 553-1269 Email: seberino(a)spawar.navy.mil _______________________________________ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Please help with simple syslog-ng.conf creation questions....
by seberino＠spawar.navy.mil 30 Jan '03

30 Jan '03

configure;make;make install of syslog-ng source did not create /etc/syslog-ng directory with /etc/syslog-ng.conf ready to go. I assume I must create this directory and file myself??? syslog-ng has *tons* of features. Please tell me how I can just throw everything into /var/log/messages. I don't require fancy stuff just yet. In old syslog.conf this would be: *.info /var/log/messages Will syslog-ng recognize a one line syslog-ng.conf containing this old style config??? thanks, Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2363 49590 Lassing Road, Room A339 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-7940 Fax: (619) 553-1269 Email: seberino(a)spawar.navy.mil _______________________________________

1 0

template() and template_escape() extension for all destination drivers
by Achim Gsell 30 Jan '03

30 Jan '03

Hi, On Wed, Oct 30, 2002 at 20:47:55+0100, Balazs Scheidler wrote: > I came to having some time to integrate pending patches, and found your > patch. I have a couple of comments, which needs to be fixed before releasing > a syslog-ng with these parts integrated. > > * expand_macro & friends should be declared in a header file instead of > declaring it in every referencing module. maybe a new file called > macros.c would be a good way of resolving this problem. > * expand_macros returns a newly allocated string, which must be freed, so > constructs like this cause memory leaks: > + if (self->template_output) > + A_WRITE_STRING(&self->dest_buf->super, > + c_format("<%i>%S\n", > + msg->pri, > expand_macros(self->cfg, self->template_output, self->template_escape, msg))); > > c_format() has an option to free an ol_string by specifying 'f' like this: > > c_format("%fS", expand_macros()) ... > Otherwise your patch looks ok to me. If you want to have it integrated prior > to 1.6.0 is being released, please send a modified diff. In the attachment you find a revised version of the patch. The functions "expand_macros()" & friend are now declared in "macros.h" and coded in "macros.c". The memory leaks are fixed ... Achim

1 0

Differences between 1.5.x and 1.4.x
by Brian E. Seppanen 30 Jan '03

30 Jan '03

How stable is the 1.5.x series of syslog-ng release, and is the only difference that 1.5.x is a development tree? Are their significant configuration file differences? Where would I find information on variations and additional features within 1.5.x series? Thanks for all the help Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

2 1

RE: [syslog-ng]Question about syslog-ng conf file syntax...
by Michael Breton 29 Jan '03

29 Jan '03

> -----Original Message----- > From: Ryan Dooley [mailto:dooleyr@missouri.edu] > Sent: Wednesday, January 29, 2003 4:53 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Question about syslog-ng conf file syntax... > > > Hello All, > > I have a question about syslog-ng conf file... I have a destination > filter that looks like this: > > destination d_somefile { > file("/path/to/file"); > }; > > That "syslog-ng -s" says there is a syntax error... Any ideas? I have a hunch that the third line with the }; need to start with whitespace to be considered on the same line. Michael Breton Commtel

2 2

Question about syslog-ng conf file syntax...
by Ryan Dooley 29 Jan '03

29 Jan '03

Hello All, I have a question about syslog-ng conf file... I have a destination filter that looks like this: destination d_somefile { file("/path/to/file"); }; That "syslog-ng -s" says there is a syntax error... Any ideas? Cheers, Ryan

2 1

RE: [syslog-ng]UDP syslog not being logged by syslog-ng
by Hamilton, Andrew 29 Jan '03

29 Jan '03

Glad you figured it out. Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 1:11 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Drew, Thanks for you help. It was me being stupid! It's the Red Hat firewall stopping it working! Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 5:14 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Joel, I'm not sure this will really make a difference and it may just be a typo in the message, but in the filters you have authprov which should be authpriv, I believe. You could also try logging just source, destination and not use any filters to see what you are getting. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 12:02 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng They are in the local log files either. I tried changing the parameter to yes and still no success. Thanks for the ideas so far... Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 2:23 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Did you check the log file for the log server host? You have keep_hostname(no) so I think that the machine will log as from the local log server. Check to see if they are in the local host log file. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 9:08 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]UDP syslog not being logged by syslog-ng Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0